Merge master into staging-next

nixos/modules/programs/java.nix

···
 let
   cfg = config.programs.java;
 in
-
 {
 
   options = {
···
         type = types.package;
       };
 
+      binfmt = mkEnableOption (lib.mdDoc "binfmt to execute java jar's and classes");
+
     };
 
   };
 
   config = mkIf cfg.enable {
+
+    boot.binfmt.registrations = mkIf cfg.binfmt {
+      java-class = {
+        recognitionType = "extension";
+        magicOrExtension = "class";
+        interpreter = pkgs.writeShellScript "java-class-wrapper" ''
+          test -e ${cfg.package}/nix-support/setup-hook && source ${cfg.package}/nix-support/setup-hook
+          classpath=$(dirname "$1")
+          class=$(basename "''${1%%.class}")
+          $JAVA_HOME/bin/java -classpath "$classpath" "$class" "''${@:2}"
+        '';
+      };
+      java-jar = {
+        recognitionType = "extension";
+        magicOrExtension = "jar";
+        interpreter = pkgs.writeShellScript "java-jar-wrapper" ''
+          test -e ${cfg.package}/nix-support/setup-hook && source ${cfg.package}/nix-support/setup-hook
+          $JAVA_HOME/bin/java -jar "$@"
+        '';
+      };
+    };
 
     environment.systemPackages = [ cfg.package ];
 

nixos/modules/services/backup/btrbk.nix

···
     then [ "${name} ${value}" ]
     else concatLists (mapAttrsToList (genSection name) value);
 
-  addDefaults = settings: { backend = "btrfs-progs-sudo"; } // settings;
+  sudo_doas =
+    if config.security.sudo.enable then "sudo"
+    else if config.security.doas.enable then "doas"
+    else throw "The btrbk nixos module needs either sudo or doas enabled in the configuration";
+
+  addDefaults = settings: { backend = "btrfs-progs-${sudo_doas}"; } // settings;
 
   mkConfigFile = name: settings: pkgs.writeTextFile {
     name = "btrbk-${name}.conf";
···
   };
   config = mkIf (sshEnabled || serviceEnabled) {
     environment.systemPackages = [ pkgs.btrbk ] ++ cfg.extraPackages;
-    security.sudo.extraRules = [
-      {
-        users = [ "btrbk" ];
-        commands = [
-          { command = "${pkgs.btrfs-progs}/bin/btrfs"; options = [ "NOPASSWD" ]; }
-          { command = "${pkgs.coreutils}/bin/mkdir"; options = [ "NOPASSWD" ]; }
-          { command = "${pkgs.coreutils}/bin/readlink"; options = [ "NOPASSWD" ]; }
-          # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}
-          { command = "/run/current-system/bin/btrfs"; options = [ "NOPASSWD" ]; }
-          { command = "/run/current-system/sw/bin/mkdir"; options = [ "NOPASSWD" ]; }
-          { command = "/run/current-system/sw/bin/readlink"; options = [ "NOPASSWD" ]; }
+    security.sudo = mkIf (sudo_doas == "sudo") {
+      extraRules = [
+        {
+            users = [ "btrbk" ];
+            commands = [
+            { command = "${pkgs.btrfs-progs}/bin/btrfs"; options = [ "NOPASSWD" ]; }
+            { command = "${pkgs.coreutils}/bin/mkdir"; options = [ "NOPASSWD" ]; }
+            { command = "${pkgs.coreutils}/bin/readlink"; options = [ "NOPASSWD" ]; }
+            # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}
+            { command = "/run/current-system/bin/btrfs"; options = [ "NOPASSWD" ]; }
+            { command = "/run/current-system/sw/bin/mkdir"; options = [ "NOPASSWD" ]; }
+            { command = "/run/current-system/sw/bin/readlink"; options = [ "NOPASSWD" ]; }
+            ];
+        }
+      ];
+    };
+    security.doas = mkIf (sudo_doas == "doas") {
+      extraRules = let
+        doasCmdNoPass = cmd: { users = [ "btrbk" ]; cmd = cmd; noPass = true; };
+      in
+        [
+            (doasCmdNoPass "${pkgs.btrfs-progs}/bin/btrfs")
+            (doasCmdNoPass "${pkgs.coreutils}/bin/mkdir")
+            (doasCmdNoPass "${pkgs.coreutils}/bin/readlink")
+            # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}
+            (doasCmdNoPass "/run/current-system/bin/btrfs")
+            (doasCmdNoPass "/run/current-system/sw/bin/mkdir")
+            (doasCmdNoPass "/run/current-system/sw/bin/readlink")
+
+            # doas matches command, not binary
+            (doasCmdNoPass "btrfs")
+            (doasCmdNoPass "mkdir")
+            (doasCmdNoPass "readlink")
         ];
-      }
-    ];
+    };
     users.users.btrbk = {
       isSystemUser = true;
       # ssh needs a home directory
···
               "best-effort" = 2;
               "realtime" = 1;
             }.${cfg.ioSchedulingClass};
+            sudo_doas_flag = "--${sudo_doas}";
           in
-          ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"} ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh --sudo ${options}" ${v.key}''
+          ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"} ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options}" ${v.key}''
         )
         cfg.sshAccess;
     };

nixos/modules/services/x11/desktop-managers/plasma5.nix

···
             kio-extras
           ];
           optionalPackages = [
+            ark
             elisa
             gwenview
             okular

nixos/tests/all-tests.nix

···
   breitbandmessung = handleTest ./breitbandmessung.nix {};
   brscan5 = handleTest ./brscan5.nix {};
   btrbk = handleTest ./btrbk.nix {};
+  btrbk-doas = handleTest ./btrbk-doas.nix {};
   btrbk-no-timer = handleTest ./btrbk-no-timer.nix {};
   btrbk-section-order = handleTest ./btrbk-section-order.nix {};
   buildbot = handleTest ./buildbot.nix {};

nixos/tests/btrbk-doas.nix

···
+import ./make-test-python.nix ({ pkgs, ... }:
+
+  let
+    privateKey = ''
+      -----BEGIN OPENSSH PRIVATE KEY-----
+      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+      QyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrwAAAJB+cF5HfnBe
+      RwAAAAtzc2gtZWQyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrw
+      AAAEBN75NsJZSpt63faCuaD75Unko0JjlSDxMhYHAPJk2/xXHxQHThDpD9/AMWNqQer3Tg
+      9gXMb2lTZMn0pelo8xyvAAAADXJzY2h1ZXR6QGt1cnQ=
+      -----END OPENSSH PRIVATE KEY-----
+    '';
+    publicKey = ''
+      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHHxQHThDpD9/AMWNqQer3Tg9gXMb2lTZMn0pelo8xyv
+    '';
+  in
+  {
+    name = "btrbk-doas";
+    meta = with pkgs.lib; {
+      maintainers = with maintainers; [ symphorien tu-maurice ];
+    };
+
+    nodes = {
+      archive = { ... }: {
+        security.sudo.enable = false;
+        security.doas.enable = true;
+        environment.systemPackages = with pkgs; [ btrfs-progs ];
+        # note: this makes the privateKey world readable.
+        # don't do it with real ssh keys.
+        environment.etc."btrbk_key".text = privateKey;
+        services.btrbk = {
+          extraPackages = [ pkgs.lz4 ];
+          instances = {
+            remote = {
+              onCalendar = "minutely";
+              settings = {
+                ssh_identity = "/etc/btrbk_key";
+                ssh_user = "btrbk";
+                stream_compress = "lz4";
+                volume = {
+                  "ssh://main/mnt" = {
+                    target = "/mnt";
+                    snapshot_dir = "btrbk/remote";
+                    subvolume = "to_backup";
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+
+      main = { ... }: {
+        security.sudo.enable = false;
+        security.doas.enable = true;
+        environment.systemPackages = with pkgs; [ btrfs-progs ];
+        services.openssh = {
+          enable = true;
+          passwordAuthentication = false;
+          kbdInteractiveAuthentication = false;
+        };
+        services.btrbk = {
+          extraPackages = [ pkgs.lz4 ];
+          sshAccess = [
+            {
+              key = publicKey;
+              roles = [ "source" "send" "info" "delete" ];
+            }
+          ];
+          instances = {
+            local = {
+              onCalendar = "minutely";
+              settings = {
+                volume = {
+                  "/mnt" = {
+                    snapshot_dir = "btrbk/local";
+                    subvolume = "to_backup";
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      # create btrfs partition at /mnt
+      for machine in (archive, main):
+        machine.succeed("dd if=/dev/zero of=/data_fs bs=120M count=1")
+        machine.succeed("mkfs.btrfs /data_fs")
+        machine.succeed("mkdir /mnt")
+        machine.succeed("mount /data_fs /mnt")
+
+      # what to backup and where
+      main.succeed("btrfs subvolume create /mnt/to_backup")
+      main.succeed("mkdir -p /mnt/btrbk/{local,remote}")
+
+      # check that local snapshots work
+      with subtest("local"):
+          main.succeed("echo foo > /mnt/to_backup/bar")
+          main.wait_until_succeeds("cat /mnt/btrbk/local/*/bar | grep foo")
+          main.succeed("echo bar > /mnt/to_backup/bar")
+          main.succeed("cat /mnt/btrbk/local/*/bar | grep foo")
+
+      # check that btrfs send/receive works and ssh access works
+      with subtest("remote"):
+          archive.wait_until_succeeds("cat /mnt/*/bar | grep bar")
+          main.succeed("echo baz > /mnt/to_backup/bar")
+          archive.succeed("cat /mnt/*/bar | grep bar")
+    '';
+  })

pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix

···
 
 stdenv.mkDerivation rec {
   pname = "bitwig-studio";
-  version = "4.4.6";
+  version = "4.4.8";
 
   src = fetchurl {
     url = "https://downloads.bitwig.com/stable/${version}/${pname}-${version}.deb";
-    sha256 = "sha256-VcK74JrVH81sgNeh1FDvCO1jtgkVeLpx5IqlXuzH27A=";
+    sha256 = "sha256-qdqRvCmp6Q7lcTdOIEHeQKAAOLtJxs867gapopyeHuc=";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];

pkgs/applications/audio/ncspot/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
     rev = "v${version}";
-    sha256 = "sha256-kqGYBaXmGeGuGJ5fcc4OQzHISU8fVuQNGwiD8nyPa/0=";
+    hash = "sha256-YWA8chp33SkMdo+XT/7qikIkgwt8pozC9wMFpY8Dv8Q=";
   };
 
-  cargoSha256 = "sha256-gVXH2pFtyMfYkCqda9NrqOgczvmxiWHe0zArJfnnrgE=";
+  cargoHash = "sha256-DB3r6pPtustEQG8QXM6qT1hkd7msC//46bhVP/HMxnY=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/audio/strawberry/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "strawberry";
-  version = "1.0.14";
+  version = "1.0.15";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    hash = "sha256-ThfycS5yNpp6+mE33qPqEWlhSB3OIF7d/t2XvI+rF2E=";
+    hash = "sha256-P7M7UIRFr0pABNhb63pV3TqIdTP8Xox4f0BT2ii9rRE=";
   };
 
   # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead

pkgs/applications/emulators/proton-caller/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "proton-caller";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "caverym";
     repo = pname;
     rev = version;
-    sha256 = "sha256-fN/8woLkTFD0aGILwweHhpey3cGQw2NolvpOmdkEEGA=";
+    sha256 = "sha256-srzahBMihkEP9/+7oRij5POHkCcH6QBh4kGz42Pz0nM=";
   };
 
-  cargoSha256 = "sha256-2zczu9MtsDDbfjbmLXCiPJrxNoNNBN0KAGeN+a53SRg=";
+  cargoHash = "sha256-LBXCcFqqscCGgtTzt/gr7Lz0ExT9kAWrXPuPuKzKt0E=";
 
   meta = with lib; {
     description = "Run Windows programs with Proton";

pkgs/applications/networking/cluster/kubebuilder/default.nix

···
 
 buildGoModule rec {
   pname = "kubebuilder";
-  version = "3.9.0";
+  version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "kubebuilder";
     rev = "v${version}";
-    hash = "sha256-AT7BrLVe5sSqAnQyhrkDktxVhuh1e0o5eB8oWWVbL8Q=";
+    hash = "sha256-sX+MYMZTRJ3udCtW3yeGBlYpJV35UDQwtcgi7/pXhek=";
   };
 
   vendorHash = "sha256-wxKEywUs5ezeOlIRT2k3C4G0XaX6h1ORt9/G6+FzVic=";

pkgs/applications/networking/cluster/kubelogin-oidc/default.nix

···
 
 buildGoModule rec {
   pname = "kubelogin";
-  version = "1.26.0";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "int128";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-A8J381KNhQbWZ+68P8+1xj/lEEc/+YiJ80LqRQatdFQ=";
+    sha256 = "sha256-oBgth4lAQP4UrFIk/AErlfyyCgPrugs5wQJDFxqGum0=";
   };
 
   subPackages = ["."];
 
-  vendorSha256 = "sha256-V+O3yFxGJTcFETD2qYOurQUbME5NvRNQTr43OkxXFFE=";
+  vendorHash = "sha256-IJCbh1ryyk0r72SrVEiI7K5nIFf1+UGjTkXaNKpGsmo=";
 
   # Rename the binary instead of symlinking to avoid conflict with the
   # Azure version of kubelogin

pkgs/applications/networking/cluster/roxctl/default.nix

···
 
 buildGoModule rec {
   pname = "roxctl";
-  version = "3.73.2";
+  version = "3.73.3";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "stackrox";
     rev = version;
-    sha256 = "sha256-5MMSQy7SUFZhUycv1Kfkz46aY2tMldNZOH63wlQjq6o=";
+    sha256 = "sha256-ri4ir5mOfefB23gVk+XltXNYEz1jMoIVbJ5b0sS444k=";
   };
 
   vendorHash = "sha256-YRNOOn/Ei0rHLZrTtQxlBBn48pePDHllnI65Iil160k=";

pkgs/applications/networking/cluster/terraform-providers/providers.json

···
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-PvlW3BB2ZATZA18nOGgxMSWzjC8YIjUY9ofw7XwnbmU=",
+    "hash": "sha256-XcqBkb+de+ikNtrDe33OZHhhv6ed2pXhbXXb7L661RI=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v3.46.0",
+    "rev": "v3.47.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
···
     "vendorHash": "sha256-fqVBnAivVekV+4tpkl+E6eNA3wi8mhLevJRCs3W7L2g="
   },
   "grafana": {
-    "hash": "sha256-b6vmtr2eHm7YNhRHS96+l6BLHYHgixR8Pw7/jK0tRPI=",
+    "hash": "sha256-2Ig0ZwU9ZzsfAq5XCFMvL1NCmfnhVjoIrgl74hQypGE=",
     "homepage": "https://registry.terraform.io/providers/grafana/grafana",
     "owner": "grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v1.36.0",
+    "rev": "v1.36.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-zPO+TbJsFrgfjSaSrX5YRop/0LDDw/grNNntaIGiBU0="
   },
···
     "vendorHash": "sha256-rxh8Me+eOKPCbfHFT3tRsbM7JU67dBqv2JOiWArI/2Y="
   },
   "huaweicloud": {
-    "hash": "sha256-x/5jt31yPTJRHSHRZqSrrjNdERWho6l71jvS7x6dR0c=",
+    "hash": "sha256-5Yw1b7tuGg8tDL1rQhqgFMTgtvc2k0n45dR5xvr7Dmo=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.45.0",
+    "rev": "v1.45.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
···
     "vendorHash": null
   },
   "launchdarkly": {
-    "hash": "sha256-7m5+Fu9UjmGWL4PgYCpI9vMStfmU4oQ1cx+7wAirEbQ=",
+    "hash": "sha256-zi4GzbQmvvfxQ5vL4FbVkqUcwm7Y4ET8GFeIc/LipTY=",
     "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
     "owner": "launchdarkly",
     "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.11.0",
+    "rev": "v2.12.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-j8Lit22aWeLvYrq5ao0nIdcVZDSxaAKaW+bxQ/JCSgE="
+    "vendorHash": "sha256-Fb2k493XTePXgpCY9ZoMWaCZqq3fx3A2dBRsOp1MDBc="
   },
   "libvirt": {
     "hash": "sha256-VO9fbRLz7mDYT8WORodnN4l3II2j+TdpV8cZ9M+NjTM=",
···
     "vendorHash": null
   },
   "okta": {
-    "hash": "sha256-3Ym2Q3Y2f26ioiB3N2HZiPsrgVe4zszJDR7e0gzxOHU=",
+    "hash": "sha256-O4ZTGYM9r3XFzr2Nx/Tt2Fs7WOqQuQWfo+ZMmZyg+mo=",
     "homepage": "https://registry.terraform.io/providers/okta/okta",
     "owner": "okta",
     "repo": "terraform-provider-okta",
-    "rev": "v3.43.0",
+    "rev": "v3.44.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-7jA44ZcBGCeLrr+On8F9er+ch2qf6vbijTRtu+aHrB4="
+    "vendorHash": "sha256-KYOzbbBjE2C7+1St62rs9mlJFhpIlWQJ0reh5V5tQsk="
   },
   "oktaasa": {
     "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
···
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-9aIYGmcbDgSZqtldLBMRjD0qKJZ3USuwNBpK3bvGrFY=",
+    "hash": "sha256-FHGoaWJQ3HRtY/LNCTX+L+jgYMPKkefjpbtfzMVbPQw=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v2.11.1",
+    "rev": "v2.11.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
···
     "vendorHash": null
   },
   "scaleway": {
-    "hash": "sha256-4xHPQFmOAqEpqfJ6ng5z3wcuNZF8jNqu+4ZNJNxaBaI=",
+    "hash": "sha256-aWn/w7k+gxCodN7W9GBM9Ontkg6Ir2LNLYkY34ORxzI=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.13.0",
+    "rev": "v2.13.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-kh1wv7cuWCC1rP0WBQW95pFg53gZTakqGoMIDMDSmt0="
   },

pkgs/applications/version-management/gitlint/default.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gitlint";
-  version = "0.19.0";
+  version = "0.19.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "jorisroovers";
     repo = "gitlint";
-    rev = "v${version}";
-    sha256 = "sha256-w4v6mcjCX0V3Mj1K23ErpXdyEKQcA4vykns7UwNBEZ4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4SGkkC4LjZXTDXwK6jMOIKXR1qX76CasOwSqv8XUrjs=";
   };
-
-  patches = [
-    # otherwise hatch tries to run git to collect some metadata about the build
-    ./dont-try-to-use-git.diff
-  ];
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
···
   meta = with lib; {
     description = "Linting for your git commit messages";
     homepage = "https://jorisroovers.com/gitlint/";
+    changelog = "https://github.com/jorisroovers/gitlint/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ ethancedwards8 fab ];
   };

pkgs/applications/version-management/gitlint/dont-try-to-use-git.diff

···
---- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -61,10 +63,3 @@ include = [
- exclude = [
-     "/gitlint/tests", #
- ]
--
--[tool.hatch.metadata.hooks.vcs.urls]
--Homepage = "https://jorisroovers.github.io/gitlint"
--Documentation = "https://jorisroovers.github.io/gitlint"
--Source = "https://github.com/jorisroovers/gitlint/tree/main/gitlint-core"
--Changelog = "https://github.com/jorisroovers/gitlint/blob/main/CHANGELOG.md"
--'Source Commit' = "https://github.com/jorisroovers/gitlint/tree/{commit_hash}/gitlint-core"
-\ No newline at end of file

pkgs/applications/virtualization/colima/default.nix

···
 
 buildGoModule rec {
   pname = "colima";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uAstW+LzgT+xEJf4WNVSZsWtE50RU/rRpC7mkkFMIJU=";
+    sha256 = "sha256-oCYHQFajtZXVAVeJ8zvJABlmwmOUgisvVg9eLT7wd0M=";
     # We need the git revision
     leaveDotGit = true;
     postFetch = ''

pkgs/data/fonts/charis-sil/default.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "charis-sil";
-  version = "6.101";
+  version = "6.200";
 
   src = fetchzip {
     url = "https://software.sil.org/downloads/r/charis/CharisSIL-${version}.zip";
-    hash = "sha256-Rf5eKQVZw7zgTv6KkJUdNdd4sSJPdvjy/GDLusvlgzE=";
+    hash = "sha256-q451lec/l13Uanmr8K/C55Cr3avRvqQUkPK/ZZ1kgHo=";
   };
 
   installPhase = ''

pkgs/development/compilers/circt/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.30.0";
+  version = "1.34.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    sha256 = "sha256-VP1QwY/gA8wxjpzbAlEV5r2Q8sTt3K2sGdKmxr6ndB8=";
+    sha256 = "sha256-QrCli0nNlvOM4taqWZ6GzK5luvXmyxaCgfDlXSRLSQA=";
     fetchSubmodules = true;
   };
 

pkgs/development/libraries/boca/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "BoCA";
-  version = "1.0.6a";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "enzo1982";
     repo = "boca";
     rev = "v${version}";
-    sha256 = "sha256-LndlwdM5NlTv73Z1lMkHuIZkVfn48P/LssBnE4X9Sgc=";
+    sha256 = "sha256-HIYUMFj5yiEC+liZLMXD9otPyoEb1sxHlECTYtYXc2I=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libheif/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libheif";
-  version = "1.14.2";
+  version = "1.15.1";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
···
     owner = "strukturag";
     repo = "libheif";
     rev = "v${version}";
-    sha256 = "sha256-JwPeSNUc++z6RfMe0qAuXdekzLWR/MCmsT+Ykvp9a/s=";
+    sha256 = "sha256-5908S46hEXhCYcTsqulmUnat0KOlXsnY5LI/l1l7/1Q=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/liblouis/default.nix

···
 , perl
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "liblouis";
-  version = "3.24.0";
+  version = "3.25.0";
 
   outputs = [ "out" "dev" "info" "doc" ]
     # configure: WARNING: cannot generate manual pages while cross compiling
···
   src = fetchFromGitHub {
     owner = "liblouis";
     repo = "liblouis";
-    rev = "v${version}";
-    sha256 = "sha256-QSrCQhP3t+WPyBQPLJbZEaDCjXD8Lo6IAGKHsbL2S1o=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-On5PbBgvDAeD41oGb5EKBtKvi/VXnLsVrTMX7tcwnq4=";
   };
 
   strictDeps = true;
···
 
   meta = with lib; {
     description = "Open-source braille translator and back-translator";
-    homepage = "https://liblouis.org/";
+    homepage = "https://liblouis.io/";
     license = with licenses; [
       lgpl21Plus # library
       gpl3Plus # tools
···
     maintainers = with maintainers; [ jtojnar ];
     platforms = platforms.unix;
   };
-}
+})

pkgs/development/libraries/migraphx/default.nix

···
   };
 in stdenv.mkDerivation (finalAttrs: {
   pname = "migraphx";
-  version = "5.4.2";
+  version = "5.4.3";
 
   outputs = [
     "out"

pkgs/development/libraries/minizip-ng/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "minizip-ng";
-  version = "3.0.7";
+  version = "3.0.8";
 
   src = fetchFromGitHub {
     owner = "zlib-ng";
     repo = finalAttrs.pname;
     rev = finalAttrs.version;
-    sha256 = "sha256-m/zSVx8vYzLA23Cusd1p/ZSGd1mV3gM6UqDnmEXqpq4=";
+    sha256 = "sha256-Vzp+5fQBJoO1pG7j8LwC2/B/cOgM/exhKyb3zHuy89Y=";
   };
-
-  patches = [
-    (fetchpatch {
-      name = "find-system-gtest.patch";
-      url = "https://github.com/zlib-ng/minizip-ng/commit/be23c8d3b7e2cb5ba619e60517cad277ee510fb7.patch";
-      sha256 = "sha256-azwrGj6kgTyTepGAmOlxDOFOwJKQE5J2bwUIn6sgKUY=";
-    })
-
-    # otherwise signing unit tests fail
-    (fetchpatch {
-      name = "disable-mz-signing-by-default.patch";
-      url = "https://github.com/zlib-ng/minizip-ng/commit/60649ada97581afc0bc2fffc50ce402ff1e6df5d.patch";
-      sha256 = "sha256-bHGM4H8RPYkfAjxcS1bPohR9IFOFT0Mx4Mg34UnnD+w=";
-    })
-  ];
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ zlib bzip2 xz zstd openssl ];

pkgs/development/libraries/qxmpp/default.nix

···
 
 mkDerivation rec {
   pname = "qxmpp";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "qxmpp-project";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6iI+s+iSKK8TeocvyOxou7cF9ZXlWr5prUbPhoHOoSM=";
+    sha256 = "sha256-nwU0Iw3aLv4EyNdblTOQKcCYVYfK8i54c0piks4DoUo=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/django-ipware/default.nix

···
-{ lib, buildPythonPackage, fetchPypi, django }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, django
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "django-ipware";
-  version = "4.0.2";
+  version = "5.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "602a58325a4808bd19197fef2676a0b2da2df40d0ecf21be414b2ff48c72ad05";
+    hash = "sha256-T6VgfuheEu5eFYvHVp/x4TT7FXloGqH/Pw7QS+Ib4VM=";
   };
 
   propagatedBuildInputs = [ django ];
···
   meta = with lib; {
     description = "A Django application to retrieve user's IP address";
     homepage = "https://github.com/un33k/django-ipware";
+    changelog = "https://github.com/un33k/django-ipware/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };

pkgs/development/python-modules/peaqevcore/default.nix

···
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "13.0.0";
+  version = "13.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uQ5e85KHFaJCgpALFCYVs+nY0fZIE4UIYdNOn6VrIWM=";
+    hash = "sha256-2V0+F0S2i7paBDN8FmsT1wV4qdJ4XmkOyZ3EDfyjGks=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pydeconz/default.nix

···
 
 buildPythonPackage rec {
   pname = "pydeconz";
-  version = "108";
+  version = "110";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
···
     owner = "Kane610";
     repo = "deconz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CPFkfVwvk0AO/DoE1Nj1jLdLvuOpRzndmRK/M6SSGtk=";
+    hash = "sha256-2eHKFq+urzJS3K55O0hca0h4ElowJZD6nIkYkzyBFCM=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/altair-graphql-client/default.nix

···
 
 let
   pname = "altair";
-  version = "5.0.14";
+  version = "5.0.17";
 
   src = fetchurl {
     url = "https://github.com/imolorhe/altair/releases/download/v${version}/altair_${version}_x86_64_linux.AppImage";
-    sha256 = "sha256-gd7aSBNhTO1ira76lL+1apLlXYXRfGWAbGAsJEUtEqw=";
+    sha256 = "sha256-UX7WqQt5inVldrXG3bIVmR8ucCvbHdyVLgQ/srhpCak=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };

pkgs/development/tools/database/dbmate/default.nix

···
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "1.16.2";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "v${version}";
-    sha256 = "sha256-5hjAP2+0hbYcA9G7YJyRqqp1ZC8LzFDomjeFjl4z4FY=";
+    sha256 = "sha256-zARaxjzVTi90BkwPOyfGYk3mBHRoAGMOe2LPlJB4Mvo=";
   };
 
-  vendorHash = "sha256-7fC1jJMY/XK+GX5t2/o/k+EjFxAlRAmiemMcWaZhL9o=";
+  vendorHash = "sha256-NZ2HVFViU8Vzwyo33cueNJwdCT4exZlB7g4WgoWKZBE=";
 
   doCheck = false;
 

pkgs/development/tools/language-servers/nil/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "nil";
-  version = "2023-03-01";
+  version = "2023-03-11";
 
   src = fetchFromGitHub {
     owner = "oxalica";
     repo = pname;
     rev = version;
-    hash = "sha256-HGd/TV8ZHVAVBx+ndrxAfS/Nz+VHOQjNWjtKkkgYkqA=";
+    hash = "sha256-5WEdrN+ABrNOdfQc2k2mf+fj+ZvZR1Dp/PtypEdlFWA=";
   };
 
-  cargoHash = "sha256-A6Go1OYAaoDvQtAcK5BL5Tz00iLPOft0VLH6usWtb9g=";
+  cargoHash = "sha256-ISkw0lhUKJG8nWUHcR93sLUFt5dDEyK7EORcOXEmVbE=";
 
   CFG_RELEASE = version;
 

pkgs/development/tools/marksman/default.nix

···
 
 buildDotnetModule rec {
   pname = "marksman";
-  version = "2023-01-29";
+  version = "2023-03-04";
 
   src = fetchFromGitHub {
     owner = "artempyanykh";
     repo = "marksman";
     rev = version;
-    sha256 = "sha256-UPPO4ueu7gMR7a573M2/xT3N0QgRSNBshJAqoyXEZpc=";
+    sha256 = "sha256-jBZC2z1wtDMIssgRrKkZpl9NQ3XkRCcxo5eylwB2OBQ=";
   };
 
   projectFile = "Marksman/Marksman.fsproj";

pkgs/development/tools/misc/cmake-language-server/default.nix

···
 
 buildPythonApplication rec {
   pname = "cmake-language-server";
-  version = "unstable-2023-01-08";
+  version = "0.1.7";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "regen100";
-    repo = pname;
-    rev = "60c376a5fda29835060687569cb212350a292116";
-    hash = "sha256-vNG43sZy2wMetY5mbgxIoei5jCCj1f8vWiovWtwzbPc=";
+    repo = "cmake-language-server";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ExEAi47hxxEJeoT3FCwpRwJrf3URnI47/5FDL7fS5sY=";
   };
 
-  PDM_PEP517_SCM_VERSION = "2023.1";
+  PDM_PEP517_SCM_VERSION = version;
 
   patches = [
     # Test timeouts occasionally cause the build to fail

pkgs/development/tools/misc/cmake-language-server/disable-test-timeouts.patch

···
 diff --git a/tests/test_server.py b/tests/test_server.py
-index 2d09bb2..59a122a 100644
+index f349329..d130a2e 100644
 --- a/tests/test_server.py
 +++ b/tests/test_server.py
-@@ -26,7 +26,7 @@ from pygls.lsp.types import (
- )
- from pygls.server import LanguageServer
+@@ -27,7 +27,7 @@ from pygls.server import LanguageServer
+ 
+ from cmake_language_server.server import CMakeLanguageServer
  
 -CALL_TIMEOUT = 2
 +CALL_TIMEOUT = None

pkgs/development/tools/opcr-policy/default.nix

···
 
 buildGoModule rec {
   pname = "opcr-policy";
-  version = "0.1.50";
+  version = "0.1.51";
 
   src = fetchFromGitHub {
     owner = "opcr-io";
     repo = "policy";
     rev = "v${version}";
-    sha256 = "sha256-u7epE09WcbXAX1W+zkCOTDECnBTIOFC3gjNowtpuYtI=";
+    sha256 = "sha256-RpjuKtxiZA6l0ZW0TsEUn2AMLjU/V2RRfQLmfa0imW4=";
   };
   vendorHash = "sha256-QoD6J+is+InumLiFdbL/y1tuWwBCdBebx6RrIZ4Irik=";
 

pkgs/development/tools/xc/default.nix

···
 
 buildGoModule rec {
   pname = "xc";
-  version = "0.0.175";
+  version = "0.1.181";
 
   src = fetchFromGitHub {
     owner = "joerdav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Uc9MTxl32xQ7u6N0mocDAoD9tgv/YOPCzhonsavX9Vo=";
+    sha256 = "sha256-C6qZdO6+n9BWm69y09kvnEBF45sB6bfOfmteNO2x68I=";
   };
 
   vendorHash = "sha256-cySflcTuAzbFZbtXmzZ98nfY8HUq1UedONTtKP4EICs=";

pkgs/development/web/flyctl/default.nix

···
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.483";
+  version = "0.0.484";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-z6FBJ8cE8UeOP/3ojzQo3LjEJr5bBshf+4CgMmb1RTQ=";
+    hash = "sha256-2//mxYTF6lAolj5aQOXF12NOwEa/VPoen9LNxD7gYDo=";
   };
 
   vendorHash = "sha256-2y671bvOmkKEqbcttcCG1L1by/J8gkGZxts7kFyTIxk=";

pkgs/games/unciv/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "4.5.2";
+  version = "4.5.5";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-HhMccVlpIJoGW3LLqg1clw+dWcRUVHwCgtrmBcOXFSE=";
+    hash = "sha256-m7wyWxTKXrxJUtUpG2Dwg4s91TBbE0eFNAyDhS98ggo=";
   };
 
   dontUnpack = true;

pkgs/games/vassal/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "VASSAL";
-  version = "3.6.13";
+  version = "3.6.14";
 
   src = fetchzip {
     url = "https://github.com/vassalengine/vassal/releases/download/${version}/${pname}-${version}-linux.tar.bz2";
-    sha256 = "sha256-5YswOh2jnOafctp7q8INtIqQwx1ugGm0QP9vDfal7t0=";
+    sha256 = "sha256-0/QJyntLV1DLzLJ8p4f+tCXPKl3DMf+j4/gkI+Mt+rc=";
   };
 
   buildInputs = [

pkgs/os-specific/linux/kernel/zen-kernels.nix

···
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.2.2"; #zen
-    suffix = "zen2"; #zen
-    sha256 = "0hbsd8id1f27zlxffid7pyycm5dlh6hw8y6f8dv6czd8k9v1qngs"; #zen
+    version = "6.2.5"; #zen
+    suffix = "zen1"; #zen
+    sha256 = "0ilkb8rqww30nl4sa01jy97s8gs67y96qwf9r0z0z7xy3w05s8bl"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.1.15"; #lqx
-    suffix = "lqx2"; #lqx
-    sha256 = "1z3bwn2pmbaa8cqld4fsxkzkdb5213n83bgb8jkm9v4943pa220i"; #lqx
+    version = "6.1.18"; #lqx
+    suffix = "lqx1"; #lqx
+    sha256 = "1gyjy01ys74apa65abgvxcj0y51vf5ixampyj3jd8lxzn4vvkih6"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {

pkgs/servers/adguardhome/bins.nix

···
 { fetchurl, fetchzip }:
 {
 x86_64-darwin = fetchzip {
-  sha256 = "sha256-mOn0RYWmGzIeHyVwVTGPUvFyVQ8Zu57KW7UkGMWRejA=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_darwin_amd64.zip";
+  sha256 = "sha256-hGa1SrueZWGokeJb+p/6eaYv1AP1a2TUiGo+rcJBw3Y=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_darwin_amd64.zip";
 };
 aarch64-darwin = fetchzip {
-  sha256 = "sha256-urdLtEOMJ2ZeaWezihpv5UU8Li2gnmYk6+gzn9E/3Nw=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_darwin_arm64.zip";
+  sha256 = "sha256-wm8scjBaQuKJQu2OfYWDQqF2TLdPEZQEGSgaLzoGTb0=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_darwin_arm64.zip";
 };
 i686-linux = fetchurl {
-  sha256 = "sha256-yWlo7adaQcPrM4zOPq5BLw6rZPYg2Qr2T1R7H8QZuvA=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_386.tar.gz";
+  sha256 = "sha256-nie5WOeMajq8ucOwLHDXMG1FU7wBS3GTQHKCn0XjBCQ=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_386.tar.gz";
 };
 x86_64-linux = fetchurl {
-  sha256 = "sha256-pD1vs4NHWByZmEozdgpzBXDeSzbEBouyawd41Emf8QE=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_amd64.tar.gz";
+  sha256 = "sha256-Ai6QzmNrALHKxJIX5gx5GQiLlcpKRuT+ALxN0PDJQ9E=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_amd64.tar.gz";
 };
 aarch64-linux = fetchurl {
-  sha256 = "sha256-BpknO9qL4Jo31d/vRXjuU/wJWfCVvLfgh6tZLG/6ipI=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_arm64.tar.gz";
+  sha256 = "sha256-cJ7vvv4Yyo0r01eOuZI6jqc4LFmSDmVl84aJjwxkuR4=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_arm64.tar.gz";
 };
 armv6l-linux = fetchurl {
-  sha256 = "sha256-yUyRz/2hqvN8XkuzfMfG6ibYOb68WjJaqgAIAfoZH0s=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_armv6.tar.gz";
+  sha256 = "sha256-DfeSBIOO/vZQExbrqku28s8a9s22tfuojccIwe37tS4=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_armv6.tar.gz";
 };
 armv7l-linux = fetchurl {
-  sha256 = "sha256-MOvDKvq24+NFmgseZZA3zz0z6Vr/7OvO8sHpsDWvMuo=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_armv7.tar.gz";
+  sha256 = "sha256-OHoU8dP5b2jqFTfn4FCxL88HrQntcxZ5enMFr/YN1zI=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_armv7.tar.gz";
 };
 }

pkgs/servers/adguardhome/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "adguardhome";
-  version = "0.107.25";
+  version = "0.107.26";
   src = sources.${system} or (throw "Source for ${pname} is not available for ${system}");
 
   installPhase = ''
···
 
   passthru = {
     updateScript = ./update.sh;
-    schema_version = 16;
+    schema_version = 17;
     tests.adguardhome = nixosTests.adguardhome;
   };
 

pkgs/servers/komga/default.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "0.162.0";
+  version = "0.163.0";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/v${version}/${pname}-${version}.jar";
-    sha256 = "sha256-RcEAqMfpXH7PudLOROpSZw/5HrEeuBFBkllOjGdXZCU=";
+    sha256 = "sha256-dKbdzfjb+brY++uflVvuF1LaOIaYn1UqIGIjCsyLMv8=";
   };
 
   nativeBuildInputs = [

pkgs/servers/pocketbase/default.nix

···
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.12.3";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/uqUOuNHFyah6nrQI3lRNkB2vpV9vKXJog1ck0zoruo=";
+    sha256 = "sha256-P150wEJHTC294LcRhSHF5/+w08WKBvhUZsJ9ENi1EM8=";
   };
 
-  vendorHash = "sha256-8NBudXcU3cjSbo6qpGZVLtbrLedzwijwrbiTgC+OMcU=";
+  vendorHash = "sha256-hvziOq5zyYwWcvqa23IzHXj/DT27MAcNVegYR38beJ4=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];

pkgs/tools/audio/openai-whisper-cpp/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "whisper-cpp";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "whisper.cpp";
     rev = "refs/tags/v${version}" ;
-    hash = "sha256-7/10t1yE7Gbs+cyj8I9vJoDeaxEz9Azc2j3f6QCjDGM=";
+    hash = "sha256-gcw+tcrwCt2CynNXQZxb+WxN/0chIQIJnwUAw9JGkYA=";
   };
 
   # The upstream download script tries to download the models to the

pkgs/tools/backup/btrbk/default.nix

···
   '';
 
   passthru.tests = {
-    inherit (nixosTests) btrbk btrbk-no-timer btrbk-section-order;
+    inherit (nixosTests) btrbk btrbk-no-timer btrbk-section-order btrbk-doas;
   };
 
   passthru.updateScript = genericUpdater {

pkgs/tools/games/minecraft/fabric-installer/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "fabric-installer";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchurl {
     url = "https://maven.fabricmc.net/net/fabricmc/fabric-installer/${version}/fabric-installer-${version}.jar";
-    sha256 = "sha256-eRf5+hS+babvPNt/5r87Y6WToOuHO9Yn6YGn45iM1zo=";
+    sha256 = "sha256-xq1b7xuxK1pyJ74+5UDCyQav30rIEUt44KygsUYAXCc=";
   };
 
   dontUnpack = true;

pkgs/tools/graphics/directx-shader-compiler/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "directx-shader-compiler";
-  version = "1.7.2212";
+  version = "1.7.2212.1";
 
   # Put headers in dev, there are lot of them which aren't necessary for
   # using the compiler binary.
···
     owner = "microsoft";
     repo = "DirectXShaderCompiler";
     rev = "v${version}";
-    hash = "sha256-/FuG6ThvA3XMlHhnshRJpKC+vf4LM8/hurUoPagpTqA=";
+    hash = "sha256-old/vGNoj0mimuvd/RkwNeynBp+gBrkwQ7ah2oUZll0=";
     fetchSubmodules = true;
   };
 

pkgs/tools/misc/rpm-ostree/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "rpm-ostree";
-  version = "2023.1";
+  version = "2023.2";
 
   outputs = [ "out" "dev" "man" "devdoc" ];
 
   src = fetchurl {
     url = "https://github.com/coreos/${pname}/releases/download/v${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-JNLp1IHbIRpe3Au2iUsx7x065rirQlzT9bg7CoqHCyg=";
+    hash = "sha256-/C5la0b1plfqnsfSnfoSkSROIlAcvAfeg4m/PYV2UnY=";
   };
 
   nativeBuildInputs = [

pkgs/tools/misc/turbo/default.nix

···
 , extra-cmake-modules
 , fontconfig
 , go
+, testers
+, turbo
 }:
 let
   version = "1.8.3";
···
 
   # Browser tests time out with chromium and google-chrome
   doCheck = false;
+
+  passthru.tests.version = testers.testVersion { package = turbo; };
 
   meta = with lib; {
     description = "High-performance build system for JavaScript and TypeScript codebases";

pkgs/tools/networking/opensnitch/daemon.nix

···
 , iptables
 , makeWrapper
 , protoc-gen-go-grpc
+, testers
+, opensnitch
 }:
 
 buildGoModule rec {
···
     wrapProgram $out/bin/opensnitchd \
       --prefix PATH : ${lib.makeBinPath [ iptables ]}
   '';
+
+  passthru.tests.version = testers.testVersion {
+    package = opensnitch;
+    command = "opensnitchd -version";
+  };
 
   meta = with lib; {
     description = "An application firewall";

pkgs/tools/security/browserpass/default.nix

···
 { lib, buildGoModule, fetchFromGitHub, makeWrapper, gnupg }:
 buildGoModule rec {
   pname = "browserpass";
-  version = "3.0.10";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "browserpass";
     repo = "browserpass-native";
     rev = version;
-    sha256 = "8eAwUwcRTnhVDkQc3HsvTP0TqC4LfVrUelxdbJxe9t0=";
+    sha256 = "sha256-UZzOPRRiCUIG7uSSp9AEPMDN/+4cgyK47RhrI8oUx8U=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
-  vendorSha256 = "gWXcYyIp86b/Pn6vj7qBj/VZS9rTr4weVw0YWmg+36c=";
+  vendorHash = "sha256-CjuH4ANP2bJDeA+o+1j+obbtk5/NVLet/OFS3Rms4r0=";
 
   doCheck = false;
 

pkgs/tools/security/step-cli/default.nix

···
 
 buildGoModule rec {
   pname = "step-cli";
-  version = "0.23.3";
+  version = "0.23.4";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gJsezi7yczVagR7faQvehyGWW6E7sfDXrJEVdsUSSp0=";
+    hash = "sha256-RNuYqmfMrIrWodrn7lpM0YO+HVxz+gKr5IregRqo5ak=";
   };
 
   ldflags = [
···
     rm command/certificate/remote_test.go
   '';
 
-  vendorHash = "sha256-YsZGs5/QQLdnXOeEnDXevlnJrOBoLkdYqTj2ZIoUOkA=";
+  vendorHash = "sha256-drIVwsqgJsYDXSuu5AhnBnKwwgkhVyNS/HS9FcoJeLM=";
 
   meta = with lib; {
     description = "A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc";

pkgs/tools/system/zfxtop/default.nix

···
 
 buildGoModule rec {
   pname = "zfxtop";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "ssleert";
     repo = "zfxtop";
     rev = version;
-    hash = "sha256-9o32sryffcCt/sBnaT5QzD5oLRfJHgq1yKP8d0pk2JQ=";
+    hash = "sha256-auq5NvpI7De9/QBUDPFtXwsAeX/D2RmlVaKe/lrs1MQ=";
   };
 
-  vendorHash = "sha256-H1X7j77Wp8ipgNTMZbFwoSA7NrILahFK8YwoP1W3h2c=";
+  vendorHash = "sha256-VKBRgDu9xVbZrC5fadkdFjd1OETNwaxgraRnA34ETzE=";
 
   meta = with lib; {
     description = "fetch top for gen Z with X written by bubbletea enjoyer";

pkgs/tools/text/xml/html-xml-utils/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "html-xml-utils";
-  version = "8.4";
+  version = "8.5";
 
   src = fetchurl {
     url = "https://www.w3.org/Tools/HTML-XML-utils/${pname}-${version}.tar.gz";
-    sha256 = "sha256-QbubFOH0zWEC4/jft55xRqJMCWk4aYcxZcQhdppX0Tc=";
+    sha256 = "sha256-8gpGrE7TDQKM14R25fIPXikXqVy3vOfffxfY+z5Peec=";
   };
 
   buildInputs = [curl libiconv];