Merge master into haskell-updates

2025-04-17 18:28:30 +00:00 · 2022-12-07 00:13:32 +00:00 · 2022-12-07 00:13:32 +00:00 · 0ad12b3774
commit 0ad12b3774
parent d7af8ae032 35be6085dc
342 changed files with 3254 additions and 1879 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -9442,6 +9442,15 @@
    githubId = 249317;
    name = "montag451";
  };
+  montchr = {
+    name = "Chris Montgomery";
+    email = "chris@cdom.io";
+    github = "montchr";
+    githubId = 1757914;
+    keys = [{
+      fingerprint = "6460 4147 C434 F65E C306  A21F 135E EDD0 F719 34F3";
+    }];
+  };
  moosingin3space = {
    email = "moosingin3space@gmail.com";
    github = "moosingin3space";
@ -14118,6 +14127,12 @@
    githubId = 8794235;
    name = "Tom Siewert";
  };
+  tonyshkurenko = {
+    email = "support@twingate.com";
+    github = "tonyshkurenko";
+    githubId = 8597964;
+    name = "Anton Shkurenko";
+  };
  toonn = {
    email = "nixpkgs@toonn.io";
    matrix = "@toonn:matrix.org";
--- a/maintainers/scripts/update-luarocks-shell.nix
+++ b/maintainers/scripts/update-luarocks-shell.nix
@ -2,7 +2,7 @@
 }:
 with nixpkgs;
 let
-  pyEnv = python3.withPackages(ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages(ps: [ ps.gitpython ]);
 in
 mkShell {
  packages = [
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -561,6 +561,14 @@
          <link xlink:href="options.html#opt-services.prometheus.exporters.smartctl.enable">services.prometheus.exporters.smartctl</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://docs.twingate.com/docs/linux">twingate</link>,
+          a high performance, easy to use zero trust solution that
+          enables access to private resources from any device with
+          better security than a VPN.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-21.11-incompatibilities">
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -164,6 +164,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [smartctl_exporter](https://github.com/prometheus-community/smartctl_exporter), a Prometheus exporter for [S.M.A.R.T.](https://en.wikipedia.org/wiki/S.M.A.R.T.) data. Available as [services.prometheus.exporters.smartctl](options.html#opt-services.prometheus.exporters.smartctl.enable).

+- [twingate](https://docs.twingate.com/docs/linux), a high performance, easy to use zero trust solution that enables access to private resources from any device with better security than a VPN.
+
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}

 - The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix` (`pkgs.testers.nixosTest` since 22.05), now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout.
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@ -30,8 +30,8 @@ with lib;
      beam = super.beam_nox;
      cairo = super.cairo.override { x11Support = false; };
      dbus = super.dbus.override { x11Support = false; };
-      ffmpeg_4 = super.ffmpeg_4.override { sdlSupport = false; vdpauSupport = false; };
-      ffmpeg_5 = super.ffmpeg_5.override { sdlSupport = false; vdpauSupport = false; };
+      ffmpeg_4 = super.ffmpeg_4-headless;
+      ffmpeg_5 = super.ffmpeg_5-headless;
      gobject-introspection = super.gobject-introspection.override { x11Support = false; };
      imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; };
      imagemagickBig = super.imagemagickBig.override { libX11Support = false; libXtSupport = false; };
--- a/nixos/modules/config/xdg/portal.nix
+++ b/nixos/modules/config/xdg/portal.nix
@ -61,6 +61,17 @@ in
        Defaults to `false` to respect its opt-in nature.
      '';
    };
+
+    xdgOpenUsePortal = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Sets environment variable `NIXOS_XDG_OPEN_USE_PORTAL` to `1`
+        This will make `xdg-open` use the portal to open programs, which resolves bugs involving
+        programs opening inside FHS envs or with unexpected env vars set from wrappers.
+        See [#160923](https://github.com/NixOS/nixpkgs/issues/160923) for more info.
+      '';
+    };
  };

  config =
@ -95,6 +106,7 @@ in

        sessionVariables = {
          GTK_USE_PORTAL = mkIf cfg.gtkUsePortal "1";
+          NIXOS_XDG_OPEN_USE_PORTAL = mkIf cfg.xdgOpenUsePortal "1";
          XDG_DESKTOP_PORTAL_DIR = "${joinedPortals}/share/xdg-desktop-portal/portals";
        };
      };
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -988,6 +988,7 @@
  ./services/networking/tox-node.nix
  ./services/networking/toxvpn.nix
  ./services/networking/tvheadend.nix
+  ./services/networking/twingate.nix
  ./services/networking/ucarp.nix
  ./services/networking/unbound.nix
  ./services/networking/unifi.nix
@ -1015,6 +1016,7 @@
  ./services/networking/zerotierone.nix
  ./services/networking/znc/default.nix
  ./services/printing/cupsd.nix
+  ./services/printing/ipp-usb.nix
  ./services/scheduling/atd.nix
  ./services/scheduling/cron.nix
  ./services/scheduling/fcron.nix
--- a/nixos/modules/services/backup/borgbackup.xml
+++ b/nixos/modules/services/backup/borgbackup.xml
@ -179,7 +179,7 @@ sudo borg init --encryption=repokey-blake2  \
          mode = "repokey-blake2";
          passCommand = "cat /run/keys/borgbackup_passphrase";
        };
-        BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase";
+        environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
        compression = "auto,lzma";
        startAt = "daily";
    };
--- a/nixos/modules/services/databases/cassandra.nix
+++ b/nixos/modules/services/databases/cassandra.nix
@ -19,6 +19,10 @@ let

  cfg = config.services.cassandra;

+  atLeast3 = versionAtLeast cfg.package.version "3";
+  atLeast3_11 = versionAtLeast cfg.package.version "3.11";
+  atLeast4 = versionAtLeast cfg.package.version "4";
+
  defaultUser = "cassandra";

  cassandraConfig = flip recursiveUpdate cfg.extraConfig (
@ -39,7 +43,7 @@ let
          parameters = [{ seeds = concatStringsSep "," cfg.seedAddresses; }];
        }
      ];
-    } // optionalAttrs (versionAtLeast cfg.package.version "3") {
+    } // optionalAttrs atLeast3 {
      hints_directory = "${cfg.homeDir}/hints";
    }
  );
@ -62,7 +66,7 @@ let
    cassandraLogbackConfig = pkgs.writeText "logback.xml" cfg.logbackConfig;

    passAsFile = [ "extraEnvSh" ];
-    inherit (cfg) extraEnvSh;
+    inherit (cfg) extraEnvSh package;

    buildCommand = ''
      mkdir -p "$out"
@ -80,6 +84,10 @@ let

      # Delete default password file
      sed -i '/-Dcom.sun.management.jmxremote.password.file=\/etc\/cassandra\/jmxremote.password/d' "$out/cassandra-env.sh"
+
+      ${lib.optionalString atLeast4 ''
+        cp $package/conf/jvm*.options $out/
+      ''}
    '';
  };

@ -95,8 +103,20 @@ let
      "-Dcom.sun.management.jmxremote.password.file=${cfg.jmxRolesFile}"
    ] ++ optionals cfg.remoteJmx [
      "-Djava.rmi.server.hostname=${cfg.rpcAddress}"
+    ] ++ optionals atLeast4 [
+      # Historically, we don't use a log dir, whereas the upstream scripts do
+      # expect this. We override those by providing our own -Xlog:gc flag.
+      "-Xlog:gc=warning,heap*=warning,age*=warning,safepoint=warning,promotion*=warning"
    ];

+  commonEnv = {
+    # Sufficient for cassandra 2.x, 3.x
+    CASSANDRA_CONF = "${cassandraEtc}";
+
+    # Required since cassandra 4
+    CASSANDRA_LOGBACK_CONF = "${cassandraEtc}/logback.xml";
+  };
+
 in
 {
  options.services.cassandra = {
@ -435,7 +455,7 @@ in
    jmxRolesFile = mkOption {
      type = types.nullOr types.path;
      default =
-        if versionAtLeast cfg.package.version "3.11"
+        if atLeast3_11
        then pkgs.writeText "jmx-roles-file" defaultJmxRolesFile
        else null;
      defaultText = literalMD ''generated configuration file if version is at least 3.11, otherwise `null`'';
@ -486,8 +506,7 @@ in
    systemd.services.cassandra = {
      description = "Apache Cassandra service";
      after = [ "network.target" ];
-      environment = {
-        CASSANDRA_CONF = "${cassandraEtc}";
+      environment = commonEnv // {
        JVM_OPTS = builtins.concatStringsSep " " fullJvmOptions;
        MAX_HEAP_SIZE = toString cfg.maxHeapSize;
        HEAP_NEWSIZE = toString cfg.heapNewSize;
@ -508,6 +527,7 @@ in
      description = "Perform a full repair on this Cassandra node";
      after = [ "cassandra.service" ];
      requires = [ "cassandra.service" ];
+      environment = commonEnv;
      serviceConfig = {
        User = cfg.user;
        Group = cfg.group;
@ -536,6 +556,7 @@ in
      description = "Perform an incremental repair on this cassandra node.";
      after = [ "cassandra.service" ];
      requires = [ "cassandra.service" ];
+      environment = commonEnv;
      serviceConfig = {
        User = cfg.user;
        Group = cfg.group;
--- a/nixos/modules/services/networking/twingate.nix
+++ b/nixos/modules/services/networking/twingate.nix
@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.twingate;
+
+in {
+
+  options.services.twingate = {
+    enable = mkEnableOption (lib.mdDoc "Twingate Client daemon");
+  };
+
+  config = mkIf cfg.enable {
+
+    networking.firewall.checkReversePath = lib.mkDefault false;
+    networking.networkmanager.enable = true;
+
+    environment.systemPackages = [ pkgs.twingate ]; # for the CLI
+    systemd.packages = [ pkgs.twingate ];
+
+    systemd.services.twingate.preStart = ''
+      cp -r -n ${pkgs.twingate}/etc/twingate/. /etc/twingate/
+    '';
+
+    systemd.services.twingate.wantedBy = [ "multi-user.target" ];
+  };
+}
--- a/nixos/modules/services/printing/ipp-usb.nix
+++ b/nixos/modules/services/printing/ipp-usb.nix
@ -0,0 +1,63 @@
+{ config, lib, pkgs, ... }: {
+  options = {
+    services.ipp-usb = {
+      enable = lib.mkEnableOption (lib.mdDoc "ipp-usb, a daemon to turn an USB printer/scanner supporting IPP everywhere (aka AirPrint, WSD, AirScan) into a locally accessible network printer/scanner");
+    };
+  };
+  config = lib.mkIf config.services.ipp-usb.enable {
+    systemd.services.ipp-usb = {
+      description = "Daemon for IPP over USB printer support";
+      after = [ "cups.service" "avahi-deamon.service" ];
+      wants = [ "avahi-daemon.service" ];
+      serviceConfig = {
+        ExecStart = [ "${pkgs.ipp-usb}/bin/ipp-usb" ];
+        Type = "simple";
+        Restart = "on-failure";
+        StateDirectory = "ipp-usb";
+        LogsDirectory = "ipp-usb";
+
+        # hardening.
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectControlGroups = true;
+        MemoryDenyWriteExecute = true;
+        # breaks the daemon, presumably because it messes with DeviceAllow
+        ProtectClock = false;
+        ProtectKernelTunables = true;
+        ProtectKernelLogs = true;
+        ProtectSystem = "strict";
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        PrivateMounts = true;
+        ProtectHostname = true;
+        ProtectKernelModules = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_NETLINK" "AF_INET" "AF_INET6" ];
+        ProtectProc = "noaccess";
+      };
+    };
+
+    # starts the systemd service
+    services.udev.packages = [ pkgs.ipp-usb ];
+    services.avahi = {
+      enable = true;
+      publish = {
+        enable = true;
+        userServices = true;
+      };
+    };
+    # enable printing and scanning by default, but not required.
+    services.printing.enable = lib.mkDefault true;
+    hardware.sane.enable = lib.mkDefault true;
+    # so that sane discovers scanners
+    hardware.sane.extraBackends = [ pkgs.sane-airscan ];
+  };
+}
+
+
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -113,6 +113,7 @@ in {
  calibre-web = handleTest ./calibre-web.nix {};
  cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; };
  cassandra_3_11 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_11; };
+  cassandra_4 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_4; };
  ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {};
  ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
  ceph-single-node-bluestore = handleTestOn ["x86_64-linux"] ./ceph-single-node-bluestore.nix {};
--- a/pkgs/applications/audio/cyanrip/default.nix
+++ b/pkgs/applications/audio/cyanrip/default.nix
@ -4,7 +4,7 @@
 , meson
 , ninja
 , pkg-config
-, ffmpeg
+, ffmpeg-headless
 , libcdio
 , libcdio-paranoia
 , libmusicbrainz5
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ meson ninja pkg-config ];
-  buildInputs = [ ffmpeg libcdio libcdio-paranoia libmusicbrainz5 curl ];
+  buildInputs = [ ffmpeg-headless libcdio libcdio-paranoia libmusicbrainz5 curl ];

  meta = with lib; {
    homepage = "https://github.com/cyanreg/cyanrip";
--- a/pkgs/applications/audio/mmtc/default.nix
+++ b/pkgs/applications/audio/mmtc/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mmtc";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "figsoda";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-fWd349IDlN6XNv7MrqJeLwkmevZoKXLSz8a09YWsNcI=";
+    sha256 = "sha256-7jQwa4BfyI1CPnMt1YEP9rE6cok90FbEJpyLAPFuxtE=";
  };

-  cargoSha256 = "sha256-WrEC3zWwY1plOn8DrspbJFI3R/fE6yDQT2u2lVubbQU=";
+  cargoSha256 = "sha256-f18aXs8PyA0IaGnPG568ZB/oPsAO+U44WsoDNEgKKXk=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/audio/sooperlooper/default.nix
+++ b/pkgs/applications/audio/sooperlooper/default.nix
@ -9,7 +9,7 @@
 , libxml2
 , libjack2
 , libsndfile
-, wxGTK30-gtk3
+, wxGTK30
 , libsigcxx
 , libsamplerate
 , rubberband
@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
    libxml2
    libjack2
    libsndfile
-    wxGTK30-gtk3
+    wxGTK30
    libsigcxx
    libsamplerate
    rubberband
--- a/pkgs/applications/audio/soundux/default.nix
+++ b/pkgs/applications/audio/soundux/default.nix
@ -0,0 +1,142 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, makeBinaryWrapper
+, pipewire
+, libpulseaudio
+, libappindicator
+, libstartup_notification
+, openssl
+, libwnck
+, pcre
+, util-linux
+, libselinux
+, libsepol
+, libthai
+, libdatrie
+, xorg
+, libxkbcommon
+, libepoxy
+, dbus
+, at-spi2-core
+, nlohmann_json
+, fancypp
+, httplib
+, semver-cpp
+, webkitgtk
+, yt-dlp
+, ffmpeg
+, lsb-release
+}:
+
+stdenv.mkDerivation rec {
+  pname = "soundux";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "Soundux";
+    repo = "Soundux";
+    rev = version;
+    sha256 = "sha256-aSCsg6nJt6F+6O7UeXnvYva0vllTfsxK/cjaeOhObZY=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeBinaryWrapper
+  ];
+
+  buildInputs = [
+    pipewire
+    libpulseaudio
+    libappindicator
+    openssl
+    libwnck
+    pcre
+    util-linux
+    libselinux
+    libsepol
+    libthai
+    libdatrie
+    xorg.libXdmcp
+    xorg.libXtst
+    xorg.libXres
+    libxkbcommon
+    libepoxy
+    dbus
+    at-spi2-core
+    nlohmann_json
+    fancypp
+    httplib
+    semver-cpp
+    libstartup_notification
+    webkitgtk
+    yt-dlp
+    ffmpeg
+  ];
+
+  postPatch = ''
+    # cannot be overwritten with variables
+    substituteInPlace CMakeLists.txt \
+      --replace "set(CMAKE_INSTALL_PREFIX \"/opt/soundux\" CACHE PATH \"Install path prefix, prepended onto install directories.\" FORCE)" "" \
+      --replace "/usr/share" "$out/usr/share"
+    substituteInPlace src/ui/impl/webview/webview.cpp \
+      --replace "/usr/share/pixmaps/soundux.png" "$out/share/pixmaps/soundux.png"
+  '';
+
+  # We need to append /opt to our CMAKE_INSTALL_PREFIX
+  dontAddPrefix = true;
+
+  preConfigure = ''
+    # This needs to be set in preConfigure to access the $prefix variable
+    export cmakeFlags="-DCMAKE_INSTALL_PREFIX=$prefix/opt $cmakeFlags"
+
+    # Replace some fetched submodules with symlinks nix packages.
+    rm -rf \
+      lib/json \
+      lib/fancypp \
+      lib/lib-httplib \
+      lib/semver
+
+    ln -s ${nlohmann_json} lib/json
+    ln -s ${fancypp} lib/fancypp
+    ln -s ${httplib} lib/lib-httplib
+    ln -s ${semver-cpp} lib/semver
+  '';
+
+  # Somehow some of the install destination paths in the build system still
+  # gets transformed to point to /var/empty/share, even though they are at least
+  # relative to the nix output directory with our earlier patching.
+  postInstall = ''
+    mv "$out/var/empty/share" "$out"
+    rm -rf "$out/var"
+    mkdir "$out/bin"
+    ln -s "$out/opt/soundux" "$out/bin"
+    substituteInPlace "$out/share/applications/soundux.desktop" \
+      --replace "/opt/soundux/soundux" "soundux"
+  '';
+
+  postFixup = let
+    rpaths = lib.makeLibraryPath [libwnck pipewire libpulseaudio];
+  in ''
+    # Wnck, PipeWire, and PulseAudio are dlopen-ed by Soundux, so they do
+    # not end up on the RPATH during the build process.
+    patchelf --add-rpath "${rpaths}" "$out/opt/soundux-${version}"
+
+    # Work around upstream bug https://github.com/Soundux/Soundux/issues/435
+    wrapProgram "$out/bin/soundux" \
+      --set WEBKIT_DISABLE_COMPOSITING_MODE 1 \
+      --prefix PATH : ${lib.makeBinPath [ yt-dlp ffmpeg lsb-release ]} \
+  '';
+
+  meta = with lib; {
+    description = "A cross-platform soundboard.";
+    homepage = "https://soundux.rocks/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ aidalgol ];
+  };
+}
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK30-gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK30, gtk3, wrapGAppsHook }:

 stdenv.mkDerivation rec {
  pname = "spek";
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];

-  buildInputs = [ ffmpeg wxGTK30-gtk3 wxGTK30-gtk3.gtk ];
+  buildInputs = [ ffmpeg wxGTK30 gtk3 ];

  meta = with lib; {
    description = "Analyse your audio files by showing their spectrogram";
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@ -24,8 +24,7 @@ rustPlatform.buildRustPackage rec {
  cargoHash = "sha256-p4t+G13XaCl7+IbX5YyBFF0PmARbw4XlRvnA0PRcjvQ=";

  # needed for librocksdb-sys
-  nativeBuildInputs = [ llvmPackages.clang ];
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];

  # link rocksdb dynamically
  ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@ -2,11 +2,11 @@

 let
  pname = "ledger-live-desktop";
-  version = "2.49.2";
+  version = "2.50.0";

  src = fetchurl {
    url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-8KGZRTJu3uGFyf4vogoC9kDrKegD8Op4Z7gqQK+UFl8=";
+    hash = "sha256-Xh0UwE2rgFmUI4mx/PHqhRkgw51/CuNPxrsxI9al2E8=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/blockchains/lighthouse/default.nix
+++ b/pkgs/applications/blockchains/lighthouse/default.nix
@ -34,14 +34,12 @@ rustPlatform.buildRustPackage rec {

  buildFeatures = [ "modern" "gnosis" ];

-  nativeBuildInputs = [ clang cmake perl protobuf ];
+  nativeBuildInputs = [ rustPlatform.bindgenHook cmake perl protobuf ];

  buildInputs = lib.optionals stdenv.isDarwin [
    Security
  ];

-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
  depositContractSpec = fetchurl {
    url = "https://raw.githubusercontent.com/ethereum/eth2.0-specs/v${depositContractSpecVersion}/deposit_contract/contracts/validator_registration.json";
    hash = "sha256-ZslAe1wkmkg8Tua/AmmEfBmjqMVcGIiYHwi+WssEwa8=";
--- a/pkgs/applications/blockchains/lndhub-go/default.nix
+++ b/pkgs/applications/blockchains/lndhub-go/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "lndhub-go";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "getAlby";
    repo = "lndhub.go";
    rev = "${version}";
-    sha256 = "sha256-f/CkmO0KHupmi4XZDWRbvesLnYIxT6DlThgX3S/kdJ8=";
+    sha256 = "sha256-UGrIj/0ysU4i6PQVkuIeyGdKNCMa9LxikaIPhSKGvaQ=";
  };

-  vendorSha256 = "sha256-SWQudULFRMrKmxY6ZgH0NL8d6UPxowQnovhRx+209D4=";
+  vendorSha256 = "sha256-AiRbUSgMoU8nTzis/7H9HRW2/xZxXFf39JipRbukeiA=";

  doCheck = false; # tests require networking

--- a/pkgs/applications/blockchains/nearcore/default.nix
+++ b/pkgs/applications/blockchains/nearcore/default.nix
@ -4,7 +4,7 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "nearcore";
-  version = "1.29.2";
+  version = "1.29.3";

  # https://github.com/near/nearcore/tags
  src = fetchFromGitHub {
@ -13,10 +13,10 @@ rustPlatform.buildRustPackage rec {
    # there is also a branch for this version number, so we need to be explicit
    rev = "refs/tags/${version}";

-    sha256 = "sha256-dVju9emwTqNQCYST4HuwSWdafM0yxVS3JXXJqCdFEpc=";
+    sha256 = "sha256-Qbpp+ITWVFbigWLdSDHAo5JhHejEN2FknRIjcpcS2wY=";
  };

-  cargoSha256 = "sha256-k/JzKbWn5M+H6w1UEv2APzZNBZOBYZY09keyCrXaGCM=";
+  cargoSha256 = "sha256-GSgzJNpVGxbvGF6AtFQxGyev/9c8Roav1HBz0SCQyvw=";
  cargoPatches = [ ./0001-make-near-test-contracts-optional.patch ];

  postPatch = ''
@ -42,14 +42,12 @@ rustPlatform.buildRustPackage rec {
  nativeBuildInputs = [
    pkg-config
    protobuf
+    rustPlatform.bindgenHook
  ];

  # fat LTO requires ~3.4GB RAM
  requiredSystemFeatures = [ "big-parallel" ];

-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-  BINDGEN_EXTRA_CLANG_ARGS = "-isystem ${llvmPackages.libclang.lib}/lib/clang/${lib.getVersion llvmPackages.clang}/include";
-
  meta = with lib; {
    description = "Reference client for NEAR Protocol";
    homepage = "https://github.com/near/nearcore";
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@ -36,14 +36,13 @@ rustPlatform.buildRustPackage rec {

  buildInputs = lib.optionals stdenv.isDarwin [ Security ];

-  nativeBuildInputs = [ clang ];
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];

  preBuild = ''
    export SUBSTRATE_CLI_GIT_COMMIT_HASH=$(cat .git_commit)
    rm .git_commit
  '';

-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
  PROTOC = "${protobuf}/bin/protoc";

  # NOTE: We don't build the WASM runtimes since this would require a more
--- a/pkgs/applications/blockchains/snarkos/default.nix
+++ b/pkgs/applications/blockchains/snarkos/default.nix
@ -23,15 +23,13 @@ rustPlatform.buildRustPackage rec {

  # buildAndTestSubdir = "cli";

-  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config llvmPackages.clang ];
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config rustPlatform.bindgenHook ];

  # Needed to get openssl-sys to use pkg-config.
  OPENSSL_NO_VENDOR = 1;
  OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
  OPENSSL_DIR="${lib.getDev openssl}";

-  LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
-
  # TODO check why rust compilation fails by including the rocksdb from nixpkgs
  # Used by build.rs in the rocksdb-sys crate. If we don't set these, it would
  # try to build RocksDB from source.
--- a/pkgs/applications/blockchains/solana-validator/default.nix
+++ b/pkgs/applications/blockchains/solana-validator/default.nix
@ -68,12 +68,9 @@ rustPlatform.buildRustPackage rec {
  cargoBuildFlags = builtins.map (n: "--bin=${n}") solanaPkgs;

  # weird errors. see https://github.com/NixOS/nixpkgs/issues/52447#issuecomment-852079285
-  LIBCLANG_PATH = "${libclang.lib}/lib";
-  BINDGEN_EXTRA_CLANG_ARGS =
-    "-isystem ${libclang.lib}/lib/clang/${lib.getVersion clang}/include";
-  LLVM_CONFIG_PATH = "${llvm}/bin/llvm-config";
+  # LLVM_CONFIG_PATH = "${llvm}/bin/llvm-config";

-  nativeBuildInputs = [ clang llvm pkg-config protobuf rustfmt perl ];
+  nativeBuildInputs = [ pkg-config protobuf rustfmt perl rustPlatform.bindgenHook ];
  buildInputs =
    [ openssl zlib libclang hidapi ] ++ (lib.optionals stdenv.isLinux [ udev ]);
  strictDeps = true;
--- a/pkgs/applications/blockchains/teos/default.nix
+++ b/pkgs/applications/blockchains/teos/default.nix
@ -38,11 +38,8 @@ let
    perl  # used by openssl-sys to configure
    protobuf
    rustfmt
-    llvmPackages.clang
+    rustPlatform.bindgenHook
  ];
-
-
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 in
 {
  teos = rustPlatform.buildRustPackage {
@ -50,7 +47,7 @@ in
    cargoSha256 = "sha256-7VYYYSMJ2JP1KuA8sD0X3wInubH/jbA/sgzsTsomyEc=";
    buildAndTestSubdir = "teos";

-    inherit version src cargoPatches buildInputs nativeBuildInputs LIBCLANG_PATH;
+    inherit version src cargoPatches buildInputs nativeBuildInputs;

    meta = common.meta // {
      description = "A Lightning watchtower compliant with BOLT13, written in Rust";
@ -66,7 +63,7 @@ in
    cargoSha256 = "sha256-xL+DiEfgBYJQ1UJm7LAr1/f34pkU8FRl4Seic8MFAlM=";
    buildAndTestSubdir = "watchtower-plugin";

-    inherit version src cargoPatches buildInputs nativeBuildInputs LIBCLANG_PATH;
+    inherit version src cargoPatches buildInputs nativeBuildInputs;

    meta = common.meta // {
      description = "A Lightning watchtower plugin for clightning";
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix
@ -43,13 +43,9 @@ let

    pname = "tsc-dyn";

-    nativeBuildInputs = [ clang ];
+    nativeBuildInputs = [ rustPlatform.bindgenHook ];
    sourceRoot = "source/core";

-    configurePhase = ''
-      export LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib"
-    '';
-
    postInstall = ''
      LIB=($out/lib/libtsc_dyn.*)
      TSC_PATH=$out/share/emacs/site-lisp/elpa/tsc-${version}
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@ -66,14 +66,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    desktop-file-utils
-    (gi-docgen.overrideAttrs (attrs: {
-      patches = attrs.patches ++ [
-        (fetchpatch {
-          url = "https://gitlab.gnome.org/GNOME/gi-docgen/-/commit/f4ff4787cce962b705fb2588b31f2988c5063c13.patch";
-          sha256 = "11VGFFb2PLVxnX/qUQdLPLfhGQWx4sf4apBP7R2JWjA=";
-        })
-      ];
-    }))
+    gi-docgen
    gobject-introspection
    meson
    ninja
--- a/pkgs/applications/editors/kakoune/plugins/update-shell.nix
+++ b/pkgs/applications/editors/kakoune/plugins/update-shell.nix
@ -2,7 +2,7 @@

 with pkgs;
 let
-  pyEnv = python3.withPackages (ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages (ps: [ ps.gitpython ]);
 in

 mkShell {
--- a/pkgs/applications/editors/vim/plugins/update-shell.nix
+++ b/pkgs/applications/editors/vim/plugins/update-shell.nix
@ -3,7 +3,7 @@
 # Ideally, pkgs points to default.nix file of Nixpkgs official tree
 with pkgs;
 let
-  pyEnv = python3.withPackages (ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages (ps: [ ps.gitpython ]);
 in

 mkShell {
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -891,8 +891,8 @@ let
        mktplcRef = {
          name = "gitlens";
          publisher = "eamodio";
-          version = "2022.11.2204";
-          sha256 = "0npr9fymfjnrq7xvfj6fdc04lysz28qncf9r8syv0w9873f3695h";
+          version = "2022.12.604";
+          sha256 = "sha256-yfqGITviASp5ZDEJA+zyVz1LpPWV4FM/4fU4eq52Xng=";
        };
        meta = with lib; {
          changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@ -2544,8 +2544,8 @@ let
        mktplcRef = {
          name = "code-spell-checker";
          publisher = "streetsidesoftware";
-          version = "2.11.1";
-          sha256 = "sha256-o6Se+xpqwrdJIMnVE/HaDGIoDqZkeX0nTGHa8GjaqVQ=";
+          version = "2.12.0";
+          sha256 = "sha256-Dhd0QVWdCCvdGKuu8OB4KrBS0XUHWLzRSyreAf7sGLU=";
        };
        meta = with lib; {
          changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@ -21,7 +21,7 @@
 , fetchFromGitHub
 , libusb1
 , libevdev
-, wxGTK30-gtk3
+, wxGTK30
 , soundtouch
 , miniupnpc
 , mbedtls
@ -101,7 +101,7 @@ stdenv.mkDerivation rec {
    portaudio
    libusb1
    libpulseaudio
-    wxGTK30-gtk3
+    wxGTK30
    soundtouch
    miniupnpc
    mbedtls
--- a/pkgs/applications/emulators/mame/001-use-absolute-paths.diff
+++ b/pkgs/applications/emulators/mame/001-use-absolute-paths.diff
@ -10,18 +10,18 @@
 -	{ OPTION_CTRLRPATH,                                  "ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
 -	{ OPTION_INIPATH,                                    ".;ini;ini/presets",     core_options::option_type::STRING,     "path to ini files" },
 -	{ OPTION_FONTPATH,                                   ".",         core_options::option_type::STRING,     "path to font files" },
-+	{ OPTION_HASHPATH ";hash_directory;hash",            "hash;@mame@/hash",      core_options::option_type::STRING,     "path to software definition files" },
-+	{ OPTION_SAMPLEPATH ";sp",                           "samples;@mame@/samples",   core_options::option_type::STRING,     "path to audio sample sets" },
-+	{ OPTION_ARTPATH,                                    "artwork;@mame@/artwork",   core_options::option_type::STRING,     "path to artwork files" },
-+	{ OPTION_CTRLRPATH,                                  "ctrlr;@mame@/ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
-+	{ OPTION_INIPATH,                                    ".;ini;ini/presets;@mame@/ini/presets",     core_options::option_type::STRING,     "path to ini files" },
-+	{ OPTION_FONTPATH,                                   ".;@mame@",         core_options::option_type::STRING,     "path to font files" },
+	{ OPTION_HASHPATH ";hash_directory;hash",            "hash;@mamePath@/hash",      core_options::option_type::STRING,     "path to software definition files" },
+	{ OPTION_SAMPLEPATH ";sp",                           "samples;@mamePath@/samples",   core_options::option_type::STRING,     "path to audio sample sets" },
+	{ OPTION_ARTPATH,                                    "artwork;@mamePath@/artwork",   core_options::option_type::STRING,     "path to artwork files" },
+	{ OPTION_CTRLRPATH,                                  "ctrlr;@mamePath@/ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
+	{ OPTION_INIPATH,                                    ".;ini;ini/presets;@mamePath@/ini/presets",     core_options::option_type::STRING,     "path to ini files" },
+	{ OPTION_FONTPATH,                                   ".;@mamePath@",         core_options::option_type::STRING,     "path to font files" },
 	{ OPTION_CHEATPATH,                                  "cheat",     core_options::option_type::STRING,     "path to cheat files" },
 	{ OPTION_CROSSHAIRPATH,                              "crosshair", core_options::option_type::STRING,     "path to crosshair files" },
 -	{ OPTION_PLUGINSPATH,                                "plugins",   core_options::option_type::STRING,     "path to plugin files" },
 -	{ OPTION_LANGUAGEPATH,                               "language",  core_options::option_type::STRING,     "path to UI translation files" },
-+	{ OPTION_PLUGINSPATH,                                "plugins;@mame@/plugins",   core_options::option_type::STRING,     "path to plugin files" },
-+	{ OPTION_LANGUAGEPATH,                               "language;@mame@/language",  core_options::option_type::STRING,     "path to UI translation files" },
+	{ OPTION_PLUGINSPATH,                                "plugins;@mamePath@/plugins",   core_options::option_type::STRING,     "path to plugin files" },
+	{ OPTION_LANGUAGEPATH,                               "language;@mamePath@/language",  core_options::option_type::STRING,     "path to UI translation files" },
 	{ OPTION_SWPATH,                                     "software",  core_options::option_type::STRING,     "path to loose software" },
 
 	// output directory options
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@ -1,24 +1,24 @@
 { lib
 , stdenv
-, alsa-lib
-, copyDesktopItems
-, CoreAudioKit
-, expat
 , fetchFromGitHub
-, fetchurl
+, alsa-lib
+, SDL2
+, SDL2_ttf
+, copyDesktopItems
+, expat
 , flac
 , fontconfig
-, ForceFeedback
 , glm
 , installShellFiles
+, libXi
+, libXinerama
 , libjpeg
 , libpcap
 , libpulseaudio
-, libXi
-, libXinerama
 , lua5_3
 , makeDesktopItem
 , makeWrapper
+, papirus-icon-theme
 , pkg-config
 , portaudio
 , portmidi
@ -26,31 +26,26 @@
 , python3
 , qtbase
 , rapidjson
-, SDL2
-, SDL2_ttf
 , sqlite
 , utf8proc
 , which
 , writeScript
 , zlib
+, darwin
 }:

 let
-  # Get icon from Arch Linux package
-  icon = fetchurl {
-    url = "https://raw.githubusercontent.com/archlinux/svntogit-community/614b24ef3856cb52b5cafc386b0f77923cbc9156/trunk/mame.svg";
-    sha256 = "sha256-F8RCyTPXZBdeTOHeUKgMDC3dXXM8rwnDzV5rppesQ/Q=";
-  };
-  dest = "$out/opt/mame";
+  inherit (darwin.apple_sdk.frameworks) CoreAudioKit ForceFeedback;
 in
 stdenv.mkDerivation rec {
  pname = "mame";
  version = "0.250";
+  srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;

  src = fetchFromGitHub {
    owner = "mamedev";
    repo = "mame";
-    rev = "mame${builtins.replaceStrings [ "." ] [ "" ] version}";
+    rev = "mame${srcVersion}";
    sha256 = "sha256-jexs/1ovRk9Is5orD7hT9fN+dYm+WA+57aZ6JH7zjL4=";
  };

@ -109,15 +104,17 @@ stdenv.mkDerivation rec {
  ];

  patches = [
-    # by default MAME assumes that paths with stock resources
-    # are relative and that you run MAME changing to
-    # install directory, so we add absolute paths here
-    ./emuopts.patch
+    # by default MAME assumes that paths with stock resources are relative and
+    # that you run MAME changing to install directory, so we add absolute paths
+    # here
+    ./001-use-absolute-paths.diff
  ];

+  # Since the bug described in https://github.com/NixOS/nixpkgs/issues/135438,
+  # it is not possible to use substituteAll
  postPatch = ''
    substituteInPlace src/emu/emuopts.cpp \
-      --subst-var-by mame ${dest}
+      --subst-var-by mamePath "$out/opt/mame"
  '';

  desktopItems = [
@ -134,23 +131,26 @@ stdenv.mkDerivation rec {
    })
  ];

-  installPhase = ''
+  # TODO: copy shaders from src/osd/modules/opengl/shader/glsl*.*h
+  # to the final package after we figure out how they work
+  installPhase = let
+    icon = "${papirus-icon-theme}/share/icons/Papirus/32x32/apps/mame.svg";
+  in ''
    runHook preInstall

    # mame
-    mkdir -p ${dest}
+    mkdir -p $out/opt/mame

    install -Dm755 mame -t $out/bin
    install -Dm644 ${icon} $out/share/icons/hicolor/scalable/apps/mame.svg
    installManPage docs/man/*.1 docs/man/*.6
-    cp -ar {artwork,bgfx,plugins,language,ctrlr,keymaps,hash} ${dest}
-    # TODO: copy shaders from src/osd/modules/opengl/shader/glsl*.*h
-    # to the final package after we figure out how they work
+    cp -ar {artwork,bgfx,plugins,language,ctrlr,keymaps,hash} $out/opt/mame

    # mame-tools
-    for _i in castool chdman floptool imgtool jedutil ldresample ldverify nltool nlwav pngcmp regrep romcmp \
-              split srcclean testkeys unidasm; do
-      install -Dm755 $_i -t $tools/bin
+    for _tool in castool chdman floptool imgtool jedutil ldresample ldverify \
+                 nltool nlwav pngcmp regrep romcmp split srcclean testkeys \
+                 unidasm; do
+       install -Dm755 $_tool -t $tools/bin
    done
    mv $tools/bin/{,mame-}split

@ -176,11 +176,26 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    broken = stdenv.isDarwin;
-    description = "Is a multi-purpose emulation framework";
    homepage = "https://www.mamedev.org/";
+    description = "A multi-purpose emulation framework";
+    longDescription = ''
+      MAME's purpose is to preserve decades of software history. As electronic
+      technology continues to rush forward, MAME prevents this important
+      "vintage" software from being lost and forgotten. This is achieved by
+      documenting the hardware and how it functions. The source code to MAME
+      serves as this documentation. The fact that the software is usable serves
+      primarily to validate the accuracy of the documentation (how else can you
+      prove that you have recreated the hardware faithfully?). Over time, MAME
+      (originally stood for Multiple Arcade Machine Emulator) absorbed the
+      sister-project MESS (Multi Emulator Super System), so MAME now documents a
+      wide variety of (mostly vintage) computers, video game consoles and
+      calculators, in addition to the arcade video games that were its initial
+      focus.
+    '';
+    changelog = "https://github.com/mamedev/mame/releases/download/mame${srcVersion}/whatsnew_${srcVersion}.txt";
    license = with licenses; [ bsd3 gpl2Plus ];
-    platforms = platforms.unix;
    maintainers = with maintainers; [ thiagokokada ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -46,13 +46,13 @@ in

 stdenv.mkDerivation rec {
  pname = "imagemagick";
-  version = "7.1.0-52";
+  version = "7.1.0-53";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    rev = version;
-    hash = "sha256-GV71O4cHUKJ7+6u4T+vdaFz5q2SpZVDCfEAbfz0s6f4=";
+    hash = "sha256-U111mor498zAyoYKqCerb9cnxUUOlXKYPfaIzKxZiUM=";
  };

  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
--- a/pkgs/applications/graphics/freecad/default.nix
+++ b/pkgs/applications/graphics/freecad/default.nix
@ -4,7 +4,7 @@
 , fetchFromGitHub
 , cmake
 , ninja
-, GitPython
+, gitpython
 , boost
 , coin3d
 , eigen
@ -68,7 +68,7 @@ mkDerivation rec {
  ];

  buildInputs = [
-    GitPython # for addon manager
+    gitpython # for addon manager
    boost
    coin3d
    eigen
--- a/pkgs/applications/misc/authenticator/default.nix
+++ b/pkgs/applications/misc/authenticator/default.nix
@ -42,7 +42,6 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    appstream-glib
-    clang
    desktop-file-utils
    meson
    ninja
@ -52,6 +51,7 @@ stdenv.mkDerivation rec {
    cargoSetupHook
    rust.cargo
    rust.rustc
+    bindgenHook
  ]);

  buildInputs = [
@ -69,8 +69,6 @@ stdenv.mkDerivation rec {
    zbar
  ];

-  LIBCLANG_PATH = "${lib.getLib libclang}/lib";
-
  meta = {
    description = "Two-factor authentication code generator for GNOME";
    homepage = "https://gitlab.gnome.org/World/Authenticator";
--- a/pkgs/applications/misc/clipcat/default.nix
+++ b/pkgs/applications/misc/clipcat/default.nix
@ -14,8 +14,6 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "1n4il3l59m2a6ca54vfaivzg25abf8s4w5kpd5q51p13624iz0kb";

-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
  # needed for internal protobuf c wrapper library
  PROTOC = "${protobuf}/bin/protoc";
  PROTOC_INCLUDE = "${protobuf}/include";
@ -23,8 +21,7 @@ rustPlatform.buildRustPackage rec {
  nativeBuildInputs = [
    pkg-config

-    clang
-    llvmPackages.libclang
+    rustPlatform.bindgenHook

    rustfmt
    protobuf
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.107.0";
+  version = "0.108.0";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-8Ru1T6GSz5TfMxFvUU2QgpiWNLJK+ky723qc3flrDIw=";
+    sha256 = "sha256-MbpBGqu7IwQCf9DjSfIDi25ZGJYTI6xxSk9wPWxychw=";
  };

-  vendorSha256 = "sha256-92QLkSUrwMEZ/8pIeOj4KKtC47oN+ITxJnpp7Fb0Z10=";
+  vendorSha256 = "sha256-qFqSpQExz4u1ngjpt2Li6dk/qz4DCKEY9IcFFCna5is=";

  doCheck = false;

--- a/pkgs/applications/misc/imag/default.nix
+++ b/pkgs/applications/misc/imag/default.nix
@ -21,13 +21,11 @@ rustPlatform.buildRustPackage rec {
    sha256 = "0f9915f083z5qqcxyavj0w6m973c8m1x7kfb89pah5agryy5mkaq";
  };

-  nativeBuildInputs = [ installShellFiles pkg-config ];
+  nativeBuildInputs = [ installShellFiles pkg-config rustPlatform.bindgenHook ];
  buildInputs = [ openssl ]
    ++ lib.optional stdenv.isDarwin Security;
  checkInputs = [ gitMinimal util-linuxMinimal ];

-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
  cargoSha256 = "1vnrc72g2271i2p847z30kplxmdpi60n3dzpw0s7dahg33g14ai6";

  checkPhase = ''
--- a/pkgs/applications/misc/lenmus/default.nix
+++ b/pkgs/applications/misc/lenmus/default.nix
@ -11,7 +11,7 @@
 , libpng
 , pngpp
 , zlib
-, wxGTK30-gtk3
+, wxGTK30
 , wxsqlite3
 }:

@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
    libpng
    pngpp
    zlib
-    wxGTK30-gtk3
+    wxGTK30
    wxsqlite3
  ];

--- a/pkgs/applications/misc/lutris/fhsenv.nix
+++ b/pkgs/applications/misc/lutris/fhsenv.nix
@ -30,7 +30,7 @@ in buildFHSUserEnv {
    # DGen // TODO: libarchive is broken

    # Dolphin
-    bluez ffmpeg gettext portaudio wxGTK30-gtk3 miniupnpc mbedtls lzo sfml gsm
+    bluez ffmpeg gettext portaudio wxGTK30 miniupnpc mbedtls lzo sfml gsm
    wavpack orc nettle gmp pcre vulkan-loader

    # DOSBox
--- a/pkgs/applications/misc/mediainfo-gui/default.nix
+++ b/pkgs/applications/misc/mediainfo-gui/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libmediainfo, wxGTK30-gtk3
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libmediainfo, wxGTK30
 , desktop-file-utils, libSM, imagemagick }:

 stdenv.mkDerivation rec {
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libmediainfo wxGTK30-gtk3 desktop-file-utils libSM imagemagick ];
+  buildInputs = [ libmediainfo wxGTK30 desktop-file-utils libSM imagemagick ];

  sourceRoot = "./MediaInfo/Project/GNU/GUI/";

--- a/pkgs/applications/misc/pwsafe/default.nix
+++ b/pkgs/applications/misc/pwsafe/default.nix
@ -6,7 +6,7 @@
 , zip
 , gettext
 , perl
-, wxGTK30-gtk3
+, wxGTK30
 , libXext
 , libXi
 , libXt
@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
    libXi
    libXt
    libXtst
-    wxGTK30-gtk3
+    wxGTK30
    curl
    qrencode
    libuuid
--- a/pkgs/applications/networking/cluster/terraform-compliance/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-compliance/default.nix
@ -1,5 +1,5 @@
 { lib
-, GitPython
+, gitpython
 , buildPythonApplication
 , emoji
 , fetchFromGitHub
@ -18,7 +18,6 @@ buildPythonApplication rec {
  pname = "terraform-compliance";
  version = "1.2.11";

-  # No tests in Pypi package
  src = fetchFromGitHub {
    owner = "eerkunt";
    repo = pname;
@ -31,7 +30,9 @@ buildPythonApplication rec {
      --replace "IPython==7.16.1" "IPython"
  '';

-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [
+    pytestCheckHook
+  ];

  disabledTests = [
    "test_which_success"
@ -39,7 +40,7 @@ buildPythonApplication rec {
  ];

  propagatedBuildInputs = [
-    GitPython
+    gitpython
    emoji
    filetype
    ipython
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -176,11 +176,11 @@
    "vendorHash": "sha256-Qkla3OEcyiMn6eqBj+4LB8JwpIwceLAASI1qvOcUBD0="
  },
  "brightbox": {
-    "hash": "sha256-l4gN7gxLMTuUMjf50Hc2Els5pJ4BId1QlRAhykseK7c=",
+    "hash": "sha256-F/AQq45ADM0+PbFpMPtpMvbYw8F41GDBzk7LoY/L/Qg=",
    "homepage": "https://registry.terraform.io/providers/brightbox/brightbox",
    "owner": "brightbox",
    "repo": "terraform-provider-brightbox",
-    "rev": "v3.0.5",
+    "rev": "v3.0.6",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-ZT+SOHn/8aoZLXUau9toc3NtQNaXfttM0agIw8T28tk="
  },
@ -442,24 +442,24 @@
    "vendorHash": "sha256-QAFx/Ew86T4LWJ6ZtJTUWwR5rGunWj0E5Vzt++BN9ks="
  },
  "google": {
-    "hash": "sha256-e2jVnL13j4iSb288CB/H6G3vR58bjwi+2ZHzve1tuUo=",
+    "hash": "sha256-VqQK6NifhilmnJL5L4EHmmeFWZPBmQhoUl3mz8igSck=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.44.1",
+    "rev": "v4.45.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-X5wjho+hotqi9aZ5ABv3RY0xJj1HFH7IN/HLPKIxi2c="
+    "vendorHash": "sha256-nwA+OD0gtnV5di43wgH1OZp/RngLvnVRAuKQxsxnlLw="
  },
  "google-beta": {
-    "hash": "sha256-ejMWZTSrkGMAKr02TIg0yngzpqEVL8y56JSoQrCJ7lA=",
+    "hash": "sha256-/fdgwdIIFHLEMeqsWashkQJlIoFU86ZmsbA4pX18FhE=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.44.1",
+    "rev": "v4.45.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-X5wjho+hotqi9aZ5ABv3RY0xJj1HFH7IN/HLPKIxi2c="
+    "vendorHash": "sha256-nwA+OD0gtnV5di43wgH1OZp/RngLvnVRAuKQxsxnlLw="
  },
  "googleworkspace": {
    "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@ -507,11 +507,11 @@
    "vendorHash": null
  },
  "heroku": {
-    "hash": "sha256-NabwjOTbBRlDNFBpCshxZMO9E958tfAIPPuyArvacFI=",
+    "hash": "sha256-TdL0m83sIS8BuNE6j6mSsEnXq7KuaYJEhuDHkXyNAMc=",
    "homepage": "https://registry.terraform.io/providers/heroku/heroku",
    "owner": "heroku",
    "repo": "terraform-provider-heroku",
-    "rev": "v5.1.6",
+    "rev": "v5.1.7",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -598,13 +598,13 @@
    "vendorHash": null
  },
  "kafka": {
-    "hash": "sha256-bKbY2cOIORy3D9yCBqVuKUZb650sx+87d4wtUB3dPdg=",
+    "hash": "sha256-p8KT6K9fcd0OFy+NoZyZzQxG13fIiyMJg2yNPKIWH60=",
    "homepage": "https://registry.terraform.io/providers/Mongey/kafka",
    "owner": "Mongey",
    "repo": "terraform-provider-kafka",
-    "rev": "v0.5.1",
+    "rev": "v0.5.2",
    "spdx": "MIT",
-    "vendorHash": "sha256-03QV6C2DEN5xwMwABwSvv5Ts6pTHQDBP2zUUqIcOtVQ="
+    "vendorHash": "sha256-RzC8j+Toub7kiOKW6IppjwyJ0vGEJ0YHb8YXrWFkZW4="
  },
  "kafka-connect": {
    "hash": "sha256-PiSVfzNPEXAgONb/eaVAN4yPudn5glcHL0BLqE5PWsw=",
@ -643,11 +643,11 @@
    "vendorHash": "sha256-lXQHo66b9X0jZhoF+5Ix5qewQGyI82VPJ7gGzc2CHao="
  },
  "kubernetes": {
-    "hash": "sha256-hWFC8VBbM3BRGrX1Y45Znd/W3klYy/7aS7JbbKN7EUg=",
+    "hash": "sha256-aKGcKmnlYxNS7SrFW2SouRQUXYy339qHrDtQMXGD4DE=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/kubernetes",
    "owner": "hashicorp",
    "repo": "terraform-provider-kubernetes",
-    "rev": "v2.16.0",
+    "rev": "v2.16.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@ -12,7 +12,8 @@
 , sqlite
 , tinyxml
 , wrapGAppsHook
-, wxGTK30-gtk3
+, wxGTK30
+, gtk3
 , xdg-utils
 }:

@ -42,8 +43,8 @@ stdenv.mkDerivation rec {
    pugixml
    sqlite
    tinyxml
-    wxGTK30-gtk3
-    wxGTK30-gtk3.gtk
+    wxGTK30
+    gtk3
    xdg-utils
  ];

--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -9,7 +9,7 @@

 stdenv.mkDerivation rec {
  pname = "signal-desktop";
-  version = "6.0.0"; # Please backport all updates to the stable channel.
+  version = "6.0.1"; # Please backport all updates to the stable channel.
  # All releases have a limited lifetime and "expire" 90 days after the release.
  # When releases "expire" the application becomes unusable until an update is
  # applied. The expiration date for the current release can be extracted with:
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-aJLsRxxpLWKl0Y/91uR56nIUUOALd572LtXpqXGTXSg=";
+    sha256 = "sha256-7Cojhz3wBPd/13uVg2MgJXvR9QMPZcwBibk/sCrRMAE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@ -20,12 +20,12 @@

 stdenv.mkDerivation rec {
  pname = "rsync";
-  version = "3.2.6";
+  version = "3.2.7";

  src = fetchurl {
    # signed with key 0048 C8B0 26D4 C96F 0E58  9C2F 6C85 9FB1 4B96 A8C5
    url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
-    sha256 = "sha256-+zNlurJ4N9Qf6vQulnxXvTpHvI8Qdlo2ce/Wo4NUVNM=";
+    sha256 = "sha256-Tn2dP27RCHjFjF+3JKZ9rPS2qsc0CxPkiPstxBNG8rs=";
  };

  nativeBuildInputs = [ perl ];
--- a/pkgs/applications/networking/twingate/default.nix
+++ b/pkgs/applications/networking/twingate/default.nix
@ -0,0 +1,51 @@
+{ autoPatchelfHook
+, curl
+, dpkg
+, dbus
+, fetchurl
+, lib
+, libnl
+, udev
+, cryptsetup
+, stdenv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "twingate";
+  version = "1.0.60";
+
+  src = fetchurl {
+    url = "https://binaries.twingate.com/client/linux/DEB/${version}/twingate-amd64.deb";
+    sha256 = "b308c422af8a33ecd58e21a10a72c353351a189df67006e38d1ec029a93d5678";
+  };
+
+  buildInputs = [ dbus curl libnl udev cryptsetup ];
+  nativeBuildInputs = [ dpkg autoPatchelfHook ];
+
+  unpackCmd = "mkdir root ; dpkg-deb -x $curSrc root";
+
+  postPatch = ''
+    while read file; do
+      substituteInPlace "$file" \
+        --replace "/usr/bin" "$out/bin" \
+        --replace "/usr/sbin" "$out/bin"
+    done < <(find etc usr/lib usr/share -type f)
+  '';
+
+  installPhase = ''
+    mkdir $out
+    mv etc $out/
+    mv usr/bin $out/bin
+    mv usr/sbin/* $out/bin
+    mv usr/lib $out/lib
+    mv usr/share $out/share
+  '';
+
+  meta = with lib; {
+    description = "Twingate Client";
+    homepage = "https://twingate.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ tonyshkurenko ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/networking/yaup/default.nix
+++ b/pkgs/applications/networking/yaup/default.nix
@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, intltool
+, pkg-config
+, wrapGAppsHook
+, gtk3
+, miniupnpc
+}:
+
+stdenv.mkDerivation rec {
+  pname = "yaup";
+  version = "unstable-2019-10-16";
+
+  src = fetchFromGitHub {
+    owner = "Holarse-Linuxgaming";
+    repo = "yaup";
+    rev = "7ee3fdbd8c1ecf0a0e6469c47560e26082808250";
+    hash = "sha256-RWnNjpgXRYncz9ID8zirENffy1UsfHD1H6Mmd8DKN4k=";
+  };
+
+  nativeBuildInputs = [
+    intltool
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    miniupnpc
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/Holarse-Linuxgaming/yaup";
+    description = "Yet Another UPnP Portmapper";
+    longDescription = ''
+      Portmapping made easy.
+      Portforward your incoming traffic to a specified local ip.
+      Mostly used for IPv4.
+    '';
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+    # ld: unknown option: --export-dynamic
+    broken = stdenv.isDarwin;
+  };
+}
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "PortfolioPerformance";
-  version = "0.59.4";
+  version = "0.59.5";

  src = fetchurl {
    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "sha256-Yjp69p1UCLkGgTm8jn/sJfh2dYSKVbHdi1OLIYeB18w=";
+    sha256 = "sha256-6AEc9wc3/8AubPvqq8s9R1RnO+P8+92UsNEt6AdQv+w=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/astronomy/phd2/default.nix
+++ b/pkgs/applications/science/astronomy/phd2/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, gtk3, wxGTK30-gtk3
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, gtk3, wxGTK30
 , curl, gettext, glib, indi-full, libnova, wrapGAppsHook }:

 stdenv.mkDerivation rec {
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    gtk3
-    wxGTK30-gtk3
+    wxGTK30
    curl
    gettext
    glib
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@ -6,7 +6,6 @@
 , java
 , scala_3
 , polyml
-, z3
 , veriT
 , vampire
 , eprover-ho
@ -15,7 +14,6 @@
 , perl
 , makeDesktopItem
 , isabelle-components
-, isabelle
 , symlinkJoin
 , fetchhg
 }:
@ -46,7 +44,7 @@ let
      cp libsha1.so $out/lib/
    '';
  };
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation (finalAttrs: rec {
  pname = "isabelle";
  version = "2022";

@ -68,25 +66,22 @@ in stdenv.mkDerivation rec {

  nativeBuildInputs = [ java ];

-  buildInputs = [ polyml z3 veriT vampire eprover-ho nettools ]
+  buildInputs = [ polyml veriT vampire eprover-ho nettools ]
    ++ lib.optionals (!stdenv.isDarwin) [ java ];

-  sourceRoot = dirname;
+  sourceRoot = "${dirname}${lib.optionalString stdenv.isDarwin ".app"}";
+
+  doCheck = true;
+  checkPhase = "bin/isabelle build -v HOL-SMT_Examples";

  postUnpack = lib.optionalString stdenv.isDarwin ''
-    mv $sourceRoot.app $sourceRoot
+    mv $sourceRoot ${dirname}
+    sourceRoot=${dirname}
  '';

  postPatch = ''
    patchShebangs lib/Tools/ bin/

-    cat >contrib/z3*/etc/settings <<EOF
-      Z3_HOME=${z3}
-      Z3_VERSION=${z3.version}
-      Z3_SOLVER=${z3}/bin/z3
-      Z3_INSTALLED=yes
-    EOF
-
    cat >contrib/verit-*/etc/settings <<EOF
      ISABELLE_VERIT=${veriT}/bin/veriT
    EOF
@ -122,7 +117,7 @@ in stdenv.mkDerivation rec {

    echo ISABELLE_LINE_EDITOR=${rlwrap}/bin/rlwrap >>etc/settings

-    for comp in contrib/jdk* contrib/polyml-* contrib/z3-* contrib/verit-* contrib/vampire-* contrib/e-*; do
+    for comp in contrib/jdk* contrib/polyml-* contrib/verit-* contrib/vampire-* contrib/e-*; do
      rm -rf $comp/x86*
    done

@ -143,15 +138,14 @@ in stdenv.mkDerivation rec {
      --replace 'ISABELLE_APPLE_PLATFORM64=arm64-darwin' ""
  '' + lib.optionalString stdenv.isLinux ''
    arch=${if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux" else "x86-linux"}
-    for f in contrib/*/$arch/{bash_process,epclextract,nunchaku,SPASS,zipperposition}; do
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f"
-    done
-    for f in contrib/*/platform_$arch/{bash_process,epclextract,nunchaku,SPASS,zipperposition}; do
+    for f in contrib/*/$arch/{z3,epclextract,nunchaku,SPASS,zipperposition}; do
      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f"
    done
+    patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) contrib/bash_process-*/platform_$arch/bash_process
    for d in contrib/kodkodi-*/jni/$arch; do
      patchelf --set-rpath "${lib.concatStringsSep ":" [ "${java}/lib/openjdk/lib/server" "${stdenv.cc.cc.lib}/lib" ]}" $d/*.so
    done
+    patchelf --set-rpath "${stdenv.cc.cc.lib}/lib" contrib/z3-*/$arch/z3
  '';

  buildPhase = ''
@ -219,14 +213,15 @@ in stdenv.mkDerivation rec {
    maintainers = [ maintainers.jwiegley maintainers.jvanbruegge ];
    platforms = platforms.unix;
  };
-} // {
-  withComponents = f:
+
+  passthru.withComponents = f:
    let
+      isabelle = finalAttrs.finalPackage;
      base = "$out/${isabelle.dirname}";
      components = f isabelle-components;
    in symlinkJoin {
      name = "isabelle-with-components-${isabelle.version}";
-      paths = [ isabelle ] ++ components;
+      paths = [ isabelle ] ++ (builtins.map (c: c.override { inherit isabelle; }) components);

      postBuild = ''
        rm $out/bin/*
@ -244,4 +239,4 @@ in stdenv.mkDerivation rec {
        echo contrib/${c.pname}-${c.version} >> ${base}/etc/components
      '') components;
    };
-}
+})
--- a/pkgs/applications/science/machine-learning/streamlit/default.nix
+++ b/pkgs/applications/science/machine-learning/streamlit/default.nix
@ -1,21 +1,18 @@
-{
-  # Nix
-  lib
-, buildPythonApplication
-, fetchPypi
-, # Build inputs
-  altair
+{ lib
+, altair
 , blinker
-, click
+, buildPythonApplication
 , cachetools
-, GitPython
+, click
+, fetchPypi
+, gitpython
 , importlib-metadata
 , jinja2
 , pillow
+, protobuf3
 , pyarrow
 , pydeck
 , pympler
-, protobuf3
 , requests
 , rich
 , semver
@ -25,7 +22,6 @@
 , tzlocal
 , validators
 , watchdog
-,
 }:

 buildPythonApplication rec {
@ -43,7 +39,7 @@ buildPythonApplication rec {
    blinker
    cachetools
    click
-    GitPython
+    gitpython
    importlib-metadata
    jinja2
    pillow
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication rec {
    datrie
    docutils
    filelock
-    GitPython
+    gitpython
    jinja2
    jsonschema
    nbformat
--- a/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
@ -1,29 +1,38 @@
 { lib
-, buildPythonApplication
-, fetchPypi
 , annexremote
+, buildPythonApplication
 , drivelib
-, GitPython
-, tenacity
+, fetchPypi
+, gitpython
 , humanfriendly
+, tenacity
 }:

 buildPythonApplication rec {
  pname = "git-annex-remote-googledrive";
  version = "1.3.2";
+  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
    sha256 = "0rwjcdvfgzdlfgrn1rrqwwwiqqzyh114qddrbfwd46ld5spry6r1";
  };

-  propagatedBuildInputs = [ annexremote drivelib GitPython tenacity humanfriendly ];
+  propagatedBuildInputs = [
+    annexremote
+    drivelib
+    gitpython
+    tenacity
+    humanfriendly
+  ];

  # while git-annex does come with a testremote command that *could* be used,
  # testing this special remote obviously depends on authenticating with google
  doCheck = false;

-  pythonImportsCheck = [ "git_annex_remote_googledrive" ];
+  pythonImportsCheck = [
+    "git_annex_remote_googledrive"
+  ];

  meta = with lib; {
    description = "A git-annex special remote for Google Drive";
--- a/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
@ -9,8 +9,6 @@ python3.pkgs.buildPythonApplication rec {
  version = "2.1.0";
  format = "setuptools";

-  disabled = python3.pythonOlder "3.6";
-
  src = fetchFromGitHub {
    owner = "EMPRI-DEVOPS";
    repo = pname;
@ -21,7 +19,7 @@ python3.pkgs.buildPythonApplication rec {
  propagatedBuildInputs = with python3.pkgs; [
    click
    git-filter-repo
-    GitPython
+    gitpython
    pynacl
    setuptools
  ];
--- a/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
@ -1,5 +1,9 @@
-{ lib, buildPythonApplication, fetchPypi
-, colorama, GitPython }:
+{ lib
+, buildPythonApplication
+, colorama
+, fetchPypi
+, gitpython
+}:

 buildPythonApplication rec {
  pname = "gitup";
@ -10,7 +14,10 @@ buildPythonApplication rec {
    sha256 = "1pa612rcc94nc461zs9sag9p46sycc214622b06gdn35rmwp0y2g";
  };

-  propagatedBuildInputs = [ colorama GitPython ];
+  propagatedBuildInputs = [
+    colorama
+    gitpython
+  ];

  # no tests
  doCheck = false;
@ -19,7 +26,6 @@ buildPythonApplication rec {
    description = "Easily update multiple Git repositories at once";
    homepage = "https://github.com/earwig/git-repo-updater";
    license = licenses.mit;
-    maintainers = [ maintainers.bdesham ];
-    platforms = platforms.all;
+    maintainers = with maintainers; [bdesham ];
  };
 }
--- a/pkgs/applications/version-management/git-and-tools/git-up/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-up/default.nix
@ -1,4 +1,7 @@
-{ lib, pythonPackages, git }:
+{ lib
+, pythonPackages
+, git
+}:

 pythonPackages.buildPythonApplication rec {
  pname = "git-up";
@ -10,7 +13,16 @@ pythonPackages.buildPythonApplication rec {
  };

  # git should be on path for tool to work correctly
-  propagatedBuildInputs = [ git ] ++ (with pythonPackages; [ click colorama docopt GitPython six termcolor ]);
+  propagatedBuildInputs = [
+    git
+  ] ++ (with pythonPackages; [
+    click
+    colorama
+    docopt
+    gitpython
+    six
+    termcolor
+  ]);

  checkInputs = [ git pythonPackages.nose ]; # git needs to be on path
  # 1. git fails to run as it cannot detect the email address, so we set it
--- a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "lefthook";
-  version = "1.2.3";
+  version = "1.2.4";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "evilmartians";
    repo = "lefthook";
-    sha256 = "sha256-tns/JUOYlgG+oiFACnXlCwHBF4enctV4GPlpEZCM/nM=";
+    sha256 = "sha256-Z6j/Y8b9lq2nYS5Ki8iJoDsG3l5M6RylfDqQL7WrwNg=";
  };

  vendorSha256 = "sha256-sBcgt2YsV9RQhSjPN6N54tRk7nNvcOVhPEsEP+0Dtco=";
--- a/pkgs/applications/version-management/git-and-tools/legit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/legit/default.nix
@ -1,8 +1,11 @@
-{ lib, python3Packages }:
+{ lib
+, python3Packages
+}:

 python3Packages.buildPythonApplication rec {
  pname = "legit";
  version = "1.2.0";
+
  src = python3Packages.fetchPypi {
    inherit pname version;
    sha256 = "0ngh3ar6v15516f52j21k6qz7hykmxfjadhb2rakvl27b5xvjy1c";
@ -12,7 +15,7 @@ python3Packages.buildPythonApplication rec {
    click
    clint
    crayons
-    GitPython
+    gitpython
    six
  ];

--- a/pkgs/applications/version-management/jujutsu/default.nix
+++ b/pkgs/applications/version-management/jujutsu/default.nix
@ -15,16 +15,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "jujutsu";
-  version = "0.5.1";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "martinvonz";
    repo = "jj";
    rev = "v${version}";
-    sha256 = "sha256-ITYpdCUh+WzP2RrAkSep3DsQ7dztvOMuwESKimn8JBQ=";
+    sha256 = "sha256-xS4uktydrvkeTsR9QGT9gYdhFh92XdpoG0TrDt7IPdc=";
  };

-  cargoSha256 = "sha256-eH8/R4dwQ08Q7Dyw8CnE+DGjneAmtTdsRben2cxpG8Q=";
+  cargoSha256 = "sha256-VM+Oq0nf4pMK3nbPbHbl7E2qgUnGlu7kf2p47d8cm1c=";

  # Needed to get openssl-sys to use pkg-config.
  OPENSSL_NO_VENDOR = 1;
--- a/pkgs/applications/version-management/rapidsvn/default.nix
+++ b/pkgs/applications/version-management/rapidsvn/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, wxGTK30-gtk3, subversion, apr, aprutil, python3, fetchpatch }:
+{ lib, stdenv, fetchurl, wxGTK30, subversion, apr, aprutil, python3, fetchpatch }:

 stdenv.mkDerivation rec {
  pname = "rapidsvn";
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    sha256 = "1bmcqjc12k5w0z40k7fkk8iysqv4fw33i80gvcmbakby3d4d4i4p";
  };

-  buildInputs = [ wxGTK30-gtk3 subversion apr aprutil python3 ];
+  buildInputs = [ wxGTK30 subversion apr aprutil python3 ];

  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];

--- a/pkgs/applications/video/dvdstyler/default.nix
+++ b/pkgs/applications/video/dvdstyler/default.nix
@ -17,7 +17,7 @@
 , libjpeg
 , pkg-config
 , wrapGAppsHook
-, wxGTK30-gtk3 # crash with wxGTK30 with GTK2 compat
+, wxGTK30 # crash with wxGTK30 with GTK2 compat
 , wxSVG
 , xine-ui
 , xmlto
@ -62,7 +62,7 @@ in stdenv.mkDerivation rec {
    libexif
    libjpeg
    wxSVG
-    wxGTK30-gtk3
+    wxGTK30
    xine-ui
 ]
  ++ optionals dvdisasterSupport [ dvdisaster ]
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@ -41,13 +41,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "icewm";
-  version = "3.2.2";
+  version = "3.2.3";

  src = fetchFromGitHub {
    owner = "ice-wm";
    repo = "icewm";
    rev = finalAttrs.version;
-    hash = "sha256-tVbBV3eaZ9MUXlzriiOeEuzojI3GHNaXRBjdsQjXrzw=";
+    hash = "sha256-cG+I7WMWboMNH6A0eKFI3evN16C5EGE127q+a/PBR5E=";
  };

  nativeBuildInputs = [
--- a/pkgs/build-support/fetchzip/default.nix
+++ b/pkgs/build-support/fetchzip/default.nix
@ -36,7 +36,7 @@ in
 fetchurl ((
  if (pname != "" && version != "") then
    {
-      name = "${name}-${version}";
+      name = "${pname}-${version}";
      inherit pname version;
    }
  else
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@ -88,7 +88,7 @@ NIX_NO_SELF_RPATH=1


 # Move subpaths that match pattern $1 from under any output/ to the $2 output/
-# Beware: only globbing patterns are accepted, e.g.: * ? {foo,bar}
+# Beware: only globbing patterns are accepted, e.g.: * ? [abc]
 # A special target "REMOVE" is allowed: moveToOutput foo REMOVE
 moveToOutput() {
    local patt="$1"
--- a/pkgs/data/fonts/amiri/default.nix
+++ b/pkgs/data/fonts/amiri/default.nix
@ -1,17 +1,16 @@
 { lib, fetchzip }:

 let
-  version = "0.900";
+  version = "1.000";

 in fetchzip rec {
  name = "Amiri-${version}";

  url = "https://github.com/alif-type/amiri/releases/download/${version}/${name}.zip";

-  sha256 = "sha256-FjuzWW9xVWDOxHBwYL4pmopQVc9KYHGHhye5tPdw68s=";
+  sha256 = "sha256-hG6m/zsGoGF5/xhHz9EHVL9Sg9dlQqfXpQ/lqNyI1vU=";

  postFetch = ''
-    rm -rf $out/otf
    mkdir -p $out/share/fonts/truetype
    mv $out/*.ttf $out/share/fonts/truetype/
    mkdir -p $out/share/doc/${name}
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "16.3.6";
+  version = "16.4.0";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
@ -34,6 +34,7 @@ in stdenv.mkDerivation rec {
    inherit (iosevka.meta) homepage downloadPage description license platforms;
    maintainers = with lib.maintainers; [
      cstrahan
+      montchr
    ];
  };

--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1xjpzif2v3p78abny74wwrrcq05hahvk4rf0swhbjhsv7j1ycmnf";
-  iosevka-aile = "1m1naxhf6ksasd3fq5npikgm8yv60salnhvb9b50rmyw6as2hmyb";
-  iosevka-curly = "0xdb8ymcg0kmdcj7jhr3pqfyv6cw9ab1f1rgs0cvn6g97n4ag2yq";
-  iosevka-curly-slab = "0396zjh043qv1j10f7m2pbibfyfkc6361rzjjgdqyvjhj0qh3wsi";
-  iosevka-etoile = "0d89q4d8fvcl2130v45v873g31vvcd051wk461lid1mdmydvfs9d";
-  iosevka-slab = "0jgsg1rnkx8mrcp74qbkc7dazlkh9wzyb6gn51yvwzv2gs2sj69m";
-  iosevka-ss01 = "16c3kh3ynmwm0r83gv1swv2z4bhdm78a91hkdczzkngbzaa0mxhg";
-  iosevka-ss02 = "1xmylqgh0972p1cz2vshlgnjpfg20k7x5alirjhpsvyj8n1v7jsx";
-  iosevka-ss03 = "1qw2rwwhw4yd2s0876xp3z5kxxgf5x125vwy83wbcgca9hx7b1cw";
-  iosevka-ss04 = "1nlw7na37rx9lk9g3b01v2wipglcj0lszyyk0s6j2g8cdmvcdqap";
-  iosevka-ss05 = "1b3ckxpw28ail62x8g06rs6fn4gba7xfpnk2qaf8fl0lhvjyv0kf";
-  iosevka-ss06 = "0ifrzd1kxhflf2kxbfsshp9chpiidx6nvvblws11276qz7qir9lq";
-  iosevka-ss07 = "0bm2n688i8f40awi8k1jj8p6pz45p230pp7brlps99ljjq7ipqcb";
-  iosevka-ss08 = "0qqhfcr9xmfr24rp4xq3xy8zld5l2pnqwbd801ljv6qy3zza9xhk";
-  iosevka-ss09 = "0dgpzjnab2fwp2jns5fvgzh4n8w0qhxzx1fhxw4b5c99n5bnim07";
-  iosevka-ss10 = "1nz8an3ar3lw3zfdyck1xh17hdkqdpg8rmwih4wxz93hpp5xhrbv";
-  iosevka-ss11 = "1wmxs075ymvyzl9r687xh32iqp3xsaakdfh01m1iwpyglspyr8y0";
-  iosevka-ss12 = "0c7abkq0ylzqv8ssizby5g6lnibqyiw2pfmyk8cccx9pq1ihr1jq";
-  iosevka-ss13 = "0xalbmkgyj30a9y4wzqpcc8ix64jdll1sm972fc35ln8134m7fzl";
-  iosevka-ss14 = "1638n30hhqv0rm2q1gqvj36knjn2n6jry6dz1xfczlaqm956395v";
-  iosevka-ss15 = "05blb6va180fk4iw3ldgq17w11gqi0jflmcdgzjzxw5pxs8j1qwp";
-  iosevka-ss16 = "1qgfrc5kj0x7yc77aqswy5668ymnxw9gw5rp71r4j5778wmslr5s";
-  iosevka-ss17 = "03226nda56dhbia3nf5p603zz04avh5j1x24qz9z3irhqg4rn0js";
-  iosevka-ss18 = "17vyf3msafgdhqhhby4qrn8p5pxdmvxwfgf44vx41iy860q89avh";
-  sgr-iosevka = "0vxfkhx77b9hf63an7wzpgldlj6pbs27i65qsq45n869cyvzd9ga";
-  sgr-iosevka-aile = "1iqxc42hc6398a61k84ibmjkl328sza9q3l81s04iav4kkrjd0g6";
-  sgr-iosevka-curly = "0ww4h12xfpa8yxjxhgs3m819024vz6isw8gq88spj07p2w4jx4mp";
-  sgr-iosevka-curly-slab = "1my79s02hhi803rakwia61c2rkpgzf6zw6xhzw6n1jkmjj1r77a7";
-  sgr-iosevka-etoile = "0rp1fk156s2mxibyak8pzw871p33pjdizi2ix9ppxqdb2zyn64xd";
-  sgr-iosevka-fixed = "0rldw2gq22hf2hy0brf03g12vw4rh8h5ascccsc6mljzzgwy6wir";
-  sgr-iosevka-fixed-curly = "1sal7i1kybfgxfhr1c90rmjal8zhh4cbf6xqzs6zrz3zxhp1zj30";
-  sgr-iosevka-fixed-curly-slab = "0spkivcqg4nzkd7r3gvym1v87d8r7cd353sw8sbllq9a93axcffs";
-  sgr-iosevka-fixed-slab = "1kpzcsjdk74fbr16iqz7xm10arg8kmcnpv54xxn23h4xbxx6qy5z";
-  sgr-iosevka-fixed-ss01 = "0j7kzcy7rwjqhl9hlhpbm4495b5ifl0kl9jh58nc0r17c3vfhhxq";
-  sgr-iosevka-fixed-ss02 = "1lx6gx2qr82nzphxyd38xj50mrhn9y2c0lq2c1n6iq7zig7yybn6";
-  sgr-iosevka-fixed-ss03 = "0clpiaa12mxksvbyrxahq56nh0dmn3y5x0dclx8clh7v39z652s6";
-  sgr-iosevka-fixed-ss04 = "1lvr6vs6qbmkrgkzw5jvp3a3ib681y9784mwv25il5z7q6imlnng";
-  sgr-iosevka-fixed-ss05 = "0bxqcd18657pvf6j64rhwvgpq6frqdhp65r8rb90bwfv12yqxrw7";
-  sgr-iosevka-fixed-ss06 = "1fz1zvbvkyj04c8qh2xwshcnwswnzldvi6y7c1qzbfm357xsjblg";
-  sgr-iosevka-fixed-ss07 = "01ndbbchf4azc4n8w26snd1l6078zxc8xzxy2vbw7vby3lify2i1";
-  sgr-iosevka-fixed-ss08 = "1rv1rywpk53nf6kyc5wjsjf9j2aj1bzlr4gwk5s6m63klr7q10wx";
-  sgr-iosevka-fixed-ss09 = "10rv346mjg12rihix0rr97vi5y63j4ia0q24rbs0546g4g309k6w";
-  sgr-iosevka-fixed-ss10 = "0ry6abyjaq6dy39mkvzqglzrrpbgwfcq2lxy5j9kncjcwx72mpin";
-  sgr-iosevka-fixed-ss11 = "0nq997c81pxjkgsr1gvkbaapv4qkqpf5w5pixhdkc22g2fp68w6s";
-  sgr-iosevka-fixed-ss12 = "1v7irhjrf31mlj3h0v1bxnl1x187555zdrrv2fhycn7700im5pj2";
-  sgr-iosevka-fixed-ss13 = "17m1fjlvh279wc1n2m7fhmrn3a8b2rqrnj34vps67f1m7bafh1yz";
-  sgr-iosevka-fixed-ss14 = "1sm9z1zad7war4066rj5mdmc0qhl03bjq7wir01na42bw464yz2a";
-  sgr-iosevka-fixed-ss15 = "0xsgjz0225vdzw5b9x8333anmshpva1w5kw7g6m0m2m21n3kvpc8";
-  sgr-iosevka-fixed-ss16 = "1z5h9s9vqmmdjzkv6jzd2rxzkrdbchcbbdxilgvh0nkicpz7h1f6";
-  sgr-iosevka-fixed-ss17 = "06va44pbrbp3yrpb6k58c5vkyrfjbl1sm2jhbpih0vxcpmqa209k";
-  sgr-iosevka-fixed-ss18 = "03plkqbjmpbz200k062s5j9a42717fzi37c6d0jjmhqlyr62j478";
-  sgr-iosevka-slab = "0xf2wzd5679j3csd5br4yfyh1m8vmijf42871szxbq85mw8k1q6f";
-  sgr-iosevka-ss01 = "1v4cifbn4icgsnzvxqyg2sqza5m2378bmcqmw511cbkhrgzr15ff";
-  sgr-iosevka-ss02 = "1d91qzbzlkwj0f9nfd4jvvy2lq0dy70w6dzkgggb75xm6rwn0251";
-  sgr-iosevka-ss03 = "0praj6n5i1ahxnp3zji3jffvvzhpb1382inzihlgrbysjna4cqkv";
-  sgr-iosevka-ss04 = "1lxifnvb61ad8v53cnj4zi4m1jnlh4gk1w6kk5w04yd0z749hyx1";
-  sgr-iosevka-ss05 = "1a446rhyn69ss20ybf9mqy55i4ajq2jpwppmn6srfnrjx63706w6";
-  sgr-iosevka-ss06 = "112k2gyv6r9ircw2rnrgsijw9v1fs64p5737ww6540kg8xrpz1kx";
-  sgr-iosevka-ss07 = "0alc313vgf9649xgynq8h6d006phw9mbijn2m4qjzgjkw4v28xh8";
-  sgr-iosevka-ss08 = "1c1xfj3jryfcgzmqyfmcz7nafhh5jzj7glcdaifviddbbdj5xi88";
-  sgr-iosevka-ss09 = "1fw4qnn22fvz42mfbl1gwr4bwv53xjy0dqd7c6sy7886gxmkr04y";
-  sgr-iosevka-ss10 = "1m62m1xb6xb9vwpgicag8vw817r8qf6gq6mv7kr18fs0mqv4h8sh";
-  sgr-iosevka-ss11 = "0xa5wy6qnk9fgkm3yb0scwkhfxg59hchimzfzrbgvfylsdpq527y";
-  sgr-iosevka-ss12 = "0c49wjypsxjgkm9s1py58lx8rybb3kzm6z3xysvmffqhyx4h03xa";
-  sgr-iosevka-ss13 = "1hr0fbmhjq5ngp4hdm7zjxk3wggbk2yhx50byvbm39056v3pxbym";
-  sgr-iosevka-ss14 = "0ibqdh2ddz9rv8icbfvba6jj5pcpi7l7kjkwsqx0081wqv1c3jxk";
-  sgr-iosevka-ss15 = "004ibn5hrgcby93h2kz248x5qmz4xbirih1k3ic0xqda23yyqq7j";
-  sgr-iosevka-ss16 = "1mad0yiwknl9f7z6c52fv12ngdgwr1yic74ssbzk529vrqmafwy1";
-  sgr-iosevka-ss17 = "1igrbzw63jailzgqlv72h1iv3lz33qd3z9s0hv92w2kh2ig7q6kf";
-  sgr-iosevka-ss18 = "0nsq4hg8mmnzi8dgdn0km03x72ja1vk7g7kbzr7m148kb1p4x5vv";
-  sgr-iosevka-term = "1ax6i21cf4w8gwhml0rwvb3yk9hlhkjfn1pyjyglajnsbh8z4r3w";
-  sgr-iosevka-term-curly = "0y7jkqddqkc2cnmgfsrq29c7id070y8gxj664q81k6alivpj62rs";
-  sgr-iosevka-term-curly-slab = "021m8lmxss1qms0slsc83l78njvnjjyniarrkx95x9vpqs2dym0h";
-  sgr-iosevka-term-slab = "0qkxy91hvxa36bz8q1wwf31qn18b2zvyabkpsjnv6yhpzimz4wm0";
-  sgr-iosevka-term-ss01 = "0sxm07qr1l64n0p5f7dnssgi545i73gdahm18iyvijwqcvxg83rn";
-  sgr-iosevka-term-ss02 = "0zlzvxbf2p27g7p5g19ixa5vf77fxd0b7bqky9pfzf72wpwd89jd";
-  sgr-iosevka-term-ss03 = "09qd2np8z224h2z7yyqfz7csxdbr11kc4v9p8z4qnb8k8wg5akz9";
-  sgr-iosevka-term-ss04 = "0jr5bk9x3nb9841nxlsl3wjwdy5si8g4rwh5axm5g5hwjxr29x8z";
-  sgr-iosevka-term-ss05 = "1w41g52b2b5qzkhai3wk3fvsa5qi8h70wmbq0shq954gqzrlchnp";
-  sgr-iosevka-term-ss06 = "0hmsq5jpnb9605scvh89wqdvyxsypm74aqwz8zsyn7siwfkhh3hc";
-  sgr-iosevka-term-ss07 = "06spijbyw6dzwc73gzi9r14af9g47js0p94ddn54aq3sw2d1c9jq";
-  sgr-iosevka-term-ss08 = "1yrr7lknz0h126gr6srxzfs4npl7vv8v32b2hzkixqzf1pfjv3mr";
-  sgr-iosevka-term-ss09 = "1lf04m0f3l2pw1rm3klfynainxma8fs5x2zv9vgjd1vr07si0c5n";
-  sgr-iosevka-term-ss10 = "1p9p3gpfd353jq1aab5dh16ppzx2qjii8x8hvaqnmhy1a1ip15jg";
-  sgr-iosevka-term-ss11 = "1x1n5fjya6a01m0cwcdcf6xlynzgk2413axkr4p5glmqad7w82h8";
-  sgr-iosevka-term-ss12 = "07bxpw4bsxbwsrjvbw3n6kj1bkvr9a730zp509zjzg72dy6i96ca";
-  sgr-iosevka-term-ss13 = "1mw0nfknzk4qcf9nsg9904389li6sbpvgn48iydrk4bzyr41qza1";
-  sgr-iosevka-term-ss14 = "13pvn4kkl4yz1hkrl04ifqbk9x7lym1i7w3d6nh8l3ch3783sjha";
-  sgr-iosevka-term-ss15 = "1hqrn050qx5iljfbflzpzl4nl21jnnlih53kj9ik3scwb76pkfal";
-  sgr-iosevka-term-ss16 = "1svj0wq7j0kzn4pnyn5lkd5sni3k6vv78r943zc6dlxrs7vbkljp";
-  sgr-iosevka-term-ss17 = "0qmzpxgsibf8c0k6hzq7ps1gd0mb050z3dsjmjjammh0cwflax6p";
-  sgr-iosevka-term-ss18 = "0qss7kz6mwzaxlff4m1lylf0a8sy65l7z6my7k6kif9iiy2595wx";
+  iosevka = "07v98pr0anqbxn1yc55245k5ixxzfk2wmfq67zhz84aa18viqhbc";
+  iosevka-aile = "03y0xijb7c0kampm3gjb69mv8hikhsgqhlw1w3zfcjhr2vc62g6q";
+  iosevka-curly = "1i31zj0j8npgx7wn2qibih48s76qjxakz14sa2hgx908p8xyfwq5";
+  iosevka-curly-slab = "1xijhk5vbgs3c89a7g9cfjqjqv801gimjja4wqpvaficab692jh2";
+  iosevka-etoile = "1rqagk6gyja15fa4m107ylbjwbhn811gbl9lbr9yzashw4drjpp9";
+  iosevka-slab = "063qk1d75l1jq7gdwzqxd7j8j56g7da0aagsqm0lvwl217l7x48b";
+  iosevka-ss01 = "0rjbyfmm46ffslf0glvn5yrsxiaznj3bk53si5jhnipphqw11r9v";
+  iosevka-ss02 = "0sgpaqzcp4zpk96xr2nz04sfg026ph4glkkzky7z1245z12lzdlc";
+  iosevka-ss03 = "01wjv069mmyjw9mk9hkcj4d23f0lgwdy91j21lcja6gybawly5g6";
+  iosevka-ss04 = "0j2qjly3z8vr8z62g2dlj1i6cpx5mlzfvng41x8hxq23j9gfr2y6";
+  iosevka-ss05 = "1aimq0mm749mai3ykh6975ya8ng402ddkzb1hhxz3nnm8v6cwd27";
+  iosevka-ss06 = "1yd882vj4l0qhz67nbba61nyplg9psyr3hnvknvkmr2wnj723dbm";
+  iosevka-ss07 = "09x54z8lzg85akfdc95k6gyka77qgmz3fnhq2ji01apshf8hc751";
+  iosevka-ss08 = "1lmsgcc5q68wm2hs0h35s374bql7rl8r5yp7z17vrjz2qwp3n7b4";
+  iosevka-ss09 = "1p5f2885b18xgxbl63g5zphr2kz52swdpm98d0rcwr60bkqkf79l";
+  iosevka-ss10 = "0kmc0fxyi1imndw88wsdfg6nhvijprrxc2d6nmgvnalnwrx95d33";
+  iosevka-ss11 = "15k64sn23jh2plwwqsvplc04099xv9w16fmmzxzz9vd4js8j4245";
+  iosevka-ss12 = "10y5ll8256h61ycgyjrysfaki9h93va271qgam0b5bjl0v9vhdlk";
+  iosevka-ss13 = "1lv9w2yiqy09sggbzd17vx8nn8vh1qv7yn9rsnwcq95xqd4dpw60";
+  iosevka-ss14 = "1pb53ahx5jig7a6yjb4kwpcgbpdbxans25p3amiswy7xyklhw3la";
+  iosevka-ss15 = "1jax0zx17k8mzp7489fd1bprvh79ww4ghcy6vhih2nbg18kzxsqc";
+  iosevka-ss16 = "0s3xq3ijrd8b51myh779hf5cvwvxvxz8xx9gxksnbzh1pml9zz1a";
+  iosevka-ss17 = "1mnw0lh65yj936p3shsayq6k31s708cqb60qys82hcwas5bacidr";
+  iosevka-ss18 = "1jyywvp9j6rj21v99psbwsr8xrfzfvq76z54hw0acb3j5mhl7s4r";
+  sgr-iosevka = "1p2n8q6nj9f8nibb7zzy60ck0sp2cg6lz1z3inizs5i9lpnr8mx3";
+  sgr-iosevka-aile = "1nxysymkc273cmk00b44bky63lm73dl3p9yai8lcn14lv1apdjg6";
+  sgr-iosevka-curly = "0bwlalijphm1aykv8j652lp9p1xl4jj4gmc26ag8s13gmbx6gxhy";
+  sgr-iosevka-curly-slab = "11d3biggpk6r0pa7k7ig8sgxmjw80b723ass3pqxns13y3krm8il";
+  sgr-iosevka-etoile = "0lspbn81bajdc905wafqmfp8cjlw6q6xlvry1alq7y7ng19vm5dh";
+  sgr-iosevka-fixed = "1zzqi09pafma9fj9603ixhygwa2aayzk27xda2yzhixiw11wxz33";
+  sgr-iosevka-fixed-curly = "1j07rqa1495dr0s2ppcypycclmzgpbpl0yibkd7f1mlzl629gk38";
+  sgr-iosevka-fixed-curly-slab = "1wlq2qdl3nx8q6a39dc3sv6h2gr8v3bhswgvgavbr7m2q6jcss8g";
+  sgr-iosevka-fixed-slab = "1m20f9zc4q2rv16yl5pfvx4l2031783ixv4k6vhnzwqkvqqrk9dg";
+  sgr-iosevka-fixed-ss01 = "1c7ldr1h2bgl6w8ggwbsifad7n3mincwplfiam4w4n56xkn19qdx";
+  sgr-iosevka-fixed-ss02 = "1hck8rcja59c0jgl62dk9i5xrixxihd3mzcma6yqqsxadgvf6cc5";
+  sgr-iosevka-fixed-ss03 = "1qck9qdanfwl1jgbjmyzvv52dgxa46gw9h6ygn3pp34pgbgj6lnd";
+  sgr-iosevka-fixed-ss04 = "1d3gv5zcs66qjazxwig2kw6nlwqzvn3pmnpbwif65xd5hlqs1m3c";
+  sgr-iosevka-fixed-ss05 = "1l335c8fnh3ijhx7bl2wpa8k1vnjskhrlhcg7k04z9jhjcyagr9f";
+  sgr-iosevka-fixed-ss06 = "06zm8yr6n17b6vmic9ngv3iv7jvnps0bazvdi8y38r371gwp4af9";
+  sgr-iosevka-fixed-ss07 = "0ambs05hjxvx6v905wzqk8wjl8a8yrd216fm8sy23wr8vkm7zrca";
+  sgr-iosevka-fixed-ss08 = "10zgxj5p50hzbczh33mq1qw708srwcwp615ajfmmx0b86qgxmfqw";
+  sgr-iosevka-fixed-ss09 = "1k0hd06lislhzvgd5vz7sra9pbwnl7nv0cxzmxglmlskafcls7zb";
+  sgr-iosevka-fixed-ss10 = "0bgkfk31fd60w7x1nzy6x3p7gi2d72z7cf8f5av54rnamw4a4hnq";
+  sgr-iosevka-fixed-ss11 = "0vsv9plkcmynrj6s75kbb57kkfpxay4k90nlimgb3s1z7d17az0a";
+  sgr-iosevka-fixed-ss12 = "040bpjhgjii0s19ilfrvg1261ssk4n9xyynw61cbn65rh2dpfdcl";
+  sgr-iosevka-fixed-ss13 = "0bmmfpynl5j74i71b0cyi9vyrrb6d5axz3frsg48q8pwqac2vkx7";
+  sgr-iosevka-fixed-ss14 = "1bqfbv4rcvcpbrzsg2zpk870yq2a6j7ishsgc6p9xsqfblnw1p6a";
+  sgr-iosevka-fixed-ss15 = "1rhks1drqs0yx2sbcdqyq9lvxrh11adqisw7pxncgm6flcgkhx29";
+  sgr-iosevka-fixed-ss16 = "14kkdvmj2gpyxs5dcbfyghidbqaz147r114xi42yhl4fpsdppkrk";
+  sgr-iosevka-fixed-ss17 = "0csd2ag4h8cdngscbmhj5kh1rlj022pmg8ig758hxp25ddmb2h8l";
+  sgr-iosevka-fixed-ss18 = "0hpkzzx35a1nmspb2k7gg5z9kp00i4hd4k1nni4jg661mgvilldp";
+  sgr-iosevka-slab = "1y8csc7kgm2xipa6s2jy0ibgb4j9pj6wxpjlxyad3ssbsqf5yfvc";
+  sgr-iosevka-ss01 = "0hq5s1ajqfmq6y3l189h2xjkawayq10sjwpcmzkbf4565qifinm6";
+  sgr-iosevka-ss02 = "0921izv9x38zziw8vfha4aqvvdb5g926gycg6rl2rxfymjsg2f1m";
+  sgr-iosevka-ss03 = "0c9sfswgf4rgmwbsm4wwyfaqk7brp0dmw76krzylbppcyzsczjbr";
+  sgr-iosevka-ss04 = "0ic7g811156cwkrsizjd5f051k964lpr216nrd15ap06viar4vk4";
+  sgr-iosevka-ss05 = "0hxpi57xzxw03qr9ss2mrpl4p479v14c15y9iqjflb478qdicxg0";
+  sgr-iosevka-ss06 = "04ny0vyr0sayfymaxgsqfnvqsx1afsh9fjdpcfna5vpl661ljnsf";
+  sgr-iosevka-ss07 = "10s8vhcikk6xrvyjmzjq7k4b81cf9i71c6dhsrnwxvn732dx5awl";
+  sgr-iosevka-ss08 = "0ji3gsf26xji6qfx99azhxj816q7bhpzqdxh43ncs86snl86g9xf";
+  sgr-iosevka-ss09 = "0c1n399v3vf68q165mn26qc0cnbi5yfvvkxwxp1inl7vdsgzhslw";
+  sgr-iosevka-ss10 = "07g2zbpgd8zbb2zyqk9kfb9s1hd94wmx1ijaf9fh6c6sby2wgssk";
+  sgr-iosevka-ss11 = "0kfiln8w5gim2swyk80k2bnvnyr853imgp91z2v330hdllca99ra";
+  sgr-iosevka-ss12 = "01kljfahn4ljss2rd66srp2lwj94fvkigpzk315zd21qxyy4wfl2";
+  sgr-iosevka-ss13 = "0bgxfrpfn4yh6852155qj0j7zfsrf14rg4gc3ffidmszhindllcc";
+  sgr-iosevka-ss14 = "04qldb75h61wca2pzkmks3amcq6q3n0dhjva0b5v1dg0y6qzs2c9";
+  sgr-iosevka-ss15 = "1344wgx2nx1a7aphi06xkl6niij5cqlnnydbb6la0k75invyz2i6";
+  sgr-iosevka-ss16 = "1apkrdmhz69vdbjhr88288qyqz4pfya11fj4gpxkb3hk01dbkwzs";
+  sgr-iosevka-ss17 = "0mba09669408icz6p944pivfb0m99pirapmml1d1glni0xj4mndd";
+  sgr-iosevka-ss18 = "0j463s8is0w0rvgqn63mxhf3wcx0r5a7q4zs6621f3xigqvbhkdm";
+  sgr-iosevka-term = "034p2llrz2ffm5aslxg1ah8l0bj6kr9lx53yi1hg61cnx18z3yx0";
+  sgr-iosevka-term-curly = "0zixih0y7ksav7qxswysijfdnnj1jjb74znz0bkb0f7cviaa6w2i";
+  sgr-iosevka-term-curly-slab = "1vsz17s0yp3v01054342plc62pag3mx7xs5jb8llx729zc5qzpd7";
+  sgr-iosevka-term-slab = "04bsgvzyjy2d0jndzxb2d0pv6sfr9gm3ryv94va65rxv3fc0mj73";
+  sgr-iosevka-term-ss01 = "12hfzalx076gh9kskfxvgr9b3w8i3kk2lhbcsj417vsn5nx48grq";
+  sgr-iosevka-term-ss02 = "15chkrw65nyfl9vd23y12cqvsn4sddrnf3zmxy0jval5paz8hnx3";
+  sgr-iosevka-term-ss03 = "0ivxs8pdpbx1lcmfm1r6qkvzsx82swwi7xn4ja92rh8zix9i78bv";
+  sgr-iosevka-term-ss04 = "08zfbmq6cvc7jzkindyvx7mlfvyhhicdxqm4pyblgb9xfh6vvk0k";
+  sgr-iosevka-term-ss05 = "0c8mbjbkw6a5hpxshr20qsrwp0chwnxxijm3sqaf28hg2ka79qhg";
+  sgr-iosevka-term-ss06 = "1ymdi01cl9v86qlcl0ka9v1p9ry129wqjmsjy1i60ld579yy8x05";
+  sgr-iosevka-term-ss07 = "09qqjmn7iaykl08pdd4qj57z12npap246y8c0kp3rvwjdyh3p7y1";
+  sgr-iosevka-term-ss08 = "10qca50vbwb5fa509jrb3w63dxk6ny7i7ffdmyiz1slv418jjjha";
+  sgr-iosevka-term-ss09 = "0chhlxql7j1b0nfa6pnw3dfrjv6wij8wsl0i2xf5ar52rgzr2s95";
+  sgr-iosevka-term-ss10 = "1z6za3sdaf793vma9d70a38rlb47nzqj08pnp6jqir2fifdsvzl1";
+  sgr-iosevka-term-ss11 = "1midlf29xqli721gv195gy6mjmp9w8nq8kc1ly2d62spq3lhqmqw";
+  sgr-iosevka-term-ss12 = "0bagnqg4r0a76p32d3yg8j6raxwzc7wbhx5kv7habpbinhq96ink";
+  sgr-iosevka-term-ss13 = "0wj3gx4h4r99whfsnqja8j3a737b8firn5sga6320qm33szzgh69";
+  sgr-iosevka-term-ss14 = "0zsmy58w23355laqjs9xh76i4bz80yha65yaj44ssrsz1h0f9bpn";
+  sgr-iosevka-term-ss15 = "1yp9kywi00lykwj2wwvwvw4qblaw1549lj0ahrhrhljnijjc1zmb";
+  sgr-iosevka-term-ss16 = "12c8i4gwshxj3mnzz7ycprwlmc5nhfc9dvg1wwcvc59xvdphpgzc";
+  sgr-iosevka-term-ss17 = "0fiji4hbb9cbssx3whvjhsvm7zi1chrnrp46q01627z4nzw2s5a7";
+  sgr-iosevka-term-ss18 = "0hmdpzffywgdls5qy38sq04jfsx9ym56lypb6fiwjvppgn8vkcgl";
 }
--- a/pkgs/data/fonts/lexend/default.nix
+++ b/pkgs/data/fonts/lexend/default.nix
@ -5,13 +5,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "lexend";
-  version = "0.pre+date=2022-01-27";
+  version = "0.pre+date=2022-09-22";

  src = fetchFromGitHub {
    owner = "googlefonts";
    repo = pname;
-    rev = "57e6c14e2a9b457e8376044a31525c2100297e9c";
-    sha256 = "sha256-+tPggQIO50a8kOSnOVN/MR9ZwX5xZqYVNZO79eog9QA=";
+    rev = "cd26b9c2538d758138c20c3d2f10362ed613854b";
+    sha256 = "ZKogntyJ/44GBZmFwbtw5Ujw5Gnvv0tVB59ciKqR4c8=";
  };

  installPhase = ''
@ -19,8 +19,8 @@ stdenvNoCC.mkDerivation rec {

    cd fonts
    for f in *; do
-      mkdir -p $out/share/fonts/truetype/lexend/$f
-      install $f/ttf/* $out/share/fonts/truetype/lexend/$f/
+      install -D -t $out/share/fonts/truetype/lexend/$f $f/ttf/*
+      install -D -t $out/share/fonts/variable/lexend/$f $f/variable/*
    done

    runHook postInstall
--- a/pkgs/data/icons/simp1e-cursors/default.nix
+++ b/pkgs/data/icons/simp1e-cursors/default.nix
@ -0,0 +1,42 @@
+{ lib, stdenvNoCC, fetchFromGitLab, python3, librsvg, xcursorgen }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "simp1e-cursors";
+  version = "20221103.2";
+
+  src = fetchFromGitLab {
+    owner = "cursors";
+    repo = "simp1e";
+    rev = version;
+    sha256 = "sha256-3DCF6TwxWwYK5pF2Ykr3OwF76H7J03vLNZch/XoZZZk=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    (python3.withPackages (ps: with ps; [ pillow ]))
+    librsvg
+    xcursorgen
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    patchShebangs ./build.sh ./cursor-generator
+    HOME=$TMP ./build.sh
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -dm 755 $out/share/icons
+    cp -r built_themes/* $out/share/icons/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An aesthetic cursor theme for Linux desktops";
+    homepage = "https://gitlab.com/cursors/simp1e";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ natto1784 ];
+  };
+}
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "iana-etc";
-  version = "20220915";
+  version = "20221107";

  src = fetchzip {
    url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-gBaM5YEK2XA42S7ELwjQChie/wYgo6n8dt2WEg3Pdns=";
+    sha256 = "sha256-vucC9MfpCCPyST21n09QDrj3z3MzKdBGo/ONUQvuxxQ=";
  };

  installPhase = ''
--- a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "elementary-camera";
-  version = "6.2.0";
+  version = "6.2.1";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "camera";
    rev = version;
-    sha256 = "sha256-866Iky0GKQv2yUJVNY1McgXGeup5WqONN3gvoOlilGU=";
+    sha256 = "sha256-ijzEMGXoH0gACem/3JaC/aOIaOQgP7Y7n48NgoDMKBk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
+++ b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
@ -49,17 +49,18 @@ let
  # targetInfo.triple is what Google thinks the toolchain should be, this is a little
  # different from what we use. We make it four parts to conform with the existing
  # standard more properly.
-  targetConfig = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (stdenv.targetPlatform.config);
+  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (stdenv.targetPlatform.config + "-");
 in

 rec {
  # Misc tools
  binaries = stdenv.mkDerivation {
-    pname = "${targetConfig}-ndk-toolchain";
+    pname = "${targetPrefix}ndk-toolchain";
    inherit (androidndk) version;
    nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
    propagatedBuildInputs = [ androidndk ];
    passthru = {
+      inherit targetPrefix;
      isClang = true; # clang based cc, but bintools ld
    };
    dontUnpack = true;
@ -91,23 +92,23 @@ rec {
      ln -s $out/toolchain/bin $out/bin
      ln -s $out/toolchain/${targetInfo.triple}/bin/* $out/bin/
      for f in $out/bin/${targetInfo.triple}-*; do
-        ln -s $f ''${f/${targetInfo.triple}-/${targetConfig}-}
+        ln -s $f ''${f/${targetInfo.triple}-/${targetPrefix}}
      done
      for f in $(find $out/toolchain -type d -name ${targetInfo.triple}); do
-        ln -s $f ''${f/${targetInfo.triple}/${targetConfig}}
+        ln -s $f ''${f/${targetInfo.triple}/${targetPrefix}}
      done

-      rm -f $out/bin/${targetConfig}-ld
-      ln -s $out/bin/lld $out/bin/${targetConfig}-ld
+      rm -f $out/bin/${targetPrefix}ld
+      ln -s $out/bin/lld $out/bin/${targetPrefix}ld

      (cd $out/bin;
        for tool in llvm-*; do
-          ln -sf $tool ${targetConfig}-$(echo $tool | sed 's/llvm-//')
+          ln -sf $tool ${targetPrefix}$(echo $tool | sed 's/llvm-//')
          ln -sf $tool $(echo $tool | sed 's/llvm-//')
        done)

      # handle last, as llvm-as is for llvm bytecode
-      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/${targetConfig}-as
+      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/${targetPrefix}as
      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/as

      patchShebangs $out/bin
@ -131,7 +132,7 @@ rec {
      # Android needs executables linked with -pie since version 5.0
      # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
      echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
-      echo "-z,noexecstack -z,relro -z,now" >> $out/nix-support/cc-ldflags
+      echo "-z,noexecstack -z,relro -z,now -z,muldefs" >> $out/nix-support/cc-ldflags
      echo 'if [[ ! " $@ " =~ " -shared " ]]; then NIX_LDFLAGS_${suffixSalt}+=" -pie"; fi' >> $out/nix-support/add-flags.sh
      echo "-Xclang -mnoexecstack" >> $out/nix-support/cc-cxxflags
      if [ ${targetInfo.triple} == arm-linux-androideabi ]; then
--- a/pkgs/development/compilers/chicken/4/chicken.nix
+++ b/pkgs/development/compilers/chicken/4/chicken.nix
@ -31,6 +31,7 @@ stdenv.mkDerivation {
  ] ++ (lib.optionals stdenv.isDarwin [
    "XCODE_TOOL_PATH=${darwin.binutils.bintools}/bin"
    "C_COMPILER=$(CC)"
+    "POSTINSTALL_PROGRAM=install_name_tool"
  ]);

  # We need a bootstrap-chicken to regenerate the c-files after
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@ -225,7 +225,7 @@ let
      };

      meta = with lib; {
-        broken = stdenv.isDarwin;
+        broken = stdenv.isDarwin && (isAarch64Darwin -> lib.versionOlder version "1.2.0");
        description = "A compiled language with Ruby like syntax and type inference";
        homepage = "https://crystal-lang.org/";
        license = licenses.asl20;
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@ -47,13 +47,7 @@ with lib;
 with builtins;

 let majorVersion = "11";
-    # The patch below for aarch64-darwin does not apply to 11.3.0 and an
-    # updated version is not available. Keep aarch64-darwin on 11.2.0 so the
-    # large body of packages which depend on gfortran are still functional
-    # until GCC 12 is the default.
-    # On x86_64-darwin, building libgcc suffers from some different issues with 11.3.0.
-    version = if stdenv.isDarwin then
-      "${majorVersion}.2.0" else "${majorVersion}.3.0";
+    version = "${majorVersion}.3.0";

    inherit (stdenv) buildPlatform hostPlatform targetPlatform;

@ -70,10 +64,14 @@ let majorVersion = "11";
      ++ optional langFortran ../gfortran-driving.patch
      ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch

-      ++ optional (stdenv.isDarwin && stdenv.isAarch64) (fetchpatch {
-        url = "https://github.com/fxcoudert/gcc/compare/releases/gcc-11.2.0...gcc-11.2.0-arm-20211201.diff";
-        sha256 = "sha256-z62s/cXuH9Kgq/oD/OiiZ8LWnX1xl1D43sONnwaEW1w=";
-      })
+      ++ optionals stdenv.isDarwin [
+        (fetchpatch {
+          # There are no upstream release tags in https://github.com/iains/gcc-11-branch.
+          # 2d280e7 is the commit from https://github.com/gcc-mirror/gcc/releases/tag/releases%2Fgcc-11.3.0
+          url = "https://github.com/iains/gcc-11-branch/compare/2d280e7eafc086e9df85f50ed1a6526d6a3a204d..gcc-11.3-darwin-r2.diff";
+          sha256 = "sha256-LFAXUEoYD7YeCG8V9mWanygyQOI7U5OhCRIKOVCCDAg=";
+        })
+      ]

      # Obtain latest patch with ../update-mcfgthread-patches.sh
      ++ optional (!crossStageStatic && targetPlatform.isMinGW && threadsCross.model == "mcf") ./Added-mcf-thread-model-support-from-mcfgthread.patch;
@ -93,9 +91,7 @@ stdenv.mkDerivation ({

  src = fetchurl {
    url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = if stdenv.isDarwin
-      then "sha256-0I7cU2tUw3KhAQ/2YZ3SdMDxYDqkkhK6IPeqLNo2+os="
-      else "sha256-tHzygYaR9bHiHfK7OMeV+sLPvWQO3i0KXhyJ4zijrDk=";
+    sha256 = "sha256-tHzygYaR9bHiHfK7OMeV+sLPvWQO3i0KXhyJ4zijrDk=";
  };

  inherit patches;
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , bison
 , cmake
 , jq
@ -26,6 +27,20 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake python3 bison jq ];

+  patches = [
+    # https://github.com/NixOS/nixpkgs/pull/201747
+    (fetchpatch {
+      name = "Fix-locations-of-cmake-files-in-side-compat-shims.patch";
+      url = "https://github.com/KhronosGroup/glslang/commit/88fd417b0bb7d91755961c70e846d274c182f2b0.patch";
+      hash = "sha256-rjeaPX5Ieem6zkICNvPd2SjvvLzG5wBERZfDLZEJsAk=";
+    })
+    (fetchpatch {
+      name = "Use-CMAKE_INSTALL_FULL_LIBDIR-in-compat-cmake-files.patch";
+      url = "https://github.com/KhronosGroup/glslang/commit/7627bd89583c5aafb8b38c81c15494019271fabf.patch";
+      hash = "sha256-1Dwhn78PG4gAGgEwTXpC+mkZRyvy8sTIsEvihXFeNaQ=";
+    })
+  ];
+
  postPatch = ''
    cp --no-preserve=mode -r "${spirv-tools.src}" External/spirv-tools
    ln -s "${spirv-headers.src}" External/spirv-tools/external/spirv-headers
--- a/pkgs/development/compilers/jetbrains-jdk/default.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/default.nix
@ -7,16 +7,13 @@

 openjdk17.overrideAttrs (oldAttrs: rec {
  pname = "jetbrains-jdk";
-  version = "17.0.3-b469.37";
+  version = "17.0.5-b653.14";

  src = fetchFromGitHub {
    owner = "JetBrains";
    repo = "JetBrainsRuntime";
    rev = "jb${version}";
-    hash =
-     # Upstream issue: https://github.com/JetBrains/JetBrainsRuntime/issues/163
-     if stdenv.isDarwin then "sha256-ExRvjs53rIuhUx4oCgAqu1Av3CNAgmE1ZlN0srEh3XM="
-     else "sha256-O+OIDRJcIsb/vhO2+SYuYdUYWYTGkBcQ9cHTExLIFDE=";
+    hash = "sha256-7Nx7Y12oMfs4zeQMSfnUaDCW1xJYMEkcoTapSpmVCfU=";
  };

  meta = with lib; {
--- a/pkgs/development/compilers/julia/1.8.nix
+++ b/pkgs/development/compilers/julia/1.8.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , which
 , python3
 , gfortran
@ -40,6 +41,15 @@ stdenv.mkDerivation rec {
      path = name: "https://raw.githubusercontent.com/archlinux/svntogit-community/6fd126d089d44fdc875c363488a7c7435a223cec/trunk/${name}";
    in
    [
+      # Pull upstream fix to fix tests mpfr-4.1.1
+      #   https://github.com/JuliaLang/julia/pull/47659
+      (fetchpatch {
+        name = "mfr-4.1.1.patch";
+        url = "https://github.com/JuliaLang/julia/commit/59965205ccbdffb4e25e1b60f651ca9df79230a4.patch";
+        hash = "sha256-QJ5wxZMhz+or8BqcYv/5fNSTxDAvdSizTYqt7630kcw=";
+        includes = [ "stdlib/MPFR_jll/test/runtests.jl" ];
+      })
+
      (fetchurl {
        url = path "julia-hardcoded-libs.patch";
        sha256 = "sha256-kppSpVA7bRohd0wXDs4Jgct9ocHnpbeiiSz7ElFom1U=";
--- a/pkgs/development/compilers/llvm/10/clang/default.nix
+++ b/pkgs/development/compilers/llvm/10/clang/default.nix
@ -84,6 +84,7 @@ let
      fi
      mv $out/share/clang/*.py $python/share/clang
      rm $out/bin/c-index-test
+      patchShebangs $python/bin

      mkdir -p $dev/bin
      cp bin/clang-tblgen $dev/bin
--- a/pkgs/development/compilers/llvm/10/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/10/libcxx/default.nix
@ -51,6 +51,20 @@ stdenv.mkDerivation {
      "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";

+  preInstall = lib.optionalString (stdenv.isDarwin) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
  passthru = {
    isLLVM = true;
  };
--- a/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
@ -42,8 +42,10 @@ stdenv.mkDerivation {

  preInstall = lib.optionalString stdenv.isDarwin ''
    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
      # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"

      # this should be done in CMake, but having trouble figuring out
      # the magic combination of necessary CMake variables
@ -54,7 +56,7 @@ stdenv.mkDerivation {
      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
      # libcxxabi to sometimes link against a different version of itself.
      # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
      done
    done
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@ -89,6 +89,7 @@ let
      fi
      mv $out/share/clang/*.py $python/share/clang
      rm $out/bin/c-index-test
+      patchShebangs $python/bin

      mkdir -p $dev/bin
      cp bin/clang-tblgen $dev/bin
--- a/pkgs/development/compilers/llvm/11/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxx/default.nix
@ -67,6 +67,20 @@ stdenv.mkDerivation {
      stdenv.hostPlatform != stdenv.buildPlatform
    ) "-DCMAKE_SYSTEM_VERSION=20.1.0";

+  preInstall = lib.optionalString (stdenv.isDarwin) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
  passthru = {
    isLLVM = true;
  };
--- a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
@ -46,8 +46,10 @@ stdenv.mkDerivation {

  preInstall = lib.optionalString stdenv.isDarwin ''
    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
      # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"

      # this should be done in CMake, but having trouble figuring out
      # the magic combination of necessary CMake variables
@ -58,7 +60,7 @@ stdenv.mkDerivation {
      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
      # libcxxabi to sometimes link against a different version of itself.
      # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
      done
    done
--- a/pkgs/development/compilers/llvm/12/clang/default.nix
+++ b/pkgs/development/compilers/llvm/12/clang/default.nix
@ -83,6 +83,7 @@ let
      fi
      mv $out/share/clang/*.py $python/share/clang
      rm $out/bin/c-index-test
+      patchShebangs $python/bin

      mkdir -p $dev/bin
      cp bin/clang-tblgen $dev/bin
--- a/pkgs/development/compilers/llvm/12/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxx/default.nix
@ -42,6 +42,20 @@ stdenv.mkDerivation {
      "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";

+  preInstall = lib.optionalString (stdenv.isDarwin) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
  passthru = {
    isLLVM = true;
  };
--- a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
@ -44,8 +44,10 @@ stdenv.mkDerivation {

  preInstall = lib.optionalString stdenv.isDarwin ''
    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
      # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"

      # this should be done in CMake, but having trouble figuring out
      # the magic combination of necessary CMake variables
@ -56,7 +58,7 @@ stdenv.mkDerivation {
      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
      # libcxxabi to sometimes link against a different version of itself.
      # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
      done
    done
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@ -77,6 +77,7 @@ let
      fi
      mv $out/share/clang/*.py $python/share/clang
      rm $out/bin/c-index-test
+      patchShebangs $python/bin

      mkdir -p $dev/bin
      cp bin/clang-tblgen $dev/bin
--- a/pkgs/development/compilers/llvm/13/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/13/libcxx/default.nix
@ -46,6 +46,20 @@ stdenv.mkDerivation rec {
  buildFlags = lib.optional headersOnly "generate-cxx-headers";
  installTargets = lib.optional headersOnly "install-cxx-headers";

+  preInstall = lib.optionalString (stdenv.isDarwin && !headersOnly) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
  # At this point, cxxabi headers would be installed in the dev output, which
  # prevents moveToOutput from doing its job later in the build process.
  postInstall = lib.optionalString (!headersOnly) ''
--- a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
@ -41,8 +41,10 @@ stdenv.mkDerivation rec {

  preInstall = lib.optionalString stdenv.isDarwin ''
    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
      # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"

      # this should be done in CMake, but having trouble figuring out
      # the magic combination of necessary CMake variables
@ -53,7 +55,7 @@ stdenv.mkDerivation rec {
      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
      # libcxxabi to sometimes link against a different version of itself.
      # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
      done
    done
--- a/pkgs/development/compilers/llvm/14/clang/default.nix
+++ b/pkgs/development/compilers/llvm/14/clang/default.nix
@ -80,6 +80,7 @@ let
      fi
      mv $out/share/clang/*.py $python/share/clang
      rm $out/bin/c-index-test
+      patchShebangs $python/bin

      mkdir -p $dev/bin
      cp bin/clang-tblgen $dev/bin
--- a/pkgs/development/compilers/llvm/14/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/14/libcxx/default.nix
@ -62,6 +62,20 @@ stdenv.mkDerivation rec {
  buildFlags = lib.optional headersOnly "generate-cxx-headers";
  installTargets = lib.optional headersOnly "install-cxx-headers";

+  preInstall = lib.optionalString (stdenv.isDarwin && !headersOnly) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
  passthru = {
    isLLVM = true;
  };
--- a/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
@ -52,8 +52,10 @@ stdenv.mkDerivation rec {
  installPhase = if stdenv.isDarwin
    then ''
      for file in lib/*.dylib; do
+        if [ -L "$file" ]; then continue; fi
+
        # Fix up the install name. Preserve the basename, just replace the path.
-        installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+        installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"

        # this should be done in CMake, but having trouble figuring out
        # the magic combination of necessary CMake variables
@ -64,7 +66,7 @@ stdenv.mkDerivation rec {
        # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
        # libcxxabi to sometimes link against a different version of itself.
        # Here we simply make that second reference point to ourselves.
-        for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
          ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
        done
      done
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@ -77,6 +77,7 @@ let
      fi
      mv $out/share/clang/*.py $python/share/clang
      rm $out/bin/c-index-test
+      patchShebangs $python/bin

      mkdir -p $dev/bin
      cp bin/clang-tblgen $dev/bin
--- a/pkgs/development/compilers/llvm/5/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/5/libcxx/default.nix
@ -41,6 +41,20 @@ stdenv.mkDerivation {
    "-DLIBCXX_CXX_ABI=libcxxabi"
  ] ++ lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1";

+  preInstall = lib.optionalString (stdenv.isDarwin) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
  passthru = {
    isLLVM = true;
  };
--- a/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
@ -27,8 +27,10 @@ stdenv.mkDerivation {

  preInstall = lib.optionalString stdenv.isDarwin ''
    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
      # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"

      # this should be done in CMake, but having trouble figuring out
      # the magic combination of necessary CMake variables
@ -39,7 +41,7 @@ stdenv.mkDerivation {
      # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
      # libcxxabi to sometimes link against a different version of itself.
      # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
        ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
      done
    done
--- a/Show More
+++ b/Show More