Merge staging-next into staging

.github/workflows/backport.yml

···
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs
-        uses: korthout/backport-action@v1.1.0
+        uses: korthout/backport-action@v1.2.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           pull_description: |-

maintainers/maintainer-list.nix

···
     email = "[e-mail]";
     github = "MrFreezeex";
     name = "Arthur Outhenin-Chalandre";
-    githubId = 14573967;
+    githubId = 3845213;
   };
   mrityunjaygr8 = {
     email = "[e-mail]";

nixos/modules/virtualisation/podman/default.nix

···
 
       systemd.packages = [ cfg.package ];
 
-      systemd.services.podman.serviceConfig = {
-        ExecStart = [ "" "${cfg.package}/bin/podman $LOGGING system service" ];
-      };
-
       systemd.services.podman-prune = {
         description = "Prune podman resources";
 
···
 
       systemd.sockets.podman.wantedBy = [ "sockets.target" ];
       systemd.sockets.podman.socketConfig.SocketGroup = "podman";
-
-      systemd.user.services.podman.serviceConfig = {
-        ExecStart = [ "" "${cfg.package}/bin/podman $LOGGING system service" ];
-      };
 
       systemd.user.sockets.podman.wantedBy = [ "sockets.target" ];
 

nixos/tests/podman/default.nix

···
     nodes = {
       rootful = { pkgs, ... }: {
         virtualisation.podman.enable = true;
+
+        # hack to ensure that podman built with and without zfs in extraPackages is cached
+        boot.supportedFilesystems = [ "zfs" ];
+        networking.hostId = "00000000";
       };
       rootless = { pkgs, ... }: {
         virtualisation.podman.enable = true;

pkgs/applications/audio/reaper/default.nix

···
 , makeWrapper
 
 , alsa-lib
+, curl
 , gtk3
 , lame
+, libxml2
 , ffmpeg
 , vlc
 , xdg-utils
···
     # Setting the rpath of the plugin shared object files does not
     # seem to have an effect for some plugins.
     # We opt for wrapping the executable with LD_LIBRARY_PATH prefix.
+    # Note that libcurl and libxml2 are needed for ReaPack to run.
     wrapProgram $out/opt/REAPER/reaper \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ lame ffmpeg vlc xdotool ]}"
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ curl lame libxml2 ffmpeg vlc xdotool stdenv.cc.cc.lib ]}"
 
     mkdir $out/bin
     ln -s $out/opt/REAPER/reaper $out/bin/

pkgs/applications/editors/neovim/utils.nix

···
         python3 = withPython3;
         ruby = withRuby;
       };
+      # as expected by packdir
+      packpathDirs.myNeovimPackages = myVimPackage;
       ## Here we calculate all of the arguments to the 1st call of `makeWrapper`
       # We start with the executable itself NOTE we call this variable "initial"
       # because if configure != {} we need to call makeWrapper twice, in order to
···
 
     builtins.removeAttrs args ["plugins"] // {
       wrapperArgs = makeWrapperArgs;
+      inherit packpathDirs;
       inherit neovimRcContent;
       inherit manifestRc;
       inherit python3Env;

pkgs/applications/editors/vscode/extensions/default.nix

···
         mktplcRef = {
           name = "code-spell-checker";
           publisher = "streetsidesoftware";
-          version = "2.17.1";
-          sha256 = "sha256-gQSAq63fqniHmA9T0nKpUAzo+kpSCZzblr6FQ33LIPI=";
+          version = "2.18.0";
+          sha256 = "sha256-HwexlpPW15sXoxPQXDHWcQ8Yvz/5KMtZO4A34rXoXQ8=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";

pkgs/applications/graphics/drawio/headless.nix

···
     # Drawio needs to run in a virtual X session, because Electron
     # refuses to work and dies with an unhelpful error message otherwise:
     # "The futex facility returned an unexpected error code."
-    XDG_CONFIG_HOME="$tmpdir" ${xvfb-run}/bin/xvfb-run ${drawio}/bin/drawio $@
+    XDG_CONFIG_HOME="$tmpdir" ${xvfb-run}/bin/xvfb-run --auto-display ${drawio}/bin/drawio $@
   '';
 
   meta = with lib; {

pkgs/applications/graphics/gnome-decoder/default.nix

···
 
   LIBCLANG_PATH = "${libclang.lib}/lib";
 
+  # FIXME: workaround for Pipewire 0.3.64 deprecated API change, remove when fixed upstream
+  # https://gitlab.freedesktop.org/pipewire/pipewire-rs/-/issues/55
+  preBuild = ''
+    export BINDGEN_EXTRA_CLANG_ARGS="$BINDGEN_EXTRA_CLANG_ARGS -DPW_ENABLE_DEPRECATED"
+  '';
+
   meta = with lib; {
     description = "Scan and Generate QR Codes";
     homepage = "https://gitlab.gnome.org/World/decoder";

pkgs/applications/misc/bottles/default.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "bottles-unwrapped";
-  version = "50.2";
+  version = "51.5";
 
   src = fetchFromGitHub {
     owner = "bottlesdevs";
     repo = "bottles";
     rev = version;
-    sha256 = "sha256-+r/r3vExnvYQIicKAEmwZ+eRSep6kWte5k7gu9jC67w=";
+    sha256 = "sha256-8VF/CD0Wu2eV6wOpj/M6peKDthFWlcg+1NzzTSIH4S8=";
   };
 
   patches = [ ./vulkan_icd.patch ];
···
   ];
 
   propagatedBuildInputs = with python3Packages; [
+    pathvalidate
     pycurl
     pyyaml
     requests
···
     chardet
     certifi
     idna
-    pillow
     orjson
     icoextract
   ] ++ [

pkgs/applications/networking/freefilesync/default.nix

···
 
 gcc12Stdenv.mkDerivation rec {
   pname = "freefilesync";
-  version = "12.0";
+  version = "12.1";
 
   src = fetchFromGitHub {
     owner = "hkneptune";
     repo = "FreeFileSync";
     rev = "v${version}";
-    hash = "sha256-7vdhSEh43mpVbrzJzt005EkwoXfknYnAC+FZIAZF020=";
+    hash = "sha256-KA3Bn8skJ2gMmihmwlUmN6jXZmfoYY/f4vqbKwvxwgw=";
   };
 
   # Patches from ROSA Linux

pkgs/applications/networking/maestral-qt/default.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "maestral-qt";
-  version = "1.6.5";
+  version = "1.7.1";
   disabled = python3.pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "SamSchott";
     repo = "maestral-qt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yKsCM8LZ/GR/bc2WW+Ml1vSroB4iaxh09Az/B+aIVBU=";
+    hash = "sha256-YYlH9s3iNEIacs8izEnIU32j+2lruQ5JJrjvDIzQjRE=";
   };
 
   format = "pyproject";

pkgs/applications/virtualization/podman/default.nix

···
 , go-md2man
 , nixosTests
 , python3
+, makeWrapper
+, symlinkJoin
+, extraPackages ? [ ]
+, runc
+, crun
+, conmon
+, slirp4netns
+, fuse-overlayfs
+, util-linux
+, iptables
+, iproute2
+, catatonit
+, gvproxy
+, aardvark-dns
+, netavark
 , testers
 , podman
 }:
+let
+  # do not add qemu to this wrapper, store paths get written to the podman vm config and break when GCed
 
+  binPath = lib.makeBinPath ([
+  ] ++ lib.optionals stdenv.isLinux [
+    runc
+    crun
+    conmon
+    slirp4netns
+    fuse-overlayfs
+    util-linux
+    iptables
+    iproute2
+  ] ++ extraPackages);
+
+  helpersBin = symlinkJoin {
+    name = "podman-helper-binary-wrapper";
+
+    # this only works for some binaries, others may need to be be added to `binPath` or in the modules
+    paths = [
+      gvproxy
+    ] ++ lib.optionals stdenv.isLinux [
+      aardvark-dns
+      catatonit # added here for the pause image and also set in `containersConf` for `init_path`
+      netavark
+    ];
+  };
+in
 buildGoModule rec {
   pname = "podman";
   version = "4.4.2";
···
 
   doCheck = false;
 
-  outputs = [ "out" "man" ] ++ lib.optionals stdenv.isLinux [ "rootlessport" ];
+  outputs = [ "out" "man" ];
 
-  nativeBuildInputs = [ pkg-config go-md2man installShellFiles python3 ];
+  nativeBuildInputs = [ pkg-config go-md2man installShellFiles makeWrapper python3 ];
 
   buildInputs = lib.optionals stdenv.isLinux [
     btrfs-progs
···
     systemd
   ];
 
+  HELPER_BINARIES_DIR = "${PREFIX}/libexec/podman"; # used in buildPhase & installPhase
+  PREFIX = "${placeholder "out"}";
+
   buildPhase = ''
     runHook preBuild
     patchShebangs .
     ${if stdenv.isDarwin then ''
       make podman-remote # podman-mac-helper uses FHS paths
     '' else ''
-      make bin/podman bin/rootlessport
+      make bin/podman bin/rootlessport bin/quadlet
     ''}
     make docs
     runHook postBuild
···
 
   installPhase = ''
     runHook preInstall
-    mkdir -p {$out/{bin,etc,lib,share},$man} # ensure paths exist for the wrapper
     ${if stdenv.isDarwin then ''
-      mv bin/{darwin/podman,podman}
+      install bin/darwin/podman -Dt $out/bin
     '' else ''
-      install -Dm644 contrib/tmpfile/podman.conf -t $out/lib/tmpfiles.d
-      for s in contrib/systemd/**/*.in; do
-        substituteInPlace "$s" --replace "@@PODMAN@@" "podman" # don't use unwrapped binary
-      done
-      PREFIX=$out make install.systemd
-      install -Dm555 bin/rootlessport -t $rootlessport/bin
+      make install.bin install.systemd
     ''}
-    install -Dm555 bin/podman -t $out/bin
-    PREFIX=$out make install.completions
-    MANDIR=$man/share/man make install.man
+    make install.completions install.man
+    mkdir -p ${HELPER_BINARIES_DIR}
+    ln -s ${helpersBin}/bin/* ${HELPER_BINARIES_DIR}
+    wrapProgram $out/bin/podman \
+      --prefix PATH : ${lib.escapeShellArg binPath}
     runHook postInstall
   '';
 
   postFixup = lib.optionalString stdenv.isLinux ''
-    RPATH=$(patchelf --print-rpath $out/bin/podman)
-    patchelf --set-rpath "${lib.makeLibraryPath [ systemd ]}":$RPATH $out/bin/podman
+    RPATH=$(patchelf --print-rpath $out/bin/.podman-wrapped)
+    patchelf --set-rpath "${lib.makeLibraryPath [ systemd ]}":$RPATH $out/bin/.podman-wrapped
   '';
 
   passthru.tests = {

pkgs/applications/virtualization/podman/wrapper.nix

···
-{ podman-unwrapped
-, runCommand
-, makeWrapper
-, symlinkJoin
-, lib
-, stdenv
-, extraPackages ? []
-, runc # Default container runtime
-, crun # Container runtime (default with cgroups v2 for podman/buildah)
-, conmon # Container runtime monitor
-, slirp4netns # User-mode networking for unprivileged namespaces
-, fuse-overlayfs # CoW for images, much faster than default vfs
-, util-linux # nsenter
-, iptables
-, iproute2
-, catatonit
-, gvproxy
-, aardvark-dns
-, netavark
-}:
-
-# do not add qemu to this wrapper, store paths get written to the podman vm config and break when GCed
-
-let
-  binPath = lib.makeBinPath ([
-  ] ++ lib.optionals stdenv.isLinux [
-    runc
-    crun
-    conmon
-    slirp4netns
-    fuse-overlayfs
-    util-linux
-    iptables
-    iproute2
-  ] ++ extraPackages);
-
-  helpersBin = symlinkJoin {
-    name = "${podman-unwrapped.pname}-helper-binary-wrapper-${podman-unwrapped.version}";
-
-    # this only works for some binaries, others may need to be be added to `binPath` or in the modules
-    paths = [
-      gvproxy
-    ] ++ lib.optionals stdenv.isLinux [
-      aardvark-dns
-      catatonit # added here for the pause image and also set in `containersConf` for `init_path`
-      netavark
-      podman-unwrapped.rootlessport
-    ];
-  };
-
-in runCommand podman-unwrapped.name {
-  name = "${podman-unwrapped.pname}-wrapper-${podman-unwrapped.version}";
-  inherit (podman-unwrapped) pname version passthru;
-
-  preferLocalBuild = true;
-
-  meta = builtins.removeAttrs podman-unwrapped.meta [ "outputsToInstall" ];
-
-  outputs = [
-    "out"
-    "man"
-  ];
-
-  nativeBuildInputs = [
-    makeWrapper
-  ];
-
-} ''
-  ln -s ${podman-unwrapped.man} $man
-
-  mkdir -p $out/bin
-  ln -s ${podman-unwrapped}/etc $out/etc
-  ln -s ${podman-unwrapped}/lib $out/lib
-  ln -s ${podman-unwrapped}/share $out/share
-  makeWrapper ${podman-unwrapped}/bin/podman $out/bin/podman \
-    --set CONTAINERS_HELPER_BINARY_DIR ${helpersBin}/bin \
-    --prefix PATH : ${lib.escapeShellArg binPath}
-''

pkgs/build-support/coq/default.nix

···
   inherit (fetched) version src;
 
   nativeBuildInputs = args.overrideNativeBuildInputs
-    or ([ which coq.ocamlPackages.findlib ]
+    or ([ which ]
         ++ optional useDune coq.ocamlPackages.dune_3
-        ++ optional (useDune || mlPlugin) coq.ocamlPackages.ocaml
+        ++ optionals (useDune || mlPlugin) [ coq.ocamlPackages.ocaml coq.ocamlPackages.findlib ]
         ++ (args.nativeBuildInputs or []) ++ extraNativeBuildInputs);
   buildInputs = args.overrideBuildInputs
     or ([ coq ] ++ (args.buildInputs or []) ++ extraBuildInputs);

pkgs/desktops/pantheon/granite/7/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "granite";
-  version = "7.1.0";
+  version = "7.2.0";
 
   outputs = [ "out" "dev" ];
 
···
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-tdZSiIK+BW8uhbRxLUcrGQt71jRfVLOTgFNOqeLK6ig=";
+    sha256 = "sha256-LU2eIeaNqO4/6dPUuzOQ/w4tx0dEm26JwZ87yQ16c4o=";
   };
 
   nativeBuildInputs = [

pkgs/development/coq-modules/coq-elpi/default.nix

···
   buildFlags = [ "OCAMLWARN=" ];
 
   mlPlugin = true;
-  propagatedBuildInputs = [ elpi ];
+  propagatedBuildInputs = [ coq.ocamlPackages.findlib elpi ];
 
   meta = {
     description = "Coq plugin embedding ELPI.";

pkgs/development/coq-modules/coqhammer/default.nix

···
   release."1.3-coq8.10".version  = "1.3";
   release."1.1.1-coq8.9".version = "1.1.1";
   release."1.1-coq8.9".version   = "1.1";
-  releaseRev = v: "v${v}";
+  releaseRev = v: "refs/tags/v${v}";
 
   postPatch = ''
     substituteInPlace Makefile.coq.local --replace \

pkgs/development/libraries/science/chemistry/openmm/default.nix

···
     "-DCMAKE_LIBRARY_PATH=${cudaPackages.cudatoolkit}/lib64/stubs"
   ];
 
+  # https://github.com/NixOS/nixpkgs/issues/201254
+  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
+
   postInstall = lib.strings.optionalString enablePython ''
       export OPENMM_LIB_PATH=$out/lib
       export OPENMM_INCLUDE_PATH=$out/include

pkgs/development/python-modules/adblock/default.nix

···
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , buildPythonPackage
 , rustPlatform
 , pkg-config
···
     rev = "refs/tags/${version}";
     hash = "sha256-5g5xdUzH/RTVwu4Vfb5Cb1t0ruG0EXgiXjrogD/+JCU=";
   };
+
+  patches = [
+    # https://github.com/ArniDagur/python-adblock/pull/91
+    (fetchpatch {
+      name = "pep-621-compat.patch";
+      url = "https://github.com/ArniDagur/python-adblock/commit/2a8716e0723b60390f0aefd0e05f40ba598ac73f.patch";
+      hash = "sha256-n9+LDs0no66OdNZxw3aU57ngWrAbmm6hx4qIuxXoatM=";
+    })
+  ];
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;

pkgs/development/python-modules/maestral/default.nix

···
 
 buildPythonPackage rec {
   pname = "maestral";
-  version = "1.6.5";
+  version = "1.7.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
     owner = "SamSchott";
     repo = "maestral";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YCPMPkvMaZ0uzTiiCbXFDpgDS0yGlfF0wKK2HhYmH+Y=";
+    hash = "sha256-WYLYDDXxO5ot30oSBkxgJszn8nyAQh5XtCyywBz56J4=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pyvista/default.nix

···
 
 buildPythonPackage rec {
   pname = "pyvista";
-  version = "0.38.2";
+  version = "0.38.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-wyzS/51IXsSuyLIWFVUK4sgtHrppL5Hp52H6aWTcN+c=";
+    hash = "sha256-DkJZfzBS/amQqZDcsmQo+WlSxOYtIwizXJOjF/N2lSE=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/roonapi/default.nix

···
 
 buildPythonPackage rec {
   pname = "roonapi";
-  version = "0.1.3";
+  version = "0.1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
     owner = "pavoni";
     repo = "pyroon";
     rev = version;
-    hash = "sha256-QOFBNTz8g3f6C8Vjkblrd3QFCRrA1WqOCv6xS4GbFC4=";
+    hash = "sha256-TXIKa5DB5+511fQuHAQwPWqw7vQPP+s1X3U7BgEfzzE=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/tld/default.nix

···
 
 buildPythonPackage rec {
   pname = "tld";
-  version = "0.12.7";
+  version = "0.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tvdynhnODrx3ugpltw1iE665UsAf9gXhKZquX7diHF4=";
+    hash = "sha256-k93l4cBL3xhEl26uRAcGN50h9KsjW3PAXXSD4HT7Vik=";
   };
+
+  postPatch = ''
+    sed -i "/--cov/d" pytest.ini
+  '';
 
   nativeCheckInputs = [
     pytestCheckHook

pkgs/development/tools/build-managers/rocm-cmake/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-cmake";
-  version = "5.4.2";
+  version = "5.4.3";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";

pkgs/development/tools/jira_cli/default.nix

···
       homepage = "https://github.com/alisaifee/jira-cli";
       maintainers = with maintainers; [ nyarly ];
       license = licenses.mit;
+      # Project is unmaintained
+      # https://github.com/alisaifee/jira-cli#this-project-needs-a-new-owner
+      # Requires suds-jurko which was removed (due to the usage of use_2to3)
+      # Checked on 2023-02-27
+      broken = true;
     };
   }

pkgs/os-specific/linux/kernel/common-config.nix

···
       XEN_SAVE_RESTORE            = option yes;
       XEN_SCRUB_PAGES             = whenOlder "4.19" yes;
       XEN_SELFBALLOONING          = whenOlder "5.3" yes;
+
+      # Enable device detection on virtio-mmio hypervisors
+      VIRTIO_MMIO_CMDLINE_DEVICES = yes;
     };
 
     media = {

pkgs/os-specific/linux/kernel/hardened/patches.json

···
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.305-hardened1.patch",
-            "sha256": "05zcfy7dh8vlbvf9iw99m2xi7d9df254lg3a77hhb8cb264yn6z0",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.305-hardened1/linux-hardened-4.14.305-hardened1.patch"
+            "name": "linux-hardened-4.14.307-hardened1.patch",
+            "sha256": "0fqif3brjhjfwdxjwm12allj5pdgdlfm83h6izlgxkn5iy05cviq",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.307-hardened1/linux-hardened-4.14.307-hardened1.patch"
         },
-        "sha256": "16lmhxqpbhyqmgmlyicjadzz3axhl5smfrr230x45ahkdghwsnx3",
-        "version": "4.14.305"
+        "sha256": "00dp0vj9572ig4zsnmhl2a2v5vx40hnjibyifw24x1q6qdaia72f",
+        "version": "4.14.307"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.272-hardened1.patch",
-            "sha256": "1qimbp19mimy6dqv4rc8hb6966sq7l1y72hp0s0vy682qx556zwg",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.272-hardened1/linux-hardened-4.19.272-hardened1.patch"
+            "name": "linux-hardened-4.19.274-hardened1.patch",
+            "sha256": "0hc2ci4jy2jhjmmqmmv6i2g6lj997d8hwgrh68qrraifzd3rjm23",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.274-hardened1/linux-hardened-4.19.274-hardened1.patch"
         },
-        "sha256": "1y8kyc48v8bsl53zc6dsy5xhazv0vyna98fycj181aypicvbk7s8",
-        "version": "4.19.272"
+        "sha256": "1a2w6knszfqg7ilnvxrs0kbgcviq90iqw9wp2d6y3qy9jfhnb8k4",
+        "version": "4.19.274"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.168-hardened1.patch",
-            "sha256": "1qhpsvra0b6vwshkxbqjzdz27szj79rwgpi1fv3g4401pa15dk69",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.168-hardened1/linux-hardened-5.10.168-hardened1.patch"
+            "name": "linux-hardened-5.10.170-hardened1.patch",
+            "sha256": "0fr0rzxrpmcddzamdnc15ywpd396dl8j7ycy19a789vhfz3132bz",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.170-hardened1/linux-hardened-5.10.170-hardened1.patch"
         },
-        "sha256": "171mmgkjdsn6gx6z8kr5d80aygn4jjf8jc9zfh7m2c4dpab2azdn",
-        "version": "5.10.168"
+        "sha256": "0pw2jnsnq2yxxvl4dkx6f7a8gczj8l484qpd4ibw737vprv1idd2",
+        "version": "5.10.170"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.94-hardened1.patch",
-            "sha256": "11w4cs6j9g1p7ycf8zbyf1lx6pq3k8za6llsc80s0l4i1kvk0k3f",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.94-hardened1/linux-hardened-5.15.94-hardened1.patch"
+            "name": "linux-hardened-5.15.96-hardened1.patch",
+            "sha256": "032311r4phsp8cb4vzgdh3gsm4l5494138x1jfwfxhzkgmp4g4yh",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.96-hardened1/linux-hardened-5.15.96-hardened1.patch"
         },
-        "sha256": "0wjsqvhp0jnisypb8yw6dncyp5k7zxbhjivh7jqivpsdwvdp14ns",
-        "version": "5.15.94"
+        "sha256": "167g34xjbqxr5klqp127j2j15pms4jmgs0y7gr8zipiz2i69g39l",
+        "version": "5.15.96"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.231-hardened1.patch",
-            "sha256": "1fximwmcp0205i3jxmglf0jawgy1knrc9cnjpz05am8yi7ndikmd",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.231-hardened1/linux-hardened-5.4.231-hardened1.patch"
+            "name": "linux-hardened-5.4.233-hardened1.patch",
+            "sha256": "11df6i0v7xsp363hdqfdixadn5db41ig51pd5fhknpdh1yrpx9by",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.233-hardened1/linux-hardened-5.4.233-hardened1.patch"
         },
-        "sha256": "1a1nbyvkf6iaj5lz6ahg7kk9pyrx7j77jmaj92fyihdl3mzyml4d",
-        "version": "5.4.231"
+        "sha256": "09vnp4qcv7kwahbbvjznnv7pxq1cvbn11n0rn5rzx97jnia5f7js",
+        "version": "5.4.233"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.12-hardened1.patch",
-            "sha256": "0nz2gz7nx0z9am8fldza28vj0fgp7hdx3skpm1xvdhgy8d35p33l",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.12-hardened1/linux-hardened-6.1.12-hardened1.patch"
+            "name": "linux-hardened-6.1.14-hardened1.patch",
+            "sha256": "1r76nhg11sv654hg90gf6s9bmwdbmc88jh7wbpb9cyj63dw8dliv",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.14-hardened1/linux-hardened-6.1.14-hardened1.patch"
         },
-        "sha256": "1spdl3i69qwn7cywzs6kql8nlisdnmnwk9za7v4xq1092xsscynl",
-        "version": "6.1.12"
+        "sha256": "03c1pszgm0qwwz7l5fnmbr6ank632bsl81pdx48svizy3q0pcw52",
+        "version": "6.1.14"
     }
 }

pkgs/os-specific/linux/kernel/linux-4.14.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.306";
+  version = "4.14.307";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "17phif2kazp5wykjv7vphjzv8bcanvpv5qq4v3df5nq9gbpypfsq";
+    sha256 = "00dp0vj9572ig4zsnmhl2a2v5vx40hnjibyifw24x1q6qdaia72f";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-4.19.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.273";
+  version = "4.19.274";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0wr7sprmqkdr6d44cj3rvaynyvrmyn1rax9wjqa7sk36yhvz47ij";
+    sha256 = "1a2w6knszfqg7ilnvxrs0kbgcviq90iqw9wp2d6y3qy9jfhnb8k4";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-5.10.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.169";
+  version = "5.10.170";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1kxgxdbgymdhf7w416qxv948py0mq8qlhz5ag962322ynmp4yxfr";
+    sha256 = "0pw2jnsnq2yxxvl4dkx6f7a8gczj8l484qpd4ibw737vprv1idd2";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-5.15.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.95";
+  version = "5.15.96";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "06s4aqkk26fph8hm15m7cssjrwa5y7cqy9y2znfnf0w8sbqd2wga";
+    sha256 = "167g34xjbqxr5klqp127j2j15pms4jmgs0y7gr8zipiz2i69g39l";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-5.4.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.232";
+  version = "5.4.233";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "14qf8ddyhcs1ga1zqj4q2si6nc48sfc67nn9nigsnbcbg5g6lrdh";
+    sha256 = "09vnp4qcv7kwahbbvjznnv7pxq1cvbn11n0rn5rzx97jnia5f7js";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-6.1.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.13";
+  version = "6.1.14";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0rvss7g77kp1hldhwrpfc7ck50rd0cjfcxj1bshps1xhyhci7128";
+    sha256 = "03c1pszgm0qwwz7l5fnmbr6ank632bsl81pdx48svizy3q0pcw52";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-6.2.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "6.2";
+  version = "6.2.1";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "sha256-dIYvqKtA7a6FuzOFwLcf4QMoi85RhSbWMZeACzy97LE=";
+    sha256 = "0d154mps5967mgl8sxls6x5nw2ya1pmvxyahiwacx90fr7hhgk1g";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-rt-5.15.nix

···
 , ... } @ args:
 
 let
-  version = "5.15.94-rt59"; # updated by ./update-rt.sh
+  version = "5.15.95-rt60"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0wjsqvhp0jnisypb8yw6dncyp5k7zxbhjivh7jqivpsdwvdp14ns";
+    sha256 = "06s4aqkk26fph8hm15m7cssjrwa5y7cqy9y2znfnf0w8sbqd2wga";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "12lv1cywnlylb908bwy76ala94j1j5klrgv71l9ihf4vvdpj2nxi";
+      sha256 = "0plz9zcibhpqsrapykvvqqhz0i2sy7wrjd3jsypvia6j3vghrz4s";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 

pkgs/servers/invidious/versions.json

···
     "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
   },
   "invidious": {
-    "rev": "7993784701686c057b85c57704537135e6326de9",
-    "sha256": "sha256-LKoUm38gUXucOdXmiJGaKt7ckeb7JBd5I/AxDRDnq30=",
-    "version": "unstable-2023-02-13"
+    "rev": "0995e0447c2b54d80b55231830b847d41c19b404",
+    "sha256": "sha256-hXF836jxMriMJ/qcBJIF5cRvQG719PStKqTZQcIRqlw=",
+    "version": "unstable-2023-02-22"
   },
   "lsquic": {
     "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",
     "version": "2.18.1"
   },
   "videojs": {
-    "sha256": "0m09pc9acpzhfwwvc9dayl60nn28skmmglgvmlp48dlkqgfbgc27"
+    "sha256": "0zj8fgxdg6jsllaxn795xipa6yxh4yf08hb8x0idyg74q37gfh4c"
   }
 }

pkgs/tools/admin/google-cloud-sdk/components.nix

···
 , google-cloud-sdk
 , system
 , snapshotPath
+, autoPatchelfHook
+, python3
 , ...
 }:
 
···
         # Write the snapshot file to the `.install` folder
         cp $snapshotPath $out/google-cloud-sdk/.install/${pname}.snapshot.json
       '';
+      nativeBuildInputs = [
+        autoPatchelfHook
+        python3
+        stdenv.cc.cc
+      ];
       passthru = {
         dependencies = filterForSystem dependencies;
       };

pkgs/tools/admin/lexicon/default.nix

···
 
 buildPythonApplication rec {
   pname = "lexicon";
-  version = "3.9.4";
+  version = "3.11.7";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "AnalogJ";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-TySgIxBEl2RolndAkEN4vCIDKaI48vrh2ocd+CTn7Ow=";
   };
 
···
 
   propagatedBuildInputs = [
     beautifulsoup4
-    boto3
     cryptography
-    dnspython
-    future
-    localzone
-    oci
-    pynamecheap
+    importlib-metadata
     pyyaml
     requests
-    softlayer
     tldextract
-    transip
-    xmltodict
-    zeep
   ];
 
+  passthru.optional-dependencies = {
+    route53 = [
+      boto3
+    ];
+    localzone = [
+      localzone
+    ];
+    softlayer = [
+      softlayer
+    ];
+    gransy = [
+      zeep
+    ];
+    ddns = [
+      dnspython
+    ];
+    oci = [
+      oci
+    ];
+    full = [
+      boto3
+      dnspython
+      localzone
+      oci
+      softlayer
+      zeep
+    ];
+  };
+
   nativeCheckInputs = [
     mock
     pytestCheckHook
     pytest-xdist
     vcrpy
-  ];
+  ] ++ passthru.optional-dependencies.full;
 
   disabledTestPaths = [
     # Tests require network access
     "lexicon/tests/providers/test_auto.py"
+    # Tests require an additional setup
+    "lexicon/tests/providers/test_localzone.py"
   ];
 
   pythonImportsCheck = [
···
   meta = with lib; {
     description = "Manipulate DNS records of various DNS providers in a standardized way";
     homepage = "https://github.com/AnalogJ/lexicon";
+    changelog = "https://github.com/AnalogJ/lexicon/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ flyfloh ];
   };

pkgs/tools/networking/rathole/default.nix

···
 
   __darwinAllowLocalNetworking = true;
 
+  doCheck = false; # https://github.com/rapiz1/rathole/issues/222
+
   meta = with lib; {
     description = "Reverse proxy for NAT traversal";
     homepage = "https://github.com/rapiz1/rathole";

pkgs/tools/wayland/oguri/default.nix

···
     description = "A very nice animated wallpaper daemon for Wayland compositors";
     license = licenses.mit;
     maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.unix;
+    inherit (wayland.meta) platforms;
+    broken = stdenv.isDarwin; # this should be enfoced by wayland platforms in the future
   };
 }

pkgs/top-level/all-packages.nix

···
     stdenv =
       if stdenv.isDarwin && stdenv.isAarch64 then llvmPackages_14.stdenv
       # https://github.com/NixOS/nixpkgs/issues/201254
-      else if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc11Stdenv
+      else if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc12Stdenv
       else stdenv;
   };
 
···
     # See comments on https://github.com/NixOS/nixpkgs/pull/198836
     # Remove below when stdenv for linux-aarch64 become recent enough.
     # https://github.com/NixOS/nixpkgs/issues/201254
-    stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc11Stdenv else stdenv;
+    stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc12Stdenv else stdenv;
   };
   kakoune = wrapKakoune kakoune-unwrapped {
     plugins = [ ];  # override with the list of desired plugins
···
 
   pocketbase = callPackage ../servers/pocketbase { };
 
-  podman = callPackage ../applications/virtualization/podman/wrapper.nix { };
-  podman-unwrapped = callPackage ../applications/virtualization/podman { };
+  podman = callPackage ../applications/virtualization/podman { };
 
   podman-compose = python3Packages.callPackage ../applications/virtualization/podman-compose {};
 
···
 
   qovery-cli = callPackage ../tools/admin/qovery-cli { };
 
-  qownnotes = libsForQt5.callPackage ../applications/office/qownnotes { };
+  qownnotes = darwin.apple_sdk_11_0.callPackage ../applications/office/qownnotes {
+    inherit (libsForQt5) qmake qtbase qtdeclarative qtsvg qttools qtwayland qtwebsockets qtx11extras qtxmlpatterns wrapQtAppsHook;
+  };
 
   qpdf = callPackage ../development/libraries/qpdf { };
 
···
   rpm-ostree = callPackage ../tools/misc/rpm-ostree {
     gperf = gperf_3_0;
     # https://github.com/NixOS/nixpkgs/issues/201254
-    stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc11Stdenv else stdenv;
+    stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc12Stdenv else stdenv;
   };
 
   rpm2targz = callPackage ../tools/archivers/rpm2targz { };
···
     else callPackage ../os-specific/linux/bionic-prebuilt { };
 
 
-  bobcat = callPackage ../development/libraries/bobcat
-    (lib.optionalAttrs (with stdenv.hostPlatform; isAarch64 && isLinux) {
-      # C++20 is required, aarch64-linux has gcc 9 by default
-      stdenv = gcc10Stdenv;
-    });
+  bobcat = callPackage ../development/libraries/bobcat {
+    # C++20 is required, aarch64-linux has gcc 9 by default
+    # https://github.com/NixOS/nixpkgs/issues/201254
+    stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc12Stdenv else stdenv;
+  };
 
   boehmgc = callPackage ../development/libraries/boehm-gc { };
 
···
 
   mtxclient = callPackage ../development/libraries/mtxclient {
     # https://github.com/NixOS/nixpkgs/issues/201254
-    stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc11Stdenv else stdenv;
+    stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc12Stdenv else stdenv;
   };
 
   mu = callPackage ../tools/networking/mu {
···
   open-policy-agent = callPackage ../development/tools/open-policy-agent { };
 
   openmm = callPackage ../development/libraries/science/chemistry/openmm {
-    stdenv = if stdenv.targetPlatform.isAarch64 then gcc9Stdenv else gcc11Stdenv;
-    gfortran = if stdenv.targetPlatform.isAarch64 then gfortran9 else gfortran11;
+    stdenv = gcc11Stdenv;
+    gfortran = gfortran11;
   };
 
   openshift = callPackage ../applications/networking/cluster/openshift { };
···
 
   nheko = libsForQt5.callPackage ../applications/networking/instant-messengers/nheko {
     # https://github.com/NixOS/nixpkgs/issues/201254
-    stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc11Stdenv else stdenv;
+    stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc12Stdenv else stdenv;
   };
 
   nomacs = libsForQt5.callPackage ../applications/graphics/nomacs { };
···
 
   quantomatic = callPackage ../applications/science/physics/quantomatic { };
 
-  quassel = libsForQt5.callPackage ../applications/networking/irc/quassel { };
+  quassel = darwin.apple_sdk_11_0.callPackage ../applications/networking/irc/quassel {
+    inherit (libsForQt5) kconfigwidgets kcoreaddons knotifications knotifyconfig ktextwidgets kwidgetsaddons kxmlgui phonon qtbase qtscript mkDerivation qca-qt5;
+  };
 
   quasselClient = quassel.override {
     monolithic = false;
···
     python = python3;
     inherit (darwin.apple_sdk.frameworks) Cocoa CoreSymbolication OpenGL;
     # https://github.com/NixOS/nixpkgs/issues/201254
-    stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc11Stdenv else stdenv;
+    stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc12Stdenv else stdenv;
   };
 
   root5 = lowPrio (callPackage ../applications/science/misc/root/5.nix {

pkgs/top-level/qt5-packages.nix

···
 
   pulseaudio-qt = callPackage ../development/libraries/pulseaudio-qt { };
 
-  qca-qt5 = callPackage ../development/libraries/qca-qt5 { };
+  qca-qt5 = pkgs.darwin.apple_sdk_11_0.callPackage ../development/libraries/qca-qt5 {
+    inherit (libsForQt5) qtbase;
+  };
 
   qcoro = callPackage ../development/libraries/qcoro { };