Merge staging-next into staging

2023-03-24 12:02:22 +00:00 · 2023-03-24 12:02:22 +00:00 · 9e6337ddc0
commit 9e6337ddc0
parent dcc576176c f2ead7fbda
144 changed files with 4351 additions and 2419 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -14178,6 +14178,16 @@
    githubId = 6277322;
    name = "Wei Tang";
  };
+  soywod = {
+    name = "Clément DOUIN";
+    email = "clement.douin@posteo.net";
+    matrix = "@soywod:matrix.org";
+    github = "soywod";
+    githubId = 10437171;
+    keys = [{
+      fingerprint = "75F0 AB7C FE01 D077 AEE6  CAFD 353E 4A18 EE0F AB72";
+    }];
+  };
  spacefrogg = {
    email = "spacefrogg-nixos@meterriblecrew.net";
    github = "spacefrogg";
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -187,6 +187,12 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The `services.pipewire.config` options have been removed, as they have basically never worked correctly. All behavior defined by the default configuration can be overridden with drop-in files as necessary - see [below](#sec-release-23.05-migration-pipewire) for details.

+- The catch-all `hardware.video.hidpi.enable` option was removed. Users on high density displays may want to:
+
+  - Set `services.xserver.upscaleDefaultCursor` to upscale the default X11 cursor for higher resolutions
+  - Adjust settings under `fonts.fontconfig` according to preference
+  - Adjust `console.font` according to preference, though the kernel will generally choose a reasonably sized font
+
 - `services.pipewire.media-session` and the `pipewire-media-session` package have been removed, as they are no longer supported upstream. Users are encouraged to use `services.pipewire.wireplumber` instead.

 - The `baget` package and module was removed due to being unmaintained.
@ -270,11 +276,6 @@ In addition to numerous new and upgraded packages, this release has the followin
    [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
    can be directly written as attribute-set in Nix within this option.

- The `hardware.video.hidpi.enable` was renamed to `fonts.optimizeForVeryHighDPI` to be consistent with what it actually does.
-  They disable by default: antialiasing, hinting and LCD filter for subpixel rendering. They can be overridden if you experience problems with font rendering.
-  On Xorg, the default cursor is upscaled.
-  Please see the documentation for the new option to decide if you want to keep it enabled.
-
 - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.

 - `services.grafana` listens only on localhost by default again. This was changed to upstreams default of `0.0.0.0` by accident in the freeform setting conversion.
@ -345,6 +346,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `k3s` can now be configured with an EnvironmentFile for its systemd service, allowing secrets to be provided without ending up in the Nix Store.

+- `boot.initrd.luks.device.<name>` has a new `tryEmptyPassphrase` option, this is useful for OEM's who need to install an encrypted disk with a future settable passphrase
+
 ## Detailed migration information {#sec-release-23.05-migration}

 ### Pipewire configuration overrides {#sec-release-23.05-migration-pipewire}
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@ -7,6 +7,19 @@ This module generates a package containing configuration files and link it in /e
 Fontconfig reads files in folder name / file name order, so the number prepended to the configuration file name decide the order of parsing.
 Low number means high priority.

+NOTE: Please take extreme care when adjusting the default settings of this module.
+People care a lot, and I mean A LOT, about their font rendering, and you will be
+The Person That Broke It if it changes in a way people don't like.
+
+See prior art:
+- https://github.com/NixOS/nixpkgs/pull/194594
+- https://github.com/NixOS/nixpkgs/pull/222236
+- https://github.com/NixOS/nixpkgs/pull/222689
+
+And do not repeat our mistakes.
+
+- @K900, March 2023
+
 */

 { config, pkgs, lib, ... }:
@ -218,6 +231,8 @@ let
    paths = cfg.confPackages;
    ignoreCollisions = true;
  };
+
+  fontconfigNote = "Consider manually configuring fonts.fontconfig according to personal preference.";
 in
 {
  imports = [
@ -229,6 +244,8 @@ in
    (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "dpi" ] "Use display server-specific options")
+    (mkRemovedOptionModule [ "hardware" "video" "hidpi" "enable" ] fontconfigNote)
+    (mkRemovedOptionModule [ "fonts" "optimizeForVeryHighDPI" ] fontconfigNote)
  ] ++ lib.forEach [ "enable" "substitutions" "preset" ]
     (opt: lib.mkRemovedOptionModule [ "fonts" "fontconfig" "ultimate" "${opt}" ] ''
       The fonts.fontconfig.ultimate module and configuration is obsolete.
--- a/nixos/modules/config/fonts/fonts.nix
+++ b/nixos/modules/config/fonts/fonts.nix
@ -13,13 +13,10 @@ let
      pkgs.unifont
      pkgs.noto-fonts-emoji
    ];
-
 in
-
 {
  imports = [
    (mkRemovedOptionModule [ "fonts" "enableCoreFonts" ] "Use fonts.fonts = [ pkgs.corefonts ]; instead.")
-    (mkRenamedOptionModule [ "hardware" "video" "hidpi" "enable" ] [ "fonts" "optimizeForVeryHighDPI" ])
  ];

  options = {
@ -42,33 +39,9 @@ in
          and families and reasonable coverage of Unicode.
        '';
      };
-
-      optimizeForVeryHighDPI = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Optimize configuration for very high-density (>200 DPI) displays:
-            - disable subpixel anti-aliasing
-            - disable hinting
-            - automatically upscale the default X11 cursor
-        '';
-      };
    };

  };

-  config = mkMerge [
-    { fonts.fonts = mkIf cfg.enableDefaultFonts defaultFonts; }
-    (mkIf cfg.optimizeForVeryHighDPI {
-      services.xserver.upscaleDefaultCursor = mkDefault true;
-      # Conforms to the recommendation in fonts/fontconfig.nix
-      # for > 200DPI.
-      fonts.fontconfig = {
-        antialias = mkDefault false;
-        hinting.enable = mkDefault false;
-        subpixel.lcdfilter = mkDefault "none";
-      };
-    })
-  ];
-
+  config = { fonts.fonts = mkIf cfg.enableDefaultFonts defaultFonts; };
 }
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@ -702,7 +702,20 @@ in {
              users.groups.${user.name} = {};
            '';
          }
-        ]
+        ] ++ (map (shell: {
+            assertion = (user.shell == pkgs.${shell}) -> (config.programs.${shell}.enable == true);
+            message = ''
+              users.users.${user.name}.shell is set to ${shell}, but
+              programs.${shell}.enable is not true. This will cause the ${shell}
+              shell to lack the basic nix directories in its PATH and might make
+              logging in as that user impossible. You can fix it with:
+              programs.${shell}.enable = true;
+            '';
+          }) [
+          "fish"
+          "xonsh"
+          "zsh"
+        ])
    ));

    warnings =
--- a/nixos/modules/services/logging/logrotate.nix
+++ b/nixos/modules/services/logging/logrotate.nix
@ -187,7 +187,7 @@ in
          A configuration file automatically generated by NixOS.
        '';
        description = lib.mdDoc ''
-          Override the configuration file used by MySQL. By default,
+          Override the configuration file used by logrotate. By default,
          NixOS generates one automatically from [](#opt-services.logrotate.settings).
        '';
        example = literalExpression ''
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@ -158,6 +158,20 @@ let
      wait_target "header" ${dev.header} || die "${dev.header} is unavailable"
    ''}

+    try_empty_passphrase() {
+        ${if dev.tryEmptyPassphrase then ''
+             echo "Trying empty passphrase!"
+             echo "" | ${csopen}
+             cs_status=$?
+             if [ $cs_status -eq 0 ]; then
+                 return 0
+             else
+                 return 1
+             fi
+        '' else "return 1"}
+    }
+
+
    do_open_passphrase() {
        local passphrase

@ -212,13 +226,27 @@ let
            ${csopen} --key-file=${dev.keyFile} \
              ${optionalString (dev.keyFileSize != null) "--keyfile-size=${toString dev.keyFileSize}"} \
              ${optionalString (dev.keyFileOffset != null) "--keyfile-offset=${toString dev.keyFileOffset}"}
+            cs_status=$?
+            if [ $cs_status -ne 0 ]; then
+              echo "Key File ${dev.keyFile} failed!"
+              if ! try_empty_passphrase; then
+                ${if dev.fallbackToPassword then "echo" else "die"} "${dev.keyFile} is unavailable"
+                echo " - failing back to interactive password prompt"
+                do_open_passphrase
+              fi
+            fi
        else
-            ${if dev.fallbackToPassword then "echo" else "die"} "${dev.keyFile} is unavailable"
-            echo " - failing back to interactive password prompt"
-            do_open_passphrase
+            # If the key file never shows up we should also try the empty passphrase
+            if ! try_empty_passphrase; then
+               ${if dev.fallbackToPassword then "echo" else "die"} "${dev.keyFile} is unavailable"
+               echo " - failing back to interactive password prompt"
+               do_open_passphrase
+            fi
        fi
        '' else ''
-        do_open_passphrase
+           if ! try_empty_passphrase; then
+              do_open_passphrase
+           fi
        ''}
    }

@ -476,6 +504,7 @@ let
  preLVM = filterAttrs (n: v: v.preLVM) luks.devices;
  postLVM = filterAttrs (n: v: !v.preLVM) luks.devices;

+
  stage1Crypttab = pkgs.writeText "initrd-crypttab" (lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: let
    opts = v.crypttabExtraOpts
      ++ optional v.allowDiscards "discard"
@ -483,6 +512,8 @@ let
      ++ optional (v.header != null) "header=${v.header}"
      ++ optional (v.keyFileOffset != null) "keyfile-offset=${toString v.keyFileOffset}"
      ++ optional (v.keyFileSize != null) "keyfile-size=${toString v.keyFileSize}"
+      ++ optional (v.keyFileTimeout != null) "keyfile-timeout=${builtins.toString v.keyFileTimeout}s"
+      ++ optional (v.tryEmptyPassphrase) "try-empty-password=true"
    ;
  in "${n} ${v.device} ${if v.keyFile == null then "-" else v.keyFile} ${lib.concatStringsSep "," opts}") luks.devices));

@ -594,6 +625,25 @@ in
            '';
          };

+          tryEmptyPassphrase = mkOption {
+            default = false;
+            type = types.bool;
+            description = lib.mdDoc ''
+              If keyFile fails then try an empty passphrase first before
+              prompting for password.
+            '';
+          };
+
+          keyFileTimeout = mkOption {
+            default = null;
+            example = 5;
+            type = types.nullOr types.int;
+            description = lib.mdDoc ''
+              The amount of time in seconds for a keyFile to appear before
+              timing out and trying passwords.
+            '';
+          };
+
          keyFileSize = mkOption {
            default = null;
            example = 4096;
@ -889,6 +939,10 @@ in
          message = "boot.initrd.luks.devices.<name>.bypassWorkqueues is not supported for kernels older than 5.9";
        }

+        { assertion = !config.boot.initrd.systemd.enable -> all (x: x.keyFileTimeout == null) (attrValues luks.devices);
+          message = "boot.initrd.luks.devices.<name>.keyFileTimeout is only supported for systemd initrd";
+        }
+
        { assertion = config.boot.initrd.systemd.enable -> all (dev: !dev.fallbackToPassword) (attrValues luks.devices);
          message = "boot.initrd.luks.devices.<name>.fallbackToPassword is implied by systemd stage 1.";
        }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -311,6 +311,7 @@ in {
  influxdb = handleTest ./influxdb.nix {};
  initrd-network-openvpn = handleTest ./initrd-network-openvpn {};
  initrd-network-ssh = handleTest ./initrd-network-ssh {};
+  initrd-luks-empty-passphrase = handleTest ./initrd-luks-empty-passphrase.nix {};
  initrdNetwork = handleTest ./initrd-network.nix {};
  initrd-secrets = handleTest ./initrd-secrets.nix {};
  initrd-secrets-changing = handleTest ./initrd-secrets-changing.nix {};
@ -662,6 +663,7 @@ in {
  systemd-initrd-btrfs-raid = handleTest ./systemd-initrd-btrfs-raid.nix {};
  systemd-initrd-luks-fido2 = handleTest ./systemd-initrd-luks-fido2.nix {};
  systemd-initrd-luks-keyfile = handleTest ./systemd-initrd-luks-keyfile.nix {};
+  systemd-initrd-luks-empty-passphrase = handleTest ./initrd-luks-empty-passphrase.nix { systemdStage1 = true; };
  systemd-initrd-luks-password = handleTest ./systemd-initrd-luks-password.nix {};
  systemd-initrd-luks-tpm2 = handleTest ./systemd-initrd-luks-tpm2.nix {};
  systemd-initrd-modprobe = handleTest ./systemd-initrd-modprobe.nix {};
--- a/nixos/tests/initrd-luks-empty-passphrase.nix
+++ b/nixos/tests/initrd-luks-empty-passphrase.nix
@ -0,0 +1,97 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. {inherit system config; }
+, systemdStage1 ? false }:
+import ./make-test-python.nix ({ lib, pkgs, ... }: let
+
+  keyfile = pkgs.writeText "luks-keyfile" ''
+    MIGHAoGBAJ4rGTSo/ldyjQypd0kuS7k2OSsmQYzMH6TNj3nQ/vIUjDn7fqa3slt2
+    gV6EK3TmTbGc4tzC1v4SWx2m+2Bjdtn4Fs4wiBwn1lbRdC6i5ZYCqasTWIntWn+6
+    FllUkMD5oqjOR/YcboxG8Z3B5sJuvTP9llsF+gnuveWih9dpbBr7AgEC
+  '';
+
+in {
+  name = "initrd-luks-empty-passphrase";
+
+  nodes.machine = { pkgs, ... }: {
+    virtualisation = {
+      emptyDiskImages = [ 512 ];
+      useBootLoader = true;
+      useEFIBoot = true;
+    };
+
+    boot.loader.systemd-boot.enable = true;
+    boot.initrd.systemd = lib.mkIf systemdStage1 {
+      enable = true;
+      emergencyAccess = true;
+    };
+    environment.systemPackages = with pkgs; [ cryptsetup ];
+
+    specialisation.boot-luks-wrong-keyfile.configuration = {
+      boot.initrd.luks.devices = lib.mkVMOverride {
+        cryptroot = {
+          device = "/dev/vdc";
+          keyFile = "/etc/cryptroot.key";
+          tryEmptyPassphrase = true;
+          fallbackToPassword = !systemdStage1;
+        };
+      };
+      virtualisation.bootDevice = "/dev/mapper/cryptroot";
+      boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
+    };
+
+    specialisation.boot-luks-missing-keyfile.configuration = {
+      boot.initrd.luks.devices = lib.mkVMOverride {
+        cryptroot = {
+          device = "/dev/vdc";
+          keyFile = "/etc/cryptroot.key";
+          tryEmptyPassphrase = true;
+          fallbackToPassword = !systemdStage1;
+        };
+      };
+      virtualisation.bootDevice = "/dev/mapper/cryptroot";
+    };
+  };
+
+  testScript = ''
+    # Encrypt key with empty key so boot should try keyfile and then fallback to empty passphrase
+
+
+    def grub_select_boot_luks_wrong_key_file():
+        """
+        Selects "boot-luks" from the GRUB menu
+        to trigger a login request.
+        """
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey ret")
+
+    def grub_select_boot_luks_missing_key_file():
+        """
+        Selects "boot-luks" from the GRUB menu
+        to trigger a login request.
+        """
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey ret")
+
+    # Create encrypted volume
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("echo "" | cryptsetup luksFormat /dev/vdc --batch-mode")
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-wrong-keyfile.conf")
+    machine.succeed("sync")
+    machine.crash()
+
+    # Check if rootfs is on /dev/mapper/cryptroot
+    machine.wait_for_unit("multi-user.target")
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+
+    # Choose boot-luks-missing-keyfile specialisation
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-missing-keyfile.conf")
+    machine.succeed("sync")
+    machine.crash()
+
+    # Check if rootfs is on /dev/mapper/cryptroot
+    machine.wait_for_unit("multi-user.target")
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+  '';
+})
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "lsp-plugins";
-  version = "1.2.5";
+  version = "1.2.6";

  src = fetchurl {
    url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
+    sha256 = "sha256-lNrIsXW3ZNKMFwsl5qowWqK/ZaCaQUAlrSscnsOxvVg=";
  };

  outputs = [ "out" "dev" "doc" ];
@ -19,6 +19,8 @@ stdenv.mkDerivation rec {

  makeFlags = [
    "PREFIX=${placeholder "out"}"
+    "ETCDIR=${placeholder "out"}/etc"
+    "SHAREDDIR=${placeholder "out"}/share"
  ];

  env.NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
@ -34,138 +36,58 @@ stdenv.mkDerivation rec {
  meta = with lib;
    { description = "Collection of open-source audio plugins";
      longDescription = ''
-        Compatible with follwing formats:
+        Compatible with the following formats:

+        - CLAP - set of plugins for Clever Audio Plugins API
        - LADSPA - set of plugins for Linux Audio Developer's Simple Plugin API
        - LV2 - set of plugins and UIs for Linux Audio Developer's Simple Plugin API (LADSPA) version 2
        - LinuxVST - set of plugins and UIs for Steinberg's VST 2.4 format ported on GNU/Linux Platform
        - JACK - Standalone versions for JACK Audio connection Kit with UI

-        Contains the following plugins:
+        Contains the following plugins (https://lsp-plug.in/?page=plugins)

-        - Limiter Mono - Begrenzer Mono
-        - Limiter Stereo - Begrenzer Stereo
-        - Dynamic Processor LeftRight - Dynamikprozessor LeftRight
-        - Dynamic Processor MidSide - Dynamikprozessor MidSide
-        - Dynamic Processor Mono - Dynamikprozessor Mono
-        - Dynamic Processor Stereo - Dynamikprozessor Stereo
-        - Expander LeftRight - Expander LeftRight
-        - Expander MidSide - Expander MidSide
-        - Expander Mono - Expander Mono
-        - Expander Stereo - Expander Stereo
-        - Crossover LeftRight x8 - Frequenzweiche LeftRight x8
-        - Crossover MidSide x8 - Frequenzweiche MidSide x8
-        - Crossover Mono x8 - Frequenzweiche Mono x8
-        - Crossover Stereo x8 - Frequenzweiche Stereo x8
-        - Gate LeftRight - Gate LeftRight
-        - Gate MidSide - Gate MidSide
-        - Gate Mono - Gate Mono
-        - Gate Stereo - Gate Stereo
-        - Graphic Equalizer x16 LeftRight - Grafischer Entzerrer x16 LeftRight
-        - Graphic Equalizer x16 MidSide - Grafischer Entzerrer x16 MidSide
-        - Graphic Equalizer x16 Mono - Grafischer Entzerrer x16 Mono
-        - Graphic Equalizer x16 Stereo - Grafischer Entzerrer x16 Stereo
-        - Graphic Equalizer x32 LeftRight - Grafischer Entzerrer x32 LeftRight
-        - Graphic Equalizer x32 MidSide - Grafischer Entzerrer x32 MidSide
-        - Graphic Equalizer x32 Mono - Grafischer Entzerrer x32 Mono
-        - Graphic Equalizer x32 Stereo - Grafischer Entzerrer x32 Stereo
-        - Impulse Responses Mono - Impulsantworten Mono
-        - Impulse Responses Stereo - Impulsantworten Stereo
-        - Impulse Reverb Mono - Impulsnachhall Mono
-        - Impulse Reverb Stereo - Impulsnachhall Stereo
-        - Sampler Mono - Klangerzeuger Mono
-        - Sampler Stereo - Klangerzeuger Stereo
-        - Compressor LeftRight - Kompressor LeftRight
-        - Compressor MidSide - Kompressor MidSide
-        - Compressor Mono - Kompressor Mono
-        - Compressor Stereo - Kompressor Stereo
-        - Artistic Delay Mono - Künstlerische Verzögerung
-        - Artistic Delay Stereo - Künstlerische Verzögerung
-        - Latency Meter - Latenzmessgerät
-        - Loudness Compensator Mono - Lautstärke Kompensator Mono
-        - Loudness Compensator Stereo - Lautstärke Kompensator Stereo
-        - Multiband Expander LeftRight x8 - Multi-band Expander LeftRight x8
-        - Multiband Expander MidSide x8 - Multi-band Expander MidSide x8
-        - Multiband Expander Mono x8 - Multi-band Expander Mono x8
-        - Multiband Expander Stereo x8 - Multi-band Expander Stereo x8
-        - Multiband Gate LeftRight x8 - Multi-band Gate LeftRight x8
-        - Multiband Gate MidSide x8 - Multi-band Gate MidSide x8
-        - Multiband Gate Mono x8 - Multi-band Gate Mono x8
-        - Multiband Gate Stereo x8 - Multi-band Gate Stereo x8
-        - Multiband Compressor LeftRight x8 - Multi-band Kompressor LeftRight x8
-        - Multiband Compressor MidSide x8 - Multi-band Kompressor MidSide x8
-        - Multiband Compressor Mono x8 - Multi-band Kompressor Mono x8
-        - Multiband Compressor Stereo x8 - Multi-band Kompressor Stereo x8
-        - Oscilloscope x1 - Oscilloscope x1
-        - Oscilloscope x2 - Oscilloscope x2
-        - Oscilloscope x4 - Oscilloscope x4
-        - Oscillator Mono - Oszillator Mono
-        - Parametric Equalizer x16 LeftRight - Parametrischer Entzerrer x16 LeftRight
-        - Parametric Equalizer x16 MidSide - Parametrischer Entzerrer x16 MidSide
-        - Parametric Equalizer x16 Mono - Parametrischer Entzerrer x16 Mono
-        - Parametric Equalizer x16 Stereo - Parametrischer Entzerrer x16 Stereo
-        - Parametric Equalizer x32 LeftRight - Parametrischer Entzerrer x32 LeftRight
-        - Parametric Equalizer x32 MidSide - Parametrischer Entzerrer x32 MidSide
-        - Parametric Equalizer x32 Mono - Parametrischer Entzerrer x32 Mono
-        - Parametric Equalizer x32 Stereo - Parametrischer Entzerrer x32 Stereo
-        - Phase Detector - Phasendetektor
-        - Profiler Mono - Profiler Mono
-        - Profiler Stereo - Profiler Stereo
-        - Room Builder Mono - Raumbaumeister Mono
-        - Room Builder Stereo - Raumbaumeister Stereo
-        - Multi-Sampler x12 DirectOut - Schlagzeug x12 Direktausgabe
-        - Multi-Sampler x12 Stereo - Schlagzeug x12 Stereo
-        - Multi-Sampler x24 DirectOut - Schlagzeug x24 Direktausgabe
-        - Multi-Sampler x24 Stereo - Schlagzeug x24 Stereo
-        - Multi-Sampler x48 DirectOut - Schlagzeug x48 Direktausgabe
-        - Multi-Sampler x48 Stereo - Schlagzeug x48 Stereo
-        - Sidechain Multiband Expander LeftRight x8 - Sidechain Multi-band Expander LeftRight x8
-        - Sidechain Multiband Expander MidSide x8 - Sidechain Multi-band Expander MidSide x8
-        - Sidechain Multiband Expander Mono x8 - Sidechain Multi-band Expander Mono x8
-        - Sidechain Multiband Expander Stereo x8 - Sidechain Multi-band Expander Stereo x8
-        - Sidechain Multiband Gate LeftRight x8 - Sidechain Multi-band Gate LeftRight x8
-        - Sidechain Multiband Gate MidSide x8 - Sidechain Multi-band Gate MidSide x8
-        - Sidechain Multiband Gate Mono x8 - Sidechain Multi-band Gate Mono x8
-        - Sidechain Multiband Gate Stereo x8 - Sidechain Multi-band Gate Stereo x8
-        - Sidechain Multiband Compressor LeftRight x8 - Sidechain Multi-band Kompressor LeftRight x8
-        - Sidechain Multiband Compressor MidSide x8 - Sidechain Multi-band Kompressor MidSide x8
-        - Sidechain Multiband Compressor Mono x8 - Sidechain Multi-band Kompressor Mono x8
-        - Sidechain Multiband Compressor Stereo x8 - Sidechain Multi-band Kompressor Stereo x8
-        - Sidechain Limiter Mono - Sidechain-Begrenzer Mono
-        - Sidechain Limiter Stereo - Sidechain-Begrenzer Stereo
-        - Sidechain Dynamic Processor LeftRight - Sidechain-Dynamikprozessor LeftRight
-        - Sidechain Dynamic Processor MidSide - Sidechain-Dynamikprozessor MidSide
-        - Sidechain Dynamic Processor Mono - Sidechain-Dynamikprozessor Mono
-        - Sidechain Dynamic Processor Stereo - Sidechain-Dynamikprozessor Stereo
-        - Sidechain Expander LeftRight - Sidechain-Expander LeftRight
-        - Sidechain Expander MidSide - Sidechain-Expander MidSide
-        - Sidechain Expander Mono - Sidechain-Expander Mono
-        - Sidechain Expander Stereo - Sidechain-Expander Stereo
-        - Sidechain Gate LeftRight - Sidechain-Gate LeftRight
-        - Sidechain Gate MidSide - Sidechain-Gate MidSide
-        - Sidechain Gate Mono - Sidechain-Gate Mono
-        - Sidechain Gate Stereo - Sidechain-Gate Stereo
-        - Sidechain Compressor LeftRight - Sidechain-Kompressor LeftRight
-        - Sidechain Compressor MidSide - Sidechain-Kompressor MidSide
-        - Sidechain Compressor Mono - Sidechain-Kompressor Mono
-        - Sidechain Compressor Stereo - Sidechain-Kompressor Stereo
-        - Slapback Delay Mono - Slapback-Delay Mono
-        - Slapback Delay Stereo - Slapback-Delay Stereo
-        - Spectrum Analyzer x1 - Spektrumanalysator x1
-        - Spectrum Analyzer x12 - Spektrumanalysator x12
-        - Spectrum Analyzer x16 - Spektrumanalysator x16
-        - Spectrum Analyzer x2 - Spektrumanalysator x2
-        - Spectrum Analyzer x4 - Spektrumanalysator x4
-        - Spectrum Analyzer x8 - Spektrumanalysator x8
-        - Surge Filter Mono - Sprungfilter Mono
-        - Surge Filter Stereo - Sprungfilter Stereo
-        - Trigger MIDI Mono - Triggersensor MIDI Mono
-        - Trigger MIDI Stereo - Triggersensor MIDI Stereo
-        - Trigger Mono - Triggersensor Mono
-        - Trigger Stereo - Triggersensor Stereo
-        - Delay Compensator Mono - Verzögerungsausgleicher Mono
-        - Delay Compensator Stereo - Verzögerungsausgleicher Stereo
-        - Delay Compensator x2 Stereo - Verzögerungsausgleicher x2 Stereo
+        Equalizers:
+        - Graphic Equalizer
+        - Parametric Equalizer
+        Dynamic Processing:
+        - Compressor
+        - Dynamic Processor
+        - Expander
+        - Gate
+        - Limiter
+        Multiband Dynamic Processing:
+        - Multiband Compressor
+        - Multiband Dynamic Processor
+        - Multiband Expander
+        - Multiband Gate
+        Convolution / Reverb processing:
+        - Impulse Responses
+        - Impulse Reverb
+        - Room Builder
+        Delay Effects:
+        - Artistic Delay
+        - Compensation Delay
+        - Slap-back Delay
+        Analyzers:
+        - Oscilloscope
+        - Phase Detector
+        - Spectrum Analyzer
+        Multiband Processing:
+        - Crossover
+        Samplers:
+        - Multisampler
+        - Sampler
+        Generators / Oscillators:
+        - Noise Generator
+        - Oscillator
+        Utilitary Plugins:
+        - A/B Test Plugin
+        - Latency Meter
+        - Loudness Compensator
+        - Mixer
+        - Profiler
+        - Surge Filter
+        - Trigger
      '';
      homepage = "https://lsp-plug.in";
      maintainers = with maintainers; [ magnetophon ];
--- a/pkgs/applications/audio/noisetorch/default.nix
+++ b/pkgs/applications/audio/noisetorch/default.nix
@ -2,21 +2,21 @@

 buildGoModule rec {
  pname = "NoiseTorch";
-  version = "0.12.0";
+  version = "0.12.2";

  src = fetchFromGitHub {
    owner = "noisetorch";
    repo = "NoiseTorch";
    rev = "v${version}";
-    sha256 = "sha256-A6cX1ck47/ZIn9cnV/Ow4CxVFfOX5J0K0Q+B70jCFdQ=";
    fetchSubmodules = true;
+    sha256 = "sha256-gOPSMPH99Upi/30OnAdwSb7SaMV0i/uHB051cclfz6A=";
  };

  vendorHash = null;

  doCheck = false;

-  ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.distribution=nix" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.distribution=nixpkgs" ];

  subPackages = [ "." ];

@ -32,9 +32,6 @@ buildGoModule rec {
  '';

  meta = with lib; {
-    insecure = true;
-    knownVulnerabilities =
-      lib.optional (lib.versionOlder version "0.12") "https://github.com/noisetorch/NoiseTorch/releases/tag/v0.12.0";
    description = "Virtual microphone device with noise supression for PulseAudio";
    homepage = "https://github.com/noisetorch/NoiseTorch";
    license = licenses.gpl3Plus;
--- a/pkgs/applications/audio/sonic-lineup/default.nix
+++ b/pkgs/applications/audio/sonic-lineup/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, alsa-lib, boost, bzip2, fftw, fftwFloat, libfishsound
+{ lib, stdenv, fetchurl, fetchpatch2, alsa-lib, boost, bzip2, fftw, fftwFloat, libfishsound
 , libid3tag, liblo, libmad, liboggz, libpulseaudio, libsamplerate
 , libsndfile, lrdf, opusfile, portaudio, rubberband, serd, sord, capnproto
 , wrapQtAppsHook, pkg-config
@ -14,6 +14,16 @@ stdenv.mkDerivation rec {
    sha256 = "0k45k9fawcm4s5yy05x00pgww7j8m7k2cxcc7g0fn9vqy7vcbq9h";
  };

+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/sonic-visualiser/svcore/commit/5a7b517e43b7f0b3f03b7fc3145102cf4e5b0ffc.patch";
+      stripLen = 1;
+      extraPrefix = "svcore/";
+      sha256 = "sha256-DOCdQqCihkR0g/6m90DbJxw00QTpyVmFzCxagrVWKiI=";
+    })
+    ./match-vamp.patch
+  ];
+
  buildInputs =
    [ alsa-lib boost bzip2 fftw fftwFloat libfishsound libid3tag liblo
      libmad liboggz libpulseaudio libsamplerate libsndfile lrdf opusfile
@ -36,7 +46,5 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2Plus;
    maintainers = [ maintainers.vandenoever ];
    platforms = platforms.linux;
-    # undefined reference to `std::__throw_bad_array_new_length()@GLIBCXX_3.4.29'
-    broken = true; # at 2022-09-30
  };
 }
--- a/pkgs/applications/audio/sonic-lineup/match-vamp.patch
+++ b/pkgs/applications/audio/sonic-lineup/match-vamp.patch
@ -0,0 +1,11 @@
+--- a/match/src/FullDTW.h
+++ b/match/src/FullDTW.h
+@@ -83,7 +83,7 @@
+      * against the best-matching subsequence of s1; otherwise it is
+      * against the whole of s1.
+      */
+-    std::vector<size_t> align(const featureseq_t &s1,
+    std::vector<std::size_t> align(const featureseq_t &s1,
+                               const featureseq_t &s2);
+ 
+ private:
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -69,6 +69,17 @@
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-bash";
  };
+  bass = buildGrammar {
+    language = "bass";
+    version = "27f110d";
+    src = fetchFromGitHub {
+      owner = "amaanq";
+      repo = "tree-sitter-bass";
+      rev = "27f110dfe79620993f5493ffa0d0f2fe12d250ed";
+      hash = "sha256-OmYtp2TAsAjw2fgdSezHUrP46b/QXgCbDeJa4ANrtvY=";
+    };
+    meta.homepage = "https://github.com/amaanq/tree-sitter-bass";
+  };
  beancount = buildGrammar {
    language = "beancount";
    version = "f3741a3";
@ -590,12 +601,12 @@
  };
  glimmer = buildGrammar {
    language = "glimmer";
-    version = "40cfb72";
+    version = "bc1c685";
    src = fetchFromGitHub {
      owner = "alexlafroscia";
      repo = "tree-sitter-glimmer";
-      rev = "40cfb72a53654cbd666451ca04ffd500257c7b73";
-      hash = "sha256-h9ZZz6mbkErLIG/BamNRRoRdqmuBO3v17W0uvmpbm7A=";
+      rev = "bc1c685aa6a7caf9e58c5746ab386a1e673eb9af";
+      hash = "sha256-CDXyynCsnmOvOs1rs9e29tNHosywTvGM0UyWVtwMqZ8=";
    };
    meta.homepage = "https://github.com/alexlafroscia/tree-sitter-glimmer";
  };
@ -1597,12 +1608,12 @@
  };
  sql = buildGrammar {
    language = "sql";
-    version = "4cb5b36";
+    version = "d2b64d8";
    src = fetchFromGitHub {
      owner = "derekstride";
      repo = "tree-sitter-sql";
-      rev = "4cb5b36d70687bfe4687c68483b4dacde309ae6f";
-      hash = "sha256-7YkVPuQS8NGcHXHwgFTZ4kWL01AnNeOGxdY8xFISSzY=";
+      rev = "d2b64d85d0cab5edeffe44243134033e6ff07c02";
+      hash = "sha256-Mo87yEF0YGF9t+bXvxuULtlOWAFKyBDjU6rF6eOXLao=";
    };
    meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
  };
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -5,6 +5,7 @@
 , buildGoModule
 , buildVimPluginFrom2Nix
 , fetchFromGitHub
+, fetchFromSourcehut
 , fetchpatch
 , fetchurl
 , substituteAll
@ -496,12 +497,13 @@ self: super: {
  });

  himalaya-vim = super.himalaya-vim.overrideAttrs (old: {
-    postPatch = ''
-      substituteInPlace plugin/himalaya.vim \
-        --replace "if !executable('himalaya')" "if v:false"
-      substituteInPlace autoload/himalaya/request.vim \
-        --replace "'himalaya" "'${himalaya}/bin/himalaya"
-    '';
+    buildInputs = [ himalaya ];
+    src = fetchFromSourcehut {
+      owner = "~soywod";
+      repo = "himalaya-vim";
+      rev = "v${himalaya.version}";
+      sha256 = "W+91hnNeS6WkDiR9r1s7xPTK9JlCWiVkI/nXVYbepY0=";
+    };
  });

  jedi-vim = super.jedi-vim.overrideAttrs (old: {
@ -793,7 +795,7 @@ self: super: {
        pname = "sg-nvim-rust";
        inherit (old) version src;

-        cargoHash = "sha256-z3ZWHhqiJKFzVcFJadfPU6+ELlnvEOAprCyStszegdI=";
+        cargoHash = "sha256-GN7KM3fkeOcqmyUwsPMw499kS/eYqh8pbyPgMv4/NN4=";

        nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -324,6 +324,7 @@ https://github.com/cocopon/iceberg.vim/,,
 https://github.com/idris-hackers/idris-vim/,,
 https://github.com/edwinb/idris2-vim/,,
 https://github.com/lewis6991/impatient.nvim/,,
+https://github.com/smjonas/inc-rename.nvim/,HEAD,
 https://github.com/nishigori/increment-activator/,,
 https://github.com/haya14busa/incsearch-easymotion.vim/,,
 https://github.com/haya14busa/incsearch.vim/,,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2953,6 +2953,24 @@ let
        };
      };

+      vscjava.vscode-gradle = buildVscodeMarketplaceExtension rec {
+        mktplcRef = {
+          name = "vscode-gradle";
+          publisher = "vscjava";
+          version = "3.12.6";
+          sha256 = "sha256-j4JyhNGsRlJmS8Wj38gLpC1gXVvdPx10cgzP8dXmmNo=";
+        };
+
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/vscjava.vscode-gradle/changelog";
+          description = "A Visual Studio Code extension for Gradle build tool";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=vscjava.vscode-gradle";
+          homepage = "https://github.com/microsoft/vscode-gradle";
+          license = lib.licenses.mit;
+          maintainers = with lib.maintainers; [ rhoriguchi ];
+        };
+      };
+
      vscjava.vscode-java-debug = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "vscode-java-debug";
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@ -18,7 +18,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "komikku";
-  version = "1.15.0";
+  version = "1.16.0";

  format = "other";

@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "valos";
    repo = "Komikku";
    rev = "v${version}";
-    hash = "sha256-dmi8a9Gf4ixq5oW6ewDGZYRmxY2qmUrD42DfjskRpHk=";
+    hash = "sha256-SzK86uzdGnNFNtbvw56n3AxjxcCBjHFs9wD98TVggAo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/pick-colour-picker/default.nix
+++ b/pkgs/applications/graphics/pick-colour-picker/default.nix
@ -22,6 +22,11 @@ buildPythonPackage rec {
    fetchSubmodules = false;
  };

+  postPatch = ''
+    sed "s|sys\.prefix|'\.'|g" -i setup.py
+    sed "s|os.environ.get('SNAP'), \"usr\"|'$out'|g" -i pick/__main__.py
+  '';
+
  nativeBuildInputs = [
    gobject-introspection
    wrapGAppsHook
@ -37,16 +42,6 @@ buildPythonPackage rec {
    gtk3
  ];

-  preDistPhases = [ "fixupIconPath" ];
-
-  fixupIconPath = ''
-    pickLoc="$out/${python.sitePackages}/pick"
-    shareLoc=$(echo "$out/${python.sitePackages}/nix/store/"*)
-    mv "$shareLoc/share" "$out/share"
-
-    sed "s|os.environ.get('SNAP'), \"usr\"|'$out'|g" -i "$pickLoc/__main__.py"
-    '';
-
  meta = with lib; {
    homepage = "https://kryogenix.org/code/pick/";
    license = licenses.mit;
--- a/pkgs/applications/misc/ttdl/default.nix
+++ b/pkgs/applications/misc/ttdl/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ttdl";
-  version = "3.6.5";
+  version = "3.7.0";

  src = fetchFromGitHub {
    owner = "VladimirMarkelov";
    repo = "ttdl";
    rev = "v${version}";
-    sha256 = "sha256-mplV++N+us6IntNJsZoH4yyKZ8eYplUYuVJeac0ZIkQ=";
+    sha256 = "sha256-4XmOFoj2kynQZzos/vf0rciJCGfnFLN7f1MG9NU53os=";
  };

-  cargoHash = "sha256-mgvMQjScXCmr3HIQtGJ2YWRUhiSP5resL96LUCe8D+c=";
+  cargoHash = "sha256-9TyEHAlxTNx/ildlqEjuFIKfmUQQFQSVoxcrb2Tg9Ps=";

  meta = with lib; {
    description = "A CLI tool to manage todo lists in todo.txt format";
--- a/pkgs/applications/misc/veracrypt/default.nix
+++ b/pkgs/applications/misc/veracrypt/default.nix
@ -12,6 +12,7 @@
 , exfat
 , ntfs3g
 , btrfs-progs
+, wrapGAppsHook
 }:

 stdenv.mkDerivation rec {
@ -37,7 +38,7 @@ stdenv.mkDerivation rec {

  sourceRoot = "src";

-  nativeBuildInputs = [ makeself pkg-config yasm ];
+  nativeBuildInputs = [ makeself pkg-config yasm wrapGAppsHook ];
  buildInputs = [ fuse lvm2 wxGTK ];

  enableParallelBuilding = true;
--- a/pkgs/applications/misc/watchmate/default.nix
+++ b/pkgs/applications/misc/watchmate/default.nix
@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "watchmate";
-  version = "0.4.3";
+  version = "0.4.4";

  src = fetchFromGitHub {
    owner = "azymohliad";
    repo = "watchmate";
    rev = "v${version}";
-    hash = "sha256-LwtlI6WCOO24w8seUzyhCp51pfEiCM+iL6lu/J6v4PQ=";
+    hash = "sha256-+E1tyDfFSu3J89fXd75bdYxh+Z1zTwKL6AmMTNQBEYY=";
  };

-  cargoHash = "sha256-MD0eWZDpCevBY1Y3Gzgk13qCFtL7QOPDATv8MA+Q5go=";
+  cargoHash = "sha256-xfgO2MInUAidgqN1B7byMIzHD19IzbnBvRMo7Ir10hk=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -1,8 +1,8 @@
 {
  "stable": {
-    "version": "111.0.5563.64",
-    "sha256": "0x20zqwq051a5j76q1c3m0ddf1hhcm6fgz3b7rqrfamjppia0p3x",
-    "sha256bin64": "0rnqrjnybghb4h413cw3f54ga2x76mfmf1fp2nnf59c1yml4r4vf",
+    "version": "111.0.5563.110",
+    "sha256": "0rd7hxa02dy64xwhkwk8v71hqmbvyzcnqldvxpvdr8khn5rnrpa9",
+    "sha256bin64": "18ph8di5g235jrsc0xpwf58f2sx2mmaz25g1921d3fqva8s1vri0",
    "deps": {
      "gn": {
        "version": "2022-12-12",
@ -12,16 +12,16 @@
      }
    },
    "chromedriver": {
-      "version": "111.0.5563.41",
-      "sha256_linux": "160khwa4x6w9gv5vkvalwbx87r6hrql0y0xr7zvxsir1x6rklwm2",
-      "sha256_darwin": "0z5q9r39jd5acyd79yzrkgqkvv3phdkyq4wvdsmhnpypazg072l6",
-      "sha256_darwin_aarch64": "0xiagydqnywzrpqq3i7363zhiywkp8ra9ygb2q1gznb40rx98pbr"
+      "version": "111.0.5563.64",
+      "sha256_linux": "0f4v6hds5wl43hnmqxmzidlg5nqgr4iy04hmrmvzaihsdny3na8s",
+      "sha256_darwin": "0izdp36d4wid5hmz8wcna3gddly7nbkafqqf5k1ikb2jgx9ipp8f",
+      "sha256_darwin_aarch64": "0yzn7bibj36wrc980s9sa8cl0qds01n9i88jk95afx5lk5zb8rgc"
    }
  },
  "beta": {
-    "version": "112.0.5615.29",
-    "sha256": "0k9dn1gzfr2j353ppza1nypj0a4b27p9n742cms3z8583da8kw6p",
-    "sha256bin64": "04m77ndsfygpb1g11iyscvfszgykbr5n3s6bh1shnpkpdbvx3dki",
+    "version": "112.0.5615.39",
+    "sha256": "12q4wxlgcqqflsxvcbx00228l1hjzb940ichywhiwmndxjjdvrgg",
+    "sha256bin64": "0b5c02wlmywhkxgdlnwys1djknicvqxcichxgazgpxbjmr8mmzwv",
    "deps": {
      "gn": {
        "version": "2023-02-17",
@ -45,8 +45,8 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "111.0.5563.65",
-    "sha256": "1wg84pd50zi5268snkiahnp5191c66bqkbvdz2z8azivm95lwqwp",
+    "version": "111.0.5563.111",
+    "sha256": "0r03p8m92fwsi8z1i8qjwllbb68gkspnzwynvmag3jy5kyk4vprv",
    "sha256bin64": null,
    "deps": {
      "gn": {
@ -56,8 +56,8 @@
        "sha256": "1b5fwldfmkkbpp5x63n1dxv0nc965hphc8rm8ah7zg44zscm9z30"
      },
      "ungoogled-patches": {
-        "rev": "111.0.5563.65-1",
-        "sha256": "06mfm2gaz1nbwqhn2jp34pm52rw1q99i9fq7wh19m0qasdpidis9"
+        "rev": "111.0.5563.111-1",
+        "sha256": "1m8kf8af5zjc5mgdccppyfbl6bxlwcnb6rw58q5020a810x7y6f8"
      }
    }
  }
--- a/pkgs/applications/networking/cluster/kubedog/default.nix
+++ b/pkgs/applications/networking/cluster/kubedog/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "kubedog";
-  version = "0.9.9";
+  version = "0.9.11";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "kubedog";
    rev = "v${version}";
-    hash = "sha256-j7LR6+c2ZZJCqmHihXodtiF5bJhNR8eizDEqwm9IUn0=";
+    hash = "sha256-yHyCmUjxvMzeHpG5OqC3nAjWaiHErTXrbmS+/0Y4A7E=";
  };

-  vendorHash = "sha256-UPfB3nOzJpqh14xLKZP2mLfg7C55nQivrkmh3B7aKzo=";
+  vendorHash = "sha256-OgfgCsysNtY7mZQXdmHFyJ0FqmBD3SeQdTLd5Lw3F7k=";

  subPackages = [ "cmd/kubedog" ];

--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -20,16 +20,16 @@

 buildGoModule rec {
  pname = "kubernetes";
-  version = "1.26.1";
+  version = "1.26.3";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    rev = "v${version}";
-    sha256 = "sha256-bC2Q4jWBh27bqLGhvG4JcuHIAQmiGz5jDt9Me9qbVpk=";
+    hash = "sha256-dJMfnd82JIPxyVisr5o9s/bC3ZDiolF841pmV4c9LN8=";
  };

-  vendorSha256 = null;
+  vendorHash = null;

  doCheck = false;

--- a/pkgs/applications/networking/cluster/kubeshark/default.nix
+++ b/pkgs/applications/networking/cluster/kubeshark/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubeshark";
-  version = "38.5";
+  version = "39.4";

  src = fetchFromGitHub {
    owner = "kubeshark";
    repo = "kubeshark";
    rev = version;
-    sha256 = "sha256-xu+IcmYNsFBYhb0Grnqyi31LCG/3XhSh1LH8XakQ3Yk=";
+    sha256 = "sha256-Z32FuQPh9wG2XNMAfC9Zg7G9j8btNxTcYRl+Z5f5gM8=";
  };

-  vendorHash = "sha256-o04XIUsHNqOBkvcejASHNz1HDnV6F9t+Q2Hg8eL/Uoc=";
+  vendorHash = "sha256-stpWIqLQ2PTjocuekkOI/D7QvkxX4NI1YTKIh3V6c4c=";

  ldflags = let t = "github.com/kubeshark/kubeshark"; in [
   "-s" "-w"
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -110,13 +110,13 @@
    "vendorHash": null
  },
  "aws": {
-    "hash": "sha256-j+hKWMHnIE6nmRdGHaQxLybeljmheZ7t83NSXVWViZI=",
+    "hash": "sha256-7LN+ezJMoBsH/WiJuVbkVyaOURUHTuY1kJ8gBOebAIM=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
    "owner": "hashicorp",
    "repo": "terraform-provider-aws",
-    "rev": "v4.59.0",
+    "rev": "v4.60.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-TGzTElOmYW6XO4EtMD9MWvdvd1opnFSAVcEA2eYCQdk="
+    "vendorHash": "sha256-ydAQqeaj/XN3VXNpcJAYYOV0iXSQVUraWUZKDoZOyrw="
  },
  "azuread": {
    "hash": "sha256-MGCGfocs16qmJnvMRRD7TRHnPkS17h+oNUkMARAQhLs=",
@ -328,13 +328,13 @@
    "vendorHash": "sha256-Ba4J6LUchqhdZTxcJxTgP20aZVioybIzKvF4j5TDQIk="
  },
  "dnsimple": {
-    "hash": "sha256-8xESl8n/AMURVtnJ9Gd0eZ+flbdLya8RotRBgMF7mBk=",
+    "hash": "sha256-fLYaGjQy4NtXuVePYQ8/dI7W04QM6UV3h6f2qU8hM6k=",
    "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
    "owner": "dnsimple",
    "repo": "terraform-provider-dnsimple",
-    "rev": "v0.16.2",
+    "rev": "v0.16.3",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Id1rL/Mu/aES7OFQ/rQRMmm3D/GSbGofZludqbWffKo="
+    "vendorHash": "sha256-gARkcCVDxamHHyLhUaJ85OGDmUjeOW8LUxVyM348QUY="
  },
  "docker": {
    "hash": "sha256-UyHOI8C0eDV5YllAi9clHp/CEldHjIp3FHHMPy1rK58=",
@ -639,11 +639,11 @@
    "vendorHash": "sha256-lXQHo66b9X0jZhoF+5Ix5qewQGyI82VPJ7gGzc2CHao="
  },
  "kubernetes": {
-    "hash": "sha256-4TUUejEKbnsRmqwdQVhHF+QWW8kReq+ZQQvpcT+YhsQ=",
+    "hash": "sha256-FV5FoEd0zjXa8x77r/z8Tn/I1lZI1NZ4a8yisAuAhNQ=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/kubernetes",
    "owner": "hashicorp",
    "repo": "terraform-provider-kubernetes",
-    "rev": "v2.18.1",
+    "rev": "v2.19.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -856,13 +856,13 @@
    "vendorHash": "sha256-62q67aaOZA3fQmyL8bEHB+W497bcx9Xy7kKrbkjkbaI="
  },
  "opentelekomcloud": {
-    "hash": "sha256-fkEQ4VWGJiPFTA6Wz8AxAiL4DOW+Kewl8T9ywy/yPME=",
+    "hash": "sha256-ZDhihbYH6O6UCU2WOkPE+tcOODkAsbx7v9Vg1wrbklg=",
    "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
    "owner": "opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.33.2",
+    "rev": "v1.34.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-EbUHKM6fKEZk1ey4qTgAd/20OKJu0DoBF0MAOxB7y64="
+    "vendorHash": "sha256-tLtgg6QQiXivDxDVEYeOnLqXobwN7ZFqQrI0d3pUHeE="
  },
  "opsgenie": {
    "hash": "sha256-Wbe+DyK5wKuZZX8yd3DJN+2wT8KZt+YsBwJYKnZnfcI=",
@ -1072,13 +1072,13 @@
    "vendorHash": "sha256-fgvNdBwkz+YHOrLRQSe1D+3/VUhttKkJGzV6cg57g8s="
  },
  "sumologic": {
-    "hash": "sha256-1BwhcyEJs7Xm+p2ChA9K7g+qBzqoh3eyAT9qKMfHB1g=",
+    "hash": "sha256-sJo3dGGtKT+hPo9qVA+2BYkJhNY9N9FrgKpHqdTYrUQ=",
    "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
    "owner": "SumoLogic",
    "repo": "terraform-provider-sumologic",
-    "rev": "v2.21.0",
+    "rev": "v2.22.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-dpMa+XnfavXO0lXiBZOsU+O+5/3a/IMkfzpQcnD/sSw="
+    "vendorHash": "sha256-iNBM4Y24vDGPKyb5cppSogk145F0/pAFmOzEeiWgfLI="
  },
  "tailscale": {
    "hash": "sha256-X3YV640d3pLyKm/v88oEhXfYnox+ksrEWKgiJbYl6gk=",
@ -1108,13 +1108,13 @@
    "vendorHash": null
  },
  "tfe": {
-    "hash": "sha256-eFyRa4T+CqIeOcEYj4DQP6ypR7AROYrGDYuYSqBfKr0=",
+    "hash": "sha256-K0l9oaYkgilz47ErUxio9oJtPHQTWZnKdPpjRZ1SDhg=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
    "owner": "hashicorp",
    "repo": "terraform-provider-tfe",
-    "rev": "v0.42.0",
+    "rev": "v0.43.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-bhAoNJSbrpAzw0qCKIm84h6tFqUWT0JeBs1gJpPeJdU="
+    "vendorHash": "sha256-plYy3INLi/SeKu7R0lDLY1CvRDU7bmZsQKzFtMc2Wu4="
  },
  "thunder": {
    "hash": "sha256-GLyGm9Q+ajuQFIni/OCYvYhpj2fiVYHzkPwbofq/DEs=",
@ -1254,13 +1254,13 @@
    "vendorHash": "sha256-ib1Esx2AO7b9S+v+zzuATgSVHI3HVwbzEeyqhpBz1BQ="
  },
  "yandex": {
-    "hash": "sha256-XT31rLurZAvjE08cAGIkd7pcS1LMdOIU6e60qLrLsXI=",
+    "hash": "sha256-bkKGZAGxeJC5JeVwRB+moChFvTF2zUHxB75H82RSACI=",
    "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
    "owner": "yandex-cloud",
    "proxyVendor": true,
    "repo": "terraform-provider-yandex",
-    "rev": "v0.87.0",
+    "rev": "v0.88.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-r2+ARKvTghscGBhmZpz84vdBudiy2OsmQR03oDz5gbs="
+    "vendorHash": "sha256-X8jQnuTtuN1M2qDYaE0dgOdB2DdgyQashsGb8mZOycQ="
  }
 }
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "dino";
-  version = "0.4.1";
+  version = "0.4.2";

  src = fetchFromGitHub {
    owner = "dino";
    repo = "dino";
    rev = "v${version}";
-    sha256 = "sha256-1czey1/Zn96JneCUnhPMyffG9FVV4bA9aidNB7Ozkpo=";
+    sha256 = "sha256-85Sh3UwoMaa+bpL81gIKtkpCeRl1mXbs8Odux1FURdQ=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/mailreaders/himalaya/default.nix
+++ b/pkgs/applications/networking/mailreaders/himalaya/default.nix
@ -2,44 +2,51 @@
 , rustPlatform
 , fetchFromGitHub
 , stdenv
-, enableCompletions ? stdenv.hostPlatform == stdenv.buildPlatform
 , installShellFiles
+, installShellCompletions ? stdenv.hostPlatform == stdenv.buildPlatform
+, installManPages ? stdenv.hostPlatform == stdenv.buildPlatform
 , pkg-config
 , Security
 , libiconv
 , openssl
+, notmuch
+, withImapBackend ? true
+, withNotmuchBackend ? false
+, withSmtpSender ? true
 }:

 rustPlatform.buildRustPackage rec {
  pname = "himalaya";
-  version = "0.6.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "soywod";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-d+ERCUPUHx41HfBtjb6BjhGKzkUTGIb01BRWvAnLYwk=";
+    sha256 = "sha256-yAfNH9LSXlS/Hzi5kAuur5BX2vITMucprDzxhlV8RiY=";
  };

-  cargoSha256 = "sha256-ICaahkIP1uSm4iXvSPMo8uVTtSa1nCyJdDihGdVEQvg=";
+  cargoSha256 = "sha256-FXfh6T8dNsnD/V/wYSMDWs+ll0d1jg1Dc3cQT39b0ws=";

-  nativeBuildInputs = lib.optionals enableCompletions [ installShellFiles ]
-    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ pkg-config ];
+  nativeBuildInputs = [ ]
+    ++ lib.optional (installManPages || installShellCompletions) installShellFiles
+    ++ lib.optional (!stdenv.hostPlatform.isDarwin) pkg-config;

-  buildInputs =
-    if stdenv.hostPlatform.isDarwin then [
-      Security
-      libiconv
-    ] else [
-      openssl
-    ];
+  buildInputs = [ ]
+    ++ (if stdenv.hostPlatform.isDarwin then [ Security libiconv ] else [ openssl ])
+    ++ lib.optional withNotmuchBackend notmuch;

-  # flag added because without end-to-end testing is ran which requires
-  # additional tooling and servers to test
-  cargoTestFlags = [ "--lib" ];
+  buildNoDefaultFeatures = true;
+  buildFeatures = [ ]
+    ++ lib.optional withImapBackend "imap-backend"
+    ++ lib.optional withNotmuchBackend "notmuch-backend"
+    ++ lib.optional withSmtpSender "smtp-sender";

-  postInstall = lib.optionalString enableCompletions ''
-    # Install shell function
+  postInstall = lib.optionalString installManPages ''
+    mkdir -p $out/man
+    $out/bin/himalaya man $out/man
+    installManPage $out/man/*
+  '' + lib.optionalString installShellCompletions ''
    installShellCompletion --cmd himalaya \
      --bash <($out/bin/himalaya completion bash) \
      --fish <($out/bin/himalaya completion fish) \
@ -50,7 +57,7 @@ rustPlatform.buildRustPackage rec {
    description = "Command-line interface for email management";
    homepage = "https://github.com/soywod/himalaya";
    changelog = "https://github.com/soywod/himalaya/blob/v${version}/CHANGELOG.md";
-    license = licenses.bsdOriginal;
-    maintainers = with maintainers; [ toastal yanganto ];
+    license = licenses.mit;
+    maintainers = with maintainers; [ soywod toastal yanganto ];
  };
 }
--- a/pkgs/applications/networking/shellhub-agent/default.nix
+++ b/pkgs/applications/networking/shellhub-agent/default.nix
@ -9,18 +9,18 @@

 buildGo120Module rec {
  pname = "shellhub-agent";
-  version = "0.11.6";
+  version = "0.11.7";

  src = fetchFromGitHub {
    owner = "shellhub-io";
    repo = "shellhub";
    rev = "v${version}";
-    sha256 = "eZLQzy3lWwGM6VWFbsJ6JuGC+/dZnoymZgNtM8CPBM4=";
+    sha256 = "d5ESQQgBPUFe2tuCbeFIqiWPpr9wUczbXLc5QdXurXY=";
  };

  modRoot = "./agent";

-  vendorSha256 = "sha256-7kDPo24I58Nh7OiHj6Zy40jAEaXSOmbcczkgJPXBItU=";
+  vendorSha256 = "sha256-/85rIBfFBpXYrsCBDGVzXfAxO6xXQ8uTL2XeEPKQwDQ=";

  ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];

--- a/pkgs/applications/version-management/datalad/default.nix
+++ b/pkgs/applications/version-management/datalad/default.nix
@ -8,7 +8,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "datalad";
    repo = pname;
    rev = version;
-    hash = "sha256-6uWOKsYeNZJ64WqoGHL7AsoK4iZd24TQOJ1ECw+K28Y=";
+    hash = "sha256-F5UFW0/XqntrHclpj3TqoAwuHJbiiv5a7/4MnFoJ1dE=";
  };

  nativeBuildInputs = [ installShellFiles git ];
--- a/pkgs/applications/version-management/dvc/default.nix
+++ b/pkgs/applications/version-management/dvc/default.nix
@ -17,7 +17,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "iterative";
    repo = pname;
    rev = version;
-    hash = "sha256-2h+fy4KMxFrVtKJBtA1RmJDZv0OVm1BxO1akZzAw95Y=";
+    hash = "sha256-P0J+3TNHGqMw3krfs1uLnf8nEiIBK6UrrB37mY+fBA0=";
  };

  postPatch = ''
@ -98,5 +98,6 @@ python3.pkgs.buildPythonApplication rec {
    homepage = "https://dvc.org";
    license = licenses.asl20;
    maintainers = with maintainers; [ cmcdragonkai fab ];
+    broken = true; # requires new python package: dvc-studio-client
  };
 }
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -10,24 +10,24 @@ with lib;

 let
  pname = "gitkraken";
-  version = "9.1.1";
+  version = "9.2.1";

  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchzip {
      url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-      sha256 = "sha256-CbIKdErthpMnVIuv+EJsWBRixMDG8h9aQ2XcmqpzKUc=";
+      sha256 = "sha256-JyfbCFh76b2ZWQ8J1xhsp8LYeFGdgJcUDgBCJWHf0Rk=";
    };

    x86_64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      sha256 = "sha256-J6ruK1UE0A9VG1tUHeSUDEL4wqRmUnOH8ftKHIIQuVc=";
+      sha256 = "sha256-sXWgxl+j78r/OhkMkQMQ6iUPz+SY+QDS4pvLErJTeRQ=";
    };

    aarch64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin-arm64/GitKraken-v${version}.zip";
-      sha256 = "sha256-cjz/pbV+uV6tbhj3NXDfZ93hgxFtNYhFIh6+jG4pFtU=";
+      sha256 = "sha256-1IsNJMfqpi+s2bHkB6Uo6FacvuRdLpkF+ctmi5b2Lto=";
    };
  };

--- a/pkgs/applications/video/olive-editor/default.nix
+++ b/pkgs/applications/video/olive-editor/default.nix
@ -1,34 +1,69 @@
-{ lib, stdenv, fetchFromGitHub
-, pkg-config, which, qmake, wrapQtAppsHook
-, qtmultimedia, frei0r, opencolorio_1, ffmpeg_4, CoreFoundation }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, which
+, frei0r
+, opencolorio
+, ffmpeg_4
+, CoreFoundation
+, cmake
+, wrapQtAppsHook
+, openimageio
+, openexr_3
+, portaudio
+, imath
+, qtwayland
+, qtmultimedia
+, qttools
+}:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "olive-editor";
-  version = "0.1.2";
+  version = "unstable-2023-03-20";

  src = fetchFromGitHub {
+    fetchSubmodules = true;
    owner = "olive-editor";
    repo = "olive";
-    rev = version;
-    sha256 = "151g6jwhipgbq4llwib92sq23p1s9hm6avr7j4qq3bvykzrm8z1a";
+    rev = "8ca16723613517c41304de318169d27c571b90af";
+    sha256 = "sha256-lL90+8L7J7pjvhbqfeIVF0WKgl6qQzNun8pL9YPL5Is=";
  };

-  patches = [
-    ./q-painter-path.patch
+  cmakeFlags = [
+    "-DBUILD_QT6=1"
  ];

+  # https://github.com/olive-editor/olive/issues/2200
+  patchPhase = ''
+    runHook prePatch
+    substituteInPlace ./app/node/project/serializer/serializer.h \
+      --replace 'QStringRef' 'QStringView'
+    substituteInPlace ./app/node/project/serializer/serializer.cpp \
+      --replace 'QStringRef' 'QStringView'
+    substituteInPlace ./app/node/project/serializer/serializer230220.cpp \
+      --replace 'QStringRef' 'QStringView'
+    runHook postPatch
+  '';
+
  nativeBuildInputs = [
    pkg-config
    which
-    qmake
+    cmake
    wrapQtAppsHook
  ];

  buildInputs = [
    ffmpeg_4
    frei0r
-    opencolorio_1
+    opencolorio
+    openimageio
+    imath
+    openexr_3
+    portaudio
+    qtwayland
    qtmultimedia
+    qttools
  ] ++ lib.optional stdenv.isDarwin CoreFoundation;

  meta = with lib; {
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -61,13 +61,13 @@ let
 in
 buildGoModule rec {
  pname = "podman";
-  version = "4.4.2";
+  version = "4.4.3";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    rev = "v${version}";
-    hash = "sha256-337PFsPGm7pUgnFeNJKwT+/7AdbWSfCx4kXyAvHyWJQ=";
+    hash = "sha256-s0aGZN4rnyyNLoO3nnAO7KbeD7MYxE9VMOHrQsKGNBk=";
  };

  patches = [
--- a/pkgs/build-support/alternatives/lapack/default.nix
+++ b/pkgs/build-support/alternatives/lapack/default.nix
@ -35,6 +35,9 @@ stdenv.mkDerivation {
    implementation = lapackImplementation;
  };

+  # TODO: drop this forced rebuild, as it was needed just once.
+  rebuild_salt = if stdenv.isDarwin && stdenv.isx86_64 then "J4AQ" else null;
+
  dontBuild = true;
  dontConfigure = true;
  unpackPhase = "src=$PWD";
--- a/pkgs/build-support/rust/build-rust-package/sysroot/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/sysroot/default.nix
@ -1,10 +1,10 @@
-{ stdenv, rust, rustPlatform, buildPackages }:
+{ lib, stdenv, rust, rustPlatform, buildPackages }:

 { shortTarget, originalCargoToml, target, RUSTFLAGS }:

 let
  cargoSrc = import ../../sysroot/src.nix {
-    inherit stdenv rustPlatform buildPackages originalCargoToml;
+    inherit lib stdenv rustPlatform buildPackages originalCargoToml;
  };
 in rustPlatform.buildRustPackage {
  inherit target RUSTFLAGS;
@ -14,7 +14,7 @@ in rustPlatform.buildRustPackage {

  RUSTC_BOOTSTRAP = 1;
  __internal_dontAddSysroot = true;
-  cargoSha256 = "0y6dqfhsgk00y3fv5bnjzk0s7i30nwqc1rp0xlrk83hkh80x81mw";
+  cargoSha256 = "sha256-zgkwevitxsu1C4OgGTsqNSc0gDxaNXYK1WPbfER48d0=";

  doCheck = false;

@ -29,4 +29,7 @@ in rustPlatform.buildRustPackage {
    host=${rust.toRustTarget stdenv.buildPlatform}
    cp -r $RUST_SYSROOT/lib/rustlib/$host $out
  '';
+
+  # allows support for cross-compilation
+  meta.platforms = lib.platforms.all;
 }
--- a/pkgs/build-support/rust/replace-workspace-values.py
+++ b/pkgs/build-support/rust/replace-workspace-values.py
@ -63,8 +63,16 @@ def replace_dependencies(


 def main() -> None:
+    top_cargo_toml = load_file(sys.argv[2])
+
+    if "workspace" not in top_cargo_toml:
+        # If top_cargo_toml is not a workspace manifest, then this script was probably
+        # ran on something that does not actually use workspace dependencies
+        print(f"{sys.argv[2]} is not a workspace manifest, doing nothing.")
+        return
+
    crate_manifest = load_file(sys.argv[1])
-    workspace_manifest = load_file(sys.argv[2])["workspace"]
+    workspace_manifest = top_cargo_toml["workspace"]

    if "workspace" in crate_manifest:
        return
--- a/pkgs/build-support/rust/sysroot/Cargo.lock
+++ b/pkgs/build-support/rust/sysroot/Cargo.lock
@ -1,5 +1,7 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
+version = 3
+
 [[package]]
 name = "alloc"
 version = "0.0.0"
@ -10,9 +12,9 @@ dependencies = [

 [[package]]
 name = "compiler_builtins"
-version = "0.1.52"
+version = "0.1.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6591c2442ee984e2b264638a8b5e7ae44fd47b32d28e3a08e2e9c3cdb0c2fb0"
+checksum = "f867ce54c09855ccd135ad4a50c777182a0c7af5ff20a8f537617bd648b10d50"
 dependencies = [
 "rustc-std-workspace-core",
 ]
--- a/pkgs/build-support/rust/sysroot/src.nix
+++ b/pkgs/build-support/rust/sysroot/src.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation {
  + ''
    ${buildPackages.python3.withPackages (ps: with ps; [ toml ])}/bin/python3 ${./cargo.py}
    mkdir -p $out/src
-    touch $out/src/lib.rs
+    echo '#![no_std]' > $out/src/lib.rs
    cp Cargo.toml $out/Cargo.toml
    cp ${./Cargo.lock} $out/Cargo.lock
  '';
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "v2ray-geoip";
-  version = "202303160048";
+  version = "202303230043";

  src = fetchFromGitHub {
    owner = "v2fly";
    repo = "geoip";
-    rev = "ca1a04c113293b00434d9d60e24aee17e660f4a6";
-    sha256 = "sha256-YhFYrVN6ZQQeuM8ZCeFRmID/NTsI75oe4c51lOfb18s=";
+    rev = "163f6f7caad67d43b51a9c342a72e34feeccb4d0";
+    sha256 = "sha256-hwKRwCu/LHbjqzgpwG8YcTX4C+eEkonCDqVq36FIprQ=";
  };

  installPhase = ''
--- a/pkgs/desktops/mate/mate-desktop/default.nix
+++ b/pkgs/desktops/mate/mate-desktop/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-desktop";
-  version = "1.26.0";
+  version = "1.26.1";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "18sj8smf0b998m5qvki37hxg0agcx7wmgz9z7cwv6v48i2dnnz2z";
+    sha256 = "EtFmiiesGr1gk1OB0/OYIbuAhGenuKz570WIXXyAohE=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-polkit/default.nix
+++ b/pkgs/desktops/mate/mate-polkit/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-polkit";
-  version = "1.26.0";
+  version = "1.26.1";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0kkjv025l1l8352m5ky1g7hmk7isgi3dnfnh7sqg9pyhml97i9dd";
+    sha256 = "9bewtd/FMwLEBAMkWZjrkSGvP1DnFmagmrc7slRSA1c=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/bootil/default.nix
+++ b/pkgs/development/libraries/bootil/default.nix
@ -39,6 +39,7 @@ stdenv.mkDerivation {
    license = licenses.free;
    maintainers = with maintainers; [ abigailbuccaneer ];
    # Build uses `-msse` and `-mfpmath=sse`
+    platforms = platforms.all;
    badPlatforms = [ "aarch64-linux" ];
  };
 }
--- a/pkgs/development/libraries/imgui/default.nix
+++ b/pkgs/development/libraries/imgui/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "imgui";
-  version = "1.89.3";
+  version = "1.89.4";

  src = fetchFromGitHub {
    owner = "ocornut";
    repo = "imgui";
    rev = "v${version}";
-    sha256 = "sha256-hPUOqXMpjKNuWVo2RUq2Nw5i+p8PE8qmlyATV7y3Lgg=";
+    sha256 = "sha256-iBpJzfU8ATDilU/1zhV9T/1Zy22g8vw81cmkmJ5+6cg=";
  };

  dontBuild = true;
--- a/pkgs/development/libraries/minizip-ng/default.nix
+++ b/pkgs/development/libraries/minizip-ng/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "minizip-ng";
-  version = "3.0.8";
+  version = "3.0.9";

  src = fetchFromGitHub {
    owner = "zlib-ng";
    repo = finalAttrs.pname;
    rev = finalAttrs.version;
-    sha256 = "sha256-Vzp+5fQBJoO1pG7j8LwC2/B/cOgM/exhKyb3zHuy89Y=";
+    sha256 = "sha256-yuHJUy/Ed7dutmosmcbedz5nZoCc5imLDOXikIde8bs=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/mygui/default.nix
+++ b/pkgs/development/libraries/mygui/default.nix
@ -20,13 +20,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mygui";
-  version = "3.4.0";
+  version = "3.4.1";

  src = fetchFromGitHub {
    owner = "MyGUI";
    repo = "mygui";
    rev = "MyGUI${version}";
-    sha256 = "0a4zi8w18pjj813n7kmxldl1d9r1jp0iyhkw7pbqgl8f7qaq994w";
+    hash = "sha256-5u9whibYKPj8tCuhdLOhL4nDisbFAB0NxxdjU/8izb8=";
  };

  patches = [
@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "http://mygui.info/";
    description = "Library for creating GUIs for games and 3D applications";
-    license = licenses.lgpl3Plus;
+    license = licenses.mit;
    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/physics/rivet/default.nix
+++ b/pkgs/development/libraries/physics/rivet/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "rivet";
-  version = "3.1.6";
+  version = "3.1.7";

  src = fetchurl {
    url = "https://www.hepforge.org/archive/rivet/Rivet-${version}.tar.bz2";
-    hash = "sha256-HPbrtqedGBxEHR0MfG1iPEI4F8YQk/NvIa2q4j5nkJA=";
+    hash = "sha256-J8fbvLX9fugcrxNtr06WC8oOwlXZ+hq+YC9NQwhhsno=";
  };

  latex = texlive.combine { inherit (texlive)
--- a/pkgs/development/libraries/rocm-opencl-runtime/default.nix
+++ b/pkgs/development/libraries/rocm-opencl-runtime/default.nix
@ -14,7 +14,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rocm-opencl-runtime";
-  version = "5.4.3";
+  version = "5.4.4";

  src = fetchFromGitHub {
    owner = "RadeonOpenCompute";
--- a/pkgs/development/libraries/science/math/or-tools/default.nix
+++ b/pkgs/development/libraries/science/math/or-tools/default.nix
@ -39,6 +39,12 @@ stdenv.mkDerivation rec {
      url = "https://github.com/google/or-tools/commit/a26602f24781e7bfcc39612568aa9f4010bb9736.patch";
      hash = "sha256-gM0rW0xRXMYaCwltPK0ih5mdo3HtX6mKltJDHe4gbLc=";
    })
+    # Backport fix in cmake test configuration where pip installs newer version from PyPi over local build,
+    #  breaking checkPhase: https://github.com/google/or-tools/issues/3260
+    (fetchpatch {
+      url = "https://github.com/google/or-tools/commit/edd1544375bd55f79168db315151a48faa548fa0.patch";
+      hash = "sha256-S//1YM3IoRCp3Ghg8zMF0XXgIpVmaw4gH8cVb9eUbqM=";
+    })
  ];

  cmakeFlags = [
@ -48,7 +54,7 @@ stdenv.mkDerivation rec {
    "-DFETCH_PYTHON_DEPS=OFF"
    "-DUSE_GLPK=ON"
    "-DUSE_SCIP=OFF"
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ "-DCMAKE_MACOSX_RPATH=OFF" ];
  nativeBuildInputs = [
    cmake
    ensureNewerSourcesForZipFilesHook
@ -104,6 +110,6 @@ stdenv.mkDerivation rec {
      Google's software suite for combinatorial optimization.
    '';
    maintainers = with maintainers; [ andersk ];
-    platforms = with platforms; linux;
+    platforms = with platforms; linux ++ darwin;
  };
 }
--- a/pkgs/development/libraries/sope/default.nix
+++ b/pkgs/development/libraries/sope/default.nix
@ -1,4 +1,4 @@
-{ gnustep, lib, fetchFromGitHub , libxml2, openssl
+{ gnustep, lib, fetchFromGitHub, fetchpatch, libxml2, openssl
 , openldap, mariadb, libmysqlclient, postgresql }:

 gnustep.stdenv.mkDerivation rec {
@ -12,20 +12,36 @@ gnustep.stdenv.mkDerivation rec {
    hash = "sha256-sXIpKdJ5930+W+FsxQ8DZOq/49XWMM1zV8dIzbQdcbc=";
  };

+  patches = [
+    (fetchpatch {
+      name = "sope-no-unnecessary-vars.patch";
+      url = "https://github.com/Alinto/sope/commit/0751a2f11961fd7de4e2728b6e34e9ba4ba5887e.patch";
+      hash = "sha256-1txj8Qehg2N7ZsiYQA2FXI4peQAE3HUwDYkJEP9WnEk=";
+    })
+    (fetchpatch {
+      name = "sope-fix-wformat.patch";
+      url = "https://github.com/Alinto/sope/commit/6adfadd5dd2da4041657ad071892f2c9b1704d22.patch";
+      hash = "sha256-zCbvVdbeBeNo3/cDVdYbyUUC2z8D6Q5ga0plUoMqr98=";
+    })
+  ];
+
  hardeningDisable = [ "format" ];
  nativeBuildInputs = [ gnustep.make ];
-  buildInputs = lib.flatten ([ gnustep.base libxml2 openssl ]
+  buildInputs = [ gnustep.base libxml2 openssl ]
    ++ lib.optional (openldap != null) openldap
    ++ lib.optionals (mariadb != null) [ libmysqlclient mariadb ]
-    ++ lib.optional (postgresql != null) postgresql);
-
-  postPatch = ''
-    # Exclude NIX_ variables
-    sed -i 's/grep GNUSTEP_/grep ^GNUSTEP_/g' configure
-  '';
+    ++ lib.optional (postgresql != null) postgresql;

+  # Configure directories where files are installed to. Everything is automatically
+  # put into $out (thanks GNUstep) apart from the makefiles location which is where
+  # makefiles are read from during build but also where the SOPE makefiles are
+  # installed to in the install phase. We move them over after the installation.
  preConfigure = ''
-    export DESTDIR="$out"
+    mkdir -p /build/Makefiles
+    ln -s ${gnustep.make}/share/GNUstep/Makefiles/* /build/Makefiles
+    cat <<EOF > /build/GNUstep.conf
+    GNUSTEP_MAKEFILES=/build/Makefiles
+    EOF
  '';

  configureFlags = [ "--prefix=" "--disable-debug" "--enable-xml" "--with-ssl=ssl" ]
@ -33,10 +49,12 @@ gnustep.stdenv.mkDerivation rec {
    ++ lib.optional (mariadb != null) "--enable-mysql"
    ++ lib.optional (postgresql != null) "--enable-postgresql";

-  # Yes, this is ugly.
-  preFixup = ''
-    cp -rlPa $out/nix/store/*/* $out
-    rm -rf $out/nix/store
+  env.GNUSTEP_CONFIG_FILE = "/build/GNUstep.conf";
+
+  # Move over the makefiles (see comment over preConfigure)
+  postInstall = ''
+    mkdir -p $out/share/GNUstep/Makefiles
+    find /build/Makefiles -mindepth 1 -maxdepth 1 -not -type l -exec cp -r '{}' $out/share/GNUstep/Makefiles \;
  '';

  meta = with lib; {
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@ -11,6 +11,7 @@
 , withLibraries ? stdenv.isLinux
 , withTests ? stdenv.isLinux
 , libffi
+, epoll-shim
 , withDocumentation ? withLibraries && stdenv.hostPlatform == stdenv.buildPlatform
 , graphviz-nox
 , doxygen
@ -82,6 +83,8 @@ stdenv.mkDerivation rec {
    libxml2
  ] ++ lib.optionals withLibraries [
    libffi
+  ] ++ lib.optionals (withLibraries && !stdenv.hostPlatform.isLinux) [
+    epoll-shim
  ] ++ lib.optionals withDocumentation [
    docbook_xsl
    docbook_xml_dtd_45
--- a/pkgs/development/ocaml-modules/janestreet/0.15.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.15.nix
@ -254,6 +254,15 @@ with self;
    propagatedBuildInputs = [ async_websocket cohttp-async ppx_jane uri-sexp ];
  };

+  cohttp_static_handler = janePackage {
+    duneVersion = "3";
+    pname = "cohttp_static_handler";
+    version = "0.15.0";
+    hash = "sha256-ENaH8ChvjeMc9WeNIhkeNBB7YK9vB4lw95o6FFZI1ys=";
+    meta.description = "A library for easily creating a cohttp handler for static files";
+    propagatedBuildInputs = [ cohttp-async ];
+  };
+
  core = janePackage {
    pname = "core";
    version = "0.15.1";
--- a/pkgs/development/ocaml-modules/magic-trace/default.nix
+++ b/pkgs/development/ocaml-modules/magic-trace/default.nix
@ -0,0 +1,27 @@
+{ lib, fetchFromGitHub, buildDunePackage, async, cohttp_static_handler
+, core_unix, owee, ppx_jane, shell }:
+
+buildDunePackage rec {
+  pname = "magic-trace";
+  version = "1.1.0";
+
+  minimalOCamlVersion = "4.12";
+  duneVersion = "3";
+
+  src = fetchFromGitHub {
+    owner = "janestreet";
+    repo = "magic-trace";
+    rev = "v${version}";
+    sha256 = "sha256-615AOkrbQI6vRosA5Kz3Epipe9f9+Gs9+g3bVl5gzBY=";
+  };
+
+  buildInputs = [ async cohttp_static_handler core_unix owee ppx_jane shell ];
+
+  meta = with lib; {
+    description =
+      "Collects and displays high-resolution traces of what a process is doing";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/janestreet/magic-trace";
+  };
+}
--- a/pkgs/development/ocaml-modules/owee/default.nix
+++ b/pkgs/development/ocaml-modules/owee/default.nix
@ -2,19 +2,20 @@

 buildDunePackage rec {
  minimalOCamlVersion = "4.06";
-  useDune2 = true;
+  duneVersion = "2";
  pname = "owee";
-  version = "0.4";
+  version = "0.6";

  src = fetchurl {
-    url = "https://github.com/let-def/owee/releases/download/v${version}/owee-${version}.tbz";
-    sha256 = "sha256:055bi0yfdki1pqagbhrwmfvigyawjgsmqw04zhpp6hds8513qzvb";
+    url =
+      "https://github.com/let-def/owee/releases/download/v${version}/owee-${version}.tbz";
+    sha256 = "sha256-GwXV5t4GYbDiGwyvQyW8NZoYvn4qXlLnjX331Bj1wjM=";
  };

-  meta = {
+  meta = with lib; {
    description = "An experimental OCaml library to work with DWARF format";
    homepage = "https://github.com/let-def/owee/";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.vbgl ];
+    license = licenses.mit;
+    maintainers = with maintainers; [ vbgl alizter ];
  };
 }
--- a/pkgs/development/ocaml-modules/spacetime_lib/default.nix
+++ b/pkgs/development/ocaml-modules/spacetime_lib/default.nix
@ -6,8 +6,7 @@ lib.throwIfNot (lib.versionAtLeast "4.12" ocaml.version)
 buildDunePackage rec {
  pname = "spacetime_lib";
  version = "0.3.0";
-
-  useDune2 = true;
+  duneVersion = "2";

  src = fetchFromGitHub {
    owner = "lpw25";
@ -16,6 +15,8 @@ buildDunePackage rec {
    sha256 = "0biisgbycr5v3nm5jp8i0h6vq76vzasdjkcgh8yr7fhxc81jgv3p";
  };

+  patches = [ ./spacetime.diff ];
+
  propagatedBuildInputs = [ owee ];

  preConfigure = ''
--- a/pkgs/development/ocaml-modules/spacetime_lib/spacetime.diff
+++ b/pkgs/development/ocaml-modules/spacetime_lib/spacetime.diff
@ -0,0 +1,14 @@
+diff --git a/src/elf_locations.ml b/src/elf_locations.ml
+index a08b359..0db9274 100644
+--- a/src/elf_locations.ml
+++ b/src/elf_locations.ml
+@@ -37,7 +37,8 @@ let resolve_from_dwarf t ~program_counter =
+     | Some section ->
+       let body = Owee_buf.cursor (Owee_elf.section_body t.map section) in
+       let rec aux () =
+-        match Owee_debug_line.read_chunk body with
+        let pointers_to_other_sections = Owee_elf.debug_line_pointers t.map t.sections in
+        match Owee_debug_line.read_chunk body ~pointers_to_other_sections with
+         | None -> ()
+         | Some (header, chunk) ->
+           (* CR-soon mshinwell: fix owee .mli to note that [state] is
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.42";
+  version = "9.2.43";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-45wEnYx2/XvyVlew8rwPFSHZtj6NdZWPEEomkqBLNIw=";
+    hash = "sha256-Nww43TIIWHJo8tKNQoPYWHXzslnsBGftxfTCg3elo6w=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aioharmony/default.nix
+++ b/pkgs/development/python-modules/aioharmony/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "aioharmony";
-  version = "0.2.9";
+  version = "0.2.10";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-T30pLzPWD+5pb0ShkpNdiBFO45RdiMYgCOSg8rx+t+Y=";
+    hash = "sha256-18+38QunEdEGdirQOT+528vYqiqDuUr/CWRQtXKf4rs=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -31,7 +31,7 @@

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.42";
+  version = "9.2.43";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -40,7 +40,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-EbOGAY7aqpWngy8ImdDt8dmJhc1UEiX0I8KY8TSump0=";
+    hash = "sha256-SHUuKF7rT2x7CxF9s6ntxniOjhf7asY7HJeMi38Dqrc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/annexremote/default.nix
+++ b/pkgs/development/python-modules/annexremote/default.nix
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "Lykos153";
    repo = "AnnexRemote";
    rev = "v${version}";
-    sha256 = "08myswj1vqkl4s1glykq6xn76a070nv5mxj0z8ibl6axz89bvypi";
+    sha256 = "sha256-h03gkRAMmOq35zzAq/OuctJwPAbP0Idu4Lmeu0RycDc=";
  };

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.42";
+  version = "9.2.43";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-jDC4nmHg7OCo7mQ7iLeG7OFB1xAQxkKw1WZTyY2FBoY=";
+    hash = "sha256-j+JzLN6ila3PsTtxespvPKyH6NVO8eFncDw9qPFDLyQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/asf-search/default.nix
+++ b/pkgs/development/python-modules/asf-search/default.nix
@ -9,7 +9,6 @@
 , importlib-metadata
 , numpy
 , dateparser
-, jinja2
 , remotezip
 , pytestCheckHook
 , requests-mock
@ -18,7 +17,7 @@

 buildPythonPackage rec {
  pname = "asf-search";
-  version = "6.1.0";
+  version = "6.2.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -27,7 +26,7 @@ buildPythonPackage rec {
    owner = "asfadmin";
    repo = "Discovery-asf_search";
    rev = "refs/tags/v${version}";
-    hash = "sha256-3CnarUqW7/hEo4zvRGLJ+VAY5X+aacBdY1Epef523vY=";
+    hash = "sha256-4RFGhA9xzc1kxSni6rAbevoDkc1bLdQD1II/2xq/uKM=";
  };

  propagatedBuildInputs = [
@ -38,7 +37,6 @@ buildPythonPackage rec {
    importlib-metadata
    numpy
    dateparser
-    jinja2
    remotezip
  ];

@ -56,6 +54,7 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
+    changelog = "https://github.com/asfadmin/Discovery-asf_search/blob/${src.rev}/CHANGELOG.md";
    description = "Python wrapper for the ASF SearchAPI";
    homepage = "https://github.com/asfadmin/Discovery-asf_search";
    license = licenses.bsd3;
--- a/pkgs/development/python-modules/azure-keyvault-keys/default.nix
+++ b/pkgs/development/python-modules/azure-keyvault-keys/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "azure-keyvault-keys";
-  version = "4.7.0";
+  version = "4.8.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -20,7 +20,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    hash = "sha256-9jdA9dwNmxQtitZZCfSoSe9UmiDobf8uwyLBPeBILYw=";
+    hash = "sha256-bAuy94MgKjSj5ex0hm5iEuWRrHEk8DuWadGwm2giS8Q=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/bluetooth-adapters/default.nix
+++ b/pkgs/development/python-modules/bluetooth-adapters/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "bluetooth-adapters";
-  version = "0.15.2";
+  version = "0.15.3";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-vwcOMg10XRT6wNkQQF6qkbWSG2rsUXaDSEiIevii1eA=";
+    hash = "sha256-sh5wOx/4J1AEzR5zrd77v7Cbq6Mt9vOjCSREKHRN4aQ=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/cairo-lang/default.nix
+++ b/pkgs/development/python-modules/cairo-lang/default.nix
@ -31,28 +31,16 @@

 buildPythonPackage rec {
  pname = "cairo-lang";
-  version = "0.10.0";
+  version = "0.10.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchzip {
    url = "https://github.com/starkware-libs/cairo-lang/releases/download/v${version}/cairo-lang-${version}.zip";
-    hash = "sha256-+PE7RSKEGADbue63FoT6UBOwURJs7lBNkL7aNlpSxP8=";
+    hash = "sha256-MNbzDqqNhij9JizozLp9hhQjbRGzWxECOErS3TOPlAA=";
  };

-  # TODO: remove a substantial part when https://github.com/starkware-libs/cairo-lang/pull/88/files is merged.
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "lark-parser" "lark"
-
-    substituteInPlace starkware/cairo/lang/compiler/parser_transformer.py \
-      --replace 'value, meta' 'meta, value' \
-      --replace 'value: Tuple[CommaSeparatedWithNotes], meta' 'meta, value: Tuple[CommaSeparatedWithNotes]'
-    substituteInPlace starkware/cairo/lang/compiler/parser.py \
-      --replace 'standard' 'basic'
-  '';
-
  nativeBuildInputs = [
    pythonRelaxDepsHook
  ];
@ -99,6 +87,10 @@ buildPythonPackage rec {
    "pytest-asyncio"
  ];

+  postFixup = ''
+    chmod +x $out/bin/*
+  '';
+
  # There seems to be no test included in the ZIP release…
  # Cloning from GitHub is harder because they use a custom CMake setup
  # TODO(raitobezarius): upstream was pinged out of band about it.
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.42";
+  version = "9.2.43";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-94FEyPL9zjHBFC8L/Aij8OcS5GiBBEY1Tnm4N7zNW0g=";
+    hash = "sha256-g7kXjoJDzc+MPmGR6dO7mGi3LcJQem6pnLvbuoC9Pxw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -16,7 +16,7 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.42";
+  version = "9.2.43";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
@ -38,7 +38,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-NZPXpL4bnPXJHIPf+Jwt6vE7G43JAjhZhW2xeNSw3R8=";
+    hash = "sha256-GWChdbQRnoD6hRVONLcFNoW9vJO9iWKLnjd8xiA/7jI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/dateparser/default.nix
+++ b/pkgs/development/python-modules/dateparser/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "dateparser";
-  version = "1.1.7";
+  version = "1.1.8";

  disabled = pythonOlder "3.7";

@ -31,7 +31,7 @@ buildPythonPackage rec {
    owner = "scrapinghub";
    repo = "dateparser";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KQCjXuBDBZduNYJITwk1qx7mBp8CJ95ZbFlhrFMkE8w=";
+    hash = "sha256-52g8defF5bsisBv2QoyUymXcf0sljOI9PjeR4l0Pw6k=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/debugpy/default.nix
+++ b/pkgs/development/python-modules/debugpy/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , pythonOlder
+, pythonAtLeast
 , fetchFromGitHub
 , fetchpatch
 , substituteAll
@ -22,13 +23,15 @@ buildPythonPackage rec {
  version = "1.6.6";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
+  # Currently doesn't support 3.11:
+  # https://github.com/microsoft/debugpy/issues/1107
+  disabled = pythonOlder "3.7" || pythonAtLeast "3.11";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "debugpy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-GanRWzGyg0Efa+kuU7Q0IOmO0ohXZIjuz8RZYERTpzo=";
+    hash = "sha256-jEhvpPO3QeKjPiOMxg2xOWitWtZ6UCWyM1WvnbrKnFI=";
  };

  patches = [
--- a/pkgs/development/python-modules/gpaw/default.nix
+++ b/pkgs/development/python-modules/gpaw/default.nix
@ -13,6 +13,7 @@
 , ase
 , numpy
 , scipy
+, pyyaml
 }:

 assert lib.asserts.assertMsg (!blas.isILP64)
@ -85,7 +86,7 @@ in buildPythonPackage rec {

  buildInputs = [ blas scalapack libxc libvdwxc ];

-  propagatedBuildInputs = [ ase scipy numpy mpi ];
+  propagatedBuildInputs = [ ase scipy numpy mpi pyyaml ];

  patches = [ ./SetupPath.patch ];

--- a/pkgs/development/python-modules/gvm-tools/default.nix
+++ b/pkgs/development/python-modules/gvm-tools/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "gvm-tools";
-  version = "23.2.0";
+  version = "23.3.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "greenbone";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-TwGeLEfP69ZK/fkhS0sB6aPh8aDjg6Tri2mUUzk4jbk=";
+    hash = "sha256-sv34PwOEWGsIgSNpUcqvwjJ+6FSrmpXNB5gc47EjFU0=";
  };

  nativeBuildInputs = [
@ -48,6 +48,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Collection of APIs that help with remote controlling a Greenbone Security Manager";
    homepage = "https://github.com/greenbone/gvm-tools";
+    changelog = "https://github.com/greenbone/gvm-tools/releases/tag/v${version}";
    license = with licenses; [ gpl3Plus ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "mautrix";
-  version = "0.19.6";
+  version = "0.19.7";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -29,8 +29,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "mautrix";
    repo = "python";
-    rev = "v${version}";
-    hash = "sha256-Km6Lh4iKUBwQcsChTrV9yCaPhVBINJotp/5XnPfoOMk=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uL4eNMe+NXyE+kLy87zZPNBDuMnAt3KHT01ryFVfBZU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/myst-docutils/default.nix
+++ b/pkgs/development/python-modules/myst-docutils/default.nix
@ -13,12 +13,12 @@

 buildPythonPackage rec {
  pname = "myst-docutils";
-  version = "0.18.1";
+  version = "1.0.0";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Dxg5TtQaK4plvRmXZa7AqPFIv/jvUOpV8M/BJohiXj0=";
+    hash = "sha256-fbh97Z/5TnnMHj2bGZ4UvJkPpYtrTTcFOgpLWgHUYk0=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "peaqevcore";
-  version = "13.3.0";
+  version = "13.4.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-1faEVqSGhRr+CaRHgZMS093fSC3hBgK2CX0oCxAIjCU=";
+    hash = "sha256-f4Xq68QBcnHZdwZrAwg7QUvZrXYvrflEkh1us48YN/g=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pnglatex/default.nix
+++ b/pkgs/development/python-modules/pnglatex/default.nix
@ -0,0 +1,27 @@
+{ lib, buildPythonPackage, fetchPypi, poppler_utils, netpbm }:
+
+buildPythonPackage rec {
+
+  pname = "pnglatex";
+  version = "1.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-CZUGDUkmttO0BzFYbGFSNMPkWzFC/BW4NmAeOwz4Y9M=";
+  };
+
+  propagatedBuildInputs = [
+    poppler_utils
+    netpbm
+  ];
+
+  # There are no tests
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/MaT1g3R/pnglatex";
+    description = "a small program that converts LaTeX snippets to png";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ GaetanLepage ];
+  };
+}
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@ -17,16 +17,16 @@

 buildPythonPackage rec {
  pname = "pontos";
-  version = "23.3.5";
+  version = "23.3.6";
  format = "pyproject";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-Eb9mX04ws+FhiRw5j1XsEhjm5ZdYFCbA5pntgb4z//M=";
+    hash = "sha256-cs+UeE5QRL/yzFABpMQ4masbLHwG++Ipu5GidXJ1Y0E=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pvo/default.nix
+++ b/pkgs/development/python-modules/pvo/default.nix
@ -13,16 +13,16 @@

 buildPythonPackage rec {
  pname = "pvo";
-  version = "0.2.2";
+  version = "1.0.0";
  format = "pyproject";

-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";

  src = fetchFromGitHub {
    owner = "frenck";
    repo = "python-pvoutput";
-    rev = "v${version}";
-    hash = "sha256-2/O81MnFYbdOrzLiTSoX7IW+3ZGyyE/tIqgKr/sEaHI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-6oVACUnK8WVlEx047CUXmSXQ0+M3xnSvyMHw5Wttk7M=";
  };

  nativeBuildInputs = [
@ -55,6 +55,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python module to interact with the PVOutput API";
    homepage = "https://github.com/frenck/python-pvoutput";
+    changelog = "https://github.com/frenck/python-pvoutput/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@ -1,10 +1,12 @@
 { lib
+, async-timeout
 , bleak
 , bleak-retry-connector
 , boto3
 , buildPythonPackage
 , cryptography
 , fetchFromGitHub
+, pyopenssl
 , pythonOlder
 , pytestCheckHook
 , requests
@ -12,7 +14,7 @@

 buildPythonPackage rec {
  pname = "pyswitchbot";
-  version = "0.37.3";
+  version = "0.37.4";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -21,14 +23,16 @@ buildPythonPackage rec {
    owner = "Danielhiversen";
    repo = "pySwitchbot";
    rev = "refs/tags/${version}";
-    hash = "sha256-0Kzzyzlxs5PaEHKzJLsconUg4zmgPzWI8LD5UIcKwEY=";
+    hash = "sha256-2P7hj0kfKLPyuKk6ouHJtkWCUT3EC1spQTjBQarwpbU=";
  };

  propagatedBuildInputs = [
+    async-timeout
    bleak
    bleak-retry-connector
    boto3
    cryptography
+    pyopenssl
    requests
  ];

--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "pyvex";
-  version = "9.2.42";
+  version = "9.2.43";
  format = "pyproject";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-5pp66sI15sdavyZD+xrTFqhAgjT89KswBE0MQ09Fdl4=";
+    hash = "sha256-X1lFSbVhHBhQ6Y1pbzjObAISqA6rBTpx0Ww5c6p+3LM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "reolink-aio";
-  version = "0.5.5";
+  version = "0.5.6";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "starkillerOG";
    repo = "reolink_aio";
    rev = "refs/tags/${version}";
-    hash = "sha256-Nu0U/I0dDwJ2wAk2Vj6nMt0/0galfTPurj8MqAUzSks=";
+    hash = "sha256-tkmaWD+OfJfI3QjvdQivmqi8kv5Yuk2UxLlYw8hVocY=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/rpmfile/default.nix
+++ b/pkgs/development/python-modules/rpmfile/default.nix
@ -5,11 +5,11 @@
 }:
 buildPythonPackage rec {
  pname = "rpmfile";
-  version = "1.0.8";
+  version = "1.1.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "e56cfc10e1a7d953b1890d81652a89400c614f4cdd9909464aece434d93c3a3e";
+    sha256 = "sha256-ZxcHe1QxdG2GBIPMNrnJy6Vd8SRgZ4HOtwsks2be8Cs=";
  };

  # Tests access the internet
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "scmrepo";
-  version = "0.1.15";
+  version = "0.1.16";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-Z/W49P1T8XgCmKWLTO/eI7ArAB9QKWUbJWRTlRnjJ7E=";
+    hash = "sha256-d8CwvxWdFhKXzv6mzWh+WIH6VSBsQOpdyc5UIwrh7kg=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/upcloud-api/default.nix
+++ b/pkgs/development/python-modules/upcloud-api/default.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "upcloud-api";
-  version = "2.0.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "UpCloudLtd";
    repo = "upcloud-python-api";
-    rev = "v${version}";
-    sha256 = "1kkgrn97pw4k49ys97hjrvh2j8y2p2r9970v9csgrk5wci4562wm";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-thmrbCpGjlDkHIZwIjRgIVMplaypiKByFS/nS8F2LXA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/vispy/default.nix
+++ b/pkgs/development/python-modules/vispy/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "vispy";
-  version = "0.12.1";
+  version = "0.12.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-4AiBwdD5ssCOtuJuk2GtveijqW54eO5sHhmefFhyIk8=";
+    hash = "sha256-FBwt3MwRWFVbyJ8JAQxLHXVEh+gWNXMz8x55WnFGoCQ=";
  };

  patches = [
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "zeroconf";
-  version = "0.47.3";
+  version = "0.47.4";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "jstasiak";
    repo = "python-zeroconf";
    rev = "refs/tags/${version}";
-    hash = "sha256-hpbJ7kcyM8S2xAaVjuPzHXl/gcAYk3CX7NHxsbZXQ10=";
+    hash = "sha256-ig0AMGNshe0bm7ZOkqV62hEcLeYlHBayMLk2fJQ8Uyo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@ -15,13 +15,13 @@

 buildGoModule rec {
  pname = "buildah";
-  version = "1.29.0";
+  version = "1.29.1";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "buildah";
    rev = "v${version}";
-    hash = "sha256-g8Y4ZmQvDbzM7rG1otTxm+SRl/sK3sLM2SOWrBseOPQ=";
+    hash = "sha256-l21mirarWEOd+XxyM0YgfDiA1JSEr/uqREmBS22C9fs=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/development/tools/buildkit/default.nix
+++ b/pkgs/development/tools/buildkit/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "buildkit";
-  version = "0.11.4";
+  version = "0.11.5";

  src = fetchFromGitHub {
    owner = "moby";
    repo = "buildkit";
    rev = "v${version}";
-    hash = "sha256-/9gP8ciHeFKjO0VAKXDor19Wm6wULLVlFYbHUYWFpWY=";
+    hash = "sha256-bQqdHSmouZm89sV2GjBrEwYTdTYKttVBfXcm2fN09NI=";
  };

  vendorHash = null;
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "clj-kondo";
-  version = "2023.02.17";
+  version = "2023.03.17";

  src = fetchurl {
    url = "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-HVwZZ280ZABgG/LAAaRfq6wYmUF1c2ojR7XLMCwVSk0=";
+    sha256 = "sha256-hI/0kYAQtkDSu8LE8CO6+2zDA6OOK/MdybsLQEPMkCk=";
  };

  extraNativeImageBuildArgs = [
--- a/pkgs/development/tools/coursier/default.nix
+++ b/pkgs/development/tools/coursier/default.nix
@ -1,24 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre, writeScript, common-updater-scripts
 , coreutils, git, gnused, nix, nixfmt }:

-let
+stdenv.mkDerivation rec {
+  pname = "coursier";
  version = "2.1.0-RC6";

-  zshCompletion = fetchurl {
-    url =
-      "https://raw.githubusercontent.com/coursier/coursier/v${version}/modules/cli/src/main/resources/completions/zsh";
-    sha256 = "0afxzrk9w1qinfsz55jjrxydw0fcv6p722g1q955dl7f6xbab1jh";
-  };
-
-  repo = "git@github.com:coursier/coursier.git";
-in stdenv.mkDerivation rec {
-  inherit version;
-
-  pname = "coursier";
-
  src = fetchurl {
-    url =
-      "https://github.com/coursier/coursier/releases/download/v${version}/coursier";
+    url = "https://github.com/coursier/coursier/releases/download/v${version}/coursier";
    sha256 = "0b52qp0jb2bhb649r6cca0yd1cj8wsyp0f1j3pnmir6rizjwkm5q";
  };

@ -28,28 +16,18 @@ in stdenv.mkDerivation rec {
    install -Dm555 $src $out/bin/cs
    patchShebangs $out/bin/cs
    wrapProgram $out/bin/cs --prefix PATH ":" ${jre}/bin
-
-    # copy zsh completion
-    install -Dm755 ${zshCompletion} $out/share/zsh/site-functions/_cs
  '';

  passthru.updateScript = writeScript "update.sh" ''
    #!${stdenv.shell}
    set -o errexit
-    PATH=${
-      lib.makeBinPath [ common-updater-scripts coreutils git gnused nix nixfmt ]
-    }
+    PATH=${lib.makeBinPath [ common-updater-scripts coreutils git gnused nix ]}
    oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion ${pname}" | tr -d '"')"
-    latestTag="$(git -c 'versionsort.suffix=-' ls-remote --exit-code --refs --sort='version:refname' --tags ${repo} 'v*.*.*' | tail --lines=1 | cut --delimiter='/' --fields=3 | sed 's|^v||g')"
+    latestTag="$(git -c 'versionsort.suffix=-' ls-remote --exit-code --refs --sort='version:refname' --tags https://github.com/coursier/coursier.git 'v*.*.*' | tail --lines=1 | cut --delimiter='/' --fields=3 | sed 's|^v||g')"
    if [ "$oldVersion" != "$latestTag" ]; then
      nixpkgs="$(git rev-parse --show-toplevel)"
      default_nix="$nixpkgs/pkgs/development/tools/coursier/default.nix"
      update-source-version ${pname} "$latestTag" --version-key=version --print-changes
-      url="${builtins.head zshCompletion.urls}"
-      completion_url=$(echo $url | sed "s|$oldVersion|$latestTag|g")
-      completion_sha256="$(nix-prefetch-url --type sha256 $completion_url)"
-      sed -i "s|${zshCompletion.outputHash}|$completion_sha256|g" "$default_nix"
-      nixfmt "$default_nix"
    else
      echo "${pname} is already up-to-date"
    fi
@ -57,8 +35,7 @@ in stdenv.mkDerivation rec {

  meta = with lib; {
    homepage = "https://get-coursier.io/";
-    description =
-      "A Scala library to fetch dependencies from Maven / Ivy repositories";
+    description = "Scala library to fetch dependencies from Maven / Ivy repositories";
    license = licenses.asl20;
    maintainers = with maintainers; [ adelbertc nequissimus ];
  };
--- a/pkgs/development/tools/git-ps-rs/default.nix
+++ b/pkgs/development/tools/git-ps-rs/default.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-ps-rs";
-  version = "6.5.0";
+  version = "6.6.0";

  src = fetchFromGitHub {
    owner = "uptech";
    repo = "git-ps-rs";
    rev = version;
-    hash = "sha256-4wSm3H+98ZJZ+fZdLYshPKafRkPq98Pv3Lwh9o0be6U=";
+    hash = "sha256-pWad/OCSoszdEQb6Mb6fD4vsZRagbYa3TKft4IyGg94=";
  };

-  cargoHash = "sha256-1p46xvo7abMPlVP8BeQ1j/8QQpK3kCgbTL3cdidfq04=";
+  cargoHash = "sha256-MoWb6slvcTlLYbUg/5xBuOYT40C9SQeHIJKdBdhqics=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/development/tools/misc/drush/default.nix
+++ b/pkgs/development/tools/misc/drush/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "drush";
-  version = "8.4.11";
+  version = "8.4.12";

  src = fetchurl {
    url = "https://github.com/drush-ops/drush/releases/download/${version}/drush.phar";
-    sha256 = "sha256-4DD16PQHGZzAGwmm/WNeZ/dDKnlQslcb35AkpiJs5tQ=";
+    sha256 = "sha256-YtD9lD621LJJAM/ieL4KWvY4o4Uqo3+FWgjGYGdQQaw=";
  };

  dontUnpack = true;
--- a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
@ -1,10 +1,11 @@
 { pkgs ? import <nixpkgs> { }
 , lib ? pkgs.lib
+, poetry ? null
 , poetryLib ? import ./lib.nix { inherit lib pkgs; stdenv = pkgs.stdenv; }
 }:
 let
  # Poetry2nix version
-  version = "1.39.1";
+  version = "1.40.1";

  inherit (poetryLib) isCompatible readTOML normalizePackageName normalizePackageSet;

@ -27,6 +28,7 @@ let
    , includeBuildSystem ? true
    , groups ? [ ]
    , checkGroups ? [ "dev" ]
+    , extras ? [ "*" ]  # * means all extras, otherwise include the dependencies for a given extra
    }:
    let
      getInputs = attr: attrs.${attr} or [ ];
@ -58,12 +60,26 @@ let

      mkInput = attr: extraInputs: getInputs attr ++ extraInputs;

+      rawDeps = pyProject.tool.poetry."dependencies" or { };
+
+      rawRequiredDeps = lib.filterAttrs (_: v: !(v.optional or false)) rawDeps;
+
+      desiredExtrasDeps = lib.unique
+        (lib.concatMap (extra: pyProject.tool.poetry.extras.${extra}) extras);
+
+      allRawDeps =
+        if extras == [ "*" ] then
+          rawDeps
+        else
+          rawRequiredDeps // lib.getAttrs desiredExtrasDeps rawDeps;
+      checkInputs' = getDeps (pyProject.tool.poetry."dev-dependencies" or { })  # <poetry-1.2.0
+        # >=poetry-1.2.0 dependency groups
+        ++ lib.flatten (map (g: getDeps (pyProject.tool.poetry.group.${g}.dependencies or { })) checkGroups);
    in
    {
      buildInputs = mkInput "buildInputs" (if includeBuildSystem then buildSystemPkgs else [ ]);
      propagatedBuildInputs = mkInput "propagatedBuildInputs" (
-        (getDeps pyProject.tool.poetry."dependencies" or { })
-        ++ (
+        getDeps allRawDeps ++ (
          # >=poetry-1.2.0 dependency groups
          if pyProject.tool.poetry.group or { } != { }
          then lib.flatten (map (g: getDeps pyProject.tool.poetry.group.${g}.dependencies) groups)
@ -71,11 +87,8 @@ let
        )
      );
      nativeBuildInputs = mkInput "nativeBuildInputs" [ ];
-      nativeCheckInputs = mkInput "nativeCheckInputs" (
-        getDeps (pyProject.tool.poetry."dev-dependencies" or { })  # <poetry-1.2.0
-        # >=poetry-1.2.0 dependency groups
-        ++ lib.flatten (map (g: getDeps (pyProject.tool.poetry.group.${g}.dependencies or { })) checkGroups)
-      );
+      checkInputs = mkInput "checkInputs" checkInputs';
+      nativeCheckInputs = mkInput "nativeCheckInputs" checkInputs';
    };


@ -124,6 +137,7 @@ lib.makeScope pkgs.newScope (self: {
    { projectDir ? null
    , pyproject ? projectDir + "/pyproject.toml"
    , poetrylock ? projectDir + "/poetry.lock"
+    , poetrylockPos ? { file = toString poetrylock; line = 0; column = 0; }
    , overrides ? self.defaultPoetryOverrides
    , python ? pkgs.python3
    , pwd ? projectDir
@ -133,6 +147,7 @@ lib.makeScope pkgs.newScope (self: {
    , pyProject ? readTOML pyproject
    , groups ? [ ]
    , checkGroups ? [ "dev" ]
+    , extras ? [ "*" ]
    }:
    let
      /* The default list of poetry2nix override overlays */
@ -193,6 +208,7 @@ lib.makeScope pkgs.newScope (self: {
                  value = self.mkPoetryDep (
                    pkgMeta // {
                      inherit pwd preferWheels;
+                      pos = poetrylockPos;
                      source = pkgMeta.source or null;
                      # Default to files from lock file version 2.0 and fall back to 1.1
                      files = pkgMeta.files or lockFiles.${normalizedName};
@ -221,6 +237,11 @@ lib.makeScope pkgs.newScope (self: {
        (
          [
            # Remove Python packages aliases with non-normalized names to avoid issues with infinite recursion (issue #750).
+            (self: super: {
+              # Upstream nixpkgs uses non canonical names
+              async-generator = super.async-generator or super.async_generator or null;
+            })
+
            (self: super: lib.attrsets.mapAttrs
              (
                name: value:
@ -248,7 +269,7 @@ lib.makeScope pkgs.newScope (self: {
                }
            )

-            # Fix infinite recursion in a lot of packages because of nativeCheckInputs
+            # Fix infinite recursion in a lot of packages because of checkInputs
            (self: super: lib.mapAttrs
              (name: value: (
                if lib.isDerivation value && lib.hasAttr "overridePythonAttrs" value
@ -268,7 +289,7 @@ lib.makeScope pkgs.newScope (self: {
      packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) overlays;
      py = python.override { inherit packageOverrides; self = py; };

-      inputAttrs = mkInputAttrs { inherit py pyProject groups checkGroups; attrs = { }; includeBuildSystem = false; };
+      inputAttrs = mkInputAttrs { inherit py pyProject groups checkGroups extras; attrs = { }; includeBuildSystem = false; };

      requiredPythonModules = python.pkgs.requiredPythonModules;
      /* Include all the nested dependencies which are required for each package.
@ -304,6 +325,7 @@ lib.makeScope pkgs.newScope (self: {
    , editablePackageSources ? { }
    , extraPackages ? ps: [ ]
    , groups ? [ "dev" ]
+    , extras ? [ "*" ]
    }:
    let
      inherit (lib) hasAttr;
@ -336,7 +358,7 @@ lib.makeScope pkgs.newScope (self: {
        excludedEditablePackageNames;

      poetryPython = self.mkPoetryPackages {
-        inherit pyproject poetrylock overrides python pwd preferWheels pyProject groups;
+        inherit pyproject poetrylock overrides python pwd preferWheels pyProject groups extras;
        editablePackageSources = editablePackageSources';
      };

@ -371,11 +393,12 @@ lib.makeScope pkgs.newScope (self: {
    , preferWheels ? false
    , groups ? [ ]
    , checkGroups ? [ "dev" ]
+    , extras ? [ "*" ]
    , ...
    }@attrs:
    let
      poetryPython = self.mkPoetryPackages {
-        inherit pyproject poetrylock overrides python pwd preferWheels groups checkGroups;
+        inherit pyproject poetrylock overrides python pwd preferWheels groups checkGroups extras;
      };
      py = poetryPython.python;

@ -392,7 +415,7 @@ lib.makeScope pkgs.newScope (self: {
      ];
      passedAttrs = builtins.removeAttrs attrs specialAttrs;

-      inputAttrs = mkInputAttrs { inherit py pyProject attrs groups checkGroups; };
+      inputAttrs = mkInputAttrs { inherit py pyProject attrs groups checkGroups extras; };

      app = py.pkgs.buildPythonPackage (
        passedAttrs // inputAttrs // {
@ -481,7 +504,7 @@ lib.makeScope pkgs.newScope (self: {
  /*
    The default list of poetry2nix override overlays

-    Can be overridden by calling defaultPoetryOverrides.overrideOverlay which takes an overlay function
+    Can be overriden by calling defaultPoetryOverrides.overrideOverlay which takes an overlay function
  */
  defaultPoetryOverrides = self.mkDefaultPoetryOverrides (import ./overrides { inherit pkgs lib poetryLib; });

@ -501,8 +524,8 @@ lib.makeScope pkgs.newScope (self: {
      combining it with poetry2nix default overrides
    */
    withDefaults = overlay: [
-      self.defaultPoetryOverrides
      overlay
+      self.defaultPoetryOverrides
    ];
  };
 })
--- a/pkgs/development/tools/poetry2nix/poetry2nix/fetch_from_legacy.py
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/fetch_from_legacy.py
@ -60,6 +60,12 @@ context = ssl.create_default_context()
 context.check_hostname = False
 context.verify_mode = ssl.CERT_NONE

+# Extract out username/password from index_url, if present.
+parsed_url = urlparse(index_url)
+username = parsed_url.username or username
+password = parsed_url.password or password
+index_url = parsed_url._replace(netloc=parsed_url.netloc.rpartition("@")[-1]).geturl()
+
 req = urllib.request.Request(index_url)
 if username and password:
    import base64
--- a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
@ -1,12 +1,14 @@
 { python
+, stdenv
 , buildPackages
 , makeSetupHook
 , wheel
 , pip
 , pkgs
+, lib
 }:
 let
-  callPackage = python.pythonForBuild.pkgs.callPackage;
+  inherit (python.pythonForBuild.pkgs) callPackage;
  pythonInterpreter = python.pythonForBuild.interpreter;
  pythonSitePackages = python.sitePackages;

@ -14,23 +16,27 @@ let
  makeRemoveSpecialDependenciesHook = { fields, kind }:
    nonOverlayedPython.pkgs.callPackage
      (
-        {}:
+        _:
        makeSetupHook
          {
            name = "remove-path-dependencies.sh";
-            propagatedBuildInputs = [ ];
            substitutions = {
              # NOTE: We have to use a non-overlayed Python here because otherwise we run into an infinite recursion
              # because building of tomlkit and its dependencies also use these hooks.
              pythonPath = nonOverlayedPython.pkgs.makePythonPath [ nonOverlayedPython ];
              pythonInterpreter = nonOverlayedPython.interpreter;
              pyprojectPatchScript = "${./pyproject-without-special-deps.py}";
-              fields = fields;
-              kind = kind;
+              inherit fields;
+              inherit kind;
            };
          } ./remove-special-dependencies.sh
      )
      { };
+  makeSetupHookArgs = deps:
+    if lib.elem "propagatedBuildInputs" (builtins.attrNames (builtins.functionArgs makeSetupHook)) then
+      { propagatedBuildInputs = deps; }
+    else
+      { inherit deps; };
 in
 {
  removePathDependenciesHook = makeRemoveSpecialDependenciesHook {
@ -48,23 +54,21 @@ in
    (
      { pip, wheel }:
      makeSetupHook
-        {
+        ({
          name = "pip-build-hook.sh";
-          propagatedBuildInputs = [ pip wheel ];
          substitutions = {
            inherit pythonInterpreter pythonSitePackages;
          };
-        } ./pip-build-hook.sh
+        } // (makeSetupHookArgs [ pip wheel ])) ./pip-build-hook.sh
    )
    { };

  poetry2nixFixupHook = callPackage
    (
-      {}:
+      _:
      makeSetupHook
        {
          name = "fixup-hook.sh";
-          propagatedBuildInputs = [ ];
          substitutions = {
            inherit pythonSitePackages;
            filenames = builtins.concatStringsSep " " [
@ -77,14 +81,51 @@ in
    )
    { };

+  # As of 2023-03 a newer version of packaging introduced a new behaviour where python-requires
+  # cannot contain version wildcards. This behaviour is complaint with PEP440
+  #
+  # The wildcards are a no-op anyway so we can work around this issue by just dropping the precision down to the last known number.
+  poetry2nixPythonRequiresPatchHook = callPackage
+    (
+      _:
+      let
+        # Python pre 3.9 does not contain the ast.unparse method.
+        # We can extract this from Python 3.8 for any
+        unparser = stdenv.mkDerivation {
+          name = "${python.name}-astunparse";
+          inherit (python) src;
+          dontConfigure = true;
+          dontBuild = true;
+
+          installPhase = ''
+            mkdir -p $out/poetry2nix_astunparse
+            cp ./Tools/parser/unparse.py $out/poetry2nix_astunparse/__init__.py
+          '';
+        };
+
+        pythonPath =
+          [ ]
+          ++ lib.optional (lib.versionOlder python.version "3.9") unparser;
+
+      in
+      makeSetupHook
+        {
+          name = "require-python-patch-hook.sh";
+          substitutions = {
+            inherit pythonInterpreter pythonPath;
+            patchScript = ./python-requires-patch-hook.py;
+          };
+        } ./python-requires-patch-hook.sh
+    )
+    { };
+
  # When the "wheel" package itself is a wheel the nixpkgs hook (which pulls in "wheel") leads to infinite recursion
  # It doesn't _really_ depend on wheel though, it just copies the wheel.
  wheelUnpackHook = callPackage
-    ({}:
+    (_:
      makeSetupHook
        {
          name = "wheel-unpack-hook.sh";
-          propagatedBuildInputs = [ ];
        } ./wheel-unpack-hook.sh
    )
    { };
--- a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/python-requires-patch-hook.py
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/python-requires-patch-hook.py
@ -0,0 +1,79 @@
+#!/usr/bin/env python
+import ast
+import sys
+import io
+
+
+# Python2 compat
+if sys.version_info[0] < 3:
+    FileNotFoundError = IOError
+
+
+# Python <= 3.8 compat
+def astunparse(tree):
+    # Use bundled unparse by default
+    if hasattr(ast, "unparse"):
+        return ast.unparse(tree)
+
+    # Use example tool from Python sources for older interpreter versions
+    from poetry2nix_astunparse import Unparser
+
+    buf = io.StringIO()
+    up = Unparser(tree, buf)
+
+    return buf.getvalue()
+
+
+class Rewriter(ast.NodeVisitor):
+    def __init__(self, *args, **kwargs):
+        super(Rewriter, self).__init__(*args, **kwargs)
+        self.modified = False
+
+    def visit_Call(self, node):
+        function_name = ""
+
+        if isinstance(node.func, ast.Name):
+            function_name = node.func.id
+        elif isinstance(node.func, ast.Attribute):
+            function_name = node.func.attr
+        else:
+            return
+
+        if function_name != "setup":
+            return
+
+        for kw in node.keywords:
+            if kw.arg != "python_requires":
+                continue
+
+            value = kw.value
+            if not isinstance(value, ast.Constant):
+                return
+
+            # Rewrite version constraints without wildcard characters.
+            #
+            # Only rewrite the file if the modified value actually differs, as we lose whitespace and comments when rewriting
+            # with the AST module.
+            python_requires = ", ".join(
+                [v.strip().rstrip(".*") for v in value.value.split(",")]
+            )
+            if value.value != python_requires:
+                value.value = python_requires
+                self.modified = True
+
+
+if __name__ == "__main__":
+    sys.path.extend(sys.argv[1:])
+
+    try:
+        with open("setup.py") as f:
+            tree = ast.parse(f.read())
+    except FileNotFoundError:
+        exit(0)
+
+    r = Rewriter()
+    r.visit(tree)
+
+    if r.modified:
+        with open("setup.py", "w") as f:
+            f.write(astunparse(tree))
--- a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/python-requires-patch-hook.sh
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/python-requires-patch-hook.sh
@ -0,0 +1,7 @@
+poetry2nix-python-requires-patch-hook() {
+    if [ -z "${dontFixupPythonRequires-}" ]; then
+        @pythonInterpreter@ @patchScript@ @pythonPath@
+    fi
+}
+
+postPatchHooks+=(poetry2nix-python-requires-patch-hook)
--- a/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
@ -151,7 +151,7 @@ let
        (builtins.filter
          ({ prefix, path }: "NETRC" == prefix)
          builtins.nixPath);
-      netrc_file = lib.optionalString (pathParts != [ ]) (builtins.head pathParts).path;
+      netrc_file = if (pathParts != [ ]) then (builtins.head pathParts).path else "";
    in
    pkgs.runCommand file
      {
--- a/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
@ -7,6 +7,7 @@
 }:
 { name
 , version
+, pos ? __curPos
 , files
 , source
 , dependencies ? { }
@ -45,6 +46,7 @@ pythonPackages.callPackage
      isSource = source != null;
      isGit = isSource && source.type == "git";
      isUrl = isSource && source.type == "url";
+      isWheelUrl = isSource && source.type == "url" && lib.strings.hasSuffix ".whl" source.url;
      isDirectory = isSource && source.type == "directory";
      isFile = isSource && source.type == "file";
      isLegacy = isSource && source.type == "legacy";
@ -61,6 +63,8 @@ pythonPackages.callPackage
              inherit pythonPackages pyProject;
            } else [ ];

+      pname = normalizePackageName name;
+      preferWheel' = preferWheel && pname != "wheel";
      fileInfo =
        let
          isBdist = f: lib.strings.hasSuffix "whl" f.file;
@ -69,7 +73,9 @@ pythonPackages.callPackage
          binaryDist = selectWheel fileCandidates;
          sourceDist = builtins.filter isSdist fileCandidates;
          eggs = builtins.filter isEgg fileCandidates;
-          entries = (if preferWheel then binaryDist ++ sourceDist else sourceDist ++ binaryDist) ++ eggs;
+          # the `wheel` package cannot be built from a wheel, since that requires the wheel package
+          # this causes a circular dependency so we special-case ignore its `preferWheel` attribute value
+          entries = (if preferWheel' then binaryDist ++ sourceDist else sourceDist ++ binaryDist) ++ eggs;
          lockFileEntry = (
            if lib.length entries > 0 then builtins.head entries
            else throw "Missing suitable source/wheel file entry for ${name}"
@ -89,13 +95,12 @@ pythonPackages.callPackage
            else (builtins.elemAt (lib.strings.splitString "-" name) 2);
        };

-      format = if isDirectory || isGit || isUrl then "pyproject" else fileInfo.format;
+      format = if isWheelUrl then "wheel" else if isDirectory || isGit || isUrl then "pyproject" else fileInfo.format;

      hooks = python.pkgs.callPackage ./hooks { };
    in
    buildPythonPackage {
-      pname = normalizePackageName name;
-      version = version;
+      inherit pname version;

      # Circumvent output separation (https://github.com/NixOS/nixpkgs/pull/190487)
      format = if format == "pyproject" then "poetry2nix" else format;
@ -108,6 +113,7 @@ pythonPackages.callPackage
      nativeBuildInputs = [
        hooks.poetry2nixFixupHook
      ]
+      ++ lib.optional (!pythonPackages.isPy27) hooks.poetry2nixPythonRequiresPatchHook
      ++ lib.optional (isLocked && (getManyLinuxDeps fileInfo.name).str != null) autoPatchelfHook
      ++ lib.optionals (format == "wheel") [
        hooks.wheelUnpackHook
@ -147,6 +153,8 @@ pythonPackages.callPackage
        in
        builtins.map (n: pythonPackages.${normalizePackageName n}) depAttrs;

+      inherit pos;
+
      meta = {
        broken = ! isCompatible (poetryLib.getPythonVersion python) python-versions;
        license = [ ];
@ -155,6 +163,7 @@ pythonPackages.callPackage

      passthru = {
        inherit args;
+        preferWheel = preferWheel';
      };

      # We need to retrieve kind from the interpreter and the filename of the package
@ -174,10 +183,17 @@ pythonPackages.callPackage
              }
            ))
          )
+        else if isWheelUrl then
+          builtins.fetchurl
+            {
+              inherit (source) url;
+              sha256 = fileInfo.hash;
+            }
        else if isUrl then
          builtins.fetchTarball
            {
              inherit (source) url;
+              sha256 = fileInfo.hash;
            }
        else if isDirectory then
          (poetryLib.cleanPythonSources { src = localDepPath; })
--- a/Show More
+++ b/Show More