Merge staging-next into staging

.github/ISSUE_TEMPLATE/bug_report.md

···
 Add any other context about the problem here.
 
 ### Notify maintainers
+
 <!--
 Please @ people who are in the `meta.maintainers` list of the offending package or module.
 If in doubt, check `git blame` for whoever last touched something.

.github/ISSUE_TEMPLATE/build_failure.md

···
 ---
 name: Build failure
 about: Create a report to help us improve
-title: ''
+title: 'Build failure: PACKAGENAME'
 labels: '0.kind: build failure'
 assignees: ''
 
 ---
 
 ### Steps To Reproduce
+
 Steps to reproduce the behavior:
 1. build *X*
 
 ### Build log
+
 ```
 log here if short otherwise a link to a gist
 ```
 
 ### Additional context
+
 Add any other context about the problem here.
 
 ### Notify maintainers
+
 <!--
 Please @ people who are in the `meta.maintainers` list of the offending package or module.
 If in doubt, check `git blame` for whoever last touched something.
 -->
 
 ### Metadata
+
 Please run `nix-shell -p nix-info --run "nix-info -m"` and paste the result.
 
 ```console

.github/ISSUE_TEMPLATE/missing_documentation.md

···
 ---
 name: Missing or incorrect documentation
 about: Help us improve the Nixpkgs and NixOS reference manuals
-title: ''
+title: 'Documentation: '
 labels: '9.needs: documentation'
 assignees: ''
 
···
 ## Problem
 
 <!-- describe your problem -->
+
+## Proposal
+
+<!-- propose a solution (optional) -->
 
 ## Checklist
 
···
 [nixos-source]: https://github.com/NixOS/nixpkgs/tree/master/nixos/doc/manual
 [open documentation issues]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+label%3A%229.needs%3A+documentation%22
 [open documentation pull requests]: https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+is%3Apr+label%3A%228.has%3A+documentation%22%2C%226.topic%3A+documentation%22
-
-## Proposal
-
-<!-- propose a solution -->
 

.github/ISSUE_TEMPLATE/out_of_date_package_report.md

···
 ---
 name: Out-of-date package reports
 about: For packages that are out-of-date
-title: ''
+title: 'Update request: PACKAGENAME OLDVERSION → NEWVERSION'
 labels: '9.needs: package (update)'
 assignees: ''
 
 ---
 
-
-###### Checklist
-
-<!-- Note that these are hard requirements -->
-
-<!--
-You can use the "Go to file" functionality on GitHub to find the package
-Then you can go to the history for this package
-Find the latest "package_name: old_version -> new_version" commit
-The "new_version" is the current version of the package
--->
-- [ ] Checked the [nixpkgs master branch](https://github.com/NixOS/nixpkgs)
+- Package name:
+- Latest released version:
+<!-- Search your package here: https://search.nixos.org/packages?channel=unstable -->
+- Current version on the unstable channel:
+- Current version on the stable/release channel:
 <!--
 Type the name of your package and try to find an open pull request for the package
 If you find an open pull request, you can review it!
···
 -->
 - [ ] Checked the [nixpkgs pull requests](https://github.com/NixOS/nixpkgs/pulls)
 
-###### Project name
-`nix search` name:
-<!--
-The current version can be found easily with the same process as above for checking the master branch
-If an open PR is present for the package, take this version as the current one and link to the PR
--->
-current version:
-desired version:
+**Notify maintainers**
 
-###### Notify maintainers
-<!--
-Search your package here: https://search.nixos.org/packages?channel=unstable
-If no maintainer is listed for your package, tag the person that last updated the package
--->
+<!-- If the search.nixos.org result shows no maintainers, tag the person that last updated the package. -->
 
-maintainers:
+-----
 
-###### Note for maintainers
-
-Please tag this issue in your PR.
+Note for maintainers: Please tag this issue in your PR.

.github/ISSUE_TEMPLATE/packaging_request.md

···
 ---
 name: Packaging requests
 about: For packages that are missing
-title: ''
+title: 'Package request: PACKAGENAME'
 labels: '0.kind: packaging request'
 assignees: ''
 
 ---
 
 **Project description**
-_describe the project a little_
+
+<!-- Describe the project a little: -->
 
 **Metadata**
 

doc/default.nix

···
 { pkgs ? (import ./.. { }), nixpkgs ? { }}:
 let
-  lib = pkgs.lib;
   doc-support = import ./doc-support { inherit pkgs nixpkgs; };
 in pkgs.stdenv.mkDerivation {
   name = "nixpkgs-manual";
···
     xmlformat
   ];
 
-  src = lib.cleanSource ./.;
+  src = pkgs.nix-gitignore.gitignoreSource [] ./.;
 
   postPatch = ''
     ln -s ${doc-support} ./doc-support/result

doc/stdenv/stdenv.chapter.md

···
 
 ### The check phase {#ssec-check-phase}
 
-The check phase checks whether the package was built correctly by running its test suite. The default `checkPhase` calls `make $checkTarget`, but only if the `doCheck` variable is enabled (see below).
+The check phase checks whether the package was built correctly by running its test suite. The default `checkPhase` calls `make $checkTarget`, but only if the [`doCheck` variable](#var-stdenv-doCheck) is enabled.
 
 #### Variables controlling the check phase {#variables-controlling-the-check-phase}
 
···
 
 ##### `checkTarget` {#var-stdenv-checkTarget}
 
-The make target that runs the tests. Defaults to `check` if it exists, otherwise `test`; if neither is found, do nothing.
+The `make` target that runs the tests.
+If unset, use `check` if it exists, otherwise `test`; if neither is found, do nothing.
 
 ##### `checkFlags` / `checkFlagsArray` {#var-stdenv-checkFlags}
 

lib/licenses.nix

···
     free = false;
   };
 
+  ecl20 = {
+    fullName = "Educational Community License, Version 2.0";
+    url = "https://opensource.org/licenses/ECL-2.0";
+    shortName = "ECL 2.0";
+    spdxId = "ECL-2.0";
+  };
+
   efl10 = {
     spdxId = "EFL-1.0";
     fullName = "Eiffel Forum License v1.0";

lib/path/default.nix

···
 
   inherit (builtins)
     isString
+    isPath
     split
     match
     ;
···
 
   inherit (lib.asserts)
     assertMsg
+    ;
+
+  inherit (lib.path.subpath)
+    isValid
     ;
 
   # Return the reason why a subpath is invalid, or `null` if it's valid
···
 
 in /* No rec! Add dependencies on this file at the top. */ {
 
+  /* Append a subpath string to a path.
+
+    Like `path + ("/" + string)` but safer, because it errors instead of returning potentially surprising results.
+    More specifically, it checks that the first argument is a [path value type](https://nixos.org/manual/nix/stable/language/values.html#type-path"),
+    and that the second argument is a valid subpath string (see `lib.path.subpath.isValid`).
+
+    Type:
+      append :: Path -> String -> Path
+
+    Example:
+      append /foo "bar/baz"
+      => /foo/bar/baz
+
+      # subpaths don't need to be normalised
+      append /foo "./bar//baz/./"
+      => /foo/bar/baz
+
+      # can append to root directory
+      append /. "foo/bar"
+      => /foo/bar
+
+      # first argument needs to be a path value type
+      append "/foo" "bar"
+      => <error>
+
+      # second argument needs to be a valid subpath string
+      append /foo /bar
+      => <error>
+      append /foo ""
+      => <error>
+      append /foo "/bar"
+      => <error>
+      append /foo "../bar"
+      => <error>
+  */
+  append =
+    # The absolute path to append to
+    path:
+    # The subpath string to append
+    subpath:
+    assert assertMsg (isPath path) ''
+      lib.path.append: The first argument is of type ${builtins.typeOf path}, but a path was expected'';
+    assert assertMsg (isValid subpath) ''
+      lib.path.append: Second argument is not a valid subpath string:
+          ${subpathInvalidReason subpath}'';
+    path + ("/" + subpath);
 
   /* Whether a value is a valid subpath string.
 
···
     subpath.isValid "./foo//bar/"
     => true
   */
-  subpath.isValid = value:
+  subpath.isValid =
+    # The value to check
+    value:
     subpathInvalidReason value == null;
 
 
···
 
   Laws:
 
-  - (Idempotency) Normalising multiple times gives the same result:
+  - Idempotency - normalising multiple times gives the same result:
 
         subpath.normalise (subpath.normalise p) == subpath.normalise p
 
-  - (Uniqueness) There's only a single normalisation for the paths that lead to the same file system node:
+  - Uniqueness - there's only a single normalisation for the paths that lead to the same file system node:
 
         subpath.normalise p != subpath.normalise q -> $(realpath ${p}) != $(realpath ${q})
 
···
     subpath.normalise "/foo"
     => <error>
   */
-  subpath.normalise = path:
-    assert assertMsg (subpathInvalidReason path == null)
-      "lib.path.subpath.normalise: Argument is not a valid subpath string: ${subpathInvalidReason path}";
-    joinRelPath (splitRelPath path);
+  subpath.normalise =
+    # The subpath string to normalise
+    subpath:
+    assert assertMsg (isValid subpath) ''
+      lib.path.subpath.normalise: Argument is not a valid subpath string:
+          ${subpathInvalidReason subpath}'';
+    joinRelPath (splitRelPath subpath);
 
 }

lib/path/tests/unit.nix

···
 { libpath }:
 let
   lib = import libpath;
-  inherit (lib.path) subpath;
+  inherit (lib.path) append subpath;
 
   cases = lib.runTests {
+    # Test examples from the lib.path.append documentation
+    testAppendExample1 = {
+      expr = append /foo "bar/baz";
+      expected = /foo/bar/baz;
+    };
+    testAppendExample2 = {
+      expr = append /foo "./bar//baz/./";
+      expected = /foo/bar/baz;
+    };
+    testAppendExample3 = {
+      expr = append /. "foo/bar";
+      expected = /foo/bar;
+    };
+    testAppendExample4 = {
+      expr = (builtins.tryEval (append "/foo" "bar")).success;
+      expected = false;
+    };
+    testAppendExample5 = {
+      expr = (builtins.tryEval (append /foo /bar)).success;
+      expected = false;
+    };
+    testAppendExample6 = {
+      expr = (builtins.tryEval (append /foo "")).success;
+      expected = false;
+    };
+    testAppendExample7 = {
+      expr = (builtins.tryEval (append /foo "/bar")).success;
+      expected = false;
+    };
+    testAppendExample8 = {
+      expr = (builtins.tryEval (append /foo "../bar")).success;
+      expected = false;
+    };
+
+    # Test examples from the lib.path.subpath.isValid documentation
     testSubpathIsValidExample1 = {
       expr = subpath.isValid null;
       expected = false;
···
       expr = subpath.isValid "./foo//bar/";
       expected = true;
     };
+    # Some extra tests
     testSubpathIsValidTwoDotsEnd = {
       expr = subpath.isValid "foo/..";
       expected = false;
···
       expected = true;
     };
 
+    # Test examples from the lib.path.subpath.normalise documentation
     testSubpathNormaliseExample1 = {
       expr = subpath.normalise "foo//bar";
       expected = "./foo/bar";
···
       expr = (builtins.tryEval (subpath.normalise "/foo")).success;
       expected = false;
     };
+    # Some extra tests
     testSubpathNormaliseIsValidDots = {
       expr = subpath.normalise "./foo/.bar/.../baz...qux";
       expected = "./foo/.bar/.../baz...qux";

maintainers/maintainer-list.nix

···
     githubId = 1592375;
     name = "Walter Huf";
   };
+  hughobrien = {
+    email = "[e-mail]";
+    github = "hughobrien";
+    githubId = 3400690;
+    name = "Hugh O'Brien";
+  };
   hugolgst = {
     email = "[e-mail]";
     github = "hugolgst";

nixos/doc/manual/configuration/xfce.chapter.md

···
 $ xfconf-query -c xfce4-session -p /compat/LaunchGNOME -s true
 ```
 
-A log-out and re-log will be needed for this to take effect.
+It is necessary to log out and log in again for this to take effect.

nixos/doc/manual/from_md/configuration/xfce.chapter.xml

···
 $ xfconf-query -c xfce4-session -p /compat/LaunchGNOME -s true
 </programlisting>
     <para>
-      A log-out and re-log will be needed for this to take effect.
+      It is necessary to log out and log in again for this to take
+      effect.
     </para>
   </section>
 </chapter>

nixos/lib/test-driver/test_driver/machine.py

···
-from contextlib import _GeneratorContextManager
+from contextlib import _GeneratorContextManager, nullcontext
 from pathlib import Path
 from queue import Queue
 from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple
···
         return rootlog.nested(msg, my_attrs)
 
     def wait_for_monitor_prompt(self) -> str:
-        with self.nested("waiting for monitor prompt"):
-            assert self.monitor is not None
-            answer = ""
-            while True:
-                undecoded_answer = self.monitor.recv(1024)
-                if not undecoded_answer:
-                    break
-                answer += undecoded_answer.decode()
-                if answer.endswith("(qemu) "):
-                    break
-            return answer
+        assert self.monitor is not None
+        answer = ""
+        while True:
+            undecoded_answer = self.monitor.recv(1024)
+            if not undecoded_answer:
+                break
+            answer += undecoded_answer.decode()
+            if answer.endswith("(qemu) "):
+                break
+        return answer
 
     def send_monitor_command(self, command: str) -> str:
         self.run_callbacks()
-        with self.nested(f"sending monitor command: {command}"):
-            message = f"{command}\n".encode()
-            assert self.monitor is not None
-            self.monitor.send(message)
-            return self.wait_for_monitor_prompt()
+        message = f"{command}\n".encode()
+        assert self.monitor is not None
+        self.monitor.send(message)
+        return self.wait_for_monitor_prompt()
 
     def wait_for_unit(
         self, unit: str, user: Optional[str] = None, timeout: int = 900
···
         self.shell.send("echo ${PIPESTATUS[0]}\n".encode())
         rc = int(self._next_newline_closed_block_from_shell().strip())
 
-        return (rc, output.decode())
+        return (rc, output.decode(errors="replace"))
 
     def shell_interact(self, address: Optional[str] = None) -> None:
         """Allows you to interact with the guest shell for debugging purposes.
···
             retry(tty_matches)
 
     def send_chars(self, chars: str, delay: Optional[float] = 0.01) -> None:
-        with self.nested(f"sending keys '{chars}'"):
+        with self.nested(f"sending keys {repr(chars)}"):
             for char in chars:
-                self.send_key(char, delay)
+                self.send_key(char, delay, log=False)
 
     def wait_for_file(self, filename: str) -> None:
         """Waits until the file exists in machine's file system."""
···
                 if matches is not None:
                     return
 
-    def send_key(self, key: str, delay: Optional[float] = 0.01) -> None:
+    def send_key(
+        self, key: str, delay: Optional[float] = 0.01, log: Optional[bool] = True
+    ) -> None:
         key = CHAR_TO_KEY.get(key, key)
-        self.send_monitor_command(f"sendkey {key}")
-        if delay is not None:
-            time.sleep(delay)
+        context = self.nested(f"sending key {repr(key)}") if log else nullcontext()
+        with context:
+            self.send_monitor_command(f"sendkey {key}")
+            if delay is not None:
+                time.sleep(delay)
 
     def send_console(self, chars: str) -> None:
         assert self.process

nixos/modules/hardware/video/nvidia.nix

···
   pCfg = cfg.prime;
   syncCfg = pCfg.sync;
   offloadCfg = pCfg.offload;
-  primeEnabled = syncCfg.enable || offloadCfg.enable;
+  reverseSyncCfg = pCfg.reverseSync;
+  primeEnabled = syncCfg.enable || reverseSyncCfg.enable || offloadCfg.enable;
   nvidiaPersistencedEnabled =  cfg.nvidiaPersistenced;
   nvidiaSettings = cfg.nvidiaSettings;
   busIDType = types.strMatching "([[:print:]]+[\:\@][0-9]{1,3}\:[0-9]{1,2}\:[0-9])?";
···
   imports =
     [
       (mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "enable" ] [ "hardware" "nvidia" "prime" "sync" "enable" ])
-      (mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "allowExternalGpu" ] [ "hardware" "nvidia" "prime" "sync" "allowExternalGpu" ])
+      (mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "allowExternalGpu" ] [ "hardware" "nvidia" "prime" "allowExternalGpu" ])
+      (mkRenamedOptionModule [ "hardware" "nvidia" "prime" "sync" "allowExternalGpu" ] [ "hardware" "nvidia" "prime" "allowExternalGpu" ])
       (mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "nvidiaBusId" ] [ "hardware" "nvidia" "prime" "nvidiaBusId" ])
       (mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "intelBusId" ] [ "hardware" "nvidia" "prime" "intelBusId" ])
     ];
···
       description = lib.mdDoc ''
         Enable NVIDIA Optimus support using the NVIDIA proprietary driver via PRIME.
         If enabled, the NVIDIA GPU will be always on and used for all rendering,
-        while enabling output to displays attached only to the integrated Intel GPU
-        without a multiplexer.
+        while enabling output to displays attached only to the integrated Intel/AMD
+        GPU without a multiplexer.
 
         Note that this option only has any effect if the "nvidia" driver is specified
         in {option}`services.xserver.videoDrivers`, and it should preferably
         be the only driver there.
 
-        If this is enabled, then the bus IDs of the NVIDIA and Intel GPUs have to be
-        specified ({option}`hardware.nvidia.prime.nvidiaBusId` and
-        {option}`hardware.nvidia.prime.intelBusId`).
+        If this is enabled, then the bus IDs of the NVIDIA and Intel/AMD GPUs have to
+        be specified ({option}`hardware.nvidia.prime.nvidiaBusId` and
+        {option}`hardware.nvidia.prime.intelBusId` or
+        {option}`hardware.nvidia.prime.amdgpuBusId`).
 
         If you enable this, you may want to also enable kernel modesetting for the
         NVIDIA driver ({option}`hardware.nvidia.modesetting.enable`) in order
···
       '';
     };
 
-    hardware.nvidia.prime.sync.allowExternalGpu = mkOption {
+    hardware.nvidia.prime.allowExternalGpu = mkOption {
       type = types.bool;
       default = false;
       description = lib.mdDoc ''
-        Configure X to allow external NVIDIA GPUs when using optimus.
+        Configure X to allow external NVIDIA GPUs when using Prime [Reverse] sync optimus.
       '';
     };
 
···
       description = lib.mdDoc ''
         Enable render offload support using the NVIDIA proprietary driver via PRIME.
 
-        If this is enabled, then the bus IDs of the NVIDIA and Intel GPUs have to be
-        specified ({option}`hardware.nvidia.prime.nvidiaBusId` and
-        {option}`hardware.nvidia.prime.intelBusId`).
+        If this is enabled, then the bus IDs of the NVIDIA and Intel/AMD GPUs have to
+        be specified ({option}`hardware.nvidia.prime.nvidiaBusId` and
+        {option}`hardware.nvidia.prime.intelBusId` or
+        {option}`hardware.nvidia.prime.amdgpuBusId`).
+      '';
+    };
+
+    hardware.nvidia.prime.offload.enableOffloadCmd = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Adds a `nvidia-offload` convenience script to {option}`environment.systemPackages`
+        for offloading programs to an nvidia device. To work, should have also enabled
+        {option}`hardware.nvidia.prime.offload.enable` or {option}`hardware.nvidia.prime.reverseSync.enable`.
+
+        Example usage `nvidia-offload sauerbraten_client`.
+      '';
+    };
+
+    hardware.nvidia.prime.reverseSync.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Warning: This feature is relatively new, depending on your system this might
+        work poorly. AMD support, especially so.
+        See: https://forums.developer.nvidia.com/t/the-all-new-outputsink-feature-aka-reverse-prime/129828
+
+        Enable NVIDIA Optimus support using the NVIDIA proprietary driver via reverse
+        PRIME. If enabled, the Intel/AMD GPU will be used for all rendering, while
+        enabling output to displays attached only to the NVIDIA GPU without a
+        multiplexer.
+
+        Note that this option only has any effect if the "nvidia" driver is specified
+        in {option}`services.xserver.videoDrivers`, and it should preferably
+        be the only driver there.
+
+        If this is enabled, then the bus IDs of the NVIDIA and Intel/AMD GPUs have to
+        be specified ({option}`hardware.nvidia.prime.nvidiaBusId` and
+        {option}`hardware.nvidia.prime.intelBusId` or
+        {option}`hardware.nvidia.prime.amdgpuBusId`).
+
+        If you enable this, you may want to also enable kernel modesetting for the
+        NVIDIA driver ({option}`hardware.nvidia.modesetting.enable`) in order
+        to prevent tearing.
+
+        Note that this configuration will only be successful when a display manager
+        for which the {option}`services.xserver.displayManager.setupCommands`
+        option is supported is used.
       '';
     };
 
···
       }
 
       {
+        assertion = offloadCfg.enableOffloadCmd -> offloadCfg.enable || reverseSyncCfg.enable;
+        message = ''
+          Offload command requires offloading or reverse prime sync to be enabled.
+        '';
+      }
+
+      {
         assertion = primeEnabled -> pCfg.nvidiaBusId != "" && (pCfg.intelBusId != "" || pCfg.amdgpuBusId != "");
         message = ''
           When NVIDIA PRIME is enabled, the GPU bus IDs must configured.
···
       }
 
       {
+        assertion = (reverseSyncCfg.enable && pCfg.amdgpuBusId != "") -> versionAtLeast nvidia_x11.version "470.0";
+        message = "NVIDIA PRIME render offload for AMD APUs is currently only supported on versions >= 470 beta.";
+      }
+
+      {
         assertion = !(syncCfg.enable && offloadCfg.enable);
-        message = "Only one NVIDIA PRIME solution may be used at a time.";
+        message = "PRIME Sync and Offload cannot be both enabled";
+      }
+
+      {
+        assertion = !(syncCfg.enable && reverseSyncCfg.enable);
+        message = "PRIME Sync and PRIME Reverse Sync cannot be both enabled";
       }
 
       {
···
     # - Configure the display manager to run specific `xrandr` commands which will
     #   configure/enable displays connected to the Intel iGPU / AMD APU.
 
-    services.xserver.drivers = let
-    in optional primeEnabled {
+    # reverse sync implies offloading
+    hardware.nvidia.prime.offload.enable = mkDefault reverseSyncCfg.enable;
+
+    services.xserver.drivers = optional primeEnabled {
       name = igpuDriver;
       display = offloadCfg.enable;
       modules = optionals (igpuDriver == "amdgpu") [ pkgs.xorg.xf86videoamdgpu ];
···
       deviceSection = optionalString primeEnabled
         ''
           BusID "${pCfg.nvidiaBusId}"
-          ${optionalString syncCfg.allowExternalGpu "Option \"AllowExternalGpus\""}
+          ${optionalString pCfg.allowExternalGpu "Option \"AllowExternalGpus\""}
         '';
       screenSection =
         ''
···
 
     services.xserver.serverLayoutSection = optionalString syncCfg.enable ''
       Inactive "Device-${igpuDriver}[0]"
+    '' + optionalString reverseSyncCfg.enable ''
+      Inactive "Device-nvidia[0]"
     '' + optionalString offloadCfg.enable ''
       Option "AllowNVIDIAGPUScreens"
     '';
 
     services.xserver.displayManager.setupCommands = let
-      sinkGpuProviderName = if igpuDriver == "amdgpu" then
+      gpuProviderName = if igpuDriver == "amdgpu" then
         # find the name of the provider if amdgpu
         "`${pkgs.xorg.xrandr}/bin/xrandr --listproviders | ${pkgs.gnugrep}/bin/grep -i AMD | ${pkgs.gnused}/bin/sed -n 's/^.*name://p'`"
       else
         igpuDriver;
-    in optionalString syncCfg.enable ''
+      providerCmdParams = if syncCfg.enable then "\"${gpuProviderName}\" NVIDIA-0" else "NVIDIA-G0 \"${gpuProviderName}\"";
+    in optionalString (syncCfg.enable || reverseSyncCfg.enable) ''
       # Added by nvidia configuration module for Optimus/PRIME.
-      ${pkgs.xorg.xrandr}/bin/xrandr --setprovideroutputsource "${sinkGpuProviderName}" NVIDIA-0
+      ${pkgs.xorg.xrandr}/bin/xrandr --setprovideroutputsource ${providerCmdParams}
       ${pkgs.xorg.xrandr}/bin/xrandr --auto
     '';
 
···
 
     environment.systemPackages = [ nvidia_x11.bin ]
       ++ optionals cfg.nvidiaSettings [ nvidia_x11.settings ]
-      ++ optionals nvidiaPersistencedEnabled [ nvidia_x11.persistenced ];
+      ++ optionals nvidiaPersistencedEnabled [ nvidia_x11.persistenced ]
+      ++ optionals offloadCfg.enableOffloadCmd [
+        (pkgs.writeShellScriptBin "nvidia-offload" ''
+          export __NV_PRIME_RENDER_OFFLOAD=1
+          export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0
+          export __GLX_VENDOR_LIBRARY_NAME=nvidia
+          export __VK_LAYER_NV_optimus=NVIDIA_only
+          exec "$@"
+        '')
+      ];
 
     systemd.packages = optional cfg.powerManagement.enable nvidia_x11.out;
 

nixos/modules/services/mail/roundcube.nix

···
             root = cfg.package;
             index = "index.php";
             extraConfig = ''
-              location ~* \.php$ {
+              location ~* \.php(/|$) {
                 fastcgi_split_path_info ^(.+\.php)(/.+)$;
                 fastcgi_pass unix:${fpm.socket};
+
+                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+                fastcgi_param PATH_INFO       $fastcgi_path_info;
+
                 include ${config.services.nginx.package}/conf/fastcgi_params;
                 include ${pkgs.nginx}/conf/fastcgi.conf;
               }

nixos/tests/all-tests.nix

···
   gnome = handleTest ./gnome.nix {};
   gnome-flashback = handleTest ./gnome-flashback.nix {};
   gnome-xorg = handleTest ./gnome-xorg.nix {};
+  gnupg = handleTest ./gnupg.nix {};
   go-neb = handleTest ./go-neb.nix {};
   gobgpd = handleTest ./gobgpd.nix {};
   gocd-agent = handleTest ./gocd-agent.nix {};

nixos/tests/gnupg.nix

···
+import ./make-test-python.nix ({ pkgs, lib, ...}:
+
+{
+  name = "gnupg";
+  meta = with lib.maintainers; {
+    maintainers = [ rnhmjoj ];
+  };
+
+  # server for testing SSH
+  nodes.server = { ... }: {
+    imports = [ ../modules/profiles/minimal.nix ];
+
+    users.users.alice.isNormalUser = true;
+    services.openssh.enable = true;
+  };
+
+  # machine for testing GnuPG
+  nodes.machine = { pkgs, ... }: {
+    imports = [ ../modules/profiles/minimal.nix ];
+
+    users.users.alice.isNormalUser = true;
+    services.getty.autologinUser = "alice";
+
+    environment.shellInit = ''
+      # preset a key passphrase in gpg-agent
+      preset_key() {
+        # find all keys
+        case "$1" in
+          ssh) grips=$(awk '/^[0-9A-F]/{print $1}' "''${GNUPGHOME:-$HOME/.gnupg}/sshcontrol") ;;
+          pgp) grips=$(gpg --with-keygrip --list-secret-keys | awk '/Keygrip/{print $3}') ;;
+        esac
+
+        # try to preset the passphrase for each key found
+        for grip in $grips; do
+          "$(gpgconf --list-dirs libexecdir)/gpg-preset-passphrase" -c -P "$2" "$grip"
+        done
+      }
+    '';
+
+    programs.gnupg.agent.enable = true;
+    programs.gnupg.agent.enableSSHSupport = true;
+  };
+
+  testScript =
+    ''
+      import shlex
+
+
+      def as_alice(command: str) -> str:
+          """
+          Wraps a command to run it as Alice in a login shell
+          """
+          quoted = shlex.quote(command)
+          return "su --login alice --command " + quoted
+
+
+      start_all()
+
+      with subtest("Wait for the autologin"):
+          machine.wait_until_tty_matches("1", "alice@machine")
+
+      with subtest("Can generate a PGP key"):
+          # Note: this needs a tty because of pinentry
+          machine.send_chars("gpg --gen-key\n")
+          machine.wait_until_tty_matches("1", "Real name:")
+          machine.send_chars("Alice\n")
+          machine.wait_until_tty_matches("1", "Email address:")
+          machine.send_chars("alice@machine\n")
+          machine.wait_until_tty_matches("1", "Change")
+          machine.send_chars("O\n")
+          machine.wait_until_tty_matches("1", "Please enter")
+          machine.send_chars("pgp_p4ssphrase\n")
+          machine.wait_until_tty_matches("1", "Please re-enter")
+          machine.send_chars("pgp_p4ssphrase\n")
+          machine.wait_until_tty_matches("1", "public and secret key created")
+
+      with subtest("Confirm the key is in the keyring"):
+          machine.wait_until_succeeds(as_alice("gpg --list-secret-keys | grep -q alice@machine"))
+
+      with subtest("Can generate and add an SSH key"):
+          machine.succeed(as_alice("ssh-keygen -t ed25519 -f alice -N ssh_p4ssphrase"))
+
+          # Note: apparently this must be run before using the OpenSSH agent
+          # socket for the first time in a tty. It's not needed for `ssh`
+          # because there's a hook that calls it automatically (only in NixOS).
+          machine.send_chars("gpg-connect-agent updatestartuptty /bye\n")
+
+          # Note: again, this needs a tty because of pinentry
+          machine.send_chars("ssh-add alice\n")
+          machine.wait_until_tty_matches("1", "Enter passphrase")
+          machine.send_chars("ssh_p4ssphrase\n")
+          machine.wait_until_tty_matches("1", "Please enter")
+          machine.send_chars("ssh_agent_p4ssphrase\n")
+          machine.wait_until_tty_matches("1", "Please re-enter")
+          machine.send_chars("ssh_agent_p4ssphrase\n")
+
+      with subtest("Confirm the SSH key has been registered"):
+          machine.wait_until_succeeds(as_alice("ssh-add -l | grep -q alice@machine"))
+
+      with subtest("Can preset the key passphrases in the agent"):
+          machine.succeed(as_alice("echo allow-preset-passphrase > .gnupg/gpg-agent.conf"))
+          machine.succeed(as_alice("pkill gpg-agent"))
+          machine.succeed(as_alice("preset_key pgp pgp_p4ssphrase"))
+          machine.succeed(as_alice("preset_key ssh ssh_agent_p4ssphrase"))
+
+      with subtest("Can encrypt and decrypt a message"):
+          machine.succeed(as_alice("echo Hello | gpg -e -r alice | gpg -d | grep -q Hello"))
+
+      with subtest("Can log into the server"):
+          # Install Alice's public key
+          public_key = machine.succeed(as_alice("cat alice.pub"))
+          server.succeed("mkdir /etc/ssh/authorized_keys.d")
+          server.succeed(f"printf '{public_key}' > /etc/ssh/authorized_keys.d/alice")
+
+          server.wait_for_open_port(22)
+          machine.succeed(as_alice("ssh -i alice -o StrictHostKeyChecking=no server exit"))
+    '';
+})

pkgs/applications/audio/bambootracker/default.nix

···
-{ mkDerivation
-, stdenv
+{ stdenv
 , lib
 , fetchFromGitHub
-, qmake
 , pkg-config
-, qttools
+, qmake
+, qt5compat ? null
 , qtbase
+, qttools
 , rtaudio
 , rtmidi
+, wrapQtAppsHook
 }:
 
-mkDerivation rec {
+assert lib.versionAtLeast qtbase.version "6.0" -> qt5compat != null;
+
+stdenv.mkDerivation rec {
   pname = "bambootracker";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "BambooTracker";
     repo = "BambooTracker";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-yubaKTc8NFLxMY0/5c2VubRHgAGOsRlitmXJ1UHzl60=";
+    hash = "sha256-Ymi1tjJCgStF0Rtseelq/YuTtBs2PrbF898TlbjyYUw=";
   };
 
-  nativeBuildInputs = [ qmake qttools pkg-config ];
+  postPatch = lib.optionalString (lib.versionAtLeast qtbase.version "6.0") ''
+    # Work around lrelease finding in qmake being broken by using pre-Qt5.12 code path
+    # https://github.com/NixOS/nixpkgs/issues/214765
+    substituteInPlace BambooTracker/lang/lang.pri \
+      --replace 'equals(QT_MAJOR_VERSION, 5):lessThan(QT_MINOR_VERSION, 12)' 'if(true)'
+  '';
 
-  buildInputs = [ qtbase rtaudio rtmidi ];
+  nativeBuildInputs = [
+    pkg-config
+    qmake
+    qttools
+    wrapQtAppsHook
+  ];
 
-  qmakeFlags = [ "CONFIG+=system_rtaudio" "CONFIG+=system_rtmidi" ];
+  buildInputs = [
+    qtbase
+    rtaudio
+    rtmidi
+  ] ++ lib.optionals (lib.versionAtLeast qtbase.version "6.0") [
+    qt5compat
+  ];
+
+  qmakeFlags = [
+    "CONFIG+=system_rtaudio"
+    "CONFIG+=system_rtmidi"
+  ];
 
   postConfigure = "make qmake_all";
+
+  # Wrapping the inside of the app bundles, avoiding double-wrapping
+  dontWrapQtApps = stdenv.hostPlatform.isDarwin;
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p $out/Applications
     mv $out/{bin,Applications}/BambooTracker.app
     ln -s $out/{Applications/BambooTracker.app/Contents/MacOS,bin}/BambooTracker
+    wrapQtApp $out/Applications/BambooTracker.app/Contents/MacOS/BambooTracker
   '';
 
   meta = with lib; {

pkgs/applications/audio/lollypop/default.nix

···
 { lib
-, fetchgit
+, fetchFromGitLab
 , nix-update-script
 , meson
 , ninja
···
 , gst_all_1
 , libhandy
 , libsecret
-, libsoup
+, libsoup_3
 , appstream-glib
 , desktop-file-utils
 , totem-pl-parser
···
 
 python3.pkgs.buildPythonApplication rec  {
   pname = "lollypop";
-  version = "1.4.35";
+  version = "1.4.37";
 
   format = "other";
-  doCheck = false;
 
-  src = fetchgit {
-    url = "https://gitlab.gnome.org/World/lollypop";
-    rev = "refs/tags/${version}";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = pname;
+    rev = version;
     fetchSubmodules = true;
-    sha256 = "sha256-Rdp0gZjdj2tXOWarsTpqgvSZVXAQsCLfk5oUyalE/ZA=";
+    sha256 = "sha256-3GPmGNbbSxvLq0t3F9q1x64BwNQCEvFQWLb0bSO9KUY=";
   };
 
   nativeBuildInputs = [
···
     gstreamer
     gtk3
     libhandy
-    libsoup
+    libsoup_3
     pango
     totem-pl-parser
   ] ++ lib.optional lastFMSupport libsecret;
···
   passthru = {
     updateScript = nix-update-script { };
   };
-
 
   meta = with lib; {
     changelog = "https://gitlab.gnome.org/World/lollypop/tags/${version}";

pkgs/applications/audio/pbpctrl/default.nix

···
+{ rustPlatform
+, fetchFromGitHub
+, pkg-config
+, dbus
+, protobuf
+, lib
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "pbpctrl";
+
+  # https://github.com/qzed/pbpctrl/issues/4
+  version = "unstable-2023-02-07";
+
+  src = fetchFromGitHub {
+    owner = "qzed";
+    repo = "${pname}";
+    rev = "9fef4bb88046a9f00719b189f8e378c8dbdb8ee6";
+    hash = "sha256-8YbsBqqITJ9bKzbGX6d/CSBb8wzr6bDzy8vsyntL1CA=";
+  };
+
+  cargoHash = "sha256-ZxJjjaT/ZpEPxvO42UWBy3xW/V5dhXGsKn3KmuM89YA==";
+
+  nativeBuildInputs = [ pkg-config protobuf ];
+  buildInputs = [ dbus ];
+
+  meta = with lib; {
+    description = "Control Google Pixel Buds Pro from the Linux command line.";
+    homepage = "https://github.com/qzed/pbpctrl";
+    license = with licenses; [ asl20 mit ];
+    maintainers = [ maintainers.vanilla ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/audio/shortwave/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "shortwave";
-  version = "3.1.0";
+  version = "3.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "Shortwave";
     rev = version;
-    sha256 = "sha256-N0ftIq0+sxkpo56IGHZYAK6MgRNW7T6C2jWEiJsYy/Y=";
+    sha256 = "sha256-ESZ1yD1IuBar8bv83xMczZbtPtHbWRpe2yMVyr7K5gQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-90JBN3cJKqIJX6DRq5FtEpIr5Isxf+jb1SlxGMbBwMQ=";
+    hash = "sha256-8W46bGAitR2YbZbnsigAZMW5pSFTkDAe5JNaNOH5JfA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/spotify-player/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-player";
-  version = "0.10.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "aome510";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-bHPWpx8EJibr2kNuzuGAQPZ0DE6qeJwIRYDy+NFS/PQ=";
+    sha256 = "sha256-iaDaPjh2wZXxBxBDhWp+hHrJZyXqw6HSzgCzbZj9iho=";
   };
 
-  cargoSha256 = "sha256-QeQ3PYI5RmbJ+VQ9hLSTXgQXVVoID5zbRqSTrbWzVy8=";
+  cargoHash = "sha256-I8n/fR1aOsSex2p0u5FaqoJCh2J0oMxkikS9aynxgpA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/editors/eclipse/default.nix

···
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops${platform_major}/R-${platform_major}.${platform_minor}-${timestamp}/eclipse-SDK-${platform_major}.${platform_minor}-linux-gtk-${arch}.tar.gz";
         hash = {
-          x86_64 = "sha512-hmdWGteMDt4HhYq+k9twuftalpTzHtGnVVLphZcpJcw+6vJfersciDMaeLRqbCAeFbzJdgzjYo76bpP6FubySw==";
+          x86_64 = "sha512-yH4/K9sBLCUc2EVYwPL0dLql/S3AfaV6fFh7ewAuIb7yHtcsOWMqy/h1hZUlFFg2ykfwDWDDHEK7qfTI0hM7BQ==";
           aarch64 = "sha512-UYp8t7r2RrN3rKN180cWpJyhyO5LVXL8LrTRKJzttUgB7kM1nroTEI3DesBu+Hw4Ynl7eLiBK397rqcpOAfxJw==";
         }.${arch};
       };

pkgs/applications/editors/gnome-builder/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "gnome-builder";
-  version = "43.5";
+  version = "43.6";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Rav15H1s4jzjTXjFcOgeBrIntD6ZoRMlcy7GXhskU+o=";
+    sha256 = "m08hPdloyVL75CJoUPXJVk3f1XimoPiT06K2rhmjd6k=";
   };
 
   patches = [

pkgs/applications/emulators/rpcs3/default.nix

···
 
 let
   # Keep these separate so the update script can regex them
-  rpcs3GitVersion = "14637-c471120a8";
-  rpcs3Version = "0.0.26-14637-c471120a8";
-  rpcs3Revision = "c471120a80ec6f12cd4489e1a9be073d7d9c96f2";
-  rpcs3Sha256 = "1fl7zarxbjaz6mi3lqv55kdwpvjfz8d02qfl0655zihwm6zzdny5";
+  rpcs3GitVersion = "14684-8652b7d35";
+  rpcs3Version = "0.0.26-14684-8652b7d35";
+  rpcs3Revision = "8652b7d358fe975242dd2c51c91fd2968e6bcb82";
+  rpcs3Sha256 = "08cd082cih9pcppipkhid1x1s7bq4grsz0zfa1rlxkzw3lajxnrf";
 
   ittapi = fetchFromGitHub {
     owner = "intel";

pkgs/applications/gis/qgis/unwrapped-ltr.nix

···
     six
   ];
 in mkDerivation rec {
-  version = "3.22.15";
+  version = "3.22.16";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-0hly1yZ7NAcSe84XMwDlcmZPunPcNXYzvAhd0Z5rB0Q=";
+    hash = "sha256-6UpWVEyh94Oo6eI/dEmDuJHRwpPtkEsksjE90iAUgo8=";
   };
 
   passthru = {

pkgs/applications/graphics/ImageMagick/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.1.0-60";
+  version = "7.1.0-61";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    hash = "sha256-dQfmW9rt66eWOaKbZ9j8jc1k8v+F8B9TpTx12L+0VE4=";
+    hash = "sha256-g7WeqPpPd1gceU+s+vRDpb41IX1lzpiqh3cAYeFdUlg=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big

pkgs/applications/misc/moolticute/default.nix

···
 
 mkDerivation rec {
   pname = "moolticute";
-  version = "1.00.1";
+  version = "1.01.0";
 
   src = fetchFromGitHub {
     owner = "mooltipass";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-oENMr3d2vFisEFl7gYBQQ0XRBeogAYOfBE5th463laI=";
+    sha256 = "sha256-6vqYyAJ9p0ey49kc2Tp/HZVv0mePARX2dcmcIG4bcNQ=";
   };
 
   outputs = [ "out" "udev" ];
···
     '';
     homepage = "https://github.com/mooltipass/moolticute";
     license = licenses.gpl3Plus;
-    maintainers = [ maintainers.kirikaza ];
+    maintainers = with maintainers; [ kirikaza hughobrien ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/misc/privacyidea/default.nix

···
 in
 python3'.pkgs.buildPythonPackage rec {
   pname = "privacyIDEA";
-  version = "3.8";
+  version = "3.8.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-FCvuWXon8c9LnX1FnCxcSTfBR5/6zijD6ld0iAEVFkU=";
+    sha256 = "sha256-SYXw8PBCb514v3rcy15W/vZS5JyMsu81D2sJmviLRtw=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/cluster/glooctl/default.nix

···
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.13.4";
+  version = "1.13.5";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-eyfMWum1fZUq4iF77Q+0FP2Rdq2P+xK0au3ytN8MS+k=";
+    hash = "sha256-mBmjGP7O1uX+uVM4/us4RWeJcXB1lSEvZQWT/3Ygzik=";
   };
 
   subPackages = [ "projects/gloo/cli/cmd" ];

pkgs/applications/networking/instant-messengers/zulip/default.nix

···
 
 let
   pname = "zulip";
-  version = "5.9.4";
+  version = "5.9.5";
 
   src = fetchurl {
     url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
-    hash = "sha256-gbusyhMgoaQmeWm6dB6pc3kSykD4T97VQcJgcF5KbzM=";
+    hash = "sha256-w2thmF/UA42j3u3m4L+/onilQhwMOa7IJoOMZ/ERypw=";
     name="${pname}-${version}.AppImage";
   };
 

pkgs/applications/networking/n8n/node-packages.nix

···
         sha512 = "UA/8dgLy3+ZiwJjAZHxL4MUB14fFQPkaAOZ94jsTW/Z6WmoOeny2+cLk0+dyIX/iH6qSrEWKwbStEeB970B9pA==";
       };
     };
-    "@azure/msal-browser-2.32.2" = {
+    "@azure/msal-browser-2.33.0" = {
       name = "_at_azure_slash_msal-browser";
       packageName = "@azure/msal-browser";
-      version = "2.32.2";
+      version = "2.33.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@azure/msal-browser/-/msal-browser-2.32.2.tgz";
-        sha512 = "1YqGzXtPG3QrZPFBKaMWr2WQdukDj+PelqUCv351+p+hlw/AhdRrb8haY73/iqkhT6Cdrbnh7sL4gikVsF4O1g==";
+        url = "https://registry.npmjs.org/@azure/msal-browser/-/msal-browser-2.33.0.tgz";
+        sha512 = "c7CVh1tfUfxiWkEIhoIb11hL4PGo4hz0M+gMy34ATagAKdLK7qyEu/5AXJWAf5lz5eE+vQhm7+LKiuETrcXXGw==";
+      };
+    };
+    "@azure/msal-common-10.0.0" = {
+      name = "_at_azure_slash_msal-common";
+      packageName = "@azure/msal-common";
+      version = "10.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@azure/msal-common/-/msal-common-10.0.0.tgz";
+        sha512 = "/LghpT93jsZLy55QzTsRZWMx6R1Mjc1Aktwps8sKSGE3WbrGwbSsh2uhDlpl6FMcKChYjJ0ochThWwwOodrQNg==";
       };
     };
     "@azure/msal-common-4.5.1" = {
···
         sha512 = "XqfbglUTVLdkHQ8F9UQJtKseRr3sSnr9ysboxtoswvaMVaEfvyLtMoHv9XdKUfOc0qKGzNgRFd9yRjIWVepl6Q==";
       };
     };
-    "@azure/msal-common-9.1.1" = {
-      name = "_at_azure_slash_msal-common";
-      packageName = "@azure/msal-common";
-      version = "9.1.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@azure/msal-common/-/msal-common-9.1.1.tgz";
-        sha512 = "we9xR8lvu47fF0h+J8KyXoRy9+G/fPzm3QEa2TrdR3jaVS3LKAyE2qyMuUkNdbVkvzl8Zr9f7l+IUSP22HeqXw==";
-      };
-    };
     "@azure/msal-node-1.0.0-beta.6" = {
       name = "_at_azure_slash_msal-node";
       packageName = "@azure/msal-node";
···
         sha512 = "ZQI11Uz1j0HJohb9JZLRD8z0moVcPks1AFW4Q/Gcl67+QvH4aKEJti7fjCcipEEZYb/qzLSO8U6IZgPYytsiJQ==";
       };
     };
-    "@azure/msal-node-1.14.6" = {
+    "@azure/msal-node-1.15.0" = {
       name = "_at_azure_slash_msal-node";
       packageName = "@azure/msal-node";
-      version = "1.14.6";
+      version = "1.15.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@azure/msal-node/-/msal-node-1.14.6.tgz";
-        sha512 = "em/qqFL5tLMxMPl9vormAs13OgZpmQoJbiQ/GlWr+BA77eCLoL+Ehr5xRHowYo+LFe5b+p+PJVkRvT+mLvOkwA==";
+        url = "https://registry.npmjs.org/@azure/msal-node/-/msal-node-1.15.0.tgz";
+        sha512 = "fwC5M0c8pxOAzmScPbpx7j28YVTDebUaizlVF7bR0xvlU0r3VWW5OobCcr9ybqKS6wGyO7u4EhXJS9rjRWAuwA==";
       };
     };
     "@azure/storage-blob-12.12.0" = {
···
         sha512 = "erqUpFXksaeR2kejKnhnjZjbFxUpGZx4Z7ydNL9ie8tEhXPiZTsLeUDJ6aR1F8j5wWUAtOAQWUqkc7givBJbBA==";
       };
     };
-    "@types/express-4.17.16" = {
+    "@types/express-4.17.17" = {
       name = "_at_types_slash_express";
       packageName = "@types/express";
-      version = "4.17.16";
+      version = "4.17.17";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/express/-/express-4.17.16.tgz";
-        sha512 = "LkKpqRZ7zqXJuvoELakaFYuETHjZkSol8EV6cNnyishutDBCCdv6+dsKPbKkCcIk57qRphOLY5sEgClw1bO3gA==";
+        url = "https://registry.npmjs.org/@types/express/-/express-4.17.17.tgz";
+        sha512 = "Q4FmmuLGBG58btUnfS1c1r/NQdlp3DMfGDGig8WhfpA2YRUtEkxAjkZb0yvplJGYdF1fsQ81iMDcH24sSCNC/Q==";
       };
     };
     "@types/express-jwt-0.0.42" = {
···
         sha512 = "/SNsDidUFCvqqcWDwxv2feww/yqhNeTRL5CVoL3jU4Goc4kKEL10T7Eye65ZqPNi4HRx8sAEX59pV1aEH7drNA==";
       };
     };
-    "@types/node-18.11.18" = {
+    "@types/node-18.11.19" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "18.11.18";
+      version = "18.11.19";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-18.11.18.tgz";
-        sha512 = "DHQpWGjyQKSHj3ebjFI/wRKcqQcdR+MoFBygntYOZytCqNfkd2ZC4ARDJ2DQqhjH5p85Nnd3jhUJIXrszFX/JA==";
+        url = "https://registry.npmjs.org/@types/node/-/node-18.11.19.tgz";
+        sha512 = "YUgMWAQBWLObABqrvx8qKO1enAvBUdjZOAWQ5grBAkp5LQv45jBvYKZ3oFS9iKRCQyFjqw6iuEa1vmFqtxYLZw==";
       };
     };
     "@types/node-fetch-2.6.2" = {
···
         sha512 = "kr90f+ERiQtKWMz5rP32ltJ/BtULDI5RVO0uavn1HQUOwjx0R1h0rnDYNL0CepF1zL5bSY6FISAfd9tOdDhU5Q==";
       };
     };
-    "@types/validator-13.7.11" = {
+    "@types/validator-13.7.12" = {
       name = "_at_types_slash_validator";
       packageName = "@types/validator";
-      version = "13.7.11";
+      version = "13.7.12";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/validator/-/validator-13.7.11.tgz";
-        sha512 = "WqTos+CnAKN64YwyBMhgUYhb5VsTNKwUY6AuzG5qu9/pFZJar/RJFMZBXwX7VS+uzYi+lIAr3WkvuWqEI9F2eg==";
+        url = "https://registry.npmjs.org/@types/validator/-/validator-13.7.12.tgz";
+        sha512 = "YVtyAPqpefU+Mm/qqnOANW6IkqKpCSrarcyV269C8MA8Ux0dbkEuQwM/4CjL47kVEM2LgBef/ETfkH+c6+moFA==";
       };
     };
     "@types/webidl-conversions-7.0.0" = {
···
         sha512 = "9cYNccliXZDByFsFliVwk5GvTq058Fj513CiR4E60ndDwmuXzTJEp/Bp8FyuRmGyYupLjHLs+JA9/CBoVS4/NQ==";
       };
     };
-    "aws-sdk-2.1308.0" = {
+    "aws-sdk-2.1310.0" = {
       name = "aws-sdk";
       packageName = "aws-sdk";
-      version = "2.1308.0";
+      version = "2.1310.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1308.0.tgz";
-        sha512 = "tm4UXah8dCqt1geyxrtoyp6dN5QhuLjNeACUZEsffww5oZPMx24EX9dAtvtSu3UfIHwmbR74QomYi1c1u8Jndg==";
+        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1310.0.tgz";
+        sha512 = "D0m9uFUa1UVXWTe4GSyNJP4+6DXwboE2FEG/URkLoo4r9Q8LHxwNFCGkBhaoEwssREyRe2LOYS1Nag/6WyvC6Q==";
       };
     };
     "aws-sign2-0.7.0" = {
···
         sha512 = "V/Hy/X9Vt7f3BbPJEi8BdVFMByHi+jNXrYkW3huaybV/kQ0KJg0Y6PkEMbn+zeT+i+SiKZ/HMqJGIIt4LZDqNQ==";
       };
     };
-    "better-sqlite3-8.0.1" = {
+    "better-sqlite3-8.1.0" = {
       name = "better-sqlite3";
       packageName = "better-sqlite3";
-      version = "8.0.1";
+      version = "8.1.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-8.0.1.tgz";
-        sha512 = "JhTZjpyapA1icCEjIZB4TSSgkGdFgpWZA2Wszg7Cf4JwJwKQmbvuNnJBeR+EYG/Z29OXvR4G//Rbg31BW/Z7Yg==";
+        url = "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-8.1.0.tgz";
+        sha512 = "p1m09H+Oi8R9TPj810pdNswMFuVgRNgCJEWypp6jlkOgSwMIrNyuj3hW78xEuBRGok5RzeaUW8aBtTWF3l/TQA==";
       };
     };
     "big-integer-1.6.51" = {
···
         sha512 = "4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==";
       };
     };
-    "ics-2.41.0" = {
+    "ics-2.44.0" = {
       name = "ics";
       packageName = "ics";
-      version = "2.41.0";
+      version = "2.44.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/ics/-/ics-2.41.0.tgz";
-        sha512 = "6oleMfOpdBIrZGMNrTutwW7eFwua8lOkymDNxMXlsVF00HghqH+I3S6frt3a2rfjXTlkI0qiY2rnsKP2JQ9vJA==";
+        url = "https://registry.npmjs.org/ics/-/ics-2.44.0.tgz";
+        sha512 = "JeiPjNeWkd7Qri/wfHqjZCtglVwRJRqy1MEFKn9QzatzxUyCOsx4YARPlLkU8UnPxpg4VtEjR+VRUG+Cvj6bDg==";
       };
     };
     "ieee754-1.1.13" = {
···
         sha512 = "A9SzX4hMKWS25MyalwcOnNoplyHbkNVsjidhTp8ru0Sj23wY9GWBKS8gAIGDSAqeWjIjvE4KBEl24XXAs+v4wQ==";
       };
     };
-    "logform-2.4.2" = {
+    "logform-2.5.0" = {
       name = "logform";
       packageName = "logform";
-      version = "2.4.2";
+      version = "2.5.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/logform/-/logform-2.4.2.tgz";
-        sha512 = "W4c9himeAwXEdZ05dQNerhFz2XG80P9Oj0loPUMV23VC2it0orMHQhJm4hdnnor3rd1HsGf6a2lPwBM1zeXHGw==";
+        url = "https://registry.npmjs.org/logform/-/logform-2.5.0.tgz";
+        sha512 = "fsFiH2yjSCTmzotZ5JmEo0brQyJ7iHrc8pQ5pnHg6e1e5WfkqdNMDvgRWSfz+aCr3Y2YxYzHA4UKj+6QoctKrg==";
       };
     };
     "long-4.0.0" = {
···
         sha512 = "DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==";
       };
     };
-    "minipass-4.0.1" = {
+    "minipass-4.0.2" = {
       name = "minipass";
       packageName = "minipass";
-      version = "4.0.1";
+      version = "4.0.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/minipass/-/minipass-4.0.1.tgz";
-        sha512 = "V9esFpNbK0arbN3fm2sxDKqMYgIp7XtVdE4Esj+PE4Qaaxdg1wIw48ITQIOn1sc8xXSmUviVL3cyjMqPlrVkiA==";
+        url = "https://registry.npmjs.org/minipass/-/minipass-4.0.2.tgz";
+        sha512 = "4Hbzei7ZyBp+1aw0874YWpKOubZd/jc53/XU+gkYry1QV+VvrbO8icLM5CUtm4F0hyXn85DXYKEMIS26gitD3A==";
       };
     };
     "minipass-collect-1.0.2" = {
···
         sha512 = "Dd6SdWYDjlhgrpPbof4DFPP4hPdpH9cA+3YkFSCgQLNyCi0RdqiQJqPQ5xQFlNVaxd6a7R69RHy/oNwt6/+cLw==";
       };
     };
-    "n8n-editor-ui-0.180.0" = {
+    "n8n-editor-ui-0.180.2" = {
       name = "n8n-editor-ui";
       packageName = "n8n-editor-ui";
-      version = "0.180.0";
+      version = "0.180.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.180.0.tgz";
-        sha512 = "Xbjumqnc9chwVWDulXsIhXZ8r9i1nYUzJGBepC6xNM8kTaCRwCokfxUALfFPGNRUBg/A47ez89TNgDY9Mu/X3w==";
+        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.180.2.tgz";
+        sha512 = "5XIIDN6X2CbQtDFwthCOqanvkOgbbFu36h9LZb/eB8KdQKs5dxNFi958lIrKuyZaiPYBQTZCPZWMcqqie+9JIQ==";
       };
     };
-    "n8n-nodes-base-0.212.0" = {
+    "n8n-nodes-base-0.212.2" = {
       name = "n8n-nodes-base";
       packageName = "n8n-nodes-base";
-      version = "0.212.0";
+      version = "0.212.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.212.0.tgz";
-        sha512 = "OENgQkAU70krTAoElQkQTX61Bh/rz2cpip+WDFea+KTXTBqU1gQDNlt3IZdhkS1l0F4e1VfblQawqMeJVFxwbA==";
+        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.212.2.tgz";
+        sha512 = "kmuuZOvQ+c84Eap2TW/RUzTZffYznI9fscTUSZYd8xpFdbptIH9TL0pkkcKhybvOC5y0CFPeMKV5JcH0uEujmw==";
       };
     };
     "n8n-workflow-0.135.0" = {
···
         sha512 = "fgAN3jGAh+RoxUGZHTSOLJIqUc2wmoBwGR4tbpNAKmmovFoWq0OdRkb0VkldReO2a2iBT/OEulG9XSUc10r3zg==";
       };
     };
-    "node-abi-3.31.0" = {
+    "node-abi-3.32.0" = {
       name = "node-abi";
       packageName = "node-abi";
-      version = "3.31.0";
+      version = "3.32.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/node-abi/-/node-abi-3.31.0.tgz";
-        sha512 = "eSKV6s+APenqVh8ubJyiu/YhZgxQpGP66ntzUb3lY1xB9ukSRaGnx0AIxI+IM+1+IVYC1oWobgG5L3Lt9ARykQ==";
+        url = "https://registry.npmjs.org/node-abi/-/node-abi-3.32.0.tgz";
+        sha512 = "HkwdiLzE/LeuOMIQq/dJq70oNyRc88+wt5CH/RXYseE00LkA/c4PkS6Ti1vE4OHYUiKjkwuxjWq9pItgrz8UJw==";
       };
     };
     "node-abort-controller-2.0.0" = {
···
         sha512 = "a7wPxPdVlQL7lqvitHGGRsofhdwtkoSXPGATFuSOA2i1ZNQEPLrGnj68vOp2sOJTCFAQVXPeNMX/GctBaO9L2w==";
       };
     };
-    "tinycolor2-1.5.2" = {
+    "tinycolor2-1.6.0" = {
       name = "tinycolor2";
       packageName = "tinycolor2";
-      version = "1.5.2";
+      version = "1.6.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/tinycolor2/-/tinycolor2-1.5.2.tgz";
-        sha512 = "h80m9GPFGbcLzZByXlNSEhp1gf8Dy+VX/2JCGUZsWLo7lV1mnE/XlxGYgRBoMLJh1lIDXP0EMC4RPTjlRaV+Bg==";
+        url = "https://registry.npmjs.org/tinycolor2/-/tinycolor2-1.6.0.tgz";
+        sha512 = "XPaBkWQJdsf3pLKJV9p4qN/S+fm2Oj8AIPo1BTUhg5oxkvm9+SVEGFdhyOz7tTdUTfvxMiAs4sp6/eZO2Ew+pw==";
       };
     };
     "title-case-3.0.3" = {
···
         sha512 = "ZZKSmDAEFOijERBLkmYfJ+vmk3w+7hOLYDNkRCuRuMJGEmqYNCNLyBBFwWKVMhfwaEF3WOd0Zlw86U/WC/+nYw==";
       };
     };
-    "vm2-3.9.13" = {
+    "vm2-3.9.14" = {
       name = "vm2";
       packageName = "vm2";
-      version = "3.9.13";
+      version = "3.9.14";
       src = fetchurl {
-        url = "https://registry.npmjs.org/vm2/-/vm2-3.9.13.tgz";
-        sha512 = "0rvxpB8P8Shm4wX2EKOiMp7H2zq+HUE/UwodY0pCZXs9IffIKZq6vUti5OgkVCTakKo9e/fgO4X1fkwfjWxE3Q==";
+        url = "https://registry.npmjs.org/vm2/-/vm2-3.9.14.tgz";
+        sha512 = "HgvPHYHeQy8+QhzlFryvSteA4uQLBCOub02mgqdR+0bN/akRZ48TGB1v0aCv7ksyc0HXx16AZtMHKS38alc6TA==";
       };
     };
     "vue-2.6.14" = {
···
   n8n = nodeEnv.buildNodePackage {
     name = "n8n";
     packageName = "n8n";
-    version = "0.214.0";
+    version = "0.214.2";
     src = fetchurl {
-      url = "https://registry.npmjs.org/n8n/-/n8n-0.214.0.tgz";
-      sha512 = "nCwdAvgweOtKOg1ZAMLNoc9PgKBFPHAob3+2mw1UAqV0O+pBFcearssVMczcqiH9yr+PYkL4FKqvrPkB292Iwg==";
+      url = "https://registry.npmjs.org/n8n/-/n8n-0.214.2.tgz";
+      sha512 = "9KbRJMT8/f4+5kiCnqZbe+ETKdBnBb5VJtw7DUbtu3Uj327dtGlPeX2E/kgXwwonnkO6XgdOteJZDSiixxozbg==";
     };
     dependencies = [
       (sources."@acuminous/bitsyntax-0.1.2" // {
···
         ];
       })
       sources."@azure/ms-rest-nodeauth-3.1.1"
-      (sources."@azure/msal-browser-2.32.2" // {
+      (sources."@azure/msal-browser-2.33.0" // {
         dependencies = [
-          sources."@azure/msal-common-9.1.1"
+          sources."@azure/msal-common-10.0.0"
         ];
       })
       sources."@azure/msal-common-7.6.0"
-      (sources."@azure/msal-node-1.14.6" // {
+      (sources."@azure/msal-node-1.15.0" // {
         dependencies = [
-          sources."@azure/msal-common-9.1.1"
+          sources."@azure/msal-common-10.0.0"
         ];
       })
       (sources."@azure/storage-blob-12.12.0" // {
···
       sources."@types/connect-3.4.35"
       sources."@types/duplexify-3.6.1"
       sources."@types/es-aggregate-error-1.0.2"
-      sources."@types/express-4.17.16"
+      sources."@types/express-4.17.17"
       sources."@types/express-jwt-0.0.42"
       sources."@types/express-serve-static-core-4.17.33"
       sources."@types/express-unless-2.0.1"
···
       sources."@types/long-4.0.2"
       sources."@types/mime-3.0.1"
       sources."@types/multer-1.4.7"
-      sources."@types/node-18.11.18"
+      sources."@types/node-18.11.19"
       (sources."@types/node-fetch-2.6.2" // {
         dependencies = [
           sources."form-data-3.0.1"
···
       sources."@types/tough-cookie-2.3.8"
       sources."@types/tunnel-0.0.3"
       sources."@types/uuid-9.0.0"
-      sources."@types/validator-13.7.11"
+      sources."@types/validator-13.7.12"
       sources."@types/webidl-conversions-7.0.0"
       sources."@types/whatwg-url-8.2.2"
       sources."@vue/compiler-sfc-2.7.14"
···
       })
       sources."available-typed-arrays-1.0.5"
       sources."avsc-5.7.7"
-      (sources."aws-sdk-2.1308.0" // {
+      (sources."aws-sdk-2.1310.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."events-1.1.1"
···
       })
       sources."bcrypt-pbkdf-1.0.2"
       sources."bcryptjs-2.4.3"
-      sources."better-sqlite3-8.0.1"
+      sources."better-sqlite3-8.1.0"
       sources."big-integer-1.6.51"
       sources."big.js-6.2.1"
       sources."bignumber.js-2.4.0"
···
       sources."humanize-ms-1.2.1"
       sources."hyperlinker-1.0.0"
       sources."iconv-lite-0.6.3"
-      sources."ics-2.41.0"
+      sources."ics-2.44.0"
       sources."ieee754-1.2.1"
       sources."ignore-5.2.4"
       (sources."imap-0.8.19" // {
···
       sources."lodash.uniqby-4.7.0"
       sources."lodash.unset-4.5.2"
       sources."lodash.zipobject-4.1.3"
-      sources."logform-2.4.2"
+      sources."logform-2.5.0"
       sources."long-4.0.0"
       sources."lossless-json-1.0.5"
       (sources."lower-case-2.0.2" // {
···
         ];
       })
       sources."minimist-1.2.7"
-      sources."minipass-4.0.1"
+      sources."minipass-4.0.2"
       (sources."minipass-collect-1.0.2" // {
         dependencies = [
           sources."minipass-3.3.6"
···
           sources."vue2-boring-avatars-0.3.8"
         ];
       })
-      sources."n8n-editor-ui-0.180.0"
-      (sources."n8n-nodes-base-0.212.0" // {
+      sources."n8n-editor-ui-0.180.2"
+      (sources."n8n-nodes-base-0.212.2" // {
         dependencies = [
           sources."chokidar-3.5.2"
         ];
···
           sources."tslib-2.5.0"
         ];
       })
-      sources."node-abi-3.31.0"
+      sources."node-abi-3.32.0"
       sources."node-abort-controller-3.1.1"
       sources."node-addon-api-4.3.0"
       sources."node-ensure-0.0.0"
···
       sources."through2-filter-3.0.0"
       sources."throwback-4.1.0"
       sources."timeago.js-4.0.2"
-      sources."tinycolor2-1.5.2"
+      sources."tinycolor2-1.6.0"
       (sources."title-case-3.0.3" // {
         dependencies = [
           sources."tslib-2.5.0"
···
           sources."core-util-is-1.0.2"
         ];
       })
-      sources."vm2-3.9.13"
+      sources."vm2-3.9.14"
       sources."vue-2.7.14"
       sources."vue-agile-2.0.0"
       sources."vue-color-2.8.1"

pkgs/applications/science/chemistry/nwchem/default.nix

···
+{ lib
+, stdenv
+, pkgs
+, fetchFromGitHub
+, fetchpatch
+, which
+, openssh
+, gcc
+, gfortran
+, perl
+, mpi
+, blas
+, lapack
+, python3
+, tcsh
+, bash
+, automake
+, autoconf
+, libtool
+, makeWrapper
+}:
+
+assert blas.isILP64 == lapack.isILP64;
+
+let
+  versionGA = "5.7.2"; # Fixed by nwchem
+
+  ga_src = fetchFromGitHub {
+    owner = "GlobalArrays";
+    repo = "ga";
+    rev = "v${versionGA}";
+    sha256 = "0c1y9a5jpdw9nafzfmvjcln1xc2gklskaly0r1alm18ng9zng33i";
+  };
+
+in
+stdenv.mkDerivation rec {
+  pname = "nwchem";
+  version = "7.0.2";
+
+  src = fetchFromGitHub {
+    owner = "nwchemgit";
+    repo = "nwchem";
+    rev = "v${version}-release";
+    sha256 = "1ckhcjaw1hzdsmm1x2fva27c4rs3r0h82qivg72v53idz880hbp3";
+  };
+
+  patches = [
+    # Fix Python 3.10 compatibility
+    (fetchpatch {
+      name = "python3.10";
+      url = "https://github.com/nwchemgit/nwchem/commit/638401361c6f294164a4f820ff867a62ac836fd5.patch";
+      sha256 = "sha256-yUZb3wWYZm1dX0HwvffksFwhVdb7ix1p8ooJnqiSgEg=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    perl
+    automake
+    autoconf
+    libtool
+    makeWrapper
+    gfortran
+    which
+  ];
+  buildInputs = [
+    tcsh
+    openssh
+    blas
+    lapack
+    python3
+  ];
+  propagatedBuildInputs = [ mpi ];
+  propagatedUserEnvPkgs = [ mpi ];
+
+  postUnpack = ''
+    cp -r ${ga_src}/ source/src/tools/ga-${versionGA}
+    chmod -R u+w source/src/tools/ga-${versionGA}
+  '';
+
+  postPatch = ''
+    find -type f -executable -exec sed -i "s:/bin/csh:${tcsh}/bin/tcsh:" \{} \;
+    find -type f -name "GNUmakefile" -exec sed -i "s:/usr/bin/gcc:${gcc}/bin/gcc:" \{} \;
+    find -type f -name "GNUmakefile" -exec sed -i "s:/bin/rm:rm:" \{} \;
+    find -type f -executable -exec sed -i "s:/bin/rm:rm:" \{} \;
+    find -type f -name "makelib.h" -exec sed -i "s:/bin/rm:rm:" \{} \;
+
+    # Overwrite script, skipping the download
+    echo -e '#!/bin/sh\n cd ga-${versionGA};autoreconf -ivf' > src/tools/get-tools-github
+
+    patchShebangs ./
+  '';
+
+  # There is no configure script. Instead the build is controlled via
+  # environment variables passed to the Makefile
+  configurePhase = ''
+    runHook preConfigure
+
+    # config parameters
+    export NWCHEM_TARGET="LINUX64"
+
+    export ARMCI_NETWORK="MPI-PR"
+    export USE_MPI="y"
+    export USE_MPIF="y"
+
+    export NWCHEM_MODULES="all python"
+
+    export USE_PYTHONCONFIG="y"
+    export USE_PYTHON64="n"
+    export PYTHONLIBTYPE="so"
+    export PYTHONHOME="${python3}"
+    export PYTHONVERSION=${lib.versions.majorMinor python3.version}
+
+    export BLASOPT="-L${blas}/lib -lblas"
+    export LAPACK_LIB="-L${lapack}/lib -llapack"
+    export BLAS_SIZE=${if blas.isILP64 then "8" else "4"}
+
+    # extra TCE related options
+    export MRCC_METHODS="y"
+    export EACCSD="y"
+    export IPCCSD="y"
+
+    export NWCHEM_TOP="$(pwd)"
+
+    runHook postConfigure
+  '';
+
+  enableParallelBuilding = true;
+
+  preBuild = ''
+    ln -s ${ga_src} src/tools/ga-${versionGA}.tar.gz
+    cd src
+    make nwchem_config
+    ${lib.optionalString (!blas.isILP64) "make 64_to_32"}
+  '';
+
+  postBuild = ''
+    cd $NWCHEM_TOP/src/util
+    make version
+    make
+    cd $NWCHEM_TOP/src
+    make link
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share/nwchem
+
+    cp $NWCHEM_TOP/bin/LINUX64/nwchem $out/bin/nwchem
+    cp -r $NWCHEM_TOP/src/data $out/share/nwchem/
+    cp -r $NWCHEM_TOP/src/basis/libraries $out/share/nwchem/data
+    cp -r $NWCHEM_TOP/src/nwpw/libraryps $out/share/nwchem/data
+    cp -r $NWCHEM_TOP/QA $out/share/nwchem
+
+    wrapProgram $out/bin/nwchem \
+      --set-default NWCHEM_BASIS_LIBRARY $out/share/nwchem/data/libraries/
+
+    cat > $out/share/nwchem/nwchemrc << EOF
+    nwchem_basis_library $out/share/nwchem/data/libraries/
+    nwchem_nwpw_library $out/share/nwchem//data/libraryps/
+    ffield amber
+    amber_1 $out/share/nwchem/data/amber_s/
+    amber_2 $out/share/nwchem/data/amber_q/
+    amber_3 $out/share/nwchem/data/amber_x/
+    amber_4 $out/share/nwchem/data/amber_u/
+    spce    $out/share/nwchem/data/solvents/spce.rst
+    charmm_s $out/share/nwchem/data/charmm_s/
+    charmm_x $out/share/nwchem/data/charmm_x/
+    EOF
+  '';
+
+  doCheck = false;
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    export OMP_NUM_THREADS=1
+
+    # Fix to make mpich run in a sandbox
+    export HYDRA_IFACE=lo
+    export OMPI_MCA_rmaps_base_oversubscribe=1
+
+    # run a simple water test
+    mpirun -np 2 $out/bin/nwchem $out/share/nwchem/QA/tests/h2o/h2o.nw > h2o.out
+    grep "Total SCF energy" h2o.out  | grep 76.010538
+  '';
+
+  passthru = { inherit mpi; };
+
+  meta = with lib; {
+    description = "Open Source High-Performance Computational Chemistry";
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ sheepforce markuskowa ];
+    homepage = "https://nwchemgit.github.io";
+    license = licenses.ecl20;
+  };
+}

pkgs/applications/terminal-emulators/kitty/default.nix

···
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.27.0";
+  version = "0.27.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "refs/tags/v${version}";
-    hash = "sha256-742RB5ijCEYgjGgGyb6ZZ34GfMHm8253d3cNLQQzL38=";
+    hash = "sha256-/K/5T15kULTQP1FCLnyrKfhlQjIStayutaxLjmHjHes=";
   };
-  vendorHash = "sha256-0hylttMwkmhpydKY7cpOoHrKmaGF4ediI8uwtcT3x4I=";
+  vendorHash = "sha256-JLPPNOsoq+ErLhELsX3z3YehYfgp7OGXEXlP3IVcM5k=";
 
   buildInputs = [
     harfbuzz

pkgs/applications/virtualization/colima/default.nix

···
 { lib
+, stdenv
 , buildGoModule
 , fetchFromGitHub
 , installShellFiles
 , lima
+, lima-bin
 , makeWrapper
 , qemu
 , testers
 , colima
+  # use lima-bin on darwin to support native macOS virtualization
+  # https://github.com/NixOS/nixpkgs/pull/209171
+, lima-drv ? if stdenv.isDarwin then lima-bin else lima
 }:
 
 buildGoModule rec {
···
 
   postInstall = ''
     wrapProgram $out/bin/colima \
-      --prefix PATH : ${lib.makeBinPath [ lima qemu ]}
+      --prefix PATH : ${lib.makeBinPath [ lima-drv qemu ]}
 
     installShellCompletion --cmd colima \
       --bash <($out/bin/colima completion bash) \

pkgs/data/fonts/lxgw-neoxihei/default.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.005";
+  version = "1.006";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-IvbbeBjpFz9zHt3mHu5vY8sLETKnvOMv7eHjANQ2GlA=";
+    hash = "sha256-n7TTunWOHGWLxvs75r5My1il0KELOZbAgTGqtMpQ+mQ=";
   };
 
   dontUnpack = true;

pkgs/desktops/deepin/default.nix

···
 
     #### MISC
     deepin-desktop-base = callPackage ./misc/deepin-desktop-base { };
+    deepin-turbo = callPackage ./misc/deepin-turbo { };
   };
 in
 lib.makeScope libsForQt5.newScope packages

pkgs/desktops/deepin/misc/deepin-turbo/default.nix

···
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, pkg-config
+, wrapQtAppsHook
+, dtkwidget
+}:
+
+stdenv.mkDerivation rec {
+  pname = "deepin-turbo";
+  version = "0.0.6.3";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-t6/Ws/Q8DO0zBzrUr/liD61VkxbOv4W4x6VgMWr+Ozk=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    dtkwidget
+  ];
+
+  postPatch = ''
+    substituteInPlace src/{booster-dtkwidget/CMakeLists.txt,booster-desktop/{CMakeLists.txt,desktop.conf},booster-generic/CMakeLists.txt} --replace "/usr" "$out"
+  '';
+
+  meta = with lib; {
+    description = "A daemon that helps to launch dtk applications faster";
+    homepage = "https://github.com/linuxdeepin/deepin-turbo";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}

pkgs/desktops/gnome/extensions/extensionOverrides.nix

···
 , nvme-cli
 , procps
 , pulseaudio
+, libgtop
 , python3
 , smartmontools
 , substituteAll
···
     ];
 
     meta.maintainers = with lib.maintainers; [ rhoriguchi ];
+  }))
+
+  (patchExtension "[e-mail]" (old: {
+    patches = [
+      (substituteAll {
+        src = ./extensionOverridesPatches/tophat_at_fflewddur.github.io.patch;
+        gtop_path = "${libgtop}/lib/girepository-1.0";
+      })
+    ];
   }))
 
   (patchExtension "[e-mail]" (old: {

pkgs/desktops/gnome/extensions/extensionOverridesPatches/tophat_at_fflewddur.github.io.patch

···
+diff --git a/extension.js b/extension.js
+index 60396f8..b044872 100644
+--- a/extension.js
++++ b/extension.js
+@@ -20,6 +20,8 @@
+ 
+ /* exported init, enable, disable */
+ 
++imports.gi.GIRepository.Repository.prepend_search_path('@gtop_path@');
++
+ let depFailures = [];
+ let missingLibs = [];
+ 

pkgs/development/libraries/aravis/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "aravis";
-  version = "0.8.22";
+  version = "0.8.24";
 
   src = fetchFromGitHub {
     owner = "AravisProject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-S9DmXjywxNr5Rpx605zip76vGKBSrUwyerqXlBm05VI=";
+    sha256 = "sha256-2d2CZzRfVr45gfgIg43Rr+1SoVIxzy8YjaQJhwi5owE=";
   };
 
   outputs = [ "bin" "dev" "out" "lib" ];

pkgs/development/libraries/ffmpeg-full/default.nix

···
-{ lib, stdenv, buildPackages, ffmpeg, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
-/*
- *  Licensing options (yes some are listed twice, filters and such are not listed)
- */
-, gplLicensing ? true # GPL: fdkaac,openssl,frei0r,cdio,samba,utvideo,vidstab,x265,x265,xavs,avid,zvbi,x11grab
-, version3Licensing ? true # (L)GPL3: libvmaf,opencore-amrnb,opencore-amrwb,samba,vo-aacenc,vo-amrwbenc
-, nonfreeLicensing ? false # NONFREE: openssl,fdkaac,blackmagic-design-desktop-video
-/*
- *  Build options
- */
-, smallBuild ? false # Optimize for size instead of speed
-, runtimeCpuDetectBuild ? true # Detect CPU capabilities at runtime (disable to compile natively)
-, grayBuild ? true # Full grayscale support
-, swscaleAlphaBuild ? true # Alpha channel support in swscale
-, hardcodedTablesBuild ? true # Hardcode decode tables instead of runtime generation
-, safeBitstreamReaderBuild ? true # Buffer boundary checking in bitreaders
-, multithreadBuild ? true # Multithreading via pthreads/win32 threads
-, networkBuild ? true # Network support
-, pixelutilsBuild ? true # Pixel utils in libavutil
-, enableLto ? false # build with link-time optimization
-/*
- *  Program options
- */
-, ffmpegProgram ? true # Build ffmpeg executable
-, ffplayProgram ? true # Build ffplay executable
-, ffprobeProgram ? true # Build ffprobe executable
-, qtFaststartProgram ? true # Build qt-faststart executable
-/*
- *  Library options
- */
-, avcodecLibrary ? true # Build avcodec library
-, avdeviceLibrary ? true # Build avdevice library
-, avfilterLibrary ? true # Build avfilter library
-, avformatLibrary ? true # Build avformat library
-, avutilLibrary ? true # Build avutil library
-, postprocLibrary ? true # Build postproc library
-, swresampleLibrary ? true # Build swresample library
-, swscaleLibrary ? true # Build swscale library
-/*
- *  Documentation options
- */
-, htmlpagesDocumentation ? false # HTML documentation pages
-, manpagesDocumentation ? true # Man documentation pages
-, podpagesDocumentation ? false # POD documentation pages
-, txtpagesDocumentation ? false # Text documentation pages
-/*
- *  External libraries options
- */
-, alsa-lib ? null # Alsa in/output support
-#, avisynth ? null # Support for reading AviSynth scripts
-, bzip2 ? null
-, clang ? null
-, celt ? null # CELT decoder
-#, crystalhd ? null # Broadcom CrystalHD hardware acceleration
-, cuda ? !stdenv.isDarwin && !stdenv.isAarch64 # Dynamically linked CUDA
-, cuda-llvm ? !stdenv.isDarwin && !stdenv.isAarch64 # LLVM-based CUDA compilation
-, dav1d ? null # AV1 decoder (focused on speed and correctness)
-#, decklinkExtlib ? false, blackmagic-design-desktop-video ? null # Blackmagic Design DeckLink I/O support
-, fdkaacExtlib ? false, fdk_aac ? null # Fraunhofer FDK AAC de/encoder
-#, flite ? null # Flite (voice synthesis) support
-, fontconfig ? null # Needed for drawtext filter
-, freetype ? null # Needed for drawtext filter
-, frei0r ? null # frei0r video filtering
-, fribidi ? null # Needed for drawtext filter
-, game-music-emu ? null # Game Music Emulator
-, gnutls ? null
-, gsm ? null # GSM de/encoder
-#, ilbc ? null # iLBC de/encoder
-, libjack2 ? null # Jack audio (only version 2 is supported in this build)
-, ladspaH ? null # LADSPA audio filtering
-, lame ? null # LAME MP3 encoder
-, libass ? null # (Advanced) SubStation Alpha subtitle rendering
-, libaom ? null # AV1 encoder
-, libbluray ? null # BluRay reading
-, libbs2b ? null # bs2b DSP library
-, libcaca ? null # Textual display (ASCII art)
-#, libcdio-paranoia ? null # Audio CD grabbing
-, libdc1394 ? null, libraw1394 ? null # IIDC-1394 grabbing (ieee 1394)
-, libdrm ? null # libdrm support
-, libiconv ? null
-#, libiec61883 ? null, libavc1394 ? null # iec61883 (also uses libraw1394)
-, libmfx ? null # Hardware acceleration vis libmfx
-, libmodplug ? null # ModPlug support
-, libmysofa ? null # HRTF support via SOFAlizer
-#, libnut ? null # NUT (de)muxer, native (de)muser exists
-, libogg ? null # Ogg container used by vorbis & theora
-, libopenmpt ? null # Tracked music files decoder
-, libopus ? null # Opus de/encoder
-, librsvg ? null # SVG protocol
-, libssh ? null # SFTP protocol
-, libtheora ? null # Theora encoder
-, libv4l ? null # Video 4 Linux support
-, libva ? null # Vaapi hardware acceleration
-, libvdpau ? null # Vdpau hardware acceleration
-, libvmaf ? null # Netflix's VMAF (Video Multi-Method Assessment Fusion)
-, libvorbis ? null # Vorbis de/encoding, native encoder exists
-, libvpx ? null # VP8 & VP9 de/encoding
-, libwebp ? null # WebP encoder
-, libX11 ? null # Xlib support
-, libxcb ? null # X11 grabbing using XCB
-, libxcbshmExtlib ? true # X11 grabbing shm communication
-, libxcbxfixesExtlib ? true # X11 grabbing mouse rendering
-, libxcbshapeExtlib ? true # X11 grabbing shape rendering
-, libXv ? null # Xlib support
-, libXext ? null # Xlib support
-, libxml2 ? null # libxml2 support, for IMF and DASH demuxers
-, xz ? null # xz-utils
-, nv-codec-headers ? null
-, nvdec ? !stdenv.isDarwin && !stdenv.isAarch64 # NVIDIA NVDEC support
-, nvenc ? !stdenv.isDarwin && !stdenv.isAarch64 # NVIDIA NVENC support
-, openal ? null # OpenAL 1.1 capture support
-, ocl-icd ? null # OpenCL ICD
-, opencl-headers ? null # OpenCL headers
-, opencore-amr ? null # AMR-NB de/encoder & AMR-WB decoder
-#, opencv ? null # Video filtering
-, openglExtlib ? false, libGL ? null, libGLU ? null # OpenGL rendering
-, openh264 ? null # H.264/AVC encoder
-, openjpeg ? null # JPEG 2000 de/encoder
-, opensslExtlib ? false, openssl ? null
-, libpulseaudio ? null # Pulseaudio input support
-, rav1e ? null # AV1 encoder (focused on speed and safety)
-, svt-av1 ? null # AV1 encoder/decoder (focused on speed and correctness)
-, rtmpdump ? null # RTMP[E] support
-#, libquvi ? null # Quvi input support
-, samba ? null # Samba protocol
-#, schroedinger ? null # Dirac de/encoder
-, SDL2 ? null
-#, shine ? null # Fixed-point MP3 encoder
-, soxr ? null # Resampling via soxr
-, speex ? null # Speex de/encoder
-, srt ? null # Secure Reliable Transport (SRT) protocol
-#, twolame ? null # MP2 encoder
-#, utvideo ? null # Ut Video de/encoder
-, vid-stab ? null # Video stabilization
-#, vo-aacenc ? null # AAC encoder
-, vo-amrwbenc ? null # AMR-WB encoder
-, x264 ? null # H.264/AVC encoder
-, x265 ? null # H.265/HEVC encoder
-, xavs ? null # AVS encoder
-, xvidcore ? null # Xvid encoder, native encoder exists
-, zeromq4 ? null # Message passing
-, zimg ? null
-, zlib ? null
-, vulkan-loader ? null
-, glslang ? null
-#, zvbi ? null # Teletext support
-/*
- *  Developer options
- */
-, debugDeveloper ? false
-, optimizationsDeveloper ? true
-, extraWarningsDeveloper ? false
-, strippingDeveloper ? false
-/*
- *  Darwin frameworks
- */
-, Cocoa, CoreAudio, CoreServices, AVFoundation, MediaToolbox
-, VideoDecodeAcceleration, VideoToolbox
-}:
-
-/* Maintainer notes:
- *
- * Version bumps:
- * It should always be safe to bump patch releases (e.g. 2.1.x, x being a patch release)
- * If adding a new branch, note any configure flags that were added, changed, or deprecated/removed
- *   and make the necessary changes.
- *
- * Packages with errors:
- *   flite ilbc schroedinger
- *   opencv - circular dependency issue
- *
- * Not packaged:
- *   aacplus avisynth cdio-paranoia crystalhd libavc1394 libiec61883
- *   libnut libquvi nvenc oss shine twolame
- *   utvideo vo-aacenc vo-amrwbenc xvmc zvbi blackmagic-design-desktop-video
- *
- * Need fixes to support Darwin:
- *   gsm libjack2 libmodplug libmfx(intel-media-sdk) nvenc pulseaudio samba
- *   vid-stab
- *
- * Need fixes to support AArch64:
- *   libmfx(intel-media-sdk) nvenc
- *
- * Not supported:
- *   stagefright-h264(android only)
- *
- * Known issues:
- * flite: configure fails to find library
- *   Tried modifying ffmpeg's configure script and flite to use pkg-config
- * Cross-compiling will disable features not present on host OS
- *   (e.g. dxva2 support [DirectX] will not be enabled unless natively compiled on Cygwin)
- *
- */
-
-let
-  inherit (stdenv) isCygwin isDarwin isFreeBSD isLinux isAarch64;
-  inherit (lib) optional optionals optionalString enableFeature;
-in
-
-/*
- *  Licensing dependencies
- */
-assert version3Licensing -> gplLicensing;
-assert nonfreeLicensing -> gplLicensing && version3Licensing;
-/*
- *  Build dependencies
- */
-assert networkBuild -> gnutls != null || opensslExtlib;
-assert pixelutilsBuild -> avutilLibrary;
-/*
- *  Platform dependencies
- */
-assert isDarwin -> !nvenc;
-/*
- *  Program dependencies
- */
-assert ffmpegProgram -> avcodecLibrary
-                     && avfilterLibrary
-                     && avformatLibrary
-                     && swresampleLibrary;
-assert ffplayProgram -> avcodecLibrary
-                     && avformatLibrary
-                     && swscaleLibrary
-                     && swresampleLibrary
-                     && SDL2 != null;
-assert ffprobeProgram -> avcodecLibrary && avformatLibrary;
-/*
- *  Library dependencies
- */
-assert avcodecLibrary -> avutilLibrary; # configure flag since 0.6
-assert avdeviceLibrary -> avformatLibrary
-                       && avcodecLibrary
-                       && avutilLibrary; # configure flag since 0.6
-assert avformatLibrary -> avcodecLibrary && avutilLibrary; # configure flag since 0.6
-assert postprocLibrary -> avutilLibrary;
-assert swresampleLibrary -> soxr != null;
-assert swscaleLibrary -> avutilLibrary;
-/*
- *  External libraries
- */
-#assert decklinkExtlib -> blackmagic-design-desktop-video != null
-#                                       && !isCygwin && multithreadBuild # POSIX threads required
-#                                       && nonfreeLicensing;
-assert fdkaacExtlib -> fdk_aac != null && nonfreeLicensing;
-assert gnutls != null -> !opensslExtlib;
-assert libxcbshmExtlib -> libxcb != null;
-assert libxcbxfixesExtlib -> libxcb != null;
-assert libxcbshapeExtlib -> libxcb != null;
-assert openglExtlib -> libGL != null && libGLU != null;
-assert opensslExtlib -> gnutls == null && openssl != null && nonfreeLicensing;
-
-stdenv.mkDerivation rec {
-  pname = "ffmpeg-full";
-  inherit (ffmpeg) src version patches;
-
-  prePatch = ''
-    patchShebangs .
-  '' + lib.optionalString stdenv.isDarwin ''
-    sed -i 's/#ifndef __MAC_10_11/#if 1/' ./libavcodec/audiotoolboxdec.c
-  '' + lib.optionalString (frei0r != null) ''
-    substituteInPlace libavfilter/vf_frei0r.c \
-      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
-    substituteInPlace doc/filters.texi \
-      --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
-  '';
-
-  configurePlatforms = [];
-  configureFlags = [
-    "--target_os=${if stdenv.hostPlatform.isMinGW then "mingw64" else stdenv.hostPlatform.parsed.kernel.name}" #mingw32 and mingw64 doesn't have a difference here, it is internally rewritten as mingw32
-    "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
-    /*
-     *  Licensing flags
-     */
-    (enableFeature gplLicensing "gpl")
-    (enableFeature version3Licensing "version3")
-    (enableFeature nonfreeLicensing "nonfree")
-    /*
-     *  Build flags
-     */
-    # On some ARM platforms --enable-thumb
-    "--enable-shared"
-    (enableFeature true "pic")
-    (enableFeature smallBuild "small")
-    (enableFeature runtimeCpuDetectBuild "runtime-cpudetect")
-    (enableFeature enableLto "lto")
-    (enableFeature grayBuild "gray")
-    (enableFeature swscaleAlphaBuild "swscale-alpha")
-    (enableFeature hardcodedTablesBuild "hardcoded-tables")
-    (enableFeature safeBitstreamReaderBuild "safe-bitstream-reader")
-    (if multithreadBuild then (
-       if stdenv.hostPlatform.isWindows then
-         "--disable-pthreads --enable-w32threads"
-       else # Use POSIX threads by default
-         "--enable-pthreads --disable-w32threads")
-     else
-       "--disable-pthreads --disable-w32threads")
-    "--disable-os2threads" # We don't support OS/2
-    (enableFeature networkBuild "network")
-    (enableFeature pixelutilsBuild "pixelutils")
-    /*
-     *  Program flags
-     */
-    (enableFeature ffmpegProgram "ffmpeg")
-    (enableFeature ffplayProgram "ffplay")
-    (enableFeature ffprobeProgram "ffprobe")
-    /*
-     *  Library flags
-     */
-    (enableFeature avcodecLibrary "avcodec")
-    (enableFeature avdeviceLibrary "avdevice")
-    (enableFeature avfilterLibrary "avfilter")
-    (enableFeature avformatLibrary "avformat")
-    (enableFeature avutilLibrary "avutil")
-    (enableFeature (postprocLibrary && gplLicensing) "postproc")
-    (enableFeature swresampleLibrary "swresample")
-    (enableFeature swscaleLibrary "swscale")
-    /*
-     *  Documentation flags
-     */
-    (enableFeature (htmlpagesDocumentation
-          || manpagesDocumentation
-          || podpagesDocumentation
-          || txtpagesDocumentation) "doc")
-    (enableFeature htmlpagesDocumentation "htmlpages")
-    (enableFeature manpagesDocumentation "manpages")
-    (enableFeature podpagesDocumentation "podpages")
-    (enableFeature txtpagesDocumentation "txtpages")
-    /*
-     *  External libraries
-     */
-    #(enableFeature avisynth "avisynth")
-    (enableFeature (bzip2 != null) "bzlib")
-    (enableFeature (celt != null) "libcelt")
-    (enableFeature cuda "cuda")
-    (enableFeature (clang != null && cuda-llvm) "cuda-llvm")
-    #(enableFeature crystalhd "crystalhd")
-    (enableFeature (dav1d != null) "libdav1d")
-    #(enableFeature decklinkExtlib "decklink")
-    (enableFeature (fdkaacExtlib && gplLicensing) "libfdk-aac")
-    #(enableFeature (flite != null) "libflite")
-    "--disable-libflite" # Force disable until a solution is found
-    (enableFeature (fontconfig != null) "fontconfig")
-    (enableFeature (freetype != null) "libfreetype")
-    (enableFeature (frei0r != null && gplLicensing) "frei0r")
-    (enableFeature (fribidi != null) "libfribidi")
-    (enableFeature (game-music-emu != null) "libgme")
-    (enableFeature (gnutls != null) "gnutls")
-    (enableFeature (gsm != null) "libgsm")
-    #(enableFeature (ilbc != null) "libilbc")
-    (enableFeature (ladspaH !=null) "ladspa")
-    (enableFeature (lame != null) "libmp3lame")
-    (enableFeature (libaom != null) "libaom")
-    (enableFeature (libass != null) "libass")
-    #(enableFeature (libavc1394 != null) null null)
-    (enableFeature (libbluray != null) "libbluray")
-    (enableFeature (libbs2b != null) "libbs2b")
-    #(enableFeature (libcaca != null) "libcaca")
-    #(enableFeature (cdio-paranoia != null && gplLicensing) "libcdio")
-    (enableFeature (if isLinux then libdc1394 != null && libraw1394 != null else false) "libdc1394")
-    (enableFeature ((isLinux || isFreeBSD) && libdrm != null) "libdrm")
-    (enableFeature (libiconv != null) "iconv")
-    (enableFeature (libjack2 != null) "libjack")
-    #(enableFeature (if isLinux then libiec61883 != null && libavc1394 != null && libraw1394 != null else false) "libiec61883")
-    (enableFeature (if isLinux && !isAarch64 then libmfx != null else false) "libmfx")
-    (enableFeature (libmodplug != null) "libmodplug")
-    (enableFeature (libmysofa != null) "libmysofa")
-    #(enableFeature (libnut != null) "libnut")
-    (enableFeature (libopenmpt != null) "libopenmpt")
-    (enableFeature (libopus != null) "libopus")
-    (enableFeature (librsvg != null) "librsvg")
-    (enableFeature (srt != null) "libsrt")
-    (enableFeature (libssh != null) "libssh")
-    (enableFeature (libtheora != null) "libtheora")
-    (enableFeature (if isLinux then libv4l != null else false) "libv4l2")
-    (enableFeature ((isLinux || isFreeBSD) && libva != null) "vaapi")
-    (enableFeature (libvdpau != null) "vdpau")
-    (enableFeature (libvorbis != null) "libvorbis")
-    (enableFeature (!isAarch64 && libvmaf != null && version3Licensing) "libvmaf")
-    (enableFeature (libvpx != null) "libvpx")
-    (enableFeature (libwebp != null) "libwebp")
-    (enableFeature (libX11 != null && libXv != null && libXext != null) "xlib")
-    (enableFeature (libxcb != null) "libxcb")
-    (enableFeature libxcbshmExtlib "libxcb-shm")
-    (enableFeature libxcbxfixesExtlib "libxcb-xfixes")
-    (enableFeature libxcbshapeExtlib "libxcb-shape")
-    (enableFeature (libxml2 != null) "libxml2")
-    (enableFeature (xz != null) "lzma")
-    (enableFeature nvdec "cuvid")
-    (enableFeature nvdec "nvdec")
-    (enableFeature nvenc "nvenc")
-    (enableFeature (openal != null) "openal")
-    (enableFeature (ocl-icd != null && opencl-headers != null) "opencl")
-    (enableFeature (opencore-amr != null && version3Licensing) "libopencore-amrnb")
-    #(enableFeature (opencv != null) "libopencv")
-    (enableFeature openglExtlib "opengl")
-    (enableFeature (openh264 != null) "libopenh264")
-    (enableFeature (openjpeg != null) "libopenjpeg")
-    (enableFeature (opensslExtlib && gplLicensing) "openssl")
-    (enableFeature (libpulseaudio != null) "libpulse")
-    #(enableFeature quvi "libquvi")
-    (enableFeature (rav1e != null) "librav1e")
-    (enableFeature (svt-av1 != null) "libsvtav1")
-    (enableFeature (rtmpdump != null) "librtmp")
-    #(enableFeature (schroedinger != null) "libschroedinger")
-    (enableFeature (SDL2 != null) "sdl2")
-    (enableFeature (soxr != null) "libsoxr")
-    (enableFeature (speex != null) "libspeex")
-    #(enableFeature (twolame != null) "libtwolame")
-    #(enableFeature (utvideo != null && gplLicensing) "libutvideo")
-    (enableFeature (vid-stab != null && gplLicensing) "libvidstab") # Actual min. version 2.0
-    #(enableFeature (vo-aacenc != null && version3Licensing) "libvo-aacenc")
-    (enableFeature (vo-amrwbenc != null && version3Licensing) "libvo-amrwbenc")
-    (enableFeature (x264 != null && gplLicensing) "libx264")
-    (enableFeature (x265 != null && gplLicensing) "libx265")
-    (enableFeature (xavs != null && gplLicensing) "libxavs")
-    (enableFeature (xvidcore != null && gplLicensing) "libxvid")
-    (enableFeature (zeromq4 != null) "libzmq")
-    (enableFeature (zimg != null) "libzimg")
-    (enableFeature (zlib != null) "zlib")
-    (enableFeature (isLinux && vulkan-loader != null) "vulkan")
-    (enableFeature (isLinux && vulkan-loader != null && glslang != null) "libglslang")
-    (enableFeature (samba != null && gplLicensing && version3Licensing) "libsmbclient")
-    #(enableFeature (zvbi != null && gplLicensing) "libzvbi")
-    /*
-     * Developer flags
-     */
-    (enableFeature debugDeveloper "debug")
-    (enableFeature optimizationsDeveloper "optimizations")
-    (enableFeature extraWarningsDeveloper "extra-warnings")
-    (enableFeature strippingDeveloper "stripping")
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "--cross-prefix=${stdenv.cc.targetPrefix}"
-    "--enable-cross-compile"
-    "--host-cc=${buildPackages.stdenv.cc}/bin/cc"
-  ] ++ optionals stdenv.cc.isClang [
-    "--cc=clang"
-    "--cxx=clang++"
-  ];
-
-  nativeBuildInputs = [ addOpenGLRunpath perl pkg-config texinfo yasm ];
-
-  buildInputs = [
-    bzip2 celt dav1d fontconfig freetype frei0r fribidi game-music-emu gnutls gsm
-    libjack2 ladspaH lame libaom libass libbluray libbs2b libcaca libdc1394 libmodplug libmysofa
-    libogg libopenmpt libopus librsvg libssh libtheora libvdpau libvorbis libvpx libwebp libX11
-    libxcb libXv libXext libxml2 xz openal ocl-icd opencl-headers openjpeg libpulseaudio rav1e svt-av1 rtmpdump opencore-amr
-    samba SDL2 soxr speex srt vid-stab vo-amrwbenc x264 x265 xavs xvidcore
-    zeromq4 zimg zlib openh264
-  ] ++ optionals openglExtlib [ libGL libGLU ]
-    ++ optionals nonfreeLicensing [ fdk_aac openssl ]
-    ++ optional ((isLinux || isFreeBSD) && libva != null) libva
-    ++ optional ((isLinux || isFreeBSD) && libdrm != null) libdrm
-    ++ optional (!isAarch64 && libvmaf != null && version3Licensing) libvmaf
-    ++ optionals isLinux [ alsa-lib libraw1394 libv4l vulkan-loader glslang ]
-    ++ optional (isLinux && !isAarch64 && libmfx != null) libmfx
-    ++ optional (nvdec || nvenc) nv-codec-headers
-    ++ optional cuda-llvm clang
-    ++ optionals stdenv.isDarwin [ Cocoa CoreServices CoreAudio AVFoundation
-                                   MediaToolbox VideoDecodeAcceleration VideoToolbox
-                                   libiconv ];
-
-  buildFlags = [ "all" ]
-    ++ optional qtFaststartProgram "tools/qt-faststart"; # Build qt-faststart executable
-
-  doCheck = true;
-  checkPhase = let
-    ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
-  in ''
-    ${ldLibraryPathEnv}="libavcodec:libavdevice:libavfilter:libavformat:libavutil:libpostproc:libswresample:libswscale:''${${ldLibraryPathEnv}}" \
-      make check -j$NIX_BUILD_CORES
-  '';
-
-  # Hacky framework patching technique borrowed from the phantomjs2 package
-  postInstall = optionalString qtFaststartProgram ''
-    cp -a tools/qt-faststart $out/bin/
-  '';
-
-  postFixup = optionalString stdenv.isLinux ''
-    # Set RUNPATH so that libnvcuvid and libcuda in /run/opengl-driver(-32)/lib can be found.
-    # See the explanation in addOpenGLRunpath.
-    addOpenGLRunpath $out/lib/libavcodec.so
-    addOpenGLRunpath $out/lib/libavutil.so
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "A complete, cross-platform solution to record, convert and stream audio and video";
-    homepage = "https://www.ffmpeg.org/";
-    changelog = "https://github.com/FFmpeg/FFmpeg/blob/n${version}/Changelog";
-    longDescription = ''
-      FFmpeg is the leading multimedia framework, able to decode, encode, transcode,
-      mux, demux, stream, filter and play pretty much anything that humans and machines
-      have created. It supports the most obscure ancient formats up to the cutting edge.
-      No matter if they were designed by some standards committee, the community or
-      a corporation.
-    '';
-    license = (
-      if nonfreeLicensing then
-        licenses.unfreeRedistributable
-      else if version3Licensing then
-        licenses.gpl3
-      else if gplLicensing then
-        licenses.gpl2Plus
-      else
-        licenses.lgpl21Plus
-    );
-    platforms = platforms.all;
-    maintainers = with maintainers; [ codyopel ];
-  };
-}

pkgs/development/libraries/ffmpeg/generic.nix

···
 , buildAvdevice ? withHeadlessDeps # Build avdevice library
 , buildAvfilter ? withHeadlessDeps # Build avfilter library
 , buildAvformat ? withHeadlessDeps # Build avformat library
+# Deprecated but depended upon by some packages.
+# https://github.com/NixOS/nixpkgs/pull/211834#issuecomment-1417435991)
+, buildAvresample ? withHeadlessDeps && lib.versionOlder version "5" # Build avresample library
 , buildAvutil ? withHeadlessDeps # Build avutil library
 , buildPostproc ? withHeadlessDeps # Build postproc library
 , buildSwresample ? withHeadlessDeps # Build swresample library
···
 assert buildFfmpeg -> buildAvcodec
                      && buildAvfilter
                      && buildAvformat
-                     && buildSwresample;
+                     && (buildSwresample || buildAvresample);
 assert buildFfplay -> buildAvcodec
                      && buildAvformat
                      && buildSwscale
-                     && buildSwresample;
+                     && (buildSwresample || buildAvresample);
 assert buildFfprobe -> buildAvcodec && buildAvformat;
 /*
  *  Library dependencies
···
     (enableFeature buildAvdevice "avdevice")
     (enableFeature buildAvfilter "avfilter")
     (enableFeature buildAvformat "avformat")
+  ] ++ optionals (lib.versionOlder version "5") [
+    # Ffmpeg > 4 doesn't know about the flag anymore
+    (enableFeature buildAvresample "avresample")
+  ] ++ [
     (enableFeature buildAvutil "avutil")
     (enableFeature (buildPostproc && withGPL) "postproc")
     (enableFeature buildSwresample "swresample")
···
 
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 
-  # Fails with SIGABRT otherwise
+  # Fails with SIGABRT otherwise FIXME: Why?
   checkPhase = let
     ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+    libsToLink = [ ]
+      ++ optional buildAvcodec "libavcodec"
+      ++ optional buildAvdevice "libavdevice"
+      ++ optional buildAvfilter "libavfilter"
+      ++ optional buildAvformat "libavformat"
+      ++ optional buildAvresample "libavresample"
+      ++ optional buildAvutil "libavutil"
+      ++ optional buildPostproc "libpostproc"
+      ++ optional buildSwresample "libswresample"
+      ++ optional buildSwscale "libswscale"
+    ;
   in ''
-    ${ldLibraryPathEnv}="libavcodec:libavdevice:libavfilter:libavformat:libavutil:libpostproc${
-      optionalString (withHeadlessDeps) ":libswresample" # TODO this can probably go away
-    }:libswscale:''${${ldLibraryPathEnv}}" \
-      make check -j$NIX_BUILD_CORES
+    ${ldLibraryPathEnv}="${lib.concatStringsSep ":" libsToLink}" make check -j$NIX_BUILD_CORES
   '';
 
   outputs = optionals withBin [ "bin" ] # The first output is the one that gets symlinked by default!

pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch

···
-From 7725e7bfe6f2ce8146b6552b44e0d226be7638e7 Mon Sep 17 00:00:00 2001
-From: Pauli <[e-mail]>
-Date: Fri, 11 Nov 2022 09:40:19 +1100
-Subject: [PATCH] x509: fix double locking problem
-
-This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the
-redundant flag setting.
-
-Fixes #19643
-
-Fixes LOW CVE-2022-3996
-
-Reviewed-by: Dmitry Belyavskiy <[e-mail]>
-Reviewed-by: Tomas Mraz <[e-mail]>
-(Merged from https://github.com/openssl/openssl/pull/19652)
-
-(cherry picked from commit 4d0340a6d2f327700a059f0b8f954d6160f8eef5)
----
- crypto/x509/pcy_map.c | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c
-index 05406c6493fc..60dfd1e3203b 100644
---- a/crypto/x509/pcy_map.c
-+++ b/crypto/x509/pcy_map.c
-@@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
- 
-     ret = 1;
-  bad_mapping:
--    if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) {
--        x->ex_flags |= EXFLAG_INVALID_POLICY;
--        CRYPTO_THREAD_unlock(x->lock);
--    }
-     sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free);
-     return ret;
- 

pkgs/development/libraries/openssl/default.nix

···
 
 
   openssl_1_1 = common {
-    version = "1.1.1s";
-    sha256 = "sha256-xawB52Dub/Dath1rK70wFGck0GPrMiGAxvGKb3Tktqo=";
+    version = "1.1.1t";
+    sha256 = "sha256-je6bJL2x3L8MPR6bAvuPa/IhZegH9Fret8lndTaFnTs=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
···
   };
 
   openssl_3 = common {
-    version = "3.0.7";
-    sha256 = "sha256-gwSdBComDmlvYkBqxcCL9wb9hDg/lFzyG9YentlcOW4=";
+    version = "3.0.8";
+    sha256 = "sha256-bBPSvzj98x6sPOKjRwc2c/XWMmM5jx9p0N9KQSU+Sz4=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
···
       (if stdenv.hostPlatform.isDarwin
        then ./use-etc-ssl-certs-darwin.patch
        else ./use-etc-ssl-certs.patch)
-
-       # Remove with 3.0.8 release
-       ./3.0/CVE-2022-3996.patch
     ];
 
     withDocs = true;

pkgs/development/ocaml-modules/caqti/driver-sqlite3.nix

···
   pname = "caqti-driver-sqlite3";
   inherit (caqti) version src;
 
+  duneVersion = "3";
+
   propagatedBuildInputs = [ caqti ocaml_sqlite3 ];
 
   meta = caqti.meta // {

pkgs/development/ocaml-modules/checkseum/default.nix

···
   pname = "checkseum";
 
   minimalOCamlVersion = "4.07";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/checkseum/releases/download/v${version}/checkseum-${version}.tbz";
-    sha256 = "sha256-K6QPMts5+hxH2a+WQ1N0lwMBoshG2T0bSozNgzRvAlo=";
+    hash = "sha256-K6QPMts5+hxH2a+WQ1N0lwMBoshG2T0bSozNgzRvAlo=";
   };
 
   buildInputs = [ dune-configurator ];

pkgs/development/ocaml-modules/chrome-trace/default.nix

···
   pname = "chrome-trace";
   inherit (dune_3) src version;
 
+  minimalOCamlVersion = "4.08";
   duneVersion = "3";
 
   dontAddPrefix = true;

pkgs/development/ocaml-modules/irmin/chunk.nix

···
 
   pname = "irmin-chunk";
   inherit (irmin) version src strictDeps;
+  duneVersion = "3";
 
   propagatedBuildInputs = [ irmin fmt logs lwt ];
 

pkgs/development/ocaml-modules/irmin/containers.nix

···
   pname = "irmin-containers";
 
   inherit (ppx_irmin) src version strictDeps;
+  duneVersion = "3";
 
   nativeBuildInputs = [
     ppx_irmin

pkgs/development/ocaml-modules/irmin/default.nix

···
 
   inherit (ppx_irmin) src version strictDeps;
 
-  minimalOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.10";
+  duneVersion = "3";
 
   propagatedBuildInputs = [
     astring

pkgs/development/ocaml-modules/irmin/fs.nix

···
   pname = "irmin-fs";
 
   inherit (irmin) version src strictDeps;
+  duneVersion = "3";
 
   propagatedBuildInputs = [ irmin astring logs lwt ];
 

pkgs/development/ocaml-modules/irmin/mirage.nix

···
   pname = "irmin-mirage";
 
   inherit (irmin) version src strictDeps;
+  duneVersion = "3";
 
   propagatedBuildInputs = [
     irmin fmt ptime mirage-clock

pkgs/development/ocaml-modules/irmin/pack.nix

···
 { lib, buildDunePackage
-, index, ppx_irmin, irmin, optint, fmt, logs, lwt, mtime, cmdliner
+, index, ppx_irmin, irmin, optint, fmt, logs, lwt, mtime, cmdliner, checkseum, rusage
 , alcotest, alcotest-lwt, astring, irmin-test
 }:
 
 buildDunePackage rec {
-  minimalOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.10";
+  duneVersion = "3";
 
   pname = "irmin-pack";
 
···
 
   nativeBuildInputs = [ ppx_irmin ];
 
-  propagatedBuildInputs = [ index irmin optint fmt logs lwt mtime cmdliner ];
+  propagatedBuildInputs = [ index irmin optint fmt logs lwt mtime cmdliner checkseum rusage ];
 
   checkInputs = [ astring alcotest alcotest-lwt irmin-test ];
 

pkgs/development/ocaml-modules/irmin/ppx.nix

···
 
 buildDunePackage rec {
   pname = "ppx_irmin";
-  version = "3.4.1";
+  version = "3.5.1";
 
   src = fetchurl {
     url = "https://github.com/mirage/irmin/releases/download/${version}/irmin-${version}.tbz";
-    sha256 = "sha256-kig2EWww7GgGijhpSgm7pSHPR+3Q5K5E4Ha5tJY9oYA=";
+    hash = "sha256-zXiKjT9KPdGNwWChU9SuyR6vaw+0GtQUZNJsecMEqY4=";
   };
 
   minimalOCamlVersion = "4.10";
+  duneVersion = "3";
 
   propagatedBuildInputs = [
     ppx_repr

pkgs/development/ocaml-modules/irmin/test.nix

···
   pname = "irmin-test";
 
   inherit (irmin) version src strictDeps;
+  duneVersion = "3";
 
   nativeBuildInputs = [ ppx_irmin ];
 

pkgs/development/ocaml-modules/irmin/tezos.nix

···
   pname = "irmin-tezos";
 
   inherit (irmin) version src strictDeps;
+  duneVersion = "3";
 
   propagatedBuildInputs = [
     irmin

pkgs/development/ocaml-modules/ordering/default.nix

···
   pname = "ordering";
   inherit (dune_3) version src;
   duneVersion = "3";
+  minimalOCamlVersion = "4.08";
 
   dontAddPrefix = true;
 

pkgs/development/ocaml-modules/rusage/default.nix

···
+{ lib, fetchurl, buildDunePackage }:
+
+buildDunePackage rec {
+  pname = "rusage";
+  version = "1.0.0";
+
+  duneVersion = "3";
+
+  src = fetchurl {
+    url = "https://github.com/CraigFe/ocaml-rusage/releases/download/${version}/rusage-${version}.tbz";
+    hash = "sha256-OgYA2Fe1goqoaOS45Z6FBJNNYN/uq+KQoUwG8KSo6Fk=";
+  };
+
+  meta = {
+    description = "Bindings to the GETRUSAGE(2) syscall";
+    homepage = "https://github.com/CraigFe/ocaml-rusage";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}

pkgs/development/ocaml-modules/sqlite3/default.nix

···
 buildDunePackage rec {
   pname = "sqlite3";
   version = "5.1.0";
-  useDune2 = true;
-  minimumOCamlVersion = "4.05";
+  duneVersion = "3";
+  minimalOCamlVersion = "4.12";
 
   src = fetchurl {
     url = "https://github.com/mmottl/sqlite3-ocaml/releases/download/${version}/sqlite3-${version}.tbz";
-    sha256 = "sha256-uw23EWkajfok/insTstpEkRK2Q4PTER6+Jgx5tHf/qU=";
+    hash = "sha256-uw23EWkajfok/insTstpEkRK2Q4PTER6+Jgx5tHf/qU=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/development/ocaml-modules/xdg/default.nix

···
   inherit (dune_3) src version;
 
   duneVersion = "3";
+  minimalOCamlVersion = "4.08";
 
   dontAddPrefix = true;
 

pkgs/development/perl-modules/ham/default.nix

···
-{ lib, buildPerlPackage, fetchFromGitHub, makeWrapper, openssh, GitRepository, URI, XMLMini }:
+{ lib
+, buildPerlPackage
+, fetchFromGitHub
+, makeWrapper
+, openssh
+, GitRepository
+, URI
+, XMLMini
+}:
 
 buildPerlPackage {
   pname = "ham-unstable";
-  version = "2020-09-09";
+  version = "2022-10-26";
 
   src = fetchFromGitHub {
     owner = "kernkonzept";
     repo = "ham";
-    rev = "ae2a326f2efcdae0fa7c5bf0ba205b580fc91ecc";
-    sha256 = "0m65pav2830y0ivwsy60dc4w457qlc0nqg43lji1kj2g96hmy2bw";
+    rev = "f2f10516177d00a79fe81701351632df2544ba4e";
+    hash = "sha256-cxlZh1x8ycpZIwSeOwqB6BtwYaMoWtSPaeiyW41epdk=";
   };
 
   outputs = [ "out" ];
···
 
   doCheck = false;
 
-  meta = {
+  meta = with lib; {
     description = "A tool to manage big projects consisting of multiple loosely-coupled git repositories";
     homepage = "https://github.com/kernkonzept/ham";
-    license = "unknown"; # should be gpl2, but not quite sure
-    maintainers = with lib.maintainers; [ aw ];
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ aw ];
     mainProgram = "ham";
-    platforms = lib.platforms.unix;
+    platforms = platforms.unix;
   };
 }

pkgs/development/python-modules/bluemaestro-ble/default.nix

···
 
 buildPythonPackage rec {
   pname = "bluemaestro-ble";
-  version = "0.2.1";
+  version = "0.2.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-QGad5o9JZ6ansVh3bRBO+9mE4PKw05acY+9+Ur2OBsY=";
+    hash = "sha256-mJ5JNGN4F9U3WMJQDwiZwuxE0zOirwo1sWF3/bVwXhY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/bluetooth-sensor-state-data/default.nix

···
 
 buildPythonPackage rec {
   pname = "bluetooth-sensor-state-data";
-  version = "1.6.0";
+  version = "1.6.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Btfya9l1UX7GbiUxuaFHT0l+pG+Dg5X0L2JS+1/VYOo=";
+    hash = "sha256-3qZlk6zV/AeFG4OSRONQ7EMw9Kk/yHjVHV2o64bxCGM=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/desktop-notifier/default.nix

···
 
 buildPythonPackage rec {
   pname = "desktop-notifier";
-  version = "3.4.2";
+  version = "3.4.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
     owner = "SamSchott";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-OujBpq3SBDKw9Jgb9MD200Rp0fD0OJRw90flxS22I2s=";
+    hash = "sha256-V5CggWp9G0/XoQhArrY3LCvfkF2SymORDWdJGjsr7yI=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/django_treebeard/default.nix

···
 
 buildPythonPackage rec {
   pname = "django-treebeard";
-  version = "4.6.0";
+  version = "4.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-frHrcbJCFPLn3DvSFfDDrjL9Z2QXnNR3SveqtJE53qA=";
+    hash = "sha256-hKs1BAJ31STrd5OeI1VoychWy1I8yWVXk7Zv6aPvRos=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/elementpath/default.nix

···
 
 buildPythonPackage rec {
   pname = "elementpath";
-  version = "3.0.2";
+  version = "4.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "sissaschool";
     repo = "elementpath";
     rev = "refs/tags/v${version}";
-    hash = "sha256-b+Th28GI2UOmfO4jy4biohAJWPiYWkvFLqqs9lgR4Vc=";
+    hash = "sha256-BEnSPRuQUnKXtPAJfjxS+fwE0rpPj1U2yRK8eImKMYw=";
   };
 
   # avoid circular dependency with xmlschema which directly depends on this

pkgs/development/python-modules/goodwe/default.nix

···
 
 buildPythonPackage rec {
   pname = "goodwe";
-  version = "0.2.23";
+  version = "0.2.24";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
···
     owner = "marcelblijleven";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-SX49v+DuV4IZdTJc9XhqhgtG81qLC9QnR/LPMu2m0fo=";
+    sha256 = "sha256-dcz9IEPr5n86NHne9lEDB0kERY8o+jUEqPmz6QMEF4Q=";
   };
 
   postPatch = ''

pkgs/development/python-modules/lupupy/default.nix

···
 
 buildPythonPackage rec {
   pname = "lupupy";
-  version = "0.2.5";
+  version = "0.2.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SxhGUwcZjaRNCS5dB2hh5uctFGHWuKnM48CcIz6VMh8=";
+    hash = "sha256-nSa/qFJUnk1QTwUqq2il0RWCPdF4Jwby9NPIwAwcVds=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/oralb-ble/default.nix

···
 
 buildPythonPackage rec {
   pname = "oralb-ble";
-  version = "0.17.2";
+  version = "0.17.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-v2c1FoLgG6HH02d+YBr4Qh12ztRsiwWyueUNOBpWqPM=";
+    hash = "sha256-KvvcyeYXBtV/sUKMv+1xoXH9ALUX46EWS/STFZkCnUQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pydeps/default.nix

···
 
 buildPythonPackage rec {
   pname = "pydeps";
-  version = "1.11.0";
+  version = "1.11.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "thebjorn";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-XAx7B3v+7xYiW15nJgiL82YlNeBxW80M0Rq0LMMsWu0=";
+    hash = "sha256-nFdt68QhpX1URLEQtdikR11KFK9E9Y+cTvJQn4/YZlI=";
   };
 
   buildInputs = [

pkgs/development/python-modules/pymemcache/default.nix

···
   disabledTests = [
     # python-memcached is not available (last release in 2017)
     "TestClientSocketConnect"
+  ] ++ lib.optionals stdenv.is32bit [
+    # test_compressed_complex is broken on 32-bit platforms
+    # this can be removed on the next version bump
+    # see also https://github.com/pinterest/pymemcache/pull/480
+    "test_compressed_complex"
   ];
 
   pythonImportsCheck = [
···
     homepage = "https://pymemcache.readthedocs.io/";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
-    broken = stdenv.is32bit;
   };
 }

pkgs/development/python-modules/schwifty/default.nix

···
 
 buildPythonPackage rec {
   pname = "schwifty";
-  version = "2022.9.0";
+  version = "2023.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-/zxK0pUfg5G5w9E+QBt1H12Ld5gWc+WakQdNVRMSFiA=";
+    sha256 = "sha256-YEBBrU+Xcl5zFPEt/EvPD5eFPUYSpGJ3ZoIK6PRVwlc=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/sensorpro-ble/default.nix

···
 
 buildPythonPackage rec {
   pname = "sensorpro-ble";
-  version = "0.5.1";
+  version = "0.5.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-D0xHNPsGlNBoHR3LqR6TbVhqXWapzwYsG+uN3kSF1oE=";
+    hash = "sha256-Zqa6qa0Jw79Iu4VEw6KN0GsZcC1X7OpiYUiyT4zwKyY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/sensorpush-ble/default.nix

···
 
 buildPythonPackage rec {
   pname = "sensorpush-ble";
-  version = "1.5.2";
+  version = "1.5.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-64DywtZwfDFjW8WUzw3ZTT462sBGFgAHGc0bGnKCJpY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-17Yzpbcy/r+GlkLktgghehfAEboZHMbB/Dze1no4I80=";
   };
 
   nativeBuildInputs = [
···
   meta = with lib; {
     description = "Library for SensorPush BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/sensorpush-ble";
+    changelog = "https://github.com/Bluetooth-Devices/sensorpush-ble/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/soundfile/default.nix

···
 
 buildPythonPackage rec {
   pname = "soundfile";
-  version = "0.10.3.post1";
+  version = "0.11.0";
   # https://github.com/bastibe/python-soundfile/issues/157
   disabled = isPyPy || stdenv.isi686;
 
   src = fetchPypi {
-    pname = "SoundFile";
-    inherit version;
-    sha256 = "0yqhrfz7xkvqrwdxdx2ydy4h467sk7z3gf984y1x2cq7cm1gy329";
+    inherit pname version;
+    sha256 = "sha256-kxc4ock+hoTC0+HVFKxjRAzoJ+x4PqCi0+RzDj3FjBg=";
   };
-
-  patches = [
-    # Fix build on macOS arm64, https://github.com/bastibe/python-soundfile/pull/332
-    (fetchpatch {
-      url = "https://github.com/bastibe/python-soundfile/commit/e554e9ce8bed96207d587e6aa661e4b08f1c6a79.patch";
-      sha256 = "sha256-vu/7s5q4I3yBnoNHmmFmcXvOLFcPwY9ri9ri6cKLDwU=";
-    })
-  ];
 
   postPatch = ''
     substituteInPlace soundfile.py --replace "_find_library('sndfile')" "'${libsndfile.out}/lib/libsndfile${stdenv.hostPlatform.extensions.sharedLibrary}'"
···
   nativeCheckInputs = [ pytestCheckHook ];
   propagatedBuildInputs = [ numpy libsndfile cffi ];
   propagatedNativeBuildInputs = [ cffi ];
-
-  # Test fails on aarch64-darwin with `MemoryError`, 53 failed, 31 errors, see
-  # https://github.com/bastibe/python-soundfile/issues/331
-  doCheck = stdenv.system != "aarch64-darwin";
 
   meta = {
     description = "An audio library based on libsndfile, CFFI and NumPy";

pkgs/development/python-modules/thermopro-ble/default.nix

···
 
 buildPythonPackage rec {
   pname = "thermopro-ble";
-  version = "0.4.3";
+  version = "0.4.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
     owner = "bluetooth-devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-y8Uh1REZqfrS3Y/L/uCmHYkdPQzwzdx7eSz003oz05o=";
+    hash = "sha256-z3RrPOV7NGl3aNor+baeVivn+DKwYHcrdlM5sNMGVD0=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/tilt-ble/default.nix

···
 
 buildPythonPackage rec {
   pname = "tilt-ble";
-  version = "0.2.3";
+  version = "0.2.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-PR+BA0wUljUeUYCTRMKxkG+kj6PfklksbO/k9L7sWdE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ok9XWx47hcke535480NORfS1pSagaOJvMR48lYTa/Tg=";
   };
 
   nativeBuildInputs = [
···
   meta = with lib; {
     description = "Library for Tilt BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/tilt-ble";
+    changelog = "https://github.com/Bluetooth-Devices/tilt-ble/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/types-colorama/default.nix

···
 
 buildPythonPackage rec {
   pname = "types-colorama";
-  version = "0.4.15.5";
+  version = "0.4.15.7";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PSqJbsfz0fZpz3ruoO9+usRznwLbM6sTKB5qcewvwsU=";
+    hash = "sha256-2oToq+lcLhGtKyi6VXq45dyAhjvW+HOefBkWyVB1WvQ=";
   };
 
   # Module has no tests

pkgs/development/python-modules/types-docutils/default.nix

···
 
 buildPythonPackage rec {
   pname = "types-docutils";
-  version = "0.19.1.2";
+  version = "0.19.1.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yj0hNUhK21LdBCu929bt3LvajGCLo/Xl+Qi9VI/8s5k=";
+    hash = "sha256-Nv4w3lbx7OGp96mQ1H2qeBta+DHSs/Lct9/QG4V8w9Q=";
   };
 
   # Module doesn't have tests

pkgs/development/python-modules/types-requests/default.nix

···
 
 buildPythonPackage rec {
   pname = "types-requests";
-  version = "2.28.11.8";
+  version = "2.28.11.11";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-5nQkUl+ErfvqtyaKFZ08Yzhi2vrhXFsZVHzhtVlU8KM=";
+    sha256 = "sha256-GWIqzjWl2hg47pytDfSlDH46Qg+KN+g1fOhw/tSS+oE=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/types-urllib3/default.nix

···
 
 buildPythonPackage rec {
   pname = "types-urllib3";
-  version = "1.26.25.4";
+  version = "1.26.25.5";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7sVVZCjuyGKxrFePtpqrOHeZWpn/7J5aEs9/vQzJ2u4=";
+    hash = "sha256-VjDleCRtFw2R6+OQF4jNKNU8TgRNwuJIjjsNVftoldg=";
   };
 
   # Module doesn't have tests

pkgs/development/python-modules/volvooncall/default.nix

···
 
 buildPythonPackage rec {
   pname = "volvooncall";
-  version = "0.10.1";
+  version = "0.10.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
···
     owner = "molobrakos";
     repo = "volvooncall";
     rev = "refs/tags/v${version}";
-    hash = "sha256-udYvgKj7Rlc/hA86bbeBfnoVRjKkXT4TwpceWz226cU=";
+    hash = "sha256-/BMwDuo4xE/XOLM8qzJwt0A0h0+ihbCVCxT3BBToiVU=";
   };
 
   patches = [
···
   meta = with lib; {
     description = "Retrieve information from the Volvo On Call web service";
     homepage = "https://github.com/molobrakos/volvooncall";
-    changelog = "https://github.com/molobrakos/volvooncall/releases/tag/v${version}";
     license = licenses.unlicense;
     maintainers = with maintainers; [ dotlambda ];
   };

pkgs/development/python-modules/xiaomi-ble/default.nix

···
 
 buildPythonPackage rec {
   pname = "xiaomi-ble";
-  version = "0.15.0";
+  version = "0.16.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-6j5hZ9NGmAFpbgYTyC4UuI4XkQwotZND1UMHnmJHCdo=";
+    hash = "sha256-JsrOt6LmmhJZ4MBwLVKKt3IMbvAnxJx70AZROhb9gbc=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/xmlschema/default.nix

···
 , buildPythonPackage
 , fetchFromGitHub
 , elementpath
+, jinja2
 , lxml
 , pytestCheckHook
 , pythonOlder
···
 
 buildPythonPackage rec {
   pname = "xmlschema";
-  version = "2.1.1";
+  version = "2.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "sissaschool";
     repo = "xmlschema";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rt7QScg458ezDwktO1QRydmC3XqedX+kPpv6J+JvLzQ=";
+    hash = "sha256-KK1F8OVK+19ZWwu+2UtTMiVNyPPoPOv3V1qJFZAu2h4=";
   };
 
   propagatedBuildInputs = [
···
   ];
 
   nativeCheckInputs = [
+    jinja2
     lxml
     pytestCheckHook
-  ];
-
-  # Ignore broken fixtures, and tests for files which don't exist.
-  # For darwin, we need to explicity say we can't reach network
-  disabledTests = [
-    "export_remote"
-    "element_tree_import_script"
-  ];
-
-  disabledTestPaths = [
-    "tests/test_schemas.py"
-    "tests/test_memory.py"
-    "tests/test_validation.py"
   ];
 
   pythonImportsCheck = [
···
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/sissaschool/xmlschema/blob/${src.rev}/CHANGELOG.rst";
     description = "XML Schema validator and data conversion library for Python";
     homepage = "https://github.com/sissaschool/xmlschema";
     license = licenses.mit;

pkgs/development/tools/codeowners/default.nix

···
 
 buildGoModule rec {
   pname = "codeowners";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "hmarr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-lklKZCDX/e3MZ0ix3A4AIEICPoufBq7SAIULqDXOYDI=";
+    hash = "sha256-bjSlt439Y5hmbxR6s4J37ao+P2tuKNuwqRg872P+MUg=";
   };
 
-  vendorSha256 = "sha256-G+oaX3SXsHJu3lq6n8dLmoRXDAYcFkrYarwePB/MdEU=";
+  vendorHash = "sha256-G+oaX3SXsHJu3lq6n8dLmoRXDAYcFkrYarwePB/MdEU=";
 
   meta = with lib; {
     description = "A CLI and Go library for Github's CODEOWNERS file";

pkgs/development/tools/lazygit/default.nix

···
 
 buildGoModule rec {
   pname = "lazygit";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0emAo/K27lmQ+409maTR/hnonQVkbijF0RAwvIErBFo=";
+    sha256 = "sha256-A6aFHC4MNNFl7IieR/7aQ3cMzhBXfQwq6sPv+v5Gu4o=";
   };
 
   vendorSha256 = null;

pkgs/development/tools/misc/sqitch/default.nix

···
 , shortenPerlShebang
 , mysqlSupport ? false
 , postgresqlSupport ? false
+, templateToolkitSupport ? false
 }:
 
 let
   sqitch = perlPackages.AppSqitch;
   modules = with perlPackages; [ ]
     ++ lib.optional mysqlSupport DBDmysql
-    ++ lib.optional postgresqlSupport DBDPg;
+    ++ lib.optional postgresqlSupport DBDPg
+    ++ lib.optional templateToolkitSupport TemplateToolkit;
 in
 
 stdenv.mkDerivation {

pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix

···
   pname = "js_of_ocaml-compiler";
   version = "4.1.0";
   duneVersion = "3";
+  minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/ocsigen/js_of_ocaml/releases/download/${version}/js_of_ocaml-${version}.tbz";

pkgs/development/web/deno/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.30.2";
+  version = "1.30.3";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WpS1pqy6o8FUWMdJpzG5T8xoCkQZ/SbWI4k9vellVb8=";
+    sha256 = "sha256-Dg4ZX1CpjZuCXDu3GxbaRIwdhDuJ50j53b6XETfFGAU=";
   };
-  cargoSha256 = "sha256-RVoXHrEWMwuC+nD6ypiZzGsYEr/BFReE67z7gqqDOzA=";
+  cargoSha256 = "sha256-6V9djLUmPEQDewKEN0ND7zyXSrKdakXZdYSRsyXWNuE=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds

pkgs/games/anki/bin.nix

···
 let
   pname = "anki-bin";
   # Update hashes for both Linux and Darwin!
-  version = "2.1.56";
+  version = "2.1.57";
 
   sources = {
     linux = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-qt6.tar.zst";
-      sha256 = "sha256-bois8+W/Jvte0HqC6Vi8WcXzrc8y8fKoW3ttbPb/v14=";
+      sha256 = "sha256-W8EQxvdOQRYHVKoYGu+6LNAHJZGsVQgdvNsRXOBVUKM=";
     };
 
     # For some reason anki distributes completely separate dmg-files for the aarch64 version and the x86_64 version
     darwin-x86_64 = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-intel-qt6.dmg";
-      sha256 = "sha256-xd96wG+dElf6kSJ3jtdwfDhxJIv2r/o/JF2RcIwaZkg=";
+      sha256 = "sha256-NhCMmXuZj+Il/hhZZhbk7eLsmbfnqYlSRgw33xIbv8M=";
     };
     darwin-aarch64 = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-apple-qt6.dmg";
-      sha256 = "sha256-dYYgKEN6ytZ1CIH2+hK7H7xs3ISMbZGDv3w+Ie+ISlw=";
+      sha256 = "sha256-8gLtFoqJVvh1NfaSpNeH8+YecMln+A7UyqeSXWVEtmo=";
     };
   };
 

pkgs/games/heroic/default.nix

···
 
 mkYarnPackage rec {
   pname = "heroic-unwrapped";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "Heroic-Games-Launcher";
     repo = "HeroicGamesLauncher";
     rev = "v${version}";
-    sha256 = "sha256-bU4jvF81GI8a9ACwYn1Hdb5DbpK6GI7z19enO7uu48o=";
+    sha256 = "sha256-QXciJkY5l5Oqzgnj9vV5IwOSUtVeLMH29r2EIQVt2LI=";
   };
 
   packageJSON = ./package.json;

pkgs/games/heroic/package.json

···
 {
   "name": "heroic",
-  "version": "2.6.1",
+  "version": "2.6.2",
   "private": true,
   "main": "build/electron/main.js",
   "homepage": "./",
···
       }
     ],
     "win": {
-      "artifactName": "${productName}-${version}-Setup.${ext}",
+      "artifactName": "${productName}-${version}-Setup-${arch}.${ext}",
       "icon": "build/win_icon.ico",
       "asarUnpack": [
         "build/bin/win32/legendary.exe",
···
       ]
     },
     "portable": {
-      "artifactName": "${productName}-${version}-Portable.${ext}"
+      "artifactName": "${productName}-${version}-Portable-${arch}.${ext}"
     },
     "mac": {
       "artifactName": "${productName}-${version}-macOS-${arch}.${ext}",
···
     "test-watch": "jest --watch --maxWorkers=25%",
     "test:ci": "jest --runInBand --silent",
     "release:linux": "vite build && electron-builder -p always --linux deb AppImage rpm pacman tar.xz",
-    "release:mac": "vite build && electron-builder -p always --mac",
-    "release:win": "vite build && electron-builder -p always --win nsis portable",
+    "release:mac": "vite build && electron-builder -p always --mac --x64 --arm64",
+    "release:win": "vite build && electron-builder -p never --win nsis portable --x64 --arm64",
     "dist:linux": "vite build && electron-builder --linux",
-    "dist:mac": "vite build && electron-builder --mac --x64 --arm64",
+    "dist:mac": "vite build && electron-builder --mac",
     "dist:win": "vite build && electron-builder --win",
     "dist:flatpak": "yarn dist:linux appimage && yarn flatpak:prepare && yarn flatpak:build",
     "lint": "eslint --cache -c .eslintrc --ext .tsx,ts ./src",

pkgs/games/heroic/yarn.lock

···
     entities "^4.3.0"
 
 http-cache-semantics@^4.0.0:
-  version "4.1.0"
-  resolved "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz#49e91c5cbf36c9b94bcfcd71c23d5249ec74e390"
-  integrity sha512-carPklcUh7ROWRK7Cv27RPtdhYhUsela/ue5/jKzjegVvXDqM2ILE9Q2BGn9JZJh1g87cp56su/FgQSzcWS8cQ==
+  version "4.1.1"
+  resolved "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.1.1.tgz#abe02fcb2985460bf0323be664436ec3476a6d5a"
+  integrity sha512-er295DKPVsV82j5kw1Gjt+ADA/XYHsajl82cGNQG2eyoPkvgUhX+nDIyelzhIWbbsXP39EHcI6l5tYs2FYqYXQ==
 
 http-proxy-agent@^5.0.0:
   version "5.0.0"

pkgs/games/heroic/yarn.nix

···
       };
     }
     {
-      name = "http_cache_semantics___http_cache_semantics_4.1.0.tgz";
+      name = "http_cache_semantics___http_cache_semantics_4.1.1.tgz";
       path = fetchurl {
-        name = "http_cache_semantics___http_cache_semantics_4.1.0.tgz";
-        url  = "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz";
-        sha512 = "carPklcUh7ROWRK7Cv27RPtdhYhUsela/ue5/jKzjegVvXDqM2ILE9Q2BGn9JZJh1g87cp56su/FgQSzcWS8cQ==";
+        name = "http_cache_semantics___http_cache_semantics_4.1.1.tgz";
+        url  = "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.1.1.tgz";
+        sha512 = "er295DKPVsV82j5kw1Gjt+ADA/XYHsajl82cGNQG2eyoPkvgUhX+nDIyelzhIWbbsXP39EHcI6l5tYs2FYqYXQ==";
       };
     }
     {

pkgs/games/unciv/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "4.4.9";
+  version = "4.4.11";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    sha256 = "sha256-8OoQgiMrjYPlEjvm/9m7YkMaKyGBtNBkGavjACwY/00=";
+    hash = "sha256-UvTEqptA9Dp1wdri12sAYDB6rjiZCvk2tiG5i0AWU78=";
   };
 
   dontUnpack = true;
···
     maintainers = with maintainers; [ tex ];
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.mpl20;
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.all;
   };
 }

pkgs/os-specific/linux/setools/default.nix

···
 
 buildPythonApplication rec {
   pname = "setools";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = pname;
-    rev = version;
-    sha256 = "1qvd5j6zwq4fmlahg45swjplhif2z89x7s6pnp07gvcp2fbqdsh5";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-4T5FIdnKi35JSm+IoYA2gIBBRV0nN0YLEw9xvDqNcgo=";
   };
 
   nativeBuildInputs = [ cython ];

pkgs/servers/caddy/xcaddy/default.nix

···
 
 buildGoModule rec {
   pname = "xcaddy";
-  version = "0.3.1";
+  version = "0.3.2";
 
   subPackages = [ "cmd/xcaddy" ];
 
···
     owner = "caddyserver";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-oGTtS5UlEebIqv4SM4q0YclASJNu8DNOLrGLRRAtkd8=";
+    hash = "sha256-M0eMI/TtUNVqE4F1ifizVb0e4ACGa+yLkG3pJLaaDNs=";
   };
 
   patches = [
+    ./inject_version_info.diff
     ./use_tmpdir_on_darwin.diff
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/caddyserver/xcaddy/cmd.customVersion=v${version}"
   ];
 
   vendorHash = "sha256-RpbnoXyTrqGOI7DpgkO+J47P17T4QCVvM1CfS6kRO9Y=";
···
     homepage = "https://github.com/caddyserver/xcaddy";
     description = "Build Caddy with plugins";
     license = licenses.asl20;
-    maintainers = with maintainers; [ tjni ];
+    maintainers = with maintainers; [ tjni indeednotjames ];
   };
 }

pkgs/servers/caddy/xcaddy/inject_version_info.diff

···
+diff --git a/cmd/main.go b/cmd/main.go
+index ede7cd8..c553140 100644
+--- a/cmd/main.go
++++ b/cmd/main.go
+@@ -401,8 +401,11 @@ func splitWith(arg string) (module, version, replace string, err error) {
+ 	return
+ }
+
++var customVersion string
++
+ // xcaddyVersion returns a detailed version string, if available.
+ func xcaddyVersion() string {
++	return customVersion
+ 	mod := goModule()
+ 	ver := mod.Version
+ 	if mod.Sum != "" {

pkgs/servers/dns/pdns-recursor/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "pdns-recursor";
-  version = "4.8.1";
+  version = "4.8.2";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2";
-    sha256 = "17A0RwCSV+US8B/MRsvbnIWbZyocmyP684LocHZbDw0=";
+    sha256 = "sha256-Q4LT6E8TQBaFdyd53+3my8gVfs9nY/p/2x3TPuP3msc=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/servers/icingaweb2/default.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "icingaweb2";
-  version = "2.11.3";
+  version = "2.11.4";
 
   src = fetchFromGitHub {
     owner = "Icinga";
     repo = "icingaweb2";
     rev = "v${version}";
-    hash = "sha256-DxAWSU6nleTRkgtU6cW5KEJ0aQuzom+kGwTOk1Kg8CI=";
+    hash = "sha256-UMC1puEM0PhIu+lJouOj81tI/E6fz1PzPN0FU7TNwTg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/servers/jackett/default.nix

···
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.20.2916";
+  version = "0.20.2986";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha512-tYIPpEAqN+ENYN/NJcGWnk3NpJm0MeTBwAp7nu21QWED88sKkHatM/z+puibWxM46WMb7kyPtCmyA//aP08mJQ==";
+    hash = "sha512-IbcIn2n5Cob+Ewp0lkkIENuo00HBlNy6V5pKARC6EgBDRKbB+YXETDX1Ko3Dsl0x6mxZgoTCbzEIPxD+Y2J4Rw==";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";

pkgs/servers/prowlarr/default.nix

···
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-0JeZaHaAJ0Z+wcEPGA8yidiKsU/lxEgC6BGpFEzjO0A=";
-    arm64-linux_hash = "sha256-/N8SY0JS3yX2MARb7MN68CWEZQ8mIXM5zmg96r8hVsw=";
-    x64-osx_hash = "sha256-kcD6ATOGYJULk6g+v4uISDtnzr0c1y2BntIt3MWUR0Q=";
+    x64-linux_hash = "sha256-hKvme3saa3/GT0l6OlFjYI0RPClo5rWtVYFN/YuJSaw=";
+    arm64-linux_hash = "sha256-f7YIJRk1AhlfepmsQqlDFMA97QnbAAzrUtPFfbuV+QY=";
+    x64-osx_hash = "sha256-7nU12Y7f+fwjziUm6O+xO78IZf8EOfgmz+JibAP/xk8=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "prowlarr";
-  version = "1.1.2.2453";
+  version = "1.1.3.2521";
 
   src = fetchurl {
-    url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.develop.${version}.${os}-core-${arch}.tar.gz";
+    url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.master.${version}.${os}-core-${arch}.tar.gz";
     sha256 = hash;
   };
 

pkgs/servers/prowlarr/update.sh

···
 
     hashKey="${arch}-${os}_hash"
 
-    url="https://github.com/Prowlarr/Prowlarr/releases/download/v$version/Prowlarr.develop.$version.$os-core-$arch.tar.gz"
+    url="https://github.com/Prowlarr/Prowlarr/releases/download/v$version/Prowlarr.master.$version.$os-core-$arch.tar.gz"
     hash=$(nix-prefetch-url --type sha256 $url)
     sriHash="$(nix hash to-sri --type sha256 $hash)"
 

pkgs/servers/sabnzbd/default.nix

···
   ]);
   path = lib.makeBinPath [ par2cmdline unrar unzip p7zip ];
 in stdenv.mkDerivation rec {
-  version = "3.7.1";
+  version = "3.7.2";
   pname = "sabnzbd";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-Zzqqh/3ijOTVVm5ksmsHY4LOL034VXHeZ7XsEg8cxY0=";
+    sha256 = "sha256-1gGvdc6TJrkFIrN+TUL/7EejApgpgAQxnQbp8RMknHQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/servers/sql/proxysql/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "proxysql";
-  version = "2.4.5";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "sysown";
     repo = pname;
     rev = version;
-    hash = "sha256-JWrll6VF0Ss1DlPNrh+xd3sGMclMeb6dlVgHd/UaNs0=";
+    hash = "sha256-psQzKycavS9xr24wGiRkr255IXW79AoG9fUEBkvPMZk=";
   };
 
   patches = [
···
   ];
 
   enableParallelBuilding = true;
-
-  # otherwise, it looks for …-1.15
-  ACLOCAL = "aclocal";
-  AUTOMAKE = "automake";
 
   GIT_VERSION = version;
 
···
     popd
 
     sed -i s_/usr/bin/env_${coreutils}/bin/env_g libssl/openssl/config
+
+    pushd libmicrohttpd/libmicrohttpd
+    autoreconf
+    popd
+
+    pushd libconfig/libconfig
+    autoreconf
+    popd
+
+    pushd libdaemon/libdaemon
+    autoreconf
+    popd
 
     popd
     patchShebangs .

pkgs/servers/sql/proxysql/makefiles.patch

···
 diff --git a/Makefile b/Makefile
-index fba4e6a1..ceff4f3d 100644
+index e7dae058..09c28859 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -57,11 +57,7 @@ endif
···
  USERCHECK := $(shell getent passwd proxysql)
  GROUPCHECK := $(shell getent group proxysql)
  
-@@ -724,16 +720,10 @@ cleanbuild:
+@@ -784,16 +780,10 @@ cleanbuild:
  
  .PHONY: install
  install: src/proxysql
···
  	install -m 0755 etc/init.d/proxysql /etc/init.d
  ifeq ($(DISTRO),"CentOS Linux")
 diff --git a/deps/Makefile b/deps/Makefile
-index 13eed9c5..9abb2262 100644
+index 23ef204c..3fbcc4a7 100644
 --- a/deps/Makefile
 +++ b/deps/Makefile
-@@ -65,18 +65,11 @@ endif
+@@ -65,10 +65,7 @@ endif
  
  
  libinjection/libinjection/src/libinjection.a:
 -	cd libinjection && rm -rf libinjection-*/ || true
 -	cd libinjection && tar -zxf libinjection-3.10.0.tar.gz
--ifneq ($(CENTOSVER),6)
+ ifneq ($(CENTOSVER),6)
 -	cd libinjection/libinjection && patch -p1 < ../update-build-py3.diff
--endif
- 	sed -i 's/CC=/CC?=/' libinjection/libinjection/src/Makefile
- 	cd libinjection/libinjection && CC=${CC} CXX=${CXX} ${MAKE}
+ 	cd libinjection/libinjection && patch -p1 < ../libinjection_sqli.c.patch
+ endif
+ ifeq ($(UNAME_S),Darwin)
+@@ -80,8 +77,6 @@ endif
  libinjection: libinjection/libinjection/src/libinjection.a
  
  libssl/openssl/libssl.a:
···
  	cd libssl/openssl && patch crypto/ec/curve448/curve448.c < ../curve448.c-multiplication-overflow.patch
  	cd libssl/openssl && patch crypto/asn1/a_time.c < ../a_time.c-multiplication-overflow.patch
  	cd libssl/openssl && ./config no-ssl3 no-tests
-@@ -93,8 +86,6 @@ ifeq ($(MIN_VERSION),$(lastword $(sort $(GCC_VERSION) $(MIN_VERSION))))
+@@ -99,9 +94,6 @@ ifeq ($(MIN_VERSION),$(lastword $(SORTED_VERSIONS)))
  endif
  
  libhttpserver/libhttpserver/build/src/.libs/libhttpserver.a: libmicrohttpd/libmicrohttpd/src/microhttpd/.libs/libmicrohttpd.a re2/re2/obj/libre2.a
 -	cd libhttpserver && rm -rf libhttpserver-*/ || true
 -	cd libhttpserver && tar -zxf libhttpserver-0.18.1.tar.gz
- ifeq ($(REQUIRE_PATCH), true)
+-#ifeq ($(REQUIRE_PATCH), true)
  	cd libhttpserver/libhttpserver && patch src/httpserver/basic_auth_fail_response.hpp < ../basic_auth_fail_response.hpp.patch
  	cd libhttpserver/libhttpserver && patch src/httpserver/create_webserver.hpp < ../create_webserver.hpp.patch
-@@ -117,34 +108,16 @@ endif
+ 	cd libhttpserver/libhttpserver && patch src/httpserver/deferred_response.hpp < ../deferred_response.hpp.patch
+@@ -112,7 +104,6 @@ libhttpserver/libhttpserver/build/src/.libs/libhttpserver.a: libmicrohttpd/libmi
+ 	cd libhttpserver/libhttpserver && patch src/httpserver/http_response.hpp < ../http_response.hpp.patch
+ 	cd libhttpserver/libhttpserver && patch src/httpserver/string_response.hpp < ../string_response.hpp.patch
+ 	cd libhttpserver/libhttpserver && patch -p0 < ../re2_regex.patch
+-#endif
+ 	cd libhttpserver/libhttpserver && patch -p0 < ../final_val_post_process.patch
+ 	cd libhttpserver/libhttpserver && patch -p0 < ../empty_uri_log_crash.patch
+ ifeq ($(UNAME_S),FreeBSD)
+@@ -124,35 +115,17 @@ endif
  libhttpserver: libhttpserver/libhttpserver/build/src/.libs/libhttpserver.a
  
  libev/libev/.libs/libev.a:
···
 -	cd curl && rm -rf curl-*/ || true
 -	cd curl && tar -zxf curl-*.tar.gz
 -	#cd curl/curl && ./configure --disable-debug --disable-ftp --disable-ldap --disable-ldaps --disable-rtsp --disable-proxy --disable-dict --disable-telnet --disable-tftp --disable-pop3 --disable-imap --disable-smb --disable-smtp --disable-gopher --disable-manual --disable-ipv6 --disable-sspi --disable-crypto-auth --disable-ntlm-wb --disable-tls-srp --without-nghttp2 --without-libidn2 --without-libssh2 --without-brotli --with-ssl=$(shell pwd)/../../libssl/openssl/ && CC=${CC} CXX=${CXX} ${MAKE}
+ 	cd curl/curl && patch configure < ../configure.patch
  	cd curl/curl && CFLAGS=-fPIC ./configure --disable-debug --disable-ftp --disable-ldap --disable-ldaps --disable-rtsp --disable-proxy --disable-dict --disable-telnet --disable-tftp --disable-pop3 --disable-imap --disable-smb --disable-smtp --disable-gopher --disable-manual --disable-ipv6 --disable-sspi --disable-ntlm-wb --disable-tls-srp --without-nghttp2 --without-libidn2 --without-libssh2 --without-brotli --without-librtmp --without-libpsl --without-zstd --with-ssl=$(shell pwd)/libssl/openssl/ --enable-shared=no && CC=${CC} CXX=${CXX} ${MAKE}
  curl: curl/curl/lib/.libs/libcurl.a
  
···
 -	cd libmicrohttpd && tar -zxf libmicrohttpd-0.9.68.tar.gz
 -	cd libmicrohttpd/libmicrohttpd && patch src/microhttpd/connection.c < ../connection.c-snprintf-overflow.patch
 -endif
--ifeq ($(OS),Darwin)
+-ifeq ($(UNAME_S),Darwin)
 -	cd libmicrohttpd/libmicrohttpd && patch src/microhttpd/mhd_sockets.c < ../mhd_sockets.c-issue-5977.patch
 -endif
  	cd libmicrohttpd/libmicrohttpd && ./configure --enable-https && CC=${CC} CXX=${CXX} ${MAKE}
  microhttpd: libmicrohttpd/libmicrohttpd/src/microhttpd/.libs/libmicrohttpd.a
  
-@@ -155,8 +128,6 @@ cityhash/cityhash/src/.libs/libcityhash.a:
+@@ -163,8 +136,6 @@ cityhash/cityhash/src/.libs/libcityhash.a:
  cityhash: cityhash/cityhash/src/.libs/libcityhash.a
  
  lz4/lz4/liblz4.a:
···
  	cd lz4/lz4 && CC=${CC} CXX=${CXX} ${MAKE}
  lz4: lz4/lz4/liblz4.a
  
-@@ -181,8 +152,6 @@ clickhouse-cpp: clickhouse-cpp/clickhouse-cpp/clickhouse/libclickhouse-cpp-lib-s
+@@ -189,8 +160,6 @@ clickhouse-cpp: clickhouse-cpp/clickhouse-cpp/clickhouse/libclickhouse-cpp-lib-s
  
  
  libdaemon/libdaemon/libdaemon/.libs/libdaemon.a:
 -	cd libdaemon && rm -rf libdaemon-*/ || true
 -	cd libdaemon && tar -zxf libdaemon-0.14.tar.gz
- 	cd libdaemon/libdaemon && cp ../config.guess . && chmod +x config.guess && ./configure --disable-examples
+ 	cd libdaemon/libdaemon && cp ../config.guess . && chmod +x config.guess && cp ../config.sub . && chmod +x config.sub && ./configure --disable-examples
  	cd libdaemon/libdaemon && CC=${CC} CXX=${CXX} ${MAKE}
  
-@@ -253,17 +222,12 @@ sqlite3/sqlite3/sqlite3.o:
+@@ -264,17 +233,12 @@ sqlite3/sqlite3/sqlite3.o:
  sqlite3: sqlite3/sqlite3/sqlite3.o
  
  libconfig/libconfig/lib/.libs/libconfig++.a:
···
  	cd prometheus-cpp/prometheus-cpp && patch -p1 < ../serial_exposer.patch
  	cd prometheus-cpp/prometheus-cpp && patch -p0 < ../registry_counters_reset.patch
  	cd prometheus-cpp/prometheus-cpp && patch -p0 < ../include_limits.patch
-@@ -273,10 +237,6 @@ prometheus-cpp/prometheus-cpp/lib/libprometheus-cpp-core.a:
+@@ -284,10 +248,6 @@ prometheus-cpp/prometheus-cpp/lib/libprometheus-cpp-core.a:
  prometheus-cpp: prometheus-cpp/prometheus-cpp/lib/libprometheus-cpp-core.a
  
  re2/re2/obj/libre2.a:
···
 -#	cd re2/re2 && sed -i -e 's/-O3 -g /-O3 -fPIC /' Makefile
 -#	cd re2/re2 && patch util/mutex.h < ../mutex.h.patch
  	cd re2/re2 && patch re2/onepass.cc < ../onepass.cc-multiplication-overflow.patch
- 	cd re2/re2 && sed -i -e 's/-O3 /-O3 -fPIC -DMEMORY_SANITIZER -DRE2_ON_VALGRIND /' Makefile
- 	cd re2/re2 && sed -i -e 's/RE2_CXXFLAGS?=-std=c++11 /RE2_CXXFLAGS?=-std=c++11 -fPIC /' Makefile
-@@ -285,8 +245,6 @@ re2/re2/obj/libre2.a:
+ ifeq ($(UNAME_S),Darwin)
+ 	cd re2/re2 && sed -i '' -e 's/-O3 /-O3 -fPIC -DMEMORY_SANITIZER -DRE2_ON_VALGRIND /' Makefile
+@@ -301,8 +261,6 @@ endif
  re2: re2/re2/obj/libre2.a
  
  pcre/pcre/.libs/libpcre.a:

pkgs/servers/x11/xorg/overrides.nix

···
             url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/ccdd431cd8f1cabae9d744f0514b6533c438908c.diff";
             sha256 = "sha256-IGPsjS7KgRPLrs1ImBXvIFCa8Iu5ZiAHRZvHlBYP8KQ=";
           })
+          (fetchpatch {
+            name = "CVE-2023-0494.diff";
+            url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ec.diff";
+            sha256 = "sha256-/+IuGk09OYVEIB/Y+DTKf7kfHyukEFX/6u1FDIGJieY=";
+          })
         ];
         buildInputs = commonBuildInputs ++ [ libdrm mesa ];
         propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [

pkgs/shells/zsh/zimfw/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "zimfw";
-  version = "1.11.0";
+  version = "1.11.1";
   src = fetchFromGitHub {
     owner = "zimfw";
     repo = "zimfw";
     rev = "v${version}";
     ## zim only needs this one file to be installed.
     sparseCheckout = [ "zimfw.zsh" ];
-    sha256 = "sha256-BmzYAgP5Z77VqcpAB49cQLNuvQX1qcKmAh9BuXsy2pA=";
+    sha256 = "sha256-ZL/x5FNklRa5JnZ5UUofnIcW4dCInaEvTLBQfMJDWIM=";
   };
   strictDeps = true;
   dontConfigure = true;

pkgs/tools/admin/mycli/default.nix

···
     sqlparse
   ];
 
-  nativeCheckInputs = [ pytest glibcLocales ];
+  nativeCheckInputs = [ pytestCheckHook glibcLocales ];
 
-  checkPhase = ''
+  preCheck = ''
     export HOME=.
     export LC_ALL="en_US.UTF-8"
-
-    py.test \
-      --ignore=mycli/packages/paramiko_stub/__init__.py
   '';
+
+  disabledTestPaths = [
+    "mycli/packages/paramiko_stub/__init__.py"
+  ];
+
+  disabledTests = [
+    # Note: test_auto_escaped_col_names is currently failing due to a bug upstream.
+    # TODO: re-enable this test once there is a fix upstream. See
+    # https://github.com/dbcli/mycli/issues/1103 for details.
+    "test_auto_escaped_col_names"
+  ];
 
   postPatch = ''
     substituteInPlace setup.py \

pkgs/tools/filesystems/httm/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "httm";
-  version = "0.20.4";
+  version = "0.20.5";
 
   src = fetchFromGitHub {
     owner = "kimono-koans";
     repo = pname;
     rev = version;
-    sha256 = "sha256-PmfyULkB93PvouOWp96F4YXyNFQqRmoy6LpOFGz0EZk=";
+    sha256 = "sha256-8SizRNjA+lvp8ZD14SoRcymhYmJXlwoeZQjrekIbdL4=";
   };
 
-  cargoHash = "sha256-L5/qOnyxfj3KfcZDI9Xp2IgE33P8yzQjVg6+4jmGQyM=";
+  cargoHash = "sha256-tXV1G0qWN0jLOKlnZfHHlOZw+wUItLzQtSg4o2f96u0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/tools/inputmethods/touchegg/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "touchegg";
-  version = "2.0.15";
+  version = "2.0.16";
 
   src = fetchFromGitHub {
     owner = "JoseExposito";
     repo = pname;
     rev = version;
-    sha256 = "sha256-oz3+hNNjQ/5vXWPMuhA2N2KK8W8S42WeSeDbhV4oJ9M=";
+    sha256 = "sha256-/0XeFW0cdS1/UaE/z2FROwk2dTyZMqXjiBzt62x8f8o=";
   };
 
   patches = lib.optionals withPantheon [

pkgs/tools/misc/vtm/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "vtm";
-  version = "0.9.8q";
+  version = "0.9.8r";
 
   src = fetchFromGitHub {
     owner = "netxs-group";
     repo = "vtm";
     rev = "v${version}";
-    sha256 = "sha256-oY0zmyAgxMHPcBxFNdByQfeLIquw6eQ2SSfCgTKtO7Q=";
+    sha256 = "sha256-1nCO8wtARnRCanIEH1XAJBjEnW18Bhm+pcr/EeiRrzY=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/tools/networking/ipinfo/default.nix

···
 
 buildGoModule rec {
   pname = "ipinfo";
-  version = "2.10.0";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "cli";
-    rev = "${pname}-${version}";
-    hash = "sha256-oim234254qUWITfgBfB2theMgpVnGHNmrzwE5ULM2M4=";
+    rev = "refs/tags/${pname}-${version}";
+    hash = "sha256-/CW+CmtKc96tVEh5cB6x+/Hb4WnbVi+3AZ0CEao0NE4=";
   };
 
   vendorSha256 = null;
···
   meta = with lib; {
     description = "Command Line Interface for the IPinfo API";
     homepage = "https://github.com/ipinfo/cli";
+    changelog = "https://github.com/ipinfo/cli/releases/tag/ipinfo-${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/tools/networking/udp2raw/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "udp2raw";
-  version = "20200818.0";
+  version = "20230206.0";
 
   src = fetchFromGitHub {
     owner = "wangyu-";
     repo = "udp2raw";
     rev = version;
-    hash = "sha256-TkTOfF1RfHJzt80q0mN4Fek3XSFY/8jdeAVtyluZBt8=";
+    hash = "sha256-mchSaqw6sOJ7+dydCM8juP7QMOVUrPL4MFA79Rvyjdo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/tools/package-management/nix-eval-jobs/default.nix

···
 }:
 stdenv.mkDerivation rec {
   pname = "nix-eval-jobs";
-  version = "2.12.1";
+  version = "2.13.0";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-8nFseSTAIGJdB4P/K/cXAehvdrSLcTTBZLQNs/ZC+I8=";
+    hash = "sha256-O0Ro9vwf2kDhGFs32puQIeW/rSSduC9sD5zV8e/GtvA=";
   };
   buildInputs = [
     boost

pkgs/tools/security/gnupg/24.nix

···
 { fetchurl, fetchpatch, lib, stdenv, pkg-config, libgcrypt, libassuan, libksba
 , libgpg-error, libiconv, npth, gettext, texinfo, buildPackages
+, nixosTests
 , guiSupport ? stdenv.isDarwin, enableMinimal ? false
 , adns, bzip2, gnutls, libusb1, openldap
 , pinentry, readline, sqlite, zlib
···
   '';
 
   enableParallelBuilding = true;
+
+  passthru.tests.connman = nixosTests.gnupg;
 
   meta = with lib; {
     homepage = "https://gnupg.org";

pkgs/tools/security/terrascan/default.nix

···
 
 buildGoModule rec {
   pname = "terrascan";
-  version = "1.17.1";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "accurics";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-XcMDdnqx64UcEzD44z34sm5TmshPOTb5tivBnGXQLjo=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-EzdyJzUPoWcLux6RiEZL3DiB65T+pgY70bpD1fX1JN4=";
   };
 
-  vendorHash = "sha256-HjWUV5gfh2WnUAayZIj6LGFs0rMv2n7v6zJJrzBHBwg=";
+  vendorHash = "sha256-yTndvnlCmXsQSpImcwuwSXB0WuF2naGJEHfU1iAJApM=";
 
   # Tests want to download a vulnerable Terraform project
   doCheck = false;

pkgs/tools/video/wtwitch/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "wtwitch";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "krathalan";
     repo = pname;
     rev = version;
-    hash = "sha256-KkuXZOquihY3IRVp4FM+AdN3kYi0MqmrXFuNmydTpio=";
+    hash = "sha256-CHIAxUF0kvt8iV5xRbX5zuOCIecH7NoviQOYiOK0CgY=";
   };
 
   # hardcode SCRIPT_NAME because #150841

pkgs/top-level/all-packages.nix

···
   kermit-terminal = callPackage ../applications/terminal-emulators/kermit-terminal { };
 
   kitty = darwin.apple_sdk_11_0.callPackage ../applications/terminal-emulators/kitty {
+    go = go_1_20;
     harfbuzz = harfbuzz.override { withCoreText = stdenv.isDarwin; };
     inherit (darwin.apple_sdk_11_0) Libsystem;
     inherit (darwin.apple_sdk_11_0.frameworks)
···
   };
 
   passExtensions = recurseIntoAttrs pass.extensions;
+
+  pbpctrl = callPackage ../applications/audio/pbpctrl { };
 
   pdepend = callPackage ../development/php-packages/pdepend { };
 
···
 
   freeswitch = callPackage ../servers/sip/freeswitch {
     inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
-    openssl = openssl_1_1;
   };
 
   fusionInventory = callPackage ../servers/monitoring/fusion-inventory { };
···
 
   azpainter = callPackage ../applications/graphics/azpainter { };
 
-  bambootracker = libsForQt5.callPackage ../applications/audio/bambootracker { };
+  bambootracker = libsForQt5.callPackage ../applications/audio/bambootracker {
+    stdenv = if stdenv.hostPlatform.isDarwin then
+      darwin.apple_sdk_11_0.stdenv
+    else
+      stdenv;
+  };
+  bambootracker-qt6 = qt6Packages.callPackage ../applications/audio/bambootracker {
+    stdenv = if stdenv.hostPlatform.isDarwin then
+      darwin.apple_sdk_11_0.stdenv
+    else
+      stdenv;
+  };
 
   blocky = callPackage ../applications/networking/blocky { };
 
···
 
   mopac = callPackage ../applications/science/chemistry/mopac { };
 
+  nwchem = callPackage ../applications/science/chemistry/nwchem { };
+
   octopus = callPackage ../applications/science/chemistry/octopus { };
 
   openlp = libsForQt5.callPackage ../applications/misc/openlp { };
···
 
   dnadd = callPackage ../tools/nix/dnadd { };
 
-  nix-eval-jobs = callPackage ../tools/package-management/nix-eval-jobs {
-    nix = nixVersions.nix_2_12; # fails to build with 2.13
-  };
+  nix-eval-jobs = callPackage ../tools/package-management/nix-eval-jobs { };
 
   nix-doc = callPackage ../tools/package-management/nix-doc { };
 

pkgs/top-level/ocaml-packages.nix

···
       then pkgs.dune_2
       else throw "dune_2 is not available for OCaml ${ocaml.version}";
 
-    dune_3 = callPackage ../development/tools/ocaml/dune/3.nix { };
+    dune_3 =
+      if lib.versionAtLeast ocaml.version "4.08"
+      then callPackage ../development/tools/ocaml/dune/3.nix { }
+      else if lib.versionAtLeast ocaml.version "4.02"
+      then pkgs.dune_3
+      else throw "dune_3 is not available for OCaml ${ocaml.version}";
 
     dune-action-plugin = callPackage ../development/ocaml-modules/dune-action-plugin { };
 
···
     result = callPackage ../development/ocaml-modules/ocaml-result { };
 
     rock = callPackage ../development/ocaml-modules/rock { };
+
+    rusage = callPackage ../development/ocaml-modules/rusage { };
 
     samplerate = callPackage ../development/ocaml-modules/samplerate { };
 

pkgs/top-level/perl-packages.nix

···
   };
 
   AppSqitch = buildPerlModule {
-    version = "1.1.0";
+    version = "1.3.1";
     pname = "App-Sqitch";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/D/DW/DWHEELER/App-Sqitch-v1.1.0.tar.gz";
-      hash = "sha256-7hRs111jAIN+bKVZuwveJH1CEjyWssXUsoAPONPj0as=";
+      url = "mirror://cpan/authors/id/D/DW/DWHEELER/App-Sqitch-v1.3.1.tar.gz";
+      hash = "sha256-9edo0pjNQEfuKuQjGXgujCzaMSc3vL2/r1gL1H7+i5Q=";
     };
     buildInputs = [ CaptureTiny TestDeep TestDir TestException TestFile TestFileContents TestMockModule TestMockObject TestNoWarnings TestWarn ];
     propagatedBuildInputs = [ Clone ConfigGitLike DBI DateTime EncodeLocale HashMerge IOPager IPCRun3 IPCSystemSimple ListMoreUtils PathClass PerlIOutf8_strict PodParser StringFormatter StringShellQuote TemplateTiny Throwable TypeTiny URIdb libintl-perl ];
···
     };
   };
 
+  NetIPXS = buildPerlPackage {
+    pname = "Net-IP-XS";
+    version = "0.22";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TO/TOMHRR/Net-IP-XS-0.22.tar.gz";
+      hash = "sha256-JZe0aDizgur3S6XJnD9gpqC1poHsNqFBchJL9E9LGSA=";
+    };
+    propagatedBuildInputs = [ IOCapture TieSimple ];
+    meta = {
+      homepage = "https://github.com/tomhrr/p5-Net-IP-XS";
+      description = "IPv4/IPv6 address library";
+      license = with lib.licenses; [ gpl2Plus ];
+    };
+  };
+
   NetLDAPServer = buildPerlPackage {
     pname = "Net-LDAP-Server";
     version = "0.43";
···
 
   TemplateToolkit = buildPerlPackage {
     pname = "Template-Toolkit";
-    version = "3.009";
+    version = "3.101";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/A/AT/ATOOMIC/Template-Toolkit-3.009.tar.gz";
-      hash = "sha256-1q0ju/Y3pZtd/RrABkYN/LGFmC5IUs3ncVD70IXx9bY=";
+      url = "mirror://cpan/authors/id/A/AB/ABW/Template-Toolkit-3.101.tar.gz";
+      hash = "sha256-0qMt1sIeSzfGqT34CHyp6IDPrmE6Pl766jB7C9yu21g=";
     };
     doCheck = !stdenv.isDarwin;
     propagatedBuildInputs = [ AppConfig ];
···
 
   ZonemasterCLI = buildPerlPackage {
     pname = "Zonemaster-CLI";
-    version = "4.0.1";
+    version = "5.0.1";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Z/ZN/ZNMSTR/Zonemaster-CLI-v4.0.1.tar.gz";
-      hash = "sha256-7dNPe4E35JLmzoR0xFpVBXLcpQVqve/EXAdt+daWXKA=";
+      url = "mirror://cpan/authors/id/Z/ZN/ZNMSTR/Zonemaster-CLI-v5.0.1.tar.gz";
+      hash = "sha256-a/PPgavkaw9gCW44rj7+6AjOOSHKglg4H3kr6jXuRE4=";
     };
     propagatedBuildInputs = [
       JSONXS
···
 
   ZonemasterEngine = buildPerlPackage {
     pname = "Zonemaster-Engine";
-    version = "4.5.1";
+    version = "4.6.1";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Z/ZN/ZNMSTR/Zonemaster-Engine-v4.5.1.tar.gz";
-      hash = "sha256-RdIExtrXzZAXYIS/JCe6qM5QNoSlaZ6+sjbk0zvAuoY=";
+      url = "mirror://cpan/authors/id/Z/ZN/ZNMSTR/Zonemaster-Engine-v4.6.1.tar.gz";
+      hash = "sha256-4AXo3bZTOLnnPjjX5KNb/2O7MRqcAtlqpz5sPwNN9b0=";
     };
     buildInputs = [ PodCoverage TestDifferences TestException TestFatal TestNoWarnings TestPod ];
-    propagatedBuildInputs = [ ClassAccessor Clone EmailValid FileShareDir FileSlurp IOSocketINET6 ListMoreUtils ModuleFind Moose MooseXSingleton NetIP Readonly TextCSV ZonemasterLDNS libintl-perl ];
-
-    preCheck = ''
-      # disable dnssec test as it fails
-      rm -f t/Test-dnssec.t t/manifest.t
-    '';
+    propagatedBuildInputs = [ ClassAccessor Clone EmailValid FileShareDir FileSlurp IOSocketINET6 ListMoreUtils ModuleFind Moose MooseXSingleton NetIP NetIPXS Readonly TextCSV ZonemasterLDNS libintl-perl ];
 
     meta = {
       description = "A tool to check the quality of a DNS zone";
···
 
   ZonemasterLDNS = buildPerlPackage {
     pname = "Zonemaster-LDNS";
-    version = "2.2.2";
+    version = "3.1.0";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Z/ZN/ZNMSTR/Zonemaster-LDNS-2.2.2.tar.gz";
-      hash = "sha256-4KccPjWqdhkJvjI9QQGCPX/B8vRUGw91eUUgxhHk788=";
+      url = "mirror://cpan/authors/id/Z/ZN/ZNMSTR/Zonemaster-LDNS-3.1.0.tar.gz";
+      hash = "sha256-Rr4uoQg5g9/ZLVnFQiLAz5MB+Uj39U24YWEa+o2+9HE=";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl_1_1.dev}/include -I${pkgs.libidn2}.dev}/include";
-    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl_1_1}/lib -L${lib.getLib pkgs.libidn2}/lib -lcrypto -lidn2";
+    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include -I${pkgs.libidn2}.dev}/include";
+    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -L${lib.getLib pkgs.libidn2}/lib -lcrypto -lidn2";
 
-    makeMakerFlags = [ "--prefix-openssl=${pkgs.openssl_1_1.dev}" ];
+    makeMakerFlags = [ "--prefix-openssl=${pkgs.openssl.dev}" ];
 
     nativeBuildInputs = [ pkgs.pkg-config ];
-    buildInputs = [ DevelChecklib ModuleInstall ModuleInstallXSUtil TestFatal pkgs.ldns pkgs.libidn2 pkgs.openssl_1_1 ];
+    buildInputs = [ DevelChecklib ModuleInstall ModuleInstallXSUtil TestFatal pkgs.ldns pkgs.libidn2 pkgs.openssl ];
     meta = {
       description = "Perl wrapper for the ldns DNS library";
       license = with lib.licenses; [ bsd3 ];