Merge staging-next into staging

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -273,6 +273,16 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `services.chronyd` is now started with additional systemd sandbox/hardening options for better security.
 
+- PostgreSQL has opt-in support for [JIT compilation](https://www.postgresql.org/docs/current/jit-reason.html). It can be enabled like this:
+  ```nix
+  {
+    services.postgresql = {
+      enable = true;
+      enableJIT = true;
+    };
+  }
+  ```
+
 - `services.dhcpcd` service now don't solicit or accept IPv6 Router Advertisements on interfaces that use static IPv6 addresses.
 
 - The module `services.headscale` was refactored to be compliant with [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md). To be precise, this means that the following things have changed:

nixos/modules/services/databases/postgresql.md

@@ -171,3 +171,40 @@ self: super: {
   };
 }
 ```
+
+## JIT (Just-In-Time compilation) {#module-services-postgres-jit}
+
+[JIT](https://www.postgresql.org/docs/current/jit-reason.html)-support in the PostgreSQL package
+is disabled by default because of the ~300MiB closure-size increase from the LLVM dependency. It
+can be optionally enabled in PostgreSQL with the following config option:
+
+```nix
+{
+  services.postgresql.enableJIT = true;
+}
+```
+
+This makes sure that the [`jit`](https://www.postgresql.org/docs/current/runtime-config-query.html#GUC-JIT)-setting
+is set to `on` and a PostgreSQL package with JIT enabled is used. Further tweaking of the JIT compiler, e.g. setting a different
+query cost threshold via [`jit_above_cost`](https://www.postgresql.org/docs/current/runtime-config-query.html#GUC-JIT-ABOVE-COST)
+can be done manually via [`services.postgresql.settings`](#opt-services.postgresql.settings).
+
+The attribute-names of JIT-enabled PostgreSQL packages are suffixed with `_jit`, i.e. for each `pkgs.postgresql`
+(and `pkgs.postgresql_<major>`) in `nixpkgs` there's also a `pkgs.postgresql_jit` (and `pkgs.postgresql_<major>_jit`).
+Alternatively, a JIT-enabled variant can be derived from a given `postgresql` package via `postgresql.withJIT`.
+This is also useful if it's not clear which attribute from `nixpkgs` was originally used (e.g. when working with
+[`config.services.postgresql.package`](#opt-services.postgresql.package) or if the package was modified via an
+overlay) since all modifications are propagated to `withJIT`. I.e.
+
+```nix
+with import <nixpkgs> {
+  overlays = [
+    (self: super: {
+      postgresql = super.postgresql.overrideAttrs (_: { pname = "foobar"; });
+    })
+  ];
+};
+postgresql.withJIT.pname
+```
+
+evaluates to `"foobar"`.

nixos/modules/services/databases/postgresql.nix

@@ -7,9 +7,18 @@ let
   cfg = config.services.postgresql;
 
   postgresql =
+    let
+      # ensure that
+      #   services.postgresql = {
+      #     enableJIT = true;
+      #     package = pkgs.postgresql_<major>;
+      #   };
+      # works.
+      base = if cfg.enableJIT && !cfg.package.jitSupport then cfg.package.withJIT else cfg.package;
+    in
     if cfg.extraPlugins == []
-      then cfg.package
-      else cfg.package.withPackages (_: cfg.extraPlugins);
+      then base
+      else base.withPackages (_: cfg.extraPlugins);
 
   toStr = value:
     if true == value then "yes"
@@ -42,6 +51,8 @@ in
 
       enable = mkEnableOption (lib.mdDoc "PostgreSQL Server");
 
+      enableJIT = mkEnableOption (lib.mdDoc "JIT support");
+
       package = mkOption {
         type = types.package;
         example = literalExpression "pkgs.postgresql_11";
@@ -435,19 +446,21 @@ in
         log_line_prefix = cfg.logLinePrefix;
         listen_addresses = if cfg.enableTCPIP then "*" else "localhost";
         port = cfg.port;
+        jit = mkDefault (if cfg.enableJIT then "on" else "off");
       };
 
     services.postgresql.package = let
         mkThrow = ver: throw "postgresql_${ver} was removed, please upgrade your postgresql version.";
+        base = if versionAtLeast config.system.stateVersion "22.05" then pkgs.postgresql_14
+            else if versionAtLeast config.system.stateVersion "21.11" then pkgs.postgresql_13
+            else if versionAtLeast config.system.stateVersion "20.03" then pkgs.postgresql_11
+            else if versionAtLeast config.system.stateVersion "17.09" then mkThrow "9_6"
+            else mkThrow "9_5";
     in
       # Note: when changing the default, make it conditional on
       # ‘system.stateVersion’ to maintain compatibility with existing
       # systems!
-      mkDefault (if versionAtLeast config.system.stateVersion "22.05" then pkgs.postgresql_14
-            else if versionAtLeast config.system.stateVersion "21.11" then pkgs.postgresql_13
-            else if versionAtLeast config.system.stateVersion "20.03" then pkgs.postgresql_11
-            else if versionAtLeast config.system.stateVersion "17.09" then mkThrow "9_6"
-            else mkThrow "9_5");
+      mkDefault (if cfg.enableJIT then base.withJIT else base);
 
     services.postgresql.dataDir = mkDefault "/var/lib/postgresql/${cfg.package.psqlSchema}";
 

nixos/tests/all-tests.nix

@@ -565,6 +565,7 @@ in {
   postfixadmin = handleTest ./postfixadmin.nix {};
   postgis = handleTest ./postgis.nix {};
   postgresql = handleTest ./postgresql.nix {};
+  postgresql-jit = handleTest ./postgresql-jit.nix {};
   postgresql-wal-receiver = handleTest ./postgresql-wal-receiver.nix {};
   powerdns = handleTest ./powerdns.nix {};
   powerdns-admin = handleTest ./powerdns-admin.nix {};

nixos/tests/postgresql-jit.nix

@@ -0,0 +1,48 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+
+let
+  inherit (pkgs) lib;
+  packages = builtins.attrNames (import ../../pkgs/servers/sql/postgresql pkgs);
+
+  mkJitTest = packageName: makeTest {
+    name = "${packageName}";
+    meta.maintainers = with lib.maintainers; [ ma27 ];
+    nodes.machine = { pkgs, lib, ... }: {
+      services.postgresql = {
+        enable = true;
+        enableJIT = true;
+        package = pkgs.${packageName};
+        initialScript = pkgs.writeText "init.sql" ''
+          create table demo (id int);
+          insert into demo (id) select generate_series(1, 5);
+        '';
+      };
+    };
+    testScript = ''
+      machine.start()
+      machine.wait_for_unit("postgresql.service")
+
+      with subtest("JIT is enabled"):
+          machine.succeed("sudo -u postgres psql <<<'show jit;' | grep 'on'")
+
+      with subtest("Test JIT works fine"):
+          output = machine.succeed(
+              "cat ${pkgs.writeText "test.sql" ''
+                set jit_above_cost = 1;
+                EXPLAIN ANALYZE SELECT CONCAT('jit result = ', SUM(id)) FROM demo;
+                SELECT CONCAT('jit result = ', SUM(id)) from demo;
+              ''} | sudo -u postgres psql"
+          )
+          assert "JIT:" in output
+          assert "jit result = 15" in output
+
+      machine.shutdown()
+    '';
+  };
+in
+lib.genAttrs packages mkJitTest

nixos/tests/postgresql-wal-receiver.nix

@@ -116,4 +116,4 @@ let
     };
 
 # Maps the generic function over all attributes of PostgreSQL packages
-in builtins.listToAttrs (map makePostgresqlWalReceiverTest (builtins.attrNames (import ../../pkgs/servers/sql/postgresql { })))
+in builtins.listToAttrs (map makePostgresqlWalReceiverTest (builtins.attrNames (import ../../pkgs/servers/sql/postgresql pkgs)))

nixos/tests/postgresql.nix

@@ -137,7 +137,7 @@ let
       maintainers = [ zagy ];
     };
 
-    machine = {...}:
+    nodes.machine = {...}:
       {
         services.postgresql = {
           enable = true;

pkgs/applications/audio/setbfree/default.nix

@@ -14,9 +14,9 @@ stdenv.mkDerivation  rec {
   };
 
   postPatch = ''
-    sed 's#/usr/local#$(out)#g' -i common.mak
-    sed 's#/usr/share/fonts/truetype/ttf-bitstream-vera#${ttf_bitstream_vera}/share/fonts/truetype#g' \
-      -i b_synth/Makefile
+    substituteInPlace common.mak \
+      --replace /usr/local "$out" \
+      --replace /usr/share/fonts/truetype/ttf-bitstream-vera "${ttf_bitstream_vera}/share/fonts/truetype"
   '';
 
   nativeBuildInputs = [ pkg-config ];
@@ -25,6 +25,15 @@ stdenv.mkDerivation  rec {
     ttf_bitstream_vera
   ];
 
+  doInstallCheck = true;
+
+  installCheckPhase = ''(
+    set -x
+    test -e $out/bin/setBfreeUI
+  )'';
+
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "A DSP tonewheel organ emulator";
     homepage = "https://setbfree.org";

pkgs/applications/editors/jetbrains/default.nix

@@ -8,6 +8,7 @@
 , patchelf
 , openssl
 , expat
+, libxcrypt-legacy
 , vmopts ? null
 }:
 
@@ -50,6 +51,7 @@ let
         libdbusmenu
         openssl.out
         expat
+        libxcrypt-legacy
       ];
       dontAutoPatchelf = true;
       postFixup = (attrs.postFixup or "") + lib.optionalString (stdenv.isLinux) ''

pkgs/applications/networking/avalanchego/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "avalanchego";
-  version = "1.9.11";
+  version = "1.9.16";
 
   src = fetchFromGitHub {
     owner = "ava-labs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fgjuLQNw5Em+wEJSmote6TuFH8dUVDtkQTgCcGhh2ro=";
+    hash = "sha256-xskLRQLjLSXXHK39h7e8knP5OtIbcllF7OvefPpIQCU=";
   };
 
-  vendorHash = "sha256-IxPJBpOSqcramegQ+M/U9p6ls6dStOi0OUdddDj11d0=";
+  vendorHash = "sha256-lyXP1mkJmHpHHMtH0rXa0orf5u+AbZ4H/MJXt8o49ng=";
   # go mod vendor has a bug, see: https://github.com/golang/go/issues/57529
   proxyVendor = true;
 

pkgs/applications/networking/cluster/kubernetes-metrics-server/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubernetes-metrics-server";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "metrics-server";
     rev = "v${version}";
-    sha256 = "sha256-TTI+dNBQ/jKt6Yhud3/OO+zOkeO46CmUz6J6ByX26JE=";
+    sha256 = "sha256-hPI+Wq0mZ2iu4FSDpdPdGEqgFCeUdqeK5ldJCByDE4M=";
   };
 
-  vendorSha256 = "sha256-lpSMvHYlPtlJQUqsdXJ6ewBEBiwLPvP/rsUgYzJhOxc=";
+  vendorHash = "sha256-BR9mBBH5QE3FMTNtyHfHA1ei18CIDr5Yhvg28hGbDR4=";
 
   preCheck = ''
     # the e2e test breaks the sandbox, so let's skip that

pkgs/applications/radio/dump1090/default.nix

@@ -48,7 +48,6 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "A simple Mode S decoder for RTLSDR devices";
     homepage = "https://github.com/flightaware/dump1090";
     license = licenses.gpl2Plus;

pkgs/applications/science/logic/glucose/default.nix

@@ -1,26 +1,29 @@
 { lib
 , stdenv
 , fetchurl
+, unzip
 , zlib
 , enableUnfree ? false
 }:
 
 stdenv.mkDerivation rec {
   pname = "glucose" + lib.optionalString enableUnfree "-syrup";
-  version = "4.1";
+  version = "4.2.1";
 
   src = fetchurl {
-    url = "http://www.labri.fr/perso/lsimon/downloads/softwares/glucose-syrup-${version}.tgz";
-    hash = "sha256-Uaoc8b7SsU8VQ7CZ6FpW3RqSvjfm4+sMSh/Yg9XMUCk=";
+    url = "https://www.labri.fr/perso/lsimon/downloads/softwares/glucose-${version}.zip";
+    hash = "sha256-J0J9EKC/4cCiZr/y4lz+Hm7OcmJmMIIWzQ+4c+KhqXg=";
   };
 
-  sourceRoot = "glucose-syrup-${version}/${if enableUnfree then "parallel" else "simp"}";
+  sourceRoot = "glucose-${version}/sources/${if enableUnfree then "parallel" else "simp"}";
 
   postPatch = ''
     substituteInPlace Main.cc \
       --replace "defined(__linux__)" "defined(__linux__) && defined(__x86_64__)"
   '';
 
+  nativeBuildInputs = [ unzip ];
+
   buildInputs = [ zlib ];
 
   makeFlags = [ "r" ];

pkgs/applications/virtualization/firectl/default.nix

@@ -1,19 +1,20 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
 buildGoModule rec {
   pname = "firectl";
-  # The latest upstream 0.1.0 is incompatible with firecracker
-  # v0.1.0. See issue: https://github.com/firecracker-microvm/firectl/issues/82
-  version = "unstable-2022-07-12";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "firecracker-microvm";
     repo = pname;
-    rev = "ec72798240c0561dea8341d828e8c72bb0cc36c5";
-    sha256 = "sha256-RAl1DaeMR7eYYwqVAvm6nib5gEGaM/t7TR8u1IpqOIM=";
+    rev = "v${version}";
+    hash = "sha256-3MNNgFRq4goWdHFyqWNMAl2K0eKfd03BF05i82FIzNE=";
   };
 
-  vendorSha256 = "sha256-dXAJOifRtzcTyGzUTFu9+daGAlL/5dQSwcjerkZDuKA=";
+  vendorHash = "sha256-rD+QCQKgCZU5ktItV8NYqoyQPR7lk8sutvJwSJxFfZQ=";
 
   doCheck = false;
 

pkgs/applications/virtualization/runc/default.nix

@@ -15,13 +15,13 @@
 
 buildGoModule rec {
   pname = "runc";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
     rev = "v${version}";
-    sha256 = "sha256-ougJHW1Z+qZ324P8WpZqawY1QofKnn8WezP7orzRTdA=";
+    sha256 = "sha256-r5as3hb0zt+XPfxAPeH+YIc/n6IRlscPOZMGfhVE5C4=";
   };
 
   vendorSha256 = null;

pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix

@@ -11,6 +11,11 @@ let
 
   target = ./. + "/${arch}-unknown-none.json";
 
+in
+
+assert lib.assertMsg (builtins.pathExists target) "Target spec not found";
+
+let
   cross = import ../../../.. {
     system = hostPlatform.system;
     crossSystem = lib.systems.examples."${arch}-embedded" // {

pkgs/data/misc/v2ray-geoip/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202303230043";
+  version = "202303272340";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "163f6f7caad67d43b51a9c342a72e34feeccb4d0";
-    sha256 = "sha256-hwKRwCu/LHbjqzgpwG8YcTX4C+eEkonCDqVq36FIprQ=";
+    rev = "0473ff6f84b7bb926af68238489d05f683b87e1d";
+    sha256 = "sha256-76SsWF3jOi+I975C9WNVMGrLqvgtdM48n9bV0jevx3Q=";
   };
 
   installPhase = ''

pkgs/development/coq-modules/stdpp/default.nix

@@ -6,7 +6,7 @@ mkCoqDerivation rec {
   domain = "gitlab.mpi-sws.org";
   owner = "iris";
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.13" "8.16"; out = "1.8.0"; }
+    { case = range "8.13" "8.17"; out = "1.8.0"; }
     { case = range "8.12" "8.14"; out = "1.6.0"; }
     { case = range "8.11" "8.13"; out = "1.5.0"; }
     { case = range "8.8" "8.10";  out = "1.4.0"; }

pkgs/development/node-packages/main-programs.nix

@@ -20,6 +20,7 @@
   "@commitlint/cli" = "commitlint";
   "@forge/cli" = "forge";
   "@gitbeaker/cli" = "gitbeaker";
+  "@githubnext/github-copilot-cli" = "github-copilot-cli";
   "@google/clasp" = "clasp";
   "@medable/mdctl-cli" = "mdctl";
   "@mermaid-js/mermaid-cli" = "mmdc";

pkgs/development/node-packages/node-packages.json

@@ -152,6 +152,7 @@
 , "git-ssb"
 , "git-standup"
 , "@gitbeaker/cli"
+, "@githubnext/github-copilot-cli"
 , "gitmoji-cli"
 , "glob"
 , "gramma"

pkgs/development/python-modules/ailment/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.43";
+  version = "9.2.44";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Nww43TIIWHJo8tKNQoPYWHXzslnsBGftxfTCg3elo6w=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-KgQX8uVLnRZj2u2gkClX0PkaAPxgJR0D6E4lviZF1gk=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/angr/default.nix

@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.43";
+  version = "9.2.44";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -39,8 +39,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-SHUuKF7rT2x7CxF9s6ntxniOjhf7asY7HJeMi38Dqrc=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-o2jTRh8N7FfyewGy77+PuOMNZi+8BuuSwS88iTPWNxs=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/archinfo/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.43";
+  version = "9.2.44";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-j+JzLN6ila3PsTtxespvPKyH6NVO8eFncDw9qPFDLyQ=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-/3H6Ieq5Qt0BKlgexvJLQ/DtZn+s+k+QV2sraeoioUk=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/btest/default.nix

@@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "btest";
+  version = "1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "zeek";
+    repo = "btest";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QvK2MZTx+DD2u+h7dk0F5kInXGVp73ZTvG080WV2BVQ=";
+  };
+
+  # No tests available and no module to import
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A Generic Driver for Powerful System Tests";
+    homepage = "https://github.com/zeek/btest";
+    changelog = "https://github.com/zeek/btest/blob/${version}/CHANGES";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/claripy/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.43";
+  version = "9.2.44";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-g7kXjoJDzc+MPmGR6dO7mGi3LcJQem6pnLvbuoC9Pxw=";
+    hash = "sha256-+PGCPM3EbdeS7ftqmJBd2F5HOdoXNtBWHvEEWq7JKTs=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/cle/default.nix

@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.43";
+  version = "9.2.44";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -37,8 +37,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-GWChdbQRnoD6hRVONLcFNoW9vJO9iWKLnjd8xiA/7jI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-yA7Wh+8ClPl+Eythk9i6cFZnFF481e/UkKMGzmZxdYA=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/databricks-sql-connector/default.nix

@@ -70,5 +70,8 @@ buildPythonPackage rec {
     changelog = "https://github.com/databricks/databricks-sql-python/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ harvidsen ];
+    # No SQLAlchemy 2.0 support
+    # https://github.com/databricks/databricks-sql-python/issues/91
+    broken = true;
   };
 }

pkgs/development/python-modules/datadog/default.nix

@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "datadog";
-  version = "0.44.0";
+  version = "0.45.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BxFw8MfvIlEdv3+b12xL5QDuLT1SBykApch7VJXSxzM=";
+    hash = "sha256-a//tZ0SMtL9d/1WfsqzuHAbn2oYSuOKnNPJ4tQs5ZgM=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/dpath/default.nix

@@ -2,24 +2,29 @@
 , buildPythonPackage
 , fetchPypi
 , hypothesis
-, isPy27
+, pythonOlder
 , mock
 , nose2
 , pytestCheckHook
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "dpath";
-  version = "2.1.4";
+  version = "2.1.5";
+  format = "setuptools";
 
-  disabled = isPy27; # uses python3 imports
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-M4CnfQ20q/EEElhg/260vQfJfGW4Gq1CpglxcImhvtA=";
+    hash = "sha256-zNlk24ObqtSqggYStLhzGwn0CiRdQBtyMVbOTvRbIrc=";
   };
 
-  # use pytest as nosetests hangs
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     hypothesis
     mock
@@ -27,11 +32,14 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "dpath" ];
+  pythonImportsCheck = [
+    "dpath"
+  ];
 
   meta = with lib; {
     description = "Python library for accessing and searching dictionaries via /slashed/paths ala xpath";
     homepage = "https://github.com/akesterson/dpath-python";
+    changelog = "https://github.com/dpath-maintainers/dpath-python/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ mmlb ];
   };

pkgs/development/python-modules/flux-led/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "flux-led";
-  version = "0.28.35";
+  version = "0.28.36";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = "refs/tags/${version}";
-    hash = "sha256-+MbcI/gcoQOpfL77AyA0rZBP5OgP87gSDt4e5pjriqY=";
+    hash = "sha256-UoWeVLsfc8rK3U7zaF8bKXk/XdrgT6F3biNe/UFq/rE=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/google-cloud-bigquery-storage/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery-storage";
-  version = "2.19.0";
+  version = "2.19.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5bsOrT4IIrxOnPIpvR0T1MOPGeUNU6odcKs82aN8B8I=";
+    hash = "sha256-DZtfQqcD8yELSzrUWhgTkZH5NHQP3zYpsbIv2VrfC7o=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/gradient/default.nix

@@ -36,9 +36,9 @@ buildPythonPackage rec {
       --replace 'attrs<=' 'attrs>=' \
       --replace 'colorama==' 'colorama>=' \
       --replace 'gql[requests]==3.0.0a6' 'gql' \
-      --replace 'PyYAML==' 'PyYAML>=' \
+      --replace 'PyYAML==5.*' 'PyYAML' \
       --replace 'marshmallow<' 'marshmallow>=' \
-      --replace 'websocket-client==' 'websocket-client>='
+      --replace 'websocket-client==0.57.*' 'websocket-client'
   '';
 
   propagatedBuildInputs = [

pkgs/development/python-modules/malduck/default.nix

@@ -60,5 +60,8 @@ buildPythonPackage rec {
     changelog = "https://github.com/CERT-Polska/malduck/releases/tag/v${version}";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ fab ];
+    # Compatibility issues with yara-python v4.3.0
+    # https://github.com/CERT-Polska/malduck/issues/88
+    broken = true;
   };
 }

pkgs/development/python-modules/mypy-boto3-builder/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.14.2";
+  version = "7.14.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "youtype";
     repo = "mypy_boto3_builder";
     rev = "refs/tags/${version}";
-    hash = "sha256-dcVEIeDsVX9bdi6IgBPHM/aVrRujmd/BHmCUCuD0v8k=";
+    hash = "sha256-aEmJ4jyIsgAL7CUZek/YZSPrHqW7i+S1bbZv8jH9FGc=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/mypy-boto3-s3/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-s3";
-  version = "1.26.97.post2";
+  version = "1.26.99";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5fa2iL4H73Ne+U1hVzdJomV6NRJRcmsyXz3OSUcQrQg=";
+    hash = "sha256-iImkxirshZBr218nJ1YLvUxBy1h0ugZ+JQ8k4J4NmyQ=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/peaqevcore/default.nix

@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "13.4.1";
+  version = "13.4.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f4Xq68QBcnHZdwZrAwg7QUvZrXYvrflEkh1us48YN/g=";
+    hash = "sha256-AW1MPFXQ/8/KqUr4wM263nSzrN67ai+L/dXVTCUG8uI=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pyaussiebb/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyaussiebb";
-  version = "0.0.15";
+  version = "0.0.16";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "yaleman";
     repo = "aussiebb";
-    rev = "v${version}";
-    hash = "sha256-V9yN05Bkv5vkHgXZ77ps3d6JS39M5iMuiijOGRBFi0U=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-dbu26QFboqVaSFYlTXsOFA4yhXXNcB4QBCA8PZTphns=";
   };
 
   nativeBuildInputs = [
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module for interacting with the Aussie Broadband APIs";
     homepage = "https://github.com/yaleman/aussiebb";
+    changelog = "https://github.com/yaleman/pyaussiebb/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/pychromecast/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pychromecast";
-  version = "13.0.4";
+  version = "13.0.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyChromecast";
     inherit version;
-    hash = "sha256-eS+6PzHklopemcGcdxd0CDoqp+iX6/b14hjjCOM6Rh8=";
+    hash = "sha256-FJ2tKMvtIpa1B0wyZmLZywCTuDS0F8ue4Fgo6XsoLnM=";
   };
 
   postPatch = ''

pkgs/development/python-modules/python-engineio/default.nix

@@ -4,7 +4,6 @@
 , buildPythonPackage
 , eventlet
 , fetchFromGitHub
-, fetchpatch
 , iana-etc
 , libredirect
 , mock
@@ -17,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "python-engineio";
-  version = "4.3.4";
+  version = "4.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -26,18 +25,9 @@ buildPythonPackage rec {
     owner = "miguelgrinberg";
     repo = "python-engineio";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fymO9WqkYaRsHKCJHQJpySHqZor2t8BfVrfYUfYoJno=";
+    hash = "sha256-pixLk9Q7mIw1ReFemDu039lJtCwqi73tvhXl0KhKvgw=";
   };
 
-  patches = [
-    # Address Python 3.11 mocking issue, https://github.com/miguelgrinberg/python-engineio/issues/279
-    (fetchpatch {
-      name = "mocking-issue-py311.patch";
-      url = "https://github.com/miguelgrinberg/python-engineio/commit/ac3911356fbe933afa7c11d56141f0e228c01528.patch";
-      hash = "sha256-LNMhjX8kqOI3y8XugCHxCPEC6lF83NROfIczXWiLuqY=";
-    })
-  ];
-
   nativeCheckInputs = [
     aiohttp
     eventlet

pkgs/development/python-modules/python-socketio/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "python-socketio";
-  version = "5.7.2";
+  version = "5.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "miguelgrinberg";
     repo = "python-socketio";
     rev = "v${version}";
-    hash = "sha256-mSFs/k+3Lp5w4WdOLKj65kOA5b+Nc1uuksVmeeqV58E=";
+    hash = "sha256-3Do3Ql48cmhvrFe14ZYvWH0xi3T8hJ2LP0FyyWin580=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pyvex/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.43";
+  version = "9.2.44";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-X1lFSbVhHBhQ6Y1pbzjObAISqA6rBTpx0Ww5c6p+3LM=";
+    hash = "sha256-BJw1c9X+rRNiM10Fo514ZybbvM++Ph7te2LuFNNJFTk=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/yara-python/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "yara-python";
-  version = "4.2.3";
+  version = "4.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "VirusTotal";
     repo = "yara-python";
     rev = "v${version}";
-    hash = "sha256-spUQuezQMqaG1hboM0/Gs7siCM6x0b40O+sV7qGGBng=";
+    hash = "sha256-r1qsD5PquOVDEVmrgU2QP5bZpsuZuKlfaaHUjY4AHy4=";
   };
 
   buildInputs = [

pkgs/development/python-modules/yfinance/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "yfinance";
-  version = "0.2.12";
+  version = "0.2.14";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "ranaroussi";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-k0al/N9xWen/IlE8JfFV98DSRnelQk+MURXz3IjGgNI=";
+    hash = "sha256-KUG8hixdfLg1qBvwU1s6HFORWKCdSY54wLo0onhXmE0=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/ytmusicapi/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "ytmusicapi";
-  version = "0.25.0";
+  version = "0.25.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hpX/qmRRwvCE0N5jIWl6AZkcYaVViK30nPbJwyZD+rM=";
+    hash = "sha256-uc/fgDetSYaCRzff0SzfbRhs3TaKrfE2h6roWkkj8yQ=";
   };
 
   nativeBuildInputs = [
@@ -37,6 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python API for YouTube Music";
     homepage = "https://github.com/sigma67/ytmusicapi";
+    changelog = "https://github.com/sigma67/ytmusicapi/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
   };

pkgs/development/tools/analysis/rizin/default.nix

@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rizin";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchurl {
     url = "https://github.com/rizinorg/rizin/releases/download/v${version}/rizin-src-v${version}.tar.xz";
-    hash = "sha256-96EzipCd5GX1bkpZIXZp1ZUVO+Oe4t5bhthGZHUVmFk=";
+    hash = "sha256-cauA/DyKycgKEAANg4EoryigXTGg7hg5AMLFxuNQ7KM=";
   };
 
   mesonFlags = [

pkgs/development/tools/esbuild/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.17.13";
+  version = "0.17.14";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    hash = "sha256-b9hepd8rF96lU/986Kgc0aSulUylecu73cuxM6Kuu24=";
+    hash = "sha256-4TC1d5FOZHUMuEMTcTOBLZZM+sFUswhyblI5HVWyvPA=";
   };
 
   vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";

pkgs/development/tools/golangci-lint-langserver/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint-langserver";
-  version = "0.0.7";
+  version = "0.0.8";
 
   src = fetchFromGitHub {
     owner = "nametake";
     repo = "golangci-lint-langserver";
     rev = "v${version}";
-    sha256 = "sha256-VsS0IV8G9ctJVDHpU9WN58PGIAwDkH0UH5v/ZEtbXDE=";
+    sha256 = "sha256-UdDWu3dZ/XUol2Y8lWk6d2zRZ+Pc1GiR6yqOuNaXxZY=";
   };
 
-  vendorSha256 = "sha256-tAcl6P+cgqFX1eMYdS8vnfdNyb+1QNWwWdJsQU6Fpgg=";
+  vendorHash = "sha256-tAcl6P+cgqFX1eMYdS8vnfdNyb+1QNWwWdJsQU6Fpgg=";
 
   subPackages = [ "." ];
 

pkgs/misc/fastly/default.nix

@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "fastly";
-  version = "8.1.0";
+  version = "8.1.2";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4RynQS3Y+Aa93hYWyvZSkAq2teUKJhqAn8NSvnEEdzE=";
+    hash = "sha256-M/2ShE1lmT7DLUSANt+JVGUPhXoXkIyachtfXpbu5MU=";
     # The git commit is part of the `fastly version` original output;
     # leave that output the same in nixpkgs. Use the `.git` directory
     # to retrieve the commit SHA, and remove the directory afterwards,

pkgs/servers/livepeer/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, buildGoModule
+{ lib, fetchFromGitHub, buildGoModule
 , pkg-config, ffmpeg, gnutls
 }:
 
@@ -24,7 +24,6 @@ buildGoModule rec {
   buildInputs = [ ffmpeg gnutls ];
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "Official Go implementation of the Livepeer protocol";
     homepage = "https://livepeer.org";
     license = licenses.mit;

pkgs/servers/mastodon/gemset.nix

@@ -353,15 +353,14 @@
     version = "1.0.0";
   };
   blurhash = {
-    dependencies = ["ffi"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rs61mwdiyriq8mb8na2sfrqzz8igls04md63ajyhk4yj8d2j0sz";
+      sha256 = "057afgqy73n8vm7k3cr4pbwm1hhqnm58lp4x7bgm5wzbs39m7xf8";
       type = "gem";
     };
-    version = "0.1.6";
+    version = "0.1.7";
   };
   bootsnap = {
     dependencies = ["msgpack"];

pkgs/servers/mastodon/source.nix

@@ -1,5 +1,5 @@
 # This file was generated by pkgs.mastodon.updateScript.
-{ fetchgit, applyPatches }: let
+{ fetchgit, applyPatches, fetchpatch }: let
   src = fetchgit {
     url = "https://github.com/mastodon/mastodon.git";
     rev = "v4.1.1";
@@ -7,5 +7,10 @@
   };
 in applyPatches {
   inherit src;
-  patches = [];
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mastodon/mastodon/commit/e7b81d7d9625893b1323e12215a2a98c0f19f58f.patch";
+      hash = "sha256-cF0wtbjTNbsyqHb3uy5zYFaACIcziJ2ulJpOT5VoDO0=";
+    })
+  ];
 }

pkgs/servers/sql/postgresql/default.nix

@@ -14,17 +14,28 @@ let
       , this, self, newScope, buildEnv
 
       # source specification
-      , version, hash, psqlSchema,
+      , version, hash, psqlSchema
 
       # for tests
-      nixosTests, thisAttr
+      , nixosTests, thisAttr
+
+      # JIT
+      , jitSupport ? false
+      , nukeReferences, patchelf, llvmPackages
+      , makeRustPlatform, buildPgxExtension, rustPlatform
+
+      # detection of crypt fails when using llvm stdenv, so we add it manually
+      # for <13 (where it got removed: https://github.com/postgres/postgres/commit/c45643d618e35ec2fe91438df15abd4f3c0d85ca)
+      , libxcrypt
     }:
   let
     atLeast = lib.versionAtLeast version;
+    olderThan = lib.versionOlder version;
     lz4Enabled = atLeast "14";
     zstdEnabled = atLeast "15";
 
-  in stdenv.mkDerivation rec {
+    stdenv' = if jitSupport then llvmPackages.stdenv else stdenv;
+  in stdenv'.mkDerivation rec {
     pname = "postgresql";
     inherit version;
 
@@ -33,7 +44,7 @@ let
       inherit hash;
     };
 
-    hardeningEnable = lib.optionals (!stdenv.cc.isClang) [ "pie" ];
+    hardeningEnable = lib.optionals (!stdenv'.cc.isClang) [ "pie" ];
 
     outputs = [ "out" "lib" "doc" "man" ];
     setOutputFlags = false; # $out retains configureFlags :-/
@@ -45,18 +56,21 @@ let
       libxml2
       icu
     ]
+      ++ lib.optionals (olderThan "13") [ libxcrypt ]
+      ++ lib.optionals jitSupport [ llvmPackages.llvm ]
       ++ lib.optionals lz4Enabled [ lz4 ]
       ++ lib.optionals zstdEnabled [ zstd ]
       ++ lib.optionals enableSystemd [ systemd ]
       ++ lib.optionals gssSupport [ libkrb5 ]
-      ++ lib.optionals (!stdenv.isDarwin) [ libossp_uuid ];
+      ++ lib.optionals (!stdenv'.isDarwin) [ libossp_uuid ];
 
     nativeBuildInputs = [
       makeWrapper
       pkg-config
-    ];
+    ]
+      ++ lib.optionals jitSupport [ llvmPackages.llvm.dev nukeReferences patchelf ];
 
-    enableParallelBuilding = !stdenv.isDarwin;
+    enableParallelBuilding = !stdenv'.isDarwin;
 
     separateDebugInfo = true;
 
@@ -65,7 +79,7 @@ let
     env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
     # Otherwise it retains a reference to compiler and fails; see #44767.  TODO: better.
-    preConfigure = "CC=${stdenv.cc.targetPrefix}cc";
+    preConfigure = "CC=${stdenv'.cc.targetPrefix}cc";
 
     configureFlags = [
       "--with-openssl"
@@ -76,11 +90,12 @@ let
       "--with-system-tzdata=${tzdata}/share/zoneinfo"
       "--enable-debug"
       (lib.optionalString enableSystemd "--with-systemd")
-      (if stdenv.isDarwin then "--with-uuid=e2fs" else "--with-ossp-uuid")
+      (if stdenv'.isDarwin then "--with-uuid=e2fs" else "--with-ossp-uuid")
     ] ++ lib.optionals lz4Enabled [ "--with-lz4" ]
       ++ lib.optionals zstdEnabled [ "--with-zstd" ]
       ++ lib.optionals gssSupport [ "--with-gssapi" ]
-      ++ lib.optionals stdenv.hostPlatform.isRiscV [ "--disable-spinlocks" ];
+      ++ lib.optionals stdenv'.hostPlatform.isRiscV [ "--disable-spinlocks" ]
+      ++ lib.optionals jitSupport [ "--with-llvm" ];
 
     patches = [
       ./patches/disable-resolve_symlinks.patch
@@ -88,7 +103,7 @@ let
       ./patches/hardcode-pgxs-path.patch
       ./patches/specify_pkglibdir_at_runtime.patch
       ./patches/findstring.patch
-    ] ++ lib.optionals stdenv.isLinux [
+    ] ++ lib.optionals stdenv'.isLinux [
       (if atLeast "13" then ./patches/socketdir-in-run-13.patch else ./patches/socketdir-in-run.patch)
     ];
 
@@ -99,6 +114,11 @@ let
     postPatch = ''
       # Hardcode the path to pgxs so pg_config returns the path in $out
       substituteInPlace "src/common/config_info.c" --replace HARDCODED_PGXS_PATH "$out/lib"
+    '' + lib.optionalString jitSupport ''
+        # Force lookup of jit stuff in $out instead of $lib
+        substituteInPlace src/backend/jit/jit.c --replace pkglib_path \"$out/lib\"
+        substituteInPlace src/backend/jit/llvm/llvmjit.c --replace pkglib_path \"$out/lib\"
+        substituteInPlace src/backend/jit/llvm/llvmjit_inline.cpp --replace pkglib_path \"$out/lib\"
     '';
 
     postInstall =
@@ -109,27 +129,54 @@ let
         moveToOutput "lib/libecpg*" "$out"
 
         # Prevent a retained dependency on gcc-wrapper.
-        substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${stdenv.cc}/bin/ld ld
+        substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${stdenv'.cc}/bin/ld ld
 
         if [ -z "''${dontDisableStatic:-}" ]; then
           # Remove static libraries in case dynamic are available.
           for i in $out/lib/*.a $lib/lib/*.a; do
             name="$(basename "$i")"
-            ext="${stdenv.hostPlatform.extensions.sharedLibrary}"
+            ext="${stdenv'.hostPlatform.extensions.sharedLibrary}"
             if [ -e "$lib/lib/''${name%.a}$ext" ] || [ -e "''${i%.a}$ext" ]; then
               rm "$i"
             fi
           done
         fi
+      '' + lib.optionalString jitSupport ''
+        # Move the bitcode and libllvmjit.so library out of $lib; otherwise, every client that
+        # depends on libpq.so will also have libLLVM.so in its closure too, bloating it
+        moveToOutput "lib/bitcode" "$out"
+        moveToOutput "lib/llvmjit*" "$out"
+
+        # In the case of JIT support, prevent a retained dependency on clang-wrapper
+        substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${self.llvmPackages.stdenv.cc}/bin/clang clang
+        nuke-refs $out/lib/llvmjit_types.bc $(find $out/lib/bitcode -type f)
+
+        # Stop out depending on the default output of llvm
+        substituteInPlace $out/lib/pgxs/src/Makefile.global \
+          --replace ${self.llvmPackages.llvm.out}/bin "" \
+          --replace '$(LLVM_BINPATH)/' ""
+
+        # Stop out depending on the -dev output of llvm
+        substituteInPlace $out/lib/pgxs/src/Makefile.global \
+          --replace ${self.llvmPackages.llvm.dev}/bin/llvm-config llvm-config \
+          --replace -I${self.llvmPackages.llvm.dev}/include ""
+
+        ${lib.optionalString (!stdenv'.isDarwin) ''
+          # Stop lib depending on the -dev output of llvm
+          rpath=$(patchelf --print-rpath $out/lib/llvmjit.so)
+          nuke-refs -e $out $out/lib/llvmjit.so
+          # Restore the correct rpath
+          patchelf $out/lib/llvmjit.so --set-rpath "$rpath"
+        ''}
       '';
 
-    postFixup = lib.optionalString (!stdenv.isDarwin && stdenv.hostPlatform.libc == "glibc")
+    postFixup = lib.optionalString (!stdenv'.isDarwin && stdenv'.hostPlatform.libc == "glibc")
       ''
         # initdb needs access to "locale" command from glibc.
         wrapProgram $out/bin/initdb --prefix PATH ":" ${glibc.bin}/bin
       '';
 
-    doCheck = !stdenv.isDarwin;
+    doCheck = !stdenv'.isDarwin;
     # autodetection doesn't seem to able to find this, but it's there.
     checkTarget = "check";
 
@@ -138,7 +185,7 @@ let
       #     ! ERROR:  could not load library "/build/postgresql-11.5/tmp_install/nix/store/...-postgresql-11.5-lib/lib/libpqwalreceiver.so": Error loading shared library libpq.so.5: No such file or directory (needed by /build/postgresql-11.5/tmp_install/nix/store/...-postgresql-11.5-lib/lib/libpqwalreceiver.so)
       # See also here:
       #     https://git.alpinelinux.org/aports/tree/main/postgresql/disable-broken-tests.patch?id=6d7d32c12e073a57a9e5946e55f4c1fbb68bd442
-      if stdenv.hostPlatform.isMusl then ''
+      if stdenv'.hostPlatform.isMusl then ''
         substituteInPlace src/test/regress/parallel_schedule \
           --replace "subscription" "" \
           --replace "object_address" ""
@@ -146,13 +193,32 @@ let
 
     doInstallCheck = false; # needs a running daemon?
 
-    disallowedReferences = [ stdenv.cc ];
+    disallowedReferences = [ stdenv'.cc ];
 
-    passthru = {
-      inherit readline psqlSchema;
+    passthru = let
+      jitToggle = this.override {
+        jitSupport = !jitSupport;
+        this = jitToggle;
+      };
+    in
+    {
+      inherit readline psqlSchema jitSupport;
+
+      withJIT = if jitSupport then this else jitToggle;
+      withoutJIT = if jitSupport then jitToggle else this;
 
       pkgs = let
-        scope = { postgresql = this; };
+        scope = {
+          postgresql = this;
+          stdenv = stdenv';
+          buildPgxExtension = buildPgxExtension.override {
+            stdenv = stdenv';
+            rustPlatform = makeRustPlatform {
+              stdenv = stdenv';
+              inherit (rustPlatform.rust) rustc cargo;
+            };
+          };
+        };
         newSelf = self // scope;
         newSuper = { callPackage = newScope (scope // this.pkgs); };
       in import ./packages.nix newSelf newSuper;
@@ -163,15 +229,33 @@ let
                      }
                      this.pkgs;
 
-      tests.postgresql = nixosTests.postgresql-wal-receiver.${thisAttr};
+      tests = {
+        postgresql = nixosTests.postgresql-wal-receiver.${thisAttr};
+      } // lib.optionalAttrs jitSupport {
+        postgresql-jit = nixosTests.postgresql-jit.${thisAttr};
+      };
+    } // lib.optionalAttrs jitSupport {
+      inherit (llvmPackages) llvm;
     };
 
     meta = with lib; {
       homepage    = "https://www.postgresql.org";
       description = "A powerful, open source object-relational database system";
       license     = licenses.postgresql;
-      maintainers = with maintainers; [ thoughtpolice danbst globin marsam ivan ];
+      maintainers = with maintainers; [ thoughtpolice danbst globin marsam ivan ma27 ];
       platforms   = platforms.unix;
+
+      # JIT support doesn't work with cross-compilation. It is attempted to build LLVM-bytecode
+      # (`%.bc` is the corresponding `make(1)`-rule) for each sub-directory in `backend/` for
+      # the JIT apparently, but with a $(CLANG) that can produce binaries for the build, not the
+      # host-platform.
+      #
+      # I managed to get a cross-build with JIT support working with
+      # `depsBuildBuild = [ llvmPackages.clang ] ++ buildInputs`, but considering that the
+      # resulting LLVM IR isn't platform-independent this doesn't give you much.
+      # In fact, I tried to test the result in a VM-test, but as soon as JIT was used to optimize
+      # a query, postgres would coredump with `Illegal instruction`.
+      broken = jitSupport && (stdenv.hostPlatform != stdenv.buildPlatform);
     };
   };
 
@@ -204,50 +288,60 @@ let
     passthru.psqlSchema = postgresql.psqlSchema;
   };
 
-in self: {
+  mkPackages = self: {
+    postgresql_11 = self.callPackage generic {
+      version = "11.19";
+      psqlSchema = "11.1"; # should be 11, but changing it is invasive
+      hash = "sha256-ExCeK3HxE5QFwnIB2jczphrOcu4cIo2cnwMg4GruFMI=";
+      this = self.postgresql_11;
+      thisAttr = "postgresql_11";
+      inherit self;
+    };
 
-  postgresql_11 = self.callPackage generic {
-    version = "11.19";
-    psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    hash = "sha256-ExCeK3HxE5QFwnIB2jczphrOcu4cIo2cnwMg4GruFMI=";
-    this = self.postgresql_11;
-    thisAttr = "postgresql_11";
-    inherit self;
+    postgresql_12 = self.callPackage generic {
+      version = "12.14";
+      psqlSchema = "12";
+      hash = "sha256-eFYQI304LIQtNW40cTjljAb/6uJA5swLUqxevMMNBD4=";
+      this = self.postgresql_12;
+      thisAttr = "postgresql_12";
+      inherit self;
+    };
+
+    postgresql_13 = self.callPackage generic {
+      version = "13.10";
+      psqlSchema = "13";
+      hash = "sha256-W7z1pW2FxE86iwWPtGhi/0nLyRg00H4pXQLm3jwhbfI=";
+      this = self.postgresql_13;
+      thisAttr = "postgresql_13";
+      inherit self;
+    };
+
+    postgresql_14 = self.callPackage generic {
+      version = "14.7";
+      psqlSchema = "14";
+      hash = "sha256-zvYPAJj6gQHBVG9CVORbcir1QxM3lFs3ryBwB2MNszE=";
+      this = self.postgresql_14;
+      thisAttr = "postgresql_14";
+      inherit self;
+    };
+
+    postgresql_15 = self.callPackage generic {
+      version = "15.2";
+      psqlSchema = "15";
+      hash = "sha256-maIXH8PWtbX1a3V6ejy4XVCaOOQnOAXe8jlB7SuEaMc=";
+      this = self.postgresql_15;
+      thisAttr = "postgresql_15";
+      inherit self;
+    };
   };
 
-  postgresql_12 = self.callPackage generic {
-    version = "12.14";
-    psqlSchema = "12";
-    hash = "sha256-eFYQI304LIQtNW40cTjljAb/6uJA5swLUqxevMMNBD4=";
-    this = self.postgresql_12;
-    thisAttr = "postgresql_12";
-    inherit self;
-  };
-
-  postgresql_13 = self.callPackage generic {
-    version = "13.10";
-    psqlSchema = "13";
-    hash = "sha256-W7z1pW2FxE86iwWPtGhi/0nLyRg00H4pXQLm3jwhbfI=";
-    this = self.postgresql_13;
-    thisAttr = "postgresql_13";
-    inherit self;
-  };
-
-  postgresql_14 = self.callPackage generic {
-    version = "14.7";
-    psqlSchema = "14";
-    hash = "sha256-zvYPAJj6gQHBVG9CVORbcir1QxM3lFs3ryBwB2MNszE=";
-    this = self.postgresql_14;
-    thisAttr = "postgresql_14";
-    inherit self;
-  };
-
-  postgresql_15 = self.callPackage generic {
-    version = "15.2";
-    psqlSchema = "15";
-    hash = "sha256-maIXH8PWtbX1a3V6ejy4XVCaOOQnOAXe8jlB7SuEaMc=";
-    this = self.postgresql_15;
-    thisAttr = "postgresql_15";
-    inherit self;
-  };
-}
+in self:
+  let packages = mkPackages self; in
+  packages
+  // self.lib.mapAttrs'
+    (attrName: postgres: self.lib.nameValuePair "${attrName}_jit" (postgres.override rec {
+      jitSupport = true;
+      thisAttr = "${attrName}_jit";
+      this = self.${thisAttr};
+    }))
+    packages

pkgs/servers/sql/postgresql/ext/plv8/default.nix

@@ -138,5 +138,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with maintainers; [ marsam ];
     platforms = [ "x86_64-linux" ];
     license = licenses.postgresql;
+    broken = postgresql.jitSupport;
   };
 })

pkgs/servers/sql/postgresql/ext/postgis.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libxml2 postgresql geos proj gdal json_c protobufc ]
                 ++ lib.optional stdenv.isDarwin libiconv;
-  nativeBuildInputs = [ perl pkg-config ];
+  nativeBuildInputs = [ perl pkg-config ] ++ lib.optional postgresql.jitSupport postgresql.llvm;
   dontDisableStatic = true;
 
   # postgis config directory assumes /include /lib from the same root for json-c library

pkgs/shells/zsh/default.nix

@@ -71,7 +71,7 @@ if test -e /etc/NIXOS; then
   else
     emulate bash
     alias shopt=false
-    if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ]; then
+    if [ -z "\$__NIXOS_SET_ENVIRONMENT_DONE" ]; then
       . /etc/set-environment
     fi
     unalias shopt

pkgs/tools/bluetooth/obex-data-server/default.nix

@@ -9,7 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "0kq940wqs9j8qjnl58d6l3zhx0jaszci356xprx23l6nvdfld6dk";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  strictDeps = true;
+  nativeBuildInputs = [
+    pkg-config
+    dbus-glib # required for dbus-binding-tool
+  ];
   buildInputs = [ libusb-compat-0_1 glib dbus-glib bluez openobex dbus ];
 
   patches = [ ./obex-data-server-0.4.6-build-fixes-1.patch ];

pkgs/tools/graphics/netpbm/default.nix

@@ -20,14 +20,14 @@ stdenv.mkDerivation {
   # Determine version and revision from:
   # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
   pname = "netpbm";
-  version = "11.1.0";
+  version = "11.2.0";
 
   outputs = [ "bin" "out" "dev" ];
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "4489";
-    sha256 = "00qagNgNZ+9sedBme0WmJfedF4WST8EFeqUJ5Wx3yEQ=";
+    rev = "4539";
+    sha256 = "LIcB8EBMGTiFw5hrvWZPxr8Zol6WUH/1I7kVohbo4eA=";
   };
 
   nativeBuildInputs = [

pkgs/tools/package-management/zkg/default.nix

@@ -0,0 +1,42 @@
+{ lib
+, python3
+, fetchFromGitHub
+, pkgs
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "zkg";
+  version = "2.13.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "zeek";
+    repo = "package-manager";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kQFm8VlbvJ791Ll8b0iu6xqaxhYTf41jTmvGxLgIzuE=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    btest
+    gitpython
+    semantic-version
+    sphinx
+    sphinx-rtd-theme
+    pkgs.bash
+  ];
+
+  # No tests available
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "zeekpkg"
+  ];
+
+  meta = with lib; {
+    description = "Package manager for Zeek";
+    homepage = "https://github.com/zeek/package-manager";
+    changelog = "https://github.com/zeek/package-manager/blob/${version}/CHANGES";
+    license = licenses.ncsa;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/tools/security/dalfox/default.nix

@@ -5,20 +5,24 @@
 
 buildGoModule rec {
   pname = "dalfox";
-  version = "2.8.2";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-+RCjudjbvc793sE2GCV/l23JD7ZqjNWhi7ZjUaCvTzw=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-AG5CNqkxPQJQ+HN3JGUIgSYxgFigmUqVGn1yAHmo7Mo=";
   };
 
-  vendorSha256 = "sha256-pLhTwbcMIqm7nrzypMs6yVrqtdCAoPrabTXsUtJ6Zls=";
+  vendorSha256 = "sha256-OLT85GOcTnWmU+ZRem2+vY29nzvzXhnmIN2W+U6phPk=";
+
+  # Tests require network access
+  doCheck = false;
 
   meta = with lib; {
     description = "Tool for analysing parameter and XSS scanning";
     homepage = "https://github.com/hahwul/dalfox";
+    changelog = "https://github.com/hahwul/dalfox/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

pkgs/tools/security/dontgo403/default.nix

@@ -5,20 +5,21 @@
 
 buildGoModule rec {
   pname = "dontgo403";
-  version = "0.5";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "devploit";
     repo = pname;
-    rev = version;
-    hash = "sha256-aVPmS4qIa9v7jnK1YG9EUV81frhu3/0x3zY7akPkpeg=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Gpr2L7iSdMBqwMzdYDtdzyZYu+Uwjn1wZvw4LTr8xWI=";
   };
 
-  vendorSha256 = "sha256-jF+CSmLHMdlFpttYf3pK84wdfFAHSVPAK8S5zunUzB0=";
+  vendorHash = "sha256-he/+M8NffvMLTdFQy5E2EnqLXkS/tK6eUGXTBKZSZCw=";
 
   meta = with lib; {
     description = "Tool to bypass 40X response codes";
     homepage = "https://github.com/devploit/dontgo403";
+    changelog = "https://github.com/devploit/dontgo403/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };

pkgs/tools/security/grype/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.59.1";
+  version = "0.60.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-6NQRmgbV/if0S5jYus5R5oFjLz5wwHpJppi/Tyz2FjY=";
+    hash = "sha256-CKaUNv4ymLksZ9zpI8jD4lC0keNNNSpUADSTo3evoIo=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildGoModule rec {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-eCvoTGETtB76ILnYKJ5ybtLbZUBMxX2w2CDczY05L0E=";
+  vendorHash = "sha256-2zZlURnArgHK/zfIxHoWn5W6mfd5T7CbAlSqDnal1Mw=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/tools/system/rocm-smi/default.nix

@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-smi";
-  version = "5.4.3";
+  version = "5.4.4";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";

pkgs/top-level/all-packages.nix

@@ -25471,13 +25471,26 @@ with pkgs;
     postgresql_13
     postgresql_14
     postgresql_15
+
+    postgresql_11_jit
+    postgresql_12_jit
+    postgresql_13_jit
+    postgresql_14_jit
+    postgresql_15_jit
   ;
   postgresql = postgresql_14.override { this = postgresql; };
+  postgresql_jit = postgresql_14_jit.override { this = postgresql_jit; };
   postgresqlPackages = recurseIntoAttrs postgresql.pkgs;
+  postgresqlJitPackages = recurseIntoAttrs postgresql_jit.pkgs;
   postgresql11Packages = recurseIntoAttrs postgresql_11.pkgs;
   postgresql12Packages = recurseIntoAttrs postgresql_12.pkgs;
   postgresql13Packages = recurseIntoAttrs postgresql_13.pkgs;
   postgresql15Packages = recurseIntoAttrs postgresql_15.pkgs;
+  postgresql11JitPackages = recurseIntoAttrs postgresql_11_jit.pkgs;
+  postgresql12JitPackages = recurseIntoAttrs postgresql_12_jit.pkgs;
+  postgresql13JitPackages = recurseIntoAttrs postgresql_13_jit.pkgs;
+  postgresql14JitPackages = recurseIntoAttrs postgresql_14_jit.pkgs;
+  postgresql15JitPackages = recurseIntoAttrs postgresql_15_jit.pkgs;
   postgresql14Packages = postgresqlPackages;
 
   postgresql_jdbc = callPackage ../development/java-modules/postgresql_jdbc { };
@@ -39164,6 +39177,8 @@ with pkgs;
 
   xbps = callPackage ../tools/package-management/xbps { };
 
+  zkg = callPackage ../tools/package-management/zkg { };
+
   xcftools = callPackage ../tools/graphics/xcftools { };
 
   xhyve = callPackage ../applications/virtualization/xhyve {

pkgs/top-level/perl-packages.nix

@@ -5217,11 +5217,11 @@ let
     };
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
     NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
+    OPENSSL_PREFIX = pkgs.openssl;
     buildInputs = [ CryptOpenSSLGuess ];
     meta = {
       description = "OpenSSL/LibreSSL pseudo-random number generator access";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
-      broken = stdenv.isDarwin && stdenv.isAarch64; # errors with: 74366 Abort trap: 6
     };
   };
 
@@ -5235,6 +5235,7 @@ let
     propagatedBuildInputs = [ CryptOpenSSLRandom ];
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
     NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
+    OPENSSL_PREFIX = pkgs.openssl;
     buildInputs = [ CryptOpenSSLGuess ];
     meta = {
       description = "RSA encoding and decoding, using the openSSL libraries";
@@ -5251,6 +5252,7 @@ let
     };
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
     NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
+    OPENSSL_PREFIX = pkgs.openssl;
     buildInputs = [ CryptOpenSSLGuess ];
     propagatedBuildInputs = [ ConvertASN1 ];
     meta = {

pkgs/top-level/python-packages.nix

@@ -1477,6 +1477,8 @@ self: super: with self; {
 
   btchip-python = callPackage ../development/python-modules/btchip-python { };
 
+  btest = callPackage ../development/python-modules/btest { };
+
   bthome-ble = callPackage ../development/python-modules/bthome-ble { };
 
   bt-proximity = callPackage ../development/python-modules/bt-proximity { };