Merge master into haskell-updates

.github/CODEOWNERS

@@ -322,9 +322,8 @@ pkgs/applications/version-management/forgejo @bendlas @emilylange
 /pkgs/development/ocaml-modules     @ulrikstrid
 
 # ZFS
-pkgs/os-specific/linux/zfs                @raitobezarius
-nixos/lib/make-single-disk-zfs-image.nix  @raitobezarius
-nixos/lib/make-multi-disk-zfs-image.nix   @raitobezarius
+pkgs/os-specific/linux/zfs/2_1.nix        @raitobezarius
+pkgs/os-specific/linux/zfs/generic.nix    @raitobezarius
 nixos/modules/tasks/filesystems/zfs.nix   @raitobezarius
 nixos/tests/zfs.nix                       @raitobezarius
 

lib/systems/default.nix

@@ -45,7 +45,7 @@ rec {
            else args';
 
     # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
-    rust = assert !(args ? rust && args ? rustc); args.rust or args.rustc or {};
+    rust = args.rust or args.rustc or {};
 
     final = {
       # Prefer to parse `config` as it is strictly more informative.
@@ -169,96 +169,6 @@ rec {
       # TODO: remove after 23.05 is EOL, with an error pointing to the rust.* attrs.
       rustc = args.rustc or {};
 
-      rust = rust // {
-        # Once args.rustc.platform.target-family is deprecated and
-        # removed, there will no longer be any need to modify any
-        # values from args.rust.platform, so we can drop all the
-        # "args ? rust" etc. checks, and merge args.rust.platform in
-        # /after/.
-        platform = rust.platform or {} // {
-          # https://doc.rust-lang.org/reference/conditional-compilation.html#target_arch
-          arch =
-            /**/ if rust ? platform then rust.platform.arch
-            else if final.isAarch32 then "arm"
-            else if final.isMips64  then "mips64"     # never add "el" suffix
-            else if final.isPower64 then "powerpc64"  # never add "le" suffix
-            else final.parsed.cpu.name;
-
-          # https://doc.rust-lang.org/reference/conditional-compilation.html#target_os
-          os =
-            /**/ if rust ? platform then rust.platform.os or "none"
-            else if final.isDarwin then "macos"
-            else final.parsed.kernel.name;
-
-          # https://doc.rust-lang.org/reference/conditional-compilation.html#target_family
-          target-family =
-            /**/ if args ? rust.platform.target-family then args.rust.platform.target-family
-            else if args ? rustc.platform.target-family
-            then
-              (
-                # Since https://github.com/rust-lang/rust/pull/84072
-                # `target-family` is a list instead of single value.
-                let
-                  f = args.rustc.platform.target-family;
-                in
-                  if builtins.isList f then f else [ f ]
-              )
-            else lib.optional final.isUnix "unix"
-                 ++ lib.optional final.isWindows "windows";
-
-          # https://doc.rust-lang.org/reference/conditional-compilation.html#target_vendor
-          vendor = let
-            inherit (final.parsed) vendor;
-          in rust.platform.vendor or {
-            "w64" = "pc";
-          }.${vendor.name} or vendor.name;
-        };
-
-        # The name of the rust target, even if it is custom. Adjustments are
-        # because rust has slightly different naming conventions than we do.
-        rustcTarget = let
-          inherit (final.parsed) cpu kernel abi;
-          cpu_ = rust.platform.arch or {
-            "armv7a" = "armv7";
-            "armv7l" = "armv7";
-            "armv6l" = "arm";
-            "armv5tel" = "armv5te";
-            "riscv64" = "riscv64gc";
-          }.${cpu.name} or cpu.name;
-          vendor_ = final.rust.platform.vendor;
-        in rust.config
-          or "${cpu_}-${vendor_}-${kernel.name}${lib.optionalString (abi.name != "unknown") "-${abi.name}"}";
-
-        # The name of the rust target if it is standard, or the json file
-        # containing the custom target spec.
-        rustcTargetSpec =
-          /**/ if rust ? platform
-          then builtins.toFile (final.rust.rustcTarget + ".json") (builtins.toJSON rust.platform)
-          else final.rust.rustcTarget;
-
-        # The name of the rust target if it is standard, or the
-        # basename of the file containing the custom target spec,
-        # without the .json extension.
-        #
-        # This is the name used by Cargo for target subdirectories.
-        cargoShortTarget =
-          lib.removeSuffix ".json" (baseNameOf "${final.rust.rustcTargetSpec}");
-
-        # When used as part of an environment variable name, triples are
-        # uppercased and have all hyphens replaced by underscores:
-        #
-        # https://github.com/rust-lang/cargo/pull/9169
-        # https://github.com/rust-lang/cargo/issues/8285#issuecomment-634202431
-        cargoEnvVarTarget =
-          lib.strings.replaceStrings ["-"] ["_"]
-            (lib.strings.toUpper final.rust.cargoShortTarget);
-
-        # True if the target is no_std
-        # https://github.com/rust-lang/rust/blob/2e44c17c12cec45b6a682b1e53a04ac5b5fcc9d2/src/bootstrap/config.rs#L415-L421
-        isNoStdTarget =
-          builtins.any (t: lib.hasInfix t final.rust.rustcTarget) ["-none" "nvptx" "switch" "-uefi"];
-      };
-
       linuxArch =
         if final.isAarch32 then "arm"
         else if final.isAarch64 then "arm64"
@@ -356,7 +266,97 @@ rec {
 
     }) // mapAttrs (n: v: v final.parsed) inspect.predicates
       // mapAttrs (n: v: v final.gcc.arch or "default") architectures.predicates
-      // args;
+      // args // {
+        rust = rust // {
+          # Once args.rustc.platform.target-family is deprecated and
+          # removed, there will no longer be any need to modify any
+          # values from args.rust.platform, so we can drop all the
+          # "args ? rust" etc. checks, and merge args.rust.platform in
+          # /after/.
+          platform = rust.platform or {} // {
+            # https://doc.rust-lang.org/reference/conditional-compilation.html#target_arch
+            arch =
+              /**/ if rust ? platform then rust.platform.arch
+              else if final.isAarch32 then "arm"
+              else if final.isMips64  then "mips64"     # never add "el" suffix
+              else if final.isPower64 then "powerpc64"  # never add "le" suffix
+              else final.parsed.cpu.name;
+
+            # https://doc.rust-lang.org/reference/conditional-compilation.html#target_os
+            os =
+              /**/ if rust ? platform then rust.platform.os or "none"
+              else if final.isDarwin then "macos"
+              else final.parsed.kernel.name;
+
+            # https://doc.rust-lang.org/reference/conditional-compilation.html#target_family
+            target-family =
+              /**/ if args ? rust.platform.target-family then args.rust.platform.target-family
+              else if args ? rustc.platform.target-family
+              then
+                (
+                  # Since https://github.com/rust-lang/rust/pull/84072
+                  # `target-family` is a list instead of single value.
+                  let
+                    f = args.rustc.platform.target-family;
+                  in
+                    if builtins.isList f then f else [ f ]
+                )
+              else lib.optional final.isUnix "unix"
+                   ++ lib.optional final.isWindows "windows";
+
+            # https://doc.rust-lang.org/reference/conditional-compilation.html#target_vendor
+            vendor = let
+              inherit (final.parsed) vendor;
+            in rust.platform.vendor or {
+              "w64" = "pc";
+            }.${vendor.name} or vendor.name;
+          };
+
+          # The name of the rust target, even if it is custom. Adjustments are
+          # because rust has slightly different naming conventions than we do.
+          rustcTarget = let
+            inherit (final.parsed) cpu kernel abi;
+            cpu_ = rust.platform.arch or {
+              "armv7a" = "armv7";
+              "armv7l" = "armv7";
+              "armv6l" = "arm";
+              "armv5tel" = "armv5te";
+              "riscv64" = "riscv64gc";
+            }.${cpu.name} or cpu.name;
+            vendor_ = final.rust.platform.vendor;
+          in rust.config
+            or "${cpu_}-${vendor_}-${kernel.name}${lib.optionalString (abi.name != "unknown") "-${abi.name}"}";
+
+          # The name of the rust target if it is standard, or the json file
+          # containing the custom target spec.
+          rustcTargetSpec = rust.rustcTargetSpec or (
+            /**/ if rust ? platform
+            then builtins.toFile (final.rust.rustcTarget + ".json") (builtins.toJSON rust.platform)
+            else final.rust.rustcTarget);
+
+          # The name of the rust target if it is standard, or the
+          # basename of the file containing the custom target spec,
+          # without the .json extension.
+          #
+          # This is the name used by Cargo for target subdirectories.
+          cargoShortTarget =
+            lib.removeSuffix ".json" (baseNameOf "${final.rust.rustcTargetSpec}");
+
+          # When used as part of an environment variable name, triples are
+          # uppercased and have all hyphens replaced by underscores:
+          #
+          # https://github.com/rust-lang/cargo/pull/9169
+          # https://github.com/rust-lang/cargo/issues/8285#issuecomment-634202431
+          cargoEnvVarTarget =
+            lib.strings.replaceStrings ["-"] ["_"]
+              (lib.strings.toUpper final.rust.cargoShortTarget);
+
+          # True if the target is no_std
+          # https://github.com/rust-lang/rust/blob/2e44c17c12cec45b6a682b1e53a04ac5b5fcc9d2/src/bootstrap/config.rs#L415-L421
+          isNoStdTarget =
+            builtins.any (t: lib.hasInfix t final.rust.rustcTarget) ["-none" "nvptx" "switch" "-uefi"];
+        };
+      };
   in assert final.useAndroidPrebuilt -> final.isAndroid;
      assert lib.foldl
        (pass: { assertion, message }:

maintainers/maintainer-list.nix

@@ -4976,6 +4976,12 @@
     githubId = 424946;
     name = "James Earl Douglas";
   };
+  EBADBEEF = {
+    name = "EBADBEEF";
+    email = "errno@ebadf.com";
+    github = "EBADBEEF";
+    githubId = 4167946;
+  };
   ebbertd = {
     email = "daniel@ebbert.nrw";
     github = "ebbertd";
@@ -15489,6 +15495,12 @@
     githubId = 69053978;
     name = "rogarb";
   };
+  rollf = {
+    email = "rolf.schroeder@limbus-medtec.com";
+    github = "rollf";
+    githubId = 58295931;
+    name = "Rolf Schröder";
+  };
   roman = {
     email = "open-source@roman-gonzalez.info";
     github = "roman";
@@ -18776,6 +18788,12 @@
     githubId = 223408;
     name = "Varun Madiath";
   };
+  vancluever = {
+    email = "chrism@vancluevertech.com";
+    github = "vancluever";
+    githubId = 10704423;
+    name = "Chris Marchesi";
+  };
   vandenoever = {
     email = "jos@vandenoever.info";
     github = "vandenoever";

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -184,6 +184,8 @@
 
 - `services.knot` now supports `.settings` from RFC42.  The previous `.extraConfig` still works the same, but it displays a warning now.
 
+- `services.invoiceplane` now supports .settings from RFC42. The previous .extraConfig still works the same, but it displays a warning now.
+
 - `mu` now does not install `mu4e` files by default.  Users should get `mu4e` from Emacs lisp package set `emacs.pkgs.mu4e`.
 
 - `mariadb` now defaults to `mariadb_1011` instead of `mariadb_106`, meaning the default version was upgraded from 10.6.x to 10.11.x. See the [upgrade notes](https://mariadb.com/kb/en/upgrading-from-mariadb-10-6-to-mariadb-10-11/) for potential issues.
@@ -331,6 +333,8 @@
 
 - The `woodpecker-*` CI packages have been updated to 1.0.0. This release is wildly incompatible with the 0.15.X versions that were previously packaged. Please read [upstream's documentation](https://woodpecker-ci.org/docs/next/migrations#100) to learn how to update your CI configurations.
 
+- Meilisearch was updated from 1.3.1 to 1.5.0. The update has breaking changes about backslashes and filtering. See the [release announcement](https://blog.meilisearch.com/v1-4-release/) for more information.
+
 - The Caddy module gained a new option named `services.caddy.enableReload` which is enabled by default. It allows reloading the service instead of restarting it, if only a config file has changed. This option must be disabled if you have turned off the [Caddy admin API](https://caddyserver.com/docs/caddyfile/options#admin). If you keep this option enabled, you should consider setting [`grace_period`](https://caddyserver.com/docs/caddyfile/options#grace-period) to a non-infinite value to prevent Caddy from delaying the reload indefinitely.
 
 - mdraid support is now optional. This reduces initramfs size and prevents the potentially undesired automatic detection and activation of software RAID pools. It is disabled by default in new configurations (determined by `stateVersion`), but the appropriate settings will be generated by `nixos-generate-config` when installing to a software RAID device, so the standard installation procedure should be unaffected. If you have custom configs relying on mdraid, ensure that you use `stateVersion` correctly or set `boot.swraid.enable` manually. On systems with an updated `stateVersion` we now also emit warnings if `mdadm.conf` does not contain the minimum required configuration necessary to run the dynamically enabled monitoring daemons.

nixos/maintainers/scripts/lxd/lxd-container-image-inner.nix

@@ -8,7 +8,7 @@
   imports =
     [
       # Include the default lxd configuration.
-      "${modulesPath}/modules/virtualisation/lxc-container.nix"
+      "${modulesPath}/virtualisation/lxc-container.nix"
       # Include the container-specific autogenerated configuration.
       ./lxd.nix
     ];

nixos/modules/module-list.nix

@@ -1406,6 +1406,7 @@
   ./services/x11/xautolock.nix
   ./services/x11/xbanish.nix
   ./services/x11/xfs.nix
+  ./services/x11/xscreensaver.nix
   ./services/x11/xserver.nix
   ./system/activation/activatable-system.nix
   ./system/activation/activation-script.nix

nixos/modules/programs/git.nix

@@ -58,6 +58,10 @@ in
         '';
       };
 
+      prompt = {
+        enable = mkEnableOption "automatically sourcing git-prompt.sh. This does not change $PS1; it simply provides relevant utility functions";
+      };
+
       lfs = {
         enable = mkEnableOption (lib.mdDoc "git-lfs");
 
@@ -89,6 +93,11 @@ in
         };
       };
     })
+    (mkIf (cfg.enable && cfg.prompt.enable) {
+      environment.interactiveShellInit = ''
+        source ${cfg.package}/share/bash-completion/completions/git-prompt.sh
+      '';
+    })
   ];
 
   meta.maintainers = with maintainers; [ figsoda ];

nixos/modules/services/security/clamav.nix

@@ -15,6 +15,9 @@ let
 
   clamdConfigFile = pkgs.writeText "clamd.conf" (toKeyValue cfg.daemon.settings);
   freshclamConfigFile = pkgs.writeText "freshclam.conf" (toKeyValue cfg.updater.settings);
+  fangfrischConfigFile = pkgs.writeText "fangfrisch.conf" ''
+    ${lib.generators.toINI {} cfg.fangfrisch.settings}
+  '';
 in
 {
   imports = [
@@ -66,6 +69,36 @@ in
           '';
         };
       };
+      fangfrisch = {
+        enable = mkEnableOption (lib.mdDoc "ClamAV fangfrisch updater");
+
+        interval = mkOption {
+          type = types.str;
+          default = "hourly";
+          description = lib.mdDoc ''
+            How often freshclam is invoked. See systemd.time(7) for more
+            information about the format.
+          '';
+        };
+
+        settings = mkOption {
+          type = lib.types.submodule {
+            freeformType = with types; attrsOf (attrsOf (oneOf [ str int bool ]));
+          };
+          default = { };
+          example = {
+            securiteinfo = {
+              enabled = "yes";
+              customer_id = "your customer_id";
+            };
+          };
+          description = lib.mdDoc ''
+            fangfrisch configuration. Refer to <https://rseichter.github.io/fangfrisch/#_configuration>,
+            for details on supported values.
+            Note that by default urlhaus and sanesecurity are enabled.
+          '';
+        };
+      };
     };
   };
 
@@ -98,6 +131,15 @@ in
       DatabaseMirror = [ "database.clamav.net" ];
     };
 
+    services.clamav.fangfrisch.settings = {
+      DEFAULT.db_url = mkDefault "sqlite:////var/lib/clamav/fangfrisch_db.sqlite";
+      DEFAULT.local_directory = mkDefault stateDir;
+      DEFAULT.log_level = mkDefault "INFO";
+      urlhaus.enabled = mkDefault "yes";
+      urlhaus.max_size = mkDefault "2MB";
+      sanesecurity.enabled = mkDefault "yes";
+    };
+
     environment.etc."clamav/freshclam.conf".source = freshclamConfigFile;
     environment.etc."clamav/clamd.conf".source = clamdConfigFile;
 
@@ -146,5 +188,53 @@ in
         PrivateDevices = "yes";
       };
     };
+
+    systemd.services.clamav-fangfrisch-init = mkIf cfg.fangfrisch.enable {
+      wantedBy = [ "multi-user.target" ];
+      # if the sqlite file can be found assume the database has already been initialised
+      script = ''
+        db_url="${cfg.fangfrisch.settings.DEFAULT.db_url}"
+        db_path="''${db_url#sqlite:///}"
+
+        if [ ! -f "$db_path" ]; then
+          ${pkgs.fangfrisch}/bin/fangfrisch --conf ${fangfrischConfigFile} initdb
+        fi
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+        StateDirectory = "clamav";
+        RuntimeDirectory = "clamav";
+        User = clamavUser;
+        Group = clamavGroup;
+        PrivateTmp = "yes";
+        PrivateDevices = "yes";
+      };
+    };
+
+    systemd.timers.clamav-fangfrisch = mkIf cfg.fangfrisch.enable {
+      description = "Timer for ClamAV virus database updater (fangfrisch)";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = cfg.fangfrisch.interval;
+        Unit = "clamav-fangfrisch.service";
+      };
+    };
+
+    systemd.services.clamav-fangfrisch = mkIf cfg.fangfrisch.enable {
+      description = "ClamAV virus database updater (fangfrisch)";
+      restartTriggers = [ fangfrischConfigFile ];
+      after = [ "network-online.target" "clamav-fangfrisch-init.service" ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.fangfrisch}/bin/fangfrisch --conf ${fangfrischConfigFile} refresh";
+        StateDirectory = "clamav";
+        RuntimeDirectory = "clamav";
+        User = clamavUser;
+        Group = clamavGroup;
+        PrivateTmp = "yes";
+        PrivateDevices = "yes";
+      };
+    };
   };
 }

nixos/modules/services/web-apps/invoiceplane.nix

@@ -28,7 +28,19 @@ let
     REMOVE_INDEXPHP=true
   '';
 
-  extraConfig = hostName: cfg: pkgs.writeText "extraConfig.php" ''
+  mkPhpValue = v:
+    if isString v then escapeShellArg v
+    # NOTE: If any value contains a , (comma) this will not get escaped
+    else if isList v && any lib.strings.isCoercibleToString v then escapeShellArg (concatMapStringsSep "," toString v)
+    else if isInt v then toString v
+    else if isBool v then boolToString v
+    else abort "The Invoiceplane config value ${lib.generators.toPretty {} v} can not be encoded."
+  ;
+
+  extraConfig = hostName: cfg: let
+    settings = mapAttrsToList (k: v: "${k}=${mkPhpValue v}") cfg.settings;
+  in pkgs.writeText "extraConfig.php" ''
+    ${concatStringsSep "\n" settings}
     ${toString cfg.extraConfig}
   '';
 
@@ -182,11 +194,31 @@ let
             InvoicePlane configuration. Refer to
             <https://github.com/InvoicePlane/InvoicePlane/blob/master/ipconfig.php.example>
             for details on supported values.
+
+            **Note**: Please pass structured settings via
+            `services.invoiceplane.sites.${name}.settings` instead, this option
+            will get deprecated in the future.
+          '';
+        };
+
+        settings = mkOption {
+          type = types.attrsOf types.anything;
+          default = {};
+          description = lib.mdDoc ''
+            Structural InvoicePlane configuration. Refer to
+            <https://github.com/InvoicePlane/InvoicePlane/blob/master/ipconfig.php.example>
+            for details and supported values.
+          '';
+          example = literalExpression ''
+            {
+              SETUP_COMPLETED = true;
+              DISABLE_SETUP = true;
+              IP_URL = "https://invoice.example.com";
+            }
           '';
         };
 
         cron = {
-
           enable = mkOption {
             type = types.bool;
             default = false;
@@ -197,12 +229,10 @@ let
               on how to configure it.
             '';
           };
-
           key = mkOption {
             type = types.str;
             description = lib.mdDoc "Cron key taken from the administration page.";
           };
-
         };
 
       };
@@ -239,8 +269,14 @@ in
   # implementation
   config = mkIf (eachSite != {}) (mkMerge [{
 
-    assertions = flatten (mapAttrsToList (hostName: cfg:
-      [{ assertion = cfg.database.createLocally -> cfg.database.user == user;
+    warnings = flatten (mapAttrsToList (hostName: cfg: [
+      (optional (cfg.extraConfig != null) ''
+        services.invoiceplane.sites."${hostName}".extraConfig will be deprecated in future releases, please use the settings option now.
+      '')
+    ]) eachSite);
+
+    assertions = flatten (mapAttrsToList (hostName: cfg: [
+      { assertion = cfg.database.createLocally -> cfg.database.user == user;
         message = ''services.invoiceplane.sites."${hostName}".database.user must be ${user} if the database is to be automatically provisioned'';
       }
       { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;

nixos/modules/services/web-servers/caddy/default.nix

@@ -378,7 +378,7 @@ in
         LogsDirectory = mkIf (cfg.logDir == "/var/log/caddy") [ "caddy" ];
         Restart = "on-failure";
         RestartPreventExitStatus = 1;
-        RestartSecs = "5s";
+        RestartSec = "5s";
 
         # TODO: attempt to upstream these options
         NoNewPrivileges = true;

nixos/modules/services/x11/xscreensaver.nix

@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.xscreensaver;
+in
+{
+  options.services.xscreensaver = {
+    enable = lib.mkEnableOption "xscreensaver user service";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.xscreensaver;
+      defaultText = lib.literalExpression "pkgs.xscreensaver";
+      description = "Which xscreensaver package to use.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Make xscreensaver-auth setuid root so that it can (try to) prevent the OOM
+    # killer from unlocking the screen.
+    security.wrappers.xscreensaver-auth = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${pkgs.xscreensaver}/libexec/xscreensaver/xscreensaver-auth";
+    };
+
+    systemd.user.services.xscreensaver = {
+      enable = true;
+      description = "XScreenSaver";
+      after = [ "graphical-session-pre.target" ];
+      partOf = [ "graphical-session.target" ];
+      wantedBy = [ "graphical-session.target" ];
+      path = [ cfg.package ];
+      serviceConfig.ExecStart = "${cfg.package}/bin/xscreensaver -no-splash";
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ vancluever AndersonTorres ];
+}

nixos/modules/tasks/filesystems/zfs.nix

@@ -16,6 +16,7 @@ let
   cfgTrim = config.services.zfs.trim;
   cfgZED = config.services.zfs.zed;
 
+  selectModulePackage = package: config.boot.kernelPackages.${package.kernelModuleAttribute};
   inInitrd = any (fs: fs == "zfs") config.boot.initrd.supportedFilesystems;
   inSystem = any (fs: fs == "zfs") config.boot.supportedFilesystems;
 
@@ -210,11 +211,17 @@ in
   options = {
     boot.zfs = {
       package = mkOption {
-        readOnly = true;
         type = types.package;
-        default = if config.boot.zfs.enableUnstable then pkgs.zfsUnstable else pkgs.zfs;
-        defaultText = literalExpression "if config.boot.zfs.enableUnstable then pkgs.zfsUnstable else pkgs.zfs";
-        description = lib.mdDoc "Configured ZFS userland tools package.";
+        default = if cfgZfs.enableUnstable then pkgs.zfsUnstable else pkgs.zfs;
+        defaultText = literalExpression "if zfsUnstable is enabled then pkgs.zfsUnstable else pkgs.zfs";
+        description = lib.mdDoc "Configured ZFS userland tools package, use `pkgs.zfsUnstable` if you want to track the latest staging ZFS branch.";
+      };
+
+      modulePackage = mkOption {
+        internal = true; # It is supposed to be selected automatically, but can be overridden by expert users.
+        default = selectModulePackage cfgZfs.package;
+        type = types.package;
+        description = lib.mdDoc "Configured ZFS kernel module package.";
       };
 
       enabled = mkOption {
@@ -533,6 +540,10 @@ in
   config = mkMerge [
     (mkIf cfgZfs.enabled {
       assertions = [
+        {
+          assertion = cfgZfs.modulePackage.version == cfgZfs.package.version;
+          message = "The kernel module and the userspace tooling versions are not matching, this is an unsupported usecase.";
+        }
         {
           assertion = cfgZED.enableMail -> cfgZfs.package.enableMail;
           message = ''
@@ -571,18 +582,14 @@ in
         # https://github.com/NixOS/nixpkgs/issues/106093
         kernelParams = lib.optionals (!config.boot.zfs.allowHibernation) [ "nohibernate" ];
 
-        extraModulePackages = let
-          kernelPkg = if config.boot.zfs.enableUnstable then
-            config.boot.kernelPackages.zfsUnstable
-           else
-            config.boot.kernelPackages.zfs;
-        in [
-          (kernelPkg.override { inherit (cfgZfs) removeLinuxDRM; })
+        extraModulePackages = [
+          (cfgZfs.modulePackage.override { inherit (cfgZfs) removeLinuxDRM; })
         ];
       };
 
       boot.initrd = mkIf inInitrd {
-        kernelModules = [ "zfs" ] ++ optional (!cfgZfs.enableUnstable) "spl";
+        # spl has been removed in ≥ 2.2.0.
+        kernelModules = [ "zfs" ] ++ lib.optional (lib.versionOlder "2.2.0" version) "spl";
         extraUtilsCommands =
           mkIf (!config.boot.initrd.systemd.enable) ''
             copy_bin_and_libs ${cfgZfs.package}/sbin/zfs

nixos/tests/all-tests.nix

@@ -927,6 +927,7 @@ in {
   xmonad-xdg-autostart = handleTest ./xmonad-xdg-autostart.nix {};
   xpadneo = handleTest ./xpadneo.nix {};
   xrdp = handleTest ./xrdp.nix {};
+  xscreensaver = handleTest ./xscreensaver.nix {};
   xss-lock = handleTest ./xss-lock.nix {};
   xterm = handleTest ./xterm.nix {};
   xxh = handleTest ./xxh.nix {};

nixos/tests/lxd/ui.nix

@@ -11,9 +11,37 @@ import ../make-test-python.nix ({ pkgs, lib, ... }: {
       lxd.ui.enable = true;
     };
 
-    environment.systemPackages = [ pkgs.curl ];
+    environment.systemPackages =
+      let
+        seleniumScript = pkgs.writers.writePython3Bin "selenium-script"
+          {
+            libraries = with pkgs.python3Packages; [ selenium ];
+          } ''
+          from selenium import webdriver
+          from selenium.webdriver.common.by import By
+          from selenium.webdriver.firefox.options import Options
+          from selenium.webdriver.support.ui import WebDriverWait
+
+          options = Options()
+          options.add_argument("--headless")
+          service = webdriver.FirefoxService(executable_path="${lib.getExe pkgs.geckodriver}")  # noqa: E501
+
+          driver = webdriver.Firefox(options=options, service=service)
+          driver.implicitly_wait(10)
+          driver.get("https://localhost:8443/ui")
+
+          wait = WebDriverWait(driver, 60)
+
+          assert len(driver.find_elements(By.CLASS_NAME, "l-application")) > 0
+          assert len(driver.find_elements(By.CLASS_NAME, "l-navigation__drawer")) > 0
+
+          driver.close()
+        '';
+      in
+      with pkgs; [ curl firefox-unwrapped geckodriver seleniumScript ];
   };
 
+
   testScript = ''
     machine.wait_for_unit("sockets.target")
     machine.wait_for_unit("lxd.service")
@@ -31,5 +59,8 @@ import ../make-test-python.nix ({ pkgs, lib, ... }: {
 
     # Ensure the endpoint returns an HTML page with 'LXD UI' in the title
     machine.succeed("curl -kLs https://localhost:8443/ui | grep '<title>LXD UI</title>'")
+
+    # Ensure the application is actually rendered by the Javascript
+    machine.succeed("PYTHONUNBUFFERED=1 selenium-script")
   '';
 })

nixos/tests/xscreensaver.nix

@@ -0,0 +1,64 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "pass-secret-service";
+  meta.maintainers = with lib.maintainers; [ vancluever AndersonTorres ];
+
+  nodes = {
+    ok = { nodes, pkgs, ... }:
+      {
+        imports = [ ./common/x11.nix ./common/user-account.nix ];
+        test-support.displayManager.auto.user = "alice";
+        services.xscreensaver.enable = true;
+      };
+
+    empty_wrapperPrefix = { nodes, pkgs, ... }:
+      {
+        imports = [ ./common/x11.nix ./common/user-account.nix ];
+        test-support.displayManager.auto.user = "alice";
+        services.xscreensaver.enable = true;
+        nixpkgs.overlays = [
+          (self: super: {
+            xscreensaver = super.xscreensaver.override {
+              wrapperPrefix = "";
+            };
+          })
+        ];
+      };
+
+    bad_wrapperPrefix = { nodes, pkgs, ... }:
+      {
+        imports = [ ./common/x11.nix ./common/user-account.nix ];
+        test-support.displayManager.auto.user = "alice";
+        services.xscreensaver.enable = true;
+        nixpkgs.overlays = [
+          (self: super: {
+            xscreensaver = super.xscreensaver.override {
+              wrapperPrefix = "/a/bad/path";
+            };
+          })
+        ];
+      };
+  };
+
+  testScript = ''
+    ok.wait_for_x()
+    ok.wait_for_unit("xscreensaver", "alice")
+    _, output_ok = ok.systemctl("status xscreensaver", "alice")
+    assert 'To prevent the kernel from randomly unlocking' not in output_ok
+    assert 'your screen via the out-of-memory killer' not in output_ok
+    assert '"xscreensaver-auth" must be setuid root' not in output_ok
+
+    empty_wrapperPrefix.wait_for_x()
+    empty_wrapperPrefix.wait_for_unit("xscreensaver", "alice")
+    _, output_empty_wrapperPrefix = empty_wrapperPrefix.systemctl("status xscreensaver", "alice")
+    assert 'To prevent the kernel from randomly unlocking' in output_empty_wrapperPrefix
+    assert 'your screen via the out-of-memory killer' in output_empty_wrapperPrefix
+    assert '"xscreensaver-auth" must be setuid root' in output_empty_wrapperPrefix
+
+    bad_wrapperPrefix.wait_for_x()
+    bad_wrapperPrefix.wait_for_unit("xscreensaver", "alice")
+    _, output_bad_wrapperPrefix = bad_wrapperPrefix.systemctl("status xscreensaver", "alice")
+    assert 'To prevent the kernel from randomly unlocking' in output_bad_wrapperPrefix
+    assert 'your screen via the out-of-memory killer' in output_bad_wrapperPrefix
+    assert '"xscreensaver-auth" must be setuid root' in output_bad_wrapperPrefix
+  '';
+})

nixos/tests/zfs.nix

@@ -13,6 +13,7 @@ let
                       else pkgs.linuxPackages
     , enableUnstable ? false
     , enableSystemdStage1 ? false
+    , zfsPackage ? if enableUnstable then pkgs.zfs else pkgs.zfsUnstable
     , extraTest ? ""
     }:
     makeTest {
@@ -21,7 +22,7 @@ let
         maintainers = [ adisbladis elvishjerricco ];
       };
 
-      nodes.machine = { pkgs, lib, ... }:
+      nodes.machine = { config, pkgs, lib, ... }:
         let
           usersharePath = "/var/lib/samba/usershares";
         in {
@@ -35,8 +36,8 @@ let
         boot.loader.efi.canTouchEfiVariables = true;
         networking.hostId = "deadbeef";
         boot.kernelPackages = kernelPackage;
+        boot.zfs.package = zfsPackage;
         boot.supportedFilesystems = [ "zfs" ];
-        boot.zfs.enableUnstable = enableUnstable;
         boot.initrd.systemd.enable = enableSystemdStage1;
 
         environment.systemPackages = [ pkgs.parted ];
@@ -193,6 +194,11 @@ let
 
 in {
 
+  # maintainer: @raitobezarius
+  series_2_1 = makeZfsTest "2.1-series" {
+    zfsPackage = pkgs.zfs_2_1;
+  };
+
   stable = makeZfsTest "stable" { };
 
   unstable = makeZfsTest "unstable" {

pkgs/applications/audio/ekho/default.nix

@@ -1,16 +1,46 @@
-{ lib, stdenv, fetchurl, pkg-config
-, libsndfile, libpulseaudio
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, autoconf
+, automake
+, libtool
+, libsndfile
+, libpulseaudio
+, espeak-ng
+, sonic
+, utf8cpp
+, AudioUnit
 }:
 
-let
-  version = "5.8.2";
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "ekho";
-  inherit version;
+  version = "9.0";
+
+  src = fetchFromGitHub {
+    owner = "hgneng";
+    repo = "ekho";
+    rev = "v${version}";
+    hash = "sha256-VYN9tR3BJXd3UA0V5vqQJNItJe1e1knZ+S7tLeaeYYk=";
+  };
+
+  preConfigure = ''
+    ./autogen.sh
+  '';
+
+  CXXFLAGS = [
+    "-O0"
+    "-I${lib.getDev utf8cpp}/include/utf8cpp"
+  ];
+
+  nativeBuildInputs = [ pkg-config autoconf automake libtool ];
+
+  buildInputs = [ libsndfile libpulseaudio espeak-ng sonic utf8cpp ]
+    ++ lib.optionals stdenv.isDarwin [ AudioUnit ];
 
   meta = with lib; {
     description = "Chinese text-to-speech software";
-    homepage    = "http://www.eguidedog.net/ekho.php";
+    homepage = "http://www.eguidedog.net/ekho.php";
     longDescription = ''
       Ekho (余音) is a free, open source and multilingual text-to-speech (TTS)
       software. It supports Cantonese (Chinese dialect spoken in Hong Kong and
@@ -18,22 +48,8 @@ in stdenv.mkDerivation rec {
       (a dialect in Taiwan), Tibetan, Ngangien (an ancient Chinese before
       Yuan Dynasty) and Korean (in trial).
     '';
-    license        = licenses.gpl2Plus;
-    platforms      = platforms.linux;
-    hydraPlatforms = [];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux ++ platforms.darwin;
+    maintainers = with maintainers; [ aaronjheng ];
   };
-
-  src = fetchurl {
-    url = "mirror://sourceforge/e-guidedog/Ekho/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0ym6lpcpsvwvsiwlzkl1509a2hljwcw7synngrmqjq1n49ww00nj";
-  };
-
-  preConfigure = with lib; ''
-    NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE ${optionalString stdenv.is64bit "-D_x86_64"}"
-    NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -DEKHO_DATA_PATH=\"$out/share/ekho-data\""
-  '';
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ libsndfile libpulseaudio ];
 }

pkgs/applications/audio/touchosc/default.nix

@@ -45,7 +45,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "touchosc";
-  version = "1.2.4.180";
+  version = "1.2.5.183";
 
   suffix = {
     aarch64-linux = "linux-arm64";
@@ -56,9 +56,9 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     url = "https://hexler.net/pub/${pname}/${pname}-${version}-${suffix}.deb";
     hash = {
-      aarch64-linux = "sha256-Z3vHcfimchshFTRbSsVhAw4DJPetZF59zyAnnbQ3YAM=";
-      armv7l-linux  = "sha256-KUA6UFenEVme0AMuE69dR13RfYSGAd9GEdikh3DS0ko=";
-      x86_64-linux  = "sha256-3RA+piRJ4UE4tPYALaifENJg7+0BZDmSwS36VJiEn8Q=";
+      aarch64-linux = "sha256-V5615E2jVqk7CcCBbW5A0JEyEi6secC0Rj8KrQpfjns=";
+      armv7l-linux  = "sha256-0nyRffx8/OieVJTvJRtUIvrx5IyqmqEMMEZszPPDXb0=";
+      x86_64-linux  = "sha256-oV2T7l5/3JqXXoyiR3PeYJyHQe4GcDUxsi6cNxLUcng=";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 

pkgs/applications/editors/cudatext/default.nix

@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cudatext";
-  version = "1.201.0.2";
+  version = "1.202.1";
 
   src = fetchFromGitHub {
     owner = "Alexey-T";
     repo = "CudaText";
     rev = version;
-    hash = "sha256-ke7i0eeZHEsVhtzaS0AeLQOrYE1F+ppCwjR2TWeJQPA=";
+    hash = "sha256-ZFMO986D4RtrTnLFdcL0a2BNjcsB+9pIolylblku7j4=";
   };
 
   patches = [ ./proc_globdata.patch ];

pkgs/applications/editors/cudatext/deps.json

@@ -16,8 +16,8 @@
   },
   "ATSynEdit": {
     "owner": "Alexey-T",
-    "rev": "2023.10.30",
-    "hash": "sha256-xsJ02zGzi7ByFBXql4lLWWLiPVWwtOLXzixmv4AeC2I="
+    "rev": "2023.11.23",
+    "hash": "sha256-LGYGCxEPdZL4BU3TGiFxydu7AN8g5kqOdW+dcbiCf7E="
   },
   "ATSynEdit_Cmp": {
     "owner": "Alexey-T",
@@ -26,13 +26,13 @@
   },
   "EControl": {
     "owner": "Alexey-T",
-    "rev": "2023.08.18",
-    "hash": "sha256-X/KFQfLAnbcquLSsOk0ve0X5SzoEgEG0q0JY4TuQXpY="
+    "rev": "2023.11.16",
+    "hash": "sha256-FxUV+K9JRsdr0xqQzvg1UI4bBHyhqxiVoPN58h2+WVg="
   },
   "ATSynEdit_Ex": {
     "owner": "Alexey-T",
-    "rev": "2023.10.02",
-    "hash": "sha256-mn+mTZZyDkc7P7w1PG/rDgp+rpXC3dahoiRk+DUDMHQ="
+    "rev": "2023.11.23",
+    "hash": "sha256-RNXP8O3UF+hwA3TNzLorZqlt04Idnc4Z9LA87JJSsZE="
   },
   "Python-for-Lazarus": {
     "owner": "Alexey-T",

pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix

@@ -93,6 +93,8 @@ in
 
   wat-mode = callPackage ./manual-packages/wat-mode { };
 
+  xapian-lite = callPackage ./manual-packages/xapian-lite { };
+
   yes-no = callPackage ./manual-packages/yes-no { };
 
   youtube-dl = callPackage ./manual-packages/youtube-dl { };

pkgs/applications/editors/emacs/elisp-packages/manual-packages/xapian-lite/default.nix

@@ -0,0 +1,36 @@
+{ lib, stdenv, emacs, fetchFromSourcehut, xapian }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xapian-lite";
+  version = "2.0.0";
+
+  src = fetchFromSourcehut {
+    owner = "~casouri";
+    repo = "xapian-lite";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-uFO5yxPHIUJjT3OV2hZKp7KgT3l73W95X2SAz6vhCpI=";
+    domain = "sr.ht";
+  };
+
+  preBuild = ''
+    rm emacs-module.h
+  '';
+
+  buildInputs = [ xapian emacs ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 -t $out/share/emacs/site-lisp/ xapian-lite${stdenv.targetPlatform.extensions.sharedLibrary}
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://git.sr.ht/~casouri/xapian-lite";
+    description = "A minimal Emacs dynamic module for Xapian";
+    maintainers = [ lib.maintainers.marsam ];
+    license = lib.licenses.gpl3Plus;
+    inherit (emacs.meta) platforms;
+  };
+})

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -248,12 +248,12 @@
   };
   commonlisp = buildGrammar {
     language = "commonlisp";
-    version = "0.0.0+rev=5153dbb";
+    version = "0.0.0+rev=cf10fc3";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-commonlisp";
-      rev = "5153dbbc70e4cc2324320c1bdae020d31079c7c0";
-      hash = "sha256-0eC2cm/cP9BLfNKsubJd4S4BHF2nJdx/OCNJNC4ur6Q=";
+      rev = "cf10fc38bc24faf0549d59217ff37c789973dfdc";
+      hash = "sha256-Pm8aZnsw2fKRA0Cz0sOdcWh2GX7ty3wy34OfUtxmBds=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-commonlisp";
   };
@@ -326,12 +326,12 @@
   };
   cuda = buildGrammar {
     language = "cuda";
-    version = "0.0.0+rev=d33ee2c";
+    version = "0.0.0+rev=2c6e806";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-cuda";
-      rev = "d33ee2caab572f7b46cef12e090331b9ed1c02e2";
-      hash = "sha256-9fQ0z7DozjGdcQZG36w419mFXIVDeafkG+ciQHgh0EE=";
+      rev = "2c6e806949197e7898910c78f514a3b7ff679068";
+      hash = "sha256-JAShJo+jDv4kzFCPID0C3EokmeiWxMVcJoEsVOzKBEw=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-cuda";
   };
@@ -371,12 +371,12 @@
   };
   devicetree = buildGrammar {
     language = "devicetree";
-    version = "0.0.0+rev=cc26cbf";
+    version = "0.0.0+rev=53b4137";
     src = fetchFromGitHub {
       owner = "joelspadin";
       repo = "tree-sitter-devicetree";
-      rev = "cc26cbf2121a27eaa72a05a795ce38aba4e0f86e";
-      hash = "sha256-r23ycLCR79Ow4eI8rK03B3M1loU8/7K8dDrqBIPSAS0=";
+      rev = "53b4137bd37e726116ea918139767f982a1584d8";
+      hash = "sha256-eHH6PiOR1xlIYFY2OcnvVVQanfAuJMkbsvDy9Wjm80U=";
     };
     meta.homepage = "https://github.com/joelspadin/tree-sitter-devicetree";
   };
@@ -538,12 +538,12 @@
   };
   erlang = buildGrammar {
     language = "erlang";
-    version = "0.0.0+rev=35ae91b";
+    version = "0.0.0+rev=b7969b5";
     src = fetchFromGitHub {
       owner = "WhatsApp";
       repo = "tree-sitter-erlang";
-      rev = "35ae91b2e9f5514c0ad6d6887f9859f28907c7d5";
-      hash = "sha256-sA1Sy2yHBACDlicLYX+BLdcy4cnpleaYYVcjPcgHtW0=";
+      rev = "b7969b5f12c44038379901a6f2094c31afa2ec2f";
+      hash = "sha256-wfzfUGulZ3d7En5b/DiTrMcBNi4JHT723nSOS055v6w=";
     };
     meta.homepage = "https://github.com/WhatsApp/tree-sitter-erlang";
   };
@@ -736,12 +736,12 @@
   };
   glsl = buildGrammar {
     language = "glsl";
-    version = "0.0.0+rev=c9082ed";
+    version = "0.0.0+rev=5bb58a6";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-glsl";
-      rev = "c9082edab87b145e97090b133167cb53626d9f58";
-      hash = "sha256-bwuPykagBFfTJ87C5oNcUWmKs9eBBYPZ0UOC/8zbbF8=";
+      rev = "5bb58a6a5b0941d4e1256c6335e50d9780e74dde";
+      hash = "sha256-k2hs8psjVJ2HcNZoVaM4k81uccmacqbl7VxDXXOAQzA=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-glsl";
   };
@@ -934,12 +934,12 @@
   };
   hlsl = buildGrammar {
     language = "hlsl";
-    version = "0.0.0+rev=ac65c93";
+    version = "0.0.0+rev=8b10fab";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-hlsl";
-      rev = "ac65c934b3214e96e0f854be009a3bd51549bd14";
-      hash = "sha256-rTBal4RBOFBKfb9cydvWH+JtCCMOlnnGMPb2X7LXRjE=";
+      rev = "8b10faba024b536dc85f76e0c678f573b1776034";
+      hash = "sha256-9bl7RhZjQOqBOePB4Lx3FLR79svMSh7ZVe+YlFv27WU=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
   };
@@ -1666,12 +1666,12 @@
   };
   pod = buildGrammar {
     language = "pod";
-    version = "0.0.0+rev=ea5d557";
+    version = "0.0.0+rev=39da859";
     src = fetchFromGitHub {
       owner = "tree-sitter-perl";
       repo = "tree-sitter-pod";
-      rev = "ea5d557cbd185cdcb5efcfdb6bc846fe909d86ae";
-      hash = "sha256-CFPfpFQYlaryMX/k6tBT9k0WbQRz2vdVzh++lIVYe80=";
+      rev = "39da859947b94abdee43e431368e1ae975c0a424";
+      hash = "sha256-sMUlAtl0IaykKlEhOiAkdrLNNJiCS0L7gj7+2WHwO5U=";
     };
     meta.homepage = "https://github.com/tree-sitter-perl/tree-sitter-pod";
   };
@@ -1719,6 +1719,17 @@
     };
     meta.homepage = "https://github.com/MichaHoffmann/tree-sitter-promql";
   };
+  properties = buildGrammar {
+    language = "properties";
+    version = "0.0.0+rev=9725327";
+    src = fetchFromGitHub {
+      owner = "ObserverOfTime";
+      repo = "tree-sitter-properties";
+      rev = "97253273bdf8b63546c8006e71ba155ecc27069e";
+      hash = "sha256-pzAoRPBZRqlchnaYrKixrgjTZZ3nLzoOD5MZCqS7trI=";
+    };
+    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-properties";
+  };
   proto = buildGrammar {
     language = "proto";
     version = "0.0.0+rev=e9f6b43";
@@ -2064,12 +2075,12 @@
   };
   smithy = buildGrammar {
     language = "smithy";
-    version = "0.0.0+rev=cf8c7eb";
+    version = "0.0.0+rev=8327eb8";
     src = fetchFromGitHub {
       owner = "indoorvivants";
       repo = "tree-sitter-smithy";
-      rev = "cf8c7eb9faf7c7049839585eac19c94af231e6a0";
-      hash = "sha256-3cqT6+e0uqAtd92M55qSbza1eph8gklGlEGyO9R170w=";
+      rev = "8327eb84d55639ffbe08c9dc82da7fff72a1ad07";
+      hash = "sha256-6z2Psw+cjC11CXoGOJ/lkBPJXKqECCSrhchOiAPmd14=";
     };
     meta.homepage = "https://github.com/indoorvivants/tree-sitter-smithy";
   };
@@ -2132,12 +2143,12 @@
   };
   sql = buildGrammar {
     language = "sql";
-    version = "0.0.0+rev=d8fffdf";
+    version = "0.0.0+rev=a3ea0e4";
     src = fetchFromGitHub {
       owner = "derekstride";
       repo = "tree-sitter-sql";
-      rev = "d8fffdf0902bf55994fd2e8a0a46e221ca988589";
-      hash = "sha256-PowCYtL56lLGJaXFEdtPGAXaqYF0/u/mqDCjXHmyps0=";
+      rev = "a3ea0e4143a617fc2c4ccf29c41e0ba7a1ff6ab9";
+      hash = "sha256-VwkehcELs+t+1GjiOiPs1UQT+0E7OZaXaWTyjFWlMto=";
     };
     meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
   };
@@ -2154,12 +2165,12 @@
   };
   ssh_config = buildGrammar {
     language = "ssh_config";
-    version = "0.0.0+rev=1651e63";
+    version = "0.0.0+rev=9ff3cab";
     src = fetchFromGitHub {
       owner = "ObserverOfTime";
       repo = "tree-sitter-ssh-config";
-      rev = "1651e637d57c667708add5440d3726f07e97d953";
-      hash = "sha256-jshQhWIeMcsUA7g2RGuH3DSfBfRhRx9dMOJVm/92Jkw=";
+      rev = "9ff3cabeb738f94bfc3c2de4d3857133ad717e3f";
+      hash = "sha256-uEm3Egz2/37TxmF24YklfVaxboQsbh5f9+TVcPAdpd0=";
     };
     meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-ssh-config";
   };
@@ -2344,12 +2355,12 @@
   };
   tlaplus = buildGrammar {
     language = "tlaplus";
-    version = "0.0.0+rev=d99cb5c";
+    version = "0.0.0+rev=c5fae9e";
     src = fetchFromGitHub {
       owner = "tlaplus-community";
       repo = "tree-sitter-tlaplus";
-      rev = "d99cb5c77bb0e733176d607a0875ac30e17e1e72";
-      hash = "sha256-ShZlFHokmy3hhfTeh+/anz7a2bGDwWAdWIdi3X/lchQ=";
+      rev = "c5fae9e4ad9f483fb6232a8688a2c940be6b496b";
+      hash = "sha256-k2NN7vRIDsq/J4J6T9KEAwSht7JBtU9Ul7tUL/TrU58=";
     };
     meta.homepage = "https://github.com/tlaplus-community/tree-sitter-tlaplus";
   };
@@ -2502,12 +2513,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "0.0.0+rev=2f24b03";
+    version = "0.0.0+rev=20433e0";
     src = fetchFromGitHub {
       owner = "v-analyzer";
       repo = "v-analyzer";
-      rev = "2f24b0377ddb865eb4285634f6945cb4ee3f395c";
-      hash = "sha256-DLtG1RzoDC252O1FItP9vDZyt/MpV4bR7tcMSOLINWA=";
+      rev = "20433e0d8ff5bb6e7bb28d12948773be2bdd983d";
+      hash = "sha256-QdcGwVw8NNgdL1F+cytA6L1uzoAXGEcedTp16fLkS+o=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/v-analyzer/v-analyzer";
@@ -2602,12 +2613,12 @@
   };
   wing = buildGrammar {
     language = "wing";
-    version = "0.0.0+rev=f6423ec";
+    version = "0.0.0+rev=d483d21";
     src = fetchFromGitHub {
       owner = "winglang";
       repo = "wing";
-      rev = "f6423ecace1ef34f57dc77db031504ce21ebfaaf";
-      hash = "sha256-uIUIXHxHWedJ5oH1u/88degVAzklzN97AYc5B39nFwE=";
+      rev = "d483d21ad212bc9641e88deee0db2dad670eaaf3";
+      hash = "sha256-EmK4xFO1WlIw3zebshrvBqJeEa/C9d2ACCzeKd4EAyM=";
     };
     location = "libs/tree-sitter-wing";
     generate = true;

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1086,6 +1086,7 @@ https://github.com/peitalin/vim-jsx-typescript/,,
 https://github.com/mroavi/vim-julia-cell/,HEAD,
 https://github.com/NoahTheDuke/vim-just/,,
 https://github.com/knubie/vim-kitty-navigator/,,
+https://github.com/lark-parser/vim-lark-syntax/,HEAD,
 https://github.com/farmergreg/vim-lastplace/,,
 https://github.com/xuhdev/vim-latex-live-preview/,,
 https://github.com/ludovicchabant/vim-lawrencium/,,

pkgs/applications/emulators/darling/default.nix

@@ -4,6 +4,7 @@
 , writeShellScript
 , fetchFromGitHub
 , fetchpatch
+, nixosTests
 
 , freetype
 , libjpeg
@@ -107,14 +108,14 @@ let
   ];
 in stdenv.mkDerivation {
   pname = "darling";
-  version = "unstable-2023-05-02";
+  version = "unstable-2023-11-07";
 
   src = fetchFromGitHub {
     owner = "darlinghq";
     repo = "darling";
-    rev = "557e7e9dece394a3f623825679474457e5b64fd0";
+    rev = "34351655a40d2090e70b3033a577b8cdea967633";
     fetchSubmodules = true;
-    hash = "sha256-SOoLaV7wg33qRHPQXkdMvrY++CvoG85kwd6IU6DkYa0=";
+    hash = "sha256-Jhr7Do15vms8bJ8AczVSkuWrC7gUR5ZvU9/PfCmGGcg=";
   };
 
   outputs = [ "out" "sdk" ];
@@ -221,6 +222,8 @@ in stdenv.mkDerivation {
       $out/libexec/darling/usr/libexec/darling/mldr
   '';
 
+  passthru.tests.nixos = nixosTests.darling;
+
   meta = with lib; {
     description = "Open-source Darwin/macOS emulation layer for Linux";
     homepage = "https://www.darlinghq.org";

pkgs/applications/graphics/hydrus/default.nix

@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "552";
+  version = "553";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MaS9WxYlbQ7V/2mrETKS0UyWb5IzCrSwDcp4UlVS3zk=";
+    hash = "sha256-AQq5ljaxNzh0ZsoUqKgzz5kZKZMav99Jj8fI+e0wv7s=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/albert/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "albert";
-  version = "0.22.14";
+  version = "0.22.16";
 
   src = fetchFromGitHub {
     owner = "albertlauncher";
     repo = "albert";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-cAxdCjaCqEkwjL+OXW7ONkS7OpKfey3bUYmGzJyV+g8=";
+    sha256 = "sha256-Cx3DCTBsJLk0PZhGhkqLN7U8VeIVrv3Hj1OUYoHBvKA=";
     fetchSubmodules = true;
   };
 

pkgs/applications/misc/calibre/default.nix

@@ -32,11 +32,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "7.0.0";
+  version = "7.1.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-VAnzacz/8LYCVMCjHXqd4B+NUFmiMqdxQqpyap+UMNc=";
+    hash = "sha256-cKUV+tBZ5ZdXkoLdJPdURKnWP5B5gzCUQQehVQIRgko=";
   };
 
   patches = [

pkgs/applications/misc/rivercarro/default.nix

@@ -4,26 +4,28 @@
 , pkg-config
 , river
 , wayland
-, zig_0_9
+, wayland-protocols
+, zig_0_11
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rivercarro";
-  version = "0.1.4";
+  version = "0.3.0";
 
   src = fetchFromSourcehut {
     owner = "~novakane";
     repo = "rivercarro";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-eATbbwIt5ytEVLPodyq9vFF9Rs5S1xShpvNYQnfwdV4=";
+    hash = "sha256-lucwn9MmyVd4pynuG/ZAXnZ384wdS0gi7JN44vNQA1I=";
   };
 
   nativeBuildInputs = [
     pkg-config
     river
     wayland
-    zig_0_9.hook
+    wayland-protocols
+    zig_0_11.hook
   ];
 
   meta = with lib; {
@@ -42,6 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://git.sr.ht/~novakane/rivercarro/refs/v${finalAttrs.version}";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ kraem ];
-    inherit (zig_0_9.meta) platforms;
+    inherit (zig_0_11.meta) platforms;
   };
 })

pkgs/applications/networking/asn/default.nix

@@ -15,16 +15,18 @@
 
 stdenv.mkDerivation rec {
   pname = "asn";
-  version = "0.74";
+  version = "0.75";
 
   src = fetchFromGitHub {
     owner = "nitefood";
     repo = "asn";
-    rev = "v${version}";
-    sha256 = "sha256-400I8aWQaPE7qCV/HqyPzuMmKpUyLc+RK7GCVgbt7JQ=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-XqP0Nx5pfYtM1xXxEDGooONj7nQ9UngJ9/AOZefnPV8=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+  ];
 
   installPhase = ''
     install -Dv asn "$out/bin/asn"
@@ -33,7 +35,7 @@ stdenv.mkDerivation rec {
       --prefix PATH : "${lib.makeBinPath [ curl whois bind mtr jq ipcalc grepcidr nmap aha ]}"
   '';
 
-  meta = {
+  meta = with lib; {
     description = "OSINT command line tool for investigating network data";
     longDescription = ''
       ASN / RPKI validity / BGP stats / IPv4v6 / Prefix / URL / ASPath / Organization /
@@ -41,7 +43,8 @@ stdenv.mkDerivation rec {
       lookup API server / Web traceroute server
     '';
     homepage = "https://github.com/nitefood/asn";
-    license = with lib.licenses; [ mit ];
-    maintainers = with lib.maintainers; [ devhell ];
+    changelog = "https://github.com/nitefood/asn/releases/tag/v${version}";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ devhell ];
   };
 }

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -66,7 +66,7 @@ let
       deprecatedNativeMessagingHost = option: pkg:
         if (cfg.${option} or false)
           then
-            lib.warn "The cfg.${option} argument for `firefox.override` is deprecated, please add `pkgs.${pkg.pname}` to `nativeMessagingHosts` instead"
+            lib.warn "The cfg.${option} argument for `firefox.override` is deprecated, please add `pkgs.${pkg.pname}` to `nativeMessagingHosts.packages` instead"
             [pkg]
           else [];
 

pkgs/applications/networking/browsers/qutebrowser/default.nix

@@ -26,14 +26,14 @@ let
     stripRoot = false;
   };
 
-  pname = "qutebrowser";
   version = "3.0.2";
 in
 
 python3.pkgs.buildPythonApplication {
-  inherit pname version;
+  pname = "qutebrowser" + lib.optionalString (!isQt6) "-qt5";
+  inherit version;
   src = fetchurl {
-    url = "https://github.com/qutebrowser/qutebrowser/releases/download/v${version}/${pname}-${version}.tar.gz";
+    url = "https://github.com/qutebrowser/qutebrowser/releases/download/v${version}/qutebrowser-${version}.tar.gz";
     hash = "sha256-pRiT3koSNRmvuDcjuc7SstmPTKUoUnjIHpvdqR7VvFE=";
   };
 

pkgs/applications/networking/cluster/gatekeeper/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gatekeeper";
-  version = "3.13.3";
+  version = "3.13.4";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "gatekeeper";
     rev = "v${version}";
-    hash = "sha256-kLDriWkzOX4mC4VTpkyEtMTpOSoR0BsCwVeWLCfaY5w=";
+    hash = "sha256-h6GxU7y6z5wyZjuK7wI6BG0aF2u6hqLsID7ijTNzifc=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/kyverno/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kyverno";
-  version = "1.10.4";
+  version = "1.10.5";
 
   src = fetchFromGitHub {
     owner = "kyverno";
     repo = "kyverno";
     rev = "v${version}";
-    sha256 = "sha256-Qcy+LGvoDJZ+zpIJvC8P0c5pl6GpiDuq7sWdrdMojmg=";
+    sha256 = "sha256-APv9Z8cxcG283sEvC3/xwNMXStytM2dr/pemTES0Ltk=";
   };
 
   ldflags = [
@@ -18,7 +18,7 @@ buildGoModule rec {
     "-X github.com/kyverno/kyverno/pkg/version.BuildTime=1970-01-01_00:00:00"
   ];
 
-  vendorHash = "sha256-6JM5r/MUETmlMB/8Z82mpUe8bAym9ekb1HL24ik2OlE=";
+  vendorHash = "sha256-R2810TRxKDPOBfdCSNFJ4425tHQC6R4d5Xltd7jK2V8=";
 
   subPackages = [ "cmd/cli/kubectl-kyverno" ];
 

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix

@@ -258,6 +258,7 @@ stdenv.mkDerivation rec {
       the MTProto secure protocol.
     '';
     license = licenses.gpl3Only;
+    platforms = platforms.all;
     homepage = "https://desktop.telegram.org/";
     changelog = "https://github.com/telegramdesktop/tdesktop/releases/tag/v${version}";
     maintainers = with maintainers; [ nickcao ];

pkgs/applications/networking/p2p/qbittorrent/default.nix

@@ -10,6 +10,7 @@
 , qtbase
 , qtsvg
 , qttools
+, wrapGAppsHook
 , wrapQtAppsHook
 
 , guiSupport ? true
@@ -41,6 +42,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     ninja
+    wrapGAppsHook
     wrapQtAppsHook
   ];
 
@@ -74,6 +76,8 @@ stdenv.mkDerivation rec {
     "--prefix PATH : ${lib.makeBinPath [ python3 ]}"
   ];
 
+  dontWrapGApps = true;
+
   postInstall = lib.optionalString stdenv.isDarwin ''
     APP_NAME=qbittorrent${lib.optionalString (!guiSupport) "-nox"}
     mkdir -p $out/{Applications,bin}
@@ -81,6 +85,10 @@ stdenv.mkDerivation rec {
     makeWrapper $out/{Applications/$APP_NAME.app/Contents/MacOS,bin}/$APP_NAME
   '';
 
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
   meta = with lib; {
     description = "Featureful free software BitTorrent client";
     homepage = "https://www.qbittorrent.org";

pkgs/applications/networking/remote/x2goclient/default.nix

@@ -61,7 +61,7 @@ qt5.mkDerivation rec {
   meta = with lib; {
     description = "Graphical NoMachine NX3 remote desktop client";
     homepage = "http://x2go.org/";
-    maintainers = with maintainers; [ mkg20001 ];
+    maintainers = with maintainers; [ ];
     license = licenses.gpl2;
     platforms = platforms.linux;
   };

pkgs/applications/networking/remote/x2goserver/default.nix

@@ -88,6 +88,6 @@ stdenv.mkDerivation rec {
     homepage = "http://x2go.org/";
     platforms = lib.platforms.linux;
     license = licenses.gpl2;
-    maintainers = with maintainers; [ averelld mkg20001 ];
+    maintainers = with maintainers; [ averelld ];
   };
 }

pkgs/applications/radio/limesuite/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "limesuite";
-  version = "23.10.0";
+  version = "23.11.0";
 
   src = fetchFromGitHub {
     owner = "myriadrf";
     repo = "LimeSuite";
     rev = "v${version}";
-    sha256 = "sha256-o58UNc4r+MQbH00727YTV17M7D29BbH8CgUXCORKk7E=";
+    sha256 = "sha256-f1cXrkVCIc1MqTvlCUBFqzHLhIVueybVxipNZRlF2gE=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/version-management/sapling/default.nix

@@ -13,7 +13,7 @@
 , fetchYarnDeps
 , yarn
 , nodejs
-, fixup_yarn_lock
+, prefetch-yarn-deps
 , glibcLocales
 , libiconv
 , Cocoa
@@ -66,7 +66,7 @@ let
     inherit version;
 
     nativeBuildInputs = [
-      fixup_yarn_lock
+      prefetch-yarn-deps
       nodejs
       yarn
     ];
@@ -75,7 +75,7 @@ let
       runHook preBuild
 
       export HOME=$(mktemp -d)
-      fixup_yarn_lock yarn.lock
+      fixup-yarn-lock yarn.lock
       yarn config --offline set yarn-offline-mirror ${yarnOfflineCache}
       yarn install --offline --frozen-lockfile --ignore-engines --ignore-scripts --no-progress
       patchShebangs node_modules

pkgs/applications/virtualization/crun/default.nix

@@ -39,13 +39,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.11.1";
+  version = "1.12";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    hash = "sha256-D4Y+n/6R2v3U/BhYQitsHd6ckda1vfAzciFbTM/1J80=";
+    hash = "sha256-61E/71axlN5H1KpAkWFm7jOETlmmy2qh7R+JrVZlMIQ=";
     fetchSubmodules = true;
   };
 

pkgs/applications/virtualization/podman-desktop/default.nix

@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , fetchYarnDeps
 , yarn
-, fixup_yarn_lock
+, prefetch-yarn-deps
 , nodejs
 , makeWrapper
 , copyDesktopItems
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     yarn
-    fixup_yarn_lock
+    prefetch-yarn-deps
     nodejs
     makeWrapper
     copyDesktopItems
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     export HOME="$TMPDIR"
     yarn config --offline set yarn-offline-mirror "$offlineCache"
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules/
 

pkgs/applications/virtualization/singularity/packages.nix

@@ -7,14 +7,14 @@ let
   apptainer = callPackage
     (import ./generic.nix rec {
       pname = "apptainer";
-      version = "1.2.4";
+      version = "1.2.5";
       projectName = "apptainer";
 
       src = fetchFromGitHub {
         owner = "apptainer";
         repo = "apptainer";
         rev = "refs/tags/v${version}";
-        hash = "sha256-VaVOepfjMBf8F56S1Clpn8HPw65MNQMoZsQguKQ4Sg0=";
+        hash = "sha256-1XuqyNXyYrmIfqp8450z8+qET15hKVfj2v2iN9QPmDk=";
       };
 
       # Update by running

pkgs/applications/window-managers/i3/status-rust.nix

@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "i3status-rust";
-  version = "0.32.2";
+  version = "0.32.3";
 
   src = fetchFromGitHub {
     owner = "greshake";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-CKL4XsOBo8y4k06t5E7k2HBmI4VABW4rxU6Bjl52fhs=";
+    hash = "sha256-CldVak1BQ4VhRt24hHdog5O3crkQBZBkRWNT7uYUw4Y=";
   };
 
-  cargoHash = "sha256-7v5813veJPP5NVe2gFZr+iXJmK+aLajSZuhEkgsMxuY=";
+  cargoHash = "sha256-gWBmzpgZcsO4u8kXSqtr4FIYvshXpxWbECg/tcyl9Ok=";
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 

pkgs/applications/window-managers/river/default.nix

@@ -14,14 +14,14 @@
 , wayland-protocols
 , wlroots_0_16
 , xwayland
-, zig_0_10
+, zig_0_11
 , withManpages ? true
 , xwaylandSupport ? true
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "river";
-  version = "0.2.4";
+  version = "0.2.5";
 
   outputs = [ "out" ] ++ lib.optionals withManpages [ "man" ];
 
@@ -30,14 +30,14 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "river";
     rev = "refs/tags/v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-cIcO6owM6eYn+obYVaBOVQpnBx4++KOqQk5Hzo3GcNs=";
+    hash = "sha256-Xd9hg7UGTBlEyw8BDpTQYq/IRC7vUXhMx9j7YcCaQ20=";
   };
 
   nativeBuildInputs = [
     pkg-config
     wayland
     xwayland
-    zig_0_10.hook
+    zig_0_11.hook
   ]
   ++ lib.optional withManpages scdoc;
 

pkgs/applications/window-managers/sway/lock-fancy.nix

@@ -1,5 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, coreutils, grim, gawk, jq, swaylock
-, imagemagick, getopt, fontconfig, wmctrl, makeWrapper, bash
+{ lib
+, stdenv
+, fetchFromGitHub
+, coreutils
+, grim
+, gawk
+, jq
+, swaylock
+, imagemagick
+, getopt
+, fontconfig
+, wmctrl
+, makeWrapper
+, bash
 }:
 
 let
@@ -14,19 +26,22 @@ let
     fontconfig
     wmctrl
   ];
-in stdenv.mkDerivation rec {
-  pname = "swaylock-fancy-unstable";
-  version = "2021-10-11";
+  mainProgram = "swaylock-fancy";
+in
+
+stdenv.mkDerivation {
+  pname = "swaylock-fancy";
+  version = "unstable-2023-11-21";
 
   src = fetchFromGitHub {
     owner = "Big-B";
     repo = "swaylock-fancy";
-    rev = "265fbfb438392339bf676b0a9dbe294abe2a699e";
-    sha256 = "NjxeJyWYXBb1P8sXKgb2EWjF+cNodTE83r1YwRYoBjM=";
+    rev = "ff37ae3c6d0f100f81ff64fdb9d422c37de2f4f6";
+    hash = "sha256-oS4YCbZOIrMP4QSM5eHWzTn18k3w2OnJ2k+64x/DnuM=";
   };
 
   postPatch = ''
-    substituteInPlace swaylock-fancy \
+    substituteInPlace ${mainProgram} \
       --replace "/usr/share" "$out/share"
   '';
 
@@ -37,7 +52,7 @@ in stdenv.mkDerivation rec {
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   postInstall = ''
-    wrapProgram $out/bin/swaylock-fancy \
+    wrapProgram $out/bin/${mainProgram} \
       --prefix PATH : "${depsPath}"
   '';
 
@@ -46,6 +61,7 @@ in stdenv.mkDerivation rec {
     homepage = "https://github.com/Big-B/swaylock-fancy";
     license = licenses.mit;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ frogamic ];
+    inherit mainProgram;
   };
 }

pkgs/build-support/build-graalvm-native-image/default.nix

@@ -11,6 +11,7 @@
   # except in special cases. In most cases, use extraNativeBuildArgs instead
 , nativeImageBuildArgs ? [
     (lib.optionalString stdenv.isDarwin "-H:-CheckToolchain")
+    (lib.optionalString (stdenv.isLinux && stdenv.isAarch64) "-H:PageSize=64K")
     "-H:Name=${executable}"
     "-march=compatibility"
     "--verbose"

pkgs/by-name/ap/apt/package.nix

@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apt";
-  version = "2.7.6";
+  version = "2.7.7";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/a/apt/apt_${finalAttrs.version}.tar.xz";
-    hash = "sha256-hoP1Tv8L9U5R4CWzSL0HdND9Q3eZYW9IUSlWzxXAX2c=";
+    hash = "sha256-07PztwFPblYbhsBZuJBA0MdCy6vFdlk8bvqg3Xsk3nc=";
   };
 
   # cycle detection; lib can't be split

pkgs/by-name/be/beekeeper-studio/package.nix

@@ -0,0 +1,52 @@
+{ appimageTools
+, fetchurl
+, lib
+, makeWrapper
+, stdenv
+}:
+
+let
+  pname = "beekeeper-studio";
+  version = "4.0.3";
+
+  plat = {
+    aarch64-linux = "-arm64";
+    x86_64-linux = "";
+  }.${stdenv.hostPlatform.system};
+
+  hash = {
+    aarch64-linux = "sha256-PdRGZedNMZtGPI6Za2T94yKXvk6JoMoAot/kFKsBqQs=";
+    x86_64-linux = "sha256-P2HlCb0dai4cJlKcT9LLQ+njViD+oHS3KI2YdR5jR44=";
+  }.${stdenv.hostPlatform.system};
+
+  src = fetchurl {
+    url = "https://github.com/beekeeper-studio/beekeeper-studio/releases/download/v${version}/Beekeeper-Studio-${version}${plat}.AppImage";
+    inherit hash;
+  };
+
+  appimageContents = appimageTools.extractType2 { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    mv $out/bin/{${pname}-${version},${pname}}
+    source "${makeWrapper}/nix-support/setup-hook"
+    wrapProgram $out/bin/${pname} \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+    install -Dm444 ${appimageContents}/${pname}.desktop -t $out/share/applications/
+    install -Dm444 ${appimageContents}/${pname}.png -t $out/share/pixmaps/
+    substituteInPlace $out/share/applications/${pname}.desktop \
+      --replace 'Exec=AppRun --no-sandbox' 'Exec=${pname}'
+  '';
+
+  meta = with lib; {
+    description = "Modern and easy to use SQL client for MySQL, Postgres, SQLite, SQL Server, and more. Linux, MacOS, and Windows";
+    homepage = "https://www.beekeeperstudio.io";
+    changelog = "https://github.com/beekeeper-studio/beekeeper-studio/releases/tag/v${version}";
+    license = licenses.gpl3Only;
+    mainProgram = "beekeeper-studio";
+    maintainers = with maintainers; [ milogert alexnortung ];
+    platforms = [ "aarch64-linux" "x86_64-linux" ];
+  };
+}

pkgs/by-name/co/cosmic-osd/package.nix

@@ -0,0 +1,45 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, libxkbcommon
+, udev
+, wayland
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-osd";
+  version = "unstable-2023-11-15";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "c1d10382dd1132923a4ddc9c86bb89bd9a70cd68";
+    hash = "sha256-KCjWTN6hjbmJU6UfCP5NWbLy2K09+eRY5U4cQ5iV3E4=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "cosmic-config-0.1.0" = "sha256-7pfKQvScoahp+Fhv+QfgyIroCyQO6kjXcnTilBL41K8=";
+      "smithay-client-toolkit-0.17.0" = "sha256-vDY4cqz5CZD12twElUWVCsf4N6VO9O+Udl8Dc4arWK4=";
+      "smithay-client-toolkit-0.18.0" = "sha256-2WbDKlSGiyVmi7blNBr2Aih9FfF2dq/bny57hoA4BrE=";
+      "softbuffer-0.2.0" = "sha256-VD2GmxC58z7Qfu/L+sfENE+T8L40mvUKKSfgLmCTmjY=";
+      "taffy-0.3.11" = "sha256-0hXOEj6IjSW8e1t+rvxBFX6V9XRum3QO2Des1XlHJEw=";
+    };
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libxkbcommon wayland udev ];
+
+  env.POLKIT_AGENT_HELPER_1 = "/run/wrappers/bin/polkit-agent-helper-1";
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-osd";
+    description = "OSD for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+  };
+}

pkgs/by-name/co/cosmic-workspaces-epoch/package.nix

@@ -0,0 +1,60 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, libxkbcommon
+, libinput
+, libglvnd
+, mesa
+, udev
+, wayland
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-workspaces-epoch";
+  version = "unstable-2023-11-21";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "f61cdc5759235177521fbb6a39f164b9615adfc0";
+    hash = "sha256-ZPkPqROZXRLLhv6fbjfsov5hIt+D0K7VFajKebHVZaw=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
+      "smithay-client-toolkit-0.18.0" = "sha256-2WbDKlSGiyVmi7blNBr2Aih9FfF2dq/bny57hoA4BrE=";
+      "cosmic-comp-config-0.1.0" = "sha256-NKXIKhZLwZ0BZyGVEplAJ75H5YOsLRNeRrzdhczo3FQ=";
+      "cosmic-config-0.1.0" = "sha256-CxeefjDmEqQkXPhWTomF1yb4GCI9vs3OCvMawBGUgaw=";
+      "cosmic-protocols-0.1.0" = "sha256-st46wmOncJvu0kj6qaot6LT/ojmW/BwXbbGf8s0mdZ8=";
+      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "taffy-0.3.11" = "sha256-+gXAFZsS1cWxEisEpP0FMz9q1/UV7L2Ri4ToIP5Bt7s=";
+    };
+  };
+
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libxkbcommon libinput libglvnd mesa udev wayland ];
+
+  # Force linking to libEGL, which is always dlopen()ed, and to
+  # libwayland-client, which is always dlopen()ed except by the
+  # obscure winit backend.
+  RUSTFLAGS = map (a: "-C link-arg=${a}") [
+    "-Wl,--push-state,--no-as-needed"
+    "-lEGL"
+    "-lwayland-client"
+    "-Wl,--pop-state"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-workspaces-epoch";
+    description = "Workspaces Epoch for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+  };
+}

pkgs/by-name/cy/cyanrip/package.nix

@@ -10,19 +10,30 @@
 , libmusicbrainz5
 , curl
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cyanrip";
-  version = "0.9.0";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "cyanreg";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-gH/rWTRYX10Q2Y9oSaMu0bOy3SMbcSNmH3dkXHFAw90";
+    repo = "cyanrip";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-sWgHf8S4GZDAIvMUf5KvGy2y0JcUbRS53IjArdgokqc=";
   };
 
-  nativeBuildInputs = [ meson ninja pkg-config ];
-  buildInputs = [ ffmpeg-headless libcdio libcdio-paranoia libmusicbrainz5 curl ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    ffmpeg-headless
+    libcdio
+    libcdio-paranoia
+    libmusicbrainz5
+    curl
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/cyanreg/cyanrip";
@@ -31,4 +42,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     maintainers = [ maintainers.zane ];
   };
-}
+})

pkgs/by-name/ez/eza/package.nix

@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-q72IIKUWZBroDcxMEa1ppTPda9lg/KtEpCNOqlg9ZhU=";
+    hash = "sha256-wydKLy02S2REgN01Gb4PK1KsczjXsx5hU+hO9o9iZzE=";
   };
 
-  cargoHash = "sha256-UBayjaQX+bRkciookfQYUrCCewMXlIL3Z1I2ZJIbX6o=";
+  cargoHash = "sha256-MybbaJQqVHz7yt8rPp8k3aWqQHD7SJkbC7PDjwgmpLo=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]

pkgs/by-name/le/lefthook/package.nix

@@ -6,7 +6,7 @@
 
 let
   pname = "lefthook";
-  version = "1.5.2";
+  version = "1.5.3";
 in
 buildGoModule rec {
   inherit pname version;
@@ -15,7 +15,7 @@ buildGoModule rec {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${version}";
-    hash = "sha256-9lAgKHcUAhg3Z8fMNYu3JrjfSd0HaT7YhvjKlpLMi0E=";
+    hash = "sha256-pC6kEDOXNcuMfDvXomPZVMWpS/aHR4P4pIhqNkXAGuc=";
   };
 
   vendorHash = "sha256-/VLS7+nPERjIU7V2CzqXH69Z3/y+GKZbAFn+KcRKRuA=";

pkgs/by-name/li/libpkgconf/package.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pkgconf";
-  version = "2.0.3";
+  version = "2.1.0";
 
   src = fetchurl {
     url = "https://distfiles.dereferenced.org/pkgconf/pkgconf-${finalAttrs.version}.tar.xz";
-    hash = "sha256-yr3zxHRSmFT3zM6Fc8WsaK00p+YhA3U1y8OYH2sjg2w=";
+    hash = "sha256-Jm1YYe5RxSvHECk6HTZiKuFtBI1x7FYDSgLrnPlnd2E=";
   };
 
   outputs = [ "out" "lib" "dev" "man" "doc" ];

pkgs/by-name/pr/presenterm/package.nix

@@ -2,16 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "presenterm";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "mfontanini";
     repo = "presenterm";
     rev = "v${version}";
-    hash = "sha256-sXVMVU34gxZKGNye6hoyv07a7N7f6UbivA6thbSOeZA=";
+    hash = "sha256-uwLVg/bURz2jLAQZgLujDR2Zewu5pcE9bwEBg/DQ4Iw=";
   };
 
-  cargoHash = "sha256-PsDaXMws/8hEvAZwClQ4okGuryg1iKg0IBr7Xp2QYBE=";
+  cargoHash = "sha256-tEgXqvSyScO/J/56ykCda3ERrTDQj5jCxlMEDof/fCA=";
+
+  # Skip test that currently doesn't work
+  checkFlags = [ "--skip=execute::test::shell_code_execution" ];
 
   meta = with lib; {
     description = "A terminal based slideshow tool";

pkgs/by-name/sa/satty/package.nix

@@ -0,0 +1,67 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, wrapGAppsHook4
+, cairo
+, gdk-pixbuf
+, glib
+, gtk4
+, libadwaita
+, pango
+, fetchpatch
+, copyDesktopItems
+}:
+
+rustPlatform.buildRustPackage rec {
+
+  pname = "satty";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "gabm";
+    repo = "Satty";
+    rev = "v${version}";
+    hash = "sha256-x2ljheG7ZqaeiPersC/e8Er2jvk5TJs65Y3N1GjTiNU=";
+  };
+
+  cargoPatches = [
+    (fetchpatch {
+      name = "fix-Cargo.lock";
+      url = "https://github.com/gabm/Satty/commit/39be6ddce264552df971e949a6a3175b102530b2.patch";
+      hash = "sha256-GUHupZE1A7AmXvZ8WvRzBkQyH7qlMTetBjHuakfIZ7w=";
+    })
+  ];
+
+  cargoHash = "sha256-0GsbWd/gpKZm7nNXkuJhB02YKUj3XCrSfpRA9KBXydU=";
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    cairo
+    gdk-pixbuf
+    glib
+    gtk4
+    libadwaita
+    pango
+  ];
+
+  postInstall = ''
+    install -Dt $out/share/icons/hicolor/scalable/apps/ assets/satty.svg
+  '';
+
+  desktopItems = [ "satty.desktop" ];
+
+  meta = with lib; {
+    description = "A screenshot annotation tool inspired by Swappy and Flameshot";
+    homepage = "https://github.com/gabm/Satty";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ pinpox ];
+    mainProgram = "satty";
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/by-name/xs/xscreensaver/package.nix

@@ -26,6 +26,9 @@
 , systemd
 , forceInstallAllHacks ? true
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
+, nixosTests
+, substituteAll
+, wrapperPrefix ? "/run/wrappers/bin"
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -75,6 +78,13 @@ stdenv.mkDerivation (finalAttrs: {
     popd
   '';
 
+  patches = [
+    (substituteAll {
+      src = ./xscreensaver-wrapper-prefix.patch;
+      inherit wrapperPrefix;
+    })
+  ];
+
   preConfigure = ''
     # Fix installation paths for GTK resources.
     sed -e 's%@GTK_DATADIR@%@datadir@% ; s%@PO_DATADIR@%@datadir@%' \
@@ -105,6 +115,10 @@ stdenv.mkDerivation (finalAttrs: {
     cp -f $(find hacks -type f -perm -111 "!" -name "*.*" ) "$out/libexec/xscreensaver"
   '';
 
+  passthru.tests = {
+    xscreensaver = nixosTests.xscreensaver;
+  };
+
   meta = {
     homepage = "https://www.jwz.org/xscreensaver/";
     description = "A set of screensavers";

pkgs/by-name/xs/xscreensaver/xscreensaver-wrapper-prefix.patch

@@ -0,0 +1,37 @@
+--- a/driver/xscreensaver.c
++++ b/driver/xscreensaver.c
+@@ -253,6 +253,8 @@
+ #undef MAX
+ #define MAX(x,y)((x)>(y)?(x):(y))
+ 
++/* Define the default wrapper prefix here, for NixOS */
++#define NIXOS_WRAPPER_PREFIX "@wrapperPrefix@"
+ 
+ /* Globals used in this file.
+  */
+@@ -632,12 +634,24 @@ handle_sigchld (Display *dpy, Bool blanked_p)
+ static void
+ hack_environment (void)
+ {
++  static const char *wrapper_path = NIXOS_WRAPPER_PREFIX;
+   static const char *def_path = DEFAULT_PATH_PREFIX;
+   const char *opath = getenv("PATH");
+   char *npath;
+   if (! opath) opath = "/bin:/usr/bin";  /* WTF */
+-  npath = (char *) malloc(strlen(def_path) + strlen(opath) + 20);
++  /* NOTE: The NixOS patch adds extra margin than what would be expected for a
++     single extra ":" PATH separator to account for UTF-32 encoding. The
++     original 20 bytes would have only accounted for UTF-16 safely (the path
++     concatenation would have needed 28 bytes of margin at minimum for UTF-32).
++   */
++  npath = (char *) malloc(strlen(wrapper_path) + strlen(def_path) + strlen(opath) + 32);
+   strcpy (npath, "PATH=");
++  if (wrapper_path && *wrapper_path)
++    {
++      strcat (npath, wrapper_path);
++      strcat (npath, ":");
++    }
++
+   strcat (npath, def_path);
+   strcat (npath, ":");
+   strcat (npath, opath);

pkgs/by-name/zx/zxtune/disable_updates.patch

@@ -0,0 +1,20 @@
+--- ./apps/zxtune-qt/ui/desktop/mainwindow.cpp.orig	2023-11-03 10:58:54.073651511 -0700
++++ ./apps/zxtune-qt/ui/desktop/mainwindow.cpp	2023-11-03 10:59:08.900608850 -0700
+@@ -106,14 +106,9 @@
+       Require(connect(actionReportBug, &QAction::triggered, this, &DesktopMainWindowImpl::ReportIssue));
+       Require(connect(actionAboutQt, &QAction::triggered, this, &DesktopMainWindowImpl::ShowAboutQt));
+       Require(connect(actionPreferences, &QAction::triggered, this, &DesktopMainWindowImpl::ShowPreferences));
+-      if (Update::CheckOperation* op = Update::CheckOperation::Create(*this))
+-      {
+-        Require(connect(actionCheckUpdates, &QAction::triggered, op, &Update::CheckOperation::Execute));
+-      }
+-      else
+-      {
+-        actionCheckUpdates->setEnabled(false);
+-      }
++
++      // Nix: disable update checks completely
++      actionCheckUpdates->setEnabled(false);
+ 
+       Require(connect(Controls, &PlaybackControls::OnPrevious, MultiPlaylist, &Playlist::UI::ContainerView::Prev));
+       Require(connect(Controls, &PlaybackControls::OnNext, MultiPlaylist, &Playlist::UI::ContainerView::Next));

pkgs/by-name/zx/zxtune/package.nix

@@ -0,0 +1,148 @@
+{ lib
+, stdenv
+, fetchFromBitbucket
+, nix-update-script
+, boost
+, zlib
+# File backends (for decoding and encoding)
+, withMp3 ? true
+, lame
+, withOgg ? true
+, libvorbis
+, withFlac ? true
+, flac
+# Audio backends (for playback)
+, withOpenal ? false
+, openal
+, withSDL ? false
+, SDL
+, withOss ? false
+, withAlsa ? stdenv.hostPlatform.isLinux
+, alsa-lib
+, withPulse ? stdenv.hostPlatform.isLinux
+, libpulseaudio
+# GUI audio player
+, withQt ? true
+, qt5
+, zip
+}:
+let
+  dlopenBuildInputs = []
+    ++ lib.optional withMp3 lame
+    ++ lib.optional withOgg libvorbis
+    ++ lib.optional withFlac flac
+    ++ lib.optional withOpenal openal
+    ++ lib.optional withSDL SDL
+    ++ lib.optional withAlsa alsa-lib
+    ++ lib.optional withPulse libpulseaudio;
+  supportWayland = (!stdenv.hostPlatform.isDarwin);
+  platformName = "linux";
+  staticBuildInputs = [ boost zlib ]
+    ++ lib.optional withQt (if (supportWayland) then qt5.qtwayland else qt5.qtbase);
+in stdenv.mkDerivation rec {
+  pname = "zxtune";
+  version = "5055";
+
+  outputs = [ "out" ];
+
+  src = fetchFromBitbucket {
+    owner = "zxtune";
+    repo = "zxtune";
+    rev = "r${version}";
+    hash = "sha256-ABXGbzjdsPUuQnwZQOho4s2xRSDGzbZdA6/hCkBb7zE=";
+  };
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex" "r([0-9]+)" ];
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = lib.optionals withQt [ zip qt5.wrapQtAppsHook ];
+
+  buildInputs = staticBuildInputs ++ dlopenBuildInputs;
+
+  patches = [
+    ./disable_updates.patch
+  ];
+
+  # Fix use of old OpenAL header path
+  postPatch = ''
+    substituteInPlace src/sound/backends/gates/openal_api.h \
+      --replace "#include <OpenAL/" "#include <AL/"
+  '';
+
+  buildPhase = let
+    setOptionalSupport = name: var:
+      "support_${name}=" + (if (var) then "1" else "");
+    makeOptsCommon = [
+      ''-j$NIX_BUILD_CORES''
+      ''root.version=${src.rev}''
+      ''system.zlib=1''
+      ''platform=${platformName}''
+      ''includes.dirs.${platformName}="${lib.makeSearchPathOutput "dev" "include" buildInputs}"''
+      ''libraries.dirs.${platformName}="${lib.makeLibraryPath staticBuildInputs}"''
+      ''ld_flags="-Wl,-rpath=\"${lib.makeLibraryPath dlopenBuildInputs}\""''
+      (setOptionalSupport "mp3" withMp3)
+      (setOptionalSupport "ogg" withOgg)
+      (setOptionalSupport "flac" withFlac)
+      (setOptionalSupport "openal" withOpenal)
+      (setOptionalSupport "sdl" withSDL)
+      (setOptionalSupport "oss" withOss)
+      (setOptionalSupport "alsa" withAlsa)
+      (setOptionalSupport "pulseaudio" withPulse)
+    ];
+    makeOptsQt = [
+      ''tools.uic=${qt5.qtbase.dev}/bin/uic''
+      ''tools.moc=${qt5.qtbase.dev}/bin/moc''
+      ''tools.rcc=${qt5.qtbase.dev}/bin/rcc''
+    ];
+  in ''
+    runHook preBuild
+    make ${builtins.toString makeOptsCommon} -C apps/xtractor
+    make ${builtins.toString makeOptsCommon} -C apps/zxtune123
+  '' + lib.optionalString withQt ''
+    make ${builtins.toString (makeOptsCommon ++ makeOptsQt)} -C apps/zxtune-qt
+  '' + ''
+    runHook postBuild
+  '';
+
+  # Libs from dlopenBuildInputs are found with dlopen. Do not shrink rpath. Can
+  # check output of 'out/bin/zxtune123 --list-backends' to verify all plugins
+  # load ("Status: Available" or "Status: Failed to load dynamic library...").
+  dontPatchELF = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 bin/linux/release/xtractor -t $out/bin
+    install -Dm755 bin/linux/release/zxtune123 -t $out/bin
+  '' + lib.optionalString withQt ''
+    install -Dm755 bin/linux/release/zxtune-qt -t $out/bin
+  '' + ''
+    runHook postInstall
+  '';
+
+  # Only wrap the gui
+  dontWrapQtApps = true;
+  preFixup = lib.optionalString withQt ''
+    wrapQtApp "$out/bin/zxtune-qt"
+  '';
+
+  meta = with lib; {
+    description = "Crossplatform chiptunes player";
+    longDescription = ''
+      Chiptune music player with truly extensive format support. Supported
+      formats/chips include AY/YM, ZX Spectrum, PC, Amiga, Atari, Acorn, Philips
+      SAA1099, MOS6581 (Commodore 64), NES, SNES, GameBoy, Atari, TurboGrafX,
+      Nintendo DS, Sega Master System, and more. Powered by vgmstream, OpenMPT,
+      sidplay, and many other libraries.
+    '';
+    homepage = "https://zxtune.bitbucket.io/";
+    license = licenses.gpl3;
+    # zxtune supports mac and windows, but more work will be needed to
+    # integrate with the custom make system (see platformName above)
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ EBADBEEF ];
+    mainProgram = if withQt then "zxtune-qt" else "zxtune123";
+  };
+}

pkgs/desktops/gnome/extensions/extensionOverrides.nix

@@ -51,7 +51,6 @@ super: lib.trivial.pipe super [
     buildInputs = [ vte ];
     postFixup = ''
       wrapGApp "$out/share/gnome-shell/extensions/ddterm@amezin.github.com/bin/com.github.amezin.ddterm"
-      wrapGApp "$out/share/gnome-shell/extensions/ddterm@amezin.github.com/ddterm/app/dependencies-notification.js"
     '';
   }))
 

pkgs/desktops/gnome/extensions/extensionOverridesPatches/pano_at_elhan.io.patch

@@ -1,10 +1,27 @@
+diff --git a/__nix-prepend-search-paths.js b/__nix-prepend-search-paths.js
+new file mode 100644
+index 0000000..bf3071b
+--- /dev/null
++++ b/__nix-prepend-search-paths.js
+@@ -0,0 +1,3 @@
++import GIRepository from 'gi://GIRepository';
++GIRepository.Repository.prepend_search_path('@gsound@/lib/girepository-1.0');
++GIRepository.Repository.prepend_search_path('@libgda@/lib/girepository-1.0');
 diff --git a/extension.js b/extension.js
-index 26561f2..01209e7 100644
+index a3d6741..6a38850 100644
 --- a/extension.js
 +++ b/extension.js
-@@ -1,3 +1,5 @@
-+imports.gi.GIRepository.Repository.prepend_search_path('@gsound@/lib/girepository-1.0')
-+imports.gi.GIRepository.Repository.prepend_search_path('@libgda@/lib/girepository-1.0')
- 
- try {
- 
+@@ -1,3 +1,4 @@
++import './__nix-prepend-search-paths.js';
+ import Gio from 'gi://Gio';
+ import GLib from 'gi://GLib';
+ import Shell from 'gi://Shell';
+diff --git a/prefs.js b/prefs.js
+index 5dd94eb..634b2ef 100644
+--- a/prefs.js
++++ b/prefs.js
+@@ -1,3 +1,4 @@
++import './__nix-prepend-search-paths.js';
+ import Gdk from 'gi://Gdk';
+ import Gtk from 'gi://Gtk';
+ import { ExtensionPreferences } from 'resource:///org/gnome/Shell/Extensions/js/extensions/prefs.js';

pkgs/development/compilers/corretto/11.nix

@@ -0,0 +1,37 @@
+{ corretto11
+, fetchFromGitHub
+, gradle_7
+, jdk11
+, lib
+, stdenv
+, rsync
+, runCommand
+, testers
+}:
+
+let
+  corretto = import ./mk-corretto.nix {
+    inherit lib stdenv rsync runCommand testers;
+    jdk = jdk11;
+    gradle = gradle_7;
+    version = "11.0.20.9.1";
+    src = fetchFromGitHub {
+      owner = "corretto";
+      repo = "corretto-11";
+      rev = "b880bdc8397ec3dd6b7cd4b837ce846c9e902783";
+      sha256 = "sha256-IomJHQn0ZgqsBZ5BrRqVrEOhTq7wjLiIKMQlz53JxsU=";
+    };
+  };
+in
+corretto.overrideAttrs (oldAttrs: {
+  # jdk11 is built with --disable-warnings-as-errors (see openjdk/11.nix)
+  # because of several compile errors. We need to include this parameter for
+  # Corretto, too. Since the build is invoked via `gradle` build.gradle has to
+  # be adapted.
+  postPatch = oldAttrs.postPatch + ''
+    for file in $(find installers -name "build.gradle"); do
+      substituteInPlace $file --replace "command += archSpecificFlags" "command += archSpecificFlags + ['--disable-warnings-as-errors']"
+    done
+  '';
+
+})

pkgs/development/compilers/corretto/17.nix

@@ -0,0 +1,26 @@
+{ corretto17
+, fetchFromGitHub
+, gradle_7
+, jdk17
+, lib
+, stdenv
+, rsync
+, runCommand
+, testers
+}:
+
+let
+  corretto = import ./mk-corretto.nix {
+    inherit lib stdenv rsync runCommand testers;
+    jdk = jdk17;
+    gradle = gradle_7;
+    version = "17.0.8.8.1";
+    src = fetchFromGitHub {
+      owner = "corretto";
+      repo = "corretto-17";
+      rev = "9a3cc984f76cb5f90598bdb43215bad20e0f7319";
+      sha256 = "sha256-/VuB3ocD5VvDqCU7BoTG+fQ0aKvK1TejegRYmswInqQ=";
+    };
+  };
+in
+corretto

pkgs/development/compilers/corretto/19.nix

@@ -0,0 +1,26 @@
+{ corretto19
+, fetchFromGitHub
+, gradle_7
+, jdk19
+, lib
+, stdenv
+, rsync
+, runCommand
+, testers
+}:
+
+let
+  corretto = import ./mk-corretto.nix {
+    inherit lib stdenv rsync runCommand testers;
+    jdk = jdk19;
+    gradle = gradle_7;
+    version = "19.0.2.7.1";
+    src = fetchFromGitHub {
+      owner = "corretto";
+      repo = "corretto-19";
+      rev = "72f064a1d716272bd17d4e425d4a264b2c2c7d36";
+      sha256 = "sha256-mEj/MIbdXU0+fF5RhqjPuSeyclstesGaXB0e48YlKuw=";
+    };
+  };
+in
+corretto

pkgs/development/compilers/corretto/mk-corretto.nix

@@ -0,0 +1,115 @@
+{ jdk
+, version
+, src
+, lib
+, stdenv
+, gradle
+, rsync
+, runCommand
+, testers
+}:
+
+# Each Corretto version is based on a corresponding OpenJDK version. So
+# building Corretto is more or less the same as building OpenJDK. Hence, the
+# Corretto derivation overrides the corresponding OpenJDK derivation in order
+# to have access to all the version-specific fixes for the various OpenJDK
+# builds. However, Corretto uses `gradle` as build tool (which in turn will
+# invoke `make`). The configure/build phases are adapted as needed.
+
+let
+  pname = "corretto";
+  # The version scheme is different between OpenJDK & Corretto.
+  # See https://github.com/corretto/corretto-17/blob/release-17.0.8.8.1/build.gradle#L40
+  # "major.minor.security.build.revision"
+in
+jdk.overrideAttrs (finalAttrs: oldAttrs: {
+  inherit pname version src;
+  name = "${pname}-${version}";
+
+  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ jdk gradle rsync ];
+
+  dontConfigure = true;
+
+  postPatch = ''
+    # The rpm/deb task definitions require a Gradle plugin which we don't
+    # have and so the build fails. We'll simply remove them here because
+    # they are not needed anyways.
+    rm -rf installers/linux/universal/{rpm,deb}
+
+    # `/usr/bin/rsync` is invoked to copy the source tree. We don't have that.
+    for file in $(find installers -name "build.gradle"); do
+      substituteInPlace $file --replace "workingDir '/usr/bin'" "workingDir '.'"
+    done
+  '';
+
+
+  buildPhase =
+    let
+      # The Linux installer is placed at linux/universal/tar whereas the MacOS
+      # one is at mac/tar.
+      task =
+        if stdenv.isDarwin then
+          ":installers:mac:tar:packageBuildResults"
+        else ":installers:linux:universal:tar:packageBuildResults";
+    in
+    ''
+      runHook preBuild
+
+      # Corretto's actual built is triggered via `gradle`.
+      gradle --console=plain --no-daemon ${task}
+
+      # Prepare for the installPhase so that it looks like if a normal
+      # OpenJDK had been built.
+      dir=build/jdkImageName/images
+      mkdir -p $dir
+      file=$(find ./installers -name 'amazon-corretto-${version}*.tar.gz')
+      tar -xzf $file -C $dir
+      mv $dir/amazon-corretto-* $dir/jdk
+
+      runHook postBuild
+    '';
+
+  installPhase = oldAttrs.installPhase + ''
+    # The installPhase will place everything in $out/lib/openjdk and
+    # reference through symlinks. We don't rewrite the installPhase but at
+    # least move the folder to convey that this is not OpenJDK anymore.
+    mv $out/lib/openjdk $out/lib/corretto
+    ln -s $out/lib/corretto $out/lib/openjdk
+  '';
+
+  passthru =
+    let
+      pkg = finalAttrs.finalPackage;
+    in
+    oldAttrs.passthru // {
+      tests = {
+        version = testers.testVersion {
+          package = pkg;
+        };
+        vendor = runCommand "${pname}-vendor" { nativeBuildInputs = [ pkg ]; } ''
+          output=$(${pkg.meta.mainProgram} -XshowSettings:properties -version 2>&1 | grep vendor)
+          grep -Fq "java.vendor = Amazon.com Inc." - <<< "$output" && touch $out
+        '';
+        compiler = runCommand "${pname}-compiler" { nativeBuildInputs = [ pkg ]; } ''
+          cat << EOF  > Main.java
+          class Main {
+              public static void main(String[] args) {
+                  System.out.println("Hello, World!");
+              }
+          }
+          EOF
+          ${pkg}/bin/javac Main.java
+          ${pkg}/bin/java Main | grep -q "Hello, World!" && touch $out
+        '';
+      };
+    };
+
+  meta = with lib; {
+    homepage = "https://aws.amazon.com/corretto";
+    license = licenses.gpl2Only;
+    description = "Amazon's distribution of OpenJDK";
+    platforms = jdk.meta.platforms;
+    mainProgram = "java";
+    maintainers = with maintainers; [ rollf ];
+  };
+})

pkgs/development/compilers/hare/default.nix

@@ -1,7 +1,100 @@
-{ config, lib, pkgs }:
+{ lib
+, stdenv
+, fetchFromSourcehut
+, binutils-unwrapped
+, harec
+, makeWrapper
+, qbe
+, scdoc
+}:
 
-lib.makeScope pkgs.newScope (self: {
+let
+  # We use harec's override of qbe until 1.2 is released, but the `qbe` argument
+  # is kept to avoid breakage.
+  qbe = harec.qbeUnstable;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hare";
+  version = "unstable-2023-10-23";
 
-  harec = pkgs.callPackage ./harec { };
-  hare = pkgs.callPackage ./hare { };
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "hare";
+    rev = "1048620a7a25134db370bf24736efff1ffcb2483";
+    hash = "sha256-slQPIhrcM+KAVAvjuRnqNdEAEr4Xa4iQNVEpI7Wl+Ks=";
+  };
+
+  nativeBuildInputs = [
+    binutils-unwrapped
+    harec
+    makeWrapper
+    qbe
+    scdoc
+  ];
+
+  buildInputs = [
+    binutils-unwrapped
+    harec
+    qbe
+  ];
+
+  # Append the distribution name to the version
+  env.LOCALVER = "nix";
+
+  configurePhase =
+    let
+      # https://harelang.org/platforms/
+      arch =
+        if stdenv.isx86_64 then "x86_64"
+        else if stdenv.isAarch64 then "aarch64"
+        else if stdenv.hostPlatform.isRiscV && stdenv.is64bit then "riscv64"
+        else "unsupported";
+      platform =
+        if stdenv.isLinux then "linux"
+        else if stdenv.isFreeBSD then "freebsd"
+        else "unsupported";
+    in
+    ''
+      runHook preConfigure
+
+      cp config.example.mk config.mk
+      makeFlagsArray+=(
+        PREFIX="${builtins.placeholder "out"}"
+        HARECACHE="$(mktemp -d --tmpdir harecache.XXXXXXXX)"
+        BINOUT="$(mktemp -d --tmpdir bin.XXXXXXXX)"
+        PLATFORM="${platform}"
+        ARCH="${arch}"
+      )
+
+      runHook postConfigure
+    '';
+
+  doCheck = true;
+
+  postFixup =
+    let
+      binPath = lib.makeBinPath [
+        binutils-unwrapped
+        harec
+        qbe
+      ];
+    in
+    ''
+      wrapProgram $out/bin/hare --prefix PATH : ${binPath}
+    '';
+
+  setupHook = ./setup-hook.sh;
+
+  strictDeps = true;
+  enableParallelBuilding = true;
+
+  meta = {
+    homepage = "https://harelang.org/";
+    description =
+      "A systems programming language designed to be simple, stable, and robust";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ onemoresuza ];
+    mainProgram = "hare";
+    inherit (harec.meta) platforms badPlatforms;
+  };
 })

pkgs/development/compilers/hare/hare/config-template.mk

@@ -1,44 +0,0 @@
-## Template to generate config.mk via substitute-all
-
-# set PREFIX externally
-BINDIR = $(PREFIX)/bin
-MANDIR = $(PREFIX)/share/man
-SRCDIR = $(PREFIX)/src
-STDLIB = $(SRCDIR)/hare/stdlib
-
-HAREPATH = $(SRCDIR)/hare/stdlib:$(SRCDIR)/hare/third-party
-
-## Build configuration
-
-# Platform to build for
-PLATFORM = @platform@
-ARCH = @arch@
-
-# External tools and flags
-HAREC = harec
-HAREFLAGS = @hareflags@
-QBE = qbe
-AS = as
-LD = ld
-AR = ar
-SCDOC = scdoc
-
-# Where to store build artifacts
-# set HARECACHE externally
-
-# Cross-compiler toolchains
-# # TODO: fixup this
-AARCH64_AS=aarch64-as
-AARCH64_AR=aarch64-ar
-AARCH64_CC=aarch64-cc
-AARCH64_LD=aarch64-ld
-
-RISCV64_AS=riscv64-as
-RISCV64_AR=riscv64-ar
-RISCV64_CC=riscv64-cc
-RISCV64_LD=riscv64-ld
-
-X86_64_AS=as
-X86_64_AR=ar
-X86_64_CC=cc
-X86_64_LD=ld

pkgs/development/compilers/hare/hare/default.nix

@@ -1,98 +0,0 @@
-{ lib
-, stdenv
-, fetchFromSourcehut
-, binutils-unwrapped
-, harePackages
-, makeWrapper
-, qbe
-, scdoc
-, substituteAll
-}:
-
-let
-  inherit (harePackages) harec;
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "hare";
-  version = "unstable-2023-04-23";
-
-  src = fetchFromSourcehut {
-    owner = "~sircmpwn";
-    repo = "hare";
-    rev = "464ec7a660b12ab1ef8e4dcc9d00604cec996c6e";
-    hash = "sha256-5/ObckDxosqUkFfDVhGA/0kwjFzDUxu420nkfa97vqM=";
-  };
-
-  nativeBuildInputs = [
-    binutils-unwrapped
-    harec
-    makeWrapper
-    qbe
-    scdoc
-  ];
-
-  buildInputs = [
-    binutils-unwrapped
-    harec
-    qbe
-  ];
-
-  strictDeps = true;
-
-  configurePhase =
-    let
-      # https://harelang.org/platforms/
-      arch =
-        if stdenv.isx86_64 then "x86_64"
-        else if stdenv.isAarch64 then "aarch64"
-        else if stdenv.hostPlatform.isRiscV && stdenv.is64bit then "riscv64"
-        else "unsupported";
-      platform =
-        if stdenv.isLinux then "linux"
-        else if stdenv.isFreeBSD then "freebsd"
-        else "unsupported";
-      hareflags = "";
-      config-file = substituteAll {
-        src = ./config-template.mk;
-        inherit arch platform hareflags;
-      };
-    in
-    ''
-      runHook preConfigure
-
-      export HARECACHE="$NIX_BUILD_TOP/.harecache"
-      export BINOUT="$NIX_BUILD_TOP/.bin"
-      cat ${config-file} > config.mk
-
-      runHook postConfigure
-    '';
-
-  makeFlags = [
-    "PREFIX=${placeholder "out"}"
-  ];
-
-  doCheck = true;
-
-  postInstall =
-    let
-      binPath = lib.makeBinPath [
-        binutils-unwrapped
-        harec
-        qbe
-      ];
-    in
-    ''
-      wrapProgram $out/bin/hare --prefix PATH : ${binPath}
-    '';
-
-  setupHook = ./setup-hook.sh;
-
-  meta = {
-    homepage = "http://harelang.org/";
-    description =
-      "A systems programming language designed to be simple, stable, and robust";
-    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ onemoresuza ];
-    inherit (harec.meta) platforms badPlatforms;
-  };
-})

pkgs/development/compilers/hare/harec/default.nix

@@ -1,45 +0,0 @@
-{ lib
-, stdenv
-, fetchFromSourcehut
-, qbe
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "harec";
-  version = "unstable-2023-04-25";
-
-  src = fetchFromSourcehut {
-    owner = "~sircmpwn";
-    repo = "harec";
-    rev = "068e8da091f9053726251bc221abf40fdea630ff";
-    hash = "sha256-PPR0d+6JJRzPURW7AznloBSrtylMJExNCGCxFMl2LsA=";
-  };
-
-  nativeBuildInputs = [
-    qbe
-  ];
-
-  buildInputs = [
-    qbe
-  ];
-
-  # TODO: report upstream
-  hardeningDisable = [ "fortify" ];
-
-  strictDeps = true;
-
-  doCheck = true;
-
-  meta = {
-    homepage = "http://harelang.org/";
-    description = "Bootstrapping Hare compiler written in C for POSIX systems";
-    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ onemoresuza ];
-    # The upstream developers do not like proprietary operating systems; see
-    # https://harelang.org/platforms/
-    # UPDATE: https://github.com/hshq/harelang provides a MacOS port
-    platforms = with lib.platforms;
-      lib.intersectLists (freebsd ++ linux) (aarch64 ++ x86_64 ++ riscv64);
-    badPlatforms = lib.platforms.darwin;
-  };
-})

pkgs/development/compilers/harec/default.nix

@@ -0,0 +1,63 @@
+{ lib
+, stdenv
+, fetchFromSourcehut
+, qbe
+, fetchgit
+}:
+let
+  # harec needs the dbgfile and dbgloc features implemented up to this commit.
+  # This can be dropped once 1.2 is released, for a possible release date see:
+  # https://lists.sr.ht/~mpu/qbe/%3CZPkmHE9KLohoEohE%40cloudsdale.the-delta.net.eu.org%3E
+  qbe' = qbe.overrideAttrs (_old: {
+    version = "1.1-unstable-2023-08-18";
+    src = fetchgit {
+      url = "git://c9x.me/qbe.git";
+      rev = "36946a5142c40b733d25ea5ca469f7949ee03439";
+      hash = "sha256-bqxWFP3/aw7kRoD6ictbFcjzijktHvh4AgWAXBIODW8=";
+    };
+  });
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "harec";
+  version = "unstable-2023-10-22";
+
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "harec";
+    rev = "64dea196ce040fbf3417e1b4fb11331688672aca";
+    hash = "sha256-2Aeb+OZ/hYUyyxx6aTw+Oxiac+p+SClxtg0h68ZBSHc=";
+  };
+
+  nativeBuildInputs = [
+    qbe'
+  ];
+
+  buildInputs = [
+    qbe'
+  ];
+
+  strictDeps = true;
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  passthru = {
+    # We create this attribute so that the `hare` package can access the
+    # overwritten `qbe`.
+    qbeUnstable = qbe';
+  };
+
+  meta = {
+    homepage = "https://harelang.org/";
+    description = "Bootstrapping Hare compiler written in C for POSIX systems";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ onemoresuza ];
+    mainProgram = "harec";
+    # The upstream developers do not like proprietary operating systems; see
+    # https://harelang.org/platforms/
+    # UPDATE: https://github.com/hshq/harelang provides a MacOS port
+    platforms = with lib.platforms;
+      lib.intersectLists (freebsd ++ linux) (aarch64 ++ x86_64 ++ riscv64);
+    badPlatforms = lib.platforms.darwin;
+  };
+})

pkgs/development/interpreters/python/default.nix

@@ -109,9 +109,9 @@ in {
       major = "3";
       minor = "13";
       patch = "0";
-      suffix = "a1";
+      suffix = "a2";
     };
-    hash = "sha256-8Cgb8izABBQ2HBT8kZcYPn6y6rtylla2lEIiT7tj7ss=";
+    hash = "sha256-ttRrRBkMTAJCHraaBC0WsMVUgb3agYxsQW3CRBE6nC0=";
     inherit (darwin) configd;
     inherit passthruFun;
   };

pkgs/development/interpreters/zuo/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zuo";
-  version = "unstable-2023-11-10";
+  version = "unstable-2023-11-23";
 
   src = fetchFromGitHub {
     owner = "racket";
     repo = "zuo";
-    rev = "9e2aa26b0574b4ac53c838f6b59fd78f952c3923";
-    hash = "sha256-wF+jj4+4uFofW9KhVqRF7EoWViRny2KuSfX/l6UN+yY=";
+    rev = "4d85edb4f221de8a1748ee38dcc6963d8d2da33a";
+    hash = "sha256-pFEXkByZpVnQgXK1DeFSEnalvhCTwOy75WrRojBM78U=";
   };
 
   doCheck = true;

pkgs/development/libraries/libre/default.nix

@@ -8,13 +8,13 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.6.0";
+  version = "3.6.2";
   pname = "libre";
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "re";
     rev = "v${version}";
-    sha256 = "sha256-pFtrmrNRSL1lw10LjayOoNFrW/tTPXwmUipwC5v1MZs=";
+    sha256 = "sha256-mbwi6tJer4JC7ijB6WGDNoC/EM5rqCtejbYRFi9Kwgk=";
   };
 
   buildInputs = [

pkgs/development/libraries/librem/default.nix

@@ -2,13 +2,13 @@
 , cmake }:
 
 stdenv.mkDerivation rec {
-  version = "2.10.0";
+  version = "2.12.0";
   pname = "librem";
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "rem";
     rev = "v${version}";
-    sha256 = "sha256-wyzpx0WjQLA8UKx4S6QOETMehf51Af5napZsxMXttmM=";
+    sha256 = "sha256-MsXSUxFH89EqxMe4285xFV1Tsqmv2l5RnEeli48O3XQ=";
   };
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib openssl libre ];

pkgs/development/libraries/libubox/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation {
   pname = "libubox";
-  version = "unstable-2023-05-23";
+  version = "unstable-2023-11-03";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libubox.git";
-    rev = "75a3b870cace1171faf57bd55e5a9a2f1564f757";
-    hash = "sha256-QhJ09i7IWP6rbxrYuhisVsCr82Ou/JAZMEdkaLhZp1o=";
+    rev = "f7d1569113110ea8df071d2ea64fd17aaf5b42c9";
+    hash = "sha256-W0+QXI0gJ4WwrlRMPAJOChvilZ4zlAf4kXrfgBAkQAE=";
   };
 
   cmakeFlags = [ "-DBUILD_EXAMPLES=OFF" (if with_lua then "-DLUAPATH=${placeholder "out"}/lib/lua" else "-DBUILD_LUA=OFF") ];
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     description = "C utility functions for OpenWrt";
     homepage = "https://git.openwrt.org/?p=project/libubox.git;a=summary";
     license = licenses.isc;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz mkg20001 ];
     mainProgram = "jshn";
     platforms = platforms.all;
   };

pkgs/development/libraries/qt-5/5.15/default.nix

@@ -375,6 +375,5 @@ let
       if stdenv.buildPlatform == stdenv.hostPlatform
       then bootstrapScope.qttranslations
       else null;
-    qutebrowser = final.callPackage ../../../../applications/networking/browsers/qutebrowser { };
   });
 in finalScope

pkgs/development/libraries/qt-6/default.nix

@@ -1,6 +1,8 @@
 { newScope
 , lib
 , stdenv
+, generateSplicesForMkScope
+, makeScopeWithSplicing'
 , fetchurl
 , fetchpatch
 , fetchpatch2
@@ -12,6 +14,7 @@
 , overrideSDK
 , buildPackages
 , python3
+, config
 
   # options
 , developerBuild ? false
@@ -24,10 +27,11 @@ let
     mirror = "mirror://qt";
   };
 
-  addPackages = self: with self;
+  addPackages = self:
     let
       callPackage = self.newScope ({
-        inherit qtModule srcs python3;
+        inherit (self) qtModule;
+        inherit srcs python3;
         stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
       });
     in
@@ -58,7 +62,9 @@ let
         ];
       };
       env = callPackage ./qt-env.nix { };
-      full = env "qt-full-${qtbase.version}" ([
+      full = callPackage ({ env, qtbase }: env "qt-full-${qtbase.version}"
+      # `with self` is ok to use here because having these spliced is unnecessary
+      ( with self;[
         qt3d
         qt5compat
         qtcharts
@@ -96,7 +102,7 @@ let
         qtwebengine
         qtwebsockets
         qtwebview
-      ] ++ lib.optionals (!stdenv.isDarwin) [ qtwayland libglvnd ]);
+      ] ++ lib.optionals (!stdenv.isDarwin) [ qtwayland libglvnd ])) { };
 
       qt3d = callPackage ./modules/qt3d.nix { };
       qt5compat = callPackage ./modules/qt5compat.nix { };
@@ -149,11 +155,11 @@ let
           GameController ImageCaptureCore LocalAuthentication
           MediaAccessibility MediaPlayer MetalKit Network OpenDirectory Quartz
           ReplayKit SecurityInterface Vision;
-        qtModule = qtModule.override {
+        qtModule = callPackage ({ qtModule }: qtModule.override {
           stdenv = if stdenv.isDarwin
             then overrideSDK stdenv { darwinMinVersion = "10.13"; darwinSdkVersion = "11.0"; }
             else stdenv;
-        };
+        }) { };
         xcbuild = buildPackages.xcbuild.override {
           productBuildVer = "20A2408";
         };
@@ -163,26 +169,32 @@ let
         inherit (darwin.apple_sdk_11_0.frameworks) WebKit;
       };
 
-      wrapQtAppsHook = makeSetupHook
+      wrapQtAppsHook = callPackage ({ makeBinaryWrapper }: makeSetupHook
         {
           name = "wrap-qt6-apps-hook";
-          propagatedBuildInputs = [ buildPackages.makeBinaryWrapper ];
-        } ./hooks/wrap-qt-apps-hook.sh;
+          propagatedBuildInputs = [ makeBinaryWrapper ];
+        } ./hooks/wrap-qt-apps-hook.sh) { };
 
-      qmake = makeSetupHook
+      qmake = callPackage ({ qtbase }: makeSetupHook
         {
           name = "qmake6-hook";
-          propagatedBuildInputs = [ self.qtbase.dev ];
+          propagatedBuildInputs = [ qtbase.dev ];
           substitutions = {
             inherit debug;
             fix_qmake_libtool = ./hooks/fix-qmake-libtool.sh;
           };
-        } ./hooks/qmake-hook.sh;
+        } ./hooks/qmake-hook.sh) { };
+    } // lib.optionalAttrs config.allowAliases {
+      # Convert to a throw on 03-01-2023 and backport the change.
+      # Warnings show up in various cli tool outputs, throws do not.
+      # Remove completely before 24.05
+      overrideScope' = lib.warnIf (lib.isInOldestRelease 2311) "qt6 now uses makeScopeWithSplicing which does not have \"overrideScope'\", use \"overrideScope\"." self.overrideScope;
     };
 
-  # TODO(@Artturin): convert to makeScopeWithSplicing'
-  # simple example of how to do that in 5568a4d25ca406809530420996d57e0876ca1a01
-  baseScope = lib.makeScope newScope addPackages;
+  baseScope = makeScopeWithSplicing' {
+    otherSplices = generateSplicesForMkScope "qt6";
+    f = addPackages;
+  };
 
   bootstrapScope = baseScope.overrideScope(final: prev: {
     qtbase = prev.qtbase.override { qttranslations = null; };

pkgs/development/libraries/ubus/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation {
   pname = "ubus";
-  version = "unstable-2023-06-05";
+  version = "unstable-2023-11-14";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/ubus.git";
-    rev = "f787c97b34894a38b15599886cacbca01271684f";
-    hash = "sha256-PGPFtNaRXS6ryC+MA/w2CtPQfJa+vG5OXf/NPFMoIzQ=";
+    rev = "b3e8c4ef07ebb6f0f34a5c1f0dc1539068363619";
+    hash = "sha256-H/QrLMhdEC1LnSxHpp/90OdKbfHRqLVWUnzyQlsVO8c=";
   };
 
   cmakeFlags = [ "-DBUILD_LUA=OFF" ];
@@ -19,6 +19,6 @@ stdenv.mkDerivation {
     homepage = "https://git.openwrt.org/?p=project/ubus.git;a=summary";
     license = licenses.lgpl21Only;
     platforms = platforms.all;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ mkg20001 ];
   };
 }

pkgs/development/libraries/uci/default.nix

@@ -20,6 +20,6 @@ stdenv.mkDerivation {
     homepage = "https://git.openwrt.org/?p=project/uci.git;a=summary";
     license = licenses.lgpl21Only;
     platforms = platforms.all;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ mkg20001 ];
   };
 }

pkgs/development/libraries/ustream-ssl/default.nix

@@ -31,7 +31,7 @@ stdenv.mkDerivation {
     description = "ustream SSL wrapper";
     homepage = "https://git.openwrt.org/?p=project/ustream-ssl.git;a=summary";
     license = licenses.isc;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz mkg20001 ];
     platforms = platforms.all;
   };
 }

pkgs/development/ocaml-modules/atd/default.nix

@@ -1,4 +1,4 @@
-{ lib, atdgen-codec-runtime, menhir, easy-format, buildDunePackage, re, yojson, nixosTests }:
+{ lib, atdgen-codec-runtime, cmdliner, menhir, easy-format, buildDunePackage, re, yojson, nixosTests }:
 
 buildDunePackage rec {
   pname = "atd";
@@ -7,10 +7,9 @@ buildDunePackage rec {
   minimalOCamlVersion = "4.08";
 
   nativeBuildInputs = [ menhir ];
+  buildInputs = [ cmdliner ];
   propagatedBuildInputs = [ easy-format re yojson ];
 
-  strictDeps = true;
-
   passthru.tests = {
     smoke-test = nixosTests.atd;
   };

pkgs/development/ocaml-modules/atdgen/codec-runtime.nix

@@ -2,13 +2,11 @@
 
 buildDunePackage rec {
   pname = "atdgen-codec-runtime";
-  version = "2.11.0";
-
-  duneVersion = "3";
+  version = "2.15.0";
 
   src = fetchurl {
-    url = "https://github.com/ahrefs/atd/releases/download/${version}/atdts-${version}.tbz";
-    hash = "sha256-TTTuSxNKydPmTmztUapLoxntBIrAo8aWYIJ/G5cok1Y=";
+    url = "https://github.com/ahrefs/atd/releases/download/${version}/atd-${version}.tbz";
+    hash = "sha256-ukJ5vtVNE9zz9nA6SzF0TbgV3yLAUC2ZZdbGdM4IOTM=";
   };
 
   meta = {

pkgs/development/python-modules/jupyter-core/default.nix

@@ -5,21 +5,22 @@
 , hatchling
 , platformdirs
 , traitlets
+, pip
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "jupyter-core";
-  version = "5.3.1";
+  version = "5.5.0";
   disabled = pythonOlder "3.7";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jupyter";
     repo = "jupyter_core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kQ7oNEC5L19PTPaX6C2bP5FYuzlsFsS0TABsw6VvoL8=";
+    hash = "sha256-GufCQUkR4283xMsyrbv5tDfJ8SeL35WBW5Aw2z6Ardc=";
   };
 
   patches = [
@@ -36,6 +37,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    pip
     pytestCheckHook
   ];
 
@@ -43,6 +45,11 @@ buildPythonPackage rec {
     export HOME=$TMPDIR
   '';
 
+  pytestFlagsArray = [
+    # suppress pytest.PytestUnraisableExceptionWarning: Exception ignored in: <socket.socket fd=-1, family=AddressFamily.AF_UNIX, type=SocketKind.SOCK_STREAM, proto=0>
+    "-W ignore::pytest.PytestUnraisableExceptionWarning"
+  ];
+
   disabledTests = [
     # creates a temporary script, which isn't aware of PYTHONPATH
     "test_argv0"
@@ -57,7 +64,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Base package on which Jupyter projects rely";
     homepage = "https://jupyter.org/";
+    changelog = "https://github.com/jupyter/jupyter_core/blob/${src.rev}/CHANGELOG.md";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ fridh ];
+    maintainers = teams.jupyter.members;
   };
 }

pkgs/development/python-modules/jupyter-core/tests_respect_pythonpath.patch

@@ -1,8 +1,8 @@
-diff --git a/jupyter_core/tests/test_command.py b/jupyter_core/tests/test_command.py
-index 4ef38cd..08fba22 100644
---- a/jupyter_core/tests/test_command.py
-+++ b/jupyter_core/tests/test_command.py
-@@ -174,7 +174,7 @@ def test_not_on_path(tmpdir):
+diff --git a/tests/test_command.py b/tests/test_command.py
+index a0833c1..67c2110 100644
+--- a/tests/test_command.py
++++ b/tests/test_command.py
+@@ -191,7 +191,7 @@ def test_not_on_path(tmpdir):
      witness_src = "#!{}\n{}\n".format(sys.executable, 'print("WITNESS ME")')
      write_executable(witness, witness_src)
  
@@ -11,7 +11,7 @@ index 4ef38cd..08fba22 100644
      if "SYSTEMROOT" in os.environ:  # Windows http://bugs.python.org/issue20614
          env["SYSTEMROOT"] = os.environ["SYSTEMROOT"]
      if sys.platform == "win32":
-@@ -198,7 +198,7 @@ def test_path_priority(tmpdir):
+@@ -216,7 +216,7 @@ def test_path_priority(tmpdir):
      witness_b_src = "#!{}\n{}\n".format(sys.executable, 'print("WITNESS B")')
      write_executable(witness_b, witness_b_src)
  

pkgs/development/python-modules/labelbox/default.nix

@@ -1,5 +1,4 @@
 { lib
-, backoff
 , buildPythonPackage
 , fetchFromGitHub
 , geojson
@@ -7,21 +6,17 @@
 , imagesize
 , nbconvert
 , nbformat
-, ndjson
 , numpy
-, opencv
-  # , opencv-python
+, opencv4
 , packaging
 , pillow
 , pydantic
-  # , pygeotile
 , pyproj
-, pytest-cases
 , pytestCheckHook
+, python-dateutil
 , pythonOlder
-, pythonRelaxDepsHook
-, rasterio
 , requests
+, setuptools
 , shapely
 , tqdm
 , typeguard
@@ -30,8 +25,8 @@
 
 buildPythonPackage rec {
   pname = "labelbox";
-  version = "3.52.0";
-  format = "setuptools";
+  version = "3.56.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -39,7 +34,7 @@ buildPythonPackage rec {
     owner = "Labelbox";
     repo = "labelbox-python";
     rev = "refs/tags/v.${version}";
-    hash = "sha256-t0Q+6tnUPK2oqjdAwwYeSebgn2EQ1fBivw115L8ndOg=";
+    hash = "sha256-JRh14XpW/iGeBWrslm7weCP/vyJ7eZICqRgQpE2wjXs=";
   };
 
   postPatch = ''
@@ -48,18 +43,13 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
-  ];
-
-  pythonRelaxDeps = [
-    "backoff"
+    setuptools
   ];
 
   propagatedBuildInputs = [
-    backoff
     google-api-core
-    ndjson
     pydantic
+    python-dateutil
     requests
     tqdm
   ];
@@ -70,7 +60,7 @@ buildPythonPackage rec {
       geojson
       numpy
       pillow
-      # opencv-python
+      opencv4
       typeguard
       imagesize
       pyproj
@@ -83,10 +73,15 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     nbconvert
     nbformat
-    pytest-cases
     pytestCheckHook
   ] ++ passthru.optional-dependencies.data;
 
+  # disable pytest_plugins which requires `pygeotile`
+  preCheck = ''
+    substituteInPlace tests/conftest.py \
+      --replace "pytest_plugins" "_pytest_plugins"
+  '';
+
   disabledTestPaths = [
     # Requires network access
     "tests/integration"
@@ -94,11 +89,6 @@ buildPythonPackage rec {
     "tests/data"
   ];
 
-  pytestFlagsArray = [
-    # see tox.ini
-    "-k 'not notebooks'"
-  ];
-
   pythonImportsCheck = [
     "labelbox"
   ];

pkgs/development/python-modules/nbconvert/default.nix

@@ -21,7 +21,6 @@
 , importlib-metadata
 , flaky
 , ipywidgets
-, pyppeteer
 , pytestCheckHook
 }:
 
@@ -33,15 +32,14 @@ let
   };
 in buildPythonPackage rec {
   pname = "nbconvert";
-  version = "7.8.0";
+  version = "7.11.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  format = "pyproject";
-
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9bwVoSR+FN1Bzu8MCjvHACDgFldusFeNpi8cW0+VBHk=";
+    hash = "sha256-q+3AHPVDF3/94L/Cppcm1aR49q8QozL8G/Kfy08M8AA=";
   };
 
   # Add $out/share/jupyter to the list of paths that are used to search for
@@ -87,7 +85,6 @@ in buildPythonPackage rec {
   nativeCheckInputs = [
     flaky
     ipywidgets
-    pyppeteer
     pytestCheckHook
   ];
 
@@ -105,8 +102,9 @@ in buildPythonPackage rec {
 
   meta = {
     description = "Converting Jupyter Notebooks";
-    homepage = "https://jupyter.org/";
+    homepage = "https://github.com/jupyter/nbconvert";
+    changelog = "https://github.com/jupyter/nbconvert/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
+    maintainers = lib.teams.jupyter.members;
   };
 }

pkgs/development/python-modules/oauthenticator/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "oauthenticator";
-  version = "16.1.1";
+  version = "16.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Obv4MJvO7li+KqI2l6KxfxjpbZVD5KFJwjn/u+UtaQQ=";
+    hash = "sha256-z5CFFfVJYeXaDFVPYaBOfUMzgl+Uvn3LYS5Zn1AHRy0=";
   };
 
   postPatch = ''

pkgs/development/python-modules/prometheus-pandas/default.nix

@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "prometheus-pandas";
-  version = "0.3.2";
+  version = "0.3.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zysdlYPjvhextAfW4vvGN6mSPVUbWLV+AvQ1hGWCAbw=";
+    hash = "sha256-1eaTmNui3cAisKEhBMEpOv+UndJZwb4GGK2M76xiy7k=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/reolink-aio/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "reolink-aio";
-  version = "0.8.0";
+  version = "0.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "starkillerOG";
     repo = "reolink_aio";
     rev = "refs/tags/${version}";
-    hash = "sha256-HcEJwgb912NbRt2RTSNccluchWYBBqADi5LcW3mY8I4=";
+    hash = "sha256-zxIx7+cpYKN811yz+nxjtOagHOMMIs1YU0ZLN9q5T7M=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "sqlalchemy-jsonfield";
-  version = "1.0.1.post0+2023-04-24";
+  version = "1.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,8 +22,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "penguinolog";
     repo = "sqlalchemy_jsonfield";
-    rev = "a1efda9755055c1d382257fb4ef78006b713d07e";
-    hash = "sha256-6l4LEGpA8dKPw8M4quStd1nWyshMNiwQojBCxKwRRXA=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-4zLXB3UQh6pgQ80KrxkLeC5yiv1R8t2+JmSukmGXr7I=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";

pkgs/development/python-modules/taskw/default.nix

@@ -20,7 +20,11 @@ buildPythonPackage rec {
     hash = "sha256-EQm9+b3nqbMqUAejAsh4MD/2UYi2QiWsdKMomkxUi90=";
   };
 
-  patches = [ ./use-template-for-taskwarrior-install-path.patch ];
+  patches = [
+    ./use-template-for-taskwarrior-install-path.patch
+    # Remove when https://github.com/ralphbean/taskw/pull/151 is merged.
+    ./support-relative-path-in-taskrc.patch
+  ];
   postPatch = ''
     substituteInPlace taskw/warrior.py \
       --replace '@@taskwarrior@@' '${pkgs.taskwarrior}'

pkgs/development/python-modules/taskw/support-relative-path-in-taskrc.patch

@@ -0,0 +1,79 @@
+From 958b63ceec02b179482141cfb846ddbcae711a1b Mon Sep 17 00:00:00 2001
+From: Scott Mcdermott <scott@smemsh.net>
+Date: Sat, 28 Aug 2021 21:12:38 -0700
+Subject: [PATCH] RcFile: _read: try taskrc directory when trying to load
+ includes
+
+Taskwarrior itself tries includes as absolute path, then cwd, then
+relative to rcfile, then in various search paths (see
+GothenburgBitFactory/libshared -> src/Configuration.cpp ->
+Configuration::parse()).
+
+We won't try to duplicate that whole arrangement here, but at least look
+relative to the rcfile in addition to cwd/absolute, like taskwarrior
+does.  This will allow specification as relative path in most cases.
+Otherwise, we'd have to chdir anyways because includes are always tried
+as-is by taskw.  They would only work if specified as absolute paths or
+if in cwd
+
+We use a TaskRc() class variable to store the rcdir because there could
+be an include chain and all the instances will need to know the same
+one, but will be processing different paths, so we have to capture the
+directory of the first one processed, ie the base rcfile.
+
+Fixes #150
+
+Co-authored-by: Raito Bezarius <masterancpp@gmail.com>
+---
+ taskw/taskrc.py | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/taskw/taskrc.py b/taskw/taskrc.py
+index 1b6f8e5..b72dee6 100644
+--- a/taskw/taskrc.py
++++ b/taskw/taskrc.py
+@@ -1,5 +1,6 @@
+ import logging
+ import os
++import os.path
+ 
+ from taskw.fields import (
+     ChoiceField,
+@@ -39,6 +40,7 @@ class TaskRc(dict):
+ 
+     """
+ 
++    rcdir = None
+     UDA_TYPE_MAP = {
+         'date': DateField,
+         'duration': DurationField,
+@@ -54,6 +56,8 @@ class TaskRc(dict):
+                     path
+                 )
+             )
++            if not self.rcdir:
++                TaskRc.rcdir = os.path.dirname(os.path.realpath(self.path))
+             config = self._read(self.path)
+         else:
+             self.path = None
+@@ -92,6 +96,17 @@ class TaskRc(dict):
+ 
+     def _read(self, path):
+         config = {}
++        if not os.path.exists(path) and TaskRc.rcdir is not None:
++            # include path may be given relative to dir of rcfile
++            oldpath = path
++            path = os.path.join(TaskRc.rcdir, oldpath)
++            if not os.path.exists(path):
++                logger.error(
++                    "rcfile does not exist, tried %s and %s",
++                    oldpath, path
++                )
++                raise FileNotFoundError
++
+         with open(path, 'r') as config_file:
+             for raw_line in config_file.readlines():
+                 line = sanitize(raw_line)
+-- 
+2.42.0
+

pkgs/development/python-modules/toml-adapt/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "toml-adapt";
-  version = "0.2.11";
+  version = "0.2.12";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "firefly-cpp";
     repo = pname;
-    rev = version;
-    hash = "sha256-7gQZCjsCtzvmV5NPZNAW4d34TkKemH9FgeN0Iwydwgc=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-DtxA63lutgjGMH8GYz5r6IFEuuZ9iFGPGup960c4xgE=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/types-mock/default.nix

@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-mock";
-  version = "5.1.0.2";
+  version = "5.1.0.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3kjTdm5OMDTv2LJtqeCeSQjzHlMTel/i778fur7haZY=";
+    hash = "sha256-7urCVIAoe7ch+xf82i6XaNcKR23MFKLB0DiVNcVPgYQ=";
   };
 
   # Module has no tests