Merge master into haskell-updates

2026-09-28 02:40:50 +00:00 · 2023-05-21 00:13:25 +00:00
parent 5a130699b6 9ae541a3c2
commit 291c8ce17f
326 changed files with 8052 additions and 19087 deletions
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -10,7 +10,7 @@ Several versions of the Python interpreter are available on Nix, as well as a
 high amount of packages. The attribute `python3` refers to the default
 interpreter, which is currently CPython 3.10. The attribute `python` refers to
 CPython 2.7 for backwards-compatibility. It is also possible to refer to
-specific versions, e.g. `python39` refers to CPython 3.9, and `pypy` refers to
+specific versions, e.g. `python311` refers to CPython 3.11, and `pypy` refers to
 the default PyPy interpreter.

 Python is used a lot, and in different ways. This affects also how it is
@@ -26,10 +26,10 @@ however, are in separate sets, with one set per interpreter version.
 The interpreters have several common attributes. One of these attributes is
 `pkgs`, which is a package set of Python libraries for this specific
 interpreter. E.g., the `toolz` package corresponding to the default interpreter
-is `python.pkgs.toolz`, and the CPython 3.9 version is `python39.pkgs.toolz`.
+is `python.pkgs.toolz`, and the CPython 3.11 version is `python311.pkgs.toolz`.
 The main package set contains aliases to these package sets, e.g.
-`pythonPackages` refers to `python.pkgs` and `python39Packages` to
-`python39.pkgs`.
+`pythonPackages` refers to `python.pkgs` and `python311Packages` to
+`python311.pkgs`.

 #### Installing Python and packages {#installing-python-and-packages}

@@ -54,7 +54,7 @@ with `python.buildEnv` or `python.withPackages` where the interpreter and other
 executables are wrapped to be able to find each other and all of the modules.

 In the following examples we will start by creating a simple, ad-hoc environment
-with a nix-shell that has `numpy` and `toolz` in Python 3.9; then we will create
+with a nix-shell that has `numpy` and `toolz` in Python 3.11; then we will create
 a re-usable environment in a single-file Python script; then we will create a
 full Python environment for development with this same environment.

@@ -70,10 +70,10 @@ temporary shell session with a Python and a *precise* list of packages (plus
 their runtime dependencies), with no other Python packages in the Python
 interpreter's scope.

-To create a Python 3.9 session with `numpy` and `toolz` available, run:
+To create a Python 3.11 session with `numpy` and `toolz` available, run:

 ```sh
-$ nix-shell -p 'python39.withPackages(ps: with ps; [ numpy toolz ])'
+$ nix-shell -p 'python311.withPackages(ps: with ps; [ numpy toolz ])'
 ```

 By default `nix-shell` will start a `bash` session with this interpreter in our
@@ -81,8 +81,7 @@ By default `nix-shell` will start a `bash` session with this interpreter in our

 ```Python console
 [nix-shell:~/src/nixpkgs]$ python3
-Python 3.9.12 (main, Mar 23 2022, 21:36:19)
-[GCC 11.3.0] on linux
+Python 3.11.3 (main, Apr  4 2023, 22:36:41) [GCC 12.2.0] on linux
 Type "help", "copyright", "credits" or "license" for more information.
 >>> import numpy; import toolz
 ```
@@ -102,16 +101,12 @@ will still get 1 wrapped Python interpreter. We can start the interpreter
 directly like so:

 ```sh
-$ nix-shell -p "python39.withPackages (ps: with ps; [ numpy toolz requests ])" --run python3
+$ nix-shell -p "python311.withPackages (ps: with ps; [ numpy toolz requests ])" --run python3
 this derivation will be built:
-  /nix/store/mpn7k6bkjl41fm51342rafaqfsl10qs4-python3-3.9.12-env.drv
-this path will be fetched (0.09 MiB download, 0.41 MiB unpacked):
-  /nix/store/5gaiacnzi096b6prc6aa1pwrhncmhc8b-python3.9-toolz-0.11.2
-copying path '/nix/store/5gaiacnzi096b6prc6aa1pwrhncmhc8b-python3.9-toolz-0.11.2' from 'https://cache.nixos.org'...
-building '/nix/store/mpn7k6bkjl41fm51342rafaqfsl10qs4-python3-3.9.12-env.drv'...
-created 279 symlinks in user environment
-Python 3.9.12 (main, Mar 23 2022, 21:36:19)
-[GCC 11.3.0] on linux
+  /nix/store/r19yf5qgfiakqlhkgjahbg3zg79549n4-python3-3.11.2-env.drv
+building '/nix/store/r19yf5qgfiakqlhkgjahbg3zg79549n4-python3-3.11.2-env.drv'...
+created 273 symlinks in user environment
+Python 3.11.2 (main, Feb  7 2023, 13:52:42) [GCC 12.2.0] on linux
 Type "help", "copyright", "credits" or "license" for more information.
 >>> import requests
 >>>
@@ -150,7 +145,7 @@ Executing this script requires a `python3` that has `numpy`. Using what we learn
 in the previous section, we could startup a shell and just run it like so:

 ```ShellSession
-$ nix-shell -p 'python39.withPackages(ps: with ps; [ numpy ])' --run 'python3 foo.py'
+$ nix-shell -p 'python311.withPackages (ps: with ps; [ numpy ])' --run 'python3 foo.py'
 The dot product of [1 2] and [3 4] is: 11
 ```

@@ -190,17 +185,17 @@ can make it fully reproducible by pinning the `nixpkgs` import:

 ```python
 #!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p "python3.withPackages(ps: [ ps.numpy ])"
-#!nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/d373d80b1207d52621961b16aa4a3438e4f98167.tar.gz
+#!nix-shell -i python3 -p "python3.withPackages (ps: [ ps.numpy ])"
+#!nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/e51209796c4262bfb8908e3d6d72302fe4e96f5f.tar.gz
 import numpy as np
 a = np.array([1,2])
 b = np.array([3,4])
 print(f"The dot product of {a} and {b} is: {np.dot(a, b)}")
 ```

-This will execute with the exact same versions of Python 3.8, numpy, and system
+This will execute with the exact same versions of Python 3.10, numpy, and system
 dependencies a year from now as it does today, because it will always use
-exactly git commit `d373d80b1207d52621961b16aa4a3438e4f98167` of Nixpkgs for all
+exactly git commit `e51209796c4262bfb8908e3d6d72302fe4e96f5f` of Nixpkgs for all
 of the package versions.

 This is also a great way to ensure the script executes identically on different
@@ -213,12 +208,15 @@ create a single script with Python dependencies, but in the course of normal
 development we're usually working in an entire package repository.

 As explained in the Nix manual, `nix-shell` can also load an expression from a
-`.nix` file. Say we want to have Python 3.9, `numpy` and `toolz`, like before,
+`.nix` file. Say we want to have Python 3.11, `numpy` and `toolz`, like before,
 in an environment. We can add a `shell.nix` file describing our dependencies:

 ```nix
 with import <nixpkgs> {};
-(python39.withPackages (ps: [ps.numpy ps.toolz])).env
+(python311.withPackages (ps: with ps; [
+  numpy
+  toolz
+])).env
 ```

 And then at the command line, just typing `nix-shell` produces the same
@@ -232,7 +230,7 @@ What's happening here?
   imports the `<nixpkgs>` function, `{}` calls it and the `with` statement
   brings all attributes of `nixpkgs` in the local scope. These attributes form
   the main package set.
-2. Then we create a Python 3.9 environment with the `withPackages` function, as before.
+2. Then we create a Python 3.11 environment with the `withPackages` function, as before.
 3. The `withPackages` function expects us to provide a function as an argument
   that takes the set of all Python packages and returns a list of packages to
   include in the environment. Here, we select the packages `numpy` and `toolz`
@@ -243,7 +241,7 @@ To combine this with `mkShell` you can:
 ```nix
 with import <nixpkgs> {};
 let
-  pythonEnv = python39.withPackages (ps: [
+  pythonEnv = python311.withPackages (ps: [
    ps.numpy
    ps.toolz
  ]);
@@ -327,7 +325,7 @@ on NixOS.
 { # ...

  environment.systemPackages = with pkgs; [
-    (python38.withPackages(ps: with ps; [ numpy toolz ]))
+    (python310.withPackages(ps: with ps; [ numpy toolz ]))
  ];
 }
 ```
@@ -348,20 +346,32 @@ building Python libraries is `buildPythonPackage`. Let's see how we can build th
 `toolz` package.

 ```nix
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:

 buildPythonPackage rec {
  pname = "toolz";
  version = "0.10.0";
+  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
    hash = "sha256-CP3V73yWSArRHBLUct4hrNMjWZlvaaUlkpm1QP66RWA=";
  };

+  # has no tests
  doCheck = false;

+  pythonImportsCheck = [
+    "toolz.itertoolz"
+    "toolz.functoolz"
+    "toolz.dicttoolz"
+  ];
+
  meta = with lib; {
+    changelog = "https://github.com/pytoolz/toolz/releases/tag/${version}";
    homepage = "https://github.com/pytoolz/toolz";
    description = "List processing tools and functional utilities";
    license = licenses.bsd3;
@@ -376,13 +386,14 @@ arguments is the name of the package, which consists of a basename (generally
 following the name on PyPi) and a version. Another argument, `src` specifies the
 source, which in this case is fetched from PyPI using the helper function
 `fetchPypi`. The argument `doCheck` is used to set whether tests should be run
-when building the package. Furthermore, we specify some (optional) meta
+when building the package. Since there are no tests, we rely on `pythonImportsCheck`
+to test whether the package can be imported. Furthermore, we specify some meta
 information. The output of the function is a derivation.

 An expression for `toolz` can be found in the Nixpkgs repository. As explained
 in the introduction of this Python section, a derivation of `toolz` is available
-for each interpreter version, e.g. `python39.pkgs.toolz` refers to the `toolz`
-derivation corresponding to the CPython 3.9 interpreter.
+for each interpreter version, e.g. `python311.pkgs.toolz` refers to the `toolz`
+derivation corresponding to the CPython 3.11 interpreter.

 The above example works when you're directly working on
 `pkgs/top-level/python-packages.nix` in the Nixpkgs repository. Often though,
@@ -395,29 +406,35 @@ and adds it along with a `numpy` package to a Python environment.
 with import <nixpkgs> {};

 ( let
-    my_toolz = python39.pkgs.buildPythonPackage rec {
+    my_toolz = python311.pkgs.buildPythonPackage rec {
      pname = "toolz";
      version = "0.10.0";
+      format = "setuptools";

-      src = python39.pkgs.fetchPypi {
+      src = python311.pkgs.fetchPypi {
        inherit pname version;
        hash = "sha256-CP3V73yWSArRHBLUct4hrNMjWZlvaaUlkpm1QP66RWA=";
      };

+      # has no tests
      doCheck = false;

      meta = {
        homepage = "https://github.com/pytoolz/toolz/";
        description = "List processing tools and functional utilities";
+        # [...]
      };
    };

-  in python38.withPackages (ps: [ps.numpy my_toolz])
+  in python311.withPackages (ps: with ps; [
+    numpy
+    my_toolz
+  ])
 ).env
 ```

 Executing `nix-shell` will result in an environment in which you can use
-Python 3.9 and the `toolz` package. As you can see we had to explicitly mention
+Python 3.11 and the `toolz` package. As you can see we had to explicitly mention
 for which Python version we want to build a package.

 So, what did we do here? Well, we took the Nix expression that we used earlier
@@ -442,21 +459,39 @@ The following example shows which arguments are given to `buildPythonPackage` in
 order to build [`datashape`](https://github.com/blaze/datashape).

 ```nix
-{ lib, buildPythonPackage, fetchPypi, numpy, multipledispatch, python-dateutil, pytest }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# dependencies
+, numpy, multipledispatch, python-dateutil
+
+# tests
+, pytest
+}:

 buildPythonPackage rec {
  pname = "datashape";
  version = "0.4.7";
+  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
    hash = "sha256-FLLvdm1MllKrgTGC6Gb0k0deZeVYvtCCLji/B7uhong=";
  };

-  nativeCheckInputs = [ pytest ];
-  propagatedBuildInputs = [ numpy multipledispatch python-dateutil ];
+  propagatedBuildInputs = [
+    multipledispatch
+    numpy
+    python-dateutil
+  ];
+
+  nativeCheckInputs = [
+    pytest
+  ];

  meta = with lib; {
+    changelog = "https://github.com/blaze/datashape/releases/tag/${version}";
    homepage = "https://github.com/ContinuumIO/datashape";
    description = "A data description language";
    license = licenses.bsd2;
@@ -466,9 +501,9 @@ buildPythonPackage rec {
 ```

 We can see several runtime dependencies, `numpy`, `multipledispatch`, and
-`python-dateutil`. Furthermore, we have one `nativeCheckInputs`, i.e. `pytest`. `pytest` is a
-test runner and is only used during the `checkPhase` and is therefore not added
-to `propagatedBuildInputs`.
+`python-dateutil`. Furthermore, we have `nativeCheckInputs` with `pytest`.
+`pytest` is a test runner and is only used during the `checkPhase` and is
+therefore not added to `propagatedBuildInputs`.

 In the previous case we had only dependencies on other Python packages to consider.
 Occasionally you have also system libraries to consider. E.g., `lxml` provides
@@ -476,20 +511,29 @@ Python bindings to `libxml2` and `libxslt`. These libraries are only required
 when building the bindings and are therefore added as `buildInputs`.

 ```nix
-{ lib, pkgs, buildPythonPackage, fetchPypi }:
+{ lib
+, pkgs
+, buildPythonPackage
+, fetchPypi
+}:

 buildPythonPackage rec {
  pname = "lxml";
  version = "3.4.4";
+  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
    hash = "sha256-s9NiusRxFydHzaNRMjjxFcvWxfi45jGb9ql6eJJyQJk=";
  };

-  buildInputs = [ pkgs.libxml2 pkgs.libxslt ];
+  buildInputs = [
+    pkgs.libxml2
+    pkgs.libxslt
+  ];

  meta = with lib; {
+    changelog = "https://github.com/lxml/lxml/releases/tag/lxml-${version}";
    description = "Pythonic binding for the libxml2 and libxslt libraries";
    homepage = "https://lxml.de";
    license = licenses.bsd3;
@@ -509,30 +553,47 @@ The bindings don't expect to find each of them in a different folder, and
 therefore we have to set `LDFLAGS` and `CFLAGS`.

 ```nix
-{ lib, pkgs, buildPythonPackage, fetchPypi, numpy, scipy }:
+{ lib
+, pkgs
+, buildPythonPackage
+, fetchPypi
+
+# dependencies
+, numpy
+, scipy
+}:

 buildPythonPackage rec {
  pname = "pyFFTW";
  version = "0.9.2";
+  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
    hash = "sha256-9ru2r6kwhUCaskiFoaPNuJCfCVoUL01J40byvRt4kHQ=";
  };

-  buildInputs = [ pkgs.fftw pkgs.fftwFloat pkgs.fftwLongDouble];
+  buildInputs = [
+    pkgs.fftw
+    pkgs.fftwFloat
+    pkgs.fftwLongDouble
+  ];

-  propagatedBuildInputs = [ numpy scipy ];
-
-  # Tests cannot import pyfftw. pyfftw works fine though.
-  doCheck = false;
+  propagatedBuildInputs = [
+    numpy
+    scipy
+  ];

  preConfigure = ''
    export LDFLAGS="-L${pkgs.fftw.dev}/lib -L${pkgs.fftwFloat.out}/lib -L${pkgs.fftwLongDouble.out}/lib"
    export CFLAGS="-I${pkgs.fftw.dev}/include -I${pkgs.fftwFloat.dev}/include -I${pkgs.fftwLongDouble.dev}/include"
  '';

+  # Tests cannot import pyfftw. pyfftw works fine though.
+  doCheck = false;
+
  meta = with lib; {
+    changelog = "https://github.com/pyFFTW/pyFFTW/releases/tag/v${version}";
    description = "A pythonic wrapper around FFTW, the FFT library, presenting a unified interface for all the supported transforms";
    homepage = "http://hgomersall.github.com/pyFFTW";
    license = with licenses; [ bsd2 bsd3 ];
@@ -590,7 +651,7 @@ To filter tests using pytest, one can do the following:
  checkPhase = ''
    runHook preCheck

-    pytest tests/ --ignore=tests/integration -k 'not download and not update'
+    pytest tests/ --ignore=tests/integration -k 'not download and not update' --ignore=tests/test_failing.py

    runHook postCheck
  '';
@@ -618,10 +679,15 @@ when a package may need many items disabled to run the test suite.
 Using the example above, the analogous `pytestCheckHook` usage would be:

 ```
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];

  # requires additional data
-  pytestFlagsArray = [ "tests/" "--ignore=tests/integration" ];
+  pytestFlagsArray = [
+    "tests/"
+    "--ignore=tests/integration"
+  ];

  disabledTests = [
    # touches network
@@ -663,7 +729,10 @@ To help ensure the package still works, `pythonImportsCheck` can attempt to impo
 the listed modules.

 ```
-  pythonImportsCheck = [ "requests" "urllib" ];
+  pythonImportsCheck = [
+    "requests"
+    "urllib"
+  ];
 ```

 roughly translates to:
@@ -704,9 +773,16 @@ pkg3>=1.0,<=2.0
 we can do:

 ```
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-  pythonRelaxDeps = [ "pkg1" "pkg3" ];
-  pythonRemoveDeps = [ "pkg2" ];
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+  pythonRelaxDeps = [
+    "pkg1"
+    "pkg3"
+  ];
+  pythonRemoveDeps = [
+    "pkg2"
+  ];
 ```

 which would result in the following `requirements.txt` file:
@@ -749,9 +825,13 @@ with the exception of `other` (see `format` in
 `unittestCheckHook` is a hook which will substitute the setuptools `test` command for a `checkPhase` which runs `python -m unittest discover`:

 ```
-  nativeCheckInputs = [ unittestCheckHook ];
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];

-  unittestFlagsArray = [ "-s" "tests" "-v" ];
+  unittestFlagsArray = [
+    "-s" "tests" "-v"
+  ];
 ```

 #### Using sphinxHook {#using-sphinxhook}
@@ -816,7 +896,7 @@ If we create a `shell.nix` file which calls `buildPythonPackage`, and if `src`
 is a local source, and if the local source has a `setup.py`, then development
 mode is activated.

-In the following example, we create a simple environment that has a Python 3.9
+In the following example, we create a simple environment that has a Python 3.11
 version of our package in it, as well as its dependencies and other packages we
 like to have in the environment, all specified with `propagatedBuildInputs`.
 Indeed, we can just add any package we like to have in our environment to
@@ -824,12 +904,16 @@ Indeed, we can just add any package we like to have in our environment to

 ```nix
 with import <nixpkgs> {};
-with python39Packages;
+with python311Packages;

 buildPythonPackage rec {
  name = "mypackage";
  src = ./path/to/package/source;
-  propagatedBuildInputs = [ pytest numpy pkgs.libsndfile ];
+  propagatedBuildInputs = [
+    pytest
+    numpy
+    pkgs.libsndfile
+  ];
 }
 ```

@@ -857,11 +941,14 @@ Let's split the package definition from the environment definition.
 We first create a function that builds `toolz` in `~/path/to/toolz/release.nix`

 ```nix
-{ lib, buildPythonPackage }:
+{ lib
+, buildPythonPackage
+}:

 buildPythonPackage rec {
  pname = "toolz";
  version = "0.10.0";
+  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
@@ -869,6 +956,7 @@ buildPythonPackage rec {
  };

  meta = with lib; {
+    changelog = "https://github.com/pytoolz/toolz/releases/tag/${version}";
    homepage = "https://github.com/pytoolz/toolz/";
    description = "List processing tools and functional utilities";
    license = licenses.bsd3;
@@ -885,9 +973,13 @@ with import <nixpkgs> {};

 ( let
    toolz = callPackage /path/to/toolz/release.nix {
-      buildPythonPackage = python38Packages.buildPythonPackage;
+      buildPythonPackage = python310
+Packages.buildPythonPackage;
    };
-  in python38.withPackages (ps: [ ps.numpy toolz ])
+  in python310.withPackages (ps: [
+    ps.numpy
+    toolz
+  ])
 ).env
 ```

@@ -895,17 +987,17 @@ Important to remember is that the Python version for which the package is made
 depends on the `python` derivation that is passed to `buildPythonPackage`. Nix
 tries to automatically pass arguments when possible, which is why generally you
 don't explicitly define which `python` derivation should be used. In the above
-example we use `buildPythonPackage` that is part of the set `python38Packages`,
-and in this case the `python38` interpreter is automatically used.
+example we use `buildPythonPackage` that is part of the set `python3Packages`,
+and in this case the `python3` interpreter is automatically used.

 ## Reference {#reference}

 ### Interpreters {#interpreters}

-Versions 2.7, 3.7, 3.8, 3.9 and 3.10 of the CPython interpreter are available
-as respectively `python27`, `python37`, `python38`, `python39` and `python310`.
+Versions 2.7, 3.8, 3.9, 3.10 and 3.11 of the CPython interpreter are available
+as respectively `python27`, python38`, `python39`, `python310` and `python311`.
 The aliases `python2` and `python3` correspond to respectively `python27` and
-`python39`. The attribute `python` maps to `python2`. The PyPy interpreters
+`python310`. The attribute `python` maps to `python2`. The PyPy interpreters
 compatible with Python 2.7 and 3 are available as `pypy27` and `pypy3`, with
 aliases `pypy2` mapping to `pypy27` and `pypy` mapping to `pypy2`. The Nix
 expressions for the interpreters can be found in
@@ -928,7 +1020,7 @@ Each interpreter has the following attributes:
 - `buildEnv`. Function to build python interpreter environments with extra packages bundled together. See section *python.buildEnv function* for usage and documentation.
 - `withPackages`. Simpler interface to `buildEnv`. See section *python.withPackages function* for usage and documentation.
 - `sitePackages`. Alias for `lib/${libPrefix}/site-packages`.
- `executable`. Name of the interpreter executable, e.g. `python3.8`.
+- `executable`. Name of the interpreter executable, e.g. `python3.10`.
 - `pkgs`. Set of Python packages for that specific interpreter. The package set can be modified by overriding the interpreter and passing `packageOverrides`.

 ### Optimizations {#optimizations}
@@ -968,7 +1060,7 @@ attribute set is created for each available Python interpreter. The available
 sets are

 * `pkgs.python27Packages`
-* `pkgs.python37Packages`
+* `pkgs.python3Packages`
 * `pkgs.python38Packages`
 * `pkgs.python39Packages`
 * `pkgs.python310Packages`
@@ -978,7 +1070,7 @@ sets are
 and the aliases

 * `pkgs.python2Packages` pointing to `pkgs.python27Packages`
-* `pkgs.python3Packages` pointing to `pkgs.python39Packages`
+* `pkgs.python3Packages` pointing to `pkgs.python310Packages`
 * `pkgs.pythonPackages` pointing to `pkgs.python2Packages`

 #### `buildPythonPackage` function {#buildpythonpackage-function}
@@ -990,11 +1082,28 @@ using setup hooks.
 The following is an example:

 ```nix
-{ lib, buildPythonPackage, fetchPypi, hypothesis, setuptools-scm, attrs, py, setuptools, six, pluggy }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build-system
+, setuptools-scm
+
+# dependencies
+, attrs
+, pluggy
+, py
+, setuptools
+, six
+
+# tests
+, hypothesis
+ }:

 buildPythonPackage rec {
  pname = "pytest";
  version = "3.3.1";
+  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
@@ -1006,13 +1115,28 @@ buildPythonPackage rec {
    rm testing/test_argcomplete.py
  '';

-  nativeCheckInputs = [ hypothesis ];
-  nativeBuildInputs = [ setuptools-scm ];
-  propagatedBuildInputs = [ attrs py setuptools six pluggy ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    attrs
+    py
+    setuptools
+    six
+    pluggy
+  ];
+
+  nativeCheckInputs = [
+    hypothesis
+  ];

  meta = with lib; {
-    maintainers = with maintainers; [ domenkozar lovek323 madjar lsix ];
+    changelog = "https://github.com/pytest-dev/pytest/releases/tag/${version}";
    description = "Framework for writing tests";
+    homepage = "https://github.com/pytest-dev/pytest";
+    license = licenses.mit;
+    maintainers = with maintainers; [ domenkozar lovek323 madjar lsix ];
  };
 }
 ```
@@ -1114,7 +1238,7 @@ with import <nixpkgs> {};
    };
  in pkgs.python3.override {inherit packageOverrides; self = python;};

-in python.withPackages(ps: [ps.blaze])).env
+in python.withPackages(ps: [ ps.blaze ])).env
 ```

 #### Optional extra dependencies {#python-optional-dependencies}
@@ -1160,18 +1284,24 @@ called with `callPackage` and passed `python` or `pythonPackages` (possibly
 specifying an interpreter version), like this:

 ```nix
-{ lib, python3 }:
+{ lib
+, python3
+}:

 python3.pkgs.buildPythonApplication rec {
  pname = "luigi";
  version = "2.7.9";
+  format = "setuptools";

  src = python3.pkgs.fetchPypi {
    inherit pname version;
    hash  = "sha256-Pe229rT0aHwA98s+nTHQMEFKZPo/yw6sot8MivFDvAw=";
  };

-  propagatedBuildInputs = with python3.pkgs; [ tornado python-daemon ];
+  propagatedBuildInputs = with python3.pkgs; [
+    tornado
+    python-daemon
+  ];

  meta = with lib; {
    ...
@@ -1253,7 +1383,10 @@ running `nix-shell` with the following `shell.nix`
 with import <nixpkgs> {};

 (python3.buildEnv.override {
-  extraLibs = with python3Packages; [ numpy requests ];
+  extraLibs = with python3Packages; [
+    numpy
+    requests
+  ];
 }).env
 ```

@@ -1279,7 +1412,7 @@ example for the Pyramid Web Framework environment can be written like this:
 ```nix
 with import <nixpkgs> {};

-python.withPackages (ps: [ps.pyramid])
+python.withPackages (ps: [ ps.pyramid ])
 ```

 `withPackages` passes the correct package set for the specific interpreter
@@ -1289,7 +1422,7 @@ version as an argument to the function. In the above example, `ps` equals
 ```nix
 with import <nixpkgs> {};

-python3.withPackages (ps: [ps.pyramid])
+python3.withPackages (ps: [ ps.pyramid ])
 ```

 Now, `ps` is set to `python3Packages`, matching the version of the interpreter.
@@ -1301,7 +1434,10 @@ thus be also written like this:
 ```nix
 with import <nixpkgs> {};

-(python38.withPackages (ps: [ps.numpy ps.requests])).env
+(python3.withPackages (ps: with ps; [
+  numpy
+  requests
+])).env
 ```

 In contrast to `python.buildEnv`, `python.withPackages` does not support the
@@ -1393,7 +1529,7 @@ has security implications and is relevant for those using Python in a

 When the environment variable `DETERMINISTIC_BUILD` is set, all bytecode will
 have timestamp 1. The `buildPythonPackage` function sets `DETERMINISTIC_BUILD=1`
-and [PYTHONHASHSEED=0](https://docs.python.org/3.8/using/cmdline.html#envvar-PYTHONHASHSEED).
+and [PYTHONHASHSEED=0](https://docs.python.org/3.11/using/cmdline.html#envvar-PYTHONHASHSEED).
 Both are also exported in `nix-shell`.

 ### Automatic tests {#automatic-tests}
@@ -1408,22 +1544,27 @@ example of such a situation is when `py.test` is used.
 #### Common issues {#common-issues}

 * Non-working tests can often be deselected. By default `buildPythonPackage`
-  runs `python setup.py test`. Most Python modules follows the standard test
-  protocol where the pytest runner can be used instead. `py.test` supports a
-  `-k` parameter to ignore test methods or classes:
+  runs `python setup.py test`. which is deprecated. Most Python modules however
+  do follow the standard test protocol where the pytest runner can be used
+  instead. `pytest` supports the `-k` and `--ignore` parameters to ignore test
+  methods or classes as well as whole files. For `pytestCheckHook` these are
+  conveniently exposed as `disabledTests` and `disabledTestPaths` respectively.

  ```nix
  buildPythonPackage {
    # ...
-    # assumes the tests are located in tests
-    nativeCheckInputs = [ pytest ];
-    checkPhase = ''
-      runHook preCheck
+    nativeCheckInputs = [
+      pytestCheckHook
+    ];

-      py.test -k 'not function_name and not other_function' tests
+    disabledTests = [
+      "function_name"
+      "other_function"
+    ];

-      runHook postCheck
-    '';
+    disabledTestPaths = [
+      "this/file.py"
+    ];
  }
  ```

@@ -1451,9 +1592,13 @@ with import <nixpkgs> {};
    packageOverrides = self: super: {
      pandas = super.pandas.overridePythonAttrs(old: {name="foo";});
    };
-  in pkgs.python38.override {inherit packageOverrides;};
+  in pkgs.python310.override {
+    inherit packageOverrides;
+  };

-in python.withPackages(ps: [ps.pandas])).env
+in python.withPackages (ps: [
+  ps.pandas
+])).env
 ```

 Using `nix-build` on this expression will build an environment that contains the
@@ -1473,7 +1618,11 @@ with import <nixpkgs> {};
    packageOverrides = self: super: {
      scipy = super.scipy_0_17;
    };
-  in (pkgs.python38.override {inherit packageOverrides;}).withPackages (ps: [ps.blaze])
+  in (pkgs.python310.override {
+    inherit packageOverrides;
+  }).withPackages (ps: [
+    ps.blaze
+  ])
 ).env
 ```

@@ -1487,11 +1636,11 @@ If you want the whole of Nixpkgs to use your modifications, then you can use
 let
  pkgs = import <nixpkgs> {};
  newpkgs = import pkgs.path { overlays = [ (self: super: {
-    python38 = let
+    python310 = let
      packageOverrides = python-self: python-super: {
        numpy = python-super.numpy_1_18;
      };
-    in super.python38.override {inherit packageOverrides;};
+    in super.python310.override {inherit packageOverrides;};
  } ) ]; };
 in newpkgs.inkscape
 ```
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -1204,7 +1204,7 @@ Nix itself considers a build-time dependency as merely something that should pre

 In order to alleviate this burden, the setup hook mechanism was written, where any package can include a shell script that \[by convention rather than enforcement by Nix\], any downstream reverse-dependency will source as part of its build process. That allows the downstream dependency to merely specify its dependencies, and lets those dependencies effectively initialize themselves. No boilerplate mirroring the list of dependencies is needed.

-The setup hook mechanism is a bit of a sledgehammer though: a powerful feature with a broad and indiscriminate area of effect. The combination of its power and implicit use may be expedient, but isn’t without costs. Nix itself is unchanged, but the spirit of added dependencies being effect-free is violated even if the letter isn’t. For example, if a derivation path is mentioned more than once, Nix itself doesn’t care and simply makes sure the dependency derivation is already built just the same—depending is just needing something to exist, and needing is idempotent. However, a dependency specified twice will have its setup hook run twice, and that could easily change the build environment (though a well-written setup hook will therefore strive to be idempotent so this is in fact not observable). More broadly, setup hooks are anti-modular in that multiple dependencies, whether the same or different, should not interfere and yet their setup hooks may well do so.
+The setup hook mechanism is a bit of a sledgehammer though: a powerful feature with a broad and indiscriminate area of effect. The combination of its power and implicit use may be expedient, but isn’t without costs. Nix itself is unchanged, but the spirit of added dependencies being effect-free is violated even if the latter isn’t. For example, if a derivation path is mentioned more than once, Nix itself doesn’t care and simply makes sure the dependency derivation is already built just the same—depending is just needing something to exist, and needing is idempotent. However, a dependency specified twice will have its setup hook run twice, and that could easily change the build environment (though a well-written setup hook will therefore strive to be idempotent so this is in fact not observable). More broadly, setup hooks are anti-modular in that multiple dependencies, whether the same or different, should not interfere and yet their setup hooks may well do so.

 The most typical use of the setup hook is actually to add other hooks which are then run (i.e. after all the setup hooks) on each dependency. For example, the C compiler wrapper’s setup hook feeds itself flags for each dependency that contains relevant libraries and headers. This is done by defining a bash function, and appending its name to one of `envBuildBuildHooks`, `envBuildHostHooks`, `envBuildTargetHooks`, `envHostHostHooks`, `envHostTargetHooks`, or `envTargetTargetHooks`. These 6 bash variables correspond to the 6 sorts of dependencies by platform (there’s 12 total but we ignore the propagated/non-propagated axis).

--- a/lib/generators.nix
+++ b/lib/generators.nix
@@ -431,7 +431,7 @@ ${expr "" v}

  /*
   Translate a simple Nix expression to Lua representation with occasional
-   Lua-inlines that can be construted by mkLuaInline function.
+   Lua-inlines that can be constructed by mkLuaInline function.

   Configuration:
     * multiline - by default is true which results in indented block-like view.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11246,6 +11246,12 @@
    githubId = 17120571;
    name = "Xinhao Luo";
  };
+  nevivurn = {
+    email = "nevivurn@nevi.dev";
+    github = "nevivurn";
+    githubId = 7698349;
+    name = "Yongun Seong";
+  };
  newam = {
    email = "alex@thinglab.org";
    github = "newAM";
@@ -14329,9 +14335,11 @@
    name = "Scott Hamilton";
  };
  ShamrockLee = {
-    name = "Shamrock Lee";
+    email = "shamrocklee@posteo.net";
    github = "ShamrockLee";
    githubId = 44064051;
+    matrix = "@shamrocklee:matrix.org";
+    name = "Yueh-Shun Li";
  };
  shanesveller = {
    email = "shane@sveller.dev";
--- a/nixos/doc/manual/manpages/README.md
+++ b/nixos/doc/manual/manpages/README.md
@@ -17,7 +17,7 @@ In any manpage, commands, flags and arguments to the *current* executable should
 - Use `Cm` to mark literal string arguments, e.g. the `boot` command argument passed to `nixos-rebuild`.
 - Optional flags or arguments should be marked with `Op`. This includes optional repeating arguments.
 - Required flags or arguments should not be marked.
- - Mutually exclusive groups of arguments should be enclosed in curly brackets, preferrably created with `Bro`/`Brc` blocks.
+ - Mutually exclusive groups of arguments should be enclosed in curly brackets, preferably created with `Bro`/`Brc` blocks.

 When an argument is used in an example it should be marked up with `Ar` again to differentiate it from a constant. For example, a command with a `--host name` flag that calls ssh to retrieve the host's local time would signify this thusly:
 ```
@@ -45,7 +45,7 @@ Larger code blocks or those that cannot be shown inline should use indented lite
 ...
 .Ed
 ```
-Contents of code blocks may be marked up further, e.g. if they refer to arguments that will be subsituted into them:
+Contents of code blocks may be marked up further, e.g. if they refer to arguments that will be substituted into them:
 ```
 .Bd -literal -offset indent
 {
--- a/nixos/doc/manual/release-notes/rl-1609.section.md
+++ b/nixos/doc/manual/release-notes/rl-1609.section.md
@@ -20,7 +20,7 @@ When upgrading from a previous release, please be aware of the following incompa

 - A large number of packages have been converted to use the multiple outputs feature of Nix to greatly reduce the amount of required disk space, as mentioned above. This may require changes to any custom packages to make them build again; see the relevant chapter in the Nixpkgs manual for more information. (Additional caveat to packagers: some packaging conventions related to multiple-output packages [were changed](https://github.com/NixOS/nixpkgs/pull/14766) late (August 2016) in the release cycle and differ from the initial introduction of multiple outputs.)

- Previous versions of Nixpkgs had support for all versions of the LTS Haskell package set. That support has been dropped. The previously provided `haskell.packages.lts-x_y` package sets still exist in name to aviod breaking user code, but these package sets don't actually contain the versions mandated by the corresponding LTS release. Instead, our package set it loosely based on the latest available LTS release, i.e. LTS 7.x at the time of this writing. New releases of NixOS and Nixpkgs will drop those old names entirely. [The motivation for this change](https://nixos.org/nix-dev/2016-June/020585.html) has been discussed at length on the `nix-dev` mailing list and in [Github issue \#14897](https://github.com/NixOS/nixpkgs/issues/14897). Development strategies for Haskell hackers who want to rely on Nix and NixOS have been described in [another nix-dev article](https://nixos.org/nix-dev/2016-June/020642.html).
+- Previous versions of Nixpkgs had support for all versions of the LTS Haskell package set. That support has been dropped. The previously provided `haskell.packages.lts-x_y` package sets still exist in name to avoid breaking user code, but these package sets don't actually contain the versions mandated by the corresponding LTS release. Instead, our package set it loosely based on the latest available LTS release, i.e. LTS 7.x at the time of this writing. New releases of NixOS and Nixpkgs will drop those old names entirely. [The motivation for this change](https://nixos.org/nix-dev/2016-June/020585.html) has been discussed at length on the `nix-dev` mailing list and in [Github issue \#14897](https://github.com/NixOS/nixpkgs/issues/14897). Development strategies for Haskell hackers who want to rely on Nix and NixOS have been described in [another nix-dev article](https://nixos.org/nix-dev/2016-June/020642.html).

 - Shell aliases for systemd sub-commands [were dropped](https://github.com/NixOS/nixpkgs/pull/15598): `start`, `stop`, `restart`, `status`.

@@ -28,7 +28,7 @@ When upgrading from a previous release, please be aware of the following incompa

 - `/var/empty` is now immutable. Activation script runs `chattr +i` to forbid any modifications inside the folder. See [ the pull request](https://github.com/NixOS/nixpkgs/pull/18365) for what bugs this caused.

- Gitlab's maintainance script `gitlab-runner` was removed and split up into the more clearer `gitlab-run` and `gitlab-rake` scripts, because `gitlab-runner` is a component of Gitlab CI.
+- Gitlab's maintenance script `gitlab-runner` was removed and split up into the more clearer `gitlab-run` and `gitlab-rake` scripts, because `gitlab-runner` is a component of Gitlab CI.

 - `services.xserver.libinput.accelProfile` default changed from `flat` to `adaptive`, as per [ official documentation](https://wayland.freedesktop.org/libinput/doc/latest/group__config.html#gad63796972347f318b180e322e35cee79).

--- a/nixos/doc/manual/release-notes/rl-1709.section.md
+++ b/nixos/doc/manual/release-notes/rl-1709.section.md
@@ -275,7 +275,7 @@ When upgrading from a previous release, please be aware of the following incompa

  You can check that backups still work by running `systemctl start mysql-backup` then `systemctl status mysql-backup`.

- Templated systemd services e.g `container@name` are now handled currectly when switching to a new configuration, resulting in them being reloaded.
+- Templated systemd services e.g `container@name` are now handled correctly when switching to a new configuration, resulting in them being reloaded.

 - Steam: the `newStdcpp` parameter was removed and should not be needed anymore.

--- a/nixos/doc/manual/release-notes/rl-1803.section.md
+++ b/nixos/doc/manual/release-notes/rl-1803.section.md
@@ -174,7 +174,7 @@ When upgrading from a previous release, please be aware of the following incompa

 - The `openssh` package now includes Kerberos support by default; the `openssh_with_kerberos` package is now a deprecated alias. If you do not want Kerberos support, you can do `openssh.override { withKerberos = false; }`. Note, this also applies to the `openssh_hpn` package.

- `cc-wrapper` has been split in two; there is now also a `bintools-wrapper`. The most commonly used files in `nix-support` are now split between the two wrappers. Some commonly used ones, like `nix-support/dynamic-linker`, are duplicated for backwards compatability, even though they rightly belong only in `bintools-wrapper`. Other more obscure ones are just moved.
+- `cc-wrapper` has been split in two; there is now also a `bintools-wrapper`. The most commonly used files in `nix-support` are now split between the two wrappers. Some commonly used ones, like `nix-support/dynamic-linker`, are duplicated for backwards compatibility, even though they rightly belong only in `bintools-wrapper`. Other more obscure ones are just moved.

 - The propagation logic has been changed. The new logic, along with new types of dependencies that go with, is thoroughly documented in the "Specifying dependencies" section of the "Standard Environment" chapter of the nixpkgs manual. The old logic isn't but is easy to describe: dependencies were propagated as the same type of dependency no matter what. In practice, that means that many `propagatedNativeBuildInputs` should instead be `propagatedBuildInputs`. Thankfully, that was and is the least used type of dependency. Also, it means that some `propagatedBuildInputs` should instead be `depsTargetTargetPropagated`. Other types dependencies should be unaffected.

--- a/nixos/doc/manual/release-notes/rl-1903.section.md
+++ b/nixos/doc/manual/release-notes/rl-1903.section.md
@@ -81,7 +81,7 @@ When upgrading from a previous release, please be aware of the following incompa

  The slurmctld now runs as user `slurm` instead of `root`. If you want to keep slurmctld running as `root`, set `services.slurm.user = root`.

-  The options `services.slurm.nodeName` and `services.slurm.partitionName` are now sets of strings to correctly reflect that fact that each of these options can occour more than once in the configuration.
+  The options `services.slurm.nodeName` and `services.slurm.partitionName` are now sets of strings to correctly reflect that fact that each of these options can occur more than once in the configuration.

 - The `solr` package has been upgraded from 4.10.3 to 7.5.0 and has undergone some major changes. The `services.solr` module has been updated to reflect these changes. Please review http://lucene.apache.org/solr/ carefully before upgrading.

@@ -91,7 +91,7 @@ When upgrading from a previous release, please be aware of the following incompa

 - Network interface indiscriminate NixOS firewall options (`networking.firewall.allow*`) are now preserved when also setting interface specific rules such as `networking.firewall.interfaces.en0.allow*`. These rules continue to use the pseudo device "default" (`networking.firewall.interfaces.default.*`), and assigning to this pseudo device will override the (`networking.firewall.allow*`) options.

- The `nscd` service now disables all caching of `passwd` and `group` databases by default. This was interferring with the correct functioning of the `libnss_systemd.so` module which is used by `systemd` to manage uids and usernames in the presence of `DynamicUser=` in systemd services. This was already the default behaviour in presence of `services.sssd.enable = true` because nscd caching would interfere with `sssd` in unpredictable ways as well. Because we're using nscd not for caching, but for convincing glibc to find NSS modules in the nix store instead of an absolute path, we have decided to disable caching globally now, as it's usually not the behaviour the user wants and can lead to surprising behaviour. Furthermore, negative caching of host lookups is also disabled now by default. This should fix the issue of dns lookups failing in the presence of an unreliable network.
+- The `nscd` service now disables all caching of `passwd` and `group` databases by default. This was interfering with the correct functioning of the `libnss_systemd.so` module which is used by `systemd` to manage uids and usernames in the presence of `DynamicUser=` in systemd services. This was already the default behaviour in presence of `services.sssd.enable = true` because nscd caching would interfere with `sssd` in unpredictable ways as well. Because we're using nscd not for caching, but for convincing glibc to find NSS modules in the nix store instead of an absolute path, we have decided to disable caching globally now, as it's usually not the behaviour the user wants and can lead to surprising behaviour. Furthermore, negative caching of host lookups is also disabled now by default. This should fix the issue of dns lookups failing in the presence of an unreliable network.

  If the old behaviour is desired, this can be restored by setting the `services.nscd.config` option with the desired caching parameters.

@@ -135,7 +135,7 @@ When upgrading from a previous release, please be aware of the following incompa

 - GitLab Shell previously used the nix store paths for the `gitlab-shell` command in its `authorized_keys` file, which might stop working after garbage collection. To circumvent that, we regenerated that file on each startup. As `gitlab-shell` has now been changed to use `/var/run/current-system/sw/bin/gitlab-shell`, this is not necessary anymore, but there might be leftover lines with a nix store path. Regenerate the `authorized_keys` file via `sudo -u git -H gitlab-rake gitlab:shell:setup` in that case.

- The `pam_unix` account module is now loaded with its control field set to `required` instead of `sufficient`, so that later PAM account modules that might do more extensive checks are being executed. Previously, the whole account module verification was exited prematurely in case a nss module provided the account name to `pam_unix`. The LDAP and SSSD NixOS modules already add their NSS modules when enabled. In case your setup breaks due to some later PAM account module previosuly shadowed, or failing NSS lookups, please file a bug. You can get back the old behaviour by manually setting `security.pam.services.<name?>.text`.
+- The `pam_unix` account module is now loaded with its control field set to `required` instead of `sufficient`, so that later PAM account modules that might do more extensive checks are being executed. Previously, the whole account module verification was exited prematurely in case a nss module provided the account name to `pam_unix`. The LDAP and SSSD NixOS modules already add their NSS modules when enabled. In case your setup breaks due to some later PAM account module previously shadowed, or failing NSS lookups, please file a bug. You can get back the old behaviour by manually setting `security.pam.services.<name?>.text`.

 - The `pam_unix` password module is now loaded with its control field set to `sufficient` instead of `required`, so that password managed only by later PAM password modules are being executed. Previously, for example, changing an LDAP account's password through PAM was not possible: the whole password module verification was exited prematurely by `pam_unix`, preventing `pam_ldap` to manage the password as it should.

--- a/nixos/doc/manual/release-notes/rl-1909.section.md
+++ b/nixos/doc/manual/release-notes/rl-1909.section.md
@@ -194,7 +194,7 @@ When upgrading from a previous release, please be aware of the following incompa

  `security.acme.preDelay` and `security.acme.activationDelay` options have been removed. To execute a service before certificates are provisioned or renewed add a `RequiredBy=acme-${cert}.service` to any service.

-  Furthermore, the acme module will not automatically add a dependency on `lighttpd.service` anymore. If you are using certficates provided by letsencrypt for lighttpd, then you should depend on the certificate service `acme-${cert}.service>` manually.
+  Furthermore, the acme module will not automatically add a dependency on `lighttpd.service` anymore. If you are using certificates provided by letsencrypt for lighttpd, then you should depend on the certificate service `acme-${cert}.service>` manually.

  For nginx, the dependencies are still automatically managed when `services.nginx.virtualhosts.<name>.enableACME` is enabled just like before. What changed is that nginx now directly depends on the specific certificates that it needs, instead of depending on the catch-all `acme-certificates.target`. This target unit was also removed from the codebase. This will mean nginx will no longer depend on certificates it isn't explicitly managing and fixes a bug with certificate renewal ordering racing with nginx restarting which could lead to nginx getting in a broken state as described at [NixOS/nixpkgs\#60180](https://github.com/NixOS/nixpkgs/issues/60180).

--- a/nixos/doc/manual/release-notes/rl-2009.section.md
+++ b/nixos/doc/manual/release-notes/rl-2009.section.md
@@ -130,7 +130,7 @@ In addition to 1119 new, 118 updated, and 476 removed options; 61 new modules we

  - [services.cage.enable](options.html#opt-services.cage.enable) Wayland cage service

-  - [services.convos.enable](options.html#opt-services.convos.enable) IRC daemon, which can be accessed throught the browser
+  - [services.convos.enable](options.html#opt-services.convos.enable) IRC daemon, which can be accessed through the browser

  - [services.engelsystem.enable](options.html#opt-services.engelsystem.enable) Tool for coordinating volunteers and shifts on large events

@@ -552,7 +552,7 @@ When upgrading from a previous release, please be aware of the following incompa

 - The [jellyfin](options.html#opt-services.jellyfin.enable) module will use and stay on the Jellyfin version `10.5.5` if `stateVersion` is lower than `20.09`. This is because significant changes were made to the database schema, and it is highly recommended to backup your instance before upgrading. After making your backup, you can upgrade to the latest version either by setting your `stateVersion` to `20.09` or higher, or set the `services.jellyfin.package` to `pkgs.jellyfin`. If you do not wish to upgrade Jellyfin, but want to change your `stateVersion`, you can set the value of `services.jellyfin.package` to `pkgs.jellyfin_10_5`.

- The `security.rngd` service is now disabled by default. This choice was made because there's krngd in the linux kernel space making it (for most usecases) functionally redundent.
+- The `security.rngd` service is now disabled by default. This choice was made because there's krngd in the linux kernel space making it (for most usecases) functionally redundant.

 - The `hardware.nvidia.optimus_prime.enable` service has been renamed to `hardware.nvidia.prime.sync.enable` and has many new enhancements. Related nvidia prime settings may have also changed.

--- a/nixos/doc/manual/release-notes/rl-2105.section.md
+++ b/nixos/doc/manual/release-notes/rl-2105.section.md
@@ -197,7 +197,7 @@ When upgrading from a previous release, please be aware of the following incompa

  Android packages are now loaded from a repo.json file created by parsing Android repo XML files. The arguments `repoJson` and `repoXmls` have been added to allow overriding the built-in androidenv repo.json with your own. Additionally, license files are now written to allow compatibility with Gradle-based tools, and the `extraLicenses` argument has been added to accept more SDK licenses if your project requires it. See the androidenv documentation for more details.

- The attribute `mpi` is now consistently used to provide a default, system-wide MPI implementation. The default implementation is openmpi, which has been used before by all derivations affects by this change. Note that all packages that have used `mpi ? null` in the input for optional MPI builds, have been changed to the boolean input paramater `useMpi` to enable building with MPI. Building all packages with `mpich` instead of the default `openmpi` can now be achived like this:
+- The attribute `mpi` is now consistently used to provide a default, system-wide MPI implementation. The default implementation is openmpi, which has been used before by all derivations affects by this change. Note that all packages that have used `mpi ? null` in the input for optional MPI builds, have been changed to the boolean input parameter `useMpi` to enable building with MPI. Building all packages with `mpich` instead of the default `openmpi` can now be achieved like this:

  ```nix
  self: super:
@@ -272,7 +272,7 @@ When upgrading from a previous release, please be aware of the following incompa

 - `environment.defaultPackages` now includes the nano package. If pkgs.nano is not added to the list, make sure another editor is installed and the `EDITOR` environment variable is set to it. Environment variables can be set using `environment.variables`.

- `services.minio.dataDir` changed type to a list of paths, required for specifiyng multiple data directories for using with erasure coding. Currently, the service doesn't enforce nor checks the correct number of paths to correspond to minio requirements.
+- `services.minio.dataDir` changed type to a list of paths, required for specifying multiple data directories for using with erasure coding. Currently, the service doesn't enforce nor checks the correct number of paths to correspond to minio requirements.

 - All CUDA toolkit versions prior to CUDA 10 have been removed.

@@ -375,7 +375,7 @@ When upgrading from a previous release, please be aware of the following incompa

 - When defining a new user, one of [users.users._name_.isNormalUser](options.html#opt-users.users._name_.isNormalUser) and [users.users._name_.isSystemUser](options.html#opt-users.users._name_.isSystemUser) is now required. This is to prevent accidentally giving a UID above 1000 to system users, which could have unexpected consequences, like running user activation scripts for system users. Note that users defined with an explicit UID below 500 are exempted from this check, as [users.users._name_.isSystemUser](options.html#opt-users.users._name_.isSystemUser) has no effect for those.

- The `security.apparmor` module, for the [AppArmor](https://gitlab.com/apparmor/apparmor/-/wikis/Documentation) Mandatory Access Control system, has been substantialy improved along with related tools, so that module maintainers can now more easily write AppArmor profiles for NixOS. The most notable change on the user-side is the new option [security.apparmor.policies](options.html#opt-security.apparmor.policies), replacing the previous `profiles` option to provide a way to disable a profile and to select whether to confine in enforce mode (default) or in complain mode (see `journalctl -b --grep apparmor`). Security-minded users may also want to enable [security.apparmor.killUnconfinedConfinables](options.html#opt-security.apparmor.killUnconfinedConfinables), at the cost of having some of their processes killed when updating to a NixOS version introducing new AppArmor profiles.
+- The `security.apparmor` module, for the [AppArmor](https://gitlab.com/apparmor/apparmor/-/wikis/Documentation) Mandatory Access Control system, has been substantially improved along with related tools, so that module maintainers can now more easily write AppArmor profiles for NixOS. The most notable change on the user-side is the new option [security.apparmor.policies](options.html#opt-security.apparmor.policies), replacing the previous `profiles` option to provide a way to disable a profile and to select whether to confine in enforce mode (default) or in complain mode (see `journalctl -b --grep apparmor`). Security-minded users may also want to enable [security.apparmor.killUnconfinedConfinables](options.html#opt-security.apparmor.killUnconfinedConfinables), at the cost of having some of their processes killed when updating to a NixOS version introducing new AppArmor profiles.

 - The GNOME desktop manager once again installs gnome.epiphany by default.

--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -375,7 +375,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `programs.neovim.runtime` switched to a `linkFarm` internally, making it impossible to use wildcards in the `source` argument.

- The `openrazer` and `openrazer-daemon` packages as well as the `hardware.openrazer` module now require users to be members of the `openrazer` group instead of `plugdev`. With this change, users no longer need be granted the entire set of `plugdev` group permissions, which can include permissions other than those required by `openrazer`. This is desirable from a security point of view. The setting [`harware.openrazer.users`](options.html#opt-services.hardware.openrazer.users) can be used to add users to the `openrazer` group.
+- The `openrazer` and `openrazer-daemon` packages as well as the `hardware.openrazer` module now require users to be members of the `openrazer` group instead of `plugdev`. With this change, users no longer need be granted the entire set of `plugdev` group permissions, which can include permissions other than those required by `openrazer`. This is desirable from a security point of view. The setting [`hardware.openrazer.users`](options.html#opt-services.hardware.openrazer.users) can be used to add users to the `openrazer` group.

 - The fontconfig service's dpi option has been removed.
  Fontconfig should use Xft settings by default so there's no need to override one value in multiple places.
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -10,7 +10,7 @@ In addition to numerous new and upgraded packages, this release has the followin
  for Flakes, but also marks the `nix` command as experimental which now has to
  be enabled via the configuration explicitly. For more information and
  instructions for upgrades, see the
-  relase notes for [nix-2.4](https://nixos.org/manual/nix/stable/release-notes/rl-2.4.html),
+  release notes for [nix-2.4](https://nixos.org/manual/nix/stable/release-notes/rl-2.4.html),
  [nix-2.5](https://nixos.org/manual/nix/stable/release-notes/rl-2.5.html),
  [nix-2.6](https://nixos.org/manual/nix/stable/release-notes/rl-2.6.html),
  [nix-2.7](https://nixos.org/manual/nix/stable/release-notes/rl-2.7.html) and
@@ -278,11 +278,11 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `openldap` (and therefore the slapd LDAP server) were updated to version 2.6.2. The project introduced backwards-incompatible changes, namely the removal of the bdb, hdb, ndb, and shell backends in slapd. Therefore before updating, dump your database `slapcat -n 1` in LDIF format, and reimport it after updating your `services.openldap.settings`, which represents your `cn=config`.

-  Additionally with 2.5 the argon2 module was included in the standard distrubtion and renamed from `pw-argon2` to `argon2`. Remember to update your `olcModuleLoad` entry in `cn=config`.
+  Additionally with 2.5 the argon2 module was included in the standard distribution and renamed from `pw-argon2` to `argon2`. Remember to update your `olcModuleLoad` entry in `cn=config`.

 - `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface.

- `git` no longer hardcodes the path to openssh' ssh binary to reduce the amount of rebuilds. If you are using git with ssh remotes and do not have a ssh binary in your enviroment consider adding `openssh` to it or switching to `gitFull`.
+- `git` no longer hardcodes the path to openssh' ssh binary to reduce the amount of rebuilds. If you are using git with ssh remotes and do not have a ssh binary in your environment consider adding `openssh` to it or switching to `gitFull`.

 - `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.
  This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration.
@@ -639,7 +639,7 @@ In addition to numerous new and upgraded packages, this release has the followin
  changes in the database scheme and configuration format.

 - Some top-level settings under [services.epgstation](#opt-services.epgstation.enable)
-  is now deprecated because it was redudant due to the same options being
+  is now deprecated because it was redundant due to the same options being
  present in [services.epgstation.settings](#opt-services.epgstation.settings).

 - The option `services.epgstation.basicAuth` was removed because basic
@@ -653,7 +653,7 @@ In addition to numerous new and upgraded packages, this release has the followin
  option now expects options for `config.yml` in EPGStation v2.

 - Existing data for the [services.epgstation](#opt-services.epgstation.enable)
-  module would have to be backed up prior to the upgrade. To back up exising
+  module would have to be backed up prior to the upgrade. To back up existing
  data to `/tmp/epgstation.bak`, run
  `sudo -u epgstation epgstation run backup /tmp/epgstation.bak`.
  To import that data after to the upgrade, run
@@ -804,7 +804,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 - The `influxdb2` package was split into `influxdb2-server` and
  `influxdb2-cli`, matching the split that took place upstream. A
  combined `influxdb2` package is still provided in this release for
-  backwards compatibilty, but will be removed at a later date.
+  backwards compatibility, but will be removed at a later date.

 - The `unifi` package was switched from `unifi6` to `unifi7`.
  Direct downgrades from Unifi 7 to Unifi 6 are not possible and require restoring from a backup made by Unifi 6.
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -205,7 +205,7 @@ In addition to numerous new and upgraded packages, this release includes the fol

 - Linux 4.9 has been removed because it will reach its end of life within the lifespan of 22.11.

- (Neo)Vim can not be configured with `configure.pathogen` anymore to reduce maintainance burden.
+- (Neo)Vim can not be configured with `configure.pathogen` anymore to reduce maintenance burden.
  Use `configure.packages` instead.
 - Neovim can not be configured with plug anymore (still works for vim).

@@ -221,7 +221,7 @@ In addition to numerous new and upgraded packages, this release includes the fol

 - `mysql57` has been removed. Please update to `mysql80` or `mariadb`. See the [upgrade guide](https://mariadb.com/kb/en/upgrading-from-mysql-to-mariadb/) for more information.

- Consequently, `cqrlog` and `amorok` now use `mariadb` instead of `mysql57` for their embedded databases. Running `mysql_upgrade` may be neccesary.
+- Consequently, `cqrlog` and `amorok` now use `mariadb` instead of `mysql57` for their embedded databases. Running `mysql_upgrade` may be necessary.
 - `k3s` supports `clusterInit` option, and it is enabled by default, for servers.

 - `percona-server56` has been removed. Please migrate to `mysql` or `mariadb` if possible.
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -72,7 +72,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [stevenblack-blocklist](https://github.com/StevenBlack/hosts), A unified hosts file with base extensions for blocking unwanted websites. Available as [networking.stevenblack](options.html#opt-networking.stevenblack.enable).

- [Budgie Desktop](https://github.com/BuddiesOfBudgie/budgie-desktop), a familiar, modern desktop environment. Availabe as [services.xserver.desktopManager.budgie](options.html#opt-services.xserver.desktopManager.budgie).
+- [Budgie Desktop](https://github.com/BuddiesOfBudgie/budgie-desktop), a familiar, modern desktop environment. Available as [services.xserver.desktopManager.budgie](options.html#opt-services.xserver.desktopManager.budgie).

 - [imaginary](https://github.com/h2non/imaginary), a microservice for high-level image processing that Nextcloud can use to generate previews. Available as [services.imaginary](#opt-services.imaginary.enable).

@@ -88,7 +88,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [alertmanager-irc-relay](https://github.com/google/alertmanager-irc-relay), a Prometheus Alertmanager IRC Relay. Available as [services.prometheus.alertmanagerIrcRelay](options.html#opt-services.prometheus.alertmanagerIrcRelay.enable).

- [tts](https://github.com/coqui-ai/TTS), a battle-tested deep learning toolkit for Text-to-Speech. Mutiple servers may be configured below [services.tts.servers](#opt-services.tts.servers).
+- [tts](https://github.com/coqui-ai/TTS), a battle-tested deep learning toolkit for Text-to-Speech. Multiple servers may be configured below [services.tts.servers](#opt-services.tts.servers).

 - [atuin](https://github.com/ellie/atuin), a sync server for shell history. Available as [services.atuin](#opt-services.atuin.enable).

@@ -98,7 +98,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [gonic](https://github.com/sentriz/gonic), a Subsonic music streaming server. Available as [services.gonic](#opt-services.gonic.enable).

- [mmsd](https://gitlab.com/kop316/mmsd), a lower level daemon that transmits and recieves MMSes. Available as [services.mmsd](#opt-services.mmsd.enable).
+- [mmsd](https://gitlab.com/kop316/mmsd), a lower level daemon that transmits and receives MMSes. Available as [services.mmsd](#opt-services.mmsd.enable).

 - [QDMR](https://dm3mat.darc.de/qdmr/), a GUI application and command line tool for programming DMR radios [programs.qdmr](#opt-programs.qdmr.enable)

@@ -190,6 +190,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `nushell` has been updated to at least version 0.77.0, which includes potential breaking changes in aliases. The old aliases are now available as `old-alias` but it is recommended you migrate to the new format. See [Reworked aliases](https://www.nushell.sh/blog/2023-03-14-nushell_0_77.html#reworked-aliases-breaking-changes-kubouch).

+- `gajim` has been updated to version 1.7.3 which has disabled legacy ciphers. See [changelog for version 1.7.0](https://dev.gajim.org/gajim/gajim/-/releases/1.7.0).
+
 - `keepassx` and `keepassx2` have been removed, due to upstream [stopping development](https://www.keepassx.org/index.html%3Fp=636.html). Consider [KeePassXC](https://keepassxc.org) as a maintained alternative.

 - The [services.kubo.settings](#opt-services.kubo.settings) option is now no longer stateful. If you changed any of the options in [services.kubo.settings](#opt-services.kubo.settings) in the past and then removed them from your NixOS configuration again, those changes are still in your Kubo configuration file but will now be reset to the default. If you're unsure, you may want to make a backup of your configuration file (probably /var/lib/ipfs/config) and compare after the update.
@@ -255,6 +257,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `fail2ban` has been updated to 1.0.2, which has a few breaking changes compared to 0.11.2 ([changelog for 1.0.1](https://github.com/fail2ban/fail2ban/blob/1.0.1/ChangeLog), [changelog for 1.0.2](https://github.com/fail2ban/fail2ban/blob/1.0.2/ChangeLog))

+- `albert` has been updated from 0.17.6 to 0.20.13, and 0.18.0 changed the config format and many plugins ([changelog for 0.18.0](https://github.com/albertlauncher/albert/blob/v0.18.0/CHANGELOG.md))
+
 - Calling `makeSetupHook` without passing a `name` argument is deprecated.

 - Top-level buildPlatform,hostPlatform,targetPlatform have been deprecated, use stdenv.X instead.
@@ -287,7 +291,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The `nix.readOnlyStore` option has been renamed to `boot.readOnlyNixStore` to clarify that it configures the NixOS boot process, not the Nix daemon.

- Deprecated `xlibsWrapper` transitional package has been removed in favour of direct use of its constitutents: `xorg.libX11`, `freetype` and others.
+- Deprecated `xlibsWrapper` transitional package has been removed in favour of direct use of its constituents: `xorg.libX11`, `freetype` and others.

 - The latest available version of Nextcloud is v26 (available as `pkgs.nextcloud26`) which uses PHP 8.2 as interpreter by default. The installation logic is as follows:
  - If `system.stateVersion` is >=23.05, `pkgs.nextcloud26` will be installed by default.
@@ -302,7 +306,7 @@ In addition to numerous new and upgraded packages, this release has the followin
  [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20221126)
  for more details and available replacements.

- The ppp plugin `rp-pppoe.so` has been renamed to `pppoe.so` in ppp 2.4.9. Starting from ppp 2.5.0, there is no longer a alias for backwards compatiblity. Configurations that use this plugin must be updated accordingly from `plugin rp-pppoe.so` to `plugin pppoe.so`. See [upstream change](https://github.com/ppp-project/ppp/commit/610a7bd76eb1f99f22317541b35001b1e24877ed).
+- The ppp plugin `rp-pppoe.so` has been renamed to `pppoe.so` in ppp 2.4.9. Starting from ppp 2.5.0, there is no longer a alias for backwards compatibility. Configurations that use this plugin must be updated accordingly from `plugin rp-pppoe.so` to `plugin pppoe.so`. See [upstream change](https://github.com/ppp-project/ppp/commit/610a7bd76eb1f99f22317541b35001b1e24877ed).

 - [services.xserver.videoDrivers](options.html#opt-services.xserver.videoDrivers) now defaults to the `modesetting` driver over device-specific ones. The `radeon`, `amdgpu` and `nouveau` drivers are still available, but effectively unmaintained and not recommended for use.

@@ -567,7 +571,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 The Pipewire config semantics don't really match the NixOS module semantics, so it's extremely awkward to override the default config, especially when lists are involved. Vendoring the configuration files in nixpkgs also creates unnecessary maintenance overhead.

-Also, upstream added a lot of accomodations to allow doing most of the things you'd want to do with a config edit in better ways.
+Also, upstream added a lot of accommodations to allow doing most of the things you'd want to do with a config edit in better ways.

 #### Migrating your configuration {#sec-release-23.05-migration-pipewire-how}

--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@@ -133,7 +133,7 @@ def retry(fn: Callable, timeout: int = 900) -> None:


 class StartCommand:
-    """The Base Start Command knows how to append the necesary
+    """The Base Start Command knows how to append the necessary
    runtime qemu options as determined by a particular test driver
    run. Any such start command is expected to happily receive and
    append additional qemu args.
@@ -211,7 +211,7 @@ class StartCommand:
 class NixStartScript(StartCommand):
    """A start script from nixos/modules/virtualiation/qemu-vm.nix
    that also satisfies the requirement of the BaseStartCommand.
-    These Nix commands have the particular charactersitic that the
+    These Nix commands have the particular characteristic that the
    machine name can be extracted out of them via a regex match.
    (Admittedly a _very_ implicit contract, evtl. TODO fix)
    """
@@ -527,7 +527,7 @@ class Machine:
            timeout_str = f"timeout {timeout}"

        # While sh is bash on NixOS, this is not the case for every distro.
-        # We explicitely call bash here to allow for the driver to boot other distros as well.
+        # We explicitly call bash here to allow for the driver to boot other distros as well.
        out_command = (
            f"{timeout_str} bash -c {shlex.quote(command)} | (base64 --wrap 0; echo)\n"
        )
--- a/nixos/maintainers/scripts/ec2/amazon-image.nix
+++ b/nixos/maintainers/scripts/ec2/amazon-image.nix
@@ -10,7 +10,7 @@ in {

  imports = [ ../../../modules/virtualisation/amazon-image.nix ];

-  # Amazon recomments setting this to the highest possible value for a good EBS
+  # Amazon recommends setting this to the highest possible value for a good EBS
  # experience, which prior to 4.15 was 255.
  # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nvme-ebs-volumes.html#timeout-nvme-ebs-volumes
  config.boot.kernelParams =
--- a/nixos/modules/config/xdg/portal.nix
+++ b/nixos/modules/config/xdg/portal.nix
@@ -21,7 +21,7 @@ in
      in
      {
        warnings = lib.mkIf config.xdg.portal.gtkUsePortal [
-          "The option `${lib.showOption from}' defined in ${lib.showFiles fromOpt.files} has been deprecated. Setting the variable globally with `environment.sessionVariables' NixOS option can have unforseen side-effects."
+          "The option `${lib.showOption from}' defined in ${lib.showFiles fromOpt.files} has been deprecated. Setting the variable globally with `environment.sessionVariables' NixOS option can have unforeseen side-effects."
        ];
      }
    )
--- a/nixos/modules/hardware/sensor/hddtemp.nix
+++ b/nixos/modules/hardware/sensor/hddtemp.nix
@@ -43,7 +43,7 @@ in
      };

      unit = mkOption {
-        description = lib.mdDoc "Celcius or Fahrenheit";
+        description = lib.mdDoc "Celsius or Fahrenheit";
        type = types.enum [ "C" "F" ];
        default = "C";
      };
--- a/nixos/modules/installer/tools/nixos-enter.sh
+++ b/nixos/modules/installer/tools/nixos-enter.sh
@@ -97,7 +97,7 @@ chroot_add_resolv_conf "$mountPoint" || echo "$0: failed to set up resolv.conf"
        exec 2>/dev/null
    fi

-    # Run the activation script. Set $LOCALE_ARCHIVE to supress some Perl locale warnings.
+    # Run the activation script. Set $LOCALE_ARCHIVE to suppress some Perl locale warnings.
    LOCALE_ARCHIVE="$system/sw/lib/locale/locale-archive" IN_NIXOS_ENTER=1 chroot "$mountPoint" "$system/activate" 1>&2 || true

    # Create /tmp. This is needed for nix-build and the NixOS activation script to work.
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -9,10 +9,10 @@ let
    literalExpression mkRenamedOptionModule mkDefault mkOption trivial types;

  needsEscaping = s: null != builtins.match "[a-zA-Z0-9]+" s;
-  escapeIfNeccessary = s: if needsEscaping s then s else ''"${lib.escape [ "\$" "\"" "\\" "\`" ] s}"'';
+  escapeIfNecessary = s: if needsEscaping s then s else ''"${lib.escape [ "\$" "\"" "\\" "\`" ] s}"'';
  attrsToText = attrs:
    concatStringsSep "\n" (
-      mapAttrsToList (n: v: ''${n}=${escapeIfNeccessary (toString v)}'') attrs
+      mapAttrsToList (n: v: ''${n}=${escapeIfNecessary (toString v)}'') attrs
    ) + "\n";

  osReleaseContents = {
--- a/nixos/modules/programs/fish.nix
+++ b/nixos/modules/programs/fish.nix
@@ -303,7 +303,7 @@ in
    programs.fish.interactiveShellInit = ''
      # add completions generated by NixOS to $fish_complete_path
      begin
-        # joins with null byte to acommodate all characters in paths, then respectively gets all paths before (exclusive) / after (inclusive) the first one including "generated_completions",
+        # joins with null byte to accommodate all characters in paths, then respectively gets all paths before (exclusive) / after (inclusive) the first one including "generated_completions",
        # splits by null byte, and then removes all empty lines produced by using 'string'
        set -l prev (string join0 $fish_complete_path | string match --regex "^.*?(?=\x00[^\x00]*generated_completions.*)" | string split0 | string match -er ".")
        set -l post (string join0 $fish_complete_path | string match --regex "[^\x00]*generated_completions.*" | string split0 | string match -er ".")
--- a/nixos/modules/programs/nix-ld.nix
+++ b/nixos/modules/programs/nix-ld.nix
@@ -2,7 +2,7 @@
 let
  cfg = config.programs.nix-ld;

-  # TODO make glibc here configureable?
+  # TODO make glibc here configurable?
  nix-ld-so = pkgs.runCommand "ld.so" {} ''
    ln -s "$(cat '${pkgs.stdenv.cc}/nix-support/dynamic-linker')" $out
  '';
--- a/nixos/modules/programs/singularity.nix
+++ b/nixos/modules/programs/singularity.nix
@@ -25,9 +25,9 @@ in
      type = types.nullOr types.package;
      default = null;
      description = mdDoc ''
-        This option provides access to the overriden result of `programs.singularity.package`.
+        This option provides access to the overridden result of `programs.singularity.package`.

-        For example, the following configuration makes all the Nixpkgs packages use the overriden `singularity`:
+        For example, the following configuration makes all the Nixpkgs packages use the overridden `singularity`:
        ```Nix
        { config, lib, pkgs, ... }:
        {
@@ -42,7 +42,7 @@ in
        }
        ```

-        Use `lib.mkForce` to forcefully specify the overriden package.
+        Use `lib.mkForce` to forcefully specify the overridden package.
      '';
    };
    enableFakeroot = mkOption {
--- a/nixos/modules/programs/turbovnc.nix
+++ b/nixos/modules/programs/turbovnc.nix
@@ -39,7 +39,7 @@ in
  config = mkIf cfg.ensureHeadlessSoftwareOpenGL {

    # TurboVNC has builtin support for Mesa llvmpipe's `swrast`
-    # software rendering to implemnt GLX (OpenGL on Xorg).
+    # software rendering to implement GLX (OpenGL on Xorg).
    # However, just building TurboVNC with support for that is not enough
    # (it only takes care of the X server side part of OpenGL);
    # the indiviudual applications (e.g. `glxgears`) also need to directly load
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -112,7 +112,7 @@ in
    (mkRemovedOptionModule [ "services" "cryptpad" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "rtsp-simple-server" ] "Package has been completely rebranded by upstream as mediamtx, and thus the service and the package were renamed in NixOS as well.")

-    (mkRemovedOptionModule [ "i18n" "inputMethod" "fcitx" ] "The fcitx module has been removed. Plesae use fcitx5 instead")
+    (mkRemovedOptionModule [ "i18n" "inputMethod" "fcitx" ] "The fcitx module has been removed. Please use fcitx5 instead")

    # Do NOT add any option renames here, see top of the file
  ];
--- a/nixos/modules/security/pam_mount.nix
+++ b/nixos/modules/security/pam_mount.nix
@@ -47,6 +47,18 @@ in
        '';
      };

+      cryptMountOptions = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = literalExpression ''
+          [ "allow_discard" ]
+        '';
+        description = lib.mdDoc ''
+          Global mount options that apply to every crypt volume.
+          You can define volume-specific options in the volume definitions.
+        '';
+      };
+
      fuseMountOptions = mkOption {
        type = types.listOf types.str;
        default = [];
@@ -157,7 +169,7 @@ in
          <!-- specify the binaries to be called -->
          <fusemount>${pkgs.fuse}/bin/mount.fuse %(VOLUME) %(MNTPT) -o ${concatStringsSep "," (cfg.fuseMountOptions ++ [ "%(OPTIONS)" ])}</fusemount>
          <fuseumount>${pkgs.fuse}/bin/fusermount -u %(MNTPT)</fuseumount>
-          <cryptmount>${pkgs.pam_mount}/bin/mount.crypt %(VOLUME) %(MNTPT)</cryptmount>
+          <cryptmount>${pkgs.pam_mount}/bin/mount.crypt -o ${concatStringsSep "," (cfg.cryptMountOptions ++ [ "%(OPTIONS)" ])} %(VOLUME) %(MNTPT)</cryptmount>
          <cryptumount>${pkgs.pam_mount}/bin/umount.crypt %(MNTPT)</cryptumount>
          <pmvarrun>${pkgs.pam_mount}/bin/pmvarrun -u %(USER) -o %(OPERATION)</pmvarrun>
          ${optionalString oflRequired "<ofl>${fake_ofl}/bin/fake_ofl %(SIGNAL) %(MNTPT)</ofl>"}
--- a/nixos/modules/services/cluster/kubernetes/flannel.nix
+++ b/nixos/modules/services/cluster/kubernetes/flannel.nix
@@ -53,7 +53,7 @@ in
      };
    };

-    # give flannel som kubernetes rbac permissions if applicable
+    # give flannel some kubernetes rbac permissions if applicable
    services.kubernetes.addonManager.bootstrapAddons = mkIf ((storageBackend == "kubernetes") && (elem "RBAC" top.apiserver.authorizationMode)) {

      flannel-cr = {
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@@ -337,7 +337,7 @@ in
        };
      };

-      # Allways include cni plugins
+      # Always include cni plugins
      services.kubernetes.kubelet.cni.packages = [pkgs.cni-plugins pkgs.cni-plugin-flannel];

      boot.kernelModules = ["br_netfilter" "overlay"];
--- a/nixos/modules/services/continuous-integration/gitea-actions-runner.nix
+++ b/nixos/modules/services/continuous-integration/gitea-actions-runner.nix
@@ -207,7 +207,7 @@ in
              export LABELS_CURRENT="$(cat $LABELS_FILE 2>/dev/null || echo 0)"

              if [ ! -e "$INSTANCE_DIR/.runner" ] || [ "$LABELS_WANTED" != "$LABELS_CURRENT" ]; then
-                # remove existing registration file, so that changing the labels forces a re-registation
+                # remove existing registration file, so that changing the labels forces a re-registration
                rm -v "$INSTANCE_DIR/.runner" || true

                # perform the registration
--- a/nixos/modules/services/continuous-integration/woodpecker/agents.nix
+++ b/nixos/modules/services/continuous-integration/woodpecker/agents.nix
@@ -23,7 +23,7 @@ let
            DOCKER_HOST = "unix:///run/podman/podman.sock";
          }
        '';
-        description = lib.mdDoc "woodpecker-agent config envrionment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/agent-config)";
+        description = lib.mdDoc "woodpecker-agent config environment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/agent-config)";
      };

      extraGroups = lib.mkOption {
--- a/nixos/modules/services/continuous-integration/woodpecker/server.nix
+++ b/nixos/modules/services/continuous-integration/woodpecker/server.nix
@@ -28,7 +28,7 @@ in
              WOODPECKER_GITEA_URL = "https://git.example.com";
            }
          '';
-        description = lib.mdDoc "woodpecker-server config envrionment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/server-config)";
+        description = lib.mdDoc "woodpecker-server config environment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/server-config)";
      };
      environmentFile = lib.mkOption {
        type = lib.types.nullOr lib.types.path;
--- a/nixos/modules/services/databases/cockroachdb.nix
+++ b/nixos/modules/services/databases/cockroachdb.nix
@@ -164,7 +164,7 @@ in
        example = [ "--advertise-addr" "[fe80::f6f2:::]" ];
        description = lib.mdDoc ''
          Extra CLI arguments passed to {command}`cockroach start`.
-          For the full list of supported argumemnts, check <https://www.cockroachlabs.com/docs/stable/cockroach-start.html#flags>
+          For the full list of supported arguments, check <https://www.cockroachlabs.com/docs/stable/cockroach-start.html#flags>
        '';
      };
    };
--- a/nixos/modules/services/databases/couchdb.nix
+++ b/nixos/modules/services/databases/couchdb.nix
@@ -141,7 +141,7 @@ in {
        type = types.lines;
        default = "";
        description = lib.mdDoc ''
-          Extra configuration. Overrides any other cofiguration.
+          Extra configuration. Overrides any other configuration.
        '';
      };

--- a/nixos/modules/services/databases/firebird.nix
+++ b/nixos/modules/services/databases/firebird.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:

-# TODO: This may file may need additional review, eg which configuartions to
+# TODO: This may file may need additional review, eg which configurations to
 # expose to the user.
 #
 # I only used it to access some simple databases.
--- a/nixos/modules/services/databases/mongodb.nix
+++ b/nixos/modules/services/databases/mongodb.nix
@@ -142,7 +142,7 @@ in
          User = cfg.user;
          PIDFile = cfg.pidFile;
          Type = "forking";
-          TimeoutStartSec=120; # intial creating of journal can take some time
+          TimeoutStartSec=120; # initial creating of journal can take some time
          PermissionsStartOnly = true;
        };

--- a/nixos/modules/services/desktops/deepin/dde-api.nix
+++ b/nixos/modules/services/desktops/deepin/dde-api.nix
@@ -16,7 +16,7 @@ with lib;

      enable = mkEnableOption (lib.mdDoc ''
        Provides some dbus interfaces that is used for screen zone detecting,
-        thumbnail generating, and sound playing in Deepin Desktop Enviroment.
+        thumbnail generating, and sound playing in Deepin Desktop Environment.
      '');

    };
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -72,7 +72,7 @@ in
        type = types.str;
        description = lib.mdDoc ''
          Password file for the postgresql connection.
-          Must be formated according to PostgreSQL .pgpass standard (see https://www.postgresql.org/docs/current/libpq-pgpass.html)
+          Must be formatted according to PostgreSQL .pgpass standard (see https://www.postgresql.org/docs/current/libpq-pgpass.html)
          but only one line, no comments and readable by user `nginx`.
          Ignored if `database.host` is set to `localhost`, as peer authentication will be used.
        '';
--- a/nixos/modules/services/misc/siproxd.nix
+++ b/nixos/modules/services/misc/siproxd.nix
@@ -60,7 +60,7 @@ in
        default = [ ];
        example = [ "192.168.1.0/24" "192.168.2.0/24" ];
        description = lib.mdDoc ''
-          Acess control list for incoming SIP registrations.
+          Access control list for incoming SIP registrations.
        '';
      };

@@ -69,7 +69,7 @@ in
        default = [ ];
        example = [ "123.45.0.0/16" "123.46.0.0/16" ];
        description = lib.mdDoc ''
-          Acess control list for incoming SIP traffic.
+          Access control list for incoming SIP traffic.
        '';
      };

@@ -78,7 +78,7 @@ in
        default = [ ];
        example = [ "10.0.0.0/8" "11.0.0.0/8" ];
        description = lib.mdDoc ''
-          Acess control list for denying incoming
+          Access control list for denying incoming
          SIP registrations and traffic.
        '';
      };
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -1614,7 +1614,7 @@ in

        The following property holds: switching to a configuration
        (`switch-to-configuration`) that changes the prometheus
-        configuration only finishes successully when prometheus has finished
+        configuration only finishes successfully when prometheus has finished
        loading the new configuration.
      '';
    };
--- a/nixos/modules/services/monitoring/unpoller.nix
+++ b/nixos/modules/services/monitoring/unpoller.nix
@@ -47,7 +47,7 @@ in {
        type = types.bool;
        default = false;
        description = lib.mdDoc ''
-          Whether to disable the prometheus ouput plugin.
+          Whether to disable the prometheus output plugin.
        '';
      };
      http_listen = mkOption {
@@ -71,7 +71,7 @@ in {
        type = types.bool;
        default = false;
        description = lib.mdDoc ''
-          Whether to disable the influxdb ouput plugin.
+          Whether to disable the influxdb output plugin.
        '';
      };
      url = mkOption {
--- a/nixos/modules/services/networking/headscale.nix
+++ b/nixos/modules/services/networking/headscale.nix
@@ -393,7 +393,7 @@ in {
              type = types.nullOr types.path;
              default = null;
              description = lib.mdDoc ''
-                Path to a file containg ACL policies.
+                Path to a file containing ACL policies.
              '';
            };
          };
--- a/nixos/modules/services/networking/wgautomesh.nix
+++ b/nixos/modules/services/networking/wgautomesh.nix
@@ -94,7 +94,7 @@ in
                address = mkOption {
                  type = types.str;
                  description = mdDoc ''
-                    Wireguard address of this peer (a single IP address, multliple
+                    Wireguard address of this peer (a single IP address, multiple
                    addresses or address ranges are not supported).
                  '';
                  example = "10.0.0.42";
--- a/nixos/modules/services/search/meilisearch.md
+++ b/nixos/modules/services/search/meilisearch.md
@@ -30,7 +30,7 @@ you first need to add documents to an index before you can search for documents.

 - The default nixos package doesn't come with the [dashboard](https://docs.meilisearch.com/learn/getting_started/quick_start.html#search), since the dashboard features makes some assets downloads at compile time.

- Anonimized Analytics sent to meilisearch are disabled by default.
+- Anonymized Analytics sent to meilisearch are disabled by default.

 - Default deployment is development mode. It doesn't require a secret master key. All routes are not protected and accessible.

--- a/nixos/modules/services/security/authelia.nix
+++ b/nixos/modules/services/security/authelia.nix
@@ -72,7 +72,7 @@ let
              type = types.nullOr types.path;
              default = null;
              description = mdDoc ''
-                Path to your JWT secret used during identity verificaiton.
+                Path to your JWT secret used during identity verificaton.
              '';
            };

--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -10,7 +10,7 @@ let
  certPaths = builtins.map builtins.dirOf [ cfg.serverSettings.tls_chain cfg.serverSettings.tls_key ];

  # Merge bind mount paths and remove paths where a prefix is already mounted.
-  # This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is alread in the mount
+  # This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is already in the mount
  # paths, no new bind mount is added. Adding subpaths caused problems on ofborg.
  hasPrefixInList = list: newPath: lib.any (path: lib.hasPrefix (builtins.toString path) (builtins.toString newPath)) list;
  mergePaths = lib.foldl' (merged: newPath: let
--- a/nixos/modules/services/web-apps/dokuwiki.nix
+++ b/nixos/modules/services/web-apps/dokuwiki.nix
@@ -173,7 +173,7 @@ let
            }
            {
              assertion = config.usersFile != null -> config.mergedConfig.useacl != false;
-              message = "${showPath [ "settings" "useacl" ]} is required when ${showPath [ "usersFile" ]} is set (Currently defiend as `${config.usersFile}' in ${showFiles options.usersFile.files}).";
+              message = "${showPath [ "settings" "useacl" ]} is required when ${showPath [ "usersFile" ]} is set (Currently defined as `${config.usersFile}' in ${showFiles options.usersFile.files}).";
            }
          ];
        })
--- a/nixos/modules/services/web-apps/kavita.nix
+++ b/nixos/modules/services/web-apps/kavita.nix
@@ -35,7 +35,7 @@ in {
    ipAdresses = lib.mkOption {
      default = ["0.0.0.0" "::"];
      type = lib.types.listOf lib.types.str;
-      description = lib.mdDoc "IP Adresses to bind to. The default is to bind
+      description = lib.mdDoc "IP Addresses to bind to. The default is to bind
      to all IPv4 and IPv6 addresses.";
    };
  };
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@@ -508,7 +508,7 @@ in {
        type = with lib.types; listOf path;
        default = [];
        description = lib.mdDoc ''
-          Extra environment files to pass to all mastodon services. Useful for passing down environemntal secrets.
+          Extra environment files to pass to all mastodon services. Useful for passing down environmental secrets.
        '';
        example = [ "/etc/mastodon/s3config.env" ];
      };
--- a/nixos/modules/services/web-apps/monica.nix
+++ b/nixos/modules/services/web-apps/monica.nix
@@ -367,7 +367,7 @@ in {
    };

    systemd.services.monica-setup = {
-      description = "Preperation tasks for monica";
+      description = "Preparation tasks for monica";
      before = ["phpfpm-monica.service"];
      after = optional db.createLocally "mysql.service";
      wantedBy = ["multi-user.target"];
--- a/nixos/modules/services/web-apps/nextcloud-notify_push.nix
+++ b/nixos/modules/services/web-apps/nextcloud-notify_push.nix
@@ -31,7 +31,7 @@ in
      type = lib.types.bool;
      default = false;
      description = lib.mdDoc ''
-        Wether to add an entry to `/etc/hosts` for the configured nextcloud domain to point to `localhost` and add `localhost `to nextcloud's `trusted_proxies` config option.
+        Whether to add an entry to `/etc/hosts` for the configured nextcloud domain to point to `localhost` and add `localhost `to nextcloud's `trusted_proxies` config option.

        This is useful when nextcloud's domain is not a static IP address and when the reverse proxy cannot be bypassed because the backend connection is done via unix socket.
      '';
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -556,7 +556,7 @@ in {
      default = config.services.nextcloud.notify_push.enable;
      defaultText = literalExpression "config.services.nextcloud.notify_push.enable";
      description = lib.mdDoc ''
-        Wether to configure nextcloud to use the recommended redis settings for small instances.
+        Whether to configure nextcloud to use the recommended redis settings for small instances.

        ::: {.note}
        The `notify_push` app requires redis to be configured. If this option is turned off, this must be configured manually.
--- a/nixos/modules/services/web-apps/pixelfed.nix
+++ b/nixos/modules/services/web-apps/pixelfed.nix
@@ -237,7 +237,7 @@ in {
        QUEUE_DRIVER = mkDefault "redis";
        SESSION_DRIVER = mkDefault "redis";
        WEBSOCKET_REPLICATION_MODE = mkDefault "redis";
-        # Suppport phpredis and predis configuration-style.
+        # Support phpredis and predis configuration-style.
        REDIS_SCHEME = "unix";
        REDIS_HOST = config.services.redis.servers.pixelfed.unixSocket;
        REDIS_PATH = config.services.redis.servers.pixelfed.unixSocket;
--- a/nixos/modules/services/web-servers/garage.md
+++ b/nixos/modules/services/web-servers/garage.md
@@ -77,7 +77,7 @@ updated to make sure that the
 on fresh setups.

 If major-releases will be abandoned by upstream, we should check first if those are needed
-in NixOS for a safe upgrade-path before removing those. In that case we shold keep those
+in NixOS for a safe upgrade-path before removing those. In that case we should keep those
 packages, but mark them as insecure in an expression like this (in
 `<nixpkgs/pkgs/tools/filesystem/garage/default.nix>`):
 ```
--- a/nixos/modules/services/web-servers/stargazer.nix
+++ b/nixos/modules/services/web-servers/stargazer.nix
@@ -152,7 +152,7 @@ in

        Expressed as a list of attribute sets. Each set must have a key `route`
        that becomes the section name for that route in the stargazer ini cofig.
-        The remaining keys and vaules become the parameters for that route.
+        The remaining keys and values become the parameters for that route.

        [Refer to upstream docs for other params](https://git.sr.ht/~zethra/stargazer/tree/main/item/doc/stargazer.ini.5.txt)
      '';
--- a/nixos/modules/services/x11/window-managers/qtile.nix
+++ b/nixos/modules/services/x11/window-managers/qtile.nix
@@ -40,7 +40,7 @@ in
        description = lib.mdDoc ''
          Extra Python packages available to Qtile.
          An example would be to include `python3Packages.qtile-extras`
-          for additional unoffical widgets.
+          for additional unofficial widgets.
        '';
        example = literalExpression ''
          python3Packages: with python3Packages; [
--- a/nixos/modules/system/boot/loader/grub/install-grub.pl
+++ b/nixos/modules/system/boot/loader/grub/install-grub.pl
@@ -213,7 +213,7 @@ sub GrubFs {
            $search .= $matches[0];
        }

-        # BTRFS is a special case in that we need to fix the referrenced path based on subvolumes
+        # BTRFS is a special case in that we need to fix the referenced path based on subvolumes
        if ($fs->type eq 'btrfs') {
            my ($status, @id_info) = runCommand("@btrfsprogs@/bin/btrfs", "subvol", "show", @{[$fs->mount]});
            if ($status != 0) {
@@ -586,7 +586,7 @@ sub getEfiTarget {
        if (($grubTarget eq "") || ($grubTargetEfi eq "")) { die }
        else { return "both" }
    } elsif (($grub ne "") && ($grubEfi eq "")) {
-        # TODO: It would be safer to disallow non-EFI grub installation if no taget is given.
+        # TODO: It would be safer to disallow non-EFI grub installation if no target is given.
        #       If no target is given, then grub auto-detects the target which can lead to errors.
        #       E.g. it seems as if grub would auto-detect a EFI target based on the availability
        #       of a EFI partition.
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -130,7 +130,7 @@ let
    ''}

    # Disable all input echo for the whole stage. We could use read -s
-    # instead but that would ocasionally leak characters between read
+    # instead but that would occasionally leak characters between read
    # invocations.
    stty -echo
  '';
@@ -861,7 +861,7 @@ in
            '';
            description = lib.mdDoc ''
              Commands that should be run right before we try to mount our LUKS device.
-              This can be useful, if the keys needed to open the drive is on another partion.
+              This can be useful, if the keys needed to open the drive is on another partition.
            '';
          };

--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@@ -445,7 +445,7 @@ lustrateRoot () {
        mv -v "$d" "$root/old-root.tmp"
    done

-    # Use .tmp to make sure subsequent invokations don't clash
+    # Use .tmp to make sure subsequent invocations don't clash
    mv -v "$root/old-root.tmp" "$root/old-root"

    mkdir -m 0755 -p "$root/etc"
--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@@ -16,7 +16,7 @@ let
        local path="$2"
        if bcachefs unlock -c $path > /dev/null 2> /dev/null; then    # test for encryption
            prompt $name
-            until bcachefs unlock $path 2> /dev/null; do              # repeat until sucessfully unlocked
+            until bcachefs unlock $path 2> /dev/null; do              # repeat until successfully unlocked
                printf "unlocking failed!\n"
                prompt $name
            done
--- a/nixos/modules/tasks/filesystems/btrfs.nix
+++ b/nixos/modules/tasks/filesystems/btrfs.nix
@@ -25,7 +25,7 @@ in
        type = types.listOf types.path;
        example = [ "/" ];
        description = lib.mdDoc ''
-          List of paths to btrfs filesystems to regularily call {command}`btrfs scrub` on.
+          List of paths to btrfs filesystems to regularly call {command}`btrfs scrub` on.
          Defaults to all mount points with btrfs filesystems.
          If you mount a filesystem multiple times or additionally mount subvolumes,
          you need to manually specify this list to avoid scrubbing multiple times.
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -396,7 +396,7 @@ let
            '';
            postStop = ''
              echo "Cleaning Open vSwitch ${n}"
-              echo "Shuting down internal ${n} interface"
+              echo "Shutting down internal ${n} interface"
              ip link set ${n} down || true
              echo "Deleting flows for ${n}"
              ovs-ofctl --protocols=${v.openFlowVersion} del-flows ${n} || true
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@@ -437,7 +437,7 @@ in
            '';
            postStop = ''
              echo "Cleaning Open vSwitch ${n}"
-              echo "Shuting down internal ${n} interface"
+              echo "Shutting down internal ${n} interface"
              ip link set ${n} down || true
              echo "Deleting flows for ${n}"
              ovs-ofctl --protocols=${v.openFlowVersion} del-flows ${n} || true
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@@ -43,7 +43,7 @@ in
            # Passing the terminal device makes bash run non-interactively.
            # Otherwise we get errors on the terminal because bash tries to
            # setup things like job control.
-            # Note: calling bash explicitely here instead of sh makes sure that
+            # Note: calling bash explicitly here instead of sh makes sure that
            # we can also run non-NixOS guests during tests.
            PS1= exec /usr/bin/env bash --norc /dev/hvc0
          '';
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -414,13 +414,16 @@ in
    # https://libvirt.org/daemons.html#monolithic-systemd-integration
    systemd.sockets.libvirtd.wantedBy = [ "sockets.target" ];

-    security.polkit.extraConfig = ''
-      polkit.addRule(function(action, subject) {
-        if (action.id == "org.libvirt.unix.manage" &&
-          subject.isInGroup("libvirtd")) {
-          return polkit.Result.YES;
-        }
-      });
-    '';
+    security.polkit = {
+      enable = true;
+      extraConfig = ''
+        polkit.addRule(function(action, subject) {
+          if (action.id == "org.libvirt.unix.manage" &&
+            subject.isInGroup("libvirtd")) {
+            return polkit.Result.YES;
+          }
+        });
+      '';
+    };
  };
 }
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -407,7 +407,7 @@ in {
      # Ensures the issuer of our cert matches the chain
      # and matches the issuer we expect it to be.
      # It's a good validation to ensure the cert.pem and fullchain.pem
-      # are not still selfsigned afer verification
+      # are not still selfsigned after verification
      def check_issuer(node, cert_name, issuer):
          for fname in ("cert.pem", "fullchain.pem"):
              actual_issuer = node.succeed(
--- a/nixos/tests/atop.nix
+++ b/nixos/tests/atop.nix
@@ -199,7 +199,7 @@ in
    ];
  };
  everything = makeTest {
-    name = "atop-everthing";
+    name = "atop-everything";
    nodes.machine = {
      programs.atop = {
        enable = true;
--- a/nixos/tests/boot-stage1.nix
+++ b/nixos/tests/boot-stage1.nix
@@ -132,7 +132,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
        '';
      })

-      # This canary process mimicks a storage daemon, which we do NOT want to be
+      # This canary process mimics a storage daemon, which we do NOT want to be
      # killed before going into stage 2. For more on root storage daemons, see:
      # https://www.freedesktop.org/wiki/Software/systemd/RootStorageDaemons/
      (mkCmdlineCanary {
--- a/nixos/tests/cockpit.nix
+++ b/nixos/tests/cockpit.nix
@@ -93,7 +93,7 @@ import ./make-test-python.nix (
            password_input = find_element(By.CSS_SELECTOR, 'input#login-password-input')
            set_value(password_input, "${password}")

-            log("Submiting credentials for login")
+            log("Submitting credentials for login")
            driver.find_element(By.CSS_SELECTOR, 'button#login-button').click()

            # driver.implicitly_wait(1)
@@ -102,7 +102,7 @@ import ./make-test-python.nix (
            log("Waiting dashboard to load")
            wait_title_contains("${user}@server")

-            log("Waiting for the frontend to initalize")
+            log("Waiting for the frontend to initialize")
            sleep(1)

            log("Looking for that banner that tells about limited access")
--- a/nixos/tests/dokuwiki.nix
+++ b/nixos/tests/dokuwiki.nix
@@ -143,7 +143,7 @@ in {
              "curl -sSfL 'http://site2.local/doku.php?id=plugin-list' | (! grep 'plugin:tag')",
          )

-          # Test if theme is applied and working correctly (no weired relative PHP import errors)
+          # Test if theme is applied and working correctly (no weird relative PHP import errors)
          machine.succeed(
            "curl -sSfL 'http://site1.local/doku.php' | grep 'bootstrap3/images/logo.png'",
            "curl -sSfL 'http://site1.local/lib/exe/css.php' | grep 'bootstrap3'",
--- a/nixos/tests/elk.nix
+++ b/nixos/tests/elk.nix
@@ -1,4 +1,4 @@
-# To run the test on the unfree ELK use the folllowing command:
+# To run the test on the unfree ELK use the following command:
 # cd path/to/nixpkgs
 # NIXPKGS_ALLOW_UNFREE=1 nix-build -A nixosTests.elk.unfree.ELK-6

--- a/nixos/tests/enlightenment.nix
+++ b/nixos/tests/enlightenment.nix
@@ -65,7 +65,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
        machine.screenshot("wizard7")
        machine.succeed("xdotool mousemove 512 740 click 1")  # Next

-        machine.wait_for_text("BlusZ")  # Bluetooh Management (default)
+        machine.wait_for_text("BlusZ")  # Bluetooth Management (default)
        machine.screenshot("wizard8")
        machine.succeed("xdotool mousemove 512 740 click 1")  # Next

--- a/nixos/tests/fcitx5/default.nix
+++ b/nixos/tests/fcitx5/default.nix
@@ -1,7 +1,8 @@
-import ../make-test-python.nix ({ pkgs, ... }:
-# copy_from_host works only for store paths
+import ../make-test-python.nix ({ lib, ... }:
 rec {
  name = "fcitx5";
+  meta.maintainers = with lib.maintainers; [ nevivurn ];
+
  nodes.machine = { pkgs, ... }:
  {
    imports = [
@@ -30,8 +31,10 @@ rec {
    i18n.inputMethod = {
      enabled = "fcitx5";
      fcitx5.addons = [
-        pkgs.fcitx5-m17n
        pkgs.fcitx5-chinese-addons
+        pkgs.fcitx5-hangul
+        pkgs.fcitx5-m17n
+        pkgs.fcitx5-mozc
      ];
    };
  };
@@ -43,11 +46,16 @@ rec {
      fcitx_confdir = "${user.home}/.config/fcitx5";
    in
      ''
-            # We need config files before login session
-            # So copy first thing
+            start_all()
+
+            machine.wait_for_x()
+            machine.wait_for_file("${xauth}")
+            machine.succeed("xauth merge ${xauth}")
+            machine.sleep(5)
+
+            machine.succeed("su - ${user.name} -c 'kill $(pgrep fcitx5)'")
+            machine.sleep(1)

-            # Point and click would be expensive,
-            # So configure using files
            machine.copy_from_host(
                "${./profile}",
                "${fcitx_confdir}/profile",
@@ -57,15 +65,8 @@ rec {
                "${fcitx_confdir}/config",
            )

-            start_all()
-
-            machine.wait_for_file("${xauth}}")
-            machine.succeed("xauth merge ${xauth}")
-
-            machine.sleep(5)
-
-            machine.succeed("su - ${user.name} -c 'alacritty&'")
-            machine.succeed("su - ${user.name} -c 'fcitx5&'")
+            machine.succeed("su - ${user.name} -c 'alacritty >&2 &'")
+            machine.succeed("su - ${user.name} -c 'fcitx5 >&2 &'")
            machine.sleep(10)

            ### Type on terminal
@@ -74,7 +75,6 @@ rec {

            ### Start fcitx Unicode input
            machine.send_key("ctrl-alt-shift-u")
-            machine.sleep(5)
            machine.sleep(1)

            ### Search for smiling face
@@ -94,9 +94,15 @@ rec {
            machine.sleep(1)

            ### Default wubi, enter 一下
-            machine.send_chars("gggh")
+            machine.send_chars("gggh ")
            machine.sleep(1)
-            machine.send_key("\n")
+
+            ### Switch to Hangul
+            machine.send_key("alt-shift")
+            machine.sleep(1)
+
+            ### Enter 한
+            machine.send_chars("gks")
            machine.sleep(1)

            ### Switch to Harvard Kyoto
@@ -104,12 +110,17 @@ rec {
            machine.sleep(1)

            ### Enter क
-            machine.send_chars("ka ")
+            machine.send_chars("ka")
            machine.sleep(1)

+            ### Switch to Mozc
            machine.send_key("alt-shift")
            machine.sleep(1)

+            ### Enter か
+            machine.send_chars("ka\n")
+            machine.sleep(1)
+
            ### Turn off Fcitx
            machine.send_key("ctrl-spc")
            machine.sleep(1)
@@ -121,7 +132,7 @@ rec {

            ### Verify that file contents are as expected
            file_content = machine.succeed("cat ${user.home}/fcitx_test.out")
-            assert file_content == "☺一下क\n"
-            ''
+            assert file_content == "☺一下한कか\n"
+      ''
  ;
 })
--- a/nixos/tests/fcitx5/profile
+++ b/nixos/tests/fcitx5/profile
@@ -4,12 +4,24 @@ Default Layout=us
 DefaultIM=wbx

 [Groups/0/Items/0]
+Name=keyboard-us
+Layout=
+
+[Groups/0/Items/1]
 Name=wbx
 Layout=us

-[Groups/0/Items/1]
+[Groups/0/Items/2]
+Name=hangul
+Layout=us
+
+[Groups/0/Items/3]
 Name=m17n_sa_harvard-kyoto
 Layout=us

+[Groups/0/Items/4]
+Name=mozc
+Layout=us
+
 [GroupOrder]
 0=NixOS_test
--- a/nixos/tests/gnome.nix
+++ b/nixos/tests/gnome.nix
@@ -39,7 +39,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
    };

  testScript = { nodes, ... }: let
-    # Keep line widths somewhat managable
+    # Keep line widths somewhat manageable
    user = nodes.machine.config.users.users.alice;
    uid = toString user.uid;
    bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus";
--- a/nixos/tests/gotify-server.nix
+++ b/nixos/tests/gotify-server.nix
@@ -42,7 +42,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {

    assert title == "Gotify"

-    # Ensure that the UI responds with a successfuly code and that the
+    # Ensure that the UI responds with a successful code and that the
    # response is not empty
    result = machine.succeed("curl -fsS localhost:3000")
    assert result, "HTTP response from localhost:3000 must not be empty!"
--- a/nixos/tests/headscale.nix
+++ b/nixos/tests/headscale.nix
@@ -10,7 +10,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
  testScript = ''
    machine.wait_for_unit("headscale")
    machine.wait_for_open_port(8080)
-    # Test basic funcionality
+    # Test basic functionality
    machine.succeed("headscale namespaces create test")
    machine.succeed("headscale preauthkeys -u test create")
  '';
--- a/nixos/tests/hockeypuck.nix
+++ b/nixos/tests/hockeypuck.nix
@@ -57,7 +57,7 @@ in {
    # Send the key to our local keyserver
    machine.succeed("GNUPGHOME=/tmp/GNUPGHOME gpg --keyserver hkp://127.0.0.1:11371 --send-keys " + keyId)

-    # Recieve the key from our local keyserver to a separate directory
+    # Receive the key from our local keyserver to a separate directory
    machine.succeed("GNUPGHOME=$(mktemp -d) gpg --keyserver hkp://127.0.0.1:11371 --recv-keys " + keyId)
  '';
 })
--- a/nixos/tests/home-assistant.nix
+++ b/nixos/tests/home-assistant.nix
@@ -64,7 +64,6 @@ in {
        # include some popular integrations, that absolutely shouldn't break
        esphome = {};
        knx = {};
-        matter = {};
        shelly = {};
        zha = {};

--- a/nixos/tests/logrotate.nix
+++ b/nixos/tests/logrotate.nix
@@ -38,7 +38,7 @@ import ./make-test-python.nix ({ pkgs, ... }: rec {
          priority = 2000;
          shred = true;
        };
-        # using mail somewhere should add --mail to logrotate invokation
+        # using mail somewhere should add --mail to logrotate invocation
        sendmail = {
          mail = "user@domain.tld";
        };
--- a/nixos/tests/nextcloud/openssl-sse.nix
+++ b/nixos/tests/nextcloud/openssl-sse.nix
@@ -73,7 +73,7 @@ in {
        nextcloudwithopenssl1.succeed("nextcloud-occ status")

    with subtest("Existing encrypted files cannot be read, but new files can be added"):
-        # This will succed starting NC26 because of their custom implementation of openssl_seal
+        # This will succeed starting NC26 because of their custom implementation of openssl_seal
        read_existing_file_test = nextcloudwithopenssl1.fail if nextcloud_version < 26 else nextcloudwithopenssl1.succeed
        read_existing_file_test("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file >&2")
        nextcloudwithopenssl1.succeed("nextcloud-occ encryption:disable")
--- a/nixos/tests/orangefs.nix
+++ b/nixos/tests/orangefs.nix
@@ -62,7 +62,7 @@ in {
            "sudo -g orangefs -u orangefs pvfs2-server -f /etc/orangefs/server.conf"
        )

-    # start services after storage is formated on all machines
+    # start services after storage is formatted on all machines
    for server in server1, server2:
        server.succeed("systemctl start orangefs-server.service")

--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -348,9 +348,13 @@ let
        enable = true;
        url = "http://localhost";
        configFile = pkgs.writeText "json-exporter-conf.json" (builtins.toJSON {
-          metrics = [
-            { name = "json_test_metric"; path = "{ .test }"; }
-          ];
+          modules = {
+            default = {
+              metrics = [
+                { name = "json_test_metric"; path = "{ .test }"; }
+              ];
+            };
+          };
        });
      };
      metricProvider = {
--- a/nixos/tests/signal-desktop.nix
+++ b/nixos/tests/signal-desktop.nix
@@ -43,7 +43,7 @@ in {
    machine.execute("su - alice -c signal-desktop >&2 &")

    # Wait for the Signal window to appear. Since usually the tests
-    # are run sandboxed and therfore with no internet, we can not wait
+    # are run sandboxed and therefore with no internet, we can not wait
    # for the message "Link your phone ...". Nor should we wait for
    # the "Failed to connect to server" message, because when manually
    # running this test it will be not sandboxed.
--- a/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix
+++ b/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix
@@ -1,6 +1,6 @@
 # This test verifies that we can request and assign IPv6 prefixes from upstream
 # (e.g. ISP) routers.
-# The setup consits of three VMs. One for the ISP, as your residential router
+# The setup consists of three VMs. One for the ISP, as your residential router
 # and the third as a client machine in the residential network.
 #
 # There are two VLANs in this test:
@@ -268,7 +268,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
      systemd.targets.network-online.wantedBy = [ "multi-user.target" ];
    };

-    # This is the client behind the router. We should be receving router
+    # This is the client behind the router. We should be receiving router
    # advertisements for both the ULA and the delegated prefix.
    # All we have to do is boot with the default (networkd) configuration.
    client = {
--- a/nixos/tests/systemd-repart.nix
+++ b/nixos/tests/systemd-repart.nix
@@ -9,7 +9,7 @@ with pkgs.lib;
 let
  # A testScript fragment that prepares a disk with some empty, unpartitioned
  # space. and uses it to boot the test with. Takes a single argument `machine`
-  # from which the diskImage is extraced.
+  # from which the diskImage is extracted.
  useDiskImage = machine: ''
    import os
    import shutil
--- a/nixos/tests/unbound.nix
+++ b/nixos/tests/unbound.nix
@@ -1,7 +1,7 @@
 /*
 Test that our unbound module indeed works as most users would expect.
 There are a few settings that we must consider when modifying the test. The
- ususal use-cases for unbound are
+ usual use-cases for unbound are
   * running a recursive DNS resolver on the local machine
   * running a recursive DNS resolver on the local machine, forwarding to a local DNS server via UDP/53 & TCP/53
   * running a recursive DNS resolver on the local machine, forwarding to a local DNS server via TCP/853 (DoT)
@@ -74,7 +74,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
        };
      };

-      # The resolver that knows that fowards (only) to the authoritative server
+      # The resolver that knows that forwards (only) to the authoritative server
      # and listens on UDP/53, TCP/53 & TCP/853.
      resolver = { lib, nodes, ... }: {
        imports = [ common ];
--- a/pkgs/applications/accessibility/contrast/default.nix
+++ b/pkgs/applications/accessibility/contrast/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
    description = "Checks whether the contrast between two colors meet the WCAG requirements";
    homepage = "https://gitlab.gnome.org/World/design/contrast";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ jtojnar ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.unix;
    # never built on aarch64-darwin, x86_64-darwin since first introduction in nixpkgs
    broken = stdenv.isDarwin;
--- a/pkgs/applications/audio/easyeffects/default.nix
+++ b/pkgs/applications/audio/easyeffects/default.nix
@@ -105,7 +105,7 @@ stdenv.mkDerivation rec {
    description = "Audio effects for PipeWire applications.";
    homepage = "https://github.com/wwmm/easyeffects";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ jtojnar ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/osdlyrics/default.nix
+++ b/pkgs/applications/audio/osdlyrics/default.nix
@@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
    description = "Standalone lyrics fetcher/displayer";
    homepage = "https://github.com/osdlyrics/osdlyrics";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ jtojnar ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/proteus/default.nix
+++ b/pkgs/applications/audio/proteus/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
  env.NIX_CFLAGS_COMPILE = toString [
    # Support JACK output in the standalone application:
    "-DJUCE_JACK"
-    # Accomodate -flto:
+    # Accommodate -flto:
    "-ffat-lto-objects"
  ];

--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@@ -1,6 +1,12 @@
-{ lib, stdenv, callPackage }:
+{ lib
+, stdenv
+, callPackage
+, ...
+}@args:

 let
+  extraArgs = removeAttrs args [ "callPackage" ];
+
  pname = "spotify";

  meta = with lib; {
@@ -12,5 +18,5 @@ let
  };

 in if stdenv.isDarwin
-then callPackage ./darwin.nix { inherit pname meta; }
-else callPackage ./linux.nix { inherit pname meta; }
+then callPackage ./darwin.nix (extraArgs // { inherit pname meta; })
+else callPackage ./linux.nix (extraArgs // { inherit pname meta; })
--- a/pkgs/applications/audio/youtube-music/default.nix
+++ b/pkgs/applications/audio/youtube-music/default.nix
@@ -2,11 +2,11 @@

 let
  pname = "youtube-music";
-  version = "1.19.0";
+  version = "1.20.0";

  src = fetchurl {
    url = "https://github.com/th-ch/youtube-music/releases/download/v${version}/YouTube-Music-${version}.AppImage";
-    sha256 = "sha256-o/a+6EKPEcE9waXQK3hxtp7FPqokteoUAt0iOJk8bYw=";
+    hash = "sha256-eTPWLD9KUs2ZsLbYRkknnx5uDyrNSbFHPyv6gU+wL/c=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/prolog/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/prolog/default.nix
@@ -1,19 +1,14 @@
-{ lib, stdenv, fetchurl }:
+{ lib, trivialBuild, fetchurl }:

-stdenv.mkDerivation {
+trivialBuild {
  pname = "prolog-mode";
  version = "1.28";

  src = fetchurl {
-    url = "http://bruda.ca/_media/emacs/prolog.el";
+    url = "https://bruda.ca/_media/emacs/prolog.el";
    sha256 = "ZzIDFQWPq1vI9z3btgsHgn0axN6uRQn9Tt8TnqGybOk=";
  };

-  buildCommand = ''
-    mkdir -p $out/share/emacs/site-lisp/
-    cp $src $out/share/emacs/site-lisp/prolog.el
-  '';
-
  meta = {
    homepage = "https://bruda.ca/emacs/prolog_mode_for_emacs/";
    description = "Prolog mode for Emacs";
--- a/pkgs/applications/editors/helix/Cargo.lock
+++ b/pkgs/applications/editors/helix/Cargo.lock
--- a/pkgs/applications/editors/helix/default.nix
+++ b/pkgs/applications/editors/helix/default.nix
@@ -1,33 +1,33 @@
-{ fetchzip, lib, rustPlatform, installShellFiles, makeWrapper }:
+{ fetchFromGitHub, lib, rustPlatform, installShellFiles, makeWrapper, callPackage }:
+
+let
+  version = "23.05";
+
+  src = fetchFromGitHub {
+    owner = "helix-editor";
+    repo = "helix";
+    rev = "${version}";
+    hash = "sha256-Ws9uWtZLvTwL5HNonFr4YwyPoTU8QlCvhs6IJ92aLDw=";
+  };
+
+  grammars = callPackage ./grammars.nix { };
+in rustPlatform.buildRustPackage {
+  inherit src version;

-rustPlatform.buildRustPackage rec {
  pname = "helix";
-  version = "23.03";
-
  # This release tarball includes source code for the tree-sitter grammars,
  # which is not ordinarily part of the repository.
-  src = fetchzip {
-    url = "https://github.com/helix-editor/helix/releases/download/${version}/helix-${version}-source.tar.xz";
-    hash = "sha256-FtY2V7za3WGeUaC2t2f63CcDUEg9zAS2cGUWI0YeGwk=";
-    stripRoot = false;
-  };
-
-  # should be removed, when tree-sitter is not used as a git checkout anymore
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "tree-sitter-0.20.9" = "sha256-/PaFaASOT0Z8FpipX5uiRCjnv1kyZtg4B9+TnHA0yTY=";
-    };
-  };
+  cargoSha256 = "sha256-/LCtfyDAA2JuioBD/CDMv6OOxM0B9A3PpuVP/YY5oF0=";

  nativeBuildInputs = [ installShellFiles makeWrapper ];

  postInstall = ''
-    # not needed at runtime
-    rm -r runtime/grammars/sources
+    # We self build the grammar files
+    rm -r runtime/grammars

    mkdir -p $out/lib
    cp -r runtime $out/lib
+    ln -s ${grammars} $out/lib/runtime/grammars
    installShellCompletion contrib/completion/hx.{bash,fish,zsh}
    mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
    cp contrib/Helix.desktop $out/share/applications
@@ -37,6 +37,11 @@ rustPlatform.buildRustPackage rec {
    wrapProgram $out/bin/hx --set HELIX_RUNTIME $out/lib/runtime
  '';

+  # disable fetching and building of tree-sitter grammars in favor of the custom build process in ./grammars.nix
+  env.HELIX_DISABLE_AUTO_GRAMMAR_BUILD = "1";
+
+  passthru.updateScript = ./update.py;
+
  meta = with lib; {
    description = "A post-modern modal text editor";
    homepage = "https://helix-editor.com";
--- a/pkgs/applications/editors/helix/grammars.nix
+++ b/pkgs/applications/editors/helix/grammars.nix
@@ -0,0 +1,107 @@
+{
+  stdenv,
+  lib,
+  runCommand,
+  includeGrammarIf ? _: true,
+  fetchFromGitHub,
+  fetchgit,
+  ...
+}: let
+  # similiar to https://github.com/helix-editor/helix/blob/23.05/grammars.nix
+  grammars = builtins.fromJSON (builtins.readFile ./language-grammars.json);
+  isGitGrammar = grammar:
+    builtins.hasAttr "source" grammar
+    && builtins.hasAttr "git" grammar.source
+    && builtins.hasAttr "rev" grammar.source;
+  isGitHubGrammar = grammar: lib.hasPrefix "https://github.com" grammar.source.git;
+  toGitHubFetcher = url: let
+    match = builtins.match "https://github\.com/([^/]*)/([^/]*)/?" url;
+  in {
+    owner = builtins.elemAt match 0;
+    repo = builtins.elemAt match 1;
+  };
+  gitGrammars = builtins.filter isGitGrammar grammars;
+  buildGrammar = grammar: let
+    gh = toGitHubFetcher grammar.source.git;
+    sourceGit = fetchgit {
+      url = grammar.source.git;
+      inherit (grammar.source) rev sha256;
+    };
+    sourceGitHub = fetchFromGitHub {
+      owner = gh.owner;
+      repo = gh.repo;
+      inherit (grammar.source) rev sha256;
+    };
+    source =
+      if isGitHubGrammar grammar
+      then sourceGitHub
+      else sourceGit;
+  in
+    stdenv.mkDerivation rec {
+      # similar to tree-sitter grammar generation
+      pname = "helix-tree-sitter-grammar-${grammar.name}";
+      version = grammar.source.rev;
+
+      src =
+        if builtins.hasAttr "subpath" grammar.source
+        then "${source}/${grammar.source.subpath}"
+        else source;
+
+      dontUnpack = true;
+      dontConfigure = true;
+
+      FLAGS = [
+        "-I${src}/src"
+        "-g"
+        "-O3"
+        "-fPIC"
+        "-fno-exceptions"
+        "-Wl,-z,relro,-z,now"
+      ];
+
+      NAME = grammar.name;
+
+      buildPhase = ''
+        runHook preBuild
+
+        if [[ -e "$src/src/scanner.cc" ]]; then
+          $CXX -c "$src/src/scanner.cc" -o scanner.o $FLAGS
+        elif [[ -e "$src/src/scanner.c" ]]; then
+          $CC -c "$src/src/scanner.c" -o scanner.o $FLAGS
+        fi
+
+        $CC -c "$src/src/parser.c" -o parser.o $FLAGS
+        $CXX -shared -o $NAME.so *.o
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+        mkdir $out
+        mv $NAME.so $out/
+        runHook postInstall
+      '';
+
+      # Strip failed on darwin: strip: error: symbols referenced by indirect symbol table entries that can't be stripped
+      fixupPhase = lib.optionalString stdenv.isLinux ''
+        runHook preFixup
+        $STRIP $out/$NAME.so
+        runHook postFixup
+      '';
+    };
+  grammarsToBuild = builtins.filter includeGrammarIf gitGrammars;
+  builtGrammars =
+    builtins.map (grammar: {
+      inherit (grammar) name;
+      artifact = buildGrammar grammar;
+    })
+    grammarsToBuild;
+  grammarLinks =
+    builtins.map (grammar: "ln -s ${grammar.artifact}/${grammar.name}.so $out/${grammar.name}.so")
+    builtGrammars;
+in
+  runCommand "helix-tree-sitter-grammars" {} ''
+    mkdir -p $out
+    ${builtins.concatStringsSep "\n" grammarLinks}
+  ''
--- a/pkgs/applications/editors/helix/language-grammars.json
+++ b/pkgs/applications/editors/helix/language-grammars.json
--- a/pkgs/applications/editors/helix/update.py
+++ b/pkgs/applications/editors/helix/update.py
@@ -0,0 +1,47 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python3 -p nix-update python3 python3Packages.requests python3.pkgs.tomlkit nix-prefetch-git
+import tomlkit
+import json
+import requests
+import subprocess
+from pathlib import Path
+
+latest_release_url = "https://api.github.com/repos/helix-editor/helix/releases/latest"
+
+
+def get_latest_release():
+    res = requests.get(latest_release_url)
+    res.raise_for_status()
+    return res.json()["tag_name"]
+
+
+def get_grammar_config():
+    res = requests.get(f"https://raw.githubusercontent.com/helix-editor/helix/{version}/languages.toml")
+    res.raise_for_status()
+    return tomlkit.parse(res.text)["grammar"]
+
+
+def calculate_sha256(url, rev):
+    out = subprocess.check_output([
+        "nix-prefetch-git", "--quiet",
+        "--url", url,
+        "--rev", rev])
+    return json.loads(out)["sha256"]
+
+
+version = get_latest_release()
+grammars = get_grammar_config()
+for grammar in grammars:
+    if grammar["source"].get("git") is not None:
+        grammar["source"]["sha256"] = calculate_sha256(
+            grammar["source"]["git"], grammar["source"]["rev"])
+
+json_grammars = json.dumps(grammars)
+
+with open(Path(__file__).parent / "language-grammars.json", "w") as file:
+    file.write(json_grammars + "\n")
+
+subprocess.run([
+    "nix-update", "helix",
+    "--version", version,
+])
--- a/Show More
+++ b/Show More