Merge master into staging-next

2023-04-18 18:01:12 +00:00 · 2023-04-18 18:01:12 +00:00 · bcef81037b
commit bcef81037b
parent ee5e6a6453 7d9a498788
89 changed files with 3378 additions and 1795 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1124,6 +1124,16 @@
    githubId = 73002165;
    name = "apfelkuchen6";
  };
+  aplund = {
+    email = "austin.lund@gmail.com";
+    matrix = "@aplund:matrix.org";
+    github = "aplund";
+    githubId = 1369436;
+    name = "Austin Lund";
+    keys = [{
+      fingerprint = "7083 E268 4BFD 845F 2B84  9E74 B695 8918 ED23 32CE";
+    }];
+  };
  applePrincess = {
    email = "appleprincess@appleprincess.io";
    github = "applePrincess";
@ -6740,6 +6750,12 @@
      fingerprint = "6BD3 7248 30BD 941E 9180  C1A3 3A33 FA4C 82ED 674F";
    }];
  };
+  ivanmoreau = {
+    email = "Iván Molina Rebolledo";
+    github = "ivanmoreau";
+    githubId = 10843250;
+    name = "ivan@ivmoreau.com";
+  };
  ivan-timokhin = {
    email = "nixpkgs@ivan.timokhin.name";
    name = "Ivan Timokhin";
@ -10572,6 +10588,12 @@
    githubId = 133448;
    name = "Mikołaj Siedlarek";
  };
+  mslingsby = {
+    email = "morten.slingsby@eviny.no";
+    github = "MortenSlingsby";
+    githubId = 111859550;
+    name = "Morten Slingsby";
+  };
  msm = {
    email = "msm@tailcall.net";
    github = "msm-code";
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -63,6 +63,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [opensearch](https://opensearch.org), a search server alternative to Elasticsearch. Available as [services.opensearch](options.html#opt-services.opensearch.enable).

+- [monica](https://www.monicahq.com), an open source personal CRM. Available as [services.monica](options.html#opt-services.monica.enable).
+
 - [authelia](https://www.authelia.com/), is an open-source authentication and authorization server. Available under [services.authelia](options.html#opt-services.authelia.enable).

 - [goeland](https://github.com/slurdge/goeland), an alternative to rss2email written in golang with many filters. Available as [services.goeland](#opt-services.goeland.enable).
@ -89,6 +91,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [ulogd](https://www.netfilter.org/projects/ulogd/index.html), a userspace logging daemon for netfilter/iptables related logging. Available as [services.ulogd](options.html#opt-services.ulogd.enable).

+- [PufferPanel](https://pufferpanel.com), game server management panel designed to be easy to use. Available as [services.pufferpanel](#opt-services.pufferpanel.enable).
+
 - [jellyseerr](https://github.com/Fallenbagel/jellyseerr), a web-based requests manager for Jellyfin, forked from Overseerr. Available as [services.jellyseerr](#opt-services.jellyseerr.enable).

 - [photoprism](https://photoprism.app/), a AI-Powered Photos App for the Decentralized Web. Available as [services.photoprism](options.html#opt-services.photoprism.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -670,6 +670,7 @@
  ./services/misc/polaris.nix
  ./services/misc/portunus.nix
  ./services/misc/prowlarr.nix
+  ./services/misc/pufferpanel.nix
  ./services/misc/pykms.nix
  ./services/misc/radarr.nix
  ./services/misc/readarr.nix
@ -1182,6 +1183,7 @@
  ./services/web-apps/mattermost.nix
  ./services/web-apps/mediawiki.nix
  ./services/web-apps/miniflux.nix
+  ./services/web-apps/monica.nix
  ./services/web-apps/moodle.nix
  ./services/web-apps/netbox.nix
  ./services/web-apps/nextcloud.nix
--- a/nixos/modules/programs/tmux.nix
+++ b/nixos/modules/programs/tmux.nix
@ -160,7 +160,10 @@ in {
        default = defaultTerminal;
        example = "screen-256color";
        type = types.str;
-        description = lib.mdDoc "Set the $TERM variable.";
+        description = lib.mdDoc ''
+          Set the $TERM variable. Use tmux-direct if italics or 24bit true color
+          support is needed.
+        '';
      };

      secureSocket = mkOption {
--- a/nixos/modules/services/misc/pufferpanel.nix
+++ b/nixos/modules/services/misc/pufferpanel.nix
@ -0,0 +1,176 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.pufferpanel;
+in
+{
+  options.services.pufferpanel = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Whether to enable PufferPanel game management server.
+
+        Note that [PufferPanel templates] and binaries downloaded by PufferPanel
+        expect [FHS environment]. It is possible to set {option}`package` option
+        to use PufferPanel wrapper with FHS environment. For example, to use
+        `Download Game from Steam` and `Download Java` template operations:
+        ```Nix
+        { lib, pkgs, ... }: {
+          services.pufferpanel = {
+            enable = true;
+            extraPackages = with pkgs; [ bash curl gawk gnutar gzip ];
+            package = pkgs.buildFHSUserEnv {
+              name = "pufferpanel-fhs";
+              runScript = lib.getExe pkgs.pufferpanel;
+              targetPkgs = pkgs': with pkgs'; [ icu openssl zlib ];
+            };
+          };
+        }
+        ```
+
+        [PufferPanel templates]: https://github.com/PufferPanel/templates
+        [FHS environment]: https://wikipedia.org/wiki/Filesystem_Hierarchy_Standard
+      '';
+    };
+
+    package = lib.mkPackageOptionMD pkgs "pufferpanel" { };
+
+    extraGroups = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "podman" ];
+      description = lib.mdDoc ''
+        Additional groups for the systemd service.
+      '';
+    };
+
+    extraPackages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ ];
+      example = lib.literalExpression "[ pkgs.jre ]";
+      description = lib.mdDoc ''
+        Packages to add to the PATH environment variable. Both the {file}`bin`
+        and {file}`sbin` subdirectories of each package are added.
+      '';
+    };
+
+    environment = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      example = lib.literalExpression ''
+        {
+          PUFFER_WEB_HOST = ":8080";
+          PUFFER_DAEMON_SFTP_HOST = ":5657";
+          PUFFER_DAEMON_CONSOLE_BUFFER = "1000";
+          PUFFER_DAEMON_CONSOLE_FORWARD = "true";
+          PUFFER_PANEL_REGISTRATIONENABLED = "false";
+        }
+      '';
+      description = lib.mdDoc ''
+        Environment variables to set for the service. Secrets should be
+        specified using {option}`environmentFile`.
+
+        Refer to the [PufferPanel source code][] for the list of available
+        configuration options. Variable name is an upper-cased configuration
+        entry name with underscores instead of dots, prefixed with `PUFFER_`.
+        For example, `panel.settings.companyName` entry can be set using
+        {env}`PUFFER_PANEL_SETTINGS_COMPANYNAME`.
+
+        When running with panel enabled (configured with `PUFFER_PANEL_ENABLE`
+        environment variable), it is recommended disable registration using
+        `PUFFER_PANEL_REGISTRATIONENABLED` environment variable (registration is
+        enabled by default). To create the initial administrator user, run
+        {command}`pufferpanel --workDir /var/lib/pufferpanel user add --admin`.
+
+        Some options override corresponding settings set via web interface (e.g.
+        `PUFFER_PANEL_REGISTRATIONENABLED`). Those options can be temporarily
+        toggled or set in settings but do not persist between restarts.
+
+        [PufferPanel source code]: https://github.com/PufferPanel/PufferPanel/blob/master/config/entries.go
+      '';
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = lib.mdDoc ''
+        File to load environment variables from. Loaded variables override
+        values set in {option}`environment`.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.pufferpanel = {
+      description = "PufferPanel game management server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      path = cfg.extraPackages;
+      environment = cfg.environment;
+
+      # Note that we export environment variables for service directories if the
+      # value is not set. An empty environment variable is considered to be set.
+      # E.g.
+      #   export PUFFER_LOGS=${PUFFER_LOGS-$LOGS_DIRECTORY}
+      # would set PUFFER_LOGS to $LOGS_DIRECTORY if PUFFER_LOGS environment
+      # variable is not defined.
+      script = ''
+        ${lib.concatLines (lib.mapAttrsToList (name: value: ''
+          export ${name}="''${${name}-${value}}"
+        '') {
+          PUFFER_LOGS = "$LOGS_DIRECTORY";
+          PUFFER_DAEMON_DATA_CACHE = "$CACHE_DIRECTORY";
+          PUFFER_DAEMON_DATA_SERVERS = "$STATE_DIRECTORY/servers";
+          PUFFER_DAEMON_DATA_BINARIES = "$STATE_DIRECTORY/binaries";
+        })}
+        exec ${lib.getExe cfg.package} run --workDir "$STATE_DIRECTORY"
+      '';
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+
+        UMask = "0077";
+
+        SupplementaryGroups = cfg.extraGroups;
+
+        StateDirectory = "pufferpanel";
+        StateDirectoryMode = "0700";
+        CacheDirectory = "pufferpanel";
+        CacheDirectoryMode = "0700";
+        LogsDirectory = "pufferpanel";
+        LogsDirectoryMode = "0700";
+
+        EnvironmentFile = cfg.environmentFile;
+
+        # Command "pufferpanel shutdown --pid $MAINPID" sends SIGTERM (code 15)
+        # to the main process and waits for termination. This is essentially
+        # KillMode=mixed we are using here. See
+        # https://freedesktop.org/software/systemd/man/systemd.kill.html#KillMode=
+        KillMode = "mixed";
+
+        DynamicUser = true;
+        ProtectHome = true;
+        ProtectProc = "invisible";
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectControlGroups = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        PrivateUsers = true;
+        PrivateDevices = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = [ "user" "mnt" ]; # allow buildFHSUserEnv
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        LockPersonality = true;
+        DeviceAllow = [ "" ];
+        DevicePolicy = "closed";
+        CapabilityBoundingSet = [ "" ];
+      };
+    };
+  };
+
+  meta.maintainers = [ lib.maintainers.tie ];
+}
--- a/nixos/modules/services/system/cachix-watch-store.nix
+++ b/nixos/modules/services/system/cachix-watch-store.nix
@ -62,7 +62,13 @@ in
      after = [ "network-online.target" ];
      path = [ config.nix.package ];
      wantedBy = [ "multi-user.target" ];
+      unitConfig = {
+        # allow to restart indefinitely
+        StartLimitIntervalSec = 0;
+      };
      serviceConfig = {
+        # don't put too much stress on the machine when restarting
+        RestartSec = 1;
        # we don't want to kill children processes as those are deployments
        KillMode = "process";
        Restart = "on-failure";
--- a/nixos/modules/services/web-apps/monica.nix
+++ b/nixos/modules/services/web-apps/monica.nix
@ -0,0 +1,468 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.services.monica;
+  monica = pkgs.monica.override {
+    dataDir = cfg.dataDir;
+  };
+  db = cfg.database;
+  mail = cfg.mail;
+
+  user = cfg.user;
+  group = cfg.group;
+
+  # shell script for local administration
+  artisan = pkgs.writeScriptBin "monica" ''
+    #! ${pkgs.runtimeShell}
+    cd ${monica}
+    sudo() {
+      if [[ "$USER" != ${user} ]]; then
+        exec /run/wrappers/bin/sudo -u ${user} "$@"
+      else
+        exec "$@"
+      fi
+    }
+    sudo ${pkgs.php}/bin/php artisan "$@"
+  '';
+
+  tlsEnabled = cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME;
+in {
+  options.services.monica = {
+    enable = mkEnableOption (lib.mdDoc "monica");
+
+    user = mkOption {
+      default = "monica";
+      description = lib.mdDoc "User monica runs as.";
+      type = types.str;
+    };
+
+    group = mkOption {
+      default = "monica";
+      description = lib.mdDoc "Group monica runs as.";
+      type = types.str;
+    };
+
+    appKeyFile = mkOption {
+      description = lib.mdDoc ''
+        A file containing the Laravel APP_KEY - a 32 character long,
+        base64 encoded key used for encryption where needed. Can be
+        generated with <code>head -c 32 /dev/urandom | base64</code>.
+      '';
+      example = "/run/keys/monica-appkey";
+      type = types.path;
+    };
+
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default =
+        if config.networking.domain != null
+        then config.networking.fqdn
+        else config.networking.hostName;
+      defaultText = lib.literalExpression "config.networking.fqdn";
+      example = "monica.example.com";
+      description = lib.mdDoc ''
+        The hostname to serve monica on.
+      '';
+    };
+
+    appURL = mkOption {
+      description = lib.mdDoc ''
+        The root URL that you want to host monica on. All URLs in monica will be generated using this value.
+        If you change this in the future you may need to run a command to update stored URLs in the database.
+        Command example: <code>php artisan monica:update-url https://old.example.com https://new.example.com</code>
+      '';
+      default = "http${lib.optionalString tlsEnabled "s"}://${cfg.hostname}";
+      defaultText = ''http''${lib.optionalString tlsEnabled "s"}://''${cfg.hostname}'';
+      example = "https://example.com";
+      type = types.str;
+    };
+
+    dataDir = mkOption {
+      description = lib.mdDoc "monica data directory";
+      default = "/var/lib/monica";
+      type = types.path;
+    };
+
+    database = {
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = lib.mdDoc "Database host address.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 3306;
+        description = lib.mdDoc "Database host port.";
+      };
+      name = mkOption {
+        type = types.str;
+        default = "monica";
+        description = lib.mdDoc "Database name.";
+      };
+      user = mkOption {
+        type = types.str;
+        default = user;
+        defaultText = lib.literalExpression "user";
+        description = lib.mdDoc "Database username.";
+      };
+      passwordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/run/keys/monica-dbpassword";
+        description = lib.mdDoc ''
+          A file containing the password corresponding to
+          <option>database.user</option>.
+        '';
+      };
+      createLocally = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc "Create the database and database user locally.";
+      };
+    };
+
+    mail = {
+      driver = mkOption {
+        type = types.enum ["smtp" "sendmail"];
+        default = "smtp";
+        description = lib.mdDoc "Mail driver to use.";
+      };
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = lib.mdDoc "Mail host address.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 1025;
+        description = lib.mdDoc "Mail host port.";
+      };
+      fromName = mkOption {
+        type = types.str;
+        default = "monica";
+        description = lib.mdDoc "Mail \"from\" name.";
+      };
+      from = mkOption {
+        type = types.str;
+        default = "mail@monica.com";
+        description = lib.mdDoc "Mail \"from\" email.";
+      };
+      user = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        example = "monica";
+        description = lib.mdDoc "Mail username.";
+      };
+      passwordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/run/keys/monica-mailpassword";
+        description = lib.mdDoc ''
+          A file containing the password corresponding to
+          <option>mail.user</option>.
+        '';
+      };
+      encryption = mkOption {
+        type = with types; nullOr (enum ["tls"]);
+        default = null;
+        description = lib.mdDoc "SMTP encryption mechanism to use.";
+      };
+    };
+
+    maxUploadSize = mkOption {
+      type = types.str;
+      default = "18M";
+      example = "1G";
+      description = lib.mdDoc "The maximum size for uploads (e.g. images).";
+    };
+
+    poolConfig = mkOption {
+      type = with types; attrsOf (oneOf [str int bool]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+      };
+      description = lib.mdDoc ''
+        Options for the monica PHP pool. See the documentation on <literal>php-fpm.conf</literal>
+        for details on configuration directives.
+      '';
+    };
+
+    nginx = mkOption {
+      type = types.submodule (
+        recursiveUpdate
+        (import ../web-servers/nginx/vhost-options.nix {inherit config lib;}) {}
+      );
+      default = {};
+      example = ''
+        {
+          serverAliases = [
+            "monica.''${config.networking.domain}"
+          ];
+          # To enable encryption and let let's encrypt take care of certificate
+          forceSSL = true;
+          enableACME = true;
+        }
+      '';
+      description = lib.mdDoc ''
+        With this option, you can customize the nginx virtualHost settings.
+      '';
+    };
+
+    config = mkOption {
+      type = with types;
+        attrsOf
+        (nullOr
+          (either
+            (oneOf [
+              bool
+              int
+              port
+              path
+              str
+            ])
+            (submodule {
+              options = {
+                _secret = mkOption {
+                  type = nullOr str;
+                  description = lib.mdDoc ''
+                    The path to a file containing the value the
+                    option should be set to in the final
+                    configuration file.
+                  '';
+                };
+              };
+            })));
+      default = {};
+      example = ''
+        {
+          ALLOWED_IFRAME_HOSTS = "https://example.com";
+          WKHTMLTOPDF = "/home/user/bins/wkhtmltopdf";
+          AUTH_METHOD = "oidc";
+          OIDC_NAME = "MyLogin";
+          OIDC_DISPLAY_NAME_CLAIMS = "name";
+          OIDC_CLIENT_ID = "monica";
+          OIDC_CLIENT_SECRET = {_secret = "/run/keys/oidc_secret"};
+          OIDC_ISSUER = "https://keycloak.example.com/auth/realms/My%20Realm";
+          OIDC_ISSUER_DISCOVER = true;
+        }
+      '';
+      description = lib.mdDoc ''
+        monica configuration options to set in the
+        <filename>.env</filename> file.
+
+        Refer to <link xlink:href="https://github.com/monicahq/monica"/>
+        for details on supported values.
+
+        Settings containing secret data should be set to an attribute
+        set containing the attribute <literal>_secret</literal> - a
+        string pointing to a file containing the value the option
+        should be set to. See the example to get a better picture of
+        this: in the resulting <filename>.env</filename> file, the
+        <literal>OIDC_CLIENT_SECRET</literal> key will be set to the
+        contents of the <filename>/run/keys/oidc_secret</filename>
+        file.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = db.createLocally -> db.user == user;
+        message = "services.monica.database.user must be set to ${user} if services.monica.database.createLocally is set true.";
+      }
+      {
+        assertion = db.createLocally -> db.passwordFile == null;
+        message = "services.monica.database.passwordFile cannot be specified if services.monica.database.createLocally is set to true.";
+      }
+    ];
+
+    services.monica.config = {
+      APP_ENV = "production";
+      APP_KEY._secret = cfg.appKeyFile;
+      APP_URL = cfg.appURL;
+      DB_HOST = db.host;
+      DB_PORT = db.port;
+      DB_DATABASE = db.name;
+      DB_USERNAME = db.user;
+      MAIL_DRIVER = mail.driver;
+      MAIL_FROM_NAME = mail.fromName;
+      MAIL_FROM = mail.from;
+      MAIL_HOST = mail.host;
+      MAIL_PORT = mail.port;
+      MAIL_USERNAME = mail.user;
+      MAIL_ENCRYPTION = mail.encryption;
+      DB_PASSWORD._secret = db.passwordFile;
+      MAIL_PASSWORD._secret = mail.passwordFile;
+      APP_SERVICES_CACHE = "/run/monica/cache/services.php";
+      APP_PACKAGES_CACHE = "/run/monica/cache/packages.php";
+      APP_CONFIG_CACHE = "/run/monica/cache/config.php";
+      APP_ROUTES_CACHE = "/run/monica/cache/routes-v7.php";
+      APP_EVENTS_CACHE = "/run/monica/cache/events.php";
+      SESSION_SECURE_COOKIE = tlsEnabled;
+    };
+
+    environment.systemPackages = [artisan];
+
+    services.mysql = mkIf db.createLocally {
+      enable = true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = [db.name];
+      ensureUsers = [
+        {
+          name = db.user;
+          ensurePermissions = {"${db.name}.*" = "ALL PRIVILEGES";};
+        }
+      ];
+    };
+
+    services.phpfpm.pools.monica = {
+      inherit user group;
+      phpOptions = ''
+        log_errors = on
+        post_max_size = ${cfg.maxUploadSize}
+        upload_max_filesize = ${cfg.maxUploadSize}
+      '';
+      settings = {
+        "listen.mode" = "0660";
+        "listen.owner" = user;
+        "listen.group" = group;
+      } // cfg.poolConfig;
+    };
+
+    services.nginx = {
+      enable = mkDefault true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedProxySettings = true;
+      virtualHosts.${cfg.hostname} = mkMerge [
+        cfg.nginx
+        {
+          root = mkForce "${monica}/public";
+          locations = {
+            "/" = {
+              index = "index.php";
+              tryFiles = "$uri $uri/ /index.php?$query_string";
+            };
+            "~ \.php$".extraConfig = ''
+              fastcgi_pass unix:${config.services.phpfpm.pools."monica".socket};
+            '';
+            "~ \.(js|css|gif|png|ico|jpg|jpeg)$" = {
+              extraConfig = "expires 365d;";
+            };
+          };
+        }
+      ];
+    };
+
+    systemd.services.monica-setup = {
+      description = "Preperation tasks for monica";
+      before = ["phpfpm-monica.service"];
+      after = optional db.createLocally "mysql.service";
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = user;
+        UMask = 077;
+        WorkingDirectory = "${monica}";
+        RuntimeDirectory = "monica/cache";
+        RuntimeDirectoryMode = 0700;
+      };
+      path = [pkgs.replace-secret];
+      script = let
+        isSecret = v: isAttrs v && v ? _secret && isString v._secret;
+        monicaEnvVars = lib.generators.toKeyValue {
+          mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+            mkValueString = v:
+              with builtins;
+                if isInt v
+                then toString v
+                else if isString v
+                then v
+                else if true == v
+                then "true"
+                else if false == v
+                then "false"
+                else if isSecret v
+                then hashString "sha256" v._secret
+                else throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty {}) v}";
+          };
+        };
+        secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.config);
+        mkSecretReplacement = file: ''
+          replace-secret ${escapeShellArgs [(builtins.hashString "sha256" file) file "${cfg.dataDir}/.env"]}
+        '';
+        secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+        filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! elem v [{} null])) cfg.config;
+        monicaEnv = pkgs.writeText "monica.env" (monicaEnvVars filteredConfig);
+      in ''
+        # error handling
+        set -euo pipefail
+
+        # create .env file
+        install -T -m 0600 -o ${user} ${monicaEnv} "${cfg.dataDir}/.env"
+        ${secretReplacements}
+        if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+          sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+        fi
+
+        # migrate & seed db
+        ${pkgs.php}/bin/php artisan key:generate --force
+        ${pkgs.php}/bin/php artisan setup:production -v --force
+      '';
+    };
+
+    systemd.services.monica-scheduler = {
+      description = "Background tasks for monica";
+      startAt = "minutely";
+      after = ["monica-setup.service"];
+      serviceConfig = {
+        Type = "oneshot";
+        User = user;
+        WorkingDirectory = "${monica}";
+        ExecStart = "${pkgs.php}/bin/php ${monica}/artisan schedule:run -v";
+      };
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${user} ${group} - -"
+      "d ${cfg.dataDir}/public                     0750 ${user} ${group} - -"
+      "d ${cfg.dataDir}/public/uploads             0750 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage                    0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/app                0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/fonts              0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework          0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework/cache    0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework/sessions 0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework/views    0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/logs               0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/uploads            0700 ${user} ${group} - -"
+    ];
+
+    users = {
+      users = mkIf (user == "monica") {
+        monica = {
+          inherit group;
+          isSystemUser = true;
+        };
+        "${config.services.nginx.user}".extraGroups = [group];
+      };
+      groups = mkIf (group == "monica") {
+        monica = {};
+      };
+    };
+  };
+}
+
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -421,6 +421,7 @@ in {
  mjolnir = handleTest ./matrix/mjolnir.nix {};
  mod_perl = handleTest ./mod_perl.nix {};
  molly-brown = handleTest ./molly-brown.nix {};
+  monica = handleTest ./web-apps/monica.nix {};
  mongodb = handleTest ./mongodb.nix {};
  moodle = handleTest ./moodle.nix {};
  moonraker = handleTest ./moonraker.nix {};
@ -587,6 +588,7 @@ in {
  pt2-clone = handleTest ./pt2-clone.nix {};
  pykms = handleTest ./pykms.nix {};
  public-inbox = handleTest ./public-inbox.nix {};
+  pufferpanel = handleTest ./pufferpanel.nix {};
  pulseaudio = discoverTests (import ./pulseaudio.nix);
  qboot = handleTestOn ["x86_64-linux" "i686-linux"] ./qboot.nix {};
  qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix {};
--- a/nixos/tests/pufferpanel.nix
+++ b/nixos/tests/pufferpanel.nix
@ -0,0 +1,74 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "pufferpanel";
+  meta.maintainers = [ lib.maintainers.tie ];
+
+  nodes.machine = { pkgs, ... }: {
+    environment.systemPackages = [ pkgs.pufferpanel ];
+    services.pufferpanel = {
+      enable = true;
+      extraPackages = [ pkgs.netcat ];
+      environment = {
+        PUFFER_PANEL_REGISTRATIONENABLED = "false";
+        PUFFER_PANEL_SETTINGS_COMPANYNAME = "NixOS";
+      };
+    };
+  };
+
+  testScript = ''
+    import shlex
+    import json
+
+    curl = "curl --fail-with-body --silent"
+    baseURL = "http://localhost:8080"
+    adminName = "admin"
+    adminEmail = "admin@nixos.org"
+    adminPass = "admin"
+    adminCreds = json.dumps({
+      "email": adminEmail,
+      "password": adminPass,
+    })
+    stopCode = 9 # SIGKILL
+    serverPort = 1337
+    serverDefinition = json.dumps({
+      "name": "netcat",
+      "node": 0,
+      "users": [
+        adminName,
+      ],
+      "type": "netcat",
+      "run": {
+        "stopCode": stopCode,
+        "command": f"nc -l {serverPort}",
+      },
+      "environment": {
+        "type": "standard",
+      },
+    })
+
+    start_all()
+
+    machine.wait_for_unit("pufferpanel.service")
+    machine.wait_for_open_port(5657) # SFTP
+    machine.wait_for_open_port(8080) # HTTP
+
+    # Note that PufferPanel does not initialize database unless necessary.
+    # /api/config endpoint creates database file and triggers migrations.
+    # On success, we run a command to create administrator user that we use to
+    # interact with HTTP API.
+    resp = json.loads(machine.succeed(f"{curl} {baseURL}/api/config"))
+    assert resp["branding"]["name"] == "NixOS", "Invalid company name in configuration"
+    assert resp["registrationEnabled"] == False, "Expected registration to be disabled"
+
+    machine.succeed(f"pufferpanel --workDir /var/lib/pufferpanel user add --admin --name {adminName} --email {adminEmail} --password {adminPass}")
+
+    resp = json.loads(machine.succeed(f"{curl} -d '{adminCreds}' {baseURL}/auth/login"))
+    assert "servers.admin" in resp["scopes"], "User is not administrator"
+    token = resp["session"]
+    authHeader = shlex.quote(f"Authorization: Bearer {token}")
+
+    resp = json.loads(machine.succeed(f"{curl} -H {authHeader} -H 'Content-Type: application/json' -d '{serverDefinition}' {baseURL}/api/servers"))
+    serverID = resp["id"]
+    machine.succeed(f"{curl} -X POST -H {authHeader} {baseURL}/proxy/daemon/server/{serverID}/start")
+    machine.wait_for_open_port(serverPort)
+  '';
+})
--- a/nixos/tests/web-apps/monica.nix
+++ b/nixos/tests/web-apps/monica.nix
@ -0,0 +1,33 @@
+import ../make-test-python.nix ({pkgs, ...}:
+let
+  cert = pkgs.runCommand "selfSignedCerts" { nativeBuildInputs = [ pkgs.openssl ]; } ''
+    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=localhost' -days 36500
+    mkdir -p $out
+    cp key.pem cert.pem $out
+  '';
+in
+{
+  name = "monica";
+
+  nodes = {
+    machine = {pkgs, ...}: {
+      services.monica = {
+        enable = true;
+        hostname = "localhost";
+        appKeyFile = "${pkgs.writeText "keyfile" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}";
+        nginx = {
+          forceSSL = true;
+          sslCertificate = "${cert}/cert.pem";
+          sslCertificateKey = "${cert}/key.pem";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("monica-setup.service")
+    machine.wait_for_open_port(443)
+    machine.succeed("curl -k --fail https://localhost", timeout=10)
+  '';
+})
--- a/pkgs/applications/audio/mbrola/default.nix
+++ b/pkgs/applications/audio/mbrola/default.nix
@ -1,42 +1,72 @@
-{ stdenv, lib, fetchFromGitHub }:
+{ stdenv, stdenvNoCC, lib, symlinkJoin, fetchFromGitHub }:

 let
-  voices = fetchFromGitHub {
-    owner = "numediart";
-    repo = "MBROLA-voices";
-    rev = "fe05a0ccef6a941207fd6aaad0b31294a1f93a51";  # using latest commit
-    sha256 = "1w0y2xjp9rndwdjagp2wxh656mdm3d6w9cs411g27rjyfy1205a0";
-  };
-in
-stdenv.mkDerivation rec {
  pname = "mbrola";
  version = "3.3";

-  src = fetchFromGitHub {
-    owner = "numediart";
-    repo = "MBROLA";
-    rev = version;
-    sha256 = "1w86gv6zs2cbr0731n49z8v6xxw0g8b0hzyv2iqb9mqcfh38l8zy";
-  };
-
-  # required for cross compilation
-  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
-
-  installPhase = ''
-    runHook preInstall
-    install -D Bin/mbrola $out/bin/mbrola
-
-    # TODO: package separately because it's very big
-    install -d $out/share/mbrola/voices
-    cp -R ${voices}/data/* $out/share/mbrola/voices/
-    runHook postInstall
-  '';
-
  meta = with lib; {
-    description = "Speech synthesizer based on the concatenation of diphones";
-    homepage = "https://github.com/numediart/MBROLA";
    license = licenses.agpl3Plus;
    maintainers = with maintainers; [ davidak ];
    platforms = platforms.linux;
+    description = "Speech synthesizer based on the concatenation of diphones";
+    homepage = "https://github.com/numediart/MBROLA";
  };
+
+  voices = stdenvNoCC.mkDerivation {
+    pname = "${pname}-voices";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "numediart";
+      repo = "MBROLA-voices";
+      rev = "fe05a0ccef6a941207fd6aaad0b31294a1f93a51";  # using latest commit
+      sha256 = "1w0y2xjp9rndwdjagp2wxh656mdm3d6w9cs411g27rjyfy1205a0";
+    };
+
+    dontBuild = true;
+    installPhase = ''
+      runHook preInstall
+      install -d $out/share/mbrola/voices
+      cp -R $src/data/* $out/share/mbrola/voices/
+      runHook postInstall
+    '';
+    dontFixup = true;
+
+    meta = meta // {
+      description = "Speech synthesizer based on the concatenation of diphones (voice files)";
+      homepage = "https://github.com/numediart/MBROLA-voices";
+    };
+  };
+
+  bin = stdenv.mkDerivation {
+    pname = "${pname}-bin";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "numediart";
+      repo = "MBROLA";
+      rev = version;
+      sha256 = "1w86gv6zs2cbr0731n49z8v6xxw0g8b0hzyv2iqb9mqcfh38l8zy";
+    };
+
+    # required for cross compilation
+    makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
+    installPhase = ''
+      runHook preInstall
+      install -D Bin/mbrola $out/bin/mbrola
+      rm -rf $out/share/mbrola/voices/*
+      runHook postInstall
+    '';
+
+    meta = meta // {
+      description = "Speech synthesizer based on the concatenation of diphones (binary only)";
+    };
+  };
+
+in
+symlinkJoin {
+  inherit pname version meta;
+  name = "${pname}-${version}";
+  paths = [ bin voices ];
 }
--- a/pkgs/applications/audio/spotify/darwin.nix
+++ b/pkgs/applications/audio/spotify/darwin.nix
@ -0,0 +1,37 @@
+{ stdenv
+, pname
+, meta
+, fetchurl
+, undmg
+, lib
+}:
+
+stdenv.mkDerivation {
+  inherit pname;
+
+  version = "1.1.97.962.g24733a46";
+
+  src = if stdenv.isAarch64 then (
+    fetchurl {
+      url = "https://web.archive.org/web/20221101120432/https://download.scdn.co/SpotifyARM64.dmg";
+      sha256 = "sha256-8WDeVRgaZXuUa95PNa15Cuul95ynklBaZpuq+U1eGTU=";
+    })
+  else (
+    fetchurl {
+      url = "https://web.archive.org/web/20221101120647/https://download.scdn.co/Spotify.dmg";
+      sha256 = "sha256-uPpD8Hv70FlaSjtt9rq5ntI64agxG8+/LNEvRe4ocJ4=";
+    });
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+  '';
+
+  meta = meta // {
+    maintainers = with lib.maintainers; [ Enzime ];
+  };
+}
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@ -1,182 +1,16 @@
-{ fetchurl, lib, stdenv, squashfsTools, xorg, alsa-lib, makeShellWrapper, wrapGAppsHook, openssl, freetype
-, glib, pango, cairo, atk, gdk-pixbuf, gtk3, cups, nspr, nss, libpng, libnotify
-, libgcrypt, systemd, fontconfig, dbus, expat, ffmpeg, curlWithGnuTls, zlib, gnome
-, at-spi2-atk, at-spi2-core, libpulseaudio, libdrm, mesa, libxkbcommon
-  # High-DPI support: Spotify's --force-device-scale-factor argument
-  # not added if `null`, otherwise, should be a number.
-, deviceScaleFactor ? null
-}:
+{ lib, stdenv, callPackage }:

 let
-  # TO UPDATE: just execute the ./update.sh script (won't do anything if there is no update)
-  # "rev" decides what is actually being downloaded
-  # If an update breaks things, one of those might have valuable info:
-  # https://aur.archlinux.org/packages/spotify/
-  # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.1.99.878.g1e4ccc6e";
-  # To get the latest stable revision:
-  # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
-  # To get general information:
-  # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
-  # More examples of api usage:
-  # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "62";
-
-  deps = [
-    alsa-lib
-    at-spi2-atk
-    at-spi2-core
-    atk
-    cairo
-    cups
-    curlWithGnuTls
-    dbus
-    expat
-    ffmpeg
-    fontconfig
-    freetype
-    gdk-pixbuf
-    glib
-    gtk3
-    libdrm
-    libgcrypt
-    libnotify
-    libpng
-    libpulseaudio
-    libxkbcommon
-    mesa
-    nss
-    pango
-    stdenv.cc.cc
-    systemd
-    xorg.libICE
-    xorg.libSM
-    xorg.libX11
-    xorg.libxcb
-    xorg.libXcomposite
-    xorg.libXcursor
-    xorg.libXdamage
-    xorg.libXext
-    xorg.libXfixes
-    xorg.libXi
-    xorg.libXrandr
-    xorg.libXrender
-    xorg.libXScrnSaver
-    xorg.libxshmfence
-    xorg.libXtst
-    zlib
-  ];
-
-in
-
-stdenv.mkDerivation {
  pname = "spotify";
-  inherit version;
-
-  # fetch from snapcraft instead of the debian repository most repos fetch from.
-  # That is a bit more cumbersome. But the debian repository only keeps the last
-  # two versions, while snapcraft should provide versions indefinitely:
-  # https://forum.snapcraft.io/t/how-can-a-developer-remove-her-his-app-from-snap-store/512
-
-  # This is the next-best thing, since we're not allowed to re-distribute
-  # spotify ourselves:
-  # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
-  src = fetchurl {
-    url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    sha512 = "339r2q13nnpwi7gjd1axc6z2gycfm9gwz3x9dnqyaqd1g3rw7nk6nfbp6bmpkr68lfq1jfgvqwnimcgs84rsi7nmgsiabv3cz0673wv";
-  };
-
-  nativeBuildInputs = [ wrapGAppsHook makeShellWrapper squashfsTools ];
-
-  dontStrip = true;
-  dontPatchELF = true;
-
-  unpackPhase = ''
-    runHook preUnpack
-    unsquashfs "$src" '/usr/share/spotify' '/usr/bin/spotify' '/meta/snap.yaml'
-    cd squashfs-root
-    if ! grep -q 'grade: stable' meta/snap.yaml; then
-      # Unfortunately this check is not reliable: At the moment (2018-07-26) the
-      # latest version in the "edge" channel is also marked as stable.
-      echo "The snap package is marked as unstable:"
-      grep 'grade: ' meta/snap.yaml
-      echo "You probably chose the wrong revision."
-      exit 1
-    fi
-    if ! grep -q '${version}' meta/snap.yaml; then
-      echo "Package version differs from version found in snap metadata:"
-      grep 'version: ' meta/snap.yaml
-      echo "While the nix package specifies: ${version}."
-      echo "You probably chose the wrong revision or forgot to update the nix version."
-      exit 1
-    fi
-    runHook postUnpack
-  '';
-
-  # Prevent double wrapping
-  dontWrapGApps = true;
-
-  installPhase =
-    ''
-      runHook preInstall
-
-      libdir=$out/lib/spotify
-      mkdir -p $libdir
-      mv ./usr/* $out/
-
-      cp meta/snap.yaml $out
-
-      # Work around Spotify referring to a specific minor version of
-      # OpenSSL.
-
-      ln -s ${lib.getLib openssl}/lib/libssl.so $libdir/libssl.so.1.0.0
-      ln -s ${lib.getLib openssl}/lib/libcrypto.so $libdir/libcrypto.so.1.0.0
-      ln -s ${nspr.out}/lib/libnspr4.so $libdir/libnspr4.so
-      ln -s ${nspr.out}/lib/libplc4.so $libdir/libplc4.so
-
-      ln -s ${ffmpeg.lib}/lib/libavcodec.so* $libdir
-      ln -s ${ffmpeg.lib}/lib/libavformat.so* $libdir
-
-      rpath="$out/share/spotify:$libdir"
-
-      patchelf \
-        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath $rpath $out/share/spotify/spotify
-
-      librarypath="${lib.makeLibraryPath deps}:$libdir"
-      wrapProgramShell $out/share/spotify/spotify \
-        ''${gappsWrapperArgs[@]} \
-        ${lib.optionalString (deviceScaleFactor != null) ''
-          --add-flags "--force-device-scale-factor=${toString deviceScaleFactor}" \
-        ''} \
-        --prefix LD_LIBRARY_PATH : "$librarypath" \
-        --prefix PATH : "${gnome.zenity}/bin" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
-
-      # fix Icon line in the desktop file (#48062)
-      sed -i "s:^Icon=.*:Icon=spotify-client:" "$out/share/spotify/spotify.desktop"
-
-      # Desktop file
-      mkdir -p "$out/share/applications/"
-      cp "$out/share/spotify/spotify.desktop" "$out/share/applications/"
-
-      # Icons
-      for i in 16 22 24 32 48 64 128 256 512; do
-        ixi="$i"x"$i"
-        mkdir -p "$out/share/icons/hicolor/$ixi/apps"
-        ln -s "$out/share/spotify/icons/spotify-linux-$i.png" \
-          "$out/share/icons/hicolor/$ixi/apps/spotify-client.png"
-      done
-
-      runHook postInstall
-    '';

  meta = with lib; {
    homepage = "https://www.spotify.com/";
    description = "Play music from the Spotify music service";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
-    maintainers = with maintainers; [ eelco ftrvxmtrx sheenobu mudri timokau ma27 ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ];
  };
-}
+
+in if stdenv.isDarwin
+then callPackage ./darwin.nix { inherit pname meta; }
+else callPackage ./linux.nix { inherit pname meta; }
--- a/pkgs/applications/audio/spotify/linux.nix
+++ b/pkgs/applications/audio/spotify/linux.nix
@ -0,0 +1,177 @@
+{ fetchurl, lib, stdenv, squashfsTools, xorg, alsa-lib, makeShellWrapper, wrapGAppsHook, openssl, freetype
+, glib, pango, cairo, atk, gdk-pixbuf, gtk3, cups, nspr, nss, libpng, libnotify
+, libgcrypt, systemd, fontconfig, dbus, expat, ffmpeg, curlWithGnuTls, zlib, gnome
+, at-spi2-atk, at-spi2-core, libpulseaudio, libdrm, mesa, libxkbcommon
+, pname, meta
+  # High-DPI support: Spotify's --force-device-scale-factor argument
+  # not added if `null`, otherwise, should be a number.
+, deviceScaleFactor ? null
+}:
+
+let
+  # TO UPDATE: just execute the ./update.sh script (won't do anything if there is no update)
+  # "rev" decides what is actually being downloaded
+  # If an update breaks things, one of those might have valuable info:
+  # https://aur.archlinux.org/packages/spotify/
+  # https://community.spotify.com/t5/Desktop-Linux
+  version = "1.1.99.878.g1e4ccc6e";
+  # To get the latest stable revision:
+  # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
+  # To get general information:
+  # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
+  # More examples of api usage:
+  # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
+  rev = "62";
+
+  deps = [
+    alsa-lib
+    at-spi2-atk
+    at-spi2-core
+    atk
+    cairo
+    cups
+    curlWithGnuTls
+    dbus
+    expat
+    ffmpeg
+    fontconfig
+    freetype
+    gdk-pixbuf
+    glib
+    gtk3
+    libdrm
+    libgcrypt
+    libnotify
+    libpng
+    libpulseaudio
+    libxkbcommon
+    mesa
+    nss
+    pango
+    stdenv.cc.cc
+    systemd
+    xorg.libICE
+    xorg.libSM
+    xorg.libX11
+    xorg.libxcb
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXScrnSaver
+    xorg.libxshmfence
+    xorg.libXtst
+    zlib
+  ];
+
+in
+
+stdenv.mkDerivation {
+  inherit pname version;
+
+  # fetch from snapcraft instead of the debian repository most repos fetch from.
+  # That is a bit more cumbersome. But the debian repository only keeps the last
+  # two versions, while snapcraft should provide versions indefinitely:
+  # https://forum.snapcraft.io/t/how-can-a-developer-remove-her-his-app-from-snap-store/512
+
+  # This is the next-best thing, since we're not allowed to re-distribute
+  # spotify ourselves:
+  # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
+  src = fetchurl {
+    url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
+    sha512 = "339r2q13nnpwi7gjd1axc6z2gycfm9gwz3x9dnqyaqd1g3rw7nk6nfbp6bmpkr68lfq1jfgvqwnimcgs84rsi7nmgsiabv3cz0673wv";
+  };
+
+  nativeBuildInputs = [ wrapGAppsHook makeShellWrapper squashfsTools ];
+
+  dontStrip = true;
+  dontPatchELF = true;
+
+  unpackPhase = ''
+    runHook preUnpack
+    unsquashfs "$src" '/usr/share/spotify' '/usr/bin/spotify' '/meta/snap.yaml'
+    cd squashfs-root
+    if ! grep -q 'grade: stable' meta/snap.yaml; then
+      # Unfortunately this check is not reliable: At the moment (2018-07-26) the
+      # latest version in the "edge" channel is also marked as stable.
+      echo "The snap package is marked as unstable:"
+      grep 'grade: ' meta/snap.yaml
+      echo "You probably chose the wrong revision."
+      exit 1
+    fi
+    if ! grep -q '${version}' meta/snap.yaml; then
+      echo "Package version differs from version found in snap metadata:"
+      grep 'version: ' meta/snap.yaml
+      echo "While the nix package specifies: ${version}."
+      echo "You probably chose the wrong revision or forgot to update the nix version."
+      exit 1
+    fi
+    runHook postUnpack
+  '';
+
+  # Prevent double wrapping
+  dontWrapGApps = true;
+
+  installPhase =
+    ''
+      runHook preInstall
+
+      libdir=$out/lib/spotify
+      mkdir -p $libdir
+      mv ./usr/* $out/
+
+      cp meta/snap.yaml $out
+
+      # Work around Spotify referring to a specific minor version of
+      # OpenSSL.
+
+      ln -s ${lib.getLib openssl}/lib/libssl.so $libdir/libssl.so.1.0.0
+      ln -s ${lib.getLib openssl}/lib/libcrypto.so $libdir/libcrypto.so.1.0.0
+      ln -s ${nspr.out}/lib/libnspr4.so $libdir/libnspr4.so
+      ln -s ${nspr.out}/lib/libplc4.so $libdir/libplc4.so
+
+      ln -s ${ffmpeg.lib}/lib/libavcodec.so* $libdir
+      ln -s ${ffmpeg.lib}/lib/libavformat.so* $libdir
+
+      rpath="$out/share/spotify:$libdir"
+
+      patchelf \
+        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath $rpath $out/share/spotify/spotify
+
+      librarypath="${lib.makeLibraryPath deps}:$libdir"
+      wrapProgramShell $out/share/spotify/spotify \
+        ''${gappsWrapperArgs[@]} \
+        ${lib.optionalString (deviceScaleFactor != null) ''
+          --add-flags "--force-device-scale-factor=${toString deviceScaleFactor}" \
+        ''} \
+        --prefix LD_LIBRARY_PATH : "$librarypath" \
+        --prefix PATH : "${gnome.zenity}/bin" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+
+      # fix Icon line in the desktop file (#48062)
+      sed -i "s:^Icon=.*:Icon=spotify-client:" "$out/share/spotify/spotify.desktop"
+
+      # Desktop file
+      mkdir -p "$out/share/applications/"
+      cp "$out/share/spotify/spotify.desktop" "$out/share/applications/"
+
+      # Icons
+      for i in 16 22 24 32 48 64 128 256 512; do
+        ixi="$i"x"$i"
+        mkdir -p "$out/share/icons/hicolor/$ixi/apps"
+        ln -s "$out/share/spotify/icons/spotify-linux-$i.png" \
+          "$out/share/icons/hicolor/$ixi/apps/spotify-client.png"
+      done
+
+      runHook postInstall
+    '';
+
+  meta = meta // {
+    maintainers = with lib.maintainers; [ eelco ftrvxmtrx sheenobu timokau ma27 ];
+  };
+}
--- a/pkgs/applications/audio/spotify/update.sh
+++ b/pkgs/applications/audio/spotify/update.sh
@ -20,7 +20,7 @@

 channel="${1:-stable}" # stable/candidate/edge
 nixpkgs="$(git rev-parse --show-toplevel)"
-spotify_nix="$nixpkgs/pkgs/applications/audio/spotify/default.nix"
+spotify_nix="$nixpkgs/pkgs/applications/audio/spotify/linux.nix"


 #
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cudatext";
-  version = "1.190.1";
+  version = "1.191.0";

  src = fetchFromGitHub {
    owner = "Alexey-T";
    repo = "CudaText";
    rev = version;
-    hash = "sha256-JnFvbCSDRkw2/BXoSCB9IcB5hwrhB+hvS1xLj5eAQbs=";
+    hash = "sha256-wn2pSzz4w8tQjVFEIfR3/1ddeTjQBQaKl26SxXbOXG0=";
  };

  postPatch = ''
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@ -16,8 +16,8 @@
  },
  "ATSynEdit": {
    "owner": "Alexey-T",
-    "rev": "2023.04.08",
-    "hash": "sha256-FBrb/2VwmpM6FCUvHXZTJCsn/a9r3qPNBYVWyN5CS5o="
+    "rev": "2023.04.17",
+    "hash": "sha256-QllXTq9BCKedt/Pv14qOn1UoxZ57qz76OyptnjT92hA="
  },
  "ATSynEdit_Cmp": {
    "owner": "Alexey-T",
@ -26,13 +26,13 @@
  },
  "EControl": {
    "owner": "Alexey-T",
-    "rev": "2023.04.04",
-    "hash": "sha256-BLj37uTHB4T0ek97u7hYqxbUjW71efGBKGG35CEyLR8="
+    "rev": "2023.04.17",
+    "hash": "sha256-EdtrKYZTP+1MQU5fLO6vYoU3EjS91PaSQnIxtgAs7TI="
  },
  "ATSynEdit_Ex": {
    "owner": "Alexey-T",
-    "rev": "2023.04.04",
-    "hash": "sha256-bqNq1tzZjzwMw3I6G5kuFeh7qp33DGo4gu4BVd4pONk="
+    "rev": "2023.04.17",
+    "hash": "sha256-ZCRoKuwU+DtXEEZEL2QhhwMfewQMhw+/20vVRgHpHf4="
  },
  "Python-for-Lazarus": {
    "owner": "Alexey-T",
--- a/pkgs/applications/editors/eclipse/build-eclipse.nix
+++ b/pkgs/applications/editors/eclipse/build-eclipse.nix
@ -2,7 +2,7 @@
 , zlib, jdk, glib, glib-networking, gtk, libXtst, libsecret, gsettings-desktop-schemas, webkitgtk
 , makeWrapper, perl, ... }:

-{ name, src ? builtins.getAttr stdenv.hostPlatform.system sources, sources ? null, description }:
+{ name, src ? builtins.getAttr stdenv.hostPlatform.system sources, sources ? null, description, productVersion }:

 stdenv.mkDerivation rec {
  inherit name src;
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    categories = [ "Development" ];
  };

-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper perl ];
  buildInputs = [
    fontconfig freetype glib gsettings-desktop-schemas gtk jdk libX11
    libXrender libXtst libsecret zlib
@ -38,14 +38,13 @@ stdenv.mkDerivation rec {
    # settings in ~/.eclipse/org.eclipse.platform_<version> rather
    # than ~/.eclipse/org.eclipse.platform_<version>_<number>.
    productId=$(sed 's/id=//; t; d' $out/eclipse/.eclipseproduct)
-    productVersion=$(sed 's/version=//; t; d' $out/eclipse/.eclipseproduct)

    makeWrapper $out/eclipse/eclipse $out/bin/eclipse \
      --prefix PATH : ${jdk}/bin \
      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ glib gtk libXtst libsecret ] ++ lib.optional (webkitgtk != null) webkitgtk)} \
      --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
-      --add-flags "-configuration \$HOME/.eclipse/''${productId}_$productVersion/configuration"
+      --add-flags "-configuration \$HOME/.eclipse/''${productId}_${productVersion}/configuration"

    # Create desktop item.
    mkdir -p $out/share/applications
@ -54,7 +53,7 @@ stdenv.mkDerivation rec {
    ln -s $out/eclipse/icon.xpm $out/share/pixmaps/eclipse.xpm

    # ensure eclipse.ini does not try to use a justj jvm, as those aren't compatible with nix
-    ${perl}/bin/perl -i -p0e 's|-vm\nplugins/org.eclipse.justj.*/jre/bin\n||' $out/eclipse/eclipse.ini
+    perl -i -p0e 's|-vm\nplugins/org.eclipse.justj.*/jre/bin.*\n||' $out/eclipse/eclipse.ini
  ''; # */

  meta = {
--- a/pkgs/applications/editors/eclipse/default.nix
+++ b/pkgs/applications/editors/eclipse/default.nix
@ -10,15 +10,15 @@
 # find the downloads needed for new versions
 #
 # to test:
-# $ for e in cpp modeling platform sdk java jee committers rcp; do nix build -f default.nix pkgs.eclipses.eclipse-${e} -o eclipse-${e}; done
+# for e in cpp modeling platform sdk java jee committers rcp; do for s in pkgs pkgsCross.aarch64-multiplatform; do echo; echo $s $e; nix build -f default.nix ${s}.eclipses.eclipse-${e} -o eclipse-${s}-${e}; done; done

 let
  platform_major = "4";
-  platform_minor = "26";
-  year = "2022";
-  month = "12"; #release month
-  buildmonth = "11"; #sometimes differs from release month
-  timestamp = "${year}${buildmonth}231800";
+  platform_minor = "27";
+  year = "2023";
+  month = "03"; #release month
+  buildmonth = "03"; #sometimes differs from release month
+  timestamp = "${year}${buildmonth}020300";
  gtk = gtk3;
  arch = if stdenv.hostPlatform.isx86_64 then
    "x86_64"
@ -27,11 +27,13 @@ let
  else throw "don't know what platform suffix for ${stdenv.hostPlatform.system} will be";
 in rec {

-  buildEclipse = callPackage ./build-eclipse.nix {
+  # work around https://bugs.eclipse.org/bugs/show_bug.cgi?id=476075#c3
+  buildEclipseUnversioned = callPackage ./build-eclipse.nix {
    inherit stdenv makeDesktopItem freetype fontconfig libX11 libXrender zlib
            jdk glib gtk libXtst gsettings-desktop-schemas webkitgtk
            makeWrapper;
  };
+  buildEclipse = eclipseData: buildEclipseUnversioned (eclipseData // { productVersion = "${platform_major}.${platform_minor}"; });

  ### Eclipse CPP

@ -42,8 +44,8 @@ in rec {
      fetchurl {
        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-cpp-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
        hash = {
-          x86_64 = "sha512-nqqY4dewq1bjeNoZdWvOez+cBti+f9qXshx1eqJ2lB7sGJva5mcR9e+CZTVD0+EtVJ/U+8viJ+E1Veht1ZnqOw==";
-          aarch64 = "sha512-kmeNH6F8oK72LtrYtiJVLKhy6Q1HwnU+Bh+mpXdXSrfj9KtqzHQkJ0kTnnJkGYLtpi+zyXDwsxzyjh6pPyDRJA==";
+          x86_64 = "sha256-MBng3ETarHMlUUPpVvMIZxVqpe9JW5xNHonnN6CHRcw=";
+          aarch64 = "sha256-7FgpPzp5MY/fB6Q/wvrvi+Lpcm3tmH7bUTLh7q2Rjek=";
        }.${arch};
      };
  };
@ -57,8 +59,8 @@ in rec {
      fetchurl {
        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-modeling-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
        hash = {
-          x86_64 = "sha512-WU2BJt6GL3ug3yOUOd5y6/AbGLcr2MkCg+QJiNIMkSXvoU9TF6R6oimoGVc3kPZmazRy6WYoes55T3bWrHnO8Q==";
-          aarch64 = "sha512-F63f2o9u/p7hhrxI+Eu6NiL4sPccIYw876Nnj8mfSZ7bozs1OVNWftZj+xbdLLbr0bVz3WKnt4BHzcLUA6QG7g==";
+          x86_64 = "sha256-BXofrKElgCG3+WUCanpX1sGLhirj2pLi+pi24Z+WjBk=";
+          aarch64 = "sha256-CdePRa6jmWlt3Wismt3RahGzYOm1ZDwQRt82kRVXSdM=";
        }.${arch};
      };
  };
@ -72,8 +74,8 @@ in rec {
      fetchurl {
        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops${platform_major}/R-${platform_major}.${platform_minor}-${timestamp}/eclipse-platform-${platform_major}.${platform_minor}-linux-gtk-${arch}.tar.gz";
        hash = {
-          x86_64 = "sha512-hmdWGteMDt4HhYq+k9twuftalpTzHtGnVVLphZcpJcw+6vJfersciDMaeLRqbCAeFbzJdgzjYo76bpP6FubySw==";
-          aarch64 = "sha512-BvUkOdCsjwtscPeuBXG7ZpitOr8EQK5JL8nSGpw/RhhBEFz46nsc7W18l0aYjdzRHh2ie55RylS2PEQELkS/hQ==";
+          x86_64 = "sha256-aprXjNv2NMoIDCNkFxwmMKcGUt2ssRonzTZ/hH57Mig=";
+          aarch64 = "sha256-Aq9PDVo/9zTeQ2j6q5bf1aIKjKM7oonIr1mEQ7rX48Y=";
        }.${arch};
      };
  };
@ -81,9 +83,10 @@ in rec {
  ### Eclipse Scala SDK

  eclipse-scala-sdk =
-    (buildEclipse.override { jdk = jdk8; gtk = gtk2; } {
+    (buildEclipseUnversioned.override { jdk = jdk8; gtk = gtk2; } {
      name = "eclipse-scala-sdk-4.7.0";
      description = "Eclipse IDE for Scala Developers";
+      productVersion = "4.7";
      src =
        fetchurl {
          url = "https://downloads.typesafe.com/scalaide-pack/4.7.0-vfinal-oxygen-212-20170929/scala-SDK-4.7.0-vfinal-2.12-linux.gtk.x86_64.tar.gz";
@ -103,8 +106,8 @@ in rec {
      fetchurl {
        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops${platform_major}/R-${platform_major}.${platform_minor}-${timestamp}/eclipse-SDK-${platform_major}.${platform_minor}-linux-gtk-${arch}.tar.gz";
        hash = {
-          x86_64 = "sha512-yH4/K9sBLCUc2EVYwPL0dLql/S3AfaV6fFh7ewAuIb7yHtcsOWMqy/h1hZUlFFg2ykfwDWDDHEK7qfTI0hM7BQ==";
-          aarch64 = "sha512-UYp8t7r2RrN3rKN180cWpJyhyO5LVXL8LrTRKJzttUgB7kM1nroTEI3DesBu+Hw4Ynl7eLiBK397rqcpOAfxJw==";
+          x86_64 = "sha256-39DXU7wIsdxkUpNKnYPT7+qPJ2DrF7G7UJqPfhEDGGs=";
+          aarch64 = "sha256-7GwKGNHWPZ3uOFyzQj1dftFFz/3oa2j8XWkRn0wnllY=";
        }.${arch};
      };
  };
@ -118,8 +121,8 @@ in rec {
      fetchurl {
        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-java-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
        hash = {
-          x86_64 = "sha512-71mXYVLVnyDjYZbJGBKc0aDPq8sbTxlVZRQq7GlSUDv2fsoNYWYgqYfK7RSED5yoasCfs3HUYr7QowRAKJOnfQ==";
-          aarch64 = "sha512-KOQ6BZuQJeVpbMQVxF67M3F/KXMmDhmZQBNq0yWM+/8+d0DiBRkwJtqPYsnTqrax8FSunn2yy+CzlfyHSoNvpg==";
+          x86_64 = "sha256-zNBzFHmNaxUutzMh/5pOglJiKh5NAvSVwvPYyA6RVr4=";
+          aarch64 = "sha256-RtLXB9kgpLERfhpvDTaJG84qVyN1Puud1PTZtk/WIO0=";
        }.${arch};
      };
  };
@ -133,8 +136,8 @@ in rec {
      fetchurl {
        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-jee-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
        hash = {
-          x86_64 = "sha512-55i9YVOa+vKHt72vHIqy9BmKMkg1KaLqMStjTtfaLTH5yP0ei+NTP2XL8IBHOgu0hCEJqYXTq+3I3RQy476etQ==";
-          aarch64 = "sha512-iaoTB/Pinoj1weiGBBv0plQ4jGNdFs2JiBG7S/icUoAX5O6jTGAgJvOwh7Nzn+0N6YL6+HPWaV24a6lM43y8Og==";
+          x86_64 = "sha256-vpvmKZKVl6ubfq8QMDr0xprXYMWl576hu+ovvREN4ak=";
+          aarch64 = "sha256-5Yqxgl4kkN3Bb7hsTnd9q5TsCpVBVkEVvqPbL5MYEyg=";
        }.${arch};
      };
  };
@ -148,8 +151,8 @@ in rec {
      fetchurl {
        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-committers-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
        hash = {
-          x86_64 = "sha512-zGeynifM0dn1214HEVS7OVtv7xa8asjLzOXh5riJK8c/DWvNrRduHn6o6PGnxYOYVIfC9BzNRAjG1STkWu9j+Q==";
-          aarch64 = "sha512-B866dFJcsTkq+h0RZ61CxXE83TWvCf8ZAbGeIC385PpPR3i/gZnRjN2oRrDP22CNR5XXA+PfXKxqvERhJB5ebA==";
+          x86_64 = "sha256-4SAiEZWSUaiK8QO2Hg39FBcj1aYRtbOJkeF1W1AMQBo=";
+          aarch64 = "sha256-+KGDlo6QK3o/n2vSiD0HpIkBwqwIiMXzdFUpfE48gps=";
        }.${arch};
      };
  };
@ -163,8 +166,8 @@ in rec {
      fetchurl {
        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-rcp-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
        hash = {
-          x86_64 = "sha256-ml76ix0fHuR0KqYWQuTftEBAgq7iaOIyvr8V6WhuzeU=";
-          aarch64 = "sha256-sMB6a3f0fiL6ZentIjJTMi59ZOh7dizXrkMQuIRbds0=";
+          x86_64 = "sha256-bhcpzsS9cci3Y3Pk9DOrtPonKjRg/vzDqDr3Be/xfks=";
+          aarch64 = "sha256-YCb4leFWRtx4VPwK/5vgwwDH3/f0/0OWEy4ueAS7sUw=";
        }.${arch};
      };
  };
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@ -254,13 +254,13 @@ rec {

  cdt = buildEclipseUpdateSite rec {
    name = "cdt-${version}";
-    # find current version at https://www.eclipse.org/cdt/downloads.php
-    version = "11.0.0";
+    # find current version at https://github.com/eclipse-cdt/cdt/releases
+    version = "11.1.1";

    src = fetchzip {
      stripRoot = false;
      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/tools/cdt/releases/${lib.versions.majorMinor version}/${name}/${name}.zip";
-      hash = "sha256-2rt9crMqNFevIHFIdOGWDq+j0ZJPVt1a9Z7P9HG58Ks=";
+      hash = "sha256-k78QKPIb3Lr0Wcg2tTlX1abdpcvxspjaxJiP2Hrgb4A=";
    };

    meta = with lib; {
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -60,12 +60,12 @@
  };
  bash = buildGrammar {
    language = "bash";
-    version = "0.0.0+rev=b338fa9";
+    version = "0.0.0+rev=422a07c";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-bash";
-      rev = "b338fa9f4807b9e0336cd4dde04948a8c324a4cf";
-      hash = "sha256-2ARBWfjtnM9+FKfASk1s6L7cDnUFIV6U9wBld2s8WWM=";
+      rev = "422a07cb221b92c6b117e854efa8945a506b5214";
+      hash = "sha256-P5ne6DIQZElbGpSpwxbEQrufcUhekWWEhOhD0GHJ/AQ=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-bash";
  };
@ -137,12 +137,12 @@
  };
  c_sharp = buildGrammar {
    language = "c_sharp";
-    version = "0.0.0+rev=92d572e";
+    version = "0.0.0+rev=0dd182a";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-c-sharp";
-      rev = "92d572eef5ffdd4117e7ba36b56850a90cb79151";
-      hash = "sha256-Zp8aEoLv/FPaTQPJzS2gS3htU9wpUwWB1gvRfYh4gsY=";
+      rev = "0dd182a14a519a70dc60c3727fdc2fdb65c030ae";
+      hash = "sha256-yIZUsEJvQkxD4gNp4jQRGtEeSTLeSdgFdJs03nvt9ko=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-c-sharp";
  };
@ -236,12 +236,12 @@
  };
  cpp = buildGrammar {
    language = "cpp";
-    version = "0.0.0+rev=0b6d0eb";
+    version = "0.0.0+rev=670404d";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-cpp";
-      rev = "0b6d0eb9abdf7cea31961cd903eeed5bbd0aae74";
-      hash = "sha256-rsxRiZCrsEB/ixAP4YmxFtnCoDQrLAp75c74DFR0/nk=";
+      rev = "670404d7c689be1c868a46f919ba2a3912f2b7ef";
+      hash = "sha256-T+Ha2hlI7ucEsTYvDmk7xjHNEoyvnotp/1EWfyCwnWM=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-cpp";
  };
@ -258,12 +258,12 @@
  };
  cuda = buildGrammar {
    language = "cuda";
-    version = "0.0.0+rev=967e7d7";
+    version = "0.0.0+rev=a358542";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-cuda";
-      rev = "967e7d74a1a04a680674199e12141963a8dd6336";
-      hash = "sha256-3rkmxnf1YzshBUEOXBXj9Zpg9IHh2uS0QzdncOU99IQ=";
+      rev = "a35854270463a96e79096bb854aae30a4f0e6cd2";
+      hash = "sha256-8CRFEUxTge0EJQQQVabCjstUGkOIPlC1duj2jD4R89E=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-cuda";
  };
@ -392,12 +392,12 @@
  };
  elm = buildGrammar {
    language = "elm";
-    version = "0.0.0+rev=28bb193";
+    version = "0.0.0+rev=692c50c";
    src = fetchFromGitHub {
      owner = "elm-tooling";
      repo = "tree-sitter-elm";
-      rev = "28bb193640d916dfaf947912c1413cebb0484841";
-      hash = "sha256-Ijw9Ov8+IBLl0fQlkuH6rQ6E7tlKeD+huj0GZdz6XH8=";
+      rev = "692c50c0b961364c40299e73c1306aecb5d20f40";
+      hash = "sha256-0LpuyebOB5ew9fULBcaw8aUbF7HM5sXQpv+Jroz4tXg=";
    };
    meta.homepage = "https://github.com/elm-tooling/tree-sitter-elm";
  };
@ -766,12 +766,12 @@
  };
  hlsl = buildGrammar {
    language = "hlsl";
-    version = "0.0.0+rev=fce5ea2";
+    version = "0.0.0+rev=40472c1";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-hlsl";
-      rev = "fce5ea2e842404ce1af13fffdcf0daa02240c3dd";
-      hash = "sha256-7/HJPPLUwwnxgmNP0Vzm+nTJ1YfnUYbqMcOEZZj5uRA=";
+      rev = "40472c119b5740d9a1fa0b0dc0b013502b636708";
+      hash = "sha256-PfShqPSIsYVMPpW9hQhbEz378vBwDiNkBKR3rLXcIdM=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
  };
@ -788,12 +788,12 @@
  };
  html = buildGrammar {
    language = "html";
-    version = "0.0.0+rev=29f53d8";
+    version = "0.0.0+rev=594f23e";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-html";
-      rev = "29f53d8f4f2335e61bf6418ab8958dac3282077a";
-      hash = "sha256-v84N9erFL+QMoxh1dtfVdAJ5iTCoiFcT3kQ2+yq8TXE=";
+      rev = "594f23eb6da580cf269a59d966db68f2cde7d0c8";
+      hash = "sha256-DgYcJjMCQ0C96l1J4if6FdArj5atxy3LsJr+SnZqiQo=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-html";
  };
@ -964,12 +964,12 @@
  };
  latex = buildGrammar {
    language = "latex";
-    version = "0.0.0+rev=376f640";
+    version = "0.0.0+rev=cd3cc49";
    src = fetchFromGitHub {
      owner = "latex-lsp";
      repo = "tree-sitter-latex";
-      rev = "376f64097b7a26691a2ca60dc94e4dfa417be932";
-      hash = "sha256-9hcmCr9HfhKt5dkNN24haubrOySqpxzMoLVEGO53lxk=";
+      rev = "cd3cc493a92b6bac7be4b3bd6d006d35d3c36d4c";
+      hash = "sha256-CHN54T4+eD7EGx4nzAIryAHOu8NCiBDjM2A7Njjt87w=";
    };
    meta.homepage = "https://github.com/latex-lsp/tree-sitter-latex";
  };
@ -1008,12 +1008,12 @@
  };
  luadoc = buildGrammar {
    language = "luadoc";
-    version = "0.0.0+rev=5c9572f";
+    version = "0.0.0+rev=1e11522";
    src = fetchFromGitHub {
      owner = "amaanq";
      repo = "tree-sitter-luadoc";
-      rev = "5c9572faf56d1fa0f7e0740c94de1c4f67c6af5e";
-      hash = "sha256-90FXGhzTpPVVBPpAdAvfqdIOVCPKTUtRC0WWQyCR0Eg=";
+      rev = "1e1152264cc68e11d65d9e2493566f5717a13d11";
+      hash = "sha256-CNSo4m5peO1WBncZ1RGmmbA3V8qefh5LJJpFYFTAlsY=";
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-luadoc";
  };
@ -1076,12 +1076,12 @@
  };
  matlab = buildGrammar {
    language = "matlab";
-    version = "0.0.0+rev=2d5d3d5";
+    version = "0.0.0+rev=dd95e1f";
    src = fetchFromGitHub {
      owner = "mstanciu552";
      repo = "tree-sitter-matlab";
-      rev = "2d5d3d5193718a86477d4335aba5b34e79147326";
-      hash = "sha256-Rpa/F3MIFRmHunJFsuvbs3h3vDlR3U7UZ+sTN5tJS8U=";
+      rev = "dd95e1fc1b5514aa3a882d5fb8ddbf4683e953f0";
+      hash = "sha256-0CSwSFf4mUtz4lg06Fi24Szo5WpD18M9Fiu8KIg2QB8=";
    };
    meta.homepage = "https://github.com/mstanciu552/tree-sitter-matlab";
  };
@ -1245,12 +1245,12 @@
  };
  perl = buildGrammar {
    language = "perl";
-    version = "0.0.0+rev=3d3a95e";
+    version = "0.0.0+rev=60aa138";
    src = fetchFromGitHub {
      owner = "ganezdragon";
      repo = "tree-sitter-perl";
-      rev = "3d3a95ee6645d7bcd993e77b252ffd33fd297c8e";
-      hash = "sha256-YM4lxdcvkX2l4KkdktDSoNXaN2zCqAS4W0mXMh8GJOs=";
+      rev = "60aa138f9e1db15becad53070f4d5898b0e8a98c";
+      hash = "sha256-GpgUSm/kFFXgJOSBVBxPQiMfykZUgxLdmQfDfJE3Jq8=";
    };
    meta.homepage = "https://github.com/ganezdragon/tree-sitter-perl";
  };
@ -1344,12 +1344,12 @@
  };
  prql = buildGrammar {
    language = "prql";
-    version = "0.0.0+rev=4045dcf";
+    version = "0.0.0+rev=02b1e96";
    src = fetchFromGitHub {
      owner = "PRQL";
      repo = "tree-sitter-prql";
-      rev = "4045dcff3f8ac04669855b32584053dec065bba4";
-      hash = "sha256-+uyCgWon/yCRAOTpzpcDovxyXrIZ4UDwwWG4ndMz0iY=";
+      rev = "02b1e967ede00aaa5d7c9fcd4a604b83825a6261";
+      hash = "sha256-3pdfcCfHdusphn7vQX/d1gS5kKyNTE9qf0YBvsa/BjM=";
    };
    meta.homepage = "https://github.com/PRQL/tree-sitter-prql";
  };
@ -1575,12 +1575,12 @@
  };
  smali = buildGrammar {
    language = "smali";
-    version = "0.0.0+rev=a67a429";
+    version = "0.0.0+rev=b002dce";
    src = fetchFromSourcehut {
      owner = "~yotam";
      repo = "tree-sitter-smali";
-      rev = "a67a429784dafa0ca4342d71e6530137ca803883";
-      hash = "sha256-Pby6RZKPXyPR41E9m2iRsLgVt7bOn2AZyyb4lvcwYwY=";
+      rev = "b002dceb9b91a6d6de45479ab4b2e9596ebbaaf3";
+      hash = "sha256-KZ5+3xqQkxAZcOY8UVxfycQWlaGHq9pv4MzjiIaVtLY=";
    };
    meta.homepage = "https://git.sr.ht/~yotam/tree-sitter-smali";
  };
@ -1685,12 +1685,12 @@
  };
  swift = buildGrammar {
    language = "swift";
-    version = "0.0.0+rev=ca3a370";
+    version = "0.0.0+rev=05467af";
    src = fetchFromGitHub {
      owner = "alex-pinkus";
      repo = "tree-sitter-swift";
-      rev = "ca3a37055069277ad91d6a2c35faf9f247dcfbfb";
-      hash = "sha256-H/6BBBB+vITl91FwiM6/aiv8OEgGjLt3HihTTsYzTVE=";
+      rev = "05467af73ac315fc80c7f3ef397e261f30395e2a";
+      hash = "sha256-4/5ZzxkMiv8qXCXM/M/+NBX9uMw46DnGTEFKbPgNNzU=";
    };
    generate = true;
    meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@ -1708,13 +1708,13 @@
  };
  t32 = buildGrammar {
    language = "t32";
-    version = "0.0.0+rev=f8106fc";
+    version = "0.0.0+rev=0802b36";
    src = fetchFromGitea {
      domain = "codeberg.org";
      owner = "xasc";
      repo = "tree-sitter-t32";
-      rev = "f8106fcf5a27f905b3d9d55d9cd3e910bea70c60";
-      hash = "sha256-hKddSekx67Yqm4+LqVaH8Sf1+73RlCnXE6th2FTHB34=";
+      rev = "0802b3638a1c5022b4d55bdafa64f856ed43d7d6";
+      hash = "sha256-9c5EUgtvoXXZQY5AtahyfmG9SGxcjhrrOxWa0eyicqU=";
    };
    meta.homepage = "https://codeberg.org/xasc/tree-sitter-t32";
  };
@ -2011,12 +2011,12 @@
  };
  zig = buildGrammar {
    language = "zig";
-    version = "0.0.0+rev=2c7b630";
+    version = "0.0.0+rev=9b84cb6";
    src = fetchFromGitHub {
      owner = "maxxnino";
      repo = "tree-sitter-zig";
-      rev = "2c7b6308d906d7aec4b3e1fafaaeca447a8a2c2f";
-      hash = "sha256-uN/B4YasWdgAWV8IAwKd4MP/L73+RiQJGQD00ZA8d6E=";
+      rev = "9b84cb66e7d480e7c0370f4e33e8325bac6ad09f";
+      hash = "sha256-IyVYRqSAqCxUK5ADXlTfNK9MhcdvDVwCJ2Y5VF/oYVs=";
    };
    meta.homepage = "https://github.com/maxxnino/tree-sitter-zig";
  };
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -678,6 +678,7 @@ https://github.com/camspiers/snap/,,
 https://github.com/norcalli/snippets.nvim/,,
 https://github.com/shaunsingh/solarized.nvim/,HEAD,
 https://github.com/sainnhe/sonokai/,,
+https://github.com/sQVe/sort.nvim/,HEAD,
 https://github.com/chikatoike/sourcemap.vim/,,
 https://github.com/liuchengxu/space-vim/,,
 https://github.com/ctjhoa/spacevim/,,
--- a/pkgs/applications/editors/vscode/extensions/contextmapper.context-mapper-vscode-extension/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/contextmapper.context-mapper-vscode-extension/default.nix
@ -0,0 +1,36 @@
+{ graphviz
+, jre
+, lib
+, makeWrapper
+, vscode-utils
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension rec {
+  mktplcRef = {
+    name = "context-mapper-vscode-extension";
+    publisher = "contextmapper";
+    version = "6.7.0";
+    sha256 = "sha256-vlDVqn1Je0eo5Nf2gyotSvhIa07tWCINe79RZSyMzcA=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  buildInputs = [
+    graphviz
+  ];
+
+  postInstall = ''
+    wrapProgram $out/share/vscode/extensions/contextmapper.context-mapper-vscode-extension/lsp/bin/context-mapper-lsp \
+      --set JAVA_HOME "${jre}"
+  '';
+
+  meta = {
+    description = "A VSCode extension for Context Mapper";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=${mktplcRef.publisher}.${mktplcRef.name}";
+    homepage = "https://github.com/ContextMapper/vscode-extension";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.rhoriguchi ];
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -669,6 +669,8 @@ let
        };
      };

+      contextmapper.context-mapper-vscode-extension = callPackage ./contextmapper.context-mapper-vscode-extension { };
+
      coolbear.systemd-unit-file = buildVscodeMarketplaceExtension {
        mktplcRef = {
          publisher = "coolbear";
@ -1942,8 +1944,8 @@ let
        mktplcRef = {
          name = "direnv";
          publisher = "mkhl";
-          version = "0.10.1";
-          sha256 = "0m89sx1qqdkwa9pfmd9b11lp8z0dqpi6jn27js5q4ymscyg41bqd";
+          version = "0.12.0";
+          sha256 = "sha256-UMGTWAiPAxSjy5ALUkijD0GE9TW37TZ3UvMmgFBNYsU=";
        };
        meta = {
          description = "direnv support for Visual Studio Code";
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -47,13 +47,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "imagemagick";
-  version = "7.1.1-6";
+  version = "7.1.1-7";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    rev = finalAttrs.version;
-    hash = "sha256-D1ZKTL3c+engyvBwCdjYqeoHx2v/6gwmK8UfaAxjnWI=";
+    hash = "sha256-PeXWtD8AX9VEJruZu/TO1Bpaoa1XNKIFGfGK+TpQEMs=";
  };

  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
--- a/pkgs/applications/graphics/ipe/default.nix
+++ b/pkgs/applications/graphics/ipe/default.nix
@ -1,5 +1,5 @@
 { lib
-, mkDerivation
+, stdenv
 , makeDesktopItem
 , fetchurl
 , pkg-config
@ -14,21 +14,24 @@
 , lua5
 , qtbase
 , texlive
+, wrapQtAppsHook
 , zlib
+, withTeXLive ? true
 }:

-mkDerivation rec {
+stdenv.mkDerivation rec {
  pname = "ipe";
-  version = "7.2.24";
+  version = "7.2.26";

  src = fetchurl {
    url = "https://github.com/otfried/ipe/releases/download/v${version}/ipe-${version}-src.tar.gz";
-    sha256 = "sha256-/rh58k0dziWRB5B3BEbVCwPkbuLr19KBV7FwWXFkT28=";
+    sha256 = "sha256-5J0AV5E6SlFrIBfwDZrbJnkDUoVZ0fDH669s2RQ1CqU=";
  };
+  patches = [
+    ./headers-lookup.patch
+  ];

-  sourceRoot = "${pname}-${version}/src";
-
-  nativeBuildInputs = [ pkg-config copyDesktopItems ];
+  nativeBuildInputs = [ pkg-config copyDesktopItems wrapQtAppsHook ];

  buildInputs = [
    cairo
@ -40,15 +43,19 @@ mkDerivation rec {
    libspiro
    lua5
    qtbase
-    texlive
    zlib
+  ] ++ (lib.optionals withTeXLive [
+    texlive
+  ]);
+
+  makeFlags = [
+    "-C src"
+    "IPEPREFIX=${placeholder "out"}"
+    "LUA_PACKAGE=lua"
+    "IPE_NO_SPELLCHECK=1" # qtSpell is not yet packaged
  ];

-  IPEPREFIX = placeholder "out";
-  URWFONTDIR = "${texlive}/texmf-dist/fonts/type1/urw/";
-  LUA_PACKAGE = "lua";
-
-  qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ texlive ]}" ];
+  qtWrapperArgs = lib.optional withTeXLive [ "--prefix PATH : ${lib.makeBinPath [ texlive ]}" ];

  enableParallelBuilding = true;

--- a/pkgs/applications/graphics/ipe/headers-lookup.patch
+++ b/pkgs/applications/graphics/ipe/headers-lookup.patch
@ -0,0 +1,13 @@
+diff --git a/src/ipepresenter/Makefile b/src/ipepresenter/Makefile
+index ae3664e..f4f74ff 100644
+--- a/src/ipepresenter/Makefile
+++ b/src/ipepresenter/Makefile
+@@ -8,7 +8,7 @@ include ../common.mak
+ 
+ TARGET = $(call exe_target,ipepresenter)
+ 
+-CXXFLAGS += -I../include -I../ipecanvas -I../ipecairo \
+CPPFLAGS += -I../include -I../ipecanvas -I../ipecairo \
+ 	$(UI_CFLAGS) $(CAIRO_CFLAGS) $(ZLIB_CFLAGS)
+ LIBS += -L$(buildlib) -lipecanvas -lipecairo -lipe \
+ 	$(UI_LIBS) $(CAIRO_LIBS) $(ZLIB_LIBS)
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -3,10 +3,10 @@
 rec {
  firefox = buildMozillaMach rec {
    pname = "firefox";
-    version = "112.0";
+    version = "112.0.1";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "6b2bc8c0c93f3109da27168fe7e8f734c6ab4efb4ca56ff2d5e3a52659da71173bba2104037a000623833be8338621fca482f39f836e3910fe2996e6d0a68b39";
+      sha512 = "23a5cd9c1f165275d8ca7465bebce86018441c72292421f4ed56d7ad8ada9402dc8d22a08467d9d0ef3ef8c62338006dfa3bcbddf12cb8a59eafa0bd7d0cda50";
    };

    meta = {
--- a/pkgs/applications/networking/browsers/mullvad-browser/default.nix
+++ b/pkgs/applications/networking/browsers/mullvad-browser/default.nix
@ -210,10 +210,14 @@ stdenv.mkDerivation rec {
    runHook postBuild
  '';

-  postInstall = ''
+  installPhase = ''
+    runHook preInstall
+
    # Install distribution customizations
    install -Dvm644 ${distributionIni} $out/share/mullvad-browser/distribution/distribution.ini
    install -Dvm644 ${policiesJson} $out/share/mullvad-browser/distribution/policies.json
+
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "dnscontrol";
-  version = "3.31.0";
+  version = "3.31.1";

  src = fetchFromGitHub {
    owner = "StackExchange";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-NwczSmaWzwZXKwnd7AvM758/E85lFWF3SvknOx9/tf0=";
+    sha256 = "sha256-T8fErChbQbarvE3/Zds1482m1hfD9Qa3esYvqjzNN3c=";
  };

  vendorHash = "sha256-BE/UnJw5elHYmyB+quN89ZkrlMcTjaVN0T2+h8cpPS8=";
--- a/pkgs/applications/networking/feedreaders/feed2imap-go/default.nix
+++ b/pkgs/applications/networking/feedreaders/feed2imap-go/default.nix
@ -0,0 +1,27 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "feed2imap-go";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "Necoro";
+    repo = "feed2imap-go";
+    rev = "v${version}";
+    sha256 = "sha256-zRp/MfRtCgzYFNKoV4IWbORfCy7vaaDgmRvNQ0cICNQ=";
+  };
+
+  vendorHash = "sha256-py0totvLLw3kahEtdZkES1t7tZsKBAUS6IMTcn847kE=";
+
+  # The print-cache tool is not an end-user tool (https://github.com/Necoro/feed2imap-go/issues/94)
+  postInstall = ''
+    rm -f $out/bin/print-cache
+  '';
+
+  meta = with lib; {
+    description = "Uploads rss feeds as e-mails onto an IMAP server";
+    homepage = "https://github.com/Necoro/feed2imap-go";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ nomeata ];
+  };
+}
--- a/pkgs/applications/science/biology/dssp/default.nix
+++ b/pkgs/applications/science/biology/dssp/default.nix
@ -1,19 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, boost, cmake, libcifpp, zlib, }:
+{ lib, stdenv, fetchFromGitHub, cmake, libcifpp, libmcfp, zlib }:
+let
+  libcifpp' = libcifpp.overrideAttrs (oldAttrs:  rec {
+    # dssp 4.2.2.1 requires specific version "5.0.8" of libcifpp
+    version = "5.0.8";
+    src = fetchFromGitHub {
+      inherit (oldAttrs.src) owner repo;
+      rev = "v${version}";
+      sha256 = "sha256-KJGcopGhCWSl+ElG3BPJjBf/kvYJowOHxto6Ci1IMco=";
+    };
+  });
+in

 stdenv.mkDerivation rec {
  pname = "dssp";
-  version = "4.0.5";
+  version = "4.2.2.1";

  src = fetchFromGitHub {
    owner = "PDB-REDO";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1x35rdcm4fch66pjbmy73lv0gdb6g9y3v023a66512a6nzsqjsir";
+    sha256 = "sha256-vmGvC5d8LTo+pcY9sxwj0d6JvH8Lyk+QSOZo5raBci4=";
  };

  nativeBuildInputs = [ cmake ];

-  buildInputs = [ boost libcifpp zlib ];
+  buildInputs = [ libcifpp' libmcfp zlib ];

  meta = with lib; {
    description = "Calculate the most likely secondary structure assignment given the 3D structure of a protein";
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@ -25,14 +25,14 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  version = "16.1.3";
+  version = "16.1.9";
  pname = "jmol";

  src = let
    baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
  in fetchurl {
    url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "sha256-k1F4OaER9vg8GIi4eqppeh2f0MtlcBSfd4zkewFp2As=";
+    hash = "sha256-QGduoUKWNUjNlMEYO0wD5+igjuF03V5SVlgq44d2HDs=";
  };

  patchPhase = ''
--- a/pkgs/applications/science/math/sage/patches/ipywidgets-on_submit-deprecationwarning.patch
+++ b/pkgs/applications/science/math/sage/patches/ipywidgets-on_submit-deprecationwarning.patch
@ -1,13 +0,0 @@
-diff --git a/src/sage/interacts/library.py b/src/sage/interacts/library.py
-index 06d680109a..139b00bfd1 100644
--- a/src/sage/interacts/library.py
-+++ b/src/sage/interacts/library.py
-@@ -1434,6 +1434,8 @@ def riemann_sum(
-     creates the mathlet::
- 
-         sage: interacts.calculus.riemann_sum()
-+        ...
-+        DeprecationWarning: on_submit is deprecated. Instead, set the .continuous_update attribute to False and observe the value changing with: mywidget.observe(callback, 'value').
-         Manual interactive function <function riemann_sum at ...> with 9 widgets
-           title: HTMLText(value='<h2>Riemann integral with random sampling</h2>')
-           f: EvalText(value='x^2+1', description='$f(x)=$', layout=Layout(max_width='41em'))
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -141,12 +141,23 @@ stdenv.mkDerivation rec {
      sha256 = "sha256-YdPnMsjXBm9ZRm6a8hH8rSynkrABjLoIzqwp3F/rKAw=";
    })

+    # https://github.com/sagemath/sage/pull/35336, merged in 10.0.beta8
+    (fetchpatch {
+      name = "ipywidgets-8.0.5-upgrade.patch";
+      url = "https://github.com/sagemath/sage/commit/7ab3e3aa81d47a35d09161b965bba8ab16fd5c9e.diff";
+      sha256 = "sha256-WjdsPTui6uv92RerlV0mqltmLaxADvz+3aqSvxBFmfU=";
+    })
+
+    # https://github.com/sagemath/sage/pull/35499
+    (fetchpatch {
+      name = "ipywidgets-8.0.5-upgrade-part-deux.patch";
+      url = "https://github.com/sagemath/sage/pull/35499.diff";
+      sha256 = "sha256-uNCjLs9qrARTQNsq1+kTdvuV2A1M4xx5b1gWh5c55X0=";
+    })
+
    # rebased from https://github.com/sagemath/sage/pull/34994, merged in sage 10.0.beta2
    ./patches/numpy-1.24-upgrade.patch

-    # temporarily paper over https://github.com/jupyter-widgets/ipywidgets/issues/3669
-    ./patches/ipywidgets-on_submit-deprecationwarning.patch
-
    # Sage uses mixed integer programs (MIPs) to find edge disjoint
    # spanning trees. For some reason, aarch64 glpk takes much longer
    # than x86_64 glpk to solve such MIPs. Since the MIP formulation
--- a/pkgs/applications/version-management/git-ignore/default.nix
+++ b/pkgs/applications/version-management/git-ignore/default.nix
@ -1,36 +1,43 @@
-{ lib, stdenv, fetchFromGitHub, installShellFiles, rustPlatform, pkg-config, openssl, darwin }:
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, installShellFiles
+, stdenv
+, darwin
+}:

-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
  pname = "git-ignore";
-  version = "1.2.0";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "sondr3";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Bfr+4zDi6QqirlqccW1jU95eb4q82ZFG9LtT2mCPYLc=";
+    hash = "sha256-kIRuoY0dM2t+aY4iYdik9gUpG+81sDiJLD11Bmx68FI=";
  };

-  cargoSha256 = "sha256-ehEUI4M2IxqS6QhyqOncwP+w6IGbIlSFNIP/FEVH/JI=";
+  cargoHash = "sha256-6sb+OW5VtA6vY6fDtsaZePZD53ehH7QawxJJlUNsrnM=";

-  nativeBuildInputs = [ pkg-config installShellFiles ];
-  buildInputs = [ openssl ]
-  ++ lib.optionals stdenv.isDarwin [
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.Security
  ];

  postInstall = ''
-    installManPage assets/git-ignore.1
-    # There's also .elv and .ps1 completion files but I don't know where to install those
-    installShellCompletion assets/git-ignore.{bash,fish} --zsh assets/_git-ignore
+    assets=$releaseDir/../assets
+    installManPage $assets/git-ignore.1
+    installShellCompletion $assets/git-ignore.{bash,fish} --zsh $assets/_git-ignore
  '';

  meta = with lib; {
    description = "Quickly and easily fetch .gitignore templates from gitignore.io";
    homepage = "https://github.com/sondr3/git-ignore";
+    changelog = "https://github.com/sondr3/git-ignore/blob/${src.rev}/CHANGELOG.md";
    license = licenses.gpl3Plus;
-    maintainers = [ ];
+    maintainers = with maintainers; [ figsoda ];
  };
 }
--- a/pkgs/desktops/gnome/extensions/extensions.json
+++ b/pkgs/desktops/gnome/extensions/extensions.json
--- a/pkgs/development/interpreters/supercollider/default.nix
+++ b/pkgs/development/interpreters/supercollider/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, mkDerivation, fetchurl, fetchpatch, cmake
+{ lib, stdenv, mkDerivation, fetchurl, cmake
 , pkg-config, alsa-lib, libjack2, libsndfile, fftw
 , curl, gcc, libXt, qtbase, qttools, qtwebengine
 , readline, qtwebsockets, useSCEL ? false, emacs
@ -8,22 +8,16 @@

 mkDerivation rec {
  pname = "supercollider";
-  version = "3.12.2";
+  version = "3.13.0";

  src = fetchurl {
    url = "https://github.com/supercollider/supercollider/releases/download/Version-${version}/SuperCollider-${version}-Source.tar.bz2";
-    sha256 = "sha256-1QYorCgSwBK+SVAm4k7HZirr1j+znPmVicFmJdvO3g4=";
+    sha256 = "sha256-D8Xbpbrq43+Qaa0oiFqkBcaiUwnjiGy+ERvTt8BVMc4=";
  };

  patches = [
    # add support for SC_DATA_DIR and SC_PLUGIN_DIR env vars to override compile-time values
    ./supercollider-3.12.0-env-dirs.patch
-
-    # fix issue with libsndfile >=1.1.0
-    (fetchpatch {
-      url = "https://github.com/supercollider/supercollider/commit/b9dd70c4c8d61c93d7a70645e0bd18fa76e6834e.patch";
-      hash = "sha256-6FhEHyY0rnE6d7wC+v0U9K+L0aun5LkTqaEFhr3eQNw=";
-    })
  ];

  strictDeps = true;
@ -72,6 +66,7 @@ mkDerivation rec {
  meta = with lib; {
    description = "Programming language for real time audio synthesis";
    homepage = "https://supercollider.github.io";
+    changelog = "https://github.com/supercollider/supercollider/blob/Version-${version}/CHANGELOG.md";
    maintainers = with maintainers; [ lilyinstarlight ];
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
--- a/pkgs/development/libraries/libcifpp/default.nix
+++ b/pkgs/development/libraries/libcifpp/default.nix
@ -1,19 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, boost, cmake, }:
+{ lib, stdenv, fetchFromGitHub, boost, cmake, zlib }:

 stdenv.mkDerivation rec {
  pname = "libcifpp";
-  version = "4.2.2";
+  version = "5.0.8";

  src = fetchFromGitHub {
    owner = "PDB-REDO";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0mhplcpni4p8lavrq4fz9qq8mbxhvpnlxzy55yrz8y07d76ajg6y";
+    sha256 = "sha256-KJGcopGhCWSl+ElG3BPJjBf/kvYJowOHxto6Ci1IMco=";
  };

  nativeBuildInputs = [ cmake ];

-  buildInputs = [ boost ];
+  # disable network access
+  cmakeFlags = [ "-DCIFPP_DOWNLOAD_CCD=OFF" ];
+
+  buildInputs = [ boost zlib ];

  meta = with lib; {
    description = "Manipulate mmCIF and PDB files";
--- a/pkgs/development/libraries/libmcfp/default.nix
+++ b/pkgs/development/libraries/libmcfp/default.nix
@ -0,0 +1,23 @@
+{ lib, stdenv, fetchFromGitHub, cmake }:
+
+stdenv.mkDerivation rec {
+  pname = "libmcfp";
+  version = "1.2.3";
+
+  src = fetchFromGitHub {
+    owner = "mhekkel";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-Mi5nj8vR1j3V7fIMBrSyhD57emmlkCb0F08+5s7Usj0=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "Header only library that can collect configuration options from command line arguments";
+    homepage = "https://github.com/mhekkel/libmcfp";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ natsukium ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
+++ b/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "qtstyleplugin-kvantum";
-  version = "1.0.9";
+  version = "1.0.10";

  src = fetchFromGitHub {
    owner = "tsujan";
    repo = "Kvantum";
    rev = "V${version}";
-    sha256 = "5/cScJpi5Z5Z/SjizKfMTGytuEo2uUT6QtpMnn7JhKc=";
+    sha256 = "48Blio8qHLmXSKG0c1tphXSfiwQXs0Xqwxe187nM3Ro=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/ocaml-modules/arp/default.nix
+++ b/pkgs/development/ocaml-modules/arp/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildDunePackage
 , fetchurl
 , cstruct
@ -48,7 +49,8 @@ buildDunePackage rec {
    mirage-time
  ];

-  doCheck = true;
+  ## NOTE: As of 18 april 2023 and ARP version 3.0.0, tests fail on Darwin.
+  doCheck = ! stdenv.isDarwin;
  checkInputs = [
    alcotest
    mirage-clock-unix
--- a/pkgs/development/ocaml-modules/bdd/default.nix
+++ b/pkgs/development/ocaml-modules/bdd/default.nix
@ -17,6 +17,12 @@ buildDunePackage {
    hash = "sha256-3mJZlAFQsI7AgrNQOe6N94CDfX5gXYqQBooV0jcoYEA=";
  };

+  # Fix build with OCaml 4.02
+  postPatch = ''
+    substituteInPlace lib/bdd.ml \
+      --replace "Buffer.truncate Format.stdbuf 0;" "Buffer.clear Format.stdbuf;"
+  '';
+
  propagatedBuildInputs = [
    stdlib-shims
  ];
--- a/pkgs/development/ocaml-modules/cohttp/default.nix
+++ b/pkgs/development/ocaml-modules/cohttp/default.nix
@ -6,14 +6,14 @@

 buildDunePackage rec {
  pname = "cohttp";
-  version = "5.0.0";
+  version = "5.1.0";

  minimalOCamlVersion = "4.08";
  duneVersion = "3";

  src = fetchurl {
-    url = "https://github.com/mirage/ocaml-cohttp/releases/download/v${version}/cohttp-${version}.tbz";
-    sha256 = "sha256-/W/0uGyBg1XWGzoIYoWW2/UX1qfabo7exIG7BlPKWgU=";
+    url = "https://github.com/mirage/ocaml-cohttp/releases/download/v${version}/cohttp-v${version}.tbz";
+    sha256 = "sha256-mINgeBO7DSsWd84gYjQNUQFqbh8KBZ+S2bYI/iVWMAc=";
  };

  buildInputs = [ jsonm ppx_sexp_conv ];
--- a/pkgs/development/ocaml-modules/slug/default.nix
+++ b/pkgs/development/ocaml-modules/slug/default.nix
@ -0,0 +1,34 @@
+{ lib, fetchFromGitHub, buildDunePackage
+, re, uunf, uuseg
+, alcotest
+}:
+
+buildDunePackage rec {
+  pname = "slug";
+  version = "1.0.1";
+
+  duneVersion = "3";
+
+  src = fetchFromGitHub {
+    owner = "thangngoc89";
+    repo = "ocaml-slug";
+    rev = version;
+    sha256 = "sha256-pIk/0asSyibXbwmBSBuLwl2SS9aw6dNDDvwO+1VJGf8=";
+  };
+
+  propagatedBuildInputs = [
+    re
+    uunf
+    uuseg
+  ];
+
+  doCheck = true;
+  checkInputs = [ alcotest ];
+
+  meta = {
+    description = "Url safe slug generator for OCaml";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.niols ];
+    homepage = "https://github.com/thangngoc89/ocaml-slug";
+  };
+}
--- a/pkgs/development/python-modules/bytewax/default.nix
+++ b/pkgs/development/python-modules/bytewax/default.nix
@ -0,0 +1,72 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, rustPlatform
+, setuptools-rust
+, openssl
+, pkg-config
+, cyrus_sasl
+, protobuf
+, cmake
+, gcc
+, dill
+, multiprocess
+, pytestCheckHook
+, pythonAtLeast
+}:
+
+buildPythonPackage rec {
+  pname = "bytewax";
+  version = "0.15.1";
+  format = "pyproject";
+
+  disabled = pythonAtLeast "3.11";
+
+  src = fetchFromGitHub {
+    owner = "bytewax";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-4HZUu3WSrhxusvuVz8+8mndTu/9DML1tCH52eaWy+oE=";
+  };
+
+  # Remove docs tests, myst-docutils in nixpkgs is not compatible with package requirements.
+  # Package uses old version.
+  patches = [ ./remove-docs-test.patch ];
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    hash = "sha256-IfVX3k9AsqP84aagCLSwxmutUoEkP8haD+t+VY4V02U=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    rustPlatform.maturinBuildHook
+    rustPlatform.cargoSetupHook
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  buildInputs = [
+    openssl
+    cyrus_sasl
+    protobuf
+  ];
+
+  propagatedBuildInputs = [
+    dill
+    multiprocess
+  ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    description = "Python Stream Processing";
+    homepage = "https://github.com/bytewax/bytewax";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ mslingsby kfollesdal ];
+    # mismatched type expected u8, found i8
+    broken = stdenv.isAarch64;
+  };
+}
--- a/pkgs/development/python-modules/bytewax/remove-docs-test.patch
+++ b/pkgs/development/python-modules/bytewax/remove-docs-test.patch
@ -0,0 +1,10 @@
+diff --git a/pyproject.toml b/pyproject.toml
+index 9b6ee4b..4a82c15 100644
+--- a/pyproject.toml
+++ b/pyproject.toml
+@@ -56,5 +56,4 @@ testpaths = [
+ 
+     # TODO: Turn back on markdown tests once we stabilize inputs.
+ 
+-    "docs",
+ ]
--- a/pkgs/development/python-modules/comm/default.nix
+++ b/pkgs/development/python-modules/comm/default.nix
@ -8,7 +8,7 @@

 let
  pname = "comm";
-  version = "0.1.2";
+  version = "0.1.3";
 in
 buildPythonPackage {
  inherit pname version;
@ -17,8 +17,8 @@ buildPythonPackage {
  src = fetchFromGitHub {
    owner = "ipython";
    repo = "comm";
-    rev = "refs/tags/${version}";
-    hash = "sha256-Ve6tCvu89P5wUOj+vlzXItRR5RjJNKxItKnWP2fVk9U=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5IUE2g00GT231hjuM7mLPst0QTk2Y+Re302FRDq65C8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/django-parler/default.nix
+++ b/pkgs/development/python-modules/django-parler/default.nix
@ -0,0 +1,42 @@
+{ lib
+, buildPythonPackage
+, django
+, fetchFromGitHub
+, pytest
+, pytest-django
+, pythonOlder
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "django-parler";
+  version = "2.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "django-parler";
+    repo = "django-parler";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-tRGifFPCXF3aa3PQWKw3tl1H1TY+lgcChUP1VdwG1cE=";
+  };
+
+  propagatedBuildInputs = [
+    django
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} runtests.py
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "Simple Django model translations without nasty hacks";
+    homepage = "https://github.com/django-parler/django-parler";
+    changelog = "https://github.com/django-parler/django-parler/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ derdennisop ];
+  };
+}
--- a/pkgs/development/python-modules/django-scheduler/default.nix
+++ b/pkgs/development/python-modules/django-scheduler/default.nix
@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, django
+, fetchFromGitHub
+, icalendar
+, pytest
+, pytest-django
+, python
+, python-dateutil
+, pythonOlder
+, pytz
+}:
+
+buildPythonPackage rec {
+  pname = "django-scheduler";
+  version = "0.10.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "llazzaro";
+    repo = "django-scheduler";
+    rev = "refs/tags/${version}";
+    hash = "sha256-dY2TPo15RRWrv7LheUNJSQl4d/HeptSMM/wQirRSI5w=";
+  };
+
+  propagatedBuildInputs = [
+    django
+    python-dateutil
+    pytz
+    icalendar
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} -m django check --settings=tests.settings
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [
+    "schedule"
+  ];
+
+  meta = with lib; {
+    description = "A calendar app for Django";
+    homepage = "https://github.com/llazzaro/django-scheduler";
+    changelog = "https://github.com/llazzaro/django-scheduler/releases/tag/${version}";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ derdennisop ];
+  };
+}
--- a/pkgs/development/python-modules/ducc0/default.nix
+++ b/pkgs/development/python-modules/ducc0/default.nix
@ -2,7 +2,7 @@

 buildPythonPackage rec {
  pname = "ducc0";
-  version = "0.28.0";
+  version = "0.29.0";

  disabled = pythonOlder "3.7";

@ -11,7 +11,7 @@ buildPythonPackage rec {
    owner = "mtr";
    repo = "ducc";
    rev = "ducc0_${lib.replaceStrings ["."] ["_"] version}";
-    hash = "sha256-yh7L87s3STL2usGBXgIhCS7GKQuau/PV6US3T06bb0M=";
+    hash = "sha256-lI0h1dn+7qY6I4FWn7wFFu1mlqIILTX4wD8YjLzFt9c=";
  };

  buildInputs = [ pybind11 ];
--- a/pkgs/development/python-modules/ipywidgets/default.nix
+++ b/pkgs/development/python-modules/ipywidgets/default.nix
@ -13,12 +13,12 @@

 buildPythonPackage rec {
  pname = "ipywidgets";
-  version = "8.0.4";
+  version = "8.0.6";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-wABad6R9d4icr+2JK1jjO0oqlnEhVEBMZUjsIicoEeo=";
+    hash = "sha256-3n13nyBF1g3p9sJfZT/a4tuleJjmoShElLO6ILaJO7g=";
  };

  propagatedBuildInputs = [
@ -33,11 +33,6 @@ buildPythonPackage rec {

  nativeCheckInputs = [ pytestCheckHook ];

-  disabledTests = [
-    # https://github.com/jupyter-widgets/ipywidgets/issues/3711
-    "test_append_display_data"
-  ];
-
  meta = {
    description = "IPython HTML widgets for Jupyter";
    homepage = "https://ipython.org/";
--- a/pkgs/development/python-modules/jupyterlab-widgets/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-widgets/default.nix
@ -4,12 +4,12 @@

 buildPythonPackage rec {
  pname = "jupyterlab-widgets";
-  version = "3.0.5";
+  version = "3.0.7";

  src = fetchPypi {
    pname = "jupyterlab_widgets";
    inherit version;
-    hash = "sha256-7q7N6vbAOvyWDdriAc7YjVl5tMqcOJG8uPZjGvcF9e8=";
+    hash = "sha256-w6UO1b9Sigx6hpCWUDr1RwL4bdodtGmu4cktwMAbQ8o=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyorthanc/default.nix
+++ b/pkgs/development/python-modules/pyorthanc/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "pyorthanc";
-  version = "1.11.4";
+  version = "1.11.5";
  disabled = pythonOlder "3.8";

  format = "pyproject";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "gacou54";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-HbNeI6KpdIoLwRx09qQGJ/iJGKnRj0Z4/mkgoXhofGA=";
+    hash = "sha256-RZJ7BuQRJ+yaHFv9iq4uFvMtH8NvGvmpjmgmyvw9rGk=";
  };

  nativeBuildInputs = [ poetry-core ];
@ -35,6 +35,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python library that wraps the Orthanc REST API";
    homepage = "https://github.com/gacou54/pyorthanc";
+    changelog = "https://github.com/gacou54/pyorthanc/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ bcdarwin ];
  };
--- a/pkgs/development/python-modules/python-manilaclient/default.nix
+++ b/pkgs/development/python-modules/python-manilaclient/default.nix
@ -22,12 +22,12 @@

 buildPythonPackage rec {
  pname = "python-manilaclient";
-  version = "4.3.0";
+  version = "4.4.0";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Ek/RW7ZAZJhkgR6IJRvKGjtUKeHic8l5v1BuNECPiEQ=";
+    hash = "sha256-iKBbR4h9J9OiQMHjUHxUVk+NbCRUYmIPtWxRwVVGQtY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/radian/default.nix
+++ b/pkgs/development/python-modules/radian/default.nix
@ -18,13 +18,13 @@

 buildPythonPackage rec {
  pname = "radian";
-  version = "0.6.4";
+  version = "0.6.5";

  src = fetchFromGitHub {
    owner = "randy3k";
    repo = pname;
    rev = "v${version}";
-    sha256 = "QEHVdyVgsZxvs+d+xeeJqwx531+6e0uPi1J3t+hJ0d0=";
+    sha256 = "iuD4EkGZ1GwNxR8Gpg9ANe3lMHJYZ/Q/RyuN6vZZWME=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/widgetsnbextension/default.nix
+++ b/pkgs/development/python-modules/widgetsnbextension/default.nix
@ -8,12 +8,12 @@

 buildPythonPackage rec {
  pname = "widgetsnbextension";
-  version = "4.0.5";
+  version = "4.0.7";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-AD9xbZMNOFvj/Z3kLdm/AI4wBT9zvd3iNdFPvq7/Ga8=";
+    hash = "sha256-6mfBenzUrjWPj0bDswTEBpi8BCNzLj8nMyHuFBIyyL4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/delve/default.nix
+++ b/pkgs/development/tools/delve/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "delve";
-  version = "1.20.1";
+  version = "1.20.2";

  src = fetchFromGitHub {
    owner = "go-delve";
    repo = "delve";
    rev = "v${version}";
-    sha256 = "sha256-X1vds6+brQ5pl7MG2/n0CqCoS0nbjnQUcIgJqji/u60=";
+    sha256 = "sha256-NHVgNoMa/K1wVbXKycd7sdxfCpLYY6kn2uSfJWUpq1o=";
  };

-  vendorSha256 = null;
+  vendorHash = null;

  subPackages = [ "cmd/dlv" ];

--- a/pkgs/development/tools/goconvey/default.nix
+++ b/pkgs/development/tools/goconvey/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "goconvey";
-  version = "1.7.2";
+  version = "1.8.0";

  excludedPackages = "web/server/watch/integration_testing";

@ -10,10 +10,10 @@ buildGoModule rec {
    owner = "smartystreets";
    repo = "goconvey";
    rev = "v${version}";
-    sha256 = "sha256-YT9M9VaLIGUo6pdkaLWLtomcjrDqdnOqwl+C9UwDmT8=";
+    sha256 = "sha256-JgforTGu5aiQHltZrAfy16Bsu4UJ2pj6cCiof6sxz7s=";
  };

-  vendorSha256 = "sha256-sHyK/4YdNCLCDjxjMKygWAVRnHZ1peYjYRYyEcqoe+E=";
+  vendorHash = "sha256-CCtWsljI14VOGjPid6ouzvieDbylh9ljoUcAoR9r4b4=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/development/tools/goresym/default.nix
+++ b/pkgs/development/tools/goresym/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "goresym";
-  version = "2.2";
+  version = "2.3";

  src = fetchFromGitHub {
    owner = "mandiant";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-he71OrOIZ75Z4S3mf7AuQsupnLu/rsLGV2DRXyxRGS4=";
+    sha256 = "sha256-o2t542q6UGjWdhJkcAm34kGhPUGNsvZKf940T+vydoE=";
  };

  subPackages = [ "." ];
--- a/pkgs/development/tools/infisical/default.nix
+++ b/pkgs/development/tools/infisical/default.nix
@ -0,0 +1,59 @@
+{ stdenv, lib, callPackage, fetchurl }:
+
+let
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "Unsupported system: ${system}";
+
+  plat = {
+    x86_64-linux = "linux_amd64";
+    x86_64-darwin = "darwin_amd64";
+    aarch64-linux = "linux_arm64";
+    aarch64-darwin = "darwin_arm64";
+  }.${system} or throwSystem;
+
+  archive_fmt = "tar.gz";
+
+  sha256 = {
+    x86_64-linux = "194akxb692xpqppakw49aywp5ma43yfcwv5imw4pm05cna0n06b1";
+    x86_64-darwin = "0bgjx54c00v0nb88rzdv09g92yw9qsf2fxd8565g6fsw591va1pa";
+    aarch64-linux = "0z07aikjhk9055apbvyaxdp8cgjl291fqgwgfbp9y3826q7s0riq";
+    aarch64-darwin = "0garlx458jy6dpqbfd0y2p7xj9hagm815cflybbbxf5yz2v9da01";
+  }.${system} or throwSystem;
+in
+  stdenv.mkDerivation (finalAttrs: {
+    pname = "infisical";
+    version = "0.3.7";
+
+    src = fetchurl {
+      url = "https://github.com/Infisical/infisical/releases/download/v${finalAttrs.version}/infisical_${finalAttrs.version}_${plat}.tar.gz";
+      inherit sha256;
+    };
+
+    sourceRoot = ".";
+    installPhase = ''
+      mkdir -p $out/bin/ $out/share/completions/ $out/share/man/
+      cp completions/* $out/share/completions/
+      cp manpages/* $out/share/man/
+      cp infisical $out/bin
+    '';
+
+    postInstall = ''
+      installManPage share/man/infisical.1.gz
+      installShellCompletion share/completions/infisical.{bash,fish,zsh}
+      chmod +x bin/infisical
+    '';
+
+    meta = with lib; {
+      description = "The official Infisical CLI";
+      longDescription = ''
+        Infisical is an Open Source, End-to-End encrypted platform that lets you
+        securely sync secrets and configs across your team, devices, and infrastructure
+      '';
+      mainProgram = "infisical";
+      homepage = "https://infisical.com/";
+      downloadPage = "https://github.com/Infisical/infisical/releases/";
+      license = licenses.mit;
+      maintainers = [ maintainers.ivanmoreau ];
+      platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ];
+    };
+  })
--- a/pkgs/development/tools/rust/cargo-update/default.nix
+++ b/pkgs/development/tools/rust/cargo-update/default.nix
@ -16,14 +16,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-update";
-  version = "12.0.0";
+  version = "13.0.1";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-01XtxPVYamXBwn4zwqiRvpD+mHjpIUp+JT0fu3+Peq8=";
+    sha256 = "sha256-152tOUzFwkxR8B06PcnfYbrn0uLMUCOKNWh9b9LG3K0=";
  };

-  cargoHash = "sha256-x7RK6Wix5TB5/Ff2qWis3HAhBReWekeoxjcFUv19oB4=";
+  cargoHash = "sha256-QN1K/Hsy0kDQUi7D22+k5fa+LqlVFa4G5BG5Ckrouhs=";

  nativeBuildInputs = [
    cmake
--- a/pkgs/misc/cups/drivers/hll3230cdw/default.nix
+++ b/pkgs/misc/cups/drivers/hll3230cdw/default.nix
@ -0,0 +1,76 @@
+{ stdenv, lib, fetchurl, perl, gnused, dpkg, makeWrapper, autoPatchelfHook, libredirect }:
+
+stdenv.mkDerivation rec {
+  pname = "cups-brother-hll3230cdw";
+  version = "1.0.2";
+  src = fetchurl {
+    url = "https://download.brother.com/welcome/dlf103925/hll3230cdwpdrv-${version}-0.i386.deb";
+    sha256 = "9d49abc584bf22bc381510618a34107ead6ab14562b51831fefd6009947aa5a9";
+  };
+
+  nativeBuildInputs = [ dpkg makeWrapper autoPatchelfHook ];
+
+  buildInputs = [ perl gnused libredirect ];
+
+  unpackPhase = "dpkg-deb -x $src .";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out"
+    cp -pr opt "$out"
+    cp -pr usr/bin "$out/bin"
+    rm "$out/opt/brother/Printers/hll3230cdw/cupswrapper/cupswrapperhll3230cdw"
+
+    mkdir -p "$out/lib/cups/filter" "$out/share/cups/model"
+
+    ln -s "$out/opt/brother/Printers/hll3230cdw/cupswrapper/brother_lpdwrapper_hll3230cdw" \
+      "$out/lib/cups/filter/brother_lpdwrapper_hll3230cdw"
+    ln -s "$out/opt/brother/Printers/hll3230cdw/cupswrapper/brother_hll3230cdw_printer_en.ppd" \
+      "$out/share/cups/model/brother_hll3230cdw_printer_en.ppd"
+
+    runHook postInstall
+  '';
+
+  # Fix global references and replace auto discovery mechanism
+  # with hardcoded values.
+  #
+  # The configuration binary 'brprintconf_hll3230cdw' and lpd filter
+  # 'brhll3230cdwfilter' has hardcoded /opt format strings.  There isn't
+  # sufficient space in the binaries to substitute a path in the store, so use
+  # libredirect to get it to see the correct path.  The configuration binary
+  # also uses this format string to print configuration locations.  Here the
+  # wrapper output is processed to point into the correct location in the
+  # store.
+
+  postFixup = ''
+    substituteInPlace $out/opt/brother/Printers/hll3230cdw/lpd/filter_hll3230cdw \
+      --replace "my \$BR_PRT_PATH =" "my \$BR_PRT_PATH = \"$out/opt/brother/Printers/hll3230cdw/\"; #" \
+      --replace "PRINTER =~" "PRINTER = \"hll3230cdw\"; #"
+
+    substituteInPlace $out/opt/brother/Printers/hll3230cdw/cupswrapper/brother_lpdwrapper_hll3230cdw \
+      --replace "PRINTER =~" "PRINTER = \"hll3230cdw\"; #" \
+      --replace "my \$basedir = \`readlink \$0\`" "my \$basedir = \"$out/opt/brother/Printers/hll3230cdw/\""
+
+    wrapProgram $out/bin/brprintconf_hll3230cdw \
+      --set LD_PRELOAD "${libredirect}/lib/libredirect.so" \
+      --set NIX_REDIRECTS /opt=$out/opt
+
+    wrapProgram $out/opt/brother/Printers/hll3230cdw/lpd/brhll3230cdwfilter \
+      --set LD_PRELOAD "${libredirect}/lib/libredirect.so" \
+      --set NIX_REDIRECTS /opt=$out/opt
+
+    substituteInPlace $out/bin/brprintconf_hll3230cdw \
+      --replace \"\$"@"\" \"\$"@\" | LD_PRELOAD= ${gnused}/bin/sed -E '/^(function list :|resource file :).*/{s#/opt#$out/opt#}'"
+  '';
+
+  meta = with lib; {
+    description = "Brother HL-L3230CDW printer driver";
+    license = licenses.unfree;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ aplund ];
+    platforms = [ "x86_64-linux" "i686-linux" ];
+    homepage = "http://www.brother.com/";
+    downloadPage = "https://support.brother.com/g/b/downloadend.aspx?c=us&lang=en&prod=hll3230cdw_us_eu_as&os=128&dlid=dlf103925_000&flang=4&type3=10283";
+  };
+}
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2023.4.4";
+  version = "2023.4.5";
  components = {
    "3_day_blinds" = ps: with ps; [
    ];
@ -671,6 +671,7 @@
      pyserial
      pyudev
      scapy
+      securetar
      sqlalchemy
      zeroconf
    ];
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -310,7 +310,7 @@ let
  extraBuildInputs = extraPackages python.pkgs;

  # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.4.4";
+  hassVersion = "2023.4.5";

 in python.pkgs.buildPythonApplication rec {
  pname = "homeassistant";
@ -326,7 +326,7 @@ in python.pkgs.buildPythonApplication rec {
  # Primary source is the pypi sdist, because it contains translations
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-96Fjf8FOXxpdt+7QC54Q1UzyhkRFZm11xsNXUkg/D+U=";
+    hash = "sha256-nQ41tHIwmARVOGE4bi22zag4uN+6rPXJ6aDr+018fIw=";
  };

  # Secondary source is git for tests
@ -334,7 +334,7 @@ in python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    rev = "refs/tags/${version}";
-    hash = "sha256-ATchEqxVkzUDdRbVxW5YRS9T8WgIGPcdlsjCXXxeWoU=";
+    hash = "sha256-tFbgQ0e+J3/ERqlAKKXafWDaFIEIGsqX+uw8/bQyO5A=";
  };

  nativeBuildInputs = with python3.pkgs; [
--- a/pkgs/servers/home-assistant/parse-requirements.py
+++ b/pkgs/servers/home-assistant/parse-requirements.py
@ -46,6 +46,17 @@ PKG_PREFERENCES = {
    "youtube_dl": "youtube-dl-light",
 }

+# Some dependencies are loaded dynamically at runtime, and are not
+# mentioned in the manifest files.
+EXTRA_COMPONENT_DEPS = {
+    "conversation": [
+        "intent"
+    ],
+    "default_config": [
+        "backup",
+    ],
+}
+


 def run_sync(cmd: List[str]) -> None:
@ -88,6 +99,8 @@ def parse_components(version: str = "master"):
        )
        for domain in sorted(integrations):
            integration = integrations[domain]
+            if extra_deps := EXTRA_COMPONENT_DEPS.get(integration.domain):
+                integration.dependencies.extend(extra_deps)
            if not integration.disabled:
                components[domain] = integration.manifest

--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "homeassistant-stubs";
-  version = "2023.4.4";
+  version = "2023.4.5";
  format = "pyproject";

  disabled = python.version != home-assistant.python.version;
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "KapJI";
    repo = "homeassistant-stubs";
    rev = "refs/tags/${version}";
-    hash = "sha256-ycyRLt8L3OnfnT1ZoO5wJAhJljnXClh1V343rPVeZHU=";
+    hash = "sha256-uZuJ2k52p2fuT15srSifdiD/T0Vk9GUhCh7jY9/nV6o=";
  };

  nativeBuildInputs = [
--- a/pkgs/servers/http/router/default.nix
+++ b/pkgs/servers/http/router/default.nix
@ -0,0 +1,46 @@
+{ lib
+, callPackage
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, protobuf
+, elfutils
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "router";
+  version = "1.15.0";
+
+  src = fetchFromGitHub {
+    owner = "apollographql";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-TA0HE5zbSSPTq5Z/NP6/s1yqXyCicDmSAgqulmKbQeM=";
+  };
+
+  cargoSha256 = "sha256-binpEhtq5tQhSDD2mRKYMdwg9VZlBQZR3xZpOeZNYyY=";
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  buildInputs = [
+    elfutils
+  ];
+
+  # The v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
+  # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
+  RUSTY_V8_ARCHIVE = callPackage ./librusty_v8.nix { };
+
+  cargoTestFlags = [
+    "-- --skip=uplink::test::stream_from_uplink_error_no_retry"
+  ];
+
+  meta = with lib; {
+    description = "A configurable, high-performance routing runtime for Apollo Federation";
+    homepage = "https://www.apollographql.com/docs/router/";
+    license = licenses.elastic;
+    maintainers = [ maintainers.bbigras ];
+  };
+}
--- a/pkgs/servers/http/router/librusty_v8.nix
+++ b/pkgs/servers/http/router/librusty_v8.nix
@ -0,0 +1,20 @@
+{ rust, stdenv, fetchurl }:
+
+let
+  arch = rust.toRustTarget stdenv.hostPlatform;
+  fetch_librusty_v8 = args: fetchurl {
+    name = "librusty_v8-${args.version}";
+    url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${arch}.a";
+    sha256 = args.shas.${stdenv.hostPlatform.system};
+    meta = { inherit (args) version; };
+  };
+in
+fetch_librusty_v8 {
+  version = "0.60.1";
+  shas = {
+    x86_64-linux = "sha256-P8H+XJqrt9jdKM885L1epMldp+stwmEw+0Gtd2x3r4g=";
+    aarch64-linux = "sha256-frHpBP2pL3o4efFLHP2r3zsWJrNT93yYu2Qkxv+7m8Y=";
+    x86_64-darwin = "sha256-taewoYBkyikqWueLSD9dW1EDjzkV68Xplid1UaLZgRM=";
+    aarch64-darwin = "sha256-s2YEVbuYpiT/qrmE37aXk13MetrnJo6l+s1Q2y6b5kU=";
+  };
+}
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "redis";
-  version = "7.0.10";
+  version = "7.0.11";

  src = fetchurl {
    url = "https://download.redis.io/releases/${pname}-${version}.tar.gz";
-    hash = "sha256-He5MZIc0HK571kMv91kJBlIiFaBh/e+Hx9BAoMtgATE=";
+    hash = "sha256-ziUNH7oELGE944oV1AiJt498ttVGGifjUBe6ObByIeM=";
  };

  patches = [
--- a/pkgs/servers/web-apps/monica/default.nix
+++ b/pkgs/servers/web-apps/monica/default.nix
@ -0,0 +1,39 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  nixosTests,
+  dataDir ? "/var/lib/monica",
+}:
+stdenv.mkDerivation rec {
+  pname = "monica";
+  version = "4.0.0";
+
+  src = fetchurl {
+    url = "https://github.com/monicahq/monica/releases/download/v${version}/monica-v${version}.tar.bz2";
+    hash = "sha256-uHsRCO7P5w1JmKDwyLUVjK6NwnTF2mjsz0hOnPrms+w=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir $out
+    cp -R * $out/
+    rm -rf $out/storage
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/storage $out/storage
+  '';
+
+  passthru.tests.monica = nixosTests.monica;
+
+  meta = {
+    description = "Personal CRM";
+    homepage = "https://www.monicahq.com/";
+    longDescription = ''
+      Remember everything about your friends, family and business
+      relationships.
+    '';
+    license = lib.licenses.agpl3Plus;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/tools/admin/coldsnap/default.nix
+++ b/pkgs/tools/admin/coldsnap/default.nix
@ -9,15 +9,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "coldsnap";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-M3TzzaOTbe0VbAd2HSUC/S5Sfuanv8Ad17C6vBNb2og=";
+    hash = "sha256-WqNGajtezhBDYmgUayKjdNAZSyKirIYeYOnozMCIya4=";
  };
-  cargoHash = "sha256-N6066QMGA2XAQ7xr6d34Ts7lVcnRC0uFo0/xpPceNcQ=";
+  cargoHash = "sha256-av9hsvY8xsB+HlIRLYNFDJc9eyBfOyBZ347vWoVsDmM=";

  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/tools/admin/google-cloud-sdk/components.json
+++ b/pkgs/tools/admin/google-cloud-sdk/components.json
--- a/pkgs/tools/admin/google-cloud-sdk/data.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/data.nix
@ -1,32 +1,32 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "408.0.1";
+  version = "424.0.0";
  googleCloudSdkPkgs = {
    x86_64-linux =
      {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-408.0.1-linux-x86_64.tar.gz";
-        sha256 = "0m8zbyavvzdg2bjiafz3qdl50ss0fx4z3gf06mvcx9hzikzw31yl";
+        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-424.0.0-linux-x86_64.tar.gz";
+        sha256 = "063bd6994c2z43s8ap47sgzw9dhvzw4m0gb2jw7jwd93dxi3kv8z";
      };
    x86_64-darwin =
      {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-408.0.1-darwin-x86_64.tar.gz";
-        sha256 = "1d4shdqaqhah28qcdalgqhc2hlh8p12ymslp2kdq3g6g34hlka2r";
+        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-424.0.0-darwin-x86_64.tar.gz";
+        sha256 = "01a870vi591llsvn2a9bgcpikyylgh0arpx5s8dhvxafdlpf67mw";
      };
    aarch64-linux =
      {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-408.0.1-linux-arm.tar.gz";
-        sha256 = "0djaq9i9dfggg3fzlqkghb0ccicxc5n78phxfa2mda9vvgvn2zn3";
+        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-424.0.0-linux-arm.tar.gz";
+        sha256 = "021w871qdd2iiqmzpdmmfcybbq0hs5q1nismyp71bbrqgxfp0jk7";
      };
    aarch64-darwin =
      {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-408.0.1-darwin-arm.tar.gz";
-        sha256 = "0sf9j37i5pch37iz470hwqw3pcwlzw3kiryfqr4nisavm9f1i624";
+        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-424.0.0-darwin-arm.tar.gz";
+        sha256 = "0l6ig8pa19sn5jsm4p76g410704qq9ac7gclqysa3ksm5dk9p3fg";
      };
    i686-linux =
      {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-408.0.1-linux-x86.tar.gz";
-        sha256 = "01y2g92qkbvaj93js49i8z8hjw3qhabj092zn8ngcfnvlcmb9x49";
+        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-424.0.0-linux-x86.tar.gz";
+        sha256 = "1bvc28zmd0r942b3vk903x42d156rf26mhaml93prn2plvs3xxkg";
      };
  };
 }
--- a/pkgs/tools/admin/google-cloud-sdk/update.sh
+++ b/pkgs/tools/admin/google-cloud-sdk/update.sh
@ -6,7 +6,7 @@ BASE_URL="$CHANNEL_URL/downloads/google-cloud-sdk"

 # Version of Google Cloud SDK from
 # https://cloud.google.com/sdk/docs/release-notes
-VERSION="408.0.1"
+VERSION="424.0.0"

 function genMainSrc() {
    local url="${BASE_URL}-${VERSION}-${1}-${2}.tar.gz"
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@ -7,13 +7,13 @@
 }:
 buildGoModule rec {
  pname = "goreleaser";
-  version = "1.17.1";
+  version = "1.17.2";

  src = fetchFromGitHub {
    owner = "goreleaser";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-n9u44V1sMQJ1clc8zljuKAl6S1adHvrYHtHboRNYfWg=";
+    sha256 = "sha256-tNu2rZKGUdBlhY8GmTNM48Nk1DPNp7uChe0v112fhyY=";
  };

  vendorHash = "sha256-KNHi8lSsya/vbpsWbr7un3bKsb6GcyhkrTurRhczxns=";
--- a/pkgs/tools/misc/miniserve/default.nix
+++ b/pkgs/tools/misc/miniserve/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "miniserve";
-  version = "0.23.0";
+  version = "0.23.1";

  src = fetchFromGitHub {
    owner = "svenstaro";
    repo = "miniserve";
    rev = "v${version}";
-    hash = "sha256-iI9J1BGD7/SDLoJ2WfizAEHUXBJH4DiUbfGingef9lM=";
+    hash = "sha256-Syh7vBaTH5bvmiTm7VuZMX/MCzH7Jw4UpvtEYcG3+dA=";
  };

-  cargoSha256 = "sha256-qvV7rJx0Yrv5CLRqSshGf1JUL6nW5KDb7Sv7B6M6WDs=";
+  cargoSha256 = "sha256-Ip10ihsqsTtFPu26+8eQfzxfjg3i7O0iqz5MkutBvO8=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/tools/networking/clash/default.nix
+++ b/pkgs/tools/networking/clash/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "clash";
-  version = "1.15.0";
+  version = "1.15.1";

  src = fetchFromGitHub {
    owner = "Dreamacro";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-uuhxxNLhwZrOvxRRiuJ2iY5rcAA/K8KAUryA01aisSI=";
+    hash = "sha256-r74OL15stW+Io8+/cTGa98TVipM2sL4LnkZXHqa7CBE=";
  };

  vendorHash = "sha256-HS3VnQ9nkRy9OEfE1ASb3fhH/JlgUSlrVlGYNYwGmVA=";
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "exploitdb";
-  version = "2023-04-15";
+  version = "2023-04-18";

  src = fetchFromGitLab {
    owner = "exploit-database";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-Ww92lSt689Xi6IZjAADDQobhNY5l5/rkvElnT+ybx0g=";
+    hash = "sha256-0wv9+hTe04JbGjNH3MeTjaHss5oaZ35ubiwsOhxoH8I=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/security/fingerprintx/default.nix
+++ b/pkgs/tools/security/fingerprintx/default.nix
@ -0,0 +1,34 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "fingerprintx";
+  version = "1.1.8";
+
+  src = fetchFromGitHub {
+    owner = "praetorian-inc";
+    repo = "fingerprintx";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-CzKaMRPs31Pt/vyLoQ4GrUP31s6zpnEk/p7x3FS4AAg=";
+  };
+
+  vendorHash = "sha256-wpqn2Gq/sGBBVIJRiwGc+6fnNJuKRlokb94bKH03oKc=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  # Tests require network access
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Standalone utility for service discovery on open ports";
+    homepage = "https://github.com/praetorian-inc/fingerprintx";
+    changelog = "https://github.com/praetorian-inc/fingerprintx/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/tools/security/fulcio/default.nix
+++ b/pkgs/tools/security/fulcio/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "fulcio";
-  version = "1.1.0";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "sigstore";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-b2rn4et7Ze8XRc1Oa/DCfpva/rihtBLapbGlpYGvOjc=";
+    sha256 = "sha256-sDxbBIE0NgOcEMTnQNXe93RvIDBn0IjH2D15GxwVJqU=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -20,7 +20,7 @@ buildGoModule rec {
      find "$out" -name .git -print0 | xargs -0 rm -rf
    '';
  };
-  vendorHash = "sha256-8iNXBSEaKApu+qjGIYOLU6z/sxIVQhltgBRG9eN4RXw=";
+  vendorHash = "sha256-71YnLPgM3gkGzCgoiUIpknv9bFfxnZPHvf+5gAF1Knk=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/security/tlsx/default.nix
+++ b/pkgs/tools/security/tlsx/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "tlsx";
-  version = "1.0.6";
+  version = "1.0.7";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-rKnnBvutJqWUOsYt47+VwreJVRtJYYhRVxZdSqymRiw=";
+    hash = "sha256-5dVPHuwO2ELekgiIIDHu6CLgyxNoiu4jpvIoCzUA/qU=";
  };

-  vendorHash = "sha256-kLZCtmKJKNjmEk7vPoHfzqEnuBrycDYGNMh/zUDZ76g=";
+  vendorHash = "sha256-3KWvMhFjFupQWZikyTM01GKGtIvtQxxvK9o7UWQULTs=";

  # Tests require network access
  doCheck = false;
--- a/pkgs/tools/text/d2/default.nix
+++ b/pkgs/tools/text/d2/default.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "d2";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "terrastruct";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-vMgOFZJwlWjNfOp4QsFoq1y9JQm16qDkP7uoOwICuTo=";
+    hash = "sha256-4VoWAft9d0v/kB+B8Ukv/XN613a8N484SMqCbOD2GFI=";
  };

-  vendorHash = "sha256-jfGolYHWX/9Zr5JHiWl8mCfaaRT2AU8v32PtgM1KI8c=";
+  vendorHash = "sha256-oPI6FPfBIPKZDLoyGblcG5UcmoFWufZ2NIEClpSIJzU=";

  excludedPackages = [ "./e2etests" ];

--- a/pkgs/tools/text/mdcat/default.nix
+++ b/pkgs/tools/text/mdcat/default.nix
@ -12,20 +12,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdcat";
-  version = "2.0.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "lunaryorn";
    repo = "mdcat";
    rev = "mdcat-${version}";
-    sha256 = "sha256-N5/Fr1LgTOgaV6AEBuL7K+Q/zuioU4NpmOqxUAYXgn4=";
+    sha256 = "sha256-EIi3OFoYoDON8wmOXzXvnTKepzlkKG8w7oPADQ/fNx8=";
  };

  nativeBuildInputs = [ pkg-config asciidoctor installShellFiles ];
  buildInputs = [ openssl ]
    ++ lib.optional stdenv.isDarwin Security;

-  cargoSha256 = "sha256-HBWudlY7HkyBz6bpKxkih4KNcC+OrTUKWAnJjb8IXF0=";
+  cargoSha256 = "sha256-OQaNzC0iCWuo2OteQAqvTikDFVXhMkc+Ldh5apDJhk0=";

  nativeCheckInputs = [ ansi2html ];
  # Skip tests that use the network and that include files.
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1592,6 +1592,8 @@ with pkgs;
    buildGoModule = buildGo119Module; # go 1.20 build failure
  };

+  monica = callPackage ../servers/web-apps/monica { };
+
  mprocs = callPackage ../tools/misc/mprocs { };

  mpy-utils = python3Packages.callPackage ../tools/misc/mpy-utils { };
@ -7428,6 +7430,8 @@ with pkgs;
    zig = zig_0_9;
  };

+  fingerprintx = callPackage ../tools/security/fingerprintx { };
+
  bsd-finger = callPackage ../tools/networking/bsd-finger { };
  bsd-fingerd = bsd-finger.override({ buildClient = false; });

@ -8586,6 +8590,8 @@ with pkgs;

  inferno = callPackage ../development/tools/inferno { };

+  infisical = callPackage ../development/tools/infisical { };
+
  inform6 = callPackage ../development/compilers/inform6 { };

  inform7 = callPackage ../development/compilers/inform7 { };
@ -11846,6 +11852,8 @@ with pkgs;
    pythonPackages = python3Packages;
  };

+  feed2imap-go = callPackage ../applications/networking/feedreaders/feed2imap-go { };
+
  rsstail = callPackage ../applications/networking/feedreaders/rsstail { };

  rubber = callPackage ../tools/typesetting/rubber { };
@ -21656,6 +21664,8 @@ with pkgs;

  libmaxminddb = callPackage ../development/libraries/libmaxminddb { };

+  libmcfp = callPackage ../development/libraries/libmcfp { };
+
  libmcrypt = callPackage ../development/libraries/libmcrypt { };

  libmediaart = callPackage ../development/libraries/libmediaart { };
@ -23419,6 +23429,8 @@ with pkgs;

  ronn = callPackage ../development/tools/ronn { };

+  router = callPackage ../servers/http/router { };
+
  rover = callPackage ../development/tools/rover { };

  rqlite = callPackage ../servers/sql/rqlite { };
@ -38276,6 +38288,8 @@ with pkgs;

  cups-brother-hll2340dw = pkgsi686Linux.callPackage  ../misc/cups/drivers/hll2340dw { };

+  cups-brother-hll3230cdw = pkgsi686Linux.callPackage  ../misc/cups/drivers/hll3230cdw { };
+
  cups-brother-hll2350dw = callPackage  ../misc/cups/drivers/hll2350dw { };

  cups-brother-mfcl2750dw = callPackage  ../misc/cups/drivers/mfcl2750dw { };
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -1502,6 +1502,8 @@ let

    simple-diff = callPackage ../development/ocaml-modules/simple-diff { };

+    slug = callPackage ../development/ocaml-modules/slug {  };
+
    sodium = callPackage ../development/ocaml-modules/sodium { };

    sosa = callPackage ../development/ocaml-modules/sosa { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -1535,6 +1535,8 @@ self: super: with self; {

  bytecode = callPackage ../development/python-modules/bytecode { };

+  bytewax = callPackage ../development/python-modules/bytewax { };
+
  bz2file = callPackage ../development/python-modules/bz2file { };

  cachecontrol = callPackage ../development/python-modules/cachecontrol { };
@ -2693,6 +2695,8 @@ self: super: with self; {

  django-paintstore = callPackage ../development/python-modules/django-paintstore { };

+  django-parler = callPackage ../development/python-modules/django-parler { };
+
  django-pattern-library = callPackage ../development/python-modules/django-pattern-library { };

  django-payments = callPackage ../development/python-modules/django-payments { };
@ -2711,10 +2715,12 @@ self: super: with self; {

  django-q = callPackage ../development/python-modules/django-q { };

-  django-scopes = callPackage ../development/python-modules/django-scopes { };
+  django-scheduler = callPackage ../development/python-modules/django-scheduler { };

  django-scim2 = callPackage ../development/python-modules/django-scim2 { };

+  django-scopes = callPackage ../development/python-modules/django-scopes { };
+
  djangoql = callPackage ../development/python-modules/djangoql { };

  django-ranged-response = callPackage ../development/python-modules/django-ranged-response { };