Merge master into staging-next

maintainers/scripts/luarocks-packages.csv

···
 gitsigns.nvim,https://github.com/lewis6991/gitsigns.nvim.git,,,,5.1,
 http,,,,0.3-0,,vcunat
 inspect,,,,,,
+jsregexp,,,,,,
 ldbus,,,http://luarocks.org/dev,,,
 ldoc,https://github.com/stevedonovan/LDoc.git,,,,,
 lgi,,,,,,

nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

···
       </listitem>
       <listitem>
         <para>
+          <literal>teleport</literal> has been upgraded to major version
+          10. Please see upstream
+          <link xlink:href="https://goteleport.com/docs/ver/10.0/management/operations/upgrading/">upgrade
+          instructions</link> and
+          <link xlink:href="https://goteleport.com/docs/ver/10.0/changelog/#1000">release
+          notes</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           lemmy module option
           <literal>services.lemmy.settings.database.createLocally</literal>
           moved to

nixos/doc/manual/release-notes/rl-2211.section.md

···
 
 - dd-agent package removed along with the `services.dd-agent` module, due to the project being deprecated in favor of `datadog-agent`,  which is available via the `services.datadog-agent` module.
 
+- `teleport` has been upgraded to major version 10. Please see upstream [upgrade instructions](https://goteleport.com/docs/ver/10.0/management/operations/upgrading/) and [release notes](https://goteleport.com/docs/ver/10.0/changelog/#1000).
+
 - lemmy module option `services.lemmy.settings.database.createLocally`
   moved to `services.lemmy.database.createLocally`.
 

nixos/modules/security/acme/default.nix

···
     );
     renewOpts = escapeShellArgs (
       commonOpts
-      ++ [ "renew" ]
+      ++ [ "renew" "--no-random-sleep" ]
       ++ optionals data.ocspMustStaple [ "--must-staple" ]
       ++ data.extraLegoRenewFlags
     );
···
         # have many certificates, the renewals are distributed over
         # the course of the day to avoid rate limits.
         AccuracySec = "${toString (_24hSecs / numCerts)}s";
-
         # Skew randomly within the day, per https://letsencrypt.org/docs/integration-guide/.
         RandomizedDelaySec = "24h";
+        FixedRandomDelay = true;
       };
     };
 
···
         '');
       } // optionalAttrs (data.listenHTTP != null && toInt (elemAt (splitString ":" data.listenHTTP) 1) < 1024) {
         CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
       };
 
       # Working directory will be /tmp
···
 
         # Check if we can renew.
         # We can only renew if the list of domains has not changed.
-        if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(ls -1 accounts)" ]; then
+        # We also need an account key. Avoids #190493
+        if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(find accounts -name '${data.email}.key')" ]; then
 
           # Even if a cert is not expired, it may be revoked by the CA.
           # Try to renew, and silently fail if the cert is not expired.

nixos/modules/services/networking/firefox-syncserver.nix

···
       fxa_email_domain = "api.accounts.firefox.com";
       fxa_oauth_server_url = "https://oauth.accounts.firefox.com/v1";
       run_migrations = true;
+      # if JWK caching is not enabled the token server must verify tokens
+      # using the fxa api, on a thread pool with a static size.
+      additional_blocking_threads_for_fxa_requests = 10;
     } // lib.optionalAttrs cfg.singleNode.enable {
       # Single-node mode is likely to be used on small instances with little
       # capacity. The default value (0.1) can only ever release capacity when
···
         enableACME = cfg.singleNode.enableTLS;
         forceSSL = cfg.singleNode.enableTLS;
         locations."/" = {
-          proxyPass = "http://localhost:${toString cfg.settings.port}";
-          # source mentions that this header should be set
-          extraConfig = ''
-            add_header X-Content-Type-Options nosniff;
-          '';
+          proxyPass = "http://127.0.0.1:${toString cfg.settings.port}";
         };
       };
     };

nixos/tests/acme.nix

···
     inherit documentRoot;
   };
 
+  simpleConfig = {
+    security.acme = {
+      certs."http.example.test" = {
+        listenHTTP = ":80";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 80 ];
+  };
+
   # Base specialisation config for testing general ACME features
   webserverBasicConfig = {
     services.nginx.enable = true;
···
       services.nginx.logError = "stderr info";
 
       specialisation = {
+        # Tests HTTP-01 verification using Lego's built-in web server
+        http01lego.configuration = simpleConfig;
+
+        renew.configuration = lib.mkMerge [
+          simpleConfig
+          {
+            # Pebble provides 5 year long certs,
+            # needs to be higher than that to test renewal
+            security.acme.certs."http.example.test".validMinDays = 9999;
+          }
+        ];
+
+        # Tests that account creds can be safely changed.
+        accountchange.configuration = lib.mkMerge [
+          simpleConfig
+          {
+            security.acme.certs."http.example.test".email = "[e-mail]";
+          }
+        ];
+
         # First derivation used to test general ACME features
         general.configuration = { ... }: let
           caDomain = nodes.acme.test-support.acme.caDomain;
···
 
       download_ca_certs(client)
 
-      # Perform general tests first
+      # Perform http-01 w/ lego test first
+      with subtest("Can request certificate with Lego's built in web server"):
+          switch_to(webserver, "http01lego")
+          webserver.wait_for_unit("acme-finished-http.example.test.target")
+          check_fullchain(webserver, "http.example.test")
+          check_issuer(webserver, "http.example.test", "pebble")
+
+      # Perform renewal test
+      with subtest("Can renew certificates when they expire"):
+          hash = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")
+          switch_to(webserver, "renew")
+          webserver.wait_for_unit("acme-finished-http.example.test.target")
+          check_fullchain(webserver, "http.example.test")
+          check_issuer(webserver, "http.example.test", "pebble")
+          hash_after = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")
+          assert hash != hash_after
+
+      # Perform account change test
+      with subtest("Handles email change correctly"):
+          hash = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")
+          switch_to(webserver, "accountchange")
+          webserver.wait_for_unit("acme-finished-http.example.test.target")
+          check_fullchain(webserver, "http.example.test")
+          check_issuer(webserver, "http.example.test", "pebble")
+          hash_after = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")
+          # Has to do a full run to register account, which creates new certs.
+          assert hash != hash_after
+
+      # Perform general tests
       switch_to(webserver, "general")
 
       with subtest("Can request certificate with HTTP-01 challenge"):

pkgs/applications/blockchains/erigon.nix

···
 
 buildGoModule rec {
   pname = "erigon";
-  version = "2022.09.03";
+  version = "2022.10.01";
 
   src = fetchFromGitHub {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-dilsoJw7VPA7SerpAOhYUviE2zt2qMBmSLWaPm0ux2Y=";
+    sha256 = "sha256-FuOVI59vfhm5q92hnfgarh3zpLXSDRmZQJuERHf4I7A=";
     fetchSubmodules = true;
   };
 
-  vendorSha256 = "sha256-W8hEMfn2qW/3+V6x/RH1azj49V26fyQ+1y2re3tXsTk=";
+  vendorSha256 = "sha256-zdm11bGkCcwnz+8dve2pdcpg6pDgLe4UG3Ob/mbqhko=";
   proxyVendor = true;
 
   # Build errors in mdbx when format hardening is enabled:

pkgs/applications/blockchains/fulcrum/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "fulcrum";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "cculianu";
     repo = "Fulcrum";
     rev = "v${version}";
-    sha256 = "sha256-GaXXqIHuMTGn8iLymAhL8i0HzXmaO6RxtvIzgWw6QI0=";
+    sha256 = "sha256-sX9GeY+c/mcsAWApQ0E5LwoXZgWUC4w7YY8/PEzMhl8=";
   };
 
   nativeBuildInputs = [ pkg-config qmake ];

pkgs/applications/editors/android-studio/default.nix

···
     inherit tiling_wm;
   };
   stableVersion = {
-    version = "2021.2.1.15"; # "Android Studio Chipmunk (2021.2.1)"
-    sha256Hash = "ABjg38DdKSFwBRb3osRDN3xVd4jaf7CkUkPstDAHRb4=";
+    version = "2021.3.1.16"; # "Android Studio Dolphin (2021.3.1)"
+    sha256Hash = "GnJbWFeG9DuUQzbK9wM2BEbj9LXm4jQFf/Eh5Q75HZo=";
   };
   betaVersion = {
-    version = "2021.3.1.14"; # "Android Studio Dolphin (2021.3.1) Beta 5"
-    sha256Hash = "k1Qt54u45rwHsQNz9TVqnFB65kBKtfFZ3OknpfutKPI=";
+    version = "2022.1.1.11"; # "Android Studio Electic Eel (2022.1.1) Beta 1"
+    sha256Hash = "YQ20VQME9bQ2vOI7RWfA00npewOL3D6y1dGgNnJXnHc=";
   };
   latestVersion = { # canary & dev
-    version = "2022.1.1.8"; # "Android Studio Electric Eel (2022.1.1) Canary 8"
-    sha256Hash = "0bZXx4YpMztLAnwuBaSaNT3GJNfYnqCDanwR+Q7qyUc=";
+    version = "2022.2.1.2"; # "Android Studio Flamingo (2022.2.1) Canary 2"
+    sha256Hash = "hlHlgyl9If2LH4aExpElx0rqmWeoFX+qx4w6RRb5e8U=";
   };
 in {
   # Attributes are named by their corresponding release channels

pkgs/applications/editors/vscode/extensions/default.nix

···
         };
       };
 
-      jakebecker.elixir-ls = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "elixir-ls";
-          publisher = "JakeBecker";
-          version = "0.11.0";
-          sha256 = "sha256-okvwyD0m2r8ar85VtuBUNMUZGGrCfJ4DB9v7aSX5PjM=";
-        };
-        meta = with lib; {
-          changelog = "https://marketplace.visualstudio.com/items/JakeBecker.elixir-ls/changelog";
-          description = "Elixir support with debugger, autocomplete, and more. Powered by ElixirLS.";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=JakeBecker.elixir-ls";
-          homepage = "https://github.com/elixir-lsp/elixir-ls";
-          license = licenses.mit;
-          maintainers = with maintainers; [ datafoo ];
-        };
-      };
-
       james-yu.latex-workshop = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "latex-workshop";
···
 
   aliases = self: super: {
     # aliases
+    jakebecker.elixir-ls = super.elixir-lsp.vscode-elixir-ls;
     ms-vscode = lib.recursiveUpdate super.ms-vscode { inherit (super.golang) go; };
   };
 

pkgs/applications/graphics/hydrus/default.nix

···
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "500";
+  version = "501";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-gsOto37++++ucpDC0ri3HhROp7v6qlHENjFvsbuyM6k=";
+    sha256 = "sha256-dmQD3CAAAhE6IOfT38PHUIlHdDFdk6HZ6ZEZmKw7+WM=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/cluster/kubectl-doctor/default.nix

···
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:
 
 buildGoModule rec {
   pname = "kubectl-doctor";
···
     sha256 = "sha256-yp5OfSDxIASiCgISUVNxfe3dsLukgIoHARVPALIaQfY=";
   };
 
-  vendorSha256 = "sha256-pdg65q7iMkcpFvSVUTa07m5URLQNNEfWQ4mdGu4suBM=";
+  patches = [
+    (fetchpatch {
+      # https://github.com/emirozer/kubectl-doctor/pull/21
+      name = "go-1.19-client-go-0.25.patch";
+      url = "https://github.com/emirozer/kubectl-doctor/commit/a987ef58063e305409034af280d688a11682dbb9.patch";
+      sha256 = "sha256-NQd/WxUfYwBDowhnoUWaOV8k7msiOhff3Bjux+a9R9E=";
+    })
+  ];
+
+  vendorSha256 = "sha256-qhffg/s1RZFNW0nHLbJ89yqLzdC72ARXdbSfMLJK2pQ=";
 
   postInstall = ''
     mv $out/bin/{cmd,kubectl-doctor}

pkgs/applications/networking/cluster/nomad/1.2.nix

···
 
 callPackage ./generic.nix {
   inherit buildGoModule;
-  version = "1.2.12";
-  sha256 = "sha256-PdMo96/foN7rSNvMOQ16N3advy+h0GX7LYtfl23xRfs=";
-  vendorSha256 = "sha256-fmqhaM3yK2ThiD+qwQTr+d5FqhZWzkwcGTSPdXNNFTU=";
+  version = "1.2.13";
+  sha256 = "sha256-yDcvN6cKG1BlBq1ygYB58bS1YRHWqJgLXRlqI7lrW1A=";
+  vendorSha256 = "sha256-dPErDlJ4oNpER3Ij4yrN77V8sZvDUuXY7dM39u9xT4I=";
 }

pkgs/applications/networking/cluster/nomad/1.3.nix

···
 
 callPackage ./generic.nix {
   inherit buildGoModule;
-  version = "1.3.5";
-  sha256 = "sha256-WKS7EfZxysy/oyq1fa8rKvmfgHRiB7adSVhALZNFYgo=";
-  vendorSha256 = "sha256-byc6wAxpqhxlN3kyHyFQeBS9/oIjHeoz6ldYskizgaI=";
+  version = "1.3.6";
+  sha256 = "sha256-E1+QFaakAsqeXxAfY80ExWVIud7Q/q2TaUVsmADjsgo=";
+  vendorSha256 = "sha256-kgTRjPr7GsoBeE/s9wrmUWE5jv1ZmszfVDsVaRbdx14=";
 }

pkgs/applications/networking/cluster/nomad/1.4.nix

···
+{ callPackage
+, buildGoModule
+}:
+
+callPackage ./generic.nix {
+  inherit buildGoModule;
+  version = "1.4.0";
+  sha256 = "sha256-iAAnXhJdfgBsuBsuIkFQB4AbTplX3HJuf5HfUGAUEeM=";
+  vendorSha256 = "sha256-kfT2UGC8Wl7CM9lOU75UqKc0/O1okGCoGDpmQntakbU=";
+}

pkgs/data/misc/v2ray-geoip/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202209290111";
+  version = "202210060105";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "1aa11a6dd94b708175a81b12037486459fa090a8";
-    sha256 = "sha256-CVze/QyoBKZmd+U8bfjxr+u8W95W+fs9+mAdPgyIpg4=";
+    rev = "0bb2420d643555aa19b21f3c06b517a7c14826b6";
+    sha256 = "sha256-5vr7iO2vny9yalJblBVgNwupEQ9w3LZXM+VKb4xSVD0=";
   };
 
   installPhase = ''

pkgs/development/lua-modules/generated-packages.nix

···
 }) {};
 
 busted = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, penlight, luafilesystem, dkjson, lua_cliargs, lua, say, mediator_lua, luasystem, lua-term, luassert
+, fetchgit, say, luassert, lua_cliargs, luasystem, luafilesystem, lua, mediator_lua, penlight, lua-term, dkjson
 }:
 buildLuarocksPackage {
   pname = "busted";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ penlight luafilesystem dkjson lua_cliargs lua say mediator_lua luasystem lua-term luassert ];
+  propagatedBuildInputs = [ say luassert lua_cliargs luasystem luafilesystem lua mediator_lua penlight lua-term dkjson ];
 
   meta = {
     homepage = "https://lunarmodules.github.io/busted/";
···
 }) {};
 
 cassowary = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, penlight, lua
+, fetchgit, lua, penlight
 }:
 buildLuarocksPackage {
   pname = "cassowary";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ penlight lua ];
+  propagatedBuildInputs = [ lua penlight ];
 
   meta = {
     homepage = "https://github.com/sile-typesetter/cassowary.lua";
···
 }) {};
 
 digestif = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lpeg, lua
+, fetchgit, lua, lpeg
 }:
 buildLuarocksPackage {
   pname = "digestif";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.3");
-  propagatedBuildInputs = [ lpeg lua ];
+  propagatedBuildInputs = [ lua lpeg ];
 
   meta = {
     homepage = "https://github.com/astoff/digestif/";
···
 }) {};
 
 fluent = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, penlight, cldr, luaepnf, lua
+, fetchgit, luaepnf, penlight, cldr, lua
 }:
 buildLuarocksPackage {
   pname = "fluent";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ penlight cldr luaepnf lua ];
+  propagatedBuildInputs = [ luaepnf penlight cldr lua ];
 
   meta = {
     homepage = "https://github.com/alerque/fluent-lua";
···
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lewis6991/gitsigns.nvim",
-  "rev": "d7e0bcbe45bd9d5d106a7b2e11dc15917d272c7a",
-  "date": "2022-09-01T14:06:41+01:00",
-  "path": "/nix/store/3i20afjhjknqk3wggbrk3kwcbnnjqqxd-gitsigns.nvim",
-  "sha256": "1h4gxyamynwygxpqfib2a7sd1xbi6sh8ixg85j6qiaqqpahr0a4k",
+  "rev": "f98c85e7c3d65a51f45863a34feb4849c82f240f",
+  "date": "2022-09-19T00:23:17+01:00",
+  "path": "/nix/store/7gx7accssqrpn18g9325a8d4wx48467b-gitsigns.nvim",
+  "sha256": "0ljzja43jdkv77nh4253x3gwk2hjx968yk7b5ag4y1mvyp1540qn",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
···
 }) {};
 
 http = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchzip, basexx, lpeg_patterns, compat53, bit32, fifo, lua, binaryheap, cqueues, lpeg, luaossl
+, fetchzip, compat53, lpeg, cqueues, luaossl, bit32, lua, binaryheap, basexx, lpeg_patterns, fifo
 }:
 buildLuarocksPackage {
   pname = "http";
···
   };
 
   disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ basexx lpeg_patterns compat53 bit32 fifo lua binaryheap cqueues lpeg luaossl ];
+  propagatedBuildInputs = [ compat53 lpeg cqueues luaossl bit32 lua binaryheap basexx lpeg_patterns fifo ];
 
   meta = {
     homepage = "https://github.com/daurnimator/lua-http";
···
   };
 }) {};
 
+jsregexp = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
+, fetchgit, lua
+}:
+buildLuarocksPackage {
+  pname = "jsregexp";
+  version = "0.0.5-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/jsregexp-0.0.5-1.rockspec";
+    sha256 = "03zln61vxrgml71chrqdz8id076610rb0n9f2yah2nvjfpqpla68";
+  }).outPath;
+  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
+  "url": "https://github.com/kmarius/jsregexp.git",
+  "rev": "dd65498ae2c29b882d6c02c0a30577b08d660b94",
+  "date": "2022-08-16T21:04:46+02:00",
+  "path": "/nix/store/6kalvlazs50gna9k4ah0wg2avlah6nmr-jsregexp",
+  "sha256": "01hxql0z3yyzd17r3kyjx2kx0ng7zjc8dp2h2gqmpmjb9ssd4sf1",
+  "fetchLFS": false,
+  "fetchSubmodules": true,
+  "deepClone": false,
+  "leaveDotGit": false
+}
+ '') ["date" "path"]) ;
+
+  disabled = with lua; (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = {
+    homepage = "https://github.com/kmarius/jsregexp";
+    description = "javascript (ECMA19) regular expressions for lua";
+    license.fullName = "MIT";
+  };
+}) {};
+
 ldbus = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
 , fetchgit, lua
 }:
···
 }) {};
 
 lpeg_patterns = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchzip, lua, lpeg
+, fetchzip, lpeg, lua
 }:
 buildLuarocksPackage {
   pname = "lpeg_patterns";
···
     sha256 = "1s3c179a64r45ffkawv9dnxw4mzwkzj00nr9z2gs5haajgpjivw6";
   };
 
-  propagatedBuildInputs = [ lua lpeg ];
+  propagatedBuildInputs = [ lpeg lua ];
 
   meta = {
     homepage = "https://github.com/daurnimator/lpeg_patterns/archive/v0.5.zip";
···
 }) {};
 
 lua-lsp = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, inspect, lpeglabel, dkjson
+, fetchgit, dkjson, inspect, lpeglabel, lua
 }:
 buildLuarocksPackage {
   pname = "lua-lsp";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.4");
-  propagatedBuildInputs = [ lua inspect lpeglabel dkjson ];
+  propagatedBuildInputs = [ dkjson inspect lpeglabel lua ];
 
   meta = {
     homepage = "https://github.com/Alloyed/lua-lsp";
···
 }) {};
 
 lua-resty-openidc = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua-resty-http, lua-resty-jwt, lua-resty-session, lua
+, fetchgit, lua-resty-http, lua, lua-resty-session, lua-resty-jwt
 }:
 buildLuarocksPackage {
   pname = "lua-resty-openidc";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ lua-resty-http lua-resty-jwt lua-resty-session lua ];
+  propagatedBuildInputs = [ lua-resty-http lua lua-resty-session lua-resty-jwt ];
 
   meta = {
     homepage = "https://github.com/zmartzone/lua-resty-openidc";
···
 }) {};
 
 luacheck = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, luafilesystem, argparse
+, fetchgit, lua, argparse, luafilesystem
 }:
 buildLuarocksPackage {
   pname = "luacheck";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ lua luafilesystem argparse ];
+  propagatedBuildInputs = [ lua argparse luafilesystem ];
 
   meta = {
     homepage = "https://github.com/lunarmodules/luacheck";
···
 }) {};
 
 luadbi-mysql = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, luadbi
+, fetchgit, luadbi, lua
 }:
 buildLuarocksPackage {
   pname = "luadbi-mysql";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.4");
-  propagatedBuildInputs = [ lua luadbi ];
+  propagatedBuildInputs = [ luadbi lua ];
 
   meta = {
     homepage = "https://github.com/mwild1/luadbi";
···
 }) {};
 
 luadbi-postgresql = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, luadbi, lua
+, fetchgit, lua, luadbi
 }:
 buildLuarocksPackage {
   pname = "luadbi-postgresql";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.4");
-  propagatedBuildInputs = [ luadbi lua ];
+  propagatedBuildInputs = [ lua luadbi ];
 
   meta = {
     homepage = "https://github.com/mwild1/luadbi";
···
 }) {};
 
 luaepnf = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, lpeg
+, fetchgit, lpeg, lua
 }:
 buildLuarocksPackage {
   pname = "luaepnf";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.5");
-  propagatedBuildInputs = [ lua lpeg ];
+  propagatedBuildInputs = [ lpeg lua ];
 
   meta = {
     homepage = "http://siffiejoe.github.io/lua-luaepnf/";
···
 }:
 buildLuarocksPackage {
   pname = "lualogging";
-  version = "1.6.0-2";
+  version = "1.7.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lualogging-1.6.0-2.rockspec";
-    sha256 = "1235sfss0gmcw744rnhzfffhd1z732g2b2vsbpbz9kcvvhznmamb";
+    url    = "mirror://luarocks/lualogging-1.7.0-1.rockspec";
+    sha256 = "1h6zrhp3jvx4257gkskg8b6kd7pm6pd9wzhqb20vllyhj5vfb53h";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/lualogging.git",
-  "rev": "0bc4415de03ff1a99c92c02a5bed14a45b078079",
-  "date": "2021-11-09T20:20:42+01:00",
-  "path": "/nix/store/p3cyhqjw12bj7s6y4hndzqdkdfwq3958-lualogging",
-  "sha256": "18664k4kfi4zq9n0217j57h42li6ws8s3f6d4yj0rcqsl19fxa7c",
+  "rev": "540df4424165b622d7c408b1f9d2d3420a5206e8",
+  "date": "2022-09-21T22:50:18+02:00",
+  "path": "/nix/store/69jb23b1gv0pcb20jwan342zzp0zjw1f-lualogging",
+  "sha256": "1rwbf593qx67cbk45vm155d7ws1y0xgxmwca508l8clq7d6rv3x0",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
···
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/rktjmp/lush.nvim",
-  "rev": "6b9f399245de7bea8dac2c3bf91096ffdedfcbb7",
-  "date": "2022-08-10T01:43:55+10:00",
-  "path": "/nix/store/ljfhbz8s6pjnngbixk3m6ivpb7nx1gv0-lush.nvim",
-  "sha256": "0rb77rwmbm438bmbjfk5hwrrcn5sihsa1413bdpc27rw3rrn8v8z",
+  "rev": "fabf012e243bc58c4785ab4c44f05e94b34c431a",
+  "date": "2022-09-14T20:24:03+10:00",
+  "path": "/nix/store/z7nnsj480w2v8i3w0idy0z49yysvsa90-lush.nvim",
+  "sha256": "0bxxdlbay4r48xng1djljbgb93ls3xa83nb79gzvagfaiwgf6pn8",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
···
 }) {};
 
 moonscript = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, luafilesystem, lpeg, argparse
+, fetchgit, argparse, lua, lpeg, luafilesystem
 }:
 buildLuarocksPackage {
   pname = "moonscript";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ lua luafilesystem lpeg argparse ];
+  propagatedBuildInputs = [ argparse lua lpeg luafilesystem ];
 
   meta = {
     homepage = "http://moonscript.org";
···
 }) {};
 
 nvim-client = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchurl, coxpcall, luv, mpack, lua
+, fetchurl, luv, coxpcall, mpack, lua
 }:
 buildLuarocksPackage {
   pname = "nvim-client";
···
   };
 
   disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ coxpcall luv mpack lua ];
+  propagatedBuildInputs = [ luv coxpcall mpack lua ];
 
   meta = {
     homepage = "https://github.com/neovim/lua-client";
···
 }) {};
 
 penlight = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, luafilesystem, lua
+, fetchgit, lua, luafilesystem
 , busted}:
 buildLuarocksPackage {
   pname = "penlight";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ luafilesystem lua ];
+  propagatedBuildInputs = [ lua luafilesystem ];
   checkInputs = [ busted ];
 
   meta = {
···
 }) {};
 
 plenary-nvim = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, luassert
+, fetchgit, luassert, lua
 }:
 buildLuarocksPackage {
   pname = "plenary.nvim";
···
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/nvim-lua/plenary.nvim",
-  "rev": "4b66054e75356ac0b909bbfee9c682e703f535c2",
-  "date": "2022-09-03T11:21:04+02:00",
-  "path": "/nix/store/gaphh0qlf40ryk2000plscvzcbzg0kz5-plenary.nvim",
-  "sha256": "1yl5m7is35bk30swr5m1pcl2i0wf8gjcnas6bpahlxqa4x0yr1x8",
+  "rev": "4b7e52044bbb84242158d977a50c4cbcd85070c7",
+  "date": "2022-10-01T09:05:53+02:00",
+  "path": "/nix/store/hkj69cqq4qg3d98irg8wszgl7i1bg6lv-plenary.nvim",
+  "sha256": "11815h0h2mf5ym282ghk7xav90635r88qbgaflpgbyk2banl31wl",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.4");
-  propagatedBuildInputs = [ lua luassert ];
+  propagatedBuildInputs = [ luassert lua ];
 
   meta = {
     homepage = "http://github.com/nvim-lua/plenary.nvim";
···
 }) {};
 
 readline = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchurl, luaposix, lua
+, fetchurl, lua, luaposix
 }:
 buildLuarocksPackage {
   pname = "readline";
-  version = "3.1-0";
+  version = "3.2-0";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/readline-3.1-0.rockspec";
-    sha256 = "0bl5hsplnlg8fx3v83sz48y2p1rlxfig3iycnk1pn3xi724kscnc";
+    url    = "mirror://luarocks/readline-3.2-0.rockspec";
+    sha256 = "1r0sgisxm4xd1r6i053iibxh30j7j3rcj4wwkd8rzkj8nln20z24";
   }).outPath;
   src = fetchurl {
-    url    = "http://www.pjb.com.au/comp/lua/readline-3.1.tar.gz";
-    sha256 = "0i02jsywj9mb4lwiyp742xgz53i9z5xzpx34lh54hcd6q3xkcrw2";
+    url    = "http://www.pjb.com.au/comp/lua/readline-3.2.tar.gz";
+    sha256 = "1mk9algpsvyqwhnq7jlw4cgmfzj30l7n2r6ak4qxgdxgc39f48k4";
   };
 
   disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.5");
-  propagatedBuildInputs = [ luaposix lua ];
+  propagatedBuildInputs = [ lua luaposix ];
 
   meta = {
     homepage = "http://pjb.com.au/comp/lua/readline.html";
···
   meta = {
     homepage = "https://github.com/rest-nvim/rest.nvim";
     description = "A fast Neovim http client written in Lua";
+    maintainers = with lib.maintainers; [ teto ];
     license.fullName = "MIT";
   };
 }) {};
···
 }) {};
 
 std-normalize = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, std-_debug
+, fetchgit, std-_debug, lua
 }:
 buildLuarocksPackage {
   pname = "std.normalize";
···
  '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.5");
-  propagatedBuildInputs = [ lua std-_debug ];
+  propagatedBuildInputs = [ std-_debug lua ];
 
   meta = {
     homepage = "https://lua-stdlib.github.io/normalize";
···
 }) {};
 
 tl = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, compat53, luafilesystem, argparse
+, fetchgit, argparse, luafilesystem, compat53
 , dkjson}:
 buildLuarocksPackage {
   pname = "tl";
···
 }
  '') ["date" "path"]) ;
 
-  propagatedBuildInputs = [ compat53 luafilesystem argparse ];
+  propagatedBuildInputs = [ argparse luafilesystem compat53 ];
   checkInputs = [ dkjson ];
 
   meta = {

pkgs/development/python-modules/detect-secrets/default.nix

···
 
 buildPythonPackage rec {
   pname = "detect-secrets";
-  version = "1.3.0";
+  version = "1.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "Yelp";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Dl/2HgCacDko/ug9nGA9X+LyOkuDot11H28lxrgkwdE=";
+    hash = "sha256-6EmL6XPySqcA3EA+FFkfw7Dkxl5LvyBorIw0hesV5eU=";
     leaveDotGit = true;
   };
 

pkgs/development/python-modules/slack-sdk/default.nix

···
 
 buildPythonPackage rec {
   pname = "slack-sdk";
-  version = "3.18.5";
+  version = "3.19.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
···
     owner = "slackapi";
     repo = "python-slack-sdk";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-b778qmf0LkSAo8/eho1zoC0kc4byexqCG3R/fRBlr6M=";
+    sha256 = "sha256-DYDyWlNl/3SjSiA0kyMfz4/t42Oxh7VX43ZDL94eFzo=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/slither-analyzer/default.nix

···
 
 buildPythonPackage rec {
   pname = "slither-analyzer";
-  version = "0.8.3";
+  version = "0.9.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "crytic";
     repo = "slither";
-    rev = version;
-    sha256 = "sha256-Kh5owlkRB9hDlfIRiS+aNFe4YtZj38CLeE3Fe+R7diM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Td7WBPpc+ZYlFroZNzvUqQZJag0lbkCgj8TVOPrAAPY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/twilio/default.nix

···
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "7.14.1";
+  version = "7.14.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
···
     owner = "twilio";
     repo = "twilio-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-VKAeM1a1TMXrewJ+j+Outyp7vxh9xovqjJ+GneYa6eg=";
+    hash = "sha256-lamP7ltKLizwPGX1063bZ90M89oPmXVSogi3HNksvHE=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/types-pytz/default.nix

···
 
 buildPythonPackage rec {
   pname = "types-pytz";
-  version = "2022.2.1.0";
+  version = "2022.4.0.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-R8+xnFK591iWRAVB2zkv0xKjWyecYwelMdtxFS6mPis=";
+    sha256 = "sha256-F9ZuSxboDOrgeHcm86IiiN99P5/evrCR3GS5LA5OoJ0=";
   };
 
   # Modules doesn't have tests

pkgs/development/python-modules/weconnect-mqtt/default.nix

···
 
 buildPythonPackage rec {
   pname = "weconnect-mqtt";
-  version = "0.40.1";
+  version = "0.40.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "tillsteinbach";
     repo = "WeConnect-mqtt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WnaVE9WEJmdlxsPUZcEmeCf4DK1GCyd2yQmBiQZ7NkI=";
+    hash = "sha256-TRBS51ZlE4TbDAQdQyODUNDVfIuKZtrf38iBPIGyRhI=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/bashate/default.nix

···
 
 buildPythonApplication rec {
   pname = "bashate";
-  version = "2.1.0";
+  version = "2.1.1";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a0df143639715dc2fb6cf9aa6907e4a372d6f0a43afeffc55c5fb3ecfe3523c8";
+    sha256 = "sha256-S6tul3+DBacgU1+Pk/H7QsUh/LxKbCs9PXZx9C8iH0w=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/wp4nix/default.nix

···
-{ lib, buildGoModule, fetchFromGitLab, nix, subversion }:
+{ lib
+, buildGoModule
+, fetchFromGitLab
+, nix
+, subversion
+, makeWrapper
+}:
 
 buildGoModule rec {
   pname = "wp4nix";
···
 
   vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
 
-  postPatch = ''
-    substituteInPlace main.go --replace nix-hash ${nix}/bin/nix-hash
-    substituteInPlace svn.go --replace '"svn"' '"${subversion}/bin/svn"'
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/wp4nix \
+      --prefix PATH : ${lib.makeBinPath [ nix subversion ]}
   '';
 
   meta = with lib; {

pkgs/servers/dict/dictd-db.nix

···
     url = "mirror://sourceforge/freedict/eng-fra.tar.gz";
     sha256 = "0fi6rrnbqnhc6lq8d0nmn30zdqkibrah0mxfg27hsn9z7alwbj3m";
   }) "eng-fra" "en_UK";
+  jpn2eng = makeDictdDB (fetchurl {
+    url = let version = "0.1";
+          in "mirror://sourceforge/freedict/jpn-eng/${version}/freedict-jpn-eng-${version}.dictd.tar.xz";
+    sha256 = "sha256-juJBoEq7EztLZzOomc7uoZhXVaQPKoUvIxxPLB0xByc=";
+  }) "jpn-eng" "jpn-eng" "ja_JP";
+  eng2jpn = makeDictdDB (fetchurl {
+    url = let version = "2022.04.06";
+          in "https://download.freedict.org/dictionaries/eng-jpn/${version}/freedict-eng-jpn-${version}.dictd.tar.xz";
+    sha256 = "sha256-kfRT2kgbV3XKarCr4mqDRT5A1jR8M8APky5M5MFYatE=";
+  }) "eng-jpn" "eng-jpn" "en_UK";
   mueller_eng2rus_pkg = makeDictdDB (fetchurl {
     url = "mirror://sourceforge/mueller-dict/mueller-dict-3.1.tar.gz";
     sha256 = "04r5xxznvmcb8hkxqbjgfh2gxvbdd87jnhqn5gmgvxxw53zpwfmq";

pkgs/servers/klipper/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "klipper";
-  version = "unstable-2022-09-16";
+  version = "unstable-2022-10-06";
 
   src = fetchFromGitHub {
     owner = "KevinOConnor";
     repo = "klipper";
-    rev = "7527e57e5a778d069aaa05b01e03869c63a1a712";
-    sha256 = "sha256-k3tvV7uCdmPN4SvZixvPmOqt5jTN9tz0W6SUXN5g3Ss=";
+    rev = "7290c14531211d027b430f36db5645ce496be900";
+    sha256 = "sha256-+BSsk2G6g4IJsbG6pggYb9vcaezqNUXEAXXAcMMhAfw=";
   };
 
   sourceRoot = "source/klippy";

pkgs/servers/nextcloud/default.nix

···
   '';
 
   nextcloud23 = generic {
-    version = "23.0.9";
-    sha256 = "sha256-Ysxapp8IpRcRBC3CRM4yxoGYCuedAVURT3FhDD4jNBY=";
+    version = "23.0.10";
+    sha256 = "c68cff7f40b1e73e8d173f068e7d9c02d37e3f94a6a36a556a49c3ff5def4267";
   };
 
   nextcloud24 = generic {
-    version = "24.0.5";
-    sha256 = "sha256-sieIN3zLk5Hn+eztP2mpI2Zprqqy4OpSUKc+318e8CY=";
+    version = "24.0.6";
+    sha256 = "b26dff9980a47e7e722805fdbbf87e07f59a3817b03ecc32698e028e9baf0301";
   };
 
   # tip: get the sha with:

pkgs/servers/syncstorage-rs/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "syncstorage-rs";
-  version = "0.12.0";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "mozilla-services";
     repo = pname;
     rev = version;
-    hash = "sha256-VfIpjpBS7LXe32fxIFp7xmbm40VwxUdHIEm5PnMpd4s=";
+    hash = "sha256-al3SgpJPg8dfdghV1dl00wShrKSJFegRVTilaOi0RHQ=";
   };
 
   nativeBuildInputs = [
···
       --prefix PATH : ${lib.makeBinPath [ pyFxADeps ]}
   '';
 
-  cargoSha256 = "sha256-JXxArKA/2SIYJvjNA1yZHR9xDKt3N2U7HVMP/6M3BxE=";
+  cargoSha256 = "sha256-+9Yi+oKctFiTR8cXN6ajtwKEC0kkOP3+kPfUPSYsx5A=";
 
   buildFeatures = [ "grpcio/openssl" ];
 

pkgs/servers/teleport/default.nix

···
 , makeWrapper
 , symlinkJoin
 , CoreFoundation
+, libfido2
 , openssl
 , pkg-config
 , protobuf
···
 , nixosTests
 
 , withRdpClient ? true
-, withRoleTester ? true
 }:
 let
   # This repo has a private submodule "e" which fetchgit cannot handle without failing.
···
     owner = "gravitational";
     repo = "teleport";
     rev = "v${version}";
-    sha256 = "sha256-KQfdeMuZ9LJHhEJLMl58Yb0+gxgDT7VcVnK1JxjVZaI=";
+    hash = "sha256-F5v3/eKPLhSxW7FImTbE+QMtfn8w5WVTrxMWhgNr3YA=";
   };
-  version = "9.1.2";
+  version = "10.3.1";
 
   rdpClient = rustPlatform.buildRustPackage rec {
-    name = "teleport-rdpclient";
-    cargoSha256 = "sha256-Jz7bB/f4HRxBhSevmfELSrIm+IXUVlADIgp2qWQd5PY=";
+    pname = "teleport-rdpclient";
+    cargoHash = "sha256-Xmabjoq1NXxXemeR06Gg8R/HwdSE+rsxxX645pQ3SuI=";
     inherit version src;
 
     buildAndTestSubdir = "lib/srv/desktop/rdp/rdpclient";
···
     OPENSSL_NO_VENDOR = "1";
 
     postInstall = ''
-      cp -r target $out
-    '';
-  };
-
-  roleTester = rustPlatform.buildRustPackage {
-    name = "teleport-roletester";
-    inherit version src;
-
-    cargoSha256 = "sha256-gCm4ETbXy6tGJQVSzUkoAWUmKD3poYgkw133LtziASI=";
-    buildAndTestSubdir = "lib/datalog/roletester";
-
-    PROTOC = "${protobuf}/bin/protoc";
-    PROTOC_INCLUDE = "${protobuf}/include";
-
-    postInstall = ''
-      cp -r target $out
+      mkdir -p $out/include
+      cp ${buildAndTestSubdir}/librdprs.h $out/include/
     '';
   };
 
   webassets = fetchFromGitHub {
     owner = "gravitational";
     repo = "webassets";
-    rev = "67e608db77300d8a6cb17709be67f12c1d3271c3";
-    sha256 = "sha256-o4qjXGaNi5XDSUQrUuU+G77EdRnvJ1WUPWrryZU1CUE=";
+    # Submodule rev from https://github.com/gravitational/teleport/tree/v10.3.1
+    rev = "6710dcd0dc19ad101bac3259c463ef940f2ab1f3";
+    hash = "sha256-A13FSpgJODmhugAwy4kqiDw4Rihr//DhQX/bjwaeo2A=";
   };
 in
 buildGoModule rec {
   pname = "teleport";
 
   inherit src version;
-  vendorSha256 = "sha256-UMgWM7KHag99JR4i4mwVHa6yd9aHQ6Dy+pmUijNL4Ew=";
+  vendorHash = "sha256-2Zrd3CbZvxns9lNVtwaaor1mi97IhPc+MRJhj3rU760=";
 
   subPackages = [ "tool/tbot" "tool/tctl" "tool/teleport" "tool/tsh" ];
-  tags = [ "webassets_embed" ]
-    ++ lib.optional withRdpClient "desktop_access_rdp"
-    ++ lib.optional withRoleTester "roletester";
+  tags = [ "libfido2" "webassets_embed" ]
+    ++ lib.optional withRdpClient "desktop_access_rdp";
 
-  buildInputs = [ openssl ]
+  buildInputs = [ openssl libfido2 ]
     ++ lib.optionals (stdenv.isDarwin && withRdpClient) [ CoreFoundation Security ];
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper pkg-config ];
 
   patches = [
     # https://github.com/NixOS/nixpkgs/issues/120738
···
   # Reduce closure size for client machines
   outputs = [ "out" "client" ];
 
-  preBuild =
-    let rustDeps = symlinkJoin {
-      name = "teleport-rust-deps";
-      paths = lib.optional withRdpClient rdpClient
-        ++ lib.optional withRoleTester roleTester;
-    };
-    in
-    ''
-      mkdir -p build
-      echo "making webassets"
-      cp -r ${webassets}/* webassets/
-      make lib/web/build/webassets
-
-      cp -r ${rustDeps}/. .
-    '';
+  preBuild = ''
+    mkdir -p build
+    echo "making webassets"
+    cp -r ${webassets}/* webassets/
+    make -j$NIX_BUILD_CORES lib/web/build/webassets
+  '' + lib.optionalString withRdpClient ''
+    ln -s ${rdpClient}/lib/* lib/
+    ln -s ${rdpClient}/include/* lib/srv/desktop/rdp/rdpclient/
+  '';
 
   # Multiple tests fail in the build sandbox
   # due to trying to spawn nixbld's shell (/noshell), etc.
   doCheck = false;
 
   postInstall = ''
-    install -Dm755 -t $client/bin $out/bin/tsh
+    mkdir -p $client/bin
+    mv {$out,$client}/bin/tsh
     # make xdg-open overrideable at runtime
     wrapProgram $client/bin/tsh --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
-    wrapProgram $out/bin/tsh --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
+    ln -s {$client,$out}/bin/tsh
   '';
 
   doInstallCheck = true;

pkgs/servers/teleport/rdpclient.patch

···
 diff --git a/lib/srv/desktop/rdp/rdpclient/client.go b/lib/srv/desktop/rdp/rdpclient/client.go
-index d191c768f..71117a30d 100644
+index 4357d7aa1..7e21a0076 100644
 --- a/lib/srv/desktop/rdp/rdpclient/client.go
 +++ b/lib/srv/desktop/rdp/rdpclient/client.go
-@@ -56,10 +56,10 @@ package rdpclient
- #cgo linux,amd64 LDFLAGS: -L${SRCDIR}/../../../../../target/x86_64-unknown-linux-gnu/release
- #cgo linux,arm LDFLAGS: -L${SRCDIR}/../../../../../target/arm-unknown-linux-gnueabihf/release
- #cgo linux,arm64 LDFLAGS: -L${SRCDIR}/../../../../../target/aarch64-unknown-linux-gnu/release
+@@ -52,14 +52,9 @@ package rdpclient
+ 
+ /*
+ // Flags to include the static Rust library.
+-#cgo linux,386 LDFLAGS: -L${SRCDIR}/../../../../../target/i686-unknown-linux-gnu/release
+-#cgo linux,amd64 LDFLAGS: -L${SRCDIR}/../../../../../target/x86_64-unknown-linux-gnu/release
+-#cgo linux,arm LDFLAGS: -L${SRCDIR}/../../../../../target/arm-unknown-linux-gnueabihf/release
+-#cgo linux,arm64 LDFLAGS: -L${SRCDIR}/../../../../../target/aarch64-unknown-linux-gnu/release
 -#cgo linux LDFLAGS: -l:librdp_client.a -lpthread -ldl -lm
-+#cgo linux LDFLAGS: -l:librdp_client.a -lpthread -ldl -lm -lssl -lcrypto
- #cgo darwin,amd64 LDFLAGS: -L${SRCDIR}/../../../../../target/x86_64-apple-darwin/release
- #cgo darwin,arm64 LDFLAGS: -L${SRCDIR}/../../../../../target/aarch64-apple-darwin/release
+-#cgo darwin,amd64 LDFLAGS: -L${SRCDIR}/../../../../../target/x86_64-apple-darwin/release
+-#cgo darwin,arm64 LDFLAGS: -L${SRCDIR}/../../../../../target/aarch64-apple-darwin/release
 -#cgo darwin LDFLAGS: -framework CoreFoundation -framework Security -lrdp_client -lpthread -ldl -lm
-+#cgo darwin LDFLAGS: -framework CoreFoundation -framework Security -lrdp_client -lpthread -ldl -lm -lssl -lcrypto
++#cgo LDFLAGS: -L${SRCDIR}/../../../../../lib -lpthread -ldl -lm -lssl -lcrypto
++#cgo linux LDFLAGS: -l:librdp_client.a
++#cgo darwin LDFLAGS: -framework CoreFoundation -framework Security -lrdp_client
  #include <librdprs.h>
  */
  import "C"

pkgs/servers/web-apps/wordpress/packages/README.md

···
+= Adding plugin, theme or language =
+
+To extend the wordpressPackages set, add a new line to the corresponding json
+file with the codename of the package:
+
+- `wordpress-languages.json` for language packs
+- `wordpress-themes.json` for themes
+- `wordpress-plugins.json` for plugins
+
+The codename is the last part in the url of the plugin or theme page, for
+example `cookie-notice` in in the url
+`https://wordpress.org/plugins/cookie-notice/` or `twentytwenty` in
+`https://wordpress.org/themes/twentytwenty/`.
+
+In case of language packages, the name consists of country and language codes.
+For example `de_DE` for country code `de` (Germany) and language `DE` (German).
+For available translations and language codes see [upstream translation repository](https://translate.wordpress.org).
+
+To regenerate the nixpkgs wordpressPackages set, run:
+
+``` 
+./generate.sh
+``` 
+
+After that you can commit and submit the changes.
+
+= Usage with the Wordpress module =
+
+The plugins will be available in the namespace `wordpressPackages.plugins`.
+Using it together with the Wordpress module could look like this:
+
+``` 
+services.wordpress = {
+  sites."blog.${config.networking.domain}" = {
+    plugins = with pkgs.wordpressPackages.plugins; [
+      anti-spam-bee
+      code-syntax-block
+      cookie-notice
+      lightbox-with-photoswipe
+      wp-gdpr-compliance
+    ];
+  };
+};
+```
+
+The same scheme applies to `themes` and `languages`.

pkgs/servers/web-apps/wordpress/packages/default.nix

···
+# Source: https://git.helsinki.tools/helsinki-systems/wp4nix/-/blob/master/default.nix
+# Licensed under: MIT
+# Slightly modified
+
+{ lib, newScope, plugins, themes, languages }:
+
+let packages = self:
+  let
+    generatedJson = {
+      inherit plugins themes languages;
+    };
+
+  in {
+    # Create a generic WordPress package. Most arguments are just passed
+    # to `mkDerivation`. The version is automatically filtered for weird characters.
+    mkWordpressDerivation = self.callPackage ({ stdenvNoCC, lib, filterWPString, gettext, wp-cli }:
+      { type, pname, version, ... }@args:
+        assert lib.any (x: x == type) [ "plugin" "theme" "language" ];
+        stdenvNoCC.mkDerivation ({
+          pname = "wordpress-${type}-${pname}";
+          version = filterWPString version;
+
+          dontConfigure = true;
+          dontBuild = true;
+
+          installPhase = ''
+            runHook preInstall
+            cp -R ./. $out
+            runHook postInstall
+          '';
+
+          passthru = {
+            wpName = pname;
+          } // (args.passthru or {});
+        } // lib.optionalAttrs (type == "language") {
+          nativeBuildInputs = [ gettext wp-cli ];
+          dontBuild = false;
+          buildPhase = ''
+            runHook preBuild
+
+            find -name '*.po' -print0 | while IFS= read -d "" -r po; do
+              msgfmt -o $(basename "$po" .po).mo "$po"
+            done
+            wp i18n make-json .
+            rm *.po
+
+            runHook postBuild
+          '';
+        } // removeAttrs args [ "type" "pname" "version" "passthru" ])) {};
+
+    # Create a derivation from the official wordpress.org packages.
+    # This takes the type, the pname and the data generated from the go tool.
+    mkOfficialWordpressDerivation = self.callPackage ({ mkWordpressDerivation, fetchWordpress }:
+      { type, pname, data }:
+      mkWordpressDerivation {
+        inherit type pname;
+        version = data.version;
+
+        src = fetchWordpress type data;
+      }) {};
+
+    # Filter out all characters that might occur in a version string but that that are not allowed
+    # in store paths.
+    filterWPString = builtins.replaceStrings [ " " "," "/" "&" ";" ''"'' "'" "$" ":" "(" ")" "[" "]" "{" "}" "|" "*" "\t" ] [ "_" "." "." "" "" "" "" "" "" "" "" "" "" "" "" "-" "" "" ];
+
+    # Fetch a package from the official wordpress.org SVN.
+    # The data supplied is the data straight from the go tool.
+    fetchWordpress = self.callPackage ({ fetchsvn }: type: data: fetchsvn {
+      inherit (data) rev sha256;
+      url = if type == "plugin" || type == "theme" then
+        "https://" + type + "s.svn.wordpress.org/" + data.path
+      else if type == "language" then
+        "https://i18n.svn.wordpress.org/core/" + data.version + "/" + data.path
+      else if type == "pluginLanguage" then
+        "https://i18n.svn.wordpress.org/plugins/" + data.path
+      else if type == "themeLanguage" then
+        "https://i18n.svn.wordpress.org/themes/" + data.path
+      else
+        throw "fetchWordpress: invalid package type ${type}";
+    }) {};
+
+  } // lib.mapAttrs (type: pkgs: lib.makeExtensible (_: lib.mapAttrs (pname: data: self.mkOfficialWordpressDerivation { type = lib.removeSuffix "s" type; inherit pname data; }) pkgs)) generatedJson;
+
+# This creates an extensible scope.
+in (lib.makeExtensible (_: (lib.makeScope newScope packages))).extend (selfWP: superWP: {})

pkgs/servers/web-apps/wordpress/packages/generate.sh

···
+#!/usr/bin/env nix-shell
+#! nix-shell -I nixpkgs=../../../../.. -i bash -p wp4nix
+
+set -e
+set -u
+set -o pipefail
+set -x
+
+NIX_VERSION=$(nix --version|cut -d ' ' -f 3|cut -c -3)
+if [[ "$NIX_VERSION" > 2.3 ]]; then
+  nixFlags="--option experimental-features nix-command eval --raw --impure --expr"
+else
+  nixFlags="eval --raw"
+fi
+
+export WP_VERSION=$(nix $nixFlags '(import <nixpkgs> {}).wordpress.version')
+
+PLUGINS=`cat wordpress-plugins.json | jq -r '.[]' | sed -z 's/\n/,/g;s/,$/\n/'`
+THEMES=`cat wordpress-themes.json | jq -r '.[]' | sed -z 's/\n/,/g;s/,$/\n/'`
+LANGUAGES=`cat wordpress-languages.json | jq -r '.[]' | sed -z 's/\n/,/g;s/,$/\n/'`
+
+wp4nix -p $PLUGINS -pl en
+wp4nix -t $THEMES -tl en
+wp4nix -l $LANGUAGES
+
+rm *.log themeLanguages.json pluginLanguages.json

pkgs/servers/web-apps/wordpress/packages/languages.json

···
+{
+  "de_DE": {
+    "path": "de_DE",
+    "rev": "932483",
+    "sha256": "1n4rf1bkr8xr6yqxd7c6s4ha3ll819fbfiqln57is9knfpdd6fnq",
+    "version": "5.8"
+  },
+  "fr_FR": {
+    "path": "fr_FR",
+    "rev": "932480",
+    "sha256": "0lmbalcvwfc6331vdazmhr2lp3w418rsp78mrj1rs7a44y8f1igj",
+    "version": "5.8"
+  }
+}

pkgs/servers/web-apps/wordpress/packages/plugins.json

···
+{
+  "add-widget-after-content": {
+    "path": "add-widget-after-content/tags/2.4.4",
+    "rev": "2671853",
+    "sha256": "0snrkd783f1qxry01858l3r0ll9381xhsig7wlmrvi1zm5jf2drc",
+    "version": "2.4.4"
+  },
+  "antispam-bee": {
+    "path": "antispam-bee/tags/2.11.1",
+    "rev": "2748316",
+    "sha256": "1hjq1yazvypc84lwcjq7za1n3s7vcxd9mc50adpinkwjjph1cgxn",
+    "version": "2.11.1"
+  },
+  "async-javascript": {
+    "path": "async-javascript/tags/2.21.08.31",
+    "rev": "2760769",
+    "sha256": "1yf3pj0nn4gyl0a2wfvznpwb7y0glxg19rgny3bh38k4pj9mli49",
+    "version": "2.21.08.31"
+  },
+  "breeze": {
+    "path": "breeze/tags/2.0.9",
+    "rev": "2786857",
+    "sha256": "0nn3kalwb50kyd563jiixc134hiygkbzs8zkxgsbgmsi511vfzkz",
+    "version": "2.0.9"
+  },
+  "co-authors-plus": {
+    "path": "co-authors-plus/tags/3.5.2",
+    "rev": "2735979",
+    "sha256": "0ph3iskixi2j6bsnlpd4x8wixzm2hbdzchnyfz9mxzzys93qb41k",
+    "version": "3.5.2"
+  },
+  "code-syntax-block": {
+    "path": "code-syntax-block/tags/3.1.1",
+    "rev": "2747615",
+    "sha256": "0dqdsl7f3ihshvly6cqd5l4cbimx5skmips514wvifspwggwmmjm",
+    "version": "3.1.1"
+  },
+  "cookie-notice": {
+    "path": "cookie-notice/tags/2.4.1",
+    "rev": "2790369",
+    "sha256": "1a1qnmi81z8c30d6zgcd5xqd08cxkq71g2hzb6xcbdv04036nf77",
+    "version": "2.4.1"
+  },
+  "disable-xml-rpc": {
+    "path": "disable-xml-rpc/tags/1.0.1",
+    "rev": "2561901",
+    "sha256": "04x5dj79bx5avx8db991nlhrpd3qv3maniqmzwnyd8ab2zblzx83",
+    "version": "1.0.1"
+  },
+  "jetpack": {
+    "path": "jetpack/tags/11.4",
+    "rev": "2794223",
+    "sha256": "123kfn6wn23sz7zv8yk8rszrxwnjgjfrm0cqpwmrs3h1plfqv7kg",
+    "version": "11.4"
+  },
+  "jetpack-lite": {
+    "path": "jetpack-lite/tags/3.0.3",
+    "rev": "1895157",
+    "sha256": "04wq8cnhzgzrhm5pjwicsnavc46n6wdmb6xf8gz4wwl1di2hl471",
+    "version": "3.0.3"
+  },
+  "lightbox-photoswipe": {
+    "path": "lightbox-photoswipe/tags/5.0.16",
+    "rev": "2790158",
+    "sha256": "1pd83v7nz2l002z1y27h97gmhcdcbvsfi8x7llrg9vzijrx0vf18",
+    "version": "5.0.16"
+  },
+  "mailpoet": {
+    "path": "mailpoet/tags/3.100.1",
+    "rev": "2795092",
+    "sha256": "0wgzmicf6mmkmkwsxxaz2d8sylvq6v0a98nbc2yswd11l4igc8ld",
+    "version": "3.100.1"
+  },
+  "opengraph": {
+    "path": "opengraph/tags/1.11.0",
+    "rev": "2730257",
+    "sha256": "133mzlccbdpppps1aq83n2az4xzikak61k4rdzg9aax23l5ggss6",
+    "version": "1.11.0"
+  },
+  "simple-login-captcha": {
+    "path": "simple-login-captcha/tags/1.3.3",
+    "rev": "2729196",
+    "sha256": "1wy9cbibbngjarc8c9qn4bil3qc8i0h2kz0k364zcsnfpwi8jk3c",
+    "version": "1.3.3"
+  },
+  "webp-converter-for-media": {
+    "path": "webp-converter-for-media/tags/5.2.4",
+    "rev": "2791011",
+    "sha256": "18y0yrngywz0zlxd67cn16nvzypb395rhsfavfyl6pq0ygymcxnm",
+    "version": "5.2.4"
+  },
+  "wp-change-email-sender": {
+    "path": "wp-change-email-sender/trunk",
+    "rev": "2655179",
+    "sha256": "0dv5604mn4ly2zm6mwqf5y8vp9cfiw70v66bimvgbahxz4i2w23q",
+    "version": "1.0"
+  },
+  "wp-gdpr-compliance": {
+    "path": "wp-gdpr-compliance/tags/2.0.20",
+    "rev": "2793947",
+    "sha256": "1vvwmi03hjyqw566m75m8lxbhnl3y4h461531a26xwsbmjgbmf9a",
+    "version": "2.0.20"
+  },
+  "wp-mail-smtp": {
+    "path": "wp-mail-smtp/tags/3.6.1",
+    "rev": "2795051",
+    "sha256": "14ry7302c4h7d7lrasiql9jiy3x54ylim3y7j5b633g5lyzadynl",
+    "version": "3.6.1"
+  },
+  "wp-statistics": {
+    "path": "wp-statistics/tags/13.2.6",
+    "rev": "2781181",
+    "sha256": "0vzlhlnna2dx4kyi24rqhbrx5n5zsw51hqgsaslfiyyir64dkzgz",
+    "version": "13.2.6"
+  },
+  "wp-user-avatars": {
+    "path": "wp-user-avatars/trunk",
+    "rev": "2540784",
+    "sha256": "1g21nl6xs9zyq0ainjwa06wl90975l8f9rj0fa20zkmw17w2mdgl",
+    "version": "1.4.1"
+  }
+}

pkgs/servers/web-apps/wordpress/packages/themes.json

···
+{
+  "twentytwentyone": {
+    "path": "twentytwentyone/1.6",
+    "rev": "168450",
+    "sha256": "0wfqdyd59hifnncjv59ywjak050gaggsvjx7r01agh44nzkr84fs",
+    "version": "1.6"
+  },
+  "twentytwentytwo": {
+    "path": "twentytwentytwo/1.2",
+    "rev": "168451",
+    "sha256": "0ry7h5bd9h97q38jmsgymm05dfml0ycdhqn7iskpdlc1nnrjrk04",
+    "version": "1.2"
+  }
+}

pkgs/servers/web-apps/wordpress/packages/wordpress-languages.json

···
+[
+  "de_DE"
+, "fr_FR"
+]

pkgs/servers/web-apps/wordpress/packages/wordpress-plugins.json

···
+[
+  "add-widget-after-content"
+, "antispam-bee"
+, "async-javascript"
+, "breeze"
+, "code-syntax-block"
+, "cookie-notice"
+, "co-authors-plus"
+, "disable-xml-rpc"
+, "jetpack"
+, "jetpack-lite"
+, "lightbox-photoswipe"
+, "mailpoet"
+, "opengraph"
+, "simple-login-captcha"
+, "webp-converter-for-media"
+, "wp-mail-smtp"
+, "wp-gdpr-compliance"
+, "wp-statistics"
+, "wp-user-avatars"
+, "wp-change-email-sender"
+]

pkgs/servers/web-apps/wordpress/packages/wordpress-themes.json

···
+[
+  "twentytwentytwo"
+, "twentytwentyone"
+]

pkgs/tools/admin/wander/default.nix

···
-{ buildGoModule, fetchFromGitHub, lib }:
+{ wander, buildGoModule, fetchFromGitHub, fetchpatch, installShellFiles, lib, testers }:
 
 buildGoModule rec {
   pname = "wander";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "robinovitch61";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-aQqJDUDYHoUZ6ixnY3lmFOx29QpRRke5XHFIpsA+Bnw=";
+    sha256 = "sha256-G/TrfnmEyomdUCN5nUS9v5iqeUzgZzMLUZnfroQLZuk=";
   };
 
-  vendorSha256 = "sha256-T+URnRLumXFz48go9TN0Wha99T03OWGfDK7cQ+zKeRI=";
+  vendorSha256 = "sha256-iTaZ5/0UrLJ3JE3FwQpvjKKrhqklG4n1WFTJhWfj/rI=";
+
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/robinovitch61/wander/commit/b3d3249541de005404a41c17a15218a4f73f68e5.patch";
+      sha256 = "sha256-z8bdSFcAqnwEu0gupxW/L1o/asyxbvTYIdtLZNmQpz8=";
+    })
+  ];
+
+  ldflags = [ "-X github.com/robinovitch61/wander/cmd.Version=v${version}" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd wander \
+      --fish <($out/bin/wander completion fish) \
+      --bash <($out/bin/wander completion bash) \
+      --zsh <($out/bin/wander completion zsh)
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = wander;
+    command = "wander --version";
+    version = "v${version}";
+  };
 
   meta = with lib; {
     description = "Terminal app/TUI for HashiCorp Nomad";

pkgs/tools/networking/dhcp/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "dhcp";
-  version = "4.4.3";
+  version = "4.4.3-P1";
 
   src = fetchurl {
     url = "https://ftp.isc.org/isc/dhcp/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Dj7GtMKgXsAUiHS82ZmmbQVRg3jXdCH2B/sLydATWBg=";
+    sha256 = "sha256-CsQWu1WZfKhjIXT9EHN/1hzbjbonUhYKM1d1vCHcc8c=";
   };
 
   patches =

pkgs/tools/networking/mosh/default.nix

···
 { lib, stdenv, fetchurl, fetchpatch, zlib, protobuf, ncurses, pkg-config
 , makeWrapper, perl, openssl, autoreconfHook, openssh, bash-completion
-, withUtempter ? stdenv.isLinux, libutempter }:
+, withUtempter ? stdenv.isLinux && !stdenv.hostPlatform.isMusl, libutempter }:
 
 stdenv.mkDerivation rec {
   pname = "mosh";

pkgs/top-level/all-packages.nix

···
   nomad_1_3 = callPackage ../applications/networking/cluster/nomad/1.3.nix {
     buildGoModule = buildGo119Module;
   };
+  nomad_1_4 = callPackage ../applications/networking/cluster/nomad/1.4.nix {
+    buildGoModule = buildGo119Module;
+  };
 
   nomad-autoscaler = callPackage ../applications/networking/cluster/nomad-autoscaler { };
 
···
 
   kuttl = callPackage ../applications/networking/cluster/kuttl { };
 
-  kubectl-doctor = callPackage ../applications/networking/cluster/kubectl-doctor {
-    # pinned due to build failure or vendoring problems. When unpinning double check with: nix-build -A $name.go-modules --rebuild
-    buildGoModule = buildGo117Module;
-  };
+  kubectl-doctor = callPackage ../applications/networking/cluster/kubectl-doctor { };
 
   kubectl-example = callPackage ../applications/networking/cluster/kubectl-example { };
 
···
   wmutils-opt = callPackage ../tools/X11/wmutils-opt { };
 
   wordpress = callPackage ../servers/web-apps/wordpress { };
+
+  wordpressPackages = ( callPackage ../servers/web-apps/wordpress/packages {
+    plugins = lib.importJSON ../servers/web-apps/wordpress/packages/plugins.json;
+    themes = lib.importJSON ../servers/web-apps/wordpress/packages/themes.json;
+    languages = lib.importJSON ../servers/web-apps/wordpress/packages/languages.json;
+  });
 
   wprecon = callPackage ../tools/security/wprecon { };
 

pkgs/top-level/perl-packages.nix

···
 
   SysVirt = buildPerlModule rec {
     pname = "Sys-Virt";
-    version = "8.5.0";
+    version = "8.8.0";
     src = fetchFromGitLab {
       owner = "libvirt";
       repo = "libvirt-perl";
       rev = "v${version}";
-      hash = "sha256-VuM4rPrG15vXnF5e1MBSGB76zLI+8nkSiJmwWg8aJgE=";
+      hash = "sha256-8maLIW4hBbMbq+rnwEfaHsUgpppaU5K4aQTwTgUjdcI=";
     };
     nativeBuildInputs = [ pkgs.pkg-config ];
     buildInputs = [ pkgs.libvirt CPANChanges TestPod TestPodCoverage XMLXPath ];