Merge staging-next into staging

.gitignore

···
 ,*
 .*.swp
 .*.swo
+.\#*
+\#*\#
 .idea/
 .vscode/
 outputs/

nixos/doc/manual/from_md/release-notes/rl-2305.section.xml

···
       </listitem>
       <listitem>
         <para>
+          <link xlink:href="https://github.com/ellie/atuin">atuin</link>,
+          a sync server for shell history. Available as
+          <link linkend="opt-services.atuin.enable">services.atuin</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           <link xlink:href="https://v2raya.org">v2rayA</link>, a Linux
           web GUI client of Project V which supports V2Ray, Xray, SS,
           SSR, Trojan and Pingtunnel. Available as
···
           and
           <link xlink:href="https://github.com/kolloch/crate2nix">crate2nix</link>
           instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>borgbackup</literal> module now has an option for
+          inhibiting system sleep while backups are running, defaulting
+          to off (not inhibiting sleep), available as
+          <link linkend="opt-services.borgbackup.jobs._name_.inhibitsSleep"><literal>services.borgbackup.jobs.&lt;name&gt;.inhibitsSleep</literal></link>.
         </para>
       </listitem>
       <listitem>
···
           <link xlink:href="https://docs.getutm.app/">UTM</link>
           virtualisation
           <link xlink:href="https://search.nixos.org/packages?channel=unstable&amp;show=utm&amp;from=0&amp;size=1&amp;sort=relevance&amp;type=packages&amp;query=utm">package</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The new option <literal>users.motdFile</literal> allows
+          configuring a Message Of The Day that can be updated
+          dynamically.
         </para>
       </listitem>
       <listitem>

nixos/doc/manual/release-notes/rl-2305.section.md

···
 
 - [fzf](https://github.com/junegunn/fzf), a command line fuzzyfinder. Available as [programs.fzf](#opt-programs.fzf.fuzzyCompletion).
 
+- [atuin](https://github.com/ellie/atuin), a sync server for shell history. Available as [services.atuin](#opt-services.atuin.enable).
+
 - [v2rayA](https://v2raya.org), a Linux web GUI client of Project V which supports V2Ray, Xray, SS, SSR, Trojan and Pingtunnel. Available as [services.v2raya](options.html#opt-services.v2raya.enable).
 
 ## Backward Incompatibilities {#sec-release-23.05-incompatibilities}
···
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 - `carnix` and `cratesIO` has been removed due to being unmaintained, use alternatives such as [naersk](https://github.com/nix-community/naersk) and [crate2nix](https://github.com/kolloch/crate2nix) instead.
+
+- `borgbackup` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.borgbackup.jobs.<name>.inhibitsSleep`](#opt-services.borgbackup.jobs._name_.inhibitsSleep). 
 
 - The EC2 image module no longer fetches instance metadata in stage-1. This results in a significantly smaller initramfs, since network drivers no longer need to be included, and faster boots, since metadata fetching can happen in parallel with startup of other services.
   This breaks services which rely on metadata being present by the time stage-2 is entered. Anything which reads EC2 metadata from `/etc/ec2-metadata` should now have an `after` dependency on `fetch-ec2-metadata.service`
···
 - `mastodon` now supports connection to a remote `PostgreSQL` database.
 
 - A new `virtualisation.rosetta` module was added to allow running `x86_64` binaries through [Rosetta](https://developer.apple.com/documentation/apple-silicon/about-the-rosetta-translation-environment) inside virtualised NixOS guests on Apple silicon. This feature works by default with the [UTM](https://docs.getutm.app/) virtualisation [package](https://search.nixos.org/packages?channel=unstable&show=utm&from=0&size=1&sort=relevance&type=packages&query=utm).
+
+- The new option `users.motdFile` allows configuring a Message Of The Day that can be updated dynamically.
 
 - Resilio sync secret keys can now be provided using a secrets file at runtime, preventing these secrets from ending up in the Nix store.
 

nixos/modules/module-list.nix

···
   ./services/misc/airsonic.nix
   ./services/misc/ankisyncd.nix
   ./services/misc/apache-kafka.nix
+  ./services/misc/atuin.nix
   ./services/misc/autofs.nix
   ./services/misc/autorandr.nix
   ./services/misc/bazarr.nix

nixos/modules/programs/streamdeck-ui.nix

···
 
 let
   cfg = config.programs.streamdeck-ui;
-in {
+in
+{
   options.programs.streamdeck-ui = {
     enable = mkEnableOption (lib.mdDoc "streamdeck-ui");
 
···
       type = types.bool;
       description = lib.mdDoc "Whether streamdeck-ui should be started automatically.";
     };
+
+    package = mkPackageOption pkgs "streamdeck-ui" {
+      default = [ "streamdeck-ui" ];
+    };
+
   };
 
   config = mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
-      streamdeck-ui
-      (mkIf cfg.autoStart (makeAutostartItem { name = "streamdeck-ui"; package = streamdeck-ui; }))
+      cfg.package
+      (mkIf cfg.autoStart (makeAutostartItem { name = "streamdeck-ui"; package = cfg.package; }))
     ];
 
-    services.udev.packages = with pkgs; [ streamdeck-ui ];
+    services.udev.packages = [ cfg.package ];
   };
 
   meta.maintainers = with maintainers; [ majiir ];

nixos/modules/security/pam.nix

···
           optionalString (cfg.limits != []) ''
             session required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits}
           '' +
-          optionalString (cfg.showMotd && config.users.motd != null) ''
+          optionalString (cfg.showMotd && (config.users.motd != null || config.users.motdFile != null)) ''
             session optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd}
           '' +
           optionalString (cfg.enableAppArmor && config.security.apparmor.enable) ''
···
     };
   }));
 
-  motd = pkgs.writeText "motd" config.users.motd;
+  motd = if isNull config.users.motdFile
+         then pkgs.writeText "motd" config.users.motd
+         else config.users.motdFile;
 
   makePAMService = name: service:
     { name = "pam.d/${name}";
···
       description = lib.mdDoc "Message of the day shown to users when they log in.";
     };
 
+    users.motdFile = mkOption {
+      default = null;
+      example = "/etc/motd";
+      type = types.nullOr types.path;
+      description = lib.mdDoc "A file containing the message of the day shown to users when they log in.";
+    };
   };
 
 
   ###### implementation
 
   config = {
+    assertions = [
+      {
+        assertion = isNull config.users.motd || isNull config.users.motdFile;
+        message = ''
+          Only one of users.motd and users.motdFile can be set.
+        '';
+      }
+    ];
 
     environment.systemPackages =
       # Include the PAM modules in the system path mostly for the manpages.

nixos/modules/services/backup/borgbackup.nix

···
     concatStringsSep " "
       (mapAttrsToList (x: y: "--keep-${x}=${toString y}") cfg.prune.keep);
 
-  mkBackupScript = cfg: ''
+  mkBackupScript = name: cfg: pkgs.writeShellScript "${name}-script" (''
+    set -e
     on_exit()
     {
       exitStatus=$?
···
       ${optionalString (cfg.prune.prefix != null) "--glob-archives ${escapeShellArg "${cfg.prune.prefix}*"}"} \
       $extraPruneArgs
     ${cfg.postPrune}
-  '';
+  '');
 
   mkPassEnv = cfg: with cfg.encryption;
     if passCommand != null then
···
   mkBackupService = name: cfg:
     let
       userHome = config.users.users.${cfg.user}.home;
-    in nameValuePair "borgbackup-job-${name}" {
+      backupJobName = "borgbackup-job-${name}";
+      backupScript = mkBackupScript backupJobName cfg;
+    in nameValuePair backupJobName {
       description = "BorgBackup job ${name}";
       path = with pkgs; [
         borgbackup openssh
       ];
-      script = mkBackupScript cfg;
+      script = "exec " + optionalString cfg.inhibitsSleep ''\
+        ${pkgs.systemd}/bin/systemd-inhibit \
+            --who="borgbackup" \
+            --what="sleep" \
+            --why="Scheduled backup" \
+        '' + backupScript;
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
···
               {manpage}`systemd.timer(5)`
               which triggers the backup immediately if the last trigger
               was missed (e.g. if the system was powered down).
+            '';
+          };
+
+          inhibitsSleep = mkOption {
+            default = false;
+            type = types.bool;
+            example = true;
+            description = lib.mdDoc ''
+              Prevents the system from sleeping while backing up.
             '';
           };
 

nixos/modules/services/misc/atuin.nix

···
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.atuin;
+in
+{
+  options = {
+    services.atuin = {
+      enable = mkEnableOption (mdDoc "Enable server for shell history sync with atuin.");
+
+      openRegistration = mkOption {
+        type = types.bool;
+        default = false;
+        description = mdDoc "Allow new user registrations with the atuin server.";
+      };
+
+      path = mkOption {
+        type = types.str;
+        default = "";
+        description = mdDoc "A path to prepend to all the routes of the server.";
+      };
+
+      host = mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = mdDoc "The host address the atuin server should listen on.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 8888;
+        description = mdDoc "The port the atuin server should listen on.";
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = mdDoc "Open ports in the firewall for the atuin server.";
+      };
+
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    # enable postgres to host atuin db
+    services.postgresql = {
+      enable = true;
+      ensureUsers = [{
+        name = "atuin";
+        ensurePermissions = {
+          "DATABASE atuin" = "ALL PRIVILEGES";
+        };
+      }];
+      ensureDatabases = [ "atuin" ];
+    };
+
+    systemd.services.atuin = {
+      description = "atuin server";
+      after = [ "network.target" "postgresql.service" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        ExecStart = "${pkgs.atuin}/bin/atuin server start";
+        RuntimeDirectory = "atuin";
+        RuntimeDirectoryMode = "0700";
+        DynamicUser = true;
+      };
+
+      environment = {
+        ATUIN_HOST = cfg.host;
+        ATUIN_PORT = toString cfg.port;
+        ATUIN_OPEN_REGISTRATION = boolToString cfg.openRegistration;
+        ATUIN_DB_URI = "postgresql:///atuin";
+        ATUIN_PATH = cfg.path;
+        ATUIN_CONFIG_DIR = "/run/atuin"; # required to start, but not used as configuration is via environment variables
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+
+  };
+}

nixos/modules/services/web-apps/miniflux.nix

···
     services.miniflux = {
       enable = mkEnableOption (lib.mdDoc "miniflux and creates a local postgres database for it");
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.miniflux;
+        defaultText = literalExpression "pkgs.miniflux";
+        description = lib.mdDoc "Miniflux package to use.";
+      };
+
       config = mkOption {
         type = types.attrsOf types.str;
         example = literalExpression ''
···
       after = [ "network.target" "postgresql.service" "miniflux-dbsetup.service" ];
 
       serviceConfig = {
-        ExecStart = "${pkgs.miniflux}/bin/miniflux";
+        ExecStart = "${cfg.package}/bin/miniflux";
         User = dbUser;
         DynamicUser = true;
         RuntimeDirectory = "miniflux";
···
 
       environment = cfg.config;
     };
-    environment.systemPackages = [ pkgs.miniflux ];
+    environment.systemPackages = [ cfg.package ];
   };
 }

nixos/tests/all-tests.nix

···
   apparmor = handleTest ./apparmor.nix {};
   atd = handleTest ./atd.nix {};
   atop = handleTest ./atop.nix {};
+  atuin = handleTest ./atuin.nix {};
   auth-mysql = handleTest ./auth-mysql.nix {};
   avahi = handleTest ./avahi.nix {};
   avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };

nixos/tests/atuin.nix

···
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+
+let
+  testPort = 8888;
+  testUser = "testerman";
+  testPass = "password";
+  testEmail = "[e-mail]";
+in
+with lib;
+{
+  name = "atuin";
+  meta.maintainers = with pkgs.lib.maintainers; [ devusb ];
+
+  nodes = {
+    server =
+      { ... }:
+      {
+        services.atuin = {
+          enable = true;
+          port = testPort;
+          host = "0.0.0.0";
+          openFirewall = true;
+          openRegistration = true;
+        };
+      };
+
+    client =
+      { ... }:
+      { };
+
+  };
+
+  testScript = with pkgs; ''
+    start_all()
+
+    # wait for atuin server startup
+    server.wait_for_unit("atuin.service")
+    server.wait_for_open_port(${toString testPort})
+
+    # configure atuin client on server node
+    server.execute("mkdir -p ~/.config/atuin")
+    server.execute("echo 'sync_address = \"http://localhost:${toString testPort}\"' > ~/.config/atuin/config.toml")
+
+    # register with atuin server on server node
+    server.succeed("${atuin}/bin/atuin register -u ${testUser} -p ${testPass} -e ${testEmail}")
+    _, key = server.execute("${atuin}/bin/atuin key")
+
+    # store test record in atuin server and sync
+    server.succeed("ATUIN_SESSION=$(${atuin}/bin/atuin uuid) ${atuin}/bin/atuin history start 'shazbot'")
+    server.succeed("${atuin}/bin/atuin sync")
+
+    # configure atuin client on client node
+    client.execute("mkdir -p ~/.config/atuin")
+    client.execute("echo 'sync_address = \"http://server:${toString testPort}\"' > ~/.config/atuin/config.toml")
+
+    # log in to atuin server on client node
+    client.succeed(f"${atuin}/bin/atuin login -u ${testUser} -p ${testPass} -k {key}")
+
+    # pull records from atuin server
+    client.succeed("${atuin}/bin/atuin sync -f")
+
+    # check for test record
+    client.succeed("ATUIN_SESSION=$(${atuin}/bin/atuin uuid) ${atuin}/bin/atuin history list | grep shazbot")
+  '';
+})

nixos/tests/borgbackup.nix

···
           environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
         };
 
+        sleepInhibited = {
+          inhibitsSleep = true;
+          # Blocks indefinitely while "backing up" so that we can try to suspend the local system while it's hung
+          dumpCommand = pkgs.writeScript "sleepInhibited" ''
+            cat /dev/zero
+          '';
+          repo = remoteRepo;
+          encryption.mode = "none";
+          startAt = [ ];
+          environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
+        };
+
       };
     };
 
···
         client.wait_for_unit("network.target")
         client.systemctl("start --wait borgbackup-job-commandFail")
         client.succeed("systemctl is-failed borgbackup-job-commandFail")
+
+    with subtest("sleepInhibited"):
+        server.wait_for_unit("sshd.service")
+        client.wait_for_unit("network.target")
+        client.fail("systemd-inhibit --list | grep -q borgbackup")
+        client.systemctl("start borgbackup-job-sleepInhibited")
+        client.wait_until_succeeds("systemd-inhibit --list | grep -q borgbackup")
+        client.systemctl("stop borgbackup-job-sleepInhibited")
   '';
 })

nixos/tests/prometheus-exporters.nix

···
       exporterConfig.enable = true;
       exporterConfig.controllers = [{ }];
       exporterTest = ''
-        wait_for_unit("prometheus-unpoller-exporter.service")
-        wait_for_open_port(9130)
-        succeed(
-            "curl -sSf localhost:9130/metrics | grep 'unpoller_build_info{.\\+} 1'"
+        wait_until_succeeds(
+            'journalctl -eu prometheus-unpoller-exporter.service -o cat | grep "Connection Error"'
         )
       '';
     };

pkgs/applications/audio/pms/default.nix

···
+{ lib, fetchFromGitHub, buildGoModule }:
+
+buildGoModule {
+  pname = "pms";
+  version = "unstable-2022-11-12";
+
+  src = fetchFromGitHub {
+    owner = "ambientsound";
+    repo = "pms";
+    rev = "40d6e37111293187ab4542c7a64bd73d1b13974f";
+    sha256 = "sha256-294MiS4c2PO2lFSSRrg8ns7sXzZsEUAqPG3q2z3TRUg=";
+  };
+
+  vendorHash = "sha256-XNFzG4hGDUN0wWbpBoQWUH1bWIgoYcyP4tNRGSV4ro4=";
+
+  meta = with lib; {
+    description = "An interactive Vim-like console client for MPD";
+    homepage = "https://ambientsound.github.io/pms/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ deejayem ];
+  };
+}

pkgs/applications/editors/vim/plugins/generated.nix

···
     meta.homepage = "https://github.com/rktjmp/hotpot.nvim/";
   };
 
+  html5-vim = buildVimPluginFrom2Nix {
+    pname = "html5.vim";
+    version = "2020-08-22";
+    src = fetchFromGitHub {
+      owner = "othree";
+      repo = "html5.vim";
+      rev = "7c9f6f38ce4f9d35db7eeedb764035b6b63922c6";
+      sha256 = "1hgbvdpmn3yffk5ahz7hz36a7f5zjc1k3pan5ybgncmdq9f4rzq6";
+    };
+    meta.homepage = "https://github.com/othree/html5.vim/";
+  };
+
   hydra-nvim = buildVimPluginFrom2Nix {
     pname = "hydra.nvim";
     version = "2022-11-20";

pkgs/applications/editors/vim/plugins/vim-plugin-names

···
 https://github.com/urbit/hoon.vim/,,
 https://github.com/phaazon/hop.nvim/,,
 https://github.com/rktjmp/hotpot.nvim/,,
+https://github.com/othree/html5.vim/,HEAD,
 https://github.com/anuvyklack/hydra.nvim/,HEAD,
 https://github.com/mboughaba/i3config.vim/,,
 https://github.com/cocopon/iceberg.vim/,,

pkgs/applications/graphics/evilpixie/default.nix

···
-{ mkDerivation
-, lib
+{ lib
+, stdenv
 , fetchFromGitHub
-, makeDesktopItem
-, qmake
+, meson
+, ninja
+, pkg-config
+, wrapQtAppsHook
 , qtbase
 , libpng
 , giflib
+, libjpeg
 , impy
 }:
 
-let
-  desktopItem = makeDesktopItem {
-    name = "EvilPixie";
-    desktopName = "EvilPixie";
-    exec = "evilpixie %F";
-    icon = "evilpixie";
-    genericName = "Image Editor";
-    categories = [ "Graphics" "2DGraphics" "RasterGraphics" ];
-    mimeTypes = [ "image/bmp" "image/gif" "image/jpeg" "image/jpg" "image/png" "image/x-pcx" "image/x-targa" "image/x-tga" ];
-  };
-
-in mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "evilpixie";
-  version = "0.2.1";
+  version = "0.3";
 
   src = fetchFromGitHub {
     owner = "bcampbell";
     repo = "evilpixie";
     rev = "v${version}";
-    sha256 = "0dwgfr8kmkfppgf5wx9i5f7fjz3gxk0ji1l06x1z4r3vj52hdbph";
+    sha256 = "sha256-t7ccaMXaCanCyn3oV8WJ11bhF7xTBkd992AheFJpSGQ=";
   };
 
   nativeBuildInputs = [
-    qmake
+    meson
+    ninja
+    pkg-config
+    wrapQtAppsHook
   ];
 
   buildInputs = [
     qtbase
     libpng
     giflib
+    libjpeg
     impy
   ];
-
-  postInstall = ''
-    ln -s ${desktopItem}/share/applications $out/share
-    install -Dm 444 icon_128x128.png $out/share/icons/hicolor/128x128/apps/evilpixie.png
-  '';
 
   meta = with lib; {
     description = "Pixel-oriented paint program, modelled on Deluxe Paint";
···
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ fgaz ];
     platforms = platforms.all;
+    # Undefined symbols for architecture x86_64:
+    # "_bundle_path", referenced from: App::SetupPaths() in src_app.cpp.o
+    broken = stdenv.isDarwin ||
+    # https://github.com/bcampbell/evilpixie/issues/28
+      stdenv.isAarch64;
   };
 }
 

pkgs/applications/misc/bemenu/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "bemenu";
-  version = "0.6.13";
+  version = "0.6.14";
 
   src = fetchFromGitHub {
     owner = "Cloudef";
     repo = pname;
     rev = version;
-    sha256 = "sha256-YGaAJOyVZBHEWQuZVfPIIbtuntv1klQk9GcWRN+oVF4=";
+    sha256 = "sha256-bMnnuT+LNNKphmvVcD1aaNZxasSGOEcAveC4stCieG8=";
   };
 
   nativeBuildInputs = [ pkg-config pcre ];

pkgs/applications/misc/seashells/default.nix

···
+{ lib, python3Packages }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "seashells";
+  version = "0.1.2";
+  format = "setuptools";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-RBs28FC7f82DrxRcmvTP9nljVpm7tjrGuvr05l32hDM=";
+  };
+
+  doCheck = false; # there are no tests
+  pythonImportsCheck = [ "seashells" ];
+
+  meta = with lib; {
+    homepage = "https://seashells.io/";
+    description = "Pipe command-line programs to seashells.io";
+    longDescription = ''
+      Official cient for seashells.io, which allows you to view
+      command-line output on the web, in real-time.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ deejayem ];
+  };
+}

pkgs/applications/networking/gns3/gui.nix

···
   postPatch = ''
     substituteInPlace requirements.txt \
       --replace "psutil==" "psutil>=" \
-      --replace "jsonschema>=4.17.0,<4.18" "jsonschema"
+      --replace "jsonschema>=4.17.0,<4.18" "jsonschema" \
+      --replace "sentry-sdk==1.10.1,<1.11" "sentry-sdk"
   '';
 
   meta = with lib; {

pkgs/applications/networking/gns3/server.nix

···
   postPatch = ''
     substituteInPlace requirements.txt \
       --replace "psutil==" "psutil>=" \
-      --replace "jsonschema>=4.17.0,<4.18" "jsonschema"
+      --replace "jsonschema>=4.17.0,<4.18" "jsonschema" \
+      --replace "sentry-sdk==1.10.1,<1.11" "sentry-sdk"
   '';
 
   propagatedBuildInputs = with python3.pkgs; [

pkgs/applications/version-management/git-and-tools/git-delete-merged-branches/default.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "git-delete-merged-branches";
-  version = "7.2.2";
+  version = "7.3.1";
 
   src = fetchFromGitHub {
     owner = "hartwork";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-Q83s0kkrArRndxQa+V+eZw+iaJje7VR+aPScB33l1W0=";
+    sha256 = "sha256-9Y4n8OWZMwGoCunqwWtkDeDvRcJ4aepw1vgMXFHkhx0=";
   };
 
   propagatedBuildInputs = with python3Packages; [

pkgs/applications/virtualization/docker/compose.nix

···
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.14.0";
+  version = "2.14.1";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    sha256 = "sha256-6dTVDAFq5CwLvTzOczyaM+ZILKjKZzR2SAaRq2hqk7M=";
+    sha256 = "sha256-FxioqEPVHI6PlKfcQlKbPVj6LGyUsXabCpJh+zY3gco=";
   };
 
   postPatch = ''
···
     rm -rf e2e/
   '';
 
-  vendorSha256 = "sha256-B6xqMsspWexTdYX+o2BJNlXuJFL7/rv8oexFUxOO8BI=";
+  vendorSha256 = "sha256-sWEtpwtr2/2qNWyHZdiZRYdw/LTwmIQKM9nCaHxL7ns=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 

pkgs/common-updater/directory-listing-updater.nix

···
 , odd-unstable ? false
 , patchlevel-unstable ? false
 , url ? null
+, extraRegex ? null
 }:
 
 genericUpdater {
   inherit pname version attrPath ignoredVersions rev-prefix odd-unstable patchlevel-unstable;
-  versionLister = "${common-updater-scripts}/bin/list-directory-versions ${lib.optionalString (url != null) "--url=${lib.escapeShellArg url}"}";
+  versionLister = "${common-updater-scripts}/bin/list-directory-versions ${lib.optionalString (url != null) "--url=${lib.escapeShellArg url}"} ${lib.optionalString (extraRegex != null) "--extra-regex=${lib.escapeShellArg extraRegex}"}";
 }

pkgs/common-updater/scripts/list-directory-versions

···
 parser.add_argument("--url", help="url of the page that lists the package versions")
 parser.add_argument("--file", help="file name for writing debugging information")
 
+parser.add_argument("--extra-regex", help="additional regex to filter versions with")
+
 
 if __name__ == "__main__":
     args = parser.parse_args()
···
         link_url = link.get("href", None)
         if link_url is not None:
             match = re.fullmatch(
-                rf"{args.pname}-([\d.]+?(-[\d\w.-]+?)?)(\.tar)?(\.[^.]*)", link_url
+                rf"(.*/)?{args.pname}-([\d.]+?(-[\d\w.-]+?)?)(\.tar)?(\.[^.]*)", link_url
             )
             if match:
-                print(match.group(1))
+                version = match.group(2)
+                if (not args.extra_regex) or re.fullmatch(args.extra_regex, version):
+                    print(version)

pkgs/development/guile-modules/guile-gcrypt/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "guile-gcrypt";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitea {
     domain = "notabug.org";
     owner = "cwebber";
     repo = "guile-gcrypt";
     rev = "v${version}";
-    sha256 = "sha256-lAaiKBOdTFWEWsmwKgx0C67ACvtnEKUxti66dslzSVQ=";
+    hash = "sha256-vbm31EsOJiMeTs2tu5KPXckxPcAQbi3/PGJ5EHCC5VQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/interpreters/python/cpython/2.7/default.nix

···
 , stripConfig ? false
 , stripIdlelib ? false
 , stripTests ? false
+, stripLibs ? [ ]
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
 }:
 
···
     '' + optionalString strip2to3 ''
       rm -R $out/bin/2to3 $out/lib/python*/lib2to3
     '' + optionalString stripConfig ''
-      rm -R $out/bin/python*-config $out/lib/python*/config-*
+      rm -R $out/bin/python*-config $out/lib/python*/config*
     '' + optionalString stripIdlelib ''
       # Strip IDLE
       rm -R $out/bin/idle* $out/lib/python*/idlelib
     '' + optionalString stripTests ''
       # Strip tests
       rm -R $out/lib/python*/test $out/lib/python*/**/test{,s}
-    '';
+    '' + (concatStringsSep "\n"
+          (map
+            (lib:
+              ''
+                rm -vR $out/lib/python*/${lib}
+                # libraries in dynload (C libraries) may not exist,
+                # but when they exist they may be prefixed with _
+                rm -vfR $out/lib/python*/lib-dynload/{,_}${lib}
+              '') stripLibs));
 
     enableParallelBuilding = true;
 

pkgs/development/libraries/impy/default.nix

···
 { lib, stdenv
 , fetchFromGitHub
-, cmake
+, meson
+, ninja
 , pkg-config
 , libpng
 , zlib
 , giflib
 , libjpeg
-, SDL2
 }:
 
 stdenv.mkDerivation rec {
   pname = "impy";
-  version = "0.1";
+  version = "0.2";
 
   src = fetchFromGitHub {
     owner = "bcampbell";
     repo = "impy";
     rev = "v${version}";
-    sha256 = "1h45xjms56radhknspyx17a12dpnm7xgqm1x1chy42aw5ic8b5qf";
+    sha256 = "sha256-0bHm3jawYgcIeF2COALWlypX7kvPw1hifB/W+TKcC4M=";
   };
 
   nativeBuildInputs = [
-    cmake
+    meson
+    ninja
     pkg-config
   ];
 
···
     zlib
     giflib
     libjpeg
-    SDL2
   ];
 
   meta = with lib; {

pkgs/development/libraries/spice-gtk/default.nix

···
 , libusb1
 , lz4
 , meson
+, mesonEmulatorHook
 , ninja
 , openssl
 , perl
···
 , usbredir
 , vala
 , wayland-protocols
+, wayland-scanner
 , zlib
 , withPolkit ? stdenv.isLinux
 }:
···
       "# meson.add_install_script('../build-aux/setcap-or-suid',"
   '';
 
+  depsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     docbook_xsl
     gettext
···
     python3
     python3.pkgs.pyparsing
     python3.pkgs.six
+    wayland-scanner
     vala
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    mesonEmulatorHook
   ];
 
   propagatedBuildInputs = [
···
     pixman
     spice-protocol
     usbredir
+    vala
     zlib
   ] ++ lib.optionals withPolkit [
     polkit

pkgs/development/misc/resholve/default.nix

···
     stripConfig = true;
     stripIdlelib = true;
     stripTests = true;
+    stripLibs = [
+      # directories
+      "bsddb*"
+      "curses"
+      "compiler"
+      "ensurepip"
+      "hotshot"
+      "lib-tk"
+      "sqlite3"
+      # files
+      "aifc*"
+      "antigravity*"
+      "async*"
+      "*audio*"
+      "BaseHTTPServer*"
+      "Bastion*"
+      "binhex*"
+      "bdb*"
+      "CGIHTTPServer*"
+      "cgitb*"
+      "chunk*"
+      "colorsys*"
+      "dbhash*"
+      "dircache*"
+      "*dbm*"
+      "ftplib*"
+      "*hdr*"
+      "imaplib*"
+      "imputil*"
+      "MimeWriter*"
+      "mailbox*"
+      "mhlib*"
+      "mimify*"
+      "multifile*"
+      "netrc*"
+      "nntplib*"
+      "os2emxpath*"
+      "pyclbr*"
+      "pydoc*"
+      "SimpleHTTPServer*"
+      "sgmllib*"
+      "smtp*"
+      "ssl*"
+      "sun*"
+      "tabnanny*"
+      "telnetlib*"
+      "this*"
+      "wave*"
+      "webbrowser*"
+      "whichdb*"
+      "wsgiref*"
+      "xdrlib*"
+      "*XMLRPC*"
+    ];
     enableOptimizations = false;
   };
   callPackage = lib.callPackageWith (pkgs // { python27 = python27'; });

pkgs/development/mobile/maestro/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "maestro";
-  version = "1.11.3";
+  version = "1.17.2";
 
   src = fetchurl {
-    url = "https://github.com/mobile-dev-inc/maestro/releases/download/cli-${version}/maestro-${version}.zip";
-    sha256 = "0hjsrwp6d1k68p0qhn7v9689ihy06ssnfpi8dj61jw6r64c234m4";
+    url = "https://github.com/mobile-dev-inc/maestro/releases/download/cli-${version}/maestro.zip";
+    sha256 = "1lf0226gl9912qrk4s57bsncv23886b8wk7wri6icg26xp1cxa3v";
   };
 
   dontUnpack = true;
···
   installPhase = ''
     mkdir $out
     unzip $src -d $out
-    mv $out/maestro-$version/* $out
-    rm -rf $out/maestro-$version
+    mv $out/maestro/* $out
+    rm -rf $out/maestro
   '';
 
   postFixup = ''

pkgs/development/python-modules/exchangelib/default.nix

···
       url = "https://github.com/ecederstrand/exchangelib/commit/d5d386f54adec8ab02f871332b89e1176c214ba2.diff";
       hash = "sha256-E3Ys6IDJ/yMsvi+1GKbwckkhbNrc9JLM/+GrPtUz+mY=";
     })
+    (fetchpatch {
+      name = "tests-timezones-2.patch";
+      url = "https://github.com/ecederstrand/exchangelib/commit/419eafcd9261bfd0617823ee437204d5556a8271.diff";
+      excludes = [ "tests/test_ewsdatetime.py" ];
+      hash = "sha256-dSp6NkNT5dHOg8XgDi8sR3t3hq46sNtPjUXva2YfFSU=";
+    })
   ];
 
   propagatedBuildInputs = [

pkgs/development/python-modules/selenium/default.nix

···
 
 buildPythonPackage rec {
   pname = "selenium";
-  version = "4.6.0";
+  version = "4.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     repo = "selenium";
     # check if there is a newer tag with or without -python suffix
     rev = "refs/tags/selenium-${version}";
-    hash = "sha256-xgGGtJo+DZIwPa0H6dsT0VClRTMM8iFbNzSDZjH7ImI=";
+    hash = "sha256-7inmi8dHi6So+8AbLq85Go/GEaiV1XK/7+wt9UkTdo8=";
   };
 
   postPatch = ''

pkgs/development/python-modules/skorch/default.nix

···
 , buildPythonPackage
 , fetchPypi
 , pytestCheckHook
-, pytest
-, pytest-cov
 , flaky
 , numpy
 , pandas
···
 
 buildPythonPackage rec {
   pname = "skorch";
-  version = "0.11.0";
+  version = "0.12.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b35cb4e50045742f0ffcfad33044af691d5d36b50212573753a804483a947ca9";
+    hash = "sha256-fjNbNY/Dr7lgVGPrHJTvPGuhyPR6IVS7ohBQMI+J1+k=";
   };
 
   propagatedBuildInputs = [ numpy torch scikit-learn scipy tabulate tqdm ];
-  checkInputs = [ pytest pytest-cov flaky pandas pytestCheckHook ];
+  checkInputs = [ flaky pandas pytestCheckHook ];
+
+  # patch out pytest-cov dep/invocation
+  postPatch = ''
+    substituteInPlace setup.cfg  \
+      --replace "--cov=skorch" ""  \
+      --replace "--cov-report=term-missing" ""  \
+      --replace "--cov-config .coveragerc" ""
+  '';
 
   disabledTests = [
     # on CPU, these expect artifacts from previous GPU run
     "test_load_cuda_params_to_cpu"
     # failing tests
     "test_pickle_load"
-    "test_grid_search_with_slds_"
-    "test_grid_search_with_dict_works"
   ];
 
+  # tries to import `transformers` and download HuggingFace data
+  disabledTestPaths = [ "skorch/tests/test_hf.py" ];
+
+  pythonImportsCheck = [ "skorch" ];
+
   meta = with lib; {
     description = "Scikit-learn compatible neural net library using Pytorch";
     homepage = "https://skorch.readthedocs.io";
     changelog = "https://github.com/skorch-dev/skorch/blob/master/CHANGES.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ bcdarwin ];
-    # TypeError: __init__() got an unexpected keyword argument 'iid'
-    broken = true;
   };
 }

pkgs/development/tools/bacon/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "bacon";
-  version = "2.2.7";
+  version = "2.2.8";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-GVwaqpczo+9bRA8VUwpLTwP+3PQ0mqM+4F1K61WKaNA=";
+    sha256 = "sha256-UFuU3y+v1V7Llc+IrWbh7kz8uUyCsxJO2zJhE6zwjSg=";
   };
 
-  cargoSha256 = "sha256-mdzNbGDA93MSuZw3gYXGIuHbt36WAlf/7JcxJtkl0mk=";
+  cargoSha256 = "sha256-CPugHGkYbJG6WrguuGt/CnHq6NvRZ2fP2hgPIuIGGqc=";
 
   buildInputs = lib.optional stdenv.isDarwin CoreServices;
 

pkgs/development/tools/continuous-integration/cirrus-cli/default.nix

···
 
 buildGoModule rec {
   pname = "cirrus-cli";
-  version = "0.92.1";
+  version = "0.93.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ehJyC5NXB53i7ZpWTKySnMwWiqgbgBbnxIVWhyrXC0A=";
+    sha256 = "sha256-exGOCBKPHuVBaFXd+/jbjAid7ZDodtZ/h/OWp/NBOhE=";
   };
 
-  vendorSha256 = "sha256-Llq6siZn34sHsZFneT+MLXf2W9cXqi4DZwrH1R5laOY=";
+  vendorSha256 = "sha256-gotc9M2UkRJtE4LZPCpqDTXQ/cnN4tk+3HG243tFoss=";
 
   ldflags = [
     "-X github.com/cirruslabs/cirrus-cli/internal/version.Version=v${version}"

pkgs/development/tools/dtools/default.nix

···
-{stdenv, lib, fetchFromGitHub, fetchpatch, ldc, curl}:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, ldc, curl, gnumake42 }:
 
 stdenv.mkDerivation rec {
   pname = "dtools";
···
     })
   ];
 
-  nativeBuildInputs = [ ldc ];
+  nativeBuildInputs = [ ldc gnumake42 ]; # fails with make 4.4
   buildInputs = [ curl ];
 
   makeCmd = ''

pkgs/development/tools/esbuild/default.nix

···
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.16.1";
+  version = "0.16.7";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-5b9uJfIGWDQi5exPVCgK/9wrozptX1FebPMrWJ0v4TM=";
+    sha256 = "sha256-zo7YQ4Is3VWsXGvPNrg95tZ76qTSQRyntFjDeqhoyVw=";
   };
 
   vendorSha256 = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";

pkgs/games/lgames/lbreakouthd/default.nix

···
 , SDL2_image
 , SDL2_mixer
 , SDL2_ttf
+, directoryListingUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "lbreakouthd";
-  version = "1.0.10";
+  version = "1.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/lgames/${pname}-${version}.tar.gz";
-    hash = "sha256-hlGhPa91u6pOaZoFJSDcXYQdizTFjuuTLnx9fcrXUhA=";
+    hash = "sha256-5hjS0aJ5f8Oe0aSuVgcV10h5OmWsaMHF5B9wYVFrlDY=";
   };
 
   buildInputs = [
···
   ];
 
   hardeningDisable = [ "format" ];
+
+  passthru.updateScript = directoryListingUpdater {
+    inherit pname version;
+    url = "https://lgames.sourceforge.io/LBreakoutHD/";
+    extraRegex = "(?!.*-win(32|64)).*";
+  };
 
   meta = with lib; {
     broken = stdenv.isDarwin;

pkgs/games/lgames/lpairs2/default.nix

···
 , SDL2_image
 , SDL2_mixer
 , SDL2_ttf
+, directoryListingUpdater
 }:
 
 stdenv.mkDerivation rec {
···
     SDL2_mixer
     SDL2_ttf
   ];
+
+  passthru.updateScript = directoryListingUpdater {
+    inherit pname version;
+    url = "https://lgames.sourceforge.io/LPairs/";
+    extraRegex = "(?!.*-win(32|64)).*";
+  };
 
   meta = with lib; {
     broken = stdenv.isDarwin;

pkgs/games/lgames/ltris/default.nix

···
-{ lib, stdenv, fetchurl, SDL, SDL_mixer }:
+{ lib
+, stdenv
+, fetchurl
+, SDL
+, SDL_mixer
+, directoryListingUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "ltris";
-  version = "1.2.5";
+  version = "1.2.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/lgames/${pname}-${version}.tar.gz";
-    hash = "sha256-Ksb5TdQMTEzaJfjHVhgq27dSFvZxUnNUQ6OpAU+xwzM=";
+    hash = "sha256-wjziFFTAOJxSl6fvLhTv6ATZQGJefusDhqKXgOwsRvY=";
   };
 
   buildInputs = [
···
   ];
 
   hardeningDisable = [ "format" ];
+
+  passthru.updateScript = directoryListingUpdater {
+    inherit pname version;
+    url = "https://lgames.sourceforge.io/LTris/";
+    extraRegex = "(?!.*-win(32|64)).*";
+  };
 
   meta = with lib; {
     homepage = "https://lgames.sourceforge.io/LTris/";

pkgs/os-specific/linux/fwts/default.nix

···
-{ lib, stdenv, fetchzip, autoreconfHook, pkg-config, glib, pcre
+{ lib, stdenv, fetchzip, autoreconfHook, pkg-config, gnumake42, glib, pcre
 , json_c, flex, bison, dtc, pciutils, dmidecode, acpica-tools, libbsd }:
 
 stdenv.mkDerivation rec {
···
     stripRoot = false;
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  # fails with make 4.4
+  nativeBuildInputs = [ autoreconfHook pkg-config gnumake42 ];
   buildInputs = [ glib pcre json_c flex bison dtc pciutils dmidecode acpica-tools libbsd ];
 
   postPatch = ''

pkgs/os-specific/linux/kernel/hardened/patches.json

···
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.300-hardened1.patch",
-            "sha256": "1y43qxcn00w1gayjj1rr3vfws8m4f2p9nz080nqilw0g14kq73sa",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.300-hardened1/linux-hardened-4.14.300-hardened1.patch"
+            "name": "linux-hardened-4.14.302-hardened1.patch",
+            "sha256": "028wmgp5xkxf0k127vfnfr8wfvrdn68phfjxh21fjs5nag0vxmgs",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.302-hardened1/linux-hardened-4.14.302-hardened1.patch"
         },
-        "sha256": "047vmh09icm45g7mnmdvyj9cam7747bcpah1s7n9dm5i2j2f906y",
-        "version": "4.14.300"
+        "sha256": "102c9h0byr9v4bxzkdh7mnw1grm47ji6lf6l1gjlwah7f46j6ap3",
+        "version": "4.14.302"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.267-hardened1.patch",
-            "sha256": "0phlfwigzh2j5j8xjqamywqn8libpzvhingx0vjxggf0wqxvgix0",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.267-hardened1/linux-hardened-4.19.267-hardened1.patch"
+            "name": "linux-hardened-4.19.269-hardened1.patch",
+            "sha256": "03gmxnficyjngxq1ciwp2jbr38zi0pfkax8bycs3xp1xhx90p3db",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.269-hardened1/linux-hardened-4.19.269-hardened1.patch"
         },
-        "sha256": "035yxx13jz5f5ig2r6ybzgivm8vjafgnvjws0jfzha4w6klf7r9l",
-        "version": "4.19.267"
+        "sha256": "02mjb16xxfj984vibpxvhjl84y5yg0jgzjccjdxnn8db4k9aa2vf",
+        "version": "4.19.269"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.157-hardened1.patch",
-            "sha256": "1igmixscnjynnczwcrwp2kcw2llrbw3zlg4qzvyfmqvf3ylbbq5z",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.157-hardened1/linux-hardened-5.10.157-hardened1.patch"
+            "name": "linux-hardened-5.10.159-hardened1.patch",
+            "sha256": "0kjiijq9qd5zyy2gvsn8xv99jv5crfyqi69lchmsqk1gs4qhs7m9",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.159-hardened1/linux-hardened-5.10.159-hardened1.patch"
         },
-        "sha256": "0zrjdmaj3sx0w7397glaiq6w9wwdj7lpff77a09kzmbyfz0dfk7w",
-        "version": "5.10.157"
+        "sha256": "19yfi5vknxnw0cb8274q3pb5zjs6ny04n16m8xjdfdmznrbvza8v",
+        "version": "5.10.159"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.81-hardened1.patch",
-            "sha256": "0dignkwdpfi0jm3d1iz63rc4a0ki1vwyw100nganxbrg13kjm9jv",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.81-hardened1/linux-hardened-5.15.81-hardened1.patch"
+            "name": "linux-hardened-5.15.83-hardened1.patch",
+            "sha256": "0cyd14xlmiy7bj5psjws2p1xdc7vzhv1hy77xca4mlwssb41zvdb",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.83-hardened1/linux-hardened-5.15.83-hardened1.patch"
         },
-        "sha256": "1awny3lgfkh5n2gdksajbyzips8kawz6rkr0p5inwkbmppg5r24g",
-        "version": "5.15.81"
+        "sha256": "1wvzfhzqq9dps508wmp2gblfz93ipppnjzqm0n8pi1acq11hhna0",
+        "version": "5.15.83"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.225-hardened1.patch",
-            "sha256": "09h8bjq73fyx6kqk0kcy3z2a0cs32gg4visv859siwb8rw1ziva2",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.225-hardened1/linux-hardened-5.4.225-hardened1.patch"
+            "name": "linux-hardened-5.4.227-hardened1.patch",
+            "sha256": "1q5xxaz154iz65x6n4m1lfsly9p978zzrnp9xdh6sp1cw8g39fyn",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.227-hardened1/linux-hardened-5.4.227-hardened1.patch"
         },
-        "sha256": "1ak0qlxzfylgvkldh2whq4mzynh1rymhnnc1yif9a5s3f7v9dxar",
-        "version": "5.4.225"
+        "sha256": "14q5gy48j78vwnqivrgpdhj778n2jq5l7yiw5na1rwqmfh1wbvsy",
+        "version": "5.4.227"
     },
     "6.0": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.0.11-hardened1.patch",
-            "sha256": "0y48mj6sj43s1d58gds0v8dbyiavsvl5n0a8iqjs0fb8f6wbld0r",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.0.11-hardened1/linux-hardened-6.0.11-hardened1.patch"
+            "name": "linux-hardened-6.0.13-hardened1.patch",
+            "sha256": "0v037rg3h8khjdr1hhkpqv2xb9g5vc7dklxf8zidaww27gb2g528",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.0.13-hardened1/linux-hardened-6.0.13-hardened1.patch"
         },
-        "sha256": "0qn7m74wfixqk832j2yvgf2lq4vi55agm5gk9ziy2wa9wqqn3bib",
-        "version": "6.0.11"
+        "sha256": "191dlxcmbx8vy6z2k04jq2kr6hwnaknsnsyycvqnjmvmdf6i3lq8",
+        "version": "6.0.13"
     }
 }

pkgs/os-specific/linux/kernel/linux-4.14.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.301";
+  version = "4.14.302";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "16zrpfadsnznpl37crbq5g1hz1ch0zfp2a75yzlqy2fs0f7fxlmc";
+    sha256 = "102c9h0byr9v4bxzkdh7mnw1grm47ji6lf6l1gjlwah7f46j6ap3";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-4.19.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.268";
+  version = "4.19.269";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0kr0di4gr6p57c8h6ybcli01kazq235npbh6qrpx0hpmqcdcx6r1";
+    sha256 = "02mjb16xxfj984vibpxvhjl84y5yg0jgzjccjdxnn8db4k9aa2vf";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-5.10.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.158";
+  version = "5.10.159";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1rq7lyp41fydybs53rcdjhiy271arh95xch16s5s3jhhanxj82hy";
+    sha256 = "19yfi5vknxnw0cb8274q3pb5zjs6ny04n16m8xjdfdmznrbvza8v";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-5.15.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.82";
+  version = "5.15.83";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0r8v7113favmch2x6br7jk6idihza99l9qyd7ik99i5sg6xzdvpw";
+    sha256 = "1wvzfhzqq9dps508wmp2gblfz93ipppnjzqm0n8pi1acq11hhna0";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-5.4.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.226";
+  version = "5.4.227";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0i4s1hl5q0ax55z7m5krzyw1zj9v03q8jcfksknb6qrg3lm5a7qc";
+    sha256 = "14q5gy48j78vwnqivrgpdhj778n2jq5l7yiw5na1rwqmfh1wbvsy";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-6.0.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "6.0.12";
+  version = "6.0.13";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "00ag63lnxw2gijw3b6v29lhrlv480m12954q5zh4jawlz3nk1dw9";
+    sha256 = "191dlxcmbx8vy6z2k04jq2kr6hwnaknsnsyycvqnjmvmdf6i3lq8";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-rt-5.10.nix

···
 , ... } @ args:
 
 let
-  version = "5.10.153-rt76"; # updated by ./update-rt.sh
+  version = "5.10.158-rt77"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0qhn5xv0m6baip1my1gp4mrjc4j6d6nbxa701vpwllg4kx8y9wiw";
+    sha256 = "1rq7lyp41fydybs53rcdjhiy271arh95xch16s5s3jhhanxj82hy";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "12gf2nnnfcbmyp34xnns35qpnzsnwjilq2qs1xvq6m51gcnnzq7g";
+      sha256 = "1yl2add34ylsancly5dblxigljwrcxgs456cz7xlnpywrlfsir5m";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 

pkgs/os-specific/linux/libcgroup/default.nix

···
     hash = "sha256-x2yBqpr3LedtWmpZ4K1ipZxIualNJuDtC4FVGzzcQn8=";
   };
 
-  buildInputs = [ pam bison flex ];
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook bison flex ];
+  buildInputs = [ pam ];
 
   postPatch = ''
     substituteInPlace src/tools/Makefile.am \

pkgs/servers/mautrix-whatsapp/default.nix

···
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
-  version = "0.7.2";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     rev = "v${version}";
-    hash = "sha256-KeuAxrp4DYy0+K1XYF3FxindYoOHHfwtufwKnic46i8=";
+    hash = "sha256-shCFKTS6ArvjecokNSrgOBr5jO+64+d6OdubTHOWiws=";
   };
 
   buildInputs = [ olm ];
 
-  vendorSha256 = "sha256-oxRxGxYvpO1TeEBAKO1RDwqw4NUSW4XunGdVB6zXjx8=";
+  vendorSha256 = "sha256-BD1DBzr8iwVq2Qe7Zz1i871ysAYJ7iUlcBftjDYreeM=";
 
   doCheck = false;
 

pkgs/servers/monitoring/unpoller/default.nix

···
 
 buildGoModule rec {
   pname = "unpoller";
-  version = "2.3.1";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "unpoller";
     repo = "unpoller";
     rev = "v${version}";
-    hash = "sha256-0IknWsJ7fWJuvXeiMZscWEv8p90KZQaQC4Q0KV98Z88=";
+    hash = "sha256-t4f7iAIOg19n1aKG0tQy/GHNXdVAEnaRyTXMZY+1IUw=";
   };
 
-  vendorHash = "sha256-l2V41Rf8KDoh/fC9NcuGF4ISwCLwpbVuzQZiqiGNbuc=";
+  vendorHash = "sha256-GUzMu3ltdmFCKKWi9Hlr39rNe5uPnZpwQfhVAHtbeiw=";
 
   ldflags = [
     "-w" "-s"

pkgs/tools/admin/eksctl/default.nix

···
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.122.0";
+  version = "0.123.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-NvUnLnACQCBvIiM3a0dtTUhfr9P3Ra9TX5Gy4Pj0tww=";
+    sha256 = "sha256-K5o7lEFrUjAXXwL1cnWfuRNVXvLehk0tXCCIc0rfK5s=";
   };
 
-  vendorSha256 = "sha256-qc2i4bfasTBzndsxbMk6xRhtbgmbBAvuyBgUMeIiHaA=";
+  vendorSha256 = "sha256-CJ2b6O57E1mrNAWkDcnICeDzW3q4+uSeXV5UnYkbUng=";
 
   doCheck = false;
 

pkgs/tools/misc/atuin/default.nix

···
 , libiconv
 , Security
 , SystemConfiguration
+, nixosTests
 }:
 
 rustPlatform.buildRustPackage rec {
···
       --fish <($out/bin/atuin gen-completions -s fish) \
       --zsh <($out/bin/atuin gen-completions -s zsh)
   '';
+
+  passthru.tests = {
+    inherit (nixosTests) atuin;
+  };
 
   meta = with lib; {
     description = "Replacement for a shell history which records additional commands context with optional encrypted synchronization between machines";

pkgs/tools/networking/bgpdump/default.nix

···
     sha256 = "sha256-1HXMf9mHManR7jhonU2Agon0YFXOlM9APIN1Zm840AM=";
   };
 
+  postPatch = ''
+    substituteInPlace Makefile.in --replace 'ar r libbgpdump.a' '$(AR) r libbgpdump.a'
+  '';
+
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ zlib bzip2 ];
 

pkgs/tools/networking/iperf/2.nix

···
   hardeningDisable = [ "format" ];
   configureFlags = [ "--enable-fastsampling" ];
 
+  makeFlags = [ "AR:=$(AR)" ];
+
   postInstall = ''
     mv $out/bin/iperf $out/bin/iperf2
     ln -s $out/bin/iperf2 $out/bin/iperf

pkgs/tools/networking/mbidled/default.nix

···
+{ stdenv
+, lib
+, fetchFromGitHub
+, meson
+, ninja
+, libev
+, openssl
+}:
+stdenv.mkDerivation {
+  pname = "mbidled";
+  version = "unstable-2022-10-30";
+
+  src = fetchFromGitHub {
+    owner = "zsugabubus";
+    repo = "mbidled";
+    rev = "b06152f015a470876b042e538804ebb1ac247c09";
+    sha256 = "sha256-eHm10onJ7v6fhvJiGXZhuN3c9cj+NoVIW2XQb2fdmuA=";
+  };
+
+  preConfigure = ''
+    export LIBRARY_PATH=${libev}/lib
+  '';
+
+  nativeBuildInputs = [
+    meson ninja
+  ];
+
+  buildInputs = [
+    libev openssl
+  ];
+
+  meta = with lib; {
+    description = "run command on mailbox change";
+    homepage = "https://github.com/zsugabubus/mbidled";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ laalsaas ];
+    platforms = platforms.linux;
+  };
+}

pkgs/tools/networking/netsniff-ng/default.nix

···
 , liburcu
 , ncurses
 , pkg-config
+, gnumake42
 , zlib
 }:
 
···
     flex
     makeWrapper
     pkg-config
+    gnumake42 # fails with make 4.4
   ];
 
   buildInputs = [

pkgs/tools/security/nsjail/default.nix

···
   '';
 
   installPhase = ''
-    runHook preInstallPhase
+    runHook preInstall
     install -Dm755 nsjail "$out/bin/nsjail"
     installManPage nsjail.1
-    runHook postInstallPhase
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/tools/security/pinentry/default.nix

···
 { fetchurl, mkDerivation, fetchpatch, stdenv, lib, pkg-config, autoreconfHook, wrapGAppsHook
 , libgpg-error, libassuan, qtbase, wrapQtAppsHook
-, ncurses, gtk2, gcr, libcap
+, ncurses, gtk2, gcr
 , withLibsecret ? true, libsecret
 , enabledFlavors ? [ "curses" "tty" "gtk2" "emacs" ]
   ++ lib.optionals stdenv.isLinux [ "gnome3" ]
···
 
 pinentryMkDerivation rec {
   pname = "pinentry";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "mirror://gnupg/pinentry/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-EAcgRaPgQ9BYH5HNVnb8rH/+6VehZjat7apPWDphZHA=";
+    sha256 = "sha256-RXoYXlqFI4+5RalV3GNSq5YtyLSHILYvyfpIx1QKQGc=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ]
     ++ lib.concatMap(f: flavorInfo.${f}.nativeBuildInputs or []) enabledFlavors;
+
   buildInputs = [ libgpg-error libassuan ]
     ++ lib.optional withLibsecret libsecret
-    ++ lib.optional (!stdenv.isDarwin) libcap
     ++ lib.concatMap(f: flavorInfo.${f}.buildInputs or []) enabledFlavors;
 
   dontWrapGApps = true;
···
   ];
 
   configureFlags = [
-    (lib.withFeature   (libcap != null) "libcap")
-    (lib.enableFeature withLibsecret    "libsecret")
+    (lib.enableFeature withLibsecret "libsecret")
   ] ++ (map enableFeaturePinentry (lib.attrNames flavorInfo));
 
   postInstall =

pkgs/top-level/all-packages.nix

···
 
   linux-router-without-wifi = linux-router.override { useWifiDependencies = false; };
 
+  mbidled = callPackage ../tools/networking/mbidled { };
+
   metapixel = callPackage ../tools/graphics/metapixel { };
 
   midimonster = callPackage ../tools/audio/midimonster { };
···
   senpai = callPackage ../applications/networking/irc/senpai { };
 
   skim = callPackage ../tools/misc/skim { };
+
+  seashells = callPackage ../applications/misc/seashells { };
 
   seaweedfs = callPackage ../applications/networking/seaweedfs { };
 
···
   ncmpc = callPackage ../applications/audio/ncmpc { };
 
   ncmpcpp = callPackage ../applications/audio/ncmpcpp { };
+
+  pms = callPackage ../applications/audio/pms { };
 
   pragha = libsForQt5.callPackage ../applications/audio/pragha { };
 

pkgs/top-level/perl-packages.nix

···
 
   ImageExifTool = buildPerlPackage rec {
     pname = "Image-ExifTool";
-    version = "12.51";
+    version = "12.52";
 
     src = fetchurl {
       url = "https://exiftool.org/Image-ExifTool-${version}.tar.gz";
-      hash = "sha256-76meNQp9c0Z+81gNSMnDTtJmd/qOGu4uqeHsGhTnDkQ=";
+      hash = "sha256-yH8RlkTRAanHYNyq5Vi52W8mGKIJwmGZsWhzyokz+ao=";
     };
 
     nativeBuildInputs = lib.optional stdenv.isDarwin shortenPerlShebang;