Merge master into haskell-updates

.github/workflows/check-by-name.yml

@@ -17,16 +17,24 @@ jobs:
     # as specified in nixos/release-combined.nix
     runs-on: ubuntu-latest
     steps:
+      - name: Resolving the merge commit
+        run: |
+          if result=$(git ls-remote --exit-code ${{ github.event.pull_request.base.repo.clone_url }} refs/pull/${{ github.event.pull_request.number }}/merge); then
+            mergedSha=$(cut -f1 <<< "$result")
+            echo "The PR appears to not have any conflicts, checking the merge commit $mergedSha"
+          else
+            echo "The PR may have a merge conflict"
+            exit 1
+          fi
+          echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
         with:
           # pull_request_target checks out the base branch by default
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          ref: ${{ env.mergedSha }}
           # Fetches the merge commit and its parents
           fetch-depth: 2
       - name: Determining PR git hashes
         run: |
-          echo "mergedSha=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
-
           # For pull_request_target this is the same as $GITHUB_SHA
           echo "baseSha=$(git rev-parse HEAD^1)" >> "$GITHUB_ENV"
 

maintainers/maintainer-list.nix

@@ -6071,6 +6071,15 @@
     githubId = 12715461;
     name = "Anders Bo Rasmussen";
   };
+  fwam = {
+    name = "Legion Orsetti";
+    email = "fwam@queereen.dev";
+    github = "fwam";
+    githubId = 113541944;
+    keys = [{
+      fingerprint = "3822 20B8 57ED 0602 3786  8A7A 18E1 AE22 D704 B4FC";
+    }];
+  };
   fwc = {
     github = "fwc";
     githubId = 29337229;

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -418,3 +418,6 @@ The module update takes care of the new config syntax and the data itself (user
   `virtualisation.fileSystems = lib.mkForce { };`.
 
 - The `electron` packages now places its application files in `$out/libexec/electron` instead of `$out/lib/electron`. Packages using electron-builder will fail to build and need to be adjusted by changing `lib` to `libexec`.
+
+- `teleport` has been upgraded from major version 12 to major version 14. Please see upstream [upgrade instructions](https://goteleport.com/docs/management/operations/upgrading/) and release notes for versions [13](https://goteleport.com/docs/changelog/#1300-050823) and [14](https://goteleport.com/docs/changelog/#1400-092023). Note that Teleport does not officially support upgrades across more than one major version at a time. If you're running Teleport server components, it is recommended to first upgrade to an intermediate 13.x version by setting `services.teleport.package = pkgs.teleport_13`. Afterwards, this option can be removed to upgrade to the default version (14).
+

nixos/lib/testing/nodes.nix

@@ -28,9 +28,9 @@ let
             {
               virtualisation.qemu.package = testModuleArgs.config.qemu.package;
             })
-          (optionalAttrs (!config.node.pkgsReadOnly) {
+          ({ options, ... }: {
             key = "nodes.nix-pkgs";
-            config = {
+            config = mkIf (!options.nixpkgs.pkgs.isDefined) {
               # Ensure we do not use aliases. Ideally this is only set
               # when the test framework is used by Nixpkgs NixOS tests.
               nixpkgs.config.allowAliases = false;

nixos/modules/config/users-groups.nix

@@ -449,6 +449,8 @@ let
   gidsAreUnique = idsAreUnique (filterAttrs (n: g: g.gid != null) cfg.groups) "gid";
   sdInitrdUidsAreUnique = idsAreUnique (filterAttrs (n: u: u.uid != null) config.boot.initrd.systemd.users) "uid";
   sdInitrdGidsAreUnique = idsAreUnique (filterAttrs (n: g: g.gid != null) config.boot.initrd.systemd.groups) "gid";
+  groupNames = lib.mapAttrsToList (n: g: g.name) cfg.groups;
+  usersWithoutExistingGroup = lib.filterAttrs (n: u: !lib.elem u.group groupNames) cfg.users;
 
   spec = pkgs.writeText "users-groups.json" (builtins.toJSON {
     inherit (cfg) mutableUsers;
@@ -750,6 +752,18 @@ in {
       { assertion = !cfg.enforceIdUniqueness || (sdInitrdUidsAreUnique && sdInitrdGidsAreUnique);
         message = "systemd initrd UIDs and GIDs must be unique!";
       }
+      { assertion = usersWithoutExistingGroup == {};
+        message =
+          let
+            errUsers = lib.attrNames usersWithoutExistingGroup;
+            missingGroups = lib.unique (lib.mapAttrsToList (n: u: u.group) usersWithoutExistingGroup);
+            mkConfigHint = group: "users.groups.${group} = {};";
+          in ''
+            The following users have a primary group that is undefined: ${lib.concatStringsSep " " errUsers}
+            Hint: Add this to your NixOS configuration:
+              ${lib.concatStringsSep "\n  " (map mkConfigHint missingGroups)}
+          '';
+      }
       { # If mutableUsers is false, to prevent users creating a
         # configuration that locks them out of the system, ensure that
         # there is at least one "privileged" account that has a

nixos/modules/hardware/device-tree.nix

@@ -66,36 +66,32 @@ let
   };
 
   filterDTBs = src: if cfg.filter == null
-    then "${src}/dtbs"
+    then src
     else
       pkgs.runCommand "dtbs-filtered" {} ''
         mkdir -p $out
-        cd ${src}/dtbs
+        cd ${src}
         find . -type f -name '${cfg.filter}' -print0 \
           | xargs -0 cp -v --no-preserve=mode --target-directory $out --parents
       '';
 
-  filteredDTBs = filterDTBs cfg.kernelPackage;
-
-  # Compile single Device Tree overlay source
-  # file (.dts) into its compiled variant (.dtbo)
-  compileDTS = name: f: pkgs.callPackage({ stdenv, dtc }: stdenv.mkDerivation {
-    name = "${name}-dtbo";
-
-    nativeBuildInputs = [ dtc ];
-
-    buildCommand = ''
-      $CC -E -nostdinc -I${getDev cfg.kernelPackage}/lib/modules/${cfg.kernelPackage.modDirVersion}/source/scripts/dtc/include-prefixes -undef -D__DTS__ -x assembler-with-cpp ${f} | \
-        dtc -I dts -O dtb -@ -o $out
-    '';
-  }) {};
+  filteredDTBs = filterDTBs cfg.dtbSource;
 
   # Fill in `dtboFile` for each overlay if not set already.
   # Existence of one of these is guarded by assertion below
   withDTBOs = xs: flip map xs (o: o // { dtboFile =
+    let
+      includePaths = ["${getDev cfg.kernelPackage}/lib/modules/${cfg.kernelPackage.modDirVersion}/source/scripts/dtc/include-prefixes"] ++ cfg.dtboBuildExtraIncludePaths;
+      extraPreprocessorFlags = cfg.dtboBuildExtraPreprocessorFlags;
+    in
     if o.dtboFile == null then
-      if o.dtsFile != null then compileDTS o.name o.dtsFile
-      else compileDTS o.name (pkgs.writeText "dts" o.dtsText)
+      let
+        dtsFile = if o.dtsFile == null then (pkgs.writeText "dts" o.dtsText) else o.dtsFile;
+      in
+      pkgs.deviceTree.compileDTS {
+        name = "${o.name}-dtbo";
+        inherit includePaths extraPreprocessorFlags dtsFile;
+      }
     else o.dtboFile; } );
 
 in
@@ -121,7 +117,39 @@ in
           example = literalExpression "pkgs.linux_latest";
           type = types.path;
           description = lib.mdDoc ''
-            Kernel package containing the base device-tree (.dtb) to boot. Uses
+            Kernel package where device tree include directory is from. Also used as default source of dtb package to apply overlays to
+          '';
+        };
+
+        dtboBuildExtraPreprocessorFlags = mkOption {
+          default = [];
+          example = literalExpression "[ \"-DMY_DTB_DEFINE\" ]";
+          type = types.listOf types.str;
+          description = lib.mdDoc ''
+            Additional flags to pass to the preprocessor during dtbo compilations
+          '';
+        };
+
+        dtboBuildExtraIncludePaths = mkOption {
+          default = [];
+          example = literalExpression ''
+            [
+              ./my_custom_include_dir_1
+              ./custom_include_dir_2
+            ]
+          '';
+          type = types.listOf types.path;
+          description = lib.mdDoc ''
+            Additional include paths that will be passed to the preprocessor when creating the final .dts to compile into .dtbo
+          '';
+        };
+
+        dtbSource = mkOption {
+          default = "${cfg.kernelPackage}/dtbs";
+          defaultText = literalExpression "\${cfg.kernelPackage}/dtbs";
+          type = types.path;
+          description = lib.mdDoc ''
+            Path to dtb directory that overlays and other processing will be applied to. Uses
             device trees bundled with the Linux kernel by default.
           '';
         };

nixos/modules/module-list.nix

@@ -1286,6 +1286,7 @@
   ./services/web-apps/powerdns-admin.nix
   ./services/web-apps/prosody-filer.nix
   ./services/web-apps/restya-board.nix
+  ./services/web-apps/rimgo.nix
   ./services/web-apps/sftpgo.nix
   ./services/web-apps/rss-bridge.nix
   ./services/web-apps/selfoss.nix

nixos/modules/security/wrappers/default.nix

@@ -5,8 +5,29 @@ let
 
   parentWrapperDir = dirOf wrapperDir;
 
-  securityWrapper = sourceProg : pkgs.callPackage ./wrapper.nix {
+  # This is security-sensitive code, and glibc vulns happen from time to time.
+  # musl is security-focused and generally more minimal, so it's a better choice here.
+  # The dynamic linker is still a fairly complex piece of code, and the wrappers are
+  # quite small, so linking it statically is more appropriate.
+  securityWrapper = sourceProg : pkgs.pkgsStatic.callPackage ./wrapper.nix {
     inherit sourceProg;
+
+    # glibc definitions of insecure environment variables
+    #
+    # We extract the single header file we need into its own derivation,
+    # so that we don't have to pull full glibc sources to build wrappers.
+    #
+    # They're taken from pkgs.glibc so that we don't have to keep as close
+    # an eye on glibc changes. Not every relevant variable is in this header,
+    # so we maintain a slightly stricter list in wrapper.c itself as well.
+    unsecvars = lib.overrideDerivation (pkgs.srcOnly pkgs.glibc)
+      ({ name, ... }: {
+        name = "${name}-unsecvars";
+        installPhase = ''
+          mkdir $out
+          cp sysdeps/generic/unsecvars.h $out
+        '';
+      });
   };
 
   fileModeType =

nixos/modules/security/wrappers/wrapper.c

@@ -17,6 +17,9 @@
 #include <syscall.h>
 #include <byteswap.h>
 
+// imported from glibc
+#include "unsecvars.h"
+
 #ifndef SOURCE_PROG
 #error SOURCE_PROG should be defined via preprocessor commandline
 #endif
@@ -151,9 +154,55 @@ static int make_caps_ambient(const char *self_path) {
     return 0;
 }
 
+// These are environment variable aliases for glibc tunables.
+// This list shouldn't grow further, since this is a legacy mechanism.
+// Any future tunables are expected to only be accessible through GLIBC_TUNABLES.
+//
+// They are not included in the glibc-provided UNSECURE_ENVVARS list,
+// since any SUID executable ignores them. This wrapper also serves
+// executables that are merely granted ambient capabilities, rather than
+// being SUID, and hence don't run in secure mode. We'd like them to
+// defend those in depth as well, so we clear these explicitly.
+//
+// Except for MALLOC_CHECK_ (which is marked SXID_ERASE), these are all
+// marked SXID_IGNORE (ignored in secure mode), so even the glibc version
+// of this wrapper would leave them intact.
+#define UNSECURE_ENVVARS_TUNABLES \
+    "MALLOC_CHECK_\0" \
+    "MALLOC_TOP_PAD_\0" \
+    "MALLOC_PERTURB_\0" \
+    "MALLOC_MMAP_THRESHOLD_\0" \
+    "MALLOC_TRIM_THRESHOLD_\0" \
+    "MALLOC_MMAP_MAX_\0" \
+    "MALLOC_ARENA_MAX\0" \
+    "MALLOC_ARENA_TEST\0"
+
 int main(int argc, char **argv) {
     ASSERT(argc >= 1);
 
+    int debug = getenv(wrapper_debug) != NULL;
+
+    // Drop insecure environment variables explicitly
+    //
+    // glibc does this automatically in SUID binaries, but we'd like to cover this:
+    //
+    //  a) before it gets to glibc
+    //  b) in binaries that are only granted ambient capabilities by the wrapper,
+    //     but don't run with an altered effective UID/GID, nor directly gain
+    //     capabilities themselves, and thus don't run in secure mode.
+    //
+    // We're using musl, which doesn't drop environment variables in secure mode,
+    // and we'd also like glibc-specific variables to be covered.
+    //
+    // If we don't explicitly unset them, it's quite easy to just set LD_PRELOAD,
+    // have it passed through to the wrapped program, and gain privileges.
+    for (char *unsec = UNSECURE_ENVVARS_TUNABLES UNSECURE_ENVVARS; *unsec; unsec = strchr(unsec, 0) + 1) {
+        if (debug) {
+            fprintf(stderr, "unsetting %s\n", unsec);
+        }
+        unsetenv(unsec);
+    }
+
     // Read the capabilities set on the wrapper and raise them in to
     // the ambient set so the program we're wrapping receives the
     // capabilities too!

nixos/modules/security/wrappers/wrapper.nix

@@ -1,4 +1,4 @@
-{ stdenv, linuxHeaders, sourceProg, debug ? false }:
+{ stdenv, unsecvars, linuxHeaders, sourceProg, debug ? false }:
 # For testing:
 # $ nix-build -E 'with import <nixpkgs> {}; pkgs.callPackage ./wrapper.nix { parentWrapperDir = "/run/wrappers"; debug = true; }'
 stdenv.mkDerivation {
@@ -16,6 +16,6 @@ stdenv.mkDerivation {
   dontStrip = debug;
   installPhase = ''
     mkdir -p $out/bin
-    $CC $CFLAGS ${./wrapper.c} -o $out/bin/security-wrapper
+    $CC $CFLAGS ${./wrapper.c} -I${unsecvars} -o $out/bin/security-wrapper
   '';
 }

nixos/modules/services/databases/pgmanage.nix

@@ -187,7 +187,7 @@ in {
       serviceConfig = {
         User         = pgmanage;
         Group        = pgmanage;
-        ExecStart    = "${pkgs.pgmanage}/sbin/pgmanage -c ${confFile}" +
+        ExecStart    = "${cfg.package}/sbin/pgmanage -c ${confFile}" +
                        optionalString cfg.localOnly " --local-only=true";
       };
     };

nixos/modules/services/misc/gpsd.nix

@@ -92,6 +92,16 @@ in {
         '';
       };
 
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        example = [ "-r" "-s" "19200" ];
+        description = lib.mdDoc ''
+          A list of extra command line arguments to pass to gpsd.
+          Check gpsd(8) mangpage for possible arguments.
+        '';
+      };
+
     };
 
   };
@@ -117,12 +127,14 @@ in {
         Type = "forking";
         ExecStart = let
           devices = utils.escapeSystemdExecArgs cfg.devices;
+          extraArgs = utils.escapeSystemdExecArgs cfg.extraArgs;
         in ''
           ${pkgs.gpsd}/sbin/gpsd -D "${toString cfg.debugLevel}"  \
             -S "${toString cfg.port}"                             \
             ${optionalString cfg.readonly "-b"}                   \
             ${optionalString cfg.nowait "-n"}                     \
             ${optionalString cfg.listenany "-G"}                  \
+            ${extraArgs}                                          \
             ${devices}
         '';
       };

nixos/modules/services/networking/coredns.nix

@@ -29,6 +29,13 @@ in {
       type = types.package;
       description = lib.mdDoc "Coredns package to use.";
     };
+
+    extraArgs = mkOption {
+      default = [];
+      example = [ "-dns.port=53" ];
+      type = types.listOf types.str;
+      description = lib.mdDoc "Extra arguments to pass to coredns.";
+    };
   };
 
   config = mkIf cfg.enable {
@@ -44,7 +51,7 @@ in {
         AmbientCapabilities = "cap_net_bind_service";
         NoNewPrivileges = true;
         DynamicUser = true;
-        ExecStart = "${getBin cfg.package}/bin/coredns -conf=${configFile}";
+        ExecStart = "${getBin cfg.package}/bin/coredns -conf=${configFile} ${lib.escapeShellArgs cfg.extraArgs}";
         ExecReload = "${pkgs.coreutils}/bin/kill -SIGUSR1 $MAINPID";
         Restart = "on-failure";
       };

nixos/modules/services/networking/yggdrasil.nix

@@ -121,6 +121,13 @@ in
         restarted. Keys are stored at ${keysPath}.
       '');
 
+      extraArgs = mkOption {
+        type = listOf str;
+        default = [ ];
+        example = [ "-loglevel" "info" ];
+        description = lib.mdDoc "Extra command line arguments.";
+      };
+
     };
   };
 
@@ -181,7 +188,7 @@ in
             "${binYggdrasil} -genconf") + " > /run/yggdrasil/yggdrasil.conf"}
 
           # start yggdrasil
-          ${binYggdrasil} -useconffile /run/yggdrasil/yggdrasil.conf
+          ${binYggdrasil} -useconffile /run/yggdrasil/yggdrasil.conf ${lib.strings.escapeShellArgs cfg.extraArgs}
         '';
 
         serviceConfig = {

nixos/modules/services/web-apps/grocy.nix

@@ -8,6 +8,8 @@ in {
   options.services.grocy = {
     enable = mkEnableOption (lib.mdDoc "grocy");
 
+    package = mkPackageOptionMD pkgs "grocy" { };
+
     hostName = mkOption {
       type = types.str;
       description = lib.mdDoc ''
@@ -143,7 +145,7 @@ in {
     services.nginx = {
       enable = true;
       virtualHosts."${cfg.hostName}" = mkMerge [
-        { root = "${pkgs.grocy}/public";
+        { root = "${cfg.package}/public";
           locations."/".extraConfig = ''
             rewrite ^ /index.php;
           '';

nixos/modules/services/web-apps/rimgo.nix

@@ -0,0 +1,107 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.rimgo;
+  inherit (lib)
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    mkDefault
+    mkIf
+    types
+    literalExpression
+    optionalString
+    getExe
+    mapAttrs
+  ;
+in
+{
+  options.services.rimgo = {
+    enable = mkEnableOption "rimgo";
+    package = mkPackageOption pkgs "rimgo" { };
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = with types; attrsOf str;
+        options = {
+          PORT = mkOption {
+            type = types.port;
+            default = 3000;
+            example = 69420;
+            description = "The port to use.";
+          };
+          ADDRESS = mkOption {
+            type = types.str;
+            default = "127.0.0.1";
+            example = "1.1.1.1";
+            description = "The address to listen on.";
+          };
+        };
+      };
+      example = literalExpression ''
+        {
+          PORT = 69420;
+          FORCE_WEBP = "1";
+        }
+      '';
+      description = ''
+        Settings for rimgo, see [the official documentation](https://rimgo.codeberg.page/docs/usage/configuration/) for supported options.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.rimgo = {
+      description = "Rimgo";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      environment = mapAttrs (_: toString) cfg.settings;
+      serviceConfig = {
+        ExecStart = getExe cfg.package;
+        AmbientCapabilities = mkIf (cfg.settings.PORT < 1024) [
+          "CAP_NET_BIND_SERVICE"
+        ];
+        DynamicUser = true;
+        Restart = "on-failure";
+        RestartSec = "5s";
+        CapabilityBoundingSet = [
+          (optionalString (cfg.settings.PORT < 1024) "CAP_NET_BIND_SERVICE")
+        ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        PrivateUsers = cfg.settings.PORT >= 1024;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ quantenzitrone ];
+  };
+}

nixos/modules/services/web-servers/nginx/default.nix

@@ -1340,6 +1340,11 @@ in
       nginx.gid = config.ids.gids.nginx;
     };
 
+    # do not delete the default temp directories created upon nginx startup
+    systemd.tmpfiles.rules = [
+      "X /tmp/systemd-private-%b-nginx.service-*/tmp/nginx_*"
+    ];
+
     services.logrotate.settings.nginx = mapAttrs (_: mkDefault) {
       files = "/var/log/nginx/*.log";
       frequency = "weekly";

nixos/modules/services/x11/desktop-managers/gnome.nix

@@ -307,10 +307,9 @@ in
         gnome-flashback
       ] ++ map gnome-flashback.mkSystemdTargetForWm flashbackWms;
 
-      # gnome-panel needs these for menu applet
-      environment.sessionVariables.XDG_DATA_DIRS = [ "${pkgs.gnome.gnome-flashback}/share" ];
-      # TODO: switch to sessionVariables (resolve conflict)
-      environment.variables.XDG_CONFIG_DIRS = [ "${pkgs.gnome.gnome-flashback}/etc/xdg" ];
+      environment.systemPackages = with pkgs.gnome; [
+        gnome-flashback
+      ];
     })
 
     (mkIf serviceCfg.core-os-services.enable {

nixos/tests/all-tests.nix

@@ -555,6 +555,7 @@ in {
   nginx-sandbox = handleTestOn ["x86_64-linux"] ./nginx-sandbox.nix {};
   nginx-sso = handleTest ./nginx-sso.nix {};
   nginx-status-page = handleTest ./nginx-status-page.nix {};
+  nginx-tmpdir = handleTest ./nginx-tmpdir.nix {};
   nginx-variants = handleTest ./nginx-variants.nix {};
   nifi = handleTestOn ["x86_64-linux"] ./web-apps/nifi.nix {};
   nitter = handleTest ./nitter.nix {};
@@ -714,7 +715,7 @@ in {
   service-runner = handleTest ./service-runner.nix {};
   sftpgo = runTest ./sftpgo.nix;
   sfxr-qt = handleTest ./sfxr-qt.nix {};
-  sgtpuzzles = handleTest ./sgtpuzzles.nix {};
+  sgt-puzzles = handleTest ./sgt-puzzles.nix {};
   shadow = handleTest ./shadow.nix {};
   shadowsocks = handleTest ./shadowsocks {};
   shattered-pixel-dungeon = handleTest ./shattered-pixel-dungeon.nix {};

nixos/tests/gnome-flashback.nix

@@ -49,9 +49,10 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
           assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
 
       with subtest("Wait for Metacity"):
-          machine.wait_until_succeeds(
-              "pgrep metacity"
-          )
+          machine.wait_until_succeeds("pgrep metacity")
+
+      with subtest("Regression test for #233920"):
+          machine.wait_until_succeeds("pgrep -fa gnome-flashback-media-keys")
           machine.sleep(20)
           machine.screenshot("screen")
     '';

nixos/tests/kernel-generic.nix

@@ -31,7 +31,6 @@ let
       linux_5_10_hardened
       linux_5_15_hardened
       linux_6_1_hardened
-      linux_6_4_hardened
       linux_6_5_hardened
       linux_rt_5_4
       linux_rt_5_10

nixos/tests/nginx-tmpdir.nix

@@ -0,0 +1,60 @@
+let
+  dst-dir = "/run/nginx-test-tmpdir-uploads";
+in
+  import ./make-test-python.nix {
+    name = "nginx-tmpdir";
+
+    nodes.machine = { pkgs, ... }: {
+      environment.etc."tmpfiles.d/nginx-uploads.conf".text = "d ${dst-dir} 0755 nginx nginx 1d";
+
+      # overwrite the tmp.conf with a short age, there will be a duplicate line info from systemd-tmpfiles in the log
+      systemd.tmpfiles.rules = [
+        "q /tmp 1777 root root 1min"
+      ];
+
+      services.nginx.enable = true;
+      # simple upload service using the nginx client body temp path
+      services.nginx.virtualHosts = {
+        localhost = {
+          locations."~ ^/upload/([0-9a-zA-Z-.]*)$" = {
+            extraConfig = ''
+              alias ${dst-dir}/$1;
+              client_body_in_file_only clean;
+              dav_methods PUT;
+              create_full_put_path on;
+              dav_access group:rw all:r;
+            '';
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      machine.wait_for_unit("nginx")
+      machine.wait_for_open_port(80)
+
+      with subtest("Needed prerequisite --http-client-body-temp-path=/tmp/nginx_client_body and private temp"):
+        machine.succeed("touch /tmp/systemd-private-*-nginx.service-*/tmp/nginx_client_body")
+
+      with subtest("Working upload of test setup"):
+        machine.succeed("curl -X PUT http://localhost/upload/test1 --fail --data-raw 'Raw data 1'")
+        machine.succeed('test "$(cat ${dst-dir}/test1)" = "Raw data 1"')
+
+      # let the tmpfiles clean service do its job
+      machine.succeed("touch /tmp/touched")
+      machine.wait_until_succeeds(
+        "sleep 15 && systemctl start systemd-tmpfiles-clean.service && [ ! -f /tmp/touched ]",
+        timeout=150
+      )
+
+      with subtest("Working upload after cleaning"):
+        machine.succeed("curl -X PUT http://localhost/upload/test2 --fail --data-raw 'Raw data 2'")
+        machine.succeed('test "$(cat ${dst-dir}/test2)" = "Raw data 2"')
+
+      # manually remove the nginx temp dir
+      machine.succeed("rm -r --interactive=never /tmp/systemd-private-*-nginx.service-*/tmp/nginx_client_body")
+
+      with subtest("Broken upload after manual temp dir removal"):
+        machine.fail("curl -X PUT http://localhost/upload/test3 --fail --data-raw 'Raw data 3'")
+    '';
+  }

nixos/tests/sgt-puzzles.nix

@@ -1,6 +1,6 @@
 import ./make-test-python.nix ({ pkgs, ...} :
 {
-  name = "sgtpuzzles";
+  name = "sgt-puzzles";
   meta = with pkgs.lib.maintainers; {
     maintainers = [ tomfitzhenry ];
   };
@@ -14,7 +14,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
 
     services.xserver.enable = true;
     environment.systemPackages = with pkgs; [
-      sgtpuzzles
+      sgt-puzzles
     ];
   };
 

nixos/tests/yggdrasil.nix

@@ -116,6 +116,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : {
         networking.firewall.allowedTCPPorts = [ 43210 ];
         services.yggdrasil = {
           enable = true;
+          extraArgs = [ "-loglevel" "error" ];
           denyDhcpcdInterfaces = [ "ygg0" ];
           settings = {
             IfTAPMode = true;

pkgs/applications/editors/ldtk/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ldtk";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchurl {
     url = "https://github.com/deepnight/ldtk/releases/download/v${finalAttrs.version}/ubuntu-distribution.zip";
-    hash = "sha256-WuKzhE9r/yMqlV2bf/0AuNVKfxq/SlecmN3rHt6RjXo=";
+    hash = "sha256-Qt6ADyIbhuxFGh7IP1WwcsvMtjOUZoTd99GeWt5s4UM=";
   };
 
   nativeBuildInputs = [ unzip makeWrapper copyDesktopItems appimage-run ];

pkgs/applications/editors/orbiton/default.nix

@@ -4,13 +4,13 @@
 
 buildGoModule rec {
   pname = "orbiton";
-  version = "2.65.0";
+  version = "2.65.1";
 
   src = fetchFromGitHub {
     owner = "xyproto";
     repo = "orbiton";
     rev = "v${version}";
-    hash = "sha256-ul5E5xOtH5qh5tNE+S/VhUOr079wHwgtXF7ZIAwGzgU=";
+    hash = "sha256-ebtzhir6nBnIawkJJq+BgXv/5CbXtbhujXkMBzQEsNY=";
   };
 
   vendorHash = null;

pkgs/applications/editors/pulsar/default.nix

@@ -33,13 +33,13 @@
 
 let
   pname = "pulsar";
-  version = "1.108.0";
+  version = "1.109.0";
 
   sourcesPath = {
     x86_64-linux.tarname = "Linux.${pname}-${version}.tar.gz";
-    x86_64-linux.hash = "sha256-9wxMKekowNkFX+m3h2ZeTXu/uMLyPi6IIbseJ16shG4=";
+    x86_64-linux.hash = "sha256-pIm3mI1YdfapxXgIciSHtI4LeqMw5RdYTnH+eHUQ4Yo=";
     aarch64-linux.tarname = "ARM.Linux.${pname}-${version}-arm64.tar.gz";
-    aarch64-linux.hash = "sha256-GdPnmhMZR3Y2WB2j98JEWomdKFZuTgxN8oga/tBwA4U=";
+    aarch64-linux.hash = "sha256-KIY/qzfl7CU0YwIgQlNHoAMhLfrTbQe7ZZvzdkUVw+M=";
   }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   newLibpath = lib.makeLibraryPath [

pkgs/applications/editors/vscode/vscode.nix

@@ -30,21 +30,21 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0i6zk4zkwcw5lnzhg7vvnsw17nar97bbq3iishag9cpjqs9jpq4z";
-    x86_64-darwin = "1sy0ir4mhw9j5ifiv6d2928gcs8wfksxlsp312r9nsmc2h0i11g6";
-    aarch64-linux = "13lsycmia9yj6s7zf441vg8c0pipxpxdrnrj7v4rhjlvixjb8f8k";
-    aarch64-darwin = "1qwmwx0q05lzhsb8810kjk1lcw4wm7cr0zn7pkyjlsda0vkcc5g8";
-    armv7l-linux = "1hlnd9w141phrd3mzkhgiskbcnxqb05396frrv38pns007xhj103";
+    x86_64-linux = "1ayb0fj3dfcvwmfc749aihn1mm2h4nin914kvalchkm9q0xvc2y9";
+    x86_64-darwin = "0yvcm1m1dlklacc0rir4ja2bqiwlwmrmx3qwxf3ik40m1dfwhh53";
+    aarch64-linux = "0vj7q6b82n9509dph0p4d6n7b9gwz5b3wkg4wysm4w4xflqlx9al";
+    aarch64-darwin = "144fxkxg6c5216ds32wdx7qf5hnvlq4a429z90wz62iynslaggl4";
+    armv7l-linux = "1819dg30dy8hd8gi84b1992ii1bxcfcvhx9yf4q8wdf62hw5nkpq";
   }.${system} or throwSystem;
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.82.2";
+    version = "1.83.0";
     pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
     # This is used for VS Code - Remote SSH test
-    rev = "abd2f3db4bdb28f9e95536dfa84d8479f1eb312d";
+    rev = "e7e037083ff4455cf320e344325dacb480062c3c";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
     longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -68,7 +68,7 @@ in
       src = fetchurl {
         name = "vscode-server-${rev}.tar.gz";
         url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-        sha256 = "1d1ypmasr7zj4csinb5nj531ckj7a1pgn36469fdzwn0xjrgkg16";
+        sha256 = "11lf24hsbc4xbi08lrzxw4bn0jqp7rbhz120y9i3ffq25kni989l";
       };
     };
 

pkgs/applications/emulators/vice/default.nix

@@ -6,116 +6,23 @@
 , perl
 , libpng
 , giflib
-, libjpeg
 , alsa-lib
 , readline
 , libGLU
 , libGL
-, libXaw
 , pkg-config
-, gtk2
+, gtk3
+, glew
 , SDL
 , SDL_image
-, autoreconfHook
-, makeDesktopItem
 , dos2unix
+, runtimeShell
 , xa
 , file
+, wrapGAppsHook
+, xdg-utils
 }:
 
-let
-  desktopItems = [
-    (makeDesktopItem {
-      name = "x128";
-      exec = "x128";
-      comment = "VICE: C128 Emulator";
-      desktopName = "VICE: C128 Emulator";
-      genericName = "Commodore 128 emulator";
-      categories = [ "System" ];
-    })
-
-    (makeDesktopItem {
-      name = "x64dtv";
-      exec = "x64dtv";
-      comment = "VICE: C64 DTV Emulator";
-      desktopName = "VICE: C64 DTV Emulator";
-      genericName = "Commodore 64 DTV emulator";
-      categories = [ "System" ];
-    })
-
-    (makeDesktopItem {
-      name = "x64sc";
-      exec = "x64sc";
-      comment = "VICE: C64 Emulator";
-      desktopName = "VICE: C64 Emulator";
-      genericName = "Commodore 64 SC emulator";
-      categories = [ "System" ];
-    })
-
-    (makeDesktopItem {
-      name = "xcbm2";
-      exec = "xcbm2";
-      comment = "VICE: CBM-II B-Model Emulator";
-      desktopName = "VICE: CBM-II B-Model Emulator";
-      genericName = "CBM-II B-Model Emulator";
-      categories = [ "System" ];
-    })
-
-    (makeDesktopItem {
-      name = "xcbm5x0";
-      exec = "xcbm5x0";
-      comment = "VICE: CBM-II P-Model Emulator";
-      desktopName = "VICE: CBM-II P-Model Emulator";
-      genericName = "CBM-II P-Model Emulator";
-      categories = [ "System" ];
-    })
-
-    (makeDesktopItem {
-      name = "xpet";
-      exec = "xpet";
-      comment = "VICE: PET Emulator";
-      desktopName = "VICE: PET Emulator";
-      genericName = "Commodore PET Emulator";
-      categories = [ "System" ];
-    })
-
-    (makeDesktopItem {
-      name = "xplus4";
-      exec = "xplus4";
-      comment = "VICE: PLUS4 Emulator";
-      desktopName = "VICE: PLUS4 Emulator";
-      genericName = "Commodore PLUS4 Emulator";
-      categories = [ "System" ];
-    })
-
-    (makeDesktopItem {
-      name = "xscpu64";
-      exec = "xscpu64";
-      comment = "VICE: SCPU64 Emulator";
-      desktopName = "VICE: SCPU64 Emulator";
-      genericName = "Commodore SCPU64 Emulator";
-      categories = [ "System" ];
-    })
-
-    (makeDesktopItem {
-      name = "xvic";
-      exec = "xvic";
-      comment = "VICE: VIC-20 Emulator";
-      desktopName = "VICE: VIC-20 Emulator";
-      genericName = "Commodore VIC-20 Emulator";
-      categories = [ "System" ];
-    })
-
-    (makeDesktopItem {
-      name = "vsid";
-      exec = "vsid";
-      comment = "VSID: The SID Emulator";
-      desktopName = "VSID: The SID Emulator";
-      genericName = "SID Emulator";
-      categories = [ "System" ];
-    })
-  ];
-in
 stdenv.mkDerivation rec {
   pname = "vice";
   version = "3.7.1";
@@ -126,46 +33,41 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    autoreconfHook
     bison
     dos2unix
     file
     flex
     pkg-config
+    wrapGAppsHook
   ];
 
   buildInputs = [
     alsa-lib
     giflib
-    gtk2
+    gtk3
+    glew
     libGL
     libGLU
-    libXaw
-    libjpeg
     libpng
     perl
     readline
     SDL
     SDL_image
     xa
+    xdg-utils
   ];
   dontDisableStatic = true;
-  configureFlags = [ "--enable-fullscreen" "--enable-gnomeui" "--disable-pdf-docs" ];
+  configureFlags = [ "--enable-sdl2ui" "--enable-gtk3ui" "--enable-desktop-files" "--disable-pdf-docs" "--with-gif" ];
+
+  LIBS = "-lGL";
 
   preBuild = ''
-    for i in src/resid src/resid-dtv
-    do
-      mkdir -pv $i/src
-      ln -sv ../../wrap-u-ar.sh $i/src
-    done
+    sed -i -e 's|#!/usr/bin/env bash|${runtimeShell}/bin/bash|' src/arch/gtk3/novte/box_drawing_generate.sh
   '';
 
   postInstall = ''
-    for app in ${toString desktopItems}
-    do
-        mkdir -p $out/share/applications
-        cp $app/share/applications/* $out/share/applications
-    done
+    mkdir -p $out/share/applications
+    cp src/arch/gtk3/data/unix/vice-org-*.desktop $out/share/applications
   '';
 
   meta = {

pkgs/applications/graphics/viewnior/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, desktop-file-utils, gtk2, libpng, exiv2, lcms
+{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, pkg-config, desktop-file-utils, gtk2, libpng, exiv2, lcms
 , intltool, gettext, shared-mime-info, glib, gdk-pixbuf, perl}:
 
 stdenv.mkDerivation rec {
@@ -9,9 +9,22 @@ stdenv.mkDerivation rec {
     owner = "hellosiyan";
     repo = "Viewnior";
     rev = "${pname}-${version}";
-    sha256 = "sha256-LTahMmcAqgqviUxR624kTozJGTniAAGWKo1ZqXjoG5M=";
+    hash = "sha256-LTahMmcAqgqviUxR624kTozJGTniAAGWKo1ZqXjoG5M=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "viewnior-1.8-change-exiv2-AutoPtr-to-unique_ptr.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/viewnior/files/viewnior-1.8-change-exiv2-AutoPtr-to-unique_ptr.patch?id=002882203ad6a2b08ce035a18b95844a9f4b85d0";
+      hash = "sha256-O3/d7qMiOsYJmz7ekoLM6oaHcuYjEbAfPFuDUWSybfE=";
+    })
+    (fetchpatch {
+      name = "viewnior-1.8-add-support-for-exiv-0.28.0-errors.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/viewnior/files/viewnior-1.8-add-support-for-exiv-0.28.0-errors.patch?id=002882203ad6a2b08ce035a18b95844a9f4b85d0";
+      hash = "sha256-Zjc4CIlelAkbyvX2F1yo/qJjUajtAgF4+FoHWFEIPWY=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja

pkgs/applications/misc/phoc/default.nix

@@ -17,6 +17,7 @@
 , libxkbcommon
 , wlroots
 , xorg
+, nixosTests
 }:
 
 let
@@ -70,6 +71,8 @@ in stdenv.mkDerivation rec {
     patchShebangs build-aux/post_install.py
   '';
 
+  passthru.tests.phosh = nixosTests.phosh;
+
   meta = with lib; {
     description = "Wayland compositor for mobile phones like the Librem 5";
     homepage = "https://gitlab.gnome.org/World/Phosh/phoc";

pkgs/applications/networking/cluster/glooctl/default.nix

@@ -1,36 +1,45 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.15.4";
+  version = "1.15.7";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-dQvvWlfCCc9QZFdOryX0bvLVdoBlhVMeP8MqQAYKua4=";
+    hash = "sha256-sGJfQ9sALQPxne+Q1Rf8PhCHBHupbWrIShk1dqFEPhk=";
   };
 
+  vendorHash = "sha256-KaBq1VCGWv3K50DDelS0hOQkXnK1ufBiXBtbPQFzwMY=";
+
   subPackages = [ "projects/gloo/cli/cmd" ];
-  vendorHash = "sha256-FU8Siea+oH4xtSVwGk/dcivS6eNpIkWZiZqQ3EX9dwI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
+  strictDeps = true;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/solo-io/gloo/pkg/version.Version=${version}"
+  ];
+
   postInstall = ''
     mv $out/bin/cmd $out/bin/glooctl
-
-    export HOME=$TMP
     installShellCompletion --cmd glooctl \
       --bash <($out/bin/glooctl completion bash) \
       --zsh <($out/bin/glooctl completion zsh)
   '';
 
-  ldflags = [ "-s" "-w" "-X github.com/solo-io/gloo/pkg/version.Version=${version}" ];
-
-  meta = with lib; {
+  meta = {
     description = "glooctl is the unified CLI for Gloo";
     homepage = "https://docs.solo.io/gloo-edge/latest/reference/cli/glooctl/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ nelsonjeppesen ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ];
   };
 }

pkgs/applications/networking/cluster/opentofu/default.nix

@@ -0,0 +1,172 @@
+{ stdenv
+, lib
+, buildGoModule
+, fetchFromGitHub
+, makeWrapper
+, coreutils
+, runCommand
+, runtimeShell
+, writeText
+, terraform-providers
+, installShellFiles
+}:
+
+let
+  package =  buildGoModule rec {
+    pname = "opentofu";
+    version = "1.6.0-alpha1";
+
+    src = fetchFromGitHub {
+      owner = "opentofu";
+      repo = "opentofu";
+      rev = "v${version}";
+      hash = "sha256-0FO55H1nOyhAd+ex1zA0XycH6x/HKkLlxzuIJNoaI9g=";
+    };
+    vendorHash = "sha256-3jQfIIZOgOmNHQ06rXz+3QTZ37WcuCc7A7/MhC7udrg=";
+    ldflags = [ "-s" "-w" ];
+
+    postConfigure = ''
+      # speakeasy hardcodes /bin/stty https://github.com/bgentry/speakeasy/issues/22
+      substituteInPlace vendor/github.com/bgentry/speakeasy/speakeasy_unix.go \
+        --replace "/bin/stty" "${coreutils}/bin/stty"
+    '';
+
+    nativeBuildInputs = [ installShellFiles ];
+    patches = [ ./provider-path-0_15.patch ];
+
+    passthru = {
+      inherit plugins withPlugins;
+      tests = { inherit opentofu_plugins_test; };
+    };
+
+    # https://github.com/posener/complete/blob/9a4745ac49b29530e07dc2581745a218b646b7a3/cmd/install/bash.go#L8
+    postInstall = ''
+      installShellCompletion --bash --name tofu <(echo complete -C tofu tofu)
+    '';
+
+    preCheck = ''
+      export HOME=$TMPDIR
+      export TF_SKIP_REMOTE_TESTS=1
+    '';
+
+    subPackages = [ "./cmd/..." ];
+
+    meta = with lib; {
+      description = "Tool for building, changing, and versioning infrastructure";
+      homepage = "https://opentofu.org/";
+      changelog = "https://github.com/opentofu/opentofu/blob/v${version}/CHANGELOG.md";
+      license = licenses.mpl20;
+      maintainers = with maintainers; [
+        gmemstr
+      ];
+      mainProgram = "tofu";
+    };
+  };
+
+  opentofu_plugins_test = let
+    mainTf = writeText "main.tf" ''
+      resource "random_id" "test" {}
+    '';
+    opentofu = package.withPlugins (p: [ p.random ]);
+    test = runCommand "opentofu-plugin-test" {
+      buildInputs = [ opentofu ];
+    } ''
+      # make it fail outside of sandbox
+      export HTTP_PROXY=http://127.0.0.1:0 HTTPS_PROXY=https://127.0.0.1:0
+      cp ${mainTf} main.tf
+      tofu init
+      touch $out
+    '';
+  in
+    test;
+
+  plugins = removeAttrs terraform-providers [
+    "override"
+    "overrideDerivation"
+    "recurseForDerivations"
+  ];
+
+  withPlugins = plugins:
+    let
+      actualPlugins = plugins package.plugins;
+
+      # Wrap PATH of plugins propagatedBuildInputs, plugins may have runtime dependencies on external binaries
+      wrapperInputs = lib.unique (lib.flatten
+        (lib.catAttrs "propagatedBuildInputs"
+          (builtins.filter (x: x != null) actualPlugins)));
+
+      passthru = {
+        withPlugins = newplugins:
+          withPlugins (x: newplugins x ++ actualPlugins);
+        full = withPlugins (p: lib.filter lib.isDerivation (lib.attrValues p.actualProviders));
+
+        # Expose wrappers around the override* functions of the terraform
+        # derivation.
+        #
+        # Note that this does not behave as anyone would expect if plugins
+        # are specified. The overrides are not on the user-visible wrapper
+        # derivation but instead on the function application that eventually
+        # generates the wrapper. This means:
+        #
+        # 1. When using overrideAttrs, only `passthru` attributes will
+        #    become visible on the wrapper derivation. Other overrides that
+        #    modify the derivation *may* still have an effect, but it can be
+        #    difficult to follow.
+        #
+        # 2. Other overrides may work if they modify the terraform
+        #    derivation, or they may have no effect, depending on what
+        #    exactly is being changed.
+        #
+        # 3. Specifying overrides on the wrapper is unsupported.
+        #
+        # See nixpkgs#158620 for details.
+        overrideDerivation = f:
+          (package.overrideDerivation f).withPlugins plugins;
+        overrideAttrs = f:
+          (package.overrideAttrs f).withPlugins plugins;
+        override = x:
+          (package.override x).withPlugins plugins;
+      };
+      # Don't bother wrapping unless we actually have plugins, since the wrapper will stop automatic downloading
+      # of plugins, which might be counterintuitive if someone just wants a vanilla Terraform.
+    in
+      if actualPlugins == [ ] then
+        package.overrideAttrs
+          (orig: { passthru = orig.passthru // passthru; })
+      else
+        lib.appendToName "with-plugins" (stdenv.mkDerivation {
+          inherit (package) meta pname version;
+          nativeBuildInputs = [ makeWrapper ];
+
+          # Expose the passthru set with the override functions
+          # defined above, as well as any passthru values already
+          # set on `terraform` at this point (relevant in case a
+          # user overrides attributes).
+          passthru = package.passthru // passthru;
+
+          buildCommand = ''
+            # Create wrappers for terraform plugins because Terraform only
+            # walks inside of a tree of files.
+            for providerDir in ${toString actualPlugins}
+            do
+              for file in $(find $providerDir/libexec/terraform-providers -type f)
+              do
+                relFile=''${file#$providerDir/}
+                mkdir -p $out/$(dirname $relFile)
+                cat <<WRAPPER > $out/$relFile
+            #!${runtimeShell}
+            exec "$file" "$@"
+            WRAPPER
+                chmod +x $out/$relFile
+              done
+            done
+
+            # Create a wrapper for opentofu to point it to the plugins dir.
+            mkdir -p $out/bin/
+            makeWrapper "${package}/bin/tofu" "$out/bin/tofu" \
+              --set NIX_TERRAFORM_PLUGIN_DIR $out/libexec/terraform-providers \
+              --prefix PATH : "${lib.makeBinPath wrapperInputs}"
+          '';
+        });
+in
+package

pkgs/applications/networking/cluster/opentofu/provider-path-0_15.patch

@@ -0,0 +1,23 @@
+diff -Naur terraform.old/internal/command/init.go terraform.new/internal/command/init.go
+--- terraform.old/internal/command/init.go
++++ terraform.new/internal/command/init.go
+@@ -3,6 +3,7 @@
+ import (
+ 	"context"
+ 	"fmt"
++	"os"
+ 	"log"
+ 	"strings"
+ 
+@@ -55,6 +56,11 @@
+ 
+ 	var diags tfdiags.Diagnostics
+ 
++	val, ok := os.LookupEnv("NIX_TERRAFORM_PLUGIN_DIR")
++	if ok {
++		flagPluginPath = append(flagPluginPath, val)
++	}
++
+ 	if len(flagPluginPath) > 0 {
+ 		c.pluginPath = flagPluginPath
+ 	}

pkgs/applications/networking/cluster/terraform/default.nix

@@ -53,7 +53,7 @@ let
           "Tool for building, changing, and versioning infrastructure";
         homepage = "https://www.terraform.io/";
         changelog = "https://github.com/hashicorp/terraform/blob/v${version}/CHANGELOG.md";
-        license = licenses.mpl20;
+        license = licenses.bsl11;
         maintainers = with maintainers; [
           Chili-Man
           babariviere
@@ -167,9 +167,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.5.7";
-    hash = "sha256-pIhwJfa71/gW7lw/KRFBO4Q5Z5YMcTt3r9kD25k8cqM=";
-    vendorHash = "sha256-lQgWNMBf+ioNxzAV7tnTQSIS840XdI9fg9duuwoK+U4=";
+    version = "1.6.0";
+    hash = "sha256-R1phgtGn9hyNqa0wR1zY9uThTJSIj7TuK5ekXx48QP0=";
+    vendorHash = "sha256-V7S+IzHfBhIHo0xCvHJ75gOmvVbJd2k8XBdvLG1dcsc=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;

pkgs/applications/networking/cluster/tilt/default.nix

@@ -8,13 +8,13 @@ buildGoModule rec {
   /* Do not use "dev" as a version. If you do, Tilt will consider itself
     running in development environment and try to serve assets from the
     source tree, which is not there once build completes.  */
-  version = "0.33.5";
+  version = "0.33.6";
 
   src = fetchFromGitHub {
     owner = "tilt-dev";
     repo = "tilt";
     rev = "v${version}";
-    hash = "sha256-o78PoIKj+0FvZRpm0AqtUq3N9a9/LDYc7DIPZgSZe4s=";
+    hash = "sha256-WtE8ExUKFRtdYeg0+My/DB+L/qT+J1EaKHKChNjC5oI=";
   };
 
   vendorHash = null;

pkgs/applications/networking/deck/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "deck";
-  version = "1.27.0";
+  version = "1.27.1";
 
   src = fetchFromGitHub {
     owner = "Kong";
     repo = "deck";
     rev = "v${version}";
-    hash = "sha256-QP267H1vfsIo1EhV9vAWt03ewGufPHT8sZWcj/AHuxw=";
+    hash = "sha256-9eMcbmRCr92ebJsPTyDFnwGn3gsRpR7aAkzV6Qfntgo=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/applications/networking/instant-messengers/signal-cli/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-cli";
-  version = "0.12.1";
+  version = "0.12.2";
 
   # Building from source would be preferred, but is much more involved.
   src = fetchurl {
     url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}-Linux.tar.gz";
-    hash = "sha256-pxDSAVh/zg3hCuTlSuilgD4VKe1CPSG/ZLl0TF1nc1I=";
+    hash = "sha256-XhLTovymqjbc19X717WyNIi4jdpwnyttXGqkkHBFwQA=";
   };
 
   buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];

pkgs/applications/networking/instant-messengers/slack/default.nix

@@ -45,14 +45,14 @@ let
 
   pname = "slack";
 
-  x86_64-darwin-version = "4.34.119";
-  x86_64-darwin-sha256 = "17ssha6a8iyvan3k7mbg2cdyy1y7gmlwrh4dlkgcc63bqqxsavy1";
+  x86_64-darwin-version = "4.34.121";
+  x86_64-darwin-sha256 = "0j04rj8v6aq4kjlkkc6yf466zq821jg3qy6qppmvyg5z0f08cyar";
 
-  x86_64-linux-version = "4.34.120";
-  x86_64-linux-sha256 = "0wldnj6hyzqxyc9p365gb46pyqq0im1ayl12mrc8xkrikx9phb7y";
+  x86_64-linux-version = "4.34.121";
+  x86_64-linux-sha256 = "11199dsp7phmz0bxlk5al61xp2g6yzgj17nwz0zrx1g7ak0qdvz5";
 
-  aarch64-darwin-version = "4.34.119";
-  aarch64-darwin-sha256 = "0xa39l4ynjmzq6811vprxxz8znwckmxcss9aa7v68cja8vj033vj";
+  aarch64-darwin-version = "4.34.121";
+  aarch64-darwin-sha256 = "0pvlf9h8433fi31398g4rkii14gk77a684sln8n95xg5p3lxkydy";
 
   version = {
     x86_64-darwin = x86_64-darwin-version;

pkgs/applications/networking/juju/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "juju";
-  version = "3.2.2";
+  version = "3.2.3";
 
   src = fetchFromGitHub {
     owner = "juju";
     repo = "juju";
     rev = "juju-${version}";
-    sha256 = "sha256-ZmMOQCKQWtzB2O6CNZTRhhj7gkpRRXY9ILN2KdSQoWk=";
+    sha256 = "sha256-sUlM4bLy/kluZmGOzMACz92GG46XYKicNPP5k2FPSGA=";
   };
 
-  vendorHash = "sha256-rqf5nAXwcW6lm7sidEcxMqatT4KPju4Seo1/Awse5Zs=";
+  vendorHash = "sha256-mPEixXVuxAqgkBoNqIYnZaFJynHJsnmamaHqyh/svwQ=";
 
   # Disable tests because it attempts to use a mongodb instance
   doCheck = false;

pkgs/applications/networking/mailreaders/aerc/default.nix

@@ -12,19 +12,17 @@
 
 buildGoModule rec {
   pname = "aerc";
-  version = "0.15.2";
+  version = "0.16.0";
 
   src = fetchFromSourcehut {
     owner = "~rjarry";
     repo = "aerc";
     rev = version;
-    hash = "sha256-OQDA4AHDcAdDzpwNSi8rW1FKjfYaFktOwiM0FEHPd70=";
+    hash = "sha256-vmr2U0bz6A7aMZZBtOitA5gKQpXKuNhYxRCmholHYa8=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-NWOySC0czNgNOakpxFguZLtmEI7AvjJQKXDE2vFWeZg=";
-
-  doCheck = false;
+  vendorHash = "sha256-j/wTmlVcyVI4gnjbi7KLzk5rdnZtZLrdSNbihtQJxRY=";
 
   nativeBuildInputs = [
     scdoc
@@ -74,6 +72,7 @@ buildGoModule rec {
     description = "An email client for your terminal";
     homepage = "https://aerc-mail.org/";
     maintainers = with maintainers; [ tadeokondrak ];
+    mainProgram = "aerc";
     license = licenses.mit;
     platforms = platforms.unix;
   };

pkgs/applications/radio/gqrx/default.nix

@@ -27,13 +27,13 @@ assert !(pulseaudioSupport && portaudioSupport);
 
 gnuradioMinimal.pkgs.mkDerivation rec {
   pname = "gqrx";
-  version = "2.16";
+  version = "2.17";
 
   src = fetchFromGitHub {
     owner = "gqrx-sdr";
     repo = "gqrx";
     rev = "v${version}";
-    hash = "sha256-14MVimOxM7upq6vpEhvVRnrverBuFToE2ktNhG59LKE=";
+    hash = "sha256-QnwkiH8KqoHa2Q3knh0OAyGBySAArEtdpO+lTzqJ4j0=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/biology/delly/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "delly";
-  version = "1.1.6";
+  version = "1.1.7";
 
   src = fetchFromGitHub {
     owner = "dellytools";
     repo = "delly";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/I//7MhsC/CcBeIJblzbjXp/yOSBm83KWJsrYpl6UJk=";
+    hash = "sha256-oBIY8s/ippf+Xw+3QzMwP0Esc/QpiT6yWeAnqpMix6s=";
   };
 
   buildInputs = [

pkgs/applications/science/biology/truvari/default.nix

@@ -1,6 +1,5 @@
 { lib
 , fetchFromGitHub
-, fetchpatch
 , python3Packages
 , runtimeShell
 , bcftools
@@ -16,37 +15,28 @@ let
   };
 in python3Packages.buildPythonApplication rec {
   pname = "truvari";
-  version = "4.0.0";
+  version = "4.1.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ACEnglish";
     repo = "truvari";
     rev = "v${version}";
-    hash = "sha256-UJNMKEV5m2jFqnWvkVAtymkcE2TjPIXp7JqRZpMSqsE=";
+    hash = "sha256-HFVAv1TTL/nMjr62tQKhMdwh25P/y4nBGzSbxoJxMmo=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-anno-trf-on-darwin.patch";
-      url = "https://github.com/ACEnglish/truvari/commit/f9f36305e8eaa88f951562210e3672a4d4f71265.patch";
-      hash = "sha256-7O9jTQDCC2b8hUBm0qJQCYMzTC9NFtn/E0dTHSfJALU=";
-    })
-    (fetchpatch {
-      name = "fix-anno-grm-on-darwin.patch";
-      url = "https://github.com/ACEnglish/truvari/commit/31416552008a506204ed4e2add55474f10392357.patch";
-      hash = "sha256-42u0ewZU38GCoSfff+XQFv9hEFeO3WlJufTHcl6vkN4=";
-    })
-  ];
-
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace "rich==" "rich>="
     substituteInPlace truvari/utils.py \
       --replace "/bin/bash" "${runtimeShell}"
     patchShebangs repo_utils/test_files
   '';
 
+  nativeBuildInputs = [
+    python3Packages.setuptools
+  ];
+
   propagatedBuildInputs = with python3Packages; [
+    pywfa
     rich
     edlib
     pysam
@@ -83,6 +73,7 @@ in python3Packages.buildPythonApplication rec {
   meta = with lib; {
     description = "Structural variant comparison tool for VCFs";
     homepage = "https://github.com/ACEnglish/truvari";
+    changelog = "https://github.com/ACEnglish/truvari/releases/tag/${src.rev}";
     license = licenses.mit;
     maintainers = with maintainers; [ natsukium scalavision ];
     longDescription = ''

pkgs/applications/terminal-emulators/kitty/default.nix

@@ -29,20 +29,20 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.30.0";
+  version = "0.30.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "refs/tags/v${version}";
-    hash = "sha256-M6qFkeUp2rBudO2PiLN2VSrmut68c9mjjUr07WEX9VY=";
+    hash = "sha256-zjXwiRo6Jw3K0iDf05f04MCtg1qKABah7x07CwvW0/0=";
   };
 
   goModules = (buildGoModule {
     pname = "kitty-go-modules";
     inherit src version;
-    vendorHash = "sha256-53Y2S/P2fWT9STZFTdlkESxHNpoAggifZJ0+WXCzbkU=";
+    vendorHash = "sha256-KDqzcJbI2f91wlrjVWgUmut4nhXA/rO9q5q3FaDWnfc=";
   }).goModules;
 
   buildInputs = [

pkgs/applications/version-management/forgejo/default.nix

@@ -39,14 +39,14 @@ let
 in
 buildGoModule rec {
   pname = "forgejo";
-  version = "1.20.4-1";
+  version = "1.20.5-0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "forgejo";
     repo = "forgejo";
     rev = "v${version}";
-    hash = "sha256-Fxlj+ckw1LSgiQDex3ZizHakIKd52U6JcdTurJj8YWg=";
+    hash = "sha256-tuwMvSWaMUc/GghmrbGLtyjixwOwiapWEOMD9QmMLic=";
   };
 
   vendorHash = "sha256-dgtZjsLBwblhdge3BvdbK/mN/TeZKps9K5dJbqomtjo=";

pkgs/applications/version-management/gitoxide/default.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitoxide";
-  version = "0.29.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "gitoxide";
     rev = "v${version}";
-    hash = "sha256-Ry5QvOoj4iSQZr1O+Y6qSHzhmm77nbkLjCcdPOhxR18=";
+    hash = "sha256-VJZwNLFePUNIRHEyiEr1tiLaB2tuL6Ah81LNuM/1H14=";
   };
 
-  cargoHash = "sha256-WZctsAxGojrGufF8CwUiw1xWzn9qVZUphDE3KmGTGy4=";
+  cargoHash = "sha256-vEp0wLxmmmv33oRO7eOxOoOsV87/7DQ8db5RUfqUb88=";
 
   nativeBuildInputs = [ cmake pkg-config ];
 

pkgs/applications/version-management/lefthook/default.nix

@@ -6,7 +6,7 @@
 
 let
   pname = "lefthook";
-  version = "1.4.8";
+  version = "1.5.1";
 in
 buildGoModule rec {
   inherit pname version;
@@ -15,7 +15,7 @@ buildGoModule rec {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${version}";
-    hash = "sha256-lK2JGENCqfNXXzZBHirEoOB5+ktea38ypb2VD7GWxhg=";
+    hash = "sha256-v6COZt4ylhpPfPNQLSN0XDpjVk8E2ZUDIP4TU+Uzk5A=";
   };
 
   vendorHash = "sha256-/VLS7+nPERjIU7V2CzqXH69Z3/y+GKZbAFn+KcRKRuA=";

pkgs/applications/video/makemkv/default.nix

@@ -39,6 +39,10 @@ in mkDerivation {
 
   sourceRoot = "makemkv-oss-${version}";
 
+  patches = [ ./r13y.patch ];
+
+  enableParallelBuilding = true;
+
   nativeBuildInputs = [ autoPatchelfHook pkg-config ];
 
   buildInputs = [ ffmpeg openssl qtbase zlib ];
@@ -80,7 +84,7 @@ in mkDerivation {
       expiration date.
     '';
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
+    license = [ licenses.unfree licenses.lgpl21 ];
     homepage = "http://makemkv.com";
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ titanous ];

pkgs/applications/video/makemkv/r13y.patch

@@ -0,0 +1,13 @@
+diff --git a/Makefile.in b/Makefile.in
+index 61c47fc..e08ffac 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -27,7 +27,7 @@ INSTALL=@INSTALL@
+ OBJCOPY=@OBJCOPY@
+ LD=@LD@
+ BUILDINFO_ARCH_NAME=$(shell $(GCC) -dumpmachine)
+-BUILDINFO_BUILD_DATE=$(shell date)
++BUILDINFO_BUILD_DATE=$(shell date -d @${SOURCE_DATE_EPOCH})
+ 
+ top_srcdir ?= .
+ INCF=-I$(top_srcdir)/

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -223,6 +223,7 @@ let
 
   bin = writeShellScript "${name}-bwrap" (bwrapCmd { initArgs = ''"$@"''; });
 in runCommandLocal name {
+  inherit pname version;
   inherit meta;
 
   passthru = passthru // {

pkgs/build-support/php/pkgs/composer-local-repo-plugin.nix

@@ -1,7 +1,9 @@
-{ callPackage, stdenvNoCC, lib, fetchFromGitHub, makeBinaryWrapper }:
+{ php, callPackage, stdenvNoCC, lib, fetchFromGitHub, makeBinaryWrapper }:
 
 let
-  composer = callPackage ./composer-phar.nix { };
+  composer = callPackage ./composer-phar.nix {
+    inherit (php.packages.composer) version pharHash;
+  };
 
   composerKeys = stdenvNoCC.mkDerivation (finalComposerKeysAttrs: {
     pname = "composer-keys";

pkgs/build-support/php/pkgs/composer-phar.nix

@@ -10,15 +10,17 @@
   , stdenvNoCC
   , unzip
   , xz
+  , version
+  , pharHash
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "composer-phar";
-  version = "2.6.4";
+  inherit version;
 
   src = fetchurl {
     url = "https://github.com/composer/composer/releases/download/${finalAttrs.version}/composer.phar";
-    hash = "sha256-Wjnz4s5bo5HuP+yyJ/ryE5D1t+1cVvFMq54cMEi8+Lg=";
+    hash = pharHash;
   };
 
   dontUnpack = true;

pkgs/by-name/ao/aocl-utils/package.nix

@@ -0,0 +1,23 @@
+{ lib, stdenv, fetchFromGitHub, cmake } :
+
+stdenv.mkDerivation rec {
+  pname = "aocl-utils";
+  version = "4.1";
+
+  src = fetchFromGitHub {
+    owner = "amd";
+    repo = "aocl-utils";
+    rev = version;
+    hash = "sha256-7Vc3kE+YfqIt6VfvSamsVQRemolzs1sNJUVUZFKk/O8=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "Interface to all AMD AOCL libraries to access CPU features";
+    homepage = "https://github.com/amd/aocl-utils";
+    license = licenses.bsd3;
+    platforms = [ "x86_64-linux" ];
+    maintainers = [ maintainers.markuskowa ];
+  };
+}

pkgs/by-name/ri/rimgo/package.nix

@@ -0,0 +1,40 @@
+{
+  lib,
+  fetchFromGitea,
+  buildGoModule,
+  tailwindcss,
+}:
+buildGoModule rec {
+  pname = "rimgo";
+  version = "1.2.0";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "rimgo";
+    repo = "rimgo";
+    rev = "v${version}";
+    hash = "sha256-C878ABs978viVtIuv3fPn2F2anOg2GB/+f5jaCO13tc=";
+  };
+
+  vendorHash = "sha256-u5N7aI9RIQ3EmiyHv0qhMcKkvmpp+5G7xbzdQcbhybs=";
+
+  nativeBuildInputs = [ tailwindcss ];
+
+  preBuild = ''
+    tailwindcss -i static/tailwind.css -o static/app.css -m
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X codeberg.org/rimgo/rimgo/pages.VersionInfo=${version}"
+  ];
+
+  meta = with lib; {
+    description = "An alternative frontend for Imgur";
+    homepage = "https://codeberg.org/rimgo/rimgo";
+    license = licenses.agpl3Only;
+    mainProgram = "rimgo";
+    maintainers = with maintainers; [ quantenzitrone ];
+  };
+}

pkgs/by-name/sc/scdoc/package.nix

@@ -6,20 +6,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "scdoc";
-  version = "1.11.2";
+  version = "1.11.2-unstable-2023-03-08";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "scdoc";
-    rev = finalAttrs.version;
-    hash = "sha256-2NVC+1in1Yt6/XGcHXP+V4AAz8xW/hSq9ctF/Frdgh0=";
+    rev = "afeda241f3f9b2c27e461f32d9c2a704ab82ef61";
+    hash = "sha256-jIYygjUXP/6o5d9drlZjdr25KjEQx8oy4TaQwQEu8fM=";
   };
 
   outputs = [ "out" "man" "dev" ];
 
   postPatch = ''
     substituteInPlace Makefile \
-      --replace "-static" ""
+      --replace "LDFLAGS+=-static" "LDFLAGS+="
   '';
 
   makeFlags = [
@@ -33,10 +33,10 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "A simple man page generator written in C99 for POSIX systems";
     homepage = "https://git.sr.ht/~sircmpwn/scdoc";
-    changelog = "https://git.sr.ht/~sircmpwn/scdoc/refs/${finalAttrs.version}";
+    changelog = "https://git.sr.ht/~sircmpwn/scdoc/refs/${finalAttrs.src.rev}";
     license = lib.licenses.mit;
+    mainProgram = "scdoc";
     maintainers = with lib.maintainers; [ primeos AndersonTorres ];
     platforms = lib.platforms.unix;
-    mainProgram = "scdoc";
   };
 })

pkgs/by-name/su/supersonic/package.nix

@@ -0,0 +1,73 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, makeDesktopItem
+, copyDesktopItems
+, pkg-config
+, xorg
+, libglvnd
+, mpv
+, glfw3
+, waylandSupport ? false
+}:
+
+buildGoModule rec {
+  pname = "supersonic" + lib.optionalString waylandSupport "-wayland";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "dweymouth";
+    repo = "supersonic";
+    rev = "v${version}";
+    hash = "sha256-4SLAUqLMoUxTSi4I/QeHqudO62Gmhpm1XbCGf+3rPlc=";
+  };
+
+  vendorHash = "sha256-6Yp5OoybFpoBuIKodbwnyX3crLCl8hJ2r4plzo0plsY=";
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    pkg-config
+  ];
+
+  # go-glfw doesn't support both X11 and Wayland in single build
+  tags = lib.optionals waylandSupport [ "wayland" ];
+
+  buildInputs = [
+    libglvnd
+    mpv
+    xorg.libXxf86vm
+    xorg.libX11
+  ] ++ (glfw3.override { inherit waylandSupport; }).buildInputs;
+
+  postInstall = ''
+    for dimension in 128 256 512;do
+        dimensions=''${dimension}x''${dimension}
+        mkdir -p $out/share/icons/hicolor/$dimensions/apps
+        cp res/appicon-$dimension.png $out/share/icons/hicolor/$dimensions/apps/${meta.mainProgram}.png
+    done
+  '' + lib.optionalString waylandSupport ''
+    mv $out/bin/supersonic $out/bin/${meta.mainProgram}
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = meta.mainProgram;
+      exec = meta.mainProgram;
+      icon = meta.mainProgram;
+      desktopName = "Supersonic" + lib.optionalString waylandSupport " (Wayland)";
+      genericName = "Subsonic Client";
+      comment = meta.description;
+      type = "Application";
+      categories = [ "Audio" "AudioVideo" ];
+    })
+  ];
+
+  meta = with lib; {
+    mainProgram = "supersonic" + lib.optionalString waylandSupport "-wayland";
+    description = "A lightweight cross-platform desktop client for Subsonic music servers";
+    homepage = "https://github.com/dweymouth/supersonic";
+    platforms = platforms.linux;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ zane sochotnicky ];
+  };
+}

pkgs/data/fonts/sketchybar-app-font/default.nix

@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sketchybar-app-font";
-  version = "1.0.14";
+  version = "1.0.16";
 
   src = fetchurl {
     url = "https://github.com/kvndrsslr/sketchybar-app-font/releases/download/v${finalAttrs.version}/sketchybar-app-font.ttf";
-    hash = "sha256-GPxNMlG6a7newSXorh2RULZ5XHYFmQbcB46C0RytTTU=";
+    hash = "sha256-58gRCEJix9pnZEcoo6bm2zWduP0xXl3WWC6mt36SGuo=";
   };
 
   dontUnpack = true;

pkgs/desktops/gnome/core/gnome-session/default.nix

@@ -1,4 +1,5 @@
 { fetchurl
+, fetchpatch
 , lib
 , stdenv
 , substituteAll
@@ -47,6 +48,12 @@ stdenv.mkDerivation rec {
       dbusLaunch = "${dbus.lib}/bin/dbus-launch";
       bash = "${bash}/bin/bash";
     })
+    # See #226355. Can be removed on update to v45.
+    (fetchpatch {
+      name = "fix-gnome-boxes-crash.patch";
+      url = "https://gitlab.gnome.org/GNOME/gnome-session/commit/fab1a3b91677035d541de2c141f8073c4057342c.patch";
+      hash = "sha256-2xeoNgV8UDexkufXDqimAplX0GC99tUWUqjw3kfN+5Q=";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , meson
 , ninja
@@ -23,6 +24,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-j4K8qYwfu6/s4qnTSzwv6KRsk9f+Qr/l1bhLywKMHMU=";
   };
 
+  patches = [
+    # Add pantheon-portals.conf
+    # https://github.com/elementary/default-settings/pull/293
+    (fetchpatch {
+      url = "https://github.com/elementary/default-settings/commit/8201eeb6a356e6059b505756ef7a556a6848ad3b.patch";
+      sha256 = "sha256-qhGj7WQTAWJTC1kouUZhBWKqyO4hQWJghEhLVl8QVUM=";
+    })
+  ];
+
   nativeBuildInputs = [
     accountsservice
     dbus

pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix

@@ -1,30 +1,34 @@
 { lib
 , mkXfceDerivation
 , exo
+, glib
 , gtk3
 , libxfce4ui
 , xfconf
 , libwnck
+, libX11
 , libXmu
 }:
 
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-taskmanager";
-  version = "1.5.5";
+  version = "1.5.6";
   odd-unstable = false;
 
-  sha256 = "sha256-worHYB9qibRxMaCYQ0+nHA9CSTColewgahyrXiPOnQA=";
+  sha256 = "sha256-2NkjaK6xXsrMimriO2/gTOZowt9KTX4MrWJpPXM0w68=";
 
   nativeBuildInputs = [
     exo
   ];
 
   buildInputs = [
+    glib
     gtk3
     libxfce4ui
     xfconf
     libwnck
+    libX11
     libXmu
   ];
 

pkgs/desktops/xfce/core/thunar/default.nix

@@ -1,4 +1,5 @@
 { mkXfceDerivation
+, fetchpatch
 , lib
 , docbook_xsl
 , exo
@@ -25,6 +26,15 @@ let unwrapped = mkXfceDerivation {
 
   sha256 = "sha256-pxIblhC40X0wdE6+uvmV5ypp4sOZtzn/evcS33PlNpU=";
 
+  patches = [
+    # Fix log spam with new GLib
+    # https://gitlab.xfce.org/xfce/thunar/-/issues/1204
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/xfce/thunar/-/commit/2f06fcdbedbc59d9f90ccd3df07fce417cea391d.patch";
+      sha256 = "sha256-nvYakT4GJkQYmubgZF8GJIA/m7+6ZPbmD0HSgMcCh10=";
+    })
+  ];
+
   nativeBuildInputs = [
     docbook_xsl
     gobject-introspection

pkgs/desktops/xfce/core/xfce4-session/default.nix

@@ -1,5 +1,6 @@
 { lib
 , mkXfceDerivation
+, fetchpatch
 , polkit
 , exo
 , libxfce4util
@@ -19,6 +20,15 @@ mkXfceDerivation {
 
   sha256 = "sha256-qCkE3aVYVwphoO1ZAyzpL1ZtsLaP6XT1H1rlFoBI3yg=";
 
+  patches = [
+    # Add minimal xdg-desktop-portal conf file
+    # https://gitlab.xfce.org/xfce/xfce4-session/-/issues/181
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/xfce/xfce4-session/-/commit/6451c8b21085631d8861e07ff4e1b2ef64a64ad3.patch";
+      sha256 = "sha256-t3opom0iv7QsKoivzk+nXbxI5uFhNmB8/Qwb4QHvcCQ=";
+    })
+  ];
+
   buildInputs = [
     exo
     gtk3

pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix

@@ -17,8 +17,8 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-pulseaudio-plugin";
-  version = "0.4.7";
-  sha256 = "sha256-9fumaX4M6NTXHM1gGa4wB/Uq+CZIUnvm9kC+pJNbWXU=";
+  version = "0.4.8";
+  sha256 = "sha256-7vcjARm0O+/hVNFzOpxcgAnqD+wRNg5/eqXLcq4t/iU=";
 
   nativeBuildInputs = [
     automakeAddFlags

pkgs/development/compilers/cudatoolkit/redist/extension.nix

@@ -89,9 +89,9 @@ let
     in
     {
       # features : Attr Set (String PackageFeatureAttrs)
-      features = processManifest ./manifests/redistrib_features_${fullCudaVersion}.json;
+      features = processManifest (./manifests + "/redistrib_features_${fullCudaVersion}.json");
       # manifest : Attr Set (String PackageAttrs)
-      manifest = processManifest ./manifests/redistrib_${fullCudaVersion}.json;
+      manifest = processManifest (./manifests + "/redistrib_${fullCudaVersion}.json");
     };
 
   # Function to build a single redist package

pkgs/development/embedded/wch-isp/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wch-isp";
-  version = "0.2.5";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "jmaselbas";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-JF1g2Qb1gG93lSaDQvltT6jCYk/dKntsIJPkQXYUvX4=";
+    hash = "sha256-cbQJgHZAdSfzRsf/srMlRd+QgGUPpP5r3kBTNCgINDw=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/development/libraries/fbjni/default.nix

@@ -0,0 +1,54 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, fetchpatch
+, jdk_headless
+, gtest
+}:
+
+stdenv.mkDerivation rec {
+  pname = "fbjni";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "facebookincubator";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-97KqfFWtR3VJe2s0D60L3dsIDm4kMa0hpkKoZSAEoVY=";
+  };
+
+  patches = [
+    # Part of https://github.com/facebookincubator/fbjni/pull/76
+    # fix cmake file installation directory
+    (fetchpatch {
+      url = "https://github.com/facebookincubator/fbjni/commit/ab02e60b5da28647bfcc864b0bb1b9a90504cdb1.patch";
+      sha256 = "sha256-/h6kosulRH/ZAU2u0zRSaNDK39jsnFt9TaSxyBllZqM=";
+    })
+    # install headers
+    (fetchpatch {
+      url = "https://github.com/facebookincubator/fbjni/commit/74e125caa9a815244f1e6bd08eaba57d015378b4.patch";
+      sha256 = "sha256-hQS35D69GD3ewV4zzPG+LO7jk7ncCj2CYDbLJ6SnpqE=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    jdk_headless
+  ];
+
+  buildInputs = [
+    gtest
+  ];
+
+  cmakeFlags = [
+    "-DJAVA_HOME=${jdk_headless.passthru.home}"
+  ];
+
+  meta = with lib; {
+    description = "A library designed to simplify the usage of the Java Native Interface";
+    homepage = "https://github.com/facebookincubator/fbjni";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}

pkgs/development/libraries/inih/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "inih";
-  version = "56";
+  version = "57";
 
   src = fetchFromGitHub {
     owner = "benhoyt";
     repo = pname;
     rev = "r${version}";
-    sha256 = "sha256-7k3i3pElihastUDrdf9DyRZMe2UNFckfLUFGb4rbWLo=";
+    hash = "sha256-a4nvhJSmZGqu2sdZSPNPjdnkzZ9dSKocL/XG2aDyFw4=";
   };
 
   nativeBuildInputs = [ meson ninja ];

pkgs/development/libraries/libpeas/default.nix

@@ -64,6 +64,7 @@ stdenv.mkDerivation rec {
     updateScript = gnome.updateScript {
       packageName = pname;
       versionPolicy = "odd-unstable";
+      freeze = true;
     };
   };
 

pkgs/development/libraries/libsigcxx/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
       packageName = pname;
       attrPath = "libsigcxx";
       versionPolicy = "odd-unstable";
-      freeze = true;
+      freeze = "2.99.1";
     };
   };
 

pkgs/development/libraries/libsmi/default.nix

@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1lslaxr2qcj6hf4naq5n5mparfhmswsgq4wa7zm2icqvvgdcq6pj";
   };
 
+  env.NIX_CFLAGS_COMPILE = "-std=gnu90";
+
   meta = with lib; {
     description = "A Library to Access SMI MIB Information";
     homepage = "https://www.ibr.cs.tu-bs.de/projects/libsmi/index.html";

pkgs/development/libraries/orcania/default.nix

@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake, check, subunit }:
 stdenv.mkDerivation rec {
   pname = "orcania";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "babelouest";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xF6QIXfsI+6WqshcG74/J98MgjSkYjRkTW64zeH6DDY=";
+    sha256 = "sha256-Cz3IE5UrfoWjMxQ/+iR1bLsYxf5DVN+7aJqLBcPjduA=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/pango/default.nix

@@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
       packageName = pname;
       versionPolicy = "odd-unstable";
       # 1.90 is alpha for API 2.
-      freeze = true;
+      freeze = "1.90.0";
     };
   };
 

pkgs/development/libraries/science/math/amd-libflame/add-lapacke.diff

@@ -1,34 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 5549ce30..ac2ee51e 100644
---- a/Makefile
-+++ b/Makefile
-@@ -583,14 +583,14 @@ endif
- 
- # --- Shared library linker rules ---
- 
--$(LIBFLAME_SO_PATH): $(MK_ALL_FLAMEC_OBJS)
-+$(LIBFLAME_SO_PATH): $(MK_ALL_FLAMEC_OBJS) $(LAPACKE_A_PATH)
- ifeq ($(ENABLE_VERBOSE),yes)
- ifeq ($(FLA_ENABLE_MAX_ARG_LIST_HACK),yes)
- 	$(CAT) $(AR_OBJ_LIST_FILE) | xargs -n$(AR_CHUNK_SIZE) $(AR) $(ARFLAGS) $(LIBFLAME_A)
- ifeq ($(OS_NAME),Darwin)
--	$(LINKER) $(SOFLAGS) -o $@ -Wl,-force_load,$(LIBFLAME_A) $(LDFLAGS)
-+	$(LINKER) $(SOFLAGS) -o $@ -Wl,-force_load,$(LIBFLAME_A),$(LAPACKE_A_PATH) $(LDFLAGS)
- else
--	$(LINKER) $(SOFLAGS) -o $@ -Wl,--whole-archive,$(LIBFLAME_A),--no-whole-archive $(LDFLAGS)
-+	$(LINKER) $(SOFLAGS) -o $@ -Wl,--whole-archive,$(LIBFLAME_A),$(LAPACKE_A_PATH)--no-whole-archive $(LDFLAGS)
- endif
- else
- #	NOTE: Can't use $^ automatic variable as long as $(AR_OBJ_LIST_FILE) is in
-@@ -602,9 +602,9 @@ else
- ifeq ($(FLA_ENABLE_MAX_ARG_LIST_HACK),yes)
- 	@$(CAT) $(AR_OBJ_LIST_FILE) | xargs -n$(AR_CHUNK_SIZE) $(AR) $(ARFLAGS) $(LIBFLAME_A)
- ifeq ($(OS_NAME),Darwin)
--	@$(LINKER) $(SOFLAGS) -o $@ -Wl,-force_load,$(LIBFLAME_A) $(LDFLAGS)
-+	@$(LINKER) $(SOFLAGS) -o $@ -Wl,-force_load,$(LIBFLAME_A),$(LAPACKE_A_PATH) $(LDFLAGS)
- else
--	@$(LINKER) $(SOFLAGS) -o $@ -Wl,--whole-archive,$(LIBFLAME_A),--no-whole-archive $(LDFLAGS)
-+	@$(LINKER) $(SOFLAGS) -o $@ -Wl,--whole-archive,$(LIBFLAME_A),$(LAPACKE_A_PATH),--no-whole-archive $(LDFLAGS)
- endif
- else
- #	NOTE: Can't use $^ automatic variable as long as $(AR_OBJ_LIST_FILE) is in

pkgs/development/libraries/science/math/amd-libflame/default.nix

@@ -1,78 +1,62 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, cmake
 , gfortran
 , python3
 , amd-blis
+, aocl-utils
 
 , withOpenMP ? true
 , blas64 ? false
+, withAMDOpt ? false
 }:
 
-# right now only LP64 is supported
-assert !blas64;
-
 stdenv.mkDerivation rec {
   pname = "amd-libflame";
-  version = "3.0";
+  version = "4.1";
 
   src = fetchFromGitHub {
     owner = "amd";
     repo = "libflame";
     rev = version;
-    hash = "sha256-jESae5NqANw90RBbIHH2oGEq5/mudc4IONv50P/AeQ0=";
+    hash = "sha256-SZk11oOAnvn1vb7ucX6U9b0YtAJNxl3tQu4ExHpwwoo=";
   };
 
-  patches = [
-    # The LAPACKE interface is compiled as a separate static library,
-    # we want the main dynamic library to provide LAPACKE symbols.
-    # This patch adds lapacke.a to the shared library as well.
-    ./add-lapacke.diff
-  ];
-
-  passthru = { inherit blas64; };
-
-  nativeBuildInputs = [ gfortran python3 ];
-
-  buildInputs = [ amd-blis ];
-
-  configureFlags = [
-    # Build a dynamic library with a LAPACK interface.
-    "--disable-static-build"
-    "--enable-dynamic-build"
-    "--enable-lapack2flame"
-
-    # Use C BLAS interface.
-    "--enable-cblas-interfaces"
-
-    # Avoid overloading maximum number of arguments.
-    "--enable-max-arg-list-hack"
-
-    # libflame by default leaves BLAS symbols unresolved and leaves it
-    # up to the application to explicitly link to a BLAS. This is
-    # problematic for us, since then the BLAS library becomes an
-    # implicit dependency. Moreover, since the point of the AMD forks
-    # is to optimized for recent AMD CPUs, link against AMD BLIS.
-    "LDFLAGS=-lcblas"
-  ]
-  ++ lib.optionals withOpenMP [ "--enable-multithreading=openmp" ];
-
-  enableParallelBuilding = true;
-
   postPatch = ''
     patchShebangs build
+
+    # Enforce reproducible build compiler flags
+    substituteInPlace CMakeLists.txt --replace '-mtune=native' ""
   '';
 
+  passthru = { inherit blas64; };
+
+  nativeBuildInputs = [ cmake gfortran python3 ];
+
+  buildInputs = [ amd-blis aocl-utils ];
+
+  cmakeFlags = [
+    "-DLIBAOCLUTILS_LIBRARY_PATH=${lib.getLib aocl-utils}/lib"
+    "-DLIBAOCLUTILS_INCLUDE_PATH=${lib.getDev aocl-utils}/include"
+    "-DENABLE_BUILTIN_LAPACK2FLAME=ON"
+    "-DENABLE_CBLAS_INTERFACES=ON"
+    "-DENABLE_EXT_LAPACK_INTERFACE=ON"
+  ]
+  ++ lib.optional (!withOpenMP) "ENABLE_MULTITHREADING=OFF"
+  ++ lib.optional blas64 "ENABLE_ILP64=ON"
+  ++ lib.optional withAMDOpt "ENABLE_AMD_OPT=ON";
+
   postInstall = ''
-    ln -s $out/lib/libflame.so.${version} $out/lib/liblapack.so.3
-    ln -s $out/lib/libflame.so.${version} $out/lib/liblapacke.so.3
+    ln -s $out/lib/libflame.so $out/lib/liblapack.so.3
+    ln -s $out/lib/libflame.so $out/lib/liblapacke.so.3
   '';
 
   meta = with lib; {
     description = "LAPACK-compatible linear algebra library optimized for AMD CPUs";
     homepage = "https://developer.amd.com/amd-aocl/blas-library/";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
+    maintainers = [ maintainers.markuskowa ];
     platforms = [ "x86_64-linux" ];
   };
 }

pkgs/development/libraries/webkitgtk/default.nix

@@ -27,6 +27,7 @@
 , libxkbcommon
 , libavif
 , libepoxy
+, libjxl
 , at-spi2-core
 , libxml2
 , libsoup
@@ -34,7 +35,6 @@
 , libxslt
 , harfbuzz
 , libpthreadstubs
-, pcre
 , nettle
 , libtasn1
 , p11-kit
@@ -51,7 +51,6 @@
 , openjpeg
 , geoclue2
 , sqlite
-, enableGLES ? true
 , gst-plugins-base
 , gst-plugins-bad
 , woff2
@@ -71,7 +70,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "webkitgtk";
-  version = "2.40.5";
+  version = "2.42.1";
   name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "6.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";
 
   outputs = [ "out" "dev" "devdoc" ];
@@ -82,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-feBRomNmhiHZGmGl6xw3cdGnzskABD1K/vBsMmwWA38=";
+    hash = "sha256-b0H6yZidPuUcCMSN4dQ5ze3ey8dX40thgJh9mbFtJJk=";
   };
 
   patches = lib.optionals stdenv.isLinux [
@@ -132,6 +131,7 @@ stdenv.mkDerivation (finalAttrs: {
     enchant2
     libavif
     libepoxy
+    libjxl
     gnutls
     gst-plugins-bad
     gst-plugins-base
@@ -153,7 +153,6 @@ stdenv.mkDerivation (finalAttrs: {
     nettle
     openjpeg
     p11-kit
-    pcre
     sqlite
     woff2
   ] ++ (with xorg; [
@@ -219,8 +218,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-DUSE_GTK4=ON"
   ] ++ lib.optionals (!systemdSupport) [
     "-DENABLE_JOURNALD_LOG=OFF"
-  ] ++ lib.optionals (stdenv.isLinux && enableGLES) [
-    "-DENABLE_GLES2=ON"
   ];
 
   postPatch = ''

pkgs/development/libraries/webkitgtk/fdo-backend-path.patch

@@ -3,7 +3,7 @@
 @@ -84,7 +84,7 @@ void WebProcessPool::platformInitializeWebProcess(const WebProcessProxy& process
  
  #if PLATFORM(WAYLAND)
-     if (WebCore::PlatformDisplay::sharedDisplay().type() == WebCore::PlatformDisplay::Type::Wayland) {
+     if (WebCore::PlatformDisplay::sharedDisplay().type() == WebCore::PlatformDisplay::Type::Wayland && parameters.dmaBufRendererBufferMode.isEmpty()) {
 -        wpe_loader_init("libWPEBackend-fdo-1.0.so.1");
 +        wpe_loader_init("@wpebackend_fdo@/lib/libWPEBackend-fdo-1.0.so.1");
          if (AcceleratedBackingStoreWayland::checkRequirements()) {

pkgs/development/ocaml-modules/containers/data.nix

@@ -1,4 +1,5 @@
 { buildDunePackage, containers
+, ocaml
 , dune-configurator
 , gen, iter, qcheck-core
 , mdx
@@ -7,7 +8,9 @@
 buildDunePackage {
   pname = "containers-data";
 
-  inherit (containers) src version doCheck;
+  inherit (containers) src version;
+
+  doCheck = containers.doCheck && ocaml.meta.branch != "5.0";
 
   buildInputs = [ dune-configurator ];
   nativeCheckInputs = [ mdx.bin ];

pkgs/development/ocaml-modules/kafka/default.nix

@@ -5,8 +5,6 @@ buildDunePackage rec {
   pname = "kafka";
   version = "0.5";
 
-  useDune2 = true;
-
   src = fetchurl {
     url = "https://github.com/didier-wenzek/ocaml-kafka/releases/download/${version}/kafka-${version}.tbz";
     sha256 = "0m9212yap0a00hd0f61i4y4fna3141p77qj3mm7jl1h4q60jdhvy";

pkgs/development/ocaml-modules/kafka/lwt.nix

@@ -1,13 +1,18 @@
 { buildDunePackage
+, ocaml
+, lib
 , kafka
 , lwt
 , cmdliner
 }:
 
+lib.throwIf (lib.versionAtLeast ocaml.version "5.0")
+  "kafka_lwt is not available for OCaml ${ocaml.version}"
+
 buildDunePackage rec {
   pname = "kafka_lwt";
 
-  inherit (kafka) version useDune2 src;
+  inherit (kafka) version src;
 
   buildInputs = [ cmdliner ];
 

pkgs/development/ocaml-modules/lwt/default.nix

@@ -4,7 +4,7 @@
 
 buildDunePackage rec {
   pname = "lwt";
-  version = "5.6.1";
+  version = "5.7.0";
 
   minimalOCamlVersion = "4.08";
 
@@ -12,16 +12,9 @@ buildDunePackage rec {
     owner = "ocsigen";
     repo = "lwt";
     rev = version;
-    sha256 = "sha256-XstKs0tMwliCyXnP0Vzi5WC27HKJGnATUYtbbQmH1TE=";
+    hash = "sha256-o0wPK6dPdnsr/LzwcSwbIGcL85wkDjdFuEcAxuS/UEs=";
   };
 
-  postPatch = lib.optionalString (lib.versionAtLeast ocaml.version "5.0") ''
-    substituteInPlace src/core/dune \
-      --replace "(libraries bytes)" ""
-    substituteInPlace src/unix/dune \
-      --replace "libraries bigarray lwt" "libraries lwt"
-  '';
-
   nativeBuildInputs = [ cppo ];
   buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [ libev ocplib-endian ];

pkgs/development/php-packages/composer/default.nix

@@ -1,19 +1,25 @@
-{ lib, callPackage, fetchgit, php, unzip, _7zz, xz, git, curl, cacert, makeBinaryWrapper }:
+{ lib, callPackage, fetchFromGitHub, php, unzip, _7zz, xz, git, curl, cacert, makeBinaryWrapper }:
 
 php.buildComposerProject (finalAttrs: {
-  composer = callPackage ../../../build-support/php/pkgs/composer-phar.nix { };
+  # Hash used by ../../../build-support/php/pkgs/composer-phar.nix to
+  # use together with the version from this package to keep the
+  # bootstrap phar file up-to-date together with the end user composer
+  # package.
+  passthru.pharHash = "sha256-mhjho6rby5TBuv1sSpj/kx9LQ6RW70hXUTBGbhnwXdY=";
+
+  composer = callPackage ../../../build-support/php/pkgs/composer-phar.nix {
+    inherit (finalAttrs) version;
+    inherit (finalAttrs.passthru) pharHash;
+  };
 
   pname = "composer";
-  version = "2.6.4";
+  version = "2.6.5";
 
-
-  # We use `fetchgit` instead of `fetchFromGitHub` to ensure the existence
-  # of the `composer.lock` file, which is omitted in the archive downloaded
-  # via `fetchFromGitHub`.
-  src = fetchgit {
-    url = "https://github.com/composer/composer.git";
+  src = fetchFromGitHub {
+    owner = "composer";
+    repo = "composer";
     rev = finalAttrs.version;
-    hash = "sha256-8lylMfTARff+gBZpIRqttmE0jeXdJnLHZKVmqHY3p+s=";
+    hash = "sha256-CKP7CYOuMKpuWdVveET2iLJPKJyCnv5YVjx4DE68UoE=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];

pkgs/development/python-modules/alexapy/default.nix

@@ -19,8 +19,8 @@
 
 buildPythonPackage rec {
   pname = "alexapy";
-  version = "1.27.1";
-  format = "pyproject";
+  version = "1.27.4";
+  pyproject = true;
 
   disabled = pythonOlder "3.10";
 
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "keatontaylor";
     repo = "alexapy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-pMTVZ2iE/a1yNsWhmxkIQFkl18x06ZLjslj8hjKVBEA=";
+    hash = "sha256-Z7h6VX4cwcepo0Kxq9GdHv+XFNg/0s/OhJ/iHubhovs=";
   };
 
   pythonRelaxDeps = [
@@ -64,7 +64,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python Package for controlling Alexa devices (echo dot, etc) programmatically";
     homepage = "https://gitlab.com/keatontaylor/alexapy";
-    changelog = "https://gitlab.com/keatontaylor/alexapy/-/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://gitlab.com/keatontaylor/alexapy/-/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/altgraph/default.nix

@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "altgraph";
-  version = "0.17.3";
+  version = "0.17.4";
 
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ad33358114df7c9416cdb8fa1eaa5852166c505118717021c6a8c7c7abbd03dd";
+    sha256 = "sha256-G1r7uY9sTcrbLirmq5+plLu4wddfT6ltNA+UN65FRAY=";
   };
 
   pythonImportsCheck = [ "altgraph" ];

pkgs/development/python-modules/astropy/default.nix

@@ -26,25 +26,15 @@
 
 buildPythonPackage rec {
   pname = "astropy";
-  version = "5.3.3";
+  version = "5.3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8"; # according to setup.cfg
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AzDfn116IlQ2fpuM9EJVuhBwsGEjGIxqcu3BgEk/k7s=";
+    hash = "sha256-1JD34vqsLMwBySRCAtYpFUJZr4qXkQTO2J3ErOTm8dg=";
   };
-  patches = [
-    # Fixes running tests in parallel issue
-    # https://github.com/astropy/astropy/issues/15316. Fix from
-    # https://github.com/astropy/astropy/pull/15327
-    (fetchpatch {
-      url = "https://github.com/astropy/astropy/commit/1042c0fb06a992f683bdc1eea2beda0b846ed356.patch";
-      hash = "sha256-bApAcGBRrJ94thhByoYvdqw2e6v77+FmTfgmGcE6MMk=";
-    })
-  ];
-
   # Relax cython dependency to allow this to build, upstream only doesn't
   # support cython 3 as of writing. See:
   # https://github.com/astropy/astropy/issues/15315
@@ -85,6 +75,11 @@ buildPythonPackage rec {
   pythonImportsCheck = [
     "astropy"
   ];
+  disabledTests = [
+    # May fail due to parallelism, see:
+    # https://github.com/astropy/astropy/issues/15441
+    "TestUnifiedOutputRegistry"
+  ];
 
   meta = {
     description = "Astronomy/Astrophysics library for Python";

pkgs/development/python-modules/azure-storage-blob/default.nix

@@ -1,36 +1,29 @@
 { lib
-, azure-common
 , azure-core
-, azure-storage-common
 , buildPythonPackage
 , cryptography
 , fetchPypi
 , isodate
-, msrest
 , pythonOlder
 , typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "azure-storage-blob";
-  version = "12.17.0";
+  version = "12.18.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    extension = "zip";
-    hash = "sha256-wUt4WhcFCzD8MmoxW9rmvEoHiFX0+UpMMDrXSkjcjGM=";
+    hash = "sha256-4Rk1NImB/8AFuEi1XbJcBPLR+Q4e4zAAZZkGt2PPFMg=";
   };
 
   propagatedBuildInputs = [
-    azure-common
     azure-core
-    azure-storage-common
     cryptography
     isodate
-    msrest
     typing-extensions
   ];
 

pkgs/development/python-modules/beancount/default.nix

@@ -17,14 +17,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.3.5";
+  version = "2.3.6";
   pname = "beancount";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FONWJaLpy9Q8rmF42gjLPxIk9iYeVBymcm3zXZjpw2o=";
+    hash = "sha256-gB+Tvta1fS4iQ2aIxInVob8fduIQ887RhoB1fmDTR1o=";
   };
 
   # Tests require files not included in the PyPI archive.

pkgs/development/python-modules/camel-converter/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "camel-converter";
-  version = "3.0.2";
+  version = "3.0.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "sanders41";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-XKtWR9dmSMfqkJYUHDQtWBLG3CHrbrI5lNtPUTShmBE=";
+    hash = "sha256-0sNb1zg8cnDjQQnStfe1k8uB1GpmNtd/VwqSqTcLmj0=";
   };
 
   postPatch = ''

pkgs/development/python-modules/casbin/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "casbin";
-  version = "1.31.0";
+  version = "1.31.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "pycasbin";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hWKO64cx8lcErGWMPY2pDtvuO6xF1Ve+bLWhHnYL/ng=";
+    hash = "sha256-Asz91KG/sDlRTwgn7bP0Pa4yiXKt7Hgc1hzEKD8TfHM=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/chiabip158/default.nix

@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "chiabip158";
-  version = "1.2";
+  version = "1.3";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-t0Fnsh9B83KiT5dFVVfHs7sm9HyNbMsp6goj3esoph8=";
+    hash = "sha256-HUgYVVQ7yc2X3ffnV7mCZf+oFUHl/29Mb4n91dRJ7gc=";
   };
 
   nativeBuildInputs = [ cmake setuptools-scm ];

pkgs/development/python-modules/clustershell/default.nix

@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "ClusterShell";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bwqzyhQbUI2gPOGb1S8eXo0pdz/DBi1782RQqCIH7Bs=";
+    hash = "sha256-rsF/HG4GNBC+N49b+sDO2AyUI1G44wJNBUwQNPzShD0=";
   };
 
   postPatch = ''

pkgs/development/python-modules/django-reversion/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "django-reversion";
-  version = "5.0.5";
+  version = "5.0.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
 src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JTxpGwpOC+He7Atiw4yfu3W25aj9gdO1iib0YTWXAQY=";
+    hash = "sha256-buJalwcN2hTz4IK4uZm/vstKnwgv8fhR40TQVqGMk0w=";
   };
 
   propagatedBuildInputs = [
@@ -31,6 +31,7 @@ src = fetchPypi {
   meta = with lib; {
     description = "An extension to the Django web framework that provides comprehensive version control facilities";
     homepage = "https://github.com/etianen/django-reversion";
+    changelog = "https://github.com/etianen/django-reversion/blob/v${version}/CHANGELOG.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
   };

pkgs/development/python-modules/esig/default.nix

@@ -0,0 +1,60 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, cmake
+, ninja
+, oldest-supported-numpy
+, scikit-build
+, setuptools
+, numpy
+, iisignature
+, boost
+}:
+
+buildPythonPackage rec {
+  pname = "esig";
+  version = "0.9.8.3";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-BGZaJSrpNSwZMHBYFDmDVPZOtgam/EVyh5Y5FAB8e1o=";
+  };
+
+  buildInputs = [
+    boost
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    oldest-supported-numpy
+    scikit-build
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  passthru.optional-dependencies = {
+    iisignature = [
+      iisignature
+    ];
+  };
+
+  # PyPI tarball has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "esig" ];
+
+  meta = with lib; {
+    description = "This package provides \"rough path\" tools for analysing vector time series";
+    homepage = "https://github.com/datasig-ac-uk/esig";
+    changelog = "https://github.com/datasig-ac-uk/esig/blob/release/CHANGELOG";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ mbalatsko ];
+  };
+}

pkgs/development/python-modules/garth/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "garth";
-  version = "0.4.37";
+  version = "0.4.38";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7mq661cW67EvvJ1s2W5Ybw+oiDz9vdmmt/ljt/llIoo=";
+    hash = "sha256-c+wSXADcgl7DpJJxGUus3oA4v+DmjGwjKfp0tJbcxb8=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/gitignore-parser/default.nix

@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "gitignore-parser";
-  version = "0.1.8";
+  version = "0.1.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "mherrmann";
     repo = "gitignore_parser";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FgP1moyfxgPmPOWpSp6+UXZOzL5HDofg3ECh53x4iaE=";
+    hash = "sha256-T1XgcOHVFv/+oCEFKSoJeFAspJguimHasuREzjQwgWE=";
   };
 
   nativeCheckInputs = [

pkgs/development/python-modules/google-cloud-container/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.31.0";
+  version = "2.32.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PGrG29a5tq41hn8zzJWdAy4Dju1O5ZPYhZ+CcsBraAY=";
+    hash = "sha256-aU+42neWNlPhxw+mCSi0oR+vjh8VgKOQJQU6PhvM5t4=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/google-cloud-datacatalog/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-datacatalog";
-  version = "3.15.2";
+  version = "3.16.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GaGxn7Q5blqPWNWIl6pRV9lLzmGm5GGwqcyOuAWI0Ds=";
+    hash = "sha256-cD5BQ5Ykj6mEdLurnqli9MlqPK8RhMkDv8lFPSdLDqI=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/hap-python/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "hap-python";
-  version = "4.7.1";
+  version = "4.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "ikalchev";
     repo = "HAP-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-M/STfco+Bx+KxBT1lUIrYyGSjBcPw2UVX02gNOROke4=";
+    hash = "sha256-1NLLNE4LgV0r45nc21xCAAaKuH6bQm2YQWlxzhgajSI=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/iisignature/default.nix

@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, wheel
+, numpy
+}:
+
+buildPythonPackage rec {
+  pname = "iisignature";
+  version = "0.24";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-C5MUxui4BIf68yMZH7NZhq1CJuhrDGfPCjspObaVucY=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  # PyPI tarball has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "iisignature" ];
+
+  meta = with lib; {
+    description = "Iterated integral signature calculations";
+    homepage = "https://pypi.org/project/iisignature";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mbalatsko ];
+  };
+}

pkgs/development/python-modules/junos-eznc/default.nix

@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "junos-eznc";
-  version = "2.6.7";
+  version = "2.6.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "Juniper";
     repo = "py-junos-eznc";
     rev = "refs/tags/${version}";
-    hash = "sha256-+hGybznip5RpJm89MLg9JO4B/y50OIdgtmV2FIpZShU=";
+    hash = "sha256-5xZjuU2U3BodAMQiWZIJ27AZiAwoMm4yJ4qr3DjMd9o=";
   };
 
   postPatch = ''