Merge master into haskell-updates

2024-01-16 00:13:07 +00:00 · 2024-01-16 00:13:07 +00:00 · e0c9a6db2a
commit e0c9a6db2a
parent 6d2b165a04 61575afc7f
232 changed files with 7010 additions and 1702 deletions
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -323,7 +323,7 @@ All the review template samples provided in this section are generic and meant a

 To get more information about how to review specific parts of Nixpkgs, refer to the documents linked to in the [overview section][overview].

-If a pull request contains documentation changes that might require feedback from the documentation team, ping @NixOS/documentation-team on the pull request.
+If a pull request contains documentation changes that might require feedback from the documentation team, ping [@NixOS/documentation-reviewers](https://github.com/orgs/nixos/teams/documentation-reviewers) on the pull request.

 If you consider having enough knowledge and experience in a topic and would like to be a long-term reviewer for related submissions, please contact the current reviewers for that topic. They will give you information about the reviewing process. The main reviewers for a topic can be hard to find as there is no list, but checking past pull requests to see who reviewed or git-blaming the code to see who committed to that topic can give some hints.

--- a/doc/README.md
+++ b/doc/README.md
@ -159,24 +159,28 @@ In an effort to keep the Nixpkgs manual in a consistent style, please follow the
 In that case, please open an issue about the particular documentation convention and tag it with a "needs: documentation" label.

 - Put each sentence in its own line.
-  This makes reviewing documentation much easier, since GitHub's review system is based on lines.
+  This makes reviews and suggestions much easier, since GitHub's review system is based on lines.
+  It also helps identifying long sentences at a glance.

- Use the admonitions syntax for any callouts and examples (see [section above](#admonitions)).
+- Use the [admonition syntax](#admonitions) for callouts and examples.

- If you provide an example involving Nix code, make your example into a fully-working package (something that can be passed to `pkgs.callPackage`).
-  This will help others quickly test that the example works, and will also make it easier if we start automatically testing all example code to make sure it works.
-  For example, instead of providing something like:
+- Provide at least one example per function, and make examples self-contained.
+  This is easier to understand for beginners.
+  It also helps with testing that it actually works – especially once we introduce automation.

-  ```
+  Example code should be such that it can be passed to `pkgs.callPackage`.
+  Instead of something like:
+
+  ```nix
  pkgs.dockerTools.buildLayeredImage {
    name = "hello";
    contents = [ pkgs.hello ];
  }
  ```

-  Provide something like:
+  Write something like:

-  ```
+  ```nix
  { dockerTools, hello }:
  dockerTools.buildLayeredImage {
    name = "hello";
@ -200,6 +204,10 @@ In that case, please open an issue about the particular documentation convention

  : Tag of the generated image.

-      _Default value:_ the output path's hash.
+    _Default value:_ the output path's hash.

  ```
+
+## Getting help
+
+If you need documentation-specific help or reviews, ping [@NixOS/documentation-reviewers](https://github.com/orgs/nixos/teams/documentation-reviewers) on your pull request.
--- a/doc/build-helpers/trivial-build-helpers.chapter.md
+++ b/doc/build-helpers/trivial-build-helpers.chapter.md
@ -1,6 +1,7 @@
 # Trivial build helpers {#chap-trivial-builders}

-Nixpkgs provides a couple of functions that help with building derivations. The most important one, `stdenv.mkDerivation`, has already been documented above. The following functions wrap `stdenv.mkDerivation`, making it easier to use in certain cases.
+Nixpkgs provides a variety of wrapper functions that help build commonly useful derivations.
+Like [`stdenv.mkDerivation`](#sec-using-stdenv), each of these build helpers creates a derivation, but the arguments passed are different (usually simpler) from those required by `stdenv.mkDerivation`.

 ## `runCommand` {#trivial-builder-runCommand}

@ -58,63 +59,416 @@ Variant of `runCommand` that forces the derivation to be built locally, it is no
 This sets [`allowSubstitutes` to `false`](https://nixos.org/nix/manual/#adv-attr-allowSubstitutes), so only use `runCommandLocal` if you are certain the user will always have a builder for the `system` of the derivation. This should be true for most trivial use cases (e.g., just copying some files to a different location or adding symlinks) because there the `system` is usually the same as `builtins.currentSystem`.
 :::

-## `writeTextFile`, `writeText`, `writeTextDir`, `writeScript`, `writeScriptBin` {#trivial-builder-writeText}
+## Writing text files {#trivial-builder-text-writing}

-These functions write `text` to the Nix store. This is useful for creating scripts from Nix expressions. `writeTextFile` takes an attribute set and expects two arguments, `name` and `text`. `name` corresponds to the name used in the Nix store path. `text` will be the contents of the file. You can also set `executable` to true to make this file have the executable bit set.
+Nixpkgs provides the following functions for producing derivations which write text files or executable scripts into the Nix store.
+They are useful for creating files from Nix expression, and are all implemented as convenience wrappers around `writeTextFile`.

-Many more commands wrap `writeTextFile` including `writeText`, `writeTextDir`, `writeScript`, and `writeScriptBin`. These are convenience functions over `writeTextFile`.
+Each of these functions will cause a derivation to be produced.
+When you coerce the result of each of these functions to a string with [string interpolation](https://nixos.org/manual/nix/stable/language/string-interpolation) or [`builtins.toString`](https://nixos.org/manual/nix/stable/language/builtins#builtins-toString), it will evaluate to the [store path](https://nixos.org/manual/nix/stable/store/store-path) of this derivation.
+
+:::: {.note}
+Some of these functions will put the resulting files within a directory inside the [derivation output](https://nixos.org/manual/nix/stable/language/derivations#attr-outputs).
+If you need to refer to the resulting files somewhere else in a Nix expression, append their path to the derivation's store path.
+
+For example, if the file destination is a directory:
+
+```nix
+my-file = writeTextFile {
+  name = "my-file";
+  text = ''
+    Contents of File
+  '';
+  destination = "/share/my-file";
+}
+```
+
+Remember to append "/share/my-file" to the resulting store path when using it elsewhere:
+
+```nix
+writeShellScript "evaluate-my-file.sh" ''
+  cat ${my-file}/share/my-file
+'';
+```
+::::
+
+### `writeTextFile` {#trivial-builder-writeTextFile}
+
+Write a text file to the Nix store.
+
+`writeTextFile` takes an attribute set with the following possible attributes:
+
+`name` (String)
+
+: Corresponds to the name used in the Nix store path identifier.
+
+`text` (String)
+
+: The contents of the file.
+
+`executable` (Bool, _optional_)
+
+: Make this file have the executable bit set.
+
+  Default: `false`
+
+`destination` (String, _optional_)
+
+: A subpath under the derivation's output path into which to put the file.
+  Subdirectories are created automatically when the derivation is realised.
+
+  By default, the store path itself will be a file containing the text contents.
+
+  Default: `""`
+
+`checkPhase` (String, _optional_)
+
+: Commands to run after generating the file.
+
+  Default: `""`
+
+`meta` (Attribute set, _optional_)
+
+: Additional metadata for the derivation.
+
+  Default: `{}`
+
+`allowSubstitutes` (Bool, _optional_)
+
+: Whether to allow substituting from a binary cache.
+  Passed through to [`allowSubsitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `builtins.derivation`.
+
+  It defaults to `false`, as running the derivation's simple `builder` executable locally is assumed to be faster than network operations.
+  Set it to true if the `checkPhase` step is expensive.
+
+  Default: `false`
+
+`preferLocalBuild` (Bool, _optional_)
+
+: Whether to prefer building locally, even if faster [remote build machines](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-substituters) are available.
+
+  Passed through to [`preferLocalBuild`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-preferLocalBuild) of the underlying call to `builtins.derivation`.
+
+  It defaults to `true` for the same reason `allowSubstitutes` defaults to `false`.
+
+  Default: `true`
+
+The resulting store path will include some variation of the name, and it will be a file unless `destination` is used, in which case it will be a directory.
+
+::: {.example #ex-writeTextFile}
+# Usage 1 of `writeTextFile`
+
+Write `my-file` to `/nix/store/<store path>/some/subpath/my-cool-script`, making it executable.
+Also run a check on the resulting file in a `checkPhase`, and supply values for the less-used options.
+
+```nix
+writeTextFile {
+  name = "my-cool-script";
+  text = ''
+    #!/bin/sh
+    echo "This is my cool script!"
+  '';
+  executable = true;
+  destination = "/some/subpath/my-cool-script";
+  checkPhase = ''
+    ${pkgs.shellcheck}/bin/shellcheck $out/some/subpath/my-cool-script
+  '';
+  meta = {
+    license = pkgs.lib.licenses.cc0;
+  };
+  allowSubstitutes = true;
+  preferLocalBuild = false;
+};
+```
+:::
+
+::: {.example #ex2-writeTextFile}
+# Usage 2 of `writeTextFile`
+
+Write the string `Contents of File` to `/nix/store/<store path>`.
+See also the [](#trivial-builder-writeText) helper function.

-Here are a few examples:
 ```nix
-# Writes my-file to /nix/store/<store path>
 writeTextFile {
  name = "my-file";
  text = ''
    Contents of File
  '';
 }
-# See also the `writeText` helper function below.
+```
+:::

-# Writes executable my-file to /nix/store/<store path>/bin/my-file
+::: {.example #ex3-writeTextFile}
+# Usage 3 of `writeTextFile`
+
+Write an executable script `my-script` to `/nix/store/<store path>/bin/my-script`.
+See also the [](#trivial-builder-writeScriptBin) helper function.
+
+```nix
+writeTextFile {
+  name = "my-script";
+  text = ''
+    echo "hi"
+  '';
+  executable = true;
+  destination = "/bin/my-script";
+}
+```
+:::
+
+### `writeText` {#trivial-builder-writeText}
+
+Write a text file to the Nix store
+
+`writeText` takes the following arguments:
+a string.
+
+`name` (String)
+
+: The name used in the Nix store path.
+
+`text` (String)
+
+: The contents of the file.
+
+The store path will include the name, and it will be a file.
+
+::: {.example #ex-writeText}
+# Usage of `writeText`
+
+Write the string `Contents of File` to `/nix/store/<store path>`:
+
+```nix
+writeText "my-file"
+  ''
+  Contents of File
+  '';
+```
+:::
+
+This is equivalent to:
+
+```nix
+writeTextFile {
+  name = "my-file";
+  text = ''
+    Contents of File
+  '';
+}
+```
+
+### `writeTextDir` {#trivial-builder-writeTextDir}
+
+Write a text file within a subdirectory of the Nix store.
+
+`writeTextDir` takes the following arguments:
+
+`path` (String)
+
+: The destination within the Nix store path under which to create the file.
+
+`text` (String)
+
+: The contents of the file.
+
+The store path will be a directory.
+
+::: {.example #ex-writeTextDir}
+# Usage of `writeTextDir`
+
+Write the string `Contents of File` to `/nix/store/<store path>/share/my-file`:
+
+```nix
+writeTextDir "share/my-file"
+  ''
+  Contents of File
+  '';
+```
+:::
+
+This is equivalent to:
+
+```nix
+writeTextFile {
+  name = "my-file";
+  text = ''
+    Contents of File
+  '';
+  destination = "share/my-file";
+}
+```
+
+### `writeScript` {#trivial-builder-writeScript}
+
+Write an executable script file to the Nix store.
+
+`writeScript` takes the following arguments:
+
+`name` (String)
+
+: The name used in the Nix store path.
+
+`text` (String)
+
+: The contents of the file.
+
+The created file is marked as executable.
+The store path will include the name, and it will be a file.
+
+::: {.example #ex-writeScript}
+# Usage of `writeScript`
+
+Write the string `Contents of File` to `/nix/store/<store path>` and make the file executable.
+
+```nix
+writeScript "my-file"
+  ''
+  Contents of File
+  '';
+```
+:::
+
+This is equivalent to:
+
+```nix
 writeTextFile {
  name = "my-file";
  text = ''
    Contents of File
  '';
  executable = true;
-  destination = "/bin/my-file";
 }
-# Writes contents of file to /nix/store/<store path>
-writeText "my-file"
-  ''
-  Contents of File
-  '';
-# Writes contents of file to /nix/store/<store path>/share/my-file
-writeTextDir "share/my-file"
-  ''
-  Contents of File
-  '';
-# Writes my-file to /nix/store/<store path> and makes executable
-writeScript "my-file"
-  ''
-  Contents of File
-  '';
-# Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
-writeScriptBin "my-file"
-  ''
-  Contents of File
-  '';
-# Writes my-file to /nix/store/<store path> and makes executable.
-writeShellScript "my-file"
-  ''
-  Contents of File
-  '';
-# Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
-writeShellScriptBin "my-file"
-  ''
-  Contents of File
-  '';
+```

+### `writeScriptBin` {#trivial-builder-writeScriptBin}
+
+Write a script within a `bin` subirectory of a directory in the Nix store.
+This is for consistency with the convention of software packages placing executables under `bin`.
+
+`writeScriptBin` takes the following arguments:
+
+`name` (String)
+
+: The name used in the Nix store path and within the file created under the store path.
+
+`text` (String)
+
+: The contents of the file.
+
+The created file is marked as executable.
+The file's contents will be put into `/nix/store/<store path>/bin/<name>`.
+The store path will include the the name, and it will be a directory.
+
+::: {.example #ex-writeScriptBin}
+# Usage of `writeScriptBin`
+
+```nix
+writeScriptBin "my-script"
+  ''
+  echo "hi"
+  '';
+```
+:::
+
+This is equivalent to:
+
+```nix
+writeTextFile {
+  name = "my-script";
+  text = ''
+    echo "hi"
+  '';
+  executable = true;
+  destination = "bin/my-script"
+}
+```
+
+### `writeShellScript` {#trivial-builder-writeShellScript}
+
+Write a Bash script to the store.
+
+`writeShellScript` takes the following arguments:
+
+`name` (String)
+
+: The name used in the Nix store path.
+
+`text` (String)
+
+: The contents of the file.
+
+The created file is marked as executable.
+The store path will include the name, and it will be a file.
+
+This function is almost exactly like [](#trivial-builder-writeScript), except that it prepends to the file a [shebang](https://en.wikipedia.org/wiki/Shebang_%28Unix%29) line that points to the version of Bash used in Nixpkgs.
+<!-- this cannot be changed in practice, so there is no point pretending it's somehow generic -->
+
+::: {.example #ex-writeShellScript}
+# Usage of `writeShellScript`
+
+```nix
+writeShellScript "my-script"
+  ''
+  echo "hi"
+  '';
+```
+:::
+
+This is equivalent to:
+
+```nix
+writeTextFile {
+  name = "my-script";
+  text = ''
+    #! ${pkgs.runtimeShell}
+    echo "hi"
+  '';
+  executable = true;
+}
+```
+
+### `writeShellScriptBin` {#trivial-builder-writeShellScriptBin}
+
+Write a Bash script to a "bin" subdirectory of a directory in the Nix store.
+
+`writeShellScriptBin` takes the following arguments:
+
+`name` (String)
+
+: The name used in the Nix store path and within the file generated under the store path.
+
+`text` (String)
+
+: The contents of the file.
+
+The file's contents will be put into `/nix/store/<store path>/bin/<name>`.
+The store path will include the the name, and it will be a directory.
+
+This function is a combination of [](#trivial-builder-writeShellScript) and [](#trivial-builder-writeScriptBin).
+
+::: {.example #ex-writeShellScriptBin}
+# Usage of `writeShellScriptBin`
+
+```nix
+writeShellScriptBin "my-script"
+  ''
+  echo "hi"
+  '';
+```
+:::
+
+This is equivalent to:
+
+```nix
+writeTextFile {
+  name = "my-script";
+  text = ''
+    #! ${pkgs.runtimeShell}
+    echo "hi"
+  '';
+  executable = true;
+  destination = "bin/my-script"
+}
 ```

 ## `concatTextFile`, `concatText`, `concatScript` {#trivial-builder-concatText}
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2867,12 +2867,6 @@
    githubId = 382011;
    name = "c4605";
  };
-  caadar = {
-    email = "v88m@posteo.net";
-    github = "caadar";
-    githubId = 15320726;
-    name = "Car Cdr";
-  };
  caarlos0 = {
    name = "Carlos A Becker";
    email = "carlos@becker.software";
@ -17230,6 +17224,11 @@
    githubId = 3789764;
    name = "skykanin";
  };
+  slam-bert = {
+    github = "slam-bert";
+    githubId = 106779009;
+    name = "Slambert";
+  };
  slbtty = {
    email = "shenlebantongying@gmail.com";
    github = "shenlebantongying";
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1044,6 +1044,7 @@
  ./services/networking/ntopng.nix
  ./services/networking/ntp/chrony.nix
  ./services/networking/ntp/ntpd.nix
+  ./services/networking/ntp/ntpd-rs.nix
  ./services/networking/ntp/openntpd.nix
  ./services/networking/nullidentdmod.nix
  ./services/networking/nylon.nix
--- a/nixos/modules/services/hardware/pcscd.nix
+++ b/nixos/modules/services/hardware/pcscd.nix
@ -22,7 +22,7 @@ in
    plugins = mkOption {
      type = types.listOf types.package;
      defaultText = literalExpression "[ pkgs.ccid ]";
-      example = literalExpression "with pkgs; [ pcsc-cyberjack yubikey-personalization ]";
+      example = literalExpression "[ pkgs.pcsc-cyberjack ]";
      description = lib.mdDoc "Plugin packages to be used for PCSC-Lite.";
    };

--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@ -98,7 +98,7 @@ let
          # anything ever again ("couldn't resolve ..., giving up on
          # it"), so we silently lose time synchronisation. This also
          # applies to openntpd.
-          /run/current-system/systemd/bin/systemctl try-reload-or-restart ntpd.service openntpd.service chronyd.service || true
+          /run/current-system/systemd/bin/systemctl try-reload-or-restart ntpd.service openntpd.service chronyd.service ntpd-rs.service || true
      fi

      ${cfg.runHook}
--- a/nixos/modules/services/networking/ntp/ntpd-rs.nix
+++ b/nixos/modules/services/networking/ntp/ntpd-rs.nix
@ -0,0 +1,89 @@
+{ lib, config, pkgs, ... }:
+
+let
+  cfg = config.services.ntpd-rs;
+  format = pkgs.formats.toml { };
+  configFile = format.generate "ntpd-rs.toml" cfg.settings;
+in
+{
+  options.services.ntpd-rs = {
+    enable = lib.mkEnableOption "Network Time Service (ntpd-rs)";
+    metrics.enable = lib.mkEnableOption "ntpd-rs Prometheus Metrics Exporter";
+
+    package = lib.mkPackageOption pkgs "ntpd-rs" { };
+
+    useNetworkingTimeServers = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = lib.mdDoc ''
+        Use source time servers from {var}`networking.timeServers` in config.
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+      default = { };
+      description = lib.mdDoc ''
+        Settings to write to {file}`ntp.toml`
+
+        See <https://docs.ntpd-rs.pendulum-project.org/man/ntp.toml.5>
+        for more information about available options.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !config.services.timesyncd.enable;
+        message = ''
+          `ntpd-rs` is not compatible with `services.timesyncd`. Please disable one of them.
+        '';
+      }
+    ];
+
+    environment.systemPackages = [ cfg.package ];
+    systemd.packages = [ cfg.package ];
+
+    services.timesyncd.enable = false;
+    systemd.services.systemd-timedated.environment = {
+      SYSTEMD_TIMEDATED_NTP_SERVICES = "ntpd-rs.service";
+    };
+
+    services.ntpd-rs.settings = {
+      observability = {
+        observation-path = lib.mkDefault "/var/run/ntpd-rs/observe";
+      };
+      source = lib.mkIf cfg.useNetworkingTimeServers (map
+        (ts: {
+          mode = "server";
+          address = ts;
+        })
+        config.networking.timeServers);
+    };
+
+    systemd.services.ntpd-rs = {
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        User = "";
+        Group = "";
+        DynamicUser = true;
+        ExecStart = [ "" "${lib.makeBinPath [ cfg.package ]}/ntp-daemon --config=${configFile}" ];
+      };
+    };
+
+    systemd.services.ntp-rs-metrics = lib.mkIf cfg.metrics.enable {
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        User = "";
+        Group = "";
+        DynamicUser = true;
+        ExecStart = [ "" "${lib.makeBinPath [ cfg.package ]}/bin/ntp-metrics-exporter --config=${configFile}" ];
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ fpletz ];
+}
--- a/nixos/modules/services/system/kerberos/heimdal.nix
+++ b/nixos/modules/services/system/kerberos/heimdal.nix
@ -35,7 +35,7 @@ in
        mkdir -m 0755 -p ${stateDir}
      '';
      serviceConfig.ExecStart =
-        "${kerberos}/libexec/heimdal/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
+        "${kerberos}/libexec/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
      restartTriggers = [ kdcConfFile ];
    };

@ -46,7 +46,7 @@ in
        mkdir -m 0755 -p ${stateDir}
      '';
      serviceConfig.ExecStart =
-        "${kerberos}/libexec/heimdal/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
+        "${kerberos}/libexec/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
      restartTriggers = [ kdcConfFile ];
    };

@ -56,7 +56,7 @@ in
      preStart = ''
        mkdir -m 0755 -p ${stateDir}
      '';
-      serviceConfig.ExecStart = "${kerberos}/libexec/heimdal/kpasswdd";
+      serviceConfig.ExecStart = "${kerberos}/libexec/kpasswdd";
      restartTriggers = [ kdcConfFile ];
    };

--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -108,12 +108,12 @@ let

  getKeyLocations = pool: if isBool cfgZfs.requestEncryptionCredentials then {
    hasKeys = cfgZfs.requestEncryptionCredentials;
-    command = "${cfgZfs.package}/sbin/zfs list -rHo name,keylocation,keystatus ${pool}";
+    command = "${cfgZfs.package}/sbin/zfs list -rHo name,keylocation,keystatus -t volume,filesystem ${pool}";
  } else let
    keys = filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials;
  in {
    hasKeys = keys != [];
-    command = "${cfgZfs.package}/sbin/zfs list -Ho name,keylocation,keystatus ${toString keys}";
+    command = "${cfgZfs.package}/sbin/zfs list -Ho name,keylocation,keystatus -t volume,filesystem ${toString keys}";
  };

  createImportService = { pool, systemd, force, prefix ? "" }:
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -620,6 +620,7 @@ in {
  nsd = handleTest ./nsd.nix {};
  ntfy-sh = handleTest ./ntfy-sh.nix {};
  ntfy-sh-migration = handleTest ./ntfy-sh-migration.nix {};
+  ntpd-rs = handleTest ./ntpd-rs.nix {};
  nzbget = handleTest ./nzbget.nix {};
  nzbhydra2 = handleTest ./nzbhydra2.nix {};
  oh-my-zsh = handleTest ./oh-my-zsh.nix {};
--- a/nixos/tests/ntpd-rs.nix
+++ b/nixos/tests/ntpd-rs.nix
@ -0,0 +1,49 @@
+import ./make-test-python.nix ({ lib, ... }:
+{
+  name = "ntpd-rs";
+
+  meta = {
+    maintainers = with lib.maintainers; [ fpletz ];
+  };
+
+  nodes = {
+    client = {
+      services.ntpd-rs = {
+        enable = true;
+        metrics.enable = true;
+        useNetworkingTimeServers = false;
+        settings = {
+          source = [
+            {
+              mode = "server";
+              address = "server";
+            }
+          ];
+          synchronization = {
+            minimum-agreeing-sources = 1;
+          };
+        };
+      };
+    };
+    server = {
+      networking.firewall.allowedUDPPorts = [ 123 ];
+      services.ntpd-rs = {
+        enable = true;
+        metrics.enable = true;
+        settings = {
+          server = [
+            { listen = "[::]:123"; }
+          ];
+        };
+      };
+    };
+  };
+
+  testScript = { nodes, ... }: ''
+    start_all()
+    server.wait_for_unit('multi-user.target')
+    client.wait_for_unit('multi-user.target')
+    server.succeed('systemctl is-active ntpd-rs.service')
+    client.succeed('systemctl is-active ntpd-rs.service')
+  '';
+})
--- a/pkgs/applications/audio/soundtracker/default.nix
+++ b/pkgs/applications/audio/soundtracker/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv
-, fetchurl
+, fetchzip
 , pkg-config
 , autoreconfHook
 , gtk2
@ -8,19 +8,21 @@
 , jack2
 , audiofile
 , goocanvas # graphical envelope editing
+, libxml2
+, libsndfile
 }:

 stdenv.mkDerivation rec {
  pname = "soundtracker";
-  version = "1.0.3";
+  version = "1.0.4";

-  src = fetchurl {
+  src = fetchzip {
    # Past releases get moved to the "old releases" directory.
    # Only the latest release is at the top level.
    # Nonetheless, only the name of the file seems to affect which file is
    # downloaded, so this path should be fine both for old and current releases.
    url = "mirror://sourceforge/soundtracker/soundtracker-${version}.tar.xz";
-    sha256 = "sha256-k+TB1DIauOIeQSCVV5uYu69wwRx7vCRAlSCTAtDguKo=";
+    hash = "sha256-kNt0BSRaEQY+oa1xbuZ1l6nCqXhcktVugxzcC3ZDaX0=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
@ -55,6 +57,8 @@ stdenv.mkDerivation rec {
    jack2
    audiofile
    goocanvas
+    libxml2
+    libsndfile
  ] ++ lib.optional stdenv.isLinux alsa-lib;

  meta = with lib; {
--- a/pkgs/applications/graphics/sane/backends/brscan5/default.nix
+++ b/pkgs/applications/graphics/sane/backends/brscan5/default.nix
@ -10,15 +10,15 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "brscan5";
-  version = "1.2.9-0";
+  version = "1.3.0-0";
  src = {
    "i686-linux" = fetchurl {
      url = "https://download.brother.com/welcome/dlf104034/${pname}-${version}.i386.deb";
-      sha256 = "ac23c9a435818955e7882ab06380adf346203ff4e45f384b40e84b8b29642f07";
+      sha256 = "sha256-LpbPUo8iD5CcwUoIOa1UYHQXMrZZJ7PjZpcuyXhXjzk=";
    };
    "x86_64-linux" = fetchurl {
      url = "https://download.brother.com/welcome/dlf104033/${pname}-${version}.amd64.deb";
-      sha256 = "4ec23ff4b457323ae778e871a0f1abcc1848ea105af17850b57f7dcaddcfd96d";
+      sha256 = "sha256-ntVe/e6/cdz3+LSpGilMFZecxfv74pd7ksh85SzEdKc=";
    };
  }."${system}" or (throw "Unsupported system: ${system}");

@ -34,8 +34,8 @@ stdenv.mkDerivation rec {
  postPatch =
    let
      patchOffsetBytes =
-        if system == "x86_64-linux" then 84632
-        else if system == "i686-linux" then 77396
+        if system == "x86_64-linux" then 86528
+        else if system == "i686-linux" then 79140
        else throw "Unsupported system: ${system}";
    in
    ''
--- a/pkgs/applications/kde/gwenview.nix
+++ b/pkgs/applications/kde/gwenview.nix
@ -14,6 +14,7 @@ mkDerivation {
    description = "KDE image viewer";
    license = with lib.licenses; [ gpl2Plus fdl12Plus ];
    maintainers = [ lib.maintainers.ttuegel ];
+    mainProgram = "gwenview";
  };
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
  buildInputs = [
--- a/pkgs/applications/misc/calcure/default.nix
+++ b/pkgs/applications/misc/calcure/default.nix
@ -6,33 +6,34 @@
 python3.pkgs.buildPythonApplication rec {
  pname = "calcure";
  version = "3.0.1";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "anufrievroman";
    repo = "calcure";
-    rev = version;
+    rev = "refs/tags/${version}";
    hash = "sha256-rs3TCZjMndeh2N7e+U62baLs+XqWK1Mk7KVnypSnWPg=";
  };

-  nativeBuildInputs = [
-    python3.pkgs.setuptools
-    python3.pkgs.wheel
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
  ];

  propagatedBuildInputs = with python3.pkgs; [
-    jdatetime
    holidays
    icalendar
-    ics
-    attrs
+    jdatetime
+    taskw
  ];

-  pythonImportsCheck = [ "calcure" ];
+  pythonImportsCheck = [
+    "calcure"
+  ];

  meta = with lib; {
    description = "Modern TUI calendar and task manager with minimal and customizable UI";
    homepage = "https://github.com/anufrievroman/calcure";
+    changelog = "https://github.com/anufrievroman/calcure/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ dit7ya ];
  };
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@ -1,15 +1,15 @@
 { lib, stdenv, fetchFromGitHub, python3Packages, wrapQtAppsHook
-, secp256k1 }:
+, secp256k1, qtwayland }:

 python3Packages.buildPythonApplication rec {
  pname = "electron-cash";
-  version = "4.2.10";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "Electron-Cash";
    repo = "Electron-Cash";
    rev = "refs/tags/${version}";
-    sha256 = "sha256-m13wJlNBG3BxOdKUyd3qmIhFBM7263FzMKr5lfD1tys=";
+    sha256 = "sha256-xOyj5XerOwgfvI0qj7+7oshDvd18h5IeZvcJTis8nWo=";
  };

  propagatedBuildInputs = with python3Packages; [
@ -27,6 +27,7 @@ python3Packages.buildPythonApplication rec {
    certifi
    pathvalidate
    dnspython
+    bitcoinrpc

    # requirements-binaries
    pyqt5
@ -47,6 +48,8 @@ python3Packages.buildPythonApplication rec {

  nativeBuildInputs = [ wrapQtAppsHook ];

+  buildInputs = [ ] ++ lib.optional stdenv.isLinux qtwayland;
+
  postPatch = ''
    substituteInPlace contrib/requirements/requirements.txt \
      --replace "qdarkstyle==2.6.8" "qdarkstyle<3"
@ -55,13 +58,6 @@ python3Packages.buildPythonApplication rec {
      --replace "(share_dir" "(\"share\""
  '';

-  nativeCheckInputs = with python3Packages; [ pytest ];
-
-  checkPhase = ''
-    unset HOME
-    pytest electroncash/tests
-  '';
-
  postInstall = lib.optionalString stdenv.isLinux ''
    substituteInPlace $out/share/applications/electron-cash.desktop \
      --replace "Exec=electron-cash" "Exec=$out/bin/electron-cash"
--- a/pkgs/applications/misc/get_iplayer/default.nix
+++ b/pkgs/applications/misc/get_iplayer/default.nix
@ -11,13 +11,13 @@

 perlPackages.buildPerlPackage rec {
  pname = "get_iplayer";
-  version = "3.34";
+  version = "3.35";

  src = fetchFromGitHub {
    owner = "get-iplayer";
    repo = "get_iplayer";
    rev = "v${version}";
-    hash = "sha256-KuDNngHOoeEHJExEHoLdNO95ZUvLx8TWiAOTmRKHtmQ=";
+    hash = "sha256-fqzrgmtqy7dlmGEaTXAqpdt9HqZCVooJ0Vf6/JUKihw=";
  };

  nativeBuildInputs = [ makeWrapper ] ++ lib.optional stdenv.isDarwin shortenPerlShebang;
@ -35,7 +35,7 @@ perlPackages.buildPerlPackage rec {

    install -D get_iplayer -t $out/bin
    wrapProgram $out/bin/get_iplayer --suffix PATH : ${lib.makeBinPath [ atomicparsley ffmpeg ]} --prefix PERL5LIB : $PERL5LIB
-    install -D get_iplayer.1 -t $out/share/man/man1
+    install -Dm444 get_iplayer.1 -t $out/share/man/man1

    runHook postInstall
  '';
--- a/pkgs/applications/misc/grsync/default.nix
+++ b/pkgs/applications/misc/grsync/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, dee, gtk3, intltool, libdbusmenu-gtk3, libunity, pkg-config, rsync }:
+{ lib, stdenv, fetchurl, dee, gtk3, intltool, libdbusmenu-gtk3, libunity, pkg-config, rsync, wrapGAppsHook }:

 stdenv.mkDerivation rec {
  version = "1.3.1";
@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    intltool
    pkg-config
+    wrapGAppsHook
  ];

  buildInputs = [
@ -27,6 +28,7 @@ stdenv.mkDerivation rec {
    homepage = "http://www.opbyte.it/grsync/";
    license = licenses.gpl2Only;
    platforms = platforms.linux;
+    mainProgram = "grsync";
    maintainers = [ maintainers.kuznero ];
  };
 }
--- a/pkgs/applications/misc/waylock/default.nix
+++ b/pkgs/applications/misc/waylock/default.nix
@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchFromGitHub
+, fetchFromGitea
 , libxkbcommon
 , pam
 , pkg-config
@ -14,7 +14,8 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "waylock";
  version = "0.6.4";

-  src = fetchFromGitHub {
+  src = fetchFromGitea {
+    domain = "codeberg.org";
    owner = "ifreund";
    repo = "waylock";
    rev = "v${finalAttrs.version}";
@ -41,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/ifreund/waylock";
    description = "A small screenlocker for Wayland compositors";
    license = lib.licenses.isc;
-    maintainers = with lib.maintainers; [ jordanisaacs ];
+    maintainers = with lib.maintainers; [ adamcstephens jordanisaacs ];
    mainProgram = "waylock";
    platforms = lib.platforms.linux;
  };
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@ -1,15 +1,15 @@
 {
-  "packageVersion": "121.0-1",
+  "packageVersion": "121.0.1-1",
  "source": {
-    "rev": "121.0-1",
-    "sha256": "1vd4vz4i27p1lwx5ibaxqf7r1ll5zlvf54n6mqmaya3q0lrawb14"
+    "rev": "121.0.1-1",
+    "sha256": "15zcrl47w6ib00wai63kks5ykcpfh5wfa0ixxj62v06v50bnd78x"
  },
  "settings": {
    "rev": "41623492f2b6970972014f6ce196015d3d7f1b59",
    "sha256": "0ayyyw44q0gh668bzlv6cfl7baa0818bnz83g53l5j2f10xd52by"
  },
  "firefox": {
-    "version": "121.0",
-    "sha512": "52e9e21ce825c4e58f09fd2c7347f1ac4efbca47e119136a712f0d4ee80c769ef80a43bad74a4c88cd377f804f5780b07f7af5b779f3fb5d244fa095e6b3b18a"
+    "version": "121.0.1",
+    "sha512": "7810850a922cb4a274ced6556e14256d3ff518a96f10a0f86d1f8e40daa0a8b1a5cfcc9cbf1391029d920944e94a9149951ee107a0e718a294954bb50b6ced2e"
  }
 }
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -24,7 +24,7 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.11.2";
+  version = "3.11.8";
  pyproject = true;

  # Fetch from GitHub in order to use `requirements.in`
@ -32,7 +32,7 @@ python.pkgs.buildPythonApplication rec {
    owner = "Flexget";
    repo = "Flexget";
    rev = "refs/tags/v${version}";
-    hash = "sha256-IM3qVn+XAv0EvRYc7ujMU4NPly5IaxF0efHAgI/lyms=";
+    hash = "sha256-kJLcOk1ci4agSoBO7L1JacVq5G2jTjOj1mh7J8S2D+Y=";
  };

  postPatch = ''
@ -60,7 +60,7 @@ python.pkgs.buildPythonApplication rec {
    loguru
    more-itertools
    packaging
-    pendulum
+    pendulum_3
    psutil
    pynzb
    pyrsistent
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@ -24,7 +24,7 @@
 , libpulseaudio
 , libupnp
 , yaml-cpp
-, msgpack
+, msgpack-cxx
 , openssl
 , restinio
 , secp256k1
@ -125,7 +125,7 @@ stdenv.mkDerivation rec {
      http-parser
      jsoncpp
      libupnp
-      msgpack
+      msgpack-cxx
      opendht-jami
      openssl
      pjsip-jami
@ -177,7 +177,7 @@ stdenv.mkDerivation rec {
      libpulseaudio
      libupnp
      yaml-cpp
-      msgpack
+      msgpack-cxx
      opendht-jami
      openssl
      pjsip-jami
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@ -8,7 +8,7 @@
 , alsa-lib
 , faac
 , faad2
-, ffmpeg_5 # Depends on deprecated libav features
+, ffmpeg
 , glib
 , openh264
 , openssl
@ -112,7 +112,7 @@ stdenv.mkDerivation rec {
    cairo
    cups
    faad2
-    ffmpeg_5
+    ffmpeg
    glib
    gst-plugins-base
    gst-plugins-good
--- a/pkgs/applications/science/math/primesieve/default.nix
+++ b/pkgs/applications/science/math/primesieve/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "primesieve";
-  version = "11.1";
+  version = "11.2";

  src = fetchFromGitHub {
    owner = "kimwalisch";
    repo = "primesieve";
    rev = "v${version}";
-    hash = "sha256-b6X3zhoJsO3UiWfeW4zbKsaoofIWArJi5usof3efQ0k=";
+    hash = "sha256-HtVuUS4dmTC7KosyBhqZ0QRstvon9WMxYf9Ocs1XIrs=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix
+++ b/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix
@ -12,6 +12,7 @@
 , sassc
 , libadwaita
 , pcre2
+, libsixel
 , libxml2
 , librsvg
 , libgee
@ -20,6 +21,7 @@
 , gtk3
 , desktop-file-utils
 , wrapGAppsHook
+, sixelSupport ? false
 }:

 let
@ -62,7 +64,18 @@ stdenv.mkDerivation rec {
  ];
  buildInputs = [
    gtk4
-    vte-gtk4
+    (vte-gtk4.overrideAttrs (old: {
+      src = fetchFromGitLab {
+        domain = "gitlab.gnome.org";
+        owner = "GNOME";
+        repo = "vte";
+        rev = "3c8f66be867aca6656e4109ce880b6ea7431b895";
+        hash = "sha256-vz9ircmPy2Q4fxNnjurkgJtuTSS49rBq/m61p1B43eU=";
+      };
+    } // lib.optionalAttrs sixelSupport {
+      buildInputs = old.buildInputs ++ [ libsixel ];
+      mesonFlags = old.mesonFlags ++ [ "-Dsixel=true" ];
+    }))
    json-glib
    marble
    libadwaita
@ -80,7 +93,7 @@ stdenv.mkDerivation rec {
    homepage = "https://gitlab.gnome.org/raggesilver/blackbox";
    changelog = "https://gitlab.gnome.org/raggesilver/blackbox/-/raw/v${version}/CHANGELOG.md";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ chuangzhu ];
+    maintainers = with maintainers; [ chuangzhu linsui ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
@ -10,10 +10,10 @@ buildGoModule rec {
    owner = "gitlab-org";
    repo = "container-registry";
    inherit rev;
-    hash = "sha256-vQ5bP2S1McZxD+Mjw0y/+GB8ntv8nQynM1cIWtUK7pU=";
+    hash = "sha256-egslb+8+RsDjpL5xQpdCU3QwFH59grRCkODQnAkZe/0=";
  };

-  vendorHash = "sha256-rDmmCwz/+FBzbREKIqwQulcOKwd4Y6/MITyNpB+pfwQ=";
+  vendorHash = "sha256-IFXIr0xYJCKM5VUHQV+4S/+FEAhFEjbMaU+9JWIh8cA=";

  patches = [
    ./Disable-inmemory-storage-driver-test.patch
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@ -162,6 +162,9 @@ stdenv.mkDerivation (finalAttrs: {
    "-DENABLE_JACK=ON"
    (lib.cmakeBool "ENABLE_QSV11" stdenv.hostPlatform.isx86_64)
    (lib.cmakeBool "ENABLE_LIBFDK" withFdk)
+    (lib.cmakeBool "ENABLE_ALSA" alsaSupport)
+    (lib.cmakeBool "ENABLE_PULSEAUDIO" pulseaudioSupport)
+    (lib.cmakeBool "ENABLE_PIPEWIRE" pipewireSupport)
  ];

  dontWrapGApps = true;
@ -199,7 +202,7 @@ stdenv.mkDerivation (finalAttrs: {
      video content, efficiently
    '';
    homepage = "https://obsproject.com";
-    maintainers = with maintainers; [ jb55 MP2E materus fpletz ];
+    maintainers = with maintainers; [ eclairevoyant jb55 MP2E materus fpletz ];
    license = with licenses; [ gpl2Plus ] ++ optional withFdk fraunhofer-fdk;
    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
    mainProgram = "obs";
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@ -44,7 +44,8 @@
 , buildFeatures ? [ ]
 , checkFeatures ? buildFeatures
 , useNextest ? false
-, auditable ? !cargo-auditable.meta.broken
+# Enable except on aarch64 pkgsStatic, where we use lld for reasons
+, auditable ? !cargo-auditable.meta.broken && !(stdenv.hostPlatform.isStatic && stdenv.hostPlatform.isAarch64 && !stdenv.hostPlatform.isDarwin)

 , depsExtraArgs ? {}

--- a/pkgs/build-support/rust/hooks/default.nix
+++ b/pkgs/build-support/rust/hooks/default.nix
@ -66,10 +66,10 @@

        cargoConfig = ''
          [target."${stdenv.buildPlatform.rust.rustcTarget}"]
-          "linker" = "${rust.envVars.ccForBuild}"
+          "linker" = "${rust.envVars.linkerForBuild}"
          ${lib.optionalString (stdenv.buildPlatform.config != stdenv.hostPlatform.config) ''
            [target."${stdenv.hostPlatform.rust.rustcTarget}"]
-            "linker" = "${rust.envVars.ccForHost}"
+            "linker" = "${rust.envVars.linkerForHost}"
          ''}
          "rustflags" = [ "-C", "target-feature=${if stdenv.hostPlatform.isStatic then "+" else "-"}crt-static" ]
        '';
--- a/pkgs/build-support/rust/lib/default.nix
+++ b/pkgs/build-support/rust/lib/default.nix
@ -12,10 +12,20 @@ rec {
  # hostPlatform-targeted compiler -- for example, `-m64` being
  # passed on a build=x86_64/host=aarch64 compilation.
  envVars = let
+
+    # As a workaround for https://github.com/rust-lang/rust/issues/89626 use lld on pkgsStatic aarch64
+    shouldUseLLD = platform: platform.isAarch64 && platform.isStatic && !stdenv.isDarwin;
+
    ccForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc";
    cxxForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}c++";
+    linkerForBuild = ccForBuild;
+
    ccForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
    cxxForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
+    linkerForHost = if shouldUseLLD stdenv.targetPlatform
+      && !stdenv.cc.bintools.isLLVM
+      then "${buildPackages.lld}/bin/ld.lld"
+      else ccForHost;

    # Unfortunately we must use the dangerous `targetPackages` here
    # because hooks are artificially phase-shifted one slot earlier
@ -23,6 +33,10 @@ rec {
    # a targetPlatform to them).
    ccForTarget = "${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}cc";
    cxxForTarget = "${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}c++";
+    linkerForTarget = if shouldUseLLD targetPackages.stdenv.targetPlatform
+      && !targetPackages.stdenv.cc.bintools.isLLVM # whether stdenv's linker is lld already
+      then "${buildPackages.lld}/bin/ld.lld"
+      else ccForTarget;

    rustBuildPlatform = stdenv.buildPlatform.rust.rustcTarget;
    rustBuildPlatformSpec = stdenv.buildPlatform.rust.rustcTargetSpec;
@ -32,9 +46,9 @@ rec {
    rustTargetPlatformSpec = stdenv.targetPlatform.rust.rustcTargetSpec;
  in {
    inherit
-      ccForBuild  cxxForBuild  rustBuildPlatform   rustBuildPlatformSpec
-      ccForHost   cxxForHost   rustHostPlatform    rustHostPlatformSpec
-      ccForTarget cxxForTarget rustTargetPlatform  rustTargetPlatformSpec;
+      ccForBuild  cxxForBuild  linkerForBuild  rustBuildPlatform   rustBuildPlatformSpec
+      ccForHost   cxxForHost   linkerForHost   rustHostPlatform    rustHostPlatformSpec
+      ccForTarget cxxForTarget linkerForTarget rustTargetPlatform  rustTargetPlatformSpec;

    # Prefix this onto a command invocation in order to set the
    # variables needed by cargo.
@ -50,15 +64,15 @@ rec {
    + lib.optionalString (rustTargetPlatform != rustHostPlatform) ''
      "CC_${stdenv.targetPlatform.rust.cargoEnvVarTarget}=${ccForTarget}" \
      "CXX_${stdenv.targetPlatform.rust.cargoEnvVarTarget}=${cxxForTarget}" \
-      "CARGO_TARGET_${stdenv.targetPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForTarget}" \
+      "CARGO_TARGET_${stdenv.targetPlatform.rust.cargoEnvVarTarget}_LINKER=${linkerForTarget}" \
    '' + ''
      "CC_${stdenv.hostPlatform.rust.cargoEnvVarTarget}=${ccForHost}" \
      "CXX_${stdenv.hostPlatform.rust.cargoEnvVarTarget}=${cxxForHost}" \
-      "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForHost}" \
+      "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_LINKER=${linkerForHost}" \
    '' + ''
      "CC_${stdenv.buildPlatform.rust.cargoEnvVarTarget}=${ccForBuild}" \
      "CXX_${stdenv.buildPlatform.rust.cargoEnvVarTarget}=${cxxForBuild}" \
-      "CARGO_TARGET_${stdenv.buildPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForBuild}" \
+      "CARGO_TARGET_${stdenv.buildPlatform.rust.cargoEnvVarTarget}_LINKER=${linkerForBuild}" \
      "CARGO_BUILD_TARGET=${rustBuildPlatform}" \
      "HOST_CC=${buildPackages.stdenv.cc}/bin/cc" \
      "HOST_CXX=${buildPackages.stdenv.cc}/bin/c++" \
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@ -182,101 +182,32 @@ rec {
        eval "$checkPhase"
      '';

-  /*
-     Writes a text file to nix store with no optional parameters available.
-
-     Example:
-
-
-     # Writes contents of file to /nix/store/<store path>
-     writeText "my-file"
-     ''
-     Contents of File
-     '';
-
-
-  */
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
  writeText = name: text: writeTextFile { inherit name text; };

-  /*
-    Writes a text file to nix store in a specific directory with no
-    optional parameters available.
-
-    Example:
-
-
-    # Writes contents of file to /nix/store/<store path>/share/my-file
-    writeTextDir "share/my-file"
-     ''
-     Contents of File
-     '';
-
-
-  */
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
  writeTextDir = path: text: writeTextFile {
    inherit text;
    name = builtins.baseNameOf path;
    destination = "/${path}";
  };

-  /*
-    Writes a text file to /nix/store/<store path> and marks the file as
-    executable.
-
-    If passed as a build input, will be used as a setup hook. This makes setup
-    hooks more efficient to create: you don't need a derivation that copies
-    them to $out/nix-support/setup-hook, instead you can use the file as is.
-
-    Example:
-
-
-    # Writes my-file to /nix/store/<store path> and makes executable
-    writeScript "my-file"
-      ''
-      Contents of File
-      '';
-
-
-  */
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
  writeScript = name: text: writeTextFile { inherit name text; executable = true; };

-  /*
-    Writes a text file to /nix/store/<store path>/bin/<name> and
-    marks the file as executable.
-
-    Example:
-
-
-
-    # Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
-    writeScriptBin "my-file"
-      ''
-      Contents of File
-      '';
-
-
-  */
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
  writeScriptBin = name: text: writeTextFile {
    inherit name text;
    executable = true;
    destination = "/bin/${name}";
  };

-  /*
-    Similar to writeScript. Writes a Shell script and checks its syntax.
-    Automatically includes interpreter above the contents passed.
-
-    Example:
-
-
-    # Writes my-file to /nix/store/<store path> and makes executable.
-    writeShellScript "my-file"
-      ''
-      Contents of File
-      '';
-
-
-  */
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
  writeShellScript = name: text:
    writeTextFile {
      inherit name;
@ -290,22 +221,8 @@ rec {
      '';
    };

-  /*
-    Similar to writeShellScript and writeScriptBin.
-    Writes an executable Shell script to /nix/store/<store path>/bin/<name> and checks its syntax.
-    Automatically includes interpreter above the contents passed.
-
-    Example:
-
-
-    # Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
-    writeShellScriptBin "my-file"
-      ''
-      Contents of File
-      '';
-
-
-  */
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
  writeShellScriptBin = name: text:
    writeTextFile {
      inherit name;
--- a/pkgs/by-name/README.md
+++ b/pkgs/by-name/README.md
@ -1,11 +1,9 @@
 # Name-based package directories

 The structure of this directory maps almost directly to top-level package attributes.
-This is the recommended way to add new top-level packages to Nixpkgs [when possible](#limitations).
+Add new top-level packages to Nixpkgs using this mechanism [whenever possible](#limitations).

-Packages found in the named-based structure do not need to be explicitly added to the
-`top-level/all-packages.nix` file unless they require overriding the default value
-of an implicit attribute (see below).
+Packages found in the name-based structure are automatically included, without needing to be added to `all-packages.nix`. However if the implicit attribute defaults need to be changed for a package, this [must still be declared in `all-packages.nix`](#changing-implicit-attribute-defaults).

 ## Example

--- a/pkgs/by-name/au/audio-sharing/package.nix
+++ b/pkgs/by-name/au/audio-sharing/package.nix
@ -0,0 +1,75 @@
+{ appstream-glib
+, cargo
+, desktop-file-utils
+, fetchFromGitLab
+, git
+, glib
+, gst_all_1
+, gtk4
+, lib
+, libadwaita
+, meson
+, ninja
+, nix-update-script
+, pkg-config
+, python3
+, rustPlatform
+, rustc
+, stdenv
+, wrapGAppsHook
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "audio-sharing";
+  version = "0.2.2";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "AudioSharing";
+    rev = finalAttrs.version;
+    hash = "sha256-ejNktgN9tfi4TzWDQJnESGcBkpvLVH34sukTFCBfo3U=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit (finalAttrs) src;
+    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    hash = "sha256-c19DxHF4HFN0qTqC2CNzwko79uVeLeyrrXAvuyxeiOQ=";
+  };
+
+  nativeBuildInputs = [
+    appstream-glib
+    cargo
+    desktop-file-utils
+    git
+    meson
+    ninja
+    pkg-config
+    python3
+    rustc
+    wrapGAppsHook
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+  ]);
+
+  buildInputs = [
+    glib
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good # pulsesrc
+    gst_all_1.gst-rtsp-server
+    gst_all_1.gstreamer
+    gtk4
+    libadwaita
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = with lib; {
+    homepage = "https://gitlab.gnome.org/World/AudioSharing";
+    description = "Automatically share the current audio playback in the form of an RTSP stream";
+    maintainers = with maintainers; [ benediktbroich ];
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+  };
+})
--- a/pkgs/by-name/aw/aws-azure-login/package.nix
+++ b/pkgs/by-name/aw/aws-azure-login/package.nix
@ -1,5 +1,7 @@
 { lib
+, callPackage
 , stdenv
+, chromium
 , fetchFromGitHub
 , fetchYarnDeps
 , makeWrapper
@ -7,24 +9,23 @@
 , prefetch-yarn-deps
 , yarn
 }:
-
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "aws-azure-login";
  version = "3.6.1";

  src = fetchFromGitHub {
    owner = "aws-azure-login";
    repo = "aws-azure-login";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-PvPnqaKD98h3dCjEOwF+Uc86xCJzn2b9XNHHn13h/2Y=";
  };

  offlineCache = fetchYarnDeps {
-    yarnLock = "${src}/yarn.lock";
+    yarnLock = "${finalAttrs.src}/yarn.lock";
    hash = "sha256-SXQPRzF6b1FJl5HkyXNm3kGoNSDXux+0RYXBX93mOts=";
  };

-  nativeBuildInputs  = [
+  nativeBuildInputs = [
    makeWrapper
    nodejs
    prefetch-yarn-deps
@ -60,17 +61,22 @@ stdenv.mkDerivation rec {
    cp -r . "$out/lib/node_modules/aws-azure-login"

    makeWrapper "${nodejs}/bin/node" "$out/bin/aws-azure-login" \
-      --add-flags "$out/lib/node_modules/aws-azure-login/lib/index.js"
+      --add-flags "$out/lib/node_modules/aws-azure-login/lib/index.js" \
+      --set PUPPETEER_EXECUTABLE_PATH "${lib.getExe chromium}"

    runHook postInstall
  '';

+  passthru.tests.aws-azure-login = callPackage ./tests.nix {
+    package = finalAttrs.finalPackage;
+  };
+
  meta = {
    description = "Use Azure AD SSO to log into the AWS via CLI";
    homepage = "https://github.com/aws-azure-login/aws-azure-login";
    license = lib.licenses.mit;
    mainProgram = "aws-azure-login";
-    maintainers = with lib.maintainers; [ yurrriq ];
+    maintainers = with lib.maintainers; [ l0b0 ];
    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/by-name/aw/aws-azure-login/tests.nix
+++ b/pkgs/by-name/aw/aws-azure-login/tests.nix
@ -0,0 +1,24 @@
+{ lib
+, runCommand
+, package
+}:
+  runCommand "${package.pname}-tests"
+    {
+      HOME = "/tmp/home";
+    } ''
+    mkdir -p "''${HOME}/.aws"
+    cat > "''${HOME}/.aws/config" <<'EOF'
+    [profile my-profile]
+    azure_tenant_id=3f03e308-ada1-45f7-9cc3-ab777eaba2d3
+    azure_app_id_uri=4fbf61f5-7302-42e5-9585-b18ad0e4649d
+    azure_default_username=user@example.org
+    azure_default_role_arn=
+    azure_default_duration_hours=1
+    azure_default_remember_me=false
+    EOF
+
+    ! ${lib.getExe package} --profile=my-profile 2> stderr
+    [[ "$(cat stderr)" == 'Unable to recognize page state! A screenshot has been dumped to aws-azure-login-unrecognized-state.png. If this problem persists, try running with --mode=gui or --mode=debug' ]]
+
+    touch $out
+  ''
--- a/pkgs/by-name/bu/bulloak/package.nix
+++ b/pkgs/by-name/bu/bulloak/package.nix
@ -1,24 +1,55 @@
 { lib
 , fetchFromGitHub
 , rustPlatform
+, fetchurl
+, stdenv
+, darwin
 }:

+let
+  # svm-rs-builds requires a list of solc versions to build, and would make network calls if not provided.
+  # The ethereum project does not provide static binaries for aarch64, so we use separate sources, the same as in
+  # svm-rs's source code.
+  solc-versions = {
+    x86_64-linux = fetchurl {
+      url = "https://raw.githubusercontent.com/ethereum/solc-bin/60de887187e5670c715931a82fdff6677b31f0cb/linux-amd64/list.json";
+      hash = "sha256-zm1cdqSP4Y9UQcq9OV8sXxnzr3+TWdc7mdg+Do8Y7WY=";
+    };
+    x86_64-darwin = fetchurl {
+      url = "https://raw.githubusercontent.com/ethereum/solc-bin/60de887187e5670c715931a82fdff6677b31f0cb/macosx-amd64/list.json";
+      hash = "sha256-uUdd5gCG7SHQgAW2DQXemTujb8bUJM27J02WjLkQgek=";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://raw.githubusercontent.com/nikitastupin/solc/923ab4b852fadc00ffe87bb76fff21d0613bd280/linux/aarch64/list.json";
+      hash = "sha256-mJaEN63mR3XdK2FmEF+VhLR6JaCCtYkIRq00wYH6Xx8=";
+    };
+    aarch64-darwin = fetchurl {
+      url = "https://raw.githubusercontent.com/alloy-rs/solc-builds/260964c1fcae2502c0139070bdc5c83eb7036a68/macosx/aarch64/list.json";
+      hash = "sha256-xrtb3deMDAuDIjzN1pxm5NyW5NW5OyoOHTFsYyWJCYY=";
+    };
+  };
+in
 rustPlatform.buildRustPackage rec {
  pname = "bulloak";
-  version = "0.5.4";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "alexfertel";
    repo = "bulloak";
    rev = "v${version}";
-    hash = "sha256-lUTMQMBqCezuUsfvuYSCBFsokoY3bPoJDGWL90EjVqY=";
+    hash = "sha256-0pzn0gXlhdndCpsrVRNxl1ylIE/S9A0l8VjNn5wDVvw=";
  };

-  cargoHash = "sha256-LH96e/dBbv4J7g7wzh3/vL+PzZn779zUMBgio6w3rJw=";
+  cargoHash = "sha256-IlDbys5uluLm418UkGf+FIM1AfR2IBAZQ4Atqlybajw=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];

  # tests run in CI on the source repo
  doCheck = false;

+  # provide the list of solc versions to the `svm-rs-builds` dependency
+  SVM_RELEASES_LIST_JSON = solc-versions.${stdenv.hostPlatform.system};
+
  meta = with lib; {
    description = "A Solidity test generator based on the Branching Tree Technique";
    homepage = "https://github.com/alexfertel/bulloak";
--- a/pkgs/by-name/ca/catppuccin-qt5ct/package.nix
+++ b/pkgs/by-name/ca/catppuccin-qt5ct/package.nix
@ -0,0 +1,31 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+}:
+stdenvNoCC.mkDerivation {
+  pname = "catppuccin-qt5ct";
+  version = "2023-03-21";
+
+  src = fetchFromGitHub {
+    owner = "catppuccin";
+    repo = "qt5ct";
+    rev = "89ee948e72386b816c7dad72099855fb0d46d41e";
+    hash = "sha256-t/uyK0X7qt6qxrScmkTU2TvcVJH97hSQuF0yyvSO/qQ=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/qt5ct
+    cp -r themes $out/share/qt5ct/colors
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Soothing pastel theme for qt5ct";
+    homepage = "https://github.com/catppuccin/qt5ct";
+    license = licenses.mit;
+    maintainers = with maintainers; [pluiedev];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/by-name/cs/csvlens/package.nix
+++ b/pkgs/by-name/cs/csvlens/package.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "csvlens";
-  version = "0.5.1";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "YS-L";
    repo = "csvlens";
    rev = "refs/tags/v${version}";
-    hash = "sha256-9zIi49iXFOARSZsz0iqzC7NfoiBngfNt6A7vZuwxItI=";
+    hash = "sha256-KileDwgVnrbJ6sCv6d4PjnyYqrEmZK6JESYa7+rBneo=";
  };

-  cargoHash = "sha256-DDMsycYSzkBNvf4f9WVpnADpP72GQEkmJIJsfrlfMcI=";
+  cargoHash = "sha256-RtnfyhWfctByh8QqOMAu32xKSigP+lCIUIDfzj7kOkE=";

  meta = with lib; {
    description = "Command line csv viewer";
--- a/pkgs/by-name/di/disk-filltest/package.nix
+++ b/pkgs/by-name/di/disk-filltest/package.nix
@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "disk-filltest";
+  version = "0.8.2";
+
+  src = fetchFromGitHub {
+    owner = "bingmann";
+    repo = "disk-filltest";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-cppofTzzJHrvG5SsafKgvCIiHc6E5740NyQdWWZxrGI=";
+  };
+
+  outputs = [ "out" "doc" "man" ];
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "prefix=${placeholder "out"}"
+    "man1dir=${placeholder "man"}/share/man/man1"
+  ];
+
+  postInstall = ''
+    install -D -m0644 -t $doc/share/doc/disk-filltest README
+  '';
+
+  meta = {
+    homepage = "https://panthema.net/2013/disk-filltest";
+    description = "Simple program to detect bad disks by filling them with random data";
+    longDescription = ''
+      disk-filltest is a tool to check storage disks for coming failures by
+      write files with pseudo-random data to the current directory until the
+      disk is full, read the files again and verify the sequence written. It
+      also can measure read/write speed while filling the disk.
+    '';
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "disk-filltest";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/em/emacs-lsp-booster/package.nix
+++ b/pkgs/by-name/em/emacs-lsp-booster/package.nix
@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "emacs-lsp-booster";
-  version = "0.1.1";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "blahgeek";
    repo = "emacs-lsp-booster";
    rev = "v${version}";
-    hash = "sha256-0roQxzQrxcmS2RHQPguBRL76xSErf2hVjuJEyFr5MeM=";
+    hash = "sha256-DmEnuAR/OtTdKApEWCdOPAJplT29kuM6ZSHeOnQVo/c=";
  };

-  cargoHash = "sha256-quqhAMKsZorYKFByy2bojGgYR2Ps959Rg/TP8SnwbqM=";
+  cargoHash = "sha256-2wXsPkBl4InjbdYUiiQ+5fZFanLA88t5ApGZ4psfDqk=";

  nativeCheckInputs = [emacs]; # tests/bytecode_test

--- a/pkgs/by-name/fi/fim-rs/Cargo.lock
+++ b/pkgs/by-name/fi/fim-rs/Cargo.lock
--- a/pkgs/by-name/fi/fim-rs/package.nix
+++ b/pkgs/by-name/fi/fim-rs/package.nix
@ -0,0 +1,68 @@
+{ lib
+, bzip2
+, darwin
+, fetchFromGitHub
+, pkg-config
+, rustPlatform
+, stdenv
+, zstd
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "fim-rs";
+  version = "0.4.10";
+
+  src = fetchFromGitHub {
+    owner = "Achiefs";
+    repo = "fim";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-NrxjiJY+qgPfsNY2Xlm0KRArIDH3+u9uA5gSPem+9uc=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    bzip2
+    zstd
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreFoundation
+    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
+  # There is a failure while the binary is checked
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Host-based file integrity monitoring tool";
+    longDescription = ''
+      FIM is a File Integrity Monitoring tool that tracks any event over your
+      files. It is capable of keeping historical data of your files. It checks
+      the filesystem changes in the background.
+
+      FIM is the fastest alternative to other software like Ossec, which
+      performs file integrity monitoring. It could integrate with other
+      security tools. The produced data can be ingested and analyzed with
+      tools like ElasticSearch/OpenSearch.
+    '';
+    homepage = "https://github.com/Achiefs/fim";
+    changelog = "https://github.com/Achiefs/fim/releases/tag/v${version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "fim";
+  };
+}
--- a/pkgs/tools/misc/gtklp/patches/autoconf.patch
+++ b/pkgs/tools/misc/gtklp/patches/autoconf.patch
--- a/pkgs/tools/misc/gtklp/patches/mdv-fix-str-fmt.patch
+++ b/pkgs/tools/misc/gtklp/patches/mdv-fix-str-fmt.patch
--- a/pkgs/by-name/gt/gtklp/package.nix
+++ b/pkgs/by-name/gt/gtklp/package.nix
@ -0,0 +1,71 @@
+{ lib
+, stdenv
+, autoreconfHook
+, cups
+, fetchurl
+, gettext
+, glib
+, gtk2
+, libtool
+, openssl
+, pkg-config
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gtklp";
+  version = "1.3.4";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/gtklp/gtklp-${finalAttrs.version}.src.tar.gz";
+    hash = "sha256-vgdgkEJZX6kyA047LXA4zvM5AewIY/ztu1GIrLa1O6s=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    cups
+  ];
+
+  buildInputs = [
+    cups
+    gettext
+    glib
+    gtk2
+    libtool
+    openssl
+  ];
+
+  outputs = [ "out" "doc" "man" ];
+
+  strictDeps = true;
+
+  patches = [
+    ./000-autoconf.patch
+    ./001-format-parameter.patch
+  ];
+
+  # Workaround build failure on -fno-common toolchains:
+  #   ld: libgtklp.a(libgtklp.o):libgtklp/libgtklp.h:83: multiple definition of `progressBar';
+  #     file.o:libgtklp/libgtklp.h:83: first defined here
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
+
+  postPatch = ''
+    substituteInPlace include/defaults.h \
+      --replace "netscape" "firefox" \
+      --replace "http://localhost:631/sum.html#STANDARD_OPTIONS" \
+                "http://localhost:631/help/"
+  '';
+
+  preInstall = ''
+    install -D -m0644 -t $doc/share/doc AUTHORS BUGS ChangeLog README USAGE
+  '';
+
+  meta = {
+    homepage = "https://gtklp.sirtobi.com";
+    description = "A GTK-based graphical frontend for CUPS";
+    license = with lib.licenses; [ gpl2Only ];
+    mainProgram = "gtklp";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/hi/hifile/package.nix
+++ b/pkgs/by-name/hi/hifile/package.nix
@ -1,12 +1,12 @@
 { lib, appimageTools, fetchurl }:

 let
-  version = "0.9.9.7";
+  version = "0.9.9.10";
  pname = "hifile";

  src = fetchurl {
    url = "https://www.hifile.app/files/HiFile-${version}.AppImage";
-    hash = "sha256-/vFW+jHmtCEioJt0B5TnNDsaIyFlDuVABnHNccm6iEw=";
+    hash = "sha256-wNS+vaWvJsZDrgiA7RWRfkGv9Mb6BZ2qyn67jwJu61I=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/by-name/li/libusbp/package.nix
+++ b/pkgs/by-name/li/libusbp/package.nix
@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, udev
+, cmake
+, pkg-config
+}:
+
+stdenv.mkDerivation(finalAttrs: {
+  pname = "libusbp";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "pololu";
+    repo = "libusbp";
+    rev = finalAttrs.version;
+    hash = "sha256-60xpJ97GlqEcy2+pxGNGPfWDnbIFGoPXJijaErOBXQs=";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    udev
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pololu/libusbp";
+    description = "Pololu USB Library (also known as libusbp)";
+    longDescription = ''
+      libusbp is a cross-platform C library for accessing USB devices
+    '';
+    platforms = platforms.all;
+    license = licenses.cc-by-sa-30;
+    maintainers = with maintainers; [ bzizou ];
+  };
+})
--- a/pkgs/by-name/ne/netop/package.nix
+++ b/pkgs/by-name/ne/netop/package.nix
@ -0,0 +1,28 @@
+{ lib, libpcap, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "netop";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "ZingerLittleBee";
+    repo = "netop";
+    rev = "v${version}";
+    hash = "sha256-Rnp2VNAi8BNbKqkGFoYUb4C5db5BS1P1cqpWlroTmdQ=";
+  };
+
+  LIBPCAP_LIBDIR = lib.makeLibraryPath [ libpcap ];
+  LIBPCAP_VER = libpcap.version;
+
+  cargoHash = "sha256-5vbv4w17DdaTKuF3vQOfv74I8hp2Zpsp40ZlF08qWlc=";
+
+  meta = with lib; {
+    changelog = "https://github.com/ZingerLittleBee/netop/raw/v${version}/CHANGELOG.md";
+    description = "A network monitor using bpf";
+    homepage = "https://github.com/ZingerLittleBee/netop";
+    license = licenses.mit;
+    mainProgram = "netop";
+    maintainers = [ maintainers.marcusramberg ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/nh/nh/package.nix
+++ b/pkgs/by-name/nh/nh/package.nix
@ -1,7 +1,9 @@
-{ lib
+{ stdenv
+, lib
 , rustPlatform
 , installShellFiles
 , makeBinaryWrapper
+, darwin
 , fetchFromGitHub
 , nix-update-script
 , nvd
@ -33,6 +35,8 @@ rustPlatform.buildRustPackage {
    makeBinaryWrapper
  ];

+  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];
+
  preFixup = ''
    mkdir completions
    $out/bin/nh completions --shell bash > completions/nh.bash
--- a/pkgs/by-name/ni/nix-lib-nmd/package.nix
+++ b/pkgs/by-name/ni/nix-lib-nmd/package.nix
@ -1,23 +1,20 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchFromSourcehut }:

 let version = "0.5.0";
 in stdenv.mkDerivation {
  pname = "nix-lib-nmd";
  inherit version;

-  # TODO: Restore when Sourcehut once its back from DDoS attack.
-  # src = fetchFromSourcehut {
-  #   owner = "~rycee";
-  #   repo = "nmd";
-  #   rev = "v${version}";
-  #   hash = "sha256-1glxIg/b+8qr+ZsSsBqZIqGpsYWzRuMyz74/sy765Uk=";
-  # };
-
-  src = fetchurl {
-    url = "https://rycee.net/tarballs/nmd-${version}.tar.gz";
-    hash = "sha256-+65+VYFgnbFGzCyyQytyxVStSZwEP989qi/6EDOdA8A=";
+  src = fetchFromSourcehut {
+    owner = "~rycee";
+    repo = "nmd";
+    rev = "v${version}";
+    hash = "sha256-x3zzcdvhJpodsmdjqB4t5mkVW22V3wqHLOun0KRBzUI=";
  };

+  outputHashMode = "recursive";
+  outputHash = "sha256-7BQmDJBo7rzv0rgfRiUAR3HvKkUHQ6x0umhBRhAAyzM=";
+
  installPhase = ''
    mkdir -v "$out"
    cp -rv * "$out"
--- a/pkgs/by-name/ni/nix-lib-nmt/package.nix
+++ b/pkgs/by-name/ni/nix-lib-nmt/package.nix
@ -1,23 +1,20 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchFromSourcehut }:

-let version = "0.5.0";
+let version = "0.5.1";
 in stdenv.mkDerivation {
  pname = "nix-lib-nmt";
  inherit version;

-  # TODO: Restore when Sourcehut once its back from DDoS attack.
-  # src = fetchFromSourcehut {
-  #   owner = "~rycee";
-  #   repo = "nmt";
-  #   rev = "v${version}";
-  #   hash = "sha256-1glxIg/b+8qr+ZsSsBqZIqGpsYWzRuMyz74/sy765Uk=";
-  # };
-
-  src = fetchurl {
-    url = "https://rycee.net/tarballs/nmt-${version}.tar.gz";
-    hash = "sha256-AO1iLsfZSLbR65tRBsAqJ98CewfSl5yNf7C6XaZj0wM=";
+  src = fetchFromSourcehut {
+    owner = "~rycee";
+    repo = "nmt";
+    rev = "v${version}";
+    hash = "sha256-krVKx3/u1mDo8qe5qylYgmwAmlAPHa1BSPDzxq09FmI=";
  };

+  outputHashMode = "recursive";
+  outputHash = "sha256-N7kGGDDXsXtc1S3Nqw7lCIbnVHtGNNLM1oO+Xe64hSE=";
+
  installPhase = ''
    mkdir -pv "$out"
    cp -rv * "$out"
--- a/pkgs/by-name/ni/nixseparatedebuginfod/package.nix
+++ b/pkgs/by-name/ni/nixseparatedebuginfod/package.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "nixseparatedebuginfod";
-  version = "0.3.2";
+  version = "0.3.3";

  src = fetchFromGitHub {
    owner = "symphorien";
    repo = "nixseparatedebuginfod";
    rev = "v${version}";
-    hash = "sha256-XSEHNoc3h21foVeR28KgfiBTRHyUh+GJ52LMD2xFHfA=";
+    hash = "sha256-KQzMLAl/2JYy+EVBIhUTouOefOX6OCE3iIZONFMQivk=";
  };

-  cargoHash = "sha256-t6W6siHuga/T9kmanA735zH2i9eCOT7vD6v7E5LIp9k=";
+  cargoHash = "sha256-UzPWJfkVLqCuMdNcAfQS38lgtWCO9HhCf5ZCqzWQ6jY=";

  # tests need a working nix install with access to the internet
  doCheck = false;
--- a/pkgs/by-name/ob/obs-do/package.nix
+++ b/pkgs/by-name/ob/obs-do/package.nix
@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "obs-do";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "jonhoo";
+    repo = "obs-do";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-MlBtnRMovnek4dkfO7ocafSgAwIXB5p1FmhNeqfSspA=";
+  };
+
+  cargoHash = "sha256-5EqiDibeWrN45guneN2bxKDXfSz3wDxBNHdl0Km/lpA=";
+
+  meta = with lib; {
+    description = "CLI for common OBS operations while streaming using WebSocket";
+    homepage = "https://github.com/jonhoo/obs-do";
+    license = with licenses; [ asl20 mit ];
+    maintainers = with maintainers; [ GaetanLepage ];
+    mainProgram = "obs-do";
+  };
+}
--- a/pkgs/by-name/po/pololu-tic/package.nix
+++ b/pkgs/by-name/po/pololu-tic/package.nix
@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, libusbp
+, cmake
+, pkg-config
+, qt5
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pololu-tic";
+  version = "1.8.1";
+
+  src = fetchFromGitHub {
+    owner = "pololu";
+    repo = "pololu-tic-software";
+    rev = "refs/tags/${finalAttrs.version}";
+    sha256 = "sha256-C/v5oaC5zZwm+j9CbFaDW+ebzHxPVb8kZLg9c0HyPbc=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    qt5.wrapQtAppsHook
+  ];
+
+  propagatedBuildInputs = [
+    libusbp
+  ];
+
+  buildInputs = [
+    qt5.qtbase
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pololu/pololu-tic-software";
+    description = "Pololu Tic stepper motor controller software";
+    platforms = platforms.all;
+    license = licenses.cc-by-sa-30;
+    maintainers = with maintainers; [ bzizou ];
+  };
+})
--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyprland";
-  version = "1.6.10";
+  version = "1.6.11";
  format = "pyproject";

  disabled = python3Packages.pythonOlder "3.10";
@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
    owner = "hyprland-community";
    repo = "pyprland";
    rev = version;
-    hash = "sha256-1JPEAVfGkIE3pRS1JNQJQXUI4YjtO/M6MpD7Q0pPR3E=";
+    hash = "sha256-intrvN6sPaokcY9If2GZvDaFdDFcHg4hO7LXXu0pLXU=";
  };

  nativeBuildInputs = with python3Packages; [ poetry-core ];
--- a/pkgs/by-name/rm/rmg/package.nix
+++ b/pkgs/by-name/rm/rmg/package.nix
@ -0,0 +1,87 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, boost
+, cmake
+, discord-rpc
+, freetype
+, hidapi
+, libpng
+, libsamplerate
+, minizip
+, nasm
+, pkg-config
+, qt6Packages
+, SDL2
+, speexdsp
+, vulkan-headers
+, vulkan-loader
+, which
+, xdg-user-dirs
+, zlib
+}:
+
+let
+  inherit (qt6Packages) qtbase qtsvg wrapQtAppsHook;
+in
+stdenv.mkDerivation rec {
+  pname = "rmg";
+  version = "0.5.4";
+
+  src = fetchFromGitHub {
+    owner = "Rosalie241";
+    repo = "RMG";
+    rev = "v${version}";
+    hash = "sha256-SAQJKfYoouJ2DLVks6oXiyiOI2/kgmyaHqt/FRfqKjI=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    nasm
+    pkg-config
+    wrapQtAppsHook
+    which
+  ];
+
+  buildInputs = [
+    boost
+    discord-rpc
+    freetype
+    hidapi
+    libpng
+    libsamplerate
+    minizip
+    qtbase
+    qtsvg
+    SDL2
+    speexdsp
+    vulkan-headers
+    vulkan-loader
+    xdg-user-dirs
+    zlib
+  ];
+
+  cmakeFlags = [
+    "-DPORTABLE_INSTALL=OFF"
+    # mupen64plus-input-gca is written in Rust, so we can't build it with
+    # everything else.
+    "-DNO_RUST=ON"
+  ];
+
+  qtWrapperArgs = lib.optionals stdenv.isLinux [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/Rosalie241/RMG";
+    description = "Rosalie's Mupen GUI";
+    longDescription = ''
+      Rosalie's Mupen GUI is a free and open-source mupen64plus front-end
+      written in C++. It offers a simple-to-use user interface.
+    '';
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    mainProgram = "RMG";
+    maintainers = with maintainers; [ slam-bert ];
+  };
+}
--- a/pkgs/by-name/ss/ssh-askpass-fullscreen/package.nix
+++ b/pkgs/by-name/ss/ssh-askpass-fullscreen/package.nix
@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, autoreconfHook
+, fetchFromGitHub
+, gtk2
+, openssh
+, pkg-config
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ssh-askpass-fullscreen";
+  version = "1.3";
+
+  src = fetchFromGitHub {
+    owner = "atj";
+    repo = "ssh-askpass-fullscreen";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-1GER+SxTpbMiYLwFCwLX/hLvzCIqutyvQc9DNJ7d1C0=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    gtk2
+    openssh
+  ];
+
+  strictDeps = true;
+
+  meta = {
+    homepage = "https://github.com/atj/ssh-askpass-fullscreen";
+    broken = stdenv.isDarwin;
+    description = "A small, fullscreen SSH askpass GUI using GTK+2";
+    license = with lib.licenses; [ gpl2Plus ];
+    mainProgram = "ssh-askpass-fullscreen";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/zi/zircolite/package.nix
+++ b/pkgs/by-name/zi/zircolite/package.nix
@ -0,0 +1,60 @@
+{ lib
+, fetchFromGitHub
+, makeWrapper
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "zircolite";
+  version = "2.10.0";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "wagga40";
+    repo = "Zircolite";
+    rev = "refs/tags/${version}";
+    hash = "sha256-r5MIoP+6CnAGsOtK4YLshLBVSZN2NVrwnkuHHDdLZrQ=";
+  };
+
+  __darwinAllowLocalNetworking = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    aiohttp
+    colorama
+    elastic-transport
+    elasticsearch
+    evtx
+    jinja2
+    lxml
+    orjson
+    requests
+    tqdm
+    urllib3
+    xxhash
+  ] ++ elasticsearch.optional-dependencies.async;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share $out/share/zircolite
+    cp -R . $out/share/zircolite
+
+    makeWrapper ${python3.interpreter} $out/bin/zircolite \
+      --set PYTHONPATH "$PYTHONPATH:$out/bin/zircolite.py" \
+      --add-flags "$out/share/zircolite/zircolite.py"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "SIGMA-based detection tool for EVTX, Auditd, Sysmon and other logs";
+    homepage = "https://github.com/wagga40/Zircolite";
+    changelog = "https://github.com/wagga40/Zircolite/releases/tag/${version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/desktops/lxqt/obconf-qt/default.nix
+++ b/pkgs/desktops/lxqt/obconf-qt/default.nix
@ -15,13 +15,13 @@

 mkDerivation rec {
  pname = "obconf-qt";
-  version = "0.16.3";
+  version = "0.16.4";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = pname;
    rev = version;
-    hash = "sha256-ExBcP+j1uf9Y8f6YfZsqyD6YTx1PriS3w8I6qdqQGeE=";
+    hash = "sha256-uF90v56BthEts/Jy+a6kH2b1QFHCtft4ZLxyi/K/Vnc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/open-watcom/v2.nix
+++ b/pkgs/development/compilers/open-watcom/v2.nix
@ -13,13 +13,13 @@
 stdenv.mkDerivation rec {
  pname = "${passthru.prettyName}-unwrapped";
  # nixpkgs-update: no auto update
-  version = "unstable-2023-05-17";
+  version = "unstable-2023-11-24";

  src = fetchFromGitHub {
    owner = "open-watcom";
    repo = "open-watcom-v2";
-    rev = "4053c858ac1f83a186704434bd16b6a6b8f4cf88";
-    sha256 = "sha256-o+cA5kqPow+ERCeWdA3UNKawF+EjuL87lPXUjFT/D1w=";
+    rev = "7976a5c7ca4e856907ccd378c17c71578ad51cb7";
+    hash = "sha256-u9ljy4dZRoXKyUqdolxZijpc99TuhKPPlL6xlV3xJXA=";
  };

  postPatch = ''
@ -47,6 +47,9 @@ stdenv.mkDerivation rec {
    ghostscript
  ];

+  # Work around https://github.com/NixOS/nixpkgs/issues/166205
+  env.NIX_LDFLAGS = lib.optionalString (stdenv.cc.isClang && stdenv.cc.libcxx != null) "-l${stdenv.cc.libcxx.cxxabi.libName}";
+
  configurePhase = ''
    runHook preConfigure

--- a/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
+++ b/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
--- a/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
+++ b/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
--- a/pkgs/development/cuda-modules/cuda-samples/extension.nix
+++ b/pkgs/development/cuda-modules/cuda-samples/extension.nix
--- a/pkgs/development/cuda-modules/cuda-samples/generic.nix
+++ b/pkgs/development/cuda-modules/cuda-samples/generic.nix
--- a/pkgs/development/cuda-modules/saxpy/default.nix
+++ b/pkgs/development/cuda-modules/saxpy/default.nix
@ -16,6 +16,7 @@ let
    libcublas
    setupCudaHook
    ;
+  inherit (lib) getDev getLib getOutput;
 in
 backendStdenv.mkDerivation {
  pname = "saxpy";
@ -36,9 +37,9 @@ backendStdenv.mkDerivation {
  buildInputs =
    lib.optionals (lib.versionOlder cudaVersion "11.4") [cudatoolkit]
    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
-      libcublas.dev
-      libcublas.lib
-      libcublas.static
+      (getDev libcublas)
+      (getLib libcublas)
+      (getOutput "static" libcublas)
      cuda_cudart
    ]
    ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [cuda_cccl];
@ -50,10 +51,11 @@ backendStdenv.mkDerivation {
    ))
  ];

-  meta = {
+  meta = rec {
    description = "A simple (Single-precision AX Plus Y) FindCUDAToolkit.cmake example for testing cross-compilation";
    license = lib.licenses.mit;
    maintainers = lib.teams.cuda.members;
    platforms = lib.platforms.unix;
+    badPlatforms = lib.optionals flags.isJetsonBuild platforms;
  };
 }
--- a/pkgs/development/cuda-modules/setup-hooks/extension.nix
+++ b/pkgs/development/cuda-modules/setup-hooks/extension.nix
@ -53,7 +53,7 @@ final: _: {
  autoAddCudaCompatRunpathHook =
    final.callPackage
      (
-        {makeSetupHook, cuda_compat ? throw "autoAddCudaCompatRunpathHook: No cuda_compat for CUDA ${final.cudaMajorMinorVersion}" }:
+        {makeSetupHook, cuda_compat ? null }:
        makeSetupHook
          {
            name = "auto-add-cuda-compat-runpath-hook";
@ -61,7 +61,12 @@ final: _: {
              # Hotfix Ofborg evaluation
              libcudaPath = if final.flags.isJetsonBuild then "${cuda_compat}/compat" else null;
            };
+
            meta.broken = !final.flags.isJetsonBuild;
+
+            # Pre-cuda_compat CUDA release:
+            meta.badPlatforms = final.lib.optionals (cuda_compat == null) final.lib.platforms.all;
+            meta.platforms = cuda_compat.platforms or [ ];
          }
          ./auto-add-cuda-compat-runpath.sh
      )
--- a/pkgs/development/libraries/kerberos/heimdal-make-missing-headers.patch
+++ b/pkgs/development/libraries/kerberos/heimdal-make-missing-headers.patch
@ -1,10 +0,0 @@
--- a/lib/hx509/Makefile.am 2018-03-21 15:41:38.622968809 +0100
-+++ b/lib/hx509/Makefile.am 2018-03-21 15:41:32.655162197 +0100
-@@ -9,6 +9,8 @@
-	sel-gram.h			\
-	$(gen_files_ocsp:.x=.c)		\
-	$(gen_files_pkcs10:.x=.c)	\
-+	ocsp_asn1.h			\
-+	pkcs10_asn1.h			\
-	hx509_err.c			\
-	hx509_err.h
--- a/pkgs/development/libraries/kerberos/heimdal.nix
+++ b/pkgs/development/libraries/kerberos/heimdal.nix
@ -1,63 +1,138 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, python3, perl, bison, flex
-, texinfo, perlPackages
-, openldap, libcap_ng, sqlite, openssl, db, libedit, pam
-, CoreFoundation, Security, SystemConfiguration
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, python3
+, perl
+, bison
+, flex
+, texinfo
+, perlPackages
+
+, openldap
+, libcap_ng
+, sqlite
+, openssl
+, db
+, libedit
+, pam
+, krb5
+, libmicrohttpd
+, cjson
+
+, CoreFoundation
+, Security
+, SystemConfiguration
+
+, curl
+, jdk
+, unzip
+, which
+
+, nixosTests
+
+, withCJSON ? true
+, withCapNG ? stdenv.isLinux
+# libmicrohttpd should theoretically work for darwin as well, but something is broken.
+# It affects tests check-bx509d and check-httpkadmind.
+, withMicroHTTPD ? stdenv.isLinux
+, withOpenLDAP ? true
+, withOpenLDAPAsHDBModule ? false
+, withOpenSSL ? true
+, withSQLite3 ? true
 }:

-stdenv.mkDerivation rec {
+assert lib.assertMsg (withOpenLDAPAsHDBModule -> withOpenLDAP) ''
+  OpenLDAP needs to be enabled in order to build the OpenLDAP HDB Module.
+'';
+
+stdenv.mkDerivation {
  pname = "heimdal";
-  version = "7.8.0";
+  version = "7.8.0-unstable-2023-11-29";

  src = fetchFromGitHub {
    owner = "heimdal";
    repo = "heimdal";
-    rev = "heimdal-${version}";
-    sha256 = "sha256-iXOaar1S3y0xHdL0S+vS0uxoFQjy43kABxqE+KEhxjU=";
+    rev = "3253c49544eacb33d5ad2f6f919b0696e5aab794";
+    hash = "sha256-uljzQBzXrZCZjcIWfioqHN8YsbUUNy14Vo+A3vZIXzM=";
  };

  outputs = [ "out" "dev" "man" "info" ];

-  patches = [ ./heimdal-make-missing-headers.patch ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    python3
+    perl
+    bison
+    flex
+    texinfo
+  ]
+  ++ (with perlPackages; [ JSON ]);

-  nativeBuildInputs = [ autoreconfHook pkg-config python3 perl bison flex texinfo ]
-    ++ (with perlPackages; [ JSON ]);
-  buildInputs = lib.optionals (stdenv.isLinux) [ libcap_ng ]
-    ++ [ db sqlite openssl libedit openldap pam]
-    ++ lib.optionals (stdenv.isDarwin) [ CoreFoundation Security SystemConfiguration ];
+  buildInputs = [ db libedit pam ]
+    ++ lib.optionals (stdenv.isDarwin) [ CoreFoundation Security SystemConfiguration ]
+    ++ lib.optionals (withCJSON) [ cjson ]
+    ++ lib.optionals (withCapNG) [ libcap_ng ]
+    ++ lib.optionals (withMicroHTTPD) [ libmicrohttpd ]
+    ++ lib.optionals (withOpenLDAP) [ openldap ]
+    ++ lib.optionals (withOpenSSL) [ openssl ]
+    ++ lib.optionals (withSQLite3) [ sqlite ];

-  ## ugly, X should be made an option
-  configureFlags = [
-    "--sysconfdir=/etc"
-    "--localstatedir=/var"
-    "--infodir=$info/share/info"
-    "--enable-hdb-openldap-module"
-    "--with-sqlite3=${sqlite.dev}"
-
-  # ugly, --with-libedit is not enought, it fall back to bundled libedit
-    "--with-libedit-include=${libedit.dev}/include"
-    "--with-libedit-lib=${libedit}/lib"
-    "--with-openssl=${openssl.dev}"
-    "--without-x"
-    "--with-berkeley-db"
-    "--with-berkeley-db-include=${db.dev}/include"
-    "--with-openldap=${openldap.dev}"
-  ] ++ lib.optionals (stdenv.isLinux) [
-    "--with-capng"
+  doCheck = true;
+  nativeCheckInputs = [
+    curl
+    jdk
+    unzip
+    which
  ];

-  postUnpack = ''
-    sed -i '/^DEFAULT_INCLUDES/ s,$, -I..,' source/cf/Makefile.am.common
-    sed -i -e 's/date/date --date="@$SOURCE_DATE_EPOCH"/' source/configure.ac
+  configureFlags = [
+    "--with-libedit-include=${libedit.dev}/include"
+    "--with-libedit-lib=${libedit}/lib"
+    "--with-berkeley-db-include=${db.dev}/include"
+    "--with-berkeley-db"
+
+    "--without-x"
+    "--disable-afs-string-to-key"
+  ] ++ lib.optionals (withCapNG) [
+    "--with-capng"
+  ] ++ lib.optionals (withCJSON) [
+    "--with-cjson=${cjson}"
+  ] ++ lib.optionals (withOpenLDAP) [
+    "--with-openldap=${openldap.dev}"
+  ] ++ lib.optionals (withOpenLDAPAsHDBModule) [
+    "--enable-hdb-openldap-module"
+  ] ++ lib.optionals (withSQLite3) [
+    "--with-sqlite3=${sqlite.dev}"
+  ];
+
+  # (check-ldap) slapd resides within ${openldap}/libexec,
+  #              which is not part of $PATH by default.
+  # (check-ldap) prepending ${openldap}/bin to the path to avoid
+  #              using the default installation of openldap on unsandboxed darwin systems,
+  #              which does not support the new mdb backend at the moment (2024-01-13).
+  # (check-ldap) the bdb backend got deprecated in favour of mdb in openldap 2.5.0,
+  #              but the heimdal tests still seem to expect bdb as the openldap backend.
+  #              This might be fixed upstream in a future update.
+  patchPhase = ''
+    runHook prePatch
+
+    substituteInPlace tests/ldap/slapd-init.in \
+      --replace 'SCHEMA_PATHS="' 'SCHEMA_PATHS="${openldap}/etc/schema '
+    substituteInPlace tests/ldap/check-ldap.in \
+      --replace 'PATH=' 'PATH=${openldap}/libexec:${openldap}/bin:'
+    substituteInPlace tests/ldap/slapd.conf \
+      --replace 'database	bdb' 'database mdb'
+
+    runHook postPatch
  '';

-  preConfigure = ''
-    configureFlagsArray+=(
-      "--bindir=$out/bin"
-      "--sbindir=$out/sbin"
-      "--libexecdir=$out/libexec/heimdal"
-      "--mandir=$man/share/man"
-      "--infodir=$man/share/info"
-      "--includedir=$dev/include")
+  # (test_cc) heimdal uses librokens implementation of `secure_getenv` on darwin,
+  #           which expects either USER or LOGNAME to be set.
+  preCheck = lib.optionalString (stdenv.isDarwin) ''
+    export USER=nix-builder
  '';

  # We need to build hcrypt for applications like samba
@ -71,15 +146,12 @@ stdenv.mkDerivation rec {
    (cd include/hcrypto; make -j $NIX_BUILD_CORES install)
    (cd lib/hcrypto; make -j $NIX_BUILD_CORES install)

-    # Do we need it?
-    rm $out/bin/su
-
    mkdir -p $dev/bin
    mv $out/bin/krb5-config $dev/bin/

    # asn1 compilers, move them to $dev
-    mv $out/libexec/heimdal/heimdal/* $dev/bin
-    rmdir $out/libexec/heimdal/heimdal
+    mv $out/libexec/heimdal/* $dev/bin
+    rmdir $out/libexec/heimdal

    # compile_et is needed for cross-compiling this package and samba
    mv lib/com_err/.libs/compile_et $dev/bin
@ -90,11 +162,17 @@ stdenv.mkDerivation rec {
  #  hx_locl.h:67:25: fatal error: pkcs10_asn1.h: No such file or directory
  #enableParallelBuilding = true;

+  passthru = {
+    implementation = "heimdal";
+    tests.nixos = nixosTests.kerberos.heimdal;
+  };
+
  meta = with lib; {
+    homepage = "https://www.heimdal.software";
+    changelog = "https://github.com/heimdal/heimdal/releases";
    description = "An implementation of Kerberos 5 (and some more stuff)";
    license = licenses.bsd3;
    platforms = platforms.unix;
+    maintainers = with maintainers; [ h7x4 ];
  };
-
-  passthru.implementation = "heimdal";
 }
--- a/pkgs/development/libraries/librealsense/default.nix
+++ b/pkgs/development/libraries/librealsense/default.nix
@ -44,6 +44,12 @@ stdenv.mkDerivation rec {
  patches = [
    ./py_pybind11_no_external_download.patch
    ./install-presets.patch
+    # https://github.com/IntelRealSense/librealsense/pull/11917
+    (fetchpatch {
+      name = "fix-gcc13-missing-cstdint.patch";
+      url = "https://github.com/IntelRealSense/librealsense/commit/b59b13671658910fc453a4a6bbd61f13ba6e83cc.patch";
+      hash = "sha256-zaW8HG8rfsApI5S/3x+x9Fx8xhyTIPNn/fJVFtkmlEA=";
+    })
  ];

  nativeBuildInputs = [
--- a/pkgs/development/libraries/opendht/default.nix
+++ b/pkgs/development/libraries/opendht/default.nix
@ -7,7 +7,7 @@
 , asio
 , nettle
 , gnutls
-, msgpack
+, msgpack-cxx
 , readline
 , libargon2
 , jsoncpp
@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
    fmt
    nettle
    gnutls
-    msgpack
+    msgpack-cxx
    readline
    libargon2
  ] ++ lib.optionals enableProxyServerAndClient [
--- a/pkgs/development/libraries/qmltermwidget/default.nix
+++ b/pkgs/development/libraries/qmltermwidget/default.nix
@ -38,6 +38,14 @@ stdenv.mkDerivation {
      hash = "sha256-1GjC2mdfP3NpePDWZaT8zvIq3vwWIZs+iQ9o01iQtD4=";
    })

+    # A fix to the above series of patches, to fix a crash in lomiri-terminal-app
+    # Remove (and update the above fetchpatch) when https://github.com/gber/qmltermwidget/pull/1 merged
+    (fetchpatch {
+      name = "0002-qmltermwidget-Mark-ColorSchemeManager-singleton-as-C++-owned.patch";
+      url = "https://github.com/gber/qmltermwidget/commit/f3050bda066575eebdcff70fc1c3a393799e1d6d.patch";
+      hash = "sha256-O8fEpVLYMze6q4ps7RDGbNukRmZZBjLwqmvRqpp+H+Y=";
+    })
+
    # Some files are copied twice to the output which makes the build fails
    ./do-not-copy-artifacts-twice.patch
  ];
--- a/pkgs/development/lisp-modules/nix-cl.nix
+++ b/pkgs/development/lisp-modules/nix-cl.nix
@ -145,7 +145,7 @@ let
      ...
    } @ args:

-    stdenv.mkDerivation (rec {
+    (stdenv.mkDerivation (rec {
      inherit
        version nativeLibs javaLibs lispLibs systems asds
        pkg program flags faslExt
@ -226,7 +226,14 @@ let
      meta = (args.meta or {}) // {
        maintainers = args.meta.maintainers or lib.teams.lisp.members;
      };
-    })));
+    })) // {
+      # Useful for overriding
+      # Overriding code would prefer to use pname from the attribute set
+      # However, pname is extended with the implementation name
+      # Moreover, it is used in the default list of systems to load
+      # So we pass the original pname
+      pname = args.pname;
+    }));

  # Build the set of lisp packages using `lisp`
  # These packages are defined manually for one reason or another:
--- a/pkgs/development/python-modules/agate/default.nix
+++ b/pkgs/development/python-modules/agate/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "agate";
-  version = "1.7.1";
+  version = "1.9.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "wireservice";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-7Ew9bgeheymCL8xXSW5li0LdFvGYb/7gPxmC4w6tHvM=";
+    hash = "sha256-I7jvZA/m06kUuUcfglySaroDbJ5wbgiF2lb84EFPmpw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aiosql/default.nix
+++ b/pkgs/development/python-modules/aiosql/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "aiosql";
-  version = "9.1";
+  version = "9.2";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "nackjicholson";
    repo = "aiosql";
    rev = "refs/tags/${version}";
-    hash = "sha256-xcrNnp3ZfWLbz+/77N3R5x7N2n7nPcw0khqaIeHn0+Y=";
+    hash = "sha256-x8ndLVIYAmixH4Fc1DIC1CK8ChYIPZc3b5VFdpT7JO8=";
  };

  sphinxRoot = "docs/source";
@ -48,7 +48,9 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [ "aiosql" ];
+  pythonImportsCheck = [
+    "aiosql"
+  ];

  meta = with lib; {
    description = "Simple SQL in Python";
--- a/pkgs/development/python-modules/ansible/core.nix
+++ b/pkgs/development/python-modules/ansible/core.nix
@ -28,11 +28,11 @@

 buildPythonPackage rec {
  pname = "ansible-core";
-  version = "2.15.5";
+  version = "2.16.2";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-jMU5y41DSa8//ZAccHIvenogOuZCfdrJX/31RqbkFgI=";
+    hash = "sha256-5KtVnn5SWxxvmQhPyoc7sBR3XV7L6EW3wHuOnWycBIs=";
  };

  # ansible_connection is already wrapped, so don't pass it through
--- a/pkgs/development/python-modules/asyncsleepiq/default.nix
+++ b/pkgs/development/python-modules/asyncsleepiq/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "asyncsleepiq";
-  version = "1.4.1";
+  version = "1.4.2";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-FDGNRBa45Q/L8468C3mZLEPduo9EpHWczO5z3Fe7Nwc=";
+    hash = "sha256-zvIEuPsko2CaImcdY55qwl+rAzrRT8gjLAovlpOR8Gk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/bokeh/default.nix
+++ b/pkgs/development/python-modules/bokeh/default.nix
@ -48,14 +48,14 @@
 buildPythonPackage rec {
  pname = "bokeh";
  # update together with panel which is not straightforward
-  version = "3.3.2";
+  version = "3.3.3";
  format = "pyproject";

  disabled = pythonOlder "3.9";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-rhgPhvd2Ul9+uBZzofJ+DrVoh9czdxZixRLsDYKkM/U=";
+    hash = "sha256-bs5vACY/LSBDok6vnbdab4YO/Ioflt9mMYb+PrJpLdM=";
  };

  src_test = fetchFromGitHub {
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@ -365,14 +365,14 @@

 buildPythonPackage rec {
  pname = "boto3-stubs";
-  version = "1.34.18";
+  version = "1.34.19";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-6U+2eed5mRbhWekT9J3VyCRw3x0eVmx7Uj9wPi7VzsE=";
+    hash = "sha256-Z/5aL7HRssU0+jHFQ7dz7bwBzpUoAQ2cwO+cUESqIYo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.34.18";
+  version = "1.34.19";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-xa+muzfKidf72yEJE5AxSFZqDyxg2a6hJW3adnIPF3E=";
+    hash = "sha256-3Rv/db/gpk5nBKjXToD5Shl41YyygQ91Sfocg6yORYw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/clarabel/Cargo.lock
+++ b/pkgs/development/python-modules/clarabel/Cargo.lock
--- a/pkgs/development/python-modules/clarabel/default.nix
+++ b/pkgs/development/python-modules/clarabel/default.nix
@ -0,0 +1,62 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, rustPlatform
+, libiconv
+, numpy
+, scipy
+}:
+
+buildPythonPackage rec {
+  pname = "clarabel";
+  version = "0.6.0.post1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "oxfordcontrol";
+    repo  = "Clarabel.rs";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5Mw+3WRMuz3BxLWRdsnXHjetsNrM3EZRZld8lVTNKgo=";
+  };
+
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    ln -s ${./Cargo.lock} ./Cargo.lock
+  '';
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ];
+
+  buildInputs = lib.optional stdenv.isDarwin libiconv;
+
+  propagatedBuildInputs = [
+    numpy
+    scipy
+  ];
+
+  pythonImportsCheck = [
+    "clarabel"
+  ];
+
+  # no tests but run the same examples as .github/workflows/pypi.yaml
+  checkPhase = ''
+    runHook preCheck
+    python examples/python/example_sdp.py
+    python examples/python/example_qp.py
+    runHook postCheck
+  '';
+
+  meta = {
+    changelog = "https://github.com/oxfordcontrol/Clarabel.rs/releases/tag/v${version}/CHANGELOG.md";
+    description = "Conic Interior Point Solver";
+    homepage = "https://github.com/oxfordcontrol/Clarabel.rs";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ a-n-n-a-l-e-e ];
+  };
+}
--- a/pkgs/development/python-modules/cvxpy/default.nix
+++ b/pkgs/development/python-modules/cvxpy/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , buildPythonPackage
+, clarabel
 , cvxopt
 , ecos
 , fetchPypi
@ -40,6 +41,7 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
+    clarabel
    cvxopt
    ecos
    numpy
--- a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-datacatalog";
-  version = "3.17.0";
+  version = "3.17.2";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-xaKBfkgmhB7MH1qFWu9hjHIIVG1BjBgzjfnyD14V9Z0=";
+    hash = "sha256-kKRuakMZfmt2HrU7g4Ap1ZxFmYYSiRNKvRB/xHkyp1U=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, deprecated
 , fetchPypi
 , google-api-core
 , google-cloud-core
@ -13,21 +14,27 @@
 , pytestCheckHook
 , pythonOlder
 , sqlparse
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "google-cloud-spanner";
-  version = "3.40.1";
-  format = "setuptools";
+  version = "3.41.0";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-YWsHyGza5seLrSe4qznYznonNRHyuR/iYPFw2SZlPC4=";
+    hash = "sha256-jK2hHdYdxwsEmk/aDp7ArXZwZbhEloqIuLJ2ZwMs9YI=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
+    deprecated
    google-api-core
    google-cloud-core
    grpc-google-iam-v1
--- a/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
+++ b/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-texttospeech";
-  version = "2.15.0";
+  version = "2.15.1";
  format = "setuptools";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-d4Y+1U94/NLhlMoRPJzF5+QLhzBszsG6MH5G3PgfBzc=";
+    hash = "sha256-R4ReOtnO/auvNYlHyxlt3eovqkzfyvhkoBHbghpN6vs=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/ics/default.nix
+++ b/pkgs/development/python-modules/ics/default.nix
@ -1,17 +1,20 @@
 { lib
+, arrow
+, attrs
 , buildPythonPackage
 , fetchFromGitHub
-, pythonOlder
-, tatsu
-, arrow
-, pytestCheckHook
 , pytest-flakes
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, tatsu
 }:

 buildPythonPackage rec {
  pname = "ics";
  version = "0.7.2";
-  format = "setuptools";
+  pyproject = true;
+
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
@ -21,7 +24,12 @@ buildPythonPackage rec {
    hash = "sha256-hdtnET7YfSb85+TGwpwzoxOfxPT7VSj9eKSiV6AXUS8=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
+    attrs
    arrow
    tatsu
  ];
@ -45,7 +53,9 @@ buildPythonPackage rec {
    "test_many_lines"
  ];

-  pythonImportsCheck = [ "ics" ];
+  pythonImportsCheck = [
+    "ics"
+  ];

  meta = with lib; {
    description = "Pythonic and easy iCalendar library (RFC 5545)";
@ -53,7 +63,7 @@ buildPythonPackage rec {
      Ics.py is a pythonic and easy iCalendar library. Its goals are to read and
      write ics data in a developer friendly way.
    '';
-    homepage = "http://icspy.readthedocs.org/en/stable/";
+    homepage = "http://icspy.readthedocs.org/";
    changelog = "https://github.com/ics-py/ics-py/releases/tag/v${version}";
    license = licenses.asl20;
    maintainers = with maintainers; [ ];
--- a/pkgs/development/python-modules/iterative-telemetry/default.nix
+++ b/pkgs/development/python-modules/iterative-telemetry/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "iterative-telemtry";
-  version = "0.0.7";
+  version = "0.0.8";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = "telemetry-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-n67nc9a/Qrz2v1EYbHZb+pGhuMDqofUMpgfD/0BwqLM=";
+    hash = "sha256-jD1AyQTdz/NfTRpvEuTE/gUfgNIhNlnimuCks5ImhwA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/langchain-community/default.nix
+++ b/pkgs/development/python-modules/langchain-community/default.nix
@ -0,0 +1,64 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, poetry-core
+, pythonOlder
+, aiohttp
+, dataclasses-json
+, langchain-core
+, langsmith
+, numpy
+, pyyaml
+, requests
+, sqlalchemy
+, tenacity
+, typer
+}:
+
+buildPythonPackage rec {
+  pname = "langchain-community";
+  version = "0.0.12";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    pname = "langchain_community";
+    inherit version;
+    hash = "sha256-fP42xSsfuGwQldTewM9Gahx1KnRGEE6LOc8PcFEqSFE=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    dataclasses-json
+    langchain-core
+    langsmith
+    numpy
+    pyyaml
+    requests
+    sqlalchemy
+    tenacity
+  ];
+
+  passthru.optional-dependencies = {
+    cli = [
+      typer
+    ];
+  };
+
+  pythonImportsCheck = [ "langchain_community" ];
+
+  # PyPI source does not have tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Community contributed LangChain integrations";
+    homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/community";
+    license = licenses.mit;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, poetry-core
+, anyio
+, jsonpatch
+, langsmith
+, packaging
+, pydantic
+, pyyaml
+, requests
+, tenacity
+}:
+
+buildPythonPackage rec {
+  pname = "langchain-core";
+  version = "0.1.10";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    pname = "langchain_core";
+    inherit version;
+    hash = "sha256-PJ4TgyZMEC/Mb4ZXANu5QWxJMaJdCsIZX2MRxrhnqhc=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    anyio
+    jsonpatch
+    langsmith
+    packaging
+    pydantic
+    pyyaml
+    requests
+    tenacity
+  ];
+
+  pythonImportsCheck = [ "langchain_core" ];
+
+  # PyPI source does not have tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Building applications with LLMs through composability";
+    homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/core";
+    license = licenses.mit;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@ -6,11 +6,12 @@
 , pythonRelaxDepsHook
 , poetry-core
 , aiohttp
-, anyio
 , async-timeout
 , dataclasses-json
 , jsonpatch
 , langsmith
+, langchain-core
+, langchain-community
 , numpy
 , pydantic
 , pyyaml
@ -18,60 +19,27 @@
 , sqlalchemy
 , tenacity
  # optional dependencies
-, atlassian-python-api
 , azure-core
 , azure-cosmos
 , azure-identity
-, beautifulsoup4
 , chardet
 , clarifai
 , cohere
-, duckduckgo-search
-, elasticsearch
 , esprima
-, faiss
-, google-api-python-client
-, google-auth
-, google-search-results
-, gptcache
-, html2text
 , huggingface-hub
-, jinja2
-, jq
 , lark
-, librosa
-, lxml
 , manifest-ml
-, neo4j
-, networkx
 , nlpcloud
-, nltk
 , openai
-, opensearch-py
-, pdfminer-six
-, pgvector
-, pinecone-client
-, psycopg2
-, pymongo
-, pyowm
-, pypdf
-, pytesseract
-, python-arango
 , qdrant-client
-, rdflib
-, redis
-, requests-toolbelt
 , sentence-transformers
 , tiktoken
 , torch
 , transformers
 , typer
-, weaviate-client
-, wikipedia
  # test dependencies
 , freezegun
 , pandas
-, pexpect
 , pytest-asyncio
 , pytest-mock
 , pytest-socket
@ -84,16 +52,16 @@

 buildPythonPackage rec {
  pname = "langchain";
-  version = "0.0.344";
+  version = "0.1.0";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
-    owner = "hwchase17";
+    owner = "langchain-ai";
    repo = "langchain";
    rev = "refs/tags/v${version}";
-    hash = "sha256-pvoY2QuGTZhqeCi9oLOH1XrxfT4FMfHwNkIGIaYTEo8=";
+    hash = "sha256-izaSah1S0INsskdzE9b7Iw4yWBsNmN5fBI6BQgaHgE4=";
  };

  sourceRoot = "${src.name}/libs/langchain";
@ -108,17 +76,18 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
+    langchain-core
+    langchain-community
    pydantic
    sqlalchemy
    requests
    pyyaml
    numpy
-    dataclasses-json
-    tenacity
    aiohttp
-    langsmith
-    anyio
+    tenacity
    jsonpatch
+    dataclasses-json
+    langsmith
  ] ++ lib.optionals (pythonOlder "3.11") [
    async-timeout
  ];
@ -169,81 +138,9 @@ buildPythonPackage rec {
      # azure-ai-vision
      # azure-cognitiveservices-speech
      # azure-search-documents
+      # azure-ai-textanalytics
    ];
    all = [
-      clarifai
-      cohere
-      openai
-      nlpcloud
-      huggingface-hub
-      manifest-ml
-      elasticsearch
-      opensearch-py
-      google-search-results
-      faiss
-      sentence-transformers
-      transformers
-      nltk
-      wikipedia
-      beautifulsoup4
-      tiktoken
-      torch
-      jinja2
-      pinecone-client
-      # pinecone-text
-      # marqo
-      pymongo
-      weaviate-client
-      redis
-      google-api-python-client
-      google-auth
-      # wolframalpha
-      qdrant-client
-      # tensorflow-text
-      pypdf
-      networkx
-      # nomic
-      # aleph-alpha-client
-      # deeplake
-      # libdeeplake
-      pgvector
-      psycopg2
-      pyowm
-      pytesseract
-      html2text
-      atlassian-python-api
-      gptcache
-      duckduckgo-search
-      # arxiv
-      azure-identity
-      # clickhouse-connect
-      azure-cosmos
-      # lancedb
-      # langkit
-      lark
-      pexpect
-      # pyvespa
-      # O365
-      jq
-      # docarray
-      pdfminer-six
-      lxml
-      requests-toolbelt
-      neo4j
-      # openlm
-      # azure-ai-formrecognizer
-      # azure-ai-vision
-      # azure-cognitiveservices-speech
-      # momento
-      # singlestoredb
-      # tigrisdb
-      # nebula3-python
-      # awadb
-      esprima
-      rdflib
-      # amadeus
-      librosa
-      python-arango
    ];
    cli = [
      typer
@ -277,6 +174,9 @@ buildPythonPackage rec {

    # these tests have network access
    "test_socket_disabled"
+
+    # this test may require a specific version of langchain-community
+    "test_compatible_vectorstore_documentation"
  ];

  pythonImportsCheck = [
@ -285,8 +185,8 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Building applications with LLMs through composability";
-    homepage = "https://github.com/hwchase17/langchain";
-    changelog = "https://github.com/hwchase17/langchain/releases/tag/v${version}";
+    homepage = "https://github.com/langchain-ai/langchain";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ natsukium ];
  };
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@ -12,8 +12,8 @@

 buildPythonPackage rec {
  pname = "langsmith";
-  version = "0.0.75";
-  format = "pyproject";
+  version = "0.0.80";
+  pyproject = true;

  disabled = pythonOlder "3.8";

@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "langchain-ai";
    repo = "langsmith-sdk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-BbDB3xP3OCRXxbOqFIzFNrpK5+wHbIZ/VlurNXrXpTw=";
+    hash = "sha256-YFXwM/YiQJzJ1Nf76kuq3WtFhU6dUIHzK4K33+VO/lQ=";
  };

  sourceRoot = "${src.name}/python";
@ -49,6 +49,8 @@ buildPythonPackage rec {
    "test_as_runnable_batch"
    "test_as_runnable_async"
    "test_as_runnable_async_batch"
+    # requires git repo
+    "test_git_info"
  ];

  disabledTestPaths = [
--- a/pkgs/development/python-modules/ledgercomm/default.nix
+++ b/pkgs/development/python-modules/ledgercomm/default.nix
@ -7,12 +7,12 @@

 buildPythonPackage rec {
  pname = "ledgercomm";
-  version = "1.2.0";
+  version = "1.2.1";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-HunJjIRa3IpSL/3pZPf6CroLxEK/l7ihh737VOAILgU=";
+    hash = "sha256-AVz8BfFrjFn4zB2fwLiTWSPx/MOAbTPutrDgVbRPWpE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/librouteros/default.nix
+++ b/pkgs/development/python-modules/librouteros/default.nix
@ -1,25 +1,30 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, isPy3k
-, pytestCheckHook
 , pytest-xdist
+, pytestCheckHook
+, pythonOlder
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "librouteros";
  version = "3.2.1";
-  format = "setuptools";
+  pyproject = true;

-  disabled = !isPy3k;
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "luqasz";
-    repo = pname;
-    rev = version;
+    repo = "librouteros";
+    rev = "refs/tags/${version}";
    hash = "sha256-VwpZ1RY6Sul7xvWY7ZoOxZ7KgbRmKRwcVdF9e2b3f6Q=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  nativeCheckInputs = [
    pytest-xdist
    pytestCheckHook
@ -33,6 +38,8 @@ buildPythonPackage rec {
    "test_add_then_remove"
    "test_add_then_update"
    "test_generator_ditch"
+    # AttributeError: 'called_once_with' is not a valid assertion
+    "test_rawCmd_calls_writeSentence"
  ];

  pythonImportsCheck = [
@ -42,6 +49,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python implementation of the MikroTik RouterOS API";
    homepage = "https://librouteros.readthedocs.io/";
+    changelog = "https://github.com/luqasz/librouteros/blob/${version}/CHANGELOG.rst";
    license = with licenses; [ gpl2Only ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/locationsharinglib/default.nix
+++ b/pkgs/development/python-modules/locationsharinglib/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "locationsharinglib";
-  version = "5.0.2";
+  version = "5.0.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ydwtcIJ2trQ6xg2r5kU/ogvjdBwUZhYhBdc6nBmSGcg=";
+    hash = "sha256-ar5/gyDnby0aceqqHe8lTQaHafOub+IPKglmct4xEGM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/logging-journald/default.nix
+++ b/pkgs/development/python-modules/logging-journald/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "logging-journald";
-  version = "0.6.5";
+  version = "0.6.7";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "mosquito";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-EyKXc/Qr9mRFngDqbCPNVs/0eD9OCbQq0FbymA6kpLQ=";
+    hash = "sha256-RQ9opkAOZfhYuqOXJ2Mtnig8soL+lCveYH2YdXL1AGM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/mkdocs-macros/default.nix
+++ b/pkgs/development/python-modules/mkdocs-macros/default.nix
@ -15,11 +15,11 @@

 buildPythonPackage rec {
  pname = "mkdocs-macros-plugin";
-  version = "0.7.0";
+  version = "1.0.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256:0206cm0153vzp10c8a15bi2znisq5pv59zi9vrcm74pnpk5f2r4y";
+    sha256 = "sha256-/jSNdfAckR82K22ZjFez2FtQWHbd5p25JPLFEsOVwyg=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/mpd2/default.nix
+++ b/pkgs/development/python-modules/mpd2/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "python-mpd2";
-  version = "3.1.0";
+  version = "3.1.1";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-8zws2w1rqnSjZyTzjBxKCZp84sjsSiu3GSFQpYVd9HY=";
+    hash = "sha256-S67DWEzEPtmUjVVZB5+vwmebBrKt4nPpCbNYJlSys/U=";
  };

  passthru.optional-dependencies = {
--- a/pkgs/development/python-modules/nose-warnings-filters/default.nix
+++ b/pkgs/development/python-modules/nose-warnings-filters/default.nix
@ -6,12 +6,13 @@
 }:

 buildPythonPackage rec {
-  pname = "nose_warnings_filters";
+  pname = "nose-warnings-filters";
  version = "0.1.5";
  format = "setuptools";

  src = fetchPypi {
-    inherit pname version;
+    pname = "nose_warnings_filters";
+    inherit version;
    sha256 = "17dvfqfy2fm7a5cmiffw2dc3064kpx72fn5mlw01skm2rhn5nv25";
  };

--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@ -26,7 +26,7 @@

 buildPythonPackage rec {
  pname = "openai";
-  version = "1.6.1";
+  version = "1.7.1";
  pyproject = true;


@ -36,7 +36,7 @@ buildPythonPackage rec {
    owner = "openai";
    repo = "openai-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-w5jj2XWTAbiu64NerLvDyGe9PybeE/WHkukoWT97SJE=";
+    hash = "sha256-NXZ+7gDA3gMGSrmgceHxcR45LrXdazXbYuhcoUsNXew=";
  };

  nativeBuildInputs = [
--- a/Show More
+++ b/Show More