Merge master into haskell-updates

2023-08-02 00:13:09 +00:00 · 2023-08-02 00:13:09 +00:00 · c17e6d2b5c
commit c17e6d2b5c
parent 988741ea02 5aeb601dae
208 changed files with 12242 additions and 3097 deletions
--- a/doc/hooks/index.md
+++ b/doc/hooks/index.md
@ -29,5 +29,6 @@ tetex-tex-live.section.md
 unzip.section.md
 validatePkgConfig.section.md
 waf.section.md
+zig.section.md
 xcbuild.section.md
 ```
--- a/doc/hooks/zig.section.md
+++ b/doc/hooks/zig.section.md
@ -0,0 +1,59 @@
+# zigHook {#zighook}
+
+[Zig](https://ziglang.org/) is a general-purpose programming language and toolchain for maintaining robust, optimal and reusable software.
+
+In Nixpkgs, `zigHook` overrides the default build, check and install phases.
+
+## Example code snippet {#example-code-snippet}
+
+```nix
+{ lib
+, stdenv
+, zigHook
+}:
+
+stdenv.mkDerivation {
+  # . . .
+
+  nativeBuildInputs = [
+    zigHook
+  ];
+
+  zigBuildFlags = [ "-Dman-pages=true" ];
+
+  dontUseZigCheck = true;
+
+  # . . .
+}
+```
+
+## Variables controlling zigHook {#variables-controlling-zighook}
+
+### `dontUseZigBuild` {#dontUseZigBuild}
+
+Disables using `zigBuildPhase`.
+
+### `zigBuildFlags` {#zigBuildFlags}
+
+Controls the flags passed to the build phase.
+
+### `dontUseZigCheck` {#dontUseZigCheck}
+
+Disables using `zigCheckPhase`.
+
+### `zigCheckFlags` {#zigCheckFlags}
+
+Controls the flags passed to the check phase.
+
+### `dontUseZigInstall` {#dontUseZigInstall}
+
+Disables using `zigInstallPhase`.
+
+### `zigInstallFlags` {#zigInstallFlags}
+
+Controls the flags passed to the install phase.
+
+### Variables honored by zigHook {#variablesHonoredByZigHook}
+
+- `prefixKey`
+- `dontAddPrefix`
--- a/doc/languages-frameworks/maven.section.md
+++ b/doc/languages-frameworks/maven.section.md
@ -4,6 +4,87 @@ Maven is a well-known build tool for the Java ecosystem however it has some chal

 The following provides a list of common patterns with how to package a Maven project (or any JVM language that can export to Maven) as a Nix package.

+## Building a package using `maven.buildMavenPackage` {#maven-buildmavenpackage}
+
+Consider the following package:
+
+```nix
+{ lib, fetchFromGitHub, jre, makeWrapper, maven }:
+
+maven.buildMavenPackage rec {
+  pname = "jd-cli";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "intoolswetrust";
+    repo = pname;
+    rev = "${pname}-${version}";
+    hash = "sha256-rRttA5H0A0c44loBzbKH7Waoted3IsOgxGCD2VM0U/Q=";
+  };
+
+  mvnHash = "sha256-kLpjMj05uC94/5vGMwMlFzLKNFOKeyNvq/vmB6pHTAo=";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share/jd-cli
+    install -Dm644 jd-cli/target/jd-cli.jar $out/share/jd-cli
+
+    makeWrapper ${jre}/bin/java $out/bin/jd-cli \
+      --add-flags "-jar $out/share/jd-cli/jd-cli.jar"
+  '';
+
+  meta = with lib; {
+    description = "Simple command line wrapper around JD Core Java Decompiler project";
+    homepage = "https://github.com/intoolswetrust/jd-cli";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ majiir ];
+  };
+}:
+```
+
+This package calls `maven.buildMavenPackage` to do its work. The primary difference from `stdenv.mkDerivation` is the `mvnHash` variable, which is a hash of all of the Maven dependencies.
+
+::: {.tip}
+After setting `maven.buildMavenPackage`, we then do standard Java `.jar` installation by saving the `.jar` to `$out/share/java` and then making a wrapper which allows executing that file; see [](#sec-language-java) for additional generic information about packaging Java applications.
+:::
+
+### Stable Maven plugins {#stable-maven-plugins}
+
+Maven defines default versions for its core plugins, e.g. `maven-compiler-plugin`. If your project does not override these versions, an upgrade of Maven will change the version of the used plugins, and therefore the derivation and hash.
+
+When `maven` is upgraded, `mvnHash` for the derivation must be updated as well: otherwise, the project will simply be built on the derivation of old plugins, and fail because the requested plugins are missing.
+
+This clearly prevents automatic upgrades of Maven: a manual effort must be made throughout nixpkgs by any maintainer wishing to push the upgrades.
+
+To make sure that your package does not add extra manual effort when upgrading Maven, explicitly define versions for all plugins. You can check if this is the case by adding the following plugin to your (parent) POM:
+
+```xml
+<plugin>
+  <groupId>org.apache.maven.plugins</groupId>
+  <artifactId>maven-enforcer-plugin</artifactId>
+  <version>3.3.0</version>
+  <executions>
+    <execution>
+      <id>enforce-plugin-versions</id>
+      <goals>
+        <goal>enforce</goal>
+      </goals>
+      <configuration>
+        <rules>
+          <requirePluginVersions />
+        </rules>
+      </configuration>
+    </execution>
+  </executions>
+</plugin>
+```
+
+## Manually using `mvn2nix` {#maven-mvn2nix}
+::: {.warning}
+This way is no longer recommended; see [](#maven-buildmavenpackage) for the simpler and preferred way.
+:::
+
 For the purposes of this example let's consider a very basic Maven project with the following `pom.xml` with a single dependency on [emoji-java](https://github.com/vdurmont/emoji-java).

 ```xml
@ -41,14 +122,11 @@ public class Main {
 }
 ```

-You find this demo project at https://github.com/fzakaria/nixos-maven-example
+You find this demo project at [https://github.com/fzakaria/nixos-maven-example](https://github.com/fzakaria/nixos-maven-example).

-## Solving for dependencies {#solving-for-dependencies}
-
-### buildMaven with NixOS/mvn2nix-maven-plugin {#buildmaven-with-nixosmvn2nix-maven-plugin}
-
-> ⚠️ Although `buildMaven` is the "blessed" way within nixpkgs, as of 2020, it hasn't seen much activity in quite a while.
+### Solving for dependencies {#solving-for-dependencies}

+#### buildMaven with NixOS/mvn2nix-maven-plugin {#buildmaven-with-nixosmvn2nix-maven-plugin}
 `buildMaven` is an alternative method that tries to follow similar patterns of other programming languages by generating a lock file. It relies on the maven plugin [mvn2nix-maven-plugin](https://github.com/NixOS/mvn2nix-maven-plugin).

 First you generate a `project-info.json` file using the maven plugin.
@ -105,9 +183,10 @@ The benefit over the _double invocation_ as we will see below, is that the _/nix
 │           ├── avalon-framework-4.1.3.jar -> /nix/store/iv5fp3955w3nq28ff9xfz86wvxbiw6n9-avalon-framework-4.1.3.jar
 ```

-### Double Invocation {#double-invocation}
-
-> ⚠️ This pattern is the simplest but may cause unnecessary rebuilds due to the output hash changing.
+#### Double Invocation {#double-invocation}
+::: {.note}
+This pattern is the simplest but may cause unnecessary rebuilds due to the output hash changing.
+:::

 The double invocation is a _simple_ way to get around the problem that `nix-build` may be sandboxed and have no Internet connectivity.

@ -115,7 +194,9 @@ It treats the entire Maven repository as a single source to be downloaded, relyi

 The first step will be to build the Maven project as a fixed-output derivation in order to collect the Maven repository -- below is an [example](https://github.com/fzakaria/nixos-maven-example/blob/main/double-invocation-repository.nix).

-> Traditionally the Maven repository is at `~/.m2/repository`. We will override this to be the `$out` directory.
+::: {.note}
+Traditionally the Maven repository is at `~/.m2/repository`. We will override this to be the `$out` directory.
+:::

 ```nix
 { lib, stdenv, maven }:
@ -147,7 +228,9 @@ stdenv.mkDerivation {

 The build will fail, and tell you the expected `outputHash` to place. When you've set the hash, the build will return with a `/nix/store` entry whose contents are the full Maven repository.

-> Some additional files are deleted that would cause the output hash to change potentially on subsequent runs.
+::: {.warning}
+Some additional files are deleted that would cause the output hash to change potentially on subsequent runs.
+:::

 ```bash
 ❯ tree $(nix-build --no-out-link double-invocation-repository.nix) | head
@ -165,40 +248,7 @@ The build will fail, and tell you the expected `outputHash` to place. When you'v

 If your package uses _SNAPSHOT_ dependencies or _version ranges_; there is a strong likelihood that over-time your output hash will change since the resolved dependencies may change. Hence this method is less recommended then using `buildMaven`.

-#### Stable Maven plugins {#stable-maven-plugins}
-
-Maven defines default versions for its core plugins, e.g. `maven-compiler-plugin`.
-If your project does not override these versions, an upgrade of Maven will change the version of the used plugins.
-This changes the output of the first invocation and the plugins required by the second invocation.
-However, since a hash is given for the output of the first invocation, the second invocation will simply fail
-because the requested plugins are missing.
-This will prevent automatic upgrades of Maven: the manual fix for this is to change the hash of the first invocation.
-
-To make sure that your package does not add manual effort when upgrading Maven, explicitly define versions for all
-plugins. You can check if this is the case by adding the following plugin to your (parent) POM:
-
-```xml
-<plugin>
-  <groupId>org.apache.maven.plugins</groupId>
-  <artifactId>maven-enforcer-plugin</artifactId>
-  <version>3.3.0</version>
-  <executions>
-    <execution>
-      <id>enforce-plugin-versions</id>
-      <goals>
-        <goal>enforce</goal>
-      </goals>
-      <configuration>
-        <rules>
-          <requirePluginVersions />
-        </rules>
-      </configuration>
-    </execution>
-  </executions>
-</plugin>
-```
-
-## Building a JAR {#building-a-jar}
+### Building a JAR {#building-a-jar}

 Regardless of which strategy is chosen above, the step to build the derivation is the same.

@ -224,7 +274,9 @@ in stdenv.mkDerivation rec {
 }
 ```

-> We place the library in `$out/share/java` since JDK package has a _stdenv setup hook_ that adds any JARs in the `share/java` directories of the build inputs to the CLASSPATH environment.
+::: {.tip}
+We place the library in `$out/share/java` since JDK package has a _stdenv setup hook_ that adds any JARs in the `share/java` directories of the build inputs to the CLASSPATH environment.
+:::

 ```bash
 ❯ tree $(nix-build --no-out-link build-jar.nix)
@ -236,7 +288,7 @@ in stdenv.mkDerivation rec {
 2 directories, 1 file
 ```

-## Runnable JAR {#runnable-jar}
+### Runnable JAR {#runnable-jar}

 The previous example builds a `jar` file but that's not a file one can run.

@ -248,9 +300,9 @@ We will use the same repository we built above (either _double invocation_ or _b

 The following two methods are more suited to Nix then building an [UberJar](https://imagej.net/Uber-JAR) which may be the more traditional approach.

-### CLASSPATH {#classpath}
+#### CLASSPATH {#classpath}

-> This is ideal if you are providing a derivation for _nixpkgs_ and don't want to patch the project's `pom.xml`.
+This method is ideal if you are providing a derivation for _nixpkgs_ and don't want to patch the project's `pom.xml`.

 We will read the Maven repository and flatten it to a single list. This list will then be concatenated with the _CLASSPATH_ separator to create the full classpath.

@ -288,9 +340,9 @@ in stdenv.mkDerivation rec {
 }
 ```

-### MANIFEST file via Maven Plugin {#manifest-file-via-maven-plugin}
+#### MANIFEST file via Maven Plugin {#manifest-file-via-maven-plugin}

-> This is ideal if you are the project owner and want to change your `pom.xml` to set the CLASSPATH within it.
+This method is ideal if you are the project owner and want to change your `pom.xml` to set the CLASSPATH within it.

 Augment the `pom.xml` to create a JAR with the following manifest:

@ -366,8 +418,9 @@ in stdenv.mkDerivation rec {
  '';
 }
 ```
-
-> Our script produces a dependency on `jre` rather than `jdk` to restrict the runtime closure necessary to run the application.
+::: {.note}
+Our script produces a dependency on `jre` rather than `jdk` to restrict the runtime closure necessary to run the application.
+:::

 This will give you an executable shell-script that launches your JAR with all the dependencies available.

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1154,6 +1154,9 @@
    githubId = 48802534;
    name = "Anselm Schüler";
    matrix = "@schuelermine:matrix.org";
+    keys = [{
+      fingerprint = "CDBF ECA8 36FE E340 1CEB  58FF BA34 EE1A BA3A 0955";
+    }];
  };
  anthonyroussel = {
    email = "anthony@roussel.dev";
@ -8463,6 +8466,12 @@
    githubId = 662666;
    name = "Justinas Stankevičius";
  };
+  justinlime = {
+    email = "justinlime1999@gmail.com";
+    github = "justinlime";
+    githubId = 119710965;
+    name = "Justin Fields";
+  };
  justinlovinger = {
    email = "git@justinlovinger.com";
    github = "JustinLovinger";
@ -8707,6 +8716,11 @@
    githubId = 762421;
    name = "Pierre Thierry";
  };
+  keto = {
+    github = "TheRealKeto";
+    githubId = 24854941;
+    name = "Keto";
+  };
  ketzacoatl = {
    email = "ketzacoatl@protonmail.com";
    github = "ketzacoatl";
@ -10697,12 +10711,6 @@
    githubId = 10420834;
    name = "Mihai-Drosi Caju";
  };
-  mcbeth = {
-    email = "mcbeth@broggs.org";
-    github = "mcbeth";
-    githubId = 683809;
-    name = "Jeffrey Brent McBeth";
-  };
  mccurdyc = {
    email = "mccurdyc22@gmail.com";
    github = "mccurdyc";
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -102,6 +102,8 @@

 - The binary of the package `cloud-sql-proxy` has changed from `cloud_sql_proxy` to `cloud-sql-proxy`.

+- The `woodpecker-*` CI packages have been updated to 1.0.0. This release is wildly incompatible with the 0.15.X versions that were previously packaged. Please read [upstream's documentation](https://woodpecker-ci.org/docs/next/migrations#100) to learn how to update your CI configurations.
+
 - The Caddy module gained a new option named `services.caddy.enableReload` which is enabled by default. It allows reloading the service instead of restarting it, if only a config file has changed. This option must be disabled if you have turned off the [Caddy admin API](https://caddyserver.com/docs/caddyfile/options#admin). If you keep this option enabled, you should consider setting [`grace_period`](https://caddyserver.com/docs/caddyfile/options#grace-period) to a non-infinite value to prevent Caddy from delaying the reload indefinitely.

 - mdraid support is now optional. This reduces initramfs size and prevents the potentially undesired automatic detection and activation of software RAID pools. It is disabled by default in new configurations (determined by `stateVersion`), but the appropriate settings will be generated by `nixos-generate-config` when installing to a software RAID device, so the standard installation procedure should be unaffected. If you have custom configs relying on mdraid, ensure that you use `stateVersion` correctly or set `boot.swraid.enable` manually.
@ -152,6 +154,8 @@ The module update takes care of the new config syntax and the data itself (user

 - `boot.initrd.network.udhcp.enable` allows control over dhcp during stage 1 regardless of what `networking.useDHCP` is set to.

+- Suricata was upgraded from 6.0 to 7.0 and no longer considers HTTP/2 support as experimental, see [upstream release notes](https://forum.suricata.io/t/suricata-7-0-0-released/3715) for more details.
+
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}

 - The `qemu-vm.nix` module by default now identifies block devices via
--- a/nixos/modules/programs/fish.nix
+++ b/nixos/modules/programs/fish.nix
@ -37,7 +37,7 @@ let
  babelfishTranslate = path: name:
    pkgs.runCommandLocal "${name}.fish" {
      nativeBuildInputs = [ pkgs.babelfish ];
-    } "${pkgs.babelfish}/bin/babelfish < ${path} > $out;";
+    } "babelfish < ${path} > $out;";

 in

--- a/nixos/modules/services/misc/atuin.nix
+++ b/nixos/modules/services/misc/atuin.nix
@ -1,14 +1,12 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
+  inherit (lib) mkOption types mdDoc mkIf;
  cfg = config.services.atuin;
 in
 {
  options = {
    services.atuin = {
-      enable = mkEnableOption (mdDoc "Enable server for shell history sync with atuin");
+      enable = lib.mkEnableOption (mdDoc "Enable server for shell history sync with atuin");

      openRegistration = mkOption {
        type = types.bool;
@ -50,16 +48,28 @@ in
        createLocally = mkOption {
          type = types.bool;
          default = true;
-          description = lib.mdDoc "Create the database and database user locally.";
+          description = mdDoc "Create the database and database user locally.";
+        };
+
+        uri = mkOption {
+          type = types.str;
+          default = "postgresql:///atuin?host=/run/postgresql";
+          example = "postgresql://atuin@localhost:5432/atuin";
+          description = mdDoc "URI to the database";
        };
      };
    };
  };

  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.database.createLocally -> config.services.postgresql.enable;
+        message = "Postgresql must be enabled to create a local database";
+      }
+    ];

-    # enable postgres to host atuin db
-    services.postgresql = {
+    services.postgresql = mkIf cfg.database.createLocally {
      enable = true;
      ensureUsers = [{
        name = "atuin";
@ -73,7 +83,7 @@ in
    systemd.services.atuin = {
      description = "atuin server";
      requires = lib.optionals cfg.database.createLocally [ "postgresql.service" ];
-      after = [ "network.target" ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ] ;
+      after = [ "network.target" ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
      wantedBy = [ "multi-user.target" ];

      serviceConfig = {
@ -81,20 +91,55 @@ in
        RuntimeDirectory = "atuin";
        RuntimeDirectoryMode = "0700";
        DynamicUser = true;
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          # Required for connecting to database sockets,
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        UMask = "0077";
      };

      environment = {
        ATUIN_HOST = cfg.host;
        ATUIN_PORT = toString cfg.port;
        ATUIN_MAX_HISTORY_LENGTH = toString cfg.maxHistoryLength;
-        ATUIN_OPEN_REGISTRATION = boolToString cfg.openRegistration;
-        ATUIN_DB_URI =  mkIf cfg.database.createLocally "postgresql:///atuin";
+        ATUIN_OPEN_REGISTRATION = lib.boolToString cfg.openRegistration;
+        ATUIN_DB_URI = cfg.database.uri;
        ATUIN_PATH = cfg.path;
        ATUIN_CONFIG_DIR = "/run/atuin"; # required to start, but not used as configuration is via environment variables
      };
    };

    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
-
  };
 }
--- a/nixos/modules/services/networking/bird.nix
+++ b/nixos/modules/services/networking/bird.nix
@ -61,7 +61,7 @@ in
      checkPhase = optionalString cfg.checkConfig ''
        ln -s $out bird2.conf
        ${cfg.preCheckConfig}
-        ${pkgs.bird}/bin/bird -d -p -c bird2.conf
+        ${pkgs.buildPackages.bird}/bin/bird -d -p -c bird2.conf
      '';
    };

--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@ -1,8 +1,8 @@
 { config, lib, pkgs, ... }:

-with lib;
-
 let
+  inherit (lib) literalExpression mdDoc mkEnableOption mkIf mkOption mkPackageOptionMD mkRenamedOptionModule types versionAtLeast;
+
  cfg = config.services.hedgedoc;

  # 21.03 will not be an official release - it was instead 21.05.  This
@ -32,6 +32,7 @@ in
  ];

  options.services.hedgedoc = {
+    package = mkPackageOptionMD pkgs "hedgedoc" { };
    enable = mkEnableOption (lib.mdDoc "the HedgeDoc Markdown Editor");

    groups = mkOption {
@ -107,6 +108,13 @@ in
          {option}`protocolUseSSL`.
        '';
      };
+      enableStatsApi = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Enables or disables the /status and /metrics endpoint.
+        '';
+      };
      hsts = {
        enable = mkOption {
          type = types.bool;
@ -1018,16 +1026,6 @@ in
        `HedgeDoc` is running.
      '';
    };
-
-    package = mkOption {
-      type = types.package;
-      default = pkgs.hedgedoc;
-      defaultText = literalExpression "pkgs.hedgedoc";
-      description = lib.mdDoc ''
-        Package that provides HedgeDoc.
-      '';
-    };
-
  };

  config = mkIf cfg.enable {
@ -1060,7 +1058,7 @@ in
      serviceConfig = {
        WorkingDirectory = cfg.workDir;
        StateDirectory = [ cfg.workDir cfg.settings.uploadsPath ];
-        ExecStart = "${cfg.package}/bin/hedgedoc";
+        ExecStart = "${lib.getExe cfg.package}";
        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
        Environment = [
          "CMD_CONFIG_FILE=${cfg.workDir}/config.json"
--- a/nixos/tests/atuin.nix
+++ b/nixos/tests/atuin.nix
@ -14,6 +14,8 @@ in
    server =
      { ... }:
      {
+        services.postgresql.enable = true;
+
        services.atuin = {
          enable = true;
          port = testPort;
--- a/nixos/tests/binary-cache.nix
+++ b/nixos/tests/binary-cache.nix
@ -1,16 +1,14 @@
-import ./make-test-python.nix ({ lib, ... }:
-
-with lib;
+import ./make-test-python.nix ({ lib, pkgs, ... }:

 {
  name = "binary-cache";
-  meta.maintainers = with maintainers; [ thomasjm ];
+  meta.maintainers = with lib.maintainers; [ thomasjm ];

  nodes.machine =
    { pkgs, ... }: {
      imports = [ ../modules/installer/cd-dvd/channel.nix ];
-      environment.systemPackages = with pkgs; [python3];
-      system.extraDependencies = with pkgs; [hello.inputDerivation];
+      environment.systemPackages = [ pkgs.python3 ];
+      system.extraDependencies = [ pkgs.hello.inputDerivation ];
      nix.extraOptions = ''
        experimental-features = nix-command
      '';
--- a/nixos/tests/buildkite-agents.nix
+++ b/nixos/tests/buildkite-agents.nix
@ -1,10 +1,8 @@
-import ./make-test-python.nix ({ pkgs, ... }:
+import ./make-test-python.nix ({ lib, pkgs, ... }:

 {
  name = "buildkite-agent";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ flokli ];
-  };
+  meta.maintainers = with lib.maintainers; [ flokli ];

  nodes.machine = { pkgs, ... }: {
    services.buildkite-agents = {
--- a/nixos/tests/deepin.nix
+++ b/nixos/tests/deepin.nix
@ -1,9 +1,7 @@
 import ./make-test-python.nix ({ pkgs, lib, ... }: {
  name = "deepin";

-  meta = with lib; {
-    maintainers = teams.deepin.members;
-  };
+  meta.maintainers = lib.teams.deepin.members;

  nodes.machine = { ... }: {
    imports = [
--- a/nixos/tests/initrd-network-ssh/default.nix
+++ b/nixos/tests/initrd-network-ssh/default.nix
@ -1,12 +1,10 @@
-import ../make-test-python.nix ({ lib, ... }:
+import ../make-test-python.nix ({ lib, pkgs, ... }:

 {
  name = "initrd-network-ssh";
-  meta = with lib.maintainers; {
-    maintainers = [ willibutz emily ];
-  };
+  meta.maintainers = with lib.maintainers; [ willibutz emily ];

-  nodes = with lib; {
+  nodes = {
    server =
      { config, ... }:
      {
@ -17,7 +15,7 @@ import ../make-test-python.nix ({ lib, ... }:
          enable = true;
          ssh = {
            enable = true;
-            authorizedKeys = [ (readFile ./id_ed25519.pub) ];
+            authorizedKeys = [ (lib.readFile ./id_ed25519.pub) ];
            port = 22;
            hostKeys = [ ./ssh_host_ed25519_key ];
          };
@ -37,12 +35,12 @@ import ../make-test-python.nix ({ lib, ... }:
      {
        environment.etc = {
          knownHosts = {
-            text = concatStrings [
+            text = lib.concatStrings [
              "server,"
-              "${toString (head (splitString " " (
-                toString (elemAt (splitString "\n" config.networking.extraHosts) 2)
+              "${toString (lib.head (lib.splitString " " (
+                toString (lib.elemAt (lib.splitString "\n" config.networking.extraHosts) 2)
              )))} "
-              "${readFile ./ssh_host_ed25519_key.pub}"
+              "${lib.readFile ./ssh_host_ed25519_key.pub}"
            ];
          };
          sshKey = {
--- a/nixos/tests/nextcloud/basic.nix
+++ b/nixos/tests/nextcloud/basic.nix
@ -14,12 +14,12 @@ in {
    client = { ... }: {
      services.davfs2.enable = true;
      system.activationScripts.davfs2-secrets = ''
-        echo "http://nextcloud/remote.php/webdav/ ${adminuser} ${adminpass}" > /tmp/davfs2-secrets
+        echo "http://nextcloud/remote.php/dav/files/${adminuser} ${adminuser} ${adminpass}" > /tmp/davfs2-secrets
        chmod 600 /tmp/davfs2-secrets
      '';
      virtualisation.fileSystems = {
        "/mnt/dav" = {
-          device = "http://nextcloud/remote.php/webdav/";
+          device = "http://nextcloud/remote.php/dav/files/${adminuser}";
          fsType = "davfs";
          options = let
            davfs2Conf = (pkgs.writeText "davfs2.conf" "secrets /tmp/davfs2-secrets");
@ -70,7 +70,7 @@ in {
    withRcloneEnv = pkgs.writeScript "with-rclone-env" ''
      #!${pkgs.runtimeShell}
      export RCLONE_CONFIG_NEXTCLOUD_TYPE=webdav
-      export RCLONE_CONFIG_NEXTCLOUD_URL="http://nextcloud/remote.php/webdav/"
+      export RCLONE_CONFIG_NEXTCLOUD_URL="http://nextcloud/remote.php/dav/files/${adminuser}"
      export RCLONE_CONFIG_NEXTCLOUD_VENDOR="nextcloud"
      export RCLONE_CONFIG_NEXTCLOUD_USER="${adminuser}"
      export RCLONE_CONFIG_NEXTCLOUD_PASS="$(${pkgs.rclone}/bin/rclone obscure ${adminpass})"
--- a/nixos/tests/nextcloud/openssl-sse.nix
+++ b/nixos/tests/nextcloud/openssl-sse.nix
@ -33,7 +33,7 @@ in {
    withRcloneEnv = host: pkgs.writeScript "with-rclone-env" ''
      #!${pkgs.runtimeShell}
      export RCLONE_CONFIG_NEXTCLOUD_TYPE=webdav
-      export RCLONE_CONFIG_NEXTCLOUD_URL="http://${host}/remote.php/webdav/"
+      export RCLONE_CONFIG_NEXTCLOUD_URL="http://${host}/remote.php/dav/files/${adminuser}"
      export RCLONE_CONFIG_NEXTCLOUD_VENDOR="nextcloud"
      export RCLONE_CONFIG_NEXTCLOUD_USER="${adminuser}"
      export RCLONE_CONFIG_NEXTCLOUD_PASS="$(${pkgs.rclone}/bin/rclone obscure ${adminpass})"
--- a/nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix
+++ b/nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix
@ -1,6 +1,6 @@
 args@{ nextcloudVersion ? 27, ... }:
 (import ../make-test-python.nix ({ pkgs, ...}: let
-  username = "custom_admin_username";
+  adminuser = "custom_admin_username";
  # This will be used both for redis and postgresql
  pass = "hunter2";
  # Don't do this at home, use a file outside of the nix store instead
@ -34,9 +34,9 @@ in {
        config = {
          dbtype = "pgsql";
          dbname = "nextcloud";
-          dbuser = username;
+          dbuser = adminuser;
          dbpassFile = passFile;
-          adminuser = username;
+          adminuser = adminuser;
          adminpassFile = passFile;
        };
        secretFile = "/etc/nextcloud-secrets.json";
@ -66,9 +66,9 @@ in {
      systemd.services.postgresql.postStart = pkgs.lib.mkAfter ''
        password=$(cat ${passFile})
        ${config.services.postgresql.package}/bin/psql <<EOF
-          CREATE ROLE ${username} WITH LOGIN PASSWORD '$password' CREATEDB;
+          CREATE ROLE ${adminuser} WITH LOGIN PASSWORD '$password' CREATEDB;
          CREATE DATABASE nextcloud;
-          GRANT ALL PRIVILEGES ON DATABASE nextcloud TO ${username};
+          GRANT ALL PRIVILEGES ON DATABASE nextcloud TO ${adminuser};
        EOF
      '';

@ -89,9 +89,9 @@ in {
    withRcloneEnv = pkgs.writeScript "with-rclone-env" ''
      #!${pkgs.runtimeShell}
      export RCLONE_CONFIG_NEXTCLOUD_TYPE=webdav
-      export RCLONE_CONFIG_NEXTCLOUD_URL="http://nextcloud/remote.php/webdav/"
+      export RCLONE_CONFIG_NEXTCLOUD_URL="http://nextcloud/remote.php/dav/files/${adminuser}"
      export RCLONE_CONFIG_NEXTCLOUD_VENDOR="nextcloud"
-      export RCLONE_CONFIG_NEXTCLOUD_USER="${username}"
+      export RCLONE_CONFIG_NEXTCLOUD_USER="${adminuser}"
      export RCLONE_CONFIG_NEXTCLOUD_PASS="$(${pkgs.rclone}/bin/rclone obscure ${pass})"
      "''${@}"
    '';
--- a/nixos/tests/nextcloud/with-mysql-and-memcached.nix
+++ b/nixos/tests/nextcloud/with-mysql-and-memcached.nix
@ -49,7 +49,7 @@ in {
    withRcloneEnv = pkgs.writeScript "with-rclone-env" ''
      #!${pkgs.runtimeShell}
      export RCLONE_CONFIG_NEXTCLOUD_TYPE=webdav
-      export RCLONE_CONFIG_NEXTCLOUD_URL="http://nextcloud/remote.php/webdav/"
+      export RCLONE_CONFIG_NEXTCLOUD_URL="http://nextcloud/remote.php/dav/files/${adminuser}"
      export RCLONE_CONFIG_NEXTCLOUD_VENDOR="nextcloud"
      export RCLONE_CONFIG_NEXTCLOUD_USER="${adminuser}"
      export RCLONE_CONFIG_NEXTCLOUD_PASS="$(${pkgs.rclone}/bin/rclone obscure ${adminpass})"
--- a/nixos/tests/nextcloud/with-postgresql-and-redis.nix
+++ b/nixos/tests/nextcloud/with-postgresql-and-redis.nix
@ -60,7 +60,7 @@ in {
    withRcloneEnv = pkgs.writeScript "with-rclone-env" ''
      #!${pkgs.runtimeShell}
      export RCLONE_CONFIG_NEXTCLOUD_TYPE=webdav
-      export RCLONE_CONFIG_NEXTCLOUD_URL="http://nextcloud/remote.php/webdav/"
+      export RCLONE_CONFIG_NEXTCLOUD_URL="http://nextcloud/remote.php/dav/files/${adminuser}"
      export RCLONE_CONFIG_NEXTCLOUD_VENDOR="nextcloud"
      export RCLONE_CONFIG_NEXTCLOUD_USER="${adminuser}"
      export RCLONE_CONFIG_NEXTCLOUD_PASS="$(${pkgs.rclone}/bin/rclone obscure ${adminpass})"
--- a/nixos/tests/osquery.nix
+++ b/nixos/tests/osquery.nix
@ -1,7 +1,5 @@
 import ./make-test-python.nix ({ lib, pkgs, ... }:

-with lib;
-
 let
  config_refresh = "10";
  nullvalue = "NULL";
@ -9,9 +7,7 @@ let
 in
 {
  name = "osquery";
-  meta = with maintainers; {
-    maintainers = [ znewman01 lewo ];
-  };
+  meta.maintainers = with lib.maintainers; [ znewman01 lewo ];

  nodes.machine = { config, pkgs, ... }: {
    services.osquery = {
--- a/nixos/tests/sftpgo.nix
+++ b/nixos/tests/sftpgo.nix
@ -12,8 +12,6 @@
 # would be a nice to have for the future.
 { pkgs, lib, ...  }:

-with lib;
-
 let
  inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;

@ -54,7 +52,7 @@ let
      # inside the dataprovider they will be automatically created.
      # You have to create the folder on the filesystem yourself
      virtual_folders =
-        optional (isMemberOf config sharedFolderName user) {
+        lib.optional (lib.isMemberOf config sharedFolderName user) {
          name = sharedFolderName;
          mapped_path = "${config.services.sftpgo.dataDir}/${sharedFolderName}";
          virtual_path = "/${sharedFolderName}";
@ -62,10 +60,10 @@ let

      # Defines the ACL on the virtual filesystem
      permissions =
-        recursiveUpdate {
+        lib.recursiveUpdate {
          "/" = [ "list" ];     # read-only top level directory
          "/private" = [ "*" ]; # private subdirectory, not shared with others
-        } (optionalAttrs (isMemberOf config "shared" user) {
+        } (lib.optionalAttrs (lib.isMemberOf config "shared" user) {
          "/shared" = [ "*" ];
        });

@ -91,7 +89,7 @@ let
  # of users and folders to import to SFTPGo.
  loadDataJson = config: pkgs.writeText "users-and-folders.json" (builtins.toJSON {
    users =
-      mapAttrsToList (name: user: generateUserAttrSet config user) (normalUsers config);
+      lib.mapAttrsToList (name: user: lib.generateUserAttrSet config user) (normalUsers config);

    folders = [
      {
--- a/nixos/tests/systemd-initrd-networkd-ssh.nix
+++ b/nixos/tests/systemd-initrd-networkd-ssh.nix
@ -2,15 +2,16 @@ import ./make-test-python.nix ({ lib, ... }: {
  name = "systemd-initrd-network-ssh";
  meta.maintainers = [ lib.maintainers.elvishjerricco ];

-  nodes = with lib; {
+  nodes = {
    server = { config, pkgs, ... }: {
-      environment.systemPackages = [pkgs.cryptsetup];
+      environment.systemPackages = [ pkgs.cryptsetup ];
      boot.loader.systemd-boot.enable = true;
      boot.loader.timeout = 0;
      virtualisation = {
        emptyDiskImages = [ 4096 ];
        useBootLoader = true;
-        # Booting off the encrypted disk requires an available init script from the Nix store
+        # Booting off the encrypted disk requires an available init script from
+        # the Nix store
        mountHostNixStore = true;
        useEFIBoot = true;
      };
@ -26,7 +27,7 @@ import ./make-test-python.nix ({ lib, ... }: {
          enable = true;
          ssh = {
            enable = true;
-            authorizedKeys = [ (readFile ./initrd-network-ssh/id_ed25519.pub) ];
+            authorizedKeys = [ (lib.readFile ./initrd-network-ssh/id_ed25519.pub) ];
            port = 22;
            # Terrible hack so it works with useBootLoader
            hostKeys = [ { outPath = "${./initrd-network-ssh/ssh_host_ed25519_key}"; } ];
@ -38,13 +39,13 @@ import ./make-test-python.nix ({ lib, ... }: {
    client = { config, ... }: {
      environment.etc = {
        knownHosts = {
-          text = concatStrings [
+          text = lib.concatStrings [
            "server,"
            "${
-              toString (head (splitString " " (toString
-                (elemAt (splitString "\n" config.networking.extraHosts) 2))))
+              toString (lib.head (lib.splitString " " (toString
+                (lib.elemAt (lib.splitString "\n" config.networking.extraHosts) 2))))
            } "
-            "${readFile ./initrd-network-ssh/ssh_host_ed25519_key.pub}"
+            "${lib.readFile ./initrd-network-ssh/ssh_host_ed25519_key.pub}"
          ];
        };
        sshKey = {
--- a/pkgs/applications/audio/alsa-scarlett-gui/default.nix
+++ b/pkgs/applications/audio/alsa-scarlett-gui/default.nix
@ -24,6 +24,10 @@ stdenv.mkDerivation rec {
  sourceRoot = "source/src";
  nativeBuildInputs = [ pkg-config wrapGAppsHook4 ];
  buildInputs = [ gtk4 alsa-lib ];
+  postInstall = ''
+      substituteInPlace $out/share/applications/vu.b4.${pname}.desktop \
+        --replace "Exec=/bin/alsa-scarlett-gui" "Exec=$out/bin/${pname}"
+  '';

  # causes redefinition of _FORTIFY_SOURCE
  hardeningDisable = [ "fortify3" ];
--- a/pkgs/applications/backup/unifi-protect-backup/default.nix
+++ b/pkgs/applications/backup/unifi-protect-backup/default.nix
@ -5,7 +5,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "unifi-protect-backup";
-  version = "0.9.1";
+  version = "0.9.4";

  format = "pyproject";

@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "ep1cman";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-L7uM5v2CYGFHYxzBUKlMF+ChtjBM24GZ8NuyoQaOU6U=";
+    hash = "sha256-MFg518iodxdHbr7k5kpkTWI59Kk7pPwyIVswVcjasl8=";
  };

  pythonRelaxDeps = [
@ -33,6 +33,7 @@ python3.pkgs.buildPythonApplication rec {
    aiorun
    aiosqlite
    apprise
+    async-lru
    click
    expiring-dict
    python-dateutil
--- a/pkgs/applications/editors/textadept/default.nix
+++ b/pkgs/applications/editors/textadept/default.nix
@ -1,53 +1,31 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl, gtk2, glib, pkg-config, unzip, ncurses, zip }:
-
+{ lib, stdenv, fetchFromGitHub, fetchurl, cmake, qtbase, wrapQtAppsHook }:
 stdenv.mkDerivation rec {
-  version = "11.4";
+  version = "12.0";
  pname = "textadept";

-  nativeBuildInputs = [ pkg-config unzip zip ];
-  buildInputs = [
-    gtk2 ncurses glib
-  ];
-
-  enableParallelBuilding = true;
-
  src = fetchFromGitHub {
    name = "textadept11";
    owner = "orbitalquark";
    repo = "textadept";
    rev = "textadept_${version}";
-    sha256 = "sha256-1we2NC4N8oY4QmmqIIWGSpTBuLx3MEFkZK+BjmNEfD0=";
+    sha256 = "sha256-KziVN0Fl/IvSnIJKK5s7UikXi3iP5mTauP0YxffKy9c=";
  };

-  preConfigure =
-    lib.concatStringsSep "\n" (lib.mapAttrsToList (name: params:
-      "ln -s ${fetchurl params} $PWD/src/${name}"
-    ) (import ./deps.nix)) + ''
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
+  buildInputs = [ qtbase ];

-    cd src
-    make deps
-  '';
-
-  postBuild = ''
-    make curses
-  '';
-
-  preInstall = ''
-    mkdir -p $out/share/applications
-    mkdir -p $out/share/pixmaps
-  '';
-
-  postInstall = ''
-    make curses install PREFIX=$out MAKECMDGOALS=curses
-  '';
-
-  makeFlags = [
-    "PREFIX=$(out)"
-    "WGET=true"
-    "PIXMAPS_DIR=$(out)/share/pixmaps"
-    "GTK2=1"
+  cmakeFlags = [
+    "CMAKE_INSTALL_PREFIX=build/install"
  ];

+  preConfigure = ''
+    mkdir -p $PWD/build/_deps
+
+    '' +
+    lib.concatStringsSep "\n" (lib.mapAttrsToList (name: params:
+      "ln -s ${fetchurl params} $PWD/build/_deps/${name}"
+    ) (import ./deps.nix));
+
  meta = with lib; {
    description = "An extensible text editor based on Scintilla with Lua scripting.";
    homepage = "http://foicica.com/textadept";
--- a/pkgs/applications/editors/textadept/deps.nix
+++ b/pkgs/applications/editors/textadept/deps.nix
@ -1,39 +1,32 @@
 {
-  "scintilla524.tgz" = {
-    url = "https://www.scintilla.org/scintilla524.tgz";
-    sha256 = "sha256-Su8UiMmkOxcuBat2JWYEnhNdG5HKnV1fn1ClnJhazGY=";
+  "scintilla536.tgz" = {
+    url = "https://www.scintilla.org/scintilla536.tgz";
+    sha256 = "sha256-ib6CeKg+eBOSWq/il32quH0r1r69F7AXn+cq/dVIyyQ=";
  };
  "lexilla510.tgz" = {
    url = "https://www.scintilla.org/lexilla510.tgz";
    sha256 = "sha256-azWVJ0AFSYZxuFTPV73uwiVJZvNxcS/POnFtl6p/P9g=";
  };
-  "9088723504b19f8611b66c119933a4dc7939d7b8.zip" = {
-    url =
-      "https://github.com/orbitalquark/scintillua/archive/9088723504b19f8611b66c119933a4dc7939d7b8.zip";
-    sha256 = "sha256-V2t1kt6+SpZQvQSzLhh8n+WiAnA32SRVFnrbTaJrHRo=";
+  "scinterm_5.0.zip" = {
+    url = "https://github.com/orbitalquark/scinterm/archive/scinterm_5.0.zip";
+    sha256 = "sha256-l1qeLMCrhyoZA/GfmXFR20rY5EsUoO5e+1vZJtYdb24=";
  };
-  "475d8d43f3418590c28bd2fb07ee9229d1fa2d07.zip" = {
-    url =
-      "https://github.com/orbitalquark/scinterm/archive/475d8d43f3418590c28bd2fb07ee9229d1fa2d07.zip";
-    sha256 = "sha256-lNMK0RFcOLg9RRE5a6VelhSzUYVl5TiAiXcje2JOedE=";
+  "scintillua_6.2.zip" = {
+    url = "https://github.com/orbitalquark/scintillua/archive/scintillua_6.2.zip";
+    sha256 = "sha256-vjlN6MBz0xjBwWd8dpx/ks37WvdXt2vE1A71YM3uDik=";
  };
-  "lua-5.4.4.tar.gz" = {
-    url = "http://www.lua.org/ftp/lua-5.4.4.tar.gz";
-    sha256 = "sha256-Fkx4SWU7gK5nvsS3RzuIS/XMjS3KBWU0dewu0nuev2E=";
+  "lua-5.4.6.tar.gz" = {
+    url = "http://www.lua.org/ftp/lua-5.4.6.tar.gz";
+    sha256 = "sha256-fV6huctqoLWco93hxq3LV++DobqOVDLA7NBr9DmzrYg=";
  };
-  "lpeg-1.0.2.tar.gz" = {
-    url = "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.2.tar.gz";
-    sha256 = "sha256-SNZldgUbbHg4j6rQm3BJMJMmRYj80PJY3aqxzdShX/4=";
+  "lpeg-1.1.0.tar.gz" = {
+    url = "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.1.0.tar.gz";
+    sha256 = "sha256-SxVdZ9IkbB/6ete8RmweqJm7xA/vAlfMnAPOy67UNSo=";
  };
  "v1_8_0.zip" = {
    url = "https://github.com/keplerproject/luafilesystem/archive/v1_8_0.zip";
    sha256 = "sha256-46a+ynqKkFIu7THbbM3F7WWkM4JlAMaGJ4TidnG54Yo=";
  };
-  "444af9ca8a73151dbf759e6676d1035af469f01a.zip" = {
-    url =
-      "https://github.com/orbitalquark/gtdialog/archive/444af9ca8a73151dbf759e6676d1035af469f01a.zip";
-    sha256 = "sha256-7AkX7OWXJtzKq3h4uJeLzHpf6mrsz67SXtPvmyA5xxg=";
-  };
  "cdk-5.0-20200923.tgz" = {
    url = "http://invisible-mirror.net/archives/cdk/cdk-5.0-20200923.tgz";
    sha256 = "sha256-AH9d6IDLLuvYVW335M2Gc9XmTJlwFH7uaSOoFMKfqu0=";
@ -42,4 +35,11 @@
    url = "http://www.leonerd.org.uk/code/libtermkey/libtermkey-0.22.tar.gz";
    sha256 = "sha256-aUW9PEqqg9qD2AoEXFVj2k7dfQN0xiwNNa7AnrMBRgA=";
  };
+  # lua-std-regex
+  "1.0.zip" = {
+    url = "https://github.com/orbitalquark/lua-std-regex/archive/1.0.zip";
+    sha256 = "sha256-W2hKHOfqYyo3qk+YvPJlzZfZ1wxZmMVphSlcaql+dOE=";
+  };
 }
+
+
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -966,18 +966,23 @@ self: super: {

  sniprun =
    let
-      version = "1.3.5";
+      version = "1.3.6";
      src = fetchFromGitHub {
        owner = "michaelb";
        repo = "sniprun";
        rev = "v${version}";
-        hash = "sha256-D2nHei7mc7Yn8rgFiWFyaR87wQuryv76B25BYOpyp2I=";
+        hash = "sha256-1xvB/YhpHlOhxbkIGlgQyTlO5ljWPHfOm+tuhKRTXAw=";
      };
      sniprun-bin = rustPlatform.buildRustPackage {
        pname = "sniprun-bin";
        inherit version src;

-        cargoHash = "sha256-TG84BeYm7K5Dn0CvMvv1gzqeX246JPks1qcwkfcsG8c=";
+        # Cargo.lock is outdated
+        preBuild = ''
+          cargo update --offline
+        '';
+
+        cargoHash = "sha256-pML4ZJYivC/tu/7yvbB/VHfXTT+UpLZuS1Y3iNXt2Ks=";

        nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2356,8 +2356,8 @@ let
        mktplcRef = {
          name = "direnv";
          publisher = "mkhl";
-          version = "0.13.0";
-          sha256 = "sha256-KdLJ7QTi9jz+JbbQuhXqyE3WV9oF+wyC/9ZJ/XTFOYc=";
+          version = "0.14.0";
+          sha256 = "sha256-T+bt6ku+zkqzP1gXNLcpjtFAevDRiSKnZaE7sM4pUOs=";
        };
        meta = {
          description = "direnv support for Visual Studio Code";
@ -3018,8 +3018,8 @@ let
        mktplcRef = {
          name = "crates";
          publisher = "serayuzgur";
-          version = "0.5.10";
-          sha256 = "1dbhd6xbawbnf9p090lpmn8i5gg1f7y8xk2whc9zhg4432kdv3vd";
+          version = "0.6.0";
+          sha256 = "080zd103vjrz86vllr1ricq2vi3hawn4534n492m7xdcry9l9dpc";
        };
        meta = {
          license = lib.licenses.mit;
@ -3462,8 +3462,8 @@ let
        mktplcRef = {
          name = "errorlens";
          publisher = "usernamehw";
-          version = "3.8.0";
-          sha256 = "sha256-T2YTEbeC22/B5BlBBrBATLv95HQC5xGab+KnCMzI1vc=";
+          version = "3.12.0";
+          sha256 = "sha256-G5+We49/f5UwYqoBovegRK+UOT6KPZo85cvoDjD1Mu4=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/usernamehw.errorlens/changelog";
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@ -24,9 +24,9 @@ let fetchurl = args@{url, hash, ...}:
 in rec {

  stable = fetchurl rec {
-    version = "8.0.1";
+    version = "8.0.2";
    url = "https://dl.winehq.org/wine/source/8.0/wine-${version}.tar.xz";
-    hash = "sha256-IgNfODa0+cOxlArZD5uePBvgkjQjbSqA2JMYBTXHW30=";
+    hash = "sha256-bsj7byxy1XbLEfUrL41Zr2RASAIVRlHRIrmEZtkdyEc=";

    ## see http://wiki.winehq.org/Gecko
    gecko32 = fetchurl rec {
--- a/pkgs/applications/emulators/yuzu/generic.nix
+++ b/pkgs/applications/emulators/yuzu/generic.nix
@ -110,7 +110,7 @@ in stdenv.mkDerivation {
  # This changes `ir/opt` to `ir/var/empty` in `externals/dynarmic/src/dynarmic/CMakeLists.txt`
  # making the build fail, as that path does not exist
  dontFixCmake = true;
-
+  patches = [./vulkan_version.patch];
  cmakeFlags = [
    # actually has a noticeable performance impact
    "-DYUZU_ENABLE_LTO=ON"
--- a/pkgs/applications/emulators/yuzu/sources.nix
+++ b/pkgs/applications/emulators/yuzu/sources.nix
@ -1,19 +1,19 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2023-06-22
+# Last updated: 2023-07-31
 {
  compatList = {
-    rev = "2288f79cad3be4c2c3148435372958aebea33156";
+    rev = "c40af830523cf820b6a391a3ef420bcc1b68b367";
    hash = "sha256:1hdsza3wf9a0yvj6h55gsl7xqvhafvbz1i8paz9kg7l49b0gnlh1";
  };

  mainline = {
-    version = "1475";
-    hash = "sha256:1948lqk89k7b48skcikjx3i3f8nwb6n6sh2bf00qqbchr8i27gpm";
+    version = "1513";
+    hash = "sha256:0mqrdsl55aimm39rws7ap6rw9qq6m4pzp7zlyvp3dchh1x58zzgq";
  };

  ea = {
-    version = "3702";
-    distHash = "sha256:178mfg7rxr1372favkkizdcjv1ckfkzmjqfpw6ja3c5kv0psv19j";
-    fullHash = "sha256:00ls667l8zaj8597saw6drd28x4k02iqh3l7rxjjxkcqny6qv6p8";
+    version = "3783";
+    distHash = "sha256:01prkdximgypikgggq2y53hlpf7gmg1z7zfbc9yi18f6s5cncs18";
+    fullHash = "sha256:0pggknr2sxlc3pdy3jh423318z8rr8f0iz43zw85qwhqnj1h9q19";
  };
 }
--- a/pkgs/applications/emulators/yuzu/vulkan_version.patch
+++ b/pkgs/applications/emulators/yuzu/vulkan_version.patch
@ -0,0 +1,13 @@
+Yuzu requires a version of Vulkan that has not yet been released as a stable Vulkan SDK. In case this patch fails, check which version Yuzu is currently using and verify that it still works with the version shipped in Nixpkgs.
+
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -314,7 +314,7 @@
+ find_package(zstd 1.5 REQUIRED)
+ 
+ if (NOT YUZU_USE_EXTERNAL_VULKAN_HEADERS)
+-    find_package(Vulkan 1.3.256 REQUIRED)
+    find_package(Vulkan 1.3.250 REQUIRED)
+ endif()
+ 
+ if (ENABLE_LIBUSB)
--- a/pkgs/applications/file-managers/mucommander/default.nix
+++ b/pkgs/applications/file-managers/mucommander/default.nix
@ -10,13 +10,13 @@
 }:

 let
-  version = "1.2.0-1";
+  version = "1.3.0-1";

  src = fetchFromGitHub {
    owner = "mucommander";
    repo = "mucommander";
    rev = version;
-    sha256 = "sha256-OrtC7E/8n9uEo7zgFHYQqXV3qLpdKtxwbwZfxoOqTqA=";
+    sha256 = "sha256-rSHHv96L2EHQuKBSAdpfi1XGP2u9o2y4g1+65FHWFMw=";
  };

  postPatch = ''
@ -49,7 +49,7 @@ let
    '';
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
-    outputHash = "sha256-T4UhEzkaYh237+ZsoQTv1RgqcAKY4dPc/3x+dEie4A8=";
+    outputHash = "sha256-9tCcUg7hDNbkZiQEWtVRsUUfms73aU+vt5tQsfknM+E=";
  };

 in
--- a/pkgs/applications/graphics/xournalpp/default.nix
+++ b/pkgs/applications/graphics/xournalpp/default.nix
@ -6,9 +6,11 @@
 , wrapGAppsHook
 , pkg-config

+, alsa-lib
 , glib
 , gsettings-desktop-schemas
 , gtk3
+, gtksourceview4
 , librsvg
 , libsndfile
 , libxml2
@ -23,20 +25,23 @@

 stdenv.mkDerivation rec {
  pname = "xournalpp";
-  version = "1.1.3";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "xournalpp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Hn7IDnbrmK3V+iz8UqdmHRV2TS4MwYSgYtnH6igbGJ8=";
+    sha256 = "sha256-0xsNfnKdGl34qeN0KZbII9w6PzC1HvvO7mtlNlRvUqQ=";
  };

  nativeBuildInputs = [ cmake gettext pkg-config wrapGAppsHook ];
  buildInputs =
-    [ glib
+    [
+      alsa-lib
+      glib
      gsettings-desktop-schemas
      gtk3
+      gtksourceview4
      librsvg
      libsndfile
      libxml2
--- a/pkgs/applications/misc/ausweisapp2/default.nix
+++ b/pkgs/applications/misc/ausweisapp2/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "AusweisApp2";
-  version = "1.26.5";
+  version = "1.26.7";

  src = fetchFromGitHub {
    owner = "Governikus";
    repo = "AusweisApp2";
    rev = version;
-    hash = "sha256-6/acpPMHsMj/8GkLGNE8yg/apt8ynhN3O35lkA95HYQ=";
+    hash = "sha256-i9hfmMp0pEqtIeKc1mcyINXetzD/33aM0utL8nomVcg=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/applications/misc/confy/default.nix
+++ b/pkgs/applications/misc/confy/default.nix
@ -1,11 +1,11 @@
-{ appstream-glib
+{ blueprint-compiler
 , desktop-file-utils
-, fetchurl
+, fetchzip
 , gobject-introspection
-, gtk3
+, gtk4
 , lib
+, libadwaita
 , libnotify
-, libhandy
 , meson
 , ninja
 , pkg-config
@ -16,14 +16,15 @@

 stdenv.mkDerivation rec {
  pname = "confy";
-  version = "0.6.5";
+  version = "0.7.0";

-  src = fetchurl {
+  src = fetchzip {
    url = "https://git.sr.ht/~fabrixxm/confy/archive/${version}.tar.gz";
-    sha256 = "sha256-zfuwOZBSGQzJUc36M6C5wSHarLbPFqayQVFo+WbVo7k=";
+    hash = "sha256-q8WASTNbiBuKb2tPQBmUL9ji60PRAPnYOTYxnUn0MAw=";
  };

  nativeBuildInputs = [
+    blueprint-compiler
    desktop-file-utils
    meson
    ninja
@ -33,8 +34,8 @@ stdenv.mkDerivation rec {

  buildInputs = [
    gobject-introspection
-    gtk3
-    libhandy
+    gtk4
+    libadwaita
    libnotify
    (python3.withPackages (ps: with ps; [
      icalendar
@ -43,8 +44,7 @@ stdenv.mkDerivation rec {
  ];

  postPatch = ''
-    # Remove executable bits so that meson runs the script with our Python interpreter
-    chmod -x build-aux/meson/postinstall.py
+    patchShebangs build-aux/meson/postinstall.py
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.116.0";
+  version = "0.116.1";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Q5aSpKBgPa2EBEI9qJAw/WRM9LjHa2rdsThMFRV2/F8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-YACMkfDdcou+Yve3D/ealaku1pzuWxInDtnhL/Y+cWw=";
  };

-  vendorHash = "sha256-ScAjE+va/5K/9sYt05X1GmTJp8AUopMukWN/WlPG1sg=";
+  vendorHash = "sha256-l7XCCsJbqZ4g1U8G3VMVArMofPgchUP0T7wGF57d4rA=";

  doCheck = false;

--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@ -3,7 +3,8 @@
 , fetchurl
 , appimageTools
 , makeWrapper
-, electron
+# graphs will not sync without matching upstream's major electron version
+, electron_24
 , git
 , nix-update-script
 }:
@ -56,10 +57,11 @@ in {

  postFixup = ''
    # set the env "LOCAL_GIT_DIRECTORY" for dugite so that we can use the git in nixpkgs
-    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
+    makeWrapper ${electron_24}/bin/electron $out/bin/${pname} \
      --set "LOCAL_GIT_DIRECTORY" ${git} \
      --add-flags $out/share/${pname}/resources/app \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}"
  '';

  passthru.updateScript = nix-update-script { };
--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@ -12,7 +12,7 @@
 let
  inherit (stdenv.hostPlatform) system;
  pname = "obsidian";
-  version = "1.3.5";
+  version = "1.3.7";
  appname = "Obsidian";
  meta = with lib; {
    description = "A powerful knowledge base that works on top of a local folder of plain text Markdown files";
@ -25,7 +25,7 @@ let
  filename = if stdenv.isDarwin then "Obsidian-${version}-universal.dmg" else "obsidian-${version}.tar.gz";
  src = fetchurl {
    url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
-    sha256 = if stdenv.isDarwin then "sha256-bTIJwQqufzxq1/ZxR8rVYER82tl0pPMpKwDPr9Gz1Q4=" else "sha256-jhm6ziFaJnv4prPSfOnJ/EbIRTf9rnvzAJVxnVqmWE4=";
+    sha256 = if stdenv.isDarwin then "sha256-jHsrSYBHJBMyChGsgXHxH/S7wdI1CMonzid8WenNSmI=" else "sha256-8Qi12d4oZ2R6INYZH/qNUBDexft53uy9Uug7UoArwYw=";
  };

  icon = fetchurl {
--- a/pkgs/applications/misc/organicmaps/default.nix
+++ b/pkgs/applications/misc/organicmaps/default.nix
@ -21,13 +21,13 @@

 mkDerivation rec {
  pname = "organicmaps";
-  version = "2023.05.08-7";
+  version = "2023.06.04-13";

  src = fetchFromGitHub {
    owner = "organicmaps";
    repo = "organicmaps";
    rev = "${version}-android";
-    sha256 = "sha256-V7qTi5NiZf+1voZSHfuAyfMeTeiYfs/CoOQ2zweKmaU=";
+    hash = "sha256-HoEOKN99ClR1sa8YFZcS9XomtXnTRdAXS0iQEdDrhvc=";
    fetchSubmodules = true;
  };

@ -37,6 +37,9 @@ mkDerivation rec {

    # crude fix for https://github.com/organicmaps/organicmaps/issues/1862
    echo "echo ${lib.replaceStrings ["." "-"] ["" ""] version}" > tools/unix/version.sh
+
+    # TODO use system boost instead, see https://github.com/organicmaps/organicmaps/issues/5345
+    patchShebangs 3party/boost/tools/build/src/engine/build.sh
  '';

  nativeBuildInputs = [
--- a/pkgs/applications/misc/process-compose/default.nix
+++ b/pkgs/applications/misc/process-compose/default.nix
@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
  pname = "process-compose";
-  version = "0.51.4";
+  version = "0.60.0";

  src = fetchFromGitHub {
    owner = "F1bonacc1";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-eR8uYeScV6bxntc2bEwJC/VSH1bXendJ1FNJB0bC2i0=";
+    hash = "sha256-BsDel6F09HP5Oz2p0DDXKuS7Id5XPhZZxEzwu76vVwk=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -43,7 +43,7 @@ buildGoModule rec {
    installShellFiles
  ];

-  vendorHash = "sha256-dlTqBKyI2t3twxQ+mnn+LTWzM2+CnEa4X0K2yDAZsQA=";
+  vendorHash = "sha256-Z5vCxzdpd2OmlZ/woHhlLN2QMgqa9mm873QGuqDToiM=";

  doCheck = false;

--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -3,10 +3,10 @@
 {
  firefox = buildMozillaMach rec {
    pname = "firefox";
-    version = "115.0.3";
+    version = "116.0";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "d42d522e4c2160824c74d94c90b9d61ff7fd0515cddc9e4d544003ddf975fe975aa517493dc28bad31c67915a22477b2fbb42266dc3bda87a2555b7f57a6f5a2";
+      sha512 = "4370c65a99bf8796524aca11ea8e99fa4f875176a5805ad49f35ae149080eb54be42e7eae84627e87e17b88b262649e48f3b30b317170ac7c208960200d1005d";
    };

    meta = {
@ -87,11 +87,11 @@

  firefox-esr-102 = buildMozillaMach rec {
    pname = "firefox-esr-102";
-    version = "102.13.0esr";
+    version = "102.14.0esr";
    applicationName = "Mozilla Firefox ESR";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "745f4a77e4c898313f11118274d27513f4baa16bb42d5b71d9bd0dbe8957dbf39a5f7ae8442cd711aca9b597bc909c04b44cb8d9094c57aa34e285e64f834fde";
+      sha512 = "6cabd474d0f3a768a0f12fa5c9984ed193906b503202010fd1da0e2affa091fcc5c165e6b9c4152d286410d46b72b2ddbf52d323bf5ea542f29e5267a94dfdcd";
    };

    meta = {
@ -115,11 +115,11 @@

  firefox-esr-115 = buildMozillaMach rec {
    pname = "firefox-esr-115";
-    version = "115.0.3esr";
+    version = "115.1.0esr";
    applicationName = "Mozilla Firefox ESR";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "416ee56bd4a602c543391faaa8de31808f267ef2167f7d913195de45d3628de08d0582dbaa8905c847e1431bccd9d1d5d73ad9e7e5ea75be39e4d908a8b40376";
+      sha512 = "b2abb706fef2f1aa9451e7ac7c2affa0cc92cf2b0c6629f106a94c62017476380c7b6f406861fa468f60ea898d8402f534ad74844eb3932741fbd981cec66592";
    };

    meta = {
--- a/pkgs/applications/networking/browsers/netsurf/browser.nix
+++ b/pkgs/applications/networking/browsers/netsurf/browser.nix
@ -1,58 +1,95 @@
-{ lib, stdenv, fetchurl, makeWrapper, wrapGAppsHook
+{ lib
+, stdenv
+, fetchurl
+, SDL
+, check
+, curl
+, expat
+, gtk2
+, gtk3
+, libXcursor
+, libXrandr
+, libidn
+, libjpeg
+, libpng
+, libwebp
+, libxml2
+, makeWrapper
+, openssl
+, perlPackages
+, pkg-config
+, wrapGAppsHook
+, xxd

-# Buildtime dependencies.
-, check, pkg-config, xxd
-
-# Runtime dependencies.
-, curl, expat, libXcursor, libXrandr, libidn, libjpeg, libpng, libwebp, libxml2
-, openssl, perl, perlPackages
-
-# uilib-specific dependencies
-, gtk2 # GTK 2
-, gtk3 # GTK 3
-, SDL  # Framebuffer
+# Netsurf-specific dependencies
+, buildsystem
+, libcss
+, libdom
+, libhubbub
+, libnsbmp
+, libnsfb
+, libnsgif
+, libnslog
+, libnspsl
+, libnsutils
+, libparserutils
+, libsvgtiny
+, libutf8proc
+, libwapcaplet
+, nsgenbind

 # Configuration
 , uilib
-
-# Netsurf-specific dependencies
-, libcss, libdom, libhubbub, libnsbmp, libnsfb, libnsgif
-, libnslog, libnspsl, libnsutils, libparserutils, libsvgtiny, libutf8proc
-, libwapcaplet, nsgenbind
 }:

-let
-  inherit (lib) optional optionals;
-in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "netsurf";
  version = "3.10";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/netsurf/releases/source/${pname}-${version}-src.tar.gz";
-    sha256 = "sha256-NkhEKeGTYUaFwv8kb1W9Cm3d8xoBi+5F4NH3wohRmV4=";
+    url = "http://download.netsurf-browser.org/netsurf/releases/source/netsurf-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-NkhEKeGTYUaFwv8kb1W9Cm3d8xoBi+5F4NH3wohRmV4=";
  };

  nativeBuildInputs = [
    makeWrapper
-    perl
    perlPackages.HTMLParser
+    perlPackages.perl
    pkg-config
    xxd
  ]
-  ++ optional (uilib == "gtk2" || uilib == "gtk3") wrapGAppsHook
-  ;
+  ++ lib.optional (uilib == "gtk2" || uilib == "gtk3") wrapGAppsHook;

  buildInputs = [
-    check curl libXcursor libXrandr libidn libjpeg libpng libwebp libxml2 openssl
-    # Netsurf-specific libraries
-    nsgenbind libnsfb libwapcaplet libparserutils libnslog libcss
-    libhubbub libdom libnsbmp libnsgif libsvgtiny libnsutils libnspsl
+    check
+    curl
+    libXcursor
+    libXrandr
+    libidn
+    libjpeg
+    libpng
+    libwebp
+    libxml2
+    openssl
+
+    libcss
+    libdom
+    libhubbub
+    libnsbmp
+    libnsfb
+    libnsgif
+    libnslog
+    libnspsl
+    libnsutils
+    libparserutils
+    libsvgtiny
    libutf8proc
+    libwapcaplet
+    nsgenbind
  ]
-  ++ optionals (uilib == "framebuffer") [ expat SDL ]
-  ++ optional (uilib == "gtk2") gtk2
-  ++ optional (uilib == "gtk3") gtk3
+  ++ lib.optionals (uilib == "framebuffer") [ expat SDL ]
+  ++ lib.optional (uilib == "gtk2") gtk2
+  ++ lib.optional (uilib == "gtk3") gtk3
  ;

  # Since at least 2018 AD, GCC and other compilers run in `-fno-common` mode as
@ -78,7 +115,7 @@ stdenv.mkDerivation rec {
    "TARGET=${uilib}"
  ];

-  meta = with lib; {
+  meta = {
    homepage = "https://www.netsurf-browser.org/";
    description = "A free, open source, small web browser";
    longDescription = ''
@ -87,8 +124,7 @@ stdenv.mkDerivation rec {
      layout and rendering engine entirely written from scratch. It is small and
      capable of handling many of the web standards in use today.
    '';
-    license = licenses.gpl2Only;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Only;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/buildsystem.nix
+++ b/pkgs/applications/networking/browsers/netsurf/buildsystem.nix
@ -1,24 +1,26 @@
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+}:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "buildsystem";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-buildsystem";
  version = "1.9";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}.tar.gz";
-    sha256 = "sha256-k4QeMUpoggmiC4dF8GU5PzqQ8Bvmj0Xpa8jS9KKqmio=";
+    url = "http://download.netsurf-browser.org/libs/releases/buildsystem-${finalAttrs.version}.tar.gz";
+    hash = "sha256-k4QeMUpoggmiC4dF8GU5PzqQ8Bvmj0Xpa8jS9KKqmio=";
  };

  makeFlags = [
    "PREFIX=$(out)"
  ];

-  meta = with lib; {
+  meta = {
    homepage = "https://www.netsurf-browser.org/";
    description = "NetSurf browser shared build system";
-    license = licenses.mit;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ vrthra AndersonTorres ];
+    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/default.nix
+++ b/pkgs/applications/networking/browsers/netsurf/default.nix
@ -1,20 +1,23 @@
 { lib, pkgs }:

-lib.makeScope pkgs.newScope (self: with self; {
+lib.makeScope pkgs.newScope (self:
+  let
+    inherit (self) callPackage;
+  in {
  # ui can be: gtk2, gtk3, sixel, framebuffer. Note that console display (sixel)
  # requires a terminal that supports `sixel` capabilities, such as mlterm
  # or xterm -ti 340
  ui = "gtk3";
-  uilib =
-    if ui == "gtk2" ||
-       ui == "gtk3" ||
-       ui == "framebuffer" then ui
-    else if ui == "sixel" then "framebuffer"
-    else null; # Never will happen
-  SDL =
-    if ui == "sixel" then pkgs.SDL_sixel
-    else if ui == "framebuffer" then pkgs.SDL
-    else null;
+  uilib = {
+    "framebuffer" = "framebuffer";
+    "gtk2" = "gtk2";
+    "gtk3" = "gtk3";
+    "sixel" = "framebuffer";
+  }.${self.ui} or null; # Null will never happen
+  SDL = {
+    "sixel" = pkgs.SDL_sixel;
+    "framebuffer" = pkgs.SDL;
+  }.${self.ui} or null;

  browser = callPackage ./browser.nix { };

--- a/pkgs/applications/networking/browsers/netsurf/libcss.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libcss.nix
@ -1,35 +1,43 @@
-{ lib, stdenv, fetchurl, pkg-config, perl
+{ lib
+, stdenv
+, fetchurl
+, perl
+, pkg-config
 , buildsystem
 , libparserutils
 , libwapcaplet
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libcss";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libcss";
  version = "0.9.1";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-0tzhbpM5Lo1qcglCDUfC1Wo4EXAaDoGnJPxUHGPTxtw=";
+    url = "http://download.netsurf-browser.org/libs/releases/libcss-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-0tzhbpM5Lo1qcglCDUfC1Wo4EXAaDoGnJPxUHGPTxtw=";
  };

  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [
    perl
+    buildsystem
    libparserutils
    libwapcaplet
-    buildsystem ];
+  ];

  makeFlags = [
    "PREFIX=$(out)"
    "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
  ];

-  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=implicit-fallthrough" "-Wno-error=maybe-uninitialized" ];
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=implicit-fallthrough"
+    "-Wno-error=maybe-uninitialized"
+  ];

-  meta = with lib; {
-    homepage = "https://www.netsurf-browser.org/projects/${libname}/";
+  meta = {
+    homepage = "https://www.netsurf-browser.org/projects/libcss/";
    description = "Cascading Style Sheets library for netsurf browser";
    longDescription = ''
      LibCSS is a CSS parser and selection engine. It aims to parse the forward
@ -37,8 +45,7 @@ stdenv.mkDerivation rec {
      and is available for use by other software, under a more permissive
      license.
    '';
-    license = licenses.mit;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/libdom.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libdom.nix
@ -1,43 +1,47 @@
-{ lib, stdenv, fetchurl, pkg-config, expat
+{ lib
+, stdenv
+, fetchurl
+, expat
+, pkg-config
 , buildsystem
 , libparserutils
 , libwapcaplet
 , libhubbub
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libdom";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libdom";
  version = "0.4.1";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-mO4HJHHlXiCMmHjlFcQQrUYso2+HtK/L7K0CPzos70o=";
+    url = "http://download.netsurf-browser.org/libs/releases/libdom-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-mO4HJHHlXiCMmHjlFcQQrUYso2+HtK/L7K0CPzos70o=";
  };

  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [
    expat
+    buildsystem
    libhubbub
    libparserutils
    libwapcaplet
-    buildsystem ];
+  ];

  makeFlags = [
    "PREFIX=$(out)"
    "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
  ];

-  meta = with lib; {
-    homepage = "https://www.netsurf-browser.org/projects/${libname}/";
+  meta = {
+    homepage = "https://www.netsurf-browser.org/projects/libdom/";
    description = "Document Object Model library for netsurf browser";
    longDescription = ''
      LibDOM is an implementation of the W3C DOM, written in C. It is currently
      in development for use with NetSurf and is intended to be suitable for use
      in other projects under a more permissive license.
    '';
-    license = licenses.mit;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/libhubbub.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libhubbub.nix
@ -1,30 +1,35 @@
-{ lib, stdenv, fetchurl, pkg-config, perl
+{ lib
+, stdenv
+, fetchurl
+, perl
+, pkg-config
 , buildsystem
 , libparserutils
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libhubbub";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libhubbub";
  version = "0.3.7";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-nnriU+bJBp51frmtTkhG84tNtSwMoBUURqn6Spd3NbY=";
+    url = "http://download.netsurf-browser.org/libs/releases/libhubbub-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-nnriU+bJBp51frmtTkhG84tNtSwMoBUURqn6Spd3NbY=";
  };

  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [
    perl
+    buildsystem
    libparserutils
-    buildsystem ];
+  ];

  makeFlags = [
    "PREFIX=$(out)"
    "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
  ];

-  meta = with lib; {
+  meta = {
    homepage = "https://www.netsurf-browser.org/projects/hubbub/";
    description = "HTML5 parser library for netsurf browser";
    longDescription = ''
@ -37,8 +42,7 @@ stdenv.mkDerivation rec {
      parse all markup, both valid and invalid. As a result, Hubbub parses web
      content well.
    '';
-    license = licenses.mit;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/libnsbmp.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libnsbmp.nix
@ -1,18 +1,21 @@
-{ lib, stdenv, fetchurl, pkg-config
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
 , buildsystem
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libnsbmp";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libnsbmp";
  version = "0.1.6";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-ecSTZfhg7UUb/EEJ7d7I3j6bfOWjvgaVlr0qoZJ5Mk8=";
+    url = "http://download.netsurf-browser.org/libs/releases/libnsbmp-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-ecSTZfhg7UUb/EEJ7d7I3j6bfOWjvgaVlr0qoZJ5Mk8=";
  };

  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [ buildsystem ];

  makeFlags = [
@ -20,11 +23,10 @@ stdenv.mkDerivation rec {
    "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
  ];

-  meta = with lib; {
+  meta = {
    homepage = "https://www.netsurf-browser.org/";
    description = "BMP Decoder for netsurf browser";
-    license = licenses.mit;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/libnsfb.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libnsfb.nix
@ -1,19 +1,23 @@
-{ lib, stdenv, fetchurl, pkg-config
-, uilib, SDL
+{ lib
+, stdenv
+, fetchurl
+, SDL
+, pkg-config
 , buildsystem
+, uilib
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libnsfb";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libnsfb";
  version = "0.2.2";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-vkRso+tU35A/LamDEdEH11dM0R9awHE+YZFW1NGeo5o=";
+    url = "http://download.netsurf-browser.org/libs/releases/libnsfb-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-vkRso+tU35A/LamDEdEH11dM0R9awHE+YZFW1NGeo5o=";
  };

  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [ SDL buildsystem ];

  makeFlags = [
@ -22,11 +26,10 @@ stdenv.mkDerivation rec {
    "TARGET=${uilib}"
  ];

-  meta = with lib; {
-    homepage = "https://www.netsurf-browser.org/projects/${libname}/";
+  meta = {
+    homepage = "https://www.netsurf-browser.org/projects/libnsfb/";
    description = "Netsurf framebuffer abstraction library";
-    license = licenses.mit;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/libnsgif.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libnsgif.nix
@ -1,20 +1,24 @@
-{ lib, stdenv, fetchurl, pkg-config, buildPackages
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, buildPackages
 , buildsystem
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libnsgif";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libnsgif";
  version = "0.2.1";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-nq6lNM1wtTxar0UxeulXcBaFprSojb407Sb0+q6Hmks=";
+    url = "http://download.netsurf-browser.org/libs/releases/libnsgif-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-nq6lNM1wtTxar0UxeulXcBaFprSojb407Sb0+q6Hmks=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];

  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [ buildsystem ];

  makeFlags = [
@ -23,11 +27,10 @@ stdenv.mkDerivation rec {
    "BUILD_CC=$(CC_FOR_BUILD)"
  ];

-  meta = with lib; {
-    homepage = "https://www.netsurf-browser.org/projects/${libname}/";
+  meta = {
+    homepage = "https://www.netsurf-browser.org/projects/libnsgif/";
    description = "GIF Decoder for netsurf browser";
-    license = licenses.mit;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/libnslog.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libnslog.nix
@ -1,18 +1,27 @@
-{ lib, stdenv, fetchurl, pkg-config, bison, flex
+{ lib
+, stdenv
+, fetchurl
+, bison
+, flex
+, pkg-config
 , buildsystem
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libnslog";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libnslog";
  version = "0.1.3";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-/JjcqdfvpnCWRwpdlsAjFG4lv97AjA23RmHHtNsEU9A=";
+    url = "http://download.netsurf-browser.org/libs/releases/libnslog-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-/JjcqdfvpnCWRwpdlsAjFG4lv97AjA23RmHHtNsEU9A=";
  };

-  nativeBuildInputs = [ pkg-config bison flex ];
+  nativeBuildInputs = [
+    bison
+    flex
+    pkg-config
+  ];
+
  buildInputs = [ buildsystem ];

  makeFlags = [
@ -20,11 +29,10 @@ stdenv.mkDerivation rec {
    "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
  ];

-  meta = with lib; {
+  meta = {
    homepage = "https://www.netsurf-browser.org/";
    description = "NetSurf Parametric Logging Library";
-    license = licenses.isc;
-    maintainers = [ maintainers.samueldr maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.isc;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/libnspsl.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libnspsl.nix
@ -1,18 +1,21 @@
-{ lib, stdenv, fetchurl, pkg-config
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
 , buildsystem
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libnspsl";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libnspsl";
  version = "0.1.6";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-08WCBct40xC/gcpVNHotCYcZzsrHBGvDZ5g7E4tFAgs=";
+    url = "http://download.netsurf-browser.org/libs/releases/libnspsl-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-08WCBct40xC/gcpVNHotCYcZzsrHBGvDZ5g7E4tFAgs=";
  };

  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [ buildsystem ];

  makeFlags = [
@ -20,11 +23,10 @@ stdenv.mkDerivation rec {
    "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
  ];

-  meta = with lib; {
+  meta = {
    homepage = "https://www.netsurf-browser.org/";
    description = "NetSurf Public Suffix List - Handling library";
-    license = licenses.mit;
-    maintainers =  [ maintainers.samueldr maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/libnsutils.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libnsutils.nix
@ -1,18 +1,21 @@
-{ lib, stdenv, fetchurl, pkg-config
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
 , buildsystem
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libnsutils";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libnsutils";
  version = "0.1.0";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-eQxlFjRKvoL2KJ1lY5LpzOvkdbIMx+Hi2EMBE4X3rvA=";
+    url = "http://download.netsurf-browser.org/libs/releases/libnsutils-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-eQxlFjRKvoL2KJ1lY5LpzOvkdbIMx+Hi2EMBE4X3rvA=";
  };

  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [ buildsystem ];

  makeFlags = [
@ -20,11 +23,10 @@ stdenv.mkDerivation rec {
    "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
  ];

-  meta = with lib; {
+  meta = {
    homepage = "https://www.netsurf-browser.org/";
    description = "Generalised utility library for netsurf browser";
-    license = licenses.mit;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/libparserutils.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libparserutils.nix
@ -1,29 +1,33 @@
-{ lib, stdenv, fetchurl, perl
+{ lib
+, stdenv
+, fetchurl
+, perl
 , buildsystem
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libparserutils";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libparserutils";
  version = "0.2.4";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-MiuuYbMMzt4+MFv26uJBSSBkl3W8X/HRtogBKjxJR9g=";
+    url = "http://download.netsurf-browser.org/libs/releases/libparserutils-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-MiuuYbMMzt4+MFv26uJBSSBkl3W8X/HRtogBKjxJR9g=";
  };

-  buildInputs = [ perl buildsystem ];
+  buildInputs = [
+    perl
+    buildsystem
+  ];

  makeFlags = [
    "PREFIX=$(out)"
    "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
  ];

-  meta = with lib; {
-    homepage = "https://www.netsurf-browser.org/projects/${libname}/";
+  meta = {
+    homepage = "https://www.netsurf-browser.org/projects/libparserutils/";
    description = "Parser building library for netsurf browser";
-    license = licenses.mit;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/libsvgtiny.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libsvgtiny.nix
@ -1,4 +1,8 @@
-{ lib, stdenv, fetchurl, pkg-config, gperf
+{ lib
+, stdenv
+, fetchurl
+, gperf
+, pkg-config
 , buildsystem
 , libdom
 , libhubbub
@ -6,34 +10,37 @@
 , libwapcaplet
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libsvgtiny";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libsvgtiny";
  version = "0.1.7";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-LA3PlS8c2ILD6VQB75RZ8W27U8XT5FEjObL563add4E=";
+    url = "http://download.netsurf-browser.org/libs/releases/libsvgtiny-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-LA3PlS8c2ILD6VQB75RZ8W27U8XT5FEjObL563add4E=";
  };

-  nativeBuildInputs = [ pkg-config gperf ];
+  nativeBuildInputs = [
+    gperf
+    pkg-config
+  ];
+
  buildInputs = [
+    buildsystem
    libdom
    libhubbub
    libparserutils
    libwapcaplet
-    buildsystem ];
+  ];

  makeFlags = [
    "PREFIX=$(out)"
    "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
  ];

-  meta = with lib; {
-    homepage = "https://www.netsurf-browser.org/projects/${libname}/";
+  meta = {
+    homepage = "https://www.netsurf-browser.org/projects/libsvgtiny/";
    description = "NetSurf SVG decoder";
-    license = licenses.mit;
-    maintainers = [ maintainers.samueldr maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/libutf8proc.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libutf8proc.nix
@ -5,13 +5,12 @@
 , buildsystem
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libutf8proc";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libutf8proc";
  version = "2.4.0-1";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
+    url = "http://download.netsurf-browser.org/libs/releases/libutf8proc-${finalAttrs.version}-src.tar.gz";
    hash = "sha256-AasdaYnBx3VQkNskw/ZOSflcVgrknCa+xRQrrGgCxHI=";
  };

@ -24,11 +23,10 @@ stdenv.mkDerivation rec {
    "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
  ];

-  meta = with lib; {
+  meta = {
    homepage = "https://www.netsurf-browser.org/";
    description = "UTF8 Processing library for netsurf browser";
-    license = licenses.mit;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/libwapcaplet.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libwapcaplet.nix
@ -1,15 +1,16 @@
-{ lib, stdenv, fetchurl
+{ lib
+, stdenv
+, fetchurl
 , buildsystem
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "libwapcaplet";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-libwapcaplet";
  version = "0.4.3";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-myqh3W1mRfjpkrNpf9vYfwwOHaVyH6VO0ptITRMWDFw=";
+    url = "http://download.netsurf-browser.org/libs/releases/libwapcaplet-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-myqh3W1mRfjpkrNpf9vYfwwOHaVyH6VO0ptITRMWDFw=";
  };

  buildInputs = [ buildsystem ];
@ -21,11 +22,10 @@ stdenv.mkDerivation rec {

  env.NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";

-  meta = with lib; {
-    homepage = "https://www.netsurf-browser.org/projects/${libname}/";
+  meta = {
+    homepage = "https://www.netsurf-browser.org/projects/libwapcaplet/";
    description = "String internment library for netsurf browser";
-    license = licenses.mit;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/netsurf/nsgenbind.nix
+++ b/pkgs/applications/networking/browsers/netsurf/nsgenbind.nix
@ -1,30 +1,36 @@
-{ lib, stdenv, fetchurl
-, flex, bison
+{ lib
+, stdenv
+, fetchurl
+, bison
+, flex
 , buildsystem
 }:

-stdenv.mkDerivation rec {
-  pname = "netsurf-${libname}";
-  libname = "nsgenbind";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netsurf-nsgenbind";
  version = "0.8";

  src = fetchurl {
-    url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "sha256-TY1TrQAK2nEncjZeanPrj8XOl1hK+chlrFsmohh/HLM=";
+    url = "http://download.netsurf-browser.org/libs/releases/nsgenbind-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-TY1TrQAK2nEncjZeanPrj8XOl1hK+chlrFsmohh/HLM=";
  };

-  buildInputs = [ flex bison buildsystem ];
+  nativeBuildInputs = [
+    bison
+    flex
+  ];
+
+  buildInputs = [ buildsystem ];

  makeFlags = [
    "PREFIX=$(out)"
    "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
  ];

-  meta = with lib; {
+  meta = {
    homepage = "https://www.netsurf-browser.org/";
    description = "Generator for JavaScript bindings for netsurf browser";
-    license = licenses.mit;
-    maintainers = [ maintainers.vrthra maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    inherit (buildsystem.meta) maintainers platforms;
  };
-}
+})
--- a/pkgs/applications/networking/browsers/offpunk/default.nix
+++ b/pkgs/applications/networking/browsers/offpunk/default.nix
@ -14,6 +14,7 @@
 let
  pythonDependencies = with python3Packages; [
    beautifulsoup4
+    chardet
    cryptography
    feedparser
    pillow
@ -30,7 +31,7 @@ let
 in
 python3Packages.buildPythonPackage rec {
  pname = "offpunk";
-  version = "1.9.2";
+  version = "1.10";
  format = "flit";

  disabled = python3Packages.pythonOlder "3.7";
@ -39,7 +40,7 @@ python3Packages.buildPythonPackage rec {
    owner = "~lioploum";
    repo = "offpunk";
    rev = "v${version}";
-    sha256 = "sha256-CYsuoj5/BaaboDRtcOrGzJoZDCfOLs7ROVWLVjOAnRU=";
+    hash = "sha256-+jGKPPnKZHn+l6VAwuae6kICwR7ymkYJjsM2OHQAEmU=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -46,11 +46,11 @@
    "vendorHash": "sha256-xZ0pS7XxfYGbG2kEw5FAjABDQZmektaI7OhToiFMXKk="
  },
  "alicloud": {
-    "hash": "sha256-w5cdAqGF9E9yDdLnMmrrZfWcp2qcfCz9NqylRUAzKOI=",
+    "hash": "sha256-0qPmUmQ+CGRyah2GXUADAt3HPietpAahQ9ze6Ip6yvE=",
    "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
    "owner": "aliyun",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.208.0",
+    "rev": "v1.208.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -182,13 +182,13 @@
    "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
  },
  "buildkite": {
-    "hash": "sha256-2nJXniJfOHuHaEEue0rugq5RRnThcFMh7MWYGE/AzmA=",
+    "hash": "sha256-3rGuE47CYbl1B+DAYUBiuGTC1sn85c5aeay+irdhTe0=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v0.21.2",
+    "rev": "v0.22.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-xxuF4LVDkFkHT42plP+Mv8GFdBrrZZVUm6vErjpho3I="
+    "vendorHash": "sha256-oVXrSI+DU6NgmVIPcS4He4mHVrkA2tMxFUpxMnv0bu4="
  },
  "checkly": {
    "hash": "sha256-UXIni594P85sgS8XVLoJ0+UTBeUS0XC+oj98KJUfghg=",
@ -445,24 +445,24 @@
    "vendorHash": "sha256-AVTWTS16d8QsPLLAJeAfgcVDzUBMp+b2oAphaCBqhS0="
  },
  "google": {
-    "hash": "sha256-kQF9ed2q5Wc/LTbFtzSKgcvJPZa18O6ybuT8dzLFdzc=",
+    "hash": "sha256-6VLZW6RlBW7D4GS/JTvlpIcF3AhIEKbNFOqsQI58HyE=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.75.1",
+    "rev": "v4.76.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2znSaprsw+uroTmLwh5+NXdgnUlkFXu4KbNLHgnGt2s="
+    "vendorHash": "sha256-rlNYh42Cw2wMF/9aI8QM0x8t2jdz+V9u4uJvS6A4zx8="
  },
  "google-beta": {
-    "hash": "sha256-8Zt7q6OqtXGBk+wMBuBYZkfckFC3Gk/m+24Y8eelflw=",
+    "hash": "sha256-ecmCr1AHpyYDmt1ofjFgJjirsNhpcdLggp9EXz3hT5E=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.75.1",
+    "rev": "v4.76.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2znSaprsw+uroTmLwh5+NXdgnUlkFXu4KbNLHgnGt2s="
+    "vendorHash": "sha256-rlNYh42Cw2wMF/9aI8QM0x8t2jdz+V9u4uJvS6A4zx8="
  },
  "googleworkspace": {
    "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@ -547,11 +547,11 @@
    "vendorHash": "sha256-hxT9mpKifb63wlCUeUzgVo4UB2TnYZy9lXF4fmGYpc4="
  },
  "huaweicloud": {
-    "hash": "sha256-1cXPpJgvNegfx/mziyZozmEyiSlGRVuGHFdLCWozjsc=",
+    "hash": "sha256-Uon1nXtoILFOQp9DsOubi31v6WJqWBa3zDZKHJdboHY=",
    "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
    "owner": "huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.52.1",
+    "rev": "v1.53.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -845,11 +845,11 @@
    "vendorHash": null
  },
  "opennebula": {
-    "hash": "sha256-bWmSXlNgPOhzNFodYAzLE1theDntCks3ywtruRbCcYc=",
+    "hash": "sha256-0XeGaHyN+u5QEU9RUr51FVi13HNmjBN6mnFwfilPw5s=",
    "homepage": "https://registry.terraform.io/providers/OpenNebula/opennebula",
    "owner": "OpenNebula",
    "repo": "terraform-provider-opennebula",
-    "rev": "v1.2.2",
+    "rev": "v1.3.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-W7UGOtyFsIMXPqFDnde2XlzU7klR7Fs00mSuJ9ID20A="
  },
@ -1034,11 +1034,11 @@
    "vendorHash": null
  },
  "snowflake": {
-    "hash": "sha256-YsLF1bPYzn5cZlCqaCRKpSIXx0ha4imxIpC1Cm48o7A=",
+    "hash": "sha256-gz41dRmJQm4cH7VhrEznir7IRA9+hGMjYzsOyQtNuG0=",
    "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
    "owner": "Snowflake-Labs",
    "repo": "terraform-provider-snowflake",
-    "rev": "v0.68.2",
+    "rev": "v0.69.0",
    "spdx": "MIT",
    "vendorHash": "sha256-ZNkZ2GMSBZHz+L626VqT7pTeb8fSYkaCi84O5ggd1FM="
  },
@ -1106,11 +1106,11 @@
    "vendorHash": "sha256-GNSKSlaFBj2P+z40U+0uwPSOuQBy+9vOVFfPe8p0A24="
  },
  "tencentcloud": {
-    "hash": "sha256-z2M3r3MNObSR2flqqldmZvTCiPJ6l+vr05a9Ks34t6U=",
+    "hash": "sha256-Pk+x9/acer3YWBEMZYZWar8oDTFLPc0QydgAHrJZBNI=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.81.17",
+    "rev": "v1.81.18",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1261,12 +1261,12 @@
    "vendorHash": "sha256-KrYtKeQsa2ApSt4QA2yxgWJHq8LpuAR+DYNB4tIsTZI="
  },
  "yandex": {
-    "hash": "sha256-03lZMLD2Iq9o9ijvMD7JNnaGNdn5OpB/s3509YdYRfQ=",
+    "hash": "sha256-bG8cBOkwsVew5qmaFXdq7yc2j8JNfY9qwnQ7IJGUZvM=",
    "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
    "owner": "yandex-cloud",
    "repo": "terraform-provider-yandex",
-    "rev": "v0.95.0",
+    "rev": "v0.96.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-IdRgtPUAYYR55MiT/2wqGzYhuMfThUmhnGGYoPQlHW0="
+    "vendorHash": "sha256-Ni422dybGvn5yzu85FbBdvG0zL7+rSpJWr8+HE1MSeg="
  }
 }
--- a/pkgs/applications/networking/freefilesync/default.nix
+++ b/pkgs/applications/networking/freefilesync/default.nix
@ -17,11 +17,16 @@

 stdenv.mkDerivation rec {
  pname = "freefilesync";
-  version = "12.4";
+  version = "12.5";

  src = fetchurl {
    url = "https://freefilesync.org/download/FreeFileSync_${version}_Source.zip";
-    hash = "sha256-rH1xp0/ggWWyUPcksY2GhYtUddTGrEDxdL/uODurvDo=";
+    # The URL only redirects to the file on the second attempt
+    postFetch = ''
+      rm -f $out
+      tryDownload "$url"
+    '';
+    hash = "sha256-KTN/HbNLP/+z5rryp3wDRo6c7l03vi6tUxCXZPMGUoM=";
  };

  sourceRoot = ".";
@ -31,8 +36,12 @@ stdenv.mkDerivation rec {
    # Disable loading of the missing Animal.dat
    (fetchpatch {
      url = "https://sources.debian.org/data/main/f/freefilesync/12.0-2/debian/patches/ffs_devuan.patch";
+      postFetch = ''
+        substituteInPlace $out \
+          --replace "-std=c++2b" "-std=c++23"
+      '';
      excludes = [ "FreeFileSync/Source/ffs_paths.cpp" ];
-      hash = "sha256-6pHr5txabMTpGMKP7I5oe1lGAmgb0cPW8ZkPv/WXN74=";
+      hash = "sha256-CtUC94AoYTxoqSMWZrzuO3jTD46rj11JnbNyXtWckCo=";
    })
    # Fix build with GTK 3
    (fetchpatch {
--- a/pkgs/applications/networking/ids/suricata/default.nix
+++ b/pkgs/applications/networking/ids/suricata/default.nix
@ -22,8 +22,7 @@
 , luajit
 , lz4
 , nspr
-, nss
-, pcre
+, pcre2
 , python
 , zlib
 , redisSupport ? true, redis, hiredis
@ -34,11 +33,11 @@
 in
 stdenv.mkDerivation rec {
  pname = "suricata";
-  version = "6.0.13";
+  version = "7.0.0";

  src = fetchurl {
    url = "https://www.openinfosecfoundation.org/download/${pname}-${version}.tar.gz";
-    hash = "sha256-4J8vgA0ODNL5fyHFBZUMzD27nOXP6AjflWe22EmjEFU=";
+    hash = "sha256-e80TExGDZkUUZdw/g4Wj9qrdCE/+RN0lfdqBBYY7t2k=";
  };

  nativeBuildInputs = [
@ -67,8 +66,7 @@ stdenv.mkDerivation rec {
    luajit
    lz4
    nspr
-    nss
-    pcre
+    pcre2
    python
    zlib
  ]
@ -101,7 +99,6 @@ stdenv.mkDerivation rec {
    "--enable-nflog"
    "--enable-nfqueue"
    "--enable-pie"
-    "--disable-prelude"
    "--enable-python"
    "--enable-unix-socket"
    "--localstatedir=/var"
--- a/pkgs/applications/networking/instant-messengers/armcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/armcord/default.nix
@ -39,7 +39,7 @@

 stdenv.mkDerivation rec {
  pname = "armcord";
-  version = "3.2.0";
+  version = "3.2.1";

  src =
    let
@ -48,11 +48,11 @@ stdenv.mkDerivation rec {
      {
        x86_64-linux = fetchurl {
          url = "${base}/v${version}/ArmCord_${version}_amd64.deb";
-          sha256 = "sha256-7lT69fU7tGujhbDTX0tYpkEquoswMCZOGAUhk2Nr+C0=";
+          sha256 = "1cfbypn9kh566s09c1bvxswpc0r11pmsvxlh4dixd5s622ia3h7r";
        };
        aarch64-linux = fetchurl {
          url = "${base}/v${version}/ArmCord_${version}_arm64.deb";
-          sha256 = "sha256-a5qLK8WjrlmKF24U9SiEpY+SNWuHf6gHJBym5IM8HZ4=";
+          sha256 = "0mb6az0mzjz2zal7igigjcigg3phn2ijfw04igpl7q2rg6ha3z00";
        };
      }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@ -1,9 +1,9 @@
 {
-  "version" = "1.11.36";
+  "version" = "1.11.37";
  "hashes" = {
-    "desktopSrcHash" = "sha256-MMTuyyUXur5Fy24aXPWtZbQLAaXR2R7coEi8ZOJo1YI=";
-    "desktopYarnHash" = "03wmdqnxzjrvdypwrb5z564liiqamwn6qmw2fww1mja8dkdkx5ng";
-    "webSrcHash" = "sha256-u+Y/iLRlTd5RkczF6qIaer9HKFnm8LUGP8ZnB/WfiGI=";
-    "webYarnHash" = "0s9ly1hr9jvb2asgjf6g5n5n5w6qh51wkwyl7ps891c0hv9m28zm";
+    "desktopSrcHash" = "sha256-6YiMAmOb0lSaLDE/ohVpZFbl4J1NxS9xNFFcebVW9MA=";
+    "desktopYarnHash" = "1ksj99g649kvilr850rkk8nkl55z7vz7m8159777kjikakzra2ly";
+    "webSrcHash" = "sha256-zFRoL/bnic6Waaiz7Vfama4qzlYKk0TTr5zPK6PNSpM=";
+    "webYarnHash" = "1lpd9mmg51jnhdr2zfisxdpc4i64kn4bpzkxqzip7dnn9iz432kw";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 (if stdenv.isDarwin then darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv).mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20230723-1";
+  version = "20230730";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-EHwQHFKahjpP8OOIY0ZRpkmYZYiDNteeMLkRwJIEp7g=";
+    hash = "sha256-5gXeAX3eV70p5wdQEMXv5QAv3vXH2OH46XL2rY0AUvE=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
@ -115,6 +115,7 @@ stdenv.mkDerivation rec {
      free = false;
    };
    maintainers = with maintainers; [ lhvwb lukegb atemu ];
+    mainProgram = "ts3client";
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/networking/remote/dayon/default.nix
+++ b/pkgs/applications/networking/remote/dayon/default.nix
@ -0,0 +1,67 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, ant
+, jdk
+, jre
+, makeWrapper
+, copyDesktopItems
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dayon";
+  version = "11.0.7";
+
+  src = fetchFromGitHub {
+    owner = "RetGal";
+    repo = "dayon";
+    rev = "v${version}";
+    hash = "sha256-3TbJVM5po4aUAOsY7JJs/b5tUzH3WGnca/H83IeMQ2s=";
+  };
+
+  # https://github.com/RetGal/Dayon/pull/66
+  postPatch = ''
+    substituteInPlace resources/deb/dayon_assisted.desktop resources/deb/dayon_assistant.desktop \
+      --replace "Exec=/usr/bin/" "Exec="
+  '';
+
+  nativeBuildInputs = [
+    ant
+    jdk
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    ant
+    runHook postBuild
+  '';
+
+  desktopItems = [
+    "resources/deb/dayon_assisted.desktop"
+    "resources/deb/dayon_assistant.desktop"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 build/dayon.jar $out/share/dayon/dayon.jar
+    mkdir -p $out/bin
+    makeWrapper ${jre}/bin/java $out/bin/dayon \
+      --add-flags "-jar $out/share/dayon/dayon.jar"
+    makeWrapper ${jre}/bin/java $out/bin/dayon_assisted \
+      --add-flags "-cp $out/share/dayon/dayon.jar mpo.dayon.assisted.AssistedRunner"
+    makeWrapper ${jre}/bin/java $out/bin/dayon_assistant \
+      --add-flags "-cp $out/share/dayon/dayon.jar mpo.dayon.assistant.AssistantRunner"
+    install -Dm644 resources/dayon.png $out/share/icons/hicolor/128x128/apps/dayon.png
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://retgal.github.io/Dayon/index.html";
+    description = "An easy to use, cross-platform remote desktop assistance solution";
+    license = licenses.gpl3Plus; # https://github.com/RetGal/Dayon/issues/59
+    platforms = platforms.all;
+    maintainers = with maintainers; [ fgaz ];
+  };
+}
--- a/pkgs/applications/office/iotas/default.nix
+++ b/pkgs/applications/office/iotas/default.nix
@ -19,7 +19,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "iotas";
-  version = "0.1.14";
+  version = "0.2.2";
  format = "other";

  src = fetchFromGitLab {
@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "cheywood";
    repo = pname;
    rev = version;
-    hash = "sha256-IvKjvsHJdoFmDvsM1/kFPikYbBLUEQ57DKr1T+Jyw7w=";
+    hash = "sha256-oThsyTsNM3283e4FViISdFzmeQnU7qXHh4xEJWA2fkc=";
  };

  nativeBuildInputs = [
@ -56,11 +56,11 @@ python3.pkgs.buildPythonApplication rec {
    requests
    markdown-it-py
    linkify-it-py
+    mdit-py-plugins
  ];

  # prevent double wrapping
  dontWrapGApps = true;
-
  preFixup = ''
    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';
--- a/pkgs/applications/office/notes/default.nix
+++ b/pkgs/applications/office/notes/default.nix
@ -0,0 +1,54 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, wrapQtAppsHook
+, qtbase
+, qtdeclarative
+, Cocoa
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "notes";
+  version = "2.2.0";
+
+  src = fetchFromGitHub {
+    owner = "nuttyartist";
+    repo = "notes";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-ZfAm77UHyjs2aYOYb+AhKViz6uteb7+KKSedonSiMkY=";
+    fetchSubmodules = true;
+  };
+
+  cmakeFlags = [ "-DUPDATE_CHECKER=OFF" ];
+
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qtbase
+    qtdeclarative
+  ] ++ lib.optionals stdenv.isDarwin [
+    Cocoa
+  ];
+
+  postInstall = lib.optionalString stdenv.isLinux ''
+    # temporary fix: https://github.com/nuttyartist/notes/issues/613
+    substituteInPlace $out/share/applications/io.github.nuttyartist.notes.desktop \
+       --replace 'Exec=notes' 'Exec=env QT_STYLE_OVERRIDE= notes'
+  '' + lib.optionalString stdenv.isDarwin ''
+    mkdir $out/Applications
+    mv $out/bin/Notes.app $out/Applications
+  '';
+
+  meta = {
+    description = "A fast and beautiful note-taking app";
+    downloadPage = "https://github.com/nuttyartist/notes";
+    homepage = "https://www.get-notes.com";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ zendo ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , perl
 , wrapGAppsHook
@ -30,6 +31,14 @@ stdenv.mkDerivation rec {
    hash = "sha256-8Iheb/9wjf0u10ZQRkLMLNN2s7P++Fqcr26iatiKcTo=";
  };

+  patches = [
+    # Compatibility with INDI 2.0 series from https://github.com/Stellarium/stellarium/pull/3269
+    (fetchpatch {
+      url = "https://github.com/Stellarium/stellarium/commit/31fd7bebf33fa710ce53ac8375238a24758312bc.patch";
+      hash = "sha256-eJEqqitZgtV6noeCi8pDBYMVTFIVWXZU1fiEvoilX8o=";
+    })
+  ];
+
  postPatch = lib.optionalString stdenv.isDarwin ''
    substituteInPlace CMakeLists.txt \
      --replace 'SET(CMAKE_INSTALL_PREFIX "''${PROJECT_BINARY_DIR}/Stellarium.app/Contents")' \
--- a/pkgs/applications/science/biology/paml/default.nix
+++ b/pkgs/applications/science/biology/paml/default.nix
@ -1,23 +1,28 @@
-{stdenv, fetchurl}:
+{ lib
+, stdenv
+, fetchFromGitHub
+}:

-stdenv.mkDerivation rec {
-  version = "4.9j";
+stdenv.mkDerivation (finalAttrs: {
  pname = "paml";
-  src = fetchurl {
-    url = "http://abacus.gene.ucl.ac.uk/software/paml${version}.tgz";
-    sha256 = "0qflf3i27x6jwks3c6q560m1q8r043ja96syah145113iz5wdalp";
+  version = "4.10.7";
+
+  src = fetchFromGitHub {
+    owner = "abacus-gene";
+    repo = "paml";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-P/oHaLxoQzjFuvmHyRdShHv1ayruy6O/I9w8aTyya2s=";
  };

-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: /build/ccKomtcd.o:(.bss+0x4544): multiple definition of `SeqTypes';
-  #     /build/ccx7EsgU.o:(.bss+0x2a0dfdc): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-D_POSIX_C_SOURCE";

  preBuild = ''
    cd ./src/
  '';
+
  installPhase = ''
+    runHook preInstall
+
    mkdir -pv $out/bin
    cp -v codeml $out/bin
    cp -v baseml $out/bin
@ -28,12 +33,16 @@ stdenv.mkDerivation rec {
    cp -v mcmctree $out/bin
    cp -v pamp $out/bin
    cp -v yn00 $out/bin
+
+    runHook postInstall
  '';

  meta = {
    description     = "Phylogenetic Analysis by Maximum Likelihood (PAML)";
    longDescription = "PAML is a package of programs for phylogenetic analyses of DNA or protein sequences using maximum likelihood. It is maintained and distributed for academic use free of charge by Ziheng Yang. ANSI C source codes are distributed for UNIX/Linux/Mac OSX, and executables are provided for MS Windows. PAML is not good for tree making. It may be used to estimate parameters and test hypotheses to study the evolutionary process, when you have reconstructed trees using other programs such as PAUP*, PHYLIP, MOLPHY, PhyML, RaxML, etc.";
-    license     = "non-commercial";
+    license     = lib.licenses.gpl3Only;
    homepage    = "http://abacus.gene.ucl.ac.uk/software/paml.html";
+    changelog = "https://github.com/abacus-gene/paml/releases/tag/${finalAttrs.src.rev}";
+    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/applications/science/chemistry/cp2k/default.nix
+++ b/pkgs/applications/science/chemistry/cp2k/default.nix
@ -11,13 +11,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "cp2k";
-  version = "2023.1";
+  version = "2023.2";

  src = fetchFromGitHub {
    owner = "cp2k";
    repo = "cp2k";
    rev = "v${version}";
-    hash = "sha256-SG5Gz0cDiSfbSZ8m4K+eARMLU4iMk/xK3esN5yt05RE=";
+    hash = "sha256-1TJorIjajWFO7i9vqSBDTAIukBdyvxbr5dargt4QB8M=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "cbmc";
-  version = "5.87.0";
+  version = "5.88.1";

  src = fetchFromGitHub {
    owner = "diffblue";
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "sha256-aBqJqsZK5O3yWTQ1BEej0eeDI8JcsnO6sIv7eH6wnkw=";
+    sha256 = "sha256-bfrtYqTMU/Nib0wZjS/t0kg5sBsuQuq9GaHX4PxL7tU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/molecular-dynamics/lammps/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/lammps/default.nix
@ -7,6 +7,7 @@
 , blas
 , lapack
 , cmake
+, cudaPackages
 , pkg-config
 # Available list of packages can be found near here:
 #
@ -59,6 +60,9 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    cmake
    pkg-config
+    # Although not always needed, it is needed if cmakeFlags include
+    # GPU_API=cuda, and it doesn't users that don't enable the GPU package.
+    cudaPackages.autoAddOpenGLRunpathHook
  ];

  passthru = {
@ -84,9 +88,14 @@ stdenv.mkDerivation rec {
  ] ++ extraBuildInputs
  ;

-  # For backwards compatibility
  postInstall = ''
+    # For backwards compatibility
    ln -s $out/bin/lmp $out/bin/lmp_serial
+    # Install vim and neovim plugin
+    install -Dm644 ../../tools/vim/lammps.vim $out/share/vim-plugins/lammps/syntax/lammps.vim
+    install -Dm644 ../../tools/vim/filetype.vim $out/share/vim-plugins/lammps/ftdetect/lammps.vim
+    mkdir -p $out/share/nvim
+    ln -s $out/share/vim-plugins/lammps $out/share/nvim/site
  '';

  meta = with lib; {
@ -106,5 +115,6 @@ stdenv.mkDerivation rec {
    # support.
    broken = (blas.isILP64 && lapack.isILP64);
    maintainers = [ maintainers.costrouc maintainers.doronbehar ];
+    mainProgram = "lmp";
  };
 }
--- a/pkgs/applications/terminal-emulators/foot/default.nix
+++ b/pkgs/applications/terminal-emulators/foot/default.nix
@ -27,7 +27,7 @@
 }:

 let
-  version = "1.15.1";
+  version = "1.15.2";

  # build stimuli file for PGO build and the script to generate it
  # independently of the foot's build, so we can cache the result
@ -99,20 +99,9 @@ stdenv.mkDerivation rec {
    owner = "dnkl";
    repo = "foot";
    rev = version;
-    hash = "sha256-YCwmPSn+XtF7HkMOFJft7j/2vr+8UE59yu/iGZ1dT8A=";
+    hash = "sha256:1iz9l01fpryc335pb0c3qi67fmmfplizv5pbc9s578mxl5j9dxg4";
  };

-  patches = [
-    # Check viewporter protocol support before using it, fixes crash under Mir
-    # Remove when https://codeberg.org/dnkl/foot/pulls/1445 in version > 1.15.1
-    (fetchpatch {
-      name = "0001-foot-dont-try-to-use-a-non-existing-viewporter-interface.patch";
-      url = "https://codeberg.org/dnkl/foot/commit/9d75c551465fa3dbb3cd20ae87d6de294fcebce1.patch";
-      excludes = [ "CHANGELOG.md" ];
-      hash = "sha256-sVfGbudsmwh7phbbobBgSXoGe1lKJ8s1UdyBnVLmLYQ=";
-    })
-  ];
-
  depsBuildBuild = [
    pkg-config
  ];
--- a/pkgs/applications/version-management/git-cinnabar/default.nix
+++ b/pkgs/applications/version-management/git-cinnabar/default.nix
@ -1,29 +1,48 @@
-{ stdenv, lib, fetchFromGitHub, cargo, pkg-config, rustPlatform
-, bzip2, curl, zlib, zstd, libiconv, CoreServices
+{ stdenv
+, lib
+, fetchFromGitHub
+, cargo
+, pkg-config
+, rustPlatform
+, bzip2
+, curl
+, zlib
+, zstd
+, libiconv
+, CoreServices
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "git-cinnabar";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromGitHub {
    owner = "glandium";
    repo = "git-cinnabar";
-    rev = version;
-    sha256 = "VvfoMypiFT68YJuGpEyPCxGOjdbDoF6FXtzLWlw0uxY=";
+    rev = finalAttrs.version;
+    hash = "sha256-1Y4zd4rYNRatemDXRMkQQwBJdkfOGfDWk9QBvJOgi7s=";
    fetchSubmodules = true;
  };

  nativeBuildInputs = [
-    pkg-config rustPlatform.cargoSetupHook cargo
+    cargo
+    pkg-config
+    rustPlatform.cargoSetupHook
  ];

-  buildInputs = [ bzip2 curl zlib zstd ]
-    ++ lib.optionals stdenv.isDarwin [ libiconv CoreServices ];
+  buildInputs = [
+    bzip2
+    curl
+    zlib
+    zstd
+  ] ++ lib.optionals stdenv.isDarwin [
+    libiconv
+    CoreServices
+  ];

  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    sha256 = "GApYgE7AezKmcGWNY+dF1Yp1TZmEeUdq3CsjvMvo/Rw=";
+    inherit (finalAttrs) src;
+    hash = "sha256-p85AS2DukUzEbW9UGYmiF3hpnZvPrZ2sRaeA9dU8j/8=";
  };

  ZSTD_SYS_USE_PKG_CONFIG = true;
@ -32,17 +51,19 @@ stdenv.mkDerivation rec {

  installPhase = ''
    runHook preInstall
+
    mkdir -p $out/bin
    install -v target/release/git-cinnabar $out/bin
    ln -sv git-cinnabar $out/bin/git-remote-hg
+
    runHook postInstall
  '';

-  meta = with lib; {
-    homepage = "https://github.com/glandium/git-cinnabar";
+  meta = {
    description = "git remote helper to interact with mercurial repositories";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ qyliss ];
-    platforms = platforms.all;
+    homepage = "https://github.com/glandium/git-cinnabar";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ qyliss ];
+    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,15 +1,15 @@
 {
-  "version": "16.1.2",
-  "repo_hash": "sha256-A9JkBwGym+CPpb5B7+Kwt8Ej4PGSHc3ZOgUA28hdyN8=",
-  "yarn_hash": "1cqyf06810ls94nkys0l4p86ni902q32aqjp66m7j1x6ldh248al",
+  "version": "16.1.3",
+  "repo_hash": "sha256-PI0nmwfk8uu74NJkavbbJR9/jDN9SS0Z9Axe4UmT2kk=",
+  "yarn_hash": "0wykn0vq16n8mz4jfh7dfyp9javzhqlfwmc5i1zm07gld91nirlm",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v16.1.2-ee",
+  "rev": "v16.1.3-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "16.1.2",
-    "GITLAB_PAGES_VERSION": "16.1.2",
+    "GITALY_SERVER_VERSION": "16.1.3",
+    "GITLAB_PAGES_VERSION": "16.1.3",
    "GITLAB_SHELL_VERSION": "14.23.0",
    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "4.3.5",
-    "GITLAB_WORKHORSE_VERSION": "16.1.2"
+    "GITLAB_WORKHORSE_VERSION": "16.1.3"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -13,7 +13,7 @@
 }:

 let
-  version = "16.1.2";
+  version = "16.1.3";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@ -24,7 +24,7 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      sha256 = "sha256-/yCmFbmKTp8V8CjdhoAPpAdwNEcaP/wB0oAeTLdMESo=";
+      sha256 = "sha256-g9K1dFcrUkWJInPrwg9fz/TEK35GrjqFpUS2bnemwLQ=";
    };

    vendorSha256 = "sha256-6oOFQGPwiMRQrESXsQsGzvWz9bCb0VTYIyyG/C2b3nA=";
--- a/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "gitlab-container-registry";
-  version = "3.77.0";
+  version = "3.79.0";
  rev = "v${version}-gitlab";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "container-registry";
    inherit rev;
-    sha256 = "sha256-tHNxPwm1h1wyXuzUUadz5YcRkPdc0QeayMIRt292uf8=";
+    sha256 = "sha256-JOXJ8HSTf7yW78SlYzbdn7IAbSwv/UE/W3oSJRyGrAQ=";
  };

-  vendorHash = "sha256-/ITZBh0vRYHb6fDUZQNRwW2pmQulJlDZ8EbObUBtsz4=";
+  vendorHash = "sha256-4cxfyG1uhqgIheAVDQbIDb4MRSqAUtLgxGYt5MuNfKw=";

  patches = [
    ./Disable-inmemory-storage-driver-test.patch
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "16.1.2";
+  version = "16.1.3";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    sha256 = "sha256-T33/SnV+aWUjfRKxVOQNWaPtFnounMkCXAeQCQ9w5RY=";
+    sha256 = "sha256-FSdew0HMbgEAzVoDhINDIQQs8Q63AHu8mu/dKo+wP9k=";
  };

  vendorHash = "sha256-SN4r9hcTTQUr3miv2Cm7iBryyh7yG1xx9lCvq3vQwc0=";
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "16.1.2";
+  version = "16.1.3";

  src = fetchFromGitLab {
    owner = data.owner;
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "containerd";
-  version = "1.7.2";
+  version = "1.7.3";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = "containerd";
    rev = "v${version}";
-    hash = "sha256-L4zaA+kMBz2tRMbitZUxb9/wdimSO2njx6ozvyKKlkk=";
+    hash = "sha256-BUbZe37rBZTr6nWb4lY2HHuwtq7toDUkGaJOiOoVkWI=";
  };

  vendorHash = null;
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -97,7 +97,7 @@ rec {

      extraUserPath = lib.optionals (stdenv.isLinux && !clientOnly) (lib.makeBinPath [ rootlesskit slirp4netns fuse-overlayfs ]);

-      patches = [
+      patches = lib.optionals (lib.versionOlder version "23") [
        # This patch incorporates code from a PR fixing using buildkit with the ZFS graph driver.
        # It could be removed when a version incorporating this patch is released.
        (fetchpatch {
@ -105,6 +105,7 @@ rec {
          url = "https://github.com/moby/moby/pull/43136.patch";
          hash = "sha256-1WZfpVnnqFwLMYqaHLploOodls0gHF8OCp7MrM26iX8=";
        })
+      ] ++ lib.optionals (lib.versionOlder version "23.0.5") [
        (fetchpatch {
          name = "fix-issue-with-go-1.20.6.patch";
          url = "https://github.com/moby/moby/pull/45972.patch";
@ -181,14 +182,13 @@ rec {
    nativeBuildInputs = [
      makeWrapper pkg-config go-md2man go libtool installShellFiles
    ];
-    buildInputs = lib.optional (!clientOnly) sqlite
-      ++ lib.optional withLvm lvm2
-      ++ lib.optional withBtrfs btrfs-progs
-      ++ lib.optional withSystemd systemd
-      ++ lib.optional withSeccomp libseccomp
-      ++ plugins;

-    patches = [
+    buildInputs = plugins ++ lib.optionals (lib.versionAtLeast version "23") [
+      glibc
+      glibc.static
+    ];
+
+    patches = lib.optionals (lib.versionOlder version "23.0.5") [
      (fetchpatch {
        name = "fix-issue-with-go-1.20.6.patch";
        url = "https://github.com/docker/cli/pull/4441.patch";
@ -222,7 +222,7 @@ rec {
      cd -
    '';

-    outputs = ["out" "man"];
+    outputs = ["out"] ++ lib.optional (lib.versionOlder version "23") "man";

    installPhase = ''
      cd ./go/src/${goPackagePath}
@ -244,13 +244,13 @@ rec {
      installShellCompletion --bash ./contrib/completion/bash/docker
      installShellCompletion --fish ./contrib/completion/fish/docker.fish
      installShellCompletion --zsh  ./contrib/completion/zsh/_docker
-    '' + lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
+    '' + lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform && lib.versionOlder version "23") ''
      # Generate man pages from cobra commands
      echo "Generate man pages from cobra"
      mkdir -p ./man/man1
      go build -o ./gen-manpages github.com/docker/cli/man
      ./gen-manpages --root . --target ./man/man1
-    '' + ''
+    '' + lib.optionalString (lib.versionOlder version "23") ''
      # Generate legacy pages from markdown
      echo "Generate legacy manpages"
      ./man/md2man-all.sh -q
@ -292,4 +292,18 @@ rec {
    tiniRev = "v0.19.0";
    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
  };
+
+  docker_24 = callPackage dockerGen rec {
+    version = "24.0.5";
+    cliRev = "v${version}";
+    cliHash = "sha256-u1quVGTx/p8BDyRn33vYyyuE5BOhWMnGQ5uVX0PZ5mg=";
+    mobyRev = "v${version}";
+    mobyHash = "sha256-JQjRz1fHZlQRkNw/R8WWLV8caN3/U3mrKKQXbZt2crU=";
+    runcRev = "v1.1.8";
+    runcHash = "sha256-rDJYEc64KW4Qa3Eg2oUjJqIKrg6THb5hxQFFbvb9Zp4=";
+    containerdRev = "v1.7.1";
+    containerdHash = "sha256-WwedtcsrDQwMQcKFO5nnPiHyGJpl5hXZlmpbBe1/ftY=";
+    tiniRev = "v0.19.0";
+    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
+  };
 }
--- a/pkgs/data/misc/dbip-country-lite/default.nix
+++ b/pkgs/data/misc/dbip-country-lite/default.nix
@ -1,16 +1,15 @@
 { lib
 , stdenvNoCC
 , fetchurl
-, dbip-country-lite
 }:

-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbip-country-lite";
-  version = "2023-07";
+  version = "2023-08";

  src = fetchurl {
-    url = "https://download.db-ip.com/free/dbip-country-lite-${version}.mmdb.gz";
-    hash = "sha256-WVsyhopYbBlCWDq9UoPe1rcGU3pBYsXkqNWbaQXzRFA=";
+    url = "https://download.db-ip.com/free/dbip-country-lite-${finalAttrs.version}.mmdb.gz";
+    hash = "sha256-+IQSHgfVZ2codxkOKwi23CLjm+rYDZOQq5EWJs0OLiQ=";
  };

  dontUnpack = true;
@ -24,7 +23,7 @@ stdenvNoCC.mkDerivation rec {
    runHook postBuild
  '';

-  passthru.mmdb = "${dbip-country-lite}/share/dbip/dbip-country-lite.mmdb";
+  passthru.mmdb = "${finalAttrs.finalPackage}/share/dbip/dbip-country-lite.mmdb";

  meta = with lib; {
    description = "The free IP to Country Lite database by DB-IP";
@ -33,4 +32,4 @@ stdenvNoCC.mkDerivation rec {
    maintainers = with maintainers; [ nickcao ];
    platforms = platforms.all;
  };
-}
+})
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@ -3,12 +3,12 @@
 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-domain-list-community";
-    version = "20230725085751";
+    version = "20230730120627";
    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "domain-list-community";
      rev = version;
-      hash = "sha256-4D975ASoDoXjEi0kkwsUIIT6nwOE3ggBzNUVp0ojsbQ=";
+      hash = "sha256-lnTP8KDYdIa7iq14h0TEVfAlJDtsURfSZaEdQ8L1TRM=";
    };
    vendorHash = "sha256-dYaGR5ZBORANKAYuPAi9i+KQn2OAGDGTZxdyVjkcVi8=";
    meta = with lib; {
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.27.6/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.27.7/ -A '*.tar.xz' )
--- a/pkgs/desktops/plasma-5/plasma-sdk.nix
+++ b/pkgs/desktops/plasma-5/plasma-sdk.nix
@ -16,11 +16,22 @@
 , ktexteditor
 , kwidgetsaddons
 , kdoctools
+, fetchpatch
 }:

 mkDerivation {
  pname = "plasma-sdk";

+  patches = [
+    # remove duplicate doc entries, fix build
+    # FIXME: remove for next update
+    (fetchpatch {
+      url = "https://invent.kde.org/plasma/plasma-sdk/-/commit/e766c3c0483329f52ba0dd7536c4160131409f8e.patch";
+      revert = true;
+      hash = "sha256-NoQbRo+0gT4F4G6YbvTiQulqrsFtnD7z0/0I4teQvUM=";
+    })
+  ];
+
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
  buildInputs = [
    karchive
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@ -4,475 +4,475 @@

 {
  aura-browser = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/aura-browser-5.27.6.tar.xz";
-      sha256 = "1ppsxzy6hdnnsrrhlx5b7vq1f8v2d1rhfg5j5ypa77ixvi1yglh2";
-      name = "aura-browser-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/aura-browser-5.27.7.tar.xz";
+      sha256 = "0pzb3wgqqq9sddc9ycwxhikc450s78v9287djb6p96mvprix205r";
+      name = "aura-browser-5.27.7.tar.xz";
    };
  };
  bluedevil = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/bluedevil-5.27.6.tar.xz";
-      sha256 = "0x6zfcdw03kggd4mhkhva2b2v2w2ajzs7svslm1p1p8f41vzivvw";
-      name = "bluedevil-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/bluedevil-5.27.7.tar.xz";
+      sha256 = "0ddzcarn06rvhbmvm9x737ba9ycxcvg030892nh6izgfrjlaxhfb";
+      name = "bluedevil-5.27.7.tar.xz";
    };
  };
  breeze = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/breeze-5.27.6.tar.xz";
-      sha256 = "0v3cz9phdalvawfjrg3yirn2n4z6h872p12g7hcf8706bdz8v6jx";
-      name = "breeze-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/breeze-5.27.7.tar.xz";
+      sha256 = "1wfclkg4d3wraz19kwpm87vwp9327s5y8n1a42qgrdh980qwzzdz";
+      name = "breeze-5.27.7.tar.xz";
    };
  };
  breeze-grub = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/breeze-grub-5.27.6.tar.xz";
-      sha256 = "0lg2fba5v22z666wkbm5a6gzlq79jxski1cqnpp1z5laj7nrh8mv";
-      name = "breeze-grub-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/breeze-grub-5.27.7.tar.xz";
+      sha256 = "1c0096x75yhmr3irpbkz302gikqh2m1mz2s5j063db2ky72vlf9m";
+      name = "breeze-grub-5.27.7.tar.xz";
    };
  };
  breeze-gtk = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/breeze-gtk-5.27.6.tar.xz";
-      sha256 = "1nkbhcsb359sqjampyc7cyl0hfnrx6gsrnqgaskdwk92p49snamc";
-      name = "breeze-gtk-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/breeze-gtk-5.27.7.tar.xz";
+      sha256 = "1s2qv51qa867b0bf29b7j90yzqmn3s2dwblczsb79h2i1gnr8ci9";
+      name = "breeze-gtk-5.27.7.tar.xz";
    };
  };
  breeze-plymouth = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/breeze-plymouth-5.27.6.tar.xz";
-      sha256 = "0gjg3ddc3g45dnj0lv5k52bf1v403qpgv2nhqrx9z3x43kidb3vc";
-      name = "breeze-plymouth-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/breeze-plymouth-5.27.7.tar.xz";
+      sha256 = "1vm33di6aaj95pf45g4r3hp79ag1i75mi1b5fpipjgi4aiiqvddz";
+      name = "breeze-plymouth-5.27.7.tar.xz";
    };
  };
  discover = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/discover-5.27.6.tar.xz";
-      sha256 = "1ici6p7bvvfszcy79lrr5xa6q1kfskxyijfr2pq9lkdhn8sdfq8n";
-      name = "discover-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/discover-5.27.7.tar.xz";
+      sha256 = "0025g1whq8z1s5915jhq83xsiz4klzqpayfzqkar8c6gni5s3v59";
+      name = "discover-5.27.7.tar.xz";
    };
  };
  drkonqi = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/drkonqi-5.27.6.tar.xz";
-      sha256 = "04yam1xjwxi6jbh4r2k0ci7vdjc5cwfg4nn36lb64f5gj2bicppr";
-      name = "drkonqi-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/drkonqi-5.27.7.tar.xz";
+      sha256 = "1li1j85yvg2nj392rl1jmdqx3mzmrdj0lf72j37xd8r2bi0ic9z8";
+      name = "drkonqi-5.27.7.tar.xz";
    };
  };
  flatpak-kcm = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/flatpak-kcm-5.27.6.tar.xz";
-      sha256 = "0ykzjaz45qxq7bl05chh3fg5b3qd0vdva5jf61dxnn7bksxr9vpw";
-      name = "flatpak-kcm-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/flatpak-kcm-5.27.7.tar.xz";
+      sha256 = "1crjxvfnx8jiaczwp7i96l75frcp866bv1rng8vizhi42pikbv52";
+      name = "flatpak-kcm-5.27.7.tar.xz";
    };
  };
  kactivitymanagerd = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kactivitymanagerd-5.27.6.tar.xz";
-      sha256 = "0bdhqn809jxgrq6j4jx1vf4q3xicqj3yi6557qpqxy34mlr0n606";
-      name = "kactivitymanagerd-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kactivitymanagerd-5.27.7.tar.xz";
+      sha256 = "1d7vz8gwqa7nhfn62dsqircm0qbp9ryass82k2891mqj0qrlbwid";
+      name = "kactivitymanagerd-5.27.7.tar.xz";
    };
  };
  kde-cli-tools = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kde-cli-tools-5.27.6.tar.xz";
-      sha256 = "1ahgpaa073lg6n7xnrkflqz9cj8sl7f77sla93415hc2pz1v3qmm";
-      name = "kde-cli-tools-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kde-cli-tools-5.27.7.tar.xz";
+      sha256 = "1br1i8ba4n7d2yl618ph4glsaasn3rxy4kjp48f12l9l2pk29nxa";
+      name = "kde-cli-tools-5.27.7.tar.xz";
    };
  };
  kde-gtk-config = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kde-gtk-config-5.27.6.tar.xz";
-      sha256 = "087qj3c46f5wn7vh3nvf0pg40rspja3113phbzapf2sk09b3mwmk";
-      name = "kde-gtk-config-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kde-gtk-config-5.27.7.tar.xz";
+      sha256 = "13qwj3gdfvs0l6k01n8hf25kzrsksi3qi0b1rzpshcj1ix31wamf";
+      name = "kde-gtk-config-5.27.7.tar.xz";
    };
  };
  kdecoration = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kdecoration-5.27.6.tar.xz";
-      sha256 = "1rllab85yzx9s3vfm2j31wxwi1s0js0a6jz7bcy8cv4sk91rpdlx";
-      name = "kdecoration-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kdecoration-5.27.7.tar.xz";
+      sha256 = "153j3w00zwj6gx9ndq46vkfwx3ayig80j0jsqbkajk8zsncs89pg";
+      name = "kdecoration-5.27.7.tar.xz";
    };
  };
  kdeplasma-addons = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kdeplasma-addons-5.27.6.tar.xz";
-      sha256 = "11zhpb4gcz4yy2v0j8mfzihi9rj35f83i8bi7iirix0vm100sfrl";
-      name = "kdeplasma-addons-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kdeplasma-addons-5.27.7.tar.xz";
+      sha256 = "0l7g4lx6y10xfabfcgvh7zb7h08clj0g9yx8ajyg7rzwfa43visi";
+      name = "kdeplasma-addons-5.27.7.tar.xz";
    };
  };
  kgamma5 = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kgamma5-5.27.6.tar.xz";
-      sha256 = "14nn3wsk9w9x8m0mbdmdi86xh6x2946zhzhwdbsfgynjrkn13wb1";
-      name = "kgamma5-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kgamma5-5.27.7.tar.xz";
+      sha256 = "0v5fynydjha9wx9j59ysw8vxx2h2gm55q27gnnhgyv0wxva8hpnl";
+      name = "kgamma5-5.27.7.tar.xz";
    };
  };
  khotkeys = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/khotkeys-5.27.6.tar.xz";
-      sha256 = "0zixhdnsm3956w2bff6fk1ksvk61ywjkylg690b90l041rhfriyv";
-      name = "khotkeys-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/khotkeys-5.27.7.tar.xz";
+      sha256 = "1ipg71jz356jrngw7kqbjs7jplpnr8q3yz694rkhqklsqlfh91bd";
+      name = "khotkeys-5.27.7.tar.xz";
    };
  };
  kinfocenter = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kinfocenter-5.27.6.tar.xz";
-      sha256 = "06whh4wzc292xvzabv7q6x8wm0gkyd2nsy50vlvk7iy85jayk5nd";
-      name = "kinfocenter-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kinfocenter-5.27.7.tar.xz";
+      sha256 = "15hm828ifrrzsbkvknqwf0l3qxr45pdi49z823cw421z45r8ivkj";
+      name = "kinfocenter-5.27.7.tar.xz";
    };
  };
  kmenuedit = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kmenuedit-5.27.6.tar.xz";
-      sha256 = "15j63b2vg5dmgqfin4irv3pz3ws6wvji0b5fdi82fml5hgx4y549";
-      name = "kmenuedit-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kmenuedit-5.27.7.tar.xz";
+      sha256 = "0n60z44wbsjinrcrhs5cfnjs9szpsv2wzva2fiwwgh36j6zz5av7";
+      name = "kmenuedit-5.27.7.tar.xz";
    };
  };
  kpipewire = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kpipewire-5.27.6.tar.xz";
-      sha256 = "12rjwkk272r9r583vgxb64p5nylkcqsfyvbn0lpa6ap8q2zm7mky";
-      name = "kpipewire-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kpipewire-5.27.7.tar.xz";
+      sha256 = "10j7sa8vv530c388z5rzafkdr4sx3agjqczlnkh7412whyw77lha";
+      name = "kpipewire-5.27.7.tar.xz";
    };
  };
  kscreen = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kscreen-5.27.6.tar.xz";
-      sha256 = "0m7jidcs9xf5xzlnhx2s9qnzn6z80fxhssrxz8i2zqk7xhg6bl6y";
-      name = "kscreen-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kscreen-5.27.7.tar.xz";
+      sha256 = "03qa2qrwdjgb6va7akhwpdvzky608sq2lnwj3b1f310mn3hmbmrq";
+      name = "kscreen-5.27.7.tar.xz";
    };
  };
  kscreenlocker = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kscreenlocker-5.27.6.tar.xz";
-      sha256 = "0pgmy4dw41kim7syk4xb2n4g4iz3jjikhwnh3bjianl9h87rc12x";
-      name = "kscreenlocker-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kscreenlocker-5.27.7.tar.xz";
+      sha256 = "11y3ksd29p8hdn8chaf8vscnc7fbh8xkjdsbakrb056p1r8kn0f2";
+      name = "kscreenlocker-5.27.7.tar.xz";
    };
  };
  ksshaskpass = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/ksshaskpass-5.27.6.tar.xz";
-      sha256 = "1ig8qvjvrl27q1bg34c4lg34yx4pdvcjzxn4jxg6h9wbxdwssk45";
-      name = "ksshaskpass-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/ksshaskpass-5.27.7.tar.xz";
+      sha256 = "0vmydvj4c9c93y9wyyjs2hr9m0hygssk1asl4idbj7mcy6n7acg1";
+      name = "ksshaskpass-5.27.7.tar.xz";
    };
  };
  ksystemstats = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/ksystemstats-5.27.6.tar.xz";
-      sha256 = "0xi3z8pk1byc4wcds0an2ndnw8j5zgq3wr0gm517rc8vck30m0gi";
-      name = "ksystemstats-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/ksystemstats-5.27.7.tar.xz";
+      sha256 = "1fx5b566xx32q7gxi8qnnx6vny7ip5r65zi2znnx3azmwsc8jgvw";
+      name = "ksystemstats-5.27.7.tar.xz";
    };
  };
  kwallet-pam = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kwallet-pam-5.27.6.tar.xz";
-      sha256 = "0c38s7iqha94vz2d8dfch4qfb7zpc6k5z7wm33f5x190bw3g1bdp";
-      name = "kwallet-pam-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kwallet-pam-5.27.7.tar.xz";
+      sha256 = "1ac0hqpzqivg40jq7pfr2s1zydl600a3nyzfv97wc20i9myzafrb";
+      name = "kwallet-pam-5.27.7.tar.xz";
    };
  };
  kwayland-integration = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kwayland-integration-5.27.6.tar.xz";
-      sha256 = "10rc14ggbs86bq0sky4i3kdwarwk8mh2yx4g77if8vr7z96xpdqh";
-      name = "kwayland-integration-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kwayland-integration-5.27.7.tar.xz";
+      sha256 = "1fvf64vx5m3h5v8h697ixkcifhva6a14wlz75kv6759ji9l9fy8y";
+      name = "kwayland-integration-5.27.7.tar.xz";
    };
  };
  kwin = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kwin-5.27.6.tar.xz";
-      sha256 = "1v4r4h2zbandg43iyww5p66sgv2z90lrri1gijnwjlg9j5gbvmb2";
-      name = "kwin-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kwin-5.27.7.tar.xz";
+      sha256 = "0bssp76lzqqlan5pfg6wjf4z9c6pl6p66ri8p82vqqw406x5bzyb";
+      name = "kwin-5.27.7.tar.xz";
    };
  };
  kwrited = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/kwrited-5.27.6.tar.xz";
-      sha256 = "153q38msna94wy8qbss02hzw7vabfghxs90bq9g9qjsr28428r86";
-      name = "kwrited-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/kwrited-5.27.7.tar.xz";
+      sha256 = "1a4g05ynblbz0j0lqclxf6628x6wcd3b52l0smic3rdvbis43v0n";
+      name = "kwrited-5.27.7.tar.xz";
    };
  };
  layer-shell-qt = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/layer-shell-qt-5.27.6.tar.xz";
-      sha256 = "14w7kr5d5s9fg2qkybk5axg11cafc6rrxkivynj5v55zcp52jp76";
-      name = "layer-shell-qt-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/layer-shell-qt-5.27.7.tar.xz";
+      sha256 = "08glqqh7jmqrli4n7j04lz3w3c6192w8p7ki51ksmwivnxylxi17";
+      name = "layer-shell-qt-5.27.7.tar.xz";
    };
  };
  libkscreen = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/libkscreen-5.27.6.tar.xz";
-      sha256 = "1ywyg1i9bg0nawndl4hzivd4yfsqk5snls8ak1vyr9xmm8zkgaf1";
-      name = "libkscreen-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/libkscreen-5.27.7.tar.xz";
+      sha256 = "1ary7qavz8vkzbvjx2mxv09h61hxa7i4f7rfgbykldbc83ripdc6";
+      name = "libkscreen-5.27.7.tar.xz";
    };
  };
  libksysguard = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/libksysguard-5.27.6.tar.xz";
-      sha256 = "1nqv0gxq011acvmqc2rpqrw4l928mcmg4rq2g45qzfmnmas2rjwy";
-      name = "libksysguard-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/libksysguard-5.27.7.tar.xz";
+      sha256 = "066bjar4105bfyry6ni7nnikz66bqzy5nvssz6vm4np3aa996ak8";
+      name = "libksysguard-5.27.7.tar.xz";
    };
  };
  milou = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/milou-5.27.6.tar.xz";
-      sha256 = "1il1sg7xi9p7snz9w3mygpydl6y02r5n24wa14yk23qhphwsgbpy";
-      name = "milou-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/milou-5.27.7.tar.xz";
+      sha256 = "0lq8m72nwink8x46m8qd5zdkadym1kc70ipnkb04b16mr7zhnsc1";
+      name = "milou-5.27.7.tar.xz";
    };
  };
  oxygen = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/oxygen-5.27.6.tar.xz";
-      sha256 = "01h9vh8gk4ncgwa1p25ps5rm6m180081vh0ryw9x3z1qw893j1m9";
-      name = "oxygen-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/oxygen-5.27.7.tar.xz";
+      sha256 = "139rar9d36cvp6hl7857qkw9h0xbmk2i7x3mdgjpsabv5wpzq652";
+      name = "oxygen-5.27.7.tar.xz";
    };
  };
  oxygen-sounds = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/oxygen-sounds-5.27.6.tar.xz";
-      sha256 = "0zijzkr6xqx3lqfccr9fkhmzmvqp5c8025nlh8sy94fi846g7smg";
-      name = "oxygen-sounds-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/oxygen-sounds-5.27.7.tar.xz";
+      sha256 = "132jaabfpj8k6xk6f1732a0qgjz1mzyyk74b1mm7q7pyhpypr2gq";
+      name = "oxygen-sounds-5.27.7.tar.xz";
    };
  };
  plank-player = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plank-player-5.27.6.tar.xz";
-      sha256 = "1mjn2qvzav3c2sxfnfv2h9bj7cd00vidl85zmljm17nflv9cvwa8";
-      name = "plank-player-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plank-player-5.27.7.tar.xz";
+      sha256 = "0360affl3wl6aa6lmd7lc6lpzq2v8sqbr5ah2c5vmq0n0p4xxk4n";
+      name = "plank-player-5.27.7.tar.xz";
    };
  };
  plasma-bigscreen = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-bigscreen-5.27.6.tar.xz";
-      sha256 = "097f5whppwla0y7zil7ykyp97glx2wdc05mwd7pk6y2l6d60fhl7";
-      name = "plasma-bigscreen-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-bigscreen-5.27.7.tar.xz";
+      sha256 = "0b2w0d5w1s2jm7al1nqdc1qh9fmrj8fw93wjbb2bsa9fabz2i81b";
+      name = "plasma-bigscreen-5.27.7.tar.xz";
    };
  };
  plasma-browser-integration = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-browser-integration-5.27.6.tar.xz";
-      sha256 = "12hrd6mvhmi649n4jc9pmv116f2cpzd3j90hxlhljixnw4g6vy3j";
-      name = "plasma-browser-integration-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-browser-integration-5.27.7.tar.xz";
+      sha256 = "0c30pdlhl452bjpdc7mwxl01hqabahyc0j1cc54liy0hla9vir9y";
+      name = "plasma-browser-integration-5.27.7.tar.xz";
    };
  };
  plasma-desktop = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-desktop-5.27.6.tar.xz";
-      sha256 = "10x68lqg6zxb8fajd277lm0qfrdg2jz7m58l3wna4nv9bni5wj72";
-      name = "plasma-desktop-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-desktop-5.27.7.tar.xz";
+      sha256 = "1njkjf3fhxfmwyviypxqzrn23klxiih82bazvd8y61cshqwai6i2";
+      name = "plasma-desktop-5.27.7.tar.xz";
    };
  };
  plasma-disks = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-disks-5.27.6.tar.xz";
-      sha256 = "09v4hwx2q8sz0b4qak8xaxnyqj6ccjlgk28fijvmnv61nxb49h1w";
-      name = "plasma-disks-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-disks-5.27.7.tar.xz";
+      sha256 = "0jwjv20ra1mhwl2cm7x2jz8pasmkc58fd57qxhzzf84l4sgbda9v";
+      name = "plasma-disks-5.27.7.tar.xz";
    };
  };
  plasma-firewall = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-firewall-5.27.6.tar.xz";
-      sha256 = "1jbcyz92q63gh1ihkrvs4ffp1xjav9miy6n5adhqik9qxpgkqqn8";
-      name = "plasma-firewall-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-firewall-5.27.7.tar.xz";
+      sha256 = "1n5ljkydhcx6qapwrshslq835zaf02gssp2zvzi3vwfy4asc7ind";
+      name = "plasma-firewall-5.27.7.tar.xz";
    };
  };
  plasma-integration = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-integration-5.27.6.tar.xz";
-      sha256 = "1awd9l874gxxkbcfzb76xga1f6firaqpshrapg0492vq33r5vzd5";
-      name = "plasma-integration-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-integration-5.27.7.tar.xz";
+      sha256 = "1ahzckvc69wk2rx73sl40h0in1y7ny0vm0i7lbrrcggv1v36dwp3";
+      name = "plasma-integration-5.27.7.tar.xz";
    };
  };
  plasma-mobile = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-mobile-5.27.6.tar.xz";
-      sha256 = "16djcga7ljq7zv979im8zd1l1fz7qfw9g2ya6kvdn9mf8li0l98j";
-      name = "plasma-mobile-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-mobile-5.27.7.tar.xz";
+      sha256 = "0f32xj9v32f89pdhwsmwm2xqfwcypq8r85jhj4zq887zxy1cgn0n";
+      name = "plasma-mobile-5.27.7.tar.xz";
    };
  };
  plasma-nano = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-nano-5.27.6.tar.xz";
-      sha256 = "02qig2zh6py0i5phcyjln0yawbd6sdx4cm13l2kgi3bl1826kklb";
-      name = "plasma-nano-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-nano-5.27.7.tar.xz";
+      sha256 = "14wc76bxnwd0z51gz4zb88p5h9n2711ifr1wpx9lrj9r7y1llank";
+      name = "plasma-nano-5.27.7.tar.xz";
    };
  };
  plasma-nm = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-nm-5.27.6.tar.xz";
-      sha256 = "1jfrd3xi4hyivkwrif6s87f9jasrnsihd7c80sqhwd1k2kl9wr0a";
-      name = "plasma-nm-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-nm-5.27.7.tar.xz";
+      sha256 = "1w9zclih2mh8gqwahsmbbm0nrg1b6gcr5w2w02szlw30iq8k92j8";
+      name = "plasma-nm-5.27.7.tar.xz";
    };
  };
  plasma-pa = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-pa-5.27.6.tar.xz";
-      sha256 = "0kvfhpsiv0nkilirjwsplx67m5zdqc5w6zmp9gkgyym46ax0hxjf";
-      name = "plasma-pa-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-pa-5.27.7.tar.xz";
+      sha256 = "1vg28v5n648y94m6amcwmr0n7dw4a2kfx16kny7jb9bkmxrgnwsc";
+      name = "plasma-pa-5.27.7.tar.xz";
    };
  };
  plasma-remotecontrollers = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-remotecontrollers-5.27.6.tar.xz";
-      sha256 = "0ibngr1qy0vpdi6sx071225g354cdsag7j0gv3b6vrhq7s0z66b0";
-      name = "plasma-remotecontrollers-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-remotecontrollers-5.27.7.tar.xz";
+      sha256 = "0iswjkg93hf5vnvy5a4gpkc7p5d2d0b4nm74v2k9j23svipnzbah";
+      name = "plasma-remotecontrollers-5.27.7.tar.xz";
    };
  };
  plasma-sdk = {
-    version = "5.27.6.1";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-sdk-5.27.6.1.tar.xz";
-      sha256 = "1byfknk60j4hajy1ibh25dv96irkpl4b5hyrrdg39m6fdx30wjrf";
-      name = "plasma-sdk-5.27.6.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-sdk-5.27.7.tar.xz";
+      sha256 = "1jbd2y1hryif8a2s3x74xjgm9nrx5ln0bszn94igi4g9p8vsdq86";
+      name = "plasma-sdk-5.27.7.tar.xz";
    };
  };
  plasma-systemmonitor = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-systemmonitor-5.27.6.tar.xz";
-      sha256 = "07cwzcy7qd3b6rlyqjwhc2z567dn5j8gx701b57cs18z0rgv4vkr";
-      name = "plasma-systemmonitor-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-systemmonitor-5.27.7.tar.xz";
+      sha256 = "1qr8krc7d1hzxv0gx0ii0rxk9bm62rgh157mr8x785qqbd11nq8l";
+      name = "plasma-systemmonitor-5.27.7.tar.xz";
    };
  };
  plasma-thunderbolt = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-thunderbolt-5.27.6.tar.xz";
-      sha256 = "1ikcbn9awh5zh9ivdm3ysi1dw208byj8d4ls5c9ckclvylkfx7v6";
-      name = "plasma-thunderbolt-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-thunderbolt-5.27.7.tar.xz";
+      sha256 = "0sgh5pafp9i0bhk7fhxc4fy20ldwidc1f5n4fcsya4aviy4cf2nn";
+      name = "plasma-thunderbolt-5.27.7.tar.xz";
    };
  };
  plasma-vault = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-vault-5.27.6.tar.xz";
-      sha256 = "0wxa80m2ppjp8l8nchwcvrmx20j0rgm9ydn93x4w4d4rmi6mypr4";
-      name = "plasma-vault-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-vault-5.27.7.tar.xz";
+      sha256 = "1p5m5rlamb50cbd1qlx81m003sv8vdijkpy5airmy1pf6xmvl6hq";
+      name = "plasma-vault-5.27.7.tar.xz";
    };
  };
  plasma-welcome = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-welcome-5.27.6.tar.xz";
-      sha256 = "0lvvxllhshawj7pjx3d9l53clcnr73x519khgf27fpblil1x0hm8";
-      name = "plasma-welcome-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-welcome-5.27.7.tar.xz";
+      sha256 = "0nz1hxz5nvgl3sbm6k3a76s0l3fy3j38i4plly2zhp5xqdk0ks1x";
+      name = "plasma-welcome-5.27.7.tar.xz";
    };
  };
  plasma-workspace = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-workspace-5.27.6.tar.xz";
-      sha256 = "10w8ix9c29gvykr9970aax7jcz2fi99cafr1kknvj2drgc7zgrhw";
-      name = "plasma-workspace-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-workspace-5.27.7.tar.xz";
+      sha256 = "0pyf5vc466mfgicxpp76igdz58lpa0n7x2cl2hhaq4zmrlfr8hh6";
+      name = "plasma-workspace-5.27.7.tar.xz";
    };
  };
  plasma-workspace-wallpapers = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plasma-workspace-wallpapers-5.27.6.tar.xz";
-      sha256 = "018vvxhs0rlc25hd5kafhzk6anl1yabggby7b5vsqvip2rsma0qk";
-      name = "plasma-workspace-wallpapers-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plasma-workspace-wallpapers-5.27.7.tar.xz";
+      sha256 = "181q0mmmp3dygzafgh4qq2pwi5w15vw6mwc21nkl98qf6z773ify";
+      name = "plasma-workspace-wallpapers-5.27.7.tar.xz";
    };
  };
  plymouth-kcm = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/plymouth-kcm-5.27.6.tar.xz";
-      sha256 = "03qkrdin7s4kx14f518f6amvgd5adavgirjy8mk1zj62mz4f1sy5";
-      name = "plymouth-kcm-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/plymouth-kcm-5.27.7.tar.xz";
+      sha256 = "1y7ahb0wir10isls65yp5p164kiw3jn8bf8zn9bkkjqp649av9sw";
+      name = "plymouth-kcm-5.27.7.tar.xz";
    };
  };
  polkit-kde-agent = {
-    version = "1-5.27.6";
+    version = "1-5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/polkit-kde-agent-1-5.27.6.tar.xz";
-      sha256 = "0k7d9jz49fp4h7gxakqsmj16h5xdv8jw69068sz5mazzczi7lwyz";
-      name = "polkit-kde-agent-1-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/polkit-kde-agent-1-5.27.7.tar.xz";
+      sha256 = "0p6gnv59mnb5y6riiifyg98sk8zycchv8bkf7x1332qa7zqhcjcc";
+      name = "polkit-kde-agent-1-5.27.7.tar.xz";
    };
  };
  powerdevil = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/powerdevil-5.27.6.tar.xz";
-      sha256 = "1dbz479ikjy6fi3l701hvhkwhbll1gkibay3vzimb13kyamhy8vb";
-      name = "powerdevil-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/powerdevil-5.27.7.tar.xz";
+      sha256 = "151qhpf5j33jk3jhhxsr4zaf0z3f8xlnw8inmzf2a8lficiq9060";
+      name = "powerdevil-5.27.7.tar.xz";
    };
  };
  qqc2-breeze-style = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/qqc2-breeze-style-5.27.6.tar.xz";
-      sha256 = "02hxczlhyy2vwrsrw7hncmhcidany4xirlrw9caxsq4rylp7vszj";
-      name = "qqc2-breeze-style-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/qqc2-breeze-style-5.27.7.tar.xz";
+      sha256 = "0cjrjnj8iwjb9jxp28a30zxb56nhgslrbxzqy392b5sz2x5gbd04";
+      name = "qqc2-breeze-style-5.27.7.tar.xz";
    };
  };
  sddm-kcm = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/sddm-kcm-5.27.6.tar.xz";
-      sha256 = "1qmmsvfs22byx5i48icgqh0cdh228yk40946yymacm39iwbsnw6w";
-      name = "sddm-kcm-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/sddm-kcm-5.27.7.tar.xz";
+      sha256 = "0hrw22ihrzph573lkwys6g5bnj72rwff1w1wjq0jzkcr3i8zai86";
+      name = "sddm-kcm-5.27.7.tar.xz";
    };
  };
  systemsettings = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/systemsettings-5.27.6.tar.xz";
-      sha256 = "17bqdsaih11wpcmv7qzk701l67431pf2nm8nnrix1s8k3qglfb5w";
-      name = "systemsettings-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/systemsettings-5.27.7.tar.xz";
+      sha256 = "0vkcmb4sch97sq5xd8rj8z42qdcxy5ys758q6dl69kbv9hadl7bw";
+      name = "systemsettings-5.27.7.tar.xz";
    };
  };
  xdg-desktop-portal-kde = {
-    version = "5.27.6";
+    version = "5.27.7";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.27.6/xdg-desktop-portal-kde-5.27.6.tar.xz";
-      sha256 = "0wzp21l521d9z9mnfgiapzljqpg5qc5ghyzndpr8cz54c2bf9mdf";
-      name = "xdg-desktop-portal-kde-5.27.6.tar.xz";
+      url = "${mirror}/stable/plasma/5.27.7/xdg-desktop-portal-kde-5.27.7.tar.xz";
+      sha256 = "1k88zr073qj96wfbj500mwn8fxj39pxscc6wqhsfjpa6ssxgknyc";
+      name = "xdg-desktop-portal-kde-5.27.7.tar.xz";
    };
  };
 }
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
@ -3,8 +3,8 @@
 mkXfceDerivation {
  category = "panel-plugins";
  pname = "xfce4-clipman-plugin";
-  version = "1.6.3";
-  sha256 = "sha256-tnpQRYLV48NxKsWDjVSmypx6X1bVbx2U5Q8kQaP0AW8=";
+  version = "1.6.4";
+  sha256 = "sha256-N/e97C6xWyF1GUg7gMN0Wcw35awypflMmA+Pdg6alEw=";

  buildInputs = [ libXtst libxfce4ui xfce4-panel xfconf ];

--- a/pkgs/development/compilers/assemblyscript/default.nix
+++ b/pkgs/development/compilers/assemblyscript/default.nix
@ -5,13 +5,13 @@

 buildNpmPackage rec {
  pname = "assemblyscript";
-  version = "0.27.5";
+  version = "0.27.6";

  src = fetchFromGitHub {
    owner = "AssemblyScript";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-3dWIYkiAA61xbUXJGmb/amjHmyXYoy16lLIAZR4sD5k=";
+    sha256 = "sha256-jN8P3EL3giDIZSExkjm5ZUwgkN3EIQhVpMqfx273yZU=";
  };

  npmDepsHash = "sha256-9ILa1qY2GpP2RckcZYcCMmgCwdXIImOm+D8nldeoQL8=";
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@ -13,12 +13,12 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "circt";
-  version = "1.45.0";
+  version = "1.48.0";
  src = fetchFromGitHub {
    owner = "llvm";
    repo = "circt";
    rev = "firtool-${version}";
-    sha256 = "sha256-yzXYiqRIwV3bkMfvmduow3QWJASXhOspM8CHZPN2/uE=";
+    sha256 = "sha256-8mqh3PPfB50ZkiJ+1OjclWw19t6OLv1mNiVkBnDz5jQ=";
    fetchSubmodules = true;
  };

@ -54,6 +54,9 @@ stdenv.mkDerivation rec {

  preConfigure = ''
    find ./test -name '*.mlir' -exec sed -i 's|/usr/bin/env|${coreutils}/bin/env|g' {} \;
+    # circt uses git to check its version, but when cloned on nix it can't access git.
+    # So this hard codes the version.
+    substituteInPlace cmake/modules/GenVersionFile.cmake --replace "unknown git version" "${src.rev}"
  '';

  installPhase = ''
--- a/pkgs/development/compilers/zig/hook.nix
+++ b/pkgs/development/compilers/zig/hook.nix
@ -0,0 +1,17 @@
+{ lib
+, makeSetupHook
+, zig
+}:
+
+makeSetupHook {
+  name = "zig-hook";
+
+  propagatedBuildInputs = [ zig ];
+
+  passthru = { inherit zig; };
+
+  meta = {
+    description = "A setup hook for using the Zig compiler in Nixpkgs";
+    inherit (zig.meta) maintainers platforms broken;
+  };
+} ./setup-hook.sh
--- a/pkgs/development/compilers/zig/setup-hook.sh
+++ b/pkgs/development/compilers/zig/setup-hook.sh
@ -0,0 +1,90 @@
+# shellcheck shell=bash disable=SC2154,SC2086
+
+# This readonly zigDefaultBuildFlagsArray below is meant to avoid CPU feature
+# impurity in Nixpkgs. However, this flagset is "unstable": it is specifically
+# meant to be controlled by the upstream development team - being up to that
+# team exposing or not that flags to the outside (especially the package manager
+# teams).
+
+# Because of this hurdle, @andrewrk from Zig Software Foundation proposed some
+# solutions for this issue. Hopefully they will be implemented in future
+# releases of Zig. When this happens, this flagset should be revisited
+# accordingly.
+
+# Below are some useful links describing the discovery process of this 'bug' in
+# Nixpkgs:
+
+# https://github.com/NixOS/nixpkgs/issues/169461
+# https://github.com/NixOS/nixpkgs/issues/185644
+# https://github.com/NixOS/nixpkgs/pull/197046
+# https://github.com/NixOS/nixpkgs/pull/241741#issuecomment-1624227485
+# https://github.com/ziglang/zig/issues/14281#issuecomment-1624220653
+
+readonly zigDefaultFlagsArray=("-Drelease-safe=true" "-Dcpu=baseline")
+
+function zigSetGlobalCacheDir {
+    ZIG_GLOBAL_CACHE_DIR=$(mktemp -d)
+    export ZIG_GLOBAL_CACHE_DIR
+}
+
+function zigBuildPhase {
+    runHook preBuild
+
+    local flagsArray=(
+        "${zigDefaultFlagsArray[@]}"
+        $zigBuildFlags "${zigBuildFlagsArray[@]}"
+    )
+
+    echoCmd 'build flags' "${flagsArray[@]}"
+    zig build "${flagsArray[@]}"
+
+    runHook postBuild
+}
+
+function zigCheckPhase {
+    runHook preCheck
+
+    local flagsArray=(
+        "${zigDefaultFlagsArray[@]}"
+        $zigCheckFlags "${zigCheckFlagsArray[@]}"
+    )
+
+    echoCmd 'check flags' "${flagsArray[@]}"
+    zig build test "${flagsArray[@]}"
+
+    runHook postCheck
+}
+
+function zigInstallPhase {
+    runHook preInstall
+
+    local flagsArray=(
+        "${zigDefaultFlagsArray[@]}"
+        $zigBuildFlags "${zigBuildFlagsArray[@]}"
+        $zigInstallFlags "${zigInstallFlagsArray[@]}"
+    )
+
+    if [ -z "${dontAddPrefix-}" ]; then
+        # Zig does not recognize `--prefix=/dir/`, only `--prefix /dir/`
+        flagsArray+=("${prefixKey:---prefix}" "$prefix")
+    fi
+
+    echoCmd 'install flags' "${flagsArray[@]}"
+    zig build install "${flagsArray[@]}"
+
+    runHook postInstall
+}
+
+addEnvHooks "$targetOffset" zigSetGlobalCacheDir
+
+if [ -z "${dontUseZigBuild-}" ] && [ -z "${buildPhase-}" ]; then
+    buildPhase=zigBuildPhase
+fi
+
+if [ -z "${dontUseZigCheck-}" ] && [ -z "${checkPhase-}" ]; then
+    checkPhase=zigCheckPhase
+fi
+
+if [ -z "${dontUseZigInstall-}" ] && [ -z "${installPhase-}" ]; then
+    installPhase=zigInstallPhase
+fi
--- a/pkgs/development/libraries/aravis/default.nix
+++ b/pkgs/development/libraries/aravis/default.nix
@ -29,13 +29,13 @@ assert enableViewer -> wrapGAppsHook != null;

 stdenv.mkDerivation rec {
  pname = "aravis";
-  version = "0.8.27";
+  version = "0.8.28";

  src = fetchFromGitHub {
    owner = "AravisProject";
    repo = pname;
    rev = version;
-    sha256 = "sha256-QxI/+2mtX9d4UTkbFFVh5N4JqTMqygGUgz08XWxAQac=";
+    sha256 = "sha256-EgKZcylg3Nx320BdeEz8PVadwo2pE6a3h0vt7YT4LVA=";
  };

  outputs = [ "bin" "dev" "out" "lib" ];
--- a/pkgs/development/libraries/botan/generic.nix
+++ b/pkgs/development/libraries/botan/generic.nix
@ -29,12 +29,13 @@ stdenv.mkDerivation rec {
  patches = extraPatches;
  inherit postPatch;

-  buildInputs = [ python3 bzip2 zlib gmp boost ]
+  nativeBuildInputs = [ python3 ];
+  buildInputs = [ bzip2 zlib gmp boost ]
    ++ lib.optionals stdenv.isDarwin [ CoreServices Security ];

  configurePhase = ''
    runHook preConfigure
-    python configure.py --prefix=$out --with-bzip2 --with-zlib ${extraConfigureFlags}${lib.optionalString stdenv.cc.isClang " --cc=clang"}
+    python configure.py --prefix=$out --with-bzip2 --with-zlib ${extraConfigureFlags}${lib.optionalString stdenv.cc.isClang " --cc=clang"} ${lib.optionalString stdenv.hostPlatform.isAarch64 " --cpu=aarch64"}
    runHook postConfigure
  '';

--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@ -34,7 +34,7 @@
 , withCaca ? withFullDeps # Textual display (ASCII art)
 , withCelt ? withFullDeps # CELT decoder
 , withCrystalhd ? withFullDeps
-, withCuda ? withFullDeps && (with stdenv; (!isDarwin && !hostPlatform.isAarch))
+, withCuda ? withFullDeps && (with stdenv; (!isDarwin && !hostPlatform.isAarch && !hostPlatform.isRiscV))
 , withCudaLLVM ? withFullDeps
 , withDav1d ? withHeadlessDeps # AV1 decoder (focused on speed and correctness)
 , withDc1394 ? withFullDeps && !stdenv.isDarwin # IIDC-1394 grabbing (ieee 1394)
@ -58,8 +58,8 @@
 , withModplug ? withFullDeps && !stdenv.isDarwin # ModPlug support
 , withMp3lame ? withHeadlessDeps # LAME MP3 encoder
 , withMysofa ? withFullDeps # HRTF support via SOFAlizer
-, withNvdec ? withHeadlessDeps && !stdenv.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.isAarch32
-, withNvenc ? withHeadlessDeps && !stdenv.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.isAarch32
+, withNvdec ? withHeadlessDeps && (with stdenv; !isDarwin && hostPlatform == buildPlatform && !isAarch32 && !hostPlatform.isRiscV)
+, withNvenc ? withHeadlessDeps && (with stdenv; !isDarwin && hostPlatform == buildPlatform && !isAarch32 && !hostPlatform.isRiscV)
 , withOgg ? withHeadlessDeps # Ogg container used by vorbis & theora
 , withOpenal ? withFullDeps # OpenAL 1.1 capture support
 , withOpencl ? withFullDeps
--- a/pkgs/development/libraries/libgpiod/0001-Drop-AC_FUNC_MALLOC-and-_REALLOC-and-check-for-them-.patch
+++ b/pkgs/development/libraries/libgpiod/0001-Drop-AC_FUNC_MALLOC-and-_REALLOC-and-check-for-them-.patch
@ -1,31 +0,0 @@
-From 2cc80dc06ea42087788cf27b31821ffa99a22f89 Mon Sep 17 00:00:00 2001
-From: Johannes Lode <johannes.lode@dynainstruments.com>
-Date: Thu, 14 Nov 2019 10:44:00 +0100
-Subject: [PATCH] Drop AC_FUNC_MALLOC and _REALLOC and check for them as
- regular functions.
-
-While cross-compiling there occurred "undefined reference to
-`rpl_malloc'", the suggested change fixes the problem.
-
-Tested for native X86_64 and armv7a-unknown-linux-gnueabihf.
---
- configure.ac | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index 008499d..b492dc4 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -81,7 +81,8 @@ AC_DEFUN([HEADER_NOT_FOUND_CXX],
- 
- # This is always checked (library needs this)
- AC_HEADER_STDC
-AC_FUNC_MALLOC
-+# AC_FUNC_MALLOC -- does not work while cross-compiling
-+AC_CHECK_FUNC([malloc realloc])
- AC_CHECK_FUNC([ioctl], [], [FUNC_NOT_FOUND_LIB([ioctl])])
- AC_CHECK_FUNC([asprintf], [], [FUNC_NOT_FOUND_LIB([asprintf])])
- AC_CHECK_FUNC([scandir], [], [FUNC_NOT_FOUND_LIB([scandir])])
-- 
-2.25.1
-
--- a/pkgs/development/libraries/libgpiod/default.nix
+++ b/pkgs/development/libraries/libgpiod/default.nix
@ -8,15 +8,9 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/snapshot/libgpiod-${version}.tar.gz";
-    sha256 = "sha256-M68o6YheNXZrDYu6u7pEvyPt2tXhTkVZD3Kv/AXYXA8=";
+    hash = "sha256-tu2lU1YWCo5zkG49SOlZ74EpZ4fXZJdbEPJX6WYGaOk=";
  };

-  patches = [
-    # cross compiling fix
-    # https://github.com/brgl/libgpiod/pull/45
-    ./0001-Drop-AC_FUNC_MALLOC-and-_REALLOC-and-check-for-them-.patch
-  ];
-
  buildInputs = [ kmod ] ++ lib.optionals enablePython [ python3 ncurses ];
  nativeBuildInputs = [
    autoconf-archive
--- a/Show More
+++ b/Show More