Merge master into staging-next

2023-04-20 06:01:11 +00:00 · 2023-04-20 06:01:11 +00:00 · 62b0fc144a
commit 62b0fc144a
parent e3d1e50acd 01cbd79e2f
53 changed files with 370 additions and 339 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -12667,6 +12667,12 @@
      fingerprint = "3586 3350 BFEA C101 DB1A 4AF0 1F81 112D 62A9 ADCE";
    }];
  };
+  qjoly = {
+    email = "github@thoughtless.eu";
+    github = "qjoly";
+    githubId = 82603435;
+    name = "Quentin JOLY";
+  };
  qknight = {
    email = "js@lastlog.de";
    github = "qknight";
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@ -7,6 +7,18 @@ let
  serverConfigFile = settingsFormat.generate "server.toml" (filterConfig cfg.serverSettings);
  clientConfigFile = settingsFormat.generate "kanidm-config.toml" (filterConfig cfg.clientSettings);
  unixConfigFile = settingsFormat.generate "kanidm-unixd.toml" (filterConfig cfg.unixSettings);
+  certPaths = builtins.map builtins.dirOf [ cfg.serverSettings.tls_chain cfg.serverSettings.tls_key ];
+
+  # Merge bind mount paths and remove paths where a prefix is already mounted.
+  # This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is alread in the mount
+  # paths, no new bind mount is added. Adding subpaths caused problems on ofborg.
+  hasPrefixInList = list: newPath: lib.any (path: lib.hasPrefix (builtins.toString path) (builtins.toString newPath)) list;
+  mergePaths = lib.foldl' (merged: newPath: let
+      # If the new path is a prefix to some existing path, we need to filter it out
+      filteredPaths = lib.filter (p: !lib.hasPrefix (builtins.toString newPath) (builtins.toString p)) merged;
+      # If a prefix of the new path is already in the list, do not add it
+      filteredNew = if hasPrefixInList filteredPaths newPath then [] else [ newPath ];
+    in filteredPaths ++ filteredNew) [];

  defaultServiceConfig = {
    BindReadOnlyPaths = [
@ -16,7 +28,7 @@ let
      "-/etc/hosts"
      "-/etc/localtime"
    ];
-    CapabilityBoundingSet = "";
+    CapabilityBoundingSet = [];
    # ProtectClock= adds DeviceAllow=char-rtc r
    DeviceAllow = "";
    # Implies ProtectSystem=strict, which re-mounts all paths
@ -216,22 +228,28 @@ in
      description = "kanidm identity management daemon";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
-      serviceConfig = defaultServiceConfig // {
-        StateDirectory = "kanidm";
-        StateDirectoryMode = "0700";
-        ExecStart = "${pkgs.kanidm}/bin/kanidmd server -c ${serverConfigFile}";
-        User = "kanidm";
-        Group = "kanidm";
+      serviceConfig = lib.mkMerge [
+        # Merge paths and ignore existing prefixes needs to sidestep mkMerge
+        (defaultServiceConfig // {
+          BindReadOnlyPaths = mergePaths (defaultServiceConfig.BindReadOnlyPaths ++ certPaths);
+        })
+        {
+          StateDirectory = "kanidm";
+          StateDirectoryMode = "0700";
+          ExecStart = "${pkgs.kanidm}/bin/kanidmd server -c ${serverConfigFile}";
+          User = "kanidm";
+          Group = "kanidm";

-        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-        # This would otherwise override the CAP_NET_BIND_SERVICE capability.
-        PrivateUsers = false;
-        # Port needs to be exposed to the host network
-        PrivateNetwork = false;
-        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
-        TemporaryFileSystem = "/:ro";
-      };
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+          # This would otherwise override the CAP_NET_BIND_SERVICE capability.
+          PrivateUsers = lib.mkForce false;
+          # Port needs to be exposed to the host network
+          PrivateNetwork = lib.mkForce false;
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          TemporaryFileSystem = "/:ro";
+        }
+      ];
      environment.RUST_LOG = "info";
    };

@ -240,34 +258,32 @@ in
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      restartTriggers = [ unixConfigFile clientConfigFile ];
-      serviceConfig = defaultServiceConfig // {
-        CacheDirectory = "kanidm-unixd";
-        CacheDirectoryMode = "0700";
-        RuntimeDirectory = "kanidm-unixd";
-        ExecStart = "${pkgs.kanidm}/bin/kanidm_unixd";
-        User = "kanidm-unixd";
-        Group = "kanidm-unixd";
+      serviceConfig = lib.mkMerge [
+        defaultServiceConfig
+        {
+          CacheDirectory = "kanidm-unixd";
+          CacheDirectoryMode = "0700";
+          RuntimeDirectory = "kanidm-unixd";
+          ExecStart = "${pkgs.kanidm}/bin/kanidm_unixd";
+          User = "kanidm-unixd";
+          Group = "kanidm-unixd";

-        BindReadOnlyPaths = [
-          "/nix/store"
-          "-/etc/resolv.conf"
-          "-/etc/nsswitch.conf"
-          "-/etc/hosts"
-          "-/etc/localtime"
-          "-/etc/kanidm"
-          "-/etc/static/kanidm"
-          "-/etc/ssl"
-          "-/etc/static/ssl"
-        ];
-        BindPaths = [
-          # To create the socket
-          "/run/kanidm-unixd:/var/run/kanidm-unixd"
-        ];
-        # Needs to connect to kanidmd
-        PrivateNetwork = false;
-        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
-        TemporaryFileSystem = "/:ro";
-      };
+          BindReadOnlyPaths = [
+            "-/etc/kanidm"
+            "-/etc/static/kanidm"
+            "-/etc/ssl"
+            "-/etc/static/ssl"
+          ];
+          BindPaths = [
+            # To create the socket
+            "/run/kanidm-unixd:/var/run/kanidm-unixd"
+          ];
+          # Needs to connect to kanidmd
+          PrivateNetwork = lib.mkForce false;
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+          TemporaryFileSystem = "/:ro";
+        }
+      ];
      environment.RUST_LOG = "info";
    };

--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@ -44,7 +44,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
        };
      };

-      networking.hosts."${nodes.server.config.networking.primaryIPAddress}" = [ serverDomain ];
+      networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ serverDomain ];

      security.pki.certificateFiles = [ certs.ca.cert ];
    };
@ -56,7 +56,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
        # We need access to the config file in the test script.
        filteredConfig = pkgs.lib.converge
          (pkgs.lib.filterAttrsRecursive (_: v: v != null))
-          nodes.server.config.services.kanidm.serverSettings;
+          nodes.server.services.kanidm.serverSettings;
        serverConfigFile = (pkgs.formats.toml { }).generate "server.toml" filteredConfig;

      in
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "logseq";
-  version = "0.9.2";
+  version = "0.9.3";

  src = fetchurl {
    url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    hash = "sha256-nXNzUHZXh2NGcg/OXRKhag/BWLB/YOAkCPITiBiMIIE=";
+    hash = "sha256-hwBTS6hjD66SPOPctcS2esybnVrgw77fFpt8phGt334=";
    name = "${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/networking/cluster/fn-cli/default.nix
+++ b/pkgs/applications/networking/cluster/fn-cli/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "fn";
-  version = "0.6.23";
+  version = "0.6.24";

  src = fetchFromGitHub {
    owner = "fnproject";
    repo = "cli";
    rev = version;
-    hash = "sha256-3g8S3cJ3RC06rvPMyQSKf8L4DkDTZ0Oe+6eh+rwyqg8=";
+    hash = "sha256-em9Bfrk7jJdmg3N+zH0VTpCdKPEOBK8vc297V5vmKzM=";
  };

-  vendorSha256 = null;
+  vendorHash = null;

  subPackages = ["."];

--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "kubernetes-helm";
-  version = "3.11.2";
+  version = "3.11.3";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-aUzVICPCxAUoPvnE7pqz+bscfukbEwB+iGmXAYuQ/eE=";
+    sha256 = "sha256-BIjbSHs0sOLYB+26EHy9f3YJtUYnzgdADIXB4n45Rv0=";
  };
-  vendorSha256 = "sha256-Hf4ElC3H5sJkzKFELeDygTmfuqBHLqRhaHG1bfnqigM=";
+  vendorHash = "sha256-uz3ZqCcT+rmhNCO+y3PuCXWjTxUx8u3XDgcJxt7A37g=";

  subPackages = [ "cmd/helm" ];
  ldflags = [
--- a/pkgs/applications/networking/cluster/linkerd/default.nix
+++ b/pkgs/applications/networking/cluster/linkerd/default.nix
@ -2,7 +2,7 @@

 (callPackage ./generic.nix { }) {
  channel = "stable";
-  version = "2.12.4";
-  sha256 = "1nl831xjhxyw1r2zvdxy3455sfn1cnn6970n02q7aalmqgz9rpdd";
-  vendorSha256 = "sha256-c7x2vNO6ap5Ecx4+1hKy6PImFuclSQqvkBKr0LPdX4M=";
+  version = "2.13.1";
+  sha256 = "1qsf2d4haqs93qf88f2vvjsgm5a5gnmivkdpdbvpwy0q8bd8rfnj";
+  vendorSha256 = "sha256-6KuXEKuQJvRNUM+6Uo+J9D3eHI+1tt62C5XZsEDwkTc=";
 }
--- a/pkgs/applications/networking/cluster/nova/default.nix
+++ b/pkgs/applications/networking/cluster/nova/default.nix
@ -0,0 +1,30 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "nova";
+  version = "3.6.2";
+
+  src = fetchFromGitHub {
+    owner = "FairwindsOps";
+    repo = pname;
+    rev = version;
+    hash = "sha256-l2HBjM5DyeWkdAwQGzPp+A3UuXXc0OTizInsVL0k/0I=";
+  };
+
+  vendorHash = "sha256-YvYfSb2ZC86S2osFRG7Ep9nrgYJV0tB8fBgZQZ07t2U=";
+
+  ldflags = [ "-X main.version=${version}" "-s" "-w" ];
+
+  meta = with lib; {
+    description = "Find outdated or deprecated Helm charts running in your cluster";
+    longDescription = ''
+      Nova scans your cluster for installed Helm charts, then
+      cross-checks them against all known Helm repositories. If it
+      finds an updated version of the chart you're using, or notices
+      your current version is deprecated, it will let you know.
+    '';
+    homepage = "https://nova.docs.fairwinds.com/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ qjoly ];
+  };
+}
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "pluto";
-  version = "5.16.0";
+  version = "5.16.1";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "pluto";
    rev = "v${version}";
-    sha256 = "sha256-M5zTnzuei/sECvRe89Dau72iIUuMtaLJyYTGeEF4GPo=";
+    sha256 = "sha256-UCq+aMUffvDWmPtSSc/PNbrak1LGWQe8Oe340O5q6LM=";
  };

-  vendorHash = "sha256-3wtE2Cz+AVF+zfsLH/+6KMHPihYcuYsrzTguHNnwT+U=";
+  vendorHash = "sha256-0VFCZ+U0W21tF35148Valpc7fDXkC9dPpz1O0+4D30U=";

  ldflags = [
    "-w" "-s"
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -119,11 +119,11 @@
    "vendorHash": "sha256-t6Hg1FLCd4dh6d3J0uNsNKKnz5T8/yoIXFo7bRO+XHM="
  },
  "azuread": {
-    "hash": "sha256-qFDCGj1ZhLnqG3Vg1bI+cdbExIbmDZaig9VYg6caWd0=",
+    "hash": "sha256-bCnCj2pEd29aQVePGeaTbVhH6sF/Y+lj94SEw1+tROc=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/azuread",
    "owner": "hashicorp",
    "repo": "terraform-provider-azuread",
-    "rev": "v2.37.1",
+    "rev": "v2.37.2",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -218,13 +218,13 @@
    "vendorHash": "sha256-w7Rsr3UgijW/3RMKzhMyWCvn5b1R1oqRs87/ZPO7jHs="
  },
  "cloudflare": {
-    "hash": "sha256-dhSjFeTkbiG/Gx/DS1WzW2b31u3apfXX4Safh29e6Fw=",
+    "hash": "sha256-DDoPVceQpRTN23JaQ79uXrEStBgtb7WWrKBIVpIpok4=",
    "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
    "owner": "cloudflare",
    "repo": "terraform-provider-cloudflare",
-    "rev": "v4.3.0",
+    "rev": "v4.4.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-sgJ1HhhWQpvOGFVEC43pymBKyVcqdn8jLlW5fR21mFE="
+    "vendorHash": "sha256-b7h8CI1NeFAAXGdDsZ4CRXcomceoijon8IGriqP6tko="
  },
  "cloudfoundry": {
    "hash": "sha256-MKhsUGuDpKfYFf9Vk0uVrP/Z4hnQyO+2WiqWXO9EAC0=",
@ -354,13 +354,13 @@
    "vendorHash": "sha256-oVTanZpCWs05HwyIKW2ajiBPz1HXOFzBAt5Us+EtTRw="
  },
  "equinix": {
-    "hash": "sha256-zyRPpAaDgjRafn5RcrzmbVTzO6gGS1HMmvLR8VFdKow=",
+    "hash": "sha256-GGJNfHizFc+wXNo7u/mqtonIs5D/S8RydBsIkftNcjc=",
    "homepage": "https://registry.terraform.io/providers/equinix/equinix",
    "owner": "equinix",
    "repo": "terraform-provider-equinix",
-    "rev": "v1.13.0",
+    "rev": "v1.14.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-Zi2e/Vg9iKTrU8Mb37Y8xHYIBL+IfDnWMUUg5Vqrbfo="
+    "vendorHash": "sha256-rJev48aS0nd8DRWmUN4i0LgDYvfjdfoO67N6AiWeg+k="
  },
  "exoscale": {
    "hash": "sha256-XbuVvVOv8k7T/7smr73+lvhFMxKtJkaLN3WgvTWIkrA=",
@ -381,11 +381,11 @@
    "vendorHash": "sha256-E1gzdES/YVxQq2J47E2zosvud2C/ViBeQ8+RfNHMBAg="
  },
  "fastly": {
-    "hash": "sha256-YKF4aW+K5JffPd5b3Kh540ml0uc9q5WSvcNgj9g6/Bk=",
+    "hash": "sha256-Z38tG5Of+nYuIT3IxY/hxbV0HIgkITBnaXcr3oYIf6Y=",
    "homepage": "https://registry.terraform.io/providers/fastly/fastly",
    "owner": "fastly",
    "repo": "terraform-provider-fastly",
-    "rev": "v4.2.0",
+    "rev": "v4.3.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -437,22 +437,22 @@
    "vendorHash": "sha256-s4FynUO6bT+8uZYkecbQCtFw1jFTAAYUkSzONI6Ba9g="
  },
  "google": {
-    "hash": "sha256-vfcRR8EKR/axaD2RJ+3r3B1pmX1XSBYTBYPmwUTx3E8=",
+    "hash": "sha256-rF68NnqyEY4BWl+oLOxfTaQw5zEGs6Ue/L9DwzsJ46M=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.62.0",
+    "rev": "v4.62.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-Xm1P6P2tMLqjV9QFX6D7koBPzg4umTH6jCQesyt0A/A="
  },
  "google-beta": {
-    "hash": "sha256-PksNHhTzIuZxTzFRheiNutEnQSJ2WRu/IgF+8b1w9Eg=",
+    "hash": "sha256-/wcNrCMaXjameyE3o09N+bPjL8r627BJy1vYy1u2iAI=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.62.0",
+    "rev": "v4.62.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-Xm1P6P2tMLqjV9QFX6D7koBPzg4umTH6jCQesyt0A/A="
  },
@ -810,11 +810,11 @@
    "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
  },
  "oci": {
-    "hash": "sha256-27vdHG/FRWGPZclW9Q0z/6ntY+of/5/PGIsKsePhF4k=",
+    "hash": "sha256-9Qcwxi8TojsDIWeyqwQcagTeTwKS/hkPukjeHANHGfU=",
    "homepage": "https://registry.terraform.io/providers/oracle/oci",
    "owner": "oracle",
    "repo": "terraform-provider-oci",
-    "rev": "v4.116.0",
+    "rev": "v4.117.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -963,13 +963,13 @@
    "vendorHash": null
  },
  "scaleway": {
-    "hash": "sha256-QIrIL0vqiZafggdfWchlSOzLRDCF5Zubh6MqwOzfr3Y=",
+    "hash": "sha256-b0prqlZNPrg0YjvLk3RdJ+4C6eL4Tzdzt7Berp6G32c=",
    "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
    "owner": "scaleway",
    "repo": "terraform-provider-scaleway",
-    "rev": "v2.16.3",
+    "rev": "v2.17.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-KUbE00fajvs4p8QxmuKV5IoRfCdWtfZTrOftcRAPSws="
+    "vendorHash": "sha256-tnZy6uN/lZaW4d6uo/quVAuEZZrXEX7qLAas0GauRJI="
  },
  "secret": {
    "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@ -1026,13 +1026,13 @@
    "vendorHash": null
  },
  "snowflake": {
-    "hash": "sha256-IAS0IJwWBmZi0x32ZMWFRyiiPZrnL6z1SGQ3AxuFAd8=",
+    "hash": "sha256-/9TTK33XwMW8izM35y9sOZOKFc6/HC2/CCnX3JMzY3I=",
    "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
    "owner": "Snowflake-Labs",
    "repo": "terraform-provider-snowflake",
-    "rev": "v0.61.0",
+    "rev": "v0.62.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-INAtZefgxjNpf/PWGLn8SS2PxKu3SBhY+06cEnr9V3g="
+    "vendorHash": "sha256-3Ry+XQxF39lXr3Ev+KOx0GatVbD0Sjs9Jai1VPjEDBE="
  },
  "sops": {
    "hash": "sha256-D1Yzs8hDimMP9y8ZRbizEhic3vGtLcZjOVSuSMUAqPk=",
@ -1098,22 +1098,22 @@
    "vendorHash": "sha256-GkmUKSnqkabwGCl22/90529BWb0oJaIJHYHlS/h3KNY="
  },
  "tencentcloud": {
-    "hash": "sha256-j1PffTicdXiit3D+dX9HzkBZFmf8Ch7LxNVU3XGi5uY=",
+    "hash": "sha256-soskWCOJaPzm2m2ocv3N8hb52Jz/T3xw/sW9hCSsf2s=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.80.3",
+    "rev": "v1.80.4",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
  "tfe": {
-    "hash": "sha256-K0l9oaYkgilz47ErUxio9oJtPHQTWZnKdPpjRZ1SDhg=",
+    "hash": "sha256-y2QBMxn8sXwtL1wASypbARLn80T2eVJuawoQ0XQlK38=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
    "owner": "hashicorp",
    "repo": "terraform-provider-tfe",
-    "rev": "v0.43.0",
+    "rev": "v0.44.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-plYy3INLi/SeKu7R0lDLY1CvRDU7bmZsQKzFtMc2Wu4="
+    "vendorHash": "sha256-vKIbswlWQUIPeaFRAMPGygM/UlWiRIr66NuTNfnpGpc="
  },
  "thunder": {
    "hash": "sha256-amGtmE1i68K0ehhYBJ6wwcdUPuVGSWoVdYAb1PwhlAs=",
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib, buildGoModule, fetchFromGitHub }:

 buildGoModule rec {
  pname = "dnscontrol";
@ -13,7 +13,9 @@ buildGoModule rec {

  vendorHash = "sha256-BE/UnJw5elHYmyB+quN89ZkrlMcTjaVN0T2+h8cpPS8=";

-  ldflags = [ "-s" "-w" ];
+  subPackages = [ "." ];
+
+  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];

  preCheck = ''
    # requires network
@ -23,6 +25,7 @@ buildGoModule rec {
  meta = with lib; {
    description = "Synchronize your DNS to multiple providers from a simple DSL";
    homepage = "https://stackexchange.github.io/dnscontrol/";
+    changelog = "https://github.com/StackExchange/dnscontrol/releases/tag/${src.rev}";
    license = licenses.mit;
    maintainers = with maintainers; [ mmahut SuperSandro2000 ];
  };
--- a/pkgs/applications/science/biology/tandem-aligner/default.nix
+++ b/pkgs/applications/science/biology/tandem-aligner/default.nix
@ -6,14 +6,14 @@
 , zlib
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "TandemAligner";
-  version = "unstable-2022-09-17";
+  version = "0.1";

  src = fetchFromGitHub {
    owner = "seryrzu";
    repo = "tandem_aligner";
-    rev = "ac6004f108ad20477045f4d0b037d96051a9df70";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-iMDj1HZ8LzmZckuAM3lbG3eSJSd/5JGVA6SBs7+AgX8=";
  };

@ -58,9 +58,10 @@ stdenv.mkDerivation {
  meta = {
    description = "A parameter-free algorithm for sequence alignment";
    homepage = "https://github.com/seryrzu/tandem_aligner";
+    changelog = "https://github.com/seryrzu/tandem_aligner/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ amesgen ];
    platforms = lib.platforms.linux;
    mainProgram = "tandem_aligner";
  };
-}
+})
--- a/pkgs/applications/version-management/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-machete/default.nix
@ -12,13 +12,13 @@

 buildPythonApplication rec {
  pname = "git-machete";
-  version = "3.16.3";
+  version = "3.17.0";

  src = fetchFromGitHub {
    owner = "virtuslab";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-pd+ZK34dPSCwl8bOwH388NZ6QNIlU5TqL7EabsWw7kk=";
+    hash = "sha256-F+2xbfMsc6izL0f8EjDfGaJs17xDNQn8/k8mvnLYzcM=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/video/filebot/default.nix
+++ b/pkgs/applications/video/filebot/default.nix
@ -1,14 +1,19 @@
-{ lib, stdenv, fetchurl, openjdk17, makeWrapper, autoPatchelfHook
+{ lib, stdenv, fetchurl, coreutils, openjdk17, makeWrapper, autoPatchelfHook
 , zlib, libzen, libmediainfo, curlWithGnuTls, libmms, glib
 }:

-stdenv.mkDerivation rec {
+let
+  lanterna = fetchurl {
+    url = "https://search.maven.org/remotecontent?filepath=com/googlecode/lanterna/lanterna/3.1.1/lanterna-3.1.1.jar";
+    hash = "sha256-7zxCeXYW5v9ritnvkwRpPKdgSptCmkT3HJOaNgQHUmQ=";
+  };
+in stdenv.mkDerivation rec {
  pname = "filebot";
-  version = "5.0.1";
+  version = "5.0.2";

  src = fetchurl {
-    url = "https://web.archive.org/web/20220305095926/https://get.filebot.net/filebot/FileBot_${version}/FileBot_${version}-portable.tar.xz";
-    sha256 = "sha256-0d0+o8ZiF1m83AasjoxUDNtUSquy69wFY1m1oYeybFw=";
+    url = "https://web.archive.org/web/20230418205553/https://get.filebot.net/filebot/FileBot_${version}/FileBot_${version}-portable.tar.xz";
+    hash = "sha256-XnzBXZy/gNA8qf7XairoviRmdQiXHbW19BgbHL52SP0=";
  };

  unpackPhase = "tar xvf $src";
@ -17,6 +22,11 @@ stdenv.mkDerivation rec {

  buildInputs = [ zlib libzen libmediainfo curlWithGnuTls libmms glib ];

+  postPatch = ''
+    # replace lanterna.jar to be able to specify `com.googlecode.lanterna.terminal.UnixTerminal.sttyCommand`
+    cp ${lanterna} jar/lanterna.jar
+  '';
+
  dontBuild = true;
  installPhase = ''
    mkdir -p $out/opt $out/bin
@ -25,7 +35,8 @@ stdenv.mkDerivation rec {
    # Filebot writes to $APP_DATA, which fails due to read-only filesystem. Using current user .local directory instead.
    substituteInPlace $out/opt/filebot.sh \
      --replace 'APP_DATA="$FILEBOT_HOME/data/$(id -u)"' 'APP_DATA=''${XDG_DATA_HOME:-$HOME/.local/share}/filebot/data' \
-      --replace '$FILEBOT_HOME/data/.license' '$APP_DATA/.license'
+      --replace '$FILEBOT_HOME/data/.license' '$APP_DATA/.license' \
+      --replace '-jar "$FILEBOT_HOME/jar/filebot.jar"' '-Dcom.googlecode.lanterna.terminal.UnixTerminal.sttyCommand=${coreutils}/bin/stty -jar "$FILEBOT_HOME/jar/filebot.jar"'
    wrapProgram $out/opt/filebot.sh \
      --prefix PATH : ${lib.makeBinPath [ openjdk17 ]}
    # Expose the binary in bin to make runnable.
--- a/pkgs/data/fonts/whatsapp-emoji/default.nix
+++ b/pkgs/data/fonts/whatsapp-emoji/default.nix
@ -0,0 +1,46 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+, imagemagick
+, nix-update-script
+, pngquant
+, python3Packages
+, which
+, zopfli
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "whatsapp-emoji-linux";
+  version = "2.22.8.79-1";
+
+  src = fetchFromGitHub {
+    rev = "refs/tags/${version}";
+    owner = "dmlls";
+    repo = "whatsapp-emoji-linux";
+    hash = "sha256-AYdyNZYskBNT3v2wl+M0BAYi5piwmrVIDfucSZ3nfTE=";
+  };
+
+  makeFlags = [
+    "PREFIX=$(out)"
+  ];
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [
+    imagemagick
+    pngquant
+    python3Packages.nototools
+    which
+    zopfli
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "WhatsApp Emoji for GNU/Linux";
+    homepage = "https://github.com/dmlls/whatsapp-emoji-linux";
+    maintainers = [ lib.maintainers.lucasew ];
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    license = lib.licenses.unfree;
+  };
+}
--- a/pkgs/desktops/deepin/core/dde-file-manager/default.nix
+++ b/pkgs/desktops/deepin/core/dde-file-manager/default.nix
@ -8,7 +8,6 @@
 , dde-qt-dbus-factory
 , docparser
 , dde-dock
-, deepin-movie-reborn
 , cmake
 , qttools
 , qtx11extras
@ -43,13 +42,13 @@

 stdenv.mkDerivation rec {
  pname = "dde-file-manager";
-  version = "6.0.14";
+  version = "6.0.15";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    sha256 = "sha256-88Ddc3986hyFMA0bYCxiupASI+pGLqjb3igOHLA8Q/g=";
+    sha256 = "sha256-tG3Wl1AvwWhHmIIHgexv3mVVrmOwNrwn8k/sD4+WZzk=";
  };

  nativeBuildInputs = [
@ -91,14 +90,12 @@ stdenv.mkDerivation rec {
  buildInputs = [
    dtkwidget
    qt5platform-plugins
-    qt5integration
    deepin-pdfium
    util-dfm
    dde-qt-dbus-factory
    glibmm
    docparser
    dde-dock
-    deepin-movie-reborn
    qtx11extras
    qtmultimedia
    kcodecs
@ -127,6 +124,11 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
+  qtWrapperArgs = [
+    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
+  ];
+
  preFixup = ''
    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';
--- a/pkgs/desktops/deepin/go-package/dde-daemon/0003-search-in-XDG-directories.patch
+++ b/pkgs/desktops/deepin/go-package/dde-daemon/0003-search-in-XDG-directories.patch
@ -1,22 +1,22 @@
-From 528f590c0c81728c324444fd76e0f7113a2e3dc4 Mon Sep 17 00:00:00 2001
-From: rewine <lhongxu@outlook.com>
-Date: Wed, 5 Apr 2023 23:41:25 +0800
+From a0667a7e82b3176e64122f4d68c43de4fa350780 Mon Sep 17 00:00:00 2001
+From: rewine <luhongxu@deepin.org>
+Date: Tue, 18 Apr 2023 17:04:36 +0800
 Subject: [PATCH 3/4] search-in-XDG-directories

 ---
 accounts/manager.go                     |  5 ++++-
 accounts/user.go                        |  8 +++++++-
 appearance/fsnotify.go                  | 21 +++++++++++++++++----
+ appearance/ifc.go                       |  3 ++-
 apps/utils.go                           |  3 ++-
- dock/desktop_file_path.go               |  6 ++++++
 gesture/config.go                       |  4 ++--
 keybinding/shortcuts/system_shortcut.go |  4 +++-
 mime/app_info.go                        |  7 ++++++-
 system/gesture/config.go                |  4 +++-
- 9 files changed, 50 insertions(+), 12 deletions(-)
+ 9 files changed, 46 insertions(+), 13 deletions(-)

 diff --git a/accounts/manager.go b/accounts/manager.go
-index a5abb157..3fd7c153 100644
+index 22c26ce7..009d9dd9 100644
 --- a/accounts/manager.go
 +++ b/accounts/manager.go
@@ -15,6 +15,7 @@ import (
@ -40,7 +40,7 @@ index a5abb157..3fd7c153 100644
 
 type InterfaceConfig struct {
 diff --git a/accounts/user.go b/accounts/user.go
-index 99138941..56a7731a 100644
+index 900033c6..f8827fb2 100644
 --- a/accounts/user.go
 +++ b/accounts/user.go
@@ -15,6 +15,7 @@ import (
@ -51,7 +51,7 @@ index 99138941..56a7731a 100644
 	dbus "github.com/godbus/dbus"
 	"github.com/linuxdeepin/dde-daemon/accounts/users"
 	authenticate "github.com/linuxdeepin/go-dbus-factory/com.deepin.daemon.authenticate"
-@@ -645,7 +646,12 @@ func getUserSession(homeDir string) string {
+@@ -649,7 +650,12 @@ func getUserSession(homeDir string) string {
 }
 
 func getSessionList() []string {
@ -119,6 +119,27 @@ index a409d0ba..ff674600 100644
 
 	m.watchDirs(iconDirs)
 }
+diff --git a/appearance/ifc.go b/appearance/ifc.go
+index f0bf32a3..6d60ffe4 100644
+--- a/appearance/ifc.go
+++ b/appearance/ifc.go
+@@ -10,6 +10,7 @@ import (
+ 	"strconv"
+ 	"strings"
+ 
+	"github.com/adrg/xdg"
+ 	"github.com/godbus/dbus"
+ 	"github.com/linuxdeepin/dde-daemon/appearance/fonts"
+ 	"github.com/linuxdeepin/dde-daemon/appearance/subthemes"
+@@ -265,7 +266,7 @@ func (m *Manager) thumbnail(ty, name string) (string, error) {
+ 	case TypeGtkTheme:
+ 		fName, ok := gtkThumbnailMap[name]
+ 		if ok {
+-			return filepath.Join("/usr/share/dde-daemon/appearance", fName+".svg"), nil
+			return xdg.SearchDataFile(filepath.Join("dde-daemon/appearance", fName+".svg"))
+ 		}
+ 		return subthemes.GetGtkThumbnail(name)
+ 	case TypeIconTheme:
 diff --git a/apps/utils.go b/apps/utils.go
 index 8863d6c2..dd6f8e16 100644
 --- a/apps/utils.go
@ -140,30 +161,6 @@ index 8863d6c2..dd6f8e16 100644
 }
 
 // get user home
-diff --git a/dock/desktop_file_path.go b/dock/desktop_file_path.go
-index 7adc9f55..e1a97679 100644
--- a/dock/desktop_file_path.go
-+++ b/dock/desktop_file_path.go
-@@ -7,6 +7,8 @@ package dock
- import (
- 	"path/filepath"
- 	"strings"
-+
-+	"github.com/adrg/xdg"
- )
- 
- var pathDirCodeMap map[string]string
-@@ -20,6 +22,10 @@ func initPathDirCodeMap() {
- 		"/usr/local/share/applications/": "/L@",
- 	}
- 
-+	for _, dataPath := range xdg.DataDirs {
-+		pathDirCodeMap[dataPath] = "/S@"
-+	}
-+
- 	dir := filepath.Join(homeDir, ".local/share/applications")
- 	dir = addDirTrailingSlash(dir)
- 	pathDirCodeMap[dir] = "/H@"
 diff --git a/gesture/config.go b/gesture/config.go
 index bfbd4db7..4ce9d641 100644
 --- a/gesture/config.go
@ -190,7 +187,7 @@ index bfbd4db7..4ce9d641 100644
 	gsKeyTouchPadEnabled    = "touch-pad-enabled"
 	gsKeyTouchScreenEnabled = "touch-screen-enabled"
 diff --git a/keybinding/shortcuts/system_shortcut.go b/keybinding/shortcuts/system_shortcut.go
-index d33a69f6..c3138099 100644
+index eaec22b5..95e1b222 100644
 --- a/keybinding/shortcuts/system_shortcut.go
 +++ b/keybinding/shortcuts/system_shortcut.go
@@ -10,6 +10,7 @@ import (
@ -253,5 +250,5 @@ index d4aebaac..f3fc92c3 100644
 +	return filepath;
 }
 -- 
-2.39.2
+2.38.1

--- a/pkgs/desktops/deepin/go-package/dde-daemon/default.nix
+++ b/pkgs/desktops/deepin/go-package/dde-daemon/default.nix
@ -58,6 +58,9 @@ buildGoPackage rec {
  ];

  postPatch = ''
+    substituteInPlace dock/desktop_file_path.go \
+      --replace "/usr/share" "/run/current-system/sw/share"
+
    substituteInPlace session/eventlog/{app_event.go,login_event.go} accounts/users/users_test.go \
      --replace "/bin/bash" "${runtimeShell}"

--- a/pkgs/desktops/xfce/core/tumbler/default.nix
+++ b/pkgs/desktops/xfce/core/tumbler/default.nix
@ -15,9 +15,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "tumbler";
-  version = "4.18.0";
+  version = "4.18.1";

-  sha256 = "sha256-qxbS0PMhwVk2I3fbblJEeIuI72xSWVsQx5SslhOvg+c=";
+  sha256 = "sha256-hn77W8IsvwNc9xSuDe9rXw9499olOvvJ2P7q+26HIG8=";

  buildInputs = [
    libxfce4util
--- a/pkgs/desktops/xfce/core/xfconf/default.nix
+++ b/pkgs/desktops/xfce/core/xfconf/default.nix
@ -3,9 +3,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "xfconf";
-  version = "4.18.0";
+  version = "4.18.1";

-  sha256 = "sha256-8zl2EWV1DRHsH0QUNa13OKvfIVDVOhIO0FCMbU978Js=";
+  sha256 = "sha256-HS+FzzTTAH8lzBBai3ESdnuvvvZW/vAVSmGe57mwcoo=";

  nativeBuildInputs = [ gobject-introspection vala ];

--- a/pkgs/desktops/xfce/panel-plugins/xfce4-genmon-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-genmon-plugin/default.nix
@ -5,6 +5,7 @@
 , intltool
 , libxfce4util
 , xfce4-panel
+, xfconf
 , libxfce4ui
 , gtk3
 , gitUpdater
@ -14,11 +15,11 @@ let
  category = "panel-plugins";
 in stdenv.mkDerivation rec {
  pname  = "xfce4-genmon-plugin";
-  version = "4.1.1";
+  version = "4.2.0";

  src = fetchurl {
    url = "mirror://xfce/src/${category}/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-shGf0P8Z+ik7l+yXsN6OJBeZ4IuGIYUVFnxWi9m1ATU=";
+    sha256 = "sha256-lI0I7l8hQIR/EJtTG8HUzGJoSWkT6nYA08WtiQJaA2I=";
  };

  nativeBuildInputs = [
@ -30,6 +31,7 @@ in stdenv.mkDerivation rec {
    libxfce4util
    libxfce4ui
    xfce4-panel
+    xfconf
    gtk3
  ];

--- a/pkgs/desktops/xfce/panel-plugins/xfce4-timer-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-timer-plugin/default.nix
@ -1,16 +1,28 @@
-{ lib, stdenv, fetchurl, pkg-config, intltool, libxfce4util, xfce4-panel, libxfce4ui, gtk3, hicolor-icon-theme, gitUpdater }:
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, intltool
+, libxfce4util
+, xfce4-panel
+, libxfce4ui
+, glib
+, gtk3
+, hicolor-icon-theme
+, gitUpdater
+}:

 let
  category = "panel-plugins";
 in

 stdenv.mkDerivation rec {
-  pname  = "xfce4-timer-plugin";
-  version = "1.7.1";
+  pname = "xfce4-timer-plugin";
+  version = "1.7.2";

  src = fetchurl {
    url = "mirror://xfce/src/${category}/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-S1LSkRsZSelFlxvmUzFV7mupnHcHjqx/1DsPKuyoJOM=";
+    sha256 = "sha256-/rO4wtOVBegWaDVAoyJr172ocMy8tMfQ9qv+7/XFi30=";
  };

  nativeBuildInputs = [
@ -22,6 +34,7 @@ stdenv.mkDerivation rec {
    libxfce4util
    libxfce4ui
    xfce4-panel
+    glib
    gtk3
    hicolor-icon-theme
  ];
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@ -1,6 +1,8 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchurl
 , aspell
+, groff
 , pkg-config
 , glib
 , hunspell
@ -11,16 +13,17 @@

 stdenv.mkDerivation rec {
  pname = "enchant";
-  version = "2.3.3";
+  version = "2.3.4";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-PaEhA/Ec9Jw88v0s4wF1dcUyGkieW5v6gd2R7EE/OJE=";
+    sha256 = "sha256-H34mdE2xyaD+ph0hafTlwc5DXPjCcxw34+QFQRnplKA=";
  };

  nativeBuildInputs = [
+    groff
    pkg-config
  ];

--- a/pkgs/development/libraries/httplib/default.nix
+++ b/pkgs/development/libraries/httplib/default.nix
@ -5,13 +5,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "httplib";
-  version = "0.12.1";
+  version = "0.12.2";

  src = fetchFromGitHub {
    owner = "yhirose";
    repo = "cpp-httplib";
    rev = "v${version}";
-    hash = "sha256-F0MXuScZP2kmyCWv+DVXOB9rRk2T7hMgum7Zbs8X7QI=";
+    hash = "sha256-mpHw9fzGpYz04rgnfG/qTNrXIf6q+vFfIsjb56kJsLg=";
  };

  # Header-only library.
--- a/pkgs/development/ocaml-modules/facile/default.nix
+++ b/pkgs/development/ocaml-modules/facile/default.nix
@ -1,5 +1,8 @@
 { lib, fetchurl, buildDunePackage, ocaml }:

+lib.throwIf (lib.versionAtLeast ocaml.version "5.0")
+  "facile is not available for OCaml ≥ 5.0"
+
 buildDunePackage rec {
  pname = "facile";
  version = "1.1.4";
@ -11,8 +14,8 @@ buildDunePackage rec {

  doCheck = true;

-  useDune2 = lib.versionAtLeast ocaml.version "4.12";
-  postPatch = lib.optionalString useDune2 "dune upgrade";
+  duneVersion = if lib.versionAtLeast ocaml.version "4.12" then "2" else "1";
+  postPatch = lib.optionalString (duneVersion != "1") "dune upgrade";

  meta = {
    homepage = "http://opti.recherche.enac.fr/facile/";
--- a/pkgs/development/ocaml-modules/nonstd/default.nix
+++ b/pkgs/development/ocaml-modules/nonstd/default.nix
@ -1,5 +1,8 @@
 { lib, fetchzip, buildDunePackage, ocaml }:

+lib.throwIf (lib.versionAtLeast ocaml.version "5.0")
+  "nonstd is not available for OCaml ≥ 5.0"
+
 buildDunePackage rec {
  pname = "nonstd";
  version = "0.0.3";
@ -11,8 +14,8 @@ buildDunePackage rec {
    sha256 = "0ccjwcriwm8fv29ij1cnbc9win054kb6pfga3ygzdbjpjb778j46";
  };

-  useDune2 = lib.versionAtLeast ocaml.version "4.12";
-  postPatch = lib.optionalString useDune2 "dune upgrade";
+  duneVersion = if lib.versionAtLeast ocaml.version "4.12" then "2" else "1";
+  postPatch = lib.optionalString (duneVersion != "1") "dune upgrade";
  doCheck = true;

  meta = with lib; {
--- a/pkgs/development/python-modules/execnb/default.nix
+++ b/pkgs/development/python-modules/execnb/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "execnb";
-  version = "0.1.4";
+  version = "0.1.5";
  format = "setuptools";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-y9gSvzJA8Fsh56HbA8SszlozsBBfTLfgWGDXm9uSBvA=";
+    sha256 = "sha256-nuAp4OMAfA3u3DJyORjFw7y7ZLsLCKEfxSFIXqNh+k0=";
  };

  propagatedBuildInputs = [ fastcore traitlets ipython ];
--- a/pkgs/development/python-modules/iocextract/default.nix
+++ b/pkgs/development/python-modules/iocextract/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "iocextract";
-  version = "1.15.1";
+  version = "1.15.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "InQuest";
    repo = "python-iocextract";
    rev = "refs/tags/v${version}";
-    hash = "sha256-muto8lr3sP44bLFIoAuPeS8pRv7pNP1JFKaAJV01TZY=";
+    hash = "sha256-l0TGi3Y3/Dcwyp80eRWYYlDaDDJdpc31fcxdYEVvQas=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/niaclass/default.nix
+++ b/pkgs/development/python-modules/niaclass/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "niaclass";
-  version = "0.1.3";
+  version = "0.1.4";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -21,8 +21,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "lukapecnik";
    repo = "NiaClass";
-    rev = version;
-    sha256 = "sha256-BDGDcIlunnaH3J9sEuDrwWsBR4Wjcy6Kxpxy9Dr6BlM=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-md1e/cOIOQKoB760E5hjzjCsC5tS1CzgqAPTeVtrmuo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/renault-api/default.nix
+++ b/pkgs/development/python-modules/renault-api/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "renault-api";
-  version = "0.1.12";
+  version = "0.1.13";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "hacf-fr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-uSyqAs0JqrsFuMpfuILoIGxLL+HVOGI/euCZziCgEdQ=";
+    hash = "sha256-BpPow6fZGAk0kzcEo5tOleyVMNUOl7RE2I5y76ntNRM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/snakeviz/default.nix
+++ b/pkgs/development/python-modules/snakeviz/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "snakeviz";
-  version = "2.1.1";
+  version = "2.1.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0d96c006304f095cb4b3fb7ed98bb866ca35a7ca4ab9020bbc27d295ee4c94d9";
+    sha256 = "sha256-K4qRmrtefpKv41EnhguMJ2sqeXvv/OLayGFPmM/4byE=";
  };

  # Upstream doesn't run tests from setup.py
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "flow";
-  version = "0.203.1";
+  version = "0.204.0";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "flow";
    rev = "v${version}";
-    sha256 = "sha256-y06RI2g7W37HyY+wgGab6hoaskdq45NBxCFZYQmmctE=";
+    sha256 = "sha256-263ZbEDGiZI/2dSLxs966+wtSHG2QMnTtzJ7hPQ4Ix8=";
  };

  postPatch = ''
--- a/pkgs/development/tools/cloud-nuke/default.nix
+++ b/pkgs/development/tools/cloud-nuke/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cloud-nuke";
-  version = "0.29.2";
+  version = "0.29.4";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-hf86r5Q9fvk+vJsOjm6tqj6hT1eZpf8gtOmHA6wKwr0=";
+    hash = "sha256-qQrgeUmsCOLlmeU4kwtovo/3cK9Vqzeng7W9M+j+hdk=";
  };

  vendorHash = "sha256-6+uQAEp+fRlRrwfJR0eDMXs0mEQwzWadLxCrXrDREhs=";
--- a/pkgs/development/tools/database/mermerd/default.nix
+++ b/pkgs/development/tools/database/mermerd/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "mermerd";
-  version = "0.6.1";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "KarnerTh";
    repo = "mermerd";
    rev = "refs/tags/v${version}";
-    hash = "sha256-8GXI5UEDGx5E+YzcAoguvKeNTwpC5ftReIvrKGg31ZA=";
+    hash = "sha256-nlertvmuP9Fiuc4uVrgKzfxjOY/sE9udKZLe51t0GEY=";
  };

  vendorHash = "sha256-RSCpkQymvUvY2bOkjhsyKnDa3vezUjC33Nwv0+O4OOQ=";
--- a/pkgs/development/tools/jet/default.nix
+++ b/pkgs/development/tools/jet/default.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "jet";
-  version = "0.4.23";
+  version = "0.4.24";

  src = fetchurl {
    url = "https://github.com/borkdude/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-ijqMyzmF1C3+5oT3ho1MSkoGuFJGvjhh7WWF/JDV/j8=";
+    sha256 = "sha256-8UIPDq+POe5Ss4H8ecHkheYKul4FpGzQgWGQ0N7h41M=";
  };

  extraNativeImageBuildArgs = [
--- a/pkgs/development/tools/ruff/Cargo.lock
+++ b/pkgs/development/tools/ruff/Cargo.lock
@ -153,15 +153,6 @@ version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"

-[[package]]
-name = "block-buffer"
-version = "0.10.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cce20737498f97b993470a6e536b8523f0af7892a4f928cceb1ac5e52ebe7e"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "bstr"
 version = "0.2.17"
@ -446,15 +437,6 @@ version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5827cebf4670468b8772dd191856768aedcb1b0278a04f989f7766351917b9dc"

-[[package]]
-name = "cpufeatures"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d997bd5e24a5928dd43e46dc529867e207907fe0b239c3477d924f7f2ca320"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "crc32fast"
 version = "1.3.2"
@ -549,16 +531,6 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"

-[[package]]
-name = "crypto-common"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
 [[package]]
 name = "ctor"
 version = "0.1.26"
@ -625,16 +597,6 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8"

-[[package]]
-name = "digest"
-version = "0.10.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8168378f4e5023e7218c89c891c0fd8ecdb5e5e4f18cb78f38cf245dd021e76f"
-dependencies = [
- "block-buffer",
- "crypto-common",
-]
-
 [[package]]
 name = "dirs"
 version = "4.0.0"
@ -774,7 +736,7 @@ checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"

 [[package]]
 name = "flake8-to-ruff"
-version = "0.0.261"
+version = "0.0.262"
 dependencies = [
 "anyhow",
 "clap 4.1.8",
@ -825,16 +787,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "generic-array"
-version = "0.14.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bff49e947297f3312447abdca79f45f4738097cc82b06e72054d2223f601f1b9"
-dependencies = [
- "typenum",
- "version_check",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.2.8"
@ -1018,9 +970,6 @@ dependencies = [
 "console",
 "lazy_static",
 "linked-hash-map",
- "pest",
- "pest_derive",
- "serde",
 "similar",
 "yaml-rust",
 ]
@ -1560,50 +1509,6 @@ version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"

-[[package]]
-name = "pest"
-version = "2.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "028accff104c4e513bad663bbcd2ad7cfd5304144404c31ed0a77ac103d00660"
-dependencies = [
- "thiserror",
- "ucd-trie",
-]
-
-[[package]]
-name = "pest_derive"
-version = "2.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ac3922aac69a40733080f53c1ce7f91dcf57e1a5f6c52f421fadec7fbdc4b69"
-dependencies = [
- "pest",
- "pest_generator",
-]
-
-[[package]]
-name = "pest_generator"
-version = "2.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d06646e185566b5961b4058dd107e0a7f56e77c3f484549fb119867773c0f202"
-dependencies = [
- "pest",
- "pest_meta",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "pest_meta"
-version = "2.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6f60b2ba541577e2a0c307c8f39d1439108120eb7903adeb6497fa880c59616"
-dependencies = [
- "once_cell",
- "pest",
- "sha2",
-]
-
 [[package]]
 name = "petgraph"
 version = "0.6.3"
@ -1977,8 +1882,9 @@ dependencies = [

 [[package]]
 name = "ruff"
-version = "0.0.261"
+version = "0.0.262"
 dependencies = [
+ "annotate-snippets 0.9.1",
 "anyhow",
 "bitflags",
 "chrono",
@ -2004,6 +1910,7 @@ dependencies = [
 "pathdiff",
 "pep440_rs",
 "pretty_assertions",
+ "quick-junit",
 "regex",
 "result-like",
 "ruff_cache",
@ -2013,6 +1920,7 @@ dependencies = [
 "ruff_python_semantic",
 "ruff_python_stdlib",
 "ruff_rustpython",
+ "ruff_text_size",
 "rustc-hash",
 "rustpython-common",
 "rustpython-parser",
@ -2021,6 +1929,7 @@ dependencies = [
 "serde",
 "serde_json",
 "shellexpand",
+ "similar",
 "smallvec",
 "strum",
 "strum_macros",
@ -2040,6 +1949,8 @@ dependencies = [
 "mimalloc",
 "once_cell",
 "ruff",
+ "ruff_python_ast",
+ "rustpython-parser",
 "serde",
 "serde_json",
 "tikv-jemallocator",
@ -2060,7 +1971,7 @@ dependencies = [

 [[package]]
 name = "ruff_cli"
-version = "0.0.261"
+version = "0.0.262"
 dependencies = [
 "annotate-snippets 0.9.1",
 "anyhow",
@ -2082,7 +1993,6 @@ dependencies = [
 "mimalloc",
 "notify",
 "path-absolutize",
- "quick-junit",
 "rayon",
 "regex",
 "ruff",
@ -2176,6 +2086,7 @@ dependencies = [
 "once_cell",
 "regex",
 "ruff_rustpython",
+ "ruff_text_size",
 "rustc-hash",
 "rustpython-common",
 "rustpython-parser",
@ -2543,17 +2454,6 @@ dependencies = [
 "serde",
 ]

-[[package]]
-name = "sha2"
-version = "0.10.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82e6b795fe2e3b1e845bafcb27aa35405c4d47cdfc92af5fc8d3002f76cebdc0"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
 [[package]]
 name = "shellexpand"
 version = "3.0.0"
@ -2936,18 +2836,6 @@ version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"

-[[package]]
-name = "typenum"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
-
-[[package]]
-name = "ucd-trie"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e79c4d996edb816c91e4308506774452e55e95c3c9de07b6729e17e15a5ef81"
-
 [[package]]
 name = "unic-char-property"
 version = "0.9.0"
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "ruff";
-  version = "0.0.261";
+  version = "0.0.262";

  src = fetchFromGitHub {
    owner = "charliermarsh";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-YFhMrmZ1Zv4nIWWxq6A7PU0VYayugmJKbbkz+AdGJ+I=";
+    hash = "sha256-G+Cz/5dL/5kOOJ1fGGecwGOiONYdwFWOPQ5KV0W2DVA=";
  };

  # We have to use importCargoLock here because `cargo vendor` currently doesn't support workspace
--- a/pkgs/development/tools/rust/cargo-chef/default.nix
+++ b/pkgs/development/tools/rust/cargo-chef/default.nix
@ -2,14 +2,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-chef";
-  version = "0.1.52";
+  version = "0.1.56";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-eUFQT2zYABRtTqWxMi+AyU1ZHdt8+B1nMC0Sz6IK6+w=";
+    sha256 = "sha256-WsK4hdV20IcG2bF8LumeII8e91330zCtR0+A3EPYtAk=";
  };

-  cargoHash = "sha256-uzuITRUvAOsuFaq+dkO8tRyozwUt4xB/3BP3mNCxr2g=";
+  cargoHash = "sha256-L/4m47TJHGSOC8/94qnjea5Febck7RtPaVVYi4/Pn5s=";

  meta = with lib; {
    description = "A cargo-subcommand to speed up Rust Docker builds using Docker layer caching";
--- a/pkgs/os-specific/linux/ksmbd-tools/default.nix
+++ b/pkgs/os-specific/linux/ksmbd-tools/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "ksmbd-tools";
-  version = "3.4.7";
+  version = "3.4.8";

  src = fetchFromGitHub {
    owner = "cifsd-team";
    repo = pname;
    rev = version;
-    sha256 = "sha256-uYJhjxarAqJC/aY8UUy7sjhA89LVoCG6B7/APkE0ouk=";
+    sha256 = "sha256-R/OWZekAGtDxE71MrzjWsdpaWGBu0c+VP0VkPro6GEo=";
  };

  buildInputs = [ glib libnl ] ++ lib.optional withKerberos libkrb5;
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@ -737,7 +737,7 @@ stdenv.mkDerivation (finalAttrs: {

    tests = {
      inherit (nixosTests) switchTest;
-      cross = pkgsCross.aarch64-multiplatform.systemd;
+      cross = pkgsCross.${if stdenv.buildPlatform.isAarch64 then "gnu64" else "aarch64-multiplatform"}.systemd;
    };
  };

--- a/pkgs/servers/irc/ergochat/default.nix
+++ b/pkgs/servers/irc/ergochat/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "ergo";
-  version = "2.11.0";
+  version = "2.11.1";

  src = fetchFromGitHub {
    owner = "ergochat";
    repo = "ergo";
    rev = "v${version}";
-    sha256 = "sha256-sZ2HSfYa7Xiu7dw8dUgqaf/tCh66bLlrXC+46J5i3iQ=";
+    sha256 = "sha256-LBKGwtprhtDHaghnU6YPQ4Pf2fqD8VN7OV9gzvFgLPY=";
  };

-  vendorSha256 = null;
+  vendorHash = null;

  passthru.tests.ergochat = nixosTests.ergochat;

--- a/pkgs/servers/monitoring/grafana-dash-n-grab/default.nix
+++ b/pkgs/servers/monitoring/grafana-dash-n-grab/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "grafana-dash-n-grab";
-  version = "0.3.1";
+  version = "0.4.3";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "esnet";
    repo = "gdg";
-    sha256 = "sha256-M4V4ybOizXCLxTTuS17M0y2tRmjQmTIBdXVbumzOoeA=";
+    sha256 = "sha256-L7EFDLCbXp8ooQY9QxbfT0ooL1oC+z8LwpEvH4CvivE=";
  };

-  vendorSha256 = "sha256-pXo80Tean5OkQ0Sv2+/RlRnAtaClwGP7tuDC2irsh+E=";
+  vendorHash = "sha256-7K2NTpknzJvKOfJ4gruV99BIvgtGgsre8ybqWTQ09tQ=";

  ldflags = [
    "-s"
--- a/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
@ -6,17 +6,17 @@

 buildGoModule rec {
  pname = "artifactory_exporter";
-  version = "1.12.0";
+  version = "1.13.0";
  rev = "v${version}";

  src = fetchFromGitHub {
    owner = "peimanja";
    repo = pname;
    rev = rev;
-    hash = "sha256-EFjWDoWPePbPX9j4vuI41TAlGcFRlUyPpSvJriZdR0U=";
+    hash = "sha256-URavjOb0OEFul4jM3VR0buIMXmNU7nLJ0R3e8vRUWQ8=";
  };

-  vendorHash = "sha256-5yzBKgjJCv4tgdBS6XmZUq1ebbka0LOuv6BARWO7kQg=";
+  vendorHash = "sha256-Gin134G4NPK8M2E2RrgH62ieiuCw15jwm9SJg03w9ts=";

  subPackages = [ "." ];

--- a/pkgs/servers/sftpgo/default.nix
+++ b/pkgs/servers/sftpgo/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "sftpgo";
-  version = "2.4.4";
+  version = "2.4.5";

  src = fetchFromGitHub {
    owner = "drakkan";
    repo = "sftpgo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-gB3r7Q4M4pXHB9cfCRU8hMccWaJ170es0CJfbo/7lsg=";
+    hash = "sha256-r7vnUzI0NBXe1bFLB3k/fl9+4Sby2W0WsN7SSqaPUgc=";
  };

-  vendorHash = "sha256-og3mn0iYl6aubcSAUohqG4ZSqdBB4AQYZtpKfbp7kcQ=";
+  vendorHash = "sha256-MAx5ue2YpEtkglPMHr+fep1Scw/ST2D6zkKVNWUbF0c=";

  ldflags = [
    "-s"
--- a/pkgs/test/make-binary-wrapper/default.nix
+++ b/pkgs/test/make-binary-wrapper/default.nix
@ -52,7 +52,7 @@ let
    "prefix"
    "suffix"
  ] makeGoldenTest // lib.optionalAttrs (! stdenv.isDarwin) {
-    cross = pkgsCross.aarch64-multiplatform.callPackage ./cross.nix { };
+    cross = pkgsCross.${if stdenv.buildPlatform.isAarch64 then "gnu64" else "aarch64-multiplatform"}.callPackage ./cross.nix { };
  };
 in

--- a/pkgs/tools/compression/unzrip/default.nix
+++ b/pkgs/tools/compression/unzrip/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "unzrip";
-  version = "unstable-2023-03-13";
+  version = "unstable-2023-04-16";

  src = fetchFromGitHub {
    owner = "quininer";
    repo = "unzrip";
-    rev = "bd2dffd43c3235857500190571602f3ce58c5f70";
-    hash = "sha256-Ih47xF4JYQf10RuTnfJJGUAJwyxDxCAdTTCdwGf4i/U=";
+    rev = "14ba4b4c9ff9c80444ecef762d665acaa5aecfce";
+    hash = "sha256-QYu4PXWQGagj7r8lLs0IngIXzt6B8uq2qonycaGDg6g=";
  };

-  cargoHash = "sha256-11UESSKvTcr6Wa0cASRSQ55kBbRL5AelI6thv3oi0sI=";
+  cargoHash = "sha256-9CjKSdd+E2frI8VvdOawYQ3u+KF22xw9kBpnAufRUG0=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/tools/filesystems/tar2ext4/default.nix
+++ b/pkgs/tools/filesystems/tar2ext4/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "tar2ext4";
-  version = "0.9.6";
+  version = "0.9.8";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "hcsshim";
    rev = "v${version}";
-    sha256 = "sha256-sBcagAFjmnLfPFYwOhWIt6bnEXyOKYobvMI2rQf4S5A=";
+    sha256 = "sha256-CvXn5b1kEZ2gYqfKSFRNzqkyOAcfcI1/3etRJTKwqog=";
  };

  sourceRoot = "source/cmd/tar2ext4";
-  vendorSha256 = null;
+  vendorHash = null;

  meta = with lib; {
    description = "Convert a tar archive to an ext4 image";
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "pspg";
-  version = "5.7.4";
+  version = "5.7.5";

  src = fetchFromGitHub {
    owner = "okbob";
    repo = pname;
    rev = version;
-    sha256 = "sha256-HZ771Q1UXnRds6o3EnZMyeu7Lt3IDFVFiUTc5snU0Bo=";
+    sha256 = "sha256-5XHT3Z40PUPO0c6bghDX547E6uEhBLZ6uRhJObVQazo=";
  };

  nativeBuildInputs = [ pkg-config installShellFiles ];
--- a/pkgs/tools/misc/tmux-mem-cpu-load/default.nix
+++ b/pkgs/tools/misc/tmux-mem-cpu-load/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "tmux-mem-cpu-load";
-  version = "3.6.2";
+  version = "3.7.0";

  src = fetchFromGitHub {
    owner = "thewtex";
    repo = "tmux-mem-cpu-load";
    rev = "v${version}";
-    sha256 = "sha256-PQFR0mkt6OhtFlIrJXriNv+aoI9d7Y6y2tBEZrKkRU8=";
+    sha256 = "sha256-4uSCYH31LO/69pxeur8byp9gYG6gaMYIiUxTmd7pag0=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/tools/security/gopass/jsonapi.nix
+++ b/pkgs/tools/security/gopass/jsonapi.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "gopass-jsonapi";
-  version = "1.15.4";
+  version = "1.15.5";

  src = fetchFromGitHub {
    owner = "gopasspw";
    repo = "gopass-jsonapi";
    rev = "v${version}";
-    hash = "sha256-gizUFoe+oAmEKHMlua/zsR+fUltGw2cp98XAgXzCm0U=";
+    hash = "sha256-ZSX5g1agmnPU8Nlmptr3GVrjtPPKbDxouSjz9ulSW44=";
  };

-  vendorHash = "sha256-vMrP6rC0uPsRyFZdU2E9mPp031eob+36NcGueNP1Y7o=";
+  vendorHash = "sha256-JWOBGTJFzihoznYFzcgjayAzNof6Ob5u3Jfx2a6zwEk=";

  subPackages = [ "." ];

--- a/pkgs/tools/security/vals/default.nix
+++ b/pkgs/tools/security/vals/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "vals";
-  version = "0.24.0";
+  version = "0.25.0";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "variantdev";
    repo = pname;
-    sha256 = "sha256-qUcNwpmWoJkrT4ClW8uq2ufFEgmiZQcDG446SSO6mR0=";
+    sha256 = "sha256-MofzTQM/dREw9b+IzjvexKoYZZ/ptbdWICROtwYK4X8=";
  };

  vendorHash = "sha256-6DJiqDEgEHQbyIt4iShoBnagBvspd3W3vD56/FGjESs=";
--- a/pkgs/tools/virtualization/shipyard/default.nix
+++ b/pkgs/tools/virtualization/shipyard/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "shipyard";
-  version = "0.4.14";
+  version = "0.5.2";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "shipyard-run";
    repo = pname;
-    sha256 = "sha256-uXpFLUTRm0urNd9dAUGqoC3vRkTvZd2kG+C9NkXFt/4=";
+    sha256 = "sha256-Fd0R067YGdigG9SyWjXQYyQEnJM7Oug7Qkb0v+zK09g=";
  };
-  vendorSha256 = "sha256-ATXM3+mi/R+/jS6Ds89J75nDVnc3d8iOGhjD3KQZkkA=";
+  vendorHash = "sha256-aE58XYgEWdPtq+DZKtn8Jbw2YIiiJSPutmVEOsG7urk=";

  ldflags = [
    "-s" "-w" "-X main.version=${version}"
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -10306,6 +10306,8 @@ with pkgs;

  nomad-pack = callPackage ../applications/networking/cluster/nomad-pack { };

+  nova = callPackage ../applications/networking/cluster/nova { };
+
  nomino = callPackage ../tools/misc/nomino { };

  nb = callPackage ../tools/misc/nb { };
@ -28643,6 +28645,8 @@ with pkgs;

  vollkorn = callPackage ../data/fonts/vollkorn { };

+  whatsapp-emoji-font = callPackage ../data/fonts/whatsapp-emoji { };
+
  weather-icons = callPackage ../data/fonts/weather-icons { };

  whitesur-gtk-theme = callPackage ../data/themes/whitesur {