Merge master into haskell-updates

2023-09-10 00:12:33 +00:00 · 2023-09-10 00:12:33 +00:00 · 864aa20266
commit 864aa20266
parent 01eec38f90 2b1eb11946
216 changed files with 8122 additions and 6930 deletions
--- a/doc/hooks/zig.section.md
+++ b/doc/hooks/zig.section.md
@ -29,31 +29,35 @@ stdenv.mkDerivation {

 ## Variables controlling zig.hook {#variables-controlling-zig-hook}

-### `dontUseZigBuild` {#dontUseZigBuild}
+### `zig.hook` Exclusive Variables {#zigHookExclusiveVariables}
+
+The variables below are exclusive to `zig.hook`.
+
+#### `dontUseZigBuild` {#dontUseZigBuild}

 Disables using `zigBuildPhase`.

-### `zigBuildFlags` {#zigBuildFlags}
-
-Controls the flags passed to the build phase.
-
-### `dontUseZigCheck` {#dontUseZigCheck}
+#### `dontUseZigCheck` {#dontUseZigCheck}

 Disables using `zigCheckPhase`.

-### `zigCheckFlags` {#zigCheckFlags}
-
-Controls the flags passed to the check phase.
-
-### `dontUseZigInstall` {#dontUseZigInstall}
+#### `dontUseZigInstall` {#dontUseZigInstall}

 Disables using `zigInstallPhase`.

-### `zigInstallFlags` {#zigInstallFlags}
+### Similar variables {#similarVariables}

-Controls the flags passed to the install phase.
+The following variables are similar to their `stdenv.mkDerivation` counterparts.
+
+| `zig.hook` Variable | `stdenv.mkDerivation` Counterpart |
+|---------------------|-----------------------------------|
+| `zigBuildFlags`     | `buildFlags`                      |
+| `zigCheckFlags`     | `checkFlags`                      |
+| `zigInstallFlags`   | `installFlags`                    |

 ### Variables honored by zig.hook {#variables-honored-by-zig-hook}

+The following variables commonly used by `stdenv.mkDerivation` are honored by `zig.hook`.
+
 - `prefixKey`
 - `dontAddPrefix`
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@ -313,6 +313,11 @@ rec {
    libc = "msvcrt"; # This distinguishes the mingw (non posix) toolchain
  };

+  ucrt64 = {
+    config = "x86_64-w64-mingw32";
+    libc = "ucrt"; # This distinguishes the mingw (non posix) toolchain
+  };
+
  # BSDs

  x86_64-freebsd = {
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4651,6 +4651,16 @@
      fingerprint = "5DD7 C6F6 0630 F08E DAE7  4711 1525 585D 1B43 C62A";
    }];
  };
+  dunxen = {
+    email = "git@dunxen.dev";
+    matrix = "@dunxen:x0f.org";
+    github = "dunxen";
+    githubId = 3072149;
+    name = "Duncan Dean";
+    keys = [{
+      fingerprint = "9484 44FC E03B 05BA 5AB0  591E C37B 1C1D 44C7 86EE";
+    }];
+  };
  dwarfmaster = {
    email = "nixpkgs@dwarfmaster.net";
    github = "dwarfmaster";
@ -8560,6 +8570,12 @@
    name = "John Soo";
    githubId = 10039785;
  };
+  jsusk = {
+    email = "joshua@suskalo.org";
+    github = "IGJoshua";
+    name = "Joshua Suskalo";
+    githubId = 27734541;
+  };
  jtbx = {
    email = "jtbx@duck.com";
    name = "Jeremy Baxter";
@ -9392,6 +9408,12 @@
    name = "Tomas Krupka";
    matrix = "@krupkat:matrix.org";
  };
+  krzaczek = {
+    name = "Pawel Krzaczkowski";
+    email = "pawel@printu.pl";
+    github = "krzaczek";
+    githubId = 5773701;
+  };
  ktf = {
    email = "giulio.eulisse@cern.ch";
    github = "ktf";
@ -10820,7 +10842,7 @@
    }];
  };
  max-amb = {
-    email = "maxpeterambaum@gmail.com";
+    email = "max_a@e.email";
    github = "max-amb";
    githubId = 137820334;
    name = "Max Ambaum";
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -231,6 +231,8 @@ The module update takes care of the new config syntax and the data itself (user

 - `services.nginx` gained a `defaultListen` option at server-level with support for PROXY protocol listeners, also `proxyProtocol` is now exposed in `services.nginx.virtualHosts.<name>.listen` option. It is now possible to run PROXY listeners and non-PROXY listeners at a server-level, see [#213510](https://github.com/NixOS/nixpkgs/pull/213510/) for more details.

+- `services.restic.backups` now adds wrapper scripts to your system path, which set the same environment variables as the service, so restic operations can easly be run from the command line. This behavior can be disabled by setting `createWrapper` to `false`, per backup configuration.
+
 - `services.prometheus.exporters` has a new exporter to monitor electrical power consumption based on PowercapRAPL sensor called [Scaphandre](https://github.com/hubblo-org/scaphandre), see [#239803](https://github.com/NixOS/nixpkgs/pull/239803) for more details.

 - The MariaDB C client library was upgraded from 3.2.x to 3.3.x. It is recomended to review the [upstream release notes](https://mariadb.com/kb/en/mariadb-connector-c-33-release-notes/).
@ -259,6 +261,8 @@ The module update takes care of the new config syntax and the data itself (user

 - The `cawbird` package is dropped from nixpkgs, as it got broken by the Twitter API closing down and has been abandoned upstream.

+- Certificate generation via the `security.acme` now limits the concurrent number of running certificate renewals and generation jobs, to avoid spiking resource usage when processing many certificates at once. The limit defaults to *5* and can be adjusted via `maxConcurrentRenewals`. Setting it to *0* disables the limits altogether.
+
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}

 - The use of `sourceRoot = "source";`, `sourceRoot = "source/subdir";`, and similar lines in package derivations using the default `unpackPhase` is deprecated as it requires `unpackPhase` to always produce a directory named "source". Use `sourceRoot = src.name`, `sourceRoot = "${src.name}/subdir";`, or `setSourceRoot = "sourceRoot=$(echo */subdir)";` or similar instead.
--- a/nixos/modules/hardware/decklink.nix
+++ b/nixos/modules/hardware/decklink.nix
@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.hardware.decklink;
+  kernelPackages = config.boot.kernelPackages;
+in
+{
+  options.hardware.decklink.enable = lib.mkEnableOption "hardware support for the Blackmagic Design Decklink audio/video interfaces";
+
+  config = lib.mkIf cfg.enable {
+    boot.kernelModules = [ "blackmagic" "blackmagic-io" "snd_blackmagic-io" ];
+    boot.extraModulePackages = [ kernelPackages.decklink ];
+    systemd.packages = [ pkgs.blackmagic-desktop-video ];
+    systemd.services.DesktopVideoHelper.wantedBy = [ "multi-user.target" ];
+  };
+}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -55,6 +55,7 @@
  ./hardware/cpu/amd-sev.nix
  ./hardware/cpu/intel-microcode.nix
  ./hardware/cpu/intel-sgx.nix
+  ./hardware/decklink.nix
  ./hardware/device-tree.nix
  ./hardware/digitalbitbox.nix
  ./hardware/flipperzero.nix
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@ -1,6 +1,8 @@
 { config, lib, pkgs, options, ... }:
 with lib;
 let
+
+
  cfg = config.security.acme;
  opt = options.security.acme;
  user = if cfg.useRoot then "root" else "acme";
@ -14,6 +16,36 @@ let
  mkAccountHash = acmeServer: data: mkHash "${toString acmeServer} ${data.keyType} ${data.email}";
  accountDirRoot = "/var/lib/acme/.lego/accounts/";

+  lockdir = "/run/acme/";
+  concurrencyLockfiles = map (n: "${toString n}.lock") (lib.range 1 cfg.maxConcurrentRenewals);
+  # Assign elements of `baseList` to each element of `needAssignmentList`, until the latter is exhausted.
+  # returns: [{fst = "element of baseList"; snd = "element of needAssignmentList"}]
+  roundRobinAssign = baseList: needAssignmentList:
+    if baseList == [] then []
+    else _rrCycler baseList baseList needAssignmentList;
+  _rrCycler = with builtins; origBaseList: workingBaseList: needAssignmentList:
+    if (workingBaseList == [] || needAssignmentList == [])
+    then []
+    else
+      [{ fst = head workingBaseList; snd = head needAssignmentList;}] ++
+      _rrCycler origBaseList (if (tail workingBaseList == []) then origBaseList else tail workingBaseList) (tail needAssignmentList);
+  attrsToList = mapAttrsToList (attrname: attrval: {name = attrname; value = attrval;});
+  # for an AttrSet `funcsAttrs` having functions as values, apply single arguments from
+  # `argsList` to them in a round-robin manner.
+  # Returns an attribute set with the applied functions as values.
+  roundRobinApplyAttrs = funcsAttrs: argsList: lib.listToAttrs (map (x: {inherit (x.snd) name; value = x.snd.value x.fst;}) (roundRobinAssign argsList (attrsToList funcsAttrs)));
+  wrapInFlock = lockfilePath: script:
+    # explainer: https://stackoverflow.com/a/60896531
+    ''
+      exec {LOCKFD}> ${lockfilePath}
+      echo "Waiting to acquire lock ${lockfilePath}"
+      ${pkgs.flock}/bin/flock ''${LOCKFD} || exit 1
+      echo "Acquired lock ${lockfilePath}"
+    ''
+    + script + "\n"
+    + ''echo "Releasing lock ${lockfilePath}"  # only released after process exit'';
+
+
  # There are many services required to make cert renewals work.
  # They all follow a common structure:
  #   - They inherit this commonServiceConfig
@ -31,6 +63,7 @@ let
    ProtectSystem = "strict";
    ReadWritePaths = [
      "/var/lib/acme"
+      lockdir
    ];
    PrivateTmp = true;

@ -118,7 +151,8 @@ let
      # We don't want this to run every time a renewal happens
      RemainAfterExit = true;

-      # These StateDirectory entries negate the need for tmpfiles
+      # StateDirectory entries are a cleaner, service-level mechanism
+      # for dealing with persistent service data
      StateDirectory = [ "acme" "acme/.lego" "acme/.lego/accounts" ];
      StateDirectoryMode = 755;
      WorkingDirectory = "/var/lib/acme";
@ -127,6 +161,25 @@ let
      ExecStart = "+" + (pkgs.writeShellScript "acme-fixperms" script);
    };
  };
+  lockfilePrepareService = {
+    description = "Manage lock files for acme services";
+
+    # ensure all required lock files exist, but none more
+    script = ''
+      GLOBIGNORE="${concatStringsSep ":" concurrencyLockfiles}"
+      rm -f *
+      unset GLOBIGNORE
+
+      xargs touch <<< "${toString concurrencyLockfiles}"
+    '';
+
+    serviceConfig = commonServiceConfig // {
+      # We don't want this to run every time a renewal happens
+      RemainAfterExit = true;
+      WorkingDirectory = lockdir;
+    };
+  };
+

  certToConfig = cert: data: let
    acmeServer = data.server;
@ -229,10 +282,10 @@ let
      };
    };

-    selfsignService = {
+    selfsignService = lockfileName: {
      description = "Generate self-signed certificate for ${cert}";
-      after = [ "acme-selfsigned-ca.service" "acme-fixperms.service" ];
-      requires = [ "acme-selfsigned-ca.service" "acme-fixperms.service" ];
+      after = [ "acme-selfsigned-ca.service" "acme-fixperms.service" ] ++ optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";
+      requires = [ "acme-selfsigned-ca.service" "acme-fixperms.service" ] ++ optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";

      path = with pkgs; [ minica ];

@ -256,7 +309,7 @@ let
      # Working directory will be /tmp
      # minica will output to a folder sharing the name of the first domain
      # in the list, which will be ${data.domain}
-      script = ''
+      script = (if (lockfileName == null) then lib.id else wrapInFlock "${lockdir}${lockfileName}") ''
        minica \
          --ca-key ca/key.pem \
          --ca-cert ca/cert.pem \
@ -277,10 +330,10 @@ let
      '';
    };

-    renewService = {
+    renewService = lockfileName: {
      description = "Renew ACME certificate for ${cert}";
-      after = [ "network.target" "network-online.target" "acme-fixperms.service" "nss-lookup.target" ] ++ selfsignedDeps;
-      wants = [ "network-online.target" "acme-fixperms.service" ] ++ selfsignedDeps;
+      after = [ "network.target" "network-online.target" "acme-fixperms.service" "nss-lookup.target" ] ++ selfsignedDeps ++ optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";
+      wants = [ "network-online.target" "acme-fixperms.service" ] ++ selfsignedDeps ++ optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";

      # https://github.com/NixOS/nixpkgs/pull/81371#issuecomment-605526099
      wantedBy = optionals (!config.boot.isContainer) [ "multi-user.target" ];
@ -329,7 +382,7 @@ let
      };

      # Working directory will be /tmp
-      script = ''
+      script = (if (lockfileName == null) then lib.id else wrapInFlock "${lockdir}${lockfileName}") ''
        ${optionalString data.enableDebugLogs "set -x"}
        set -euo pipefail

@ -755,6 +808,17 @@ in {
          }
        '';
      };
+      maxConcurrentRenewals = mkOption {
+        default = 5;
+        type = types.int;
+        description = lib.mdDoc ''
+          Maximum number of concurrent certificate generation or renewal jobs. All other
+          jobs will queue and wait running jobs to finish. Reduces the system load of
+          certificate generation.
+
+          Set to `0` to allow unlimited number of concurrent job runs."
+          '';
+      };
    };
  };

@ -875,12 +939,28 @@ in {

      users.groups.acme = {};

-      systemd.services = {
-        "acme-fixperms" = userMigrationService;
-      } // (mapAttrs' (cert: conf: nameValuePair "acme-${cert}" conf.renewService) certConfigs)
+      # for lock files, still use tmpfiles as they should better reside in /run
+      systemd.tmpfiles.rules = [
+        "d ${lockdir} 0700 ${user} - - -"
+        "Z ${lockdir} 0700 ${user} - - -"
+      ];
+
+      systemd.services = let
+        renewServiceFunctions = mapAttrs' (cert: conf: nameValuePair "acme-${cert}" conf.renewService) certConfigs;
+        renewServices =  if cfg.maxConcurrentRenewals > 0
+          then roundRobinApplyAttrs renewServiceFunctions concurrencyLockfiles
+          else mapAttrs (_: f: f null) renewServiceFunctions;
+        selfsignServiceFunctions = mapAttrs' (cert: conf: nameValuePair "acme-selfsigned-${cert}" conf.selfsignService) certConfigs;
+        selfsignServices = if cfg.maxConcurrentRenewals > 0
+          then roundRobinApplyAttrs selfsignServiceFunctions concurrencyLockfiles
+          else mapAttrs (_: f: f null) selfsignServiceFunctions;
+        in
+        { "acme-fixperms" = userMigrationService; }
+        // (optionalAttrs (cfg.maxConcurrentRenewals > 0) {"acme-lockfiles" = lockfilePrepareService; })
+        // renewServices
        // (optionalAttrs (cfg.preliminarySelfsigned) ({
        "acme-selfsigned-ca" = selfsignCAService;
-      } // (mapAttrs' (cert: conf: nameValuePair "acme-selfsigned-${cert}" conf.selfsignService) certConfigs)));
+      } // selfsignServices));

      systemd.timers = mapAttrs' (cert: conf: nameValuePair "acme-${cert}" conf.renewTimer) certConfigs;

--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@ -260,6 +260,16 @@ in
            Restic package to use.
          '';
        };
+
+        createWrapper = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = ''
+            Whether to generate and add a script to the system path, that has the same environment variables set
+            as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
+            having to manually specify most options.
+          '';
+        };
      };
    }));
    default = { };
@ -316,7 +326,8 @@ in
          in
          nameValuePair "restic-backups-${name}" ({
            environment = {
-              RESTIC_CACHE_DIR = "%C/restic-backups-${name}";
+              # not %C, because that wouldn't work in the wrapper script
+              RESTIC_CACHE_DIR = "/var/cache/restic-backups-${name}";
              RESTIC_PASSWORD_FILE = backup.passwordFile;
              RESTIC_REPOSITORY = backup.repository;
              RESTIC_REPOSITORY_FILE = backup.repositoryFile;
@ -331,7 +342,7 @@ in
                nameValuePair (rcloneAttrToConf name) (toRcloneVal value)
              )
              backup.rcloneConfig);
-            path = [ pkgs.openssh ];
+            path = [ config.programs.ssh.package ];
            restartIfChanged = false;
            wants = [ "network-online.target" ];
            after = [ "network-online.target" ];
@ -378,5 +389,22 @@ in
          timerConfig = backup.timerConfig;
        })
        config.services.restic.backups;
+
+    # generate wrapper scripts, as described in the createWrapper option
+    environment.systemPackages = lib.mapAttrsToList (name: backup: let
+      extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
+      resticCmd = "${backup.package}/bin/restic${extraOptions}";
+    in pkgs.writeShellScriptBin "restic-${name}" ''
+      set -a  # automatically export variables
+      ${lib.optionalString (backup.environmentFile != null) "source ${backup.environmentFile}"}
+      # set same environment variables as the systemd service
+      ${lib.pipe config.systemd.services."restic-backups-${name}".environment [
+        (lib.filterAttrs (_: v: v != null))
+        (lib.mapAttrsToList (n: v: "${n}=${v}"))
+        (lib.concatStringsSep "\n")
+      ]}
+
+      exec ${resticCmd} $@
+    '') (lib.filterAttrs (_: v: v.createWrapper) config.services.restic.backups);
  };
 }
--- a/nixos/modules/services/continuous-integration/buildbot/master.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/master.nix
@ -272,7 +272,13 @@ in {
        Group = cfg.group;
        WorkingDirectory = cfg.home;
        # NOTE: call twistd directly with stdout logging for systemd
-        ExecStart = "${python.pkgs.twisted}/bin/twistd -o --nodaemon --pidfile= --logfile - --python ${tacFile}";
+        ExecStart = "${python.pkgs.twisted}/bin/twistd -o --nodaemon --pidfile= --logfile - --python ${cfg.buildbotDir}/buildbot.tac";
+        # To reload on upgrade, set the following in your configuration:
+        # systemd.services.buildbot-master.reloadIfChanged = true;
+        ExecReload = [
+          "${pkgs.coreutils}/bin/ln -sf ${tacFile} ${cfg.buildbotDir}/buildbot.tac"
+          "${pkgs.coreutils}/bin/kill -HUP $MAINPID"
+        ];
      };
    };
  };
--- a/nixos/modules/services/continuous-integration/woodpecker/agents.nix
+++ b/nixos/modules/services/continuous-integration/woodpecker/agents.nix
@ -35,6 +35,16 @@ let
        '';
      };

+      path = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        example = [ "" ];
+        description = lib.mdDoc ''
+          Additional packages that should be added to the agent's `PATH`.
+          Mostly useful for the `local` backend.
+        '';
+      };
+
      environmentFile = lib.mkOption {
        type = lib.types.listOf lib.types.path;
        default = [ ];
@ -94,7 +104,7 @@ let
          "-/etc/localtime"
        ];
      };
-      inherit (agentCfg) environment;
+      inherit (agentCfg) environment path;
    };
  };
 in
@ -106,28 +116,41 @@ in
      agents = lib.mkOption {
        default = { };
        type = lib.types.attrsOf agentModule;
-        example = {
-          docker = {
-            environment = {
-              WOODPECKER_SERVER = "localhost:9000";
-              WOODPECKER_BACKEND = "docker";
-              DOCKER_HOST = "unix:///run/podman/podman.sock";
+        example = lib.literalExpression ''
+          {
+            podman = {
+              environment = {
+                WOODPECKER_SERVER = "localhost:9000";
+                WOODPECKER_BACKEND = "docker";
+                DOCKER_HOST = "unix:///run/podman/podman.sock";
+              };
+
+              extraGroups = [ "podman" ];
+
+              environmentFile = [ "/run/secrets/woodpecker/agent-secret.txt" ];
            };

-            extraGroups = [ "docker" ];
+            exec = {
+              environment = {
+                WOODPECKER_SERVER = "localhost:9000";
+                WOODPECKER_BACKEND = "local";
+              };

-            environmentFile = "/run/secrets/woodpecker/agent-secret.txt";
-          };
+              environmentFile = [ "/run/secrets/woodpecker/agent-secret.txt" ];

-          exec = {
-            environment = {
-              WOODPECKER_SERVER = "localhost:9000";
-              WOODPECKER_BACKEND = "exec";
+              path = [
+                # Needed to clone repos
+                git
+                git-lfs
+                woodpecker-plugin-git
+                # Used by the runner as the default shell
+                bash
+                # Most likely to be used in pipeline definitions
+                coreutils
+              ];
            };
-
-            environmentFile = "/run/secrets/woodpecker/agent-secret.txt";
-          };
-        };
+          }
+        '';
        description = lib.mdDoc "woodpecker-agents configurations";
      };
    };
--- a/nixos/modules/services/home-automation/zigbee2mqtt.nix
+++ b/nixos/modules/services/home-automation/zigbee2mqtt.nix
@ -66,9 +66,10 @@ in
        server = mkDefault "mqtt://localhost:1883";
      };
      serial.port = mkDefault "/dev/ttyACM0";
-      # reference device configuration, that is kept in a separate file
+      # reference device/group configuration, that is kept in a separate file
      # to prevent it being overwritten in the units ExecStartPre script
      devices = mkDefault "devices.yaml";
+      groups = mkDefault "groups.yaml";
    };

    systemd.services.zigbee2mqtt = {
--- a/nixos/modules/services/logging/logrotate.nix
+++ b/nixos/modules/services/logging/logrotate.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:

 with lib;

@ -220,6 +220,12 @@ in
          in this case you can disable the failing check with this option.
        '';
      };
+
+      extraArgs = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [];
+        description = "Additional command line arguments to pass on logrotate invocation";
+      };
    };
  };

@ -231,7 +237,7 @@ in
      serviceConfig = {
        Restart = "no";
        User = "root";
-        ExecStart = "${pkgs.logrotate}/sbin/logrotate ${mailOption} ${cfg.configFile}";
+        ExecStart = "${pkgs.logrotate}/sbin/logrotate ${utils.escapeSystemdExecArgs cfg.extraArgs} ${mailOption} ${cfg.configFile}";
      };
    };
    systemd.services.logrotate-checkconf = {
@ -240,7 +246,7 @@ in
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
-        ExecStart = "${pkgs.logrotate}/sbin/logrotate --debug ${cfg.configFile}";
+        ExecStart = "${pkgs.logrotate}/sbin/logrotate ${utils.escapeSystemdExecArgs cfg.extraArgs} --debug ${cfg.configFile}";
      };
    };
  };
--- a/nixos/modules/services/mail/listmonk.nix
+++ b/nixos/modules/services/mail/listmonk.nix
@ -54,7 +54,7 @@ let

      smtp = mkOption {
        type = listOf (submodule {
-          freeformType = with types; attrsOf (oneOf [ str int bool ]);
+          freeformType = with types; attrsOf anything;

          options = {
            enabled = mkEnableOption (lib.mdDoc "this SMTP server for listmonk");
@ -86,7 +86,7 @@ let
      # TODO: refine this type based on the smtp one.
      "bounce.mailboxes" = mkOption {
        type = listOf
-          (submodule { freeformType = with types; oneOf [ str int bool ]; });
+          (submodule { freeformType = with types; listOf (attrsOf anything); });
        default = [ ];
        description = lib.mdDoc "List of bounce mailboxes";
      };
--- a/nixos/modules/services/misc/cfdyndns.nix
+++ b/nixos/modules/services/misc/cfdyndns.nix
@ -23,6 +23,15 @@ in
        '';
      };

+      apiTokenFile = mkOption {
+        default = null;
+        type = types.nullOr types.str;
+        description = lib.mdDoc ''
+          The path to a file containing the API Token
+          used to authenticate with CloudFlare.
+        '';
+      };
+
      apikeyFile = mkOption {
        default = null;
        type = types.nullOr types.str;
@ -55,12 +64,15 @@ in
        Group = config.ids.gids.cfdyndns;
      };
      environment = {
-        CLOUDFLARE_EMAIL="${cfg.email}";
        CLOUDFLARE_RECORDS="${concatStringsSep "," cfg.records}";
      };
      script = ''
        ${optionalString (cfg.apikeyFile != null) ''
          export CLOUDFLARE_APIKEY="$(cat ${escapeShellArg cfg.apikeyFile})"
+          export CLOUDFLARE_EMAIL="${cfg.email}"
+        ''}
+        ${optionalString (cfg.apiTokenFile != null) ''
+          export CLOUDFLARE_APITOKEN="$(cat ${escapeShellArg cfg.apiTokenFile})"
        ''}
        ${pkgs.cfdyndns}/bin/cfdyndns
      '';
--- a/nixos/modules/services/networking/wstunnel.nix
+++ b/nixos/modules/services/networking/wstunnel.nix
@ -86,12 +86,12 @@ let
        description = mdDoc "Address and port to listen on. Setting the port to a value below 1024 will also give the process the required `CAP_NET_BIND_SERVICE` capability.";
        type = types.submodule hostPortSubmodule;
        default = {
-          address = "0.0.0.0";
+          host = "0.0.0.0";
          port = if config.enableHTTPS then 443 else 80;
        };
        defaultText = literalExpression ''
          {
-            address = "0.0.0.0";
+            host = "0.0.0.0";
            port = if enableHTTPS then 443 else 80;
          }
        '';
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@ -595,47 +595,9 @@ let
      tt-rss = {
        description = "Tiny Tiny RSS feeds update daemon";

-        preStart = let
-          callSql = e:
-              if cfg.database.type == "pgsql" then ''
-                  ${optionalString (cfg.database.password != null) "PGPASSWORD=${cfg.database.password}"} \
-                  ${optionalString (cfg.database.passwordFile != null) "PGPASSWORD=$(cat ${cfg.database.passwordFile})"} \
-                  ${config.services.postgresql.package}/bin/psql \
-                    -U ${cfg.database.user} \
-                    ${optionalString (cfg.database.host != null) "-h ${cfg.database.host} --port ${toString dbPort}"} \
-                    -c '${e}' \
-                    ${cfg.database.name}''
-
-              else if cfg.database.type == "mysql" then ''
-                  echo '${e}' | ${config.services.mysql.package}/bin/mysql \
-                    -u ${cfg.database.user} \
-                    ${optionalString (cfg.database.password != null) "-p${cfg.database.password}"} \
-                    ${optionalString (cfg.database.host != null) "-h ${cfg.database.host} -P ${toString dbPort}"} \
-                    ${cfg.database.name}''
-
-              else "";
-
-        in (optionalString (cfg.database.type == "pgsql") ''
-          exists=$(${callSql "select count(*) > 0 from pg_tables where tableowner = user"} \
-          | tail -n+3 | head -n-2 | sed -e 's/[ \n\t]*//')
-
-          if [ "$exists" == 'f' ]; then
-            ${callSql "\\i ${pkgs.tt-rss}/schema/ttrss_schema_${cfg.database.type}.sql"}
-          else
-            echo 'The database contains some data. Leaving it as it is.'
-          fi;
-        '')
-
-        + (optionalString (cfg.database.type == "mysql") ''
-          exists=$(${callSql "select count(*) > 0 from information_schema.tables where table_schema = schema()"} \
-          | tail -n+2 | sed -e 's/[ \n\t]*//')
-
-          if [ "$exists" == '0' ]; then
-            ${callSql "\\. ${pkgs.tt-rss}/schema/ttrss_schema_${cfg.database.type}.sql"}
-          else
-            echo 'The database contains some data. Leaving it as it is.'
-          fi;
-        '');
+        preStart = ''
+          ${pkgs.php81}/bin/php ${cfg.root}/www/update.php --update-schema
+        '';

        serviceConfig = {
          User = "${cfg.user}";
--- a/nixos/modules/system/boot/binfmt.nix
+++ b/nixos/modules/system/boot/binfmt.nix
@ -279,7 +279,7 @@ in {
          support your new systems.
          Warning: the builder can execute all emulated systems within the same build, which introduces impurities in the case of cross compilation.
        '';
-        type = types.listOf types.str;
+        type = types.listOf (types.enum (builtins.attrNames magics));
      };
    };
  };
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -2812,9 +2812,16 @@ let

      environment.etc."systemd/networkd.conf" = renderConfig cfg.config;

-      systemd.services.systemd-networkd = {
+      systemd.services.systemd-networkd = let
+        isReloadableUnitFileName = unitFileName: strings.hasSuffix ".network" unitFileName;
+        partitionedUnitFiles = lib.partition isReloadableUnitFileName unitFiles;
+        reloadableUnitFiles = partitionedUnitFiles.right;
+        nonReloadableUnitFiles = partitionedUnitFiles.wrong;
+        unitFileSources = unitFiles: map (x: x.source) (attrValues unitFiles);
+      in {
        wantedBy = [ "multi-user.target" ];
-        restartTriggers = map (x: x.source) (attrValues unitFiles) ++ [
+        reloadTriggers = unitFileSources reloadableUnitFiles;
+        restartTriggers = unitFileSources nonReloadableUnitFiles ++ [
          config.environment.etc."systemd/networkd.conf".source
        ];
        aliases = [ "dbus-org.freedesktop.network1.service" ];
--- a/nixos/modules/system/boot/stage-2-init.sh
+++ b/nixos/modules/system/boot/stage-2-init.sh
@ -105,7 +105,7 @@ fi

 # Required by the activation script
 install -m 0755 -d /etc
-if [ -d "/etc/nixos" ]; then
+if [ ! -h "/etc/nixos" ]; then
    install -m 0755 -d /etc/nixos
 fi
 install -m 01777 -d /tmp
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@ -266,6 +266,37 @@ in {
          }
        ];

+        concurrency-limit.configuration = {pkgs, ...}: lib.mkMerge [
+          webserverBasicConfig {
+            security.acme.maxConcurrentRenewals = 1;
+
+            services.nginx.virtualHosts = {
+              "f.example.test" = vhostBase // {
+                enableACME = true;
+              };
+              "g.example.test" = vhostBase // {
+                enableACME = true;
+              };
+              "h.example.test" = vhostBase // {
+                enableACME = true;
+              };
+            };
+
+            systemd.services = {
+              # check for mutual exclusion of starting renew services
+              "acme-f.example.test".serviceConfig.ExecPreStart = "+" + (pkgs.writeShellScript "test-f" ''
+                test "$(systemctl is-active acme-{g,h}.example.test.service | grep activating | wc -l)" -le 0
+                '');
+              "acme-g.example.test".serviceConfig.ExecPreStart = "+" + (pkgs.writeShellScript "test-g" ''
+                test "$(systemctl is-active acme-{f,h}.example.test.service | grep activating | wc -l)" -le 0
+                '');
+              "acme-h.example.test".serviceConfig.ExecPreStart = "+" + (pkgs.writeShellScript "test-h" ''
+                test "$(systemctl is-active acme-{g,f}.example.test.service | grep activating | wc -l)" -le 0
+                '');
+              };
+          }
+        ];
+
        # Test lego internal server (listenHTTP option)
        # Also tests useRoot option
        lego-server.configuration = { ... }: {
@ -297,7 +328,7 @@ in {

          services.caddy = {
            enable = true;
-            virtualHosts."a.exmaple.test" = {
+            virtualHosts."a.example.test" = {
              useACMEHost = "example.test";
              extraConfig = ''
                root * ${documentRoot}
@ -591,6 +622,15 @@ in {
          webserver.wait_for_unit("nginx.service")
          check_connection(client, "slow.example.test")

+      with subtest("Can limit concurrency of running renewals"):
+          switch_to(webserver, "concurrency-limit")
+          webserver.wait_for_unit("acme-finished-f.example.test.target")
+          webserver.wait_for_unit("acme-finished-g.example.test.target")
+          webserver.wait_for_unit("acme-finished-h.example.test.target")
+          check_connection(client, "f.example.test")
+          check_connection(client, "g.example.test")
+          check_connection(client, "h.example.test")
+
      with subtest("Works with caddy"):
          switch_to(webserver, "caddy")
          webserver.wait_for_unit("acme-finished-example.test.target")
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -275,7 +275,6 @@ in {
  firefox-beta = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-beta; };
  firefox-devedition = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-devedition; };
  firefox-esr    = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr; }; # used in `tested` job
-  firefox-esr-102 = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr-102; };
  firefox-esr-115 = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr-115; };
  firejail = handleTest ./firejail.nix {};
  firewall = handleTest ./firewall.nix { nftables = false; };
--- a/nixos/tests/restic.nix
+++ b/nixos/tests/restic.nix
@ -97,9 +97,9 @@ import ./make-test-python.nix (
      server.start()
      server.wait_for_unit("dbus.socket")
      server.fail(
-          "${pkgs.restic}/bin/restic -r ${remoteRepository} -p ${passwordFile} snapshots",
-          '${pkgs.restic}/bin/restic -r ${remoteFromFileRepository} -p ${passwordFile} snapshots"',
-          "${pkgs.restic}/bin/restic -r ${rcloneRepository} -p ${passwordFile} snapshots",
+          "restic-remotebackup snapshots",
+          'restic-remote-from-file-backup snapshots"',
+          "restic-rclonebackup snapshots",
          "grep 'backup.* /opt' /root/fake-restic.log",
      )
      server.succeed(
@ -112,20 +112,20 @@ import ./make-test-python.nix (
          "timedatectl set-time '2016-12-13 13:45'",
          "systemctl start restic-backups-remotebackup.service",
          "rm /root/backupCleanupCommand",
-          '${pkgs.restic}/bin/restic -r ${remoteRepository} -p ${passwordFile} snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+          'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',

          # test that restoring that snapshot produces the same directory
          "mkdir /tmp/restore-1",
-          "${pkgs.restic}/bin/restic -r ${remoteRepository} -p ${passwordFile} restore latest -t /tmp/restore-1",
+          "restic-remotebackup restore latest -t /tmp/restore-1",
          "diff -ru ${testDir} /tmp/restore-1/opt",

          # test that remote-from-file-backup produces a snapshot
          "systemctl start restic-backups-remote-from-file-backup.service",
-          '${pkgs.restic}/bin/restic -r ${remoteFromFileRepository} -p ${passwordFile} snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+          'restic-remote-from-file-backup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',

          # test that rclonebackup produces a snapshot
          "systemctl start restic-backups-rclonebackup.service",
-          '${pkgs.restic}/bin/restic -r ${rcloneRepository} -p ${passwordFile} snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+          'restic-rclonebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',

          # test that custompackage runs both `restic backup` and `restic check` with reasonable commandlines
          "systemctl start restic-backups-custompackage.service",
@ -158,12 +158,12 @@ import ./make-test-python.nix (
          "rm /root/backupCleanupCommand",
          "systemctl start restic-backups-rclonebackup.service",

-          '${pkgs.restic}/bin/restic -r ${remoteRepository} -p ${passwordFile} snapshots --json | ${pkgs.jq}/bin/jq "length | . == 4"',
-          '${pkgs.restic}/bin/restic -r ${rcloneRepository} -p ${passwordFile} snapshots --json | ${pkgs.jq}/bin/jq "length | . == 4"',
+          'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 4"',
+          'restic-rclonebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 4"',

          # test that remoteprune brings us back to 1 snapshot in remotebackup
          "systemctl start restic-backups-remoteprune.service",
-          '${pkgs.restic}/bin/restic -r ${remoteRepository} -p ${passwordFile} snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+          'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',

      )
    '';
--- a/nixos/tests/sudo.nix
+++ b/nixos/tests/sudo.nix
@ -5,7 +5,7 @@ let
 in
  import ./make-test-python.nix ({ lib, pkgs, ...} : {
    name = "sudo";
-    meta.maintainers = with lib.maintainers; [ lschuermann ];
+    meta.maintainers = pkgs.sudo.meta.maintainers;

    nodes.machine =
      { lib, ... }:
--- a/pkgs/applications/audio/tageditor/default.nix
+++ b/pkgs/applications/audio/tageditor/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "tageditor";
-  version = "3.8.1";
+  version = "3.9.0";

  src = fetchFromGitHub {
    owner = "martchus";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-7YmjrVh8P3XfnNs2I8PoLigfVvzS0UnuAC67ZQp7WdA=";
+    hash = "sha256-caki8WVnu8ELE2mXwRvT9TTTXCtMZEa0E3KVpHl05jg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/backup/pika-backup/default.nix
+++ b/pkgs/applications/backup/pika-backup/default.nix
@ -21,20 +21,20 @@

 stdenv.mkDerivation rec {
  pname = "pika-backup";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "pika-backup";
    rev = "v${version}";
-    hash = "sha256-7sgAp9/CKKxPr8rWbOot+FPAwaC8EPLa9pjVcC4TjW8=";
+    hash = "sha256-RTeRlfRmA/fXBcdzP41mbs88ArKlbU49AA0lnW3xRlg=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-Va7qLC6WvsLmG9JVmdT1FdIlWP4W/EFmsy7JOagQ+X8=";
+    hash = "sha256-2B0N/Yq9A4LqKh8EKWmzNzTelwGE3Y9FL9IAqAgFSV8=";
  };

  patches = [
--- a/pkgs/applications/blockchains/besu/default.nix
+++ b/pkgs/applications/blockchains/besu/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "besu";
-  version = "23.4.4";
+  version = "23.7.2";

  src = fetchurl {
    url = "https://hyperledger.jfrog.io/artifactory/${pname}-binaries/${pname}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-vUdtI1tv4fI2pivHCfQch962i3LEe7W1jla52Sg68sQ=";
+    sha256 = "sha256-90sywaNDy62QqIqlkna0xe7+pGQ+5UKrorv4mPha4kI=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/finance/denaro/default.nix
+++ b/pkgs/applications/finance/denaro/default.nix
@ -14,13 +14,13 @@

 buildDotnetModule rec {
  pname = "denaro";
-  version = "2023.8.1";
+  version = "2023.9.1";

  src = fetchFromGitHub {
    owner = "NickvisionApps";
    repo = "Denaro";
    rev = version;
-    hash = "sha256-wq5dwSgfmEHy38LPjWOE+J+prjIYy2z4Hezq/45Ddjk=";
+    hash = "sha256-WODAdIKCnDaOWmLir1OfYfAUaULwV8yEFMlfyO/cmfE=";
  };

  dotnet-sdk = dotnetCorePackages.sdk_7_0;
@ -65,7 +65,7 @@ buildDotnetModule rec {
    mainProgram = "NickvisionMoney.GNOME";
    license = licenses.mit;
    changelog = "https://github.com/nlogozzo/NickvisionMoney/releases/tag/${version}";
-    maintainers = with maintainers; [ chuangzhu ];
+    maintainers = with maintainers; [ chuangzhu kashw2 ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/finance/denaro/deps.nix
+++ b/pkgs/applications/finance/denaro/deps.nix
@ -37,7 +37,7 @@
  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "5.0.0"; sha256 = "0z3qyv7qal5irvabc8lmkh58zsl42mrzd1i0sssvzhv4q4kl3cg6"; })
  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; })
-  (fetchNuGet { pname = "Nickvision.Aura"; version = "2023.8.8"; sha256 = "0l8khkg0df26dqra26wl74s73cxidbqw3k5l7jv0579gvkkv9893"; })
+  (fetchNuGet { pname = "Nickvision.Aura"; version = "2023.9.1"; sha256 = "sha256-+6CXO7K/liVUHFPwdBUEUi2r5d5+/cHfoiZ15xURBBg="; })
  (fetchNuGet { pname = "Nickvision.GirExt"; version = "2023.7.3"; sha256 = "1ahf4mld9khk2gaja30zfcjmhclz2l2nims0q4l7jk2nm9p7rzi9"; })
  (fetchNuGet { pname = "OfxSharp.NetStandard"; version = "1.0.0"; sha256 = "1v7yw2glyywb4s0y5fw306bzh2vw175bswrhi5crvd92wf93makj"; })
  (fetchNuGet { pname = "PdfSharpCore"; version = "1.3.56"; sha256 = "0a01b2a14gygh25rq3509rky85331l8808q052br2fzidhb2vc10"; })
--- a/pkgs/applications/graphics/pick-colour-picker/default.nix
+++ b/pkgs/applications/graphics/pick-colour-picker/default.nix
@ -12,18 +12,18 @@

 buildPythonPackage rec {
  pname = "pick-colour-picker";
-  version = "unstable-2021-01-19";
+  version = "unstable-2022-05-08";

  src = fetchFromGitHub {
    owner = "stuartlangridge";
    repo = "ColourPicker";
-    rev = "dec8f144918aa7964aaf86a346161beb7e997f09";
-    sha256 = "hW2rarfchZ3M0JVfz5RbJRvMhv2PpyLNEMyMAp2gC+o=";
-    fetchSubmodules = false;
+    rev = "e3e4c2bcec5d7285425582b92bb564c74be2cf77";
+    hash = "sha256-vW8mZiB3JFQtbOCWauhJGfZMlGsA/nNcljNNPtJtgGw=";
  };

  postPatch = ''
    sed "s|sys\.prefix|'\.'|g" -i setup.py
+    sed "s|os.environ.get(\"SNAP\")|'$out'|g" -i pick/__main__.py
    sed "s|os.environ.get('SNAP'), \"usr\"|'$out'|g" -i pick/__main__.py
  '';

--- a/pkgs/applications/misc/camunda-modeler/default.nix
+++ b/pkgs/applications/misc/camunda-modeler/default.nix
@ -0,0 +1,71 @@
+{ stdenvNoCC
+, lib
+, fetchurl
+, electron
+, makeWrapper
+, makeDesktopItem
+, copyDesktopItems
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "camunda-modeler";
+  version = "5.13.0";
+
+  src = fetchurl {
+    url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
+    hash = "sha256-/9Af/1ZP2Hkc0PP9yXObNDNmxe6riBNWSv+JaM7O5Vs=";
+  };
+  sourceRoot = "camunda-modeler-${version}-linux-x64";
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/${pname}
+    cp -a {locales,resources} $out/share/${pname}
+    install -Dm644 support/mime-types.xml $out/share/mime/packages/${pname}.xml
+
+    for SIZE in 16 48 128; do
+      install -D -m0644 support/icon_''${SIZE}.png "$out/share/icons/hicolor/''${SIZE}x''${SIZE}/apps/${pname}.png"
+    done
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
+      --add-flags $out/share/${pname}/resources/app.asar
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      exec = pname;
+      desktopName = "Camunda Modeler";
+      icon = pname;
+      keywords = [ "bpmn" "cmmn" "dmn" "form" "modeler" "camunda"];
+      genericName = "Process Modeling Tool";
+      comment = meta.description;
+      mimeTypes = [ "application/bpmn" "application/cmmn" "application/dmn" "application/camunda-form" ];
+      extraConfig = {
+        X-Ayatana-Desktop-Shortcuts = "NewWindow;RepositoryBrowser";
+      };
+    })
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/camunda/camunda-modeler";
+    description = "An integrated modeling solution for BPMN, DMN and Forms based on bpmn.io";
+    maintainers = with maintainers; [ n0emis ];
+    license = licenses.mit;
+    inherit (electron.meta) platforms;
+  };
+}
+
--- a/pkgs/applications/misc/gnome-frog/default.nix
+++ b/pkgs/applications/misc/gnome-frog/default.nix
@ -11,6 +11,8 @@
 , desktop-file-utils
 , glib
 , gobject-introspection
+, blueprint-compiler
+, libxml2
 , libnotify
 , libadwaita
 , libportal
@ -18,17 +20,18 @@
 , librsvg
 , tesseract5
 , zbar
+, gst_all_1
 }:

 python3Packages.buildPythonApplication rec {
  pname = "gnome-frog";
-  version = "1.3.0";
+  version = "1.4.2";

  src = fetchFromGitHub {
    owner = "TenderOwl";
    repo = "Frog";
    rev = "refs/tags/${version}";
-    sha256 = "sha256-ErDHrdD9UZxOIGwgN5eakY6vhNvE6D9SoRYXZhzmYX4=";
+    sha256 = "sha256-w/ENUhJt7bYy5htBLolb/HysK8/scRaPQX5qEezQcXY=";
  };

  format = "other";
@ -52,6 +55,8 @@ python3Packages.buildPythonApplication rec {
    glib
    wrapGAppsHook4
    gobject-introspection
+    blueprint-compiler
+    libxml2
  ];

  buildInputs = [
@ -61,6 +66,7 @@ python3Packages.buildPythonApplication rec {
    libportal
    zbar
    tesseract5
+    gst_all_1.gstreamer
  ];

  propagatedBuildInputs = with python3Packages; [
@ -68,6 +74,7 @@ python3Packages.buildPythonApplication rec {
    pillow
    pytesseract
    pyzbar
+    gtts
  ];

  # This is to prevent double-wrapping the package. We'll let
@ -83,6 +90,7 @@ python3Packages.buildPythonApplication rec {
    description =
      "Intuitive text extraction tool (OCR) for GNOME desktop";
    license = licenses.mit;
+    mainProgram = "frog";
    maintainers = with maintainers; [ foo-dogsquared ];
    platforms = platforms.linux;
  };
--- a/pkgs/applications/misc/nwg-look/default.nix
+++ b/pkgs/applications/misc/nwg-look/default.nix
@ -0,0 +1,72 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, substituteAll
+, buildGoModule
+, go
+, glib
+, pkg-config
+, cairo
+, gtk3
+, xcur2png
+, libX11
+, zlib
+}:
+
+buildGoModule rec {
+  pname = "nwg-look";
+  version = "0.2.4";
+
+  src = fetchFromGitHub {
+    owner = "nwg-piotr";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-wUI58qYkVYgES87HQ4octciDlOJ10oJldbUkFgxRUd4=";
+  };
+
+  vendorHash = "sha256-dev+TV6FITd29EfknwHDNI0gLao7gsC95Mg+3qQs93E=";
+
+  # Replace /usr/ directories with the packages output location
+  # This means it references the correct path
+  patches = [ ./fix-paths.patch ];
+
+  postPatch = ''
+    substituteInPlace main.go tools.go --replace '@out@' $out
+  '';
+
+  ldflags = [ "-s" "-w" ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    cairo
+    xcur2png
+    libX11.dev
+    zlib
+    gtk3
+  ];
+
+  CGO_ENABLED = 1;
+
+  postInstall = ''
+    mkdir -p $out/share
+    mkdir -p $out/share/nwg-look/langs
+    mkdir -p $out/share/applications
+    mkdir -p $out/share/pixmaps
+    cp stuff/main.glade $out/share/nwg-look/
+    cp langs/* $out/share/nwg-look/langs
+    cp stuff/nwg-look.desktop $out/share/applications
+    cp stuff/nwg-look.svg $out/share/pixmaps
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/nwg-piotr/nwg-look";
+    description = "Nwg-look is a GTK3 settings editor, designed to work properly in wlroots-based Wayland environment.";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ max-amb ];
+    mainProgram = "nwg-look";
+  };
+}
--- a/pkgs/applications/misc/nwg-look/fix-paths.patch
+++ b/pkgs/applications/misc/nwg-look/fix-paths.patch
@ -0,0 +1,35 @@
+diff --git a/main.go b/main.go
+index 23c4756..c52e9c3 100644
+--- a/main.go
+++ b/main.go
+@@ -335,7 +335,7 @@ func main() {
+
+ 	gtkSettings, _ = gtk.SettingsGetDefault()
+
+-	builder, _ := gtk.BuilderNewFromFile("/usr/share/nwg-look/main.glade")
+	builder, _ := gtk.BuilderNewFromFile("@out@/share/nwg-look/main.glade")
+ 	win, _ := getWindow(builder, "window")
+
+ 	win.Connect("destroy", func() {
+diff --git a/tools.go b/tools.go
+index e6e7665..59d6f35 100644
+--- a/tools.go
+++ b/tools.go
+@@ -1034,7 +1034,7 @@ func getDataDirs() []string {
+ 	if os.Getenv("XDG_DATA_DIRS") != "" {
+ 		xdgDataDirs = os.Getenv("XDG_DATA_DIRS")
+ 	} else {
+-		xdgDataDirs = "/usr/local/share/:/usr/share/"
+		xdgDataDirs = "@out@/local/share/:@out@/share/"
+ 	}
+
+ 	for _, d := range strings.Split(xdgDataDirs, ":") {
+@@ -1280,7 +1280,7 @@ func detectLang() string {
+ }
+
+ func loadVocabulary(lang string) map[string]string {
+-	langsDir := "/usr/share/nwg-look/langs/"
+	langsDir := "@out@/share/nwg-look/langs/"
+ 	enUSFile := filepath.Join(langsDir, "en_US.json")
+ 	if pathExists(enUSFile) {
+ 		log.Infof(">>> Loading basic lang from '%s'", enUSFile)
--- a/pkgs/applications/misc/nwg-look/go.mod
+++ b/pkgs/applications/misc/nwg-look/go.mod
@ -0,0 +1,10 @@
+module github.com/nwg-piotr/nwg-look
+
+go 1.20
+
+require (
+	github.com/gotk3/gotk3 v0.6.2
+	github.com/sirupsen/logrus v1.9.3
+)
+
+require golang.org/x/sys v0.6.0 // indirect
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@ -86,11 +86,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "appgate-sdp";
-  version = "6.2.1";
+  version = "6.2.2";

  src = fetchurl {
    url = "https://bin.appgate-sdp.com/${lib.versions.majorMinor version}/client/appgate-sdp_${version}_amd64.deb";
-    sha256 = "sha256-TjwVUBSBYo67lJyTXeee1bSaCnYLGE/MKSt+YEV+/Hw=";
+    sha256 = "sha256-5xbwBCLTlZ0cE273n3ErykZSEr59dZjQWhVTK91W9a4=";
  };

  # just patch interpreter
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -41,9 +41,9 @@
        version = "2023-06-09";
      };
    };
-    sha256 = "0v3i688wszchyfs10zgax6yyig2wrdb38fhlzmlsbfh5vawpg5pq";
-    sha256bin64 = "1y442x3n76x9ahsw45m8yw65854h7b5zpmp4ipyvlwm5fx15zn6d";
-    version = "116.0.5845.140";
+    sha256 = "09b0i48sr5ynlhpya4lwnhgp081q4lqd23cc5l59dsxzh5ivbycb";
+    sha256bin64 = "1d49qcjh5mhfzqzjn4ilj23dpzd6nyl1pij5iv43dwxl8z2r3l3m";
+    version = "116.0.5845.179";
  };
  ungoogled-chromium = {
    deps = {
@ -54,12 +54,12 @@
        version = "2023-06-09";
      };
      ungoogled-patches = {
-        rev = "116.0.5845.140-1";
-        sha256 = "1ydki4hmrx01q39jprv2drln934b589lgy0j7g0y1df7lp02h95n";
+        rev = "116.0.5845.179-1";
+        sha256 = "0if5717w6211fbhqzgfrigy5q6yag7lj6ycdjpn1b5d0ryc97rnr";
      };
    };
-    sha256 = "0v3i688wszchyfs10zgax6yyig2wrdb38fhlzmlsbfh5vawpg5pq";
-    sha256bin64 = "1y442x3n76x9ahsw45m8yw65854h7b5zpmp4ipyvlwm5fx15zn6d";
-    version = "116.0.5845.140";
+    sha256 = "09b0i48sr5ynlhpya4lwnhgp081q4lqd23cc5l59dsxzh5ivbycb";
+    sha256bin64 = "1d49qcjh5mhfzqzjn4ilj23dpzd6nyl1pij5iv43dwxl8z2r3l3m";
+    version = "116.0.5845.179";
  };
 }
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -88,35 +88,6 @@
    env.MOZ_REQUIRE_SIGNING = "";
  });

-  firefox-esr-102 = buildMozillaMach rec {
-    pname = "firefox-esr-102";
-    version = "102.15.0esr";
-    applicationName = "Mozilla Firefox ESR";
-    src = fetchurl {
-      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "87db6e32fda215253f9b3bd233ef7fa91a64349310064b8482e5c634f34cbe99a2a111d74d2b9f2a99a0b3b510dbf9039ebe4ccfc176c2554d65bc9cfb508bf9";
-    };
-
-    meta = {
-      changelog = "https://www.mozilla.org/en-US/firefox/${lib.removeSuffix "esr" version}/releasenotes/";
-      description = "A web browser built from Firefox Extended Support Release source tree";
-      homepage = "http://www.mozilla.com/en-US/firefox/";
-      maintainers = with lib.maintainers; [ hexa ];
-      platforms = lib.platforms.unix;
-      badPlatforms = lib.platforms.darwin;
-      broken = stdenv.buildPlatform.is32bit; # since Firefox 60, build on 32-bit platforms fails with "out of memory".
-                                             # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
-      license = lib.licenses.mpl20;
-      mainProgram = "firefox";
-    };
-    tests = [ nixosTests.firefox-esr-102 ];
-    updateScript = callPackage ./update.nix {
-      attrPath = "firefox-esr-102-unwrapped";
-      versionPrefix = "102";
-      versionSuffix = "esr";
-    };
-  };
-
  firefox-esr-115 = buildMozillaMach rec {
    pname = "firefox-esr-115";
    version = "115.2.0esr";
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-cm-push.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-cm-push.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "helm-cm-push";
-  version = "0.10.3";
+  version = "0.10.4";

  src = fetchFromGitHub {
    owner = "chartmuseum";
    repo = "helm-push";
    rev = "v${version}";
-    hash = "sha256-GyVhjCosVaUS1DtztztFxKuuRlUdxlsOP4/QMQ7+TaU=";
+    hash = "sha256-YnhI1/BDk9swr3YFm5ajGf4LLgPty7blA2tlsMH0erY=";
  };

-  vendorSha256 = "sha256-9LhokpQrREmcyBqwb33BSMyG8z7IAsl9NtE3B631PnM=";
+  vendorHash = "sha256-7bUDKqkvBV1Upcrj4DQnVCP74QtKlSwF0Kl2sPFZpjc=";

  subPackage = [ "cmd/helm-cm-push" ];

--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@ -74,15 +74,12 @@ let
          cryptography = super.cryptography.overridePythonAttrs (old: {
            meta = old.meta // {
              knownVulnerabilities = old.meta.knownVulnerabilities or [ ]
-                ++ lib.optionals (lib.versionOlder old.version "39.0.1") [
-                  "CVE-2022-4304"
-                  "CVE-2023-0215"
-                  "CVE-2023-0216"
-                  "CVE-2023-0217"
-                  "CVE-2023-0401"
-                  "CVE-2022-4203"
-                  "CVE-2022-4450"
-                  "CVE-2023-23931"
+                ++ lib.optionals (lib.versionOlder old.version "41.0.0") [
+                  "CVE-2023-2650"
+                  "CVE-2023-2975"
+                  "CVE-2023-3446"
+                  "CVE-2023-3817"
+                  "CVE-2023-38325"
                ];
            };
          });
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.50.13";
+  version = "0.50.14";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-d3fWHkuJdijN5/EsG6nhdf6G8AG2nZVFN8MUN8X+qf0=";
+    hash = "sha256-jPRSwq7pLFG56NB+HaP2GP2GdK1wsOeM+y396o70Q3A=";
  };

  vendorHash = "sha256-wQ5jxOTuYkiW5zHcduByKZ+vHPKn/1ELL3DskKze+UI=";
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -6,7 +6,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.9.5";
+  version = "3.9.7";
  format = "pyproject";

  # Fetch from GitHub in order to use `requirements.in`
@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "Flexget";
    repo = "Flexget";
    rev = "refs/tags/v${version}";
-    hash = "sha256-L3AQCc5ErWjMATKMSZf9r+4rfFA8SjCCcT0rW9oMmbA=";
+    hash = "sha256-UDh5rEcnuoiXjxYZqh0KJXi02M3xjwXGNKhrEBrLtCs=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -1,12 +1,12 @@
 { callPackage }: builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; })) {
  signal-desktop = {
    dir = "Signal";
-    version = "6.29.1";
-    hash = "sha256-QtQVH8cs42vwzJNiq6klaSQO2pmB80OYjzAR4Bibb/s";
+    version = "6.30.1";
+    hash = "sha256-tG5R4A+Uz/ynw0cD7tW5/Fp8KlnNk+zmnRp01m/6vZU=";
  };
  signal-desktop-beta = {
    dir = "Signal Beta";
-    version = "6.30.0-beta.2";
-    hash = "sha256-EMgstKlHA6ilSlbDmsPAu/jNC21XGzF7LS7QzWcK2F0";
+    version = "6.31.0-beta.1";
+    hash = "sha256-j3DY+FY7kVVGvVuVZw/JxIpwxtgBttSyWcRaa9MCSjE=";
  };
 }
--- a/pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix
+++ b/pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix
@ -1,32 +1,65 @@
-{ lib, stdenv, wrapGAppsHook, fetchFromGitHub, pkg-config, gtk3, json-glib, curl
-, glib, appstream-glib, desktop-file-utils, meson, ninja, geoip, gettext
-, libappindicator, libmrss, libproxy }:
+{ lib
+, stdenv
+, appstream-glib
+, curl
+, desktop-file-utils
+, fetchFromGitHub
+, geoip
+, gettext
+, glib
+, gtk3
+, json-glib
+, libappindicator
+, libmrss
+, libproxy
+, libsoup_3
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook
+}:

 stdenv.mkDerivation rec {
  pname = "transmission-remote-gtk";
-  version = "1.5.1";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "transmission-remote-gtk";
    repo = "transmission-remote-gtk";
-    rev = version;
-    sha256 = "4/ID12JukDDvJzWupc76r7W8Us5erwv8oXZhDnB6VDk=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-/syZI/5LhuYLvXrNknnpbGHEH0z5iHeye2YRNJFWZJ0=";
  };

-  nativeBuildInputs =
-    [ desktop-file-utils wrapGAppsHook meson ninja pkg-config appstream-glib ];
+  nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
+  ];

-  buildInputs =
-    [ gtk3 json-glib curl glib gettext libmrss geoip libproxy libappindicator ];
+  buildInputs = [
+    curl
+    geoip
+    gettext
+    glib
+    gtk3
+    json-glib
+    libappindicator
+    libmrss
+    libproxy
+    libsoup_3
+  ];

  doCheck = false; # Requires network access

  meta = with lib; {
    description = "GTK remote control for the Transmission BitTorrent client";
-    homepage =
-      "https://github.com/transmission-remote-gtk/transmission-remote-gtk";
+    homepage = "https://github.com/transmission-remote-gtk/transmission-remote-gtk";
+    changelog = "https://github.com/transmission-remote-gtk/transmission-remote-gtk/releases/tag/${version}";
    license = licenses.gpl2;
-    maintainers = [ maintainers.ehmry ];
+    maintainers = with maintainers; [ ehmry ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "protonmail-bridge";
-  version = "3.4.1";
+  version = "3.4.2";

  src = fetchFromGitHub {
    owner = "ProtonMail";
    repo = "proton-bridge";
    rev = "v${version}";
-    hash = "sha256-EDUjKHqaHZA/jvPBeAAqIJHEt8eTHmg9D5lE5JGAAAU=";
+    hash = "sha256-i+RD0f3WxdW0PgMNynsIXnOfEdh3vS3NufJyXpw0EU0=";
  };

-  vendorHash = "sha256-gwRyr4zQLgZqyqxsh0wGABbuGKvZhG/yTfy/CqOiaBA=";
+  vendorHash = "sha256-lrK4L7oTR5qP34Df0UJnTJATmKUmHVZeGrD9kD+sZFw=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@ -76,13 +76,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "freerdp";
-  version = "2.11.0";
+  version = "2.11.1";

  src = fetchFromGitHub {
    owner = "FreeRDP";
    repo = "FreeRDP";
    rev = version;
-    sha256 = "sha256-yyJs6J2R2L2YtNKzHFW6X6I1aJTHipBA1+yuT7bR9Zg=";
+    sha256 = "sha256-x97I0TDPAd/zULM/FpAvYQTcArG2CwGoUUp/eEM4vdc=";
  };

  postPatch = ''
--- a/pkgs/applications/office/beamerpresenter/default.nix
+++ b/pkgs/applications/office/beamerpresenter/default.nix
@ -7,6 +7,7 @@
 , wrapQtAppsHook
 , gst_all_1
 , qtbase
+, qtsvg
 , qtmultimedia
 , qttools
 , qtwayland
@ -27,13 +28,13 @@

 stdenv.mkDerivation rec {
  pname = "beamerpresenter";
-  version = "0.2.3-1";
+  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "stiglers-eponym";
    repo = "BeamerPresenter";
-    rev = "dd41a00b3c6c8b881fa62945165c965634df66f0";
-    sha256 = "11yj1zl8hdnqbynkbyzg8kwyx1jl8c87x8f8qyllpk0s6cg304d0";
+    rev = "v${version}";
+    hash = "sha256-UQbyzkFjrIDPcrE6yGuOWsXNjz8jWyJEWiQwHmf91/8=";
  };

  nativeBuildInputs = [
@ -51,6 +52,7 @@ stdenv.mkDerivation rec {
    gst_all_1.gst-plugins-good
    zlib
    qtbase
+    qtsvg
    qtmultimedia
    qttools
  ] ++ lib.optionals stdenv.isLinux [
@ -70,10 +72,10 @@ stdenv.mkDerivation rec {
    "-DUSE_POPPLER=${if usePoppler then "ON" else "OFF"}"
    "-DUSE_MUPDF=${if useMupdf then "ON" else "OFF"}"
    "-DUSE_QTPDF=OFF"
-    "-DUSE_MUPDF_THIRD=ON"
+    "-DLINK_MUPDF_THIRD=ON"
    "-DUSE_EXTERNAL_RENDERER=${if useExternalRenderer then "ON" else "OFF"}"
-    "-DUSE_MUJS=OFF"
-    "-DUSE_GUMBO=ON"
+    "-DLINK_MUJS=OFF"
+    "-DLINK_GUMBO=ON"
    "-DUSE_TRANSLATIONS=ON"
    "-DQT_VERSION_MAJOR=${lib.versions.major qtbase.version}"
  ];
--- a/pkgs/applications/science/biology/igv/default.nix
+++ b/pkgs/applications/science/biology/igv/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "igv";
-  version = "2.16.1";
+  version = "2.16.2";
  src = fetchzip {
    url = "https://data.broadinstitute.org/igv/projects/downloads/${lib.versions.majorMinor version}/IGV_${version}.zip";
-    sha256 = "sha256-/3ielakIRdm9/iGBKSk+fTyzYRnsMTdCdsKghnziVwA=";
+    sha256 = "sha256-/X9loW8rOevf/GA/Wk3bVsES9ZceF79Bkwby75SJgTQ=";
  };

  installPhase = ''
--- a/pkgs/applications/science/logic/netlistsvg/default.nix
+++ b/pkgs/applications/science/logic/netlistsvg/default.nix
@ -47,7 +47,7 @@ buildNpmPackage rec {

  meta = {
    description = "Draw SVG digital circuits schematics from yosys JSON netlists";
-    homepage = "https://neilturley.dev/netlistsvg/";
+    homepage = "https://github.com/nturley/netlistsvg";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ pbsds ];
  };
--- a/pkgs/applications/version-management/ghorg/default.nix
+++ b/pkgs/applications/version-management/ghorg/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "ghorg";
-  version = "1.9.7";
+  version = "1.9.9";

  src = fetchFromGitHub {
    owner = "gabrie30";
    repo = "ghorg";
    rev = "v${version}";
-    sha256 = "sha256-uIhYk79ZXcJ/ttexgjtxskI2nEwlq+E4jgIZzwz8hmI=";
+    sha256 = "sha256-yq95+MHMbzVg8i/55EZBVCVkE3uwD964fAaXWP5aWYw=";
  };

  doCheck = false;
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,15 +1,15 @@
 {
-  "version": "16.3.1",
-  "repo_hash": "sha256-E0aa+sUoc8CxQ4ucHOPJL3+A1Al23xWT0TpYSSpZxgc=",
-  "yarn_hash": "0lks2s0g7x7psdfmcq353z7gjp9lw1wm72hvkvw26fy21yglml6s",
+  "version": "16.3.2",
+  "repo_hash": "sha256-SFxmbVWFEq0kWhzCLESdAksxUd0tiNeLGCOKNRHKMqI=",
+  "yarn_hash": "02g51sfpn065513n5ngcw6rqvzaws6yfq0y7gyj4lc4d8fhis088",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v16.3.1-ee",
+  "rev": "v16.3.2-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "16.3.1",
-    "GITLAB_PAGES_VERSION": "16.3.1",
+    "GITALY_SERVER_VERSION": "16.3.2",
+    "GITLAB_PAGES_VERSION": "16.3.2",
    "GITLAB_SHELL_VERSION": "14.26.0",
    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "4.3.8",
-    "GITLAB_WORKHORSE_VERSION": "16.3.1"
+    "GITLAB_WORKHORSE_VERSION": "16.3.2"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -13,7 +13,7 @@
 }:

 let
-  version = "16.3.1";
+  version = "16.3.2";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@ -24,10 +24,10 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      sha256 = "sha256-Tc7JsGuTF+JK5SLmaQwVbmdSy/Wvm3VNoZqHTyZFd6k=";
+      hash = "sha256-Q2wXoc4tLJvc0LwSct3cCswOqhUJSVVhoG/uFXeVOB4=";
    };

-    vendorSha256 = "sha256-abyouKgn31yO3+oeowtxZcuvS6mazVM8zOMEFsyw4C0=";
+    vendorHash = "sha256-abyouKgn31yO3+oeowtxZcuvS6mazVM8zOMEFsyw4C0=";

    ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];

--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "16.3.1";
+  version = "16.3.2";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    sha256 = "sha256-gUUmUVBk6Ox4oKOef8RDqmW2Hs2wQL/lpbIEbwbzgHY=";
+    hash = "sha256-1e3s+RLuNilNtsKzfKrsbAD0dzA87LbLH/c43CKh5EU=";
  };

  vendorHash = "sha256-Pdb+bWsECe7chgvPKFGXxVAWb+AbGF6khVJSdDsHqKM=";
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "16.3.1";
+  version = "16.3.2";

  src = fetchFromGitLab {
    owner = data.owner;
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@ -26,13 +26,13 @@

 mkDerivation rec {
  pname = "haruna";
-  version = "0.12.0";
+  version = "0.12.1";

  src = fetchFromGitLab {
    owner = "multimedia";
    repo = "haruna";
    rev = "v${version}";
-    hash = "sha256-NWV3DSQkgH4cqNnHipg4S3Nf5aEVdRzD0oT8a2OyCu4=";
+    hash = "sha256-x3tgH2eoLVELQKbgNLvJPGQsay8iOfMY/BGLOEov3OM=";
    domain = "invent.kde.org";
  };

@ -73,6 +73,6 @@ mkDerivation rec {
    homepage = "https://invent.kde.org/multimedia/haruna";
    description = "Open source video player built with Qt/QML and libmpv";
    license = with licenses; [ bsd3 cc-by-40 cc-by-sa-40 cc0 gpl2Plus gpl3Plus wtfpl ];
-    maintainers = with maintainers; [ jojosch ];
+    maintainers = with maintainers; [ jojosch kashw2 ];
  };
 }
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -225,6 +225,9 @@ in stdenv'.mkDerivation (finalAttrs: {
  # See the explanation in addOpenGLRunpath.
  postFixup = lib.optionalString stdenv.isLinux ''
    addOpenGLRunpath $out/bin/mpv
+  '' + lib.optionalString (stdenv.isDarwin && javascriptSupport) ''
+    ${stdenv.cc.targetPrefix}install_name_tool -change "build/release/libmujs.dylib" \
+      "${mujs}/lib/libmujs.dylib" $out/bin/mpv
  '';

  passthru = {
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@ -46,6 +46,8 @@
 , nlohmann_json
 , websocketpp
 , asio
+, decklinkSupport ? false
+, blackmagic-desktop-video
 }:

 let
@ -134,9 +136,17 @@ stdenv.mkDerivation rec {
  ];

  dontWrapGApps = true;
-  preFixup = ''
+  preFixup = let
+    wrapperLibraries = [
+      xorg.libX11
+      libvlc
+      libGL
+    ] ++ optionals decklinkSupport [
+      blackmagic-desktop-video
+    ];
+  in ''
    qtWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : "$out/lib:${lib.makeLibraryPath [ xorg.libX11 libvlc libGL ]}"
+      --prefix LD_LIBRARY_PATH : "$out/lib:${lib.makeLibraryPath wrapperLibraries}"
      ''${gappsWrapperArgs[@]}
    )
  '';
--- a/pkgs/applications/window-managers/i3/status-rust.nix
+++ b/pkgs/applications/window-managers/i3/status-rust.nix
@ -15,16 +15,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "i3status-rust";
-  version = "0.32.1";
+  version = "0.32.2";

  src = fetchFromGitHub {
    owner = "greshake";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-F09gIDByRIJENwbzUb2IlWkyXjva0b7ivORgXotL/20=";
+    hash = "sha256-CKL4XsOBo8y4k06t5E7k2HBmI4VABW4rxU6Bjl52fhs=";
  };

-  cargoHash = "sha256-D0XGH6b6dJrgLnFUViRAl9+AhnR2Bt4J2hDXUyJhOyg=";
+  cargoHash = "sha256-7v5813veJPP5NVe2gFZr+iXJmK+aLajSZuhEkgsMxuY=";

  nativeBuildInputs = [ pkg-config makeWrapper ];

--- a/pkgs/build-support/node/build-npm-package/default.nix
+++ b/pkgs/build-support/node/build-npm-package/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchNpmDeps, npmHooks, nodejs }:
+{ lib, stdenv, fetchNpmDeps, buildPackages, nodejs }:

 { name ? "${args.pname}-${args.version}"
 , src ? null
@ -44,7 +44,12 @@ let
    hash = npmDepsHash;
  };

-  inherit (npmHooks.override { inherit nodejs; }) npmConfigHook npmBuildHook npmInstallHook;
+  # .override {} negates splicing, so we need to use buildPackages explicitly
+  npmHooks = buildPackages.npmHooks.override {
+    inherit nodejs;
+  };
+
+  inherit (npmHooks) npmConfigHook npmBuildHook npmInstallHook;
 in
 stdenv.mkDerivation (args // {
  inherit npmDeps npmBuildScript;
--- a/pkgs/build-support/node/build-npm-package/hooks/default.nix
+++ b/pkgs/build-support/node/build-npm-package/hooks/default.nix
@ -1,4 +1,13 @@
-{ lib, makeSetupHook, nodejs, srcOnly, buildPackages, makeWrapper }:
+{ lib
+, srcOnly
+, makeSetupHook
+, makeWrapper
+, nodejs
+, jq
+, prefetch-npm-deps
+, diffutils
+, installShellFiles
+}:

 {
  npmConfigHook = makeSetupHook
@ -6,13 +15,13 @@
      name = "npm-config-hook";
      substitutions = {
        nodeSrc = srcOnly nodejs;
-        nodeGyp = "${buildPackages.nodejs}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js";
+        nodeGyp = "${nodejs}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js";

        # Specify `diff`, `jq`, and `prefetch-npm-deps` by abspath to ensure that the user's build
        # inputs do not cause us to find the wrong binaries.
-        diff = "${buildPackages.diffutils}/bin/diff";
-        jq = "${buildPackages.jq}/bin/jq";
-        prefetchNpmDeps = "${buildPackages.prefetch-npm-deps}/bin/prefetch-npm-deps";
+        diff = "${diffutils}/bin/diff";
+        jq = "${jq}/bin/jq";
+        prefetchNpmDeps = "${prefetch-npm-deps}/bin/prefetch-npm-deps";

        nodeVersion = nodejs.version;
        nodeVersionMajor = lib.versions.major nodejs.version;
@ -27,13 +36,13 @@
  npmInstallHook = makeSetupHook
    {
      name = "npm-install-hook";
-      propagatedBuildInputs = with buildPackages; [
+      propagatedBuildInputs = [
        installShellFiles
        makeWrapper
      ];
      substitutions = {
        hostNode = "${nodejs}/bin/node";
-        jq = "${buildPackages.jq}/bin/jq";
+        jq = "${jq}/bin/jq";
      };
    } ./npm-install-hook.sh;
 }
--- a/pkgs/by-name/cd/cdwe/package.nix
+++ b/pkgs/by-name/cd/cdwe/package.nix
@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cdwe";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "synoet";
+    repo = "cdwe";
+    rev = version;
+    hash = "sha256-6NWhx82BXhWhbI18k5gE3vEkw9v5gstE8ICJhtq68rM=";
+  };
+
+  cargoHash = "sha256-V2eWVoRtfjHLe2AypYekUFzMnuV8RYU9Pb7Q1U3fwp4=";
+
+  meta = with lib; {
+    description = "A configurable cd wrapper that lets you define your environment per directory";
+    homepage = "https://github.com/synoet/cdwe";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "cdwe";
+  };
+}
--- a/pkgs/by-name/ir/ironbar/package.nix
+++ b/pkgs/by-name/ir/ironbar/package.nix
@ -0,0 +1,80 @@
+{ gtk3
+, gdk-pixbuf
+, librsvg
+, webp-pixbuf-loader
+, gobject-introspection
+, glib-networking
+, glib
+, shared-mime-info
+, gsettings-desktop-schemas
+, wrapGAppsHook
+, gtk-layer-shell
+, gnome
+, libxkbcommon
+, openssl
+, pkg-config
+, hicolor-icon-theme
+, rustPlatform
+, lib
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ironbar";
+  version = "0.13.0";
+
+  src = fetchFromGitHub {
+    owner = "JakeStanger";
+    repo = "ironbar";
+    rev = "v${version}";
+    hash = "sha256-e79eJGc/kxQjRwa1HnF7V/pCbrMTstJsBOl1Luo6i0g=";
+  };
+
+  cargoHash = "sha256-N8uAisQ50W/9zCr9bRX6tZ0slEoe1zCEMDXuvmoWEs4=";
+
+  buildInputs = [
+    gtk3
+    gdk-pixbuf
+    glib
+    gtk-layer-shell
+    glib-networking
+    shared-mime-info
+    gnome.adwaita-icon-theme
+    hicolor-icon-theme
+    gsettings-desktop-schemas
+    libxkbcommon
+    openssl
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    wrapGAppsHook
+    gobject-introspection
+  ];
+
+  propagatedBuildInputs = [
+    gtk3
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      # Thumbnailers
+      --prefix XDG_DATA_DIRS : "${gdk-pixbuf}/share"
+      --prefix XDG_DATA_DIRS : "${librsvg}/share"
+      --prefix XDG_DATA_DIRS : "${webp-pixbuf-loader}/share"
+      --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
+
+      # gtk-launch
+      --suffix PATH : "${lib.makeBinPath [ gtk3 ]}"
+    )
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/JakeStanger/ironbar";
+    description = "Customizable gtk-layer-shell wlroots/sway bar written in Rust";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ yavko donovanglover jakestanger ];
+    mainProgram = "ironbar";
+  };
+}
--- a/pkgs/by-name/ji/jinja2-cli/package.nix
+++ b/pkgs/by-name/ji/jinja2-cli/package.nix
@ -0,0 +1,49 @@
+{ lib
+, python3
+, fetchFromGitHub
+, extras ? [ "hjson" "json5" "toml" "xml" "yaml" ]
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "jinja2-cli";
+  version = "0.8.2";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "mattrobenolt";
+    repo = "jinja2-cli";
+    rev = version;
+    hash = "sha256-67gYt0nZX+VTVaoSxVXGzbRiXD7EMsVBFWC8wHo+Vw0=";
+  };
+
+  nativeBuildInputs = [
+    python3.pkgs.setuptools
+    python3.pkgs.wheel
+  ];
+
+  nativeCheckInputs = [
+    python3.pkgs.pytestCheckHook
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    jinja2
+  ] ++ lib.attrVals extras passthru.optional-dependencies;
+
+  pythonImportsCheck = [ "jinja2cli" ];
+
+  passthru.optional-dependencies = with python3.pkgs; {
+    hjson = [ hjson ];
+    json5 = [ json5 ];
+    toml = [ toml ];
+    xml = [ xmltodict ];
+    yaml = [ pyyaml ];
+  };
+
+  meta = with lib; {
+    description = "CLI for Jinja2";
+    homepage = "https://github.com/mattrobenolt/jinja2-cli";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "jinja2";
+  };
+}
--- a/pkgs/by-name/li/liana/Cargo.lock
+++ b/pkgs/by-name/li/liana/Cargo.lock
--- a/pkgs/by-name/li/liana/package.nix
+++ b/pkgs/by-name/li/liana/package.nix
@ -0,0 +1,91 @@
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, cmake
+, copyDesktopItems
+, makeDesktopItem
+, makeWrapper
+, expat
+, fontconfig
+, freetype
+, libGL
+, systemd
+, vulkan-loader
+, xorg
+}:
+
+let
+  runtimeLibs = [
+    expat
+    fontconfig
+    freetype
+    freetype.dev
+    libGL
+    vulkan-loader
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXrandr
+  ];
+in
+rustPlatform.buildRustPackage rec {
+  pname = "liana";
+  version = "2.0";
+
+  src = fetchFromGitHub {
+    owner = "wizardsardine";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-GQNPKlqOBoh684x57gVV3CImgO7HBqt3UFp6CHC13do=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "liana-2.0.0" = "sha256-Dv/Ad8Kv7Mit8yhewzANbUbngQjtQaap/NQy9jqnbfA=";
+      "iced_futures-0.6.0" = "sha256-ejkAxU6DwiX1/119eA0GRapSmz7dqwx9M0uMwyDHATQ=";
+    };
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    copyDesktopItems
+    makeWrapper
+  ];
+
+  buildInputs = [
+    fontconfig
+    systemd
+  ];
+
+  sourceRoot = "source/gui";
+
+  postInstall = ''
+    install -Dm0644 ./ui/static/logos/liana-app-icon.svg $out/share/icons/hicolor/scalable/apps/liana.svg
+    wrapProgram $out/bin/liana-gui --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}"
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Liana";
+      exec = "liana-gui";
+      icon = "liana";
+      desktopName = "Liana";
+      comment = meta.description;
+    })
+  ];
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "A Bitcoin wallet leveraging on-chain timelocks for safety and recovery";
+    homepage = "https://wizardsardine.com/liana";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ dunxen ];
+    platforms = platforms.linux;
+    broken = stdenv.isAarch64;
+  };
+}
--- a/pkgs/by-name/pa/passes/package.nix
+++ b/pkgs/by-name/pa/passes/package.nix
@ -0,0 +1,67 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, appstream-glib
+, blueprint-compiler
+, desktop-file-utils
+, gettext
+, gtk4
+, libadwaita
+, meson
+, ninja
+, pkg-config
+, python3
+, wrapGAppsHook4
+, zint
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "passes";
+  version = "0.8";
+
+  src = fetchFromGitHub {
+    owner = "pablo-s";
+    repo = "passes";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-SIJLBVWyW9+Hzb6ebfUnBfUuvNmYBm9ojKrnFOS3BGc=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/model/meson.build \
+      --replace /app/lib ${zint}/lib
+    substituteInPlace src/view/window.blp \
+      --replace reveal_flap reveal-flap
+    substituteInPlace build-aux/meson/postinstall.py \
+      --replace gtk-update-icon-cache gtk4-update-icon-cache
+    patchShebangs build-aux/meson/postinstall.py
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    appstream-glib
+    blueprint-compiler
+    desktop-file-utils
+    gettext
+    meson
+    ninja
+    pkg-config
+    (python3.withPackages (pp: [pp.pygobject3]))
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gtk4
+    libadwaita
+    zint
+  ];
+
+  meta = with lib; {
+    description = "A digital pass manager";
+    homepage = "https://github.com/pablo-s/passes";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+    broken = stdenv.isDarwin; # Crashes
+  };
+})
--- a/pkgs/by-name/ri/ripsecrets/package.nix
+++ b/pkgs/by-name/ri/ripsecrets/package.nix
@ -0,0 +1,27 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ripsecrets";
+  version = "0.1.6";
+
+  src = fetchFromGitHub {
+    owner = "sirwart";
+    repo = "ripsecrets";
+    rev = "v${version}";
+    hash = "sha256-p3421sQko/WulSNUxXpjsHPAtRoHHg61angfxJpoyFg=";
+  };
+
+  cargoHash = "sha256-DJkEhqW5DZOmoNiS4nw+i2G0+KN2d7FbBuKp7fdAwMk=";
+
+  meta = with lib; {
+    description = "A command-line tool to prevent committing secret keys into your source code";
+    homepage = "https://github.com/sirwart/ripsecrets";
+    changelog = "https://github.com/sirwart/ripsecrets/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "ripsecrets";
+  };
+}
--- a/pkgs/by-name/wo/wonderdraft/package.nix
+++ b/pkgs/by-name/wo/wonderdraft/package.nix
@ -0,0 +1,62 @@
+{ lib
+, stdenv
+, requireFile
+, dpkg
+, xorg
+, libGL
+, alsa-lib
+, pulseaudio
+}:
+
+stdenv.mkDerivation rec {
+  pname = "wonderdraft";
+  version = "1.1.7.3";
+
+  src = requireFile {
+    name = "Wonderdraft-${version}-Linux64.deb";
+    url = "https://wonderdraft.net/";
+    hash = "sha256-i8YZF5w1dIWUyk99SUhHU7eJRjPXJDPbYUzGC1uN8JQ=";
+  };
+  sourceRoot = ".";
+  unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp -R usr/share opt $out/
+    substituteInPlace \
+      $out/share/applications/Wonderdraft.desktop \
+      --replace /opt/ $out/opt/
+    ln -s $out/opt/Wonderdraft/Wonderdraft.x86_64 $out/bin/Wonderdraft.x86_64
+    runHook postInstall
+  '';
+  preFixup = let
+    libPath = lib.makeLibraryPath [
+      xorg.libXcursor
+      xorg.libXinerama
+      xorg.libXrandr
+      xorg.libX11
+      xorg.libXi
+      libGL
+      alsa-lib
+      pulseaudio
+    ];
+  in ''
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${libPath}" \
+      $out/opt/Wonderdraft/Wonderdraft.x86_64
+  '';
+
+  meta = with lib; {
+    homepage = "https://wonderdraft.net/";
+    description = "A mapmaking tool for Tabletop Roleplaying Games, designed for city, region, or world scale";
+    license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ jsusk ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+  };
+}
--- a/pkgs/by-name/zx/zxpy/package.nix
+++ b/pkgs/by-name/zx/zxpy/package.nix
@ -0,0 +1,53 @@
+{ lib
+, python3
+, fetchFromGitHub
+, fetchpatch
+, deterministic-uname
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "zxpy";
+  version = "1.6.3";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "tusharsadhwani";
+    repo = "zxpy";
+    rev = version;
+    hash = "sha256-/sOLSIqaAUkaAghPqe0Zoq7C8CSKAd61o8ivtjJFcJY=";
+  };
+
+  patches = [
+    # fix test caused by `uname -p` printing unknown
+    # https://github.com/tusharsadhwani/zxpy/pull/53
+    (fetchpatch {
+      name = "allow-unknown-processor-in-injection-test.patch";
+      url = "https://github.com/tusharsadhwani/zxpy/commit/95ad80caddbab82346f60ad80a601258fd1238c9.patch";
+      hash = "sha256-iXasOKjWuxNjjTpb0umNMNhbFgBjsu5LsOpTaXllATM=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    python3.pkgs.setuptools
+    python3.pkgs.wheel
+  ];
+
+  nativeCheckInputs = [
+    deterministic-uname
+    python3.pkgs.pytestCheckHook
+  ];
+
+  preCheck = ''
+    export PATH=$out/bin:$PATH
+  '';
+
+  pythonImportsCheck = [ "zx" ];
+
+  meta = with lib; {
+    description = "Shell scripts made simple";
+    homepage = "https://github.com/tusharsadhwani/zxpy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "zxpy";
+  };
+}
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;

 buildNpmPackage rec {
  pname = if set != null then "iosevka-${set}" else "iosevka";
-  version = "26.3.0";
+  version = "26.3.3";

  src = fetchFromGitHub {
    owner = "be5invis";
    repo = "iosevka";
    rev = "v${version}";
-    hash = "sha256-t08S6CH8GB+TIQ4MOHjG2NGSuTnrKlqhaub/eZYIz/w=";
+    hash = "sha256-V4JBN7yPI25fA36wK1XItLiI5jLWYAaHoVCT+RQCN6k=";
  };

-  npmDepsHash = "sha256-D5uykh/DKfJg3ZOIVK6ZL+CFZMEmtFTr0rEUgfJU7Bc=";
+  npmDepsHash = "sha256-sJSBaAi4478zgUZFohOAUbQr7f/nBytcoXxFuLJS3y8=";

  nativeBuildInputs = [
    remarshal
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@ -6,6 +6,7 @@
 , git
 , fetchFromGitHub
 , ninja
+, gitUpdater
 }:

 let
@ -13,12 +14,12 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "circt";
-  version = "1.53.0";
+  version = "1.54.0";
  src = fetchFromGitHub {
    owner = "llvm";
    repo = "circt";
    rev = "firtool-${version}";
-    sha256 = "sha256-F3pGXZC4jSG9TV2sc5G9bQtKMY6xcPknwO0fqQ6uBoA=";
+    sha256 = "sha256-jHDQl6UJTyNGZ4PUTEiZCIN/RSRbBxlaVutkwrWbK9M=";
    fetchSubmodules = true;
  };

@ -69,6 +70,10 @@ stdenv.mkDerivation rec {
  doCheck = true;
  checkTarget = "check-circt check-circt-integration";

+  passthru.updateScript = gitUpdater {
+    rev-prefix = "firtool-";
+  };
+
  meta = {
    description = "Circuit IR compilers and tools";
    homepage = "https://circt.org/";
--- a/pkgs/development/compilers/fasm/bin.nix
+++ b/pkgs/development/compilers/fasm/bin.nix
@ -3,11 +3,11 @@
 stdenvNoCC.mkDerivation rec {
  pname = "fasm-bin";

-  version = "1.73.30";
+  version = "1.73.31";

  src = fetchurl {
    url = "https://flatassembler.net/fasm-${version}.tgz";
-    sha256 = "sha256-dRlQUaWIHbu+DwQBFh6Tf4o2u0LTRw/Ehp2hT9LC8QE=";
+    sha256 = "sha256-jzjLIayR+xulSGKhvQ9VxWhZC6qRZ/4IHSe3lD8LD+M=";
  };

  installPhase = ''
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@ -47,7 +47,7 @@ let
  # See https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903
  disableBootstrap' = disableBootstrap && !langFortran && !langGo;

-  crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
+  crossMingw = targetPlatform != hostPlatform && targetPlatform.isMinGW;
  crossDarwin = targetPlatform != hostPlatform && targetPlatform.libc == "libSystem";

  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
--- a/pkgs/development/compilers/gcc/common/libgcc.nix
+++ b/pkgs/development/compilers/gcc/common/libgcc.nix
@ -20,7 +20,7 @@ drv: lib.pipe drv
  (pkg: pkg.overrideAttrs (previousAttrs:
    lib.optionalAttrs (
      targetPlatform != hostPlatform &&
-      (enableShared || targetPlatform.libc == "msvcrt") &&
+      (enableShared || targetPlatform.isMinGW) &&
      withoutTargetLibc
    ) {
      makeFlags = [ "all-gcc" "all-target-libgcc" ];
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@ -115,7 +115,7 @@ let inherit version;
    patches = callFile ./patches {};

    /* Cross-gcc settings (build == host != target) */
-    crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
+    crossMingw = targetPlatform != hostPlatform && targetPlatform.isMinGW;
    stageNameAddon = if withoutTargetLibc then "stage-static" else "stage-final";
    crossNameAddon = optionalString (targetPlatform != hostPlatform) "${targetPlatform.config}-${stageNameAddon}-";

--- a/pkgs/development/compilers/ocaml/5.1.nix
+++ b/pkgs/development/compilers/ocaml/5.1.nix
@ -0,0 +1,9 @@
+import ./generic.nix {
+  major_version = "5";
+  minor_version = "1";
+  patch_version = "0-rc3";
+  src = fetchTarball {
+    url = "https://caml.inria.fr/pub/distrib/ocaml-5.1/ocaml-5.1.0~rc3.tar.xz";
+    sha256 = "sha256:0cbvdcsq1qh70mm116dcgk6y7d4g4nrypzq20k7i6ww7am1563d3";
+  };
+}
--- a/pkgs/development/compilers/zig/hook.nix
+++ b/pkgs/development/compilers/zig/hook.nix
@ -9,6 +9,26 @@ makeSetupHook {
  propagatedBuildInputs = [ zig ];

  substitutions = {
+    # This zig_default_flags below is meant to avoid CPU feature impurity in
+    # Nixpkgs. However, this flagset is "unstable": it is specifically meant to
+    # be controlled by the upstream development team - being up to that team
+    # exposing or not that flags to the outside (especially the package manager
+    # teams).
+
+    # Because of this hurdle, @andrewrk from Zig Software Foundation proposed
+    # some solutions for this issue. Hopefully they will be implemented in
+    # future releases of Zig. When this happens, this flagset should be
+    # revisited accordingly.
+
+    # Below are some useful links describing the discovery process of this 'bug'
+    # in Nixpkgs:
+
+    # https://github.com/NixOS/nixpkgs/issues/169461
+    # https://github.com/NixOS/nixpkgs/issues/185644
+    # https://github.com/NixOS/nixpkgs/pull/197046
+    # https://github.com/NixOS/nixpkgs/pull/241741#issuecomment-1624227485
+    # https://github.com/ziglang/zig/issues/14281#issuecomment-1624220653
+
    zig_default_flags =
      let
        releaseType =
--- a/pkgs/development/compilers/zig/setup-hook.sh
+++ b/pkgs/development/compilers/zig/setup-hook.sh
@ -1,25 +1,5 @@
 # shellcheck shell=bash disable=SC2154,SC2086

-# This readonly zigDefaultBuildFlagsArray below is meant to avoid CPU feature
-# impurity in Nixpkgs. However, this flagset is "unstable": it is specifically
-# meant to be controlled by the upstream development team - being up to that
-# team exposing or not that flags to the outside (especially the package manager
-# teams).
-
-# Because of this hurdle, @andrewrk from Zig Software Foundation proposed some
-# solutions for this issue. Hopefully they will be implemented in future
-# releases of Zig. When this happens, this flagset should be revisited
-# accordingly.
-
-# Below are some useful links describing the discovery process of this 'bug' in
-# Nixpkgs:
-
-# https://github.com/NixOS/nixpkgs/issues/169461
-# https://github.com/NixOS/nixpkgs/issues/185644
-# https://github.com/NixOS/nixpkgs/pull/197046
-# https://github.com/NixOS/nixpkgs/pull/241741#issuecomment-1624227485
-# https://github.com/ziglang/zig/issues/14281#issuecomment-1624220653
-
 readonly zigDefaultFlagsArray=(@zig_default_flags@)

 function zigSetGlobalCacheDir {
@ -35,7 +15,7 @@ function zigBuildPhase {
        $zigBuildFlags "${zigBuildFlagsArray[@]}"
    )

-    echoCmd 'build flags' "${flagsArray[@]}"
+    echoCmd 'zig build flags' "${flagsArray[@]}"
    zig build "${flagsArray[@]}"

    runHook postBuild
@ -49,7 +29,7 @@ function zigCheckPhase {
        $zigCheckFlags "${zigCheckFlagsArray[@]}"
    )

-    echoCmd 'check flags' "${flagsArray[@]}"
+    echoCmd 'zig check flags' "${flagsArray[@]}"
    zig build test "${flagsArray[@]}"

    runHook postCheck
@ -69,7 +49,7 @@ function zigInstallPhase {
        flagsArray+=("${prefixKey:---prefix}" "$prefix")
    fi

-    echoCmd 'install flags' "${flagsArray[@]}"
+    echoCmd 'zig install flags' "${flagsArray[@]}"
    zig build install "${flagsArray[@]}"

    runHook postInstall
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@ -221,9 +221,9 @@ in {
    inherit (pkgs.buildPackages) makeWrapper;
  };

-  sphinxHook = callPackage ({ makePythonHook, sphinx, installShellFiles }:
+  sphinxHook = callPackage ({ makePythonHook, installShellFiles }:
    makePythonHook {
      name = "python${python.pythonVersion}-sphinx-hook";
-      propagatedBuildInputs = [ sphinx installShellFiles ];
+      propagatedBuildInputs = [ pythonForBuild.pkgs.sphinx installShellFiles ];
    } ./sphinx-hook.sh) {};
 }
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@ -9,7 +9,7 @@
 , enableDebug ? false
 , enableSingleThreaded ? false
 , enableMultiThreaded ? true
-, enableShared ? !(with stdenv.hostPlatform; isStatic || libc == "msvcrt") # problems for now
+, enableShared ? !(with stdenv.hostPlatform; isStatic || isMinGW) # problems for now
 , enableStatic ? !enableShared
 , enablePython ? false
 , enableNumpy ? false
@ -91,7 +91,7 @@ let
    ++ lib.optional (!enablePython) "--without-python"
    ++ lib.optional needUserConfig "--user-config=user-config.jam"
    ++ lib.optional (stdenv.buildPlatform.isDarwin && stdenv.hostPlatform.isLinux) "pch=off"
-    ++ lib.optionals (stdenv.hostPlatform.libc == "msvcrt") [
+    ++ lib.optionals stdenv.hostPlatform.isMinGW [
    "threadapi=win32"
  ] ++ extraB2Args
  );
@ -259,7 +259,7 @@ stdenv.mkDerivation {
    # Make boost header paths relative so that they are not runtime dependencies
    cd "$dev" && find include \( -name '*.hpp' -or -name '*.h' -or -name '*.ipp' \) \
      -exec sed '1s/^\xef\xbb\xbf//;1i#line 1 "{}"' -i '{}' \;
-  '' + lib.optionalString (stdenv.hostPlatform.libc == "msvcrt") ''
+  '' + lib.optionalString stdenv.hostPlatform.isMinGW ''
    $RANLIB "$out/lib/"*.a
  '';

--- a/pkgs/development/libraries/libiconv/default.nix
+++ b/pkgs/development/libraries/libiconv/default.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
  ];

  postPatch =
-    lib.optionalString ((stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.libc == "msvcrt") || stdenv.cc.nativeLibc)
+    lib.optionalString ((stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.isMinGW) || stdenv.cc.nativeLibc)
      ''
        sed '/^_GL_WARN_ON_USE (gets/d' -i srclib/stdio.in.h
      ''
--- a/pkgs/development/libraries/libjpeg-turbo/default.nix
+++ b/pkgs/development/libraries/libjpeg-turbo/default.nix
@ -42,7 +42,7 @@ stdenv.mkDerivation rec {

  # This is needed by freeimage
  patches = [ ./0001-Compile-transupp.c-as-part-of-the-library.patch ]
-    ++ lib.optional (stdenv.hostPlatform.libc or null == "msvcrt")
+    ++ lib.optional stdenv.hostPlatform.isMinGW
    ./mingw-boolean.patch;

  outputs = [ "bin" "dev" "dev_private" "out" "man" "doc" ];
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@ -17,7 +17,7 @@
    (stdenv.hostPlatform == stdenv.buildPlatform || stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isWasi)
 , icuSupport ? false
 , icu
-, enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
+, enableShared ? !stdenv.hostPlatform.isMinGW && !stdenv.hostPlatform.isStatic
 , enableStatic ? !enableShared
 , gnome
 }:
--- a/pkgs/development/libraries/libzip/default.nix
+++ b/pkgs/development/libraries/libzip/default.nix
@ -17,11 +17,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libzip";
-  version = "1.10.0";
+  version = "1.10.1";

  src = fetchurl {
    url = "https://libzip.org/download/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-UqYLRhglh+CDtx4rgvyqumTdXrAcWx8bxxBpo4WOQP4=";
+    sha256 = "sha256-lmmuXf46xbOJdTbchGaodMjPLA47H90I11snOIQpk2M=";
  };

  outputs = [ "out" "dev" "man" ];
@ -50,6 +50,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = licenses.bsd3;
    pkgConfigModules = [ "libzip" ];
    platforms = platforms.unix;
-    changelog = "https://github.com/nih-at/libzip/blob/v${version}/NEWS.md";
+    changelog = "https://github.com/nih-at/libzip/blob/v${finalAttrs.version}/NEWS.md";
  };
 })
--- a/pkgs/development/libraries/nspr/default.nix
+++ b/pkgs/development/libraries/nspr/default.nix
@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  passthru.tests = {
-    inherit (nixosTests) firefox firefox-esr-102 firefox-esr-115;
+    inherit (nixosTests) firefox firefox-esr-115;
  };

  meta = with lib; {
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@ -182,9 +182,9 @@ stdenv.mkDerivation rec {
  passthru.updateScript = ./update.sh;

  passthru.tests = lib.optionalAttrs (lib.versionOlder version nss_latest.version) {
-    inherit (nixosTests) firefox-esr-102;
+    inherit (nixosTests) firefox-esr-115;
  } // lib.optionalAttrs (lib.versionAtLeast version nss_latest.version) {
-    inherit (nixosTests) firefox firefox-esr-115;
+    inherit (nixosTests) firefox;
  };

  meta = with lib; {
--- a/pkgs/development/libraries/openimageio/default.nix
+++ b/pkgs/development/libraries/openimageio/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "openimageio";
-  version = "2.4.14.0";
+  version = "2.4.15.0";

  src = fetchFromGitHub {
    owner = "OpenImageIO";
    repo = "oiio";
    rev = "v${version}";
-    hash = "sha256-iHXU3Zr32XNn2Q2Pn/sgF6E1q/FXbdmVrOKC4lhGx3k=";
+    hash = "sha256-I2/JPmUBDb0bw7qbSZcAkYHB2q2Uo7En7ZurMwWhg/M=";
  };

  outputs = [ "bin" "out" "dev" "doc" ];
--- a/pkgs/development/libraries/openssl/1.1/CVE-2023-4807.patch
+++ b/pkgs/development/libraries/openssl/1.1/CVE-2023-4807.patch
@ -0,0 +1,44 @@
+From 4bfac4471f53c4f74c8d81020beb938f92d84ca5 Mon Sep 17 00:00:00 2001
+From: Bernd Edlinger <bernd.edlinger@hotmail.de>
+Date: Tue, 22 Aug 2023 16:07:30 +0200
+Subject: [PATCH] Avoid clobbering non-volatile XMM registers
+
+This affects some Poly1305 assembler functions
+which are only used for certain CPU types.
+
+Remove those functions for Windows targets,
+as a simple interim solution.
+
+Fixes #21522
+
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+Reviewed-by: Paul Dale <pauli@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/21808)
+
+(cherry picked from commit 7b8e27bc2e02238986d89ef0ece067ec1b48e165)
+---
+ crypto/poly1305/asm/poly1305-x86_64.pl | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/crypto/poly1305/asm/poly1305-x86_64.pl b/crypto/poly1305/asm/poly1305-x86_64.pl
+index fa9bfb7a7b81..24bab9d0bcf9 100755
+--- a/crypto/poly1305/asm/poly1305-x86_64.pl
+++ b/crypto/poly1305/asm/poly1305-x86_64.pl
+@@ -195,7 +195,7 @@ sub poly1305_iteration {
+ 	bt	\$`5+32`,%r9		# AVX2?
+ 	cmovc	%rax,%r10
+ ___
+-$code.=<<___	if ($avx>3);
+$code.=<<___	if ($avx>3 && !$win64);
+ 	mov	\$`(1<<31|1<<21|1<<16)`,%rax
+ 	shr	\$32,%r9
+ 	and	%rax,%r9
+@@ -2724,7 +2724,7 @@ sub poly1305_iteration {
+ .cfi_endproc
+ .size	poly1305_blocks_avx512,.-poly1305_blocks_avx512
+ ___
+-if ($avx>3) {
+if ($avx>3 && !$win64) {
+ ########################################################################
+ # VPMADD52 version using 2^44 radix.
+ #
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@ -241,6 +241,9 @@ in {
    patches = [
      ./1.1/nix-ssl-cert-file.patch

+      # https://www.openssl.org/news/secadv/20230908.txt
+      ./1.1/CVE-2023-4807.patch
+
      (if stdenv.hostPlatform.isDarwin
       then ./use-etc-ssl-certs-darwin.patch
       else ./use-etc-ssl-certs.patch)
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
  setOutputFlags = false;
  outputDoc = "dev"; # single tiny man3 page

-  dontConfigure = stdenv.hostPlatform.libc == "msvcrt";
+  dontConfigure = stdenv.hostPlatform.isMinGW;

  preConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
    export CHOST=${stdenv.hostPlatform.config}
@ -96,7 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
  ''
    # Non-typical naming confuses libtool which then refuses to use zlib's DLL
    # in some cases, e.g. when compiling libpng.
-  + lib.optionalString (stdenv.hostPlatform.libc == "msvcrt" && shared) ''
+  + lib.optionalString (stdenv.hostPlatform.isMinGW && shared) ''
    ln -s zlib1.dll $out/bin/libz.dll
  '';

@ -109,7 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform && static;
  configurePlatforms = [];

-  installFlags = lib.optionals (stdenv.hostPlatform.libc == "msvcrt") [
+  installFlags = lib.optionals stdenv.hostPlatform.isMinGW [
    "BINARY_PATH=$(out)/bin"
    "INCLUDE_PATH=$(dev)/include"
    "LIBRARY_PATH=$(out)/lib"
@ -120,7 +120,7 @@ stdenv.mkDerivation (finalAttrs: {

  makeFlags = [
    "PREFIX=${stdenv.cc.targetPrefix}"
-  ] ++ lib.optionals (stdenv.hostPlatform.libc == "msvcrt") [
+  ] ++ lib.optionals stdenv.hostPlatform.isMinGW [
    "-f" "win32/Makefile.gcc"
  ] ++ lib.optionals shared [
    # Note that as of writing (zlib 1.2.11), this flag only has an effect
--- a/pkgs/development/misc/juce/default.nix
+++ b/pkgs/development/misc/juce/default.nix
@ -0,0 +1,69 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+
+# Native build inputs
+, cmake
+, pkg-config
+, makeWrapper
+
+# Dependencies
+, alsa-lib
+, freetype
+, curl
+, libglvnd
+, webkitgtk
+, pcre
+, darwin
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "juce";
+  version = "7.0.7";
+
+  src = fetchFromGitHub {
+    owner = "juce-framework";
+    repo = "juce";
+    rev = finalAttrs.version;
+    hash = "sha256-r+Wf/skPDexm3rsrVBoWrygKvV9HGlCQd7r0iHr9avM=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "juce-6.1.2-cmake_install.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/juce/-/raw/4e6d34034b102af3cd762a983cff5dfc09e44e91/juce-6.1.2-cmake_install.patch";
+      hash = "sha256-fr2K/dH0Zam5QKS63zos7eq9QLwdr+bvQL5ZxScagVU=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    freetype # libfreetype.so
+    curl # libcurl.so
+    stdenv.cc.cc.lib # libstdc++.so libgcc_s.so
+    pcre # libpcre2.pc
+  ] ++ lib.optionals stdenv.isLinux [
+    alsa-lib # libasound.so
+    libglvnd # libGL.so
+    webkitgtk # webkit2gtk-4.0
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk_11_0.frameworks.Cocoa
+    darwin.apple_sdk_11_0.frameworks.MetalKit
+    darwin.apple_sdk_11_0.frameworks.WebKit
+  ];
+
+  meta = with lib; {
+    description = "Cross-platform C++ application framework";
+    longDescription = "JUCE is an open-source cross-platform C++ application framework for desktop and mobile applications, including VST, VST3, AU, AUv3, RTAS and AAX audio plug-ins";
+    homepage = "https://github.com/juce-framework/JUCE";
+    license = with licenses; [ isc gpl3Plus ];
+    maintainers = with maintainers; [ kashw2 ];
+    platforms = platforms.all;
+  };
+})
--- a/pkgs/development/misc/resholve/README.md
+++ b/pkgs/development/misc/resholve/README.md
@ -44,7 +44,6 @@ Here's a simple example of how `resholve.mkDerivation` is already used in nixpkg
 { lib
 , fetchFromGitHub
 , resholve
-, substituteAll
 , bash
 , coreutils
 , goss
@ -154,7 +153,7 @@ that the `resholve` CLI expects. Here's an overview:
 |--------|------|------------|
 | scripts | `<list>` | scripts to resolve (`$out`-relative paths) |
 | interpreter | `"none"` `<path>` | The absolute interpreter `<path>` for the script's shebang. The special value `none` ensures there is no shebang. |
-| inputs | `<packages>` | Packages to resolve external dependencies from. |
+| inputs | `<packages>` `<paths>` | A list of packages and string paths to directories/files to resolve external dependencies from. |
 | fake | `<directives>` | pretend some commands exist |
 | fix | `<directives>` | fix things we can't auto-fix/ignore |
 | keep | `<directives>` | keep things we can't auto-fix/ignore |
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@ -57,6 +57,7 @@ mapAliases {
  inherit (pkgs) carto; # added 2023-08-17
  castnow = pkgs.castnow; # added 2023-07-30
  inherit (pkgs) clean-css-cli; # added 2023-08-18
+  inherit (pkgs) clubhouse-cli; # added 2023-08-18
  coc-imselect = throw "coc-imselect was removed because it was broken"; # added 2023-08-21
  coffee-script = pkgs.coffeescript; # added 2023-08-18
  inherit (pkgs) configurable-http-proxy; # added 2023-08-19
@ -95,6 +96,7 @@ mapAliases {
  node-inspector = throw "node-inspector was removed because it was broken"; # added 2023-08-21
  inherit (pkgs) npm-check-updates; # added 2023-08-22
  ocaml-language-server = throw "ocaml-language-server was removed because it was abandoned upstream"; # added 2023-09-04
+  parcel-bundler = parcel; # added 2023-09-04
  inherit (pkgs) react-static; # added 2023-08-21
  readability-cli = pkgs.readability-cli; # Added 2023-06-12
  reveal-md = pkgs.reveal-md; # added 2023-07-31
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@ -29,7 +29,6 @@
  cdk8s-cli = "cdk8s";
  cdktf-cli = "cdktf";
  clipboard-cli = "clipboard";
-  clubhouse-cli = "club";
  conventional-changelog-cli = "conventional-changelog";
  cpy-cli = "cpy";
  diff2html-cli = "diff2html";
@ -49,7 +48,6 @@
  lua-fmt = "luafmt";
  near-cli = "near";
  neovim = "neovim-node-host";
-  parcel-bundler = "parcel";
  parsoid = "parse.js";
  poor-mans-t-sql-formatter-cli = "sqlformat";
  postcss-cli = "postcss";
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -38,7 +38,6 @@
 , "cdk8s-cli"
 , "cdktf-cli"
 , "clipboard-cli"
-, "clubhouse-cli"
 , "coc-clangd"
 , "coc-cmake"
 , "coc-css"
@ -193,7 +192,6 @@
 , "npm-merge-driver"
 , "nrm"
 , "orval"
-, "parcel-bundler"
 , "parcel"
 , "parsoid"
 , "patch-package"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@ -256,13 +256,6 @@ final: prev: {
    '';
  };

-  parcel = prev.parcel.override {
-    buildInputs = [ final.node-gyp-build ];
-    preRebuild = ''
-      sed -i -e "s|#!/usr/bin/env node|#! ${nodejs}/bin/node|" node_modules/node-gyp-build/bin.js
-    '';
-  };
-
  pnpm = prev.pnpm.override {
    nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];

--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@ -1,5 +1,5 @@
 { lib, buildDunePackage, fetchurl
-, ppx_sexp_conv, ppx_cstruct
+, ppx_sexp_conv
 , mirage-crypto, mirage-crypto-ec, mirage-crypto-rng, mirage-crypto-pk
 , x509, cstruct, cstruct-unix, cstruct-sexp, sexplib, eqaf
 , rresult, mtime, logs, fmt, cmdliner, base64
@ -24,8 +24,6 @@ buildDunePackage rec {
    ppx_sexp_conv eqaf
  ];

-  buildInputs = [ ppx_cstruct ];
-
  doCheck = true;
  checkInputs = [ cstruct-unix cmdliner fmt ];

--- a/pkgs/development/ocaml-modules/ppx_tools/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_tools/default.nix
@ -35,6 +35,7 @@ let param =
  "4.13" = v6_6;
  "4.14" = v6_6;
  "5.0" = v6_6;
+  "5.1" = v6_6;
 }.${ocaml.meta.branch};
 in

--- a/pkgs/development/perl-modules/tk-configure-implicit-int-fix.patch
+++ b/pkgs/development/perl-modules/tk-configure-implicit-int-fix.patch
@ -0,0 +1,11 @@
+--- a/JPEG/jpeg/configure	2013-11-15 18:50:03.000000000 -0500
+++ b/JPEG/jpeg/configure	2023-09-05 23:36:12.675151164 -0400
+@@ -623,7 +623,7 @@
+ cat > conftest.$ac_ext <<EOF
+ #line 625 "configure"
+ #include "confdefs.h"
+-main(){return(0);}
+int main(){return(0);}
+ EOF
+ if { (eval echo configure:629: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest; then
+   ac_cv_prog_cc_works=yes
--- a/pkgs/development/php-packages/phalcon/default.nix
+++ b/pkgs/development/php-packages/phalcon/default.nix
@ -0,0 +1,27 @@
+{ buildPecl, lib, pcre2, fetchFromGitHub, php, pkg-config }:
+
+buildPecl rec {
+  pname = "phalcon";
+  version = "5.3.0";
+
+  src = fetchFromGitHub {
+    owner = "phalcon";
+    repo = "cphalcon";
+    rev = "v${version}";
+    hash = "sha256-82DJ+Qx0OYhw9Nv6FkAoyBec8WWfAiqNfBU9Ll/8RfA=";
+  };
+
+  internalDeps = [ php.extensions.session php.extensions.pdo ];
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ pcre2 ];
+
+  sourceRoot = "${src.name}/build/phalcon";
+
+  meta = with lib; {
+    description = "Phalcon is a full stack PHP framework offering low resource consumption and high performance.";
+    license = licenses.bsd3;
+    homepage = "https://phalcon.io";
+    maintainers = teams.php.members ++ [ maintainers.krzaczek ];
+  };
+}
--- a/Show More
+++ b/Show More