Merge staging-next into staging

2023-11-01 18:01:31 +00:00 · 2023-11-01 18:01:31 +00:00 · 2999b3c997
commit 2999b3c997
parent 9387dfcba3 cd7af6170b
96 changed files with 5686 additions and 4248 deletions
--- a/doc/languages-frameworks/texlive.section.md
+++ b/doc/languages-frameworks/texlive.section.md
@ -38,6 +38,24 @@ Since release 15.09 there is a new TeX Live packaging that lives entirely under

 - Note that the wrapper assumes that the result has a chance to be useful. For example, the core executables should be present, as well as some core data files. The supported way of ensuring this is by including some scheme, for example `scheme-basic`, into the combination.

+- TeX Live packages are also available under `texlive.pkgs` as derivations with outputs `out`, `tex`, `texdoc`, `texsource`, `tlpkg`, `man`, `info`. They cannot be installed outside of `texlive.combine` but are available for other uses. To repackage a font, for instance, use
+
+  ```nix
+  stdenvNoCC.mkDerivation rec {
+    src = texlive.pkgs.iwona;
+
+    inherit (src) pname version;
+
+    installPhase = ''
+      runHook preInstall
+      install -Dm644 fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
+      runHook postInstall
+    '';
+  }
+  ```
+
+  See `biber`, `iwona` for complete examples.
+
 ## Custom packages {#sec-language-texlive-custom-packages}

 You may find that you need to use an external TeX package. A derivation for such package has to provide the contents of the "texmf" directory in its output and provide the appropriate `tlType` attribute (one of `"run"`, `"bin"`, `"doc"`, `"source"`). Dependencies on other TeX packages can be listed in the attribute `tlDeps`.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3055,6 +3055,9 @@
    email = "chayleaf-nix@pavluk.org";
    github = "chayleaf";
    githubId = 9590981;
+    keys = [{
+      fingerprint = "4314 3701 154D 9E5F 7051  7ECF 7817 1AD4 6227 E68E";
+    }];
    matrix = "@chayleaf:matrix.pavluk.org";
    name = "Anna Pavlyuk";
  };
@ -12123,6 +12126,14 @@
    github = "MrTarantoga";
    githubId = 53876219;
  };
+  mrtnvgr = {
+    name = "Egor Martynov";
+    github = "mrtnvgr";
+    githubId = 48406064;
+    keys = [{
+      fingerprint = "6FAD DB43 D5A5 FE52 6835  0943 5B33 79E9 81EF 48B1";
+    }];
+  };
  mrVanDalo = {
    email = "contact@ingolf-wagner.de";
    github = "mrVanDalo";
--- a/nixos/modules/config/nix-channel.nix
+++ b/nixos/modules/config/nix-channel.nix
@ -98,8 +98,7 @@ in
    nix.settings.nix-path = mkIf (! cfg.channel.enable) (mkDefault "");

    systemd.tmpfiles.rules = lib.mkIf cfg.channel.enable [
-      "f /root/.nix-channels -"
-      ''w+ "/root/.nix-channels" - - - - ${config.system.defaultChannel} nixos\n''
+      ''f /root/.nix-channels - - - - ${config.system.defaultChannel} nixos\n''
    ];
  };
 }
--- a/nixos/tests/activation/nix-channel.nix
+++ b/nixos/tests/activation/nix-channel.nix
@ -11,7 +11,16 @@
  };

  testScript = { nodes, ... }: ''
+    machine.start(allow_reboot=True)
+
    assert machine.succeed("cat /root/.nix-channels") == "${nodes.machine.system.defaultChannel} nixos\n"
+
+    nixpkgs_unstable_channel = "https://nixos.org/channels/nixpkgs-unstable nixpkgs"
+    machine.succeed(f"echo '{nixpkgs_unstable_channel}' > /root/.nix-channels")
+
+    machine.reboot()
+
+    assert machine.succeed("cat /root/.nix-channels") == f"{nixpkgs_unstable_channel}\n"
  '';

 }
--- a/nixos/tests/cinnamon.nix
+++ b/nixos/tests/cinnamon.nix
@ -14,27 +14,13 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
  testScript = { nodes, ... }:
    let
      user = nodes.machine.users.users.alice;
-      uid = toString user.uid;
-      bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus";
-      display = "DISPLAY=:0.0";
-      env = "${bus} ${display}";
-      gdbus = "${env} gdbus";
+      env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus DISPLAY=:0";
      su = command: "su - ${user.name} -c '${env} ${command}'";

      # Call javascript in cinnamon (the shell), returns a tuple (success, output),
      # where `success` is true if the dbus call was successful and `output` is what
      # the javascript evaluates to.
-      eval = "call --session -d org.Cinnamon -o /org/Cinnamon -m org.Cinnamon.Eval";
-
-      # Should be 2 (RunState.RUNNING) when startup is done.
-      # https://github.com/linuxmint/cinnamon/blob/5.4.0/js/ui/main.js#L183-L187
-      getRunState = su "${gdbus} ${eval} Main.runState";
-
-      # Start gnome-terminal.
-      gnomeTerminalCommand = su "gnome-terminal";
-
-      # Hopefully gnome-terminal's wm class.
-      wmClass = su "${gdbus} ${eval} global.display.focus_window.wm_class";
+      eval = name: su "gdbus call --session -d org.Cinnamon -o /org/Cinnamon -m org.Cinnamon.Eval ${name}";
    in
    ''
      machine.wait_for_unit("display-manager.service")
@ -54,13 +40,43 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {

      with subtest("Wait for the Cinnamon shell"):
          # Correct output should be (true, '2')
-          machine.wait_until_succeeds("${getRunState} | grep -q 'true,..2'")
+          # https://github.com/linuxmint/cinnamon/blob/5.4.0/js/ui/main.js#L183-L187
+          machine.wait_until_succeeds("${eval "Main.runState"} | grep -q 'true,..2'")
+
+      with subtest("Check if Cinnamon components actually start"):
+          for i in ["csd-media-keys", "cinnamon-killer-daemon", "xapp-sn-watcher", "nemo-desktop"]:
+            machine.wait_until_succeeds(f"pgrep -f {i}")
+          machine.wait_until_succeeds("journalctl -b --grep 'Loaded applet menu@cinnamon.org'")
+          machine.wait_until_succeeds("journalctl -b --grep 'calendar@cinnamon.org: Calendar events supported'")
+
+      with subtest("Open Cinnamon Settings"):
+          machine.succeed("${su "cinnamon-settings themes >&2 &"}")
+          machine.wait_until_succeeds("${eval "global.display.focus_window.wm_class"} | grep -i 'cinnamon-settings'")
+          machine.wait_for_text('(Style|Appearance|Color)')
+          machine.sleep(2)
+          machine.screenshot("cinnamon_settings")
+
+      with subtest("Lock the screen"):
+          machine.succeed("${su "cinnamon-screensaver-command -l >&2 &"}")
+          machine.wait_until_succeeds("${su "cinnamon-screensaver-command -q"} | grep 'The screensaver is active'")
+          machine.sleep(2)
+          machine.screenshot("cinnamon_screensaver")
+          machine.send_chars("${user.password}\n", delay=0.2)
+          machine.wait_until_succeeds("${su "cinnamon-screensaver-command -q"} | grep 'The screensaver is inactive'")
+          machine.sleep(2)

      with subtest("Open GNOME Terminal"):
-          machine.succeed("${gnomeTerminalCommand}")
-          # Correct output should be (true, '"Gnome-terminal"')
-          machine.wait_until_succeeds("${wmClass} | grep -q 'true,...Gnome-terminal'")
-          machine.sleep(20)
-          machine.screenshot("screen")
+          machine.succeed("${su "gnome-terminal"}")
+          machine.wait_until_succeeds("${eval "global.display.focus_window.wm_class"} | grep -i 'gnome-terminal'")
+          machine.sleep(2)
+
+      with subtest("Open virtual keyboard"):
+          machine.succeed("${su "dbus-send --print-reply --dest=org.Cinnamon /org/Cinnamon org.Cinnamon.ToggleKeyboard"}")
+          machine.wait_for_text('(Ctrl|Alt)')
+          machine.sleep(2)
+          machine.screenshot("cinnamon_virtual_keyboard")
+
+      with subtest("Check if Cinnamon has ever coredumped"):
+          machine.fail("coredumpctl --json=short | grep -E 'cinnamon|nemo'")
    '';
 })
--- a/pkgs/applications/audio/cardinal/default.nix
+++ b/pkgs/applications/audio/cardinal/default.nix
@ -27,11 +27,11 @@

 stdenv.mkDerivation rec {
  pname = "cardinal";
-  version = "23.09";
+  version = "23.10";

  src = fetchurl {
    url = "https://github.com/DISTRHO/Cardinal/releases/download/${version}/cardinal+deps-${version}.tar.xz";
-    hash = "sha256-q42ry47y4tTkUbejv6iN5jXcadXSSTPQ3omhMUevfqU=";
+    hash = "sha256-6Wt2sC7vdrz2Fkl08bNLfnGu+pAV7b5lZUmsx1wtJRE=";
  };

  prePatch = ''
--- a/pkgs/applications/audio/qpwgraph/default.nix
+++ b/pkgs/applications/audio/qpwgraph/default.nix
@ -1,9 +1,17 @@
-{ lib, mkDerivation, fetchFromGitLab
-, cmake, pkg-config
-, alsa-lib, pipewire
+{ lib
+, stdenv
+, fetchFromGitLab
+, cmake
+, pkg-config
+, wrapQtAppsHook
+, qtbase
+, qtsvg
+, qtwayland
+, alsa-lib
+, pipewire
 }:

-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "qpwgraph";
  version = "0.5.3";

@ -11,13 +19,13 @@ mkDerivation rec {
    domain = "gitlab.freedesktop.org";
    owner = "rncbc";
    repo = "qpwgraph";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    sha256 = "sha256-50KaVpNB5/CTLs2bRbXEinYM23AZxZO/ForrVPFDN8U=";
  };

-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];

-  buildInputs = [ alsa-lib pipewire ];
+  buildInputs = [ qtbase qtsvg qtwayland alsa-lib pipewire ];

  cmakeFlags = [ "-DCONFIG_WAYLAND=ON" ];

@ -32,5 +40,6 @@ mkDerivation rec {
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
    maintainers = with maintainers; [ kanashimia exi Scrumplex ];
+    mainProgram = "qpwgraph";
  };
-}
+})
--- a/pkgs/applications/audio/tetraproc/default.nix
+++ b/pkgs/applications/audio/tetraproc/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "tetraproc";
-  version = "0.8.6";
+  version = "0.9.2";

  src = fetchurl {
    url = "https://kokkinizita.linuxaudio.org/linuxaudio/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "02155ljfwgvfgq9z258fb4z7jrz7qx022d054fj5gr0v007cv0r7";
+    sha256 = "sha256-kRak33RuYusG6U5FOf9b9vOJUjNK3zqoLL0V/bWBJqs=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1229,8 +1229,8 @@ let
        mktplcRef = {
          name = "elixir-ls";
          publisher = "JakeBecker";
-          version = "0.17.1";
-          sha256 = "sha256-WBtIdz+8zsyTl43ovU3Dz+8p154ZGvHp6BA3AQtXN/U=";
+          version = "0.17.5";
+          sha256 = "sha256-2iOyLNLMQ6Snm0gvv7Yl6von/A9UTfLYrH5l1PoJwUc=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/JakeBecker.elixir-ls/changelog";
--- a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/build-deps/package.json
+++ b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/build-deps/package.json
@ -1,23 +1,24 @@
 {
  "name": "rust-analyzer",
-  "version": "0.3.1607",
+  "version": "0.3.1697",
  "dependencies": {
+    "@hpcc-js/wasm": "^2.13.0",
    "anser": "^2.1.1",
-    "d3": "^7.6.1",
+    "d3": "^7.8.5",
    "d3-graphviz": "^5.0.2",
-    "vscode-languageclient": "^8.0.2",
+    "vscode-languageclient": "^8.1.0",
+    "@tsconfig/strictest": "^2.0.1",
    "@types/node": "~16.11.7",
-    "@types/vscode": "~1.66.0",
-    "@typescript-eslint/eslint-plugin": "^5.30.5",
-    "@typescript-eslint/parser": "^5.30.5",
-    "@vscode/test-electron": "^2.1.5",
-    "cross-env": "^7.0.3",
-    "eslint": "^8.19.0",
-    "eslint-config-prettier": "^8.5.0",
-    "ovsx": "^0.5.2",
-    "prettier": "^2.7.1",
-    "tslib": "^2.4.0",
-    "typescript": "^4.7.4",
-    "vsce": "^2.9.2"
+    "@types/vscode": "~1.75",
+    "@typescript-eslint/eslint-plugin": "^6.0.0",
+    "@typescript-eslint/parser": "^6.0.0",
+    "@vscode/test-electron": "^2.3.3",
+    "@vscode/vsce": "^2.19.0",
+    "eslint": "^8.44.0",
+    "eslint-config-prettier": "^8.8.0",
+    "ovsx": "^0.8.2",
+    "prettier": "^3.0.0",
+    "tslib": "^2.6.0",
+    "typescript": "^5.1.6"
  }
 }
--- a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
@ -20,7 +20,7 @@ let
  # Use the plugin version as in vscode marketplace, updated by update script.
  inherit (vsix) version;

-  releaseTag = "2023-07-31";
+  releaseTag = "2023-10-16";

  src = fetchFromGitHub {
    owner = "rust-lang";
--- a/pkgs/applications/emulators/box64/default.nix
+++ b/pkgs/applications/emulators/box64/default.nix
@ -1,29 +1,39 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , gitUpdater
 , cmake
 , python3
-, withDynarec ? stdenv.hostPlatform.isAarch64
+, withDynarec ? (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isRiscV64)
 , runCommand
 , hello-x86_64
-, box64
 }:

-# Currently only supported on ARM
-assert withDynarec -> stdenv.hostPlatform.isAarch64;
+# Currently only supported on ARM & RISC-V
+assert withDynarec -> (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isRiscV64);

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "box64";
  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "ptitSeb";
-    repo = pname;
-    rev = "v${version}";
+    repo = "box64";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-iCZv/WvqZkH6i23fSLA/p0nG5/CgzjyU5glVgje4c3w=";
  };

+  patches = [
+    # Fix crash due to regression in SDL1 AudioCallback signature in 0.2.4
+    # Remove when version > 0.2.4
+    (fetchpatch {
+      name = "0001-box64-Fixed_signature_of_SDL1_AudioCallback.patch";
+      url = "https://github.com/ptitSeb/box64/commit/5fabd602aea1937e3c5ce58843504c2492b8c0ec.patch";
+      hash = "sha256-dBdKijTljCFtSJ2smHrbjH/ok0puGw4YEy/kluLl4AQ=";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    python3
@ -31,12 +41,20 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DNOGIT=ON"
-    "-DARM_DYNAREC=${if withDynarec then "ON" else "OFF"}"
-    "-DRV64=${if stdenv.hostPlatform.isRiscV64 then "ON" else "OFF"}"
-    "-DPPC64LE=${if stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian then "ON" else "OFF"}"
+
+    # Arch mega-option
+    "-DARM64=${lib.boolToString stdenv.hostPlatform.isAarch64}"
+    "-DRV64=${lib.boolToString stdenv.hostPlatform.isRiscV64}"
+    "-DPPC64LE=${lib.boolToString (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian)}"
+    "-DLARCH64=${lib.boolToString stdenv.hostPlatform.isLoongArch64}"
  ] ++ lib.optionals stdenv.hostPlatform.isx86_64 [
+    # x86_64 has no arch-specific mega-option, manually enable the options that apply to it
    "-DLD80BITS=ON"
    "-DNOALIGN=ON"
+  ] ++ [
+    # Arch dynarec
+    "-DARM_DYNAREC=${lib.boolToString (withDynarec && stdenv.hostPlatform.isAarch64)}"
+    "-DRV64_DYNAREC=${lib.boolToString (withDynarec && stdenv.hostPlatform.isRiscV64)}"
  ];

  installPhase = ''
@ -47,9 +65,9 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

-  doCheck = true;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

-  doInstallCheck = true;
+  doInstallCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

  installCheckPhase = ''
    runHook preInstallCheck
@ -68,7 +86,7 @@ stdenv.mkDerivation rec {
      rev-prefix = "v";
    };
    tests.hello = runCommand "box64-test-hello" {
-      nativeBuildInputs = [ box64 hello-x86_64 ];
+      nativeBuildInputs = [ finalAttrs.finalPackage ];
    } ''
      # There is no actual "Hello, world!" with any of the logging enabled, and with all logging disabled it's hard to
      # tell what problems the emulator has run into.
@ -81,6 +99,7 @@ stdenv.mkDerivation rec {
    description = "Lets you run x86_64 Linux programs on non-x86_64 Linux systems";
    license = licenses.mit;
    maintainers = with maintainers; [ gador OPNA2608 ];
-    platforms = [ "x86_64-linux" "aarch64-linux" "riscv64-linux" "powerpc64le-linux" ];
+    mainProgram = "box64";
+    platforms = [ "x86_64-linux" "aarch64-linux" "riscv64-linux" "powerpc64le-linux" "loongarch64-linux" "mips64el-linux" ];
  };
-}
+})
--- a/pkgs/applications/misc/hyprnome/default.nix
+++ b/pkgs/applications/misc/hyprnome/default.nix
@ -2,38 +2,41 @@
 , rustPlatform
 , fetchFromGitHub
 , installShellFiles
+, nix-update-script
 }:

 rustPlatform.buildRustPackage rec {
  pname = "hyprnome";
-  version = "0.1.0";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "donovanglover";
    repo = "hyprnome";
    rev = version;
-    hash = "sha256-jb21hnPSzrCTuW7Yhs6jFzS2WUVQjkn6nCCi6LvoTGA=";
+    hash = "sha256-zlXiT2EOIdgIDI4NQuU3C903SSq5bylBAFJXyv7mdJ4=";
  };

-  cargoHash = "sha256-QM5v2hKP3E9W3Aek6kFyFFNAp9s0oTFb4CEtxEHyny0=";
+  cargoHash = "sha256-DpbRs97sr5wpJSrYF99ZiQ0SZOZdoQjfaLhKIAU95HA=";

  nativeBuildInputs = [
    installShellFiles
  ];

  postInstall = ''
-    installManPage man/hyprnome.1
+    installManPage target/man/hyprnome.1

    installShellCompletion --cmd hyprnome \
-      --bash <(cat completions/hyprnome.bash) \
-      --fish <(cat completions/hyprnome.fish) \
-      --zsh <(cat completions/_hyprnome)
+      --bash <(cat target/completions/hyprnome.bash) \
+      --fish <(cat target/completions/hyprnome.fish) \
+      --zsh <(cat target/completions/_hyprnome)
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    description = "GNOME-like workspace switching in Hyprland";
    homepage = "https://github.com/donovanglover/hyprnome";
-    license = licenses.mit;
+    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    maintainers = with maintainers; [ donovanglover ];
    mainProgram = "hyprnome";
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@ -4,7 +4,7 @@
 , appimageTools
 , makeWrapper
 # graphs will not sync without matching upstream's major electron version
-, electron_24
+, electron_25
 , git
 , nix-update-script
 }:
@ -14,11 +14,11 @@ stdenv.mkDerivation (finalAttrs: let

 in {
  pname = "logseq";
-  version = "0.9.19";
+  version = "0.9.20";

  src = fetchurl {
    url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    hash = "sha256-Y3AeeJc+PYJdckpOma5ZDbVtBbjBTfNNDqTip4l02/E=";
+    hash = "sha256-iT0Gc/ePx1tUNTPoE2Ol+dHUmbS4CkneZbyraRBx5Ak=";
    name = "${pname}-${version}.AppImage";
  };

@ -57,7 +57,7 @@ in {

  postFixup = ''
    # set the env "LOCAL_GIT_DIRECTORY" for dugite so that we can use the git in nixpkgs
-    makeWrapper ${electron_24}/bin/electron $out/bin/${pname} \
+    makeWrapper ${electron_25}/bin/electron $out/bin/${pname} \
      --set "LOCAL_GIT_DIRECTORY" ${git} \
      --add-flags $out/share/${pname}/resources/app \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
--- a/pkgs/applications/networking/browsers/vieb/default.nix
+++ b/pkgs/applications/networking/browsers/vieb/default.nix
@ -2,20 +2,21 @@

 buildNpmPackage rec {
  pname = "vieb";
-  version = "10.3.0";
+  version = "10.4.0";

  src = fetchFromGitHub {
    owner = "Jelmerro";
    repo = pname;
    rev = version;
-    hash = "sha256-eopsDwgyWshZOppkODGKT8UGnj4vvc7ssEzVAhZeDTA=";
+    hash = "sha256-SQQDlOSP1MZeN6BHdahpxpZ0e60lgA4ph0r2jkmTdP8=";
  };

  postPatch = ''
    sed -i '/"electron"/d' package.json
  '';

-  npmDepsHash = "sha256-9tnLlKzOy8ze4m2beS/pI34IiEa5TdNNr+Rmm2TFgfk=";
+  npmDepsHash = "sha256-yCWSEuhiP6DfcFns6uyUrLBJeQbOK7yJ9QfGhHkTlHI=";
+  makeCacheWritable = true;
  dontNpmBuild = true;

  nativeBuildInputs = [ makeWrapper ] ++ lib.optional stdenv.isAarch64 python3;
--- a/pkgs/applications/networking/clash-verge/default.nix
+++ b/pkgs/applications/networking/clash-verge/default.nix
@ -14,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "clash-verge";
-  version = "1.3.7";
+  version = "1.3.8";

  src = fetchurl {
    url = "https://github.com/zzzgydi/clash-verge/releases/download/v${version}/clash-verge_${version}_amd64.deb";
-    hash = "sha256-+RYfGLa4d5JkLWnlYfhjCOSREVJ4ad/R36eSiNj3GIA=";
+    hash = "sha256-kOju4yaa+EKzFWDrk0iSJVoWkQMBjQG3hKLfAsqlsy8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/helm/chart-testing/default.nix
+++ b/pkgs/applications/networking/cluster/helm/chart-testing/default.nix
@ -13,16 +13,16 @@

 buildGoModule rec {
  pname = "chart-testing";
-  version = "3.9.0";
+  version = "3.10.0";

  src = fetchFromGitHub {
    owner = "helm";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-H9Pw4HPffFmRJXGh+e2hcddYfhgmvnUOxezQ6Zc8NwY=";
+    hash = "sha256-2h1Pc313JZ/2NkFOOQnIrhe1Pm8FJ/BvxjAQhs/eSK0=";
  };

-  vendorHash = "sha256-9XdLSTr9FKuatJzpWM8AwrPtYDS+LC14bpz6evvJRuQ=";
+  vendorHash = "sha256-E+7ndvXWzsU896/eWyupbvqkLed2ly91osptZKT79fk=";

  postPatch = ''
    substituteInPlace pkg/config/config.go \
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@ -1,9 +1,9 @@
 {
-  "version" = "1.11.46";
+  "version" = "1.11.47";
  "hashes" = {
-    "desktopSrcHash" = "sha256-sgdvdTi3fi/vZohh/JPW3I24cQS0i84eM1dUgmEafWs=";
+    "desktopSrcHash" = "sha256-Ea3LJt+3HAOX2PTREMojtuPVTeA6u7VJtysd8bbTbwU=";
    "desktopYarnHash" = "1nssv92yk1a53v7mvijkrb3gzif5xrz2j6lxvg7p340z42rm7f9v";
-    "webSrcHash" = "sha256-3ucitVtYnOc5UUn4y3u+L0sKWJLt+NNrd5T6mn0wNBg=";
-    "webYarnHash" = "19396p654zzzh6d18rpyckjd67lncch3r9a0zmjb7znsi7d78k63";
+    "webSrcHash" = "sha256-DPBMZMjDnwjdNsePcUBBU0KRGOpOmNHgQZn9/ad/Qss=";
+    "webYarnHash" = "0rzipmaq0jarzdawl7lmxnapwzl52kklxadm859hgx9b1hd5vwj7";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/webcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/webcord/default.nix
@ -13,16 +13,16 @@

 buildNpmPackage rec {
  pname = "webcord";
-  version = "4.5.0";
+  version = "4.5.1";

  src = fetchFromGitHub {
    owner = "SpacingBat3";
    repo = "WebCord";
    rev = "v${version}";
-    hash = "sha256-SIGV/Hl5O+xs1DbA25TGasXJVYgCzAP/GCtsDmxKDvI=";
+    hash = "sha256-isrExJeONhIxJUXOsMMq8l9xF9amInBGnb5D+DKuzHw=";
  };

-  npmDepsHash = "sha256-ClPcLHO4+CzOswQaItbFYHVlb0W6Y5NZF140jGpoSJ8=";
+  npmDepsHash = "sha256-RTYPxS6uLLCIu4JfQqMQP8y8+S5uwe3KXWNlbe7/A7Q=";

  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/applications/networking/sync/celeste/default.nix
+++ b/pkgs/applications/networking/sync/celeste/default.nix
@ -7,13 +7,12 @@
 , pkg-config
 , wrapGAppsHook4
 , cairo
+, dbus
 , gdk-pixbuf
 , glib
 , graphene
-, gtk3
 , gtk4
 , libadwaita
-, libappindicator-gtk3
 , librclone
 , pango
 , rclone
@ -21,16 +20,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "celeste";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "hwittenborn";
    repo = "celeste";
    rev = "v${version}";
-    hash = "sha256-fqPAQCbuPnFyn3wioWDETmcXu53808nvnlEzcdUevI4=";
+    hash = "sha256-U+2imF4hUDJAwwf/RFZXfOgTxA+O8c6C+CzQoEQreJw=";
  };

-  cargoHash = "sha256-mVl7CsCX7HMlGC2EIKEfHnPNjmrexjsrpDK/Uq/GwpY=";
+  cargoHash = "sha256-9DrJoXT/uD8y7y2r58DMuURSaic+TtlnPPbw/gq9jPA=";

  postPatch = ''
    pushd $cargoDepsCopy/librclone-sys
@ -64,10 +63,10 @@ rustPlatform.buildRustPackage rec {

  buildInputs = [
    cairo
+    dbus
    gdk-pixbuf
    glib
    graphene
-    gtk3
    gtk4
    libadwaita
    librclone
@ -76,7 +75,6 @@ rustPlatform.buildRustPackage rec {

  preFixup = ''
    gappsWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libappindicator-gtk3 ]}"
      --prefix PATH : "${lib.makeBinPath [ rclone ]}"
    )
  '';
--- a/pkgs/applications/terminal-emulators/roxterm/default.nix
+++ b/pkgs/applications/terminal-emulators/roxterm/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "roxterm";
-  version = "3.14.1";
+  version = "3.14.2";

  src = fetchFromGitHub {
    owner = "realh";
    repo = "roxterm";
    rev = version;
-    sha256 = "sha256-IHJ30qXNVv9tUdePskHl1hd5kPivBb2kH1oOstBr/9s=";
+    sha256 = "sha256-LBxVZ5Az0vGalbQd437of5a3aoZH51v6OKTfndHkkiM=";
  };

  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook libxslt ];
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "docker-compose";
-  version = "2.21.0";
+  version = "2.23.0";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "compose";
    rev = "v${version}";
-    hash = "sha256-JekWw5YI6O+CLXc7oNIxPJsRzYimGFDGL6ACyM4D04k=";
+    hash = "sha256-17TlUQNv/L+LZYF8vub2nI5TVF66OqTA8PrjEYjkz5o=";
  };

  postPatch = ''
@ -16,7 +16,7 @@ buildGoModule rec {
    rm -rf e2e/
  '';

-  vendorHash = "sha256-vVnaZLvPbhJNFn/ACuYDbXCKPKNlYoGCm+liTlPMcjs=";
+  vendorHash = "sha256-zBogjMaVkLum1rQVEd+Rw8lRCNC/Dhi7cuz4YH3eCcg=";

  ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];

--- a/pkgs/applications/virtualization/imgcrypt/default.nix
+++ b/pkgs/applications/virtualization/imgcrypt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "imgcrypt";
-  version = "1.1.8";
+  version = "1.1.9";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-FLqFzEEfgsKcjAevhF6+8mR3zOUjfXyfWwWsxVOcdJU=";
+    hash = "sha256-EStyi6RDK1G6kuaDGumZaHB4OrSrhhx/F5GsLe0amyA=";
  };

  vendorHash = null;
--- a/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
@ -12,6 +12,7 @@
 , libselinux
 , libsepol
 , libthai
+, libxkbcommon
 , pango
 , pcre
 , util-linux
@ -24,13 +25,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "hyprpicker" + lib.optionalString debug "-debug";
-  version = "0.1.1";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = finalAttrs.pname;
    rev = "v${finalAttrs.version}";
-    hash = "sha256-k+rG5AZjz47Q6bpVcTK7r4s7Avg3O+1iw+skK+cn0rk=";
+    hash = "sha256-bys8S7wuY9FJRLD5WriktWED5Hi7nCKSiNbs1Rvfk4s=";
  };

  cmakeBuildType = if debug then "Debug" else "Release";
@ -50,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
    libselinux
    libsepol
    libthai
+    libxkbcommon
    pango
    pcre
    wayland
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "i3";
-  version = "4.22";
+  version = "4.23";

  src = fetchurl {
    url = "https://i3wm.org/downloads/${pname}-${version}.tar.xz";
-    sha256 = "sha256-KGOZEeWdlWOfCSZCqYL14d6lkiUMK1zpjtoQCDNRPks=";
+    sha256 = "sha256-YQJqcZbJE50POq3ScZfosyDFduOkUOAddMGspIQETEY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/as/asm-lsp/package.nix
+++ b/pkgs/by-name/as/asm-lsp/package.nix
@ -0,0 +1,39 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+}:
+let
+  pname = "asm-lsp";
+  version = "0.4.2";
+in
+rustPlatform.buildRustPackage {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "bergercookie";
+    repo = "asm-lsp";
+    rev = "v${version}";
+    hash = "sha256-EGgYOU6y23ULjnMGNjYhgF0JMPgvRuQ4UOWqwJxhBpU=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  cargoHash = "sha256-x8Cj39Wki+pdoNIO8QPGK29KFJrHtDMoZJIXFEldno0=";
+
+  meta = {
+    description = "Language server for NASM/GAS/GO Assembly";
+    homepage = "https://github.com/bergercookie/asm-lsp";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ NotAShelf ];
+    mainProgram = pname;
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/ce/celeste-classic/package.nix
+++ b/pkgs/by-name/ce/celeste-classic/package.nix
@ -0,0 +1,49 @@
+{ lib
+, stdenvNoCC
+, fetchzip
+, autoPatchelfHook
+, SDL2
+, practiceMod ? false
+}:
+
+let
+  directory = if practiceMod then "CELESTE*Practice*" else "CELESTE";
+  srcbin = if practiceMod then "celeste_practice_mod" else "celeste";
+  outbin = if practiceMod then "celeste-classic-pm" else "celeste-classic";
+in
+stdenvNoCC.mkDerivation {
+  pname = outbin;
+  version = "unstable-2020-12-08";
+
+  # From https://www.speedrun.com/celestep8/resources
+  src = fetchzip {
+    url = "https://www.speedrun.com/static/resource/174ye.zip?v=f3dc98f";
+    hash = "sha256-GANHqKB0N905QJOLaePKWkUuPl9UlL1iqvkMMvw/CC8=";
+    extension = "zip";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [ SDL2 ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dsm755 ${directory}/${srcbin} $out/lib/${outbin}/${outbin}
+    install -Dm444 ${directory}/data.pod $out/lib/${outbin}/data.pod
+    mkdir -p $out/bin
+    ln -s $out/lib/${outbin}/${outbin} $out/bin/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A PICO-8 platformer about climbing a mountain, made in four days${lib.optionalString practiceMod " (Practice Mod)"}";
+    homepage = "https://celesteclassic.github.io/";
+    license = licenses.unfree;
+    platforms = platforms.linux;
+    mainProgram = outbin;
+    maintainers = with maintainers; [ mrtnvgr ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+  };
+}
--- a/pkgs/by-name/ph/phel/package.nix
+++ b/pkgs/by-name/ph/phel/package.nix
@ -5,17 +5,22 @@

 php.buildComposerProject (finalAttrs: {
  pname = "phel";
-  version = "0.11.0-dev";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "phel-lang";
    repo = "phel-lang";
-    rev = "83d9d81b6c7daae361c0f1f68462083027b81581";
-    hash = "sha256-B2IozL/nJE4C1Gq54/64TJEySC1STroG1poCBzd3j3I=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-5PMd87Xp7i3Q1ryKQWJBmNbU5TGo2LQ6uvIFP3T36vk=";
  };

  vendorHash = "sha256-83GX/dxHa6w1E34wnJshg7yxlVyRkDT5jmAPCCqPdtA=";

+  doInstallCheck = true;
+  postCheckInstall = ''
+    $out/bin/phel --version
+  '';
+
  meta = {
    changelog = "https://github.com/phel-lang/phel-lang/releases/tag/v${finalAttrs.version}";
    description = "Phel is a functional programming language that compiles to PHP. A Lisp dialect inspired by Clojure and Janet.";
--- a/pkgs/by-name/te/terraform-plugin-docs/package.nix
+++ b/pkgs/by-name/te/terraform-plugin-docs/package.nix
@ -0,0 +1,61 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, makeWrapper
+, go
+, testers
+, terraform-plugin-docs
+, nix-update-script
+}:
+
+buildGoModule rec {
+  pname = "terraform-plugin-docs";
+  version = "0.16.0";
+
+  src = fetchFromGitHub {
+    owner = "hashicorp";
+    repo = "terraform-plugin-docs";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-5vbi69GMgkzvN3aEQbNTbk99rg+kfvAvUrdDsuyIm9s=";
+  };
+
+  vendorHash = "sha256-AjW6BokLVDkIWXToJ7wNq/g19xKTAfpQ/gVlKCV5qw0=";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  subPackages = [
+    "cmd/tfplugindocs"
+  ];
+
+  allowGoReference = true;
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+    "-X main.commit=${src.rev}"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/tfplugindocs --prefix PATH : ${lib.makeBinPath [ go ]}
+  '';
+
+  passthru = {
+    tests.version = testers.testVersion {
+      command = "tfplugindocs --version";
+      package = terraform-plugin-docs;
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = with lib; {
+    description = "Generate and validate Terraform plugin/provider documentation";
+    homepage = "https://github.com/hashicorp/terraform-plugin-docs";
+    changelog = "https://github.com/hashicorp/terraform-plugin-docs/releases/tag/v${version}";
+    license = licenses.mpl20;
+    mainProgram = "tfplugindocs";
+    maintainers = with maintainers; [ lewo ];
+  };
+}
--- a/pkgs/data/fonts/iwona/default.nix
+++ b/pkgs/data/fonts/iwona/default.nix
@ -1,10 +1,9 @@
 { lib, stdenvNoCC, texlive }:

-stdenvNoCC.mkDerivation {
-  pname = "iwona";
-  version = "0.995b";
+stdenvNoCC.mkDerivation rec {
+  inherit (src) pname version;

-  src = lib.head (builtins.filter (p: p.tlType == "run") texlive.iwona.pkgs);
+  src = texlive.pkgs.iwona;

  installPhase = ''
    runHook preInstall
@ -20,7 +19,7 @@ stdenvNoCC.mkDerivation {
    # "[...] GUST Font License (GFL), which is a free license, legally
    # equivalent to the LaTeX Project Public # License (LPPL), version 1.3c or
    # later." - GUST website
-    license = licenses.lppl13c;
+    license = src.meta.license;
    maintainers = with maintainers; [ siddharthist ];
    platforms = platforms.all;
  };
--- a/pkgs/development/compilers/fstar/default.nix
+++ b/pkgs/development/compilers/fstar/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "fstar";
-  version = "2023.04.25";
+  version = "2023.09.03";

  src = fetchFromGitHub {
    owner = "FStarLang";
    repo = "FStar";
    rev = "v${version}";
-    hash = "sha256-LF8eXi/es337QJ2fs5u9pLqegJkh1kDLjK8p4CcSGGc=";
+    hash = "sha256-ymoP5DvaLdrdwJcnhZnLEvwNxUFzhkICajPyK4lvacc=";
  };

  strictDeps = true;
@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
    stdint
    yojson
    fileutils
+    memtrace
    menhirLib
    pprint
    sedlex
--- a/pkgs/development/libraries/apr-util/clang-bdb.patch
+++ b/pkgs/development/libraries/apr-util/clang-bdb.patch
@ -0,0 +1,12 @@
+diff -ur a/build/dbm.m4 b/build/dbm.m4
+--- a/build/dbm.m4	2013-11-23 13:00:53.000000000 -0500
+++ b/build/dbm.m4	2023-10-22 20:16:37.764571446 -0400
+@@ -235,7 +235,7 @@
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <$apu_try_berkeley_db_header>
+-main ()
+int main ()
+ {
+   int major, minor, patch;
+ 
--- a/pkgs/development/libraries/apr-util/default.nix
+++ b/pkgs/development/libraries/apr-util/default.nix
@ -19,15 +19,18 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-pBB243EHRjJsOUUEKZStmk/KwM4Cd92P6gdv7DyXcrU=";
  };

-  patches = [ ./fix-libxcrypt-build.patch ]
-    ++ lib.optional stdenv.isFreeBSD ./include-static-dependencies.patch;
+  patches = [
+    ./fix-libxcrypt-build.patch
+    # Fix incorrect Berkeley DB detection with newer versions of clang due to implicit `int` on main errors.
+    ./clang-bdb.patch
+  ] ++ lib.optional stdenv.isFreeBSD ./include-static-dependencies.patch;

  NIX_CFLAGS_LINK = [ "-lcrypt" ];

  outputs = [ "out" "dev" ];
  outputBin = "dev";

-  nativeBuildInputs = [ makeWrapper ] ++ lib.optional stdenv.isFreeBSD autoreconfHook;
+  nativeBuildInputs = [ makeWrapper autoreconfHook ];

  configureFlags = [ "--with-apr=${apr.dev}" "--with-expat=${expat.dev}" ]
    ++ lib.optional (!stdenv.isCygwin) "--with-crypto"
--- a/pkgs/development/libraries/libbladeRF/default.nix
+++ b/pkgs/development/libraries/libbladeRF/default.nix
@ -35,6 +35,10 @@ stdenv.mkDerivation rec {
    "-DBLADERF_GROUP=bladerf"
  ];

+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = "-Wno-error=unused-but-set-variable";
+  };
+
  hardeningDisable = [ "fortify" ];

  meta = with lib; {
--- a/pkgs/development/libraries/parson/default.nix
+++ b/pkgs/development/libraries/parson/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation {
  pname = "parson";
-  version = "1.5.2";
+  version = "1.5.3";

  src = fetchFromGitHub {
    owner = "kgabis";
    repo = "parson";
-    rev = "60c37844d7a1c97547812cac3423d458c73e60f9"; # upstream doesn't use tags
-    hash = "sha256-SbM0kqRtdcz1s+pUTW7VPMY1O6zdql3bao19Rk4t470=";
+    rev = "ba29f4eda9ea7703a9f6a9cf2b0532a2605723c3"; # upstream doesn't use tags
+    hash = "sha256-IEmCa0nauUzG+zcLpr++ySD7i21zVJh/35r9RaQkok0=";
  };

  nativeBuildInputs = [ meson ninja ];
--- a/pkgs/development/libraries/tecla/default.nix
+++ b/pkgs/development/libraries/tecla/default.nix
@ -14,6 +14,10 @@ stdenv.mkDerivation rec {
      --replace "stripprog=" "stripprog=\$STRIP # "
  '';

+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  };
+
  meta = {
    description = "Command-line editing library";
    homepage = "https://www.astro.caltech.edu/~mcs/tecla/";
--- a/pkgs/development/mobile/maestro/default.nix
+++ b/pkgs/development/mobile/maestro/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "maestro";
-  version = "1.33.1";
+  version = "1.34.0";

  src = fetchurl {
    url = "https://github.com/mobile-dev-inc/maestro/releases/download/cli-${version}/maestro.zip";
-    sha256 = "142h53qwmibi9bpdwla9ard771vcri8yibnynvgj5nvfgapj2p4z";
+    sha256 = "1qbva38lcy1rm5k6r207hk3nqrr07h7x9sdppz4w5f37q0ll986r";
  };

  dontUnpack = true;
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/python-modules/bip32/default.nix
+++ b/pkgs/development/python-modules/bip32/default.nix
@ -0,0 +1,50 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, base58
+, coincurve
+}:
+
+buildPythonPackage rec {
+  pname = "bip32";
+  version = "3.4";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  # the PyPi source distribution ships a broken setup.py, so use github instead
+  src = fetchFromGitHub {
+    owner = "darosior";
+    repo = "python-bip32";
+    rev = version;
+    hash = "sha256-o8UKR17XDWp1wTWYeDL0DJY+D11YI4mg0UuGEAPkHxE=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    base58
+    coincurve
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "bip32"
+  ];
+
+  meta = with lib; {
+    description = "Minimalistic implementation of the BIP32 key derivation scheme";
+    homepage = "https://github.com/darosior/python-bip32";
+    changelog = "https://github.com/darosior/python-bip32/blob/${version}/CHANGELOG.md";
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ arcnmx ];
+  };
+}
--- a/pkgs/development/python-modules/dvc/default.nix
+++ b/pkgs/development/python-modules/dvc/default.nix
@ -62,7 +62,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-0XuljGj+gvYGhYD4CqGgZlESNuXG0V896mztEbJErb8=";
+    hash = "sha256-oCNszhLGNXNGiQtp91wT4GfuNzDhbZrVR55K41Ykhdg=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/enlighten/default.nix
+++ b/pkgs/development/python-modules/enlighten/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "enlighten";
-  version = "1.12.0";
+  version = "1.12.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-a4r20HG13gUBOjjoDhaHJtxv+yhY3oF/d+QV+Fss6Bk=";
+    hash = "sha256-jAn2VxEZdGzuZ3bL9OfASkjoiPTMrm2zd6WHZ0HwiZ8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/gtts/default.nix
+++ b/pkgs/development/python-modules/gtts/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "gtts";
-  version = "2.3.2";
+  version = "2.4.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "pndurette";
    repo = "gTTS";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Z5dM/PzIA8qtw0RepTKmHpqBwYMRwNLhWuEC0aBGL3U=";
+    hash = "sha256-M/RbNw5SJb1R78MDTqBHNWE0I/9PlqikrrJAy1r02f8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/ledger-bitcoin/default.nix
+++ b/pkgs/development/python-modules/ledger-bitcoin/default.nix
@ -4,6 +4,8 @@
 , setuptools
 , ledgercomm
 , packaging
+, bip32
+, coincurve
 , typing-extensions
 }:

@ -25,6 +27,8 @@ buildPythonPackage rec {
  propagatedBuildInputs = [
    ledgercomm
    packaging
+    bip32
+    coincurve
    typing-extensions
  ];

--- a/pkgs/development/python-modules/mastodon-py/default.nix
+++ b/pkgs/development/python-modules/mastodon-py/default.nix
@ -14,25 +14,24 @@
 , pytest-mock
 , pytest-vcr
 , requests-mock
+, setuptools
+, pytest-cov
 }:

 buildPythonPackage rec {
  pname = "mastodon-py";
-  version = "1.8.1";
+  # tests are broken on last release, check after next release (> 1.8.1)
+  version = "unstable-2023-06-24";

-  format = "setuptools";
+  format = "pyproject";

  src = fetchFromGitHub {
    owner = "halcy";
    repo = "Mastodon.py";
-    rev = "refs/tags/${version}";
-    hash = "sha256-r0AAUjd2MBfZANEpyztMNyaQTlGWvWoUVjJNO1eL218=";
+    rev = "cd86887d88bbc07de462d1e00a8fbc3d956c0151";
+    hash = "sha256-rJocFvtBPrSSny3lwENuRsQdAzi3u8b+SfDNGloniWI=";
  };

-  postPatch = ''
-    sed -i '/^addopts/d' setup.cfg
-  '';
-
  propagatedBuildInputs = [
    blurhash
    cryptography
@ -49,7 +48,9 @@ buildPythonPackage rec {
    pytestCheckHook
    pytest-mock
    pytest-vcr
+    pytest-cov
    requests-mock
+    setuptools
  ];

  pythonImportsCheck = [ "mastodon" ];
--- a/pkgs/development/python-modules/opencensus-ext-azure/default.nix
+++ b/pkgs/development/python-modules/opencensus-ext-azure/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "opencensus-ext-azure";
-  version = "1.1.9";
+  version = "1.1.11";
  format = "setuptools";

  disabled = pythonOlder "3.4";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-UHYIt36djqq2/9X/EbfOuH9U5KapQMS4FDMbTRsDQVE=";
+    hash = "sha256-IdTU0FGdSCOdBBQskLalH17MBDaE64DPoKcBqiM0YHM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pysolcast/default.nix
+++ b/pkgs/development/python-modules/pysolcast/default.nix
@ -7,13 +7,13 @@
 , pyyaml
 , requests
 , responses
-, setuptools-scm
+, poetry-core
 }:

 buildPythonPackage rec {
  pname = "pysolcast";
-  version = "1.0.15";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;

  disabled = pythonOlder "3.9";

@ -21,13 +21,11 @@ buildPythonPackage rec {
    owner = "mcaulifn";
    repo = "solcast";
    rev = "refs/tags/v${version}";
-    hash = "sha256-CvijYl6zSwQ6BrGZPJWp75jAApc2y/7cPdZxMq5AjmI=";
+    hash = "sha256-jLhM47o6LvkPux0kusOrRk4TDS6VLWE0QMEiQxlBCwo=";
  };

-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
  nativeBuildInputs = [
-    setuptools-scm
+    poetry-core
  ];

  propagatedBuildInputs = [
@ -41,11 +39,6 @@ buildPythonPackage rec {
    responses
  ];

-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "pytest-runner" ""
-  '';
-
  pythonImportsCheck = [
    "pysolcast"
  ];
--- a/pkgs/development/python-modules/ray/binary-hashes.nix
+++ b/pkgs/development/python-modules/ray/binary-hashes.nix
@ -1,11 +1,11 @@
 {
  cp39 = {
-    sha256 = "7708cedbeed8e37e468740b75aa941b2a3c80d2cb8791081e0b0ea159617a912";
+    sha256 = "0e0f7dbeb4444940c72b64fdecd6f331593466914b2dffeed03ce97225acec14";
  };
  cp310 = {
-    sha256 = "c9b5aabf5f41fe05028e4f3a271dc89ca7cd9c210f48a4ed815b852210ebb5a8";
+    sha256 = "b83621f5d2d4079e6ae624c3bf30046a4fefa0ea7ea5e4a4dfe4b50c580b3768";
  };
  cp311 = {
-    sha256 = "7b0286cd05d9107a2d978c716a7447c09ffd382971e5b2b388602d56f6b1c662";
+    sha256 = "8384b3f30bc1446ef810e9e894afa03238c5ac40d3c40c0740d82f347112015d";
  };
 }
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@ -52,7 +52,7 @@

 let
  pname = "ray";
-  version = "2.6.1";
+  version = "2.7.0";
 in
 buildPythonPackage rec {
  inherit pname version;
--- a/pkgs/development/python-modules/types-awscrt/default.nix
+++ b/pkgs/development/python-modules/types-awscrt/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "types-awscrt";
-  version = "0.19.6";
+  version = "0.19.7";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -15,7 +15,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "types_awscrt";
    inherit version;
-    hash = "sha256-GdSGfysTK7NPLdruHz/rp8xCqGivXgVcxqWAtC+heTM=";
+    hash = "sha256-OkqKWCnwpNgGR2vZTEp+IxpWGHn6xP4ERwWsxEshKmQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/biome/default.nix
+++ b/pkgs/development/tools/biome/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "biome";
-  version = "1.2.2";
+  version = "1.3.3";

  src = fetchFromGitHub {
    owner = "biomejs";
    repo = "biome";
    rev = "cli/v${version}";
-    hash = "sha256-WiyORFXS1kpOaMCbnPdr5ewa6D4ozFTIRSArVlA2FvY=";
+    hash = "sha256-1yVXzPbLqLiqn3RN3mZNULOabydYtjXam+BB3aKwhTs=";
  };

-  cargoHash = "sha256-s2CVEGYRzJgsg4soETStpaJ7GDNdJCBJ+Qbn88sFlDQ=";
+  cargoHash = "sha256-3EkYxq80fkRJ1U4nLtp7dYEEFaqDhgptnNsNghFQAZI=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/development/tools/database/pgweb/default.nix
+++ b/pkgs/development/tools/database/pgweb/default.nix
@ -1,14 +1,19 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, testers
+, pgweb
+}:

 buildGoModule rec {
  pname = "pgweb";
-  version = "0.14.1";
+  version = "0.14.2";

  src = fetchFromGitHub {
    owner = "sosedoff";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-0wwDye7Iku9+brYoVqlCpnm+A3xsr8tL2dyWaBVvres=";
+    hash = "sha256-gM7hqFriXkcwNO+I3d138kfp1F4YsO/Qbq0NzMszkwM=";
  };

  postPatch = ''
@ -29,7 +34,14 @@ buildGoModule rec {
    in
    [ "-skip" "${builtins.concatStringsSep "|" skippedTests}" ];

+    passthru.tests.version = testers.testVersion {
+      version = "v${version}";
+      package = pgweb;
+      command = "pgweb --version";
+    };
+
  meta = with lib; {
+    changelog = "https://github.com/sosedoff/pgweb/releases/tag/v${version}";
    description = "A web-based database browser for PostgreSQL";
    longDescription = ''
      A simple postgres browser that runs as a web server. You can view data,
@ -37,6 +49,7 @@ buildGoModule rec {
    '';
    homepage = "https://sosedoff.github.io/pgweb/";
    license = licenses.mit;
+    mainProgram = "pgweb";
    maintainers = with maintainers; [ zupo luisnquin ];
  };
 }
--- a/pkgs/development/tools/jaq/default.nix
+++ b/pkgs/development/tools/jaq/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "jaq";
-  version = "1.0.0";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "01mf02";
    repo = "jaq";
    rev = "v${version}";
-    hash = "sha256-Snn34Jl6GXtGUwOXBwo0icmuNfesLHUwA7sIvdv0xlY=";
+    hash = "sha256-W+xUc9B6tTbpPc9xyVnQuAtwiw4RICWKl9C5dF0BMN8=";
  };

-  cargoHash = "sha256-sL884chxQntagj5/h4yWLtDS8T7hbRFjHIqNbbzcsmI=";
+  cargoHash = "sha256-pxoi9yS6Oc10epSMC3BVAC2WeV0brOMaK1upNiAZbxI=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.Security
--- a/pkgs/development/tools/language-servers/helm-ls/default.nix
+++ b/pkgs/development/tools/language-servers/helm-ls/default.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "helm-ls";
-  version = "0.0.6";
+  version = "0.0.7";

  src = fetchFromGitHub {
    owner = "mrjosh";
    repo = "helm-ls";
    rev = "v${version}";
-    hash = "sha256-dNF0Q/jat2YE/3ZEKqJVX+4+iizJIV25U9U3e+2bfUM=";
+    hash = "sha256-XTY32B0RkLcZxTuKWUtZlrrUARkoT2+qYkL8Amai2cE=";
  };

  vendorHash = "sha256-wMYrgAgAEgwfjMLP81H0cKWm/kh63ppDkSiymfsaj7U=";
--- a/pkgs/development/tools/misc/act/default.nix
+++ b/pkgs/development/tools/misc/act/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "act";
-  version = "0.2.52";
+  version = "0.2.53";

  src = fetchFromGitHub {
    owner = "nektos";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-mw0Ul6m8mgx2I3ExoDs5luN4PQXAI0NADTSYt+DFCs8=";
+    hash = "sha256-p2ujmHWIBUcH5UpHHO72ddqSb1C0gWAyKUIT9E6Oyxk=";
  };

-  vendorHash = "sha256-WoeJ4yB3bTx6I+Ga5X7ZhPfjw3NERp1v/ot5pPsYYLw=";
+  vendorHash = "sha256-W50NodoaKY7s4x7Goyvydxd5Q2lz9m9pFwgcQ9wRGVM=";

  doCheck = false;

--- a/pkgs/development/tools/misc/strace/default.nix
+++ b/pkgs/development/tools/misc/strace/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "strace";
-  version = "6.5";
+  version = "6.6";

  src = fetchurl {
    url = "https://strace.io/files/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-37BRcCOJ4ZeaFRiStZAa/J6Tu8HHDYTJBq3jIkypGYA=";
+    sha256 = "sha256-QhtBhsBrcFFj5k3IXycevc9nZgr4ZnKDFH1ehZ/IqWw=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
--- a/pkgs/development/tools/pyenv/default.nix
+++ b/pkgs/development/tools/pyenv/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "pyenv";
-  version = "2.3.28";
+  version = "2.3.31";

  src = fetchFromGitHub {
    owner = "pyenv";
    repo = "pyenv";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KxYxHNoXk4RVA5+mpE3hjrl1c+7Ei/km/zrMIvvV+1M=";
+    hash = "sha256-liDm8lcHSdn9f/tNISRlnqEIcBtmusMplH0N4tW5Lgo=";
  };

  postPatch = ''
--- a/pkgs/development/tools/tfplugindocs/default.nix
+++ b/pkgs/development/tools/tfplugindocs/default.nix
@ -1,22 +0,0 @@
-{ buildGoModule, fetchFromGitHub, lib }:
-
-buildGoModule rec {
-  pname = "tfplugindocs";
-  version = "0.14.1";
-
-  src = fetchFromGitHub {
-    owner = "hashicorp";
-    repo = "terraform-plugin-docs";
-    rev = "v${version}";
-    sha256 = "sha256-GiMjm7XG/gFGOQXYeXsKbU7WQdrkQ0+J/SvfbLu24bo=";
-  };
-
-  vendorHash = "sha256-qUlyOAiLzLgrtaAfs/aGpAikGmGcQ9PI7QRyp9+Qn4w=";
-
-  meta = with lib; {
-    description = "Generate and validate Terraform plugin/provider documentation";
-    homepage = "https://github.com/hashicorp/terraform-plugin-docs";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ lewo ];
-  };
-}
--- a/pkgs/development/tools/vendir/default.nix
+++ b/pkgs/development/tools/vendir/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "vendir";
-  version = "0.35.0";
+  version = "0.35.2";

  src = fetchFromGitHub {
    owner = "vmware-tanzu";
    repo = "carvel-vendir";
    rev = "v${version}";
-    sha256 = "sha256-aN8O+5zzGGLWAPk/oNFOnBBv2rsljWaxTKlC19XTt58=";
+    sha256 = "sha256-zoZPAJTEmKHL78wfAHqayBxw8tRANIsMckj+wXtbLTw=";
  };

  vendorHash = null;
--- a/pkgs/misc/sagetex/default.nix
+++ b/pkgs/misc/sagetex/default.nix
@ -1,10 +1,11 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, writeShellScript
 , texlive
 }:

-stdenv.mkDerivation (finalAttrs: rec {
+stdenv.mkDerivation rec {
  pname = "sagetex";
  version = "3.6.1";

@ -15,8 +16,14 @@ stdenv.mkDerivation (finalAttrs: rec {
    sha256 = "sha256-OfhbXHbGI+DaDHqZCOGiSHJPHjGuT7ZqSEjKweloW38=";
  };

-  buildInputs = [
+  outputs = [ "tex" ];
+
+  nativeBuildInputs = [
    texlive.combined.scheme-basic
+    # multiple-outputs.sh fails if $out is not defined
+    (writeShellScript "force-tex-output.sh" ''
+      out="''${tex-}"
+    '')
  ];

  buildPhase = ''
@ -29,11 +36,6 @@ stdenv.mkDerivation (finalAttrs: rec {
    cp -va *.sty *.cfg *.def "$path/"
  '';

-  passthru = {
-    tlType = "run";
-    pkgs = [ finalAttrs.finalPackage ];
-  };
-
  meta = with lib; {
    description = "Embed code, results of computations, and plots from Sage into LaTeX documents";
    homepage = "https://github.com/sagemath/sagetex";
@ -41,4 +43,4 @@ stdenv.mkDerivation (finalAttrs: rec {
    maintainers = with maintainers; [ alexnortung ];
    platforms = platforms.all;
  };
-})
+}
--- a/pkgs/misc/vencord/default.nix
+++ b/pkgs/misc/vencord/default.nix
@ -5,8 +5,8 @@
 , buildWebExtension ? false
 }:
 let
-  version = "1.6.1";
-  gitHash = "a9e67e2";
+  version = "1.6.2";
+  gitHash = "dd61b0c";
 in
 buildNpmPackage rec {
  pname = "vencord";
@ -16,7 +16,7 @@ buildNpmPackage rec {
    owner = "Vendicated";
    repo = "Vencord";
    rev = "v${version}";
-    hash = "sha256-t4+8ybPzqcCtTSukBBgvbD7HiKG4K51WPVnJg0RQbs8=";
+    hash = "sha256-AqyUnDMIASJ/kUTeICdN94W5U0E52RFs6hM2/E8AjXI=";
  };

  ESBUILD_BINARY_PATH = lib.getExe (esbuild.overrideAttrs (final: _: {
@ -34,7 +34,7 @@ buildNpmPackage rec {
  npmRebuildFlags = [ "|| true" ];

  makeCacheWritable = true;
-  npmDepsHash = "sha256-PWasfMX75emOwOtHd4FrVA6TDfFcOowXsAxgZqMsgP8=";
+  npmDepsHash = "sha256-RzOv8LekJqX0C/AjC5ONkfkMK36bAGWFxyM9Akn1CIg=";
  npmFlags = [ "--legacy-peer-deps" ];
  npmBuildScript = if buildWebExtension then "buildWeb" else "build";
  npmBuildFlags = [ "--" "--standalone" "--disable-updater" ];
--- a/pkgs/misc/vencord/package-lock.json
+++ b/pkgs/misc/vencord/package-lock.json
@ -1,12 +1,12 @@
 {
    "name": "vencord",
-    "version": "1.6.1",
+    "version": "1.6.2",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
        "": {
            "name": "vencord",
-            "version": "1.6.1",
+            "version": "1.6.2",
            "license": "GPL-3.0-or-later",
            "dependencies": {
                "@sapphi-red/web-noise-suppressor": "0.3.3",
@ -893,9 +893,9 @@
            "dev": true
        },
        "node_modules/@types/node": {
-            "version": "18.18.7",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-18.18.7.tgz",
-            "integrity": "sha512-bw+lEsxis6eqJYW8Ql6+yTqkE6RuFtsQPSe5JxXbqYRFQEER5aJA9a5UH9igqDWm3X4iLHIKOHlnAXLM4mi7uQ==",
+            "version": "18.18.8",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-18.18.8.tgz",
+            "integrity": "sha512-OLGBaaK5V3VRBS1bAkMVP2/W9B+H8meUfl866OrMNQqt7wDgdpWPp5o6gmIc9pB+lIQHSq4ZL8ypeH1vPxcPaQ==",
            "dev": true,
            "dependencies": {
                "undici-types": "~5.26.4"
@ -4169,9 +4169,9 @@
            }
        },
        "node_modules/punycode": {
-            "version": "2.3.0",
-            "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.0.tgz",
-            "integrity": "sha512-rRV+zQD8tVFys26lAGR9WUuS4iUAngJScM+ZRSKtvl5tKeZ2t5bvdNFdNHBW9FWR4guGHlgmsZ1G7BSm2wTbuA==",
+            "version": "2.3.1",
+            "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+            "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
            "dev": true,
            "engines": {
                "node": ">=6"
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@ -36,21 +36,15 @@ rec {
  };

  latest = selectHighestVersion production (generic {
-    version = "530.41.03";
-    sha256_64bit = "sha256-riehapaMhVA/XRYd2jQ8FgJhKwJfSu4V+S4uoKy3hLE=";
-    sha256_aarch64 = "sha256-uM5zMEO/AO32VmqUOzmc05FFm/lz76jPSSaQmeZUlFo=";
-    openSha256 = "sha256-etbtw6LMRUcFoZC9EDDRrTDekV8JFRYmkp3idLaMk5g=";
-    settingsSha256 = "sha256-8KB6T9f+gWl8Ni+uOyrJKiiH5mNx9eyfCcW/RjPTQQA=";
-    persistencedSha256 = "sha256-zrstlt/0YVGnsPGUuBbR9ULutywi2wNDVxh7OhJM7tM=";
+    version = "545.29.02";
+    sha256_64bit = "sha256-RncPlaSjhvBFUCOzWdXSE3PAfRPCIrWAXyJMdLPKuIU=";
+    sha256_aarch64 = "sha256-Y2RDOuDtiIclr06gmLrPDfE5VFmFamXxiIIKtKAewro=";
+    openSha256 = "sha256-PukpOBtG5KvZKWYfJHVQO6SuToJUd/rkjpOlEi8pSmk=";
+    settingsSha256 = "sha256-zj173HCZJaxAbVV/A2sbJ9IPdT1+3yrwyxD+AQdkSD8=";
+    persistencedSha256 = "sha256-mmMi2pfwzI1WYOffMVdD0N1HfbswTGg7o57x9/IiyVU=";

    patchFlags = [ "-p1" "-d" "kernel" ];
-    patches = [
-      # source: https://gist.github.com/joanbm/77f0650d45747b9a4dc8e330ade2bf5c
-      (fetchpatch {
-        url = "https://gist.github.com/joanbm/77f0650d45747b9a4dc8e330ade2bf5c/raw/688b612624945926676de28059fe749203b4b549/nvidia-470xx-fix-linux-6.4.patch";
-        hash = "sha256-OyRmezyzqAi7mSJHDjsWQVocSsgJPTW5DvHDFVNX7Dk=";
-      })
-    ];
+    patches = [];
  });

  beta = selectHighestVersion latest (generic {
--- a/pkgs/os-specific/linux/nvidia-x11/settings.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/settings.nix
@ -69,7 +69,9 @@ stdenv.mkDerivation {
      url = "https://github.com/NVIDIA/nvidia-settings/commit/a7c1f5fce6303a643fadff7d85d59934bd0cf6b6.patch";
      hash = "sha256-ZwF3dRTYt/hO8ELg9weoz1U/XcU93qiJL2d1aq1Jlak=";
    })
-    ++ lib.optional (lib.versionAtLeast nvidia_x11.settingsVersion "515.43.04")
+  ++ lib.optional
+    ((lib.versionAtLeast nvidia_x11.settingsVersion "515.43.04")
+      && (lib.versionOlder nvidia_x11.settingsVersion "545.29"))
    (fetchpatch {
      # fix wayland support for compositors that use wl_output version 4
      url = "https://github.com/NVIDIA/nvidia-settings/pull/99/commits/2e0575197e2b3247deafd2a48f45afc038939a06.patch";
--- a/pkgs/pkgs-lib/formats/libconfig/test/comprehensive/default.nix
+++ b/pkgs/pkgs-lib/formats/libconfig/test/comprehensive/default.nix
@ -6,12 +6,9 @@ let
    val = 1;
  };

-  include_file = (writeText "libconfig-test-include" ''
+  include_file = writeText "libconfig-test-include" ''
    val=1;
-  '').overrideAttrs {
-    outputHashAlgo = "sha256";
-    outputHashMode = "flat";
-  };
+  '';

  expression = {
    simple_top_level_attr = "1.0";
@ -63,12 +60,15 @@ in

    doCheck = true;
    checkPhase = ''
-      diff -U3 ${./expected.txt} ${libconfig-test-cfg}
+      cp ${./expected.txt} expected.txt
+      substituteInPlace expected.txt \
+          --subst-var-by include_file "${include_file}"
+      diff -U3 ./expected.txt ${libconfig-test-cfg}
    '';

    installPhase = ''
      mkdir $out
-      cp ${./expected.txt} $out/expected.txt
+      cp expected.txt $out
      cp ${libconfig-test-cfg} $out/libconfig-test.cfg
      cp ${libconfig-test-cfg.passthru.json} $out/libconfig-test.json
    '';
--- a/pkgs/pkgs-lib/formats/libconfig/test/comprehensive/expected.txt
+++ b/pkgs/pkgs-lib/formats/libconfig/test/comprehensive/expected.txt
@ -1,6 +1,6 @@
 array1d=[1, 5, 2];array2d=([1, 2], [2, 1]);list1d=(1, "mixed!", 5, 2);list2d=(1, (1, 1.2, "foo"), ("bar", 1.2, 1));nasty_string="\"@
 \\	^*bf
 0\";'''$";nested={attrset={has={a={integer={value=100;};};};};};simple_top_level_attr="1.0";some_floaty=29.95;weirderTypes={
-@include "/nix/store/jdz5yhzbbj4j77yrr7l20x1cs4kbwkj2-libconfig-test-include"
+@include "@include_file@"
 array_of_ints=[0732, 0xa3, 1234];bigint=9223372036854775807;float=0.0012;hex=0x1fc3;list_of_weird_types=(3.141592654, 9223372036854775807, 0x1fc3, 027, 1.2e-32, 1.0);octal=027;pi=3.141592654;};

--- a/pkgs/shells/fish/plugins/bobthefish.nix
+++ b/pkgs/shells/fish/plugins/bobthefish.nix
@ -3,15 +3,15 @@
 , fetchFromGitHub
 ,
 }:
-buildFishPlugin rec {
+buildFishPlugin {
  pname = "bobthefish";
-  version = "unstable-2022-08-02";
+  version = "unstable-2023-06-16";

  src = fetchFromGitHub {
    owner = "oh-my-fish";
    repo = "theme-bobthefish";
-    rev = "2dcfcab653ae69ae95ab57217fe64c97ae05d8de";
-    sha256 = "sha256-jBbm0wTNZ7jSoGFxRkTz96QHpc5ViAw9RGsRBkCQEIU=";
+    rev = "c2c47dc964a257131b3df2a127c2631b4760f3ec";
+    sha256 = "sha256-LB4g+EA3C7OxTuHfcxfgl8IVBe5NufFc+5z9VcS0Bt0=";
  };

  meta = with lib; {
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@ -263,21 +263,24 @@ rec {

      sdk = pkgs.darwin."apple_sdk_${lib.replaceStrings [ "." ] [ "_" ] darwinSdkVersion}";

-      isSDKFramework = pkg: lib.hasPrefix "apple-framework-" (lib.getName pkg);
-
      replacePropagatedFrameworks = pkg:
        let
-          propagatedFrameworks = lib.filter isSDKFramework pkg.propagatedBuildInputs;
+          propagatedInputs = pkg.propagatedBuildInputs;
+          mappedInputs = map mapPackageToSDK propagatedInputs;
+
          env = {
            inherit (pkg) outputs;
-            # Map the old frameworks to new and the package’s outputs to their original outPaths.
-            # The mappings are rendered into tab-separated files to be read back with `read`.
-            frameworks = lib.concatMapStrings (pkg: "${pkg}\t${mapPackageToSDK pkg}\n") propagatedFrameworks;
+            # Map old frameworks to new ones and the package’s outputs to their original outPaths.
+            # Also map any packages that have propagated frameworks to their proxy packages using
+            # the requested SDK version. These mappings are rendered into tab-separated files to be
+            # parsed and read back with `read`.
+            dependencies = lib.concatMapStrings (pair: "${pair.fst}\t${pair.snd}\n") (lib.zipLists propagatedInputs mappedInputs);
            pkgOutputs = lib.concatMapStrings (output: "${output}\t${(lib.getOutput output pkg).outPath}\n") pkg.outputs;
-            passAsFile = [ "frameworks" "pkgOutputs" ];
+            passAsFile = [ "dependencies" "pkgOutputs" ];
          };
        in
-        if lib.length propagatedFrameworks > 0
+        # Only remap the package’s propagated inputs if there are any and if any of them were themselves remapped.
+        if lib.length propagatedInputs > 0 && propagatedInputs != mappedInputs
          then pkgs.runCommand pkg.name env ''
            # Iterate over the outputs in the package being replaced to make sure the proxy is
            # a fully functional replacement. This is like `symlinkJoin` except for outputs and
@ -302,7 +305,7 @@ rec {
                      while IFS=$'\t\n' read -r oldFramework newFramework; do
                        substituteInPlace "''${!outputName}/nix-support/$fileName" \
                          --replace "$oldFramework" "$newFramework"
-                      done < "$frameworksPath"
+                      done < "$dependenciesPath"
                    fi
                  done
                else
@ -319,13 +322,13 @@ rec {
          name = lib.getName pkg;
          framework = lib.removePrefix "apple-framework-" name;
        in
-        if isSDKFramework pkg
-          then sdk.frameworks."${framework}"
-          else replacePropagatedFrameworks pkg;
+        /**/ if pkg == null then pkg
+        else if name != framework then sdk.frameworks."${framework}"
+        else replacePropagatedFrameworks pkg;

      mapRuntimeToSDK = pkg:
        # Only remap xcbuild for now, which exports the SDK used to build it.
-        if pkg != null && lib.getName pkg == "xcodebuild"
+        if pkg != null && lib.isAttrs pkg && lib.getName pkg == "xcodebuild"
          then pkg.override { stdenv = overrideSDK stdenv { inherit darwinMinVersion darwinSdkVersion; }; }
          else pkg;

@ -364,6 +367,7 @@ rec {
        "buildInputs"
        "nativeBuildInputs"
        "propagatedNativeBuildInputs"
+        "propagatedBuildInputs"
      ]);
    });
 }
--- a/pkgs/test/texlive/default.nix
+++ b/pkgs/test/texlive/default.nix
@ -454,8 +454,7 @@ rec {
      '';

      # link all binaries in single derivation
-      allPackages = with lib; concatLists (catAttrs "pkgs" (filter isAttrs (attrValues texlive)));
-      binPackages = lib.filter (p: p.tlType == "bin") allPackages;
+      binPackages = lib.catAttrs "out" (lib.attrValues texlive.pkgs);
      binaries = buildEnv { name = "texlive-binaries"; paths = binPackages; };
    in
    runCommand "texlive-test-binaries"
@ -565,8 +564,7 @@ rec {

  # check that all scripts have a Nix shebang
  shebangs = let
-      allPackages = with lib; concatLists (catAttrs "pkgs" (filter isAttrs (attrValues texlive)));
-      binPackages = lib.filter (p: p.tlType == "bin") allPackages;
+      binPackages = lib.catAttrs "out" (lib.attrValues texlive.pkgs);
    in
    runCommand "texlive-test-shebangs" { }
      (''
@ -615,7 +613,7 @@ rec {
        correctLicenses = scheme: builtins.foldl'
                (acc: pkg: concatLicenses acc (lib.toList (pkg.meta.license or [])))
                []
-                scheme.passthru.packages;
+                scheme.passthru.requiredTeXPackages;
        correctLicensesAttrNames = scheme:
          lib.sort lt
            (map licenseToAttrName (correctLicenses scheme));
@ -648,10 +646,13 @@ rec {
  # this is effectively an eval-time assertion, converted into a derivation for
  # ease of testing
  fixedHashes = with lib; let
-    combine = findFirst (p: (head p.pkgs).pname == "combine") { pkgs = []; } (head texlive.collection-latexextra.pkgs).tlDeps;
-    all = concatLists (map (p: p.pkgs or []) (attrValues (removeAttrs texlive [ "bin" "combine" "combined" "tlpdb" ]))) ++ combine.pkgs;
-    fods = filter (p: isDerivation p && p.tlType != "bin") all;
-    errorText = concatMapStrings (p: optionalString (! p ? outputHash) "${p.pname + optionalString (p.tlType != "run") ("." + p.tlType)} does not have a fixed output hash\n") fods;
+    fods = lib.concatMap
+      (p: lib.optional (p ? tex) p.tex
+        ++ lib.optional (p ? texdoc) p.texdoc
+        ++ lib.optional (p ? texsource) p.texsource
+        ++ lib.optional (p ? tlpkg) p.tlpkg)
+      (attrValues texlive.pkgs);
+    errorText = concatMapStrings (p: optionalString (! p ? outputHash) "${p.pname}-${p.tlOutputName} does not have a fixed output hash\n") fods;
  in runCommand "texlive-test-fixed-hashes" {
    inherit errorText;
    passAsFile = [ "errorText" ];
--- a/pkgs/tools/filesystems/stratisd/Cargo.lock
+++ b/pkgs/tools/filesystems/stratisd/Cargo.lock
@ -1149,9 +1149,9 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"

 [[package]]
 name = "rustix"
-version = "0.37.20"
+version = "0.37.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b96e891d04aa506a6d1f318d2771bcb1c7dfda84e126660ace067c9b474bb2c0"
+checksum = "d4eb579851244c2c03e7c24f501c3432bed80b8f720af1d6e5b0e0f01555a035"
 dependencies = [
 "bitflags 1.3.2",
 "errno 0.3.1",
@ -1269,7 +1269,7 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"

 [[package]]
 name = "stratisd"
-version = "3.6.0"
+version = "3.6.1"
 dependencies = [
 "assert_cmd",
 "assert_matches",
--- a/pkgs/tools/filesystems/stratisd/default.nix
+++ b/pkgs/tools/filesystems/stratisd/default.nix
@ -28,13 +28,13 @@

 stdenv.mkDerivation rec {
  pname = "stratisd";
-  version = "3.6.0";
+  version = "3.6.1";

  src = fetchFromGitHub {
    owner = "stratis-storage";
    repo = pname;
    rev = "refs/tags/stratisd-v${version}";
-    hash = "sha256-IDCAhAioFFN4FqgdB6Bp38RG1G3n3NWQTIxK4/1TTFs=";
+    hash = "sha256-qpuJzsN6AXqvKtKBDZZEmviWBpPR0qNuq+3tIHGSWLs=";
  };

  cargoDeps = rustPlatform.importCargoLock {
--- a/pkgs/tools/llm/heygpt/default.nix
+++ b/pkgs/tools/llm/heygpt/default.nix
@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "heygpt";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "fuyufjh";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Gtbb0G7tV+cjbq/74dnZKIwWZgNfSJl0My6F4OmAdhU=";
+    hash = "sha256-gTyjj7NND5IYtnXhc454cWSzhAE+DwfPRGEWrHH+GNM=";
  };

-  cargoSha256 = "sha256-ON6+gU+KsI2QFQjwxPRcbMClaAGrjVJ33mVuf0jSro8=";
+  cargoHash = "sha256-yKHAZpELuUD7wlM3Mi7XvxbKgdU1QxD9hsvIFcj3twE=";

  nativeBuildInputs = [openssl];

--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@ -42,13 +42,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fastfetch";
-  version = "2.1.2";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "fastfetch-cli";
    repo = "fastfetch";
    rev = finalAttrs.version;
-    hash = "sha256-v/dFynTESqRWAxu5Wz0/EroXuwmNj3EEPJxzpfTGKtk=";
+    hash = "sha256-H2iIL41h3o8184S/XMYAuIDPVJPm+zSI/YX8FT8vLio=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/misc/fw/default.nix
+++ b/pkgs/tools/misc/fw/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "fw";
-  version = "2.17.1";
+  version = "2.18.0";

  src = fetchFromGitHub {
    owner = "brocode";
    repo = "fw";
    rev = "v${version}";
-    hash = "sha256-8Jq7VjTKwq8n9lrwTzazkkrq8/mNacFTwz/M+eAwBWM=";
+    hash = "sha256-8PcIaSXmk6/p5N6L2/nLrFS6JUZRRJsN2mKQYtevS6s=";
  };

-  cargoHash = "sha256-tIrACx4KRjfxLyxTiP32PpdN8NegaHBIkINsPGgygVQ=";
+  cargoHash = "sha256-l6mRjVk3qNAxfNqcKGo2dceD2Xb+hk+xMvdh/U1jZXw=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/tools/misc/mapcidr/default.nix
+++ b/pkgs/tools/misc/mapcidr/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "mapcidr";
-  version = "1.1.13";
+  version = "1.1.14";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-ggfk9ceogvTP0Q1RzA6tZgEj+iVVuGa+MU0zSZfO2ZI=";
+    hash = "sha256-Vhh/OS61dfArsowXMogr/bu/gg354nte9PuobD9lCaU=";
  };

  vendorHash = "sha256-wqbAOoRQEE7CDmaH5MRzsSKOdyrxwBY/1wDz3MCfsBc=";
--- a/pkgs/tools/misc/twm/default.nix
+++ b/pkgs/tools/misc/twm/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "twm";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "vinnymeller";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Q8WdNmO5uSm4PvitBXQ7YEkjJhlCz4qfJO/F6+XckXY=";
+    sha256 = "sha256-icJQSPt3733H5pIdnpC/Vx+u6LgwokCdbvE3wvDkIlw=";
  };

-  cargoHash = "sha256-fxDUUfC7mBgVHN+M6pb5leRp28wzO69ZdStdYmQFxQE=";
+  cargoHash = "sha256-DxT3Wsiy4zVlTSJwHqV/McSi/pc9pB0wyWY54fj1zVE=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
--- a/pkgs/tools/misc/wakapi/default.nix
+++ b/pkgs/tools/misc/wakapi/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "wakapi";
-  version = "2.9.1";
+  version = "2.9.2";

  src = fetchFromGitHub {
    owner = "muety";
    repo = pname;
    rev = version;
-    sha256 = "sha256-uTDvipz08hrdFB/gAoxVp4Eesh57HOFUG4AD/5T33H8=";
+    sha256 = "sha256-BRIcStqRzwoFG9HkWBpfumeCzbrSI0Hg//a0iDQtNw8=";
  };

  vendorHash = "sha256-SqkE4vTT+QoLhKrQcGa2L5WmD+fCX7vli4FjgwLnqjg=";
@ -16,6 +16,9 @@ buildGoModule rec {
  # Not a go module required by the project, contains development utilities
  excludedPackages = [ "scripts" ];

+  # Fix up reported version
+  postPatch = ''echo ${version} > version.txt'';
+
  ldflags = [
    "-s"
    "-w"
--- a/pkgs/tools/networking/grpc_cli/default.nix
+++ b/pkgs/tools/networking/grpc_cli/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "grpc_cli";
-  version = "1.59.1";
+  version = "1.59.2";
  src = fetchFromGitHub {
    owner = "grpc";
    repo = "grpc";
    rev = "v${version}";
-    hash = "sha256-4bou7oFQOgyxjFqJdmiFT8xEMCsOap9v34W6SPrT4WQ=";
+    hash = "sha256-ZWVXoup+gpELOsdCg36swiJFeDdioR/cHkDV68OWsso=";
    fetchSubmodules = true;
  };
  nativeBuildInputs = [ automake cmake autoconf ];
--- a/pkgs/tools/networking/kapp/default.nix
+++ b/pkgs/tools/networking/kapp/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kapp";
-  version = "0.59.0";
+  version = "0.59.1";

  src = fetchFromGitHub {
    owner = "carvel-dev";
    repo = "kapp";
    rev = "v${version}";
-    sha256 = "sha256-I+BXKJvilrYvSi2xevZKFE49emghg19dCpW/bbIcZ8o=";
+    sha256 = "sha256-0fvcBJzJB3o9gQiFfm9+qGTWcoJY2X4AR2XR8RRjerg=";
  };

  vendorHash = null;
--- a/pkgs/tools/networking/wavemon/default.nix
+++ b/pkgs/tools/networking/wavemon/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "wavemon";
-  version = "0.9.4";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "uoaerg";
    repo = "wavemon";
    rev = "v${version}";
-    sha256 = "0s3yz15vzx90fxyb8bgryksn0cr2gpz9inbcx4qjrgs7zfbm4pgh";
+    sha256 = "sha256-MvIFuPATI0Y7aIYZkb2Yr+iCco4gILHhDU5FWeMCk5Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/system/ttop/default.nix
+++ b/pkgs/tools/system/ttop/default.nix
@ -2,14 +2,14 @@

 nimPackages.buildNimPackage (finalAttrs: {
  pname = "ttop";
-  version = "1.2.6";
+  version = "1.2.7";
  nimBinOnly = true;

  src = fetchFromGitHub {
    owner = "inv2004";
    repo = "ttop";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-rTvEL9MkRJuynu50g8TXitYKnfXsa6PpkfEDaX0nfJs=";
+    hash = "sha256-oPdaUqh6eN1X5kAYVvevOndkB/xnQng9QVLX9bu5P5E=";
  };

  buildInputs = with nimPackages; [ asciigraph illwill jsony parsetoml zippy ];
--- a/pkgs/tools/typesetting/biber-ms/default.nix
+++ b/pkgs/tools/typesetting/biber-ms/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, fetchurl, perlPackages, shortenPerlShebang, texlive }:

 let
-  biberSource = lib.head (builtins.filter (p: p.tlType == "source") texlive.biber-ms.pkgs);
+  biberSource = texlive.pkgs.biber-ms.texsource;
  # missing test file
  multiscriptBltxml = (fetchFromGitHub {
    owner = "plk";
@ -12,8 +12,7 @@ let
 in

 perlPackages.buildPerlModule {
-  pname = "biber-ms";
-  inherit (biberSource) version;
+  inherit (biberSource) pname version;

  src = "${biberSource}/source/bibtex/biber-ms/biblatex-biber-ms.tar.gz";

--- a/pkgs/tools/typesetting/biber/default.nix
+++ b/pkgs/tools/typesetting/biber/default.nix
@ -1,12 +1,11 @@
 { lib, stdenv, fetchurl, perlPackages, shortenPerlShebang, texlive }:

 let
-  biberSource = lib.head (builtins.filter (p: p.tlType == "source") texlive.biber.pkgs);
+  biberSource = texlive.pkgs.biber.texsource;
 in

 perlPackages.buildPerlModule {
-  pname = "biber";
-  inherit (biberSource) version;
+  inherit (biberSource) pname version;

  src = "${biberSource}/source/bibtex/biber/biblatex-biber.tar.gz";

--- a/pkgs/tools/typesetting/tex/mftrace/default.nix
+++ b/pkgs/tools/typesetting/tex/mftrace/default.nix
@ -43,11 +43,7 @@ stdenv.mkDerivation (finalAttrs: rec {

  # experimental texlive.combine support
  # (note that only the bin/ folder will be combined into texlive)
-  passthru = {
-    tlType = "bin";
-    tlDeps = with texlive; [ kpathsea t1utils metafont ];
-    pkgs = [ finalAttrs.finalPackage ];
-  };
+  passthru.tlDeps = with texlive; [ kpathsea t1utils metafont ];

  meta = with lib; {
    description = "Scalable PostScript Fonts for MetaFont";
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@ -355,7 +355,7 @@ pygmentex = python3Packages.buildPythonApplication rec {
  inherit (src) version;
  format = "other";

-  src = assertFixedHash pname (lib.head (builtins.filter (p: p.tlType == "run") texlive.pygmentex.pkgs));
+  src = assertFixedHash pname texlive.pkgs.pygmentex.tex;

  propagatedBuildInputs = with python3Packages; [ pygments chardet ];

@ -436,7 +436,7 @@ xdvi = stdenv.mkDerivation {

 xpdfopen = stdenv.mkDerivation {
  pname = "texlive-xpdfopen.bin";
-  inherit (lib.head texlive.xpdfopen.pkgs) version;
+  inherit (texlive.pkgs.xpdfopen) version;

  inherit (common) src;

--- a/pkgs/tools/typesetting/tex/texlive/build-tex-env.nix
+++ b/pkgs/tools/typesetting/tex/texlive/build-tex-env.nix
@ -1,55 +1,125 @@
-{ lib, buildEnv, runCommand, writeText, makeWrapper, libfaketime, makeFontsConf
-, perl, bash, coreutils, gnused, gnugrep, gawk, ghostscript
-, bin, tl }:
-# combine =
-args@{
-  pkgFilter ? (pkg: pkg.tlType == "run" || pkg.tlType == "bin" || pkg.pname == "core"
-                    || pkg.hasManpages or false)
-, extraName ? "combined"
-, extraVersion ? ""
-, ...
+{
+  # texlive package set
+  tl
+, bin
+
+, lib
+, buildEnv
+, libfaketime
+, makeFontsConf
+, makeWrapper
+, runCommand
+, writeShellScript
+, writeText
+, toTLPkgSets
+, bash
+, perl
+
+  # common runtime dependencies
+, coreutils
+, gawk
+, gnugrep
+, gnused
+, ghostscript
 }:
+
+lib.fix (self: {
+  withDocs ? false
+, withSources ? false
+, requiredTeXPackages ? ps: [ ps.scheme-infraonly ]
+
+### texlive.combine backward compatibility
+, __extraName ? "combined"
+, __extraVersion ? ""
+# emulate the old texlive.combine (e.g. add man pages to main output)
+, __combine ? false
+# adjust behavior further if called from the texlive.combine wrapper
+, __fromCombineWrapper ? false
+}@args:
+
 let
-  # combine a set of TL packages into a single TL meta-package
-  combinePkgs = pkgList: lib.catAttrs "pkg" (
-    let
-      # a TeX package is an attribute set { pkgs = [ ... ]; ... } where pkgs is a list of derivations
-      # the derivations make up the TeX package and optionally (for backward compatibility) its dependencies
-      tlPkgToSets = { pkgs, ... }: map ({ tlType, version ? "", outputName ? "", ... }@pkg: {
-          # outputName required to distinguish among bin.core-big outputs
-          key = "${pkg.pname or pkg.name}.${tlType}-${version}-${outputName}";
-          inherit pkg;
-        }) pkgs;
-      pkgListToSets = lib.concatMap tlPkgToSets; in
-    builtins.genericClosure {
-      startSet = pkgListToSets pkgList;
-      operator = { pkg, ... }: pkgListToSets (pkg.tlDeps or []);
+  ### texlive.combine backward compatibility
+  # if necessary, convert old style { pkgs = [ ... ]; } packages to attribute sets
+  ensurePkgSets = ps: if ! __fromCombineWrapper && builtins.any (p: p ? pkgs && builtins.all (p: p ? tlType) p.pkgs) ps
+    then let oldStyle = builtins.partition (p: p ? pkgs && builtins.all (p: p ? tlType) p.pkgs) ps;
+      in oldStyle.wrong ++ lib.concatMap toTLPkgSets oldStyle.right
+    else ps;
+
+  pkgList = rec {
+    # resolve dependencies of the packages that affect the runtime
+    all =
+      let
+        # order of packages is irrelevant
+        packages = builtins.sort (a: b: a.pname < b.pname) (ensurePkgSets (requiredTeXPackages tl));
+        runtime = builtins.partition
+          (p: p.outputSpecified or false -> builtins.elem (p.tlOutputName or p.outputName) [ "out" "tex" "tlpkg" ])
+          packages;
+        keySet = p: {
+          key = ((p.name or "${p.pname}-${p.version}") + "-" + p.tlOutputName or p.outputName or "");
+          inherit p;
+          tlDeps = p.tlDeps or (p.requiredTeXPackages or (_: [ ]) [ ]);
+        };
+      in
+      # texlive.combine: the wrapper already resolves all dependencies
+      if __fromCombineWrapper then requiredTeXPackages null else
+        builtins.catAttrs "p" (builtins.genericClosure {
+          startSet = map keySet runtime.right;
+          operator = p: map keySet p.tlDeps;
+        }) ++ runtime.wrong;
+
+    # group the specified outputs
+    specified = builtins.partition (p: p.outputSpecified or false) all;
+    specifiedOutputs = builtins.groupBy (p: p.tlOutputName or p.outputName) specified.right;
+    otherOutputNames = builtins.catAttrs "key" (builtins.genericClosure {
+      startSet = map (key: { inherit key; }) (lib.concatLists (builtins.catAttrs "outputs" specified.wrong));
+      operator = _: [ ];
+    });
+    otherOutputs = lib.genAttrs otherOutputNames (n: builtins.catAttrs n specified.wrong);
+    outputsToInstall = builtins.catAttrs "key" (builtins.genericClosure {
+      startSet = map (key: { inherit key; })
+        ([ "out" ] ++ lib.optional (splitOutputs ? man) "man"
+          ++ lib.concatLists (builtins.catAttrs "outputsToInstall" (builtins.catAttrs "meta" specified.wrong)));
+      operator = _: [ ];
    });

-  pkgSet = removeAttrs args [ "pkgFilter" "extraName" "extraVersion" ];
-  pkgList = rec {
-    combined = combinePkgs (lib.attrValues pkgSet);
-    all = lib.filter pkgFilter combined;
-    splitBin = builtins.partition (p: p.tlType == "bin") all;
-    bin = splitBin.right;
-    nonbin = splitBin.wrong;
-    tlpkg = lib.filter (pkg: pkg.tlType == "tlpkg") combined;
+    # split binary and tlpkg from tex, texdoc, texsource
+    bin = if __fromCombineWrapper
+      then builtins.filter (p: p.tlType == "bin") all # texlive.combine: legacy filter
+      else otherOutputs.out or [ ] ++ specifiedOutputs.out or [ ];
+    tlpkg = if __fromCombineWrapper
+      then builtins.filter (p: p.tlType == "tlpkg") all # texlive.combine: legacy filter
+      else otherOutputs.tlpkg or [ ] ++ specifiedOutputs.tlpkg or [ ];
+
+    nonbin = if __fromCombineWrapper then builtins.filter (p: p.tlType != "bin" && p.tlType != "tlpkg") all # texlive.combine: legacy filter
+      else (if __combine then # texlive.combine: emulate old input ordering to avoid rebuilds
+        lib.concatMap (p: lib.optional (p ? tex) p.tex
+          ++ lib.optional ((withDocs || p ? man) && p ? texdoc) p.texdoc
+          ++ lib.optional (withSources && p ? texsource) p.texsource) specified.wrong
+        else otherOutputs.tex or [ ]
+          ++ lib.optionals withDocs (otherOutputs.texdoc or [ ])
+          ++ lib.optionals withSources (otherOutputs.texsource or [ ]))
+        ++ specifiedOutputs.tex or [ ] ++ specifiedOutputs.texdoc or [ ] ++ specifiedOutputs.texsource or [ ];
+
+    # outputs that do not become part of the environment
+    nonEnvOutputs = lib.subtractLists [ "out" "tex" "texdoc" "texsource" "tlpkg" ] otherOutputNames;
  };
+
  # list generated by inspecting `grep -IR '\([^a-zA-Z]\|^\)gs\( \|$\|"\)' "$TEXMFDIST"/scripts`
  # and `grep -IR rungs "$TEXMFDIST"`
  # and ignoring luatex, perl, and shell scripts (those must be patched using postFixup)
  needsGhostscript = lib.any (p: lib.elem p.pname [ "context" "dvipdfmx" "latex-papersize" "lyluatex" ]) pkgList.bin;

-  name = "texlive-${extraName}-${bin.texliveYear}${extraVersion}";
+  name = if __combine then "texlive-${__extraName}-${bin.texliveYear}${__extraVersion}" # texlive.combine: old name name
+    else "texlive-${bin.texliveYear}-env";

  texmfdist = (buildEnv {
    name = "${name}-texmfdist";

    # remove fake derivations (without 'outPath') to avoid undesired build dependencies
-    paths = lib.catAttrs "outPath" pkgList.nonbin;
+    paths = builtins.catAttrs "outPath" pkgList.nonbin;

    # mktexlsr
-    nativeBuildInputs = [ (lib.last tl."texlive.infra".pkgs) ];
+    nativeBuildInputs = [ tl."texlive.infra" ];

    postBuild = # generate ls-R database
    ''
@ -61,7 +131,7 @@ let
    name = "${name}-tlpkg";

    # remove fake derivations (without 'outPath') to avoid undesired build dependencies
-    paths = lib.catAttrs "outPath" pkgList.tlpkg;
+    paths = builtins.catAttrs "outPath" pkgList.tlpkg;
  }).overrideAttrs (_: { allowSubstitutes = true; });

  # the 'non-relocated' packages must live in $TEXMFROOT/texmf-dist
@ -74,7 +144,7 @@ let
    ln -s "$tlpkg" "$out"/tlpkg
  '';

-  # expose info and man pages in usual /share/{info,man} location
+  # texlive.combine: expose info and man pages in usual /share/{info,man} location
  doc = buildEnv {
    name = "${name}-doc";

@ -87,14 +157,67 @@ let
    ];
  };

-in (buildEnv {
+  meta = {
+    description = "TeX Live environment"
+      + lib.optionalString withDocs " with documentation"
+      + lib.optionalString (withDocs && withSources) " and"
+      + lib.optionalString withSources " with sources";
+    platforms = lib.platforms.all;
+    longDescription = "Contains the following packages and their transitive dependencies:\n - "
+      + lib.concatMapStringsSep "\n - "
+          (p: p.pname + (lib.optionalString (p.outputSpecified or false) " (${p.tlOutputName or p.outputName})"))
+          (requiredTeXPackages tl);
+  };
+
+  # emulate split output derivation
+  splitOutputs = {
+    out = out // { outputSpecified = true; };
+    texmfdist = texmfdist // { outputSpecified = true; };
+    texmfroot = texmfroot // { outputSpecified = true; };
+  } // (lib.genAttrs pkgList.nonEnvOutputs (outName: (buildEnv {
+    inherit name;
+    paths = builtins.catAttrs "outPath"
+      (pkgList.otherOutputs.${outName} or [ ] ++ pkgList.specifiedOutputs.${outName} or [ ]);
+    # force the output to be ${outName} or nix-env will not work
+    nativeBuildInputs = [ (writeShellScript "force-output.sh" ''
+      export out="''${${outName}-}"
+    '') ];
+    inherit meta passthru;
+  }).overrideAttrs { outputs = [ outName ]; } // { outputSpecified = true; }));
+
+  passthru = lib.optionalAttrs (! __combine) (splitOutputs // {
+    all = builtins.attrValues splitOutputs;
+    outputs = [ "out" ] ++ pkgList.nonEnvOutputs;
+  }) // {
+    # This is set primarily to help find-tarballs.nix to do its job
+    requiredTeXPackages = builtins.filter lib.isDerivation (pkgList.bin ++ pkgList.nonbin
+      ++ lib.optionals (! __fromCombineWrapper)
+        (lib.concatMap (n: (pkgList.otherOutputs.${n} or [ ] ++ pkgList.specifiedOutputs.${n} or [ ]))) pkgList.nonEnvOutputs);
+    # useful for inclusion in the `fonts.packages` nixos option or for use in devshells
+    fonts = "${texmfroot}/texmf-dist/fonts";
+    # support variants attrs, (prev: attrs)
+    __overrideTeXConfig = newArgs:
+      let appliedArgs = if builtins.isFunction newArgs then newArgs args else newArgs; in
+        self (args // { __fromCombineWrapper = false; } // appliedArgs);
+    withPackages = reqs: self (args // { requiredTeXPackages = ps: requiredTeXPackages ps ++ reqs ps; __fromCombineWrapper = false; });
+  };
+
+  out = (if (! __combine)
+    # meta.outputsToInstall = [ "out" "man" ] is invalid within buildEnv:
+    # checkMeta will notice that there is no actual "man" output, and fail
+    # so we set outputsToInstall from the outside, where it is safe
+    then lib.addMetaAttrs { inherit (pkgList) outputsToInstall; }
+    else x: x) # texlive.combine: man pages used to be part of out
+# no indent for git diff purposes
+((buildEnv {

  inherit name;

  ignoreCollisions = false;

  # remove fake derivations (without 'outPath') to avoid undesired build dependencies
-  paths = lib.catAttrs "outPath" pkgList.bin ++ [ doc ];
+  paths = builtins.catAttrs "outPath" pkgList.bin
+    ++ lib.optional __combine doc;
  pathsToLink = [
    "/"
    "/share/texmf-var/scripts"
@ -107,18 +230,13 @@ in (buildEnv {
  nativeBuildInputs = [
    makeWrapper
    libfaketime
-    (lib.last tl."texlive.infra".pkgs) # mktexlsr
-    (lib.last tl.texlive-scripts.pkgs) # fmtutil, updmap
-    (lib.last tl.texlive-scripts-extra.pkgs) # texlinks
+    tl."texlive.infra" # mktexlsr
+    tl.texlive-scripts # fmtutil, updmap
+    tl.texlive-scripts-extra # texlinks
    perl
  ];

-  passthru = {
-    # This is set primarily to help find-tarballs.nix to do its job
-    packages = pkgList.all;
-    # useful for inclusion in the `fonts.packages` nixos option or for use in devshells
-    fonts = "${texmfroot}/texmf-dist/fonts";
-  };
+  inherit meta passthru;

  postBuild =
    # environment variables (note: only export the ones that are used in the wrappers)
@ -131,7 +249,7 @@ in (buildEnv {
    export TEXMFCNF="$TEXMFSYSVAR/web2c"
  '' +
    # wrap executables with required env vars as early as possible
-    # 1. we want texlive.combine to use the wrapped binaries, to catch bugs
+    # 1. we use the wrapped binaries in the scripts below, to catch bugs
    # 2. we do not want to wrap links generated by texlinks
  ''
    enable -f '${bash}/lib/bash/realpath' realpath
@ -195,16 +313,16 @@ in (buildEnv {
  '' +
    # now filter hyphenation patterns and formats
  (let
-    hyphens = lib.filter (p: p.hasHyphens or false && p.tlType == "run") pkgList.splitBin.wrong;
+    hyphens = lib.filter (p: p.hasHyphens or false && p.tlOutputName or p.outputName == "tex") pkgList.nonbin;
    hyphenPNames = map (p: p.pname) hyphens;
-    formats = lib.filter (p: p ? formats && p.tlType == "run") pkgList.splitBin.wrong;
+    formats = lib.filter (p: p ? formats && p.tlOutputName or p.outputName == "tex") pkgList.nonbin;
    formatPNames = map (p: p.pname) formats;
    # sed expression that prints the lines in /start/,/end/ except for /end/
    section = start: end: "/${start}/,/${end}/{ /${start}/p; /${end}/!p; };\n";
    script =
      writeText "hyphens.sed" (
        # document how the file was generated (for language.dat)
-        "1{ s/^(% Generated by .*)$/\\1, modified by texlive.combine/; p; }\n"
+        "1{ s/^(% Generated by .*)$/\\1, modified by ${if __combine then "texlive.combine" else "Nixpkgs"}/; p; }\n"
        # pick up the header
        + "2,/^% from/{ /^% from/!p; };\n"
        # pick up all sections matching packages that we combine
@ -214,7 +332,7 @@ in (buildEnv {
      );
    scriptLua =
      writeText "hyphens.lua.sed" (
-        "1{ s/^(-- Generated by .*)$/\\1, modified by texlive.combine/; p; }\n"
+        "1{ s/^(-- Generated by .*)$/\\1, modified by ${if __combine then "texlive.combine" else "Nixpkgs"}/; p; }\n"
        + "2,/^-- END of language.us.lua/p;\n"
        + lib.concatMapStrings (pname: section "^-- from ${pname}:$" "^}$|^-- from") hyphenPNames
        + "$p;\n"
@ -225,7 +343,7 @@ in (buildEnv {
    fmtutilSed =
      writeText "fmtutil.sed" (
        # document how file was generated
-        "1{ s/^(# Generated by .*)$/\\1, modified by texlive.combine/; }\n"
+        "1{ s/^(# Generated by .*)$/\\1, modified by ${if __combine then "texlive.combine" else "Nixpkgs"}/; }\n"
        # disable all formats, even those already disabled
        + "s/^([^#]|#! )/#! \\1/;\n"
        # enable the formats from the packages being installed
@ -312,4 +430,5 @@ in (buildEnv {
    ln -s "$TEXMFDIST" "$out"/share/texmf
  ''
  ;
-}).overrideAttrs (_: { allowSubstitutes = true; })
+}).overrideAttrs (_: { allowSubstitutes = true; }));
+in out)
--- a/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
+++ b/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
@ -15,17 +15,27 @@
 , texliveBinaries
 }:

+/* Convert an attribute set extracted from tlpdb.nix (with the deps attribute
+  already processed) to a fake multi-output derivation with possible outputs
+  [ "tex" "texdoc" "texsource" "tlpkg" "out" "man" "info" ]
+*/
+
+# TODO stabilise a generic interface decoupled from the finer details of the
+# translation from texlive.tlpdb to tlpdb.nix
 { pname
 , revision
 , version ? toString revision
+, extraRevision ? ""
+, extraVersion ? ""
 , sha512
 , mirrors
-, extraVersion ? ""
 , fixedHashes ? { }
 , postUnpack ? ""
+, postFixup ? ""
 , stripPrefix ? 1
 , license ? [ ]
 , hasHyphens ? false
+, hasInfo ? false
 , hasManpages ? false
 , hasRunfiles ? false
 , hasTlpkg ? false
@ -34,112 +44,165 @@
 }@args:

 let
-  meta = { license = map (x: lib.licenses.${x}) license; };
-
-  commonPassthru = {
-    inherit pname revision version;
-  } // lib.optionalAttrs (args ? extraRevision) {
-    inherit (args) extraRevision;
+  # common metadata
+  name = "${pname}-${version}${extraVersion}";
+  meta = {
+    license = map (x: lib.licenses.${x}) license;
+    # TeX Live packages should not be installed directly into the user profile
+    outputsToInstall = [ ];
  };

+  hasBinfiles = args ? binfiles && args.binfiles != [ ];
+  hasDocfiles = sha512 ? doc;
+  hasSource = sha512 ? source;
+
+  # emulate drv.all, drv.outputs lists
+  all = lib.optional hasBinfiles bin ++
+    lib.optional hasRunfiles tex ++
+    lib.optional hasDocfiles texdoc ++
+    lib.optional hasSource texsource ++
+    lib.optional hasTlpkg tlpkg ++
+    lib.optional hasManpages man ++
+    lib.optional hasInfo info;
+  outputs = lib.catAttrs "tlOutputName" all;
+
+  mainDrv = if hasBinfiles then bin
+    else if hasRunfiles then tex
+    else if hasTlpkg then tlpkg
+    else if hasDocfiles then texdoc
+    else if hasSource then texsource
+    else tex; # fall back to attrset tex if there is no derivation
+
+  # emulate multi-output derivation plus additional metadata
+  # (out is handled in mkContainer)
+  passthru = {
+    inherit all outputs pname;
+    revision = toString revision + extraRevision;
+    version = version + extraVersion;
+    outputSpecified = true;
+    inherit tex;
+  } // lib.optionalAttrs (args ? deps) { tlDeps = args.deps; }
+  // lib.optionalAttrs (args ? formats) { inherit (args) formats; }
+  // lib.optionalAttrs hasHyphens { inherit hasHyphens; }
+  // lib.optionalAttrs (args ? postactionScript) { inherit (args) postactionScript; }
+  // lib.optionalAttrs hasDocfiles { texdoc = texdoc; }
+  // lib.optionalAttrs hasSource { texsource = texsource; }
+  // lib.optionalAttrs hasTlpkg { tlpkg = tlpkg; }
+  // lib.optionalAttrs hasManpages { man = man; }
+  // lib.optionalAttrs hasInfo { info = info; };
+
  # build run, doc, source, tlpkg containers
-  mkContainer = tlType: passthru: sha512:
+  mkContainer = tlType: tlOutputName: sha512:
    let
-      # NOTE: the fixed naming scheme must match generated-fixed-hashes.nix
-      # the basename used by upstream (without ".tar.xz" suffix)
-      urlName = pname + (lib.optionalString (tlType != "run" && tlType != "tlpkg") ".${tlType}");
-      # name + version for the derivation
-      tlName = urlName + (lib.optionalString (tlType == "tlpkg") ".tlpkg") + "-${version}${extraVersion}";
      fixedHash = fixedHashes.${tlType} or null; # be graceful about missing hashes
-
-      urls = args.urls or (if args ? url then [ args.url ] else
-      map (up: "${up}/archive/${urlName}.r${toString revision}.tar.xz") mirrors);
+      # the basename used by upstream (without ".tar.xz" suffix)
+      # tlpkg is not a true container but a subfolder of the run container
+      urlName = pname + (lib.optionalString (tlType != "run" && tlType != "tlpkg") ".${tlType}");
+      urls = map (up: "${up}/archive/${urlName}.r${toString revision}.tar.xz") mirrors;
+      # TODO switch to simpler "${name}-${tlOutputName}" (requires new fixed hashes)
+      container = runCommand "texlive-${pname}${lib.optionalString (tlType != "run") ".${tlType}"}-${version}${extraVersion}"
+        ({
+          src = fetchurl { inherit urls sha512; };
+          # save outputName as fixed output derivations cannot change nor override outputName
+          passthru = passthru // { inherit tlOutputName; };
+          # TODO remove tlType from derivation (requires a rebuild)
+          inherit meta stripPrefix tlType;
+        } // lib.optionalAttrs (fixedHash != null) {
+          outputHash = fixedHash;
+          outputHashAlgo = "sha256";
+          outputHashMode = "recursive";
+        })
+        (''
+          mkdir "$out"
+          if [[ "$tlType"  == "tlpkg" ]]; then
+            tar -xf "$src" \
+              --strip-components=1 \
+              -C "$out" --anchored --exclude=tlpkg/tlpobj --keep-old-files \
+              tlpkg
+          else
+            tar -xf "$src" \
+              --strip-components="$stripPrefix" \
+              -C "$out" --anchored --exclude=tlpkg --keep-old-files
+          fi
+        '' + postUnpack);
    in
-    runCommand "texlive-${tlName}"
-      ({
-        src = fetchurl { inherit urls sha512; };
-        inherit meta passthru stripPrefix tlType;
-      } // lib.optionalAttrs (fixedHash != null) {
-        outputHash = fixedHash;
-        outputHashAlgo = "sha256";
-        outputHashMode = "recursive";
-      })
-      (''
-        mkdir "$out"
-        if [[ "$tlType"  == "tlpkg" ]]; then
-          tar -xf "$src" \
-            --strip-components=1 \
-            -C "$out" --anchored --exclude=tlpkg/tlpobj --keep-old-files \
-            tlpkg
-        else
-          tar -xf "$src" \
-            --strip-components="$stripPrefix" \
-            -C "$out" --anchored --exclude=tlpkg --keep-old-files
-        fi
-      '' + postUnpack);
+    # remove the standard drv.out, optionally replace it with the bin container
+    builtins.removeAttrs container [ "out" ] // lib.optionalAttrs hasBinfiles { out = bin; };

-  tex = [
-    (
-      let passthru = commonPassthru
-        // lib.optionalAttrs (args ? deps) { tlDeps = args.deps; }
-        // lib.optionalAttrs (args ? formats) { inherit (args) formats; }
-        // lib.optionalAttrs hasHyphens { inherit hasHyphens; }; in
-      if hasRunfiles then mkContainer "run" passthru sha512.run
-      else (passthru // { tlType = "run"; })
-    )
-  ];
+  tex =
+    if hasRunfiles then mkContainer "run" "tex" sha512.run
+    else passthru
+      // { inherit meta; tlOutputName = "tex"; }
+      // lib.optionalAttrs hasBinfiles { out = bin; };

-  doc = let passthru = commonPassthru
-    // lib.optionalAttrs hasManpages { inherit hasManpages; }; in
-    lib.optional (sha512 ? doc) (mkContainer "doc" passthru sha512.doc);
+  texdoc = mkContainer "doc" "texdoc" sha512.doc;

-  source = lib.optional (sha512 ? source) (mkContainer "source" commonPassthru sha512.source);
+  texsource = mkContainer "source" "texsource" sha512.source;

-  tlpkg = let passthru = commonPassthru
-    // lib.optionalAttrs (args ? postactionScript) { postactionScript = args.postactionScript; }; in
-    lib.optional hasTlpkg (mkContainer "tlpkg" passthru sha512.run);
+  tlpkg = mkContainer "tlpkg" "tlpkg" sha512.run;

-  bin = lib.optional (args ? binfiles && args.binfiles != [ ]) (
-    let
-      # find interpreters for the script extensions found in tlpdb
-      extToInput = {
-        jar = jdk;
-        lua = texliveBinaries.luatex;
-        py = python3;
-        rb = ruby;
-        sno = snobol4;
-        tcl = tk;
-        texlua = texliveBinaries.luatex;
-        tlu = texliveBinaries.luatex;
-      };
-      run = lib.head tex;
-    in
-    runCommand "texlive-${pname}.bin-${version}"
-      {
-        passthru = commonPassthru // { tlType = "bin"; };
-        inherit meta;
-        # shebang interpreters and compiled binaries
-        buildInputs = let outName = builtins.replaceStrings [ "-" ] [ "_" ] pname; in
-          [ texliveBinaries.core.${outName} or null
-            texliveBinaries.${pname} or null
-            texliveBinaries.core-big.${outName} or null ]
-          ++ (args.extraBuildInputs or [ ]) ++ [ bash perl ]
-          ++ (lib.attrVals (args.scriptExts or [ ]) extToInput);
-        nativeBuildInputs = extraNativeBuildInputs;
-        # absolute scripts folder
-        scriptsFolder = lib.optionalString (run ? outPath) (run.outPath + "/scripts/" + args.scriptsFolder or pname);
-        # binaries info
-        inherit (args) binfiles;
-        binlinks = builtins.attrNames (args.binlinks or { });
-        bintargets = builtins.attrValues (args.binlinks or { });
-        # build scripts
-        patchScripts = ./patch-scripts.sed;
-        makeBinContainers = ./make-bin-containers.sh;
-      }
-      ''
-        . "$makeBinContainers"
-        ${args.postFixup or ""}
-      ''
-  );
+  # build bin container
+  extToInput = {
+    # find interpreters for the script extensions found in tlpdb
+    jar = jdk;
+    lua = texliveBinaries.luatex;
+    py = python3;
+    rb = ruby;
+    sno = snobol4;
+    tcl = tk;
+    texlua = texliveBinaries.luatex;
+    tlu = texliveBinaries.luatex;
+  };
+
+  # TODO switch to simpler "${name}" (requires a rebuild)
+  bin = runCommand "texlive-${pname}.bin-${version}"
+    {
+      inherit meta;
+      passthru = passthru // { tlOutputName = "out"; };
+      # shebang interpreters
+      buildInputs =let outName = builtins.replaceStrings [ "-" ] [ "_" ] pname; in
+        [ texliveBinaries.core.${outName} or null
+          texliveBinaries.${pname} or null
+          texliveBinaries.core-big.${outName} or null ]
+        ++ (args.extraBuildInputs or [ ]) ++ [ bash perl ]
+        ++ (lib.attrVals (args.scriptExts or [ ]) extToInput);
+      nativeBuildInputs = extraNativeBuildInputs;
+      # absolute scripts folder
+      scriptsFolder = lib.optionalString (tex ? outPath) (tex.outPath + "/scripts/" + args.scriptsFolder or pname);
+      # binaries info
+      inherit (args) binfiles;
+      binlinks = builtins.attrNames (args.binlinks or { });
+      bintargets = builtins.attrValues (args.binlinks or { });
+      # build scripts
+      patchScripts = ./patch-scripts.sed;
+      makeBinContainers = ./make-bin-containers.sh;
+    }
+    ''
+      . "$makeBinContainers"
+      ${args.postFixup or ""}
+    '';
+
+  # build man, info containers
+  # TODO switch to simpler "${name}-man" (requires a rebuild)
+  man = builtins.removeAttrs (runCommand "texlive-${pname}.man-${version}${extraVersion}"
+    {
+      inherit meta texdoc;
+      passthru = passthru // { tlOutputName = "man"; };
+    }
+    ''
+      mkdir -p "$out"/share
+      ln -s {"$texdoc"/doc,"$out"/share}/man
+    '') [ "out" ] // lib.optionalAttrs hasBinfiles { out = bin; };
+
+  # TODO switch to simpler "${name}-info" (requires a rebuild)
+  info = builtins.removeAttrs (runCommand "texlive-${pname}.info-${version}${extraVersion}"
+    {
+      inherit meta texdoc;
+      passthru = passthru // { tlOutputName = "info"; };
+    }
+    ''
+      mkdir -p "$out"/share
+      ln -s {"$texdoc"/doc,"$out"/share}/info
+    '') [ "out" ] // lib.optionalAttrs hasBinfiles { out = bin; };
 in
-{ pkgs = tex ++ doc ++ source ++ tlpkg ++ bin; }
+builtins.removeAttrs mainDrv [ "outputSpecified" ]
--- a/pkgs/tools/typesetting/tex/texlive/combine-wrapper.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine-wrapper.nix
@ -0,0 +1,42 @@
+# legacy texlive.combine wrapper
+{ lib, toTLPkgList, toTLPkgSets, buildTeXEnv }:
+args@{
+  pkgFilter ? (pkg: pkg.tlType == "run" || pkg.tlType == "bin" || pkg.pname == "core"
+                    || pkg.hasManpages or false)
+, extraName ? "combined"
+, extraVersion ? ""
+, ...
+}:
+let
+  pkgSet = removeAttrs args [ "pkgFilter" "extraName" "extraVersion" ];
+
+  # combine a set of TL packages into a single TL meta-package
+  combinePkgs = pkgList: lib.catAttrs "pkg" (
+    let
+      # a TeX package used to be an attribute set { pkgs = [ ... ]; ... } where pkgs is a list of derivations
+      # the derivations make up the TeX package and optionally (for backward compatibility) its dependencies
+      tlPkgToSets = drv: map ({ tlType, version ? "", outputName ? "", ... }@pkg: {
+          # outputName required to distinguish among bin.core-big outputs
+          key = "${pkg.pname or pkg.name}.${tlType}-${version}-${outputName}";
+          inherit pkg;
+        }) (drv.pkgs or (toTLPkgList drv));
+      pkgListToSets = lib.concatMap tlPkgToSets; in
+    builtins.genericClosure {
+      startSet = pkgListToSets pkgList;
+      operator = { pkg, ... }: pkgListToSets (pkg.tlDeps or []);
+    });
+  combined = combinePkgs (lib.attrValues pkgSet);
+
+  # convert to specified outputs
+  tlTypeToOut = { run = "tex"; doc = "texdoc"; source = "texsource"; bin = "out"; tlpkg = "tlpkg"; };
+  toSpecified = { tlType, ... }@drv: drv // { outputSpecified = true; tlOutputName = tlTypeToOut.${tlType}; };
+  all = lib.filter pkgFilter combined ++ lib.filter (pkg: pkg.tlType == "tlpkg") combined;
+  converted = builtins.map toSpecified all;
+in
+buildTeXEnv {
+  __extraName = extraName;
+  __extraVersion = extraVersion;
+  requiredTeXPackages = _: converted;
+  __combine = true;
+  __fromCombineWrapper = true;
+}
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@ -2,7 +2,7 @@
  - source: ../../../../../doc/languages-frameworks/texlive.xml
  - current html: https://nixos.org/nixpkgs/manual/#sec-language-texlive
 */
-{ stdenv, lib, fetchurl, runCommand, writeText, buildEnv
+{ stdenv, lib, fetchurl, runCommand, writeShellScript, writeText, buildEnv
 , callPackage, ghostscript_headless, harfbuzz
 , makeWrapper, installShellFiles
 , python3, ruby, perl, tk, jdk, bash, snobol4
@ -22,13 +22,6 @@ let
    tlpdb = overriddenTlpdb;
  };

-  # function for creating a working environment from a set of TL packages
-  combine = import ./combine.nix {
-    inherit bin buildEnv lib makeWrapper writeText runCommand
-      perl libfaketime makeFontsConf bash tl coreutils gawk gnugrep gnused;
-    ghostscript = ghostscript_headless;
-  };
-
  tlpdb = import ./tlpdb.nix;

  tlpdbVersion = tlpdb."00texlive.config";
@ -101,12 +94,108 @@ let
      // lib.optionalAttrs (args ? deps) { deps = map (n: tl.${n}) (args.deps or [ ]); })
  ) overriddenTlpdb;

+  # function for creating a working environment
+  buildTeXEnv = import ./build-tex-env.nix {
+    inherit bin tl;
+    ghostscript = ghostscript_headless;
+    inherit lib buildEnv libfaketime makeFontsConf makeWrapper runCommand
+      writeShellScript writeText toTLPkgSets bash perl coreutils gawk gnugrep gnused;
+  };
+
+  ### texlive.combine compatibility layer:
+  # convert TeX packages to { pkgs = [ ... ]; } lists
+  # respecting specified outputs
+  toTLPkgList = drv: if drv.outputSpecified or false
+    then let tlType = drv.tlType or tlOutToType.${drv.tlOutputName or drv.outputName} or null; in
+      lib.optional (tlType != null) (drv // { inherit tlType; })
+    else [ (drv.tex // { tlType = "run"; }) ] ++
+      lib.optional (drv ? texdoc) (drv.texdoc // { tlType = "doc"; } // lib.optionalAttrs (drv ? man) { hasManpages = true; }) ++
+      lib.optional (drv ? texsource) (drv.texsource // { tlType = "source"; }) ++
+      lib.optional (drv ? tlpkg) (drv.tlpkg // { tlType = "tlpkg"; }) ++
+      lib.optional (drv ? out) (drv.out // { tlType = "bin"; });
+  tlOutToType = { out = "bin"; tex = "run"; texsource = "source"; texdoc = "doc"; tlpkg = "tlpkg"; };
+
+  # convert { pkgs = [ ... ]; } lists to TeX packages
+  # possibly more than one, if pkgs is also used to specify dependencies
+  tlTypeToOut = { run = "tex"; doc = "texdoc"; source = "texsource"; bin = "out"; tlpkg = "tlpkg"; };
+  toSpecifiedNV = p: rec {
+    name = value.tlOutputName;
+    value = builtins.removeAttrs p [ "pkgs" ]
+      // { outputSpecified = true; tlOutputName = tlTypeToOut.${p.tlType}; };
+  };
+  toTLPkgSet = pname: drvs:
+    let set = lib.listToAttrs (builtins.map toSpecifiedNV drvs);
+        mainDrv = set.out or set.tex or set.tlpkg or set.texdoc or set.texsource; in
+    builtins.removeAttrs mainDrv [ "outputSpecified" ];
+  toTLPkgSets = { pkgs, ... }: lib.mapAttrsToList toTLPkgSet
+    (builtins.groupBy (p: p.pname) pkgs);
+
+  # export TeX packages as { pkgs = [ ... ]; } in the top attribute set
+  allPkgLists = lib.mapAttrs (n: drv: { pkgs = toTLPkgList drv; }) tl;
+
+  # function for creating a working environment from a set of TL packages
+  # now a legacy wrapper around buildTeXEnv
+  combine = import ./combine-wrapper.nix { inherit buildTeXEnv lib toTLPkgList toTLPkgSets; };
+
  assertions = with lib;
    assertMsg (tlpdbVersion.year == version.texliveYear) "TeX Live year in texlive does not match tlpdb.nix, refusing to evaluate" &&
    assertMsg (tlpdbVersion.frozen == version.final) "TeX Live final status in texlive does not match tlpdb.nix, refusing to evaluate";

+  # Pre-defined evironment packages for TeX Live schemes,
+  # to make nix-env usage more comfortable and build selected on Hydra.
+
+  # these license lists should be the sorted union of the licenses of the packages the schemes contain.
+  # The correctness of this collation is tested by tests.texlive.licenses
+  licenses = with lib.licenses; {
+    scheme-basic = [ free gfl gpl1Only gpl2 gpl2Plus knuth lgpl21 lppl1 lppl13c mit ofl publicDomain ];
+    scheme-context = [ bsd2 bsd3 cc-by-sa-40 free gfl gfsl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus knuth lgpl2 lgpl21
+      lppl1 lppl13c mit ofl publicDomain x11 ];
+    scheme-full = [ artistic1-cl8 artistic2 asl20 bsd2 bsd3 bsdOriginal cc-by-10 cc-by-40 cc-by-sa-10 cc-by-sa-20
+      cc-by-sa-30 cc-by-sa-40 cc0 fdl13Only free gfl gfsl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus isc knuth
+      lgpl2 lgpl21 lgpl3 lppl1 lppl12 lppl13a lppl13c mit ofl publicDomain x11 ];
+    scheme-gust = [ artistic1-cl8 asl20 bsd2 bsd3 cc-by-40 cc-by-sa-40 cc0 fdl13Only free gfl gfsl gpl1Only gpl2
+      gpl2Plus gpl3 gpl3Plus knuth lgpl2 lgpl21 lppl1 lppl12 lppl13a lppl13c mit ofl publicDomain x11 ];
+    scheme-infraonly = [ gpl2 gpl2Plus lgpl21 ];
+    scheme-medium = [ artistic1-cl8 asl20 bsd2 bsd3 cc-by-40 cc-by-sa-20 cc-by-sa-30 cc-by-sa-40 cc0 fdl13Only
+      free gfl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus isc knuth lgpl2 lgpl21 lgpl3 lppl1 lppl12 lppl13a lppl13c mit ofl
+      publicDomain x11 ];
+    scheme-minimal = [ free gpl1Only gpl2 gpl2Plus knuth lgpl21 lppl1 lppl13c mit ofl publicDomain ];
+    scheme-small = [ asl20 cc-by-40 cc-by-sa-40 cc0 fdl13Only free gfl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus knuth
+      lgpl2 lgpl21 lppl1 lppl12 lppl13a lppl13c mit ofl publicDomain x11 ];
+    scheme-tetex = [ artistic1-cl8 asl20 bsd2 bsd3 cc-by-40 cc-by-sa-10 cc-by-sa-20 cc-by-sa-30 cc-by-sa-40 cc0
+      fdl13Only free gfl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus isc knuth lgpl2 lgpl21 lgpl3 lppl1 lppl12 lppl13a
+      lppl13c mit ofl publicDomain x11];
+  };
+
+  meta = {
+    description = "TeX Live environment";
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers;  [ veprbl ];
+    license = licenses.scheme-infraonly;
+  };
+
+  combined = recurseIntoAttrs (
+    lib.genAttrs [ "scheme-basic" "scheme-context" "scheme-full" "scheme-gust" "scheme-infraonly"
+      "scheme-medium" "scheme-minimal" "scheme-small" "scheme-tetex" ]
+      (pname:
+        (buildTeXEnv {
+          __extraName = "combined" + lib.removePrefix "scheme" pname;
+          __extraVersion = with version; if final then "-final" else ".${year}${month}${day}";
+          requiredTeXPackages = ps: [ ps.${pname} ];
+          # to maintain full backward compatibility, enable texlive.combine behavior
+          __combine = true;
+        }).overrideAttrs {
+          meta = meta // {
+            description = "TeX Live environment for ${pname}";
+            license = licenses.${pname};
+          };
+        }
+      )
+  );
+
 in
-  tl // {
+  allPkgLists // {
+    pkgs = tl;

    tlpdb = {
      # nested in an attribute set to prevent them from appearing in search
@ -116,55 +205,13 @@ in

    bin = assert assertions; bin // {
      # for backward compatibility
-      latexindent = lib.findFirst (p: p.tlType == "bin") tl.latexindent.pkgs;
+      latexindent = tl.latexindent;
    };

    combine = assert assertions; combine;

-    # Pre-defined combined packages for TeX Live schemes,
-    # to make nix-env usage more comfortable and build selected on Hydra.
-    combined = with lib;
-      let
-        # these license lists should be the sorted union of the licenses of the packages the schemes contain.
-        # The correctness of this collation is tested by tests.texlive.licenses
-        licenses = with lib.licenses; {
-          scheme-basic = [ free gfl gpl1Only gpl2 gpl2Plus knuth lgpl21 lppl1 lppl13c mit ofl publicDomain ];
-          scheme-context = [ bsd2 bsd3 cc-by-sa-40 free gfl gfsl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus knuth lgpl2 lgpl21
-            lppl1 lppl13c mit ofl publicDomain x11 ];
-          scheme-full = [ artistic1-cl8 artistic2 asl20 bsd2 bsd3 bsdOriginal cc-by-10 cc-by-40 cc-by-sa-10 cc-by-sa-20
-            cc-by-sa-30 cc-by-sa-40 cc0 fdl13Only free gfl gfsl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus isc knuth
-            lgpl2 lgpl21 lgpl3 lppl1 lppl12 lppl13a lppl13c mit ofl publicDomain x11 ];
-          scheme-gust = [ artistic1-cl8 asl20 bsd2 bsd3 cc-by-40 cc-by-sa-40 cc0 fdl13Only free gfl gfsl gpl1Only gpl2
-            gpl2Plus gpl3 gpl3Plus knuth lgpl2 lgpl21 lppl1 lppl12 lppl13a lppl13c mit ofl publicDomain x11 ];
-          scheme-infraonly = [ gpl2 gpl2Plus lgpl21 ];
-          scheme-medium = [ artistic1-cl8 asl20 bsd2 bsd3 cc-by-40 cc-by-sa-20 cc-by-sa-30 cc-by-sa-40 cc0 fdl13Only
-            free gfl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus isc knuth lgpl2 lgpl21 lgpl3 lppl1 lppl12 lppl13a lppl13c mit ofl
-            publicDomain x11 ];
-          scheme-minimal = [ free gpl1Only gpl2 gpl2Plus knuth lgpl21 lppl1 lppl13c mit ofl publicDomain ];
-          scheme-small = [ asl20 cc-by-40 cc-by-sa-40 cc0 fdl13Only free gfl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus knuth
-            lgpl2 lgpl21 lppl1 lppl12 lppl13a lppl13c mit ofl publicDomain x11 ];
-          scheme-tetex = [ artistic1-cl8 asl20 bsd2 bsd3 cc-by-40 cc-by-sa-10 cc-by-sa-20 cc-by-sa-30 cc-by-sa-40 cc0
-            fdl13Only free gfl gpl1Only gpl2 gpl2Plus gpl3 gpl3Plus isc knuth lgpl2 lgpl21 lgpl3 lppl1 lppl12 lppl13a
-            lppl13c mit ofl publicDomain x11];
-        };
-      in recurseIntoAttrs (
-      mapAttrs
-        (pname: attrs:
-          addMetaAttrs rec {
-            description = "TeX Live environment for ${pname}";
-            platforms = lib.platforms.all;
-            maintainers = with lib.maintainers;  [ veprbl ];
-            license = licenses.${pname};
-          }
-          (combine {
-            ${pname} = attrs;
-            extraName = "combined" + lib.removePrefix "scheme" pname;
-            extraVersion = with version; if final then "-final" else ".${year}${month}${day}";
-          })
-        )
-        { inherit (tl)
-            scheme-basic scheme-context scheme-full scheme-gust scheme-infraonly
-            scheme-medium scheme-minimal scheme-small scheme-tetex;
-        }
-    );
+    combined = assert assertions; combined;
+
+    # convenience alias
+    withPackages = (buildTeXEnv { }).withPackages;
  }
--- a/pkgs/tools/typesetting/tex/texlive/generate-fixed-hashes.nix
+++ b/pkgs/tools/typesetting/tex/texlive/generate-fixed-hashes.nix
@ -1,13 +1,13 @@
 with import ../../../../.. { };

 with lib; let
-  isFod = p: p.tlType != "bin" && isDerivation p;
+  getFods = drv: lib.optional (isDerivation drv.tex) (drv.tex // { tlType = "run"; })
+    ++ lib.optional (drv ? texdoc) (drv.texdoc // { tlType = "doc"; })
+    ++ lib.optional (drv ? texsource) (drv.texsource // { tlType = "source"; })
+    ++ lib.optional (drv ? tlpkg) (drv.tlpkg // { tlType = "tlpkg"; });

-  # ugly hack to extract combine from collection-latexextra, since it is masked by texlive.combine
-  combine = lib.findFirst (p: (lib.head p.pkgs).pname == "combine") { pkgs = [ ]; } (lib.head texlive.collection-latexextra.pkgs).tlDeps;
-  all = filter (p: p ? pkgs) (attrValues (removeAttrs texlive [ "bin" "combine" "combined" "tlpdb" ])) ++ [ combine ];
-  sorted = sort (a: b: (head a.pkgs).pname < (head b.pkgs).pname) all;
-  fods = filter isFod (concatMap (p: p.pkgs or [ ]) all);
+  sorted = sort (a: b: a.pname < b.pname) (attrValues texlive.pkgs);
+  fods = concatMap getFods sorted;

  computeHash = fod: runCommand "${fod.pname}-${fod.tlType}-fixed-hash"
    { buildInputs = [ nix ]; inherit fod; }
@ -15,18 +15,17 @@ with lib; let

  hash = fod: fod.outputHash or (builtins.readFile (computeHash fod));

-  hashes = { pkgs }:
-    concatMapStrings ({ tlType, ... }@p: lib.optionalString (isFod p) (''${tlType}="${hash p}";'')) pkgs;
+  hashes = fods:
+    concatMapStrings ({ tlType, ... }@p: ''${tlType}="${hash p}";'') fods;

-  hashLine = { pkgs }@pkg:
+  hashLine = { pname, revision, extraRevision ? "", ... }@drv:
    let
-      fods = lib.filter isFod pkgs;
-      first = lib.head fods;
+      fods = getFods drv;
      # NOTE: the fixed naming scheme must match default.nix
-      fixedName = with first; "${pname}-${toString revision}${first.extraRevision or ""}";
+      fixedName = "${pname}-${toString revision}${extraRevision}";
    in
-    lib.optionalString (fods != [ ]) ''
-      ${strings.escapeNixIdentifier fixedName}={${hashes pkg}};
+    optionalString (fods != [ ]) ''
+      ${strings.escapeNixIdentifier fixedName}={${hashes fods}};
    '';
 in
 {
@ -37,6 +36,6 @@ in
  fixedHashesNix = writeText "fixed-hashes.nix"
    ''
      {
-      ${lib.concatMapStrings hashLine sorted}}
+      ${concatMapStrings hashLine sorted}}
    '';
 }
--- a/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
+++ b/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
@ -91,6 +91,7 @@ $a}
      t next-doc # loop if the previous lines matched

    / (texmf-dist|RELOC)\/doc\/man\//i\  hasManpages = true;
+    / (texmf-dist|RELOC)\/doc\/info\//i\  hasInfo = true;

    D # restart cycle
  }
--- a/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
+++ b/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
@ -126,7 +126,7 @@ in lib.recursiveUpdate orig rec {

  texlive-scripts.binlinks = {
    mktexfmt = "fmtutil";
-    texhash = (lib.last tl."texlive.infra".pkgs) + "/bin/mktexlsr";
+    texhash = tl."texlive.infra" + "/bin/mktexlsr";
  };

  texlive-scripts-extra.binlinks = {
@ -352,7 +352,7 @@ in lib.recursiveUpdate orig rec {
        mkdir -p support/texdoc
        touch support/texdoc/NEWS

-        TEXMFCNF="${lib.head tl.kpathsea.pkgs}/web2c" TEXMF="$out" TEXDOCS=. TEXMFVAR=. \
+        TEXMFCNF="${tl.kpathsea.tex}/web2c" TEXMF="$out" TEXDOCS=. TEXMFVAR=. \
          "${bin.luatex}"/bin/texlua "$out"/scripts/texdoc/texdoc.tlu \
          -c texlive_tlpdb=texlive.tlpdb -lM texdoc

@ -362,7 +362,7 @@ in lib.recursiveUpdate orig rec {

    # install zsh completion
    postFixup = ''
-      TEXMFCNF="${lib.head tl.kpathsea.pkgs}"/web2c TEXMF="$scriptsFolder/../.." \
+      TEXMFCNF="${tl.kpathsea.tex}"/web2c TEXMF="$scriptsFolder/../.." \
        texlua "$out"/bin/texdoc --print-completion zsh > "$TMPDIR"/_texdoc
      substituteInPlace "$TMPDIR"/_texdoc \
        --replace 'compdef __texdoc texdoc' '#compdef texdoc' \
@ -381,14 +381,14 @@ in lib.recursiveUpdate orig rec {
    license = [ "gpl2Plus" ] ++ lib.toList bin.core.meta.license.shortName ++ orig."texlive.infra".license or [ ];

    scriptsFolder = "texlive";
-    extraBuildInputs = [ coreutils gnused gnupg (lib.last tl.kpathsea.pkgs) (perl.withPackages (ps: with ps; [ Tk ])) ];
+    extraBuildInputs = [ coreutils gnused gnupg tl.kpathsea (perl.withPackages (ps: with ps; [ Tk ])) ];

    # make tlmgr believe it can use kpsewhich to evaluate TEXMFROOT
    postFixup = ''
      substituteInPlace "$out"/bin/tlmgr \
        --replace 'if (-r "$bindir/$kpsewhichname")' 'if (1)'
      sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath [ gnupg ]}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/tlmgr
-      sed -i '2iPATH="${lib.makeBinPath [ coreutils gnused (lib.last tl.kpathsea.pkgs) ]}''${PATH:+:$PATH}"' "$out"/bin/mktexlsr
+      sed -i '2iPATH="${lib.makeBinPath [ coreutils gnused tl.kpathsea ]}''${PATH:+:$PATH}"' "$out"/bin/mktexlsr
    '';

    # add minimal texlive.tlpdb
--- a/pkgs/tools/typesetting/tex/texlive/tlpdb.nix
+++ b/pkgs/tools/typesetting/tex/texlive/tlpdb.nix
@ -1707,6 +1707,7 @@ asymptote = {
  sha512.run = "4f97d0d87d1f29985c83c99629fc52e8e18f6eabf95d77aa888429187b49ed9525661d9c06b46a9b2295b03df412778ede1490fa9cd8ec680c3209a4ca6d0be0";
  sha512.doc = "940297c3d69de7e01caa09ff44483f7334aba14705bdcdc83661ca9be2210133e094f99a8355b4b88d076355bb4f13f64c21700bff57f452dd5dbc8d2fddb432";
  hasManpages = true;
+  hasInfo = true;
  hasRunfiles = true;
  license = [ "lgpl3" ];
  version = "2.85";
@ -15500,6 +15501,7 @@ dvipng = {
  sha512.run = "d24be610a63a9df22ebe6f53891519ab77900611d1159dec5e97b27160f3552b4cbce42b575a036125d2b15910a72cb5e3793a3409c5d0f4b1df0c2433e828f8";
  sha512.doc = "976ff6c9628fe85adca2287f04d76f2c1605f243e28b4d32cb1ef9a90d30dcae0d202e6d5156914c204fd42b0a66460755a89f7dbdeb9ec1ccf6010cfe8daf78";
  hasManpages = true;
+  hasInfo = true;
  license = [ "lgpl3" ];
  version = "1.17";
 };
@ -15521,6 +15523,7 @@ dvips = {
  sha512.run = "a680a4685d3cbb429ad9dada0d48098f7755253ad1d7c808731f0f4fb4c37971cb937a9fa68bcecd892de93cc35a8086b742c86338460585c2912f36d00ade67";
  sha512.doc = "a6acb780a45663fb21976622d7b6c3ea8d4adf1fe405ee97cd7c4cf09fa49b59069ba72b2aa14b53d3ba631b37c5cbd979929adaa274a0bec8b1272d85e1cd43";
  hasManpages = true;
+  hasInfo = true;
  hasRunfiles = true;
  license = [ "free" ];
 };
@ -16610,6 +16613,7 @@ eplain = {
  sha512.run = "fda8158ae2bdc96187b6e6ace2a94be3e0f68201adbc02553b48a3848481352ac10ddd72babcbc2835e089ce751ade7dfa6cfd1c642c94155c2861db865f5c29";
  sha512.doc = "60902b2422d2f5d7570a19daf7f586df7882505d7c156539699a0aa47a0f3bde5688dcbdc92c8a6a9878f11392bc9b9f147626aad230eecd2740d56f104928ed";
  hasManpages = true;
+  hasInfo = true;
  sha512.source = "015de2eeeaec99bd15882a190f9ef3f2112520f8c591c7e6d2351c52d8690b024750adea426bcf95f438aaa20c97dd321881ac7212ff181e148337b57f6d386c";
  hasRunfiles = true;
  license = [ "gpl2Plus" ];
@ -16666,6 +16670,7 @@ epspdf = {
  revision = 66119;
  sha512.run = "f155834a9636991c8ae752f61f70bdf22ab3172270c85aebb05462cf26e44f6e81fb83842c8515bfa54e632a3beab8bb91cccf2b5eef459d77738443c77df56d";
  sha512.doc = "5d06f8a4ef295e0fac8cd1dc73ff98e266dcf4394ed76223c92d20758fa8195ef5bea9bde49b1a247acfdf67aa7717092f978b55fc4fbc8665922487d57985d6";
+  hasInfo = true;
  hasRunfiles = true;
  scriptExts = [
    "tcl"
@ -18768,6 +18773,7 @@ fontname = {
  stripPrefix = 0;
  sha512.run = "424da4dbbc07c41840e6aeb6fabeef5d4778d206b9cb8a90e752ebeb65d962b96ad41a7e20c86a16665e2bf48ad795d85001da66ff41b01ae3c949c6eefa4593";
  sha512.doc = "78199996913192f5f69423b6f412acc52b74f051b01d3e345b97b7f1d9ea4aea762a7b83488068f3091b41da69471d56b3f18ab4d299cc6adfe4e004072db303";
+  hasInfo = true;
  hasRunfiles = true;
  license = [ "gpl1Only" ];
 };
@ -24499,6 +24505,7 @@ kpathsea = {
  sha512.run = "8a9f0dd49470bec5ba0f963a0385bea45141d6b805682bd65e95291b02158b9d2cedd5bd43592de7c447fe87f04efa00e4d1aa191a490147adcb57ec3922b5db";
  sha512.doc = "51500943de0184fd9794dbf6af80aed2fc7bbaf2a7949facb1840ad0e32344d217aa4d58ee76e3934aec891858f789b3847b9027cb2bd75e5962be98ddd9d02f";
  hasManpages = true;
+  hasInfo = true;
  hasRunfiles = true;
  license = [ "lgpl21" ];
 };
@ -25258,6 +25265,7 @@ latex2e-help-texinfo = {
  stripPrefix = 0;
  sha512.run = "34b91b19e1b71b1df6d0f57dda4d6976a93b16afac259656c9d4e331b0c23a9b0550563c1a10dd7a95640e3740b3b15597c1023f6c2721bf2a64800466b9cd09";
  sha512.doc = "d4584d9259f3c1867e7445d4a219e4decc5ba3b305e20d1e780180a47fbad8df4d55552726d8288e78c8388823a2b652b81080c8139b00f4ea3ca10e5789375b";
+  hasInfo = true;
  license = [ "free" ];
 };
 latex2e-help-texinfo-fr = {
@ -25265,6 +25273,7 @@ latex2e-help-texinfo-fr = {
  stripPrefix = 0;
  sha512.run = "96366ea420532f56ae076da48f5402c2ee78ca27fae8180795d6cd18aae118a8c7060208ff43ab64526addcdce9e4d90790583842b20c751f37865cf616e04e4";
  sha512.doc = "52f6aea9ac2393a73d7dc7ce8ad4d6f08e0a224397199d5def97412502026717e8cb966552368899c50718a1049b1ad4610d2d23150a45bee55cc2c776003db7";
+  hasInfo = true;
  license = [ "publicDomain" ];
 };
 latex2e-help-texinfo-spanish = {
@ -25272,6 +25281,7 @@ latex2e-help-texinfo-spanish = {
  stripPrefix = 0;
  sha512.run = "870c8f3af54ac42df5f4958669cf730cd16084c985f0b377c5aba9d526b8f7be14b367791d2c0a1f1a715739390ab63777ff2a92e7f9aad09897c8bbecff495e";
  sha512.doc = "4c751a7305e089dab61bf991436ab1e612cfca0d17e416e21d659c04ef32eeb2d14dbeb09d63649a2b79f842766a218c43ae2c6fbeeba5549f039f991049a79d";
+  hasInfo = true;
  license = [ "free" ];
 };
 latex2man = {
@ -25279,6 +25289,7 @@ latex2man = {
  sha512.run = "2617f6e8059f30c0098ea896cff69f585ea2ddbd3bbbd8066e7296dd833d3a246b8fefc0af71a92abf7e2051c754c0e3e6098175a4b181780563416bc9146b95";
  sha512.doc = "390666cc56ad70342c9a24ca593fe65b3760674a882ed8bba383d193f2578285727a085f823afc03fa0dbc9966612caf9a29222fd2a9f39214f01aa268acdc50";
  hasManpages = true;
+  hasInfo = true;
  hasRunfiles = true;
  license = [ "lppl1" ];
  version = "1.29";
@ -28873,6 +28884,7 @@ mf2pt1 = {
  revision = 61217;
  sha512.run = "ca93a3ae439f9cd8029720bd1d90fbe75a403e7ab4ebcbe1ba1e5a7a28aa9269197f90a4aee849fea59d734d5dc38f04eedc140ff1be64fd805a10ab5510a2f5";
  sha512.doc = "6c10831fdcc48d25645be675fbf5da29da945bd79032c60e73e04a39d61c287a64e7b884381ac0b08e48f5dc9b6dec27efea874f6e13d6e4a5e3f32c22fa3ce2";
+  hasInfo = true;
  hasRunfiles = true;
  license = [ "lppl13c" ];
  version = "2.7";
@ -40536,6 +40548,7 @@ tds = {
  stripPrefix = 0;
  sha512.run = "b03911aa9711eb5eeed77c026c4bbcf952da80322b855ac631e78c07a48ad2ff1a4afdd6e25a00257d1b70e054645f07f65c98fe74f6b1389be46625f5eb8487";
  sha512.doc = "f4078e3b1693fedcbe139b67c50824845644a2b1e57dd27f9e46e44504d8fe8ac0ca706590e9149c06e71794a188b20777bfd6bf1afe85f16c806ba4f9b99cd8";
+  hasInfo = true;
  license = [ "free" ];
  version = "1.1";
 };
@ -41052,6 +41065,7 @@ texdraw = {
  stripPrefix = 0;
  sha512.run = "f4d160e494b1579743a83b2a0926df9e8dd69fdaa79d3f4f97e0ed5f4ece31ab380ff6994a1c9015e0af9b842bdfb9b066442ca4b3018df6659922af9f746b0b";
  sha512.doc = "e177209a937fa1d9d683eb805e9e8929612b4b1ff750955d38ca681b657662712a59609990f77021063a223ce61a92fdd567eee91376ef4b67fd3a322db09463";
+  hasInfo = true;
  hasRunfiles = true;
  license = [ "cc-by-40" ];
  version = "v2r3";
@ -41115,6 +41129,7 @@ texlive-en = {
  stripPrefix = 0;
  sha512.run = "f790f2a94e67573635afb5b4c2d375bede61eb3afe271169078fe905d326119234363ee896ecc93a9892d26e0a394fc350edbda810e218b0b06cc30681fd9cf0";
  sha512.doc = "48ffb3b9053250f4425992c57869c6153601e9dfaa4931ac4ff3c12df44b148dce08496acbae495fd5f9fe37e11044a3fc0669c713515d2cc99506fd6be59859";
+  hasInfo = true;
 };
 texlive-es = {
  revision = 65640;
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -887,6 +887,7 @@ mapAliases ({
  telegram-cli = throw "telegram-cli was removed because it was broken and abandoned upstream"; # Added 2023-07-28
  tensile = throw "'tensile' has been replaced with 'rocmPackages.tensile'"; # Added 2023-10-08
  testVersion = testers.testVersion; # Added 2022-04-20
+  tfplugindocs = terraform-plugin-docs; # Added 2023-11-01
  invalidateFetcherByDrvHash = testers.invalidateFetcherByDrvHash; # Added 2022-05-05
  timescale-prometheus = promscale; # Added 2020-09-29
  tinygltf = throw "TinyglTF has been embedded in draco due to lack of other users and compatibility breaks."; # Added 2023-06-25
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -447,6 +447,10 @@ with pkgs;

  ccal = callPackage ../tools/misc/ccal { };

+  celeste-classic-pm = pkgs.celeste-classic.override {
+    practiceMod = true;
+  };
+
  cereal = cereal_1_3_0;
  cereal_1_3_0 = callPackage ../development/libraries/cereal/1.3.0.nix { };
  cereal_1_3_2 = callPackage ../development/libraries/cereal/1.3.2.nix { };
@ -2057,8 +2061,6 @@ with pkgs;

  tfk8s = callPackage ../tools/misc/tfk8s { };

-  tfplugindocs = callPackage ../development/tools/tfplugindocs { };
-
  thumbs = callPackage ../tools/misc/thumbs { };

  tnat64 = callPackage ../tools/networking/tnat64 { };
@ -24661,7 +24663,7 @@ with pkgs;
        darwin buildPackages;
      inherit (__splicedPackages.gst_all_1) gstreamer gst-plugins-base;
      inherit config;
-      stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
+      stdenv = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
    });

  libsForQt5 = recurseIntoAttrs (import ./qt5-packages.nix {
@ -34916,7 +34918,7 @@ with pkgs;

  qnotero = libsForQt5.callPackage ../applications/office/qnotero { };

-  qpwgraph = libsForQt5.callPackage ../applications/audio/qpwgraph { };
+  qpwgraph = qt6Packages.callPackage ../applications/audio/qpwgraph { };

  qrcode = callPackage ../tools/graphics/qrcode { };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -1440,6 +1440,8 @@ self: super: with self; {

  bip-utils = callPackage ../development/python-modules/bip-utils { };

+  bip32 = callPackage ../development/python-modules/bip32 { };
+
  bitarray = callPackage ../development/python-modules/bitarray { };

  bitbox02 = callPackage ../development/python-modules/bitbox02 { };
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@ -178,7 +178,8 @@ in (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdParty // kdeGea

  pulseaudio-qt = callPackage ../development/libraries/pulseaudio-qt { };

-  qca-qt5 = pkgs.darwin.apple_sdk_11_0.callPackage ../development/libraries/qca-qt5 {
+  qca-qt5 = callPackage ../development/libraries/qca-qt5 {
+    stdenv = if pkgs.stdenv.isDarwin then pkgs.overrideSDK pkgs.stdenv "11.0" else pkgs.stdenv;
    inherit (libsForQt5) qtbase;
  };

@ -209,8 +210,8 @@ in (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdParty // kdeGea
  qtinstaller = callPackage ../development/libraries/qtinstaller { };

  qtkeychain = callPackage ../development/libraries/qtkeychain {
-    stdenv = if pkgs.stdenv.isDarwin then pkgs.darwin.apple_sdk_11_0.stdenv else pkgs.stdenv;
-    inherit (pkgs.darwin.apple_sdk_11_0.frameworks) CoreFoundation Security;
+    stdenv = if pkgs.stdenv.isDarwin then pkgs.overrideSDK pkgs.stdenv "11.0" else pkgs.stdenv;
+    inherit (pkgs.darwin.apple_sdk.frameworks) CoreFoundation Security;
  };

  qtmpris = callPackage ../development/libraries/qtmpris { };