Merge staging-next into staging

2023-04-26 18:01:39 +00:00 · 2023-04-26 18:01:39 +00:00 · 63a3bd8731
commit 63a3bd8731
parent e058175ba3 72ac5ba408
66 changed files with 5716 additions and 728 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -5177,6 +5177,13 @@
    githubId = 66178592;
    name = "Pavel Zolotarevskiy";
  };
+  flexiondotorg = {
+    name = "Martin Wimpress";
+    email = "martin@wimpress.org";
+    matrix = "@wimpress:matrix.org";
+    github = "flexiondotorg";
+    githubId = 304639;
+  };
  fliegendewurst = {
    email = "arne.keller@posteo.de";
    github = "FliegendeWurst";
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -190,6 +190,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - Calling `makeSetupHook` without passing a `name` argument is deprecated.

+- Top-level buildPlatform,hostPlatform,targetPlatform have been deprecated, use stdenv.X instead.
+
 - `lib.systems.examples.ghcjs` and consequently `pkgsCross.ghcjs` now use the target triplet `javascript-unknown-ghcjs` instead of `js-unknown-ghcjs`. This has been done to match an [upstream decision](https://gitlab.haskell.org/ghc/ghc/-/commit/6636b670233522f01d002c9b97827d00289dbf5c) to follow Cabal's platform naming more closely. Nixpkgs will also reject `js` as an architecture name.

 - `dokuwiki` has been updated from 2023-07-31a (Igor) to 2023-04-04 (Jack Jackrum), which has [completely removed](https://www.dokuwiki.org/changes#release_2023-04-04_jack_jackrum) the options to embed HTML and PHP for security reasons. The [htmlok plugin](https://www.dokuwiki.org/plugin:htmlok) can be used to regain this functionality.
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -634,6 +634,7 @@ in {
  smokeping = handleTest ./smokeping.nix {};
  snapcast = handleTest ./snapcast.nix {};
  snapper = handleTest ./snapper.nix {};
+  snipe-it = runTest ./web-apps/snipe-it.nix;
  soapui = handleTest ./soapui.nix {};
  sogo = handleTest ./sogo.nix {};
  solanum = handleTest ./solanum.nix {};
--- a/nixos/tests/web-apps/snipe-it.nix
+++ b/nixos/tests/web-apps/snipe-it.nix
@ -0,0 +1,101 @@
+/*
+Snipe-IT NixOS test
+
+It covers the following scenario:
+- Installation
+- Backup and restore
+
+Scenarios NOT covered by this test (but perhaps in the future):
+- Sending and receiving emails
+*/
+{ pkgs, ... }: let
+  siteName = "NixOS Snipe-IT Test Instance";
+in {
+  name = "snipe-it";
+
+  meta.maintainers = with pkgs.lib.maintainers; [ yayayayaka ];
+
+  nodes = {
+    snipeit = { ... }: {
+      services.snipe-it = {
+        enable = true;
+        appKeyFile = toString (pkgs.writeText "snipe-it-app-key" "uTqGUN5GUmUrh/zSAYmhyzRk62pnpXICyXv9eeITI8k=");
+        hostName = "localhost";
+        database.createLocally = true;
+        mail = {
+          driver = "smtp";
+          encryption = "tls";
+          host = "localhost";
+          port = 1025;
+          from.name = "Snipe-IT NixOS test";
+          from.address = "snipe-it@localhost";
+          replyTo.address = "snipe-it@localhost";
+          user = "snipe-it@localhost";
+          passwordFile = toString (pkgs.writeText "snipe-it-mail-pass" "a-secure-mail-password");
+        };
+      };
+    };
+  };
+
+  testScript = { nodes }: let
+    backupPath = "${nodes.snipeit.services.snipe-it.dataDir}/storage/app/backups";
+
+    # Snipe-IT has been installed successfully if the site name shows up on the login page
+    checkLoginPage = { shouldSucceed ? true }: ''
+      snipeit.${if shouldSucceed then "succeed" else "fail"}("""curl http://localhost/login | grep '${siteName}'""")
+    '';
+  in ''
+    start_all()
+
+    snipeit.wait_for_unit("nginx.service")
+    snipeit.wait_for_unit("snipe-it-setup.service")
+
+    # Create an admin user
+    snipeit.succeed(
+        """
+        snipe-it snipeit:create-admin \
+            --username="admin" \
+            --email="janedoe@localhost" \
+            --password="extremesecurepassword" \
+            --first_name="Jane" \
+            --last_name="Doe"
+        """
+    )
+
+    with subtest("Circumvent the pre-flight setup by just writing some settings into the database ourself"):
+        snipeit.succeed(
+            """
+            mysql -D ${nodes.snipeit.services.snipe-it.database.name} -e "INSERT INTO settings (id, user_id, site_name) VALUES ('1', '1', '${siteName}');"
+            """
+        )
+
+        # Usually these are generated during the pre-flight setup
+        snipeit.succeed("snipe-it passport:keys")
+
+
+    # Login page should now contain the configured site name
+    ${checkLoginPage {}}
+
+    with subtest("Test Backup and restore"):
+        snipeit.succeed("snipe-it snipeit:backup")
+
+        # One zip file should have been created
+        snipeit.succeed("""[ "$(ls -1 "${backupPath}" | wc -l)" -eq 1 ]""")
+
+        # Purge the state
+        snipeit.succeed("snipe-it migrate:fresh --force")
+
+        # Login page should disappear
+        ${checkLoginPage { shouldSucceed = false; }}
+
+        # Restore the state
+        snipeit.succeed(
+            """
+            snipe-it snipeit:restore --force $(find "${backupPath}/" -type f -name "*.zip")
+            """
+        )
+
+        # Login page should be back again
+        ${checkLoginPage {}}
+  '';
+}
--- a/pkgs/applications/audio/termusic/default.nix
+++ b/pkgs/applications/audio/termusic/default.nix
@ -10,22 +10,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "termusic";
-  version = "0.7.9";
+  version = "0.7.10";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-ytAKINcZwLyHWbzShxfxRKx4BepM0G2BYdLgwR48g7w=";
+    hash = "sha256-m0hi5u4BcRcEDEpg1BoWXc25dfhD6+OJtqSZfSdV0HM=";
  };

-  cargoHash = "sha256-yxFF5Yqj+xTB3FAJUtgcIeAEHR44JA1xONxGFdG0yS0=";
-
-  patches = [
-    (fetchpatch {
-      name = "fix-panic-when-XDG_AUDIO_DIR-not-set.patch";
-      url = "https://github.com/tramhao/termusic/commit/b6006b22901f1f865a2e3acf7490fd3fa520ca5e.patch";
-      hash = "sha256-1ukQ0y5IRdOndsryuqXI9/zyhCDQ5NIeTan4KCynAv0=";
-    })
-  ];
+  cargoHash = "sha256-A83gLsaPm6t4nm7DJfcp9z1huDU/Sfy9gunP8pzBiCA=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -30,6 +30,7 @@
 , cargo
 , dump_syms
 , makeWrapper
+, mimalloc
 , nodejs
 , perl
 , pkg-config
@ -88,7 +89,7 @@
 , ffmpegSupport ? true
 , gssSupport ? true, libkrb5
 , jackSupport ? stdenv.isLinux, libjack2
-, jemallocSupport ? true, jemalloc
+, jemallocSupport ? !stdenv.hostPlatform.isMusl, jemalloc
 , ltoSupport ? (stdenv.isLinux && stdenv.is64bit && !stdenv.hostPlatform.isRiscV), overrideCC, buildPackages
 , pgoSupport ? (stdenv.isLinux && stdenv.hostPlatform == stdenv.buildPlatform), xvfb-run
 , pipewireSupport ? waylandSupport && webrtcSupport
@ -103,7 +104,7 @@
 # WARNING: NEVER set any of the options below to `true` by default.
 # Set to `!privacySupport` or `false`.

-, crashreporterSupport ? !privacySupport && !stdenv.hostPlatform.isRiscV, curl
+, crashreporterSupport ? !privacySupport && !stdenv.hostPlatform.isRiscV && !stdenv.hostPlatform.isMusl, curl
 , geolocationSupport ? !privacySupport
 , googleAPISupport ? geolocationSupport
 , mlsAPISupport ? geolocationSupport
@ -229,6 +230,12 @@ buildStdenv.mkDerivation ({
      url = "https://hg.mozilla.org/mozilla-central/raw-rev/1068e0955cfb";
      hash = "sha256-iPqmofsmgvlFNm+mqVPbdgMKmP68ANuzYu+PzfCpoNA=";
    })
+  ] ++ [
+    # https://bugzilla.mozilla.org/show_bug.cgi?id=1830040
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/community/firefox/avoid-redefinition.patch?id=2f620d205ed0f9072bbd7714b5ec1b7bf6911c12";
+      hash = "sha256-fLUYaJwhrC/wF24HkuWn2PHqz7LlAaIZ1HYjRDB2w9A=";
+    })
  ]
  ++ lib.optional (lib.versionOlder version "111") ./env_var_for_system_dir-ff86.patch
  ++ lib.optional (lib.versionAtLeast version "111") ./env_var_for_system_dir-ff111.patch
@ -300,25 +307,37 @@ buildStdenv.mkDerivation ({
    # RBox WASM Sandboxing
    export WASM_CC=${pkgsCross.wasi32.stdenv.cc}/bin/${pkgsCross.wasi32.stdenv.cc.targetPrefix}cc
    export WASM_CXX=${pkgsCross.wasi32.stdenv.cc}/bin/${pkgsCross.wasi32.stdenv.cc.targetPrefix}c++
- '' + lib.optionalString pgoSupport ''
-   if [ -e "$TMPDIR/merged.profdata" ]; then
-     echo "Configuring with profiling data"
-     for i in "''${!configureFlagsArray[@]}"; do
-       if [[ ''${configureFlagsArray[i]} = "--enable-profile-generate=cross" ]]; then
-         unset 'configureFlagsArray[i]'
-       fi
-     done
-     configureFlagsArray+=(
-       "--enable-profile-use=cross"
-       "--with-pgo-profile-path="$TMPDIR/merged.profdata""
-       "--with-pgo-jarlog="$TMPDIR/jarlog""
-     )
-   else
-     echo "Configuring to generate profiling data"
-     configureFlagsArray+=(
-       "--enable-profile-generate=cross"
-     )
-   fi
+  '' + lib.optionalString pgoSupport ''
+    if [ -e "$TMPDIR/merged.profdata" ]; then
+      echo "Configuring with profiling data"
+      for i in "''${!configureFlagsArray[@]}"; do
+        if [[ ''${configureFlagsArray[i]} = "--enable-profile-generate=cross" ]]; then
+          unset 'configureFlagsArray[i]'
+        fi
+      done
+      configureFlagsArray+=(
+        "--enable-profile-use=cross"
+        "--with-pgo-profile-path="$TMPDIR/merged.profdata""
+        "--with-pgo-jarlog="$TMPDIR/jarlog""
+      )
+      ${lib.optionalString stdenv.hostPlatform.isMusl ''
+        LDFLAGS="$OLD_LDFLAGS"
+        unset OLD_LDFLAGS
+      ''}
+    else
+      echo "Configuring to generate profiling data"
+      configureFlagsArray+=(
+        "--enable-profile-generate=cross"
+      )
+      ${lib.optionalString stdenv.hostPlatform.isMusl
+      # Set the rpath appropriately for the profiling run
+      # During the profiling run, loading libraries from $out would fail,
+      # since the profiling build has not been installed to $out
+      ''
+        OLD_LDFLAGS="$LDFLAGS"
+        LDFLAGS="-Wl,-rpath,$(pwd)/mozobj/dist/${binaryName}"
+      ''}
+    fi
  '' + lib.optionalString googleAPISupport ''
    # Google API key used by Chromium and Firefox.
    # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
@ -335,6 +354,9 @@ buildStdenv.mkDerivation ({
    configureFlagsArray+=("--with-mozilla-api-keyfile=$TMPDIR/mls-api-key")
  '' + lib.optionalString (enableOfficialBranding && !stdenv.is32bit) ''
    export MOZILLA_OFFICIAL=1
+  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+    # linking firefox hits the vm.max_map_count kernel limit with the default musl allocator
+    export LD_PRELOAD=${mimalloc}/lib/libmimalloc.so
  '';

  # firefox has a different definition of configurePlatforms from nixpkgs, see configureFlags
@ -474,6 +496,12 @@ buildStdenv.mkDerivation ({
  makeFlags = extraMakeFlags;
  separateDebugInfo = enableDebugSymbols;
  enableParallelBuilding = true;
+  env = lib.optionalAttrs stdenv.hostPlatform.isMusl {
+    # Firefox relies on nonstandard behavior of the glibc dynamic linker. It re-uses
+    # previously loaded libraries even though they are not in the rpath of the newly loaded binary.
+    # On musl we have to explicity set the rpath to include these libraries.
+    LDFLAGS = "-Wl,-rpath,${placeholder "out"}/lib/${binaryName}";
+  };

  # tests were disabled in configureFlags
  doCheck = false;
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@ -2,7 +2,7 @@

 (callPackage ./generic.nix { }) {
  channel = "edge";
-  version = "23.3.4";
-  sha256 = "19i0g1vbfyjc2nlqh1iml0siqb3zi91ky8lf83ng40r49p1b1c6h";
-  vendorSha256 = "sha256-f77s+WzLhHGbFdJfNRuhdx/DLFB/JyD5hG8ApCZ+h/s=";
+  version = "23.4.2";
+  sha256 = "1g7ghvxrk906sz6kgclyk078jlbxjm0idx5mbj6ll6q756ncnzyl";
+  vendorSha256 = "sha256-B0vqZBycn2IYxjy0kMOtN3KnQA8ARiKDaH6mT6dtXTo=";
 }
--- a/pkgs/applications/networking/firewalld/default.nix
+++ b/pkgs/applications/networking/firewalld/default.nix
@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "firewalld";
-  version = "1.3.1";
+  version = "1.3.2";

  src = fetchFromGitHub {
    owner = "firewalld";
    repo = "firewalld";
    rev = "v${version}";
-    sha256 = "sha256-P9jErGxylTAgWGoefqglAgU7FNRVpKHVXu9JzyjBnA8=";
+    sha256 = "sha256-xQQRhrbO1m80cgtO3JD4Nq42lh4HGA+a+yZvFYvbyaQ=";
  };

  patches = [
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@ -1,29 +1,37 @@
 { lib, stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which
 , ncurses, perl , cyrus_sasl, gss, gpgme, libkrb5, libidn, libxml2, notmuch, openssl
-, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, w3m, mailcap, sqlite, zlib
-, zstd, enableZstd ? true, enableMixmaster ? false
+, lua, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, w3m, mailcap, sqlite, zlib, lndir
+, pkg-config, zstd, enableZstd ? true, enableMixmaster ? false, enableLua ? false
+, withContrib ? true
 }:

 stdenv.mkDerivation rec {
-  version = "20220429";
+  version = "20230407";
  pname = "neomutt";

  src = fetchFromGitHub {
    owner  = "neomutt";
    repo   = "neomutt";
    rev    = version;
-    sha256 = "sha256-LBY7WtmEMg/PcMS/Tc5XEYunIWjoI4IQfUJURKgy1YA=";
+    sha256 = "sha256-cTZua1AbLMjkMhlUk2aMttj6HdwpJYnRYPuvukSxfwc=";
  };

+  patches = [
+    # https://github.com/neomutt/neomutt/issues/3773#issuecomment-1493295144
+    ./fix-open-very-large-mailbox.patch
+  ];
+
  buildInputs = [
    cyrus_sasl gss gpgme libkrb5 libidn ncurses
    notmuch openssl perl lmdb
    mailcap sqlite
  ]
-  ++ lib.optional enableZstd zstd;
+  ++ lib.optional enableZstd zstd
+  ++ lib.optional enableLua lua;

  nativeBuildInputs = [
    docbook_xsl docbook_xml_dtd_42 gettext libxml2 libxslt.bin makeWrapper tcl which zlib w3m
+    pkg-config
  ];

  enableParallelBuilding = true;
@ -46,10 +54,6 @@ stdenv.mkDerivation rec {
      --replace /etc/mime.types ${mailcap}/etc/mime.types
  '';

-  preBuild = ''
-    export HOME=$(mktemp -d)
-  '';
-
  configureFlags = [
    "--enable-autocrypt"
    "--gpgme"
@ -66,32 +70,41 @@ stdenv.mkDerivation rec {
    "--zlib"
  ]
  ++ lib.optional enableZstd "--zstd"
+  ++ lib.optional enableLua "--lua"
  ++ lib.optional enableMixmaster "--mixmaster";

-  # Fix missing libidn in mutt;
-  # this fix is ugly since it links all binaries in mutt against libidn
-  # like pgpring, pgpewrap, ...
-  NIX_LDFLAGS = "-lidn";
-
  postInstall = ''
    wrapProgram "$out/bin/neomutt" --prefix PATH : "$out/libexec/neomutt"
-  '';
+  ''
+  # https://github.com/neomutt/neomutt-contrib
+  # Contains vim-keys, keybindings presets and more.
+  + lib.optionalString withContrib "${lib.getExe lndir} ${passthru.contrib} $out/share/doc/neomutt";

  doCheck = true;

  preCheck = ''
-    cp -r ${fetchFromGitHub {
-      owner = "neomutt";
-      repo = "neomutt-test-files";
-      rev = "8629adab700a75c54e8e28bf05ad092503a98f75";
-      sha256 = "1ci04nqkab9mh60zzm66sd6mhsr6lya8wp92njpbvafc86vvwdlr";
-    }} $(pwd)/test-files
+    cp -r ${passthru.test-files} $(pwd)/test-files
    chmod -R +w test-files
    (cd test-files && ./setup.sh)

    export NEOMUTT_TEST_DIR=$(pwd)/test-files
  '';

+  passthru = {
+    test-files = fetchFromGitHub {
+      owner = "neomutt";
+      repo = "neomutt-test-files";
+      rev = "1569b826a56c39fd09f7c6dd5fc1163ff5a356a2";
+      sha256 = "sha256-MaH2zEH1Wq3C0lFxpEJ+b/A+k2aKY/sr1EtSPAuRPp8=";
+    };
+    contrib = fetchFromGitHub {
+      owner = "neomutt";
+      repo = "neomutt-contrib";
+      rev = "8e97688693ca47ea1055f3d15055a4f4ecc5c832";
+      sha256 = "sha256-tx5Y819rNDxOpjg3B/Y2lPcqJDArAxVwjbYarVmJ79k=";
+    };
+  };
+
  checkTarget = "test";
  postCheck = "unset NEOMUTT_TEST_DIR";

--- a/pkgs/applications/networking/mailreaders/neomutt/fix-open-very-large-mailbox.patch
+++ b/pkgs/applications/networking/mailreaders/neomutt/fix-open-very-large-mailbox.patch
@ -0,0 +1,51 @@
+diff --git a/mutt_mailbox.c b/mutt_mailbox.c
+index 5581a8187..22f0ca21a 100644
+--- a/mutt_mailbox.c
+++ b/mutt_mailbox.c
+@@ -160,6 +160,9 @@ int mutt_mailbox_check(struct Mailbox *m_cur, CheckStatsFlags flags)
+   st_ctx.st_dev = 0;
+   st_ctx.st_ino = 0;
+
+  if (kInMboxOpen)
+    return 0;
+
+ #ifdef USE_IMAP
+   if (flags & MUTT_MAILBOX_CHECK_FORCE)
+     mutt_update_num_postponed();
+diff --git a/mx.c b/mx.c
+index 4bf5af141..a4e9f83f5 100644
+--- a/mx.c
+++ b/mx.c
+@@ -295,6 +295,8 @@ bool mx_mbox_ac_link(struct Mailbox *m)
+   return true;
+ }
+
+int kInMboxOpen = 0;
+
+ /**
+  * mx_mbox_open - Open a mailbox and parse it
+  * @param m     Mailbox to open
+@@ -386,8 +388,10 @@ bool mx_mbox_open(struct Mailbox *m, OpenMailboxFlags flags)
+   m->msg_tagged = 0;
+   m->vcount = 0;
+
+  kInMboxOpen = 1;
+   enum MxOpenReturns rc = m->mx_ops->mbox_open(m);
+   m->opened++;
+  kInMboxOpen = 0;
+
+   if ((rc == MX_OPEN_OK) || (rc == MX_OPEN_ABORT))
+   {
+diff --git a/mx.h b/mx.h
+index 741431570..43e40bf32 100644
+--- a/mx.h
+++ b/mx.h
+@@ -38,6 +38,8 @@ extern const struct MxOps *mx_ops[];
+
+ extern struct EnumDef MboxTypeDef;
+
+extern int kInMboxOpen;
+
+ typedef uint8_t MsgOpenFlags;      ///< Flags for mx_msg_open_new(), e.g. #MUTT_ADD_FROM
+ #define MUTT_MSG_NO_FLAGS       0  ///< No flags are set
+ #define MUTT_ADD_FROM     (1 << 0) ///< add a From_ line
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@ -42,6 +42,10 @@ stdenv.mkDerivation rec {

    substituteInPlace lib/Makefile.local \
      --replace '-install_name $(libdir)' "-install_name $out/lib"
+
+    # do not override CFLAGS of the Makefile created by mkmf
+    substituteInPlace bindings/Makefile.local \
+      --replace 'CFLAGS="$(CFLAGS) -pipe -fno-plt -fPIC"' ""
  '' + lib.optionalString withEmacs ''
    substituteInPlace emacs/notmuch-emacs-mua \
      --replace 'EMACS:-emacs' 'EMACS:-${emacs}/bin/emacs' \
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
      $out/bin/tutanota-desktop \
      --add-flags $out/share/tutanota-desktop/resources/app.asar \
      --run "mkdir -p /tmp/tutanota" \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libsecret ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libsecret stdenv.cc.cc.lib ]}

    runHook postInstall
  '';
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@ -17,13 +17,13 @@
 }:

 let
-  version = "1.13.0";
+  version = "1.14.0";

  src = fetchFromGitHub {
    owner = "paperless-ngx";
    repo = "paperless-ngx";
    rev = "refs/tags/v${version}";
-    hash = "sha256-aIJWEZD98tjfNDQjQfxRR1kOJ4P/fxZP8sw1dKy7apw=";
+    hash = "sha256-O1Miy0GV34YbE1UrLUWZsatpWyfzFLGvX6fQUJnwbuE=";
  };

  # Use specific package versions required by paperless-ngx
@ -39,18 +39,6 @@ let
        };
      });

-      # downgrade redis due to https://github.com/paperless-ngx/paperless-ngx/pull/1802
-      # and https://github.com/django/channels_redis/issues/332
-      channels-redis = super.channels-redis.overridePythonAttrs (oldAttrs: rec {
-        version = "3.4.1";
-        src = fetchFromGitHub {
-          owner = "django";
-          repo = "channels_redis";
-          rev = version;
-          hash = "sha256-ZQSsE3pkM+nfDhWutNuupcyC5MDikUu6zU4u7Im6bRQ=";
-        };
-      });
-
      channels = super.channels.overridePythonAttrs (oldAttrs: rec {
        version = "3.0.5";
        pname = "channels";
@ -74,6 +62,7 @@ let
          hash = "sha256-KWkMV4L7bA2Eo/u4GGif6lmDNrZAzvYyDiyzyWt9LeI=";
        };
      });
+
    };
  };

@ -93,7 +82,7 @@ let
    pname = "paperless-ngx-frontend";
    inherit version src;

-    npmDepsHash = "sha256-es9x7KR5S7E8KjYWq8ie/EwlAy6zrDvySYQi1vy08Wc=";
+    npmDepsHash = "sha256-wUlybMxnXLNmeu2z+RFFOHVEhH12XD3ZfMo5K+HSBpY=";

    nativeBuildInputs = [
      python3
@ -160,7 +149,10 @@ python.pkgs.buildPythonApplication rec {
    django-compression-middleware
    django-extensions
    django-filter
+    django-guardian
+    django-ipware
    django
+    djangorestframework-guardian2
    djangorestframework
    filelock
    gunicorn
@ -237,6 +229,7 @@ python.pkgs.buildPythonApplication rec {
    whoosh
    zipp
    zope_interface
+    zxing_cpp
  ]
  ++ redis.optional-dependencies.hiredis
  ++ twisted.optional-dependencies.tls
--- a/pkgs/applications/science/physics/crystfel/0002-fix-ftbfs-with-gcc-10.patch
+++ b/pkgs/applications/science/physics/crystfel/0002-fix-ftbfs-with-gcc-10.patch
@ -1,43 +0,0 @@
-Description: Fixing argument mismatches in Fortran code, addressing #957430.
-Author: Andrius Merkys <merkys@debian.org>
-Forwarded: ccp4-dev@dl.ac.uk
--- a/fortran/pack_f.f
-+++ b/fortran/pack_f.f
-@@ -106,7 +106,7 @@
-          endif
-  10   continue
-       filnarray(len(filn) + 1) = 0
-      call pack_wordimage_f(data, x, y, filnarray)
-+      call pack_longimage_f(data, x, y, filnarray)
-       return
-       end
- 
-@@ -138,7 +138,7 @@
-          endif
-  10   continue
-       filnarray(len(filn) + 1) = 0
-      call v2pack_wordimage_f(data, x, y, filnarray)
-+      call v2pack_longimage_f(data, x, y, filnarray)
-       return
-       end
- 
--- a/fortran/lgglib.f
-+++ b/fortran/lgglib.f
-@@ -1236,7 +1236,7 @@
-       B3(2) = XYZ(2) * CELL(2)
-       B3(3) = XYZ(3) * CELL(3)
- C
-      CALL matmult(3,3,3,1,ORTH,B3,XYZ,B1)
-+      CALL matmult(3,3,3,1,ORTH,B3,XYZ)
-       END
- c
- c
-@@ -1274,7 +1274,7 @@
-       B3(1) = XYZ(1)
-       B3(2) = XYZ(2)
-       B3(3) = XYZ(3)
-      CALL matmult(3,3,3,1,ORTH,B3,XYZ,B1)
-+      CALL matmult(3,3,3,1,ORTH,B3,XYZ)
-       END
-       character*80 function getnam(filnam)
-       character*(*) filnam
--- a/pkgs/applications/science/physics/crystfel/default.nix
+++ b/pkgs/applications/science/physics/crystfel/default.nix
@ -3,10 +3,10 @@
 , fetchurl
 , fetchFromGitHub
 , fetchpatch
+, fetchzip
 , cmake
 , lz4
 , bzip2
-, gfortran
 , m4
 , hdf5
 , gsl
@ -38,14 +38,12 @@
 let
  libccp4 = stdenv.mkDerivation rec {
    pname = "libccp4";
-    version = "6.5.1";
+    version = "8.0.0";
    src = fetchurl {
-      # Original mirror, now times out
-      # url = "ftp://ftp.ccp4.ac.uk/opensource/${pname}-${version}.tar.gz";
-      url = "https://deb.debian.org/debian/pool/main/libc/${pname}/${pname}_${version}.orig.tar.gz";
-      sha256 = "1rfvjliny29vy5bdi6rrjaw9hhhhh72pw536xwvqipqcjlylf2r8";
+      url = "https://ftp.ccp4.ac.uk/opensource/${pname}-${version}.tar.gz";
+      hash = "sha256-y4E66GYSoIZjKd6rfO6W6sVz2BvlskA0HUD5rVMi/y0=";
    };
-    nativeBuildInputs = [ gfortran m4 ];
+    nativeBuildInputs = [ meson ninja ];
    buildInputs = [ hdf5 gsl ];

    configureFlags = [ "FFLAGS=-fallow-argument-mismatch" ];
@ -53,16 +51,22 @@ let
    # libccp4 tries to read syminfo.lib by looking at an environment variable, which hinders reproducibility.
    # We hard-code this by providing a little patch and then passing the absolute path to syminfo.lib as a
    # preprocessor flag.
-    preBuild = ''
-      makeFlagsArray+=(CFLAGS='-DNIX_PROVIDED_SYMOP_FILE=\"${placeholder "out"}/share/syminfo.lib\"')
-      export NIX_LDFLAGS="-L${gfortran.cc}/lib64 -L${gfortran.cc}/lib $NIX_LDFLAGS";
-    '';
-    makeFlags = [ "CFLAGS='-DNIX_PROVIDED_SYMOP_FILE=\"${placeholder "out"}/share/syminfo.lib\"" ];
+    env.NIX_CFLAGS_COMPILE = "-DNIX_PROVIDED_SYMOP_FILE=\"${placeholder "out"}/share/ccp4/syminfo.lib\"";

    patches = [
      ./libccp4-use-hardcoded-syminfo-lib.patch
-      ./0002-fix-ftbfs-with-gcc-10.patch
    ];
+
+    postPatch =
+      let
+        mesonPatch = fetchzip {
+          url = "https://wrapdb.mesonbuild.com/v2/libccp4c_8.0.0-1/get_patch#somefile.zip";
+          hash = "sha256-ohskfKh+972Pl56KtwAeWwHtAaAFNpCzz5vZBAI/vdU=";
+        };
+      in
+      ''
+        cp ${mesonPatch}/meson.build .
+      '';
  };
  # This is the statically-linked, pre-built binary of mosflm. Compiling it ourselves turns out to be very difficult
  # since the build process is very hard-coded for a specific machine, architecture, and libraries.
@ -145,10 +149,17 @@ let
    src = fetchFromGitHub {
      owner = "nexusformat";
      repo = pname;
-      rev = "d469f175e5273c1d488e71a6134f84088f57d39c";
-      sha256 = "1jrzzh75i68ad1yrim7s1nx9wy0s49ghkziahs71mm5azprm6gh9";
+      rev = "49e3b65eca772bca77af13ba047d8b577673afba";
+      hash = "sha256-bEzfWdZuHmb0PDzCqy8Dey4tLtq+4coO0sT0GzqrTYI=";
    };

+    patches = [
+      (fetchpatch {
+        url = "https://github.com/spanezz/HDF5-External-Filter-Plugins/commit/6b337fe36da97a3ef72354393687ce3386c0709d.patch";
+        hash = "sha256-wnBEdL/MjEyRHPwaVtuhzY+DW1AFeaUQUmIXh+JaRHo=";
+      })
+    ];
+
    nativeBuildInputs = [ cmake ];
    buildInputs = [ hdf5 lz4 bzip2 ];

@ -184,13 +195,14 @@ stdenv.mkDerivation rec {
  ] ++ lib.optionals withGui [ gtk3 gdk-pixbuf ]
  ++ lib.optionals stdenv.isDarwin [
    argp-standalone
+  ] ++ lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
    memorymappingHook
  ]
-  # hdf5-external-filter-plugins doesn't link on Darwin
-  ++ lib.optionals (withBitshuffle && !stdenv.isDarwin) [ hdf5-external-filter-plugins ];
+  ++ lib.optionals withBitshuffle [ hdf5-external-filter-plugins ];

  patches = [
    ./link-to-argp-standalone-if-needed.patch
+    ./disable-fmemopen-on-aarch64-darwin.patch
    (fetchpatch {
      url = "https://gitlab.desy.de/thomas.white/crystfel/-/commit/3c54d59e1c13aaae716845fed2585770c3ca9d14.diff";
      hash = "sha256-oaJNBQQn0c+z4p1pnW4osRJA2KdKiz4hWu7uzoKY7wc=";
@ -204,7 +216,7 @@ stdenv.mkDerivation rec {
    sed -i -e 's#execlp("mosflm"#execl("${mosflm}/bin/mosflm"#' libcrystfel/src/indexers/mosflm.c;
  '';

-  postInstall = lib.optionalString (withBitshuffle && !stdenv.isDarwin) ''
+  postInstall = lib.optionalString withBitshuffle ''
    for file in $out/bin/*; do
      wrapProgram $file --set HDF5_PLUGIN_PATH ${hdf5-external-filter-plugins}/lib/plugins
    done
@ -224,7 +236,7 @@ stdenv.mkDerivation rec {
    downloadPage = "https://www.desy.de/~twhite/crystfel/download.html";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ pmiddend ];
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    platforms = platforms.unix;
  };

 }
--- a/pkgs/applications/science/physics/crystfel/disable-fmemopen-on-aarch64-darwin.patch
+++ b/pkgs/applications/science/physics/crystfel/disable-fmemopen-on-aarch64-darwin.patch
@ -0,0 +1,13 @@
+diff --git a/libcrystfel/src/image-cbf.c b/libcrystfel/src/image-cbf.c
+index b8f09a1f..f8a15c1b 100644
+--- a/libcrystfel/src/image-cbf.c
+++ b/libcrystfel/src/image-cbf.c
+@@ -287,7 +287,7 @@ static float *read_cbf_data(const char *filename, int gz, int *w, int *h)
+ 
+ 	} else {
+ 
+-		#ifdef HAVE_ZLIB
+		#if defined(HAVE_ZLIB) && !(defined(__aarch64__) && defined(__APPLE__))
+ 		gzFile gzfh;
+ 		int len_read;
+ 		size_t len;
--- a/pkgs/applications/version-management/github-desktop/default.nix
+++ b/pkgs/applications/version-management/github-desktop/default.nix
@ -3,6 +3,7 @@
 , fetchurl
 , autoPatchelfHook
 , wrapGAppsHook
+, makeWrapper
 , gnome
 , libsecret
 , git
@ -29,7 +30,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    autoPatchelfHook
-    wrapGAppsHook
+    (wrapGAppsHook.override { inherit makeWrapper; })
  ];

  buildInputs = [
@ -61,6 +62,12 @@ stdenv.mkDerivation rec {
    ln -sf $out/opt/${pname} $out/bin/${pname}
  '';

+  preFixup = ''
+    gappsWrapperArgs+=(
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland}}"
+    )
+  '';
+
  runtimeDependencies = [
    (lib.getLib systemd)
  ];
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,14 +1,14 @@
 {
-  "version": "15.10.2",
-  "repo_hash": "sha256-XjL1D2DschFn64D2KcTQP6pppecIN26LrWMJPUfYvgI=",
-  "yarn_hash": "1il8dnjb7591ss6w14zibdihg3bylw866jjjclv1qm8cihp8k3y8",
+  "version": "15.11.0",
+  "repo_hash": "sha256-oLdw6hDn7DLWvAt2RoHkixXCkzKm0dt7iid65MPH7kM=",
+  "yarn_hash": "0b4k43512p8lm1bmiq5piv8wg1f0x2h9q8pgwnms7b2xb4sfn0g1",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v15.10.2-ee",
+  "rev": "v15.11.0-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "15.10.2",
-    "GITLAB_PAGES_VERSION": "15.10.2",
+    "GITALY_SERVER_VERSION": "15.11.0",
+    "GITLAB_PAGES_VERSION": "15.11.0",
    "GITLAB_SHELL_VERSION": "14.18.0",
-    "GITLAB_WORKHORSE_VERSION": "15.10.2"
+    "GITLAB_WORKHORSE_VERSION": "15.11.0"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile
@ -18,7 +18,7 @@ gem 'gitlab-labkit', '~> 0.31', '>= 0.31.1'
 # This version needs to be in sync with GitLab CE/EE
 gem 'licensee', '~> 9.15'

-gem 'google-protobuf', '~> 3.22.2'
+gem 'google-protobuf', '~> 3.22.3'
 gem 'nokogiri', '~> 1.14'

 # Rails is currently blocked on the upgrade to the new major version for Redis,
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@ -56,7 +56,7 @@ GEM
      with_env (= 1.1.0)
      xml-simple (~> 1.1.5)
    gitlab-markup (1.8.1)
-    google-protobuf (3.22.2)
+    google-protobuf (3.22.3)
    googleapis-common-protos-types (1.4.0)
      google-protobuf (~> 3.14)
    grpc (1.42.0)
@ -190,7 +190,7 @@ DEPENDENCIES
  gitlab-labkit (~> 0.31, >= 0.31.1)
  gitlab-license_finder
  gitlab-markup (~> 1.8.0)
-  google-protobuf (~> 3.22.2)
+  google-protobuf (~> 3.22.3)
  grpc (~> 1.42.0)
  licensee (~> 9.15)
  nokogiri (~> 1.14)
@ -204,4 +204,4 @@ DEPENDENCIES
  sentry-raven (~> 3.1)

 BUNDLED WITH
-   2.4.8
+   2.4.11
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -11,7 +11,7 @@ let
    gemdir = ./.;
  };

-  version = "15.10.2";
+  version = "15.11.0";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@ -22,10 +22,10 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      sha256 = "sha256-18BmECQqzwwxl7nY5+Bi4oyA2EPd5HqzJdgVPV8J1OM=";
+      sha256 = "sha256-kpqSDtj9ctS5PVWTJv5z/HVXYjIlP6CU/FGgueXwKic=";
    };

-    vendorSha256 = "sha256-knuUyJGz5JvYyKeDQ66cMQQSh2YKkkDB54iCir1QpEY=";
+    vendorSha256 = "sha256-gJelagGPogeCdJtRpj4RaYlqzZRhtU0EIhmj1aK4ZOk=";

    ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];

--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@ -220,10 +220,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1zqyy07ps6zh0gi9nppmnsngzv5nx1qjv726mzhv83sh90rc25nm";
+      sha256 = "1xcg53yz44cqhcpb85w3ay80kvnniy0v441c9p08wb6zzia2mnq9";
      type = "gem";
    };
-    version = "3.22.2";
+    version = "3.22.3";
  };
  googleapis-common-protos-types = {
    dependencies = ["google-protobuf"];
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "15.10.2";
+  version = "15.11.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    sha256 = "sha256-h3Q8dOz61sRhDxRlcPTP+yhP/ntTTqggyAFvTgu6m6k=";
+    sha256 = "sha256-nYpDyLg9nhl6EA0nwUzA+DFtyZVDnwplQTi1KJTwFbU=";
  };

  vendorHash = "sha256-s3HHoz9URACuVVhePQQFviTqlQU7vCLOjTJPBlus1Vo=";
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "15.10.2";
+  version = "15.11.0";

  src = fetchFromGitLab {
    owner = data.owner;
@ -16,7 +16,7 @@ buildGoModule rec {

  sourceRoot = "source/workhorse";

-  vendorSha256 = "sha256-HG/QobU1LsFhbNF4lNq9tLwjcLD2l3TXnsJ+tjqc0Q8=";
+  vendorSha256 = "sha256-/snYfip1f0TCVoPk80thanYpbYsGjEd+CAcxIt289As=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${version}" ];
  doCheck = false;
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -20,11 +20,7 @@ gem 'bootsnap', '~> 1.16.0', require: false
 # Pin openssl to match the version bundled with our supported Rubies.
 # See https://stdgems.org/openssl/#gem-version.
 gem 'openssl', '2.2.2'
-# This gem was originally bundled with Ruby 2.7, but is unbundled as of Ruby 3.
-# Since the latest version caused problems with GitLab, we pin this to an older
-# version for now.
-# See https://gitlab.com/gitlab-org/gitlab/-/issues/376417
-gem 'ipaddr', '1.2.2'
+gem 'ipaddr', '~> 1.2.5'

 # Responders respond_to and respond_with
 gem 'responders', '~> 3.0'
@ -34,7 +30,7 @@ gem 'sprockets', '~> 3.7.0'
 gem 'view_component', '~> 2.74.1'

 # Supported DBs
-gem 'pg', '~> 1.4.5'
+gem 'pg', '~> 1.4.6'

 gem 'rugged', '~> 1.5'
 gem 'grape-path-helpers', '~> 1.7.1'
@ -49,12 +45,12 @@ gem 'declarative_policy', '~> 1.1.0'
 gem 'devise', '~> 4.8.1'
 gem 'devise-pbkdf2-encryptable', '~> 0.0.0', path: 'vendor/gems/devise-pbkdf2-encryptable'
 gem 'bcrypt', '~> 3.1', '>= 3.1.14'
-gem 'doorkeeper', '~> 5.5'
-gem 'doorkeeper-openid_connect', '~> 1.8'
+gem 'doorkeeper', '~> 5.6', '>= 5.6.6'
+gem 'doorkeeper-openid_connect', '~> 1.8', '>= 1.8.5'
 gem 'rexml', '~> 3.2.5'
 gem 'ruby-saml', '~> 1.13.0'
 gem 'omniauth', '~> 2.1.0'
-gem 'omniauth-auth0', '~> 2.0.0'
+gem 'omniauth-auth0', '~> 3.1'
 gem 'omniauth-azure-activedirectory-v2', '~> 2.0'
 gem 'omniauth-azure-oauth2', '~> 0.0.9', path: 'vendor/gems/omniauth-azure-oauth2' # See gem README.md
 gem 'omniauth-cas3', '~> 1.1.4', path: 'vendor/gems/omniauth-cas3' # See vendor/gems/omniauth-cas3/README.md
@ -75,7 +71,7 @@ gem 'openid_connect', '= 1.3.0'
 gem 'omniauth-salesforce', '~> 1.0.5', path: 'vendor/gems/omniauth-salesforce' # See gem README.md
 gem 'omniauth-atlassian-oauth2', '~> 0.2.0'
 gem 'rack-oauth2', '~> 1.21.3'
-gem 'jwt', '~> 2.1.0'
+gem 'jwt', '~> 2.5'

 # Kerberos authentication. EE-only
 gem 'gssapi', '~> 1.3.1', group: :kerberos
@ -102,7 +98,7 @@ gem 'acme-client', '~> 2.0'
 gem 'browser', '~> 5.3.1'

 # OS detection for usage ping
-gem 'ohai', '~> 16.10'
+gem 'ohai', '~> 17.9'

 # GPG
 gem 'gpgme', '~> 2.0.22'
@ -166,6 +162,7 @@ gem 'google-apis-cloudresourcemanager_v1', '~> 0.31.0'
 gem 'google-apis-iam_v1', '~> 0.36.0'
 gem 'google-apis-serviceusage_v1', '~> 0.28.0'
 gem 'google-apis-sqladmin_v1beta4', '~> 0.41.0'
+gem 'google-apis-androidpublisher_v3', '~> 0.34.0'

 # for aws storage
 gem 'unf', '~> 0.1.4'
@ -177,9 +174,9 @@ gem 'seed-fu', '~> 2.3.7'
 gem 'elasticsearch-model', '~> 7.2'
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation'
 gem 'elasticsearch-api',   '7.13.3'
-gem 'aws-sdk-core', '~> 3.170.1'
+gem 'aws-sdk-core', '~> 3.171.0'
 gem 'aws-sdk-cloudformation', '~> 1'
-gem 'aws-sdk-s3', '~> 1.119.1'
+gem 'aws-sdk-s3', '~> 1.121.0'
 gem 'faraday_middleware-aws-sigv4', '~>0.3.0'
 gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections

@ -200,7 +197,7 @@ gem 'asciidoctor-plantuml', '~> 0.0.16'
 gem 'asciidoctor-kroki', '~> 0.8.0', require: false
 gem 'rouge', '~> 4.1.0'
 gem 'truncato', '~> 0.7.12'
-gem 'nokogiri', '~> 1.14.2'
+gem 'nokogiri', '~> 1.14.3'

 # Calendar rendering
 gem 'icalendar'
@ -210,7 +207,7 @@ gem 'diffy', '~> 3.4'
 gem 'diff_match_patch', '~> 0.1.0'

 # Application server
-gem 'rack', '~> 2.2.6', '>= 2.2.6.2'
+gem 'rack', '~> 2.2.6', '>= 2.2.6.4'
 # https://github.com/zombocom/rack-timeout/blob/master/README.md#rails-apps-manually
 gem 'rack-timeout', '~> 0.6.3', require: 'rack/timeout/base'

@ -230,7 +227,7 @@ gem 'acts-as-taggable-on', '~> 9.0'
 gem 'sidekiq', '~> 6.5.7'
 gem 'sidekiq-cron', '~> 1.8.0'
 gem 'redis-namespace', '~> 1.9.0'
-gem 'gitlab-sidekiq-fetcher', '0.9.0', require: 'sidekiq-reliable-fetch'
+gem 'gitlab-sidekiq-fetcher', path: 'vendor/gems/sidekiq-reliable-fetch', require: 'sidekiq-reliable-fetch'

 # Cron Parser
 gem 'fugit', '~> 1.8.1'
@ -252,6 +249,7 @@ gem 're2', '~> 1.6.0'

 # Misc

+gem 'semver_dialects', '~> 1.2.1'
 gem 'version_sorter', '~> 2.3'

 # Export Ruby Regex to Javascript
@ -289,12 +287,15 @@ gem 'ruby-fogbugz', '~> 0.3.0'
 # Kubernetes integration
 gem 'kubeclient', '~> 4.11.0'

+# AI
+gem 'ruby-openai', '~> 3.7'
+
 # Sanitize user input
 gem 'sanitize', '~> 6.0'
 gem 'babosa', '~> 1.0.4'

 # Sanitizes SVG input
-gem 'loofah', '~> 2.19.1'
+gem 'loofah', '~> 2.20.0'

 # Working with license
 # Detects the open source license the repository includes
@ -333,9 +334,9 @@ gem 'rack-attack', '~> 6.6.1'

 # Sentry integration
 gem 'sentry-raven', '~> 3.1'
-gem 'sentry-ruby', '~> 5.1.1'
-gem 'sentry-rails', '~> 5.1.1'
-gem 'sentry-sidekiq', '~> 5.1.1'
+gem 'sentry-ruby', '~> 5.8.0'
+gem 'sentry-rails', '~> 5.8.0'
+gem 'sentry-sidekiq', '~> 5.8.0'

 # PostgreSQL query parsing
 #
@ -347,7 +348,7 @@ gem 'gitlab-labkit', '~> 0.31.1'
 gem 'thrift', '>= 0.16.0'

 # I18n
-gem 'ruby_parser', '~> 3.19', require: false
+gem 'ruby_parser', '~> 3.20', require: false
 gem 'rails-i18n', '~> 7.0'
 gem 'gettext_i18n_rails', '~> 1.8.0'
 gem 'gettext_i18n_rails_js', '~> 1.3'
@ -365,13 +366,13 @@ gem 'cloud_profiler_agent', '~> 0.0.0', path: 'vendor/gems/cloud_profiler_agent'
 gem 'snowplow-tracker', '~> 0.8.0'

 # Metrics
-gem 'webrick', '~> 1.6.1', require: false
+gem 'webrick', '~> 1.8.1', require: false
 gem 'prometheus-client-mmap', '~> 0.19', require: 'prometheus/client'

 gem 'warning', '~> 1.3.0'

 group :development do
-  gem 'lefthook', '~> 1.3.3', require: false
+  gem 'lefthook', '~> 1.3.10', require: false
  gem 'rubocop'
  gem 'solargraph', '~> 0.47.2', require: false

@ -451,23 +452,23 @@ end

 group :test do
  gem 'fuubar', '~> 2.2.0'
-  gem 'rspec-retry', '~> 0.6.1'
+  gem 'rspec-retry', '~> 0.6.2'
  gem 'rspec_profiling', '~> 0.0.6'
  gem 'rspec-benchmark', '~> 0.6.0'
  gem 'rspec-parameterized', '~> 1.0', require: false

-  gem 'capybara', '~> 3.35.3'
-  gem 'capybara-screenshot', '~> 1.0.22'
-  gem 'selenium-webdriver', '~> 3.142'
+  gem 'capybara', '~> 3.39'
+  gem 'capybara-screenshot', '~> 1.0.26'
+  gem 'selenium-webdriver', '~> 3.142', '>= 3.142.7'

  gem 'graphlyte', '~> 1.0.0'

  gem 'shoulda-matchers', '~> 5.1.0', require: false
  gem 'email_spec', '~> 2.2.0'
-  gem 'webmock', '~> 3.9.1'
+  gem 'webmock', '~> 3.18.1'
  gem 'rails-controller-testing'
  gem 'concurrent-ruby', '~> 1.1'
-  gem 'test-prof', '~> 1.0.7'
+  gem 'test-prof', '~> 1.2.1'
  gem 'rspec_junit_formatter'
  gem 'guard-rspec'
  gem 'axe-core-rspec'
@ -478,9 +479,7 @@ end

 gem 'octokit', '~> 4.15'

-# Updating this gem version here is deprecated. See:
-# https://docs.gitlab.com/ee/development/emails.html#mailroom-gem-updates
-gem 'gitlab-mail_room', '~> 0.0.9', require: 'mail_room'
+gem 'gitlab-mail_room', '~> 0.0.23', require: 'mail_room'

 gem 'email_reply_trimmer', '~> 0.1'
 gem 'html2text'
@ -507,7 +506,7 @@ gem 'net-ntp'
 gem 'ssh_data', '~> 1.3'

 # Spamcheck GRPC protocol definitions
-gem 'spamcheck', '~> 1.0.0'
+gem 'spamcheck', '~> 1.3.0'

 # Gitaly GRPC protocol definitions
 gem 'gitaly', '~> 15.9.0-rc3'
@ -517,7 +516,7 @@ gem 'kas-grpc', '~> 0.0.2'

 gem 'grpc', '~> 1.42.0'

-gem 'google-protobuf', '~> 3.22', '>= 3.22.2'
+gem 'google-protobuf', '~> 3.22', '>= 3.22.3'

 gem 'toml-rb', '~> 2.2.0'

@ -533,7 +532,7 @@ gem 'lograge', '~> 0.5'
 gem 'grape_logging', '~> 1.8'

 # DNS Lookup
-gem 'gitlab-net-dns', '~> 0.9.1'
+gem 'gitlab-net-dns', '~> 0.9.2'

 # Countries list
 gem 'countries', '~> 4.0.0'
@ -546,6 +545,10 @@ gem 'lru_redux'
 # Locked as long as quoted-printable encoding issues are not resolved
 # Monkey-patched in `config/initializers/mail_encoding_patch.rb`
 # See https://gitlab.com/gitlab-org/gitlab/issues/197386
+#
+# `config/initializers/mail_starttls_patch.rb` has also been patched to
+# fix STARTTLS handling until https://github.com/mikel/mail/pull/1536 is
+# released.
 gem 'mail', '= 2.8.1'
 gem 'mail-smtp_pool', '~> 0.1.0', path: 'vendor/gems/mail-smtp_pool', require: false

--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -91,6 +91,13 @@ PATH
      nokogiri (>= 1.4.4)
      omniauth (~> 2.0)

+PATH
+  remote: vendor/gems/sidekiq-reliable-fetch
+  specs:
+    gitlab-sidekiq-fetcher (0.9.0)
+      json (>= 2.5)
+      sidekiq (~> 6.1)
+
 GEM
  remote: https://rubygems.org/
  specs:
@ -192,27 +199,27 @@ GEM
    asciidoctor-plantuml (0.0.16)
      asciidoctor (>= 2.0.17, < 3.0.0)
    ast (2.4.2)
-    atlassian-jwt (0.2.0)
-      jwt (~> 2.1.0)
+    atlassian-jwt (0.2.1)
+      jwt (~> 2.1)
    attr_required (1.0.1)
    autoprefixer-rails (10.2.5.1)
      execjs (> 0)
    awesome_print (1.9.2)
    awrence (1.2.1)
    aws-eventstream (1.2.0)
-    aws-partitions (1.730.0)
+    aws-partitions (1.733.0)
    aws-sdk-cloudformation (1.41.0)
      aws-sdk-core (~> 3, >= 3.99.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.170.1)
+    aws-sdk-core (3.171.0)
      aws-eventstream (~> 1, >= 1.0.2)
      aws-partitions (~> 1, >= 1.651.0)
      aws-sigv4 (~> 1.5)
      jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.62.0)
+    aws-sdk-kms (1.63.0)
      aws-sdk-core (~> 3, >= 3.165.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.119.1)
+    aws-sdk-s3 (1.121.0)
      aws-sdk-core (~> 3, >= 3.165.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.4)
@ -267,15 +274,16 @@ GEM
      bundler (>= 1.2.0, < 3)
      thor (>= 0.18, < 2)
    byebug (11.1.3)
-    capybara (3.35.3)
+    capybara (3.39.0)
      addressable
+      matrix
      mini_mime (>= 0.1.3)
      nokogiri (~> 1.8)
      rack (>= 1.6.0)
      rack-test (>= 0.6.3)
      regexp_parser (>= 1.5, < 3.0)
      xpath (~> 3.2)
-    capybara-screenshot (1.0.22)
+    capybara-screenshot (1.0.26)
      capybara (>= 1.0, < 4)
      launchy
    carrierwave (1.3.3)
@ -308,7 +316,7 @@ GEM
      descendants_tracker (~> 0.0.1)
    colored2 (3.1.2)
    commonmarker (0.23.6)
-    concurrent-ruby (1.2.0)
+    concurrent-ruby (1.2.2)
    connection_pool (2.3.0)
    cork (0.3.0)
      colored2 (~> 3.1)
@ -390,11 +398,11 @@ GEM
    docile (1.4.0)
    domain_name (0.5.20190701)
      unf (>= 0.0.5, < 1.0.0)
-    doorkeeper (5.5.4)
+    doorkeeper (5.6.6)
      railties (>= 5)
-    doorkeeper-openid_connect (1.8.3)
+    doorkeeper-openid_connect (1.8.5)
      doorkeeper (>= 5.5, < 5.7)
-      json-jwt (>= 1.15.0)
+      jwt (>= 2.5)
    dotenv (2.7.6)
    dry-configurable (0.12.0)
      concurrent-ruby (~> 1.0)
@ -447,7 +455,7 @@ GEM
      tzinfo
    ethon (0.15.0)
      ffi (>= 1.15.0)
-    excon (0.90.0)
+    excon (0.99.0)
    execjs (2.8.1)
    expgen (0.1.1)
      parslet
@ -610,12 +618,12 @@ GEM
      pg_query (~> 2.1)
      redis (> 3.0.0, < 6.0.0)
    gitlab-license (2.2.1)
-    gitlab-mail_room (0.0.9)
+    gitlab-mail_room (0.0.23)
+      jwt (>= 2.0)
+      net-imap (>= 0.2.1)
+      oauth2 (>= 1.4.4, < 3)
    gitlab-markup (1.9.0)
-    gitlab-net-dns (0.9.1)
-    gitlab-sidekiq-fetcher (0.9.0)
-      json (>= 2.5)
-      sidekiq (~> 6.1)
+    gitlab-net-dns (0.9.2)
    gitlab-styles (10.0.0)
      rubocop (~> 1.43.0)
      rubocop-graphql (~> 0.18)
@ -629,13 +637,15 @@ GEM
      omniauth (>= 1.3, < 3)
      pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
      rubyntlm (~> 0.5)
-    globalid (1.0.0)
+    globalid (1.1.0)
      activesupport (>= 5.0)
    gon (6.4.0)
      actionpack (>= 3.0.20)
      i18n (>= 0.7)
      multi_json
      request_store (>= 1.0)
+    google-apis-androidpublisher_v3 (0.34.0)
+      google-apis-core (>= 0.9.1, < 2.a)
    google-apis-cloudbilling_v1 (0.21.0)
      google-apis-core (>= 0.9.1, < 2.a)
    google-apis-cloudresourcemanager_v1 (0.31.0)
@ -688,7 +698,7 @@ GEM
      google-cloud-core (~> 1.6)
      googleauth (>= 0.16.2, < 2.a)
      mini_mime (~> 1.0)
-    google-protobuf (3.22.2)
+    google-protobuf (3.22.3)
    googleapis-common-protos (1.4.0)
      google-protobuf (~> 3.14)
      googleapis-common-protos-types (~> 1.2)
@ -818,7 +828,7 @@ GEM
      parser (>= 2.5, != 2.5.1.1)
    invisible_captcha (2.0.0)
      rails (>= 5.0)
-    ipaddr (1.2.2)
+    ipaddr (1.2.5)
    ipaddress (0.8.3)
    jaeger-client (1.1.0)
      opentracing (~> 0.3)
@ -847,7 +857,7 @@ GEM
      uri_template (~> 0.7)
    jsonpath (1.1.2)
      multi_json
-    jwt (2.1.0)
+    jwt (2.5.0)
    kaminari (1.2.2)
      activesupport (>= 4.1.0)
      kaminari-actionview (= 1.2.2)
@ -875,7 +885,7 @@ GEM
      rest-client (~> 2.0)
    launchy (2.5.0)
      addressable (~> 2.7)
-    lefthook (1.3.3)
+    lefthook (1.3.10)
    letter_opener (1.7.0)
      launchy (~> 2.2)
    letter_opener_web (2.0.0)
@ -910,7 +920,7 @@ GEM
      activesupport (>= 4)
      railties (>= 4)
      request_store (~> 1.0)
-    loofah (2.19.1)
+    loofah (2.20.0)
      crass (~> 1.0.2)
      nokogiri (>= 1.5.9)
    lookbook (1.5.3)
@ -937,6 +947,7 @@ GEM
    marginalia (1.11.1)
      actionpack (>= 5.2)
      activerecord (>= 5.2)
+    matrix (0.4.2)
    memoist (0.16.2)
    memory_profiler (1.0.1)
    method_source (1.0.0)
@ -993,7 +1004,7 @@ GEM
    netrc (0.11.0)
    nio4r (2.5.8)
    no_proxy_fix (0.1.2)
-    nokogiri (1.14.2)
+    nokogiri (1.14.3)
      mini_portile2 (~> 2.8.0)
      racc (~> 1.4)
    notiffany (0.1.3)
@ -1011,16 +1022,16 @@ GEM
    octokit (4.25.1)
      faraday (>= 1, < 3)
      sawyer (~> 0.9)
-    ohai (16.10.6)
-      chef-config (>= 12.8, < 17)
-      chef-utils (>= 16.0, < 17)
+    ohai (17.9.0)
+      chef-config (>= 14.12, < 18)
+      chef-utils (>= 16.0, < 18)
      ffi (~> 1.9)
      ffi-yajl (~> 2.2)
      ipaddress
      mixlib-cli (>= 1.7.0)
      mixlib-config (>= 2.0, < 4.0)
      mixlib-log (>= 2.0.1, < 4.0)
-      mixlib-shellout (>= 2.0, < 4.0)
+      mixlib-shellout (~> 3.2, >= 3.2.5)
      plist (~> 3.1)
      train-core
      wmi-lite (~> 1.0)
@ -1036,8 +1047,9 @@ GEM
    omniauth-atlassian-oauth2 (0.2.0)
      omniauth (>= 1.1.1)
      omniauth-oauth2 (>= 1.5)
-    omniauth-auth0 (2.0.0)
-      omniauth-oauth2 (~> 1.4)
+    omniauth-auth0 (3.1.0)
+      omniauth (~> 2)
+      omniauth-oauth2 (~> 1)
    omniauth-azure-activedirectory-v2 (2.0.0)
      omniauth-oauth2 (~> 1.8)
    omniauth-dingtalk-oauth2 (1.0.1)
@ -1122,7 +1134,7 @@ GEM
      tty-color (~> 0.5)
    peek (1.1.0)
      railties (>= 4.0.0)
-    pg (1.4.5)
+    pg (1.4.6)
    pg_query (2.2.1)
      google-protobuf (>= 3.19.2)
    plist (3.6.0)
@ -1162,7 +1174,7 @@ GEM
    pyu-ruby-sasl (0.0.3.3)
    raabro (1.4.0)
    racc (1.6.2)
-    rack (2.2.6.2)
+    rack (2.2.6.4)
    rack-accept (0.4.5)
      rack (>= 0.4)
    rack-attack (6.6.1)
@ -1307,7 +1319,7 @@ GEM
      rspec-expectations (~> 3.11)
      rspec-mocks (~> 3.11)
      rspec-support (~> 3.11)
-    rspec-retry (0.6.1)
+    rspec-retry (0.6.2)
      rspec-core (> 3.3)
    rspec-support (3.12.0)
    rspec_junit_formatter (0.6.0)
@ -1348,13 +1360,15 @@ GEM
      multipart-post (~> 2.0)
    ruby-magic (0.6.0)
      mini_portile2 (~> 2.8)
+    ruby-openai (3.7.0)
+      httparty (>= 0.18.1)
    ruby-progressbar (1.11.0)
    ruby-saml (1.13.0)
      nokogiri (>= 1.10.5)
      rexml
    ruby-statistics (3.0.0)
    ruby2_keywords (0.0.5)
-    ruby_parser (3.19.2)
+    ruby_parser (3.20.0)
      sexp_processor (~> 4.16)
    rubyntlm (0.6.3)
    rubypants (0.2.0)
@ -1389,18 +1403,19 @@ GEM
    selenium-webdriver (3.142.7)
      childprocess (>= 0.5, < 4.0)
      rubyzip (>= 1.2.2)
-    sentry-rails (5.1.1)
+    semver_dialects (1.2.1)
+      pastel (~> 0.8.0)
+      thor (~> 1.2.0)
+      tty-command (~> 0.10.1)
+    sentry-rails (5.8.0)
      railties (>= 5.0)
-      sentry-ruby-core (~> 5.1.1)
+      sentry-ruby (~> 5.8.0)
    sentry-raven (3.1.2)
      faraday (>= 1.0)
-    sentry-ruby (5.1.1)
+    sentry-ruby (5.8.0)
      concurrent-ruby (~> 1.0, >= 1.0.2)
-      sentry-ruby-core (= 5.1.1)
-    sentry-ruby-core (5.1.1)
-      concurrent-ruby
-    sentry-sidekiq (5.1.1)
-      sentry-ruby-core (~> 5.1.1)
+    sentry-sidekiq (5.8.0)
+      sentry-ruby (~> 5.8.0)
      sidekiq (>= 3.0)
    set (1.0.1)
    settingslogic (2.0.9)
@ -1455,7 +1470,7 @@ GEM
    sorted_set (1.0.3)
      rbtree
      set (~> 1.0)
-    spamcheck (1.0.0)
+    spamcheck (1.3.0)
      grpc (~> 1.0)
    spring (4.1.0)
    spring-commands-rspec (1.0.4)
@ -1505,7 +1520,7 @@ GEM
      unicode-display_width (>= 1.1.1, < 3)
    terser (1.0.2)
      execjs (>= 0.3.0, < 3)
-    test-prof (1.0.7)
+    test-prof (1.2.1)
    test_file_finder (0.1.4)
      faraday (~> 1.0)
    text (1.3.1)
@ -1537,6 +1552,8 @@ GEM
      htmlentities (~> 4.3.1)
      nokogiri (>= 1.7.0, <= 2.0)
    tty-color (0.6.0)
+    tty-command (0.10.1)
+      pastel (~> 0.8)
    tty-cursor (0.7.1)
    tty-markdown (0.7.2)
      kramdown (>= 1.16.2, < 3.0)
@ -1613,11 +1630,11 @@ GEM
    webfinger (1.2.0)
      activesupport
      httpclient (>= 2.4)
-    webmock (3.9.1)
-      addressable (>= 2.3.6)
+    webmock (3.18.1)
+      addressable (>= 2.8.0)
      crack (>= 0.3.2)
      hashdiff (>= 0.4.0, < 2.0.0)
-    webrick (1.6.1)
+    webrick (1.8.1)
    websocket-driver (0.7.5)
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
@ -1660,8 +1677,8 @@ DEPENDENCIES
  autoprefixer-rails (= 10.2.5.1)
  awesome_print
  aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.170.1)
-  aws-sdk-s3 (~> 1.119.1)
+  aws-sdk-core (~> 3.171.0)
+  aws-sdk-s3 (~> 1.121.0)
  axe-core-rspec
  babosa (~> 1.0.4)
  base32 (~> 0.3.0)
@ -1675,8 +1692,8 @@ DEPENDENCIES
  bullet (~> 7.0.2)
  bundler-audit (~> 0.7.0.1)
  bundler-checksum (~> 0.1.0)!
-  capybara (~> 3.35.3)
-  capybara-screenshot (~> 1.0.22)
+  capybara (~> 3.39)
+  capybara-screenshot (~> 1.0.26)
  carrierwave (~> 1.3)
  charlock_holmes (~> 0.7.7)
  cloud_profiler_agent (~> 0.0.0)!
@ -1699,8 +1716,8 @@ DEPENDENCIES
  diff_match_patch (~> 0.1.0)
  diffy (~> 3.4)
  discordrb-webhooks (~> 3.4)
-  doorkeeper (~> 5.5)
-  doorkeeper-openid_connect (~> 1.8)
+  doorkeeper (~> 5.6, >= 5.6.6)
+  doorkeeper-openid_connect (~> 1.8, >= 1.8.5)
  duo_api (~> 1.3)
  ed25519 (~> 1.3.0)
  elasticsearch-api (= 7.13.3)
@ -1734,14 +1751,15 @@ DEPENDENCIES
  gitlab-fog-azure-rm (~> 1.7.0)
  gitlab-labkit (~> 0.31.1)
  gitlab-license (~> 2.2.1)
-  gitlab-mail_room (~> 0.0.9)
+  gitlab-mail_room (~> 0.0.23)
  gitlab-markup (~> 1.9.0)
-  gitlab-net-dns (~> 0.9.1)
-  gitlab-sidekiq-fetcher (= 0.9.0)
+  gitlab-net-dns (~> 0.9.2)
+  gitlab-sidekiq-fetcher!
  gitlab-styles (~> 10.0.0)
  gitlab_chronic_duration (~> 0.10.6.2)
  gitlab_omniauth-ldap (~> 2.2.0)
  gon (~> 6.4.0)
+  google-apis-androidpublisher_v3 (~> 0.34.0)
  google-apis-cloudbilling_v1 (~> 0.21.0)
  google-apis-cloudresourcemanager_v1 (~> 0.31.0)
  google-apis-compute_v1 (~> 0.57.0)
@ -1752,7 +1770,7 @@ DEPENDENCIES
  google-apis-serviceusage_v1 (~> 0.28.0)
  google-apis-sqladmin_v1beta4 (~> 0.41.0)
  google-cloud-storage (~> 1.44.0)
-  google-protobuf (~> 3.22, >= 3.22.2)
+  google-protobuf (~> 3.22, >= 3.22.3)
  gpgme (~> 2.0.22)
  grape (~> 1.5.2)
  grape-entity (~> 0.10.0)
@ -1778,27 +1796,27 @@ DEPENDENCIES
  httparty (~> 0.20.0)
  icalendar
  invisible_captcha (~> 2.0.0)
-  ipaddr (= 1.2.2)
+  ipaddr (~> 1.2.5)
  ipaddress (~> 0.8.3)
  ipynbdiff!
  jira-ruby (~> 2.1.4)
  js_regex (~> 3.8)
  json (~> 2.6.3)
  json_schemer (~> 0.2.18)
-  jwt (~> 2.1.0)
+  jwt (~> 2.5)
  kaminari (~> 1.2.2)
  kas-grpc (~> 0.0.2)
  knapsack (~> 1.21.1)
  kramdown (~> 2.3.1)
  kubeclient (~> 4.11.0)
-  lefthook (~> 1.3.3)
+  lefthook (~> 1.3.10)
  letter_opener_web (~> 2.0.0)
  license_finder (~> 7.0)
  licensee (~> 9.15)
  listen (~> 3.7)
  lockbox (~> 1.1.1)
  lograge (~> 0.5)
-  loofah (~> 2.19.1)
+  loofah (~> 2.20.0)
  lookbook (~> 1.5, >= 1.5.3)
  lru_redux
  mail (= 2.8.1)
@ -1812,16 +1830,16 @@ DEPENDENCIES
  net-ldap (~> 0.17.1)
  net-ntp
  net-protocol (~> 0.1.3)
-  nokogiri (~> 1.14.2)
+  nokogiri (~> 1.14.3)
  oauth2 (~> 2.0)
  octokit (~> 4.15)
-  ohai (~> 16.10)
+  ohai (~> 17.9)
  oj (~> 3.13.21)
  oj-introspect (~> 0.7)
  omniauth (~> 2.1.0)
  omniauth-alicloud (~> 2.0.1)
  omniauth-atlassian-oauth2 (~> 0.2.0)
-  omniauth-auth0 (~> 2.0.0)
+  omniauth-auth0 (~> 3.1)
  omniauth-azure-activedirectory-v2 (~> 2.0)
  omniauth-azure-oauth2 (~> 0.0.9)!
  omniauth-cas3 (~> 1.1.4)!
@ -1843,7 +1861,7 @@ DEPENDENCIES
  parallel (~> 1.19)
  parslet (~> 1.8)
  peek (~> 1.1)
-  pg (~> 1.4.5)
+  pg (~> 1.4.6)
  pg_query (~> 2.2, >= 2.2.1)
  png_quantizator (~> 0.2.1)
  premailer-rails (~> 1.10.3)
@ -1853,7 +1871,7 @@ DEPENDENCIES
  pry-shell (~> 0.6.1)
  puma (~> 5.6.5)
  puma_worker_killer (~> 0.3.1)
-  rack (~> 2.2.6, >= 2.2.6.2)
+  rack (~> 2.2.6, >= 2.2.6.4)
  rack-attack (~> 6.6.1)
  rack-cors (~> 1.1.1)
  rack-oauth2 (~> 1.21.3)
@ -1879,26 +1897,28 @@ DEPENDENCIES
  rspec-benchmark (~> 0.6.0)
  rspec-parameterized (~> 1.0)
  rspec-rails (~> 6.0.1)
-  rspec-retry (~> 0.6.1)
+  rspec-retry (~> 0.6.2)
  rspec_junit_formatter
  rspec_profiling (~> 0.0.6)
  rubocop
  ruby-fogbugz (~> 0.3.0)
  ruby-magic (~> 0.6)
+  ruby-openai (~> 3.7)
  ruby-progressbar (~> 1.10)
  ruby-saml (~> 1.13.0)
-  ruby_parser (~> 3.19)
+  ruby_parser (~> 3.20)
  rubyzip (~> 2.3.2)
  rugged (~> 1.5)
  sanitize (~> 6.0)
  sassc-rails (~> 2.1.0)
  sd_notify (~> 0.1.0)
  seed-fu (~> 2.3.7)
-  selenium-webdriver (~> 3.142)
-  sentry-rails (~> 5.1.1)
+  selenium-webdriver (~> 3.142, >= 3.142.7)
+  semver_dialects (~> 1.2.1)
+  sentry-rails (~> 5.8.0)
  sentry-raven (~> 3.1)
-  sentry-ruby (~> 5.1.1)
-  sentry-sidekiq (~> 5.1.1)
+  sentry-ruby (~> 5.8.0)
+  sentry-sidekiq (~> 5.8.0)
  settingslogic (~> 2.0.9)
  shoulda-matchers (~> 5.1.0)
  sidekiq (~> 6.5.7)
@ -1911,7 +1931,7 @@ DEPENDENCIES
  slack-messenger (~> 2.3.4)
  snowplow-tracker (~> 0.8.0)
  solargraph (~> 0.47.2)
-  spamcheck (~> 1.0.0)
+  spamcheck (~> 1.3.0)
  spring (~> 4.1.0)
  spring-commands-rspec (~> 1.0.4)
  sprite-factory (~> 1.7)
@ -1923,7 +1943,7 @@ DEPENDENCIES
  tanuki_emoji (~> 0.6)
  telesignenterprise (~> 2.2)
  terser (= 1.0.2)
-  test-prof (~> 1.0.7)
+  test-prof (~> 1.2.1)
  test_file_finder (~> 0.1.3)
  thrift (>= 0.16.0)
  timfel-krb5-auth (~> 0.8)
@ -1941,10 +1961,10 @@ DEPENDENCIES
  vmstat (~> 2.3.0)
  warning (~> 1.3.0)
  webauthn (~> 3.0)
-  webmock (~> 3.9.1)
-  webrick (~> 1.6.1)
+  webmock (~> 3.18.1)
+  webrick (~> 1.8.1)
  wikicloth (= 0.8.1)
  yajl-ruby (~> 1.4.3)

 BUNDLED WITH
-   2.4.8
+   2.4.12
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@ -308,10 +308,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ckfiiwv7dnifra7zhbggj96g0x0kzkv0x9n1is7lb86svlm7rjj";
+      sha256 = "08vqx5s0ax71lwis9l1bzy570sch0hpb53031ha2wgvp31sdilig";
      type = "gem";
    };
-    version = "0.2.0";
+    version = "0.2.1";
  };
  attr_encrypted = {
    dependencies = ["encryptor"];
@ -379,10 +379,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0awhivg7pr6b06r1jw663q0g7sm3i08n9n8bvry0qjsc03kq9aij";
+      sha256 = "0lmva6m4jjc1vl4mb45ar6jhwzbaw5mb80yc6s2wi729ijlqqhad";
      type = "gem";
    };
-    version = "1.730.0";
+    version = "1.733.0";
  };
  aws-sdk-cloudformation = {
    dependencies = ["aws-sdk-core" "aws-sigv4"];
@ -401,10 +401,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19myd6fkrxmhrp55g2dlnqw0mnz96qv3zpl3zc0cv44zcbmaffsm";
+      sha256 = "0732vv8zi67z25fss1sdvqx0vv1ap3w6hz1avxzwznkjp002vj39";
      type = "gem";
    };
-    version = "3.170.1";
+    version = "3.171.0";
  };
  aws-sdk-kms = {
    dependencies = ["aws-sdk-core" "aws-sigv4"];
@ -412,10 +412,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "070s86pxrbq98iddq6shdq7g0lrzgsdqnsnc5l4kygvqimliq4dr";
+      sha256 = "0v87zi28dfmrv7bv91yfldccnpd63n295siirbz7wqv1rajn8n02";
      type = "gem";
    };
-    version = "1.62.0";
+    version = "1.63.0";
  };
  aws-sdk-s3 = {
    dependencies = ["aws-sdk-core" "aws-sdk-kms" "aws-sigv4"];
@ -423,10 +423,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1rpnlzsl52znhcki13jkwdshgwf51pn26267481f4fa842gr7xgp";
+      sha256 = "1s5v3799pi7ik53gv7dl02am5pngv6x4azzwx9my09nll4q3lfk8";
      type = "gem";
    };
-    version = "1.119.1";
+    version = "1.121.0";
  };
  aws-sigv4 = {
    dependencies = ["aws-eventstream"];
@ -715,26 +715,26 @@ src:
    version = "11.1.3";
  };
  capybara = {
-    dependencies = ["addressable" "mini_mime" "nokogiri" "rack" "rack-test" "regexp_parser" "xpath"];
+    dependencies = ["addressable" "matrix" "mini_mime" "nokogiri" "rack" "rack-test" "regexp_parser" "xpath"];
    groups = ["test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1viqcpsngy9fqjd68932m43ad6xj656d1x33nx9565q57chgi29k";
+      sha256 = "06b4nlhirsq8ny17s8zgz7qyvl9v41rixj1xkviiiwxlnjz982d3";
      type = "gem";
    };
-    version = "3.35.3";
+    version = "3.39.0";
  };
  capybara-screenshot = {
    dependencies = ["capybara" "launchy"];
-    groups = ["development" "test"];
+    groups = ["test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1x90lh7nf3zi54arjf430s9xdxr3c12xjq1l28izgxqdk8s40q7q";
+      sha256 = "0xqc7hdiw1ql42mklpfvqd2pyfsxmy55cpx0h9y0jlkpl1q96sw1";
      type = "gem";
    };
-    version = "1.0.22";
+    version = "1.0.26";
  };
  carrierwave = {
    dependencies = ["activemodel" "activesupport" "mime-types" "ssrf_filter"];
@ -921,10 +921,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1qnsflsbjj38im8xq35g0vihlz96h09wjn2dad5g543l3vvrkrx5";
+      sha256 = "0krcwb6mn0iklajwngwsg850nk8k9b35dhmc2qkbdqvmifdi2y9q";
      type = "gem";
    };
-    version = "1.2.0";
+    version = "1.2.2";
  };
  connection_pool = {
    groups = ["default"];
@ -1279,21 +1279,21 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "188ybg2cgghcp5r1jpfnbx3anf0z8fzlla72jra0vgwkdylk7qkz";
+      sha256 = "1q2pywgyn6cbnm0fh3dln5z1qgd1g8hvb4x8rppjc1bpfxnfhi13";
      type = "gem";
    };
-    version = "5.5.4";
+    version = "5.6.6";
  };
  doorkeeper-openid_connect = {
-    dependencies = ["doorkeeper" "json-jwt"];
+    dependencies = ["doorkeeper" "jwt"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0vhbw2la2hx9dm0jg14hfah6blwhifrrg7k6nkyl67wga0afgwhd";
+      sha256 = "1xi70vfh121an0gjpi388kqdvkaqqycy7kj8r51jhh25g5l5gvnl";
      type = "gem";
    };
-    version = "1.8.3";
+    version = "1.8.5";
  };
  dotenv = {
    groups = ["default"];
@ -1573,10 +1573,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1bkh80zzjpfglm14rhz116qgz0nb5gvk3ydfjpg14av5407srgh1";
+      sha256 = "0j826kfvzn7nc5pv950n270r0sx1702k988ad11cdlav3dcxxw09";
      type = "gem";
    };
-    version = "0.90.0";
+    version = "0.99.0";
  };
  execjs = {
    groups = ["default"];
@ -2206,14 +2206,15 @@ src:
    version = "2.2.1";
  };
  gitlab-mail_room = {
+    dependencies = ["jwt" "net-imap" "oauth2"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0745kls2bazgk6kbmlq1dmd42z8bgxkyn6ki9snxka8abi5kf037";
+      sha256 = "15wrq4v6xsfql4k6l10gbcfk0a02zh0shr2c3l0wakmjvaj4ymi3";
      type = "gem";
    };
-    version = "0.0.9";
+    version = "0.0.23";
  };
  gitlab-markup = {
    groups = ["default"];
@ -2230,19 +2231,18 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1jylfc47477imjmzc4jq7zsxklhrws6q4bb0zzl33drirf6s1ldw";
+      sha256 = "1785yfzgpzwkwsxi3wadwc3mlxvdj304aapi34482hwx8xwdj9pp";
      type = "gem";
    };
-    version = "0.9.1";
+    version = "0.9.2";
  };
  gitlab-sidekiq-fetcher = {
    dependencies = ["json" "sidekiq"];
    groups = ["default"];
    platforms = [];
    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "15rqw4rx7fwall9ajbgkrv3skh70c0dlwfffvzkch84z0pn1l12l";
-      type = "gem";
+      path = "${src}/vendor/gems/sidekiq-reliable-fetch";
+      type = "path";
    };
    version = "0.9.0";
  };
@ -2285,10 +2285,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1n5yc058i8xhi1fwcp1w7mfi6xaxfmrifdb4r4hjfff33ldn8lqj";
+      sha256 = "0kqm5ndzaybpnpxqiqkc41k4ksyxl41ln8qqr6kb130cdxsf2dxk";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.1.0";
  };
  gon = {
    dependencies = ["actionpack" "i18n" "multi_json" "request_store"];
@ -2301,6 +2301,17 @@ src:
    };
    version = "6.4.0";
  };
+  google-apis-androidpublisher_v3 = {
+    dependencies = ["google-apis-core"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09almff2kzdkciai63365q18wy0dfjhj48h8wa7lk77pjbfxgqfp";
+      type = "gem";
+    };
+    version = "0.34.0";
+  };
  google-apis-cloudbilling_v1 = {
    dependencies = ["google-apis-core"];
    groups = ["default"];
@ -2514,10 +2525,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1zqyy07ps6zh0gi9nppmnsngzv5nx1qjv726mzhv83sh90rc25nm";
+      sha256 = "1xcg53yz44cqhcpb85w3ay80kvnniy0v441c9p08wb6zzia2mnq9";
      type = "gem";
    };
-    version = "3.22.2";
+    version = "3.22.3";
  };
  googleapis-common-protos = {
    dependencies = ["google-protobuf" "googleapis-common-protos-types" "grpc"];
@ -3026,10 +3037,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ycz5z25dykxy4sqdifgw6xszpgiy4hc0nv7sd89hm3x6vk6x497";
+      sha256 = "0ypic2hrmvvcgw7al72raphqv5cs1zvq4w284pwrkvfqsrqrqrsf";
      type = "gem";
    };
-    version = "1.2.2";
+    version = "1.2.5";
  };
  ipaddress = {
    groups = ["default"];
@ -3152,10 +3163,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1w0kaqrbl71cq9sbnixc20x5lqah3hs2i93xmhlfdg2y3by7yzky";
+      sha256 = "0kcmnx6rgjyd7sznai9ccns2nh7p7wnw3mi8a7vf2wkm51azwddq";
      type = "gem";
    };
-    version = "2.1.0";
+    version = "2.5.0";
  };
  kaminari = {
    dependencies = ["activesupport" "kaminari-actionview" "kaminari-activerecord" "kaminari-core"];
@ -3271,10 +3282,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0pfwsag1zm990mk8sgagnzkanaf7c6k6dnwf32pnmbdbs2csfsc2";
+      sha256 = "1csrkaaqxczq2gc9rmi1524l06wc9bxmivjy9vnlwj5hi4v5ikb8";
      type = "gem";
    };
-    version = "1.3.3";
+    version = "1.3.10";
  };
  letter_opener = {
    dependencies = ["launchy"];
@ -3389,10 +3400,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "08qhzck271anrx9y6qa6mh8hwwdzsgwld8q0000rcd7yvvpnjr3c";
+      sha256 = "1mi4ia13fisc97fzd8xcd9wkjdki7zfbmdn1xkdzplicir68gyp8";
      type = "gem";
    };
-    version = "2.19.1";
+    version = "2.20.0";
  };
  lookbook = {
    dependencies = ["actioncable" "activemodel" "css_parser" "htmlbeautifier" "htmlentities" "listen" "railties" "redcarpet" "rouge" "view_component" "yard" "zeitwerk"];
@ -3467,6 +3478,16 @@ src:
    };
    version = "1.11.1";
  };
+  matrix = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1h2cgkpzkh3dd0flnnwfq6f3nl2b1zff9lvqz8xs853ssv5kq23i";
+      type = "gem";
+    };
+    version = "0.4.2";
+  };
  memoist = {
    groups = ["default"];
    platforms = [];
@ -3870,10 +3891,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1djq4rp4m967mn6sxmiw75vz24gfp0w602xv22kk1x3cmi5afrf7";
+      sha256 = "0fnw0z8zl8b5k35g9m5hhc1g4s6ajzjinhyxnqjrx7l7p07fw71v";
      type = "gem";
    };
-    version = "1.14.2";
+    version = "1.14.3";
  };
  notiffany = {
    dependencies = ["nenv" "shellany"];
@ -3934,10 +3955,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "08pc5l9p741g08x7xzbkkyi2kz5m5xr8rdj6hfna9bjzb1p80ddq";
+      sha256 = "01jlkb75ic3aw39q5mxyd8dnb65kqmzfq4shp0gli9n04ihz3765";
      type = "gem";
    };
-    version = "16.10.6";
+    version = "17.9.0";
  };
  oj = {
    groups = ["default"];
@ -3994,15 +4015,15 @@ src:
    version = "0.2.0";
  };
  omniauth-auth0 = {
-    dependencies = ["omniauth-oauth2"];
+    dependencies = ["omniauth" "omniauth-oauth2"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0id5gn14av81kh41cq4q6c9knyvzl7vc4rs3m4pmpd43g2z6jdw2";
+      sha256 = "1g24cnisa3ic3kilx1is2h0wq303qlmx2q5a92yxaal1cgwxlzg7";
      type = "gem";
    };
-    version = "2.0.0";
+    version = "3.1.0";
  };
  omniauth-azure-activedirectory-v2 = {
    dependencies = ["omniauth-oauth2"];
@ -4360,10 +4381,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1wd6nl81nbdwck04hccsm7wf23ghpi8yddd9j4rbwyvyj0sbsff1";
+      sha256 = "07m6lxljabw9kyww5k5lgsxsznsm1v5l14r1la09gqka9b5kv3yr";
      type = "gem";
    };
-    version = "1.4.5";
+    version = "1.4.6";
  };
  pg_query = {
    dependencies = ["google-protobuf"];
@ -4561,10 +4582,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0qvp6h2abmlsl4sqjsvac03cr2mxq6143gbx4kq52rpazp021qsb";
+      sha256 = "1qgwkcb8kxns8d5187cxjaxf18b7dmg9gh6cr9c1125m0bj2pnfk";
      type = "gem";
    };
-    version = "2.2.6.2";
+    version = "2.2.6.4";
  };
  rack-accept = {
    dependencies = ["rack"];
@ -5154,14 +5175,14 @@ src:
  };
  rspec-retry = {
    dependencies = ["rspec-core"];
-    groups = ["development" "test"];
+    groups = ["test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1nnqcg2yd3nn187zbvh4cgx8xsvdk56lz1985qy7232v7i8yidw6";
+      sha256 = "0n6qc0d16h6bgh1xarmc8vc58728mgjcsjj8wcd822c8lcivl0b1";
      type = "gem";
    };
-    version = "0.6.1";
+    version = "0.6.2";
  };
  rspec-support = {
    groups = ["default" "development" "test"];
@ -5294,6 +5315,17 @@ src:
    };
    version = "0.6.0";
  };
+  ruby-openai = {
+    dependencies = ["httparty"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0l0q3f2sks2i0mdd9p8c1shsh1acjij9iasc4vg2la2y0m65swzv";
+      type = "gem";
+    };
+    version = "3.7.0";
+  };
  ruby-progressbar = {
    groups = ["default" "development" "test"];
    platforms = [];
@ -5341,10 +5373,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "15pqbxh15djxpcfkschkwdfhmb3xz7a10zv61qpc7rk3jbfwxbda";
+      sha256 = "1qybplg87pv6kxwyh4nkfn7pa4cisiajbfvh22dzkkbzxyxwil0p";
      type = "gem";
    };
-    version = "3.19.2";
+    version = "3.20.0";
  };
  rubyntlm = {
    groups = ["default"];
@ -5505,16 +5537,27 @@ src:
    };
    version = "3.142.7";
  };
-  sentry-rails = {
-    dependencies = ["railties" "sentry-ruby-core"];
+  semver_dialects = {
+    dependencies = ["pastel" "thor" "tty-command"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0zv5db0wrvs4gjgrqz7fzpihgil1p9b8hm4bmf25ihyxfskz0vlh";
+      sha256 = "08zb8rlr20f1985hyakd9z7f9hc9n34qx1g8cyk5377pb5vgd8b0";
      type = "gem";
    };
-    version = "5.1.1";
+    version = "1.2.1";
+  };
+  sentry-rails = {
+    dependencies = ["railties" "sentry-ruby"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "06vklzpziqryd25k71k8qia4sy7xh10zci9wg7dbzhp2kn82s6y1";
+      type = "gem";
+    };
+    version = "5.8.0";
  };
  sentry-raven = {
    dependencies = ["faraday"];
@ -5528,37 +5571,26 @@ src:
    version = "3.1.2";
  };
  sentry-ruby = {
-    dependencies = ["concurrent-ruby" "sentry-ruby-core"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "09f1zkc99m1z89qf40bd2ik4fdkchm5h5rb77bz2zhn1f8xmcjaf";
-      type = "gem";
-    };
-    version = "5.1.1";
-  };
-  sentry-ruby-core = {
    dependencies = ["concurrent-ruby"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "012xra6f9b9y00wvnd2vks5kw3wrjaz3flm692j8sd3qxs8xhbhm";
+      sha256 = "043isdlj6x9rymj74gh8m6li6yr8b8k4a6lr9swrydxy6ca15sya";
      type = "gem";
    };
-    version = "5.1.1";
+    version = "5.8.0";
  };
  sentry-sidekiq = {
-    dependencies = ["sentry-ruby-core" "sidekiq"];
+    dependencies = ["sentry-ruby" "sidekiq"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1byig501hvjyc3y0x5x0w3h0k3c6lw9j10f3kxx7z8zvfy2n3hz4";
+      sha256 = "0yf7fwc4wczi87bdmb9bksprw66xcsvr1ldskpcmzz592qyi5lch";
      type = "gem";
    };
-    version = "5.1.1";
+    version = "5.8.0";
  };
  set = {
    groups = ["default"];
@ -5785,10 +5817,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "177wcssfjp63vwr4rxma6sx7rc0lszrx4afp2wz3b4a0322s1vnz";
+      sha256 = "1xclr7qk6fwpbwx2hlfcbpw9ki4y61p76i68hj28v0sp49sq4q54";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.3.0";
  };
  spring = {
    groups = ["development" "test"];
@ -6059,10 +6091,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1vg0zjfgibdcgkzb4c25v0f4v6v8mvpzvgcag194rwglmkkyrwkx";
+      sha256 = "09phq7jxfgamv03kjcgibw0f6w3g3mlb9yapji3bxh7cbjvwk2pa";
      type = "gem";
    };
-    version = "1.0.7";
+    version = "1.2.1";
  };
  test_file_finder = {
    dependencies = ["faraday"];
@ -6240,6 +6272,17 @@ src:
    };
    version = "0.6.0";
  };
+  tty-command = {
+    dependencies = ["pastel"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "14hi8xiahfrrnydw6g3i30lxvvz90wp4xsrlhx8mabckrcglfv0c";
+      type = "gem";
+    };
+    version = "0.10.1";
+  };
  tty-cursor = {
    groups = ["default" "development" "test"];
    platforms = [];
@ -6574,20 +6617,20 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0z9k677j9f6jrsj6nkxl2h969q0zyfzqj2ibxldznd5jaqj85xmw";
+      sha256 = "1myj44wvbbqvv18ragv3ihl0h61acgnfwrnj3lccdgp49bgmbjal";
      type = "gem";
    };
-    version = "3.9.1";
+    version = "3.18.1";
  };
  webrick = {
-    groups = ["metrics"];
+    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0z6nv626lzfl7wx407l5x5688layh9qd82k97hrm6pwgj6miwk8b";
+      sha256 = "13qm7s0gr2pmfcl7dxrmq38asaza4w0i2n9my4yzs499j731wh8r";
      type = "gem";
    };
-    version = "1.6.1";
+    version = "1.8.1";
  };
  websocket-driver = {
    dependencies = ["websocket-extensions"];
--- a/pkgs/applications/video/obs-studio/plugins/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/default.nix
@ -32,6 +32,8 @@

  obs-pipewire-audio-capture = callPackage ./obs-pipewire-audio-capture.nix { };

+  obs-source-clone = callPackage ./obs-source-clone.nix { };
+
  obs-source-record = callPackage ./obs-source-record.nix { };

  obs-vaapi = callPackage ./obs-vaapi { };
--- a/pkgs/applications/video/obs-studio/plugins/obs-source-clone.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-source-clone.nix
@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, obs-studio
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-source-clone";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "exeldro";
+    repo = "obs-source-clone";
+    rev = version;
+    sha256 = "sha256-cgqv2QdeGz4Aeoy4Dncw03l7NWGsZN1lsrZH7uHxGxw=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  cmakeFlags = [
+    "-DBUILD_OUT_OF_TREE=On"
+  ];
+
+  postInstall = ''
+    rm -rf $out/obs-plugins $out/data
+  '';
+
+  meta = with lib; {
+    description = "Plugin for OBS Studio to clone sources";
+    homepage = "https://github.com/exeldro/obs-source-clone";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Plus;
+    platforms = [ "x86_64-linux" "i686-linux" ];
+  };
+}
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@ -244,10 +244,21 @@ stdenv.mkDerivation (rec {
                    + "\nIncludes:\n"
                    + withXenfiles (name: x: "* ${name}: ${x.meta.description or "(No description)"}.");
    platforms = [ "x86_64-linux" ];
-    maintainers = with lib.maintainers; [ eelco oxij ];
+    maintainers = [ ];
    license = lib.licenses.gpl2;
+    knownVulnerabilities = [
+      # https://www.openwall.com/lists/oss-security/2023/03/21/1
+      # Affects 3.2 (at *least*) - 4.17
+      "CVE-2022-42332"
+      # https://www.openwall.com/lists/oss-security/2023/03/21/2
+      # Affects 4.11 - 4.17
+      "CVE-2022-42333"
+      "CVE-2022-42334"
+      # https://www.openwall.com/lists/oss-security/2023/03/21/3
+      # Affects 4.15 - 4.17
+      "CVE-2022-42331"
    # https://xenbits.xen.org/docs/unstable/support-matrix.html
-    knownVulnerabilities = lib.optionals (lib.versionOlder version "4.13") [
+    ] ++ lib.optionals (lib.versionOlder version "4.15") [
      "This version of Xen has reached its end of life. See https://xenbits.xen.org/docs/unstable/support-matrix.html"
    ];
  } // (config.meta or {});
--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@ -139,7 +139,7 @@ stdenv.mkDerivation (fBuildAttrs // {
      runHook postBuild
    '';

-    installPhase = fFetchAttrs.installPhase or ''
+    installPhase = fFetchAttrs.installPhase or (''
      runHook preInstall

      # Remove all built in external workspaces, Bazel will recreate them when building
@ -183,7 +183,7 @@ stdenv.mkDerivation (fBuildAttrs // {
      (cd $bazelOut/ && tar czf $out --sort=name --mtime='@1' --owner=0 --group=0 --numeric-owner external/)

      runHook postInstall
-    '';
+    '');

    dontFixup = true;
    allowedRequisites = [];
--- a/pkgs/development/compilers/mrustc/bootstrap.nix
+++ b/pkgs/development/compilers/mrustc/bootstrap.nix
@ -3,8 +3,8 @@
 , mrustc
 , mrustc-minicargo
 , rust
-, llvm_7
-, llvmPackages_7
+, llvm_12
+, llvmPackages_12
 , libffi
 , cmake
 , python3
@ -18,12 +18,14 @@
 }:

 let
-  rustcVersion = "1.29.0";
+  mrustcTargetVersion = "1.54";
+  rustcVersion = "1.54.0";
  rustcSrc = fetchurl {
    url = "https://static.rust-lang.org/dist/rustc-${rustcVersion}-src.tar.gz";
-    sha256 = "1sb15znckj8pc8q3g7cq03pijnida6cg64yqmgiayxkzskzk9sx4";
+    sha256 = "0xk9dhfff16caambmwij67zgshd8v9djw6ha0fnnanlv7rii31dc";
  };
  rustcDir = "rustc-${rustcVersion}-src";
+  outputDir = "output-${rustcVersion}";
 in

 stdenv.mkDerivation rec {
@ -37,20 +39,12 @@ stdenv.mkDerivation rec {
  dontFixLibtool = true;

  patches = [
-    ./patches/0001-use-shared-llvm.patch
-    ./patches/0002-dont-build-llvm.patch
-    ./patches/0003-echo-newlines.patch
-    ./patches/0004-increase-parallelism.patch
+    ./patches/0001-dont-download-rustc.patch
  ];

  postPatch = ''
    echo "applying patch ./rustc-${rustcVersion}-src.patch"
    patch -p0 -d ${rustcDir}/ < rustc-${rustcVersion}-src.patch
-
-    for p in ${lib.concatStringsSep " " llvmPackages_7.compiler-rt.patches}; do
-      echo "applying patch $p"
-      patch -p1 -d ${rustcDir}/src/libcompiler_builtins/compiler-rt < $p
-    done
  '';

  # rustc unfortunately needs cmake to compile llvm-rt but doesn't
@ -69,7 +63,7 @@ stdenv.mkDerivation rec {
  ];
  buildInputs = [
    # for rustc
-    llvm_7 libffi zlib libxml2
+    llvm_12 libffi zlib libxml2
    # for cargo
    openssl
    (curl.override { inherit openssl; })
@ -78,8 +72,8 @@ stdenv.mkDerivation rec {
  makeFlags = [
    # Use shared mrustc/minicargo/llvm instead of rebuilding them
    "MRUSTC=${mrustc}/bin/mrustc"
-    "MINICARGO=${mrustc-minicargo}/bin/minicargo"
-    "LLVM_CONFIG=${llvm_7.dev}/bin/llvm-config"
+    #"MINICARGO=${mrustc-minicargo}/bin/minicargo"  # FIXME: we need to rebuild minicargo locally so --manifest-overrides is applied
+    "LLVM_CONFIG=${llvm_12.dev}/bin/llvm-config"
    "RUSTC_TARGET=${rust.toRustTarget stdenv.targetPlatform}"
  ];

@ -91,26 +85,27 @@ stdenv.mkDerivation rec {
      ${toString makeFlags}
    )

+    touch ${rustcDir}/dl-version
+    export OUTDIR_SUF=-${rustcVersion}
+    export RUSTC_VERSION=${rustcVersion}
+    export MRUSTC_TARGET_VER=${mrustcTargetVersion}
+    export MRUSTC_PATH=${mrustc}/bin/mrustc
+
    echo minicargo.mk: libs
    make -f minicargo.mk "''${flagsArray[@]}" LIBS

-    echo minicargo.mk: deps
-    mkdir -p output/cargo-build
-    # minicargo has concurrency issues when running these; let's build them
-    # without parallelism
-    for crate in regex regex-0.2.11 curl-sys
-    do
-      echo "building $crate"
-      minicargo ${rustcDir}/src/vendor/$crate \
-        --vendor-dir ${rustcDir}/src/vendor \
-        --output-dir output/cargo-build -L output/
-    done
+    echo test
+    make "''${flagsArray[@]}" test
+
+    # disabled because it expects ./bin/mrustc
+    #echo local_tests
+    #make "''${flagsArray[@]}" local_tests

    echo minicargo.mk: rustc
-    make -f minicargo.mk "''${flagsArray[@]}" output/rustc
+    make -f minicargo.mk "''${flagsArray[@]}" ${outputDir}/rustc

    echo minicargo.mk: cargo
-    make -f minicargo.mk "''${flagsArray[@]}" output/cargo
+    make -f minicargo.mk "''${flagsArray[@]}" ${outputDir}/cargo

    echo run_rustc
    make -C run_rustc "''${flagsArray[@]}"
@ -123,17 +118,17 @@ stdenv.mkDerivation rec {
  doCheck = true;
  checkPhase = ''
    runHook preCheck
-    run_rustc/output/prefix/bin/hello_world | grep "hello, world"
+    run_rustc/${outputDir}/prefix/bin/hello_world | grep "hello, world"
    runHook postCheck
  '';

  installPhase = ''
    runHook preInstall
    mkdir -p $out/bin/ $out/lib/
-    cp run_rustc/output/prefix/bin/cargo $out/bin/cargo
-    cp run_rustc/output/prefix/bin/rustc_binary $out/bin/rustc
+    cp run_rustc/${outputDir}/prefix/bin/cargo $out/bin/cargo
+    cp run_rustc/${outputDir}/prefix/bin/rustc_binary $out/bin/rustc

-    cp -r run_rustc/output/prefix/lib/* $out/lib/
+    cp -r run_rustc/${outputDir}/prefix/lib/* $out/lib/
    cp $out/lib/rustlib/${rust.toRustTarget stdenv.targetPlatform}/lib/*.so $out/lib/
    runHook postInstall
  '';
--- a/pkgs/development/compilers/mrustc/default.nix
+++ b/pkgs/development/compilers/mrustc/default.nix
@ -4,9 +4,9 @@
 }:

 let
-  version = "0.9";
+  version = "0.10";
  tag = "v${version}";
-  rev = "15773561e40ca5c8cffe0a618c544b6cfdc5ad7e";
+  rev = "b364724f15fd6fce8234ad8add68107c23a22151";
 in

 stdenv.mkDerivation rec {
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
    owner = "thepowersgang";
    repo = "mrustc";
    rev = tag;
-    sha256 = "194ny7vsks5ygiw7d8yxjmp1qwigd71ilchis6xjl6bb2sj97rd2";
+    sha256 = "0f7kh4n2663sn0z3xib8gzw0s97qpvwag40g2vs3bfjlrbpgi9z0";
  };

  postPatch = ''
--- a/pkgs/development/compilers/mrustc/minicargo.nix
+++ b/pkgs/development/compilers/mrustc/minicargo.nix
@ -12,14 +12,14 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;
  makefile = "minicargo.mk";
-  makeFlags = [ "tools/bin/minicargo" ];
+  makeFlags = [ "bin/minicargo" ];

  installPhase = ''
    runHook preInstall
    mkdir -p $out/bin
-    cp tools/bin/minicargo $out/bin
+    cp bin/minicargo $out/bin

-    # without it, minicargo defaults to "<minicargo_path>/../../bin/mrustc"
+    # without it, minicargo defaults to "<minicargo_path>/../bin/mrustc"
    wrapProgram "$out/bin/minicargo" --set MRUSTC_PATH ${mrustc}/bin/mrustc
    runHook postInstall
  '';
--- a/pkgs/development/compilers/mrustc/patches/0001-dont-download-rustc.patch
+++ b/pkgs/development/compilers/mrustc/patches/0001-dont-download-rustc.patch
@ -0,0 +1,14 @@
+The $(RUSTC_SRC_DL) file already exists, but for some reason Make wants to rebuild
+this target when it has $(RUSTC_SRC_TARBALL) as a dependency.
+
+--- a/minicargo.mk	2023-04-06 08:26:18.408817572 +0200
+++ b/minicargo.mk	2023-04-06 08:27:11.553536996 +0200
+@@ -176,7 +176,7 @@
+ 	@echo [CURL] $@
+ 	@rm -f $@
+ 	@curl -sS https://static.rust-lang.org/dist/$@ -o $@
+-$(RUSTC_SRC_DL): $(RUSTC_SRC_TARBALL) rustc-$(RUSTC_VERSION)-src.patch
+$(RUSTC_SRC_DL): rustc-$(RUSTC_VERSION)-src.patch
+ 	tar -xf $(RUSTC_SRC_TARBALL)
+ 	cd $(RUSTCSRC) && patch -p0 < ../rustc-$(RUSTC_VERSION)-src.patch;
+ 	touch $(RUSTC_SRC_DL)
--- a/pkgs/development/compilers/mrustc/patches/0001-use-shared-llvm.patch
+++ b/pkgs/development/compilers/mrustc/patches/0001-use-shared-llvm.patch
@ -1,12 +0,0 @@
--- a/rustc-1.29.0-src/src/librustc_llvm/lib.rs
--- b/rustc-1.29.0-src/src/librustc_llvm/lib.rs
-@@ -23,6 +23,9 @@
- #![feature(link_args)]
- #![feature(static_nobundle)]
- 
-+// https://github.com/rust-lang/rust/issues/34486
-+#[link(name = "ffi")] extern {}
-+
- // See librustc_cratesio_shim/Cargo.toml for a comment explaining this.
- #[allow(unused_extern_crates)]
- extern crate rustc_cratesio_shim;
--- a/pkgs/development/compilers/mrustc/patches/0002-dont-build-llvm.patch
+++ b/pkgs/development/compilers/mrustc/patches/0002-dont-build-llvm.patch
@ -1,14 +0,0 @@
--- a/minicargo.mk
-+++ b/minicargo.mk
-@@ -116,11 +116,6 @@
- LLVM_CMAKE_OPTS += CMAKE_BUILD_TYPE=RelWithDebInfo
- 
- 
-$(LLVM_CONFIG): $(RUSTCSRC)build/Makefile
-	$Vcd $(RUSTCSRC)build && $(MAKE)
-$(RUSTCSRC)build/Makefile: $(RUSTCSRC)src/llvm/CMakeLists.txt
-	@mkdir -p $(RUSTCSRC)build
-	$Vcd $(RUSTCSRC)build && cmake $(addprefix -D , $(LLVM_CMAKE_OPTS)) ../src/llvm
- 
- 
- #
--- a/pkgs/development/compilers/mrustc/patches/0003-echo-newlines.patch
+++ b/pkgs/development/compilers/mrustc/patches/0003-echo-newlines.patch
@ -1,13 +0,0 @@
--- a/run_rustc/Makefile
-+++ b/run_rustc/Makefile
-@@ -103,7 +103,9 @@
- else
- 	cp $(OUTDIR)build-rustc/release/rustc_binary $(BINDIR)rustc_binary
- endif
-	echo '#!/bin/sh\nd=$$(dirname $$0)\nLD_LIBRARY_PATH="$(abspath $(LIBDIR))" $$d/rustc_binary $$@' >$@
-+	echo '#!$(shell which bash)' > $@
-+	echo 'd=$$(dirname $$0)' >> $@
-+	echo 'LD_LIBRARY_PATH="$(abspath $(LIBDIR))" $$d/rustc_binary $$@' >> $@
- 	chmod +x $@
- 
- $(BINDIR)hello_world: $(RUST_SRC)test/run-pass/hello.rs $(LIBDIR)libstd.rlib $(BINDIR)rustc
--- a/pkgs/development/compilers/mrustc/patches/0004-increase-parallelism.patch
+++ b/pkgs/development/compilers/mrustc/patches/0004-increase-parallelism.patch
@ -1,28 +0,0 @@
--- a/run_rustc/Makefile
-+++ b/run_rustc/Makefile
-@@ -79,14 +79,14 @@
- 	@mkdir -p $(OUTDIR)build-std
- 	@mkdir -p $(LIBDIR)
- 	@echo [CARGO] $(RUST_SRC)libstd/Cargo.toml
-	$VCARGO_TARGET_DIR=$(OUTDIR)build-std RUSTC=$(BINDIR_S)rustc $(CARGO_ENV) $(BINDIR)cargo build --manifest-path $(RUST_SRC)libstd/Cargo.toml  -j 1 --release --features panic-unwind
-+	$VCARGO_TARGET_DIR=$(OUTDIR)build-std RUSTC=$(BINDIR_S)rustc $(CARGO_ENV) $(BINDIR)cargo build --manifest-path $(RUST_SRC)libstd/Cargo.toml  -j $(NIX_BUILD_CORES) --release --features panic-unwind
- 	$Vcp --remove-destination $(OUTDIR)build-std/release/deps/*.rlib $(LIBDIR)
- 	$Vcp --remove-destination $(OUTDIR)build-std/release/deps/*.so $(LIBDIR)
- # libtest
- $(LIBDIR)libtest.rlib: $(BINDIR)rustc_m $(LIBDIR)libstd.rlib $(CARGO_HOME)config
- 	@mkdir -p $(OUTDIR)build-test
- 	@echo [CARGO] $(RUST_SRC)libtest/Cargo.toml
-	$VCARGO_TARGET_DIR=$(OUTDIR)build-test RUSTC=$(BINDIR)rustc_m $(CARGO_ENV) $(BINDIR)cargo build --manifest-path $(RUST_SRC)libtest/Cargo.toml  -j 1 --release
-+	$VCARGO_TARGET_DIR=$(OUTDIR)build-test RUSTC=$(BINDIR)rustc_m $(CARGO_ENV) $(BINDIR)cargo build --manifest-path $(RUST_SRC)libtest/Cargo.toml  -j $(NIX_BUILD_CORES) --release
- 	@mkdir -p $(LIBDIR)
- 	$Vcp --remove-destination $(OUTDIR)build-test/release/deps/*.rlib $(LIBDIR)
- 	$Vcp --remove-destination $(OUTDIR)build-test/release/deps/*.so $(LIBDIR)
-@@ -95,7 +95,7 @@
- $(BINDIR)rustc: $(BINDIR)rustc_m $(BINDIR)cargo $(CARGO_HOME)config $(LIBDIR)libtest.rlib
- 	@mkdir -p $(PREFIX)tmp
- 	@echo [CARGO] $(RUST_SRC)rustc/Cargo.toml
-	$V$(RUSTC_ENV_VARS) TMPDIR=$(abspath $(PREFIX)tmp) CARGO_TARGET_DIR=$(OUTDIR)build-rustc RUSTC=$(BINDIR)rustc_m RUSTC_ERROR_METADATA_DST=$(abspath $(PREFIX)) $(CARGO_ENV) $(BINDIR)cargo build --manifest-path $(RUST_SRC)rustc/Cargo.toml --release -j 1
-+	$V$(RUSTC_ENV_VARS) TMPDIR=$(abspath $(PREFIX)tmp) CARGO_TARGET_DIR=$(OUTDIR)build-rustc RUSTC=$(BINDIR)rustc_m RUSTC_ERROR_METADATA_DST=$(abspath $(PREFIX)) $(CARGO_ENV) $(BINDIR)cargo build --manifest-path $(RUST_SRC)rustc/Cargo.toml --release -j $(NIX_BUILD_CORES)
- 	cp $(OUTDIR)build-rustc/release/deps/*.so $(LIBDIR)
- 	cp $(OUTDIR)build-rustc/release/deps/*.rlib $(LIBDIR)
- ifeq ($(RUSTC_VERSION),1.19.0)
--- a/pkgs/development/libraries/libglibutil/default.nix
+++ b/pkgs/development/libraries/libglibutil/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libglibutil";
-  version = "1.0.68";
+  version = "1.0.69";

  src = fetchFromGitHub {
    owner = "sailfishos";
    repo = pname;
    rev = version;
-    sha256 = "sha256-FlBXSX6ZA6vDV1Kf1QU1XGxkyS3aWGSrwr2RtdVss10=";
+    sha256 = "sha256-+4aAujSmdrcRMnTd6wHHbyQBfC1LRskZ+8MA2d3hDnI=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/nim-packages/karax/default.nix
+++ b/pkgs/development/nim-packages/karax/default.nix
@ -3,6 +3,6 @@
 fetchFromGitHub {
  owner = "karaxnim";
  repo = "karax";
-  rev = "fa4a2dc";
-  sha256 = "0xl83jsfb9l8kb0nfan9h5y6v96iz4psng2fx06a0qmig4993408";
+  rev = "5cf360c";
+  hash = "sha256-TPwQSqi7ciR6QMklWi/bOJnyzCAT1lZyxW4DTiWTALo=";
 }
--- a/pkgs/development/python-modules/djangorestframework-guardian2/default.nix
+++ b/pkgs/development/python-modules/djangorestframework-guardian2/default.nix
@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, django-guardian
+, djangorestframework
+}:
+
+buildPythonPackage rec {
+  pname = "djangorestframework-guardian2";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "johnthagen";
+    repo = "django-rest-framework-guardian2";
+    rev = "v${version}";
+    hash = "sha256-aW20xEmVTAgwayWMJsabmyKNW65NftJyQANtT6JV74U=";
+  };
+
+  postPatch = ''
+    chmod +x manage.py
+    patchShebangs manage.py
+  '';
+
+  propagatedBuildInputs = [
+    django-guardian
+    djangorestframework
+  ];
+
+  checkPhase = ''
+    ./manage.py test
+  '';
+
+  pythonImportsCheck = [ "rest_framework_guardian" ];
+
+  meta = with lib; {
+    description = "Django-guardian support for Django REST Framework";
+    homepage = "https://github.com/johnthagen/django-rest-framework-guardian2/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ e1mo ];
+  };
+}
--- a/pkgs/development/python-modules/tokenizers/Cargo.lock
+++ b/pkgs/development/python-modules/tokenizers/Cargo.lock
--- a/pkgs/development/python-modules/tokenizers/default.nix
+++ b/pkgs/development/python-modules/tokenizers/default.nix
@ -58,7 +58,7 @@ let
 in
 buildPythonPackage rec {
  pname = "tokenizers";
-  version = "0.12.1";
+  version = "0.13.3";

  disabled = pythonOlder "3.7";

@ -66,13 +66,15 @@ buildPythonPackage rec {
    owner = "huggingface";
    repo = pname;
    rev = "python-v${version}";
-    hash = "sha256-XIXKgcqa6ToAH4OkyaaJALOS9F+sD8d5Z71RttRcIsw=";
+    hash = "sha256-QZG5jmr3vbyQs4mVBjwVDR31O66dUM+p39R0htJ1umk=";
  };

-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src sourceRoot;
-    name = "${pname}-${version}";
-    hash = "sha256-Euvf0LNMa2Od+6gY1Ldge/7VPrH5mJoZduRRsb+lM/E=";
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
  };

  sourceRoot = "source/bindings/python";
--- a/pkgs/development/tools/flock/default.nix
+++ b/pkgs/development/tools/flock/default.nix
@ -1,22 +1,30 @@
-{ stdenv, lib, fetchFromGitHub, autoreconfHook, ronn }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, autoreconfHook, ronn }:

 stdenv.mkDerivation rec {
  pname = "flock";
-  version = "0.2.3";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "discoteq";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1vdq22zhdfi7wwndsd6s7fwmz02fsn0x04d7asq4hslk7bjxjjzn";
+    sha256 = "sha256-cCpckORtogs6Nt7c5q2+z0acXAnALdLV6uzxa5ng3s4=";
  };

  nativeBuildInputs = [ autoreconfHook ];
  buildInputs = [ ronn ];

+  patches = [
+    (fetchpatch {
+      name = "fix-format-specifier.patch";
+      url = "https://github.com/discoteq/flock/commit/408bad42eb8d76cdd0c504c2f97f21c0b424c3b1.patch";
+      sha256 = "sha256-YuFKXWTBu9A2kBNqkg1Oek6vDbVo/y8dB1k9Fuh3QmA";
+    })
+  ];
+
  meta = with lib; {
    description = "Cross-platform version of flock(1)";
-    maintainers = [ maintainers.matthewbauer ];
+    maintainers = with maintainers; [ matthewbauer msfjarvis ];
    platforms = platforms.all;
    license = licenses.isc;
  };
--- a/pkgs/servers/foundationdb/cmake.nix
+++ b/pkgs/servers/foundationdb/cmake.nix
@ -85,6 +85,8 @@ let
            "-DOPENSSL_SSL_LIBRARY=${ssl.out}/lib/libssl.so"
          ];

+        hardeningDisable = [ "fortify" ];
+
        env.NIX_CFLAGS_COMPILE = toString [
          # Needed with GCC 12
          "-Wno-error=missing-template-keyword"
--- a/pkgs/servers/foundationdb/default.nix
+++ b/pkgs/servers/foundationdb/default.nix
@ -89,8 +89,8 @@ in with builtins; {
  };

  foundationdb71 = cmakeBuild {
-    version = "7.1.26";
-    sha256  = "sha256-IVUFC2Z/nJAeKr/TtEiHAo+1HUeZuSZ2birwJtiYZx0=";
+    version = "7.1.30";
+    sha256  = "sha256-dAnAE1m2NZLHgP4QJvURBPcxArXvWWdhqEYwh3tU+tU";
    boost   = boost178;
    ssl     = openssl;

--- a/pkgs/servers/irrd/default.nix
+++ b/pkgs/servers/irrd/default.nix
@ -0,0 +1,40 @@
+{ poetry2nix, pkgs, lib }:
+
+let
+  pythonPackages = (poetry2nix.mkPoetryPackages {
+    projectDir = ./.;
+    overrides = [
+      poetry2nix.defaultPoetryOverrides
+      (import ./poetry-git-overlay.nix { inherit pkgs; })
+      (self: super: {
+
+        irrd = super.irrd.overridePythonAttrs (old: {
+          prePatch = ''
+            sed -i '/wheel/d' setup.py
+          '';
+
+          meta = old.meta // {
+            description = "Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format.";
+            license = lib.licenses.mit;
+            homepage = "https://github.com/irrdnet/irrd";
+            maintainers = [ lib.maintainers.n0emis ];
+          };
+        });
+
+        coredis = super.coredis.overridePythonAttrs (old: {
+          buildInputs = old.buildInputs ++ [
+            super.setuptools
+          ];
+        });
+
+        ariadne = super.ariadne.overridePythonAttrs (old: {
+          buildInputs = old.buildInputs ++ [
+            super.setuptools
+          ];
+        });
+
+      })
+    ];
+  }).python.pkgs;
+in pythonPackages.irrd
+
--- a/pkgs/servers/irrd/poetry-git-overlay.nix
+++ b/pkgs/servers/irrd/poetry-git-overlay.nix
@ -0,0 +1,14 @@
+{ pkgs }:
+self: super: {
+
+  irrd = super.irrd.overridePythonAttrs (
+    _: {
+      src = pkgs.fetchgit {
+        url = "https://github.com/irrdnet/irrd.git";
+        rev = "1f6cefbfc70802c67f4a8911c3f0bf2c1cf7e18a";
+        sha256 = "1zmdqqv6vw8gdcwm67gc68lm224cipx6cdjf1dql61684s32g5wm";
+      };
+    }
+  );
+
+}
--- a/pkgs/servers/irrd/poetry.lock
+++ b/pkgs/servers/irrd/poetry.lock
--- a/pkgs/servers/irrd/pyproject.toml
+++ b/pkgs/servers/irrd/pyproject.toml
@ -0,0 +1,15 @@
+[tool.poetry]
+name = "irrd-env"
+version = "0.1.0"
+description = ""
+authors = []
+
+[tool.poetry.dependencies]
+python = "^3.8.1"
+irrd = { git = "https://github.com/irrdnet/irrd.git", tag = "v4.2.6" }
+
+[tool.poetry.dev-dependencies]
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
--- a/pkgs/servers/irrd/update
+++ b/pkgs/servers/irrd/update
@ -0,0 +1,5 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p poetry poetry2nix.cli
+set -eu
+poetry lock
+poetry2nix lock
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@ -15,16 +15,16 @@ let
 in
 buildGoModule rec {
  pname = "minio";
-  version = "2023-04-13T03-08-07Z";
+  version = "2023-04-20T17-56-55Z";

  src = fetchFromGitHub {
    owner = "minio";
    repo = "minio";
    rev = "RELEASE.${version}";
-    sha256 = "sha256-hwNIQO2ZVPs/pw4AiuXMYF6IH/OeXUZ9NMxIWropXVk=";
+    sha256 = "sha256-PMGQwqHXIadPRGPtY1++KNCh1HaeNwUP6pSW0Hf+Nj8=";
  };

-  vendorHash = "sha256-ZBGrZjqrfcF8EYbJwlnpUsV1nOWYmserVV1PXBMkagg=";
+  vendorHash = "sha256-D/LeNIsYTN1P6pSQZ0AICAhqY63nmhodb9xJXr6cJX4=";

  doCheck = false;

--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchurl, fetchFromGitHub, nixosTests, tzdata, wire }:
+{ lib, buildGoModule, fetchurl, fetchFromGitHub, fetchpatch, nixosTests, tzdata, wire }:

 buildGoModule rec {
  pname = "grafana";
@ -18,6 +18,14 @@ buildGoModule rec {
    sha256 = "sha256-HiKr1ier13xUlrwsJrxo60wwqmiPcza2oOLIfMgFWc0=";
  };

+  patches = [
+    (fetchpatch { # https://github.com/grafana/grafana/pull/65790
+      name = "fix-TestIntegrationAMConfigAccess.patch";
+      url = "https://github.com/grafana/grafana/commit/8500eb1c180b4d49a8e17bfd6df675d821d038a4.diff";
+      sha256 = "sha256-TWPn9fLjmCbXGXkxAc3NLTN+0XXjsaspaV4gYKg3+Mk=";
+    })
+  ];
+
  vendorSha256 = "sha256-sUvjZTg2/6UGjc2Qv8YO4IWlS4Y/FzGRVOQ9I/wp/aM=";

  nativeBuildInputs = [ wire ];
@ -48,9 +56,6 @@ buildGoModule rec {
    sed -i -e '/it should change folder successfully and return correct result/{N;s/$/\nt.Skip();/}'\
      pkg/services/libraryelements/libraryelements_patch_test.go

-    # TODO: investigate?
-    substituteInPlace pkg/tests/api/alerting/api_alertmanager_test.go \
-      --replace TestIntegrationAMConfigAccess DontTestIntegrationAMConfigAccess

    # main module (github.com/grafana/grafana) does not contain package github.com/grafana/grafana/scripts/go
    rm -r scripts/go
--- a/pkgs/servers/nats-server/default.nix
+++ b/pkgs/servers/nats-server/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "nats-server";
-  version = "2.9.15";
+  version = "2.9.16";

  src = fetchFromGitHub {
    owner = "nats-io";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-j++DjPMyBVBMOKcZQkkPwTYC0f1PD5vQVtx0yJL75Vw=";
+    hash = "sha256-tkOhPa163hiuk2sbfhHL6JTD7do3rrDZTkLYvwuue+o=";
  };

-  vendorHash = "sha256-bBJZiETZCwtcsH9w43aFwUU8lmttrCKwie4So9kiZc4=";
+  vendorHash = "sha256-OixJhKaPZ58L+eN/cZnsXUPuGhYhFxfMKtqiV/mWLak=";

  doCheck = false;

--- a/pkgs/servers/nitter/default.nix
+++ b/pkgs/servers/nitter/default.nix
@ -7,13 +7,13 @@

 nimPackages.buildNimPackage rec {
  pname = "nitter";
-  version = "unstable-2023-03-28";
+  version = "unstable-2023-04-21";

  src = fetchFromGitHub {
    owner = "zedeus";
    repo = "nitter";
-    rev = "95893eedaa2fb0ca0a0a15257d81b720f7f3eb67";
-    hash = "sha256-nXa8/d8OFFudA4LWpHiCFhnGmvBw2NXMhHMAD9Sp/vk=";
+    rev = "2254a0728c587ebcec51ff08da0bf145606a629e";
+    hash = "sha256-d4KYBCcYbfvEtOqa1umcXmYsBRvhLgpHVoCUfY0XdXI=";
  };

  patches = [
--- a/pkgs/servers/web-apps/snipe-it/default.nix
+++ b/pkgs/servers/web-apps/snipe-it/default.nix
@ -4,6 +4,7 @@
 , fetchFromGitHub
 , dataDir ? "/var/lib/snipe-it"
 , mariadb
+, nixosTests
 }:

 let
@ -42,6 +43,8 @@ in package.override rec {
    sha256 = "0c8cjywhyiywfav2syjkah777qj5f1jrckgri70ypqyxbwgb4rpm";
  };

+  passthru.tests = nixosTests.snipe-it;
+
  meta = with lib; {
    description = "A free open source IT asset/license management system";
    longDescription = ''
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@ -11,48 +11,26 @@
 let
  py = python3 // {
    pkgs = python3.pkgs.overrideScope (self: super: {
-      ipython = super.ipython.overridePythonAttrs (oldAttrs: rec {
-        pname = "ipython";
-        version = "8.5.0";
-
-        src = self.fetchPypi {
-          inherit pname version;
-          sha256 = "sha256-CXvfXNh1dv0GYXnJ9/IIAE96aGTuGyDzfTRsC8sJn4Q=";
-        };
-
-        disabledTests = [ "testIPythonLexer" ] ++ oldAttrs.disabledTests;
-      });
-
-      prompt-toolkit = super.prompt-toolkit.overridePythonAttrs (oldAttrs: rec {
-        version = "3.0.28";
-        src = self.fetchPypi {
-          pname = "prompt_toolkit";
-          inherit version;
-          hash = "sha256-nxzRax6GwpaPJRnX+zHdnWaZFvUVYSwmnRTp7VK1FlA=";
-        };
-      });
+      # nothing right now
    });
  };

 in
 with py.pkgs; buildPythonApplication rec {
  pname = "awscli2";
-  version = "2.11.6"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.11.15"; # N.B: if you change this, check if overrides are still up-to-date
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cli";
    rev = version;
-    hash = "sha256-6VEDGakOx2LJcDbBKicxxfOt0t2tf2iaRXkx1Em0Ieg=";
+    hash = "sha256-2FE5PJxdTqSrAIgkaZPf91B6bI6Bj9tbJjXg2nAaLdo=";
  };

  postPatch = ''
    substituteInPlace requirements/bootstrap.txt \
      --replace "pip>=22.0.0,<23.0.0" "pip>=22.0.0,<24.0.0"
-    substituteInPlace pyproject.toml \
-      --replace "distro>=1.5.0,<1.6.0" "distro>=1.5.0" \
-      --replace "cryptography>=3.3.2,<38.0.5" "cryptography>=3.3.2"
  '';

  nativeBuildInputs = [
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@ -2,7 +2,6 @@
 , stdenv
 , python3
 , openssl
-, fetchpatch
  # Many Salt modules require various Python modules to be installed,
  # passing them in this array enables Salt to find them.
 , extraInputs ? []
@ -10,19 +9,21 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "salt";
-  version = "3005.1";
+  version = "3006.0";

  src = python3.pkgs.fetchPypi {
    inherit pname version;
-    hash = "sha256-+hTF2HP4Y7UJUBIdfiOiRJUCdFSQx8SMDPBFQGz+V8E=";
+    hash = "sha256-7iw4s06oYUCQE8gc8KqFKX1pzxB3O3PuegcQtclC3Mo=";
  };

  propagatedBuildInputs = with python3.pkgs; [
    distro
    jinja2
    jmespath
+    looseversion
    markupsafe
    msgpack
+    packaging
    psutil
    pycryptodomex
    pyyaml
@ -44,14 +45,9 @@ python3.pkgs.buildPythonApplication rec {
    # `extraInputs` like on any other platform
    echo -n > "requirements/darwin.txt"

-    # 3004.1: requirement of pyzmq was restricted to <22.0.0; looks like that req was incorrect
-    # https://github.com/saltstack/salt/commit/070597e525bb7d56ffadede1aede325dfb1b73a4
-    # https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259279
-    # https://github.com/saltstack/salt/pull/61163
+    # Remove windows-only requirement
    substituteInPlace "requirements/zeromq.txt" \
-      --replace 'pyzmq<=20.0.0 ; python_version < "3.6"' "" \
-      --replace 'pyzmq>=17.0.0,<22.0.0 ; python_version < "3.9"' 'pyzmq>=17.0.0 ; python_version < "3.9"' \
-      --replace 'pyzmq>19.0.2,<22.0.0 ; python_version >= "3.9"' 'pyzmq>19.0.2 ; python_version >= "3.9"'
+      --replace 'pyzmq==25.0.2 ; sys_platform == "win32"' ""
  '';

  # Don't use fixed dependencies on Darwin
--- a/pkgs/tools/networking/trurl/default.nix
+++ b/pkgs/tools/networking/trurl/default.nix
@ -1,27 +1,33 @@
-{ lib, stdenv, fetchFromGitHub, curl, perl }:
+{ lib, stdenv, fetchFromGitHub, curl, python3, python3Packages, trurl, testers }:

 stdenv.mkDerivation rec {
  pname = "trurl";
-  version = "0.4";
+  version = "0.6";

  src = fetchFromGitHub {
    owner = "curl";
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "sha256-f9z0gPtHcn3iWFA6MT6ngok0nXBcd6zJ8Tjnb5Lzf6c=";
+    hash = "sha256-/Gf7T67LPzVPhjAqTvbLiJOqfKeWvwH/WHelJZTH4ZI=";
  };

+  outputs = [ "out" "dev" "man" ];
  separateDebugInfo = stdenv.isLinux;

  enableParallelBuilding = true;

+  nativeBuildInputs = [ curl ];
  buildInputs = [ curl ];
  makeFlags = [ "PREFIX=$(out)" ];

  doCheck = true;
-  checkInputs = [ perl ];
+  nativeCheckInputs = [ python3 python3Packages.packaging ];
  checkTarget = "test";

+  passthru.tests.version = testers.testVersion {
+    package = trurl;
+  };
+
  meta = with lib; {
    description = "A command line tool for URL parsing and manipulation";
    homepage = "https://curl.se/trurl";
--- a/pkgs/tools/security/slsa-verifier/default.nix
+++ b/pkgs/tools/security/slsa-verifier/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "slsa-verifier";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "slsa-framework";
    repo = "slsa-verifier";
    rev = "v${version}";
-    hash = "sha256-Y4qZMECw3o8Mr4w2mYe2sUyYes4J+SkO3rqfiuSYw2Y=";
+    hash = "sha256-5TILEYrnXNDxtRkCaFHUYAI0w5KSzlUAKovTnJcll90=";
  };

-  vendorHash = "sha256-xDJLt9aQW3hJtbC15R+eMRVQOi/dYuYMWMsGNCkjaSQ=";
+  vendorHash = "sha256-xpYXA/j/ClcJl80yh/tbG5jIfL7jdmG+k95Lipr2+RA=";

  CGO_ENABLED = 0;
  GO111MODULE = "on";
--- a/pkgs/tools/typesetting/typst/Cargo.lock
+++ b/pkgs/tools/typesetting/typst/Cargo.lock
--- a/pkgs/tools/typesetting/typst/default.nix
+++ b/pkgs/tools/typesetting/typst/default.nix
@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "typst";
-  version = "0.2.0";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "typst";
    repo = "typst";
    rev = "v${version}";
-    hash = "sha256-3vNJmLmbskAzXVXjiSVDLhRcX1j3ksOgPd53W31YZ0c=";
+    hash = "sha256-Sx4HWs52WycAxAuoJyo8t83CxnMh64P94hbPiedfztc=";
  };

  cargoLock = {
--- a/pkgs/tools/wayland/swayr/default.nix
+++ b/pkgs/tools/wayland/swayr/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "swayr";
-  version = "0.24.0";
+  version = "0.25.0";

  src = fetchFromSourcehut {
    owner = "~tsdh";
    repo = "swayr";
    rev = "swayr-${version}";
-    sha256 = "sha256-Cl/c8KfBfrBIL/AqhZK7DfEcMQNLvxOoWvAq9qqLQDQ=";
+    sha256 = "sha256-LaLliChsdsQePoRAxI7Sq5B68+uAtGuVrJKdTdva6cI=";
  };

-  cargoHash = "sha256-+z/Ru1c4U/v8EDtz5uUPy/qQu47p1BzdCIWhsHWViGY=";
+  cargoHash = "sha256-D631vqlwaWaLkBxpDFEINAXVzbi7e2K9QiRfyKPW5+A=";

  patches = [
    ./icon-paths.patch
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -16046,7 +16046,6 @@ with pkgs;
  mrustc = callPackage ../development/compilers/mrustc { };
  mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
  mrustc-bootstrap = callPackage ../development/compilers/mrustc/bootstrap.nix {
-    stdenv = gcc10StdenvCompat;
    openssl = openssl_1_1;
  };

@ -25173,6 +25172,8 @@ with pkgs;
    theme-spring = callPackage ../servers/icingaweb2/theme-spring { };
  };

+  irrd = callPackage ../servers/irrd { };
+
  inspircd = callPackage ../servers/irc/inspircd { };

  inspircdMinimal = inspircd.override { extraModules = []; };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -2749,6 +2749,8 @@ self: super: with self; {

  djangorestframework-guardian = callPackage ../development/python-modules/djangorestframework-guardian { };

+  djangorestframework-guardian2 = callPackage ../development/python-modules/djangorestframework-guardian2 { };
+
  djangorestframework-recursive = callPackage ../development/python-modules/djangorestframework-recursive { };

  djangorestframework-simplejwt = callPackage ../development/python-modules/djangorestframework-simplejwt { };