Merge staging-next into staging

2026-10-03 21:40:12 +00:00 · 2023-11-20 18:01:49 +00:00
parent 531ab0c74e 7f42d0e233
commit a1e27bbf99
68 changed files with 1390 additions and 1002 deletions
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -1,5 +1,5 @@
+/* Operations on attribute sets. */
 { lib }:
-# Operations on attribute sets.

 let
  inherit (builtins) head tail length;
--- a/lib/filesystem.nix
+++ b/lib/filesystem.nix
@@ -1,5 +1,7 @@
-# Functions for querying information about the filesystem
-# without copying any files to the Nix store.
+/*
+  Functions for querying information about the filesystem
+  without copying any files to the Nix store.
+*/
 { lib }:

 # Tested in lib/tests/filesystem.sh
--- a/lib/gvariant.nix
+++ b/lib/gvariant.nix
@@ -1,16 +1,17 @@
+/*
+  A partial and basic implementation of GVariant formatted strings.
+  See [GVariant Format Strings](https://docs.gtk.org/glib/gvariant-format-strings.html) for details.
+
+  :::{.warning}
+  This API is not considered fully stable and it might therefore
+  change in backwards incompatible ways without prior notice.
+  :::
+*/
+
 # This file is based on https://github.com/nix-community/home-manager
 # Copyright (c) 2017-2022 Home Manager contributors
-#
-
-
 { lib }:

-/* A partial and basic implementation of GVariant formatted strings.
-   See https://docs.gtk.org/glib/gvariant-format-strings.html for detauls.
-
-   Note, this API is not considered fully stable and it might therefore
-   change in backwards incompatible ways without prior notice.
-*/
 let
  inherit (lib)
    concatMapStringsSep concatStrings escape head replaceStrings;
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -1,5 +1,4 @@
-# General list operations.
-
+/* General list operations. */
 { lib }:
 let
  inherit (lib.strings) toInt;
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -1,4 +1,4 @@
-# Nixpkgs/NixOS option handling.
+/* Nixpkgs/NixOS option handling. */
 { lib }:

 let
--- a/lib/path/default.nix
+++ b/lib/path/default.nix
@@ -1,4 +1,5 @@
-# Functions for working with paths, see ./path.md
+/* Functions for working with path values. */
+# See ./README.md for internal docs
 { lib }:
 let

--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -1,4 +1,4 @@
-# Functions for copying sources to the Nix store.
+/* Functions for copying sources to the Nix store. */
 { lib }:

 # Tested in lib/tests/sources.sh
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -219,7 +219,6 @@ with lib.maintainers; {
      cole-h
      grahamc
      hoverbear
-      lheckemann
    ];
    scope = "Group registration for packages maintained by Determinate Systems.";
    shortName = "Determinate Systems employees";
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -881,6 +881,7 @@
  ./services/networking/bitlbee.nix
  ./services/networking/blockbook-frontend.nix
  ./services/networking/blocky.nix
+  ./services/networking/centrifugo.nix
  ./services/networking/cgit.nix
  ./services/networking/charybdis.nix
  ./services/networking/chisel-server.nix
--- a/nixos/modules/services/networking/centrifugo.nix
+++ b/nixos/modules/services/networking/centrifugo.nix
@@ -0,0 +1,123 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.centrifugo;
+
+  settingsFormat = pkgs.formats.json { };
+
+  configFile = settingsFormat.generate "centrifugo.json" cfg.settings;
+in
+{
+  options.services.centrifugo = {
+    enable = lib.mkEnableOption (lib.mdDoc "Centrifugo messaging server");
+
+    package = lib.mkPackageOptionMD pkgs "centrifugo" { };
+
+    settings = lib.mkOption {
+      type = settingsFormat.type;
+      default = { };
+      description = lib.mdDoc ''
+        Declarative Centrifugo configuration. See the [Centrifugo
+        documentation] for a list of options.
+
+        [Centrifugo documentation]: https://centrifugal.dev/docs/server/configuration
+      '';
+    };
+
+    credentials = lib.mkOption {
+      type = lib.types.attrsOf lib.types.path;
+      default = { };
+      example = {
+        CENTRIFUGO_UNI_GRPC_TLS_KEY = "/run/keys/centrifugo-uni-grpc-tls.key";
+      };
+      description = lib.mdDoc ''
+        Environment variables with absolute paths to credentials files to load
+        on service startup.
+      '';
+    };
+
+    environmentFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      description = lib.mdDoc ''
+        Files to load environment variables from. Options set via environment
+        variables take precedence over {option}`settings`.
+
+        See the [Centrifugo documentation] for the environment variable name
+        format.
+
+        [Centrifugo documentation]: https://centrifugal.dev/docs/server/configuration#os-environment-variables
+      '';
+    };
+
+    extraGroups = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "redis-centrifugo" ];
+      description = lib.mdDoc ''
+        Additional groups for the systemd service.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.centrifugo = {
+      description = "Centrifugo messaging server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        Type = "exec";
+
+        ExecStartPre = "${lib.getExe cfg.package} checkconfig --config ${configFile}";
+        ExecStart = "${lib.getExe cfg.package} --config ${configFile}";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+
+        Restart = "always";
+        RestartSec = "1s";
+
+        # Copy files to the credentials directory with file name being the
+        # environment variable name. Note that "%d" specifier expands to the
+        # path of the credentials directory.
+        LoadCredential = lib.mapAttrsToList (name: value: "${name}:${value}") cfg.credentials;
+        Environment = lib.mapAttrsToList (name: _: "${name}=%d/${name}") cfg.credentials;
+
+        EnvironmentFile = cfg.environmentFiles;
+
+        SupplementaryGroups = cfg.extraGroups;
+
+        DynamicUser = true;
+        UMask = "0077";
+
+        ProtectHome = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectControlGroups = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        PrivateUsers = true;
+        PrivateDevices = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        DeviceAllow = [ "" ];
+        DevicePolicy = "closed";
+        CapabilityBoundingSet = [ "" ];
+        MemoryDenyWriteExecute = true;
+        LockPersonality = true;
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+      };
+    };
+  };
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -174,6 +174,7 @@ in {
  cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; };
  cassandra_3_11 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_11; };
  cassandra_4 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_4; };
+  centrifugo = runTest ./centrifugo.nix;
  ceph-multi-node = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-multi-node.nix {};
  ceph-single-node = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-single-node.nix {};
  ceph-single-node-bluestore = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-single-node-bluestore.nix {};
--- a/nixos/tests/centrifugo.nix
+++ b/nixos/tests/centrifugo.nix
@@ -0,0 +1,80 @@
+let
+  redisPort = 6379;
+  centrifugoPort = 8080;
+  nodes = [
+    "centrifugo1"
+    "centrifugo2"
+    "centrifugo3"
+  ];
+in
+{ lib, ... }: {
+  name = "centrifugo";
+  meta.maintainers = [ lib.maintainers.tie ];
+
+  nodes = lib.listToAttrs (lib.imap0
+    (index: name: {
+      inherit name;
+      value = { config, ... }: {
+        services.centrifugo = {
+          enable = true;
+          settings = {
+            inherit name;
+            port = centrifugoPort;
+            # See https://centrifugal.dev/docs/server/engines#redis-sharding
+            engine = "redis";
+            # Connect to local Redis shard via Unix socket.
+            redis_address =
+              let
+                otherNodes = lib.take index nodes ++ lib.drop (index + 1) nodes;
+              in
+              map (name: "${name}:${toString redisPort}") otherNodes ++ [
+                "unix://${config.services.redis.servers.centrifugo.unixSocket}"
+              ];
+            usage_stats_disable = true;
+            api_insecure = true;
+          };
+          extraGroups = [
+            config.services.redis.servers.centrifugo.user
+          ];
+        };
+        services.redis.servers.centrifugo = {
+          enable = true;
+          bind = null; # all interfaces
+          port = redisPort;
+          openFirewall = true;
+          settings.protected-mode = false;
+        };
+      };
+    })
+    nodes);
+
+  testScript = ''
+    import json
+
+    redisPort = ${toString redisPort}
+    centrifugoPort = ${toString centrifugoPort}
+
+    start_all()
+
+    for machine in machines:
+      machine.wait_for_unit("redis-centrifugo.service")
+      machine.wait_for_open_port(redisPort)
+
+    for machine in machines:
+      machine.wait_for_unit("centrifugo.service")
+      machine.wait_for_open_port(centrifugoPort)
+
+    # See https://centrifugal.dev/docs/server/server_api#info
+    def list_nodes(machine):
+      curl = "curl --fail-with-body --silent"
+      body = "{}"
+      resp = json.loads(machine.succeed(f"{curl} -d '{body}' http://localhost:{centrifugoPort}/api/info"))
+      return resp["result"]["nodes"]
+    machineNames = {m.name for m in machines}
+    for machine in machines:
+      nodes = list_nodes(machine)
+      assert len(nodes) == len(machines)
+      nodeNames = {n['name'] for n in nodes}
+      assert machineNames == nodeNames
+  '';
+}
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3547,15 +3547,15 @@ let
        mktplcRef = {
          name = "uiua-vscode";
          publisher = "uiua-lang";
-          version = "0.0.23";
-          sha256 = "sha256-NauXoYTAka8qXNPYlW5g7r6NNX1x8cnvDRbEGkRsMoY=";
+          version = "0.0.24";
+          sha256 = "sha256-/MLeBsnUdzcDB4nUrugEF05HKqC30G9muYKvmlnLM7U=";
        };
        meta = {
          description = "VSCode language extension for Uiua";
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=uiua-lang.uiua-vscode";
          homepage = "https://github.com/uiua-lang/uiua-vscode";
          license = lib.licenses.mit;
-          maintainers = with lib.maintainers; [ tomasajt wackbyte ];
+          maintainers = with lib.maintainers; [ tomasajt wackbyte defelo ];
        };
      };

--- a/pkgs/applications/misc/mission-center/default.nix
+++ b/pkgs/applications/misc/mission-center/default.nix
@@ -104,6 +104,9 @@ stdenv.mkDerivation rec {
  ];

  postPatch = ''
+    substituteInPlace src/main.rs \
+      --replace "libGL.so.1" "${libGL}/lib/libGL.so.1"
+
    SRC_GATHERER=$NIX_BUILD_TOP/source/src/sys_info_v2/gatherer
    SRC_GATHERER_NVTOP=$SRC_GATHERER/3rdparty/nvtop

--- a/pkgs/applications/networking/browsers/lagrange/default.nix
+++ b/pkgs/applications/networking/browsers/lagrange/default.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lagrange";
-  version = "1.17.3";
+  version = "1.17.4";

  src = fetchFromGitHub {
    owner = "skyjake";
    repo = "lagrange";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-YPC+mwXKZOOhLtUU+WHdkQtHFYfIYOiadbuAHLvAXxM=";
+    hash = "sha256-vzdlcyA+RCr8RH0KbTiUah8lS++Xq6gLCHbgHHBFEig=";
  };

  nativeBuildInputs = [ cmake pkg-config zip ];
--- a/pkgs/applications/networking/cluster/kubedb-cli/default.nix
+++ b/pkgs/applications/networking/cluster/kubedb-cli/default.nix
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubedb-cli";
-  version = "0.36.0";
+  version = "0.37.0";

  src = fetchFromGitHub {
    owner = "kubedb";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-nDLdATiUcg5o86Pda1/Do9dPMtdNCUo/xj6ERRzih8w=";
+    sha256 = "sha256-Lm7TrdUAYPYBKC+9lPmWTDp0BQqiAc/A107wtiGDwZ4=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubeseal";
-  version = "0.24.2";
+  version = "0.24.4";

  src = fetchFromGitHub {
    owner = "bitnami-labs";
    repo = "sealed-secrets";
    rev = "v${version}";
-    sha256 = "sha256-vKAKDQrQ7FmCnJwo8ItwpiayrHa9bhMognYZMlpZAlM=";
+    sha256 = "sha256-0KXAN8unaReYFyuGI6XCHhxKiKow0suP9yDl5pI+bGQ=";
  };

-  vendorHash = "sha256-LPxU6qvpUb0ZjzjqGeTywOluwWbsi1YmiYYWJfaMWvg=";
+  vendorHash = "sha256-gbizFiZ+LFdY0SISK3K0D0vwj4Dq/UMcoCuvUYMB/F4=";

  subPackages = [ "cmd/kubeseal" ];

--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/applications/networking/msmtp/default.nix
@@ -19,6 +19,7 @@
 , libsecret
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 , systemd
+, withScripts ? true
 }:

 let
@@ -124,9 +125,11 @@ let
  };

 in
-symlinkJoin {
-  name = "msmtp-${version}";
-  inherit version meta;
-  paths = [ binaries scripts ];
-  passthru = { inherit binaries scripts; };
-}
+if withScripts then
+  symlinkJoin
+  {
+    name = "msmtp-${version}";
+    inherit version meta;
+    paths = [ binaries scripts ];
+    passthru = { inherit binaries scripts; };
+  } else binaries
--- a/pkgs/applications/networking/netmaker/default.nix
+++ b/pkgs/applications/networking/netmaker/default.nix
@@ -38,7 +38,7 @@ buildGoModule rec {
    description = "WireGuard automation from homelab to enterprise";
    homepage = "https://netmaker.io";
    changelog = "https://github.com/gravitl/netmaker/-/releases/v${version}";
-    license = licenses.sspl;
+    license = licenses.asl20;
    maintainers = with maintainers; [ urandom qjoly ];
  };
 }
--- a/pkgs/by-name/ce/centrifugo/package.nix
+++ b/pkgs/by-name/ce/centrifugo/package.nix
@@ -0,0 +1,60 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, nix-update-script
+, nixosTests
+, testers
+, centrifugo
+}:
+let
+  # Inspect build flags with `go version -m centrifugo`.
+  statsEndpoint = "https://graphite-prod-01-eu-west-0.grafana.net/graphite/metrics,https://stats.centrifugal.dev/usage";
+  statsToken = "425599:eyJrIjoi" +
+    "OWJhMTcyZGNjN2FkYjEzM2E1OTQwZjIyMTU3MTBjMjUyYzAyZWE2MSIsIm4iOiJVc2FnZSBTdGF0cyIsImlkIjo2NDUzOTN9";
+in
+buildGoModule rec {
+  pname = "centrifugo";
+  version = "5.1.1";
+
+  src = fetchFromGitHub {
+    owner = "centrifugal";
+    repo = "centrifugo";
+    rev = "v${version}";
+    hash = "sha256-g496cXjgliDi2XLkdE+dERrUl5hBGLICJx5JundeOfo=";
+  };
+
+  vendorHash = "sha256-VuxnP9Dryo0L7sGvtvAIicYGkHoQ2iGVBtAdkmiqL7E=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/centrifugal/centrifugo/v5/internal/build.Version=${version}"
+    "-X=github.com/centrifugal/centrifugo/v5/internal/build.UsageStatsEndpoint=${statsEndpoint}"
+    "-X=github.com/centrifugal/centrifugo/v5/internal/build.UsageStatsToken=${statsToken}"
+  ];
+
+  excludedPackages = [
+    "./internal/gen/api"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      inherit (nixosTests) centrifugo;
+      version = testers.testVersion {
+        package = centrifugo;
+        command = "${pname} version";
+        version = "v${version}";
+      };
+    };
+  };
+
+  meta = {
+    description = "Scalable real-time messaging server";
+    homepage = "https://centrifugal.dev";
+    changelog = "https://github.com/centrifugal/centrifugo/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.tie ];
+    mainProgram = "centrifugo";
+  };
+}
--- a/pkgs/by-name/ui/uiua/package.nix
+++ b/pkgs/by-name/ui/uiua/package.nix
@@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "uiua";
-  version = "0.2.0";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "uiua-lang";
    repo = "uiua";
    rev = version;
-    hash = "sha256-RAMQC9weEvTV44nAXjwMYv+4O5aSNNM5UOf/xBb4SBE=";
+    hash = "sha256-+Hh9vNVWen5ri8+Qy4pzaMrC0Laa1xMlURxEYwo4hSk=";
  };

-  cargoHash = "sha256-ZBedAIHwbRiR9i6w0CWIiE+OJvTkmxiEihn7zLAV/Dg=";
+  cargoHash = "sha256-tLBWbnER5ufK3NQ6mxzqY/dmiwaPKTcPOXS68S6yXf4=";

  nativeBuildInputs = lib.optionals stdenv.isDarwin [
    rustPlatform.bindgenHook
@@ -58,6 +58,6 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://www.uiua.org/";
    license = lib.licenses.mit;
    mainProgram = "uiua";
-    maintainers = with lib.maintainers; [ cafkafk tomasajt ];
+    maintainers = with lib.maintainers; [ cafkafk tomasajt defelo ];
  };
 }
--- a/pkgs/data/fonts/junicode/default.nix
+++ b/pkgs/data/fonts/junicode/default.nix
@@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "junicode";
-  version = "2.200";
+  version = "2.203";

  src = fetchzip {
    url = "https://github.com/psb1558/Junicode-font/releases/download/v${version}/Junicode_${version}.zip";
-    hash = "sha256-2K+zPq6Bjg+hZQhQrWWm1bxHVfwwRdsV7EseRGBnpUw=";
+    hash = "sha256-RG12veiZXqjfK2gONmauhGReuLEkqxbQ4h4PEwaih/U=";
  };

  outputs = [ "out" "doc" ];
--- a/pkgs/data/themes/alacritty-theme/default.nix
+++ b/pkgs/data/themes/alacritty-theme/default.nix
@@ -6,13 +6,13 @@

 stdenvNoCC.mkDerivation (self: {
  name = "alacritty-theme";
-  version = "unstable-2023-10-26";
+  version = "unstable-2023-11-07";

  src = fetchFromGitHub {
    owner = "alacritty";
    repo = "alacritty-theme";
-    rev = "e1b08b5bc06d07dd65f5e72b12fd7f736e0e7928";
-    hash = "sha256-wf0aT2uGe/6Ifv//lQStTm24yt2FX3kWQq5ebdmdPJ0=";
+    rev = "808b81b2e88884e8eca5d951b89f54983fa6c237";
+    hash = "sha256-g5tM6VBPLXin5s7X0PpzWOOGTEwHpVUurWOPqM/O13A=";
  };

  dontConfigure = true;
--- a/pkgs/desktops/pantheon/granite/7/default.nix
+++ b/pkgs/desktops/pantheon/granite/7/default.nix
@@ -19,7 +19,7 @@

 stdenv.mkDerivation rec {
  pname = "granite";
-  version = "7.3.0";
+  version = "7.4.0";

  outputs = [ "out" "dev" ];

@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "sha256-siFS8BiHVlDtM5odL0Lf1aRMoG6qqQOnbsXGKVyc218=";
+    sha256 = "sha256-z/6GxWfbsngySv2ziNwzhcEfTamxP1DnJ2ld9fft/1U=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/beam-modules/elixir-ls/default.nix
+++ b/pkgs/development/beam-modules/elixir-ls/default.nix
@@ -4,12 +4,12 @@

 let
  pname = "elixir-ls";
-  version = "0.17.3";
+  version = "0.17.10";
  src = fetchFromGitHub {
    owner = "elixir-lsp";
    repo = "elixir-ls";
    rev = "v${version}";
-    hash = "sha256-E+tlnkwJiyG8x29um/G7OqIDCJ/laDMTm3z7VvdWy6s=";
+    hash = "sha256-LUAYfR6MNNGLaqv8EBx0JQ8KYYD7jRvez3HJFnczV+Y=";
    fetchSubmodules = true;
  };
 in
@@ -21,7 +21,7 @@ mixRelease {
  mixFodDeps = fetchMixDeps {
    pname = "mix-deps-${pname}";
    inherit src version elixir;
-    hash = "sha256-ltSYZYsXWiq5ASvRmR7ETgK9e8bj4f9bhZAZEIceLkw=";
+    hash = "sha256-MVGYENy6/xI/ph/X0DxquigCuLK1FAEIONzoQU7TXoM=";
  };

  # elixir-ls is an umbrella app
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@@ -131,7 +131,7 @@ stdenv.mkDerivation rec {
  shared = if stdenv.isDarwin then "dylib" else "shared";
  configureFlags = [ "--enable-${shared}"  "--enable-lt=${libtool}/bin/libtool" ]
                   ++ lib.optionals disableDocs [ "--disable-docs" ]
-                   ++ lib.optionals stdenv.isDarwin [ "--enable-xonx" ];
+                   ++ lib.optionals stdenv.isDarwin [ "--disable-strip" "--enable-xonx" ];

  configureScript = "../configure";

--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "armadillo";
-  version = "12.6.5";
+  version = "12.6.6";

  src = fetchurl {
    url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    hash = "sha256-9vHJh/m8K1LpcYg1zEFqUlz1im1XWoUdIZwMarW4xWM=";
+    hash = "sha256-OFiw/UMXcq8DKtPzXCrrVOjavqWRaefR6fzNeLyCrTU=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/gensio/default.nix
+++ b/pkgs/development/libraries/gensio/default.nix
@@ -2,19 +2,20 @@
 , fetchFromGitHub
 , lib
 , nix-update-script
+, openssl
 , pkg-config
 , stdenv
 }:

 stdenv.mkDerivation rec {
  pname = "gensio";
-  version = "2.6.2";
+  version = "2.7.7";

  src = fetchFromGitHub {
    owner = "cminyard";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-lpP/pmM06zIw+9EZe+zywExLOcrN3K7IMK32XSrCmYs=";
+    sha256 = "sha256-fm850eDqKhvjwU5RwdwAro4R23yRn41ePn5++8MXHZ0=";
  };

  passthru = {
@@ -27,6 +28,8 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ autoreconfHook pkg-config ];

+  buildInputs = lib.optionals stdenv.isDarwin [ openssl ];
+
  meta = with lib; {
    description = "General Stream I/O";
    homepage = "https://sourceforge.net/projects/ser2net/";
--- a/pkgs/development/libraries/libndtypes/default.nix
+++ b/pkgs/development/libraries/libndtypes/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 }:

@@ -6,6 +7,8 @@ stdenv.mkDerivation {
  pname = "libndtypes";
  version = "unstable-2019-08-01";

+  outputs = [ "out" "dev" ];
+
  src = fetchFromGitHub {
    owner = "xnd-project";
    repo = "ndtypes";
--- a/pkgs/development/libraries/luabind/0.9.1-discover-luajit.patch
+++ b/pkgs/development/libraries/luabind/0.9.1-discover-luajit.patch
@@ -0,0 +1,22 @@
+diff --git a/cmake/Modules/FindLua52.cmake b/cmake/Modules/FindLua52.cmake
+index f4398e4..17377c0 100644
+--- a/cmake/Modules/FindLua52.cmake
+++ b/cmake/Modules/FindLua52.cmake
+@@ -61,7 +61,7 @@ FIND_PATH(LUA_INCLUDE_DIR lua.h
+ )
+ 
+ FIND_LIBRARY(_LUA_LIBRARY_RELEASE
+-  NAMES lua52 lua5.2 lua-5.2 lua
+  NAMES lua52 lua5.2 lua-5.2 lua luajit-5.1
+   HINTS
+   $ENV{LUA_DIR}
+   PATH_SUFFIXES lib64 lib
+@@ -75,7 +75,7 @@ FIND_LIBRARY(_LUA_LIBRARY_RELEASE
+ )
+ 
+ FIND_LIBRARY(_LUA_LIBRARY_DEBUG
+-  NAMES lua52-d lua5.2-d lua-5.2-d lua-d
+  NAMES lua52-d lua5.2-d lua-5.2-d lua-d luajit-5.1-d
+   HINTS
+   $ENV{LUA_DIR}
+   PATH_SUFFIXES lib64 lib
--- a/pkgs/development/libraries/luabind/default.nix
+++ b/pkgs/development/libraries/luabind/default.nix
@@ -21,8 +21,10 @@ stdenv.mkDerivation rec {
    inherit lua;
  };

+  patches = [./0.9.1-discover-luajit.patch];
+
  meta = {
-    homepage = "https://github.com/luabind/luabind";
+    homepage = "https://github.com/Oberon00/luabind";
    description = "A library that helps you create bindings between C++ and Lua";
    license = lib.licenses.mit;
    platforms = lib.platforms.unix;
--- a/pkgs/development/libraries/science/math/mkl/default.nix
+++ b/pkgs/development/libraries/science/math/mkl/default.nix
@@ -34,32 +34,32 @@ let

  oneapi-mkl = fetchurl {
    url = "https://yum.repos.intel.com/oneapi/intel-oneapi-mkl-${mklVersion}-${mklVersion}-${rel}.x86_64.rpm";
-    hash = "sha256-BeI5zB0rrE6C21dezNc7/WSKmTWpjsZbpg0/y0Y87VQ=";
+    hash = "sha256-PGLPNnR+11AmmaNxldeze/l2Kw/4+mfjB+RqsPhP6oM=";
  };

  oneapi-mkl-common = fetchurl {
    url = "https://yum.repos.intel.com/oneapi/intel-oneapi-mkl-common-${mklVersion}-${mklVersion}-${rel}.noarch.rpm";
-    hash = "sha256-NjIqTeFppwjXFlPYHPHfZa/bWBiHJru3atC4fIMXN0w=";
+    hash = "sha256-wztTE2R/IdG6ujGf7KFocpRmXzlZSnEKopTBOlPPlBw=";
  };

  oneapi-mkl-common-devel = fetchurl {
    url = "https://yum.repos.intel.com/oneapi/intel-oneapi-mkl-common-devel-${mklVersion}-${mklVersion}-${rel}.noarch.rpm";
-    hash = "sha256-GX19dlvBWRgwSOCmWcEOrnbmp4S2j0448fWpx+iPVWw=";
+    hash = "sha256-MWa8mpyFM4zgDLup+EzFRM+N2Oxf0o6FBBRM8mAanbI=";
  };

  oneapi-mkl-devel = fetchurl {
    url = "https://yum.repos.intel.com/oneapi/intel-oneapi-mkl-devel-${mklVersion}-${mklVersion}-${rel}.x86_64.rpm";
-    hash = "sha256-F4XxtSPAjNaShEL/l44jJK+JdOOkYI19X/njRB6FkNw=";
+    hash = "sha256-Arq5kXktI92031XqfV0pkzQCHaFsTRKX05iOA/fPNOs=";
  };

  oneapi-openmp = fetchurl {
    url = "https://yum.repos.intel.com/oneapi/intel-oneapi-openmp-${mklVersion}-${mklVersion}-${openmpRel}.x86_64.rpm";
-    hash = "sha256-1SlkI01DxFvwGPBJ73phs86ka0SmCrniwiXQ9DJwIXw=";
+    hash = "sha256-cyBD3P4AEvyreP4pP3BE+yyDB+ptblOQ9GYI8ysGsIM=";
  };

  oneapi-tbb = fetchurl {
    url = "https://yum.repos.intel.com/oneapi/intel-oneapi-tbb-${tbbVersion}-${tbbVersion}-${tbbRel}.x86_64.rpm";
-    hash = "sha256-wIktdf1p1SS1KrnUlc8LPkm0r9dhZE6cQNr4ZKTWI6A=";
+    hash = "sha256-pzJpQdiYVpcKDShePak2I0uEh7u08vJgX7OBF5p5yAM=";
  };

 in stdenvNoCC.mkDerivation ({
--- a/pkgs/development/python-modules/azure-eventhub/default.nix
+++ b/pkgs/development/python-modules/azure-eventhub/default.nix
@@ -2,27 +2,24 @@
 , buildPythonPackage
 , fetchPypi
 , azure-core
-, uamqp
 , pythonOlder
 , typing-extensions
 }:

 buildPythonPackage rec {
  pname = "azure-eventhub";
-  version = "5.11.4";
+  version = "5.11.5";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    extension = "zip";
-    hash = "sha256-aLiaNRUEDxF2+bSWxMdtOBwQd3mu13V8u7mj2r4wqCM=";
+    hash = "sha256-HDdOmQezNIPVCLTHst8p+crGM15dpaGNIYU0+UL01Uw=";
  };

  propagatedBuildInputs = [
    azure-core
-    uamqp
    typing-extensions
  ];

--- a/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
@@ -1,43 +1,41 @@
 { lib
-, buildPythonPackage
-, fetchPypi
-, msrest
-, msrestazure
 , azure-common
 , azure-mgmt-core
+, buildPythonPackage
+, fetchPypi
+, isodate
 , pythonOlder
 }:

 buildPythonPackage rec {
  pname = "azure-mgmt-keyvault";
-  version = "10.2.3";
+  version = "10.3.0";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    extension = "zip";
-    hash = "sha256-JDM6F0ToMpUeBlLULih17TLzCbrNdxrGrcq5oIfsybU=";
+    hash = "sha256-GDtBZM8YaLjqfv6qmO2tfSpOFKm9l3woGLErdRUM0qI=";
  };

  propagatedBuildInputs = [
-    msrest
-    msrestazure
    azure-common
    azure-mgmt-core
+    isodate
  ];

  pythonNamespaces = [
    "azure.mgmt"
  ];

-  # has no tests
+  # Module has no tests
  doCheck = false;

  meta = with lib; {
    description = "This is the Microsoft Azure Key Vault Management Client Library";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-mgmt-keyvault_${version}/sdk/keyvault/azure-mgmt-keyvault/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ jonringer maxwilson ];
  };
--- a/pkgs/development/python-modules/azure-synapse-artifacts/default.nix
+++ b/pkgs/development/python-modules/azure-synapse-artifacts/default.nix
@@ -1,34 +1,33 @@
 { lib
-, buildPythonPackage
-, fetchPypi
 , azure-common
 , azure-core
 , azure-mgmt-core
-, msrest
+, buildPythonPackage
+, fetchPypi
+, isodate
 , pythonOlder
 }:

 buildPythonPackage rec {
  pname = "azure-synapse-artifacts";
-  version = "0.17.0";
+  version = "0.18.0";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    extension = "zip";
-    hash = "sha256-58k8F/aUBBNJwGBiPZojkSzEXZ3Kd6uEwr0cZbFaM9k=";
+    hash = "sha256-qgiHMzW7T5NuQl0jwZheMXp7wHhNOHyH24J6wfc4VqQ=";
  };

  propagatedBuildInputs = [
    azure-common
    azure-core
    azure-mgmt-core
-    msrest
+    isodate
  ];

-  # zero tests run
+  # Tests are only available in mono-repo
  doCheck = false;

  pythonImportsCheck = [
@@ -38,6 +37,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Microsoft Azure Synapse Artifacts Client Library for Python";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-synapse-artifacts_${version}/sdk/synapse/azure-synapse-artifacts/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ jonringer ];
  };
--- a/pkgs/development/python-modules/bc-python-hcl2/default.nix
+++ b/pkgs/development/python-modules/bc-python-hcl2/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "bc-python-hcl2";
-  version = "0.3.51";
+  version = "0.4.1";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Fb/suuiC6tmY3ZMAc3I3oU5A39jJc+XH3ntMkgQKAQ8=";
+    hash = "sha256-cqQ4zuztfS5MiY4hj1WipKunqIfB1kpM+RODcZPERrY=";
  };

  # Nose is required during build process, so can not use `nativeCheckInputs`.
--- a/pkgs/development/python-modules/cantools/default.nix
+++ b/pkgs/development/python-modules/cantools/default.nix
@@ -1,33 +1,40 @@
 { lib
-, buildPythonPackage
-, fetchPypi
-, setuptools
 , argparse-addons
 , bitstruct
+, buildPythonPackage
 , can
 , crccheck
 , diskcache
+, fetchPypi
 , matplotlib
 , parameterized
 , pytestCheckHook
 , pythonOlder
+, setuptools
+, setuptools-scm
 , textparser
 }:

 buildPythonPackage rec {
  pname = "cantools";
-  version = "39.3.0";
+  version = "39.4.0";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-LD0IGSJZG8FhHJ8f9S1sivHQMxT4xyTMEU2FbMVVzCg=";
+    hash = "sha256-44zzlyOIQ2qo4Zq5hb+xnCy0ANm6iCpcBww0l2KWdMs=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "setuptools_scm>=8" "setuptools_scm"
+  '';
+
  nativeBuildInputs = [
    setuptools
+    setuptools-scm
  ];

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/clvm-rs/default.nix
+++ b/pkgs/development/python-modules/clvm-rs/default.nix
@@ -6,25 +6,24 @@
 , pythonOlder
 , openssl
 , perl
-, pkgs
 }:

 buildPythonPackage rec {
  pname = "clvm_rs";
-  version = "0.1.19";
+  version = "0.3.0";
  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "Chia-Network";
    repo = "clvm_rs";
    rev = version;
-    hash = "sha256-mCKY/PqNOUTaRsFDxQBvbTD6wC4qzP0uv5FldYkwl6c=";
+    hash = "sha256-DJviuIBJg+MF0NvmdeWK31nV+q4UZCRdmdbEAJqwXXg=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-TmrR8EeySsGWXohMdo3dCX4oT3l9uLVv5TUeRxCBQeE=";
+    hash = "sha256-bgXUSm3M8J7E2ohPjPIimHJvz1ivWrsliKZlgchOdhQ=";
  };

  format = "pyproject";
--- a/pkgs/development/python-modules/gumath/default.nix
+++ b/pkgs/development/python-modules/gumath/default.nix
@@ -39,7 +39,7 @@ buildPythonPackage {
  postPatch = ''
    substituteInPlace setup.py \
      --replace 'add_include_dirs = [".", "libgumath", "ndtypes/python/ndtypes", "xnd/python/xnd"] + INCLUDES' \
-                'add_include_dirs = [".", "${libndtypes}/include", "${libxnd}/include", "${libgumath}/include"]' \
+                'add_include_dirs = [".", "${libndtypes.dev}/include", "${libxnd}/include", "${libgumath}/include"]' \
      --replace 'add_library_dirs = ["libgumath", "ndtypes/libndtypes", "xnd/libxnd"] + LIBS' \
                'add_library_dirs = ["${libndtypes}/lib", "${libxnd}/lib", "${libgumath}/lib"]' \
      --replace 'add_runtime_library_dirs = ["$ORIGIN"]' \
--- a/pkgs/development/python-modules/ndtypes/default.nix
+++ b/pkgs/development/python-modules/ndtypes/default.nix
@@ -12,12 +12,14 @@ buildPythonPackage {
  disabled = isPy27;
  inherit (libndtypes) version src meta;

+  outputs = [ "out" "dev" ];
+
  propagatedBuildInputs = [ numpy ];

  postPatch = ''
    substituteInPlace setup.py \
      --replace 'include_dirs = ["libndtypes"]' \
-                'include_dirs = ["${libndtypes}/include"]' \
+                'include_dirs = ["${libndtypes.dev}/include"]' \
      --replace 'library_dirs = ["libndtypes"]' \
                'library_dirs = ["${libndtypes}/lib"]' \
      --replace 'runtime_library_dirs = ["$ORIGIN"]' \
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -31,7 +31,7 @@

 buildPythonPackage rec {
  pname = "ocrmypdf";
-  version = "15.3.1";
+  version = "15.4.0";

  disabled = pythonOlder "3.9";

@@ -47,7 +47,7 @@ buildPythonPackage rec {
    postFetch = ''
      rm "$out/.git_archival.txt"
    '';
-    hash = "sha256-Yngx9hH/4yftClNqM/yyrOCPH0+4Bl9GIEGjawLdy0s=";
+    hash = "sha256-cbKqisaRAeT8ljANbYiUDrptAoQmmIkMu1ya8O6nXvQ=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/ocrmypdf/paths.patch
+++ b/pkgs/development/python-modules/ocrmypdf/paths.patch
@@ -1,8 +1,8 @@
 diff --git a/src/ocrmypdf/_exec/ghostscript.py b/src/ocrmypdf/_exec/ghostscript.py
-index e28d23e9..183cd918 100644
+index 92b73a0a..9f04555c 100644
 --- a/src/ocrmypdf/_exec/ghostscript.py
 +++ b/src/ocrmypdf/_exec/ghostscript.py
-@@ -67,7 +67,7 @@ log.addFilter(DuplicateFilter(log))
+@@ -58,7 +58,7 @@ log.addFilter(DuplicateFilter(log))
 
 
 # Ghostscript executable - gswin32c is not supported
@@ -12,7 +12,7 @@ index e28d23e9..183cd918 100644
 
 def version() -> Version:
 diff --git a/src/ocrmypdf/_exec/jbig2enc.py b/src/ocrmypdf/_exec/jbig2enc.py
-index 28d3dd1c..477a7d6c 100644
+index 5a34a95a..5ee1b333 100644
 --- a/src/ocrmypdf/_exec/jbig2enc.py
 +++ b/src/ocrmypdf/_exec/jbig2enc.py
@@ -14,7 +14,7 @@ from ocrmypdf.subprocess import get_version, run
@@ -26,27 +26,27 @@ index 28d3dd1c..477a7d6c 100644
 def available():
@@ -27,7 +27,7 @@ def available():
 
- def convert_group(*, cwd, infiles, out_prefix, threshold):
+ def convert_group(cwd, infiles, out_prefix, threshold):
     args = [
 -        'jbig2',
 +        '@jbig2@',
         '-b',
         out_prefix,
         '--symbol-mode',  # symbol mode (lossy)
-@@ -50,7 +50,7 @@ def convert_group_mp(args):
+@@ -44,7 +44,7 @@ def convert_group(cwd, infiles, out_prefix, threshold):
 
 
- def convert_single(*, cwd, infile, outfile, threshold):
+ def convert_single(cwd, infile, outfile, threshold):
 -    args = ['jbig2', '--pdf', '-t', str(threshold), infile]
 +    args = ['@jbig2@', '--pdf', '-t', str(threshold), infile]
     with open(outfile, 'wb') as fstdout:
         proc = run(args, cwd=cwd, stdout=fstdout, stderr=PIPE)
     proc.check_returncode()
 diff --git a/src/ocrmypdf/_exec/pngquant.py b/src/ocrmypdf/_exec/pngquant.py
-index 8425caec..a027f041 100644
+index 5b8600d0..fcad771b 100644
 --- a/src/ocrmypdf/_exec/pngquant.py
 +++ b/src/ocrmypdf/_exec/pngquant.py
-@@ -18,7 +18,7 @@ from ocrmypdf.subprocess import get_version, run
+@@ -15,7 +15,7 @@ from ocrmypdf.subprocess import get_version, run
 
 
 def version() -> Version:
@@ -55,9 +55,9 @@ index 8425caec..a027f041 100644
 
 
 def available():
-@@ -45,7 +45,7 @@ def input_as_png(input_file: Path):
- def quantize(input_file: Path, output_file: Path, quality_min: int, quality_max: int):
-     with input_as_png(input_file) as input_stream:
+@@ -37,7 +37,7 @@ def quantize(input_file: Path, output_file: Path, quality_min: int, quality_max:
+     """
+     with open(input_file, 'rb') as input_stream:
         args = [
 -            'pngquant',
 +            '@pngquant@',
@@ -65,10 +65,10 @@ index 8425caec..a027f041 100644
             '--skip-if-larger',
             '--quality',
 diff --git a/src/ocrmypdf/_exec/tesseract.py b/src/ocrmypdf/_exec/tesseract.py
-index 4eac3470..61315d14 100644
+index fab92bb1..78b634a7 100644
 --- a/src/ocrmypdf/_exec/tesseract.py
 +++ b/src/ocrmypdf/_exec/tesseract.py
-@@ -114,7 +114,7 @@ class TesseractVersion(Version):
+@@ -95,7 +95,7 @@ class TesseractVersion(Version):
 
 
 def version() -> Version:
@@ -77,7 +77,7 @@ index 4eac3470..61315d14 100644
 
 
 def has_thresholding() -> bool:
-@@ -132,7 +132,7 @@ def get_languages() -> set[str]:
+@@ -113,7 +113,7 @@ def get_languages() -> set[str]:
         msg += output
         return msg
 
@@ -86,7 +86,7 @@ index 4eac3470..61315d14 100644
     try:
         proc = run(
             args_tess,
-@@ -154,7 +154,7 @@ def get_languages() -> set[str]:
+@@ -135,7 +135,7 @@ def get_languages() -> set[str]:
 
 
 def tess_base_args(langs: list[str], engine_mode: int | None) -> list[str]:
@@ -96,10 +96,10 @@ index 4eac3470..61315d14 100644
         args.extend(['-l', '+'.join(langs)])
     if engine_mode is not None:
 diff --git a/src/ocrmypdf/_exec/unpaper.py b/src/ocrmypdf/_exec/unpaper.py
-index 2944b4f4..55a36140 100644
+index 493d9b3a..578c2dda 100644
 --- a/src/ocrmypdf/_exec/unpaper.py
 +++ b/src/ocrmypdf/_exec/unpaper.py
-@@ -69,7 +69,7 @@ class UnpaperImageTooLargeError(Exception):
+@@ -70,7 +70,7 @@ class UnpaperImageTooLargeError(Exception):
 
 
 def version() -> Version:
@@ -107,8 +107,8 @@ index 2944b4f4..55a36140 100644
 +    return Version(get_version('@unpaper@'))
 
 
- SUPPORTED_MODES = {'1', 'L', 'RGB'}
-@@ -123,7 +123,7 @@ def _setup_unpaper_io(input_file: Path) -> Iterator[tuple[Path, Path, Path]]:
+ @contextmanager
+@@ -92,7 +92,7 @@ def _setup_unpaper_io(input_file: Path) -> Iterator[tuple[Path, Path, Path]]:
 def run_unpaper(
     input_file: Path, output_file: Path, *, dpi: DecFloat, mode_args: list[str]
 ) -> None:
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -12,7 +12,6 @@
 , pytestCheckHook
 , libxcrypt
 , makeSetupHook
-, darwin
 }: let
  setupHook = makeSetupHook {
    name = "pybind11-setup-hook";
--- a/pkgs/development/python-modules/wagtail-localize/default.nix
+++ b/pkgs/development/python-modules/wagtail-localize/default.nix
@@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "wagtail-localize";
-  version = "1.6";
+  version = "1.7";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
    repo = pname;
    owner = "wagtail";
    rev = "refs/tags/v${version}";
-    hash = "sha256-OrRR5wLTq3icSBq+9m+MxIvkTvJP7yiGR9yzPt53q+k=";
+    hash = "sha256-Q29Nh/4Z3tYuwoodWKDl5FS+lfl9yDXN7RHn/RReCds=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/xkcdpass/default.nix
+++ b/pkgs/development/python-modules/xkcdpass/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , installShellFiles
 , pytestCheckHook
 , pythonAtLeast
@@ -19,6 +20,14 @@ buildPythonPackage rec {
    hash = "sha256-zEgC3tTQ6kwDovHPHRTvYndWVF79DpnAX454VDZiedE=";
  };

+  patches = [
+    (fetchpatch {
+      name = "fix-non-deterministic-test.patch";
+      url = "https://github.com/redacted/XKCD-password-generator/commit/72d174a82822af1934c94de1b66fd956230142f5.patch";
+      hash = "sha256-GES40GHM0+Zx8bRceCy9/fOHJVlWZ7TCLfzhZczjfTE=";
+    })
+  ];
+
  nativeBuildInputs = [
    installShellFiles
  ];
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "checkov";
-  version = "3.0.38";
+  version = "3.0.40";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = "checkov";
    rev = "refs/tags/${version}";
-    hash = "sha256-2ObPi+wrxvoVWjASmp0KSPMLFuIGdWNWK4jRrZC9ODE=";
+    hash = "sha256-L7D29npEUSy9lO3RF5rJ9apQoZjWhC45D0c+7/5/8r0=";
  };

  patches = [
--- a/pkgs/development/tools/misc/hydra/unstable.nix
+++ b/pkgs/development/tools/misc/hydra/unstable.nix
@@ -123,13 +123,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "hydra";
-  version = "2023-10-20";
+  version = "2023-11-17";

  src = fetchFromGitHub {
    owner = "NixOS";
    repo = "hydra";
-    rev = "33f8a36736ea52d0cc31b947dc7e500134866a92";
-    hash = "sha256-ovt2GZQ4Ia+q6D0XboBNIdXrzy1rWC52UYzxmcMlgYk=";
+    rev = "8f48e4ddecbf403be35f8243b97d73cb39dd61bb";
+    hash = "sha256-5q/7yz6jJedD8YU3SuYyXtN3qEAlOBRKGZxOcYt/0X8=";
  };

  buildInputs = [
--- a/pkgs/development/tools/rust/cargo-shuttle/Cargo.lock
+++ b/pkgs/development/tools/rust/cargo-shuttle/Cargo.lock
--- a/pkgs/development/tools/rust/cargo-shuttle/default.nix
+++ b/pkgs/development/tools/rust/cargo-shuttle/default.nix
@@ -10,13 +10,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-shuttle";
-  version = "0.30.1";
+  version = "0.33.0";

  src = fetchFromGitHub {
    owner = "shuttle-hq";
    repo = "shuttle";
    rev = "v${version}";
-    hash = "sha256-zfRIw1PN3KCMrwnlFM3AFh/Dt8ywu2l3EABz87s8JK0=";
+    hash = "sha256-9MdEB7T+ZJuI5sGbHkhibhqKiGZYmURbaarBsU4gQMk=";
  };

  cargoLock = {
--- a/pkgs/games/shattered-pixel-dungeon/experienced-pixel-dungeon.nix
+++ b/pkgs/games/shattered-pixel-dungeon/experienced-pixel-dungeon.nix
@@ -4,13 +4,13 @@

 callPackage ./generic.nix rec {
  pname = "experienced-pixel-dungeon";
-  version = "2.15.3";
+  version = "2.16";

  src = fetchFromGitHub {
    owner = "TrashboxBobylev";
    repo = "Experienced-Pixel-Dungeon-Redone";
    rev = "ExpPD-${version}";
-    hash = "sha256-qwZk08e+GX8YAVnOZCQ6sIIfV06lWn5bM6/PKD0PAH0=";
+    hash = "sha256-EfSByMceefUcnNmLSTnFNJs/iz1Q45X0BHHfj89d7PI=";
  };

  postPatch = ''
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,38 +1,38 @@
 {
    "testing": {
-        "version": "6.7-rc1",
-        "hash": "sha256:1a071vvmm08sp48d0arqzcmqnz5xdb1vflfhxcqwmpzaabjrgadk"
+        "version": "6.7-rc2",
+        "hash": "sha256:026aqfblls4zl2j8rpnl7rjh9ma82jlwb6x00jryvv44kvwm0fgs"
    },
    "6.5": {
-        "version": "6.5.11",
-        "hash": "sha256:06dmb4hbwrms0lp4axphwgj8wbnzsym70sx55lxr501b53wlmqif"
+        "version": "6.5.12",
+        "hash": "sha256:17rmkzxszp2jg1zx2mmdcy30ffrsd0qms513sxd14klp5k9w2saa"
    },
    "6.1": {
-        "version": "6.1.62",
-        "hash": "sha256:1v453q4sf0j8708ivs1zmdf645hgimqvxfc8xz7czgnnmipn3zdr"
+        "version": "6.1.63",
+        "hash": "sha256:13bmy22mi4ybl21kr3hdy6qiaawiqz2jgl2gl9hwqkyx04xh97f2"
    },
    "5.15": {
-        "version": "5.15.138",
-        "hash": "sha256:1ajaxy97gx0c9cdxiyxa49ykfsykir22i9abfrcizh71ci0yb15g"
+        "version": "5.15.139",
+        "hash": "sha256:0kh4v1224a7p7ib64pnmc1qid3d1lvg3c14l5s4rpr8qzq6w2s4w"
    },
    "5.10": {
-        "version": "5.10.200",
-        "hash": "sha256:012i41bj8rcqn0vhfxrwq3gg82nb6pp2cwq8n146wj47pwgrcbcx"
+        "version": "5.10.201",
+        "hash": "sha256:0642y6qj2d4aww6jcki81ba53pvjyfazjxgzgj8brqx8ixchdz3a"
    },
    "5.4": {
-        "version": "5.4.260",
-        "hash": "sha256:1zpbaipd2j3idj8h9iznlj0ywcq5nkhwj707a1f9ixf82h3q4c4q"
+        "version": "5.4.261",
+        "hash": "sha256:1hsgnv2vcziflhzrrxiny2yp88ybdqda48fm60xhpaphhs0cgfii"
    },
    "4.19": {
-        "version": "4.19.298",
-        "hash": "sha256:0mhgq6hdcls1af7nj999x1mds5b37s7vwin8nsb4q0lnx2y1da4x"
+        "version": "4.19.299",
+        "hash": "sha256:12p431p2jqjfsf0all3fgn47z9fr2cdqyxipfrf4s4mlw4hpbyy6"
    },
    "4.14": {
-        "version": "4.14.329",
-        "hash": "sha256:1dvb4xf0b7snabznl7bg7gga7ffdmywy8vr8q65pzl9yf6fnhdny"
+        "version": "4.14.330",
+        "hash": "sha256:0rwgzyfmrns6zir0dpxkwz2hm3z8c0af3wy11lmxamaa5i2wq3k7"
    },
    "6.6": {
-        "version": "6.6.1",
-        "hash": "sha256:0d42b1hbvv9w3y3q4wydr6il0g5a823n54a06p4p5vcpgkadf7ns"
+        "version": "6.6.2",
+        "hash": "sha256:0zmpk5ls6282j88xpnymkr8z5hxpk2495hjjxm0jmb6ninnzdm3k"
    }
 }
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "klipper";
-  version = "unstable-2023-10-21";
+  version = "unstable-2023-11-16";

  src = fetchFromGitHub {
    owner = "KevinOConnor";
    repo = "klipper";
-    rev = "f7567a0db954eabe4c6b8da3f73ce68693698646";
-    sha256 = "sha256-zOXoHTySTtq2fR7ujU6aiKAgvw11ogM8K+HJF1RoWEQ=";
+    rev = "187cc2f1b89e3870d694f8db6a64b116992106b7";
+    sha256 = "sha256-CmnWgX8MvQs/5jQuAR8+1bKM4VsFXF2pV/jme75WJLY=";
  };

  sourceRoot = "${src.name}/klippy";
--- a/pkgs/servers/mail/mailpit/default.nix
+++ b/pkgs/servers/mail/mailpit/default.nix
@@ -12,14 +12,13 @@
 }:

 let
-
-  version = "1.10.0";
+  version = "1.10.1";

  src = fetchFromGitHub {
    owner = "axllent";
    repo = "mailpit";
    rev = "v${version}";
-    hash = "sha256-MrhTgyY89rU2EQILRSFJk8U7QWaoUf2p83ksFjA7xOM=";
+    hash = "sha256-6nACvAhmFsZGWOqa3pwFqJLnh6Cueq2eYeg4Ns8gCmk=";
  };

  # Separate derivation, because if we mix this in buildGoModule, the separate
@@ -31,7 +30,7 @@ let

    npmDeps = fetchNpmDeps {
      inherit src;
-      hash = "sha256-r4yv2qImIlNMPJagz5i1sxqBDnFAucc2kDUmjGktM6A=";
+      hash = "sha256-DlklRc9Mt4bMAOm/dZnvWPU74oGkc8RLof37Q/977Tk=";
    };

    env = lib.optionalAttrs (stdenv.isDarwin && stdenv.isx86_64) {
@@ -57,7 +56,7 @@ buildGoModule {
  pname = "mailpit";
  inherit src version;

-  vendorHash = "sha256-TXa97oOul9cf07uNGdIoxIM++da5HBFeoh05LaJzQTA=";
+  vendorHash = "sha256-COkJF6JX4NnlPtCeGjaTLYvAKgXEhh+AJC0R9V7J4CM=";

  CGO_ENABLED = 0;

--- a/pkgs/servers/wishlist/default.nix
+++ b/pkgs/servers/wishlist/default.nix
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "wishlist";
-  version = "0.14.0";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = "wishlist";
    rev = "v${version}";
-    sha256 = "sha256-NSL67j/nnE6Ftm39XNav3/TPUSFXHxQE5OxpNEIdtVc=";
+    sha256 = "sha256-B4p2j/U+vTiku7rTj5Ho6BY84kjrNHLDIkI9pZZdmHI=";
  };

-  vendorHash = "sha256-8TQkzsvHjdkYXVmUKaqbs7nURx8kUv2HGs9cBv3hPJc=";
+  vendorHash = "sha256-kfeIEpe6g4T9joAZesgqdE5dd9UD9+a0nALceKq1/zc=";

  doCheck = false;

--- a/pkgs/tools/X11/go-sct/default.nix
+++ b/pkgs/tools/X11/go-sct/default.nix
@@ -8,7 +8,7 @@ buildGoModule rec {
    owner = "d4l3k";
    repo = "go-sct";
    rev = "4ae88a6bf50e0b917541ddbcec1ff10ab77a0b15";
-    sha256 = "sha256-/0ilM1g3CNaseqV9i+cKWyzxvWnj+TFqazt+aYDtNVs=";
+    hash = "sha256-/0ilM1g3CNaseqV9i+cKWyzxvWnj+TFqazt+aYDtNVs=";
  };

  postPatch = ''
@@ -27,6 +27,7 @@ buildGoModule rec {
    homepage = "https://github.com/d4l3k/go-sct";
    license = licenses.mit;
    maintainers = with maintainers; [ ];
+    platforms = platforms.linux;
    mainProgram = "sct";
  };
 }
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "abcMIDI";
-  version = "2023.09.13";
+  version = "2023.11.17";

  src = fetchzip {
    url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    hash = "sha256-rpGINfLuWHu6QA/30aI9B8Hmpfx1o6vstiQn+t0blxA=";
+    hash = "sha256-yWCHK7bi1kCZNWBhaLqilm/ZUv5YXUGi7W3PaRKA7ww=";
  };

  meta = with lib; {
--- a/pkgs/tools/backup/rustic-rs/default.nix
+++ b/pkgs/tools/backup/rustic-rs/default.nix
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {

  meta = {
    homepage = "https://github.com/rustic-rs/rustic";
-    changelog = "https://github.com/rustic-rs/rustic/blob/${src.rev}/changelog/CHANGELOG.md";
+    changelog = "https://github.com/rustic-rs/rustic/blob/${src.rev}/CHANGELOG.md";
    description = "fast, encrypted, deduplicated backups powered by pure Rust";
    mainProgram = "rustic";
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
--- a/pkgs/tools/filesystems/duperemove/default.nix
+++ b/pkgs/tools/filesystems/duperemove/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch2
 , libgcrypt
 , pkg-config
 , glib
@@ -14,31 +13,22 @@

 stdenv.mkDerivation rec {
  pname = "duperemove";
-  version = "0.13";
+  version = "0.14";

  src = fetchFromGitHub {
    owner = "markfasheh";
    repo = "duperemove";
    rev = "v${version}";
-    hash = "sha256-D3+p8XgokKIHEwZnvOkn7cionVH1gsypcURF+PBpugY=";
+    hash = "sha256-dz7ZswOUDmWxzVM3j5GTlC/Tu8Wfgyn1QT5nIqBanrs=";
  };

-  patches = [
-    # Use variable instead of hardcoding pkg-config
-    # https://github.com/markfasheh/duperemove/pull/315
-    (fetchpatch2 {
-      url = "https://github.com/markfasheh/duperemove/commit/0e1c62d79a9a79d7bb3e80f1bd528dbf7cb75e22.patch";
-      hash = "sha256-YMMu6LCkBlipEJALukQMwIMcjQEAG5pjGEGeTW9OEJk=";
-    })
-  ];
-
  postPatch = ''
    substituteInPlace util.c --replace \
      "lscpu" "${lib.getBin util-linux}/bin/lscpu"
  '';

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libgcrypt glib linuxHeaders sqlite ];
+  buildInputs = [ libgcrypt glib linuxHeaders sqlite util-linux ];

  makeFlags = [
    "PREFIX=${placeholder "out"}"
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "ibus-m17n";
-  version = "1.4.23";
+  version = "1.4.24";

  src = fetchFromGitHub {
    owner = "ibus";
    repo = "ibus-m17n";
    rev = version;
-    sha256 = "sha256-7bmWyk7A+dXu1jjD5j9P/w88PVqPnNSxE1Kgj+Xpvyg=";
+    sha256 = "sha256-E5+IA2tH9wes6Soj9DPw1cdfQ9PINUy9zKJHMt9/fjY=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@@ -7,13 +7,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "dua";
-  version = "2.20.1";
+  version = "2.20.2";

  src = fetchFromGitHub {
    owner = "Byron";
    repo = "dua-cli";
    rev = "v${version}";
-    hash = "sha256-yBPzf0ZpL49CupdtxjEo9QiOC5vwTcqdfAC2Q6WcNhE=";
+    hash = "sha256-xF7+yOtVT464C+LWjho+eMgvTqL58YZ8COnDzw5gL3c=";
    # Remove unicode file names which leads to different checksums on HFS+
    # vs. other filesystems because of unicode normalisation.
    postFetch = ''
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
    '';
  };

-  cargoHash = "sha256-jgPOC8xtxYyKhYzsJezefwgopVL+1MED+Wf5h6bCYBg=";
+  cargoHash = "sha256-ttj770aw5NOb2+R2dTxN6Trkz0k5iVWhvHPoG9fzUbw=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.Foundation
--- a/pkgs/tools/misc/pastebinit/default.nix
+++ b/pkgs/tools/misc/pastebinit/default.nix
@@ -1,9 +1,9 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , fetchpatch
 , python3
 }:
-
 stdenv.mkDerivation rec {
  version = "1.5";
  pname = "pastebinit";
@@ -21,11 +21,9 @@ stdenv.mkDerivation rec {

  patches = [
    # Required to allow pastebinit 1.5 to run on Python 3.8
-    (fetchpatch {
-      name = "use-distro-module.patch";
-      url = "https://bazaar.launchpad.net/~arnouten/pastebinit/python38/diff/264?context=3";
-      sha256 = "1gp5inp4xald65xbb7fc5aqq5s2fhw464niwjjja9anqyp3zhawj";
-    })
+    ./use-distro-module.patch
+    # Required to remove the deprecation warning of FancyURLopener
+    ./use-urllib-request.patch
    # Required because pastebin.com now redirects http requests to https
    (fetchpatch {
      name = "pastebin-com-https.patch";
@@ -47,6 +45,6 @@ stdenv.mkDerivation rec {
    description = "A software that lets you send anything you want directly to a pastebin from the command line";
    maintainers = with maintainers; [ raboof ];
    license = licenses.gpl2;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ lib.platforms.darwin;
  };
 }
--- a/pkgs/tools/misc/pastebinit/use-distro-module.patch
+++ b/pkgs/tools/misc/pastebinit/use-distro-module.patch
@@ -0,0 +1,14 @@
+=== modified file 'pastebinit'
+--- pastebinit	2018-07-04 00:46:08 +0000
+++ pastebinit	2020-11-13 14:21:11 +0000
+@@ -38,8 +38,8 @@
+ 
+ # Now try to override it with a distributor pastebin
+ try:
+-    import platform
+-    release = platform.linux_distribution()[0].lower()
+    import distro
+    release = distro.id()
+     if release == 'debian':
+         defaultPB = "paste.debian.net"
+     elif release == 'fedora':
--- a/pkgs/tools/misc/pastebinit/use-urllib-request.patch
+++ b/pkgs/tools/misc/pastebinit/use-urllib-request.patch
@@ -0,0 +1,66 @@
+=== modified file 'pastebinit'
+--- pastebinit	2018-07-04 00:46:08 +0000
+++ pastebinit	2020-11-13 14:21:11 +0000
+@@ -23,15 +23,9 @@
+ from __future__ import print_function
+ 
+ import sys
+-if sys.version[0] == "2":
+-    from ConfigParser import NoOptionError
+-    from ConfigParser import SafeConfigParser as ConfigParser
+-    from urllib import urlencode
+-    from urllib import FancyURLopener
+-else:
+-    from configparser import ConfigParser, NoOptionError
+-    from urllib.parse import urlencode
+-    from urllib.request import FancyURLopener
+from configparser import ConfigParser, NoOptionError
+from urllib.parse import urlencode
+from urllib.request import urlopen, Request
+ 
+ # Set the default pastebin
+ defaultPB = "pastebin.com"
+@@ -72,13 +66,6 @@ try:
+     version = "1.5"
+     configfile = os.path.expanduser("~/.pastebinit.xml")
+ 
+-    # Custom urlopener to handle 401's
+-    class pasteURLopener(FancyURLopener):
+-        version = "Pastebinit v%s" % version
+-
+-        def http_error_401(self, url, fp, errcode, errmsg, headers, data=None):
+-            return None
+-
+     def preloadPastebins():
+         # Check several places for config files:
+         #  - global config in /etc/pastebin.d
+@@ -410,12 +397,18 @@ try:
+         else:
+             post_format = 'standard'
+ 
+-        url_opener = pasteURLopener()
+        request = Request(
+            fetch_url,
+            method="POST",
+            headers={
+                'User-Agent': "Pastebinit v%s" % version
+            }
+        )
+ 
+         if post_format == 'json':
+             if json:
+                 params = json.dumps(params)
+-                url_opener.addheader('Content-type', 'text/json')
+                request.add_header('Content-type', 'text/json')
+             else:
+                 print(_("Could not find any json library."), file=sys.stderr)
+                 sys.exit(1)
+@@ -428,7 +421,7 @@ try:
+             print("POSTing to: %s\nParams: %s" % (
+                 fetch_url, str(params)), file=sys.stderr)
+         try:
+-            page = url_opener.open(fetch_url, params)
+            page = urlopen(request, params.encode("utf-8"))
+         except Exception as e:
+             print(_("Failed to contact the server: %s") % e, file=sys.stderr)
+             sys.exit(1)
--- a/pkgs/tools/misc/rshim-user-space/default.nix
+++ b/pkgs/tools/misc/rshim-user-space/default.nix
@@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "rshim-user-space";
-  version = "2.0.11";
+  version = "2.0.12";

  src = fetchFromGitHub {
    owner = "Mellanox";
    repo = pname;
    rev = "rshim-${version}";
-    hash = "sha256-LbAs4IFfYT6OhrtwRXmuQR9rD7ulmmUB20Au5fO8j9w=";
+    hash = "sha256-jR9Q1i2p4weKuGPTAylNIVglgcZH0UtvXBVVCEquxu8=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/misc/taoup/default.nix
+++ b/pkgs/tools/misc/taoup/default.nix
@@ -4,13 +4,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "taoup";
-  version = "1.1.19";
+  version = "1.21";

  src = fetchFromGitHub {
    owner = "globalcitizen";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-axMpQICvxWBlNJ5D06DYI7b4zFGeadfWFcpTN6lPvpg=";
+    hash = "sha256-UHo3c+DQn77CJONy/QXM55rpIdhVkJbhR82tqmUltPQ=";
  };

  buildInputs = [ rubyEnv bash ncurses ];
--- a/pkgs/tools/misc/vector/default.nix
+++ b/pkgs/tools/misc/vector/default.nix
@@ -46,6 +46,8 @@ rustPlatform.buildRustPackage {
    hash = "sha256-vK+k+VbUVgJ8idlvuod5ExAkkeTYDk/135dyLRct0zs=";
  };

+  patches = [ ./vector-pr19075.patch ];
+
  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
--- a/pkgs/tools/misc/vector/vector-pr19075.patch
+++ b/pkgs/tools/misc/vector/vector-pr19075.patch
@@ -0,0 +1,23 @@
+From 14cd9c12416b5c9ada55ced51e8f92fdce56a4b1 Mon Sep 17 00:00:00 2001
+From: Aaron Andersen <aaron@fosslib.net>
+Date: Tue, 7 Nov 2023 09:05:26 -0500
+Subject: [PATCH] fix(config): rustc warnings
+
+---
+ src/convert_config.rs | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/convert_config.rs b/src/convert_config.rs
+index f0a900cf421a0..d81b998c5ee1f 100644
+--- a/src/convert_config.rs
+++ b/src/convert_config.rs
+@@ -157,8 +157,7 @@ fn walk_dir_and_convert(
+             let new_output_dir = if entry_path.is_dir() {
+                 let last_component = entry_path
+                     .file_name()
+-                    .unwrap_or_else(|| panic!("Failed to get file_name for {entry_path:?}"))
+-                    .clone();
+                    .unwrap_or_else(|| panic!("Failed to get file_name for {entry_path:?}"));
+                 let new_dir = output_dir.join(last_component);
+ 
+                 if !new_dir.exists() {
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21411,7 +21411,7 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) OpenCL;
  };

-  gensio = callPackage ../development/libraries/gensio { };
+  gensio = darwin.apple_sdk_11_0.callPackage ../development/libraries/gensio { };

  geoclue2 = callPackage ../development/libraries/geoclue { };