Merge staging-next into staging

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -105,7 +105,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The EC2 image module previously detected and automatically mounted ext3-formatted instance store devices and partitions in stage-1 (initramfs), storing `/tmp` on the first discovered device. This behaviour, which only catered to very specific use cases and could not be disabled, has been removed. Users relying on this should provide their own implementation, and probably use ext4 and perform the mount in stage-2.
 
-- `teleport` has been upgraded to major version 11. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and [release notes](https://goteleport.com/docs/changelog/#1100).
+- `teleport` has been upgraded from major version 10 to major version 12. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and release notes for versions [11](https://goteleport.com/docs/changelog/#1100) and [12](https://goteleport.com/docs/changelog/#1201). Note that Teleport does not officially support upgrades across more than one major version at a time. If you're running Teleport server components, it is recommended to first upgrade to an intermediate 11.x version by setting `services.teleport.package = pkgs.teleport_11`. Afterwards, this option can be removed to upgrade to the default version (12).
 
 - The EC2 image module previously detected and activated swap-formatted instance store devices and partitions in stage-1 (initramfs). This behaviour has been removed. Users relying on this should provide their own implementation.
 

nixos/modules/services/misc/paperless.nix

@@ -6,6 +6,7 @@ let
   pkg = cfg.package;
 
   defaultUser = "paperless";
+  nltkDir = "/var/cache/paperless/nltk";
 
   # Don't start a redis instance if the user sets a custom redis connection
   enableRedis = !hasAttr "PAPERLESS_REDIS" cfg.extraConfig;
@@ -15,6 +16,7 @@ let
     PAPERLESS_DATA_DIR = cfg.dataDir;
     PAPERLESS_MEDIA_ROOT = cfg.mediaDir;
     PAPERLESS_CONSUMPTION_DIR = cfg.consumptionDir;
+    PAPERLESS_NLTK_DIR = nltkDir;
     GUNICORN_CMD_ARGS = "--bind=${cfg.address}:${toString cfg.port}";
   } // optionalAttrs (config.time.timeZone != null) {
     PAPERLESS_TIME_ZONE = config.time.timeZone;
@@ -24,12 +26,14 @@ let
     lib.mapAttrs (_: toString) cfg.extraConfig
   );
 
-  manage = let
+  manage =
-    setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
+    let
-  in pkgs.writeShellScript "manage" ''
+      setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
-    ${setupEnv}
+    in
-    exec ${pkg}/bin/paperless-ngx "$@"
+    pkgs.writeShellScript "manage" ''
-  '';
+      ${setupEnv}
+      exec ${pkg}/bin/paperless-ngx "$@"
+    '';
 
   # Secure the services
   defaultServiceConfig = {
@@ -47,6 +51,7 @@ let
       cfg.dataDir
       cfg.mediaDir
     ];
+    CacheDirectory = "paperless";
     CapabilityBoundingSet = "";
     # ProtectClock adds DeviceAllow=char-rtc r
     DeviceAllow = "";
@@ -170,7 +175,7 @@ in
 
     extraConfig = mkOption {
       type = types.attrs;
-      default = {};
+      default = { };
       description = lib.mdDoc ''
         Extra paperless config options.
 
@@ -291,6 +296,33 @@ in
       };
     };
 
+    # Download NLTK corpus data
+    systemd.services.paperless-download-nltk-data = {
+      wantedBy = [ "paperless-scheduler.service" ];
+      before = [ "paperless-scheduler.service" ];
+      after = [ "network-online.target" ];
+      serviceConfig = defaultServiceConfig // {
+        User = cfg.user;
+        Type = "oneshot";
+        # Enable internet access
+        PrivateNetwork = false;
+        # Restrict write access
+        BindPaths = [];
+        BindReadOnlyPaths = [
+          "/nix/store"
+          "-/etc/resolv.conf"
+          "-/etc/nsswitch.conf"
+          "-/etc/ssl/certs"
+          "-/etc/static/ssl/certs"
+          "-/etc/hosts"
+          "-/etc/localtime"
+        ];
+        ExecStart = let pythonWithNltk = pkg.python.withPackages (ps: [ ps.nltk ]); in ''
+          ${pythonWithNltk}/bin/python -m nltk.downloader -d '${nltkDir}' punkt snowball_data stopwords
+        '';
+      };
+    };
+
     systemd.services.paperless-consumer = {
       description = "Paperless document consumer";
       # Bind to `paperless-scheduler` so that the consumer never runs

nixos/modules/services/networking/nftables.nix

@@ -28,6 +28,32 @@ in
           <https://wiki.nftables.org/wiki-nftables/index.php/Troubleshooting#Question_4._How_do_nftables_and_iptables_interact_when_used_on_the_same_system.3F>.
         '';
     };
+
+    networking.nftables.checkRuleset = mkOption {
+      type = types.bool;
+      default = true;
+      description = lib.mdDoc ''
+        Run `nft check` on the ruleset to spot syntax errors during build.
+        Because this is executed in a sandbox, the check might fail if it requires
+        access to any environmental factors or paths outside the Nix store.
+        To circumvent this, the ruleset file can be edited using the preCheckRuleset
+        option to work in the sandbox environment.
+      '';
+    };
+
+    networking.nftables.preCheckRuleset = mkOption {
+      type = types.lines;
+      default = "";
+      example = lib.literalExpression ''
+        sed 's/skgid meadow/skgid nogroup/g' -i ruleset.conf
+      '';
+      description = lib.mdDoc ''
+        This script gets run before the ruleset is checked. It can be used to
+        create additional files needed for the ruleset check to work, or modify
+        the ruleset for cases the build environment cannot cover.
+      '';
+    };
+
     networking.nftables.ruleset = mkOption {
       type = types.lines;
       default = "";
@@ -105,13 +131,24 @@ in
       wantedBy = [ "multi-user.target" ];
       reloadIfChanged = true;
       serviceConfig = let
-        rulesScript = pkgs.writeScript "nftables-rules" ''
+        rulesScript = pkgs.writeTextFile {
-          #! ${pkgs.nftables}/bin/nft -f
+          name =  "nftables-rules";
-          flush ruleset
+          executable = true;
-          ${if cfg.rulesetFile != null then ''
+          text = ''
-            include "${cfg.rulesetFile}"
+            #! ${pkgs.nftables}/bin/nft -f
-          '' else cfg.ruleset}
+            flush ruleset
-        '';
+            ${if cfg.rulesetFile != null then ''
+              include "${cfg.rulesetFile}"
+            '' else cfg.ruleset}
+          '';
+          checkPhase = lib.optionalString cfg.checkRuleset ''
+            cp $out ruleset.conf
+            ${cfg.preCheckRuleset}
+            export NIX_REDIRECTS=/etc/protocols=${pkgs.buildPackages.iana-etc}/etc/protocols:/etc/services=${pkgs.buildPackages.iana-etc}/etc/services
+            LD_PRELOAD="${pkgs.buildPackages.libredirect}/lib/libredirect.so ${pkgs.buildPackages.lklWithFirewall.lib}/lib/liblkl-hijack.so" \
+              ${pkgs.buildPackages.nftables}/bin/nft --check --file ruleset.conf
+          '';
+        };
       in {
         Type = "oneshot";
         RemainAfterExit = true;

nixos/modules/services/networking/teleport.nix

@@ -11,6 +11,14 @@ in
     services.teleport = with lib.types; {
       enable = mkEnableOption (lib.mdDoc "the Teleport service");
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.teleport;
+        defaultText = lib.literalMD "pkgs.teleport";
+        example = lib.literalMD "pkgs.teleport_11";
+        description = lib.mdDoc "The teleport package to use";
+      };
+
       settings = mkOption {
         type = settingsYaml.type;
         default = { };
@@ -74,14 +82,14 @@ in
   };
 
   config = mkIf config.services.teleport.enable {
-    environment.systemPackages = [ pkgs.teleport ];
+    environment.systemPackages = [ cfg.package ];
 
     systemd.services.teleport = {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       serviceConfig = {
         ExecStart = ''
-          ${pkgs.teleport}/bin/teleport start \
+          ${cfg.package}/bin/teleport start \
             ${optionalString cfg.insecure.enable "--insecure"} \
             ${optionalString cfg.diag.enable "--diag-addr=${cfg.diag.addr}:${toString cfg.diag.port}"} \
             ${optionalString (cfg.settings != { }) "--config=${settingsYaml.generate "teleport.yaml" cfg.settings}"}

nixos/tests/teleport.nix

@@ -1,18 +1,28 @@
 { system ? builtins.currentSystem
 , config ? { }
 , pkgs ? import ../.. { inherit system config; }
+, lib ? pkgs.lib
 }:
 
 with import ../lib/testing-python.nix { inherit system pkgs; };
 
 let
-  minimal = { config, ... }: {
+  packages = with pkgs; {
-    services.teleport.enable = true;
+    "default" = teleport;
+    "11" = teleport_11;
   };
 
-  client = { config, ... }: {
+  minimal = package: {
     services.teleport = {
       enable = true;
+      inherit package;
+    };
+  };
+
+  client = package: {
+    services.teleport = {
+      enable = true;
+      inherit package;
       settings = {
         teleport = {
           nodename = "client";
@@ -37,9 +47,10 @@ let
     }];
   };
 
-  server = { config, ... }: {
+  server = package: {
     services.teleport = {
       enable = true;
+      inherit package;
       settings = {
         teleport = {
           nodename = "server";
@@ -64,36 +75,41 @@ let
     };
   };
 in
-{
+lib.concatMapAttrs
-  minimal = makeTest {
+  (name: package: {
-    # minimal setup should always work
+    "minimal_${name}" = makeTest {
-    name = "teleport-minimal-setup";
+      # minimal setup should always work
-    meta.maintainers = with pkgs.lib.maintainers; [ ymatsiuk ];
+      name = "teleport-minimal-setup";
-    nodes = { inherit minimal; };
+      meta.maintainers = with pkgs.lib.maintainers; [ justinas ];
+      nodes.minimal = minimal package;
 
-    testScript = ''
+      testScript = ''
-      minimal.wait_for_open_port(3025)
+        minimal.wait_for_open_port(3025)
-      minimal.wait_for_open_port(3080)
+        minimal.wait_for_open_port(3080)
-      minimal.wait_for_open_port(3022)
+        minimal.wait_for_open_port(3022)
-    '';
+      '';
-  };
+    };
 
-  basic = makeTest {
+    "basic_${name}" = makeTest {
-    # basic server and client test
+      # basic server and client test
-    name = "teleport-server-client";
+      name = "teleport-server-client";
-    meta.maintainers = with pkgs.lib.maintainers; [ ymatsiuk ];
+      meta.maintainers = with pkgs.lib.maintainers; [ justinas ];
-    nodes = { inherit server client; };
+      nodes = {
+        server = server package;
+        client = client package;
+      };
 
-    testScript = ''
+      testScript = ''
-      with subtest("teleport ready"):
+        with subtest("teleport ready"):
-          server.wait_for_open_port(3025)
+            server.wait_for_open_port(3025)
-          client.wait_for_open_port(3022)
+            client.wait_for_open_port(3022)
 
-      with subtest("check applied configuration"):
+        with subtest("check applied configuration"):
-          server.wait_until_succeeds("tctl get nodes --format=json | ${pkgs.jq}/bin/jq -e '.[] | select(.spec.hostname==\"client\") | .metadata.labels.role==\"client\"'")
+            server.wait_until_succeeds("tctl get nodes --format=json | ${pkgs.jq}/bin/jq -e '.[] | select(.spec.hostname==\"client\") | .metadata.labels.role==\"client\"'")
-          server.wait_for_open_port(3000)
+            server.wait_for_open_port(3000)
-          client.succeed("journalctl -u teleport.service --grep='DEBU'")
+            client.succeed("journalctl -u teleport.service --grep='DEBU'")
-          server.succeed("journalctl -u teleport.service --grep='Starting teleport in insecure mode.'")
+            server.succeed("journalctl -u teleport.service --grep='Starting teleport in insecure mode.'")
-    '';
+      '';
-  };
+    };
-}
+  })
+  packages

pkgs/applications/blockchains/ledger-live-desktop/default.nix

@@ -2,11 +2,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.53.2";
+  version = "2.54.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-RGeJWUMZagXM/8SHHOpTpcnsz+BShnGp2yvt31qo5lI=";
+    hash = "sha256-3UCsMzpoHq4gD4bw/MT1qbl8AnXQnFJqpMi1mlPvv5w=";
   };
 
   appimageContents = appimageTools.extractType2 {
@@ -27,8 +27,8 @@ appimageTools.wrapType2 rec {
   '';
 
   meta = with lib; {
-    description = "Wallet app for Ledger Nano S and Ledger Blue";
+    description = "App for Ledger hardware wallets";
-    homepage = "https://www.ledger.com/live";
+    homepage = "https://www.ledger.com/ledger-live/";
     license = licenses.mit;
     maintainers = with maintainers; [ andresilva thedavidmeister nyanloutre RaghavSood th0rgal WeebSorceress ];
     platforms = [ "x86_64-linux" ];

pkgs/applications/graphics/menyoki/default.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "menyoki";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-z0OpRnjVfU6vcyZsxkdD2x3l+a9GkDHZcFveGunDYww=";
+    sha256 = "sha256-owP3G1Rygraifdc4iPURQ1Es0msNhYZIlfrtj0CSU6Y=";
   };
 
-  cargoSha256 = "sha256-uSoyfgPlsHeUwnTHE49ErrlB65wcfl5dxn/YrW5EKZw=";
+  cargoSha256 = "sha256-NtXjlGkX8AzSw98xHPymzdnTipMIunyDbpSr4eVowa0=";
 
   nativeBuildInputs = [ installShellFiles ]
     ++ lib.optional stdenv.isLinux pkg-config;

pkgs/applications/misc/anytype/default.nix

@@ -2,13 +2,13 @@
 
 let
   pname = "anytype";
-  version = "0.30.0";
+  version = "0.31.0";
   name = "Anytype-${version}";
   nameExecutable = pname;
   src = fetchurl {
     url = "https://at9412003.fra1.digitaloceanspaces.com/Anytype-${version}.AppImage";
     name = "Anytype-${version}.AppImage";
-    sha256 = "sha256-LifJc5mLbnt5wBXGM1n1uice0B6mCY80LYf3kEFJy90=";
+    sha256 = "sha256-s8al0R9G478A+PymQcdcdRpw6tpKkG+WIZsXZYEvf/o=";
   };
   appimageContents = appimageTools.extractType2 { inherit name src; };
 in

pkgs/applications/networking/browsers/librewolf/src.json

@@ -1,11 +1,11 @@
 {
-  "packageVersion": "110.0-1",
+  "packageVersion": "110.0.1-1",
   "source": {
-    "rev": "110.0-1",
+    "rev": "110.0.1-1",
-    "sha256": "1fs8z7b1ly3asmgqc4lnidf8k5apaimc875rqm7rqg360bc1qg2p"
+    "sha256": "06k33gf2q77w3airgbqmki555pp2yv33cbkivbi4hgz80zl1m4i3"
   },
   "firefox": {
-    "version": "110.0",
+    "version": "110.0.1",
-    "sha512": "52a37a8f59a694c4790c0a14cd81fba9e2c982f64e00191afd0897c39ae1d5e25f24cff16f74d0a0b5cdf8e93a9a0974b6042b0de605cf1a533ef4e6a3c0dcf9"
+    "sha512": "42c6a99a3874a0f60121188c43788fb35577734d9366c3f89ad41b8328cc542ce172ec81ca35b9ea551eaa698197ccdb43922ec3215d311e0770aaaa59625d21"
   }
 }

pkgs/applications/networking/cloudflared/default.nix

@@ -1,19 +1,29 @@
-{ lib, buildGoModule, fetchFromGitHub, stdenv, callPackage }:
+{ lib
+, stdenv
+, buildGoModule
+, fetchFromGitHub
+, callPackage
+}:
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2023.2.1";
+  version = "2023.2.2";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
-    rev = version;
+    rev = "refs/tags/${version}";
-    hash = "sha256-vhcz/uk1sBt7XytXQYcPreoPfNz7fdPVE+j+FTH7tPc=";
+    hash = "sha256-qZ3h8KZLGSH+sqUs0wof5arKvcps1DdqBnT+coWEiys=";
   };
 
   vendorSha256 = null;
 
-  ldflags = [ "-s" "-w" "-X main.Version=${version}" "-X github.com/cloudflare/cloudflared/cmd/cloudflared/updater.BuiltForPackageManager=nixpkgs" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.Version=${version}"
+    "-X github.com/cloudflare/cloudflared/cmd/cloudflared/updater.BuiltForPackageManager=nixpkgs"
+  ];
 
   preCheck = ''
     # Workaround for: sshgen_test.go:74: mkdir /homeless-shelter/.cloudflared: no such file or directory
@@ -52,11 +62,6 @@ buildGoModule rec {
     substituteInPlace "ingress/icmp_posix_test.go" \
       --replace "TestReuseFunnel" "SkipReuseFunnel"
 
-    # Workaround for: supervisor_test.go:49:
-    #   Expected nil, but got: Could not lookup srv records on _us-v2-origintunneld._tcp.argotunnel.com: lookup _us-v2-origintunneld._tcp.argotunnel.com on [::1]:53: read udp [::1]:49342->[::1]:53: read: connection refused
-    substituteInPlace "supervisor/supervisor_test.go" \
-      --replace "Test_Initialize_Same_Protocol" "Skip_Initialize_Same_Protocol"
-
     # Workaround for: manager_test.go:197:
     #   Should be false
     substituteInPlace "datagramsession/manager_test.go" \
@@ -70,6 +75,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Cloudflare Tunnel daemon, Cloudflare Access toolkit, and DNS-over-HTTPS client";
     homepage = "https://www.cloudflare.com/products/tunnel";
+    changelog = "https://github.com/cloudflare/cloudflared/releases/tag/${version}";
     license = licenses.asl20;
     platforms = platforms.unix ++ platforms.windows;
     maintainers = with maintainers; [ bbigras enorris thoughtpolice piperswe ];

pkgs/applications/networking/cluster/kluctl/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kluctl";
-  version = "2.19.0";
+  version = "2.19.2";
 
   src = fetchFromGitHub {
     owner = "kluctl";
     repo = "kluctl";
     rev = "v${version}";
-    hash = "sha256-2nAgJj/cMDiE5rw/YixNYQNCWnuC/8EX4BrnXN4Npao=";
+    hash = "sha256-7+hXjYaCqInhP3O8IS8IwkUTGhnmcIWRR1qqvA6UQoc=";
   };
 
   vendorHash = "sha256-xBUrY8v4yHtWGaaRXHxQRGdZHzMGoJX2hFLL+0Vb1QY=";

pkgs/applications/networking/instant-messengers/discord/disable-breaking-updates.py

@@ -22,21 +22,23 @@ XDG_CONFIG_HOME = os.environ.get("XDG_CONFIG_HOME") or os.path.join(
 
 settings_path = Path(f"{XDG_CONFIG_HOME}/@configDirName@/settings.json")
 settings_path_temp = Path(f"{XDG_CONFIG_HOME}/@configDirName@/settings.json.tmp")
-try:
+
+if os.path.exists(settings_path):
     with settings_path.open(encoding="utf-8") as settings_file:
         settings = json.load(settings_file)
+else:
+    settings = {}
 
-        if settings.get("SKIP_HOST_UPDATE"):
+if settings.get("SKIP_HOST_UPDATE"):
-            print("[Nix] Disabling updates already done")
+    print("[Nix] Disabling updates already done")
-        else:
+else:
-            skip_host_update = {"SKIP_HOST_UPDATE": True}
+    skip_host_update = {"SKIP_HOST_UPDATE": True}
-            settings.update(skip_host_update)
+    settings.update(skip_host_update)
 
-            with settings_path_temp.open("w", encoding="utf-8") as settings_file_temp:
+    os.makedirs(os.path.dirname(settings_path), exist_ok=True)
-                json.dump(settings, settings_file_temp, indent=2)
 
-            settings_path_temp.rename(settings_path)
+    with settings_path_temp.open("w", encoding="utf-8") as settings_file_temp:
-            print("[Nix] Disabled updates")
+        json.dump(settings, settings_file_temp, indent=2)
 
-except IOError:
+    settings_path_temp.rename(settings_path)
-    print("[Nix] settings.json doesn't yet exist, can't disable it yet")
+    print("[Nix] Disabled updates")

pkgs/applications/office/paperless-ngx/default.nix

@@ -318,7 +318,7 @@ python.pkgs.buildPythonApplication rec {
 
   meta = with lib; {
     description = "Tool to scan, index, and archive all of your physical documents";
-    homepage = "https://paperless-ngx.readthedocs.io/";
+    homepage = "https://docs.paperless-ngx.com/";
     changelog = "https://github.com/paperless-ngx/paperless-ngx/releases/tag/v${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ lukegb gador erikarvstedt ];

pkgs/applications/virtualization/lkl/default.nix

@@ -6,15 +6,15 @@
 
 stdenv.mkDerivation rec {
   pname = "lkl";
-  version = "2022-05-18";
+  version = "2023-01-27";
 
   outputs = [ "dev" "lib" "out" ];
 
   src = fetchFromGitHub {
     owner  = "lkl";
     repo   = "linux";
-    rev  = "10c7b5dee8c424cc2ab754e519ecb73350283ff9";
+    rev  = "b00f0fbcd5ae24636a9315fea3af32f411cf93be";
-    sha256 = "sha256-D3HQdKzhB172L62a+8884bNhcv7vm/c941wzbYtbf4I=";
+    sha256 = "sha256-GZpnTVdcnS5uAUHsVre539+0Qlv36Fui0WGjOPwvWrE=";
   };
 
   nativeBuildInputs = [ bc bison flex python3 ];

pkgs/applications/virtualization/lkl/lkl-defconfig-enable-nftables

@@ -1,71 +1,68 @@
+CONFIG_IP6_NF_FILTER=y
+CONFIG_IP6_NF_IPTABLES=y
+CONFIG_IP6_NF_MANGLE=y
+CONFIG_IP6_NF_MATCH_AH=y
+CONFIG_IP6_NF_MATCH_EUI64=y
+CONFIG_IP6_NF_MATCH_FRAG=y
+CONFIG_IP6_NF_MATCH_HL=y
+CONFIG_IP6_NF_MATCH_IPV6HEADER=y
+CONFIG_IP6_NF_MATCH_MH=y
+CONFIG_IP6_NF_MATCH_OPTS=y
+CONFIG_IP6_NF_MATCH_RPFILTER=y
+CONFIG_IP6_NF_MATCH_RT=y
+CONFIG_IP6_NF_MATCH_SRH=y
+CONFIG_IP6_NF_NAT=y
+CONFIG_IP6_NF_RAW=y
+CONFIG_IP6_NF_SECURITY=y
+CONFIG_IP6_NF_TARGET_HL=y
+CONFIG_IP6_NF_TARGET_MASQUERADE=y
+CONFIG_IP6_NF_TARGET_NPT=y
+CONFIG_IP6_NF_TARGET_REJECT=y
+CONFIG_IP6_NF_TARGET_SYNPROXY=y
+CONFIG_IP_NF_ARPFILTER=y
+CONFIG_IP_NF_ARP_MANGLE=y
+CONFIG_IP_NF_ARPTABLES=y
+CONFIG_IP_NF_FILTER=y
+CONFIG_IP_NF_IPTABLES=y
+CONFIG_IP_NF_MANGLE=y
+CONFIG_IP_NF_MATCH_AH=y
+CONFIG_IP_NF_MATCH_ECN=y
+CONFIG_IP_NF_MATCH_RPFILTER=y
+CONFIG_IP_NF_MATCH_TTL=y
+CONFIG_IP_NF_NAT=y
+CONFIG_IP_NF_RAW=y
+CONFIG_IP_NF_SECURITY=y
+CONFIG_IP_NF_TARGET_CLUSTERIP=y
+CONFIG_IP_NF_TARGET_ECN=y
+CONFIG_IP_NF_TARGET_MASQUERADE=y
+CONFIG_IP_NF_TARGET_NETMAP=y
+CONFIG_IP_NF_TARGET_REDIRECT=y
+CONFIG_IP_NF_TARGET_REJECT=y
+CONFIG_IP_NF_TARGET_SYNPROXY=y
+CONFIG_IP_NF_TARGET_TTL=y
 CONFIG_NETFILTER=y
-CONFIG_NF_CONNTRACK=y
+CONFIG_NETFILTER_ADVANCED=y
-CONFIG_NF_LOG_NETDEV=y
+CONFIG_NETFILTER_CONNCOUNT=y
-CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NETFILTER_EGRESS=y
-CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NETFILTER_FAMILY_ARP=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NETFILTER_FAMILY_BRIDGE=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NETFILTER_INGRESS=y
-CONFIG_NF_CONNTRACK_AMANDA=y
+CONFIG_NETFILTER_NETLINK_ACCT=y
-CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
-CONFIG_NF_CONNTRACK_IRC=y
-CONFIG_NF_CONNTRACK_NETBIOS_NS=y
-CONFIG_NF_CONNTRACK_SNMP=y
-CONFIG_NF_CONNTRACK_PPTP=y
-CONFIG_NF_CONNTRACK_SANE=y
-CONFIG_NF_CONNTRACK_SIP=y
-CONFIG_NF_CONNTRACK_TFTP=y
-CONFIG_NF_CT_NETLINK=y
-CONFIG_NF_CT_NETLINK_TIMEOUT=y
-CONFIG_NF_CT_NETLINK_HELPER=y
 CONFIG_NETFILTER_NETLINK_GLUE_CT=y
-CONFIG_NF_TABLES=y
+CONFIG_NETFILTER_NETLINK_HOOK=y
-CONFIG_NF_TABLES_INET=y
+CONFIG_NETFILTER_NETLINK_LOG=y
-CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NETFILTER_NETLINK_OSF=y
-CONFIG_NFT_NUMGEN=y
+CONFIG_NETFILTER_NETLINK_QUEUE=y
-CONFIG_NFT_CT=y
+CONFIG_NETFILTER_NETLINK=y
-CONFIG_NFT_COUNTER=y
+CONFIG_NETFILTER_SKIP_EGRESS=y
-CONFIG_NFT_CONNLIMIT=y
+CONFIG_NETFILTER_SYNPROXY=y
-CONFIG_NFT_LOG=y
+CONFIG_NETFILTER_XTABLES_COMPAT=y
-CONFIG_NFT_LIMIT=y
+CONFIG_NETFILTER_XTABLES=y
-CONFIG_NFT_MASQ=y
+CONFIG_NETFILTER_XT_CONNMARK=y
-CONFIG_NFT_REDIR=y
+CONFIG_NETFILTER_XT_MARK=y
-CONFIG_NFT_NAT=y
-CONFIG_NFT_TUNNEL=y
-CONFIG_NFT_OBJREF=y
-CONFIG_NFT_QUEUE=y
-CONFIG_NFT_QUOTA=y
-CONFIG_NFT_REJECT=y
-CONFIG_NFT_COMPAT=y
-CONFIG_NFT_HASH=y
-CONFIG_NFT_FIB_INET=y
-CONFIG_NFT_SOCKET=y
-CONFIG_NFT_OSF=y
-CONFIG_NFT_TPROXY=y
-CONFIG_NFT_SYNPROXY=y
-CONFIG_NFT_DUP_NETDEV=y
-CONFIG_NFT_FWD_NETDEV=y
-CONFIG_NFT_FIB_NETDEV=y
-CONFIG_NF_FLOW_TABLE_INET=y
-CONFIG_NF_FLOW_TABLE=y
-CONFIG_NETFILTER_XT_TARGET_CHECKSUM=y
-CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
-CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
-CONFIG_NETFILTER_XT_TARGET_DSCP=y
-CONFIG_NETFILTER_XT_TARGET_HMARK=y
-CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
-CONFIG_NETFILTER_XT_TARGET_LOG=y
-CONFIG_NETFILTER_XT_TARGET_MARK=y
-CONFIG_NETFILTER_XT_TARGET_NFLOG=y
-CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
-CONFIG_NETFILTER_XT_TARGET_NOTRACK=y
-CONFIG_NETFILTER_XT_TARGET_TEE=y
-CONFIG_NETFILTER_XT_TARGET_TPROXY=y
-CONFIG_NETFILTER_XT_TARGET_TRACE=y
-CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
-CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=y
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
 CONFIG_NETFILTER_XT_MATCH_BPF=y
+CONFIG_NETFILTER_XT_MATCH_CGROUP=y
 CONFIG_NETFILTER_XT_MATCH_CLUSTER=y
 CONFIG_NETFILTER_XT_MATCH_COMMENT=y
 CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y
@@ -77,11 +74,14 @@ CONFIG_NETFILTER_XT_MATCH_CPU=y
 CONFIG_NETFILTER_XT_MATCH_DCCP=y
 CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y
 CONFIG_NETFILTER_XT_MATCH_DSCP=y
+CONFIG_NETFILTER_XT_MATCH_ECN=y
 CONFIG_NETFILTER_XT_MATCH_ESP=y
 CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
 CONFIG_NETFILTER_XT_MATCH_HELPER=y
+CONFIG_NETFILTER_XT_MATCH_HL=y
 CONFIG_NETFILTER_XT_MATCH_IPCOMP=y
 CONFIG_NETFILTER_XT_MATCH_IPRANGE=y
+CONFIG_NETFILTER_XT_MATCH_IPVS=y
 CONFIG_NETFILTER_XT_MATCH_L2TP=y
 CONFIG_NETFILTER_XT_MATCH_LENGTH=y
 CONFIG_NETFILTER_XT_MATCH_LIMIT=y
@@ -91,7 +91,9 @@ CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
 CONFIG_NETFILTER_XT_MATCH_NFACCT=y
 CONFIG_NETFILTER_XT_MATCH_OSF=y
 CONFIG_NETFILTER_XT_MATCH_OWNER=y
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y
 CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y
+CONFIG_NETFILTER_XT_MATCH_POLICY=y
 CONFIG_NETFILTER_XT_MATCH_QUOTA=y
 CONFIG_NETFILTER_XT_MATCH_RATEEST=y
 CONFIG_NETFILTER_XT_MATCH_REALM=y
@@ -104,52 +106,129 @@ CONFIG_NETFILTER_XT_MATCH_STRING=y
 CONFIG_NETFILTER_XT_MATCH_TCPMSS=y
 CONFIG_NETFILTER_XT_MATCH_TIME=y
 CONFIG_NETFILTER_XT_MATCH_U32=y
-CONFIG_NFT_DUP_IPV4=y
+CONFIG_NETFILTER_XT_NAT=y
-CONFIG_NFT_FIB_IPV4=y
+CONFIG_NETFILTER_XT_SET=y
-CONFIG_NF_TABLES_ARP=y
+CONFIG_NETFILTER_XT_TARGET_AUDIT=y
-CONFIG_NF_FLOW_TABLE_IPV4=y
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=y
-CONFIG_NF_LOG_ARP=y
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
-CONFIG_IP_NF_IPTABLES=y
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
-CONFIG_IP_NF_MATCH_AH=y
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y
-CONFIG_IP_NF_MATCH_ECN=y
+CONFIG_NETFILTER_XT_TARGET_CT=y
-CONFIG_IP_NF_MATCH_RPFILTER=y
+CONFIG_NETFILTER_XT_TARGET_DSCP=y
-CONFIG_IP_NF_MATCH_TTL=y
+CONFIG_NETFILTER_XT_TARGET_HL=y
-CONFIG_IP_NF_FILTER=y
+CONFIG_NETFILTER_XT_TARGET_HMARK=y
-CONFIG_IP_NF_TARGET_REJECT=y
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
-CONFIG_IP_NF_TARGET_SYNPROXY=y
+CONFIG_NETFILTER_XT_TARGET_LED=y
-CONFIG_IP_NF_NAT=y
+CONFIG_NETFILTER_XT_TARGET_LOG=y
-CONFIG_IP_NF_TARGET_MASQUERADE=y
+CONFIG_NETFILTER_XT_TARGET_MARK=y
-CONFIG_IP_NF_TARGET_NETMAP=y
+CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
-CONFIG_IP_NF_TARGET_REDIRECT=y
+CONFIG_NETFILTER_XT_TARGET_NETMAP=y
-CONFIG_IP_NF_MANGLE=y
+CONFIG_NETFILTER_XT_TARGET_NFLOG=y
-CONFIG_IP_NF_TARGET_CLUSTERIP=y
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
-CONFIG_IP_NF_TARGET_ECN=y
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=y
-CONFIG_IP_NF_TARGET_TTL=y
+CONFIG_NETFILTER_XT_TARGET_RATEEST=y
-CONFIG_IP_NF_RAW=y
+CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
-CONFIG_IP_NF_ARPTABLES=y
+CONFIG_NETFILTER_XT_TARGET_SECMARK=y
-CONFIG_IP_NF_ARPFILTER=y
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
-CONFIG_IP_NF_ARP_MANGLE=y
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=y
-CONFIG_NFT_DUP_IPV6=y
+CONFIG_NETFILTER_XT_TARGET_TEE=y
-CONFIG_NFT_FIB_IPV6=y
+CONFIG_NETFILTER_XT_TARGET_TPROXY=y
-CONFIG_NF_FLOW_TABLE_IPV6=y
+CONFIG_NETFILTER_XT_TARGET_TRACE=y
-CONFIG_IP6_NF_IPTABLES=y
+CONFIG_NF_CONNTRACK_AMANDA=y
-CONFIG_IP6_NF_MATCH_AH=y
-CONFIG_IP6_NF_MATCH_EUI64=y
-CONFIG_IP6_NF_MATCH_FRAG=y
-CONFIG_IP6_NF_MATCH_OPTS=y
-CONFIG_IP6_NF_MATCH_HL=y
-CONFIG_IP6_NF_MATCH_IPV6HEADER=y
-CONFIG_IP6_NF_MATCH_MH=y
-CONFIG_IP6_NF_MATCH_RPFILTER=y
-CONFIG_IP6_NF_MATCH_RT=y
-CONFIG_IP6_NF_MATCH_SRH=y
-CONFIG_IP6_NF_TARGET_HL=y
-CONFIG_IP6_NF_FILTER=y
-CONFIG_IP6_NF_TARGET_REJECT=y
-CONFIG_IP6_NF_TARGET_SYNPROXY=y
-CONFIG_IP6_NF_MANGLE=y
-CONFIG_IP6_NF_RAW=y
-CONFIG_IP6_NF_NAT=y
-CONFIG_IP6_NF_TARGET_MASQUERADE=y
-CONFIG_IP6_NF_TARGET_NPT=y
 CONFIG_NF_CONNTRACK_BRIDGE=y
+CONFIG_NF_CONNTRACK_BROADCAST=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_LABELS=y
+CONFIG_NF_CONNTRACK_MARK=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SECMARK=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_GRE=y
+CONFIG_NF_CT_PROTO_SCTP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
+CONFIG_NF_DEFRAG_IPV4=y
+CONFIG_NF_DEFRAG_IPV6=y
+CONFIG_NF_DUP_IPV4=y
+CONFIG_NF_DUP_IPV6=y
+CONFIG_NF_DUP_NETDEV=y
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
+CONFIG_NF_LOG_ARP=y
+CONFIG_NF_LOG_IPV4=y
+CONFIG_NF_LOG_IPV6=y
+CONFIG_NF_LOG_SYSLOG=y
+CONFIG_NF_NAT_AMANDA=y
+CONFIG_NF_NAT_FTP=y
+CONFIG_NF_NAT_H323=y
+CONFIG_NF_NAT_IRC=y
+CONFIG_NF_NAT_MASQUERADE=y
+CONFIG_NF_NAT_PPTP=y
+CONFIG_NF_NAT_REDIRECT=y
+CONFIG_NF_NAT_SIP=y
+CONFIG_NF_NAT_SNMP_BASIC=y
+CONFIG_NF_NAT_TFTP=y
+CONFIG_NF_NAT=y
+CONFIG_NF_REJECT_IPV4=y
+CONFIG_NF_REJECT_IPV6=y
+CONFIG_NF_SOCKET_IPV4=y
+CONFIG_NF_SOCKET_IPV6=y
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_TABLES_BRIDGE=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_IPV4=y
+CONFIG_NF_TABLES_IPV6=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NF_TABLES=y
+CONFIG_NFT_BRIDGE_META=y
+CONFIG_NFT_BRIDGE_REJECT=y
+CONFIG_NFT_COMPAT=y
+CONFIG_NFT_CONNLIMIT=y
+CONFIG_NFT_CT=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_DUP_NETDEV=y
+CONFIG_NFT_FIB_INET=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NFT_FIB_IPV6=y
+CONFIG_NFT_FIB_NETDEV=y
+CONFIG_NFT_FIB=y
+CONFIG_NFT_FLOW_OFFLOAD=y
+CONFIG_NFT_FWD_NETDEV=y
+CONFIG_NFT_HASH=y
+CONFIG_NFT_LIMIT=y
+CONFIG_NFT_LOG=y
+CONFIG_NFT_MASQ=y
+CONFIG_NFT_NAT=y
+CONFIG_NFT_NUMGEN=y
+CONFIG_NFT_OBJREF=y
+CONFIG_NFT_OSF=y
+CONFIG_NF_TPROXY_IPV4=y
+CONFIG_NF_TPROXY_IPV6=y
+CONFIG_NFT_QUEUE=y
+CONFIG_NFT_QUOTA=y
+CONFIG_NFT_REDIR=y
+CONFIG_NFT_REJECT_INET=y
+CONFIG_NFT_REJECT_IPV4=y
+CONFIG_NFT_REJECT_IPV6=y
+CONFIG_NFT_REJECT_NETDEV=y
+CONFIG_NFT_REJECT=y
+CONFIG_NFT_SOCKET=y
+CONFIG_NFT_SYNPROXY=y
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_TUNNEL=y
+CONFIG_NFT_XFRM=y

pkgs/data/fonts/ibm-plex/default.nix

@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "ibm-plex";
-  version = "6.1.1";
+  version = "6.2.0";
 
   src = fetchzip {
     url = "https://github.com/IBM/plex/releases/download/v${version}/OpenType.zip";
-    hash = "sha256-PZ7KPtaXZFVD5uMc7i+GQMA4DU5PsspeAodiU/FrTpY=";
+    hash = "sha256-RvD/aeZrvltJiuAHqYMNaRsjLgTdcC1/5zqlcd4qKAA=";
   };
 
   installPhase = ''

pkgs/development/compilers/elm/default.nix

@@ -7,7 +7,8 @@ let
 
   fetchElmDeps = pkgs.callPackage ./fetchElmDeps.nix { };
 
-  hsPkgs = self: pkgs.haskell.packages.ghc810.override {
+  # Haskell packages that require ghc 8.10
+  hs810Pkgs = self: pkgs.haskell.packages.ghc810.override {
     overrides = self: super: with pkgs.haskell.lib.compose; with lib;
     let elmPkgs = rec {
       elm = overrideCabal (drv: {
@@ -31,20 +32,6 @@ let
         maintainers = with maintainers; [ domenkozar turbomack ];
       }) (self.callPackage ./packages/elm.nix { });
 
-      /*
-      The elm-format expression is updated via a script in the https://github.com/avh4/elm-format repo:
-      `package/nix/build.sh`
-      */
-      elm-format = justStaticExecutables (overrideCabal (drv: {
-        jailbreak = true;
-        doCheck = assert (drv.version == "0.8.5"); false; # golden tests fail with optparse-applicative 0.17
-
-        description = "Formats Elm source code according to a standard set of rules based on the official Elm Style Guide";
-        homepage = "https://github.com/avh4/elm-format";
-        license = licenses.bsd3;
-        maintainers = with maintainers; [ avh4 turbomack ];
-      }) (self.callPackage ./packages/elm-format.nix {}));
-
       elmi-to-json = justStaticExecutables (overrideCabal (drv: {
         prePatch = ''
           substituteInPlace package.yaml --replace "- -Werror" ""
@@ -84,23 +71,48 @@ let
       # aeson 2.0.3.0 does not build with attoparsec_0_13_2_5
       aeson = self.aeson_1_5_6_0;
 
-      # Needed for elm-format
+      # elm-instrument needs this
       indents = self.callPackage ./packages/indents.nix {};
-      bimap = self.callPackage ./packages/bimap.nix {};
+
+      # elm-instrument's tests depend on an old version of elm-format, but we set doCheck to false for other reasons above
+      elm-format = null;
+    };
+  };
+
+  # Haskell packages that require ghc 9.2
+  hs92Pkgs = self: pkgs.haskell.packages.ghc92.override {
+    overrides = self: super: with pkgs.haskell.lib.compose; with lib;
+    let elmPkgs = rec {
+      /*
+      The elm-format expression is updated via a script in the https://github.com/avh4/elm-format repo:
+      `package/nix/build.sh`
+      */
+      elm-format = justStaticExecutables (overrideCabal (drv: {
+        jailbreak = true;
+
+        description = "Formats Elm source code according to a standard set of rules based on the official Elm Style Guide";
+        homepage = "https://github.com/avh4/elm-format";
+        license = licenses.bsd3;
+        maintainers = with maintainers; [ avh4 turbomack ];
+      }) (self.callPackage ./packages/elm-format.nix {}));
+    };
+    in elmPkgs // {
+      inherit elmPkgs;
+
+      # Needed for elm-format
       avh4-lib = doJailbreak (self.callPackage ./packages/avh4-lib.nix {});
       elm-format-lib = doJailbreak (self.callPackage ./packages/elm-format-lib.nix {});
-      # We need tasty-hspec < 1.1.7 and hspec-golden < 0.2 to build elm-format-lib
-      tasty-hspec = self.tasty-hspec_1_1_6;
-      hspec-golden = self.hspec-golden_0_1_0_3;
-
-      # We need hspec hspec_core, hspec_discover < 2.8 for tasty-hspec == 1.1.6
-      hspec = self.hspec_2_7_10;
-      hspec-core = self.hspec-core_2_7_10;
-      hspec-discover = self.hspec-discover_2_7_10;
-      hspec-meta = self.hspec-meta_2_7_8;
-
       elm-format-test-lib = self.callPackage ./packages/elm-format-test-lib.nix {};
       elm-format-markdown = self.callPackage ./packages/elm-format-markdown.nix {};
+
+      # elm-format requires text >= 2.0
+      text = self.text_2_0_1;
+      # elm-format-lib requires hspec-golden < 0.2
+      hspec-golden = self.hspec-golden_0_1_0_3;
+      # unorderd-container's tests indirectly depend on text < 2.0
+      unordered-containers = overrideCabal (drv: { doCheck = false; }) super.unordered-containers;
+      # relude-1.1.0.0's tests depend on hedgehog < 1.2, which indirectly depends on text < 2.0
+      relude = overrideCabal (drv: { doCheck = false; }) super.relude;
     };
   };
 
@@ -122,7 +134,7 @@ in lib.makeScope pkgs.newScope (self: with self; {
         `patchNpmElm` function also defined in `packages/lib.nix`.
   */
   elmLib = let
-    hsElmPkgs = hsPkgs self;
+    hsElmPkgs = hs810Pkgs self;
   in import ./packages/lib.nix {
     inherit lib;
     inherit (pkgs) writeScriptBin stdenv;
@@ -141,7 +153,7 @@ in lib.makeScope pkgs.newScope (self: with self; {
       maintainers = [ maintainers.turbomack ];
     };
   };
-} // (hsPkgs self).elmPkgs // (with elmLib; with (hsPkgs self).elmPkgs; {
+} // (hs810Pkgs self).elmPkgs // (hs92Pkgs self).elmPkgs // (with elmLib; with (hs810Pkgs self).elmPkgs; {
   elm-verify-examples = patchBinwrap [elmi-to-json] nodePkgs.elm-verify-examples // {
     meta = with lib; nodePkgs.elm-verify-examples.meta // {
       description = "Verify examples in your docs";

pkgs/development/compilers/elm/packages/avh4-lib.nix

@@ -1,26 +1,26 @@
 { mkDerivation, ansi-terminal, ansi-wl-pprint, array, base, bimap
 , binary, bytestring, containers, directory, fetchgit, filepath
-, lib, mtl, process, relude, tasty, tasty-discover, tasty-hspec
+, lib, mtl, pooled-io, process, relude, tasty, tasty-discover
-, tasty-hunit, text
+, tasty-hspec, tasty-hunit, text
 }:
 mkDerivation {
   pname = "avh4-lib";
   version = "0.0.0.1";
   src = fetchgit {
     url = "https://github.com/avh4/elm-format";
-    sha256 = "0bcjkcs1dy1csz0mpk7d4b5wf93fsj9p86x8fp42mb0pipdd0bh6";
+    sha256 = "1aiq3mv2ycv6bal5hnz6k33bzmnnidzxxs5b6z9y6lvmr0lbf3j4";
-    rev = "80f15d85ee71e1663c9b53903f2b5b2aa444a3be";
+    rev = "7e80dd48dd9b30994e43f4804b2ea7118664e8e0";
     fetchSubmodules = true;
   };
   postUnpack = "sourceRoot+=/avh4-lib; echo source root reset to $sourceRoot";
   libraryHaskellDepends = [
     ansi-terminal ansi-wl-pprint array base bimap binary bytestring
-    containers directory filepath mtl process relude text
+    containers directory filepath mtl pooled-io process relude text
   ];
   testHaskellDepends = [
     ansi-terminal ansi-wl-pprint array base bimap binary bytestring
-    containers directory filepath mtl process relude tasty tasty-hspec
+    containers directory filepath mtl pooled-io process relude tasty
-    tasty-hunit text
+    tasty-hspec tasty-hunit text
   ];
   testToolDepends = [ tasty-discover ];
   doHaddock = false;

pkgs/development/compilers/elm/packages/elm-format-lib.nix

@@ -1,30 +1,30 @@
-{ mkDerivation, ansi-terminal, ansi-wl-pprint, array, avh4-lib
+{ mkDerivation, aeson, ansi-terminal, ansi-wl-pprint, array
-, base, bimap, binary, bytestring, containers, directory
+, avh4-lib, base, bimap, binary, bytestring, containers, directory
 , elm-format-markdown, elm-format-test-lib, fetchgit, filepath
-, indents, json, lib, mtl, optparse-applicative, parsec, process
+, ghc-prim, hspec, lib, mtl, optparse-applicative, process, relude
-, relude, split, tasty, tasty-discover, tasty-hspec, tasty-hunit
+, split, tasty, tasty-discover, tasty-hspec, tasty-hunit, text
-, text
 }:
 mkDerivation {
   pname = "elm-format-lib";
   version = "0.0.0.1";
   src = fetchgit {
     url = "https://github.com/avh4/elm-format";
-    sha256 = "0bcjkcs1dy1csz0mpk7d4b5wf93fsj9p86x8fp42mb0pipdd0bh6";
+    sha256 = "1aiq3mv2ycv6bal5hnz6k33bzmnnidzxxs5b6z9y6lvmr0lbf3j4";
-    rev = "80f15d85ee71e1663c9b53903f2b5b2aa444a3be";
+    rev = "7e80dd48dd9b30994e43f4804b2ea7118664e8e0";
     fetchSubmodules = true;
   };
   postUnpack = "sourceRoot+=/elm-format-lib; echo source root reset to $sourceRoot";
   libraryHaskellDepends = [
-    ansi-terminal ansi-wl-pprint array avh4-lib base bimap binary
+    aeson ansi-terminal ansi-wl-pprint array avh4-lib base bimap binary
     bytestring containers directory elm-format-markdown filepath
-    indents json mtl optparse-applicative parsec process relude text
+    ghc-prim mtl optparse-applicative process relude text
   ];
   testHaskellDepends = [
-    ansi-terminal ansi-wl-pprint array avh4-lib base bimap binary
+    aeson ansi-terminal ansi-wl-pprint array avh4-lib base bimap binary
     bytestring containers directory elm-format-markdown
-    elm-format-test-lib filepath indents json mtl optparse-applicative
+    elm-format-test-lib filepath ghc-prim hspec mtl
-    parsec process relude split tasty tasty-hspec tasty-hunit text
+    optparse-applicative process relude split tasty tasty-hspec
+    tasty-hunit text
   ];
   testToolDepends = [ tasty-discover ];
   doHaddock = false;

pkgs/development/compilers/elm/packages/elm-format-markdown.nix

@@ -4,8 +4,8 @@ mkDerivation {
   version = "0.0.0.1";
   src = fetchgit {
     url = "https://github.com/avh4/elm-format";
-    sha256 = "0bcjkcs1dy1csz0mpk7d4b5wf93fsj9p86x8fp42mb0pipdd0bh6";
+    sha256 = "1aiq3mv2ycv6bal5hnz6k33bzmnnidzxxs5b6z9y6lvmr0lbf3j4";
-    rev = "80f15d85ee71e1663c9b53903f2b5b2aa444a3be";
+    rev = "7e80dd48dd9b30994e43f4804b2ea7118664e8e0";
     fetchSubmodules = true;
   };
   postUnpack = "sourceRoot+=/elm-format-markdown; echo source root reset to $sourceRoot";

pkgs/development/compilers/elm/packages/elm-format-test-lib.nix

@@ -1,24 +1,24 @@
 { mkDerivation, avh4-lib, base, containers, fetchgit, filepath
-, hspec-core, hspec-golden, lib, mtl, split, tasty, tasty-discover
+, hspec, hspec-core, hspec-golden, lib, mtl, split, tasty
-, tasty-hspec, tasty-hunit, text
+, tasty-discover, tasty-hspec, tasty-hunit, text
 }:
 mkDerivation {
   pname = "elm-format-test-lib";
   version = "0.0.0.1";
   src = fetchgit {
     url = "https://github.com/avh4/elm-format";
-    sha256 = "0bcjkcs1dy1csz0mpk7d4b5wf93fsj9p86x8fp42mb0pipdd0bh6";
+    sha256 = "1aiq3mv2ycv6bal5hnz6k33bzmnnidzxxs5b6z9y6lvmr0lbf3j4";
-    rev = "80f15d85ee71e1663c9b53903f2b5b2aa444a3be";
+    rev = "7e80dd48dd9b30994e43f4804b2ea7118664e8e0";
     fetchSubmodules = true;
   };
   postUnpack = "sourceRoot+=/elm-format-test-lib; echo source root reset to $sourceRoot";
   libraryHaskellDepends = [
-    avh4-lib base containers filepath hspec-core hspec-golden mtl split
+    avh4-lib base containers filepath hspec hspec-core hspec-golden mtl
-    tasty tasty-hspec tasty-hunit text
+    split tasty tasty-hspec tasty-hunit text
   ];
   testHaskellDepends = [
-    avh4-lib base containers filepath hspec-core hspec-golden mtl split
+    avh4-lib base containers filepath hspec hspec-core hspec-golden mtl
-    tasty tasty-hspec tasty-hunit text
+    split tasty tasty-hspec tasty-hunit text
   ];
   testToolDepends = [ tasty-discover ];
   doHaddock = false;

pkgs/development/compilers/elm/packages/elm-format.nix

@@ -1,33 +1,35 @@
-{ mkDerivation, ansi-wl-pprint, avh4-lib, base, bimap, cmark
+{ mkDerivation, aeson, ansi-wl-pprint, avh4-lib, base, bimap
-, containers, elm-format-lib, elm-format-test-lib, fetchgit, json
+, bytestring, containers, elm-format-lib, elm-format-test-lib
-, lib, mtl, optparse-applicative, parsec, QuickCheck, quickcheck-io
+, fetchgit, hspec, lib, mtl, optparse-applicative, QuickCheck
-, relude, tasty, tasty-hspec, tasty-hunit, tasty-quickcheck, text
+, quickcheck-io, relude, tasty, tasty-hspec, tasty-hunit
+, tasty-quickcheck, text
 }:
 mkDerivation rec {
   pname = "elm-format";
-  version = "0.8.5";
+  version = "0.8.6";
   src = fetchgit {
     url = "https://github.com/avh4/elm-format";
-    sha256 = "0bcjkcs1dy1csz0mpk7d4b5wf93fsj9p86x8fp42mb0pipdd0bh6";
+    sha256 = "1aiq3mv2ycv6bal5hnz6k33bzmnnidzxxs5b6z9y6lvmr0lbf3j4";
-    rev = "80f15d85ee71e1663c9b53903f2b5b2aa444a3be";
+    rev = "7e80dd48dd9b30994e43f4804b2ea7118664e8e0";
     fetchSubmodules = true;
   };
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [
-    ansi-wl-pprint avh4-lib base containers elm-format-lib json
+    aeson ansi-wl-pprint avh4-lib base bytestring containers
-    optparse-applicative relude text
+    elm-format-lib optparse-applicative relude text
   ];
   testHaskellDepends = [
-    ansi-wl-pprint avh4-lib base bimap cmark containers elm-format-lib
+    aeson ansi-wl-pprint avh4-lib base bimap bytestring containers
-    elm-format-test-lib json mtl optparse-applicative parsec QuickCheck
+    elm-format-lib elm-format-test-lib hspec mtl optparse-applicative
-    quickcheck-io relude tasty tasty-hspec tasty-hunit tasty-quickcheck
+    QuickCheck quickcheck-io relude tasty tasty-hspec tasty-hunit
-    text
+    tasty-quickcheck text
   ];
   doHaddock = false;
   homepage = "https://elm-lang.org";
   description = "A source code formatter for Elm";
   license = lib.licenses.bsd3;
+  mainProgram = "elm-format";
   postPatch = ''
     mkdir -p ./generated
     cat <<EOHS > ./generated/Build_elm_format.hs

pkgs/development/libraries/exprtk/default.nix

@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "exprtk";
-  version = "unstable-2021-12-31";
+  version = "0.0.2";
 
   src = fetchFromGitHub {
     owner = "ArashPartow";
-    repo = "exprtk";
+    repo = pname;
-    rev = "806c519c91fd08ba4fa19380dbf3f6e42de9e2d1";
+    rev = version;
-    hash = "sha256-5/k+y3gNJeggfwXmtAVqmaiV+BXX+WKtWwZWcQSrQDM=";
+    hash = "sha256-ZV5nS6wEbKfzXhfXEtVlkwaEtxpTOYQaGlaxKx3FIvE=";
   };
 
   dontBuild = true;

pkgs/development/libraries/science/math/libbraiding/default.nix

@@ -4,14 +4,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.1";
+  version = "1.2";
   pname = "libbraiding";
 
   src = fetchFromGitHub {
     owner = "miguelmarco";
     repo = "libbraiding";
     rev = version;
-    sha256 = "1n1j58y9jaiv0ya0y4fpfb3b05wv0h6k2babpnk2zifjw26xr366";
+    sha256 = "sha256-cgg6rvlOvFqGjgbw6i7QXS+tqvfFd1MkPCEjnW/FyFs=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/appthreat-vulnerability-db/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "4.3.1";
+  version = "5.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "AppThreat";
     repo = "vulnerability-db";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HZHHSY8a7xyJZAQLFeZ+5+CKixcquJcUkkjJTllFiyk=";
+    hash = "sha256-u5gI5agNm1RT0FzsdQaqivKwiY5k7G/mtlSWCNP4V10=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pglast/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pglast";
-  version = "5.0";
+  version = "5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bR/e5pZCrnMCUt9zEszI0aVlqezTzwR3DIdpXv/6qGM=";
+    hash = "sha256-fHWJWgy/Ven5m2Cf81rG/ZKmFFWiLJsIPVxFe+rr+ms=";
   };
 
   propagatedBuildInputs = [

pkgs/development/ruby-modules/gem-config/default.nix

@@ -407,6 +407,9 @@ in
     buildFlags = [
       "--with-xml2-lib=${libxml2.out}/lib"
       "--with-xml2-include=${libxml2.dev}/include/libxml2"
+    ] ++ lib.optionals stdenv.isDarwin [
+      "--with-iconv-dir=${libiconv}"
+      "--with-opt-include=${libiconv}/include"
     ];
   };
 

pkgs/development/tools/analysis/codeql/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.12.2";
+  version = "2.12.3";
 
   dontConfigure = true;
   dontBuild = true;
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    sha256 = "sha256-n36x50rGA0fzvbwrUDpzWmF7XqwTTxnAfFtBL23gEOE=";
+    sha256 = "sha256-xBTL3atnLsw7HWhkWq32LdQmSBtsQ2ydK+8On8l+OcA=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/continuous-integration/buildkite-agent/default.nix

@@ -3,16 +3,16 @@
   nixosTests }:
 buildGoModule rec {
   pname = "buildkite-agent";
-  version = "3.43.1";
+  version = "3.44.0";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     rev = "v${version}";
-    sha256 = "sha256-gTtWfqz1XVvDPULHY4hKdhJlwEWY84VYUPloAX/9afY=";
+    sha256 = "sha256-iN6Q+HXaZgUt8kXDGG5e1hY0/g/JYSHQ768YYRwZsuw=";
   };
 
-  vendorHash = "sha256-srzTHUqXxyZY2hFCx3FhhuixclXHskYrQ586W1dB334=";
+  vendorHash = "sha256-I+tjSBfAvRyE0bjVRloAkb5Jftb6dxoq8lNSgWHAcVk=";
 
   postPatch = ''
     substituteInPlace bootstrap/shell/shell.go --replace /bin/bash ${bash}/bin/bash

pkgs/development/tools/database/vitess/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "vitess";
-  version = "15.0.2";
+  version = "16.0.0";
 
   src = fetchFromGitHub {
     owner = "vitessio";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NkJqJYmUf92QiPazxRWNsxZh0Pvc73l35hP1gmk4Fv0=";
+    hash = "sha256-Gvk608nM7Uiazuf9qzmd0uzBP4vPSQfkpAWvnSeWm84=";
   };
 
-  vendorHash = "sha256-+yCznSxv0EWoKiQIgFEQ/iUxrlQ5A1HYNkoMiRDG3ik=";
+  vendorHash = "sha256-3GqEMoFYm0TZihoPINf8mwCl3Ky6Lt+LxueYLoFDj2g=";
 
   buildInputs = [ sqlite ];
 

pkgs/development/tools/pgformatter/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, perlPackages, fetchFromGitHub, shortenPerlShebang }:
+{ lib, stdenv, perlPackages, fetchFromGitHub, fetchpatch, shortenPerlShebang }:
 
 perlPackages.buildPerlPackage rec {
   pname = "pgformatter";
@@ -18,6 +18,14 @@ perlPackages.buildPerlPackage rec {
   # Avoid creating perllocal.pod, which contains a timestamp
   installTargets = [ "pure_install" ];
 
+  patches = [
+    # Fix an uninitialized variable error. Remove with the next release.
+    (fetchpatch {
+      url = "https://github.com/darold/pgFormatter/commit/c2622c47d48cee47effecbf58a588c3cd3a7bf1a.patch";
+      sha256 = "sha256-WnQIOvfuzL2HrwtL0HaaYObrBxhXDu82jxGcqggQVhc=";
+    })
+  ];
+
   # Makefile.PL only accepts DESTDIR and INSTALLDIRS, but we need to set more to make this work for NixOS.
   patchPhase = ''
     substituteInPlace pg_format \

pkgs/development/tools/rust/cargo-insta/default.nix

@@ -1,23 +1,33 @@
-{ lib, rustPlatform, fetchFromGitHub, libiconv, stdenv }:
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, libiconv
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-insta";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "insta";
-    rev = version;
+    rev = "refs/tags/${version}";
-    sha256 = "sha256-h0jRuY3GSqK85NCeFqdqjyVdNTMbdtD70zU5G3w1STc=";
+    hash = "sha256-GqM3b2evjACNkTOyfA6N6TInuGo9f/1retkXVTgbJ3A=";
   };
 
   sourceRoot = "source/cargo-insta";
-  cargoHash = "sha256-GC2ggTJJV3Aww3qPfsnuND0eII1l3OBoZfi5RtvhO8I=";
+
-  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
+  cargoHash = "sha256-ZIS3O19N7w+sL+2IdoCw4/Hx9Jtjx7MYE7JcEu+PFRA=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    libiconv
+  ];
 
   meta = with lib; {
     description = "A Cargo subcommand for snapshot testing";
     homepage = "https://github.com/mitsuhiko/insta";
+    changelog = "https://github.com/mitsuhiko/insta/blob/${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with lib.maintainers; [ oxalica ];
   };

pkgs/development/tools/rust/cargo-wasi/default.nix

@@ -9,15 +9,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-wasi";
-  version = "0.1.26";
+  version = "0.1.27";
 
   src = fetchCrate {
     inherit version;
     pname = "cargo-wasi-src";
-    sha256 = "sha256-/u5GKqGwJWS6Gzc1WZ7O5ZSHHGoqBVZ4jQDEIfAyciE=";
+    sha256 = "sha256-u6+Fn/j2cvpBqTIfyPC8jltcCKGimFcu4NiMFCAfmwg=";
   };
 
-  cargoSha256 = "sha256-eF3HrulY7HrKseCYyZyC2EuWboFvmia2qLymBxvopKI=";
+  cargoHash = "sha256-Hi5Z5TmiHXp7YrqXfbwACKEximksQRhdoMGU1iLmXOk=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
 
   # Checks need to be disabled here because the current test suite makes assumptions
   # about the surrounding environment that aren't Nix friendly. See these lines for specifics:
-  # https://github.com/bytecodealliance/cargo-wasi/blob/0.1.26/tests/tests/support.rs#L13-L18
+  # https://github.com/bytecodealliance/cargo-wasi/blob/0.1.27/tests/tests/support.rs#L13-L18
   doCheck = false;
 
   meta = with lib; {

pkgs/development/web/flyctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.473";
+  version = "0.0.474";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-bTOGrg+dM+FXNvbeJ3fx1aMlT/2sPVYwGOzZaZfHVm8=";
+    hash = "sha256-uBx5exEShAVVQ8dQTYvn12FbHDehAxEFOJ4HN6jipD4=";
   };
 
-  vendorHash = "sha256-ExHzf4L0Ibb+tYfBV45hEaUJgSQhgpHk40QhHa5dpQ8=";
+  vendorHash = "sha256-m9n7687JjzOXqOTXPsBjD4jVeqlnUvoaxw7S9PGvn9M=";
 
   subPackages = [ "." ];
 

pkgs/misc/urbit/default.nix

@@ -10,15 +10,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "urbit";
-  version = "1.21";
+  version = "1.22";
 
   src = fetchzip {
     url = "https://github.com/urbit/vere/releases/download/vere-v${version}/${platform}.tgz";
     sha256 = {
-      x86_64-linux = "sha256-zHxISUJo2Li1PRjGC9LLXsDhLOHeuYejC+IM+9uDSks=";
+      x86_64-linux = "sha256-wYXFromLV1BCiSWlzphtCSBOWacQ3yC7i2kxxH4y88Y=";
-      aarch64-linux = "sha256-6gVuACG+/XJrYNjxJ2FxtkaEJuI2Sd8uM2Tgt4vbgkQ=";
+      aarch64-linux = "sha256-t3waCv2hwkchWPlfx1bsKKB6imp7F6scRnZUQSwS6fI=";
-      x86_64-darwin = "sha256-BVDGdueu18HzL9FmaJniQp+OLQAVpSYYxxyvjlHFv3I=";
+      x86_64-darwin = "sha256-x5Gr6z5ma+0AF7DEXJpqG+yg3ym+w2ULTqfpdLjfHGo=";
-      aarch64-darwin = "sha256-kwRezLpi5AEyAQ+Kyd992fpCerunaHOzRB4Wvb3dlY0=";
+      aarch64-darwin = "sha256-vvGZoN+Yi6FZDblhxwDzRneVtWaFFaOjyRG7017BzZI=";
     }.${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
 

pkgs/servers/monitoring/alertmanager-irc-relay/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "alertmanager-irc-relay";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "alertmanager-irc-relay";
     rev = "v${version}";
-    sha256 = "sha256-qE+cKwn/rqxL5/LUSirflmnFCow6IxjCcGvu2bbBmsk=";
+    sha256 = "sha256-Rl7o2QPa/IU1snlx/LiJxQok9pnkw9XANnJsu41vNlY=";
   };
 
-  vendorSha256 = "sha256-VLG15IXS/fXFMTCJKEqGW6qZ9aOLPhazidVsOywG+w4=";
+  vendorHash = "sha256-KX+TR0n14+95lldF+0KUo5DbqOKpUDaZNuKMBf0KHFQ=";
 
   ldflags = [ "-s" "-w" ];
 

pkgs/servers/nfs-ganesha/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nfs-ganesha";
-  version = "4.3";
+  version = "4.4";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     rev = "V${version}";
-    sha256 = "sha256-MafP6kl3SmtT2/vLPDwy8U7+tE6hUBr/lWmiAcjsQNU=";
+    sha256 = "sha256-MEPy2TXVTegwCpuaIrMol7ag8anxxdcj11z5eYNkDqQ=";
   };
 
   preConfigure = "cd src";

pkgs/servers/teleport/11.nix

@@ -0,0 +1,8 @@
+{ callPackage, ... }@args:
+callPackage ./generic.nix ({
+  version = "11.3.5";
+  hash = "sha256-/InWly0jCiPBlgM/qgS6ErMv7Hhg5PW9sldda1oaUIg=";
+  vendorHash = "sha256-NkiFLEHBNjxUOSuAlVugAV14yCCo3z6yhX7LZQFKhvA=";
+  cargoHash = "sha256-02qo6i6GuRAYKDKA7k2hDq2O6ayEQbeGhFS2g3b9Wuo=";
+  yarnHash = "sha256-kvnVmDZ/jISaaS97KM0WbPJU7Y8XWOeHrDLT0iXRyfc=";
+} // builtins.removeAttrs args [ "callPackage" ])

pkgs/servers/teleport/12.nix

@@ -0,0 +1,8 @@
+{ callPackage, ... }@args:
+callPackage ./generic.nix ({
+  version = "12.0.2";
+  hash = "sha256-9RD4ETQEXnj3d5YID3f3BghwitdqfcDgNhsk8ixWTW4=";
+  vendorHash = "sha256-2sOELuMyg7w/rhnWvnwDiUOsjUfb56JdAbrTGKvGnjs=";
+  cargoHash = "sha256-1ScU5ywq8vz1sWHW2idBsWcB1Xs+aylukBm96dKrwL4=";
+  yarnHash = "sha256-ItRi5EkYrwNB1MIf9l3yyK1BX6vNpL2+H1BlN3Evibg=";
+} // builtins.removeAttrs args [ "callPackage" ])

pkgs/servers/teleport/generic.nix

@@ -20,6 +20,12 @@
 , nixosTests
 
 , withRdpClient ? true
+
+, version
+, hash
+, vendorHash
+, cargoHash
+, yarnHash
 }:
 let
   # This repo has a private submodule "e" which fetchgit cannot handle without failing.
@@ -27,13 +33,13 @@ let
     owner = "gravitational";
     repo = "teleport";
     rev = "v${version}";
-    hash = "sha256-jJfOgcwKkNFO/5XHxMoapZxM8Tb0kEgKVA7SrMU7uW4=";
+    inherit hash;
   };
-  version = "11.3.4";
+  inherit version;
 
   rdpClient = rustPlatform.buildRustPackage rec {
     pname = "teleport-rdpclient";
-    cargoHash = "sha256-TSIwLCY01ygCWT73LR/Ch7NwPQA3a3r0PyL3hUzBNr4=";
+    inherit cargoHash;
     inherit version src;
 
     buildAndTestSubdir = "lib/srv/desktop/rdp/rdpclient";
@@ -56,7 +62,7 @@ let
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-MAGeWzA366yzpjdCY0+X6RV5MKcsHa/xD5CJu6ce1FU=";
+    hash = yarnHash;
   };
 
   webassets = stdenv.mkDerivation {
@@ -95,7 +101,7 @@ buildGoModule rec {
   pname = "teleport";
 
   inherit src version;
-  vendorHash = "sha256-NkiFLEHBNjxUOSuAlVugAV14yCCo3z6yhX7LZQFKhvA=";
+  inherit vendorHash;
   proxyVendor = true;
 
   subPackages = [ "tool/tbot" "tool/tctl" "tool/teleport" "tool/tsh" ];

pkgs/shells/zsh/zimfw/default.nix

@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "zimfw";
-  version = "1.11.2";
+  version = "1.11.3";
   src = fetchFromGitHub {
     owner = "zimfw";
     repo = "zimfw";
     rev = "v${version}";
     ## zim only needs this one file to be installed.
     sparseCheckout = [ "zimfw.zsh" ];
-    sha256 = "sha256-FgTCdSSDp8pvscRUD4vVk/peoCI4e9FPoCuHP25wxXA=";
+    sha256 = "sha256-q3OSypjqAc+ul0kF6f3u+wnFyNEm4AKwyPBwQzlVzYU=";
   };
   strictDeps = true;
   dontConfigure = true;

pkgs/tools/admin/ejson2env/default.nix

@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ lib, buildGoModule, fetchFromGitHub, nix-update-script }:
 
 buildGoModule rec {
   pname = "ejson2env";
@@ -14,9 +14,15 @@ buildGoModule rec {
   vendorSha256 = "sha256-agWcD8vFNde1SCdkRovMNPf+1KODxV8wW1mXvE0w/CI=";
 
   ldflags = [
+    "-s"
+    "-w"
     "-X main.version=${version}"
   ];
 
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
   meta = with lib; {
     description = "A tool to simplify storing secrets that should be accessible in the shell environment in your git repo.";
     homepage = "https://github.com/Shopify/ejson2env";

pkgs/tools/misc/goaccess/default.nix

@@ -10,14 +10,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.7";
+  version = "1.7.1";
   pname = "goaccess";
 
   src = fetchFromGitHub {
     owner = "allinurl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5lN+57HMxPfCop2sTSldhv1TBEIaowavXvniwqnesOQ=";
+    sha256 = "sha256-RJQyR6nTvDvR+outbVDYKFC1Tl99O0SZW94e/SbqAO0=";
   };
 
   nativeBuildInputs = [

pkgs/tools/misc/rust-motd/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-motd";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "rust-motd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-w984vvjjieSv4eM3jT8zJIIR7/7pmADhR3Esj+2dCTs=";
+    hash = "sha256-x3dx4PdYSYd7wA/GGj9QYC8rK33FWATs2SnaOagGE80=";
   };
 
-  cargoHash = "sha256-L/QdFjSYm3PekKS3tdsUl8XBVyIBE044EHOIB+aEltI=";
+  cargoHash = "sha256-7YvzVG3c10EJET+659F1fwgZ0SmBKMdAWD6LeWnGrNI=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/tools/networking/ali/default.nix

@@ -0,0 +1,27 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "ali";
+  version = "0.7.5";
+
+  src = fetchFromGitHub {
+    owner = "nakabonne";
+    repo = "ali";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-/pdHlI20IzSTX2pnsbxPiJiWmOCbp13eJWLi0Tcsueg=";
+  };
+
+  vendorHash = "sha256-YWx9K04kTMaI0FXebwRQVCt0nxIwZ6xlbtI2lk3qp0M=";
+
+  meta = with lib; {
+    description = "Generate HTTP load and plot the results in real-time";
+    homepage = "https://github.com/nakabonne/ali";
+    changelog = "https://github.com/nakabonne/ali/releases/tag/v${version}";
+    license = licenses.mit;
+    platforms = platforms.linux ++ platforms.darwin;
+    maintainers = with maintainers; [ farcaller ];
+  };
+}

pkgs/tools/security/exploitdb/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-02-28";
+  version = "2023-03-01";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-hEuOGnAWyX3oBfrUWBhT58WAjDWTWeLIYuyfUs3q0Jc=";
+    hash = "sha256-+1yu5R3JUmp6PylmkIWZlEXlq05fi9Lb1q36iBPWdso=";
   };
 
   nativeBuildInputs = [

pkgs/top-level/all-packages.nix

@@ -12570,9 +12570,13 @@ with pkgs;
 
   telegraf = callPackage ../servers/monitoring/telegraf { };
 
-  teleport = callPackage ../servers/teleport {
+  teleport_11 = callPackage ../servers/teleport/11.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security AppKit;
   };
+  teleport_12 = callPackage ../servers/teleport/12.nix {
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security AppKit;
+  };
+  teleport = teleport_12;
 
   telepresence = callPackage ../tools/networking/telepresence {
     pythonPackages = python3Packages;
@@ -39407,4 +39411,6 @@ with pkgs;
   volantes-cursors = callPackage ../data/icons/volantes-cursors { };
 
   gnss-share = callPackage ../servers/gnss-share { };
+
+  ali = callPackage ../tools/networking/ali { };
 }