Merge master into haskell-updates

2023-03-22 00:11:17 +00:00 · 2023-03-22 00:11:17 +00:00 · e6ecd31572
commit e6ecd31572
parent b432f75897 6664a6b76e
143 changed files with 4139 additions and 3747 deletions
--- a/doc/languages-frameworks/beam.section.md
+++ b/doc/languages-frameworks/beam.section.md
@ -14,7 +14,7 @@ nixpkgs follows the [official elixir deprecation schedule](https://hexdocs.pm/el

 All BEAM-related expressions are available via the top-level `beam` attribute, which includes:

- `interpreters`: a set of compilers running on the BEAM, including multiple Erlang/OTP versions (`beam.interpreters.erlangR22`, etc), Elixir (`beam.interpreters.elixir`) and LFE (Lisp Flavoured Erlang) (`beam.interpreters.lfe`).
+- `interpreters`: a set of compilers running on the BEAM, including multiple Erlang/OTP versions (`beam.interpreters.erlang_22`, etc), Elixir (`beam.interpreters.elixir`) and LFE (Lisp Flavoured Erlang) (`beam.interpreters.lfe`).

 - `packages`: a set of package builders (Mix and rebar3), each compiled with a specific Erlang/OTP version, e.g. `beam.packages.erlang22`.

@ -22,7 +22,7 @@ The default Erlang compiler, defined by `beam.interpreters.erlang`, is aliased a

 To create a package builder built with a custom Erlang version, use the lambda, `beam.packagesWith`, which accepts an Erlang/OTP derivation and produces a package builder similar to `beam.packages.erlang`.

-Many Erlang/OTP distributions available in `beam.interpreters` have versions with ODBC and/or Java enabled or without wx (no observer support). For example, there's `beam.interpreters.erlangR22_odbc_javac`, which corresponds to `beam.interpreters.erlangR22` and `beam.interpreters.erlangR22_nox`, which corresponds to `beam.interpreters.erlangR22`.
+Many Erlang/OTP distributions available in `beam.interpreters` have versions with ODBC and/or Java enabled or without wx (no observer support). For example, there's `beam.interpreters.erlang_22_odbc_javac`, which corresponds to `beam.interpreters.erlang_22` and `beam.interpreters.erlang_22_nox`, which corresponds to `beam.interpreters.erlang_22`.

 ## Build Tools {#build-tools}

@ -154,7 +154,7 @@ Here is how your `default.nix` file would look for a phoenix project.
 with import <nixpkgs> { };

 let
-  # beam.interpreters.erlangR23 is available if you need a particular version
+  # beam.interpreters.erlang_23 is available if you need a particular version
  packages = beam.packagesWith beam.interpreters.erlang;

  pname = "your_project";
@ -274,7 +274,7 @@ Usually, we need to create a `shell.nix` file and do our development inside of t

 with pkgs;
 let
-  elixir = beam.packages.erlangR24.elixir_1_12;
+  elixir = beam.packages.erlang_24.elixir_1_12;
 in
 mkShell {
  buildInputs = [ elixir ];
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@ -380,39 +380,107 @@ Values inside it are not passed to the builder, so you can change them without t

 #### `passthru.updateScript` {#var-passthru-updateScript}

-A script to be run by `maintainers/scripts/update.nix` when the package is matched. It needs to be an executable file, either on the file system:
+A script to be run by `maintainers/scripts/update.nix` when the package is matched. The attribute can contain one of the following:

-```nix
-passthru.updateScript = ./update.sh;
-```
+- []{#var-passthru-updateScript-command} an executable file, either on the file system:

-or inside the expression itself:
+  ```nix
+  passthru.updateScript = ./update.sh;
+  ```

-```nix
-passthru.updateScript = writeScript "update-zoom-us" ''
-  #!/usr/bin/env nix-shell
-  #!nix-shell -i bash -p curl pcre common-updater-scripts
+  or inside the expression itself:

-  set -eu -o pipefail
+  ```nix
+  passthru.updateScript = writeScript "update-zoom-us" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl pcre common-updater-scripts

-  version="$(curl -sI https://zoom.us/client/latest/zoom_x86_64.tar.xz | grep -Fi 'Location:' | pcregrep -o1 '/(([0-9]\.?)+)/')"
-  update-source-version zoom-us "$version"
-'';
-```
+    set -eu -o pipefail

-The attribute can also contain a list, a script followed by arguments to be passed to it:
+    version="$(curl -sI https://zoom.us/client/latest/zoom_x86_64.tar.xz | grep -Fi 'Location:' | pcregrep -o1 '/(([0-9]\.?)+)/')"
+    update-source-version zoom-us "$version"
+  '';
+  ```

-```nix
-passthru.updateScript = [ ../../update.sh pname "--requested-release=unstable" ];
-```
+- a list, a script followed by arguments to be passed to it:

-The script will be run with the `UPDATE_NIX_NAME`, `UPDATE_NIX_PNAME`, `UPDATE_NIX_OLD_VERSION` and `UPDATE_NIX_ATTR_PATH` environment variables set respectively to the name, pname, old version and attribute path of the package it is supposed to update.
+  ```nix
+  passthru.updateScript = [ ../../update.sh pname "--requested-release=unstable" ];
+  ```
+
+- an attribute set containing:
+  - [`command`]{#var-passthru-updateScript-set-command} – a string or list in the [format expected by `passthru.updateScript`](#var-passthru-updateScript-command).
+  - [`attrPath`]{#var-passthru-updateScript-set-attrPath} (optional) – a string containing the canonical attribute path for the package. If present, it will be passed to the update script instead of the attribute path on which the package was discovered during Nixpkgs traversal.
+  - [`supportedFeatures`]{#var-passthru-updateScript-set-supportedFeatures} (optional) – a list of the [extra features](#var-passthru-updateScript-supported-features) the script supports.
+
+  ```nix
+  passthru.updateScript = {
+    command = [ ../../update.sh pname ];
+    attrPath = pname;
+    supportedFeatures = [ … ];
+  };
+  ```
+
+##### How update scripts are executed? {#var-passthru-updateScript-execution}
+
+Update scripts are to be invoked by `maintainers/scripts/update.nix` script. You can run `nix-shell maintainers/scripts/update.nix` in the root of Nixpkgs repository for information on how to use it. `update.nix` offers several modes for selecting packages to update (e.g. select by attribute path, traverse Nixpkgs and filter by maintainer, etc.), and it will execute update scripts for all matched packages that have an `updateScript` attribute.
+
+Each update script will be passed the following environment variables:
+
+- [`UPDATE_NIX_NAME`]{#var-passthru-updateScript-env-UPDATE_NIX_NAME} – content of the `name` attribute of the updated package.
+- [`UPDATE_NIX_PNAME`]{#var-passthru-updateScript-env-UPDATE_NIX_PNAME} – content of the `pname` attribute of the updated package.
+- [`UPDATE_NIX_OLD_VERSION`]{#var-passthru-updateScript-env-UPDATE_NIX_OLD_VERSION} – content of the `version` attribute of the updated package.
+- [`UPDATE_NIX_ATTR_PATH`]{#var-passthru-updateScript-env-UPDATE_NIX_ATTR_PATH} – attribute path the `update.nix` discovered the package on (or the [canonical `attrPath`](#var-passthru-updateScript-set-attrPath) when available). Example: `pantheon.elementary-terminal`

 ::: {.note}
-The script will be usually run from the root of the Nixpkgs repository but you should not rely on that. Also note that the update scripts will be run in parallel by default; you should avoid running `git commit` or any other commands that cannot handle that.
+An update script will be usually run from the root of the Nixpkgs repository but you should not rely on that. Also note that `update.nix` executes update scripts in parallel by default so you should avoid running `git commit` or any other commands that cannot handle that.
 :::

-For information about how to run the updates, execute `nix-shell maintainers/scripts/update.nix`.
+::: {.tip}
+While update scripts should not create commits themselves, `maintainers/scripts/update.nix` supports automatically creating commits when running it with `--argstr commit true`. If you need to customize commit message, you can have the update script implement [`commit`](#var-passthru-updateScript-commit) feature.
+:::
+
+##### Supported features {#var-passthru-updateScript-supported-features}
+###### `commit` {#var-passthru-updateScript-commit}
+
+This feature allows update scripts to *ask* `update.nix` to create Git commits.
+
+When support of this feature is declared, whenever the update script exits with `0` return status, it is expected to print a JSON list containing an object described below for each updated attribute to standard output.
+
+When `update.nix` is run with `--argstr commit true` arguments, it will create a separate commit for each of the objects. An empty list can be returned when the script did not update any files, for example, when the package is already at the latest version.
+
+The commit object contains the following values:
+
+- [`attrPath`]{#var-passthru-updateScript-commit-attrPath} – a string containing attribute path.
+- [`oldVersion`]{#var-passthru-updateScript-commit-oldVersion} – a string containing old version.
+- [`newVersion`]{#var-passthru-updateScript-commit-newVersion} – a string containing new version.
+- [`files`]{#var-passthru-updateScript-commit-files} – a non-empty list of file paths (as strings) to add to the commit.
+- [`commitBody`]{#var-passthru-updateScript-commit-commitBody} (optional) – a string with extra content to be appended to the default commit message (useful for adding changelog links).
+- [`commitMessage`]{#var-passthru-updateScript-commit-commitMessage} (optional) – a string to use instead of the default commit message.
+
+If the returned array contains exactly one object (e.g. `[{}]`), all values are optional and will be determined automatically.
+
+```{=docbook}
+<example>
+<title>Standard output of an update script using commit feature</title>
+```
+
+```json
+[
+  {
+    "attrPath": "volume_key",
+    "oldVersion": "0.3.11",
+    "newVersion": "0.3.12",
+    "files": [
+      "/path/to/nixpkgs/pkgs/development/libraries/volume-key/default.nix"
+    ]
+  }
+]
+```
+
+```{=docbook}
+</example>
+```

 ### Recursive attributes in `mkDerivation` {#mkderivation-recursive-attributes}

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1416,6 +1416,17 @@
    githubId = 5193600;
    name = "Atkins Chang";
  };
+  atkrad = {
+    name = "Mohammad Abdolirad";
+    email = "m.abdolirad@gmail.com";
+    github = "atkrad";
+    githubId = 351364;
+    keys = [
+      {
+        fingerprint = "0380 F2F8 DF7A BA1A E7DB  D84A 1935 1496 62CA FDB8";
+      }
+    ];
+  };
  atnnn = {
    email = "etienne@atnnn.com";
    github = "AtnNn";
@ -4124,6 +4135,12 @@
    githubId = 6689924;
    name = "David Terry";
  };
+  dylanmtaylor = {
+    email = "dylan@dylanmtaylor.com";
+    github = "dylamtaylor";
+    githubId = 277927;
+    name = "Dylan Taylor";
+  };
  dysinger = {
    email = "tim@dysinger.net";
    github = "dysinger";
@ -6527,6 +6544,16 @@
      fingerprint = "6C2B 55D4 4E04 8266 6B7D  DA1A 422E 9EDA E015 7170";
    }];
  };
+  infinitivewitch = {
+    name = "Infinitive Witch";
+    email = "infinitivewitch@disroot.org";
+    matrix = "@infinitivewitch:fedora.im";
+    github = "infinitivewitch";
+    githubId = 128256833;
+    keys = [{
+      fingerprint = "CF3D F4AD C7BD 1FDB A88B  E4B3 CA2D 43DA 939D 94FB";
+    }];
+  };
  ingenieroariel = {
    email = "ariel@nunez.co";
    github = "ingenieroariel";
@ -12730,6 +12757,11 @@
    githubId = 12279531;
    name = "Ricardo Guevara";
  };
+  rhendric = {
+    name = "Ryan Hendrickson";
+    github = "rhendric";
+    githubId = 1570964;
+  };
  rhoriguchi = {
    email = "ryan.horiguchi@gmail.com";
    github = "rhoriguchi";
@ -15695,6 +15727,12 @@
    github = "deviant";
    githubId = 68829907;
  };
+  vaci = {
+    email = "vaci@vaci.org";
+    github = "vaci";
+    githubId = 6882568;
+    name = "Vaci";
+  };
  vaibhavsagar = {
    email = "vaibhavsagar@gmail.com";
    matrix = "@vaibhavsagar:matrix.org";
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -65,7 +65,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](#opt-services.archisteamfarm.enable).

- [BaGet](https://loic-sharma.github.io/BaGet/), a lightweight NuGet and symbol server. Available at [services.baget](#opt-services.baget.enable).
+- [BaGet](https://loic-sharma.github.io/BaGet/), a lightweight NuGet and symbol server. Available at services.baget.

 - [bird-lg](https://github.com/xddxdd/bird-lg-go), a BGP looking glass for Bird Routing. Available as [services.bird-lg](#opt-services.bird-lg.package).

--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -169,6 +169,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - conntrack helper autodetection has been removed from kernels 6.0 and up upstream, and an assertion was added to ensure things don't silently stop working. Migrate your configuration to assign helpers explicitly or use an older LTS kernel branch as a temporary workaround.

+- The `baget` package and module was removed due to being unmaintained.
+
 ## Other Notable Changes {#sec-release-23.05-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@ -246,10 +248,10 @@ In addition to numerous new and upgraded packages, this release has the followin
    [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
    can be directly written as attribute-set in Nix within this option.

- `hardware.video.hidpi` now provides defaults that are consistent with `fontconfig`'s documentation:
-  - antialiasing and font hinting are disabled, as they have no visible effects at high pixel densities;
-  - subpixel order isn't set: it was irrelevant with the above disabled, and the module *cannot* know the correct
-    setting for the user's screen.
+- The `hardware.video.hidpi.enable` was renamed to `fonts.optimizeForVeryHighDPI` to be consistent with what it actually does.
+  They disable by default: antialiasing, hinting and LCD filter for subpixel rendering. They can be overridden if you experience problems with font rendering.
+  On Xorg, the default cursor is upscaled.
+  Please see the documentation for the new option to decide if you want to keep it enabled.

 - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.

--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@ -46,13 +46,11 @@ in

    font = mkOption {
      type = with types; nullOr (either str path);
-      default = "Lat2-Terminus16";
+      default = null;
      example = "LatArCyrHeb-16";
      description = mdDoc ''
-        The font used for the virtual consoles.  Leave empty to use
-        whatever the {command}`setfont` program considers the
-        default font.
-        Can be either a font name or a path to a PSF font file.
+        The font used for the virtual consoles.
+        Can be `null`, a font name, or a path to a PSF font file.

        Use `null` to let the kernel choose a built-in font.
        The default is 8x16, and, as of Linux 5.3, Terminus 32 bold for display
--- a/nixos/modules/config/fonts/fonts.nix
+++ b/nixos/modules/config/fonts/fonts.nix
@ -3,29 +3,7 @@
 with lib;

 let
-  # A scalable variant of the X11 "core" cursor
-  #
-  # If not running a fancy desktop environment, the cursor is likely set to
-  # the default `cursor.pcf` bitmap font. This is 17px wide, so it's very
-  # small and almost invisible on 4K displays.
-  fontcursormisc_hidpi = pkgs.xorg.fontxfree86type1.overrideAttrs (old:
-    let
-      # The scaling constant is 230/96: the scalable `left_ptr` glyph at
-      # about 23 points is rendered as 17px, on a 96dpi display.
-      # Note: the XLFD font size is in decipoints.
-      size = 2.39583 * config.services.xserver.dpi;
-      sizeString = builtins.head (builtins.split "\\." (toString size));
-    in
-    {
-      postInstall = ''
-        alias='cursor -xfree86-cursor-medium-r-normal--0-${sizeString}-0-0-p-0-adobe-fontspecific'
-        echo "$alias" > $out/lib/X11/fonts/Type1/fonts.alias
-      '';
-    });
-
-  hasHidpi =
-    config.hardware.video.hidpi.enable &&
-    config.services.xserver.dpi != null;
+  cfg = config.fonts;

  defaultFonts =
    [ pkgs.dejavu_fonts
@ -36,16 +14,12 @@ let
      pkgs.noto-fonts-emoji
    ];

-  defaultXFonts =
-    [ (if hasHidpi then fontcursormisc_hidpi else pkgs.xorg.fontcursormisc)
-      pkgs.xorg.fontmiscmisc
-    ];
-
 in

 {
  imports = [
    (mkRemovedOptionModule [ "fonts" "enableCoreFonts" ] "Use fonts.fonts = [ pkgs.corefonts ]; instead.")
+    (mkRenamedOptionModule [ "hardware" "video" "hidpi" "enable" ] [ "fonts" "optimizeForVeryHighDPI" ])
  ];

  options = {
@ -69,13 +43,32 @@ in
        '';
      };

+      optimizeForVeryHighDPI = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Optimize configuration for very high-density (>200 DPI) displays:
+            - disable subpixel anti-aliasing
+            - disable hinting
+            - automatically upscale the default X11 cursor
+        '';
+      };
    };

  };

  config = mkMerge [
-    { fonts.fonts = mkIf config.fonts.enableDefaultFonts defaultFonts; }
-    { fonts.fonts = mkIf config.services.xserver.enable defaultXFonts; }
+    { fonts.fonts = mkIf cfg.enableDefaultFonts defaultFonts; }
+    (mkIf cfg.optimizeForVeryHighDPI {
+      services.xserver.upscaleDefaultCursor = mkDefault true;
+      # Conforms to the recommendation in fonts/fontconfig.nix
+      # for > 200DPI.
+      fonts.fontconfig = {
+        antialias = mkDefault false;
+        hinting.enable = mkDefault false;
+        subpixel.lcdfilter = mkDefault "none";
+      };
+    })
  ];

 }
--- a/nixos/modules/hardware/video/hidpi.nix
+++ b/nixos/modules/hardware/video/hidpi.nix
@ -1,25 +0,0 @@
-{ lib, pkgs, config, ...}:
-with lib;
-
-{
-  options.hardware.video.hidpi.enable = mkEnableOption (lib.mdDoc "Font/DPI configuration optimized for HiDPI displays");
-
-  config = mkIf config.hardware.video.hidpi.enable {
-    console.font = lib.mkDefault "${pkgs.terminus_font}/share/consolefonts/ter-v32n.psf.gz";
-
-    # Needed when typing in passwords for full disk encryption
-    console.earlySetup = mkDefault true;
-    boot.loader.systemd-boot.consoleMode = mkDefault "1";
-
-
-    # Disable font anti-aliasing, hinting, and sub-pixel rendering by default
-    # See recommendations in fonts/fontconfig.nix
-    fonts.fontconfig = {
-      antialias = mkDefault false;
-      hinting.enable = mkDefault false;
-      subpixel.lcdfilter = mkDefault "none";
-    };
-
-    # TODO Find reasonable defaults X11 & wayland
-  };
-}
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@ -518,21 +518,6 @@ EOF
    }
 }

-# For lack of a better way to determine it, guess whether we should use a
-# bigger font for the console from the display mode on the first
-# framebuffer. A way based on the physical size/actual DPI reported by
-# the monitor would be nice, but I don't know how to do this without X :)
-my $fb_modes_file = "/sys/class/graphics/fb0/modes";
-if (-f $fb_modes_file && -r $fb_modes_file) {
-    my $modes = read_file($fb_modes_file);
-    $modes =~ m/([0-9]+)x([0-9]+)/;
-    my $console_width = $1, my $console_height = $2;
-    if ($console_width > 1920) {
-        push @attrs, "# high-resolution display";
-        push @attrs, 'hardware.video.hidpi.enable = lib.mkDefault true;';
-    }
-}
-

 # Generate the hardware configuration file.

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -95,7 +95,6 @@
  ./hardware/video/bumblebee.nix
  ./hardware/video/capture/mwprocapture.nix
  ./hardware/video/displaylink.nix
-  ./hardware/video/hidpi.nix
  ./hardware/video/nvidia.nix
  ./hardware/video/switcheroo-control.nix
  ./hardware/video/uvcvideo/default.nix
@ -1134,7 +1133,6 @@
  ./services/web-apps/atlassian/confluence.nix
  ./services/web-apps/atlassian/crowd.nix
  ./services/web-apps/atlassian/jira.nix
-  ./services/web-apps/baget.nix
  ./services/web-apps/bookstack.nix
  ./services/web-apps/calibre-web.nix
  ./services/web-apps/coder.nix
--- a/nixos/modules/programs/starship.nix
+++ b/nixos/modules/programs/starship.nix
@ -9,10 +9,27 @@ let

  settingsFile = settingsFormat.generate "starship.toml" cfg.settings;

-in {
+  initOption =
+    if cfg.interactiveOnly then
+      "promptInit"
+    else
+      "shellInit";
+
+in
+{
  options.programs.starship = {
    enable = mkEnableOption (lib.mdDoc "the Starship shell prompt");

+    interactiveOnly = mkOption {
+      default = true;
+      example = false;
+      type = types.bool;
+      description = lib.mdDoc ''
+        Whether to enable starship only when the shell is interactive.
+        Some plugins require this to be set to false to function correctly.
+      '';
+    };
+
    settings = mkOption {
      inherit (settingsFormat) type;
      default = { };
@ -25,21 +42,21 @@ in {
  };

  config = mkIf cfg.enable {
-    programs.bash.promptInit = ''
+    programs.bash.${initOption} = ''
      if [[ $TERM != "dumb" && (-z $INSIDE_EMACS || $INSIDE_EMACS == "vterm") ]]; then
        export STARSHIP_CONFIG=${settingsFile}
        eval "$(${pkgs.starship}/bin/starship init bash)"
      fi
    '';

-    programs.fish.promptInit = ''
+    programs.fish.${initOption} = ''
      if test "$TERM" != "dumb" -a \( -z "$INSIDE_EMACS" -o "$INSIDE_EMACS" = "vterm" \)
        set -x STARSHIP_CONFIG ${settingsFile}
        eval (${pkgs.starship}/bin/starship init fish)
      end
    '';

-    programs.zsh.promptInit = ''
+    programs.zsh.${initOption} = ''
      if [[ $TERM != "dumb" && (-z $INSIDE_EMACS || $INSIDE_EMACS == "vterm") ]]; then
        export STARSHIP_CONFIG=${settingsFile}
        eval "$(${pkgs.starship}/bin/starship init zsh)"
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -44,6 +44,7 @@ with lib;
        The hidepid module was removed, since the underlying machinery
        is broken when using cgroups-v2.
    '')
+    (mkRemovedOptionModule [ "services" "baget" "enable" ] "The baget module was removed due to the upstream package being unmaintained.")
    (mkRemovedOptionModule [ "services" "beegfs" ] "The BeeGFS module has been removed")
    (mkRemovedOptionModule [ "services" "beegfsEnable" ] "The BeeGFS module has been removed")
    (mkRemovedOptionModule [ "services" "cgmanager" "enable"] "cgmanager was deprecated by lxc and therefore removed from nixpkgs.")
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@ -303,8 +303,8 @@ in
              then if (backup.paths != null) then concatStringsSep " " backup.paths else ""
              else "--files-from ${filesFromTmpFile}";
            pruneCmd = optionals (builtins.length backup.pruneOpts > 0) [
-              (resticCmd + " forget --prune --cache-dir=%C/restic-backups-${name} " + (concatStringsSep " " backup.pruneOpts))
-              (resticCmd + " check --cache-dir=%C/restic-backups-${name} " + (concatStringsSep " " backup.checkOpts))
+              (resticCmd + " forget --prune " + (concatStringsSep " " backup.pruneOpts))
+              (resticCmd + " check " + (concatStringsSep " " backup.checkOpts))
            ];
            # Helper functions for rclone remotes
            rcloneRemoteName = builtins.elemAt (splitString ":" backup.repository) 1;
@ -314,6 +314,7 @@ in
          in
          nameValuePair "restic-backups-${name}" ({
            environment = {
+              RESTIC_CACHE_DIR = "%C/restic-backups-${name}";
              RESTIC_PASSWORD_FILE = backup.passwordFile;
              RESTIC_REPOSITORY = backup.repository;
              RESTIC_REPOSITORY_FILE = backup.repositoryFile;
@ -332,7 +333,7 @@ in
            restartIfChanged = false;
            serviceConfig = {
              Type = "oneshot";
-              ExecStart = (optionals (backupPaths != "") [ "${resticCmd} backup --cache-dir=%C/restic-backups-${name} ${concatStringsSep " " (backup.extraBackupArgs ++ excludeFlags)} ${backupPaths}" ])
+              ExecStart = (optionals (backupPaths != "") [ "${resticCmd} backup ${concatStringsSep " " (backup.extraBackupArgs ++ excludeFlags)} ${backupPaths}" ])
                ++ pruneCmd;
              User = backup.user;
              RuntimeDirectory = "restic-backups-${name}";
--- a/nixos/modules/services/web-apps/baget.nix
+++ b/nixos/modules/services/web-apps/baget.nix
@ -1,170 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.baget;
-
-  defaultConfig = {
-    "PackageDeletionBehavior" = "Unlist";
-    "AllowPackageOverwrites" = false;
-
-    "Database" = {
-      "Type" = "Sqlite";
-      "ConnectionString" = "Data Source=baget.db";
-    };
-
-    "Storage" = {
-      "Type" = "FileSystem";
-      "Path" = "";
-    };
-
-    "Search" = {
-      "Type" = "Database";
-    };
-
-    "Mirror" = {
-      "Enabled" = false;
-      "PackageSource" = "https://api.nuget.org/v3/index.json";
-    };
-
-    "Logging" = {
-      "IncludeScopes" = false;
-      "Debug" = {
-        "LogLevel" = {
-          "Default" = "Warning";
-        };
-      };
-      "Console" = {
-        "LogLevel" = {
-          "Microsoft.Hosting.Lifetime" = "Information";
-          "Default" = "Warning";
-        };
-      };
-    };
-  };
-
-  configAttrs = recursiveUpdate defaultConfig cfg.extraConfig;
-
-  configFormat = pkgs.formats.json {};
-  configFile = configFormat.generate "appsettings.json" configAttrs;
-
-in
-{
-  options.services.baget = {
-    enable = mkEnableOption (lib.mdDoc "BaGet NuGet-compatible server");
-
-    apiKeyFile = mkOption {
-      type = types.path;
-      example = "/root/baget.key";
-      description = lib.mdDoc ''
-        Private API key for BaGet.
-      '';
-    };
-
-    extraConfig = mkOption {
-      type = configFormat.type;
-      default = {};
-      example = {
-        "Database" = {
-          "Type" = "PostgreSql";
-          "ConnectionString" = "Server=/run/postgresql;Port=5432;";
-        };
-      };
-      defaultText = literalExpression ''
-        {
-          "PackageDeletionBehavior" = "Unlist";
-          "AllowPackageOverwrites" = false;
-
-          "Database" = {
-            "Type" = "Sqlite";
-            "ConnectionString" = "Data Source=baget.db";
-          };
-
-          "Storage" = {
-            "Type" = "FileSystem";
-            "Path" = "";
-          };
-
-          "Search" = {
-            "Type" = "Database";
-          };
-
-          "Mirror" = {
-            "Enabled" = false;
-            "PackageSource" = "https://api.nuget.org/v3/index.json";
-          };
-
-          "Logging" = {
-            "IncludeScopes" = false;
-            "Debug" = {
-              "LogLevel" = {
-                "Default" = "Warning";
-              };
-            };
-            "Console" = {
-              "LogLevel" = {
-                "Microsoft.Hosting.Lifetime" = "Information";
-                "Default" = "Warning";
-              };
-            };
-          };
-        }
-      '';
-      description = lib.mdDoc ''
-        Extra configuration options for BaGet. Refer to <https://loic-sharma.github.io/BaGet/configuration/> for details.
-        Default value is merged with values from here.
-      '';
-    };
-  };
-
-  # implementation
-
-  config = mkIf cfg.enable {
-
-    systemd.services.baget = {
-      description = "BaGet server";
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "network-online.target" ];
-      after = [ "network.target" "network-online.target" ];
-      path = [ pkgs.jq ];
-      serviceConfig = {
-        WorkingDirectory = "/var/lib/baget";
-        DynamicUser = true;
-        StateDirectory = "baget";
-        StateDirectoryMode = "0700";
-        LoadCredential = "api_key:${cfg.apiKeyFile}";
-
-        CapabilityBoundingSet = "";
-        NoNewPrivileges = true;
-        PrivateDevices = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        PrivateMounts = true;
-        ProtectHome = true;
-        ProtectClock = true;
-        ProtectProc = "noaccess";
-        ProcSubset = "pid";
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectControlGroups = true;
-        ProtectHostname = true;
-        RestrictSUIDSGID = true;
-        RestrictRealtime = true;
-        RestrictNamespaces = true;
-        LockPersonality = true;
-        RemoveIPC = true;
-        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
-        SystemCallFilter = [ "@system-service" "~@privileged" ];
-      };
-      script = ''
-        jq --slurpfile apiKeys <(jq -R . "$CREDENTIALS_DIRECTORY/api_key") '.ApiKey = $apiKeys[0]' ${configFile} > appsettings.json
-        ln -snf ${pkgs.baget}/lib/BaGet/wwwroot wwwroot
-        exec ${pkgs.baget}/bin/BaGet
-      '';
-    };
-
-  };
-}
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@ -34,6 +34,24 @@ in
  options.services.limesurvey = {
    enable = mkEnableOption (lib.mdDoc "Limesurvey web application");

+    encryptionKey = mkOption {
+      type = types.str;
+      default = "E17687FC77CEE247F0E22BB3ECF27FDE8BEC310A892347EC13013ABA11AA7EB5";
+      description = lib.mdDoc ''
+        This is a 32-byte key used to encrypt variables in the database.
+        You _must_ change this from the default value.
+      '';
+    };
+
+    encryptionNonce = mkOption {
+      type = types.str;
+      default = "1ACC8555619929DB91310BE848025A427B0F364A884FFA77";
+      description = lib.mdDoc ''
+        This is a 24-byte nonce used to encrypt variables in the database.
+        You _must_ change this from the default value.
+      '';
+    };
+
    database = {
      type = mkOption {
        type = types.enum [ "mysql" "pgsql" "odbc" "mssql" ];
@ -42,6 +60,12 @@ in
        description = lib.mdDoc "Database engine to use.";
      };

+      dbEngine = mkOption {
+        type = types.enum [ "MyISAM" "InnoDB" ];
+        default = "InnoDB";
+        description = lib.mdDoc "Database storage engine to use.";
+      };
+
      host = mkOption {
        type = types.str;
        default = "localhost";
@ -180,6 +204,8 @@ in
      config = {
        tempdir = "${stateDir}/tmp";
        uploaddir = "${stateDir}/upload";
+        encryptionnonce = cfg.encryptionNonce;
+        encryptionsecretboxkey = cfg.encryptionKey;
        force_ssl = mkIf (cfg.virtualHost.addSSL || cfg.virtualHost.forceSSL || cfg.virtualHost.onlySSL) "on";
        config.defaultlang = "en";
      };
@ -200,6 +226,8 @@ in

    services.phpfpm.pools.limesurvey = {
      inherit user group;
+      phpPackage = pkgs.php80;
+      phpEnv.DBENGINE = "${cfg.database.dbEngine}";
      phpEnv.LIMESURVEY_CONFIG = "${limesurveyConfig}";
      settings = {
        "listen.owner" = config.services.httpd.user;
@ -256,11 +284,12 @@ in
      wantedBy = [ "multi-user.target" ];
      before = [ "phpfpm-limesurvey.service" ];
      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+      environment.DBENGINE = "${cfg.database.dbEngine}";
      environment.LIMESURVEY_CONFIG = limesurveyConfig;
      script = ''
        # update or install the database as required
-        ${pkgs.php}/bin/php ${pkg}/share/limesurvey/application/commands/console.php updatedb || \
-        ${pkgs.php}/bin/php ${pkg}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
+        ${pkgs.php80}/bin/php ${pkg}/share/limesurvey/application/commands/console.php updatedb || \
+        ${pkgs.php80}/bin/php ${pkg}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
      '';
      serviceConfig = {
        User = user;
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -138,6 +138,26 @@ let
    concatMapStringsSep "\n" (line: prefix + line) (splitString "\n" str);

  indent = prefixStringLines "  ";
+
+  # A scalable variant of the X11 "core" cursor
+  #
+  # If not running a fancy desktop environment, the cursor is likely set to
+  # the default `cursor.pcf` bitmap font. This is 17px wide, so it's very
+  # small and almost invisible on 4K displays.
+  fontcursormisc_hidpi = pkgs.xorg.fontxfree86type1.overrideAttrs (old:
+    let
+      # The scaling constant is 230/96: the scalable `left_ptr` glyph at
+      # about 23 points is rendered as 17px, on a 96dpi display.
+      # Note: the XLFD font size is in decipoints.
+      size = 2.39583 * cfg.dpi;
+      sizeString = builtins.head (builtins.split "\\." (toString size));
+    in
+    {
+      postInstall = ''
+        alias='cursor -xfree86-cursor-medium-r-normal--0-${sizeString}-0-0-p-0-adobe-fontspecific'
+        echo "$alias" > $out/lib/X11/fonts/Type1/fonts.alias
+      '';
+    });
 in

 {
@ -576,6 +596,15 @@ in
          Whether to terminate X upon server reset.
        '';
      };
+
+      upscaleDefaultCursor = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Upscale the default X cursor to be more visible on high-density displays.
+          Requires `config.services.xserver.dpi` to be set.
+        '';
+      };
    };

  };
@ -627,6 +656,10 @@ in
                + "${toString (length primaryHeads)} heads set to primary: "
                + concatMapStringsSep ", " (x: x.output) primaryHeads;
      })
+      {
+        assertion = cfg.upscaleDefaultCursor -> cfg.dpi != null;
+        message = "Specify `config.services.xserver.dpi` to upscale the default cursor.";
+      }
    ];

    environment.etc =
@ -851,6 +884,10 @@ in
      '';

    fonts.enableDefaultFonts = mkDefault true;
+    fonts.fonts = [
+      (if cfg.upscaleDefaultCursor then fontcursormisc_hidpi else pkgs.xorg.fontcursormisc)
+      pkgs.xorg.fontmiscmisc
+    ];

  };

--- a/nixos/tests/gollum.nix
+++ b/nixos/tests/gollum.nix
@ -9,6 +9,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {

  testScript = { nodes, ... }: ''
    webserver.wait_for_unit("gollum")
-    webserver.wait_for_open_port(${toString nodes.webserver.config.services.gollum.port})
+    webserver.wait_for_open_port(${toString nodes.webserver.services.gollum.port})
  '';
 })
--- a/nixos/tests/restic.nix
+++ b/nixos/tests/restic.nix
@ -100,7 +100,7 @@ import ./make-test-python.nix (
          "${pkgs.restic}/bin/restic -r ${remoteRepository} -p ${passwordFile} snapshots",
          '${pkgs.restic}/bin/restic -r ${remoteFromFileRepository} -p ${passwordFile} snapshots"',
          "${pkgs.restic}/bin/restic -r ${rcloneRepository} -p ${passwordFile} snapshots",
-          "grep 'backup .* /opt' /tmp/fake-restic.log",
+          "grep 'backup.* /opt' /tmp/fake-restic.log",
      )
      server.succeed(
          # set up
@ -129,8 +129,8 @@ import ./make-test-python.nix (

          # test that custompackage runs both `restic backup` and `restic check` with reasonable commandlines
          "systemctl start restic-backups-custompackage.service",
-          "grep 'backup .* /opt' /tmp/fake-restic.log",
-          "grep 'check .* --some-check-option' /tmp/fake-restic.log",
+          "grep 'backup.* /opt' /tmp/fake-restic.log",
+          "grep 'check.* --some-check-option' /tmp/fake-restic.log",

          # test that we can create four snapshots in remotebackup and rclonebackup
          "timedatectl set-time '2017-12-13 13:45'",
--- a/pkgs/applications/audio/go-musicfox/default.nix
+++ b/pkgs/applications/audio/go-musicfox/default.nix
@ -10,13 +10,13 @@
 # gcc only supports objc on darwin
 buildGoModule.override { stdenv = clangStdenv; } rec {
  pname = "go-musicfox";
-  version = "3.7.3";
+  version = "3.7.5";

  src = fetchFromGitHub {
    owner = "anhoder";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-aM7IJGRRY2V2Rovj042ctg5254EUw1bTuoRCp9Za1FY=";
+    hash = "sha256-+0s+MCFLw527gFj7pfiYGfKYihthFjRLPeto2SbALw0=";
  };

  deleteVendor = true;
@ -28,7 +28,7 @@ buildGoModule.override { stdenv = clangStdenv; } rec {
  ldflags = [
    "-s"
    "-w"
-    "-X go-musicfox/pkg/constants.AppVersion=${version}"
+    "-X github.com/go-musicfox/go-musicfox/pkg/constants.AppVersion=${version}"
  ];

  nativeBuildInputs = [
--- a/pkgs/applications/audio/mellowplayer/default.nix
+++ b/pkgs/applications/audio/mellowplayer/default.nix
@ -10,6 +10,7 @@
 , qtquickcontrols2
 , qttools
 , qtwebengine
+, stdenv
 }:

 mkDerivation rec {
@ -61,6 +62,7 @@ mkDerivation rec {

  meta = with lib; {
    inherit (qtbase.meta) platforms;
+    broken = stdenv.isDarwin; # test build fails, but the project is not maintained anymore

    description = "Cloud music integration for your desktop";
    homepage = "https://gitlab.com/ColinDuquesnoy/MellowPlayer";
--- a/pkgs/applications/audio/sidplayfp/default.nix
+++ b/pkgs/applications/audio/sidplayfp/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "sidplayfp";
-  version = "2.4.0";
+  version = "2.4.1";

  src = fetchFromGitHub {
    owner = "libsidplayfp";
    repo = "sidplayfp";
    rev = "v${version}";
-    sha256 = "sha256-7a09ec/Ap6XCnmQekLnXbH9kPP3io4+A72dVSfp3krs=";
+    sha256 = "sha256-15KG+LkPkCLFsnWHUAQpQbqol/izAn/HRinszVRB5Ao=";
  };

  nativeBuildInputs = [ autoreconfHook perl pkg-config ];
--- a/pkgs/applications/audio/tauon/default.nix
+++ b/pkgs/applications/audio/tauon/default.nix
@ -25,13 +25,13 @@

 stdenv.mkDerivation rec {
  pname = "tauon";
-  version = "7.5.0";
+  version = "7.6.0";

  src = fetchFromGitHub {
    owner = "Taiko2k";
    repo = "TauonMusicBox";
    rev = "v${version}";
-    hash = "sha256-9/mzh8lRBjd7d9oEyG1XGWmOdgPEFCVjHZxDnAhYDwc=";
+    hash = "sha256-oQ3mcDrWWIT/2fu4MBw+0GjxWGFw1aLSTvmaKSDsdz4=";
  };

  postUnpack = ''
--- a/pkgs/applications/audio/tonelib-metal/default.nix
+++ b/pkgs/applications/audio/tonelib-metal/default.nix
@ -17,11 +17,11 @@

 stdenv.mkDerivation rec {
  pname = "tonelib-metal";
-  version = "1.1.0";
+  version = "1.2.6";

  src = fetchurl {
-    url = "https://www.tonelib.net/download/220218/ToneLib-Metal-amd64.deb";
-    sha256 = "sha256-F5EKwNQ9f/kdZLFI+QDZHvwevV/vDnxMdSmT/vnX6ug=";
+    url = "https://tonelib.net/download/221222/ToneLib-Metal-amd64.deb";
+    sha256 = "sha256-G80EKAsXomdk8GsnNyvjN8shz3YMKhqdWWYyVB7xTsU=";
  };

  nativeBuildInputs = [ autoPatchelfHook dpkg ];
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@ -2,11 +2,11 @@

 let
  pname = "ledger-live-desktop";
-  version = "2.54.0";
+  version = "2.55.0";

  src = fetchurl {
    url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-3UCsMzpoHq4gD4bw/MT1qbl8AnXQnFJqpMi1mlPvv5w=";
+    hash = "sha256-N0BhbqZvZs3IP+jMxr85KlHs6I/fxWgoK884EKT9C9Y=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/emulators/firebird-emu/default.nix
+++ b/pkgs/applications/emulators/firebird-emu/default.nix
@ -2,29 +2,20 @@

 mkDerivation rec {
  pname = "firebird-emu";
-  version = "1.5";
+  version = "1.6";

  src = fetchFromGitHub {
    owner = "nspire-emus";
    repo = "firebird";
    rev = "v${version}";
-    sha256 = "sha256-T62WB6msdB6/wIulqd/468JrCEiPGUrvtpjkZyo4wiA=";
    fetchSubmodules = true;
+    hash = "sha256-ZptjlnOiF+hKuKYvBFJL95H5YQuR99d4biOco/MVEmE=";
  };

  nativeBuildInputs = [ qmake ];

  buildInputs = [ qtbase qtdeclarative ];

-  makeFlags = [ "INSTALL_ROOT=$(out)" ];
-
-  # Attempts to install to /usr/bin and /usr/share/applications, which Nix does
-  # not use.
-  prePatch = ''
-    substituteInPlace firebird.pro \
-      --replace '/usr/' '/'
-  '';
-
  meta = {
    homepage = "https://github.com/nspire-emus/firebird";
    description = "Third-party multi-platform emulator of the ARM-based TI-Nspire™ calculators";
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -47,13 +47,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "imagemagick";
-  version = "7.1.1-3";
+  version = "7.1.1-4";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    rev = finalAttrs.version;
-    hash = "sha256-UYmWNP+2FdBtBUqQtYGtIdw/XN8OKO0r5g4zgzPgbP8=";
+    hash = "sha256-NGtctktlaKIZ3KZUysXBUTHtvAe29RYW3Q4SL6/Eufw=";
  };

  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
@ -134,7 +134,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "A software suite to create, edit, compose, or convert bitmap images";
    pkgConfigModules = [ "ImageMagick" "MagickWand" ];
    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ erictapen dotlambda ];
+    maintainers = with maintainers; [ erictapen dotlambda rhendric ];
    license = licenses.asl20;
    mainProgram = "magick";
  };
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@ -89,6 +89,6 @@ python3.pkgs.buildPythonApplication rec {
    description = "Manga reader for GNOME";
    homepage = "https://valos.gitlab.io/Komikku/";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ chuangzhu ];
+    maintainers = with maintainers; [ chuangzhu infinitivewitch ];
  };
 }
--- a/pkgs/applications/misc/gollum/Gemfile.lock
+++ b/pkgs/applications/misc/gollum/Gemfile.lock
@ -2,9 +2,9 @@ GEM
  remote: https://rubygems.org/
  specs:
    RedCloth (4.3.2)
-    asciidoctor (2.0.17)
+    asciidoctor (2.0.18)
    builder (3.2.4)
-    concurrent-ruby (1.1.10)
+    concurrent-ruby (1.2.2)
    crass (1.0.6)
    creole (0.5.0)
    execjs (2.8.1)
@ -13,13 +13,13 @@ GEM
    gemojione (4.3.3)
      json
    github-markup (4.0.1)
-    gollum (5.3.0)
+    gollum (5.3.1)
      gemojione (~> 4.1)
-      gollum-lib (~> 5.1)
+      gollum-lib (>= 5.2.3, < 6.0)
      i18n (~> 1.8)
      kramdown (~> 2.3)
      kramdown-parser-gfm (~> 1.1.0)
-      mustache-sinatra (>= 1.0.1, < 2)
+      mustache-sinatra (~> 2.0)
      octicons (~> 12.0)
      rdoc (~> 6)
      rss (~> 0.2.9)
@ -32,88 +32,90 @@ GEM
      uglifier (~> 4.2)
      useragent (~> 0.16.2)
      webrick (~> 1.7)
-    gollum-lib (5.2)
+    gollum-lib (5.2.3)
      gemojione (~> 4.1)
      github-markup (~> 4.0)
-      gollum-rugged_adapter (~> 1.0)
+      gollum-rugged_adapter (~> 2.0)
      loofah (~> 2.3)
      nokogiri (~> 1.8)
      octicons (~> 12.0)
      rouge (~> 3.1)
      twitter-text (= 1.14.7)
-    gollum-rugged_adapter (1.1.2)
-      mime-types (~> 1.15)
-      rugged (~> 1.1.0)
+    gollum-rugged_adapter (2.1.0)
+      mime-types (~> 3.4)
+      rugged (~> 1.5)
    htmlentities (4.3.4)
-    i18n (1.10.0)
+    i18n (1.12.0)
      concurrent-ruby (~> 1.0)
-    json (2.6.2)
+    json (2.6.3)
    kramdown (2.4.0)
      rexml
    kramdown-parser-gfm (1.1.0)
      kramdown (~> 2.0)
-    loofah (2.18.0)
+    loofah (2.19.1)
      crass (~> 1.0.2)
      nokogiri (>= 1.5.9)
-    mime-types (1.25.1)
-    mini_portile2 (2.8.0)
+    mime-types (3.4.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2023.0218.1)
+    mini_portile2 (2.8.1)
    multi_json (1.15.0)
-    mustache (0.99.8)
-    mustache-sinatra (1.0.1)
-      mustache (<= 0.99.8)
-    mustermann (1.1.1)
+    mustache (1.1.1)
+    mustache-sinatra (2.0.0)
+      mustache (~> 1.0)
+    mustermann (2.0.2)
      ruby2_keywords (~> 0.0.1)
-    nokogiri (1.13.6)
+    nokogiri (1.14.2)
      mini_portile2 (~> 2.8.0)
      racc (~> 1.4)
    octicons (12.1.0)
      nokogiri (>= 1.6.3.1)
    org-ruby (0.9.12)
      rubypants (~> 0.2)
-    psych (4.0.4)
+    psych (5.1.0)
      stringio
-    racc (1.6.0)
-    rack (2.2.3.1)
-    rack-protection (2.2.0)
+    racc (1.6.2)
+    rack (2.2.6.4)
+    rack-protection (2.2.4)
      rack
-    rb-fsevent (0.11.1)
+    rb-fsevent (0.11.2)
    rb-inotify (0.10.1)
      ffi (~> 1.0)
-    rdoc (6.4.0)
+    rdoc (6.5.0)
      psych (>= 4.0.0)
    rexml (3.2.5)
-    rouge (3.29.0)
+    rouge (3.30.0)
    rss (0.2.9)
      rexml
    ruby2_keywords (0.0.5)
    rubypants (0.7.1)
-    rugged (1.1.1)
+    rugged (1.6.2)
    sass (3.7.4)
      sass-listen (~> 4.0.0)
    sass-listen (4.0.0)
      rb-fsevent (~> 0.9, >= 0.9.4)
      rb-inotify (~> 0.9, >= 0.9.7)
-    sinatra (2.2.0)
-      mustermann (~> 1.0)
+    sinatra (2.2.4)
+      mustermann (~> 2.0)
      rack (~> 2.2)
-      rack-protection (= 2.2.0)
+      rack-protection (= 2.2.4)
      tilt (~> 2.0)
-    sinatra-contrib (2.2.0)
+    sinatra-contrib (2.2.4)
      multi_json
-      mustermann (~> 1.0)
-      rack-protection (= 2.2.0)
-      sinatra (= 2.2.0)
+      mustermann (~> 2.0)
+      rack-protection (= 2.2.4)
+      sinatra (= 2.2.4)
      tilt (~> 2.0)
    sprockets (3.7.2)
      concurrent-ruby (~> 1.0)
      rack (> 1, < 3)
    sprockets-helpers (1.4.0)
      sprockets (>= 2.2)
-    stringio (3.0.2)
+    stringio (3.0.5)
    therubyrhino (2.1.2)
      therubyrhino_jar (>= 1.7.4, < 1.7.9)
    therubyrhino_jar (1.7.8)
-    tilt (2.0.10)
+    tilt (2.1.0)
    twitter-text (1.14.7)
      unf (~> 0.1.0)
    uglifier (4.2.0)
@ -122,7 +124,7 @@ GEM
      unf_ext
    unf_ext (0.0.8.2)
    useragent (0.16.10)
-    webrick (1.7.0)
+    webrick (1.8.1)
    wikicloth (0.8.3)
      builder
      expression_parser
@ -142,4 +144,4 @@ DEPENDENCIES
  wikicloth

 BUNDLED WITH
-   2.3.9
+   2.4.6
--- a/pkgs/applications/misc/gollum/gemset.nix
+++ b/pkgs/applications/misc/gollum/gemset.nix
@ -4,10 +4,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0g8gn3g6qy4bzjv1b14sj283kqynjgwq62bgq569jr4dkqwmwnzd";
+      sha256 = "11z3vnd8vh3ny1vx69bjrbck5b2g8zsbj94npyadpn7fdp8y3ldv";
      type = "gem";
    };
-    version = "2.0.17";
+    version = "2.0.18";
  };
  builder = {
    groups = ["default"];
@ -24,10 +24,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0s4fpn3mqiizpmpy2a24k4v365pv75y50292r8ajrv4i1p5b2k14";
+      sha256 = "0krcwb6mn0iklajwngwsg850nk8k9b35dhmc2qkbdqvmifdi2y9q";
      type = "gem";
    };
-    version = "1.1.10";
+    version = "1.2.2";
  };
  crass = {
    groups = ["default"];
@ -106,10 +106,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1xz7d3xfc536njk0fg4inmzzy350c5bjp237vghrcky8azc6xl7k";
+      sha256 = "1nx3ss1ck5mgj14580z73pfwri0l4f0ilnckh9mgxmi9i4rk24y2";
      type = "gem";
    };
-    version = "5.3.0";
+    version = "5.3.1";
  };
  gollum-lib = {
    dependencies = ["gemojione" "github-markup" "gollum-rugged_adapter" "loofah" "nokogiri" "octicons" "rouge" "twitter-text"];
@ -117,10 +117,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1acxi4zjdmxlj7hzv9fjqilqngcwjvzhk3khnykdfvnb0l6l4xbs";
+      sha256 = "11bs7yfkznz7rdzxc9am53mix5nnv8505d565j4cci2bg6iqy2dz";
      type = "gem";
    };
-    version = "5.2";
+    version = "5.2.3";
  };
  gollum-rugged_adapter = {
    dependencies = ["mime-types" "rugged"];
@ -128,10 +128,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1j06lsvb2bpp7xacshak2f1hxzd7l640mywyrwaz4ih9d8xqll8j";
+      sha256 = "05v24lpkssn1k07n28bw4yh7w1ygsv4cfwz046jn9lmrh3v8q4d1";
      type = "gem";
    };
-    version = "1.1.2";
+    version = "2.1.0";
  };
  htmlentities = {
    groups = ["default"];
@ -149,20 +149,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0b2qyvnk4yynlg17ymkq4g5xgr275637fhl1mjh0valw3cb1fhhg";
+      sha256 = "1vdcchz7jli1p0gnc669a7bj3q1fv09y9ppf0y3k0vb1jwdwrqwi";
      type = "gem";
    };
-    version = "1.10.0";
+    version = "1.12.0";
  };
  json = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0yk5d10yvspkc5jyvx9gc1a9pn1z8v4k2hvjk1l88zixwf3wf3cl";
+      sha256 = "0nalhin1gda4v8ybk6lq8f407cgfrj6qzn234yra4ipkmlbfmal6";
      type = "gem";
    };
-    version = "2.6.2";
+    version = "2.6.3";
  };
  kramdown = {
    dependencies = ["rexml"];
@ -192,30 +192,41 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18ymp6l3bv7abz07k6qbbi9c9vsiahq30d2smh4qzsvag8j5m5v1";
+      sha256 = "08qhzck271anrx9y6qa6mh8hwwdzsgwld8q0000rcd7yvvpnjr3c";
      type = "gem";
    };
-    version = "2.18.0";
+    version = "2.19.1";
  };
  mime-types = {
+    dependencies = ["mime-types-data"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0mhzsanmnzdshaba7gmsjwnv168r1yj8y0flzw88frw1cickrvw8";
+      sha256 = "0ipw892jbksbxxcrlx9g5ljq60qx47pm24ywgfbyjskbcl78pkvb";
      type = "gem";
    };
-    version = "1.25.1";
+    version = "3.4.1";
+  };
+  mime-types-data = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1pky3vzaxlgm9gw5wlqwwi7wsw3jrglrfflrppvvnsrlaiz043z9";
+      type = "gem";
+    };
+    version = "3.2023.0218.1";
  };
  mini_portile2 = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0rapl1sfmfi3bfr68da4ca16yhc0pp93vjwkj7y3rdqrzy3b41hy";
+      sha256 = "1af4yarhbbx62f7qsmgg5fynrik0s36wjy3difkawy536xg343mp";
      type = "gem";
    };
-    version = "2.8.0";
+    version = "2.8.1";
  };
  multi_json = {
    groups = ["default"];
@ -232,10 +243,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1g5hplm0k06vwxwqzwn1mq5bd02yp0h3rym4zwzw26aqi7drcsl2";
+      sha256 = "1l0p4wx15mi3wnamfv92ipkia4nsx8qi132c6g51jfdma3fiz2ch";
      type = "gem";
    };
-    version = "0.99.8";
+    version = "1.1.1";
  };
  mustache-sinatra = {
    dependencies = ["mustache"];
@ -243,10 +254,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1rvdwg1zk3sybpi9hzn6jj0k8rndkq19y7cl0jmqr0g2xx21z7mr";
+      sha256 = "03f2wdih6hnnm9iclfwi53dx56knpshv8wnf4cglp7kjx358036i";
      type = "gem";
    };
-    version = "1.0.1";
+    version = "2.0.0";
  };
  mustermann = {
    dependencies = ["ruby2_keywords"];
@ -254,10 +265,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ccm54qgshr1lq3pr1dfh7gphkilc19dp63rw6fcx7460pjwy88a";
+      sha256 = "0m70qz27mlv2rhk4j1li6pw797gmiwwqg02vcgxcxr1rq2v53rnb";
      type = "gem";
    };
-    version = "1.1.1";
+    version = "2.0.2";
  };
  nokogiri = {
    dependencies = ["mini_portile2" "racc"];
@ -265,10 +276,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "11w59ga9324yx6339dgsflz3dsqq2mky1qqdwcg6wi5s1bf2yldi";
+      sha256 = "1djq4rp4m967mn6sxmiw75vz24gfp0w602xv22kk1x3cmi5afrf7";
      type = "gem";
    };
-    version = "1.13.6";
+    version = "1.14.2";
  };
  octicons = {
    dependencies = ["nokogiri"];
@ -298,30 +309,30 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0c2lz03mkn43rf2a2xiy8vqgir1dvds0a0fpx7m7my6a21ygryw2";
+      sha256 = "1msambb54r3d1sg6smyj4k2pj9h9lz8jq4jamip7ivcyv32a85vz";
      type = "gem";
    };
-    version = "4.0.4";
+    version = "5.1.0";
  };
  racc = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0la56m0z26j3mfn1a9lf2l03qx1xifanndf9p3vx1azf6sqy7v9d";
+      sha256 = "09jgz6r0f7v84a7jz9an85q8vvmp743dqcsdm3z9c8rqcqv6pljq";
      type = "gem";
    };
-    version = "1.6.0";
+    version = "1.6.2";
  };
  rack = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1b1qsg0yfargdhmpapp2d3mlxj82wyygs9nj74w0r03diyi8swlc";
+      sha256 = "1qgwkcb8kxns8d5187cxjaxf18b7dmg9gh6cr9c1125m0bj2pnfk";
      type = "gem";
    };
-    version = "2.2.3.1";
+    version = "2.2.6.4";
  };
  rack-protection = {
    dependencies = ["rack"];
@ -329,20 +340,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1hz6h6d67r217qi202qmxq2xkn3643ay3iybhl3dq3qd6j8nm3b2";
+      sha256 = "1d6irsigm0i4ig1m47c94kixi3wb8jnxwvwkl8qxvyngmb73srl2";
      type = "gem";
    };
-    version = "2.2.0";
+    version = "2.2.4";
  };
  rb-fsevent = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06c50pvxib7wqnv6q0f3n7gzfcrp5chi3sa48hxpkfxc3hhy11fm";
+      sha256 = "1zmf31rnpm8553lqwibvv3kkx0v7majm1f341xbxc0bk5sbhp423";
      type = "gem";
    };
-    version = "0.11.1";
+    version = "0.11.2";
  };
  rb-inotify = {
    dependencies = ["ffi"];
@ -361,10 +372,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1bxzcvxvrmb1ngxz0bgz1va4q9c4w8m6gc8lmdhi6gnvaaf98gsy";
+      sha256 = "05r2cxscapr9saqjw8dlp89as7jvc2mlz1h5kssrmkbz105qmfcm";
      type = "gem";
    };
-    version = "6.4.0";
+    version = "6.5.0";
  };
  RedCloth = {
    groups = ["default"];
@ -391,10 +402,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "17dhzc9hfzd8x18hfsvn9rsp4jg18wdfsdy3a5p99y5dhfh1321r";
+      sha256 = "1dnfkrk8xx2m8r3r9m2p5xcq57viznyc09k7r3i4jbm758i57lx3";
      type = "gem";
    };
-    version = "3.29.0";
+    version = "3.30.0";
  };
  rss = {
    dependencies = ["rexml"];
@ -432,10 +443,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1dld1z2mdnsf9i4fs74zdr6rfk75pkgzvvyxask5w2dsmkj7bb4m";
+      sha256 = "0z33vpk4g24zdhrwsmwbr3mhb0xpdl6jna2nscrwgq77xl6iw4jg";
      type = "gem";
    };
-    version = "1.1.1";
+    version = "1.6.2";
  };
  sass = {
    dependencies = ["sass-listen"];
@ -465,10 +476,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1x3rci7k30g96y307hvglpdgm3f7nga3k3n4i8n1v2xxx290800y";
+      sha256 = "0wkc079h6hzq737j4wycpnv7c38mhd0rl33pszyy7768zzvyjc9y";
      type = "gem";
    };
-    version = "2.2.0";
+    version = "2.2.4";
  };
  sinatra-contrib = {
    dependencies = ["multi_json" "mustermann" "rack-protection" "sinatra" "tilt"];
@ -476,10 +487,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0zzckl2n7r18fk3929hgcv8pby6hxwva0rbxw66yq6r96lnwzryb";
+      sha256 = "0s6c1k3zzxp3xa7libvlpqaby27124rccyyxcsly04ih904cxk33";
      type = "gem";
    };
-    version = "2.2.0";
+    version = "2.2.4";
  };
  sprockets = {
    dependencies = ["concurrent-ruby" "rack"];
@ -508,10 +519,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1jns0x5lbafyqyx7pgzfs6i4ykc7p6zg7gxa6hd82w40n6z9rdvi";
+      sha256 = "1al02vvy3df0q3jy8sblkgpf688bji84l4p4xq9gzkk469i23bis";
      type = "gem";
    };
-    version = "3.0.2";
+    version = "3.0.5";
  };
  therubyrhino = {
    dependencies = ["therubyrhino_jar"];
@ -539,10 +550,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0rn8z8hda4h41a64l0zhkiwz2vxw9b1nb70gl37h1dg2k874yrlv";
+      sha256 = "1qmhi6d9przjzhsyk9g5pq2j75c656msh6xzprqd2mxgphf23jxs";
      type = "gem";
    };
-    version = "2.0.10";
+    version = "2.1.0";
  };
  twitter-text = {
    dependencies = ["unf"];
@ -602,10 +613,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1d4cvgmxhfczxiq5fr534lmizkhigd15bsx5719r5ds7k7ivisc7";
+      sha256 = "13qm7s0gr2pmfcl7dxrmq38asaza4w0i2n9my4yzs499j731wh8r";
      type = "gem";
    };
-    version = "1.7.0";
+    version = "1.8.1";
  };
  wikicloth = {
    dependencies = ["builder" "expression_parser" "htmlentities" "nokogiri" "twitter-text"];
--- a/pkgs/applications/misc/pop-launcher/default.nix
+++ b/pkgs/applications/misc/pop-launcher/default.nix
@ -54,6 +54,7 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "Modular IPC-based desktop launcher service";
    homepage = "https://github.com/pop-os/launcher";
+    platforms = platforms.linux;
    license = licenses.mpl20;
    maintainers = with maintainers; [ samhug ];
  };
--- a/pkgs/applications/misc/rootbar/default.nix
+++ b/pkgs/applications/misc/rootbar/default.nix
@ -41,5 +41,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ AndersonTorres ];
    platforms = platforms.unix;
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -3,10 +3,10 @@
 rec {
  firefox = buildMozillaMach rec {
    pname = "firefox";
-    version = "111.0";
+    version = "111.0.1";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "cdb300fdbb2b60068b0fc10a18df587b417e484901d36f52dd174d320d3440a42b02ea000f325c5781fd8853a5171b1a5184562fb535ece90619e4c64d46bb82";
+      sha512 = "b16c9399a19cb1de2d865a023d54fbe71c23a363ea4d36cd58f41f64f7ad04bc1b9d8a8448943417516e17337e0ee2afd370c29a72b51b0947161f4ffab6935f";
    };

    meta = {
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@ -38,8 +38,7 @@
  buildPythonApplication = if isQt6 then python3Packages.buildPythonApplication else mkDerivationWith python3Packages.buildPythonApplication;

  pname = "qutebrowser";
-  version = if isQt6 then "unstable-2022-09-16" else "2.5.3";
-
+  version = if isQt6 then "unstable-2023-03-19" else "2.5.3";
 in

 assert withMediaPlayback -> gst_all_1 != null;
@ -49,13 +48,14 @@ buildPythonApplication {
  inherit pname version;

  src = if isQt6 then
-    # comes from qt6-v2 branch of upstream
+    # comes from the master branch of upstream
    # https://github.com/qutebrowser/qutebrowser/issues/7202
+    # https://github.com/qutebrowser/qutebrowser/discussions/7628
    fetchFromGitHub {
      owner = "qutebrowser";
      repo = "qutebrowser";
-      rev = "5e11e6c7d413cf5c77056ba871a545aae1cfd66a";
-      sha256 = "sha256-5HNzPO07lUQe/Q3Nb4JiS9kb9GMQ5/FqM5029vLNNWo=";
+      rev = "294e73660c1f3d1aff50843c25e2f8f7574c4332";
+      sha256 = "sha256-vXMME9vqB4C4MScT9j7lOz4Bvu5R8nHFKi+uz9mbqtg=";
    }
  # the release tarballs are different from the git checkout!
   else fetchurl {
@ -143,6 +143,7 @@ buildPythonApplication {
      "''${qtWrapperArgs[@]}"
      --add-flags '--backend ${backend}'
      --set QUTE_QTWEBENGINE_VERSION_OVERRIDE "${lib.getVersion qtwebengine}"
+      ${lib.optionalString isQt6 ''--set QUTE_QT_WRAPPER "PyQt6"''}
      ${lib.optionalString (pipewireSupport && backend == "webengine") ''--prefix LD_LIBRARY_PATH : ${libPath}''}
      ${lib.optionalString enableWideVine ''--add-flags "--qt-flag widevine-path=${widevine-cdm}/share/google/chrome/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so"''}
    )
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles, stdenv }:

 let
-  version = "0.41.1";
-  sha256 = "0nrwhq336n0aj1c51difgxk9an8d1j4yfkxn9sgzw9dq50rrrinf";
-  manifestsSha256 = "1rrmdbaian8wskcyaa2nifp4mp4bz0nqgwz6ah5r0ywg48cfq2gm";
+  version = "0.41.2";
+  sha256 = "0c4in6k6l9kjskcapi6gap9jkbrrfd106z6nbs48afr30cv2wp24";
+  manifestsSha256 = "0kc9s5289s5b1slk2w3sr28yk9hg3lmrpy00mw3im3k6aqgrk9j0";

  manifests = fetchzip {
    url =
@ -23,13 +23,14 @@ in buildGoModule rec {
    inherit sha256;
  };

-  vendorSha256 = "sha256-Oh1FBTHkICQZ79qf8XCL7ifi5Wd3jrIDupBKzYo+AEA=";
+  vendorSha256 = "sha256-ez4yaFZ5JROdu9boN5wI/XGMqLo8OKW6b0FZsJeFw4w=";

  postUnpack = ''
    cp -r ${manifests} source/cmd/flux/manifests
-  '';

-  patches = [ ./patches/disable-tests-ssh_key.patch ];
+    # disable tests that require network access
+    rm source/cmd/flux/create_secret_git_test.go
+  '';

  ldflags = [ "-s" "-w" "-X main.VERSION=${version}" ];

--- a/pkgs/applications/networking/cluster/fluxcd/patches/disable-tests-ssh_key.patch
+++ b/pkgs/applications/networking/cluster/fluxcd/patches/disable-tests-ssh_key.patch
@ -1,19 +0,0 @@
--- flux/cmd/flux/create_secret_git_test.go.orig	2021-12-07 13:46:21.196278468 +0100
-+++ flux/cmd/flux/create_secret_git_test.go	2021-12-07 13:49:51.668566955 +0100
-@@ -20,16 +20,6 @@
- 			args:   "create secret git podinfo-auth --url=https://github.com/stefanprodan/podinfo --username=my-username --password=my-password --namespace=my-namespace --export",
- 			assert: assertGoldenFile("./testdata/create_secret/git/secret-git-basic.yaml"),
- 		},
-		{
-			name:   "ssh key",
-			args:   "create secret git podinfo-auth --url=ssh://git@github.com/stefanprodan/podinfo --private-key-file=./testdata/create_secret/git/ecdsa.private --namespace=my-namespace --export",
-			assert: assertGoldenFile("testdata/create_secret/git/git-ssh-secret.yaml"),
-		},
-		{
-			name:   "ssh key with password",
-			args:   "create secret git podinfo-auth --url=ssh://git@github.com/stefanprodan/podinfo --private-key-file=./testdata/create_secret/git/ecdsa-password.private --password=password --namespace=my-namespace --export",
-			assert: assertGoldenFile("testdata/create_secret/git/git-ssh-secret-password.yaml"),
-		},
- 	}
- 
- 	for _, tt := range tests {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -192,13 +192,13 @@
    "vendorHash": "sha256-C7bm9wDNEO7fJuqssUxQ4t9poVkPkKd8MU7S9MJTOW4="
  },
  "checkly": {
-    "hash": "sha256-LhqdFNTc0RdKmivHI6CnBPmtMW8Sml+5MT8ZjNA4rLY=",
+    "hash": "sha256-tdimESlkfRO/kdA6JOX72vQNXFLJZ9VKwPRxsJo5WFI=",
    "homepage": "https://registry.terraform.io/providers/checkly/checkly",
    "owner": "checkly",
    "repo": "terraform-provider-checkly",
-    "rev": "v1.6.4",
+    "rev": "v1.6.5",
    "spdx": null,
-    "vendorHash": "sha256-63M0cOD5QodGMFK0GrxaJsvVFVHXDS5HdgTv4sOmaBA="
+    "vendorHash": "sha256-AFmQU1+dh6HPYaTLX54egmP57mITJ/lVQq8SJ9+vXLY="
  },
  "ciscoasa": {
    "hash": "sha256-xzc44FEy2MPo51Faq/VFwg411JK9e0kQucpt0vdN8yg=",
@ -621,11 +621,11 @@
    "vendorHash": "sha256-UnWHUD9T4nTT6Y2UrvBIdIk9eA8l0vWJ/IpEY3PIzDU="
  },
  "ksyun": {
-    "hash": "sha256-1P4iv9UbSUepsKP+xKvy+YTHAIemMkwQruTrHyAsxsI=",
+    "hash": "sha256-NcXYCdWNpH5sX9+LMASCRWsgNRtbYOTK0sOailPw+44=",
    "homepage": "https://registry.terraform.io/providers/kingsoftcloud/ksyun",
    "owner": "kingsoftcloud",
    "repo": "terraform-provider-ksyun",
-    "rev": "v1.3.67",
+    "rev": "v1.3.68",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-miHKAz+ONXtuC1DNukcyZbbaYReY69dz9Zk6cJdORdQ="
  },
@ -1163,11 +1163,11 @@
    "vendorHash": null
  },
  "ucloud": {
-    "hash": "sha256-Rh1X4AboPlHWikL/PIWTAf0f2/i3vSVsxzDp1kRuNiA=",
+    "hash": "sha256-1gKDd1lLGkDDKfg9a98J8W7kO2RZG1Q0XUM182WCdhU=",
    "homepage": "https://registry.terraform.io/providers/ucloud/ucloud",
    "owner": "ucloud",
    "repo": "terraform-provider-ucloud",
-    "rev": "v1.34.1",
+    "rev": "v1.35.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.44.5";
+  version = "0.45.0";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-1wuK3rdc17fCAZjqJNReYYPy284BHyB3gp+xUt09oIY=";
+    hash = "sha256-SyA1DP9xm8NbgDfGOyzNZwaWq6Wn8IOiiL/m516/cLw=";
  };

  vendorHash = "sha256-eY9YwXSIOrXbVWUIfVrUIRso1F5weBGKbPFv43k8t2Y=";
--- a/pkgs/applications/networking/instant-messengers/baresip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/baresip/default.nix
@ -23,6 +23,8 @@
 , spandsp3
 , libuuid
 , libvpx
+, cmake
+, dbusSupport ? true
 }:
 stdenv.mkDerivation rec {
  version = "2.9.0";
@ -33,7 +35,10 @@ stdenv.mkDerivation rec {
    rev = "v${version}";
    sha256 = "sha256-B4d8D4IfLYAIYVN80Lrh5bywD5iacSnUVwEzbc6Xq7g=";
  };
-  nativeBuildInputs = [ pkg-config ];
+  prePatch = lib.optionalString (!dbusSupport) ''
+    substituteInPlace cmake/modules.cmake --replace 'list(APPEND MODULES ctrl_dbus)' ""
+  '';
+  nativeBuildInputs = [ pkg-config cmake ];
  buildInputs = [
    zlib
    openssl
@ -56,9 +61,14 @@ stdenv.mkDerivation rec {
    libuuid
    libvpx
  ] ++ (with gst_all_1; [ gstreamer gst-libav gst-plugins-base gst-plugins-bad gst-plugins-good ]);
+
+  cmakeFlags = [
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+    "-Dre_DIR=${libre}/include/re"
+  ];
+
  makeFlags = [
    "LIBRE_MK=${libre}/share/re/re.mk"
-    "LIBRE_INC=${libre}/include/re"
    "LIBRE_SO=${libre}/lib"
    "LIBREM_PATH=${librem}"
    "PREFIX=$(out)"
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -5,7 +5,7 @@ let
    ptb = "0.0.39";
    canary = "0.0.150";
  } else {
-    stable = "0.0.264";
+    stable = "0.0.273";
    ptb = "0.0.59";
    canary = "0.0.283";
  };
@ -28,7 +28,7 @@ let
    x86_64-darwin = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        sha256 = "1jvlxmbfqhslsr16prsgbki77kq7i3ipbkbn67pnwlnis40y9s7p";
+        sha256 = "1vz2g83gz9ks9mxwx7gl7kys2xaw8ksnywwadrpsbj999fzlyyal";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
--- a/pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix
@ -5,22 +5,35 @@
 , glib-networking
 , gst_all_1
 , gtkmm3
-, libappindicator-gtk3
+, libayatana-appindicator
+, libcanberra
+, libepoxy
+, libpsl
+, libdatrie
+, libdeflate
+, libselinux
+, libsepol
+, libsysprof-capture
+, libthai
+, libxkbcommon
+, sqlite
 , pcre
+, pcre2
 , pkg-config
 , webkitgtk
 , wrapGAppsHook
+, xorg
 }:

 stdenv.mkDerivation rec {
  pname = "whatsapp-for-linux";
-  version = "1.3.1";
+  version = "1.6.1";

  src = fetchFromGitHub {
    owner = "eneshecan";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-TX6fMuhe6VHbhWJSsPM0iOV4CuCfULD5McJyHuTW4lI=";
+    sha256 = "sha256-oghO6DNVJqWFHRjUAkqfnoWc7qHJnK3givVLq6xGJeo=";
  };

  nativeBuildInputs = [
@ -36,9 +49,23 @@ stdenv.mkDerivation rec {
    gst_all_1.gst-plugins-base
    gst_all_1.gst-plugins-good
    gtkmm3
-    libappindicator-gtk3
+    libayatana-appindicator
+    libcanberra
+    libdatrie
+    libdeflate
+    libepoxy
+    libpsl
+    libselinux
+    libsepol
+    libsysprof-capture
+    libthai
+    libxkbcommon
    pcre
+    pcre2
+    sqlite
    webkitgtk
+    xorg.libXdmcp
+    xorg.libXtst
  ];

  meta = with lib; {
--- a/pkgs/applications/networking/sniffnet/default.nix
+++ b/pkgs/applications/networking/sniffnet/default.nix
@ -7,7 +7,7 @@
 , alsa-lib
 , expat
 , fontconfig
-, libGL
+, vulkan-loader
 , xorg
 , darwin
 }:
@ -33,7 +33,7 @@ rustPlatform.buildRustPackage rec {
    alsa-lib
    expat
    fontconfig
-    libGL
+    vulkan-loader
    xorg.libX11
    xorg.libXcursor
    xorg.libXi
@ -45,7 +45,7 @@ rustPlatform.buildRustPackage rec {

  postFixup = lib.optionalString stdenv.isLinux ''
    patchelf $out/bin/sniffnet \
-      --add-rpath ${lib.makeLibraryPath [ libGL xorg.libX11 ]}
+      --add-rpath ${lib.makeLibraryPath [ vulkan-loader xorg.libX11 ]}
  '';

  meta = with lib; {
--- a/pkgs/applications/terminal-emulators/havoc/default.nix
+++ b/pkgs/applications/terminal-emulators/havoc/default.nix
@ -42,6 +42,7 @@ stdenv.mkDerivation rec {
    description = "A minimal terminal emulator for Wayland";
    license = with licenses; [ mit publicDomain ];
    platforms = with platforms; unix;
+    broken = stdenv.isDarwin; # no wayland support
    maintainers = with maintainers; [ AndersonTorres ];
  };
 }
--- a/pkgs/applications/version-management/forgejo/default.nix
+++ b/pkgs/applications/version-management/forgejo/default.nix
@ -25,13 +25,13 @@

 buildGoModule rec {
  pname = "forgejo";
-  version = "1.18.5-0";
+  version = "1.19.0-2";

  src = fetchurl {
    name = "${pname}-src-${version}.tar.gz";
    # see https://codeberg.org/forgejo/forgejo/releases
-    url = "https://codeberg.org/attachments/bb93c0c9-98c4-465c-bcff-e07ac3ee72a3";
-    hash = "sha256-jyaJ7W/K1Nn44ZhyJHZD+dKObU3hYx6mmDzvbvrR7gw=";
+    url = "https://codeberg.org/attachments/2bf497db-fa91-4260-9c98-5c791b6b397c";
+    hash = "sha256-neDIT+V3qHR8xgP4iy4TJQ6PCWO3svpSA7FLCacQSMI=";
  };

  vendorHash = null;
--- a/pkgs/applications/version-management/gh/default.nix
+++ b/pkgs/applications/version-management/gh/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gh";
-  version = "2.24.3";
+  version = "2.25.1";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-Z0Z8mMTk1uAgegL4swJswCJ3D5Zi7DMTai9oQXH+2WM=";
+    hash = "sha256-CE3Ds9z5CB49Hb9IVuDKwRjGwuw+0d5zBpw2IVsO7Tc=";
  };

  vendorHash = "sha256-nn2DzjcXHiuSaiEuWNZTAZ3+OKrEpRzUPzqmH+gZ9sY=";
--- a/pkgs/applications/version-management/git-credential-keepassxc/default.nix
+++ b/pkgs/applications/version-management/git-credential-keepassxc/default.nix
@ -4,6 +4,10 @@
 , fetchFromGitHub
 , DiskArbitration
 , Foundation
+, withNotification ? false
+, withYubikey ? false
+, withStrictCaller ? false
+, withAll ? false
 }:

 rustPlatform.buildRustPackage rec {
@ -21,6 +25,12 @@ rustPlatform.buildRustPackage rec {

  buildInputs = lib.optionals stdenv.isDarwin [ DiskArbitration Foundation ];

+  buildFeatures = []
+    ++ lib.optional withNotification "notification"
+    ++ lib.optional withYubikey "yubikey"
+    ++ lib.optional withStrictCaller "strict-caller"
+    ++ lib.optional withAll "all";
+
  meta = with lib; {
    description = "Helper that allows Git (and shell scripts) to use KeePassXC as credential store";
    longDescription = ''
--- a/pkgs/applications/version-management/lefthook/default.nix
+++ b/pkgs/applications/version-management/lefthook/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "lefthook";
-  version = "1.3.5";
+  version = "1.3.7";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "evilmartians";
    repo = "lefthook";
-    sha256 = "sha256-v4ES3TbuDRUBK8xH/viP5QOZmp3eWjsy0YRaSxfTZV4=";
+    hash = "sha256-6wVzl2hu6bH2dqB/m/kgUQxRxOxMQltcGlo/TIIgh/Y=";
  };

-  vendorHash = "sha256-VeR/lyrQrjXWvHdxpG4H+XPlAud9rrlzX8GqhVzn1sg=";
+  vendorHash = "sha256-cMRl+TqSLlfoAja+JNaNKfHDR9fkvMTWdB1FT3XxPd4=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/virtualization/docker/buildx.nix
+++ b/pkgs/applications/virtualization/docker/buildx.nix
@ -2,15 +2,17 @@

 buildGoModule rec {
  pname = "docker-buildx";
-  version = "0.9.1";
+  version = "0.10.4";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "buildx";
    rev = "v${version}";
-    sha256 = "sha256-nJR+wpWa7y8Mq6WWj1ZH/FRCtar40XP2fwyl1hMgELI=";
+    sha256 = "sha256-hYEFboZa6RGiy0wr7NEWaf5KCz/O7KGXTc6c9hMmoXk=";
  };

+  doCheck = false;
+
  vendorSha256 = null;

  ldflags = [
@ -32,6 +34,6 @@ buildGoModule rec {
    description = "Docker CLI plugin for extended build capabilities with BuildKit";
    homepage = "https://github.com/docker/buildx";
    license = licenses.asl20;
-    maintainers = [ maintainers.ivan-babrou ];
+    maintainers = with maintainers; [ ivan-babrou developer-guy ];
  };
 }
--- a/pkgs/applications/window-managers/leftwm/default.nix
+++ b/pkgs/applications/window-managers/leftwm/default.nix
@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = rpathLibs;

  postInstall = ''
-    for p in $out/bin/leftwm*; do
+    for p in $out/bin/left*; do
      patchelf --set-rpath "${lib.makeLibraryPath rpathLibs}" $p
    done
  '';
--- a/pkgs/applications/window-managers/miriway/default.nix
+++ b/pkgs/applications/window-managers/miriway/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "miriway";
-  version = "unstable-2023-02-18";
+  version = "unstable-2023-03-17";

  src = fetchFromGitHub {
    owner = "Miriway";
    repo = "Miriway";
-    rev = "1363ae0452c5093f84418bc65354e93796caec65";
-    hash = "sha256-hQ2z3GlTJG9qewJLkPpoRMSn0D7xCLyl+1O+G4NnedA=";
+    rev = "f4c52fee6c1aeba40fc3e8cb1d6ec7354da0765b";
+    hash = "sha256-/Av/gRTK3y0TlW3BqS+LPj8nS/4SXQpavYDpdvHwPqI=";
  };

  strictDeps = true;
--- a/pkgs/data/fonts/bqn386/default.nix
+++ b/pkgs/data/fonts/bqn386/default.nix
@ -0,0 +1,30 @@
+{ lib, stdenvNoCC, fetchFromGitHub }:
+
+stdenvNoCC.mkDerivation {
+  pname = "bqn386";
+  version = "unstable-2022-05-16";
+
+  src = fetchFromGitHub {
+    owner = "dzaima";
+    repo = "BQN386";
+    rev = "81e18d1eb8cb6b66df9e311b3b63ec086d910d18";
+    hash = "sha256-f0MbrxdkEiOqod41U07BvdDFDbFCqJuGyDIcx2Y24D0=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 -t $out/share/fonts/truetype *.ttf
+    install -Dm644 -t $out/share/fonts/woff2 *.woff2
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An APL and BQN font extending on APL386";
+    homepage = "https://dzaima.github.io/BQN386/";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ skykanin ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
@ -8,6 +8,7 @@
 , libXrandr
 , libwnck
 , libxfce4ui
+, libxfce4util
 , libxklavier
 , pam
 , systemd
@ -18,9 +19,9 @@
 mkXfceDerivation {
  category = "apps";
  pname = "xfce4-screensaver";
-  version = "4.16.0";
+  version = "4.18.0";

-  sha256 = "1vblqhhzhv85yd5bz1xg14yli82ys5qrjdcabg3l53glbk61n99p";
+  sha256 = "sha256-W9rEssR6jHMBM2m1lCBvj7YMOGOTaqBAOP7grQ01880=";

  buildInputs = [
    dbus-glib
@ -32,6 +33,7 @@ mkXfceDerivation {
    libXrandr
    libwnck
    libxfce4ui
+    libxfce4util
    libxklavier
    pam
    systemd
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-notes-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-notes-plugin/default.nix
@ -13,11 +13,11 @@ let
  category = "panel-plugins";
 in stdenv.mkDerivation rec {
  pname  = "xfce4-notes-plugin";
-  version = "1.9.0";
+  version = "1.10.0";

  src = fetchurl {
    url = "mirror://xfce/src/${category}/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-E/kJyUi2Oflt5kz3k+t0yxd5WJIB05M+/yFO6PNasIg=";
+    sha256 = "sha256-LuRAYELt01KpHhZsg7YNEyIO8E3OP6a54OsTY21jaSk=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-windowck-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-windowck-plugin/default.nix
@ -1,37 +1,47 @@
-{ lib
-, mkXfceDerivation
-, imagemagick
+{ stdenv
+, lib
+, fetchurl
+, intltool
+, pkg-config
 , libwnck
 , libxfce4ui
-, python3
 , xfce4-panel
 , xfconf
+, gitUpdater
 }:

-mkXfceDerivation {
-  category = "panel-plugins";
+stdenv.mkDerivation rec {
  pname = "xfce4-windowck-plugin";
-  version = "0.5.0";
-  rev-prefix = "v";
-  odd-unstable = false;
-  sha256 = "sha256-MhNSgI74VLdoS5yL6nfRrVrPvv7+0P5meO4zQheYFzo=";
+  version = "0.5.1";
+
+  src = fetchurl {
+    # Use dist tarballs to avoid pulling extra deps and generating images ourselves.
+    url = "mirror://xfce/src/panel-plugins/xfce4-windowck-plugin/${lib.versions.majorMinor version}/xfce4-windowck-plugin-${version}.tar.bz2";
+    sha256 = "sha256-p4FEi3gemE072lmw2qsNGE1M7CJSMW9zcKxKmO/kgfQ=";
+  };
+
+  nativeBuildInputs = [
+    intltool
+    pkg-config
+  ];

  buildInputs = [
-    imagemagick
    libwnck
    libxfce4ui
-    python3
    xfce4-panel
    xfconf
  ];

-  postPatch = ''
-    patchShebangs themes/windowck{,-dark}/{xfwm4,unity}/generator.py
-  '';
+  passthru.updateScript = gitUpdater {
+    url = "https://gitlab.xfce.org/panel-plugins/xfce4-windowck-plugin";
+    rev-prefix = "xfce4-windowck-plugin-";
+  };

  meta = with lib; {
    description = "Xfce panel plugin for displaying window title and buttons";
+    homepage = "https://gitlab.xfce.org/panel-plugins/xfce4-windowck-plugin";
    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
    maintainers = with maintainers; [ ] ++ teams.xfce.members;
  };
 }
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-xkb-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-xkb-plugin/default.nix
@ -1,6 +1,7 @@
 { lib
 , mkXfceDerivation
 , gtk3
+, libnotify
 , librsvg
 , libwnck
 , libxklavier
@ -14,13 +15,13 @@
 mkXfceDerivation {
  category = "panel-plugins";
  pname = "xfce4-xkb-plugin";
-  version = "0.8.2";
-  rev-prefix = "";
-  sha256 = "sha256-xmCoNMxykeaThYEJo6BcbraFo9CruFZL6YPjovzb6hg=";
+  version = "0.8.3";
+  sha256 = "sha256-qWxjULrBpueQS3gxwRg49cQ3ovlQ8iWvYZ6Z/THm+/s=";

  buildInputs = [
    garcon
    gtk3
+    libnotify # optional notification support
    librsvg
    libxfce4ui
    libxfce4util
--- a/pkgs/desktops/xfce/thunar-plugins/archive/default.nix
+++ b/pkgs/desktops/xfce/thunar-plugins/archive/default.nix
@ -11,9 +11,10 @@
 mkXfceDerivation {
  category = "thunar-plugins";
  pname  = "thunar-archive-plugin";
-  version = "0.4.0";
+  version = "0.5.0";
+  odd-unstable = false;

-  sha256 = "sha256-aEAErm87K2k8TAz2ZtMQEhmzhOeR2hkJjcoBUFn8I50=";
+  sha256 = "sha256-3a42chfv4UQYkvWKCX0FShAcEwt9icJARTHGEgs6/8M=";

  nativeBuildInputs = [
    intltool
--- a/pkgs/desktops/xfce/thunar-plugins/media-tags/default.nix
+++ b/pkgs/desktops/xfce/thunar-plugins/media-tags/default.nix
@ -1,8 +1,8 @@
 { lib
 , mkXfceDerivation
+, glib
 , gtk3
 , thunar
-, exo
 , libxfce4util
 , intltool
 , gettext
@ -12,10 +12,10 @@
 mkXfceDerivation {
  category = "thunar-plugins";
  pname = "thunar-media-tags-plugin";
-  version = "0.3.0";
+  version = "0.4.0";
  odd-unstable = false;

-  sha256 = "sha256-jtgcHH5U5GOvzDVUwPEreMtTdk5DT6sXvFPDbzbF684=";
+  sha256 = "sha256-2WA7EtDmNl8XP0wK00iyQcSqV3mnfHNJZTKhBJ/YWPQ=";

  nativeBuildInputs = [
    intltool
@ -24,7 +24,7 @@ mkXfceDerivation {

  buildInputs = [
    thunar
-    exo
+    glib
    gtk3
    libxfce4util
    taglib
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@ -75,8 +75,8 @@ let

      elixir-ls = callPackage ./elixir-ls { inherit elixir fetchMixDeps mixRelease; };

-      lfe = lfe_1_3;
-      lfe_1_3 = lib'.callLFE ../interpreters/lfe/1.3.nix { inherit erlang buildRebar3 buildHex; };
+      lfe = lfe_2_1;
+      lfe_2_1 = lib'.callLFE ../interpreters/lfe/2.1.nix { inherit erlang buildRebar3 buildHex; };

      # Non hex packages. Examples how to build Rebar/Mix packages with and
      # without helper functions buildRebar3 and buildMix.
--- a/pkgs/development/compilers/dart/default.nix
+++ b/pkgs/development/compilers/dart/default.nix
@ -4,43 +4,11 @@
 , unzip
 , runCommand
 , darwin
-# we need a way to build other dart versions
-# than the latest, because flutter might want
-# another version
-, version ? "2.19.3"
-, sources ? let
-    base = "https://storage.googleapis.com/dart-archive/channels";
-    x86_64 = "x64";
-    i686 = "ia32";
-    aarch64 = "arm64";
-in
-  {
-    "${version}-aarch64-darwin" = fetchurl {
-      url = "${base}/stable/release/${version}/sdk/dartsdk-macos-${aarch64}-release.zip";
-      sha256 = "sha256-wfUh6rXy8jAC0TVQJzXh4SrV2DQs9SvY8PGtNgZx+cA=";
-    };
-    "${version}-x86_64-darwin" = fetchurl {
-      url = "${base}/stable/release/${version}/sdk/dartsdk-macos-${x86_64}-release.zip";
-      sha256 = "sha256-zyu6r8akId/AHpBKH95wJXXu1LD9CKShWYKfppnSRx4=";
-    };
-    "${version}-x86_64-linux" = fetchurl {
-      url = "${base}/stable/release/${version}/sdk/dartsdk-linux-${x86_64}-release.zip";
-      sha256 = "sha256-45HE7Y9iO5dI+JfLWF1ikFfBFB+er46bK+EYkyuhFjI=";
-    };
-    "${version}-i686-linux" = fetchurl {
-      url = "${base}/stable/release/${version}/sdk/dartsdk-linux-${i686}-release.zip";
-      sha256 = "sha256-IkSJWfAocT1l8F2igAkR+Y5PNYD5PZ0j21D8aJk9JCY=";
-    };
-    "${version}-aarch64-linux" = fetchurl {
-      url = "${base}/stable/release/${version}/sdk/dartsdk-linux-${aarch64}-release.zip";
-      sha256 = "sha256-Bt18brbJA/XfiyP5o197HDXMuGm+a1AZx92Thoriv78=";
-    };
-  }
+, sources ? import ./sources.nix {inherit fetchurl;}
+, version ? sources.versionUsed
 }:

-assert version != null && version != "";
 assert sources != null && (builtins.isAttrs sources);
-
 stdenv.mkDerivation (finalAttrs: {
  pname = "dart";
  inherit version;
@ -59,29 +27,33 @@ stdenv.mkDerivation (finalAttrs: {

  libPath = lib.makeLibraryPath [ stdenv.cc.cc ];
  dontStrip = true;
-  passthru.tests = {
-    testCreate = runCommand "dart-test-create" { nativeBuildInputs = [ finalAttrs.finalPackage ]; } ''
-      PROJECTNAME="dart_test_project"
-      dart create --no-pub $PROJECTNAME
+  passthru = {
+    updateScript = ./update.sh;
+    tests = {
+      testCreate = runCommand "dart-test-create" { nativeBuildInputs = [ finalAttrs.finalPackage ]; } ''
+        PROJECTNAME="dart_test_project"
+        dart create --no-pub $PROJECTNAME

-      [[ -d $PROJECTNAME ]]
-      [[ -f $PROJECTNAME/bin/$PROJECTNAME.dart ]]
-      touch $out
-    '';
+        [[ -d $PROJECTNAME ]]
+        [[ -f $PROJECTNAME/bin/$PROJECTNAME.dart ]]
+        touch $out
+      '';

-    testCompile = runCommand "dart-test-compile" {
-      nativeBuildInputs = [ finalAttrs.finalPackage ]
-        ++ lib.optionals stdenv.isDarwin [ darwin.cctools darwin.sigtool ];
-    } ''
-      HELLO_MESSAGE="Hello, world!"
-      echo "void main() => print('$HELLO_MESSAGE');" > hello.dart
-      dart compile exe hello.dart
-      PROGRAM_OUT=$(./hello.exe)
+      testCompile = runCommand "dart-test-compile" {
+        nativeBuildInputs = [ finalAttrs.finalPackage ]
+          ++ lib.optionals stdenv.isDarwin [ darwin.cctools darwin.sigtool ];
+      } ''
+        HELLO_MESSAGE="Hello, world!"
+        echo "void main() => print('$HELLO_MESSAGE');" > hello.dart
+        dart compile exe hello.dart
+        PROGRAM_OUT=$(./hello.exe)

-      [[ "$PROGRAM_OUT" == "$HELLO_MESSAGE" ]]
-      touch $out
-    '';
+        [[ "$PROGRAM_OUT" == "$HELLO_MESSAGE" ]]
+        touch $out
+      '';
+    };
  };
+
  meta = with lib; {
    homepage = "https://www.dartlang.org/";
    maintainers = with maintainers; [ grburst ];
--- a/pkgs/development/compilers/dart/sources.nix
+++ b/pkgs/development/compilers/dart/sources.nix
@ -0,0 +1,24 @@
+let version = "2.19.3"; in
+{  fetchurl }: {
+  versionUsed = version;
+  "${version}-x86_64-darwin" = fetchurl {
+    url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${version}/sdk/dartsdk-macos-x64-release.zip";
+    sha256 = "193hf56j7bws8bzqxxzz2sgbn2d80g5s8vp8ihi22cm3mmppfi4v";
+  };
+  "${version}-aarch64-darwin" = fetchurl {
+    url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${version}/sdk/dartsdk-macos-arm64-release.zip";
+    sha256 = "0b30l8kfcsl1j6w2vbq08p0v4h4gca013l5fpznjqq0midxhybnw";
+  };
+  "${version}-aarch64-linux" = fetchurl {
+    url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${version}/sdk/dartsdk-linux-arm64-release.zip";
+    sha256 = "0qyi7ppsf4rmzx1qgx3qbn4k7bgbncxjql6a9f2b1aj6l6lllvmg";
+  };
+  "${version}-x86_64-linux" = fetchurl {
+    url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${version}/sdk/dartsdk-linux-x64-release.zip";
+    sha256 = "0iq7mdwpsnykk3j2bsgmazg30m4qg7i2lpv1ygbhy2lbhrkdpdck";
+  };
+  "${version}-i686-linux" = fetchurl {
+    url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${version}/sdk/dartsdk-linux-ia32-release.zip";
+    sha256 = "0xksis14ff6bzjvycgxgldg96n88rh42adjyrrhcay2s183vh480";
+  };
+}
--- a/pkgs/development/compilers/dart/update.sh
+++ b/pkgs/development/compilers/dart/update.sh
@ -0,0 +1,77 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq
+
+set -euo pipefail
+
+# so if the script fails, debug logs are on stderr
+log() {
+  >&2 echo "DART_UPDATER: $@"
+}
+
+# fetch the latest version number from upstream
+NEW_VER_DETAILS=$(curl -sL https://storage.googleapis.com/dart-archive/channels/stable/release/latest/VERSION)
+NEW_VER=$(jq -r '.version' <<< "$NEW_VER_DETAILS")
+
+MY_PATH=$(dirname $(realpath "$0"))
+SRC_FILE=$(mktemp)
+
+log "file to write is $SRC_FILE"
+
+PRELUDE="let version = \"$NEW_VER\"; in
+{ fetchurl }: {
+  versionUsed = version;"
+echo "$PRELUDE" > "$SRC_FILE"
+log "wrote prelude"
+
+# Fetches the source, then  writes the fetcher and hash into the sources file.
+# Arguments:
+#   - $1: VARIABLE NAME of (table of nix platform -> dart platform mappings) ("DARWIN_PLATFORMS"|"LIN_PLATFORMS")
+#   - $2: Dart-OS ("macos"|"linux")
+write_for_platform() {
+  BASE_OF_ALL_URLS='https://storage.googleapis.com/dart-archive/channels/stable/release'
+  BASE_URL_WRITTEN="$BASE_OF_ALL_URLS/\${version}/sdk"
+  BASE_URL_FETCHED="$BASE_OF_ALL_URLS/$NEW_VER/sdk"
+
+  TABLE_NAME=$1
+  declare -n TABLE=$TABLE_NAME
+
+  for platform in "${!TABLE[@]}"; do
+    DART_PLATFORM="${TABLE[$platform]}"
+    log "trying for dartplatform $DART_PLATFORM (platform $platform) (OS $2)"
+
+    URL_POSTFIX="dartsdk-$2-$DART_PLATFORM-release.zip"
+    URL="$BASE_URL_FETCHED/$URL_POSTFIX"
+    log "URL for $DART_PLATFORM: $URL"
+
+    HASH=$(nix-prefetch-url "$URL" --type sha256)
+    log "hash for platform $platform: $HASH"
+
+    FETCHER="  \"\${version}-$platform\" = fetchurl {
+    url = \"$BASE_URL_WRITTEN/$URL_POSTFIX\";
+    sha256 = \"$HASH\";
+  };"
+
+    echo "$FETCHER" >> $SRC_FILE
+  done
+  log "finished for $1"
+
+}
+
+# Map nix platforms -> Dart platforms
+X8664="x64"
+AARCH64="arm64"
+I686="ia32"
+declare -A DARWIN_PLATFORMS=(["aarch64-darwin"]="$AARCH64"
+        ["x86_64-darwin"]="$X8664")
+
+declare -A LIN_PLATFORMS=( ["x86_64-linux"]="$X8664"
+        ["i686-linux"]="$I686"
+        ["aarch64-linux"]="$AARCH64")
+
+write_for_platform "DARWIN_PLATFORMS" "macos"
+write_for_platform "LIN_PLATFORMS" "linux"
+
+echo '}' >> $SRC_FILE
+
+log "moving tempfile to target directory"
+mv "$SRC_FILE" "$MY_PATH/sources.nix"
--- a/pkgs/development/compilers/haxe/default.nix
+++ b/pkgs/development/compilers/haxe/default.nix
@ -14,8 +14,7 @@ let
      dune_3
      luv
      extlib
-    ] else if lib.versionAtLeast version "4.0"
-    then with ocaml-ng.ocamlPackages_4_10; [
+    ] else with ocaml-ng.ocamlPackages_4_10; [
      ocaml
      findlib
      sedlex
@ -26,9 +25,6 @@ let
      dune_3
      luv
      extlib-1-7-7
-    ] else with ocaml-ng.ocamlPackages_4_05; [
-      ocaml
-      camlp4
    ];

  defaultPatch = ''
@ -120,24 +116,6 @@ let
      };
    };
 in {
-  # this old version is required to compile some libraries
-  haxe_3_2 = generic {
-    version = "3.2.1";
-    sha256 = "1x9ay5a2llq46fww3k07jxx8h1vfpyxb522snc6702a050ki5vz3";
-    prePatch = ''
-      sed -i -e 's|"/usr/lib/haxe/std/";|"'"$out/lib/haxe/std/"'";\n&|g' main.ml
-      substituteInPlace extra/haxelib_src/src/tools/haxelib/Main.hx \
-        --replace '"neko"' '"${neko}/bin/neko"'
-    '';
-  };
-  haxe_3_4 = generic {
-    version = "3.4.6";
-    sha256 = "1myc4b8fwp0f9vky17wv45n34a583f5sjvajsc93f5gm1wanp4if";
-    prePatch = ''
-      ${defaultPatch}
-      sed -i -re 's!(let +prefix_path += +).*( +in)!\1"'"$out/"'"\2!' src/main.ml
-    '';
-  };
  haxe_4_0 = generic {
    version = "4.0.5";
    sha256 = "0f534pchdx0m057ixnk07ab4s518ica958pvpd0vfjsrxg5yjkqa";
--- a/pkgs/development/compilers/open-watcom/v2.nix
+++ b/pkgs/development/compilers/open-watcom/v2.nix
@ -13,13 +13,13 @@
 stdenv.mkDerivation rec {
  pname = "${passthru.prettyName}-unwrapped";
  # nixpkgs-update: no auto update
-  version = "unstable-2023-01-30";
+  version = "unstable-2023-03-20";

  src = fetchFromGitHub {
    owner = "open-watcom";
    repo = "open-watcom-v2";
-    rev = "996740acdbb173499ec1bf2ba6c8942f2a374220";
-    sha256 = "sha256-9m+0e2v1Hk8jYZHqJwb1mN02WgGDArsWbF7Ut3Z5OIg=";
+    rev = "d9181a345b9301a64380eb40d78c74c197a3fa1e";
+    sha256 = "sha256-2kT4OZJk6m6Z/XN2q17jXJPgAG4nD2U1+J5CZl4+tAs=";
  };

  postPatch = ''
--- a/pkgs/development/interpreters/erlang/R21.nix
+++ b/pkgs/development/interpreters/erlang/R21.nix
--- a/pkgs/development/interpreters/erlang/R22.nix
+++ b/pkgs/development/interpreters/erlang/R22.nix
--- a/pkgs/development/interpreters/erlang/R23.nix
+++ b/pkgs/development/interpreters/erlang/R23.nix
--- a/pkgs/development/interpreters/erlang/R24.nix
+++ b/pkgs/development/interpreters/erlang/R24.nix
--- a/pkgs/development/interpreters/erlang/R25.nix
+++ b/pkgs/development/interpreters/erlang/R25.nix
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@ -158,7 +158,7 @@ stdenv.mkDerivation ({
        latest=$(list-git-tags --url=https://github.com/erlang/otp.git | sed -n 's/^OTP-${major}/${major}/p' | sort -V | tail -1)
        if [ "$latest" != "${version}" ]; then
          nixpkgs="$(git rev-parse --show-toplevel)"
-          nix_file="$nixpkgs/pkgs/development/interpreters/erlang/R${major}.nix"
+          nix_file="$nixpkgs/pkgs/development/interpreters/erlang/${major}.nix"
          update-source-version ${baseName}R${major} "$latest" --version-key=version --print-changes --file="$nix_file"
        else
          echo "${baseName}R${major} is already up-to-date"
--- a/pkgs/development/interpreters/lfe/1.2.nix
+++ b/pkgs/development/interpreters/lfe/1.2.nix
@ -1,7 +0,0 @@
-{ mkDerivation }:
-
-mkDerivation {
-  version = "1.2.1";
-  sha256 = "0j5gjlsk92y14kxgvd80q9vwyhmjkphpzadcswyjxikgahwg1avz";
-  maximumOTPVersion = "19";
-}
--- a/pkgs/development/interpreters/lfe/1.3.nix
+++ b/pkgs/development/interpreters/lfe/1.3.nix
@ -1,43 +0,0 @@
-{ fetchpatch, mkDerivation }:
-
-let
-  _fetchpatch =
-    { rev, sha256 }:
-    fetchpatch {
-      url = "https://github.com/rvirding/lfe/commit/${rev}.patch";
-      inherit sha256;
-    };
-  fetchPatches = map _fetchpatch;
-in
-
-mkDerivation {
-  version = "1.3";
-  sha256 = "0pgwi0h0d34353m39jin8dxw4yykgfcg90k6pc4qkjyrg40hh4l6";
-  maximumOTPVersion = "21";
-  patches = fetchPatches [
-    {
-      rev = "b457e5d521bb35008e6049fab31b4073cc10d583";
-      sha256 = "1zrq1b3291xhb0jsirgb5s8hacq5xvz7xidsp29aqcnpazdvivdc";
-    }
-    {
-      rev = "5fe9f37741b7d53bd43109fd3435e1437f124a0d";
-      sha256 = "1anqlcbih52lc0wynf58r67w1jhn264lz49rczwgh19pqg92dvqf";
-    }
-    {
-      rev = "b8f3e06511cb6805cf3a904c1589b27f33f3958d";
-      sha256 = "1zqafc0asm9m6cq7r0brvfawv69fqggy1phif3zknjmpicf25pqf";
-    }
-    {
-      rev = "40c239a608460e55563edb68c1b6faca57518b54";
-      sha256 = "03av5115jwyammw337xzy50l6api5h0wbwwda5vzw0w10zwb2z8y";
-    }
-    {
-      rev = "5faa7106419263689bfc0bc08a7451ccb1fba718";
-      sha256 = "0ml5yh5b3rn4ympks4bpx409hkra0i79zvq80azk0kmbjd869fxp";
-    }
-    {
-      rev = "9ff978693babcfd043d741b5c6940920b8315892";
-      sha256 = "04968dmp527wbkdv7dqpaj3nsyjls93whc1b5hx73b39dvl3n3y1";
-    }
-  ];
-}
--- a/pkgs/development/interpreters/lfe/2.1.nix
+++ b/pkgs/development/interpreters/lfe/2.1.nix
@ -0,0 +1,7 @@
+{ fetchpatch, mkDerivation }:
+
+mkDerivation {
+  version = "2.1.1";
+  sha256 = "sha256-HUOVBzUaU0ixIfPPctwR2TPijxJjcFY3dJ8Z7Ot2bpE=";
+  maximumOTPVersion = "25";
+}
--- a/pkgs/development/interpreters/lfe/fix-rebar-config.patch
+++ b/pkgs/development/interpreters/lfe/fix-rebar-config.patch
@ -1,29 +1,24 @@
 diff --git a/rebar.config b/rebar.config
-index 1d5a68e..a86ee39 100644
+index 1204a6f..7e2c102 100644
 --- a/rebar.config
 +++ b/rebar.config
-@@ -2,20 +2,20 @@
- 
- {erl_opts, [debug_info]}.
- 
-{profiles, [{test, [{deps, [proper]}]}]}.
-+%%{profiles, [{test, [{deps, [proper]}]}]}.
+@@ -23,16 +23,16 @@
 
 {pre_hooks, [{"(linux|darwin|solaris|freebsd|netbsd|openbsd)", ct,
-               "bin/lfe bin/lfec"
+               "bin/lfescript bin/lfec"
 -              " -o $REBAR_DEPS_DIR/lfe/test"
 +              " -o test"
               " test/*_SUITE.lfe"},
              {"(linux|darwin|solaris|freebsd|netbsd|openbsd)", eunit,
-               "bin/lfe bin/lfec"
+               "bin/lfescript bin/lfec"
 -              " -o $REBAR_DEPS_DIR/lfe/ebin"
 +              " -o ebin"
-               " test/clj-tests.lfe"},
+               " test/clj-tests.lfe test/maps-tests.lfe"},
              %% TODO: Test this on a win32 box
              %%  {"win32", ct,
-              %%   "bin/lfe bin/lfec -o $REBAR_DEPS_DIR/lfe/test test/*_SUITE.lfe"}
+              %%   "bin/lfescript bin/lfec -o $REBAR_DEPS_DIR/lfe/test test/*_SUITE.lfe"}
              {"(linux|darwin|solaris|freebsd|netbsd|openbsd)", app_compile,
-              "bin/lfe bin/lfec -o $REBAR_DEPS_DIR/lfe/ebin src/*.lfe"}
-+              "bin/lfe bin/lfec -o ebin src/*.lfe"}
+-              "bin/lfescript bin/lfec -o $REBAR_DEPS_DIR/lfe/ebin src/*.lfe"}
+              "bin/lfescript bin/lfec -o ebin src/*.lfe"}
              %% TODO: equivalent win32 hook
             ]}.
--- a/pkgs/development/interpreters/lfe/generic-builder.nix
+++ b/pkgs/development/interpreters/lfe/generic-builder.nix
@ -18,13 +18,9 @@ let

  proper = buildHex {
    name = "proper";
-    version = "1.1.1-beta";
+    version = "1.4.0";

-    sha256  = "0hnkhs761yjynw9382w8wm4j3x0r7lllzavaq2kh9n7qy3zc1rdx";
-
-    configurePhase = ''
-      ${erlang}/bin/escript write_compile_flags include/compile_flags.hrl
-    '';
+    sha256  = "sha256-GChYQhhb0z772pfRNKXLWgiEOE2zYRn+4OPPpIhWjLs=";
  };

 in
--- a/pkgs/development/interpreters/php/8.1.nix
+++ b/pkgs/development/interpreters/php/8.1.nix
@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "8.1.16";
-    hash = "sha256-zZ8OoU2C2UVVh6SaC2yAKnuNj/eXA/n0ixfbAQ+2M84=";
+    version = "8.1.17";
+    hash = "sha256-9Pspig6wkflE7OusV7dtqudoqXDC9RYQpask802MDK8=";
  });

 in
--- a/pkgs/development/interpreters/php/8.2.nix
+++ b/pkgs/development/interpreters/php/8.2.nix
@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "8.2.3";
-    hash = "sha256-h7tYhl849eKUGBMCkVLOohAv4pYbtNaLiPgx3dBUjQ8=";
+    version = "8.2.4";
+    hash = "sha256-eRhvlL1RDbhuMeU13USCd6Hrkqh4eDA6Hq1EYC2LEZc=";
  });

 in
--- a/pkgs/development/libraries/cimg/default.nix
+++ b/pkgs/development/libraries/cimg/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "cimg";
-  version = "3.2.1";
+  version = "3.2.2";

  src = fetchFromGitHub {
-    owner = "dtschump";
+    owner = "GreycLab";
    repo = "CImg";
    rev = "v.${version}";
-    hash = "sha256-MPkZGKewusCw5TsW5NOtnrjqEK2dxRSCal1fn7Yiaio=";
+    hash = "sha256-koXew0Lwb7wW8MQctTjxpo7TNVtrS5MzxQFfUS1gwZs=";
  };

  outputs = [ "out" "doc" ];
@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
      processing applications.
    '';
    license = licenses.cecill-c;
-    maintainers = [ maintainers.AndersonTorres ];
+    maintainers = [ maintainers.AndersonTorres maintainers.lilyinstarlight ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/libsvm/default.nix
+++ b/pkgs/development/libraries/libsvm/default.nix
@ -1,33 +1,49 @@
-{lib, stdenv, fetchurl}:
+{ lib
+, stdenv
+, fetchurl
+, fixDarwinDylibNames
+, llvmPackages
+, withOpenMP ? true
+}:

 stdenv.mkDerivation rec {
  pname = "libsvm";
-  version = "3.25";
+  version = "3.31";

  src = fetchurl {
    url = "https://www.csie.ntu.edu.tw/~cjlin/libsvm/libsvm-${version}.tar.gz";
-    sha256 = "sha256-UjUOiqdAsXbh13Pp3AjxNAIYw34BvsN6uQ2wEn5LteU=";
+    sha256 = "sha256-AKtWH0jfX8kqhCCa2P5Rmery5Rmzwnm6z8k1l4p1zx8=";
  };

-  buildPhase = ''
-    make
-    make lib
-  '';
+  patches = lib.optionals withOpenMP [ ./openmp.patch ];

-  installPhase = let
-    libSuff = stdenv.hostPlatform.extensions.sharedLibrary;
-  in ''
-    install -D libsvm.so.2 $out/lib/libsvm.2${libSuff}
-    ln -s $out/lib/libsvm.2${libSuff} $out/lib/libsvm${libSuff}
-    install -Dt $out/bin/ svm-scale svm-train svm-predict
-    install -Dm644 -t $out/include svm.h
-    mkdir $out/include/libsvm
-    ln -s $out/include/svm.h $out/include/libsvm/svm.h
-  '';
+  buildInputs = lib.optionals (stdenv.cc.isClang && withOpenMP) [ llvmPackages.openmp ];

-  postFixup = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -id libsvm.2.dylib $out/lib/libsvm.2.dylib;
-  '';
+  buildFlags = [ "lib" "all" ];
+
+  outputs = [ "out" "bin" "dev" ];
+
+  nativeBuildInputs = lib.optionals stdenv.isDarwin [ fixDarwinDylibNames ];
+
+  installPhase =
+    let
+      libSuff = stdenv.hostPlatform.extensions.sharedLibrary;
+      soVersion = "3";
+    in
+    ''
+      runHook preInstall
+
+      install -D libsvm.so.${soVersion} $out/lib/libsvm.${soVersion}${libSuff}
+      ln -s $out/lib/libsvm.${soVersion}${libSuff} $out/lib/libsvm${libSuff}
+
+      install -Dt $bin/bin/ svm-scale svm-train svm-predict
+
+      install -Dm644 -t $dev/include svm.h
+      mkdir $dev/include/libsvm
+      ln -s $dev/include/svm.h $dev/include/libsvm/svm.h
+
+      runHook postInstall
+    '';

  meta = with lib; {
    description = "A library for support vector machines";
--- a/pkgs/development/libraries/libsvm/openmp.patch
+++ b/pkgs/development/libraries/libsvm/openmp.patch
@ -0,0 +1,13 @@
+--- /Makefile	1970-01-01 01:00:01.000000000 +0100
+++ /Makefile	1970-01-01 01:00:01.000000000 +0100
+@@ -9,8 +9,8 @@
+ endif
+ 
+ # Uncomment the following lines to enable parallelization with OpenMP
+-# CFLAGS += -fopenmp
+-# SHARED_LIB_FLAG += -fopenmp
+CFLAGS += -fopenmp
+SHARED_LIB_FLAG += -fopenmp
+ 
+ all: svm-train svm-predict svm-scale
+ 
--- a/pkgs/development/libraries/minixml/default.nix
+++ b/pkgs/development/libraries/minixml/default.nix
@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-l7GUA+vlSECi/72eU3Y9COpGtLTRh3vYcHUi+uRkCn8=";
  };

+  # remove the -arch flags which are set by default in the build
+  configureFlags = lib.optionals stdenv.isDarwin [
+    "--with-archflags=\"-mmacosx-version-min=10.14\""
+  ];
+
  enableParallelBuilding = true;

  meta = with lib; {
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@ -1,20 +1,17 @@
-{ mkDerivation, fetchurl, makeWrapper, unzip, lib, php }:
+{ mkDerivation, fetchurl, makeBinaryWrapper, unzip, lib, php }:

-let
+mkDerivation rec {
  pname = "composer";
-  version = "2.5.1";
-in
-mkDerivation {
-  inherit pname version;
+  version = "2.5.4";

  src = fetchurl {
    url = "https://github.com/composer/composer/releases/download/${version}/composer.phar";
-    sha256 = "sha256-8blP7hGlvWoarl13yNomnfJ8cF/MgG6/TIwub6hkXCA=";
+    sha256 = "sha256-kc5sv5Rj6uhq6dXCHUL6pgGlGfP7srYjpV7iRngHm9M=";
  };

  dontUnpack = true;

-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeBinaryWrapper ];

  installPhase = ''
    runHook preInstall
--- a/pkgs/development/python-modules/aardwolf/default.nix
+++ b/pkgs/development/python-modules/aardwolf/default.nix
@ -22,7 +22,7 @@

 buildPythonPackage rec {
  pname = "aardwolf";
-  version = "0.2.1";
+  version = "0.2.7";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -30,15 +30,15 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "skelsec";
    repo = "aardwolf";
-    rev = "86c4b511e0dfeeb767081902af2244f6297a68eb";
-    hash = "sha256-ULczCJWVLrj0is6UYZxJNyLV6opzoJAFStqsjEmjaIA=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xz3461QgZ2tySj2cTlKQ5faYQDSECvbk1U6QCbzM86w=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    sourceRoot = "source/aardwolf/utils/rlers";
    name = "${pname}-${version}";
-    hash = "sha256-F6NLWc5B577iH0uKAdj2y2TtQfo4eeXkMIK6he1tpvQ=";
+    hash = "sha256-JGXTCCyC20EuUX0pP3xSZG3qFB5jRL7+wW2YRC3EiCc=";
  };

  cargoRoot = "aardwolf/utils/rlers";
@ -78,6 +78,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Asynchronous RDP protocol implementation";
    homepage = "https://github.com/skelsec/aardwolf";
+    changelog = "https://github.com/skelsec/aardwolf/releases/tag/${version}";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/aiomusiccast/default.nix
+++ b/pkgs/development/python-modules/aiomusiccast/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "aiomusiccast";
-  version = "0.14.7";
+  version = "0.14.8";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "vigonotion";
    repo = "aiomusiccast";
    rev = "refs/tags/${version}";
-    hash = "sha256-6fHTZ5zFiXuyFtZj9cNH5ejLbzx/1cEBUy+fs+Q6O4Y=";
+    hash = "sha256-V4xl2QY+pPEnJtx7dxSNj/aXqHvV9Z6uuWgbVHNyLjA=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/blebox-uniapi/default.nix
+++ b/pkgs/development/python-modules/blebox-uniapi/default.nix
@ -3,7 +3,6 @@
 , fetchFromGitHub
 , aiohttp
 , semver
-, asynctest
 , deepmerge
 , pytest-asyncio
 , pytestCheckHook
@ -35,7 +34,6 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
-    asynctest
    deepmerge
    pytest-asyncio
    pytestCheckHook
@ -46,7 +44,7 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
-    changelog = "https://github.com/blebox/blebox_uniapi/blob/${src.rev}/HISTORY.rst";
+    changelog = "https://github.com/blebox/blebox_uniapi/blob/${version}/HISTORY.rst";
    description = "Python API for accessing BleBox smart home devices";
    homepage = "https://github.com/blebox/blebox_uniapi";
    license = licenses.asl20;
--- a/pkgs/development/python-modules/installer/default.nix
+++ b/pkgs/development/python-modules/installer/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "installer";
-  version = "0.6.0";
+  version = "0.7.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "pradyunsg";
    repo = pname;
    rev = version;
-    hash = "sha256-IXznSrc/4LopgZDGFSC6cAOCbts+siKpdl5SvN1FFvA=";
+    hash = "sha256-thHghU+1Alpay5r9Dc3v7ATRFfYKV8l9qR0nbGOOX/A=";
  };

  nativeBuildInputs = [ flit-core ];
@ -27,8 +27,9 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
+    changelog = "https://github.com/pypa/installer/blob/${src.rev}/docs/changelog.md";
    homepage = "https://github.com/pradyunsg/installer";
-    description = "A low-level library for installing a Python package from a wheel distribution.";
+    description = "A low-level library for installing a Python package from a wheel distribution";
    license = licenses.mit;
    maintainers = with maintainers; [ cpcloud fridh ];
  };
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "mautrix";
-  version = "0.19.4";
+  version = "0.19.6";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "mautrix";
    repo = "python";
    rev = "v${version}";
-    hash = "sha256-zPcqM+Ge7K4pJD4K0MkkGdSiYvXxe0K1qbfHzVYmGx0=";
+    hash = "sha256-Km6Lh4iKUBwQcsChTrV9yCaPhVBINJotp/5XnPfoOMk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pygls/default.nix
+++ b/pkgs/development/python-modules/pygls/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
@ -45,6 +46,11 @@ buildPythonPackage rec {
  # Fixes hanging tests on Darwin
  __darwinAllowLocalNetworking = true;

+  preCheck = lib.optionalString stdenv.isDarwin ''
+    # Darwin issue: OSError: [Errno 24] Too many open files
+    ulimit -n 1024
+  '';
+
  pythonImportsCheck = [ "pygls" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/strenum/default.nix
+++ b/pkgs/development/python-modules/strenum/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "strenum";
-  version = "0.4.9";
+  version = "0.4.10";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "irgeek";
    repo = "StrEnum";
    rev = "refs/tags/v${version}";
-    hash = "sha256-tElXpwyjrgTw9eHqGPgXakY+G9JXkBQYG7jSZSjv6P0=";
+    hash = "sha256-OkNV4kUXGgYPGuyylGOtAr0e0spgZQ1MrftKKL2HmV8=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/woob/default.nix
+++ b/pkgs/development/python-modules/woob/default.nix
@ -5,6 +5,7 @@
 , cssselect
 , feedparser
 , fetchFromGitLab
+, fetchpatch
 , gdata
 , gnupg
 , google-api-python-client
@ -13,6 +14,7 @@
 , lxml
 , mechanize
 , nose
+, packaging
 , pdfminer-six
 , pillow
 , prettytable
@ -23,12 +25,14 @@
 , requests
 , simplejson
 , termcolor
+, testers
 , unidecode
+, woob
 }:

 buildPythonPackage rec {
  pname = "woob";
-  version = "3.0";
+  version = "3.3.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -37,10 +41,11 @@ buildPythonPackage rec {
    owner = "woob";
    repo = pname;
    rev = version;
-    hash = "sha256-XLcHNidclORbxVXgcsHY6Ja/dak+EVSKTaVQmg1f/rw=";
+    hash = "sha256-aPkMfPRDjPfHIlGDEvorGwk09yQuEWwOkJJUST0vLAs=";
  };

  nativeBuildInputs = [
+    packaging
    pyqt5
  ];

@ -57,6 +62,7 @@ buildPythonPackage rec {
    libyaml
    lxml
    mechanize
+    packaging
    pdfminer-six
    pillow
    prettytable
@ -68,11 +74,12 @@ buildPythonPackage rec {
    unidecode
  ];

-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "with-doctest = 1" "" \
-      --replace "with-coverage = 1" ""
-  '';
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.com/woob/woob/-/commit/861b1bb92be53998d8174dcca6fa643d1c7cde12.patch";
+      sha256 = "sha256-IXcE59pMFtPLTOYa2inIvuA14USQvck6Q4hrKZTC0DE=";
+    })
+  ];

  nativeCheckInputs = [
    nose
@ -86,6 +93,11 @@ buildPythonPackage rec {
    "woob"
  ];

+  passthru.tests.version = testers.testVersion {
+    package = woob;
+    version = "v${version}";
+  };
+
  meta = with lib; {
    description = "Collection of applications and APIs to interact with websites";
    homepage = "https://woob.tech";
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@ -34,6 +34,7 @@ stdenv.mkDerivation rec {

    ln -sf $out/codeql/tools/linux64/lib64trace.so $out/codeql/tools/linux64/libtrace.so

+    sed -i 's%\$CODEQL_DIST/tools/\$CODEQL_PLATFORM/java-aarch64%\${jdk17}%g' $out/codeql/codeql
    sed -i 's%\$CODEQL_DIST/tools/\$CODEQL_PLATFORM/java%\${jdk17}%g' $out/codeql/codeql

    ln -s $out/codeql/codeql $out/bin/
--- a/pkgs/development/tools/continuous-integration/gitea-actions-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitea-actions-runner/default.nix
@ -2,17 +2,23 @@

 buildGoModule rec {
  pname = "gitea-actions-runner";
-  version = "unstable-2023-02-08";
+  version = "unstable-2023-03-18";

  src = fetchFromGitea {
    domain = "gitea.com";
    owner = "gitea";
    repo = "act_runner";
-    rev = "990cf93c7136669408eb1832cd05df3ad4dd81b3";
-    sha256 = "1ysp7g199dzh1zpxxhki88pn96qghln7a5g8zfjip9173q1rgiyb";
+    rev = "9eb8b08a69e8b1c699c9c07a06c1ff8e5f6ad0fe";
+    sha256 = "sha256-B8vD+86X8cqZhPmDmEjHgSsq3TdJuCf9h3XgdXC7hQY=";
  };

-  vendorSha256 = "0a3q7rsk37dc6v3vnqaywkimaqvyjmkrwljhcjcnswsdfcgng62b";
+  vendorSha256 = "sha256-K/d/ip8icc+rjTmajsGxw5aij1VMW6wJJu4LCkKqaVQ=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X gitea.com/gitea/act_runner/cmd.version=${version}"
+  ];

  meta = with lib; {
    mainProgram = "act_runner";
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  pname = "jenkins";
-  version = "2.375.3";
+  version = "2.387.1";

  src = fetchurl {
    url = "https://get.jenkins.io/war-stable/${version}/jenkins.war";
-    hash = "sha256-1WBl8eXEMj/sNqlqv3cQskUeNLxPudoXnn3xKaTMwaw=";
+    hash = "sha256-wTKh4AtoWvx5luulML5CijJ5xkk5lBf5+jj8vA2+wCc=";
  };

  nativeBuildInputs = [ makeWrapper ];
@ -51,11 +51,10 @@ stdenv.mkDerivation rec {

      version="$(jq -r .version <<<$core_json)"
      sha256="$(jq -r .sha256 <<<$core_json)"
-      hash="$(nix-hash --type sha256 --to-base32 "$sha256")"
-      url="$(jq -r .url <<<$core_json)"
+      hash="$(nix hash to-sri --type sha256 "$sha256")"

      if [ ! "$oldVersion" = "$version" ]; then
-        update-source-version jenkins "$version" "$hash" "$url"
+        update-source-version jenkins "$version" "$hash"
        nixpkgs="$(git rev-parse --show-toplevel)"
        default_nix="$nixpkgs/pkgs/development/tools/continuous-integration/jenkins/default.nix"
        nixfmt "$default_nix"
--- a/pkgs/development/tools/language-servers/metals/default.nix
+++ b/pkgs/development/tools/language-servers/metals/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "metals";
-  version = "0.11.10";
+  version = "0.11.11";

  deps = stdenv.mkDerivation {
    name = "${pname}-deps-${version}";
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    '';
    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
-    outputHash = "sha256-CNLBDsyiEOmMGA9r8eU+3z75VYps21kHnLpB1LYC7W4=";
+    outputHash = "sha256-oz4lrRnpVzc9kN+iJv+mtV/S1wdMKwJBkKpvmWCSwE0=";
  };

  nativeBuildInputs = [ makeWrapper setJavaClassPath ];
--- a/pkgs/development/tools/language-servers/millet/default.nix
+++ b/pkgs/development/tools/language-servers/millet/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "millet";
-  version = "0.8.1";
+  version = "0.8.3";

  src = fetchFromGitHub {
    owner = "azdavis";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-yIOb6AeEpIbKarY4I0X4zq5Gtrv05QLrDlFaBD3x6rw=";
+    hash = "sha256-b5zb0sDya/58kEEgqWqu4u6Xo61sq8Le0F3Z1Q3dBdk=";
  };

-  cargoHash = "sha256-DIRs+xhcdV74NFjsB1jJYgd8Cu/BmAUcBf58rGAp/yo=";
+  cargoHash = "sha256-5uURD+c5OR2ACS2a3OYlPX/EpJ966+m97MDKyw3snjA=";

  postPatch = ''
    rm .cargo/config.toml
--- a/pkgs/development/tools/ldid/default.nix
+++ b/pkgs/development/tools/ldid/default.nix
@ -4,7 +4,7 @@
 , fetchgit
 , libplist
 , libxml2
-, openssl_1_1
+, openssl
 , CoreFoundation
 , Security
 }:
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    libplist
    libxml2
-    openssl_1_1
+    openssl
  ] ++ lib.optionals stdenv.isDarwin [
    CoreFoundation
    Security
--- a/pkgs/development/tools/wails/default.nix
+++ b/pkgs/development/tools/wails/default.nix
@ -14,13 +14,13 @@

 buildGoModule rec {
  pname = "wails";
-  version = "2.4.0";
+  version = "2.4.1";

  src = fetchFromGitHub {
    owner = "wailsapp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-2MjEVQybSI9gQ/KI4rBbvbqCNhTsXTtWfUl37gVsqK4=";
+    sha256 = "sha256-ei+bp4fwlxZ9ZiXW/FqpqICXpFxpmOKkZZYW0LxHh1s=";
  } + "/v2";

  vendorSha256 = "sha256-RiectpUhm24xjgfPZEMDVFSEzPtIjn7L/qC2KE2s5aw=";
--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "yq-go";
-  version = "4.31.2";
+  version = "4.32.2";

  src = fetchFromGitHub {
    owner = "mikefarah";
    repo = "yq";
    rev = "v${version}";
-    hash = "sha256-Cf9Y7sdvpflQhhnOuRZUTyYQ3fpFTLo28dZtePsayfE=";
+    hash = "sha256-gP5Ah/KVWtmEl1CUKge5XdsYwoAAdNabb10b0pdN0tk=";
  };

-  vendorHash = "sha256-nv1sJ5GGB2IbGF1ebGZmeKF6qHLXgFebdibcsB36juY=";
+  vendorHash = "sha256-/7ah71isg0GB9PncNamMKaW2cW+EMN2BaPqP7gsLMmg=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/development/web/postman/darwin.nix
+++ b/pkgs/development/web/postman/darwin.nix
@ -11,12 +11,12 @@ let
  dist = {
    aarch64-darwin = {
      arch = "arm64";
-      sha256 = "sha256-zvGWkV92qDsiveS1tvkY6jHIr/Xj3ARSOqov+MCRM+o=";
+      sha256 = "sha256-dJM85/6JCNqSXtrglEjP11cypGkj8+zHPo0qNANyylU=";
    };

    x86_64-darwin = {
      arch = "64";
-      sha256 = "sha256-LuXC1ucEsrxqx8wAkBkot2wXbUUVp+FIQPx9/2+tfIw=";
+      sha256 = "sha256-36T7S/F35hRCmXXYA8DWwwLsuJiUVU9UBY7eAXjzx1s=";
    };
  }.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");

--- a/pkgs/development/web/postman/default.nix
+++ b/pkgs/development/web/postman/default.nix
@ -2,13 +2,13 @@

 let
  pname = "postman";
-  version = "9.31.0";
+  version = "10.12.0";
  meta = with lib; {
    homepage = "https://www.getpostman.com";
    description = "API Development Environment";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.postman;
-    platforms = [ "x86_64-linux" "aarch64-darwin" "x86_64-darwin" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" "x86_64-darwin" ];
    maintainers = with maintainers; [ johnrichardrinehart evanjs tricktron Crafter ];
  };

--- a/pkgs/development/web/postman/linux.nix
+++ b/pkgs/development/web/postman/linux.nix
@ -43,13 +43,27 @@
 , copyDesktopItems
 }:

+let
+  dist = {
+    aarch64-linux = {
+      arch = "arm64";
+      sha256 = "sha256-ciQ9LqtaOosUAtcZiwOQ+8gB5dTut8pXHAjUsoQEEB8=";
+    };
+
+    x86_64-linux = {
+      arch = "64";
+      sha256 = "sha256-QaIj+SOQGR6teUIdLB3D5klRlYrna1MoE3c6UXYEoB4=";
+    };
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+in
 stdenv.mkDerivation rec {
  inherit pname version meta;

  src = fetchurl {
-    url = "https://dl.pstmn.io/download/version/${version}/linux64";
-    sha256 = "sha256-ZCfPE+bvPEQjEvUO/FQ1iNR9TG6GtI4vmj6yJ7B62iw=";
-    name = "${pname}.tar.gz";
+    url = "https://dl.pstmn.io/download/version/${version}/linux${dist.arch}";
+    inherit (dist) sha256;
+    name = "${pname}-${version}.tar.gz";
  };

  dontConfigure = true;
--- a/Show More
+++ b/Show More