Merge master into haskell-updates

2026-09-29 03:10:19 +00:00 · 2022-10-30 00:18:02 +00:00
parent 6451493ab5 960c82945c
commit 353f91c930
202 changed files with 2566 additions and 1390 deletions
--- a/flake.nix
+++ b/flake.nix
@@ -45,6 +45,15 @@
        }).nixos.manual.x86_64-linux;
      };

+      # The "legacy" in `legacyPackages` doesn't imply that the packages exposed
+      # through this attribute are "legacy" packages. Instead, `legacyPackages`
+      # is used here as a substitute attribute name for `packages`. The problem
+      # with `packages` is that it makes operations like `nix flake show
+      # nixpkgs` unusably slow due to the sheer number of packages the Nix CLI
+      # needs to evaluate. But when the Nix CLI sees a `legacyPackages`
+      # attribute it displays `omitted` instead of evaluating all packages,
+      # which keeps `nix flake show` on Nixpkgs reasonably fast, though less
+      # information rich.
      legacyPackages = forAllSystems (system: import ./. { inherit system; });

      nixosModules = {
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6000,6 +6000,12 @@
    github = "j0hax";
    githubId = 3802620;
  };
+  j0lol = {
+    name = "Jo";
+    email = "me@j0.lol";
+    github = "j0lol";
+    githubId = 24716467;
+  };
  j4m3s = {
    name = "James Landrein";
    email = "github@j4m3s.eu";
@@ -7375,6 +7381,12 @@
    githubId = 2037002;
    name = "Konstantinos";
  };
+  kototama = {
+    email = "kototama@posteo.jp";
+    github = "kototama";
+    githubId = 128620;
+    name = "Kototama";
+  };
  kouyk = {
    email = "skykinetic@stevenkou.xyz";
    github = "kouyk";
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -874,6 +874,18 @@
          <literal>hardware.saleae-logic.package</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          ZFS module will not allow hibernation by default, this is a
+          safety measure to prevent data loss cases like the ones
+          described at
+          <link xlink:href="https://github.com/openzfs/zfs/issues/260">OpenZFS/260</link>
+          and
+          <link xlink:href="https://github.com/openzfs/zfs/issues/12842">OpenZFS/12842</link>.
+          Use the <literal>boot.zfs.allowHibernation</literal> option to
+          configure this behaviour.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The Redis module now disables RDB persistence when
@@ -894,6 +906,23 @@
          the mtu on interfaces and tag its packets with an fwmark.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The option <literal>overrideStrategy</literal> was added to
+          the different systemd unit options
+          (<literal>systemd.services.&lt;name&gt;</literal>,
+          <literal>systemd.sockets.&lt;name&gt;</literal>, …) to allow
+          enforcing the creation of a dropin file, rather than the main
+          unit file, by setting it to <literal>asDropin</literal>. This
+          is useful in cases where the existence of the main unit file
+          is not known to Nix at evaluation time, for example when the
+          main unit file is provided by adding a package to
+          <literal>systemd.packages</literal>. See the fix proposed in
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/135557#issuecomment-1295392470">NixOS’s
+          systemd abstraction doesn’t work with systemd template
+          units</link> for an example.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The <literal>polymc</literal> package has been removed due to
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -273,12 +273,18 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).

 - A new module was added for the Saleae Logic device family, providing the options `hardware.saleae-logic.enable` and `hardware.saleae-logic.package`.

+- ZFS module will not allow hibernation by default, this is a safety measure to prevent data loss cases like the ones described at [OpenZFS/260](https://github.com/openzfs/zfs/issues/260) and [OpenZFS/12842](https://github.com/openzfs/zfs/issues/12842). Use the `boot.zfs.allowHibernation` option to configure this behaviour.
+
 - The Redis module now disables RDB persistence when `services.redis.servers.<name>.save = []` instead of using the Redis default.

 - Neo4j was updated from version 3 to version 4. See this [migration guide](https://neo4j.com/docs/upgrade-migration-guide/current/) on how to migrate your Neo4j instance.

 - The `networking.wireguard` module now can set the mtu on interfaces and tag its packets with an fwmark.

+- The option `overrideStrategy` was added to the different systemd unit options (`systemd.services.<name>`, `systemd.sockets.<name>`, …) to allow enforcing the creation of a dropin file, rather than the main unit file, by setting it to `asDropin`.
+  This is useful in cases where the existence of the main unit file is not known to Nix at evaluation time, for example when the main unit file is provided by adding a package to `systemd.packages`.
+  See the fix proposed in [NixOS's systemd abstraction doesn't work with systemd template units](https://github.com/NixOS/nixpkgs/issues/135557#issuecomment-1295392470) for an example.
+
 - The `polymc` package has been removed due to a rogue maintainer. It has been
  replaced by `prismlauncher`, a fork by the rest of the maintainers. For more
  details, see [the pull request that made this
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@@ -26,8 +26,8 @@ let
    Type = "oneshot";
    User = user;
    Group = mkDefault "acme";
-    UMask = 0022;
-    StateDirectoryMode = 750;
+    UMask = "0022";
+    StateDirectoryMode = "750";
    ProtectSystem = "strict";
    ReadWritePaths = [
      "/var/lib/acme"
@@ -85,7 +85,7 @@ let
    serviceConfig = commonServiceConfig // {
      StateDirectory = "acme/.minica";
      BindPaths = "/var/lib/acme/.minica:/tmp/ca";
-      UMask = 0077;
+      UMask = "0077";
    };

    # Working directory will be /tmp
@@ -243,7 +243,7 @@ let

      serviceConfig = commonServiceConfig // {
        Group = data.group;
-        UMask = 0027;
+        UMask = "0027";

        StateDirectory = "acme/${cert}";

--- a/nixos/modules/services/databases/postgresql.xml
+++ b/nixos/modules/services/databases/postgresql.xml
@@ -72,16 +72,20 @@ Type "help" for help.
 { config, pkgs, ... }:
 {
  <xref linkend="opt-environment.systemPackages" /> = [
-    (pkgs.writeScriptBin "upgrade-pg-cluster" ''
+    (let
+      # XXX specify the postgresql package you'd like to upgrade to.
+      # Do not forget to list the extensions you need.
+      newPostgres = pkgs.postgresql_13.withPackages (pp: [
+        # pp.plv8
+      ]);
+    in pkgs.writeScriptBin "upgrade-pg-cluster" ''
      set -eux
      # XXX it's perhaps advisable to stop all services that depend on postgresql
      systemctl stop postgresql

-      # XXX replace `&lt;new version&gt;` with the psqlSchema here
-      export NEWDATA="/var/lib/postgresql/&lt;new version&gt;"
+      export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"

-      # XXX specify the postgresql package you'd like to upgrade to
-      export NEWBIN="${pkgs.postgresql_13}/bin"
+      export NEWBIN="${newPostgres}/bin"

      export OLDDATA="${config.<xref linkend="opt-services.postgresql.dataDir"/>}"
      export OLDBIN="${config.<xref linkend="opt-services.postgresql.package"/>}/bin"
@@ -127,12 +131,25 @@ Type "help" for help.
   </listitem>
   <listitem>
    <para>
-     After the upgrade it's advisable to analyze the new cluster (as <literal>su -l postgres</literal> in the
-     <xref linkend="opt-services.postgresql.dataDir" />, in this example <filename>/var/lib/postgresql/13</filename>):
+     After the upgrade it's advisable to analyze the new cluster.
+    </para>
+    <itemizedlist>
+     <listitem>
+      <para>
+       For PostgreSQL ≥ 14, use the <literal>vacuumdb</literal> command printed by the upgrades script.
+      </para>
+     </listitem>
+     <listitem>
+       <para>
+        For PostgreSQL &lt; 14, run (as <literal>su -l postgres</literal> in the <xref linkend="opt-services.postgresql.dataDir" />, in this example <filename>/var/lib/postgresql/13</filename>):
 <programlisting>
 <prompt>$ </prompt>./analyze_new_cluster.sh
 </programlisting>
-     <warning><para>The next step removes the old state-directory!</para></warning>
+       </para>
+     </listitem>
+    </itemizedlist>
+    <para>
+      <warning><para>The next step removes the old state-directory!</para></warning>
 <programlisting>
 <prompt>$ </prompt>./delete_old_cluster.sh
 </programlisting>
--- a/nixos/modules/services/logging/journalwatch.nix
+++ b/nixos/modules/services/logging/journalwatch.nix
@@ -239,7 +239,7 @@ in {
        Type = "oneshot";
        # requires a relative directory name to create beneath /var/lib
        StateDirectory = user;
-        StateDirectoryMode = 0750;
+        StateDirectoryMode = "0750";
        ExecStart = "${pkgs.python3Packages.journalwatch}/bin/journalwatch mail";
        # lowest CPU and IO priority, but both still in best-effort class to prevent starvation
        Nice=19;
--- a/nixos/modules/services/matrix/appservice-discord.nix
+++ b/nixos/modules/services/matrix/appservice-discord.nix
@@ -137,7 +137,7 @@ in {
        PrivateTmp = true;
        WorkingDirectory = appDir;
        StateDirectory = baseNameOf dataDir;
-        UMask = 0027;
+        UMask = "0027";
        EnvironmentFile = cfg.environmentFile;

        ExecStart = ''
--- a/nixos/modules/services/matrix/mautrix-telegram.nix
+++ b/nixos/modules/services/matrix/mautrix-telegram.nix
@@ -162,7 +162,7 @@ in {
        PrivateTmp = true;
        WorkingDirectory = pkgs.mautrix-telegram; # necessary for the database migration scripts to be found
        StateDirectory = baseNameOf dataDir;
-        UMask = 0027;
+        UMask = "0027";
        EnvironmentFile = cfg.environmentFile;

        ExecStart = ''
--- a/nixos/modules/services/misc/geoipupdate.nix
+++ b/nixos/modules/services/misc/geoipupdate.nix
@@ -183,7 +183,7 @@ in
        DynamicUser = true;
        ReadWritePaths = cfg.settings.DatabaseDirectory;
        RuntimeDirectory = "geoipupdate";
-        RuntimeDirectoryMode = 0700;
+        RuntimeDirectoryMode = "0700";
        CapabilityBoundingSet = "";
        PrivateDevices = true;
        PrivateMounts = true;
--- a/nixos/modules/services/misc/mx-puppet-discord.nix
+++ b/nixos/modules/services/misc/mx-puppet-discord.nix
@@ -107,7 +107,7 @@ in {
        PrivateTmp = true;
        WorkingDirectory = pkgs.mx-puppet-discord;
        StateDirectory = baseNameOf dataDir;
-        UMask = 0027;
+        UMask = "0027";

        ExecStart = ''
          ${pkgs.mx-puppet-discord}/bin/mx-puppet-discord \
--- a/nixos/modules/services/misc/rmfakecloud.nix
+++ b/nixos/modules/services/misc/rmfakecloud.nix
@@ -138,7 +138,7 @@ in {
        SystemCallArchitectures = "native";
        WorkingDirectory = serviceDataDir;
        StateDirectory = baseNameOf serviceDataDir;
-        UMask = 0027;
+        UMask = "0027";
      };
    };
  };
--- a/nixos/modules/services/monitoring/parsedmarc.nix
+++ b/nixos/modules/services/monitoring/parsedmarc.nix
@@ -494,7 +494,7 @@ in
            Group = "parsedmarc";
            DynamicUser = true;
            RuntimeDirectory = "parsedmarc";
-            RuntimeDirectoryMode = 0700;
+            RuntimeDirectoryMode = "0700";
            CapabilityBoundingSet = "";
            PrivateDevices = true;
            PrivateMounts = true;
--- a/nixos/modules/services/ttys/getty.nix
+++ b/nixos/modules/services/ttys/getty.nix
@@ -146,7 +146,7 @@ in
        enable = mkDefault config.boot.isContainer;
      };

-    environment.etc.issue =
+    environment.etc.issue = mkDefault
      { # Friendly greeting on the virtual consoles.
        source = pkgs.writeText "issue" ''

--- a/nixos/modules/services/web-apps/bookstack.nix
+++ b/nixos/modules/services/web-apps/bookstack.nix
@@ -372,7 +372,7 @@ in {
        User = user;
        WorkingDirectory = "${bookstack}";
        RuntimeDirectory = "bookstack/cache";
-        RuntimeDirectoryMode = 0700;
+        RuntimeDirectoryMode = "0700";
      };
      path = [ pkgs.replace-secret ];
      script =
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@@ -798,13 +798,13 @@ in
          "public"
          "sockets"
        ];
-        RuntimeDirectoryMode = 0750;
+        RuntimeDirectoryMode = "0750";
        StateDirectory = map (p: "discourse/" + p) [
          "uploads"
          "backups"
          "tmp"
        ];
-        StateDirectoryMode = 0750;
+        StateDirectoryMode = "0750";
        LogsDirectory = "discourse";
        TimeoutSec = "infinity";
        Restart = "on-failure";
--- a/nixos/modules/services/web-apps/keycloak.nix
+++ b/nixos/modules/services/web-apps/keycloak.nix
@@ -616,7 +616,7 @@ in
              Group = "keycloak";
              DynamicUser = true;
              RuntimeDirectory = "keycloak";
-              RuntimeDirectoryMode = 0700;
+              RuntimeDirectoryMode = "0700";
              AmbientCapabilities = "CAP_NET_BIND_SERVICE";
            };
            script = ''
--- a/nixos/modules/services/web-apps/snipe-it.nix
+++ b/nixos/modules/services/web-apps/snipe-it.nix
@@ -394,7 +394,7 @@ in {
        User = user;
        WorkingDirectory = snipe-it;
        RuntimeDirectory = "snipe-it/cache";
-        RuntimeDirectoryMode = 0700;
+        RuntimeDirectoryMode = "0700";
      };
      path = [ pkgs.replace-secret ];
      script =
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@@ -226,6 +226,15 @@ in
          '';
      };

+      allowHibernation = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Allow hibernation support, this may be a unsafe option depending on your
+          setup. Make sure to NOT use Swap on ZFS.
+        '';
+      };
+
      extraPools = mkOption {
        type = types.listOf types.str;
        default = [];
@@ -498,6 +507,10 @@ in

      boot = {
        kernelModules = [ "zfs" ];
+        # https://github.com/openzfs/zfs/issues/260
+        # https://github.com/openzfs/zfs/issues/12842
+        # https://github.com/NixOS/nixpkgs/issues/106093
+        kernelParams = lib.optionals (!config.boot.zfs.allowHibernation) [ "nohibernate" ];

        extraModulePackages = [
          (if config.boot.zfs.enableUnstable then
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -147,6 +147,7 @@ stdenv.mkDerivation rec {
  ];

  cmakeFlags = [
+    "-DAUDACITY_BUILD_LEVEL=2"
    "-DAUDACITY_REV_LONG=nixpkgs"
    "-DAUDACITY_REV_TIME=nixpkgs"
    "-DDISABLE_DYNAMIC_LOADING_FFMPEG=ON"
--- a/pkgs/applications/audio/mmlgui/default.nix
+++ b/pkgs/applications/audio/mmlgui/default.nix
@@ -15,14 +15,14 @@

 stdenv.mkDerivation rec {
  pname = "mmlgui";
-  version = "unstable-2022-09-15";
+  version = "unstable-2022-10-13";

  src = fetchFromGitHub {
    owner = "superctr";
    repo = "mmlgui";
-    rev = "163cc73a7c009d524b0d5aff94f9ed47fe19e3ce";
+    rev = "6b2687504644b481db403f032f463e38bbbb1dca";
    fetchSubmodules = true;
-    sha256 = "kKo3ge2wcDK2xU1YCfEwyqw84N+3jcbOEEsJHSpMpzY=";
+    sha256 = "OkYVjdvi8ls01DaIiDEPFXFCUh6g9AEeSlbDFfdPKeo=";
  };

  postPatch = ''
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "pt2-clone";
-  version = "1.53";
+  version = "1.53.1";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${version}";
-    sha256 = "sha256-zW/uNJr2cip1JbFLKyB6TD75p1v9/dQu9kmtKXckc2c=";
+    sha256 = "sha256-7qBvv4D86uX8oqqJ+UDI+fbaG5g1+Zg1otuU9lqyTdo=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -582,8 +582,8 @@ let
        mktplcRef = {
          name = "catppuccin-vsc";
          publisher = "catppuccin";
-          version = "2.1.0";
-          sha256 = "sha256-1pX9NQxW2Rm9p912Pn7QmLmXPI7EmiXTnCLWsIQNFhY=";
+          version = "2.2.1";
+          sha256 = "sha256-vS+hz3RxG71F5QoO4LQOgOgFh6GQ8QX/+4mMD0KC1kA=";
        };
        meta = with lib; {
          description = "Soothing pastel theme for VSCode";
@@ -1731,8 +1731,8 @@ let
        mktplcRef = {
          name = "direnv";
          publisher = "mkhl";
-          version = "0.6.1";
-          sha256 = "sha256-5/Tqpn/7byl+z2ATflgKV1+rhdqj+XMEZNbGwDmGwLQ=";
+          version = "0.7.0";
+          sha256 = "sha256-MLBPhDBU8vPVvbde3fdwhxKvQa8orUMKAAXoOfNrbh4=";
        };
        meta = with lib; {
          description = "direnv support for Visual Studio Code";
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -15,11 +15,11 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1qchwn6dccmq81bmz4zpv5pc6g2gyd7avi9hi1dd099jcxl9xgc8";
-    x86_64-darwin = "099s32kbv64s90jy1yrafwmn49f80x4qzq3kwpwpkp6vfsclvnvw";
-    aarch64-linux = "1a1rp0gki86dw03lhlnn5l378jd6z7v736x17qsbyc3qfm5schil";
-    aarch64-darwin = "153jp14zjzrdw4nwfg9mja0vy9m376dfxf2d6iwb7gl6byvqa1jj";
-    armv7l-linux = "1g5dxcly41bxdnfvmybwxrlf2qm3lkb3k0i538wfwxzy8k73i5h5";
+    x86_64-linux = "0bc95mdl19la63yvqrpfcvq9sx68wfv60a3xrz2z5lk308khfpr6";
+    x86_64-darwin = "0qb8610ilf69j0zl7z031bmqdsxsj15w1maz7lx0z09yrdyvgi7c";
+    aarch64-linux = "157arn7wsxgh3qr4bzhy75y7zw9qwz1zch7ny36kr53135d2nhz6";
+    aarch64-darwin = "0dwzqv1j1gcjyc1w41f9k1pijazr62r569arh4l53xi7amrp7hx8";
+    armv7l-linux = "1lam1z8hqdav4al07d1ahq4qh2npv191n2gqpdxg5b1fs7zv3k85";
  }.${system} or throwSystem;

  sourceRoot = if stdenv.isDarwin then "" else ".";
@@ -29,7 +29,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.72.2.22286";
+    version = "1.72.2.22289";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mame";
-  version = "0.243";
+  version = "0.249";

  src = fetchFromGitHub {
    owner = "mamedev";
    repo = "mame";
    rev = "mame${builtins.replaceStrings [ "." ] [ "" ] version}";
-    sha256 = "sha256-dUgYLNvgvolz9M0ySkGJIZjVMBQwejkxsZ6npg8rIqk=";
+    sha256 = "sha256-im6y/E0pQxruX2kNXZLE3fHq+zXfsstnOoC1QvH4fd4=";
  };

  hardeningDisable = [ "fortify" ];
--- a/pkgs/applications/emulators/mame/emuopts.patch
+++ b/pkgs/applications/emulators/mame/emuopts.patch
@@ -1,29 +1,32 @@
-diff --git a/src/emu/emuopts.cpp b/src/emu/emuopts.cpp
-index c42fcef848..d1bddae060 100644
--- a/src/emu/emuopts.cpp
-+++ b/src/emu/emuopts.cpp
-@@ -36,16 +36,16 @@ const options_entry emu_options::s_option_entries[] =
- 	{ nullptr,                                           nullptr,     OPTION_HEADER,     "CORE SEARCH PATH OPTIONS" },
- 	{ OPTION_HOMEPATH,                                   ".",         OPTION_STRING,     "path to base folder for plugin data (read/write)" },
- 	{ OPTION_MEDIAPATH ";rp;biospath;bp",                "roms",      OPTION_STRING,     "path to ROM sets and hard disk images" },
-	{ OPTION_HASHPATH ";hash_directory;hash",            "hash",      OPTION_STRING,     "path to software definition files" },
-	{ OPTION_SAMPLEPATH ";sp",                           "samples",   OPTION_STRING,     "path to audio sample sets" },
-	{ OPTION_ARTPATH,                                    "artwork",   OPTION_STRING,     "path to artwork files" },
-	{ OPTION_CTRLRPATH,                                  "ctrlr",     OPTION_STRING,     "path to controller definitions" },
-	{ OPTION_INIPATH,                                    ".;ini;ini/presets",     OPTION_STRING,     "path to ini files" },
-	{ OPTION_FONTPATH,                                   ".",         OPTION_STRING,     "path to font files" },
-+	{ OPTION_HASHPATH ";hash_directory;hash",            "hash;@mame@/hash",      OPTION_STRING,     "path to software definition files" },
-+	{ OPTION_SAMPLEPATH ";sp",                           "samples;@mame@/samples",   OPTION_STRING,     "path to audio sample sets" },
-+	{ OPTION_ARTPATH,                                    "artwork;@mame@/artwork",   OPTION_STRING,     "path to artwork files" },
-+	{ OPTION_CTRLRPATH,                                  "ctrlr;@mame@/ctrlr",     OPTION_STRING,     "path to controller definitions" },
-+	{ OPTION_INIPATH,                                    ".;ini;ini/presets;@mame@/ini/presets",     OPTION_STRING,     "path to ini files" },
-+	{ OPTION_FONTPATH,                                   ".;@mame@",         OPTION_STRING,     "path to font files" },
- 	{ OPTION_CHEATPATH,                                  "cheat",     OPTION_STRING,     "path to cheat files" },
- 	{ OPTION_CROSSHAIRPATH,                              "crosshair", OPTION_STRING,     "path to crosshair files" },
-	{ OPTION_PLUGINSPATH,                                "plugins",   OPTION_STRING,     "path to plugin files" },
-	{ OPTION_LANGUAGEPATH,                               "language",  OPTION_STRING,     "path to UI translation files" },
-+	{ OPTION_PLUGINSPATH,                                "plugins;@mame@/plugins",   OPTION_STRING,     "path to plugin files" },
-+	{ OPTION_LANGUAGEPATH,                               "language;@mame@/language",  OPTION_STRING,     "path to UI translation files" },
- 	{ OPTION_SWPATH,                                     "software",  OPTION_STRING,     "path to loose software" },
+--- a/src/emu/emuopts.cpp	2022-10-29 15:05:18.591381088 +0200
+++ b/src/emu/emuopts.cpp	2022-10-29 15:10:10.938037551 +0200
+@@ -39,16 +39,16 @@
+ 	{ nullptr,                                           nullptr,     core_options::option_type::HEADER,     "CORE SEARCH PATH OPTIONS" },
+ 	{ OPTION_PLUGINDATAPATH,                             ".",         core_options::option_type::STRING,     "path to base folder for plugin data (read/write)" },
+ 	{ OPTION_MEDIAPATH ";rp;biospath;bp",                "roms",      core_options::option_type::STRING,     "path to ROM sets and hard disk images" },
+-	{ OPTION_HASHPATH ";hash_directory;hash",            "hash",      core_options::option_type::STRING,     "path to software definition files" },
+-	{ OPTION_SAMPLEPATH ";sp",                           "samples",   core_options::option_type::STRING,     "path to audio sample sets" },
+-	{ OPTION_ARTPATH,                                    "artwork",   core_options::option_type::STRING,     "path to artwork files" },
+-	{ OPTION_CTRLRPATH,                                  "ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
+-	{ OPTION_INIPATH,                                    ".;ini;ini/presets",     core_options::option_type::STRING,     "path to ini files" },
+-	{ OPTION_FONTPATH,                                   ".",         core_options::option_type::STRING,     "path to font files" },
+	{ OPTION_HASHPATH ";hash_directory;hash",            "hash;@mame@/hash",      core_options::option_type::STRING,     "path to software definition files" },
+	{ OPTION_SAMPLEPATH ";sp",                           "samples;@mame@/samples",   core_options::option_type::STRING,     "path to audio sample sets" },
+	{ OPTION_ARTPATH,                                    "artwork;@mame@/artwork",   core_options::option_type::STRING,     "path to artwork files" },
+	{ OPTION_CTRLRPATH,                                  "ctrlr;@mame@/ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
+	{ OPTION_INIPATH,                                    ".;ini;ini/presets;@mame@/ini/presets",     core_options::option_type::STRING,     "path to ini files" },
+	{ OPTION_FONTPATH,                                   ".;@mame@",         core_options::option_type::STRING,     "path to font files" },
+ 	{ OPTION_CHEATPATH,                                  "cheat",     core_options::option_type::STRING,     "path to cheat files" },
+ 	{ OPTION_CROSSHAIRPATH,                              "crosshair", core_options::option_type::STRING,     "path to crosshair files" },
+-	{ OPTION_PLUGINSPATH,                                "plugins",   core_options::option_type::STRING,     "path to plugin files" },
+-	{ OPTION_LANGUAGEPATH,                               "language",  core_options::option_type::STRING,     "path to UI translation files" },
+	{ OPTION_PLUGINSPATH,                                "plugins;@mame@/plugins",   core_options::option_type::STRING,     "path to plugin files" },
+	{ OPTION_LANGUAGEPATH,                               "language;@mame@/language",  core_options::option_type::STRING,     "path to UI translation files" },
+ 	{ OPTION_SWPATH,                                     "software",  core_options::option_type::STRING,     "path to loose software" },
 
 	// output directory options
+@@ -1301,3 +1301,4 @@
+ 	m_entry = entry;
+ 	return entry;
+ }
+
--- a/pkgs/applications/emulators/retroarch/cores.nix
+++ b/pkgs/applications/emulators/retroarch/cores.nix
--- a/pkgs/applications/emulators/retroarch/default.nix
+++ b/pkgs/applications/emulators/retroarch/default.nix
@@ -6,18 +6,17 @@
 , withVulkan ? stdenv.isLinux
 , withWayland ? stdenv.isLinux
 , alsa-lib
-, AppKit
 , dbus
 , fetchFromGitHub
 , ffmpeg_4
-, Foundation
+, flac
 , freetype
 , gamemode
 , libdrm
 , libGL
 , libGLU
-, libobjc
 , libpulseaudio
+, libretro-core-info
 , libv4l
 , libX11
 , libXdmcp
@@ -26,71 +25,61 @@
 , libxml2
 , libXxf86vm
 , makeWrapper
+, mbedtls
 , mesa
 , nvidia_cg_toolkit
 , pkg-config
 , python3
 , SDL2
+, substituteAll
 , udev
 , vulkan-loader
 , wayland
+, zlib
 }:

 let
-  version = "1.12.0";
-  libretroCoreInfo = fetchFromGitHub {
-    owner = "libretro";
-    repo = "libretro-core-info";
-    sha256 = "sha256-9Sfp/JkMJIe34YGNRxf93fONOBuQxR2pduoJU+xtuF0=";
-    # Upstream didn't tag a new libretro-core-info in 1.12.0 release
-    rev = "v1.11.1";
-  };
  runtimeLibs =
    lib.optional withVulkan vulkan-loader ++
    lib.optional withGamemode (lib.getLib gamemode);
 in
 stdenv.mkDerivation rec {
  pname = "retroarch-bare";
-  inherit version;
+  version = "1.12.0";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "RetroArch";
-    sha256 = "sha256-doLWNA8aTAllxx3zABtvZaegBQEPIi8276zbytPSdBU=";
+    hash = "sha256-doLWNA8aTAllxx3zABtvZaegBQEPIi8276zbytPSdBU=";
    rev = "v${version}";
  };

  patches = [
-    ./use-fixed-paths.patch
+    (substituteAll {
+      src = ./use-fixed-path-for-libretro_core_info.patch;
+      libretro_info_path = libretro-core-info;
+    })
  ];

-  postPatch = ''
-    substituteInPlace "frontend/drivers/platform_unix.c" \
-      --subst-var-by libretro_directory "$out/lib" \
-      --subst-var-by libretro_info_path "$out/share/libretro/info" \
-      --subst-var-by out "$out"
-    substituteInPlace "frontend/drivers/platform_darwin.m" \
-      --subst-var-by libretro_directory "$out/lib" \
-      --subst-var-by libretro_info_path "$out/share/libretro/info"
-  '';
-
  nativeBuildInputs = [ pkg-config ] ++
    lib.optional withWayland wayland ++
    lib.optional (runtimeLibs != [ ]) makeWrapper;

  buildInputs = [
    ffmpeg_4
+    flac
    freetype
    libGL
    libGLU
    libxml2
+    mbedtls
    python3
    SDL2
+    zlib
  ] ++
  lib.optional enableNvidiaCgToolkit nvidia_cg_toolkit ++
  lib.optional withVulkan vulkan-loader ++
  lib.optional withWayland wayland ++
-  lib.optionals stdenv.isDarwin [ libobjc AppKit Foundation ] ++
  lib.optionals stdenv.isLinux [
    alsa-lib
    dbus
@@ -110,6 +99,9 @@ stdenv.mkDerivation rec {

  configureFlags = [
    "--disable-update_cores"
+    "--disable-builtinmbedtls"
+    "--disable-builtinzlib"
+    "--disable-builtinflac"
  ] ++
  lib.optionals stdenv.isLinux [
    "--enable-dbus"
@@ -117,39 +109,13 @@ stdenv.mkDerivation rec {
    "--enable-kms"
  ];

-  postInstall = ''
-    # TODO: ideally each core should have its own core information
-    mkdir -p $out/share/libretro/info
-    cp -r ${libretroCoreInfo}/* $out/share/libretro/info
-  '' +
-  lib.optionalString (runtimeLibs != [ ]) ''
+  postInstall = lib.optionalString (runtimeLibs != [ ]) ''
    wrapProgram $out/bin/retroarch \
      --prefix LD_LIBRARY_PATH ':' ${lib.makeLibraryPath runtimeLibs}
-  '' +
-  lib.optionalString stdenv.isDarwin ''
-    # https://github.com/libretro/RetroArch/blob/master/retroarch-apple-packaging.sh
-    app=$out/Applications/RetroArch.app
-    mkdir -p $app/Contents/MacOS
-    cp -r pkg/apple/OSX/* $app/Contents
-    cp $out/bin/retroarch $app/Contents/MacOS
-    # FIXME: using Info_Metal.plist results in input not working
-    # mv $app/Contents/Info_Metal.plist $app/Contents/Info.plist
-
-    substituteInPlace $app/Contents/Info.plist \
-      --replace '${"\${EXECUTABLE_NAME}"}' 'RetroArch' \
-      --replace '$(PRODUCT_BUNDLE_IDENTIFIER)' 'com.libretro.RetroArch' \
-      --replace '${"\${PRODUCT_NAME}"}' 'RetroArch' \
-      --replace '${"\${MACOSX_DEPLOYMENT_TARGET}"}' '10.13'
-
-    cp media/retroarch.icns $app/Contents/Resources/
  '';

  preFixup = "rm $out/bin/retroarch-cg2glsl";

-  # Workaround for the following error affecting newer versions of Clang:
-  # ./config.def.h:xxx:x: error: 'TARGET_OS_TV' is not defined, evaluates to 0 [-Werror,-Wundef-prefix=TARGET_OS_]
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isClang [ "-Wno-undef-prefix" ];
-
  passthru.tests = nixosTests.retroarch;

  meta = with lib; {
@@ -159,9 +125,11 @@ stdenv.mkDerivation rec {
    platforms = platforms.unix;
    changelog = "https://github.com/libretro/RetroArch/blob/v${version}/CHANGES.md";
    maintainers = with maintainers; teams.libretro.members ++ [ matthewbauer kolbycrouch ];
-    # FIXME: error while building in macOS:
-    # "Undefined symbols for architecture <arch>"
-    # See also retroarch/wrapper.nix that is also broken in macOS
+    mainProgram = "retroarch";
+    # If you want to (re)-add support for macOS, see:
+    # https://docs.libretro.com/development/retroarch/compilation/osx/
+    # and
+    # https://github.com/libretro/RetroArch/blob/71eb74d256cb4dc5b8b43991aec74980547c5069/.gitlab-ci.yml#L330
    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/applications/emulators/retroarch/libretro-core-info.nix
+++ b/pkgs/applications/emulators/retroarch/libretro-core-info.nix
@@ -0,0 +1,28 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "libretro-core-info";
+  version = "1.12.0";
+
+  src = fetchFromGitHub {
+    owner = "libretro";
+    repo = "libretro-core-info";
+    hash = "sha256-ByATDM0V40UJxigqVLyTWkHY5tiCC2dvZebksl8GsUI=";
+    rev = "v${version}";
+  };
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  dontBuild = true;
+
+  meta = with lib; {
+    description = "Libretro's core info files";
+    homepage = "https://libretro.com";
+    license = licenses.mit;
+    maintainers = with maintainers; teams.libretro.members ++ [ ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/emulators/retroarch/mkLibretroCore.nix
+++ b/pkgs/applications/emulators/retroarch/mkLibretroCore.nix
@@ -0,0 +1,80 @@
+{ lib
+, stdenv
+, core
+, makeWrapper
+, retroarch
+, zlib
+, makefile ? "Makefile.libretro"
+, extraBuildInputs ? [ ]
+, extraNativeBuildInputs ? [ ]
+  # Location of resulting RetroArch core on $out
+, libretroCore ? "/lib/retroarch/cores"
+  # The core filename is derivated from the core name
+  # Setting `normalizeCore` to `true` will convert `-` to `_` on the core filename
+, normalizeCore ? true
+, ...
+}@args:
+
+let
+  d2u = if normalizeCore then (lib.replaceChars [ "-" ] [ "_" ]) else (x: x);
+  coreDir = placeholder "out" + libretroCore;
+  coreFilename = "${d2u core}_libretro${stdenv.hostPlatform.extensions.sharedLibrary}";
+  mainProgram = "retroarch-${core}";
+  extraArgs = builtins.removeAttrs args [
+    "lib"
+    "stdenv"
+    "core"
+    "makeWrapper"
+    "retroarch"
+    "zlib"
+    "makefile"
+    "extraBuildInputs"
+    "extraNativeBuildInputs"
+    "libretroCore"
+    "normalizeCore"
+    "makeFlags"
+    "meta"
+  ];
+in
+stdenv.mkDerivation ({
+  pname = "libretro-${core}";
+
+  buildInputs = [ zlib ] ++ extraBuildInputs;
+  nativeBuildInputs = [ makeWrapper ] ++ extraNativeBuildInputs;
+
+  inherit makefile;
+
+  makeFlags = [
+    "platform=${{
+      linux = "unix";
+      darwin = "osx";
+      windows = "win";
+    }.${stdenv.hostPlatform.parsed.kernel.name} or stdenv.hostPlatform.parsed.kernel.name}"
+    "ARCH=${{
+      armv7l = "arm";
+      armv6l = "arm";
+      i686 = "x86";
+    }.${stdenv.hostPlatform.parsed.cpu.name} or stdenv.hostPlatform.parsed.cpu.name}"
+  ] ++ (args.makeFlags or [ ]);
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt ${coreDir} ${coreFilename}
+    makeWrapper ${retroarch}/bin/retroarch $out/bin/${mainProgram} \
+      --add-flags "-L ${coreDir}/${coreFilename} $@"
+
+    runHook postInstall
+  '';
+
+  enableParallelBuilding = true;
+
+  passthru = { inherit core libretroCore; };
+
+  meta = with lib; {
+    inherit mainProgram;
+    inherit (retroarch.meta) platforms;
+    homepage = "https://www.libretro.com/";
+    maintainers = with maintainers; teams.libretro.members ++ [ hrdinka ];
+  } // (args.meta or { });
+} // extraArgs)
--- a/pkgs/applications/emulators/retroarch/use-fixed-path-for-libretro_core_info.patch
+++ b/pkgs/applications/emulators/retroarch/use-fixed-path-for-libretro_core_info.patch
@@ -0,0 +1,41 @@
+From 6145cb9ed935621f1974655fe1ab44cf2f0fbcce Mon Sep 17 00:00:00 2001
+From: Thiago Kenji Okada <thiagokokada@gmail.com>
+Date: Sat, 29 Oct 2022 12:27:55 +0100
+Subject: [PATCH] Use fixed path for libretro_core_info
+
+---
+ configuration.c                  | 2 +-
+ frontend/drivers/platform_unix.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/configuration.c b/configuration.c
+index af3fc8f43c..c6d56308b3 100644
+--- a/configuration.c
+++ b/configuration.c
+@@ -1468,7 +1468,7 @@ static struct config_path_setting *populate_settings_path(
+    SETTING_PATH("core_options_path",
+          settings->paths.path_core_options, false, NULL, true);
+    SETTING_PATH("libretro_info_path",
+-         settings->paths.path_libretro_info, false, NULL, true);
+         settings->paths.path_libretro_info, false, NULL, false);
+    SETTING_PATH("content_database_path",
+          settings->paths.path_content_database, false, NULL, true);
+    SETTING_PATH("cheat_database_path",
+diff --git a/frontend/drivers/platform_unix.c b/frontend/drivers/platform_unix.c
+index fe5f7341c9..c2a91f8c99 100644
+--- a/frontend/drivers/platform_unix.c
+++ b/frontend/drivers/platform_unix.c
+@@ -1799,8 +1799,8 @@ static void frontend_unix_get_env(int *argc,
+    fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE_INFO], base_path,
+          "core_info", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
+ #else
+-   fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE_INFO], base_path,
+-         "cores", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
+   fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE_INFO], "@libretro_info_path@",
+         "share/libretro/info", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
+ #endif
+    fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG], base_path,
+          "autoconfig", sizeof(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG]));
+-- 
+2.38.0
+
--- a/pkgs/applications/emulators/retroarch/use-fixed-paths.patch
+++ b/pkgs/applications/emulators/retroarch/use-fixed-paths.patch
@@ -1,154 +0,0 @@
-From 8a1cffebb23f9d2a28228cd8cbf4fd80836157e8 Mon Sep 17 00:00:00 2001
-From: Thiago Kenji Okada <thiagokokada@gmail.com>
-Date: Tue, 18 Oct 2022 17:41:33 +0100
-Subject: [PATCH] Use fixed paths
-
---
- configuration.c                    |  2 +-
- frontend/drivers/platform_darwin.m |  4 +--
- frontend/drivers/platform_unix.c   | 56 +++++++++++++++---------------
- 3 files changed, 31 insertions(+), 31 deletions(-)
-
-diff --git a/configuration.c b/configuration.c
-index ac4779b2d7..d980892dda 100644
--- a/configuration.c
-+++ b/configuration.c
-@@ -1468,7 +1468,7 @@ static struct config_path_setting *populate_settings_path(
-    SETTING_PATH("core_options_path",
-          settings->paths.path_core_options, false, NULL, true);
-    SETTING_PATH("libretro_info_path",
-         settings->paths.path_libretro_info, false, NULL, true);
-+         settings->paths.path_libretro_info, false, NULL, false);
-    SETTING_PATH("content_database_path",
-          settings->paths.path_content_database, false, NULL, true);
-    SETTING_PATH("cheat_database_path",
-diff --git a/frontend/drivers/platform_darwin.m b/frontend/drivers/platform_darwin.m
-index c771ec0f55..d5e21a1f4d 100644
--- a/frontend/drivers/platform_darwin.m
-+++ b/frontend/drivers/platform_darwin.m
-@@ -400,9 +400,9 @@ static void frontend_darwin_get_env(int *argc, char *argv[],
- 		    home_dir_buf, "cores", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE]));
- #else
-     fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE],
-		    bundle_path_buf, "modules", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE]));
-+		    "@libretro_directory@", "", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE]));
- #endif
-   fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE_INFO], home_dir_buf, "info", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
-+   fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE_INFO], "@libretro_info_path@", "", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
-    fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_OVERLAY], home_dir_buf, "overlays", sizeof(g_defaults.dirs[DEFAULT_DIR_OVERLAY]));
- #ifdef HAVE_VIDEO_LAYOUT
-    fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_VIDEO_LAYOUT], home_dir_buf, "layouts", sizeof(g_defaults.dirs[DEFAULT_DIR_VIDEO_LAYOUT]));
-diff --git a/frontend/drivers/platform_unix.c b/frontend/drivers/platform_unix.c
-index 29e9a0d633..dba8abe941 100644
--- a/frontend/drivers/platform_unix.c
-+++ b/frontend/drivers/platform_unix.c
-@@ -1792,8 +1792,8 @@ static void frontend_unix_get_env(int *argc,
-       strlcpy(g_defaults.dirs[DEFAULT_DIR_CORE], libretro_directory,
-             sizeof(g_defaults.dirs[DEFAULT_DIR_CORE]));
-    else
-      fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE], base_path,
-            "cores", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE]));
-+      fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE], "@libretro_directory@",
-+            "", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE]));
- #if defined(DINGUX)
-    /* On platforms that require manual core installation/
-     * removal, placing core info files in the same directory
-@@ -1802,27 +1802,27 @@ static void frontend_unix_get_env(int *argc,
-    fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE_INFO], base_path,
-          "core_info", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
- #else
-   fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE_INFO], base_path,
-         "cores", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
-+   fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE_INFO], "@libretro_info_path@",
-+         "", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
- #endif
-    fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG], base_path,
-          "autoconfig", sizeof(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG]));
- 
-   if (path_is_directory("/usr/local/share/retroarch/assets"))
-+   if (path_is_directory("@out@/local/share/retroarch/assets"))
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_ASSETS],
-            "/usr/local/share/retroarch",
-+            "@out@/local/share/retroarch",
-             "assets", sizeof(g_defaults.dirs[DEFAULT_DIR_ASSETS]));
-   else if (path_is_directory("/usr/share/retroarch/assets"))
-+   else if (path_is_directory("@out@/share/retroarch/assets"))
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_ASSETS],
-            "/usr/share/retroarch",
-+            "@out@/share/retroarch",
-             "assets", sizeof(g_defaults.dirs[DEFAULT_DIR_ASSETS]));
-   else if (path_is_directory("/usr/local/share/games/retroarch/assets"))
-+   else if (path_is_directory("@out@/local/share/games/retroarch/assets"))
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_ASSETS],
-            "/usr/local/share/games/retroarch",
-+            "@out@/local/share/games/retroarch",
-             "assets", sizeof(g_defaults.dirs[DEFAULT_DIR_ASSETS]));
-   else if (path_is_directory("/usr/share/games/retroarch/assets"))
-+   else if (path_is_directory("@out@/share/games/retroarch/assets"))
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_ASSETS],
-            "/usr/share/games/retroarch",
-+            "@out@/share/games/retroarch",
-             "assets", sizeof(g_defaults.dirs[DEFAULT_DIR_ASSETS]));
-    else
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_ASSETS], base_path,
-@@ -1834,41 +1834,41 @@ static void frontend_unix_get_env(int *argc,
-    fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER], base_path,
-          "filters/video", sizeof(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER]));
- #else
-   if (path_is_directory("/usr/local/share/retroarch/filters/audio"))
-+   if (path_is_directory("@out@/local/share/retroarch/filters/audio"))
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_AUDIO_FILTER],
-            "/usr/local/share/retroarch",
-+            "@out@/local/share/retroarch",
-             "filters/audio", sizeof(g_defaults.dirs[DEFAULT_DIR_AUDIO_FILTER]));
-   else if (path_is_directory("/usr/share/retroarch/filters/audio"))
-+   else if (path_is_directory("@out@/share/retroarch/filters/audio"))
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_AUDIO_FILTER],
-            "/usr/share/retroarch",
-+            "@out@/share/retroarch",
-             "filters/audio", sizeof(g_defaults.dirs[DEFAULT_DIR_AUDIO_FILTER]));
-   else if (path_is_directory("/usr/local/share/games/retroarch/filters/audio"))
-+   else if (path_is_directory("@out@/local/share/games/retroarch/filters/audio"))
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_AUDIO_FILTER],
-            "/usr/local/share/games/retroarch",
-+            "@out@/local/share/games/retroarch",
-             "filters/audio", sizeof(g_defaults.dirs[DEFAULT_DIR_AUDIO_FILTER]));
-   else if (path_is_directory("/usr/share/games/retroarch/filters/audio"))
-+   else if (path_is_directory("@out@/share/games/retroarch/filters/audio"))
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_AUDIO_FILTER],
-            "/usr/share/games/retroarch",
-+            "@out@/share/games/retroarch",
-             "filters/audio", sizeof(g_defaults.dirs[DEFAULT_DIR_AUDIO_FILTER]));
-    else
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_AUDIO_FILTER], base_path,
-             "filters/audio", sizeof(g_defaults.dirs[DEFAULT_DIR_AUDIO_FILTER]));
- 
-   if (path_is_directory("/usr/local/share/retroarch/filters/video"))
-+   if (path_is_directory("@out@/local/share/retroarch/filters/video"))
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER],
-            "/usr/local/share/retroarch",
-+            "@out@/local/share/retroarch",
-             "filters/video", sizeof(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER]));
-   else if (path_is_directory("/usr/share/retroarch/filters/video"))
-+   else if (path_is_directory("@out@/share/retroarch/filters/video"))
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER],
-            "/usr/share/retroarch",
-+            "@out@/share/retroarch",
-             "filters/video", sizeof(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER]));
-   else if (path_is_directory("/usr/local/share/games/retroarch/filters/video"))
-+   else if (path_is_directory("@out@/local/share/games/retroarch/filters/video"))
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER],
-            "/usr/local/share/games/retroarch",
-+            "@out@/local/share/games/retroarch",
-             "filters/video", sizeof(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER]));
-   else if (path_is_directory("/usr/share/games/retroarch/filters/video"))
-+   else if (path_is_directory("@out@/share/games/retroarch/filters/video"))
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER],
-            "/usr/share/games/retroarch",
-+            "@out@/share/games/retroarch",
-             "filters/video", sizeof(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER]));
-    else
-       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER], base_path,
-- 
-2.37.3
-
--- a/pkgs/applications/emulators/retroarch/wrapper.nix
+++ b/pkgs/applications/emulators/retroarch/wrapper.nix
@@ -1,41 +1,48 @@
-{ stdenv, lib, makeWrapper, retroarch, cores ? [ ] }:
+{ lib
+, stdenv
+, makeWrapper
+, retroarch
+, symlinkJoin
+, writeTextDir
+, cores ? [ ]
+}:

-stdenv.mkDerivation {
-  pname = "retroarch";
-  version = lib.getVersion retroarch;
+let
+  # All cores should be located in the same path after symlinkJoin,
+  # but let's be safe here
+  coresPath = lib.lists.unique (map (c: c.libretroCore) cores);
+  wrapperArgs = lib.strings.escapeShellArgs
+    (lib.lists.flatten
+      (map (p: [ "--add-flags" "-L ${placeholder "out" + p}" ]) coresPath));
+in
+symlinkJoin {
+  name = "retroarch-with-cores-${lib.getVersion retroarch}";
+
+  paths = [ retroarch ] ++ cores;

  nativeBuildInputs = [ makeWrapper ];

-  buildCommand = ''
-    mkdir -p $out/lib
-    for coreDir in $cores; do
-      ln -s $coreDir/* $out/lib/.
-    done
+  passthru = {
+    inherit cores;
+    unwrapped = retroarch;
+  };

-    ln -s -t $out ${retroarch}/share
+  postBuild = ''
+    # remove core specific binaries
+    find $out/bin -name 'retroarch-*' -type l -delete

-    if [ -d ${retroarch}/Applications ]; then
-      ln -s -t $out ${retroarch}/Applications
-    fi
-
-    makeWrapper ${retroarch}/bin/retroarch $out/bin/retroarch \
-      --suffix-each LD_LIBRARY_PATH ':' "$cores" \
-      --add-flags "-L $out/lib/" \
+    # wrap binary to load cores from the proper location(s)
+    wrapProgram $out/bin/retroarch ${wrapperArgs}
  '';

-  cores = map (x: x + x.libretroCore) cores;
-  preferLocalBuild = true;
-
  meta = with retroarch.meta; {
    inherit changelog description homepage license maintainers platforms;
    longDescription = ''
      RetroArch is the reference frontend for the libretro API.
-
-      The following cores are included:
-      ${lib.concatStringsSep "\n" (map (x: "  - ${x.name}") cores)}
+    ''
+    + lib.optionalString (cores != [ ]) ''
+      The following cores are included: ${lib.concatStringsSep ", " (map (c: c.core) cores)}
    '';
-    # FIXME: exit with error on macOS:
-    # No Info.plist file in application bundle or no NSPrincipalClass in the Info.plist file, exiting
-    broken = stdenv.isDarwin;
+    mainProgram = "retroarch";
  };
 }
--- a/pkgs/applications/emulators/uxn/default.nix
+++ b/pkgs/applications/emulators/uxn/default.nix
@@ -4,15 +4,15 @@
 , SDL2
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "uxn";
-  version = "0.pre+unstable=2021-08-30";
+  version = "unstable-2022-10-22";

  src = fetchFromSourcehut {
    owner = "~rabbits";
-    repo = pname;
-    rev = "a2e40d9d10c11ef48f4f93d0dc86f5085b4263ce";
-    hash = "sha256-/hxDYi814nQydm2iQk4NID4vpJ3BcBcM6NdL0iuZk5M=";
+    repo = "uxn";
+    rev = "1b2049e238df96f32335edf1c6db35bd09f8b42d";
+    hash = "sha256-lwms+qUelfpTC+i2m5b3dW7ww9298YMPFdPVsFrwcDQ=";
  };

  buildInputs = [
@@ -21,14 +21,14 @@ stdenv.mkDerivation rec {

  dontConfigure = true;

-  # It is easier to emulate build.sh script
+  postPatch = ''
+     sed -i -e 's|UXNEMU_LDFLAGS="$(brew.*$|UXNEMU_LDFLAGS="$(sdl2-config --cflags --libs)"|' build.sh
+  '';
+
  buildPhase = ''
    runHook preBuild

-    cc -std=c89 -Wall -Wno-unknown-pragmas src/uxnasm.c -o uxnasm
-    cc -std=c89 -Wall -Wno-unknown-pragmas src/uxn.c src/uxncli.c -o uxncli
-    cc -std=c89 -Wall -Wno-unknown-pragmas src/uxn.c src/devices/ppu.c \
-       src/devices/apu.c src/uxnemu.c $(sdl2-config --cflags --libs) -o uxnemu
+    ./build.sh --no-run

    runHook postBuild
  '';
@@ -36,10 +36,10 @@ stdenv.mkDerivation rec {
  installPhase = ''
    runHook preInstall

-    install -d $out/bin/ $out/share/${pname}/
+    install -d $out/bin/ $out/share/uxn/

-    cp uxnasm uxncli uxnemu $out/bin/
-    cp -r projects $out/share/${pname}/
+    cp bin/uxnasm bin/uxncli bin/uxnemu $out/bin/
+    cp -r projects $out/share/uxn/

    runHook postInstall
  '';
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
    homepage = "https://wiki.xxiivv.com/site/uxn.html";
    description = "An assembler and emulator for the Uxn stack machine";
    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ AndersonTorres ];
+    maintainers = with maintainers; [ AndersonTorres kototama ];
    platforms = with platforms; unix;
  };
 }
--- a/pkgs/applications/graphics/batik/default.nix
+++ b/pkgs/applications/graphics/batik/default.nix
@@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "batik";
-  version = "1.15";
+  version = "1.16";

  src = fetchurl {
    url = "mirror://apache/xmlgraphics/batik/binaries/batik-bin-${version}.tar.gz";
-    sha256 = "sha256-NYo7+8DikUmDsioM1Q1YW1s3KwsQeTnwIKDr+RHxxyo=";
+    sha256 = "sha256-Y4bJ6X46sKx1+fmNkOS2RU7gn7n0fKDnkOYMq0S8fYM=";
  };

  meta = with lib; {
--- a/pkgs/applications/graphics/xfig/default.nix
+++ b/pkgs/applications/graphics/xfig/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, xlibsWrapper
 , makeWrapper
 , imagemagick
 , libXpm
@@ -25,7 +24,6 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ imagemagick makeWrapper ];

  buildInputs = [
-    xlibsWrapper
    libXpm
    libXmu
    libXi
--- a/pkgs/applications/graphics/xmountains/default.nix
+++ b/pkgs/applications/graphics/xmountains/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, xlibsWrapper, xorg }:
+{ lib, stdenv, fetchFromGitHub, xorg }:

 stdenv.mkDerivation rec {
  pname = "xmountains";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    sha256 = "0dx4n2y736lv04sj41cp1dw8n5zkw5gyd946a6zsiv0k796s9ra9";
  };

-  buildInputs = [ xlibsWrapper xorg.xbitmaps ];
+  buildInputs = [ xorg.xbitmaps xorg.libX11 ];
  nativeBuildInputs = with xorg; [ imake gccmakedep ];

  installPhase = "install -Dm755 xmountains -t $out/bin";
--- a/pkgs/applications/misc/fluidd/default.nix
+++ b/pkgs/applications/misc/fluidd/default.nix
@@ -2,12 +2,12 @@

 stdenvNoCC.mkDerivation rec {
  pname = "fluidd";
-  version = "1.20.1";
+  version = "1.21.1";

  src = fetchurl {
    name = "fluidd-v${version}.zip";
    url = "https://github.com/cadriel/fluidd/releases/download/v${version}/fluidd.zip";
-    sha256 = "sha256-CA0C3yERT6r33GdtCZ7UZheEhDL4uzjAvcuhZeZQLvg=";
+    sha256 = "sha256-TahXPbZy7eoSJ/U2wL6GaMM8F6zypf7EU91JVWlevQg=";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -1,17 +1,24 @@
 { lib, buildPythonApplication, fetchPypi, requests, yt-dlp, pytestCheckHook }:

 buildPythonApplication rec {
-  pname = "gallery_dl";
-  version = "1.23.3";
+  pname = "gallery-dl";
+  version = "1.23.4";
+  format = "setuptools";

  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-CoZN0cLXSujZRSGFX3dsNGuvgupa4t1VrEoW+Zu41yw=";
+    inherit version;
+    pname = "gallery_dl";
+    sha256 = "sha256-IpbV6wWIfRDuljX/Bexo9siFXMezeCRBFK5CzVH0vUU=";
  };

-  propagatedBuildInputs = [ requests yt-dlp ];
+  propagatedBuildInputs = [
+    requests
+    yt-dlp
+  ];

-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [
+    pytestCheckHook
+  ];

  pytestFlagsArray = [
    # requires network access
@@ -22,7 +29,9 @@ buildPythonApplication rec {
    "--ignore=test/test_ytdl.py"
  ];

-  pythonImportsCheck = [ "gallery_dl" ];
+  pythonImportsCheck = [
+    "gallery_dl"
+  ];

  meta = with lib; {
    description = "Command-line program to download image-galleries and -collections from several image hosting sites";
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.104.3";
+  version = "0.105.0";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-bGyU0i/wwFprAoLENrmBY2IxLjwyX4pQ9z4LFIUguI4=";
+    sha256 = "sha256-qKcybKgdNkn3AhDVwl1vCYt0HoQimz8qi+O95jKaW8Q=";
  };

-  vendorSha256 = "sha256-is1dQJwvhygn95rbeHeGI97vDXo8ftnNqug4eERN3gI=";
+  vendorSha256 = "sha256-M74pfS7bmSrXhUvQ3hDokBPNLYxJslc9UGR3Bhp2BBQ=";

  doCheck = false;

--- a/pkgs/applications/misc/mediaelch/default.nix
+++ b/pkgs/applications/misc/mediaelch/default.nix
@@ -18,13 +18,13 @@

 mkDerivation rec {
  pname = "mediaelch";
-  version = "2.8.16";
+  version = "2.8.18";

  src = fetchFromGitHub {
    owner = "Komet";
    repo = "MediaElch";
    rev = "v${version}";
-    sha256 = "sha256-83bHfIRVAC+3RkCYmV+TBjjQxaFMHfVyxt5Jq44dzeI=";
+    sha256 = "sha256-9kwU9j8YNF/OmzrQaRAlBpW+t/tIpZJw5+pfEoTmCBA=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.14.0";
+  version = "2.14.1";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-iaaf5ZHaHSEkQdxqZtsc6K/3+x6gAfvgQoWWYWcFeV4=";
+    sha256 = "sha256-262tnSKX6M9ggm4JIs0pANeq2JSNYzKkTN8awpqLyMM=";
  };

-  vendorSha256 = "sha256-zYIbtcDM9iYSRHagvI9D284Y7w0ZxG4Ba1p4jqmQyng=";
+  vendorSha256 = "sha256-E2Q+mXojMb8E0zSnaCOl9xp5QLeYcuTXjhcp3Hc8gH4=";

  ldflags = [
    "-s -w"
--- a/pkgs/applications/misc/wofi/default.nix
+++ b/pkgs/applications/misc/wofi/default.nix
@@ -1,13 +1,24 @@
-{ stdenv, lib, fetchhg, pkg-config, meson, ninja, wayland, gtk3, wrapGAppsHook, installShellFiles }:
-
+{ stdenv
+, lib
+, fetchFromSourcehut
+, pkg-config
+, meson
+, ninja
+, wayland
+, gtk3
+, wrapGAppsHook
+, installShellFiles
+}:
 stdenv.mkDerivation rec {
  pname = "wofi";
  version = "1.3";

-  src = fetchhg {
-    url = "https://hg.sr.ht/~scoopta/wofi";
+  src = fetchFromSourcehut {
+    repo = pname;
+    owner = "~scoopta";
    rev = "v${version}";
    sha256 = "sha256-GxMjEXBPQniD+Yc9QZjd8TH4ILJAX5dNzrjxDawhy8w=";
+    vc = "hg";
  };

  nativeBuildInputs = [ pkg-config meson ninja wrapGAppsHook installShellFiles ];
--- a/pkgs/applications/misc/workrave/default.nix
+++ b/pkgs/applications/misc/workrave/default.nix
@@ -1,29 +1,84 @@
-{ lib, stdenv, fetchFromGitHub, wrapGAppsHook
-, autoconf, autoconf-archive, automake, gettext, intltool, libtool, pkg-config
-, libICE, libSM, libXScrnSaver, libXtst, cheetah
-, gobject-introspection, glib, glibmm, gtkmm3, atk, pango, pangomm, cairo
-, cairomm , dbus, dbus-glib, gdome2, gstreamer, gst-plugins-base
-, gst-plugins-good, libsigcxx }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, wrapGAppsHook
+, autoconf
+, autoconf-archive
+, automake
+, gettext
+, intltool
+, libtool
+, pkg-config
+, libICE
+, libSM
+, libXScrnSaver
+, libXtst
+, gobject-introspection
+, glib
+, glibmm
+, gtkmm3
+, atk
+, pango
+, pangomm
+, cairo
+, cairomm
+, dbus
+, dbus-glib
+, gdome2
+, gstreamer
+, gst-plugins-base
+, gst-plugins-good
+, libsigcxx
+, boost
+, jinja2
+}:

 stdenv.mkDerivation rec {
  pname = "workrave";
-  version = "1.10.31";
+  version = "1.10.50";

  src = fetchFromGitHub {
-    sha256 = "0v2mx2idaxlsyv5w66b7pknlill9j9i2gqcs3vq54gak7ix9fj1p";
-    rev = with lib;
-      "v" + concatStringsSep "_" (splitVersion version);
    repo = "workrave";
    owner = "rcaelers";
+    rev = with lib;
+      "v" + concatStringsSep "_" (splitVersion version);
+    sha256 = "sha256-fSUfgk0PmiteVQis+0NmMMZXBe/377X2k9oS2yp2Qzo=";
  };

  nativeBuildInputs = [
-    autoconf autoconf-archive automake gettext intltool libtool pkg-config wrapGAppsHook
+    autoconf
+    autoconf-archive
+    automake
+    gettext
+    intltool
+    libtool
+    pkg-config
+    wrapGAppsHook
+    jinja2
  ];
+
  buildInputs = [
-    libICE libSM libXScrnSaver libXtst cheetah
-    gobject-introspection glib glibmm gtkmm3 atk pango pangomm cairo cairomm
-    dbus dbus-glib gdome2 gstreamer gst-plugins-base gst-plugins-good libsigcxx
+    libICE
+    libSM
+    libXScrnSaver
+    libXtst
+    gobject-introspection
+    glib
+    glibmm
+    gtkmm3
+    atk
+    pango
+    pangomm
+    cairo
+    cairomm
+    dbus
+    dbus-glib
+    gdome2
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
+    libsigcxx
+    boost
  ];

  preConfigure = "./autogen.sh";
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -87,7 +87,7 @@ let
  fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "11.5.5";
+  version = "11.5.6";

  lang = "en-US";

@@ -99,7 +99,7 @@ let
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
      ];
-      sha256 = "sha256-AOt0PFot6Qh9voqvi5bagW0HLk2kP8b6A2c8Jdv5vkQ=";
+      sha256 = "sha256-DTMY6n7GXokOz6WSrvFUkC64Siuo1Zy80A4UDolmIME=";
    };

    i686-linux = fetchurl {
@@ -109,7 +109,7 @@ let
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
      ];
-      sha256 = "sha256-MQrJgdAsNvG+WCx4eeb2UHZp/0LoOIhZZQUKESNIGZY=";
+      sha256 = "sha256-2/fGt+m/EDoeaSune32zmktHVHt8zH2wCr8+stewKCs=";
    };
  };
 in
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@@ -7,20 +7,20 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.8.47";
+  version = "0.8.48";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    sha256 = "sha256-vKP/bexxXbhyJEa6ojLFw7ebDS+NYsZgq2jKtimbE3A=";
+    sha256 = "sha256-3yYbuVx2dZsMefFFNVGivAR4wwXJwsr9XqGiyUKNAMo=";
  };

  CGO_ENABLED = 0;

  nativeBuildInputs = [ installShellFiles ];

-  vendorSha256 = "sha256-TUaCqHbPEwhB2xS8RSoF7RCSkKFJzQKbuV1PbxApyMQ=";
+  vendorSha256 = "sha256-Kr6m1qhVTiXllm5xaxXKsWAtWbnsDwbwWH0iqc0sKfM=";

  # Exclude pkg/get: tests downloading of binaries which fail when sandbox=true
  subPackages = [
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "istioctl";
-  version = "1.15.2";
+  version = "1.15.3";

  src = fetchFromGitHub {
    owner = "istio";
    repo = "istio";
    rev = version;
-    sha256 = "sha256-ZbOh0BMvYnJQD0WjZcKKiG4ECn1Lbr9760Hn2ecdPH8=";
+    sha256 = "sha256-mgf3xQIsd4j3a5pqZz2UHhsHizACjVC4St1GfsDJsfY=";
  };
-  vendorSha256 = "sha256-RgxGPPNBYXe1/gFNKeM+huPCD6EGBPea5EtciSA9o58=";
+  vendorSha256 = "sha256-P40VPtPxbfL0xpAMLJrqPhyyB7xFTsXMfBSCGL3S4Gg=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/kluctl/default.nix
+++ b/pkgs/applications/networking/cluster/kluctl/default.nix
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kluctl";
-  version = "2.16.0";
+  version = "2.16.1";

  src = fetchFromGitHub {
    owner = "kluctl";
    repo = "kluctl";
    rev = "v${version}";
-    hash = "sha256-NwjPClD3P9EP7gKPPgKXI3h+kLeGPd7Gf6gZXMCCLHk=";
+    hash = "sha256-rcwtVhtLc49rD6J3AZFumLQrZuTveE7OY+agufe/4MQ=";
  };

  vendorHash = "sha256-IC+sjctDqd0lQD5labl+UYWsRiptQKSjSHYf2SGkp14=";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -120,13 +120,13 @@
    "version": "2.30.0"
  },
  "azurerm": {
-    "hash": "sha256-W86RutsTsOi7bH1kJleaf6K1a91caDJTcXxsBn9gkmk=",
+    "hash": "sha256-TOm7e3yLTsmWCIDHklUncCjI5vbd0u/HWH/koOL95u4=",
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
    "repo": "terraform-provider-azurerm",
-    "rev": "v3.29.0",
+    "rev": "v3.29.1",
    "vendorHash": null,
-    "version": "3.29.0"
+    "version": "3.29.1"
  },
  "azurestack": {
    "hash": "sha256-aSwVa7y1AJ6sExx+bO/93oLBNgSBDJjuPYPY8i3C9T0=",
@@ -804,13 +804,13 @@
    "version": "1.12.8"
  },
  "nsxt": {
-    "hash": "sha256-oXcT1VmwC9a+U0vM5O9y2As2PbzPr95LrUB6KlFKcMc=",
+    "hash": "sha256-TOoRtCKdR1fBjk39dbMgBd7pDJGfjvkQAqfpJzWRwRg=",
    "owner": "vmware",
    "provider-source-address": "registry.terraform.io/vmware/nsxt",
    "repo": "terraform-provider-nsxt",
-    "rev": "v3.2.8",
+    "rev": "v3.2.9",
    "vendorHash": null,
-    "version": "3.2.8"
+    "version": "3.2.9"
  },
  "null": {
    "hash": "sha256-2YM3btZInUlIwp1VkasuugZZ8FervpRviUlx60vhVak=",
@@ -841,13 +841,13 @@
    "version": "4.96.0"
  },
  "okta": {
-    "hash": "sha256-yUWz6JiejI36QXSzGj36Pzu8/exK4U/DXCdbToSeCrE=",
+    "hash": "sha256-COGXHUjXYGB2QDY0iBG+MvNcxGy87vpGIerQU2XXEmw=",
    "owner": "okta",
    "provider-source-address": "registry.terraform.io/okta/okta",
    "repo": "terraform-provider-okta",
-    "rev": "v3.37.0",
-    "vendorHash": "sha256-qAnMwxTvvds3pOarRTWWVQqOCJKd0wSH2LZoPl4n2uA=",
-    "version": "3.37.0"
+    "rev": "v3.38.0",
+    "vendorHash": "sha256-iGQ3JPJ78Qhj+izR8D4H5oWGq4fF5lXuNHQCmpr7zFE=",
+    "version": "3.38.0"
  },
  "oktaasa": {
    "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@@ -1039,13 +1039,13 @@
    "version": "1.7.10"
  },
  "signalfx": {
-    "hash": "sha256-ke/35QtsYNW+6HVjBrx6hQ+CO2zhZsVLlryWTgI1vRE=",
+    "hash": "sha256-alLC61bEaFiVtoH0Fczj7G0m70ie1RNvTBR+MgYZGkQ=",
    "owner": "splunk-terraform",
    "provider-source-address": "registry.terraform.io/splunk-terraform/signalfx",
    "repo": "terraform-provider-signalfx",
-    "rev": "v6.17.0",
-    "vendorHash": "sha256-hxYQF1sZOS5x6sZtUJg13A6SPZG6Ql20vAs8VDQegqQ=",
-    "version": "6.17.0"
+    "rev": "v6.18.0",
+    "vendorHash": "sha256-ESUNfkllwkS1NcAD30tO90VQcHR5XhdIeyXXHmU/byc=",
+    "version": "6.18.0"
  },
  "skytap": {
    "hash": "sha256-EAimiuQJOt12baZSjDKI+c9UjJd8e26ouOAZIZezw/I=",
--- a/pkgs/applications/networking/instant-messengers/gurk-rs/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gurk-rs/default.nix
@@ -7,16 +7,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "gurk-rs";
-  version = "0.2.4";
+  version = "0.2.5";

  src = fetchFromGitHub {
    owner = "boxdot";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-WZUoUvu7GaiBOaRAOGRCXrLe6u3DRbI6CDTAf5jryGc=";
+    sha256 = "sha256-CEsnZ0V85eOH+bjtico5yo9kS6eMT7Dx3H6wiDUjQm4=";
  };

-  cargoHash = "sha256-81ZW61JX40W0D/cmYogR3RJH2dvEKW1K7sIsl2io/7E=";
+  postPatch = ''
+    rm .cargo/config.toml
+  '';
+
+  cargoHash = "sha256-z+2G/hD1zYOoJrYFB0eEP6y9MoV2OfdkJVt6je94EkU=";
  buildInputs = [ protobuf ];

  PROTOC = "${protobuf}/bin/protoc";
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@@ -24,11 +24,11 @@

 stdenv.mkDerivation rec {
  pname = "liferea";
-  version = "1.14-RC1";
+  version = "1.14-RC2";

  src = fetchurl {
    url = "https://github.com/lwindolf/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "cBtS+Km2d1n5Yl0wrQkN3Pg6OxSzhG7oVu7ZJ5RQuRQ=";
+    sha256 = "UTK82s+7bzL+SyT40qDsqX8KTkITTpWtR/0VY/+OpcA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/paper-note/default.nix
+++ b/pkgs/applications/office/paper-note/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, vala
+, gtk4
+, libgee
+, libadwaita
+, gtksourceview5
+, blueprint-compiler
+, wrapGAppsHook4
+, appstream-glib
+, desktop-file-utils
+}:
+
+stdenv.mkDerivation rec {
+  pname = "paper-note";
+  version = "22.11";
+
+  src = fetchFromGitLab {
+    owner = "posidon_software";
+    repo = "paper";
+    rev = version;
+    hash = "sha256-o5MYagflHE8Aup8CbqauRBrdt3TrSlffs35psYT7hyE=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    vala
+    pkg-config
+    wrapGAppsHook4
+    appstream-glib
+    desktop-file-utils
+    blueprint-compiler
+  ];
+
+  buildInputs = [
+    gtk4
+    libadwaita
+    libgee
+    gtksourceview5
+  ];
+
+  postInstall = ''
+    ln -s $out/bin/io.posidon.Paper $out/bin/paper
+  '';
+
+  meta = with lib; {
+    description = "Take notes in Markdown";
+    homepage = "https://posidon.io/paper/";
+    license = licenses.gpl3;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ j0lol ];
+  };
+}
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -41,12 +41,12 @@

 stdenv.mkDerivation rec {
  pname = "zotero";
-  version = "6.0.12";
+  version = "6.0.15";

  src = fetchurl {
    url =
      "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "sha256-RIPFn0fLk2CbOoiZ4a5ungnbvfRWFQQUypCYVvVIQms=";
+    sha256 = "sha256-h/hyaRjunVkVoHmVpru481goN73Ano1TDRDDg5AVoTI=";
  };

  nativeBuildInputs = [ wrapGAppsHook ];
--- a/pkgs/applications/science/astronomy/gnuastro/default.nix
+++ b/pkgs/applications/science/astronomy/gnuastro/default.nix
@@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "gnuastro";
-  version = "0.18";
+  version = "0.19";

  src = fetchurl {
    url = "mirror://gnu/gnuastro/gnuastro-${version}.tar.gz";
-    sha256 = "sha256-bKfiLhQFERdMbwL9+UitCL8/dB/k6YKNjBzfKnCtWec=";
+    sha256 = "sha256-4bPNW0sSb/J34vSOit8BA9Z/wK0Hz5o9OqfgVSlDDjU=";
  };

  nativeBuildInputs = [ libtool ];
--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "cbmc";
-  version = "5.69.0";
+  version = "5.69.1";

  src = fetchFromGitHub {
    owner = "diffblue";
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "sha256-X0Kc7I+5it0sbyRT6QXm7OOA9efnY3KwnMnyldgsNaA=";
+    sha256 = "sha256-1HwR+MM2AUrx07knBDJg+xCm0/cyGzYGQ2LvJUxXEyE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/robotics/mujoco/default.nix
+++ b/pkgs/applications/science/robotics/mujoco/default.nix
@@ -0,0 +1,122 @@
+{ cmake
+, fetchFromGitHub
+, fetchFromGitLab
+, git
+, lib
+, libGL
+, stdenv
+, xorg
+}:
+
+let
+  # See https://github.com/deepmind/mujoco/blob/573d331b69845c5d651b70f5d1b0f3a0d2a3a233/cmake/MujocoDependencies.cmake#L21-L59
+  abseil-cpp = fetchFromGitHub {
+    owner = "abseil";
+    repo = "abseil-cpp";
+    rev = "8c0b94e793a66495e0b1f34a5eb26bd7dc672db0";
+    hash = "sha256-Od1FZOOWEXVQsnZBwGjDIExi6LdYtomyL0STR44SsG8=";
+  };
+  benchmark = fetchFromGitHub {
+    owner = "google";
+    repo = "benchmark";
+    rev = "d845b7b3a27d54ad96280a29d61fa8988d4fddcf";
+    hash = "sha256-XTnTM1k6xMGXUws/fKdJUbpCPcc4U0IelL6BPEEnpEQ=";
+  };
+  ccd = fetchFromGitHub {
+    owner = "danfis";
+    repo = "libccd";
+    rev = "7931e764a19ef6b21b443376c699bbc9c6d4fba8";
+    hash = "sha256-TIZkmqQXa0+bSWpqffIgaBela0/INNsX9LPM026x1Wk=";
+  };
+  eigen3 = fetchFromGitLab {
+    owner = "libeigen";
+    repo = "eigen";
+    rev = "3bb6a48d8c171cf20b5f8e48bfb4e424fbd4f79e";
+    hash = "sha256-k71DoEsx8JpC9AlQ0cCRI0fWMIWFBFL/Yscx+2iBtNM=";
+  };
+  googletest = fetchFromGitHub {
+    owner = "google";
+    repo = "googletest";
+    rev = "58d77fa8070e8cec2dc1ed015d66b454c8d78850";
+    hash = "sha256-W+OxRTVtemt2esw4P7IyGWXOonUN5ZuscjvzqkYvZbM=";
+  };
+  lodepng = fetchFromGitHub {
+    owner = "lvandeve";
+    repo = "lodepng";
+    rev = "b4ed2cd7ecf61d29076169b49199371456d4f90b";
+    hash = "sha256-5cCkdj/izP4e99BKfs/Mnwu9aatYXjlyxzzYiMD/y1M=";
+  };
+  qhull = fetchFromGitHub {
+    owner = "qhull";
+    repo = "qhull";
+    rev = "3df027b91202cf179f3fba3c46eebe65bbac3790";
+    hash = "sha256-aHO5n9Y35C7/zb3surfMyjyMjo109DoZnkozhiAKpYQ=";
+  };
+  tinyobjloader = fetchFromGitHub {
+    owner = "tinyobjloader";
+    repo = "tinyobjloader";
+    rev = "1421a10d6ed9742f5b2c1766d22faa6cfbc56248";
+    hash = "sha256-9z2Ne/WPCiXkQpT8Cun/pSGUwgClYH+kQ6Dx1JvW6w0=";
+  };
+  tinyxml2 = fetchFromGitHub {
+    owner = "leethomason";
+    repo = "tinyxml2";
+    rev = "1dee28e51f9175a31955b9791c74c430fe13dc82";
+    hash = "sha256-AQQOctXi7sWIH/VOeSUClX6hlm1raEQUOp+VoPjLM14=";
+  };
+
+  # See https://github.com/deepmind/mujoco/blob/573d331b69845c5d651b70f5d1b0f3a0d2a3a233/simulate/cmake/SimulateDependencies.cmake#L32-L35
+  glfw = fetchFromGitHub {
+    owner = "glfw";
+    repo = "glfw";
+    rev = "7482de6071d21db77a7236155da44c172a7f6c9e";
+    hash = "sha256-4+H0IXjAwbL5mAWfsIVhW0BSJhcWjkQx4j2TrzZ3aIo=";
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "mujoco";
+  version = "2.3.0";
+
+  src = fetchFromGitHub {
+    owner = "deepmind";
+    repo = pname;
+    rev = version;
+    hash = "sha256-FxMaXl7yfUAyY6LE1sxaw226dBtp1DOCWNnROp0WX2I=";
+  };
+
+  patches = [ ./dependencies.patch ];
+
+  nativeBuildInputs = [ cmake git ];
+
+  buildInputs = [
+    libGL
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXext
+    xorg.libXi
+    xorg.libXinerama
+    xorg.libXrandr
+  ];
+
+  # Move things into place so that cmake doesn't try downloading dependencies.
+  preConfigure = ''
+    mkdir -p build/_deps
+    ln -s ${abseil-cpp} build/_deps/abseil-cpp-src
+    ln -s ${benchmark} build/_deps/benchmark-src
+    ln -s ${ccd} build/_deps/ccd-src
+    ln -s ${eigen3} build/_deps/eigen3-src
+    ln -s ${glfw} build/_deps/glfw-src
+    ln -s ${googletest} build/_deps/googletest-src
+    ln -s ${lodepng} build/_deps/lodepng-src
+    ln -s ${qhull} build/_deps/qhull-src
+    ln -s ${tinyobjloader} build/_deps/tinyobjloader-src
+    ln -s ${tinyxml2} build/_deps/tinyxml2-src
+  '';
+
+  meta = with lib; {
+    description = "Multi-Joint dynamics with Contact. A general purpose physics simulator.";
+    homepage = "https://mujoco.org/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ samuela ];
+  };
+}
--- a/pkgs/applications/science/robotics/mujoco/dependencies.patch
+++ b/pkgs/applications/science/robotics/mujoco/dependencies.patch
@@ -0,0 +1,114 @@
+diff --git a/cmake/MujocoDependencies.cmake b/cmake/MujocoDependencies.cmake
+index 99e4a7a..cf9a901 100644
+--- a/cmake/MujocoDependencies.cmake
+++ b/cmake/MujocoDependencies.cmake
+@@ -82,8 +82,6 @@ set(BUILD_SHARED_LIBS
+ if(NOT TARGET lodepng)
+   FetchContent_Declare(
+     lodepng
+-    GIT_REPOSITORY https://github.com/lvandeve/lodepng.git
+-    GIT_TAG ${MUJOCO_DEP_VERSION_lodepng}
+   )
+ 
+   FetchContent_GetProperties(lodepng)
+@@ -111,10 +109,6 @@ findorfetch(
+   qhull
+   LIBRARY_NAME
+   qhull
+-  GIT_REPO
+-  https://github.com/qhull/qhull.git
+-  GIT_TAG
+-  ${MUJOCO_DEP_VERSION_qhull}
+   TARGETS
+   qhull
+   # TODO(fraromano) Remove when https://github.com/qhull/qhull/pull/112 is merged.
+@@ -146,10 +140,6 @@ findorfetch(
+   tinyxml2
+   LIBRARY_NAME
+   tinyxml2
+-  GIT_REPO
+-  https://github.com/leethomason/tinyxml2.git
+-  GIT_TAG
+-  ${MUJOCO_DEP_VERSION_tinyxml2}
+   TARGETS
+   tinyxml2
+   EXCLUDE_FROM_ALL
+@@ -164,10 +154,6 @@ findorfetch(
+   tinyobjloader
+   LIBRARY_NAME
+   tinyobjloader
+-  GIT_REPO
+-  https://github.com/tinyobjloader/tinyobjloader.git
+-  GIT_TAG
+-  ${MUJOCO_DEP_VERSION_tinyobjloader}
+   TARGETS
+   tinyobjloader
+   EXCLUDE_FROM_ALL
+@@ -182,10 +168,6 @@ findorfetch(
+   ccd
+   LIBRARY_NAME
+   ccd
+-  GIT_REPO
+-  https://github.com/danfis/libccd.git
+-  GIT_TAG
+-  ${MUJOCO_DEP_VERSION_ccd}
+   TARGETS
+   ccd
+   EXCLUDE_FROM_ALL
+@@ -222,10 +204,6 @@ if(MUJOCO_BUILD_TESTS)
+     absl
+     LIBRARY_NAME
+     abseil-cpp
+-    GIT_REPO
+-    https://github.com/abseil/abseil-cpp.git
+-    GIT_TAG
+-    ${MUJOCO_DEP_VERSION_abseil}
+     TARGETS
+     absl::core_headers
+     EXCLUDE_FROM_ALL
+@@ -249,10 +227,6 @@ if(MUJOCO_BUILD_TESTS)
+     GTest
+     LIBRARY_NAME
+     googletest
+-    GIT_REPO
+-    https://github.com/google/googletest.git
+-    GIT_TAG
+-    ${MUJOCO_DEP_VERSION_gtest}
+     TARGETS
+     gtest
+     gmock
+@@ -283,10 +257,6 @@ if(MUJOCO_BUILD_TESTS)
+     benchmark
+     LIBRARY_NAME
+     benchmark
+-    GIT_REPO
+-    https://github.com/google/benchmark.git
+-    GIT_TAG
+-    ${MUJOCO_DEP_VERSION_benchmark}
+     TARGETS
+     benchmark::benchmark
+     benchmark::benchmark_main
+@@ -303,8 +273,6 @@ if(MUJOCO_TEST_PYTHON_UTIL)
+ 
+     FetchContent_Declare(
+       Eigen3
+-      GIT_REPOSITORY https://gitlab.com/libeigen/eigen.git
+-      GIT_TAG ${MUJOCO_DEP_VERSION_Eigen3}
+     )
+ 
+     FetchContent_GetProperties(Eigen3)
+diff --git a/simulate/cmake/SimulateDependencies.cmake b/simulate/cmake/SimulateDependencies.cmake
+index 6616d6f..5d5a889 100644
+--- a/simulate/cmake/SimulateDependencies.cmake
+++ b/simulate/cmake/SimulateDependencies.cmake
+@@ -81,10 +81,6 @@ findorfetch(
+   glfw
+   LIBRARY_NAME
+   glfw
+-  GIT_REPO
+-  https://github.com/glfw/glfw.git
+-  GIT_TAG
+-  ${MUJOCO_DEP_VERSION_glfw}
+   TARGETS
+   glfw
+   EXCLUDE_FROM_ALL
--- a/pkgs/applications/system/glances/default.nix
+++ b/pkgs/applications/system/glances/default.nix
@@ -9,14 +9,14 @@

 buildPythonApplication rec {
  pname = "glances";
-  version = "3.2.7";
+  version = "3.3.0";
  disabled = isPyPy;

  src = fetchFromGitHub {
    owner = "nicolargo";
    repo = "glances";
-    rev = "v${version}";
-    sha256 = "sha256-WZDvC95Y6Xc7dOuPJJlJLI4PCZR76pYPl8NGtmxe91o=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-4EZjr8oW5759U20YS6eWVZ0pelTCDj75FBc7IkAzd3M=";
  };

  # On Darwin this package segfaults due to mismatch of pure and impure
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -64,7 +64,6 @@
 , systemd
 , taglib
 , unzip
-, xlibsWrapper
 , xorg
 , zlib
 , chromecastSupport ? true, libmicrodns, protobuf
@@ -150,10 +149,10 @@ stdenv.mkDerivation rec {
    srt
    systemd
    taglib
-    xlibsWrapper
    zlib
  ]
  ++ (with xorg; [
+    libSM
    libXpm
    libXv
    libXvMC
--- a/pkgs/applications/video/xine-ui/default.nix
+++ b/pkgs/applications/video/xine-ui/default.nix
@@ -12,7 +12,6 @@
 , readline
 , shared-mime-info
 , xine-lib
-, xlibsWrapper
 , xorg
 }:

@@ -47,7 +46,6 @@ stdenv.mkDerivation rec {
    ncurses
    readline
    xine-lib
-    xlibsWrapper
  ] ++ (with xorg; [
    libXext
    libXft
--- a/pkgs/applications/virtualization/ecs-agent/default.nix
+++ b/pkgs/applications/virtualization/ecs-agent/default.nix
@@ -2,7 +2,7 @@

 buildGoPackage rec {
  pname   = "amazon-ecs-agent";
-  version = "1.65.0";
+  version = "1.65.1";

  goPackagePath = "github.com/aws/${pname}";
  subPackages   = [ "agent" ];
@@ -11,7 +11,7 @@ buildGoPackage rec {
    rev    = "v${version}";
    owner  = "aws";
    repo   = pname;
-    sha256 = "sha256-vnq76WifMax2GAUSoeYtjmAQc2T8cyer18+PaG87n7A=";
+    sha256 = "sha256-IsbY2ZQQq8eOhdT/ws1Yu7YlnQOyjhDaIr1knOHB4Yc=";
  };

  meta = with lib; {
--- a/pkgs/applications/virtualization/flintlock/default.nix
+++ b/pkgs/applications/virtualization/flintlock/default.nix
@@ -10,16 +10,16 @@

 buildGoModule rec{
  pname = "flintlock";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = "flintlock";
    rev = "v${version}";
-    sha256 = "sha256-zVsI8443/4joOhhuqhrUGsIW6iFvetW9BhHqASL+XUk=";
+    sha256 = "sha256-kHrVpQ4E8b1YV+ofZwd4iGJ9ucVUUam6rxdpOGmvRR4=";
  };

-  vendorSha256 = "sha256-PPda8/9WSiWQYyJJQhWo94g8LqGEEwx2u2j2wfqpOv0=";
+  vendorSha256 = "sha256-A3LrikB2KrnSI+OREiLmlkTFpRKQWRB8w4OJ6ApX7oY=";

  subPackages = [ "cmd/flintlock-metrics" "cmd/flintlockd" ];

@@ -41,7 +41,7 @@ buildGoModule rec{

  meta = with lib; {
    description = "Create and manage the lifecycle of MicroVMs backed by containerd";
-    homepage = "https://github.com/weaveworks/flintlock";
+    homepage = "https://github.com/weaveworks-liquidmetal/flintlock";
    license = licenses.mpl20;
    platforms = [ "x86_64-linux" "aarch64-linux" ];
    maintainers = with maintainers; [ techknowlogick ];
--- a/pkgs/applications/virtualization/libnvidia-container/default.nix
+++ b/pkgs/applications/virtualization/libnvidia-container/default.nix
@@ -10,6 +10,7 @@
 , libtirpc
 , makeWrapper
 , substituteAll
+, removeReferencesTo
 , go
 }:
 let
@@ -86,7 +87,7 @@ stdenv.mkDerivation rec {
  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
  NIX_LDFLAGS = [ "-L${libtirpc.dev}/lib" "-ltirpc" ];

-  nativeBuildInputs = [ pkg-config go rpcsvc-proto makeWrapper ];
+  nativeBuildInputs = [ pkg-config go rpcsvc-proto makeWrapper removeReferencesTo ];

  buildInputs = [ libelf libcap libseccomp libtirpc ];

@@ -105,8 +106,10 @@ stdenv.mkDerivation rec {
      libraryPath = lib.makeLibraryPath [ "$out" driverLink "${driverLink}-32" ];
    in
    ''
+      remove-references-to -t "${go}" $out/lib/libnvidia-container-go.so.1.9.0
      wrapProgram $out/bin/nvidia-container-cli --prefix LD_LIBRARY_PATH : ${libraryPath}
    '';
+  disallowedReferences = [ go ];

  meta = with lib; {
    homepage = "https://github.com/NVIDIA/libnvidia-container";
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "nixpacks";
-  version = "0.10.5";
+  version = "0.11.5";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Z1xmBoRdOTMB9NHGWKQyweT0/PyjGHiK+yj5uKjZPtE=";
+    sha256 = "sha256-QLF49k8f8YYwPl26pyz9/bbO4IO0KqSlgTFNjbvPf7k=";
  };

-  cargoSha256 = "sha256-jLO1UPfu0vN2NCvvGBnUY1UPV1F+0fYlrtsM/AE39tU=";
+  cargoSha256 = "sha256-u0L3NJ4ku5ETBx6PKgVStrcSCX4I7E6GNtW+iv3yy2g=";

  # skip test due FHS dependency
  doCheck = false;
--- a/pkgs/applications/window-managers/ion-3/default.nix
+++ b/pkgs/applications/window-managers/ion-3/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, xlibsWrapper, lua, gettext, groff }:
+{ lib, stdenv, fetchurl, lua, gettext, groff, libICE, libSM, libX11, libXext }:

 stdenv.mkDerivation rec {
  pname = "ion";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    sha256 = "1nkks5a95986nyfkxvg2rik6zmwx0lh7szd5fji7yizccwzc9xns";
  };

-  buildInputs = [ xlibsWrapper lua gettext groff ];
+  buildInputs = [ libICE libSM libX11 libXext lua gettext groff ];

  buildFlags = [ "LUA_DIR=${lua}" "X11_PREFIX=/no-such-path" "PREFIX=\${out}" ];

--- a/pkgs/data/fonts/go-font/default.nix
+++ b/pkgs/data/fonts/go-font/default.nix
@@ -1,11 +1,11 @@
 { lib, fetchgit }:

 let
-  version = "2017-03-30";
+  version = "2.010";
 in (fetchgit {
  name = "go-font-${version}";
  url = "https://go.googlesource.com/image";
-  rev = "f03a046406d4d7fbfd4ed29f554da8f6114049fc";
+  rev = "41969df76e82aeec85fa3821b1e24955ea993001";

  postFetch = ''
    mv $out/* .
@@ -15,11 +15,12 @@ in (fetchgit {
    mv $out/share/fonts/truetype/README $out/share/doc/go-font/LICENSE
  '';

-  sha256 = "1488426ya2nzmwjas947fx9h5wzxrp9wasn8nkjqf0y0mpd4f1xz";
+  sha256 = "dteUL/4ZUq3ybL6HaLYqu2Tslx3q8VvELIY3tVC+ODo=";
 }) // {
  meta = with lib; {
    homepage = "https://blog.golang.org/go-fonts";
    description = "The Go font family";
+    changelog = "https://go.googlesource.com/image/+log/refs/heads/master/font/gofont";
    license = licenses.bsd3;
    maintainers = with maintainers; [ sternenseemann ];
    platforms = lib.platforms.all;
--- a/pkgs/data/fonts/twemoji-color-font/default.nix
+++ b/pkgs/data/fonts/twemoji-color-font/default.nix
@@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "twemoji-color-font";
-  version = "13.1.0";
+  version = "14.0.2";

  # We fetch the prebuilt font because building it takes 1.5 hours on hydra.
  # Relevant issue: https://github.com/NixOS/nixpkgs/issues/97871
  src = fetchurl {
    url = "https://github.com/eosrei/twemoji-color-font/releases/download/v${version}/TwitterColorEmoji-SVGinOT-Linux-${version}.tar.gz";
-    sha256 = "sha256-V8DWUUAK+HLDPcq3izPs174PfUnaSeLByDpZwhUIX5Q=";
+    sha256 = "sha256-aCbiHqCNxd8myIeuTlYEaYfg9JCd+MAsc94FcUoDU8E=";
  };

  dontBuild = true;
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@@ -168,7 +168,7 @@ stdenv.mkDerivation rec {
    sed 's|"lspci"|"${pciutils}/bin/lspci"|g' -i ./files/usr/share/cinnamon/cinnamon-settings/modules/cs_info.py

    sed "s| cinnamon-session| ${cinnamon-session}/bin/cinnamon-session|g" -i ./files/usr/bin/cinnamon-session-cinnamon  -i ./files/usr/bin/cinnamon-session-cinnamon2d
-    sed "s|/usr/bin|$out/bin|g" -i ./files/usr/share/xsessions/cinnamon.desktop ./files/usr/share/xsessions/cinnamon2d.desktop
+    sed "s|/usr/bin|$out/bin|g" -i ./files/usr/share/xsessions/cinnamon.desktop ./files/usr/share/xsessions/cinnamon2d.desktop ./files/usr/share/applications/cinnamon2d.desktop

    sed "s|msgfmt|${gettext}/bin/msgfmt|g" -i ./files/usr/share/cinnamon/cinnamon-settings/bin/Spices.py

--- a/pkgs/development/compilers/dotnet/combine-packages.nix
+++ b/pkgs/development/compilers/dotnet/combine-packages.nix
@@ -21,7 +21,7 @@ assert lib.assertMsg ((builtins.length packages) > 0)
      makeWrapper
    ];
    postBuild = ''
-      cp -R ${cli}/{dotnet,LICENSE.txt,nix-support,ThirdPartyNotices.txt} $out/
+      cp -R ${cli}/{dotnet,share,nix-support} $out/

      mkdir $out/bin
      ln -s $out/dotnet $out/bin/dotnet
--- a/pkgs/development/compilers/dotnet/versions/5.0.nix
+++ b/pkgs/development/compilers/dotnet/versions/5.0.nix
@@ -4,61 +4,134 @@
 {
  aspnetcore_5_0 = buildAspNetCore {
    inherit icu;
-    version = "5.0.12";
+    version = "5.0.17";
    srcs = {
      x86_64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/ad0a54ca-4b88-4762-a790-aebeaba6b9e7/0f796fb90696d078046d90d8a05c027e/aspnetcore-runtime-5.0.12-linux-x64.tar.gz";
-        sha512  = "0529f23ffa651ac2c2807b70d6e5034f6ae4c88204afdaaa76965ef604d6533f9440d68d9f2cdd3a9f2ca37e9140e6c61a9f9207d430c71140094c7d5c33bf79";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/a2b96f83-e22a-4fa6-a10e-709b3effac9a/0d6ade6c0ceebc8ef7dbf2b1a6d86f17/aspnetcore-runtime-5.0.17-linux-x64.tar.gz";
+        sha512  = "d8e87804e9e86273c6512785bd5a6f0e834ff3f4bbebc11c4fcdf16ab4fdfabd0d981a756955267c1aa9bbeec596de3728ce9b2e6415d2d80daef0d999a5df6d";
      };
      aarch64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/bfc8ae06-2830-4082-a09e-63b3c7134096/880a4712d4ba3491c88aa566553c4e8a/aspnetcore-runtime-5.0.12-linux-arm64.tar.gz";
-        sha512  = "70570177896943613f0cddeb046ffccaafb1c8245c146383e45fbcfb27779c70dff1ab22c2b13a14bf096173c9279e0a386f61665106a3abb5f623b50281a652";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/6eb8aee2-cbea-4c4f-9bb9-ea6229ec229b/d6c438e5071c359ad995134f0a33e731/aspnetcore-runtime-5.0.17-linux-arm64.tar.gz";
+        sha512  = "ac1a9d89f1b730dfdca9c2e48373ef21f8f9316014eefbe6b11516f8195d3b3efc4e482883774b74ea2ff1cb77174a2cb471bd1157ab5b7d71621e3026c38e9b";
      };
      x86_64-darwin = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/06d71ed5-0755-40d6-8b8e-14a24b8a9cb7/47a8b4deda0deecf3658716b642c69bf/aspnetcore-runtime-5.0.12-osx-x64.tar.gz";
-        sha512  = "bd9e7dd7f48c220121dde85b3acc4ce7eb2a1944d472f9340276718ef72d033f05fd9a62ffb9de93b8e7633843e731ff1cb5e8c836315f7571f519fdb0a119e1";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/25e4817f-6fd0-46dc-be0d-d819445bac5c/a8fa228c872df683741c8a79745f8fb3/aspnetcore-runtime-5.0.17-osx-x64.tar.gz";
+        sha512  = "bb0c43c723090fa2d8a0255e6fc8c004ebe7baf2d5d56e22ad2e6336a67fe415333d451e459c8857c0ccb5819d998232c9617bf45f222559d4b8891b0af41f20";
      };
    };
  };

  runtime_5_0 = buildNetRuntime {
    inherit icu;
-    version = "5.0.12";
+    version = "5.0.17";
    srcs = {
      x86_64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/781b7ae6-166c-4114-97f8-926d2bf74d34/fe51479e3138d672c512ef0322be23d3/dotnet-runtime-5.0.12-linux-x64.tar.gz";
-        sha512  = "32b5f86db3b1d4c21e3cf616d22f0e4a7374385dac0cf03cdebf3520dcf846460d9677ec1829a180920740a0237d64f6eaa2421d036a67f4fe9fb15d4f6b1db9";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/e77438f6-865f-45e0-9a52-3e4b04aa609f/024a880ed4bfbfd3b9f222fec0b6aaff/dotnet-runtime-5.0.17-linux-x64.tar.gz";
+        sha512  = "a9c4784930a977abbc42aff1337dda06ec588c1ec4769a59f9fcab4d5df4fc9efe65f8e61e5433db078f67a94ea2dfe870c32c482a50d4c16283ffacacff4261";
      };
      aarch64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/7c342ad2-2dae-471b-ae46-c0c820321c1f/a480ad8ca0bc826a48c9b1e56efd972b/dotnet-runtime-5.0.12-linux-arm64.tar.gz";
-        sha512  = "a8089fad8d21a4b582aa6c3d7162d56a21fee697fd400f050a772f67c2ace5e4196d1c4261d3e861d6dc2e5439666f112c406104d6271e5ab60cda80ef2ffc64";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/6690730f-cf10-40f1-9d4d-4c0d002f22d0/e117133858f190c169873200b8d7b9d7/dotnet-runtime-5.0.17-linux-arm64.tar.gz";
+        sha512  = "99cb11871924d3abedcc9c8079c54bc0c550203c7cbe4e349ed70d4355f40e4620b68d90b797e6461d898c06bed6953580e2cd4ad01483e5de107ca5a3409610";
      };
      x86_64-darwin = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/8f990fa6-6b13-40ad-95f6-383391ff3d91/7531048d16c01efdf3885da367aa8b89/dotnet-runtime-5.0.12-osx-x64.tar.gz";
-        sha512  = "a3160eaec15d0e2b62a4a2cdbb6663ef2e817fd26a3a3b8b3d75c5e3538b2947ff66eaddafb39cc297b9f087794d5fbd5a0e097ec8522ab6fea562f230055264";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/39326cf0-dc7f-42a3-9f7a-fe30c75c7a7f/33cbce552148e13d47120fe4502f5b5e/dotnet-runtime-5.0.17-osx-x64.tar.gz";
+        sha512  = "31add512418640f98bc9511509db2049a2674c7725169d26be89218a02ac7972e03e5d6be5a3d45a0dfa764e6eade503a8f4957b7b198ec6ad412e423d95f1b9";
      };
    };
  };

  sdk_5_0 = buildNetSdk {
    inherit icu;
-    version = "5.0.403";
+    version = "5.0.408";
    srcs = {
      x86_64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/b77183fa-c045-4058-82c5-d37742ed5f2d/ddaccef3e448a6df348cae4d1d271339/dotnet-sdk-5.0.403-linux-x64.tar.gz";
-        sha512  = "7ba5f7f898dba64ea7027dc66184d60ac5ac35fabe750bd509711628442e098413878789fad5766be163fd2867cf22ef482a951e187cf629bbc6f54dd9293a4a";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/904da7d0-ff02-49db-bd6b-5ea615cbdfc5/966690e36643662dcc65e3ca2423041e/dotnet-sdk-5.0.408-linux-x64.tar.gz";
+        sha512  = "abbf22c420df2d8398d1616efa3d31e1b8f96130697746c45ad68668676d12e65ec3b4dd75f28a5dc7607da58b6e369693c0e658def15ce2431303c28e99db55";
      };
      aarch64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/91015c72-ce5a-4840-9e87-5bfa4bb80224/b39692ac418d790ff7a2e092eb07de98/dotnet-sdk-5.0.403-linux-arm64.tar.gz";
-        sha512  = "6cc705fe45c0d8df6a493eb2923539ef5b62d048d5218859bf3af06fb3934c9c716c16f98ee1a28c818d77adff8430bf39a2ae54a59a1468b704b4ba192234ac";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/d4b71fac-a2fd-4516-ac58-100fb09d796a/e79d6c2a8040b59bf49c0d167ae70a7b/dotnet-sdk-5.0.408-linux-arm64.tar.gz";
+        sha512  = "50f23d7aca91051d8b7c37f1a76b1eb51e6fe73e017d98558d757a6b9699e4237d401ce81515c1601b8c21eb62fee4e0b4f0bbed8967eefa3ceba75fc242f01b";
      };
      x86_64-darwin = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/5ccdb916-531f-4064-84e8-5475b273a4de/80dcfa0c2eb528f8b0e7c313ed36f4f1/dotnet-sdk-5.0.403-osx-x64.tar.gz";
-        sha512  = "70beea069db182cca211cf04d7a80f3d6a3987d76cbd2bb60590ee76b93a4041b1b86ad91057cddbbaddd501c72327c1bc0a5fec630f38063f84bd60ba2b4792";
+        url     = "https://download.visualstudio.microsoft.com/download/pr/4aeecc7c-7ffa-418f-9362-cf5eb3ed0396/055d5e6064a9fdecd7d906f5f262373d/dotnet-sdk-5.0.408-osx-x64.tar.gz";
+        sha512  = "3fdd4deac2809b00c0f669d5488000ac1b9a47dee6ab7b31167d7cec4759a10ee347fd4f52090a40684e5ecc1e1f57eb99c558e561edfd1436a2f77fc1c1a0b2";
      };
    };
    packages = { fetchNuGet }: [
-
+      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm"; version = "5.0.17"; sha256 = "0mfawgcc23r44a1r7ynafxwga6jzn0f0z5ys03qssrvlcdsb376x"; })
+      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "5.0.17"; sha256 = "183xgqzlwd5lhacxdwcjl8vcq7r7xypv0hddps9k32mmmwf83d8h"; })
+      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"; version = "5.0.17"; sha256 = "0i5pp1smjkyhiyhcbkyc3cxz0sx9204bfml8wsdy7bxznbh2gkmw"; })
+      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"; version = "5.0.17"; sha256 = "1fmd9jq2nzy63hjh4sa6zl636wpgwr3r8ahzln5w14m9k87lfdbk"; })
+      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "5.0.17"; sha256 = "066fwdlssbv556zd9w1x87x1j8j4kafj9rxyy0692bssdb4gcyc8"; })
+      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-x64"; version = "5.0.17"; sha256 = "1qvvqf8mmzzc7a7fhx324dprnbxhknr3qxspb2xhsn3yyg44xn2d"; })
+      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-arm"; version = "5.0.17"; sha256 = "1gzf2gv4z9bn1cr1kpqpf1jf7m0p0wd1pxq5ndylq6bw353yglk1"; })
+      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-arm64"; version = "5.0.17"; sha256 = "1lml70ln9bfjrfjf3jbxfzd5kgd4cp4h7v052md5ja364g7lalsy"; })
+      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-x64"; version = "5.0.17"; sha256 = "0j90fri15c05lw96xybgvqkysfm7g8grhkrg25g75vhi6ni2ricj"; })
+      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-x86"; version = "5.0.17"; sha256 = "1bdb887xvgxsmphys83zp9skn848p1r8viclc8p29w1rby4wi19i"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm"; version = "5.0.17"; sha256 = "0y90p765sj54clf2bwrka99w73g8b9550b4qvyilqggzydl1c1hk"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm64"; version = "5.0.17"; sha256 = "07v7vyqm556xr1ypkazfp6gh6drgf20zkwbhkpja8bwdcr6lphbb"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-musl-arm64"; version = "5.0.17"; sha256 = "0sbzlzhazh31s63hw9553hk9j56fxssncmfgidiyh0dg73aacrsp"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-musl-x64"; version = "5.0.17"; sha256 = "1qxphvlr882rvmj71y2imnf6r3hh4ln2n138qjyv1z129dp2g4y1"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "5.0.17"; sha256 = "1lc2jhr4ikffi5ylyf8f6ya6k0hdj0wp1l0017grrwd4m5ajj4vv"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "5.0.17"; sha256 = "02g5w41ivrw3n6cy3l3ixhcl8bw1fsv4bzs2m34k9h5fqmliaf3c"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-arm"; version = "5.0.17"; sha256 = "07rfkxpf6rp8x0lybl8hx40mk09w5gjrr9djkjcp8lvjgzidnxq9"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-arm64"; version = "5.0.17"; sha256 = "1i7wka56n3akr96jrkj37jx98bwxfzhpx5705930v50izligd08x"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x64"; version = "5.0.17"; sha256 = "15f1kqlpp1d05dhg3dfya32vvzbpj6c7gxds947f10jb0hqlnhdj"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x86"; version = "5.0.17"; sha256 = "1j1334zxv815ksdnllnbwwsbwnimjlpknjmqy1riy2zpswxlfkz6"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm"; version = "5.0.17"; sha256 = "0mmgd6nacx4fzf0w02ch0qxa43vrv6wfspykxsy2bkpvrnvr8xr9"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "5.0.17"; sha256 = "16whaq82pj6fqa0vam3a0va9ly843aa1z12hza040vn6252kk9fq"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-musl-arm64"; version = "5.0.17"; sha256 = "1zavnwqvn2f7lhb880wgv02anrvqsh6l34w72knwd31irggph08l"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-musl-x64"; version = "5.0.17"; sha256 = "173r2srcbad2prrw3l914scmdks3mghxgszvlwypdjnv0f2szgvv"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "5.0.17"; sha256 = "0jgcfs3jc98jfyaaamssznckbpnaygplk8pjsp6dswpansz5bnnq"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-x64"; version = "5.0.17"; sha256 = "1ph5kx18syinp8bpzw80bgq3njl65gwzws727xcmxnysgm7snmjp"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-arm"; version = "5.0.17"; sha256 = "0m4jhn70parwnl18fql0sk9sf14y8cf08xw6x2cm5bfhnc9jvjny"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-arm64"; version = "5.0.17"; sha256 = "1af20jkv73767b4fy18s2dvjncaca1ny0csyr7wbhvqfs59y3n1x"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-x64"; version = "5.0.17"; sha256 = "0llhsi03wyp2yjqy0snywqgwjgam91i4nsf5lc9kaxkk5h6vj1a0"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-x86"; version = "5.0.17"; sha256 = "0xvprbjwd3fymddvavsy7wk5q2hp45hdi10qz4rdbmns23vqkzmf"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "0vhvxpba3i9ffp4gp56l3rnlhq9yg07n3dv5qi89zb90vgyqjh1p"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "074c9byxwmndfdavxn103220f5gklaaxc9wj7zpb5v3yr3ads30f"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "03jkkpsy2zjfp722fa2fcnpk2g6jzy0bn9vip5c39k78y5pz29x6"; })
+      (fetchNuGet { pname = "Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "1ih6c104skp9q17i2dnsma45l6nv5c62vv2i1988dcjw2v0sl98m"; })
+      (fetchNuGet { pname = "runtime.linux-arm64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "0gwsxd1l0n32xnw0lyjixj2634iyygdb8pd7chydsr3qk8njxnpk"; })
+      (fetchNuGet { pname = "runtime.linux-arm64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "0x5dhn1jkwqnd0cki1vi97rhyfac6w79hvh9dxvnkn2k04sbps8q"; })
+      (fetchNuGet { pname = "runtime.linux-arm64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "1ipx3qn78z6gi415c4fa9wgy8k75aifbml6ys1c9ghl6yxbv0fd0"; })
+      (fetchNuGet { pname = "runtime.linux-arm64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "1wgbx648yndl0hh8vx6sflfwjyr5pfhi7vj7v19l6vxnrr1096w7"; })
+      (fetchNuGet { pname = "runtime.linux-arm.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "17jc8jc2dk1g8996jpq3k0g6c5inijivxkbz0grxrgr5jbyiv19y"; })
+      (fetchNuGet { pname = "runtime.linux-arm.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "0ydn40qn6cs6f20byvmc9j008s6csxjbh6jh5w4q995vipcmcpcj"; })
+      (fetchNuGet { pname = "runtime.linux-arm.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "0bw08wlf96vcyix850y8jips1glrz2cbj647af4d7gggw8p3wwzw"; })
+      (fetchNuGet { pname = "runtime.linux-arm.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "0xsqyw848scwcz09pgc719776q712xabx4xv47srzij34p2pq7np"; })
+      (fetchNuGet { pname = "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "00b0vipypjai4l8icr74kjhglxx2xlc3nw3vyiwisg52l9zyby66"; })
+      (fetchNuGet { pname = "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "1cdgd4p5zr1mzz9hlb5mj946zfa1vn9wya5y2bhqn9y4ak831wzp"; })
+      (fetchNuGet { pname = "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "17v8m4fxm4q40z49a2h4lw9dawg6pwfv4s2dskzc23ggcjgr6dp1"; })
+      (fetchNuGet { pname = "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "1fbqi92prqmvxx0rx7vhl10l665jmmhb2ng5jndimggydb0ckpqh"; })
+      (fetchNuGet { pname = "runtime.linux-musl-x64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "1rijxkzzk65xs9z2ygs13h0rhw1cli5vwshmvs1gfnwhhn8ic0gx"; })
+      (fetchNuGet { pname = "runtime.linux-musl-x64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "02mxvpm2zs5jvawigvxlnrw6si4zwj6qlcas99m9xdmm8yqq22cm"; })
+      (fetchNuGet { pname = "runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "0c1lcl3yy88vdfw12c7h0ww596qfjd5f8l2mn7mlqs6i3f864bkg"; })
+      (fetchNuGet { pname = "runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "0w0wg9ah7vngvpyds67l6qhizpkdf2r6m6cqyyvv3s5dw5l8rxin"; })
+      (fetchNuGet { pname = "runtime.linux-x64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "17yy7605vkfz0f4h58005gdfg6fnjxlcnq0vg0hrxsgbdqmd7p1i"; })
+      (fetchNuGet { pname = "runtime.linux-x64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "0av25fgkdl7zvn44wp8gqx2xl2mdlv1f9cgxzp7xk5yq8f7ynxpq"; })
+      (fetchNuGet { pname = "runtime.linux-x64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "1smhmdfq0jlv1gq18hdaj0y9yzkvqzmki19c0b3j5b76yxxxpbwz"; })
+      (fetchNuGet { pname = "runtime.linux-x64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "0n0cdb9zpdb4h4v6r265pqmqg8c94ydywvna6jp1c6qhqlr0qk39"; })
+      (fetchNuGet { pname = "runtime.osx-x64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "1s2n2sx29c8rx549zizj8yrddjl98a7vwvxw56y0jvvbwphr9gz4"; })
+      (fetchNuGet { pname = "runtime.osx-x64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "19m66yvv0hnmyrmx2l4drbls0fcib75fxq2csdx6p8gd54bnrsh3"; })
+      (fetchNuGet { pname = "runtime.osx-x64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "0bcnlsxcrvhybcjbb9879njx0c4z76y7djx4643g1rpjnkcrj9ww"; })
+      (fetchNuGet { pname = "runtime.osx-x64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "1bf95h2f0dmpmv7z7961zia5vaqvmjq3wkf6iil9jxv4z674624w"; })
+      (fetchNuGet { pname = "runtime.win-arm64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "02q593q09mwwh23m86048vc7b7an7pqch5nd86d4hxzkamnpnpsa"; })
+      (fetchNuGet { pname = "runtime.win-arm64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "16vzxywfj88gjcwfnmcb6b50ld8dp46i4pqiwwcy7yz15xgdhbm2"; })
+      (fetchNuGet { pname = "runtime.win-arm64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "1ix5lg2j5ihdfp9j3jdxc042g4syjzc4bafid465j52h6znsm6wm"; })
+      (fetchNuGet { pname = "runtime.win-arm64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "0w30v8r26cg427n5glm9nz6r10baalkqq5icqqxkq71hmh8fsjqb"; })
+      (fetchNuGet { pname = "runtime.win-arm.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "168iq4hdp6bhdpgqa1mir1bygmh2ggwkys1r82d6kpl2lzbxjy28"; })
+      (fetchNuGet { pname = "runtime.win-arm.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "18jpw2wbrb1b941729lb7hiq4yfq2z53pcxwz4mpgawnr58y0562"; })
+      (fetchNuGet { pname = "runtime.win-arm.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "0ig464fcsj2jr0p02f6slifwf1m0408g95npm0vccf5ww1nbgkpi"; })
+      (fetchNuGet { pname = "runtime.win-arm.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "0qj5avmjrvabxzimprg4m54k3p6zkwrhbpv0byc8c9gbi47s323j"; })
+      (fetchNuGet { pname = "runtime.win-x64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "05ghz164lpff7n8mrxs7jm2h8n3clsg4w953zrag3k5ry9j36m9c"; })
+      (fetchNuGet { pname = "runtime.win-x64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "0azgs542mbg69jlc81529i2z5m728w8sc2i9m5dx15hvxqqqcjiz"; })
+      (fetchNuGet { pname = "runtime.win-x64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "12n1kcgcv5z8hkvjqfk0n705kcipbai4sgcwiimi52xpaf34xw8m"; })
+      (fetchNuGet { pname = "runtime.win-x64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "0b1s2m0a7xcdzfz22x6k7v5hkca90azdjk6pw7wwdnvszwq26nxp"; })
+      (fetchNuGet { pname = "runtime.win-x86.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "1sjpq07swgj0isdgyh6p2yb254qb9781lv44xfhj6nz7mx2yhdh1"; })
+      (fetchNuGet { pname = "runtime.win-x86.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "1gnzrqdp26d7pwwz29gm4qb09n2zsb767qkhbwkifcsyxlwi6m0f"; })
+      (fetchNuGet { pname = "runtime.win-x86.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "089jww13gaf7x7yd9d3qkyx9iq8abcp3r147hd9nblh561c9bzbg"; })
+      (fetchNuGet { pname = "runtime.win-x86.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "1nycl1rayk0fhaakpj6q9rfp2lv3dpl7pziavmd9kcfryz952ff5"; })
    ];
  };
 }
--- a/pkgs/development/compilers/go-jsonnet/default.nix
+++ b/pkgs/development/compilers/go-jsonnet/default.nix
@@ -1,37 +1,30 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, fetchpatch
-, testers
-}:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch, testers, go-jsonnet }:

-let self = buildGoModule rec {
+buildGoModule rec {
  pname = "go-jsonnet";
-  version = "0.18.0";
+  version = "0.19.1";

  src = fetchFromGitHub {
    owner = "google";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-o/IjXskGaMhvQmTsAS745anGBMI2bwHf/EOEp57H8LU=";
+    hash = "sha256-FgQYnas0qkIedRAA8ApZXLzEylg6PS6+8zzl7j+yOeI=";
  };

+  vendorSha256 = "sha256-j1fTOUpLx34TgzW94A/BctLrg9XoTtb3cBizhVJoEEI=";
+
  patches = [
+    # See https://github.com/google/go-jsonnet/issues/653.
    (fetchpatch {
-      name = "update-x-sys-for-go-1.18-on-aarch64-darwin.patch";
-      url = "https://github.com/google/go-jsonnet/commit/7032dd729f7e684dcfb2574f4fe99499165ef9cb.patch";
-      hash = "sha256-emUcuE9Q4qkXFXLyLvLHjzrKAaQhjcSWLNafABvHxhM=";
+      url = "https://github.com/google/go-jsonnet/commit/5712f2ed2c8dfa685e4f1234eefc7690a580af6f.patch";
+      hash = "sha256-/+6BlAaul4FoD7pq7yAy1xG78apEBuH2LC4fsfbugFQ=";
    })
  ];

-  vendorHash = "sha256-H4vLVXpuPkECB15LHoS9N9IwUD7Fzccshwbo5hjeXXc=";
-
-  doCheck = false;
-
  subPackages = [ "cmd/jsonnet*" ];

  passthru.tests.version = testers.testVersion {
-    package = self;
+    package = go-jsonnet;
    version = "v${version}";
  };

@@ -42,5 +35,4 @@ let self = buildGoModule rec {
    maintainers = with maintainers; [ nshalman aaronjheng ];
    mainProgram = "jsonnet";
  };
-};
-in self
+}
--- a/pkgs/development/compilers/idris2/default.nix
+++ b/pkgs/development/compilers/idris2/default.nix
@@ -23,13 +23,13 @@ let
 # Uses scheme to bootstrap the build of idris2
 in stdenv.mkDerivation rec {
  pname = "idris2";
-  version = "0.5.1";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "idris-lang";
    repo = "Idris2";
    rev = "v${version}";
-    sha256 = "sha256-6CTn8o5geWSesXO7vTrrV/2EOQ3f+nPQ2M5cem13ZSY=";
+    sha256 = "sha256-80MAGM1IEtI09h5aCYfDL4PRrjGq2gT8OUEibOVk8H4=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/roslyn/deps.nix
+++ b/pkgs/development/compilers/roslyn/deps.nix
@@ -137,18 +137,18 @@
  }
  {
    pname = "microsoft.netcore.app.host.linux-x64";
-    version = "3.1.21";
+    version = "3.1.25";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/45bacae2-5efb-47c8-91e5-8ec20c22b4f8/nuget/v3/flat2/microsoft.netcore.app.host.linux-x64/3.1.21/microsoft.netcore.app.host.linux-x64.3.1.21.nupkg";
-      sha256 = "01kbhi29lhv6mg1zfsyakz3z8hfbxnc0kxy0fczl8xqviik9svx7";
+      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/45bacae2-5efb-47c8-91e5-8ec20c22b4f8/nuget/v3/flat2/microsoft.netcore.app.host.linux-x64/3.1.25/microsoft.netcore.app.host.linux-x64.3.1.25.nupkg";
+      sha256 = "1dxk7v29wr736hlz8nfm2xv8dxmdl59w8w56kqjrvdw1lvgm411v";
    };
  }
  {
    pname = "microsoft.netcore.app.host.linux-arm64";
-    version = "3.1.21";
+    version = "3.1.25";
    src = fetchurl {
-      url = "https://globalcdn.nuget.org/packages/microsoft.netcore.app.host.linux-arm64.3.1.21.nupkg";
-      sha256 = "0mv79mv0g539437jy4cxvkic7iqgh2xs1nlpd8bzx7jha27g5mlr";
+      url = "https://globalcdn.nuget.org/packages/microsoft.netcore.app.host.linux-arm64.3.1.25.nupkg";
+      sha256 = "1xp56v22il0cmg6r113yv9rprgyppmvphx400zagdgac8a536ywq";
    };
  }
  {
--- a/pkgs/development/compilers/vyper/default.nix
+++ b/pkgs/development/compilers/vyper/default.nix
@@ -47,7 +47,7 @@ buildPythonPackage rec {
    setuptools-scm
  ];

-  pythonRelaxDeps = [ "semantic-version" ];
+  pythonRelaxDeps = [ "asttokens" "semantic-version" ];

  propagatedBuildInputs = [
    asttokens
--- a/pkgs/development/interpreters/luau/default.nix
+++ b/pkgs/development/interpreters/luau/default.nix
@@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "luau";
-  version = "0.550";
+  version = "0.551";

  src = fetchFromGitHub {
    owner = "Roblox";
    repo = "luau";
    rev = version;
-    sha256 = "sha256-bCZ1V3ygN6+6IHWxT8VPi7vWVk711fki9aIPUUsjiQA=";
+    sha256 = "sha256-1IQeTq5eLn0jYtdc6SM0TuVJ3TUWUWtjQjAviba5ibw=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/interpreters/php/8.0.nix
+++ b/pkgs/development/interpreters/php/8.0.nix
@@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "8.0.24";
-    hash = "sha256-kI4XzqMx1au4UGtKicY5K5YuEnw5Eyd3fHSF60tBXUM=";
+    version = "8.0.25";
+    hash = "sha256-CdcWvOtbPbdtkCOxDBaB674EDlH0wY39Nfn/i3O7z4w=";
  });

 in
--- a/pkgs/development/interpreters/php/8.1.nix
+++ b/pkgs/development/interpreters/php/8.1.nix
@@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "8.1.11";
-    hash = "sha256-r2JQsYtEA7bu/5tKAnhqyGoSoggUH29lR495JW9H8kY=";
+    version = "8.1.12";
+    hash = "sha256-+H1z6Rf6z3jee83lP8L6pNTb4Eh6lAbhq2jIro8z6wM=";
  });

 in
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -1,23 +1,25 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , cmake
 , openssl
+, nix
 }:

 stdenv.mkDerivation rec {
  pname = "s2n-tls";
-  version = "1.3.25";
+  version = "1.3.26";

  src = fetchFromGitHub {
    owner = "aws";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Ugchtv8c+nRFJk4ord7Q8Rqn0bsqJtLb+DV7u/MrCa0=";
+    sha256 = "sha256-eVqiY/AomnKbN83hSB66EIuGD82Ilx+ybQtBMyX57WY=";
  };

  nativeBuildInputs = [ cmake ];

-  outputs = [ "out" "dev"];
+  outputs = [ "out" "dev" ];

  buildInputs = [ openssl ]; # s2n-config has find_dependency(LibCrypto).

@@ -39,6 +41,10 @@ stdenv.mkDerivation rec {
    done
  '';

+  passthru.tests = {
+    inherit nix;
+  };
+
  meta = with lib; {
    description = "C99 implementation of the TLS/SSL protocols";
    homepage = "https://github.com/aws/s2n-tls";
--- a/pkgs/development/libraries/sundials/default.nix
+++ b/pkgs/development/libraries/sundials/default.nix
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "sundials";
-  version = "6.3.0";
+  version = "6.4.0";

  outputs = [ "out" "examples" ];

  src = fetchurl {
    url = "https://github.com/LLNL/sundials/releases/download/v${version}/sundials-${version}.tar.gz";
-    hash = "sha256-iaIr6oIP8lCqcjn2NKsH+jTv4dLc/eKcyNOvEUVboqc=";
+    hash = "sha256-Cv+AOhLG0pjQW1aDkZfdCYWGMYZAF+JV7Ynii0m2UvE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "brev-cli";
-  version = "0.6.139";
+  version = "0.6.148";

  src = fetchFromGitHub {
    owner = "brevdev";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-yqyqlH2aYtVBFa5sFUTh6Ra0l5bOYpHjx/c7wlyxQfg=";
+    sha256 = "sha256-WMy65tnNYN1RzAEAyn2a+H3c+2ygFjqv1eGbBWIj3v0=";
  };

  vendorSha256 = "sha256-cNwfK1LpguRfM/ORebU6v+JLIxDJdT5y+zM3KmEamEw=";
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, unzip, lib, php }:
 let
  pname = "composer";
-  version = "2.4.2";
+  version = "2.4.4";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://getcomposer.org/download/${version}/composer.phar";
-    sha256 = "sha256-j+mKAQUMksxoErjq071bbgvNxXXOepOyQr3kl6MddzI=";
+    sha256 = "sha256-wlLCoiGZVviAif/CQrQsjLkwCjaP04kNY5QOT8llI0U=";
  };

  dontUnpack = true;
--- a/pkgs/development/python-modules/Rtree/default.nix
+++ b/pkgs/development/python-modules/Rtree/default.nix
@@ -10,13 +10,13 @@

 buildPythonPackage rec {
  pname = "rtree";
-  version = "1.0.0";
+  version = "1.0.1";
  disabled = pythonOlder "3.7";

  src = fetchPypi {
    pname = "Rtree";
    inherit version;
-    sha256 = "sha256-0Eg0ghITRrCTuaQlGNQPkhrfRFkVt66jB+smdoyDloI=";
+    sha256 = "sha256-IiEhaZwwOmQGXYSb9wOLHsq8N7Zcf6NAvts47w6AVCk=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/add-trailing-comma/default.nix
+++ b/pkgs/development/python-modules/add-trailing-comma/default.nix
@@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "add-trailing-comma";
-  version = "2.2.3";
+  version = "2.3.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "asottile";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-hJVVRhaElroZ1GVlbGK49gzts2tozLqp9xfoaPdbb3I=";
+    sha256 = "sha256-NEXPIkPeH6ZAm1uzqc8iRWnlLbhKmvGQGGraLu989sw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aiofiles/default.nix
+++ b/pkgs/development/python-modules/aiofiles/default.nix
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "aiofiles";
-  version = "0.8.0";
+  version = "22.1.0";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "Tinche";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-V7F+xalFGMgTgT30Gmd9FVV3cPndI/i9cB5vEuW/KVc=";
+    sha256 = "sha256-2itjGYusJT6sbCAgvKsI9IXeAOP7VQV0bpifFBZmnAo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aiolifx/default.nix
+++ b/pkgs/development/python-modules/aiolifx/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "aiolifx";
-  version = "0.8.6";
+  version = "0.8.7";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-FJ7XMAl00KkZtLOOkj50gwVakYzjnr894QrUvwceTjo=";
+    hash = "sha256-pqneX4O3BnDH7vT7RgFiEIMpLcoXOpBvKOYuMla3Iq4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aiomysensors/default.nix
+++ b/pkgs/development/python-modules/aiomysensors/default.nix
@@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "aiomysensors";
-  version = "0.3.0";
+  version = "0.3.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "MartinHjelmare";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-EGVoHEJrpGtp8OrhQhRZVaN1GhL4QCo/azp6pzgYYcs=";
+    hash = "sha256-uzVtgJ4R2MK6lqruvmoqgkzVCLhjyaEV92X6U6+lwG4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/async-upnp-client/default.nix
+++ b/pkgs/development/python-modules/async-upnp-client/default.nix
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "async-upnp-client";
-  version = "0.32.0";
+  version = "0.32.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "StevenLooman";
    repo = "async_upnp_client";
    rev = version;
-    sha256 = "sha256-pVeVn2Z+onRjG3bIeRl5dXoNPwAWtarV56PL/CQOQUA=";
+    sha256 = "sha256-T/8AZU95eHl/AIVkG9tYhN19B8PLvTWRTBRJjbvfI+8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "awscrt";
-  version = "0.14.7";
+  version = "0.15.1";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-59bwgjT3zFYx4q8G5Bi5RMUSQCVIlupu7rtycgXNXtg=";
+    hash = "sha256-2VBdad9NL19eW2Djot2gkynyjSCUvG4f0KnEub6M0vg=";
  };

  buildInputs = lib.optionals stdenv.isDarwin [
--- a/pkgs/development/python-modules/datasette-template-sql/default.nix
+++ b/pkgs/development/python-modules/datasette-template-sql/default.nix
@@ -1,33 +1,40 @@
-{ buildPythonPackage
-, fetchFromGitHub
-, lib
+{ lib
+, buildPythonPackage
 , datasette
-, pytestCheckHook
+, fetchFromGitHub
 , pytest-asyncio
-, sqlite-utils
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "datasette-template-sql";
  version = "1.0.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "simonw";
    repo = pname;
    rev = version;
-    sha256 = "1ag5f62y445jscxnklcfd84pjinkknmrpk1kmm2j121p7484hrsn";
+    hash = "sha256-VmdIEDk3iCBFrTPMm6ud00Z5CWqO0Wk707IQ4oVx5ak=";
  };

-  propagatedBuildInputs = [ datasette ];
+  propagatedBuildInputs = [
+    datasette
+  ];

-  checkInputs = [ pytestCheckHook pytest-asyncio sqlite-utils ];
+  # Tests require a running datasette instance
+  doCheck = false;

-  pythonImportsCheck = [ "datasette_template_sql" ];
+  pythonImportsCheck = [
+    "datasette_template_sql"
+  ];

  meta = with lib; {
    description = "Datasette plugin for executing SQL queries from templates";
    homepage = "https://datasette.io/plugins/datasette-template-sql";
    license = licenses.asl20;
-    maintainers = [ maintainers.MostAwesomeDude ];
+    maintainers = with maintainers; [ MostAwesomeDude ];
  };
 }
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -16,7 +16,6 @@
 , pyyaml
 , uvicorn
 , httpx
-# Check Inputs
 , pytestCheckHook
 , pytest-asyncio
 , pytest-timeout
@@ -30,7 +29,8 @@

 buildPythonPackage rec {
  pname = "datasette";
-  version = "0.61.1";
+  version = "0.63";
+  format = "setuptools";

  disabled = pythonOlder "3.7";

@@ -38,18 +38,13 @@ buildPythonPackage rec {
    owner = "simonw";
    repo = pname;
    rev = version;
-    sha256 = "sha256-HVzMyF4ujYK12UQ25il/XROPo+iBldsMxOTx+duoc5o=";
+    sha256 = "sha256-kzehFvGSmGo2TAtiNZCjRVv/kaiE+shniNnD0gO58b4=";
  };

  postPatch = ''
    substituteInPlace setup.py \
      --replace '"pytest-runner"' "" \
-      --replace "click>=7.1.1,<8.1.0" "click>=7.1.1,<8.2.0" \
-      --replace "click-default-group~=1.2.2" "click-default-group" \
-      --replace "hupper~=1.9" "hupper" \
-      --replace "Jinja2>=2.10.3,<3.1.0" "Jinja2" \
-      --replace "pint~=0.9" "pint" \
-      --replace "uvicorn~=0.11" "uvicorn"
+      --replace "click-default-group-wheel>=1.2.2" "click-default-group"
  '';

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/dlms-cosem/default.nix
+++ b/pkgs/development/python-modules/dlms-cosem/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, asn1crypto
+, attrs
+, buildPythonPackage
+, cryptography
+, fetchFromGitHub
+, pyserial
+, pytestCheckHook
+, python-dateutil
+, pythonOlder
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "dlms-cosem";
+  version = "21.3.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "pwitab";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-BrLanP+SIRRof15yzqwcDOxw92phbW7m9CfORz0xo7I=";
+  };
+
+  propagatedBuildInputs = [
+    asn1crypto
+    attrs
+    cryptography
+    pyserial
+    python-dateutil
+    typing-extensions
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dlms_cosem"
+  ];
+
+  meta = with lib; {
+    description = "Python module to parse DLMS/COSEM";
+    homepage = "https://github.com/pwitab/dlms-cosem";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/dsmr-parser/default.nix
+++ b/pkgs/development/python-modules/dsmr-parser/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, dlms-cosem
 , fetchFromGitHub
 , pyserial
 , pyserial-asyncio
@@ -11,7 +12,7 @@

 buildPythonPackage rec {
  pname = "dsmr-parser";
-  version = "0.33";
+  version = "0.34";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@@ -20,10 +21,11 @@ buildPythonPackage rec {
    owner = "ndokter";
    repo = "dsmr_parser";
    rev = "v${version}";
-    sha256 = "sha256-Phx8Yqx6beTzkQv0fU8Pfs2btPgKVARdO+nMcne1S+w=";
+    sha256 = "sha256-GO+lSgTmFgi/ljt99mteoot+p5BJnGb6ZFky5I3I6Io=";
  };

  propagatedBuildInputs = [
+    dlms-cosem
    pyserial
    pyserial-asyncio
    pytz
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@@ -6,12 +6,12 @@

 buildPythonPackage rec {
  pname = "fiona";
-  version = "1.8.21";
+  version = "1.8.22";

  src = fetchPypi {
    pname = "Fiona";
    inherit version;
-    sha256 = "sha256-Og7coqegcNtAXXEYchSkPSMzpXtAl1RKP8woIGali/w=";
+    sha256 = "sha256-qCqZzps+eCV0AVfEXJ+yJZ1OkvCohqqsJfDbQP/h7qM=";
  };

  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
--- a/pkgs/development/python-modules/flake8-bugbear/default.nix
+++ b/pkgs/development/python-modules/flake8-bugbear/default.nix
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "flake8-bugbear";
-  version = "22.10.25";
+  version = "22.10.27";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "PyCQA";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-+eE9MY1k9JN0l3g8/wWOfbhkoSZLYG+wPKvl63R1n3o=";
+    hash = "sha256-pzVzCEkndbesX3tzuuPqtpEmCd5/bSuQmJ2J2IPFRMk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/geopandas/default.nix
+++ b/pkgs/development/python-modules/geopandas/default.nix
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "geopandas";
-  version = "0.12.0";
+  version = "0.12.1";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "geopandas";
    repo = "geopandas";
    rev = "refs/tags/v${version}";
-    hash = "sha256-pMboKhwlueRjpbukF9u+yy9jlu0ikA1vQ08n7V2C7wo=";
+    hash = "sha256-aLERNVojPgZ3Y7+CnirGvC4RfuQf+K3Oj2/0BqdorwI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/glcontext/default.nix
+++ b/pkgs/development/python-modules/glcontext/default.nix
@@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "glcontext";
-  version = "2.3.6";
+  version = "2.3.7";

  src = fetchFromGitHub {
    owner = "moderngl";
    repo = pname;
    rev = "refs/tags/${version}";
-    sha256 = "sha256-fE1fyoKQz1jmTBcAz2CbkLjRfgN5QedpMOLMU8keIZs=";
+    sha256 = "sha256-U/oP9nx7iTK6EYbUl90UD7fTOo5oDlh9ULPNjRibsXE=";
  };

  disabled = !isPy3k;
--- a/pkgs/development/python-modules/google-cloud-container/default.nix
+++ b/pkgs/development/python-modules/google-cloud-container/default.nix
@@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-container";
-  version = "2.12.2";
+  version = "2.13.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-GnA60NjGi33i9P5D8IItQjLKlLirJITyijrGQROQHvM=";
+    hash = "sha256-Rq4DuCbXX4DSIr01AFYo0O4+wQv4B5yzrrX9a2ecAFI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-re2/default.nix
+++ b/pkgs/development/python-modules/google-re2/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "google-re2";
-  version = "0.2.20220601";
+  version = "1.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-zBCYPcqgsyYKTNHAfHrcH6aWfbz6zJwajxHkwRjHeQU=";
+    hash = "sha256-IcitwpY2DeH/QmuqOMcS6tpiLChY0ZXrSH5BXZQZTpE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/growattserver/default.nix
+++ b/pkgs/development/python-modules/growattserver/default.nix
@@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "growattserver";
-  version = "1.2.2";
+  version = "1.2.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "indykoning";
    repo = "PyPi_GrowattServer";
-    rev = version;
-    hash = "sha256-dS5Ng89aYzfegdFlyt1eo7vhva2ME77pQV2hkd/iNq8=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-79/siHqwY3TNFIxodR24TJwsrKapG1GP4u4fIKxdFI4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/immutabledict/default.nix
+++ b/pkgs/development/python-modules/immutabledict/default.nix
@@ -3,18 +3,21 @@
 , fetchFromGitHub
 , poetry-core
 , pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "immutabledict";
-  version = "2.2.1";
+  version = "2.2.2";
  format = "pyproject";

+  disabled = pythonOlder "3.7";
+
  src = fetchFromGitHub {
    owner = "corenting";
    repo = "immutabledict";
    rev = "v${version}";
-    sha256 = "sha256-z04xxoCw0eBtkt++y/1yUsAPaLlAGUtWBdRBM74ul1c=";
+    hash = "sha256-YqUxkpFl2G/LFLtFWqocXbFvgVhqqiquoWNIIO9c/6o=";
  };

  nativeBuildInputs = [
@@ -36,4 +39,3 @@ buildPythonPackage rec {
    maintainers = with maintainers; [ hexa ];
  };
 }
-
--- a/Show More
+++ b/Show More