Merge branch 'master' into staging-next

2024-11-22 15:03:28 +00:00 · 2023-11-16 09:49:24 +01:00 · 2023-11-16 09:49:24 +01:00 · 0fe5300699
commit 0fe5300699
parent 1181aa74bc 826934df9a
152 changed files with 2944 additions and 1775 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -11,9 +11,6 @@
 # This also holds true for GitHub teams. Since almost none of our teams have write
 # permissions, you need to list all members of the team with commit access individually.

-# This file
-/.github/CODEOWNERS @edolstra
-
 # GitHub actions
 /.github/workflows @NixOS/Security @Mic92 @zowoq
 /.github/workflows/merge-staging @FRidh
@ -22,12 +19,12 @@
 /.editorconfig @Mic92 @zowoq

 # Libraries
-/lib                        @edolstra @infinisil
+/lib                        @infinisil
 /lib/systems                @alyssais @ericson2314 @amjoseph-nixpkgs
-/lib/generators.nix         @infinisil @edolstra @Profpatsch
-/lib/cli.nix                @infinisil @edolstra @Profpatsch
-/lib/debug.nix              @infinisil @edolstra @Profpatsch
-/lib/asserts.nix            @infinisil @edolstra @Profpatsch
+/lib/generators.nix         @infinisil @Profpatsch
+/lib/cli.nix                @infinisil @Profpatsch
+/lib/debug.nix              @infinisil @Profpatsch
+/lib/asserts.nix            @infinisil @Profpatsch
 /lib/path.*                 @infinisil @fricklerhandwerk
 /lib/fileset                @infinisil
 /doc/functions/fileset.section.md @infinisil
--- a/lib/fileset/README.md
+++ b/lib/fileset/README.md
@ -238,6 +238,21 @@ Arguments:
  And it would be unclear how the library should behave if the one file wouldn't be added to the store:
  `toSource { root = ./file.nix; fileset = <empty>; }` has no reasonable result because returing an empty store path wouldn't match the file type, and there's no way to have an empty file store path, whatever that would mean.

+### `fileFilter` takes a path
+
+The `fileFilter` function takes a path, and not a file set, as its second argument.
+
+- (-) Makes it harder to compose functions, since the file set type, the return value, can't be passed to the function itself like `fileFilter predicate fileset`
+  - (+) It's still possible to use `intersection` to filter on file sets: `intersection fileset (fileFilter predicate ./.)`
+    - (-) This does need an extra `./.` argument that's not obvious
+      - (+) This could always be `/.` or the project directory, `intersection` will make it lazy
+- (+) In the future this will allow `fileFilter` to support a predicate property like `subpath` and/or `components` in a reproducible way.
+  This wouldn't be possible if it took a file set, because file sets don't have a predictable absolute path.
+  - (-) What about the base path?
+    - (+) That can change depending on which files are included, so if it's used for `fileFilter`
+      it would change the `subpath`/`components` value depending on which files are included.
+- (+) If necessary, this restriction can be relaxed later, the opposite wouldn't be possible
+
 ## To update in the future

 Here's a list of places in the library that need to be updated in the future:
--- a/lib/fileset/default.nix
+++ b/lib/fileset/default.nix
@ -366,7 +366,7 @@ in {
          type :: String,
          ...
        } -> Bool)
-        -> FileSet
+        -> Path
        -> FileSet

    Example:
@ -397,14 +397,24 @@ in {
      Other attributes may be added in the future.
    */
    predicate:
-    # The file set to filter based on the predicate function
-    fileset:
+    # The path whose files to filter
+    path:
    if ! isFunction predicate then
      throw ''
        lib.fileset.fileFilter: First argument is of type ${typeOf predicate}, but it should be a function instead.''
+    else if ! isPath path then
+      if path._type or "" == "fileset" then
+        throw ''
+          lib.fileset.fileFilter: Second argument is a file set, but it should be a path instead.
+              If you need to filter files in a file set, use `intersection fileset (fileFilter pred ./.)` instead.''
+      else
+        throw ''
+          lib.fileset.fileFilter: Second argument is of type ${typeOf path}, but it should be a path instead.''
+    else if ! pathExists path then
+      throw ''
+        lib.fileset.fileFilter: Second argument (${toString path}) is a path that does not exist.''
    else
-      _fileFilter predicate
-        (_coerce "lib.fileset.fileFilter: Second argument" fileset);
+      _fileFilter predicate path;

  /*
    The file set containing all files that are in both of two given file sets.
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@ -786,9 +786,9 @@ rec {
        _differenceTree (path + "/${name}") lhsValue (rhs.${name} or null)
      ) (_directoryEntries path lhs);

-  # Filters all files in a file set based on a predicate
-  # Type: ({ name, type, ... } -> Bool) -> FileSet -> FileSet
-  _fileFilter = predicate: fileset:
+  # Filters all files in a path based on a predicate
+  # Type: ({ name, type, ... } -> Bool) -> Path -> FileSet
+  _fileFilter = predicate: root:
    let
      # Check the predicate for a single file
      # Type: String -> String -> filesetTree
@ -807,19 +807,22 @@ rec {

      # Check the predicate for all files in a directory
      # Type: Path -> filesetTree
-      fromDir = path: tree:
-        mapAttrs (name: subtree:
-          if isAttrs subtree || subtree == "directory" then
-            fromDir (path + "/${name}") subtree
-          else if subtree == null then
-            null
+      fromDir = path:
+        mapAttrs (name: type:
+          if type == "directory" then
+            fromDir (path + "/${name}")
          else
-            fromFile name subtree
-        ) (_directoryEntries path tree);
+            fromFile name type
+        ) (readDir path);
+
+      rootType = pathType root;
    in
-    if fileset._internalIsEmptyWithoutBase then
-      _emptyWithoutBase
+    if rootType == "directory" then
+      _create root (fromDir root)
    else
-      _create fileset._internalBase
-        (fromDir fileset._internalBase fileset._internalTree);
+      # Single files are turned into a directory containing that file or nothing.
+      _create (dirOf root) {
+        ${baseNameOf root} =
+          fromFile (baseNameOf root) rootType;
+      };
 }
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@ -813,14 +813,15 @@ checkFileset 'difference ./. ./b'
 # The first argument needs to be a function
 expectFailure 'fileFilter null (abort "this is not needed")' 'lib.fileset.fileFilter: First argument is of type null, but it should be a function instead.'

-# The second argument can be a file set or an existing path
-expectFailure 'fileFilter (file: abort "this is not needed") null' 'lib.fileset.fileFilter: Second argument is of type null, but it should be a file set or a path instead.'
+# The second argument needs to be an existing path
+expectFailure 'fileFilter (file: abort "this is not needed") _emptyWithoutBase' 'lib.fileset.fileFilter: Second argument is a file set, but it should be a path instead.
+\s*If you need to filter files in a file set, use `intersection fileset \(fileFilter pred \./\.\)` instead.'
+expectFailure 'fileFilter (file: abort "this is not needed") null' 'lib.fileset.fileFilter: Second argument is of type null, but it should be a path instead.'
 expectFailure 'fileFilter (file: abort "this is not needed") ./a' 'lib.fileset.fileFilter: Second argument \('"$work"'/a\) is a path that does not exist.'

 # The predicate is not called when there's no files
 tree=()
 checkFileset 'fileFilter (file: abort "this is not needed") ./.'
-checkFileset 'fileFilter (file: abort "this is not needed") _emptyWithoutBase'

 # The predicate must be able to handle extra attributes
 touch a
@ -882,14 +883,6 @@ checkFileset 'union ./c/a (fileFilter (file: assert file.name != "a"; true) ./.)
 # but here we need to use ./c
 checkFileset 'union (fileFilter (file: assert file.name != "a"; true) ./.) ./c'

-# Also lazy, the filter isn't called on a filtered out path
-tree=(
-    [a]=1
-    [b]=0
-    [c]=0
-)
-checkFileset 'fileFilter (file: assert file.name != "c"; file.name == "a") (difference ./. ./c)'
-
 # Make sure single files are filtered correctly
 tree=(
    [a]=1
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3079,6 +3079,12 @@
    githubId = 1689801;
    name = "Mikhail Chekan";
  };
+  chen = {
+    email = "i@cuichen.cc";
+    github = "cu1ch3n";
+    githubId = 80438676;
+    name = "Chen Cui";
+  };
  ChengCat = {
    email = "yu@cheng.cat";
    github = "ChengCat";
@ -11714,6 +11720,12 @@
    githubId = 34864484;
    name = "Mikael Fangel";
  };
+  mikecm = {
+    email = "mikecmcleod@gmail.com";
+    github = "MaxwellDupre";
+    githubId = 14096356;
+    name = "Michael McLeod";
+  };
  mikefaille = {
    email = "michael@faille.io";
    github = "mikefaille";
@ -16513,6 +16525,11 @@
    githubId = 158321;
    name = "Stewart Mackenzie";
  };
+  skovati = {
+    github = "skovati";
+    githubId = 49844593;
+    name = "skovati";
+  };
  skykanin = {
    github = "skykanin";
    githubId = 3789764;
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -385,6 +385,8 @@

 - The `prayer` package as well as `services.prayer` have been removed because it's been unmaintained for several years and the author's website has vanished.

+- The `chrony` NixOS module now tracks the Real-Time Clock drift from the System Clock with `rtcfile` and automatically adjusts it with `rtcautotrim` when it exceeds the maximum error specified in `services.chrony.autotrimThreshold` (default 30 seconds). If you enabled `rtcsync` in `extraConfig`, you should remove RTC related options from `extraConfig`. If you do not want chrony configured to keep the RTC in check, you can set `services.chrony.enableRTCTrimming = false;`
+
 ## Other Notable Changes {#sec-release-23.11-notable-changes}

 - A new option `system.switch.enable` was added. By default, this is option is
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@ -9,6 +9,7 @@ let
  stateDir = cfg.directory;
  driftFile = "${stateDir}/chrony.drift";
  keyFile = "${stateDir}/chrony.keys";
+  rtcFile = "${stateDir}/chrony.rtc";

  configFile = pkgs.writeText "chrony.conf" ''
    ${concatMapStringsSep "\n" (server: "server " + server + " " + cfg.serverOption + optionalString (cfg.enableNTS) " nts") cfg.servers}
@ -20,8 +21,10 @@ let

    driftfile ${driftFile}
    keyfile ${keyFile}
+    ${optionalString (cfg.enableRTCTrimming) "rtcfile ${rtcFile}"}
    ${optionalString (cfg.enableNTS) "ntsdumpdir ${stateDir}"}

+    ${optionalString (cfg.enableRTCTrimming) "rtcautotrim ${builtins.toString cfg.autotrimThreshold}"}
    ${optionalString (!config.time.hardwareClockInLocalTime) "rtconutc"}

    ${cfg.extraConfig}
@ -85,6 +88,33 @@ in
        '';
      };

+      enableRTCTrimming = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc ''
+          Enable tracking of the RTC offset to the system clock and automatic trimming.
+          See also [](#opt-services.chrony.autotrimThreshold)
+
+          ::: {.note}
+          This is not compatible with the `rtcsync` directive, which naively syncs the RTC time every 11 minutes.
+
+          Tracking the RTC drift will allow more precise timekeeping,
+          especially on intermittently running devices, where the RTC is very relevant.
+          :::
+        '';
+      };
+
+      autotrimThreshold = mkOption {
+        type = types.ints.positive;
+        default = 30;
+        example = 10;
+        description = ''
+          Maximum estimated error threshold for the `rtcautotrim` command.
+          When reached, the RTC will be trimmed.
+          Only used when [](#opt-services.chrony.enableRTCTrimming) is enabled.
+        '';
+      };
+
      enableNTS = mkOption {
        type = types.bool;
        default = false;
@ -141,7 +171,7 @@ in
  };

  config = mkIf cfg.enable {
-    meta.maintainers = with lib.maintainers; [ thoughtpolice ];
+    meta.maintainers = with lib.maintainers; [ thoughtpolice vifino ];

    environment.systemPackages = [ chronyPkg ];

@ -156,12 +186,19 @@ in

    services.timesyncd.enable = mkForce false;

+    # If chrony controls and tracks the RTC, writing it externally causes clock error.
+    systemd.services.save-hwclock = lib.mkIf cfg.enableRTCTrimming {
+      enable = lib.mkForce false;
+    };
+
    systemd.services.systemd-timedated.environment = { SYSTEMD_TIMEDATED_NTP_SERVICES = "chronyd.service"; };

    systemd.tmpfiles.rules = [
      "d ${stateDir} 0750 chrony chrony - -"
      "f ${driftFile} 0640 chrony chrony - -"
      "f ${keyFile} 0640 chrony chrony - -"
+    ] ++ lib.optionals cfg.enableRTCTrimming [
+      "f ${rtcFile} 0640 chrony chrony - -"
    ];

    systemd.services.chronyd =
--- a/nixos/modules/services/networking/unbound.nix
+++ b/nixos/modules/services/networking/unbound.nix
@ -166,7 +166,7 @@ in {
    services.unbound.settings = {
      server = {
        directory = mkDefault cfg.stateDir;
-        username = cfg.user;
+        username = ''""'';
        chroot = ''""'';
        pidfile = ''""'';
        # when running under systemd there is no need to daemonize
@ -245,14 +245,13 @@ in {
        NotifyAccess = "main";
        Type = "notify";

-        # FIXME: Which of these do we actually need, can we drop the chroot flag?
        AmbientCapabilities = [
+          "CAP_NET_BIND_SERVICE"
+          "CAP_NET_RAW" # needed if ip-transparent is set to true
+        ];
+        CapabilityBoundingSet = [
          "CAP_NET_BIND_SERVICE"
          "CAP_NET_RAW"
-          "CAP_SETGID"
-          "CAP_SETUID"
-          "CAP_SYS_CHROOT"
-          "CAP_SYS_RESOURCE"
        ];

        User = cfg.user;
@ -266,22 +265,19 @@ in {
        ProtectControlGroups = true;
        ProtectKernelModules = true;
        ProtectSystem = "strict";
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectKernelLogs = true;
+        ProtectKernelTunables = true;
        RuntimeDirectory = "unbound";
        ConfigurationDirectory = "unbound";
        StateDirectory = "unbound";
        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_NETLINK" "AF_UNIX" ];
        RestrictRealtime = true;
        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "~@clock"
-          "@cpu-emulation"
-          "@debug"
-          "@keyring"
-          "@module"
-          "mount"
-          "@obsolete"
-          "@resources"
-        ];
+        SystemCallFilter = [ "@system-service" ];
        RestrictNamespaces = true;
        LockPersonality = true;
        RestrictSUIDSGID = true;
--- a/nixos/modules/services/networking/unifi.nix
+++ b/nixos/modules/services/networking/unifi.nix
@ -1,60 +1,61 @@
 { config, options, lib, pkgs, utils, ... }:
-with lib;
 let
  cfg = config.services.unifi;
  stateDir = "/var/lib/unifi";
-  cmd = ''
-    @${cfg.jrePackage}/bin/java java \
-        ${optionalString (lib.versionAtLeast (lib.getVersion cfg.jrePackage) "16")
-        ("--add-opens java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED "
-        + "--add-opens java.base/sun.security.util=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED "
-        + "--add-opens java.rmi/sun.rmi.transport=ALL-UNNAMED")} \
-        ${optionalString (cfg.initialJavaHeapSize != null) "-Xms${(toString cfg.initialJavaHeapSize)}m"} \
-        ${optionalString (cfg.maximumJavaHeapSize != null) "-Xmx${(toString cfg.maximumJavaHeapSize)}m"} \
-        -jar ${stateDir}/lib/ace.jar
-  '';
+  cmd = lib.escapeShellArgs ([ "@${cfg.jrePackage}/bin/java" "java" ]
+    ++ lib.optionals (lib.versionAtLeast (lib.getVersion cfg.jrePackage) "16") [
+      "--add-opens=java.base/java.lang=ALL-UNNAMED"
+      "--add-opens=java.base/java.time=ALL-UNNAMED"
+      "--add-opens=java.base/sun.security.util=ALL-UNNAMED"
+      "--add-opens=java.base/java.io=ALL-UNNAMED"
+      "--add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED"
+    ]
+    ++ (lib.optional (cfg.initialJavaHeapSize != null) "-Xms${(toString cfg.initialJavaHeapSize)}m")
+    ++ (lib.optional (cfg.maximumJavaHeapSize != null) "-Xmx${(toString cfg.maximumJavaHeapSize)}m")
+    ++ cfg.extraJvmOptions
+    ++ [ "-jar" "${stateDir}/lib/ace.jar" ]);
 in
 {

  options = {

-    services.unifi.enable = mkOption {
-      type = types.bool;
+    services.unifi.enable = lib.mkOption {
+      type = lib.types.bool;
      default = false;
      description = lib.mdDoc ''
        Whether or not to enable the unifi controller service.
      '';
    };

-    services.unifi.jrePackage = mkOption {
-      type = types.package;
+    services.unifi.jrePackage = lib.mkOption {
+      type = lib.types.package;
      default = if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.5") then pkgs.jdk17_headless else if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.3") then pkgs.jdk11 else pkgs.jre8;
-      defaultText = literalExpression ''if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.5") then pkgs.jdk17_headless else if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.3" then pkgs.jdk11 else pkgs.jre8'';
+      defaultText = lib.literalExpression ''if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.5") then pkgs.jdk17_headless else if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.3" then pkgs.jdk11 else pkgs.jre8'';
      description = lib.mdDoc ''
        The JRE package to use. Check the release notes to ensure it is supported.
      '';
    };

-    services.unifi.unifiPackage = mkOption {
-      type = types.package;
+    services.unifi.unifiPackage = lib.mkOption {
+      type = lib.types.package;
      default = pkgs.unifi5;
-      defaultText = literalExpression "pkgs.unifi5";
+      defaultText = lib.literalExpression "pkgs.unifi5";
      description = lib.mdDoc ''
        The unifi package to use.
      '';
    };

-    services.unifi.mongodbPackage = mkOption {
-      type = types.package;
+    services.unifi.mongodbPackage = lib.mkOption {
+      type = lib.types.package;
      default = pkgs.mongodb-4_4;
-      defaultText = literalExpression "pkgs.mongodb";
+      defaultText = lib.literalExpression "pkgs.mongodb";
      description = lib.mdDoc ''
        The mongodb package to use. Please note: unifi7 officially only supports mongodb up until 3.6 but works with 4.4.
      '';
    };

-    services.unifi.openFirewall = mkOption {
-      type = types.bool;
+    services.unifi.openFirewall = lib.mkOption {
+      type = lib.types.bool;
      default = false;
      description = lib.mdDoc ''
        Whether or not to open the minimum required ports on the firewall.
@ -65,8 +66,8 @@ in
      '';
    };

-    services.unifi.initialJavaHeapSize = mkOption {
-      type = types.nullOr types.int;
+    services.unifi.initialJavaHeapSize = lib.mkOption {
+      type = with lib.types; nullOr int;
      default = null;
      example = 1024;
      description = lib.mdDoc ''
@ -75,8 +76,8 @@ in
      '';
    };

-    services.unifi.maximumJavaHeapSize = mkOption {
-      type = types.nullOr types.int;
+    services.unifi.maximumJavaHeapSize = lib.mkOption {
+      type = with lib.types; nullOr int;
      default = null;
      example = 4096;
      description = lib.mdDoc ''
@ -85,9 +86,18 @@ in
      '';
    };

+    services.unifi.extraJvmOptions = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = [ ];
+      example = lib.literalExpression ''["-Xlog:gc"]'';
+      description = lib.mdDoc ''
+        Set extra options to pass to the JVM.
+      '';
+    };
+
  };

-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {

    users.users.unifi = {
      isSystemUser = true;
@ -97,7 +107,7 @@ in
    };
    users.groups.unifi = {};

-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
      # https://help.ubnt.com/hc/en-us/articles/218506997
      allowedTCPPorts = [
        8080  # Port for UAP to inform controller.
@ -123,8 +133,8 @@ in

      serviceConfig = {
        Type = "simple";
-        ExecStart = "${(removeSuffix "\n" cmd)} start";
-        ExecStop = "${(removeSuffix "\n" cmd)} stop";
+        ExecStart = "${cmd} start";
+        ExecStop = "${cmd} stop";
        Restart = "on-failure";
        TimeoutSec = "5min";
        User = "unifi";
@ -166,7 +176,7 @@ in
        StateDirectory = "unifi";
        RuntimeDirectory = "unifi";
        LogsDirectory = "unifi";
-        CacheDirectory= "unifi";
+        CacheDirectory = "unifi";

        TemporaryFileSystem = [
          # required as we want to create bind mounts below
@ -176,7 +186,7 @@ in
        # We must create the binary directories as bind mounts instead of symlinks
        # This is because the controller resolves all symlinks to absolute paths
        # to be used as the working directory.
-        BindPaths =  [
+        BindPaths = [
          "/var/log/unifi:${stateDir}/logs"
          "/run/unifi:${stateDir}/run"
          "${cfg.unifiPackage}/dl:${stateDir}/dl"
@ -194,7 +204,7 @@ in

  };
  imports = [
-    (mkRemovedOptionModule [ "services" "unifi" "dataDir" ] "You should move contents of dataDir to /var/lib/unifi/data" )
-    (mkRenamedOptionModule [ "services" "unifi" "openPorts" ] [ "services" "unifi" "openFirewall" ])
+    (lib.mkRemovedOptionModule [ "services" "unifi" "dataDir" ] "You should move contents of dataDir to /var/lib/unifi/data")
+    (lib.mkRenamedOptionModule [ "services" "unifi" "openPorts" ] [ "services" "unifi" "openFirewall" ])
  ];
 }
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@ -30,13 +30,15 @@ let
    PAPERCLIP_ROOT_PATH = "/var/lib/mastodon/public-system";
    PAPERCLIP_ROOT_URL = "/system";
    ES_ENABLED = if (cfg.elasticsearch.host != null) then "true" else "false";
-    ES_HOST = cfg.elasticsearch.host;
-    ES_PORT = toString(cfg.elasticsearch.port);

    TRUSTED_PROXY_IP = cfg.trustedProxy;
  }
  // lib.optionalAttrs (cfg.database.host != "/run/postgresql" && cfg.database.port != null) { DB_PORT = toString cfg.database.port; }
  // lib.optionalAttrs cfg.smtp.authenticate { SMTP_LOGIN  = cfg.smtp.user; }
+  // lib.optionalAttrs (cfg.elasticsearch.host != null) { ES_HOST = cfg.elasticsearch.host; }
+  // lib.optionalAttrs (cfg.elasticsearch.host != null) { ES_PORT = toString(cfg.elasticsearch.port); }
+  // lib.optionalAttrs (cfg.elasticsearch.host != null) { ES_PRESET = cfg.elasticsearch.preset; }
+  // lib.optionalAttrs (cfg.elasticsearch.user != null) { ES_USER = cfg.elasticsearch.user; }
  // cfg.extraConfig;

  systemCallsList = [ "@cpu-emulation" "@debug" "@keyring" "@ipc" "@mount" "@obsolete" "@privileged" "@setuid" ];
@ -513,6 +515,31 @@ in {
          type = lib.types.port;
          default = 9200;
        };
+
+        preset = lib.mkOption {
+          description = lib.mdDoc ''
+            It controls the ElasticSearch indices configuration (number of shards and replica).
+          '';
+          type = lib.types.enum [ "single_node_cluster" "small_cluster" "large_cluster" ];
+          default = "single_node_cluster";
+          example = "large_cluster";
+        };
+
+        user = lib.mkOption {
+          description = lib.mdDoc "Used for optionally authenticating with Elasticsearch.";
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          example = "elasticsearch-mastodon";
+        };
+
+        passwordFile = lib.mkOption {
+          description = lib.mdDoc ''
+            Path to file containing password for optionally authenticating with Elasticsearch.
+          '';
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          example = "/var/lib/mastodon/secrets/elasticsearch-password";
+        };
      };

      package = lib.mkOption {
@ -665,6 +692,8 @@ in {
        DB_PASS="$(cat ${cfg.database.passwordFile})"
      '' + lib.optionalString cfg.smtp.authenticate ''
        SMTP_PASSWORD="$(cat ${cfg.smtp.passwordFile})"
+      '' + lib.optionalString (cfg.elasticsearch.passwordFile != null) ''
+        ES_PASS="$(cat ${cfg.elasticsearch.passwordFile})"
      '' + ''
        EOF
      '';
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "reaper";
-  version = "7.03";
+  version = "7.05";

  src = fetchurl {
    url = url_for_platform version stdenv.hostPlatform.qemuArch;
    hash = {
-      x86_64-linux = "sha256-74fQXN6a3SqNZIc2MkOf2iWwP6oQToklbb3kBuaku6s=";
-      aarch64-linux = "sha256-BF7iN8NdejqwZzHTFdys422p3qoNIm20IpFuaHdUx3U=";
+      x86_64-linux = "sha256-P/PnbJPr4ErDz5ho1/dLERhqkKjdetHzKpCpfVZAYb0=";
+      aarch64-linux = "sha256-PdnBVlHwoEEv2SPq/p5oyiOlduCEqL35gAY+QIJU1Ys=";
    }.${stdenv.hostPlatform.system};
  };

--- a/pkgs/applications/editors/quartus-prime/default.nix
+++ b/pkgs/applications/editors/quartus-prime/default.nix
@ -65,8 +65,7 @@ in buildFHSEnv rec {
    progs_to_wrap=(
      "${unwrapped}"/quartus/bin/*
      "${unwrapped}"/quartus/sopc_builder/bin/qsys-{generate,edit,script}
-      # Should we install all executables?
-      "${unwrapped}"/modelsim_ase/bin/{vsim,vlog,vlib,vcom,vdel,vmap}
+      "${unwrapped}"/modelsim_ase/bin/*
      "${unwrapped}"/modelsim_ase/linuxaloem/lmutil
    )

--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -292,12 +292,12 @@
  };
  cpp = buildGrammar {
    language = "cpp";
-    version = "0.0.0+rev=a90f170";
+    version = "0.0.0+rev=d153fe1";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-cpp";
-      rev = "a90f170f92d5d70e7c2d4183c146e61ba5f3a457";
-      hash = "sha256-e9Mz84lssaPR80hlogyjXx+jA8gD8YVp4T06qC6gRVI=";
+      rev = "d153fe1c3385ee0521730ff4e0be9358e903b322";
+      hash = "sha256-zxAz82XpTtKondA84L1sO3VByo8vLI4j154pWbxlV74=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-cpp";
  };
@ -714,12 +714,12 @@
  };
  gleam = buildGrammar {
    language = "gleam";
-    version = "0.0.0+rev=3f93ccc";
+    version = "0.0.0+rev=b2afa4f";
    src = fetchFromGitHub {
      owner = "gleam-lang";
      repo = "tree-sitter-gleam";
-      rev = "3f93cccaf278cc4c9cf9a373ea2f6389174d634c";
-      hash = "sha256-TjyAaxEtGVjnBdcw1uyeQhotNhZlQKvN1SgbZwKvm3M=";
+      rev = "b2afa4fd6bb41a7bf912b034c653c90af7ae5122";
+      hash = "sha256-Z1wutK2NyI5EMwTezeZp/g8JFD0p7kqBGCuh9Amyjgo=";
    };
    meta.homepage = "https://github.com/gleam-lang/tree-sitter-gleam";
  };
@ -901,12 +901,12 @@
  };
  hcl = buildGrammar {
    language = "hcl";
-    version = "0.0.0+rev=b553906";
+    version = "0.0.0+rev=fdf6463";
    src = fetchFromGitHub {
      owner = "MichaHoffmann";
      repo = "tree-sitter-hcl";
-      rev = "b5539065432c08e4118eb3ee7c94902fdda85708";
-      hash = "sha256-okLwoDGgK6aM5+8oelfRnuKqIimTs8Hc0N8Ikrm2eY0=";
+      rev = "fdf6463216f1a45d83ba911cdb9f57445a8d3b51";
+      hash = "sha256-UEjC3PeTQCvbtfk4a0EaLh+DXraUQIaSUGU6vszYP3E=";
    };
    meta.homepage = "https://github.com/MichaHoffmann/tree-sitter-hcl";
  };
@ -934,12 +934,12 @@
  };
  hlsl = buildGrammar {
    language = "hlsl";
-    version = "0.0.0+rev=f2902bd";
+    version = "0.0.0+rev=ac65c93";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-hlsl";
-      rev = "f2902bd614e3916bdf65e1bc9ad45ebd08417bba";
-      hash = "sha256-tuie4Yzauejf+5Par2qnWfaQgOLhROL2le1+UTq5cSY=";
+      rev = "ac65c934b3214e96e0f854be009a3bd51549bd14";
+      hash = "sha256-rTBal4RBOFBKfb9cydvWH+JtCCMOlnnGMPb2X7LXRjE=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
  };
@ -1011,12 +1011,12 @@
  };
  ini = buildGrammar {
    language = "ini";
-    version = "0.0.0+rev=7f11a02";
+    version = "0.0.0+rev=bcb84a2";
    src = fetchFromGitHub {
      owner = "justinmk";
      repo = "tree-sitter-ini";
-      rev = "7f11a02fb8891482068e0fe419965d7bade81a68";
-      hash = "sha256-IIpKzpA4q1jpYVZ75VZaxWHaqNt8TA427eMOui2s71M=";
+      rev = "bcb84a2d4bcd6f55b911c42deade75c8f90cb0c5";
+      hash = "sha256-dYPeVTNWO4apY5dsjsKViavU7YtLeGTp6BzEemXhsEU=";
    };
    meta.homepage = "https://github.com/justinmk/tree-sitter-ini";
  };
@ -1220,12 +1220,12 @@
  };
  leo = buildGrammar {
    language = "leo";
-    version = "0.0.0+rev=91d7aa6";
+    version = "0.0.0+rev=23a9534";
    src = fetchFromGitHub {
      owner = "r001";
      repo = "tree-sitter-leo";
-      rev = "91d7aa606f524cf4f5df7f4aacb45b4056fac704";
-      hash = "sha256-8nea6Qg0eT5ciif+tzD13TcFqP9/uJVxgVSW93OdiVY=";
+      rev = "23a9534d09d523d0dcee7dbf89e7c819e6835f6f";
+      hash = "sha256-21Vqvc3HjmKi1FRKyswMcf8rPjkyAbjTayDYMsTUsBg=";
    };
    meta.homepage = "https://github.com/r001/tree-sitter-leo";
  };
@ -1319,24 +1319,24 @@
  };
  markdown = buildGrammar {
    language = "markdown";
-    version = "0.0.0+rev=7ce4c69";
+    version = "0.0.0+rev=f9820b2";
    src = fetchFromGitHub {
      owner = "MDeiml";
      repo = "tree-sitter-markdown";
-      rev = "7ce4c69fe92d1c10225e3d1b3676c87dd9427b45";
-      hash = "sha256-UxpTkiRChAwNJBVS9y/lydI8R035EuRy3t39Y1mscq0=";
+      rev = "f9820b2db958228f9be339b67d2de874d065866e";
+      hash = "sha256-0T0P018Zb4tfU2D4PLhiW8tunOInlRtrHajPOVqOpwc=";
    };
    location = "tree-sitter-markdown";
    meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
  };
  markdown_inline = buildGrammar {
    language = "markdown_inline";
-    version = "0.0.0+rev=7ce4c69";
+    version = "0.0.0+rev=f9820b2";
    src = fetchFromGitHub {
      owner = "MDeiml";
      repo = "tree-sitter-markdown";
-      rev = "7ce4c69fe92d1c10225e3d1b3676c87dd9427b45";
-      hash = "sha256-UxpTkiRChAwNJBVS9y/lydI8R035EuRy3t39Y1mscq0=";
+      rev = "f9820b2db958228f9be339b67d2de874d065866e";
+      hash = "sha256-0T0P018Zb4tfU2D4PLhiW8tunOInlRtrHajPOVqOpwc=";
    };
    location = "tree-sitter-markdown-inline";
    meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
@ -1498,12 +1498,12 @@
  };
  objdump = buildGrammar {
    language = "objdump";
-    version = "0.0.0+rev=64e4741";
+    version = "0.0.0+rev=28d3b2e";
    src = fetchFromGitHub {
      owner = "ColinKennedy";
      repo = "tree-sitter-objdump";
-      rev = "64e4741d58345c36ded639f5a3bcd7811be7f8f8";
-      hash = "sha256-v5skJKQ/c0YeGVj3Vs+SNnFqTkp0mblZU4DyJ9hg7s4=";
+      rev = "28d3b2e25a0b1881d1b47ed1924ca276c7003d45";
+      hash = "sha256-OPqIhgItghXplQ78Vlwd0G6KtDWTVkaG17RPqx1b5JY=";
    };
    meta.homepage = "https://github.com/ColinKennedy/tree-sitter-objdump";
  };
@ -1766,12 +1766,12 @@
  };
  purescript = buildGrammar {
    language = "purescript";
-    version = "0.0.0+rev=5ef5592";
+    version = "0.0.0+rev=f89bd14";
    src = fetchFromGitHub {
      owner = "postsolar";
      repo = "tree-sitter-purescript";
-      rev = "5ef5592674ea42de75fc2792972e4ea0b6e3da6c";
-      hash = "sha256-V9cuENH/tpXt9mfZqJ2v4dxJvbwEHU8Ri+UxQafWemY=";
+      rev = "f89bd149e44624342bf49f76245d3284f2beed9a";
+      hash = "sha256-c4Zux+6kg9b9/0t9LOtfSdMMQbp1xwiQH8dz4BBB/pY=";
    };
    meta.homepage = "https://github.com/postsolar/tree-sitter-purescript";
  };
@ -2121,12 +2121,12 @@
  };
  sql = buildGrammar {
    language = "sql";
-    version = "0.0.0+rev=5f928f4";
+    version = "0.0.0+rev=9fe5aea";
    src = fetchFromGitHub {
      owner = "derekstride";
      repo = "tree-sitter-sql";
-      rev = "5f928f404d2aa024abce8657778fc10c03f1511f";
-      hash = "sha256-7W6vuaZjDZgoaxJexPPBjJZlutlTT+hTFL1dq9k2NSo=";
+      rev = "9fe5aeaa8d58d00cc31c20a3ae923ae695ce2ce7";
+      hash = "sha256-HnSZGrxrHlARPhgTJRO6P0FcmjOdB3c5eMpH9+5ZaX8=";
    };
    meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
  };
@ -2277,12 +2277,12 @@
  };
  terraform = buildGrammar {
    language = "terraform";
-    version = "0.0.0+rev=b553906";
+    version = "0.0.0+rev=fdf6463";
    src = fetchFromGitHub {
      owner = "MichaHoffmann";
      repo = "tree-sitter-hcl";
-      rev = "b5539065432c08e4118eb3ee7c94902fdda85708";
-      hash = "sha256-okLwoDGgK6aM5+8oelfRnuKqIimTs8Hc0N8Ikrm2eY0=";
+      rev = "fdf6463216f1a45d83ba911cdb9f57445a8d3b51";
+      hash = "sha256-UEjC3PeTQCvbtfk4a0EaLh+DXraUQIaSUGU6vszYP3E=";
    };
    location = "dialects/terraform";
    meta.homepage = "https://github.com/MichaHoffmann/tree-sitter-hcl";
@ -2322,12 +2322,12 @@
  };
  tlaplus = buildGrammar {
    language = "tlaplus";
-    version = "0.0.0+rev=204e858";
+    version = "0.0.0+rev=d99cb5c";
    src = fetchFromGitHub {
      owner = "tlaplus-community";
      repo = "tree-sitter-tlaplus";
-      rev = "204e858899f7dd5713dea7b0148d6aa477d4a18f";
-      hash = "sha256-AzCXFr6YAmbmEiBEN6MI+MeBDoEDrJB2vcZl/OEUqmg=";
+      rev = "d99cb5c77bb0e733176d607a0875ac30e17e1e72";
+      hash = "sha256-ShZlFHokmy3hhfTeh+/anz7a2bGDwWAdWIdi3X/lchQ=";
    };
    meta.homepage = "https://github.com/tlaplus-community/tree-sitter-tlaplus";
  };
@ -2580,12 +2580,12 @@
  };
  wing = buildGrammar {
    language = "wing";
-    version = "0.0.0+rev=238200d";
+    version = "0.0.0+rev=eacf704";
    src = fetchFromGitHub {
      owner = "winglang";
      repo = "wing";
-      rev = "238200d172538d5ff1228a929ea543465acfc410";
-      hash = "sha256-a/8lbO8/+XhD3i6hjAxCA1rpovlkVHnDxz8xkc3bPoY=";
+      rev = "eacf704338661b981fcf4fdb5ee44d898f038144";
+      hash = "sha256-JwA49Up2G2/jobjqniQeJ1Rfko3PFfgINRvi/QswlCk=";
    };
    location = "libs/tree-sitter-wing";
    generate = true;
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -999,7 +999,7 @@ self: super: {
        pname = "sg-nvim-rust";
        inherit (old) version src;

-        cargoHash = "sha256-Rqs9INcc53SYGXHRyeTbLkGGU035i2i6n6A4ekFKve0=";
+        cargoHash = "sha256-ITrjY15Haz8hEztWym4q8YW2h0R8/kOYPaIYJu87sN4=";

        nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/editors/vim/plugins/patches/coq_nvim/emulate-venv.patch
+++ b/pkgs/applications/editors/vim/plugins/patches/coq_nvim/emulate-venv.patch
@ -1,15 +1,15 @@
 diff --git a/coq/__main__.py b/coq/__main__.py
-index 5a6c6fd2..e0d9eec8 100644
+index dd40afc1..36bcca21 100644
 --- a/coq/__main__.py
 +++ b/coq/__main__.py
@@ -78,7 +78,7 @@ _EXEC_PATH = Path(executable)
 _EXEC_PATH = _EXEC_PATH.parent.resolve(strict=True) / _EXEC_PATH.name
 _REQ = REQUIREMENTS.read_text()
-
+ 
 -_IN_VENV = _RT_PY == _EXEC_PATH
 +_IN_VENV = True
-
-
+ 
+ 
 if command == "deps":
@@ -152,7 +152,7 @@ elif command == "run":
     try:
@ -21,15 +21,15 @@ index 5a6c6fd2..e0d9eec8 100644
         else:
             import pynvim_pp
 diff --git a/coq/consts.py b/coq/consts.py
-index 5a027fe9..a3e0c5a4 100644
+index 804e92ab..5c090a93 100644
 --- a/coq/consts.py
 +++ b/coq/consts.py
-@@ -9,7 +9,7 @@ TOP_LEVEL = Path(__file__).resolve(strict=True).parent.parent
+@@ -10,7 +10,7 @@ TOP_LEVEL = Path(__file__).resolve(strict=True).parent.parent
 REQUIREMENTS = TOP_LEVEL / "requirements.txt"
-
-
+ 
+ 
 -VARS = TOP_LEVEL / ".vars"
 +VARS = Path.home() / ".cache/coq_nvim/vars"
-
+ 
 RT_DIR = VARS / "runtime"
 RT_PY = RT_DIR / "Scripts" / "python.exe" if IS_WIN else RT_DIR / "bin" / "python3"
--- a/pkgs/applications/editors/vim/plugins/vim-clap/Cargo.lock
+++ b/pkgs/applications/editors/vim/plugins/vim-clap/Cargo.lock
@ -149,6 +149,15 @@ version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "604178f6c5c21f02dc555784810edfb88d34ac2c73b2eae109655649ee73ce3d"

+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@ -200,6 +209,15 @@ version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"

+[[package]]
+name = "camino"
+version = "1.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c59e92b5a388f549b863a7bea62612c09f24c8393560709a54558a9abdfb3b9c"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "cargo-lock"
 version = "9.0.0"
@ -212,6 +230,29 @@ dependencies = [
 "url",
 ]

+[[package]]
+name = "cargo-platform"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cfa25e60aea747ec7e1124f238816749faa93759c6ff5b31f1ccdda137f4479"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cargo_metadata"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb9ac64500cc83ce4b9f8dafa78186aa008c8dea77a09b94cd307fd0cd5022a8"
+dependencies = [
+ "camino",
+ "cargo-platform",
+ "semver",
+ "serde",
+ "serde_json",
+ "thiserror",
+]
+
 [[package]]
 name = "cc"
 version = "1.0.83"
@ -360,6 +401,12 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"

+[[package]]
+name = "colorsys"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54261aba646433cb567ec89844be4c4825ca92a4f8afba52fc4dd88436e31bbd"
+
 [[package]]
 name = "combine"
 version = "4.6.6"
@ -398,6 +445,15 @@ version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"

+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "crossbeam-channel"
 version = "0.5.8"
@ -441,6 +497,41 @@ dependencies = [
 "cfg-if",
 ]

+[[package]]
+name = "darling"
+version = "0.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0209d94da627ab5605dcccf08bb18afa5009cfbef48d8a8b7d7bdbc79be25c5e"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "177e3443818124b357d8e76f53be906d60937f0d3a90773a664fa63fa253e621"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "836a9bbc7ad63342d6d6e7b815ccab164bc77a2d95d84bc3117a8c0d5c98e2d5"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "deranged"
 version = "0.3.8"
@ -571,6 +662,16 @@ dependencies = [
 "utils",
 ]

+[[package]]
+name = "flate2"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@ -809,6 +910,20 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"

+[[package]]
+name = "highlighter"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "colorsys",
+ "once_cell",
+ "rgb2ansi256",
+ "serde",
+ "syntect",
+ "tracing",
+ "utils",
+]
+
 [[package]]
 name = "home"
 version = "0.5.5"
@ -922,6 +1037,12 @@ dependencies = [
 "serde_json",
 ]

+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
 [[package]]
 name = "idna"
 version = "0.4.0"
@ -1095,6 +1216,37 @@ dependencies = [
 "vcpkg",
 ]

+[[package]]
+name = "line-wrap"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f30344350a2a51da54c1d53be93fade8a237e545dbcc4bdbe635413f2117cab9"
+dependencies = [
+ "safemem",
+]
+
+[[package]]
+name = "linked-hash-map"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
+
+[[package]]
+name = "linter"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "cargo_metadata",
+ "once_cell",
+ "parking_lot",
+ "paths",
+ "regex",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.5"
@ -1128,7 +1280,7 @@ dependencies = [

 [[package]]
 name = "maple"
-version = "0.1.46"
+version = "0.1.47"
 dependencies = [
 "built",
 "chrono",
@ -1156,9 +1308,12 @@ dependencies = [
 "futures",
 "grep-matcher",
 "grep-searcher",
+ "highlighter",
 "icon",
 "ignore",
 "itertools",
+ "linter",
+ "maple_derive",
 "matcher",
 "once_cell",
 "parking_lot",
@ -1180,6 +1335,18 @@ dependencies = [
 "webbrowser",
 ]

+[[package]]
+name = "maple_derive"
+version = "0.1.0"
+dependencies = [
+ "darling",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "types",
+]
+
 [[package]]
 name = "matcher"
 version = "0.1.0"
@ -1195,9 +1362,9 @@ dependencies = [

 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"

 [[package]]
 name = "memmap2"
@ -1308,6 +1475,28 @@ version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"

+[[package]]
+name = "onig"
+version = "6.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c4b31c8722ad9171c6d77d3557db078cab2bd50afcc9d09c8b315c59df8ca4f"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+ "once_cell",
+ "onig_sys",
+]
+
+[[package]]
+name = "onig_sys"
+version = "69.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b829e3d7e9cc74c7e315ee8edb185bf4190da5acde74afd7fc59c35b1f086e7"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
 [[package]]
 name = "overload"
 version = "0.1.1"
@ -1384,6 +1573,20 @@ version = "0.3.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"

+[[package]]
+name = "plist"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdc0001cfea3db57a2e24bc0d818e9e20e554b5f97fabb9bc231dc240269ae06"
+dependencies = [
+ "base64 0.21.2",
+ "indexmap 1.9.3",
+ "line-wrap",
+ "quick-xml",
+ "serde",
+ "time 0.3.27",
+]
+
 [[package]]
 name = "printer"
 version = "0.1.0"
@ -1406,6 +1609,15 @@ dependencies = [
 "unicode-ident",
 ]

+[[package]]
+name = "quick-xml"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81b9228215d82c7b61490fec1de287136b5de6f5700f6e58ea9ad61a7964ca51"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.33"
@ -1474,25 +1686,25 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.9.3"
+version = "1.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81bc1d4caf89fac26a70747fe603c130093b53c773888797a6329091246d651a"
+checksum = "697061221ea1b4a94a624f67d0ae2bfe4e22b8a17b6a192afb11046542cc8c47"
 dependencies = [
 "aho-corasick 1.0.4",
 "memchr",
 "regex-automata",
- "regex-syntax 0.7.4",
+ "regex-syntax 0.7.5",
 ]

 [[package]]
 name = "regex-automata"
-version = "0.3.6"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed1ceff11a1dddaee50c9dc8e4938bd106e9d89ae372f192311e7da498e3b69"
+checksum = "c2f401f4955220693b56f8ec66ee9c78abffd8d1c4f23dc41a23839eb88f0795"
 dependencies = [
 "aho-corasick 1.0.4",
 "memchr",
- "regex-syntax 0.7.4",
+ "regex-syntax 0.7.5",
 ]

 [[package]]
@ -1503,9 +1715,9 @@ checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"

 [[package]]
 name = "regex-syntax"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5ea92a5b6195c6ef2a0295ea818b312502c6fc94dde986c5553242e18fd4ce2"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"

 [[package]]
 name = "reqwest"
@ -1546,6 +1758,12 @@ dependencies = [
 "winreg",
 ]

+[[package]]
+name = "rgb2ansi256"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebca96b1c05912d531790498048bab5b7b97a756a7bb9df71fa4ef7ef9814e1"
+
 [[package]]
 name = "ring"
 version = "0.16.20"
@ -1627,6 +1845,12 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"

+[[package]]
+name = "safemem"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef703b7cb59335eae2eb93ceb664c0eb7ea6bf567079d843e09420219668e072"
+
 [[package]]
 name = "same-file"
 version = "1.0.6"
@ -1804,6 +2028,27 @@ dependencies = [
 "unicode-ident",
 ]

+[[package]]
+name = "syntect"
+version = "5.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e02b4b303bf8d08bfeb0445cba5068a3d306b6baece1d5582171a9bf49188f91"
+dependencies = [
+ "bincode",
+ "bitflags 1.3.2",
+ "flate2",
+ "fnv",
+ "once_cell",
+ "onig",
+ "plist",
+ "regex-syntax 0.7.5",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "walkdir",
+ "yaml-rust",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.47"
@ -2486,3 +2731,12 @@ dependencies = [
 "cfg-if",
 "windows-sys 0.48.0",
 ]
+
+[[package]]
+name = "yaml-rust"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
+dependencies = [
+ "linked-hash-map",
+]
--- a/pkgs/applications/editors/vim/plugins/vim-clap/default.nix
+++ b/pkgs/applications/editors/vim/plugins/vim-clap/default.nix
@ -11,13 +11,13 @@
 }:

 let
-  version = "0.46";
+  version = "0.47";

  src = fetchFromGitHub {
    owner = "liuchengxu";
    repo = "vim-clap";
    rev = "v${version}";
-    hash = "sha256-KWBuoZ2GxjwIu7L1PPq/7u3iuYFp5QrlsleL2RQTdUE=";
+    hash = "sha256-CYv5AZsGvN2dtN7t58b50a8PH7804Lnm4d4wAX6Mm5Q=";
  };

  meta = with lib; {
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -15,11 +15,11 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1v2lcbmb0g3pw58mmiqd2j9c7r7dcl371nxc6w9rsmcbf7s0f8h0";
-    x86_64-darwin = "11if8l556rsvacwbsknv2hnqfwkad99klgnwx4kjcbm8g63ra3ab";
-    aarch64-linux = "1fmahjn99cvylm8r4cf4b1654gyyk6n6mqad1l0cncpypdxc2pdw";
-    aarch64-darwin = "053jnxpkpfh5a8nfx557ib6byhi4dd1dnxasp4igy59cbx25an9q";
-    armv7l-linux = "0qc48mg34pkr23p3wnlczvfspfii3qn6ikbkgj1qsagxn9ycqjak";
+    x86_64-linux = "1h2s90h1a4b4r9rqafd5fj95mx21xqlp3msv8fxfjd2kkfl8bdcl";
+    x86_64-darwin = "1cprq4cy01cmyqrvv5p9f09k7h5p4nj9jbk4lrlnyj1z2xvhcls1";
+    aarch64-linux = "0g9j14vnan10r014309s6mdkizjfpbd83bf1kxx2kk625n87xszc";
+    aarch64-darwin = "10rw2dy3khpxa292zygxi67amxd6s351ha8nxvav5m9xfxlgd2qn";
+    armv7l-linux = "0bw0hfhvwv7wbh2daxgxaxm34v5z5ak4nmmk45ksxc4xsmjc5v23";
  }.${system} or throwSystem;

  sourceRoot = lib.optionalString (!stdenv.isDarwin) ".";
@ -29,7 +29,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.84.2.23314";
+    version = "1.84.2.23317";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@ -12,14 +12,14 @@

 python3Packages.buildPythonPackage rec {
  pname = "hydrus";
-  version = "549";
+  version = "551";
  format = "other";

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
    rev = "refs/tags/v${version}";
-    hash = "sha256-y3WFQhPE8H0198Xu3Dn9YAqaX8YvFJcdt90tebTg7qw=";
+    hash = "sha256-P/U44ndfucbRnwGLdSnnA0VE4K40zPz3wtNpQj8rh5Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/texturepacker/default.nix
+++ b/pkgs/applications/graphics/texturepacker/default.nix
@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, fetchurl
+, dpkg
+, autoPatchelfHook
+, wrapQtAppsHook
+, qtbase
+, qtdeclarative
+, qtsvg
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "texturepacker";
+  version = "7.1.0";
+
+  src = fetchurl {
+    url = "https://www.codeandweb.com/download/texturepacker/${finalAttrs.version}/TexturePacker-${finalAttrs.version}.deb";
+    hash = "sha256-9HbmdMPTp6qZCEU/lIZv4HbjKUlEtPVval+y0tiYObc=";
+  };
+
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qtbase
+    qtdeclarative
+    qtsvg
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin $out/lib
+    cp usr/lib/texturepacker/{libGrantlee_Templates.so.5,libHQX.so.1.0.0,libPVRTexLib.so} $out/lib
+    cp usr/lib/texturepacker/TexturePacker $out/bin
+    cp -r usr/share $out
+  '';
+
+  meta = {
+    changelog = "https://www.codeandweb.com/texturepacker/download";
+    description = "Sprite sheet creator and game graphics optimizer";
+    homepage = "https://www.codeandweb.com/texturepacker";
+    license = lib.licenses.unfree;
+    mainProgram = "TexturePacker";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -92,11 +92,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.59.124";
+  version = "1.60.118";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-uY9i0TxTsSvOfMA98amxwWpQh1nsRVEgxeSZ2sv8NEU=";
+    sha256 = "sha256-Lo9F7z8gJJRId7LBfVTj18C65swDr8C7Mt1gNmXoSoY=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "helmfile";
-  version = "0.158.0";
+  version = "0.158.1";

  src = fetchFromGitHub {
    owner = "helmfile";
    repo = "helmfile";
    rev = "v${version}";
-    sha256 = "sha256-768rlhkh8scQbzLvWyjyQSba4zCY/ydYreve+HmcFgw=";
+    sha256 = "sha256-ohf8MUUTZ3YNon12QpSRE80RaHvWsbrZk/slgEVbgoo=";
  };

-  vendorHash = "sha256-ip01Uj720Sa11ni+8//U1PkHgiY6ttftvMHdxZgfKLk=";
+  vendorHash = "sha256-rA8egwzvvhArQboWpH2ZZTSJGTyzHUIl6aLusPfr8tw=";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/kube-router/default.nix
+++ b/pkgs/applications/networking/cluster/kube-router/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kube-router";
-  version = "2.0.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "cloudnativelabs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-7laXw0tC25zPTeLJlB/rX6WVcRFCd6DCB+3EUPnE4cM=";
+    hash = "sha256-Iwo+I1EfclkF4FL8QM3xGkIFxakmelI+hSUepLwfFSw=";
  };

-  vendorHash = "sha256-qJA6gnb+VIkJD24iq6yyn8r4zYY19ZywcyalwfaTtbo=";
+  vendorHash = "sha256-VjPesQ27GcwnFQrNI+VYzJ4/aahcjASbfMi//Zs/KLM=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/cluster/stern/default.nix
+++ b/pkgs/applications/networking/cluster/stern/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "stern";
-  version = "1.26.0";
+  version = "1.27.0";

  src = fetchFromGitHub {
    owner = "stern";
    repo = "stern";
    rev = "v${version}";
-    sha256 = "sha256-86XoYzw1bnIWwGiFgRl9RcZSYrF4byYKnDlJ4QSqXV0=";
+    sha256 = "sha256-W8jGUs63R6QpwuTgzK5yVLhKGXypvKOyCWHT2xdb6eM=";
  };

  vendorHash = "sha256-LLVd9WB8ixH78CHYe0sS4sCDCD+6SQ7PxWr2MHiAOxI=";
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "talosctl";
-  version = "1.5.4";
+  version = "1.5.5";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "talos";
    rev = "v${version}";
-    hash = "sha256-l0cR5BDUREBOOac/b87re5lzq3maz8Tg3msalXV6zAs=";
+    hash = "sha256-15sNXiJ/s3MlrXFXPxA7mQ+/36HRSZF6XKos6XEHi1Y=";
  };

-  vendorHash = "sha256-/l0crKz1Pks2yiQ+t/rY2ZxB+jYCymSfoILtHYtQ7K8=";
+  vendorHash = "sha256-fGl16Wsb1tW9+wZBg5yY73t7n+EJ1dVx5IlzY2B8PJA=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@ -46,6 +46,8 @@ let
          name = "source-${rev}";
          inherit owner repo rev hash;
        };
+        # nixpkgs-update: no auto update
+        # easier to update all providers together

        meta = {
          inherit homepage;
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -167,9 +167,9 @@ rec {
  mkTerraform = attrs: pluggable (generic attrs);

  terraform_1 = mkTerraform {
-    version = "1.6.3";
-    hash = "sha256-2ai0WAknz4rt33BuBoqnTCsfPNHmet9+PdgYeeJKQkQ=";
-    vendorHash = "sha256-ZtaXUX0PgL1nwXgohcfCyj/fLPAodx8amHEsQnlOQrc=";
+    version = "1.6.4";
+    hash = "sha256-kA0H+JxyMV6RKRr20enTOzfwj2Lk2IP4vivfHv02+w8=";
+    vendorHash = "sha256-cxnvEwtZLXYZzCITJgYk8hDRndLLC8YTD+RvgcNska0=";
    patches = [ ./provider-path-0_15.patch ];
    passthru = {
      inherit plugins;
--- a/pkgs/applications/networking/cluster/weave-gitops/default.nix
+++ b/pkgs/applications/networking/cluster/weave-gitops/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "weave-gitops";
-  version = "0.34.0";
+  version = "0.35.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-W7Q5rsmNEDUGofQumbs9HaByQEb7sj4tOT7ZpIe98E4=";
+    sha256 = "sha256-H/l/b6yPoNZeBG1TPc9PCBpZg4ETnF9FmYnbRmKl8c8=";
  };

  ldflags = [ "-s" "-w" "-X github.com/weaveworks/weave-gitops/cmd/gitops/version.Version=${version}" ];

-  vendorHash = "sha256-+UxrhtwYP+ctn+y7IxKKLO5RVoiUSl4ky0xprXr98Jc=";
+  vendorHash = "sha256-le34zvlgquxOv0xdOPfpf7/ZuoPd9MEfp8Gshigvtas=";

  subPackages = [ "cmd/gitops" ];

--- a/pkgs/applications/networking/gmailctl/default.nix
+++ b/pkgs/applications/networking/gmailctl/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "gmailctl";
-  version = "0.10.6";
+  version = "0.10.7";

  src = fetchFromGitHub {
    owner = "mbrt";
    repo = "gmailctl";
    rev = "v${version}";
-    sha256 = "sha256-OpRkBHNWRrBhh6nGrV7dZT01xsSlbANCk+g7b8SidG0=";
+    hash = "sha256-OpRkBHNWRrBhh6nGrV7dZT01xsSlbANCk+g7b8SidG0=";
  };

  vendorHash = "sha256-+r0WHrKARcxW1hUY1HwAXk0X6ZQrbgBj9+GjIJV5DS0=";
--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@ -12,25 +12,25 @@ in {

  guiStable = mkGui {
    channel = "stable";
-    version = "2.2.43";
-    hash = "sha256-+2dcyWnTJqGaH9yhknYc9/0gnj3qh80eAy6uxG7+fFM=";
+    version = "2.2.44.1";
+    hash = "sha256-Ae1Yij81/rhZOMMfLYaQKR4Dxx1gDGZBpBj0gLCSToI=";
  };

  guiPreview = mkGui {
    channel = "stable";
-    version = "2.2.43";
-    hash = "sha256-+2dcyWnTJqGaH9yhknYc9/0gnj3qh80eAy6uxG7+fFM=";
+    version = "2.2.44.1";
+    hash = "sha256-Ae1Yij81/rhZOMMfLYaQKR4Dxx1gDGZBpBj0gLCSToI=";
  };

  serverStable = mkServer {
    channel = "stable";
-    version = "2.2.43";
-    hash = "sha256-xWt2qzeqBtt86Wv3dYl4GXkfjr+7WAKn5HdDeUzOQd8=";
+    version = "2.2.44.1";
+    hash = "sha256-YtYXTEZj5009L8OU7jdhegYu5Xll3jZAW6NJFWOvxHQ=";
  };

  serverPreview = mkServer {
    channel = "stable";
-    version = "2.2.43";
-    hash = "sha256-xWt2qzeqBtt86Wv3dYl4GXkfjr+7WAKn5HdDeUzOQd8=";
+    version = "2.2.44.1";
+    hash = "sha256-YtYXTEZj5009L8OU7jdhegYu5Xll3jZAW6NJFWOvxHQ=";
  };
 }
--- a/pkgs/applications/networking/gns3/gui.nix
+++ b/pkgs/applications/networking/gns3/gui.nix
@ -8,6 +8,8 @@
 , fetchFromGitHub
 , qt5
 , wrapQtAppsHook
+, testers
+, gns3-gui
 }:

 python3.pkgs.buildPythonApplication rec {
@ -56,6 +58,11 @@ python3.pkgs.buildPythonApplication rec {
    export QT_QPA_PLATFORM=offscreen
  '';

+  passthru.tests.version = testers.testVersion {
+    package = gns3-gui;
+    command = "${lib.getExe gns3-gui} --version";
+  };
+
  meta = with lib; {
    description = "Graphical Network Simulator 3 GUI (${channel} release)";
    longDescription = ''
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@ -8,6 +8,8 @@
 , fetchFromGitHub
 , pkgsStatic
 , stdenv
+, testers
+, gns3-server
 }:

 python3.pkgs.buildPythonApplication {
@ -32,7 +34,6 @@ python3.pkgs.buildPythonApplication {
    aiohttp-cors
    async-generator
    distro
-    importlib-resources
    jinja2
    jsonschema
    multidict
@ -45,6 +46,8 @@ python3.pkgs.buildPythonApplication {
    truststore
    yarl
    zipstream
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    importlib-resources
  ];

  postInstall = lib.optionalString (!stdenv.hostPlatform.isWindows) ''
@ -72,6 +75,11 @@ python3.pkgs.buildPythonApplication {
    "--reruns 3"
  ];

+  passthru.tests.version = testers.testVersion {
+    package = gns3-server;
+    command = "${lib.getExe gns3-server} --version";
+  };
+
  meta = with lib; {
    description = "Graphical Network Simulator 3 server (${channel} release)";
    longDescription = ''
@ -84,5 +92,6 @@ python3.pkgs.buildPythonApplication {
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    maintainers = with maintainers; [ anthonyroussel ];
+    mainProgram = "gns3server";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@ -15,6 +15,8 @@
 , sqlcipher
 , stdenv
 , CoreServices
+, testers
+, deltachat-desktop
 }:

 let
@ -33,16 +35,16 @@ let
 in
 buildNpmPackage rec {
  pname = "deltachat-desktop";
-  version = "unstable-2023-11-03";
+  version = "1.41.1";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-desktop";
-    rev = "40152e9543eb773fc27e7a4f96ef1eecebe9310e";
-    hash = "sha256-9GPXFUCu9GKa/bJgO8CIPMLccI6WAJ6PhfoyJ6s/DHE=";
+    rev = "v${version}";
+    hash = "sha256-ITcBIm47OiGy/i6jnG6r1OoStjRPystOts6ViLioLNY=";
  };

-  npmDepsHash = "sha256-g3nkgqZNoq+xuwXbXLHEMVpHH6Sq3792xhITCx7WvOc=";
+  npmDepsHash = "sha256-+t6m2kDUOh6kIkbZgol/CQciDTxUZSkTr1amPywrMb4=";

  nativeBuildInputs = [
    makeWrapper
@ -116,6 +118,12 @@ buildNpmPackage rec {
    ];
  });

+  passthru.tests = {
+    version = testers.testVersion {
+      package = deltachat-desktop;
+    };
+  };
+
  meta = with lib; {
    description = "Email-based instant messaging for Desktop";
    homepage = "https://github.com/deltachat/deltachat-desktop";
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@ -19,18 +19,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "teams-for-linux";
-  version = "1.3.18";
+  version = "1.3.19";

  src = fetchFromGitHub {
    owner = "IsmaelMartinez";
    repo = "teams-for-linux";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-evOwjHUmeGw8AUpXSig8zVW2cpJbWkNTH/RUuNipFsQ=";
+    hash = "sha256-+n26VTNRymPdzMbSz8AZsQ73xOHizOFAstw6toKfZQM=";
  };

  offlineCache = fetchYarnDeps {
    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-tMC8/qHYli7+OTdxVWRDEyCNzrkYA+zKlHJXlTsl+W0=";
+    hash = "sha256-SxUdTzk8WngkKwT05U8HJsK8+8ezcJWdiT/ettxpeEE=";
  };

  nativeBuildInputs = [ yarn fixup_yarn_lock nodejs copyDesktopItems makeWrapper ];
@ -102,7 +102,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Unofficial Microsoft Teams client for Linux";
    homepage = "https://github.com/IsmaelMartinez/teams-for-linux";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ muscaln lilyinstarlight qjoly ];
+    maintainers = with lib.maintainers; [ muscaln lilyinstarlight qjoly chvp ];
    platforms = lib.platforms.unix;
    broken = stdenv.isDarwin;
  };
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "picard-tools";
-  version = "3.1.0";
+  version = "3.1.1";

  src = fetchurl {
    url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "sha256-6nnKYnml6BjLb6aKNHbd55nH6gP/5Somo8poxx7yhVk=";
+    sha256 = "sha256-FcefUf0KwAEEn53XubrB2991ncsCMKicf20fJG6LurQ=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/science/electronics/verilator/default.nix
+++ b/pkgs/applications/science/electronics/verilator/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "verilator";
-  version = "5.016";
+  version = "5.018";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-MVQbAZXSIdzX7+yKbSrFLLd0j6dfLSXpES3uu6bcPt8=";
+    hash = "sha256-f06UzNw2MQ5me03EPrVFhkwxKum/GLDzQbDNTBsJMJs=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/science/logic/eprover/default.nix
+++ b/pkgs/applications/science/logic/eprover/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "eprover";
-  version = "2.6";
+  version = "3.0";

  src = fetchurl {
    url = "https://wwwlehre.dhbw-stuttgart.de/~sschulz/WORK/E_DOWNLOAD/V_${version}/E.tgz";
-    sha256 = "sha256-qh896qIpFR5g1gdWAwGkbNJLBqUQCeCpuoYHHkDXPt0=";
+    sha256 = "sha256-RJ2uc/GIWU/fDJijSzYS8GdL7zUkeExOLWXtTbi8ZLk=";
  };

  buildInputs = [ which ];
--- a/pkgs/applications/version-management/pijul/default.nix
+++ b/pkgs/applications/version-management/pijul/default.nix
@ -13,14 +13,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "pijul";
-  version = "1.0.0-beta.6";
+  version = "1.0.0-beta.7";

  src = fetchCrate {
    inherit version pname;
-    hash = "sha256-1cIb4QsDYlOCGrQrLgEwIjjHZ3WwD2o0o0bF+OOqEtI=";
+    hash = "sha256-BXDz9po8i937/xYoIW4S/FddtcWxSmtRUWYIphgh060=";
  };

-  cargoHash = "sha256-mRi0NUETTdYE/oM+Jo7gW/zNby8dPAKl6XhzP0Qzsf0=";
+  cargoHash = "sha256-+KF1G4bDfcjHHzZR93lIR8muO6s3j5jDobr3A7Arr+Q=";

  doCheck = false;
  nativeBuildInputs = [ installShellFiles pkg-config ];
--- a/pkgs/applications/version-management/sourcehut/default.nix
+++ b/pkgs/applications/version-management/sourcehut/default.nix
@ -1,4 +1,6 @@
-{ python3
+{ lib
+, stdenv
+, python3
 , callPackage
 , recurseIntoAttrs
 , nixosTests
@ -35,7 +37,9 @@ let
          hash = "sha256-aRO4JH2KKS74MVFipRkx4rQM6RaB8bbxj2lwRSAMSjA=";
        };
        nativeCheckInputs = with super; [ pytestCheckHook mock ];
-        disabledTestPaths = [];
+        disabledTestPaths = []
+          # Disable incompatible tests on Darwin.
+          ++ lib.optionals stdenv.isDarwin [ "test/aaa_profiling" ];
      });

      flask-sqlalchemy = super.flask-sqlalchemy.overridePythonAttrs (oldAttrs: rec {
--- a/pkgs/applications/video/obs-studio/plugins/obs-pipewire-audio-capture.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-pipewire-audio-capture.nix
@ -32,10 +32,10 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    description = " Audio device and application capture for OBS Studio using PipeWire ";
+    description = "Audio device and application capture for OBS Studio using PipeWire";
    homepage = "https://github.com/dimtpap/obs-pipewire-audio-capture";
    maintainers = with maintainers; [ Elinvention ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
    platforms = [ "x86_64-linux" "i686-linux" ];
  };
 }
--- a/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-vaapi";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "fzwoch";
    repo = pname;
    rev = version;
-    hash = "sha256-AbSI6HBdOEI54bUVqqF+b4LcCyzW30XlS9SXX2ajkas=";
+    hash = "sha256-PpGNLIOz+fCpcP/nvjcJ+1fkduxjcbZjb7yx8TUO25s=";
  };

  nativeBuildInputs = [ pkg-config meson ninja ];
--- a/pkgs/applications/video/ustreamer/default.nix
+++ b/pkgs/applications/video/ustreamer/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "ustreamer";
-  version = "5.42";
+  version = "5.45";

  src = fetchFromGitHub {
    owner = "pikvm";
    repo = "ustreamer";
    rev = "v${version}";
-    hash = "sha256-V4ScXzZwh3fWCWmeGeb1hce+INYBmf3wtemwNch5FjY=";
+    hash = "sha256-2WJXOv15oZRk2doecd+xOURygbX4oGyeMAJiiuiRBi4=";
  };

  buildInputs = [ libbsd libevent libjpeg ];
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -179,7 +179,7 @@ rec {
      makeWrapper pkg-config go-md2man go libtool installShellFiles
    ];

-    buildInputs = plugins ++ lib.optionals (lib.versionAtLeast version "23") [
+    buildInputs = plugins ++ lib.optionals (lib.versionAtLeast version "23" && stdenv.isLinux) [
      glibc
      glibc.static
    ];
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@ -1,6 +1,6 @@
 { lib, fetchFromGitHub, python3, intltool, file, wrapGAppsHook, gtk-vnc
 , vte, avahi, dconf, gobject-introspection, libvirt-glib, system-libvirt
-, gsettings-desktop-schemas, libosinfo, gnome, gtksourceview4, docutils, cpio
+, gsettings-desktop-schemas, gst_all_1, libosinfo, gnome, gtksourceview4, docutils, cpio
 , e2fsprogs, findutils, gzip, cdrtools, xorriso, fetchpatch
 , desktopToDarwinBundle, stdenv
 , spiceSupport ? true, spice-gtk ? null
@ -21,10 +21,12 @@ python3.pkgs.buildPythonApplication rec {
    intltool file
    gobject-introspection # for setup hook populating GI_TYPELIB_PATH
    docutils
+    wrapGAppsHook
  ] ++ lib.optional stdenv.isDarwin desktopToDarwinBundle;

  buildInputs = [
-    wrapGAppsHook
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
    libvirt-glib vte dconf gtk-vnc gnome.adwaita-icon-theme avahi
    gsettings-desktop-schemas libosinfo gtksourceview4
  ] ++ lib.optional spiceSupport spice-gtk;
--- a/pkgs/applications/window-managers/cosmic/applets/default.nix
+++ b/pkgs/applications/window-managers/cosmic/applets/default.nix
@ -1,62 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform
-, cargo, just, pkg-config, util-linuxMinimal
-, dbus, glib, libxkbcommon, pulseaudio, wayland
-}:
-
-rustPlatform.buildRustPackage {
-  pname = "cosmic-applets";
-  version = "unstable-2023-10-04";
-
-  src = fetchFromGitHub {
-    owner = "pop-os";
-    repo = "cosmic-applets";
-    rev = "fefaea9b63548b1baa5e64521b860234ee46339a";
-    hash = "sha256-I+18NCKLH/3QajYpZRPYmCUxkbptAjuEHfKtnZVOlH4=";
-  };
-
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "accesskit-0.11.0" = "sha256-/6KUCH1CwMHd5YEMOpAdVeAxpjl9JvrzDA4Xnbd1D9k=";
-      "cosmic-client-toolkit-0.1.0" = "sha256-pVWK+dODQxNej5jWyb5wX/insoiXkX8NFBDkDEejVV0=";
-      "cosmic-config-0.1.0" = "sha256-pUDuRHX46fbcPw19s5DEsPyJdb/Bem/lJg+3NEO/WX0=";
-      "cosmic-dbus-networkmanager-0.1.0" = "sha256-eWqB+zRCfJYdrcPE8Ey+WgzPBJltN0zRiutzgdtWsDA=";
-      "cosmic-notifications-config-0.1.0" = "sha256-KnPQdrMpzA05v4bt0Fz9fbcKdC0cSU60Hv7wqrthIaw=";
-      "cosmic-panel-config-0.1.0" = "sha256-H3QuiP7Og69wm9yCX/uoSG0aQ3B/61q9Sdj+rW4KZMU=";
-      "cosmic-time-0.3.0" = "sha256-JiTwbJSml8azelBr6b3cBvJsuAL1hmHtuHx2TJupEzE=";
-      "smithay-client-toolkit-0.17.0" = "sha256-v3FxzDypxSfbEU50+oDoqrGWPm+S+kDZQq//3Q4DDRU=";
-      "softbuffer-0.2.0" = "sha256-VD2GmxC58z7Qfu/L+sfENE+T8L40mvUKKSfgLmCTmjY=";
-      "xdg-shell-wrapper-config-0.1.0" = "sha256-Otxp8D5dNZl70K1ZIBswGj6K5soGVbVim7gutUHkBvw=";
-    };
-  };
-
-  postPatch = ''
-    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
-  '';
-
-  nativeBuildInputs = [ just pkg-config util-linuxMinimal ];
-  buildInputs = [ dbus glib libxkbcommon pulseaudio wayland ];
-
-  dontUseJustBuild = true;
-
-  justFlags = [
-    "--set" "prefix" (placeholder "out")
-    "--set" "target" "${stdenv.hostPlatform.rust.cargoShortTarget}/release"
-  ];
-
-  # Force linking to libwayland-client, which is always dlopen()ed.
-  "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
-    map (a: "-C link-arg=${a}") [
-      "-Wl,--push-state,--no-as-needed"
-      "-lwayland-client"
-      "-Wl,--pop-state"
-    ];
-
-  meta = with lib; {
-    homepage = "https://github.com/pop-os/cosmic-applets";
-    description = "Applets for the COSMIC Desktop Environment";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ qyliss ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/window-managers/cosmic/applets/Cargo.lock
+++ b/pkgs/applications/window-managers/cosmic/applets/Cargo.lock
--- a/pkgs/by-name/co/cosmic-applets/package.nix
+++ b/pkgs/by-name/co/cosmic-applets/package.nix
@ -0,0 +1,72 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, just
+, pkg-config
+, util-linuxMinimal
+, dbus
+, glib
+, libxkbcommon
+, pulseaudio
+, wayland
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "cosmic-applets";
+  version = "unstable-2023-11-13";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-applets";
+    rev = "21fc43e5781a7fbe7e7f39a0b68963dc8c2d486d";
+    hash = "sha256-WOUlYIh4a8qQhga4weKcuJYxNL5fa4FzNFuRB1T32oU=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "cosmic-client-toolkit-0.1.0" = "sha256-st46wmOncJvu0kj6qaot6LT/ojmW/BwXbbGf8s0mdZ8=";
+      "cosmic-config-0.1.0" = "sha256-6g/Om3SFLa+3fu2dkifbXbFP3ksXTbsjb6Xu7tDB570=";
+      "cosmic-dbus-networkmanager-0.1.0" = "sha256-eSUyDME39UhoimO/gd2mJDaunCrLNXesO9C69IwtjgM=";
+      "cosmic-notifications-config-0.1.0" = "sha256-QsLlm+jxsmc90Jc73qKgi52PVZoSwuGXDXw+iSJTALw=";
+      "cosmic-panel-config-0.1.0" = "sha256-uUq+xElZMcG5SWzha9/8COaenycII5aiXmm7sXGgjXE=";
+      "cosmic-time-0.3.0" = "sha256-Vx9MrdnAwqDCnA6WgT/cXxs4NDWvAVZ6hv0FXi2A8t4=";
+      "smithay-client-toolkit-0.18.0" = "sha256-9NwNrEC+csTVtmXrNQFvOgohTGUO2VCvqOME7SnDCOg=";
+      "softbuffer-0.2.0" = "sha256-VD2GmxC58z7Qfu/L+sfENE+T8L40mvUKKSfgLmCTmjY=";
+      "taffy-0.3.11" = "sha256-0hXOEj6IjSW8e1t+rvxBFX6V9XRum3QO2Des1XlHJEw=";
+      "xdg-shell-wrapper-config-0.1.0" = "sha256-3Dc2fU8xBVUmAs0Q1zEdcdG7vlxpBO+UIlyM/kzGcC4=";
+    };
+  };
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  nativeBuildInputs = [ just pkg-config util-linuxMinimal ];
+  buildInputs = [ dbus glib libxkbcommon pulseaudio wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set" "prefix" (placeholder "out")
+    "--set" "target" "${stdenv.hostPlatform.rust.cargoShortTarget}/release"
+  ];
+
+  # Force linking to libwayland-client, which is always dlopen()ed.
+  "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
+    map (a: "-C link-arg=${a}") [
+      "-Wl,--push-state,--no-as-needed"
+      "-lwayland-client"
+      "-Wl,--pop-state"
+    ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-applets";
+    description = "Applets for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ qyliss nyanbinary ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/ln/lngen/package.nix
+++ b/pkgs/by-name/ln/lngen/package.nix
@ -0,0 +1,23 @@
+{ lib
+, haskellPackages
+, fetchFromGitHub
+}:
+
+haskellPackages.mkDerivation {
+  pname = "lngen";
+  version = "unstable-2023-10-17";
+  src = fetchFromGitHub {
+    owner = "plclub";
+    repo = "lngen";
+    rev = "c7645001404e0e2fec2c56f128e30079b5b3fac6";
+    hash = "sha256-2vUYHtl9yAadwdTtsjTI0klP+nRSYGXVpaSwD9EBTTI=";
+  };
+  isLibrary = true;
+  isExecutable = true;
+  libraryHaskellDepends = with haskellPackages; [ base syb parsec containers mtl ];
+  executableHaskellDepends = with haskellPackages; [ base ];
+  homepage = "https://github.com/plclub/lngen";
+  description = "Tool for generating Locally Nameless definitions and proofs in Coq, working together with Ott";
+  maintainers = with lib.maintainers; [ chen ];
+  license = lib.licenses.mit;
+}
--- a/pkgs/by-name/ma/mariadb-connector-java/package.nix
+++ b/pkgs/by-name/ma/mariadb-connector-java/package.nix
@ -1,17 +1,21 @@
-{ lib, maven, fetchFromGitHub }:
+{ lib
+, maven
+, fetchFromGitHub
+, nix-update-script
+}:

 maven.buildMavenPackage rec {
  pname = "mariadb-connector-java";
-  version = "3.2.0";
+  version = "3.3.0";

  src = fetchFromGitHub {
    owner = "mariadb-corporation";
    repo = "mariadb-connector-j";
    rev = "refs/tags/${version}";
-    hash = "sha256-ssh6v2h/Ikl2Ulim6lSJ45avjKSCh3Vmtg+LPOgONRU=";
+    hash = "sha256-JuMm01ihgVoKpe8wyuUIDyzSxMODRg7dQpTCyVA/K10=";
  };

-  mvnHash = "sha256-MizBoFlpYxwwcU7rOac1h2VPJoXv3eRQgWRgsTh8Xno=";
+  mvnHash = "sha256-Px4Qxb1tTvRKZum1xfe0mdX+EyimnyyfzrydiaDaYRo=";

  # Disable tests because they require networking
  mvnParameters = "-DskipTests";
@ -22,6 +26,8 @@ maven.buildMavenPackage rec {
    runHook postInstall
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    description = "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases";
    homepage = "https://mariadb.com/kb/en/about-mariadb-connector-j/";
--- a/pkgs/by-name/ni/nix-search-cli/package.nix
+++ b/pkgs/by-name/ni/nix-search-cli/package.nix
@ -0,0 +1,30 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, unstableGitUpdater
+}:
+
+buildGoModule {
+  pname = "nix-search-cli";
+  version = "unstable-2023-09-12";
+
+  src = fetchFromGitHub {
+    owner = "peterldowns";
+    repo = "nix-search-cli";
+    rev = "f3f1c53c72dadac06472a7112aeb486ab5dda695";
+    hash = "sha256-YM1Lf7py79rU8aJE0PfQaMr5JWx5J1covUf1aCjRkc8=";
+  };
+
+  vendorHash = "sha256-JDOu7YdX9ztMZt0EFAMz++gD7n+Mn1VOe5g6XwrgS5M=";
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "CLI for searching packages on search.nixos.org";
+    homepage = "https://github.com/peterldowns/nix-search-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ donovanglover ];
+    platforms = platforms.all;
+    mainProgram = "nix-search";
+  };
+}
--- a/pkgs/by-name/rt/rtl-sdr-osmocom/package.nix
+++ b/pkgs/by-name/rt/rtl-sdr-osmocom/package.nix
@ -0,0 +1,53 @@
+{ lib
+, stdenv
+, fetchFromGitea
+, cmake
+, pkg-config
+, libusb1
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rtl-sdr-osmocom";
+  version = "2.0.1";
+
+  src = fetchFromGitea {
+    domain = "gitea.osmocom.org";
+    owner = "sdr";
+    repo = "rtl-sdr";
+    rev = "v${version}";
+    hash = "sha256-+RYSCn+wAkb9e7NRI5kLY8a6OXtJu7QcSUht1R6wDX0=";
+  };
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace '/etc/udev/rules.d' "$out/etc/udev/rules.d" \
+      --replace "VERSION_INFO_PATCH_VERSION git" "VERSION_INFO_PATCH_VERSION ${lib.versions.patch version}"
+
+    substituteInPlace rtl-sdr.rules \
+      --replace 'MODE:="0666"' 'ENV{ID_SOFTWARE_RADIO}="1", MODE="0660", GROUP="plugdev"'
+  '';
+
+  nativeBuildInputs = [ pkg-config cmake ];
+
+  propagatedBuildInputs = [ libusb1 ];
+
+  cmakeFlags = lib.optionals stdenv.isLinux [
+    "-DINSTALL_UDEV_RULES=ON"
+    "-DWITH_RPC=ON"
+  ];
+
+  meta = with lib; {
+    description = "Software to turn the RTL2832U into a SDR receiver";
+    longDescription = ''
+    This packages the rtl-sdr library by the Osmocom project. This is the upstream codebase of the unsuffixed "rtl-sdr" package, which is a downstream fork. A list of differences can be found here:
+    https://github.com/librtlsdr/librtlsdr/blob/master/README_improvements.md
+
+    The Osmocom upstream has a regular release schedule, so this package will likely support newer SDR dongles. It should be compatible with most software that currently depends on the "rtl-sdr" nixpkg, but comptabiliy should be manually confirmed.
+    '';
+    homepage = "https://gitea.osmocom.org/sdr/rtl-sdr";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ skovati ];
+    platforms = platforms.unix;
+    mainProgram = "rtl_sdr";
+  };
+}
--- a/pkgs/by-name/se/seclists/package.nix
+++ b/pkgs/by-name/se/seclists/package.nix
@ -5,13 +5,13 @@

 stdenvNoCC.mkDerivation {
  pname = "seclists";
-  version = "2023.2";
+  version = "2023.3";

  src = fetchFromGitHub {
    owner = "danielmiessler";
    repo = "SecLists";
-    rev = "2023.2";
-    hash = "sha256-yVxb5GaQDuCsyjIV+oZzNUEFoq6gMPeaIeQviwGdAgY=";
+    rev = "2023.3";
+    hash = "sha256-mJgCzp8iKzSWf4Tud5xDpnuY4aNJmnEo/hTcuGTaOWM=";
  };

  installPhase = ''
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@ -17,13 +17,13 @@
 assert lib.elem lineEditingLibrary [ "isocline" "readline" ];
 stdenv.mkDerivation (finalAttrs: {
  pname = "trealla";
-  version = "2.29.36";
+  version = "2.30.7";

  src = fetchFromGitHub {
    owner = "trealla-prolog";
    repo = "trealla";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-tQp2DOBW71Wm1aQqspW9tuH8aM8ir+ilZiENdElB/+0=";
+    hash = "sha256-W0hcIeWbgORWBYuNbVJRA8NNnuBEG8HMLeVBxXtd2VQ=";
  };

  postPatch = ''
--- a/pkgs/by-name/xs/xscreensaver/package.nix
+++ b/pkgs/by-name/xs/xscreensaver/package.nix
@ -24,19 +24,21 @@
 , perlPackages
 , pkg-config
 , systemd
-, forceInstallAllHacks ? false
+, forceInstallAllHacks ? true
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "xscreensaver";
-  version = "6.06";
+  version = "6.08";

  src = fetchurl {
    url = "https://www.jwz.org/xscreensaver/xscreensaver-${finalAttrs.version}.tar.gz";
-    hash = "sha256-9TT6uFqDbeW4vo6R/CG4DKfWpO2ThuviB9S+ek50mac=";
+    hash = "sha256-XPUrpSXO7PlLLyvWNIXr3zGOEvzA8q2tfUwQbYVedqM=";
  };

+  outputs = [ "out" "man" ];
+
  nativeBuildInputs = [
    intltool
    makeWrapper
@ -65,7 +67,13 @@ stdenv.mkDerivation (finalAttrs: {
    perlPackages.MozillaCA
    perlPackages.perl
  ]
-  ++ lib.optional withSystemd systemd;
+  ++ lib.optionals withSystemd [ systemd ];
+
+  postPatch = ''
+    pushd hacks
+    patchShebangs check-configs.pl munge-ad.pl xml2man.pl
+    popd
+  '';

  preConfigure = ''
    # Fix installation paths for GTK resources.
--- a/pkgs/data/icons/tau-hydrogen/default.nix
+++ b/pkgs/data/icons/tau-hydrogen/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tau-hydrogen";
-  version = "1.0.13";
+  version = "1.0.14";

  src = fetchFromGitHub {
    owner = "tau-OS";
    repo = "tau-hydrogen";
    rev = finalAttrs.version;
-    hash = "sha256-rfgSNytPCVCkAJ9N3kRw9mfcXr+JEqy1jyyDgXqxtsM=";
+    hash = "sha256-8awcowBm0hwoYYm/wtKeqCWRhgXh2rI3UvAlL1tbj6c=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/julia/1.9-bin.nix
+++ b/pkgs/development/compilers/julia/1.9-bin.nix
@ -24,24 +24,24 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "julia-bin";
-  version = "1.9.3";
+  version = "1.9.4";

  src = {
    x86_64-linux = fetchurl {
      url = "https://julialang-s3.julialang.org/bin/linux/x64/${lib.versions.majorMinor version}/julia-${version}-linux-x86_64.tar.gz";
-      sha256 = "d76670cc9ba3e0fd4c1545dd3d00269c0694976a1176312795ebce1692d323d1";
+      sha256 = "07d20c4c2518833e2265ca0acee15b355463361aa4efdab858dad826cf94325c";
    };
    aarch64-linux = fetchurl {
      url = "https://julialang-s3.julialang.org/bin/linux/aarch64/${lib.versions.majorMinor version}/julia-${version}-linux-aarch64.tar.gz";
-      sha256 = "55437879f6b98470d96c4048b922501b643dfffb8865abeb90c7333a83df7524";
+      sha256 = "541d0c5a9378f8d2fc384bb8595fc6ffe20d61054629a6e314fb2f8dfe2f2ade";
    };
    x86_64-darwin = fetchurl {
      url = "https://julialang-s3.julialang.org/bin/mac/x64/${lib.versions.majorMinor version}/julia-${version}-mac64.tar.gz";
-      sha256 = "6eea87748424488226090d1e7d553e72ab106a873d63c732fc710a3d080abb97";
+      sha256 = "67eec264f6afc9e9bf72c0f62c84d91c2ebdfaed6a0aa11606e3c983d278b441";
    };
    aarch64-darwin = fetchurl {
      url = "https://julialang-s3.julialang.org/bin/mac/aarch64/${lib.versions.majorMinor version}/julia-${version}-macaarch64.tar.gz";
-      sha256 = "f518e38d7bd5b37766fb051916bd295993aa4b52a47018f4c98b5fde721ced87";
+      sha256 = "67542975e86102eec95bc4bb7c30c5d8c7ea9f9a0b388f0e10f546945363b01a";
    };
  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

--- a/pkgs/development/compilers/julia/1.9.nix
+++ b/pkgs/development/compilers/julia/1.9.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "julia";
-  version = "1.9.3";
+  version = "1.9.4";

  src = fetchurl {
    url = "https://github.com/JuliaLang/julia/releases/download/v${version}/julia-${version}-full.tar.gz";
-    hash = "sha256-j8DJ3FRDoo01m9ed2jlA+pS6K3lmuJhlvrINqBEjwxY=";
+    hash = "sha256-YYQ7lkf9BtOymU8yd6ZN4ctaWlKX2TC4yOO8DpN0ACQ=";
  };

  patches = [
--- a/pkgs/development/coq-modules/fourcolor/default.nix
+++ b/pkgs/development/coq-modules/fourcolor/default.nix
@ -16,7 +16,7 @@ mkCoqDerivation {
  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ] [
    { cases = [ (isGe "8.16") (isGe "2.0") ]; out = "1.3.1"; }
    { cases = [ (isGe "8.16") "2.0.0" ]; out = "1.3.0"; }
-    { cases = [ (isGe "8.11") (range "1.12" "1.17") ]; out = "1.2.5"; }
+    { cases = [ (isGe "8.11") (range "1.12" "1.18") ]; out = "1.2.5"; }
    { cases = [ (isGe "8.11") (range "1.11" "1.14") ]; out = "1.2.4"; }
    { cases = [ (isLe "8.13") (lib.pred.inter (isGe "1.11.0") (isLt "1.13")) ]; out = "1.2.3"; }
  ] null;
--- a/pkgs/development/coq-modules/graph-theory/default.nix
+++ b/pkgs/development/coq-modules/graph-theory/default.nix
@ -1,4 +1,4 @@
-{ lib, mkCoqDerivation, coq, mathcomp-algebra, mathcomp-finmap, mathcomp-fingroup
+{ lib, mkCoqDerivation, coq, mathcomp, mathcomp-finmap
 , fourcolor, hierarchy-builder, version ? null }:

 mkCoqDerivation {
@ -6,16 +6,20 @@ mkCoqDerivation {

  release."0.9".sha256 = "sha256-Hl3JS9YERD8QQziXqZ9DqLHKp63RKI9HxoFYWSkJQZI=";
  release."0.9.1".sha256 = "sha256-lRRY+501x+DqNeItBnbwYIqWLDksinWIY4x/iojRNYU=";
+  release."0.9.2".sha256 = "sha256-DPYCZS8CzkfgpR+lmYhV2v20ezMtyWp8hdWpuh0OOQU=";
+  release."0.9.3".sha256 = "sha256-9WX3gsw+4btJLqcGg2W+7Qy+jaZtkfw7vCp8sXYmaWw=";

  releaseRev = v: "v${v}";

  inherit version;
-  defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.14" "8.16"; out = "0.9.1"; }
-    { case = range "8.12" "8.12"; out = "0.9"; }
+  defaultVersion = with lib.versions; lib.switch [ coq.coq-version mathcomp.version ] [
+    { cases = [ (isGe "8.16") (range "2.0.0" "2.1.0") ]; out = "0.9.3"; }
+    { cases = [ (range "8.14" "8.18") (range "1.13.0" "1.18.0") ]; out = "0.9.2"; }
+    { cases = [ (range "8.14" "8.16") (range "1.13.0" "1.14.0") ]; out = "0.9.1"; }
+    { cases = [ (range "8.12" "8.13") (range "1.12.0" "1.14.0") ]; out = "0.9"; }
  ] null;

-  propagatedBuildInputs = [ mathcomp-algebra mathcomp-finmap mathcomp-fingroup fourcolor hierarchy-builder ];
+  propagatedBuildInputs = [ mathcomp.algebra mathcomp-finmap mathcomp.fingroup fourcolor hierarchy-builder ];

  meta = with lib; {
    description = "Library of formalized graph theory results in Coq";
--- a/pkgs/development/coq-modules/mathcomp-analysis/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
@ -9,6 +9,8 @@ let
  repo  = "analysis";
  owner = "math-comp";

+  release."0.6.6".sha256 = "sha256-tWtv6yeB5/vzwpKZINK9OQ0yQsvD8qu9zVSNHvLMX5Y=";
+  release."0.6.5".sha256 = "sha256-oJk9/Jl1SWra2aFAXRAVfX7ZUaDfajqdDksYaW8dv8E=";
  release."0.6.1".sha256 = "sha256-1VyNXu11/pDMuH4DmFYSUF/qZ4Bo+/Zl3Y0JkyrH/r0=";
  release."0.6.0".sha256 = "sha256-0msICcIrK6jbOSiBu0gIVU3RHwoEEvB88CMQqW/06rg=";
  release."0.5.3".sha256 = "sha256-1NjFsi5TITF8ZWx1NyppRmi8g6YaoUtTdS9bU/sUe5k=";
@ -24,7 +26,9 @@ let
  release."0.2.3".sha256 = "0p9mr8g1qma6h10qf7014dv98ln90dfkwn76ynagpww7qap8s966";

  defaultVersion = with versions; lib.switch [ coq.version mathcomp.version ]  [
-      { cases = [ (isGe "8.14") (isGe "1.13.0") ];               out = "0.6.1"; }
+      { cases = [ (isGe "8.17") (range "1.15.0" "1.18.0") ];     out = "0.6.6"; }
+      { cases = [ (isGe "8.14") (range "1.15.0" "1.17.0") ];     out = "0.6.5"; }
+      { cases = [ (isGe "8.14") (range "1.13.0" "1.16.0") ];     out = "0.6.1"; }
      { cases = [ (isGe "8.14") (range "1.13" "1.15") ];         out = "0.5.2"; }
      { cases = [ (range "8.13" "8.15") (range "1.13" "1.14") ]; out = "0.5.1"; }
      { cases = [ (range "8.13" "8.15") (range "1.12" "1.14") ]; out = "0.3.13"; }
--- a/pkgs/development/coq-modules/mathcomp-apery/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-apery/default.nix
@ -8,7 +8,7 @@ mkCoqDerivation {

  inherit version;
  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
-      { cases = [ (range "8.13" "8.16") (isGe "1.12.0") ]; out = "1.0.2"; }
+      { cases = [ (range "8.13" "8.16") (range "1.12.0" "1.17.0") ]; out = "1.0.2"; }
    ] null;

  release."1.0.2".sha256 = "sha256-llxyMKYvWUA7fyroG1S/jtpioAoArmarR1edi3cikcY=";
--- a/pkgs/development/coq-modules/mathcomp-finmap/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
@ -8,7 +8,7 @@ mkCoqDerivation {
  inherit version;
  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
      { cases = [ (range "8.16" "8.18")  (isGe "2.0") ];          out = "2.0.0"; }
-      { cases = [ (range "8.13" "8.18")  (range "1.12" "1.17") ]; out = "1.5.2"; }
+      { cases = [ (range "8.13" "8.18")  (range "1.12" "1.18") ]; out = "1.5.2"; }
      { cases = [ (isGe "8.10")          (range "1.11" "1.17") ]; out = "1.5.1"; }
      { cases = [ (range "8.7" "8.11")   "1.11.0" ];              out = "1.5.0"; }
      { cases = [ (isEq "8.11")          (range "1.8" "1.10") ];  out = "1.4.0+coq-8.11"; }
--- a/pkgs/development/coq-modules/mathcomp-infotheo/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-infotheo/default.nix
@ -7,7 +7,7 @@ mkCoqDerivation {
  inherit version;
  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp-analysis.version] [
    { cases = [ (isGe "8.17") (isGe "0.6.0") ];                  out = "0.5.2"; }
-    { cases = [ (range "8.15" "8.16") (range "0.5.4" "0.6.2") ]; out = "0.5.1"; }
+    { cases = [ (range "8.15" "8.16") (range "0.5.4" "0.6.5") ]; out = "0.5.1"; }
  ] null;
  release."0.5.1".sha256 = "sha256-yBBl5l+V+dggsg5KM59Yo9CULKog/xxE8vrW+ZRnX7Y=";
  release."0.5.2".sha256 = "sha256-8WAnAV53c0pMTdwj8XcUDUkLZbpUgIQbEOgOb63uHQA=";
--- a/pkgs/development/coq-modules/mathcomp-zify/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-zify/default.nix
@ -10,7 +10,7 @@ mkCoqDerivation rec {
  defaultVersion = with lib.versions;
     lib.switch [ coq.coq-version mathcomp-algebra.version ] [
       { cases = [ (range "8.16" "8.18") (isGe "2.0.0") ]; out = "1.5.0+2.0+8.16"; }
-       { cases = [ (range "8.13" "8.18") (range "1.12" "1.17.0") ]; out = "1.3.0+1.12+8.13"; }
+       { cases = [ (range "8.13" "8.18") (range "1.12" "1.18.0") ]; out = "1.3.0+1.12+8.13"; }
       { cases = [ (range "8.13" "8.16") (range "1.12" "1.17.0") ]; out = "1.1.0+1.12+8.13"; }
     ] null;

--- a/pkgs/development/coq-modules/mathcomp/default.nix
+++ b/pkgs/development/coq-modules/mathcomp/default.nix
@ -19,7 +19,8 @@ let
  owner = "math-comp";
  withDoc = single && (args.withDoc or false);
  defaultVersion = with versions; lib.switch coq.coq-version [
-      { case = isGe "8.15"; out = "1.17.0"; }
+      { case = isGe "8.17"; out = "1.18.0"; }
+      { case = range "8.15" "8.18"; out = "1.17.0"; }
      { case = range "8.16" "8.18"; out = "2.1.0"; }
      { case = range "8.16" "8.18"; out = "2.0.0"; }
      { case = range "8.13" "8.18"; out = "1.16.0"; }
@ -37,6 +38,7 @@ let
  release = {
    "2.1.0".sha256  = "sha256-XDLx0BIkVRkSJ4sGCIE51j3rtkSGemNTs/cdVmTvxqo=";
    "2.0.0".sha256  = "sha256-dpOmrHYUXBBS9kmmz7puzufxlbNpIZofpcTvJFLG5DI=";
+    "1.18.0".sha256 = "sha256-mJJ/zvM2WtmBZU3U4oid/zCMvDXei/93v5hwyyqwiiY=";
    "1.17.0".sha256 = "sha256-bUfoSTMiW/GzC1jKFay6DRqGzKPuLOSUsO6/wPSFwNg=";
    "1.16.0".sha256 = "sha256-gXTKhRgSGeRBUnwdDezMsMKbOvxdffT+kViZ9e1gEz0=";
    "1.15.0".sha256 = "1bp0jxl35ms54s0mdqky15w9af03f3i0n06qk12k4gw1xzvwqv21";
--- a/pkgs/development/coq-modules/multinomials/default.nix
+++ b/pkgs/development/coq-modules/multinomials/default.nix
@ -11,7 +11,7 @@
  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ] [
      { cases = [ (isGe "8.16") (isGe "2.1.0") ];               out = "2.1.0"; }
      { cases = [ (isGe "8.16") "2.0.0" ];                      out = "2.0.0"; }
-      { cases = [ (isGe "8.15") (range "1.15.0" "1.17.0") ];    out = "1.6.0"; }
+      { cases = [ (isGe "8.15") (range "1.15.0" "1.18.0") ];    out = "1.6.0"; }
      { cases = [ (isGe "8.10") (range "1.13.0" "1.17.0") ];    out = "1.5.6"; }
      { cases = [ (range "8.10" "8.16") (range "1.12.0" "1.15.0") ]; out = "1.5.5"; }
      { cases = [ (range "8.10" "8.12") "1.12.0" ];             out = "1.5.3"; }
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -351,8 +351,8 @@ in {
  };

  ruby_3_3 = generic {
-    version = rubyVersion "3" "3" "0" "preview2";
-    sha256 = "sha256-MM6LD+EbN7WsCI9aV2V0S5NerEW7ianjgXMVMxRPWZE=";
+    version = rubyVersion "3" "3" "0" "preview3";
+    sha256 = "sha256-CWkUG+kuZ+DtuEqPs1SsyY8BvXjmAqI6DxNgRcgvSAk=";
    cargoSha256 = "sha256-GeelTMRFIyvz1QS2L+Q3KAnyQy7jc0ejhx3TdEFVEbk=";
  };

--- a/pkgs/development/interpreters/zuo/default.nix
+++ b/pkgs/development/interpreters/zuo/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "zuo";
-  version = "unstable-2023-10-17";
+  version = "unstable-2023-11-10";

  src = fetchFromGitHub {
    owner = "racket";
    repo = "zuo";
-    rev = "493e9cd08147add01bba9247f36759f095b87678";
-    hash = "sha256-gsCjB3V+A0kMZJZ9onZ57R6b1Ha0K+Q383DQoVGfY7I=";
+    rev = "9e2aa26b0574b4ac53c838f6b59fd78f952c3923";
+    hash = "sha256-wF+jj4+4uFofW9KhVqRF7EoWViRny2KuSfX/l6UN+yY=";
  };

  doCheck = true;
--- a/pkgs/development/libraries/libcmis/default.nix
+++ b/pkgs/development/libraries/libcmis/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libcmis";
-  version = "0.6.0";
+  version = "0.6.2";

  src = fetchFromGitHub {
    owner = "tdf";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-E2A4uJUayqMMxVifzeAeYKLL+FiV2vShNNdXe5ZLXZ4=";
+    sha256 = "sha256-HXiyQKjOlQXWABY10XrOiYxPqfpmUJC3a6xD98LIHDw=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config docbook2x ];
--- a/pkgs/development/libraries/libdeltachat/Cargo.lock
+++ b/pkgs/development/libraries/libdeltachat/Cargo.lock
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@ -30,13 +30,13 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "libdeltachat";
-  version = "1.128.0";
+  version = "1.131.1";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-core-rust";
    rev = "v${version}";
-    hash = "sha256-kujPkKKobn4/J0rCdZfnlNZzGM0SUVtOWOhyDawYiqw=";
+    hash = "sha256-JXSZrlekvPVGKR+ritxk3Eru2DhtUN9UBtqUZ7G9/gg=";
  };

  patches = [
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@ -155,16 +155,12 @@ stdenv.mkDerivation rec {
      src/storage/storage_backend_disk.c \
      src/storage/storage_util.c
  '' + lib.optionalString isDarwin ''
-    sed -i '/qemucapabilitiestest/d' tests/meson.build
-    sed -i '/vircryptotest/d' tests/meson.build
-    sed -i '/domaincapstest/d' tests/meson.build
+    # Darwin doesn’t support -fsemantic-interposition, but the problem doesn’t seem to affect Mach-O.
+    # See https://gitlab.com/libvirt/libvirt/-/merge_requests/235
+    sed -i "s/not supported_cc_flags.contains('-fsemantic-interposition')/false/" meson.build
    sed -i '/qemufirmwaretest/d' tests/meson.build
    sed -i '/qemuvhostusertest/d' tests/meson.build
    sed -i '/qemuxml2xmltest/d' tests/meson.build
-  '' + lib.optionalString (isDarwin && isx86_64) ''
-    sed -i '/qemucaps2xmltest/d' tests/meson.build
-    sed -i '/qemuhotplugtest/d' tests/meson.build
-    sed -i '/virnetdaemontest/d' tests/meson.build
  '';

  strictDeps = true;
--- a/pkgs/development/libraries/omorfi/default.nix
+++ b/pkgs/development/libraries/omorfi/default.nix
@ -3,6 +3,7 @@
 , autoreconfHook
 , cg3
 , fetchFromGitHub
+, fetchpatch
 , hfst
 , hfst-ospell
 , icu
@ -24,6 +25,16 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-UoqdwNWCNOPX6u1YBlnXUcB/fmcvcy/HXbYciVrMBOY=";
  };

+  patches = [
+    # allow building with python311.
+    # patch is incorporated upstream and should be removed on the next update
+    (fetchpatch {
+      name = "python311.patch";
+      url = "https://github.com/flammie/omorfi/commit/9736452ae6624060dbea0876a722c3731e776357.patch";
+      hash = "sha256-Q4fi5HMmO0fq8YI833vgv2EYp//9Um/xFoRk28WrUMk=";
+    })
+  ];
+
  # Fix for omorfi-hyphenate.sh file not found error
  postInstall = ''
    ln -s $out/share/omorfi/{omorfi.hyphenate-rules.hfst,omorfi.hyphenate.hfst}
--- a/pkgs/development/libraries/wxwidgets/wxGTK32.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK32.nix
@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "wxwidgets";
-  version = "3.2.3";
+  version = "3.2.4";

  src = fetchFromGitHub {
    owner = "wxWidgets";
    repo = "wxWidgets";
    rev = "v${version}";
-    hash = "sha256-tuLNNhQA9HGax1aueZHQ+eB2dyIQnKjlmarp7e6Jplc=";
+    hash = "sha256-YkV150sDsfBEHvHne0GF6i8Y5881NrByPkLtPAmb24E=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "adafruit-platformdetect";
-  version = "3.53.0";
+  version = "3.54.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -15,7 +15,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "Adafruit-PlatformDetect";
    inherit version;
-    hash = "sha256-P6oR9Aszj2yj2w+2hAjCMDwngJ+uuUNLpgZooYImzyk=";
+    hash = "sha256-P+f7eBqD0/KIEry/807dQQCvtokB2cYu4i0H6CTYIWg=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.76";
+  version = "9.2.77";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-RIYGWPvQ2n+NgZHw2pGEvgWAtbpb/rdyb6/K4JClRxM=";
+    hash = "sha256-Bff44LSWdoXrijTAjnlsaN5iqDbHjfmYqe0FR4dmZxU=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@ -22,7 +22,7 @@

 buildPythonPackage rec {
  pname = "aioesphomeapi";
-  version = "18.4.0";
+  version = "18.4.1";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -31,7 +31,7 @@ buildPythonPackage rec {
    owner = "esphome";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-jSPoVMtGRtqpDFagjvLTxps5plcN92Mp9vjtQlmqyGg=";
+    hash = "sha256-o1Yv4/wSM2k+L2/JP3teUj129QlyLjoShCRWJ3lIN98=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aiomisc/default.nix
+++ b/pkgs/development/python-modules/aiomisc/default.nix
@ -22,14 +22,14 @@

 buildPythonPackage rec {
  pname = "aiomisc";
-  version = "17.3.23";
+  version = "17.3.25";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-9Df/eGMnXFdv3RUh4LmlPm7STlUcVBw4flfH+bZ6q9Q=";
+    hash = "sha256-EPEfBK/1nbwcajqyv5lFX+02WMvbyFnij2w5J91+UK8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.76";
+  version = "9.2.77";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "angr";
    rev = "refs/tags/v${version}";
-    hash = "sha256-B3oYh0okbIeEvBjBHvY29QTqPyR2TTzLmz6fMsIRcs0=";
+    hash = "sha256-EslJnwgZUUN+EtyjGi/7a4Upr2/vbfNXpkc7I+/ZrU8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "appthreat-vulnerability-db";
-  version = "5.5.1";
+  version = "5.5.2";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "AppThreat";
    repo = "vulnerability-db";
    rev = "refs/tags/v${version}";
-    hash = "sha256-URDVNuUrxWoQjeNRPrSJz8aiEozn5BzRTvhqc4bihA0=";
+    hash = "sha256-ioFTayuPkxXIaaKKVHBLyU47jID6dGWCX1G9kVkD5Yo=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.76";
+  version = "9.2.77";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-g1qlcaSByXhF+6ffxwbV/0tXFdmLySH3TcDuok4y6xw=";
+    hash = "sha256-uTkPDhk4Ugyb9HV/0PMwWpuNajpzfTn1dg7gsQnc/zg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/argcomplete/default.nix
+++ b/pkgs/development/python-modules/argcomplete/default.nix
@ -8,8 +8,8 @@

 buildPythonPackage rec {
  pname = "argcomplete";
-  version = "3.1.2";
-  format = "pyproject";
+  version = "3.1.6";
+  pyproject = true;

  disabled = pythonOlder "3.8";

@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "kislyuk";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-vKXHmCcZZTjVBwQZWtyRjJT4tTuIiK5Qos9yJT/mpag=";
+    hash = "sha256-Akwa6dsf8w/Sw0ydUrqKEP5+dzHYX4hS8vcl7Gw4ePc=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
@ -35,9 +35,10 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
-    description = "Bash tab completion for argparse";
-    homepage = "https://kislyuk.github.io/argcomplete/";
    changelog = "https://github.com/kislyuk/argcomplete/blob/v${version}/Changes.rst";
+    description = "Bash tab completion for argparse";
+    downloadPage = "https://github.com/kislyuk/argcomplete";
+    homepage = "https://kislyuk.github.io/argcomplete/";
    license = licenses.asl20;
    maintainers = with maintainers; [ womfoo ];
  };
--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@ -65,7 +65,7 @@
 }:
 let
  pname = "argilla";
-  version = "1.18.0";
+  version = "1.19.0";
  optional-dependencies = {
    server = [
      fastapi
@ -126,7 +126,7 @@ buildPythonPackage {
    owner = "argilla-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-2VWzmNMdd4WXSBrMSmclpjSZ9jDKNG7GbndUh8zLmgQ=";
+    hash = "sha256-Idl5Tm1XWgBLVgHPbXiyt9MW4J5wZdPb2J7iIDBnorg=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.76";
+  version = "9.2.77";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "claripy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-BwhM5J+20ZvP0d+9TAqy0AgRuPU6XoLKgM88WJdf3Qg=";
+    hash = "sha256-YLa70xxLDyOOKQg/PzFO90JzS5SyvgcJ2+Nltz0q6T8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -16,14 +16,14 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.76";
+  version = "9.2.77";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
    owner = "angr";
    repo = "binaries";
    rev = "refs/tags/v${version}";
-    hash = "sha256-01Y4UKTkaO6bYtVTvv4KFzkEdj4qKiWKaC80/iKa/Eg=";
+    hash = "sha256-YPxdKwR+pq0S1B9GltE8r3bFWDPpCU8OQ05w+kp4lAs=";
  };

 in
@ -38,7 +38,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "cle";
    rev = "refs/tags/v${version}";
-    hash = "sha256-uMT9LvDkXl3SueR80pgGJRkWbymDRmGEn8HV93K/VNc=";
+    hash = "sha256-tdfV+DoDcRO+8TjiBc0u1huA+etF4MY5uYj670lqudY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/edalize/default.nix
+++ b/pkgs/development/python-modules/edalize/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "edalize";
-  version = "0.5.0";
+  version = "0.5.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "olofk";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-jsrJr/iuezh9/KL0PykWB1XKev4Wr5QeDh0ZWNMZSp8=";
+    hash = "sha256-foq1CwIe86d+s7PlhLlGpnJCwrpOyr+uf5/RMLASSJU=";
  };

  postPatch = ''
@ -52,6 +52,21 @@ buildPythonPackage rec {
    "edalize"
  ];

+  disabledTests = [
+    # disable failures related to pandas 2.1.0 apply(...,errors="ignore")
+    # behavior change. upstream pins pandas to 2.0.3 as of 2023-10-10
+    # https://github.com/olofk/edalize/commit/2a3db6658752f97c61048664b478ebfe65a909f8
+    "test_picorv32_artix7_summary"
+    "test_picorv32_artix7_resources"
+    "test_picorv32_artix7_timing"
+    "test_picorv32_kusp_summary"
+    "test_picorv32_kusp_resources"
+    "test_picorv32_kusp_timing"
+    "test_linux_on_litex_vexriscv_arty_a7_summary"
+    "test_linux_on_litex_vexriscv_arty_a7_resources"
+    "test_linux_on_litex_vexriscv_arty_a7_timing"
+  ];
+
  disabledTestPaths = [
    "tests/test_questa_formal.py"
    "tests/test_slang.py"
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@ -27,7 +27,7 @@ let
 in
 buildPythonPackage rec {
  pname = "jax";
-  version = "0.4.19";
+  version = "0.4.20";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -37,7 +37,7 @@ buildPythonPackage rec {
    repo = "jax";
    # google/jax contains tags for jax and jaxlib. Only use jax tags!
    rev = "refs/tags/${pname}-v${version}";
-    hash = "sha256-l5uLPqhg/hqtO9oJSaioow5cH/0jKHDVziGezkfnVcc=";
+    hash = "sha256-WLYXUtchOaA6SGnKuVhN9CmV06xMCLQTEuEtL13ttZU=";
  };

  nativeBuildInputs = [
@ -108,6 +108,10 @@ buildPythonPackage rec {
    "test_device_put"
    "test_make_array_from_callback"
    "test_make_array_from_single_device_arrays"
+
+    # Fails on some hardware due to some numerical error
+    # See https://github.com/google/jax/issues/18535
+    "testQdwhWithOnRankDeficientInput5"
  ];

  disabledTestPaths = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
--- a/pkgs/development/python-modules/jaxlib/bin.nix
+++ b/pkgs/development/python-modules/jaxlib/bin.nix
@ -39,7 +39,7 @@ in
 assert cudaSupport -> lib.versionAtLeast cudatoolkit.version "11.1" && lib.versionAtLeast cudnn.version "8.2" && stdenv.isLinux;

 let
-  version = "0.4.19";
+  version = "0.4.20";

  inherit (python) pythonVersion;

@ -60,65 +60,65 @@ let
      "3.9-x86_64-linux" = getSrcFromPypi {
        platform = "manylinux2014_x86_64";
        dist = "cp39";
-        hash = "sha256-8bTrWutuK0qVnbkcwMfgBf414YdaLc3GK5IsCm/JNPE=";
+        hash = "sha256-eIE+rz5x5BEkO85zncIWE8p/wDPxV8bnVJdHiknS998=";
      };
      "3.9-aarch64-darwin" = getSrcFromPypi {
        platform = "macosx_11_0_arm64";
        dist = "cp39";
-        hash = "sha256-Tmv2iOqlNbZqw/rYjef6GmM0N18EA5JTt6T3lQe+4Rs=";
+        hash = "sha256-dxInv8/aQiHsN7DpScuZao2ZyHDjF0AaTqUDA0qqg/M=";
      };
      "3.9-x86_64-darwin" = getSrcFromPypi {
        platform = "macosx_10_14_x86_64";
        dist = "cp39";
-        hash = "sha256-mDT1INLqPdCkxtMMFR0qHLOIZdWEy8Iuzw1/vOoECsA=";
+        hash = "sha256-wva6LkSokEHN+WQLCancVC7YBIxfImPsQpB1LzFcyqM=";
      };

      "3.10-x86_64-linux" = getSrcFromPypi {
        platform = "manylinux2014_x86_64";
        dist = "cp310";
-        hash = "sha256-ksnY+CPEstact5lKjbSg+ZSPJtSt0Y0NFWEFufBCByk=";
+        hash = "sha256-Yo2TYnkIelyy4vb5+nC/yY8SjV34i/jJvCe/VRQppmo=";
      };
      "3.10-aarch64-darwin" = getSrcFromPypi {
        platform = "macosx_11_0_arm64";
        dist = "cp310";
-        hash = "sha256-O7dHvdKLKfNELGfF4TKy7N5EX6Ca7Zu8OtLXWvFykR8=";
+        hash = "sha256-ufA/ACE4s4R/Fiq5SN7T44SVEN1Z5OfkJ/98lKxRFmo=";
      };
      "3.10-x86_64-darwin" = getSrcFromPypi {
        platform = "macosx_10_14_x86_64";
        dist = "cp310";
-        hash = "sha256-gqKMUZSXrt8sQtTAoQbzAfCzO8gM9Y1/tZpuJVWyN0Y=";
+        hash = "sha256-hBSrYQyOGMn0BexRWQKYnJdEYYlzHUWuWGHmjVT10TE=";
      };

      "3.11-x86_64-linux" = getSrcFromPypi {
        platform = "manylinux2014_x86_64";
        dist = "cp311";
-        hash = "sha256-m+NDzwXMNboNjDl2nLY+vqAoN2dQJZVWb1UQDpqqDPw=";
+        hash = "sha256-5N0nghTBrsa7d8kt8hZC2ghqlxCNC7U8ApD0PG7DHn8=";
      };
      "3.11-aarch64-darwin" = getSrcFromPypi {
        platform = "macosx_11_0_arm64";
        dist = "cp311";
-        hash = "sha256-zCOAjaWWCQT9Jnm1jjc1Rh5gemqy7ACtTKLM0MqSJzM=";
+        hash = "sha256-j13Br64cKe0hFh/cMBbOMuTXqauAvSKE+KzEmN7U6RA=";
      };
      "3.11-x86_64-darwin" = getSrcFromPypi {
        platform = "macosx_10_14_x86_64";
        dist = "cp311";
-        hash = "sha256-gOLIxkk+2hew2GqWu1WgMVEx1YEutx7Zod7QbwsuUVQ=";
+        hash = "sha256-nTnyawU4Ngq9VTE6oDuEfR6iJPRy+E/VLt98cU6eW4M=";
      };

      "3.12-x86_64-linux" = getSrcFromPypi {
        platform = "manylinux2014_x86_64";
        dist = "cp312";
-        hash = "sha256-BZTmkgNuV4nWtfbY4t/19aP43szZQEdgpFXh5qwGRXk=";
+        hash = "sha256-qPMoa7cso7DRBWuCJQoiOEzLPL3m76MPZZMYmZUj400=";
      };
      "3.12-aarch64-darwin" = getSrcFromPypi {
        platform = "macosx_11_0_arm64";
        dist = "cp312";
-        hash = "sha256-aAMTrLXU9EYwPv+kdeyI88/D7b4NANB39Fn8vuXUqFA=";
+        hash = "sha256-VqTC5egDHaDIvwVa3sAc9Sdtd0CwEFcXjDU/i54h844=";
      };
      "3.12-x86_64-darwin" = getSrcFromPypi {
        platform = "macosx_10_14_x86_64";
        dist = "cp312";
-        hash = "sha256-KHzlIfa9KtYcHX+i/F/SKaYTpD4/XjHVu5j3BdRTUmc=";
+        hash = "sha256-1F98Je2rMJJKrksI/EVAsX9n+dOpmDehUeAaMq/BY7o=";
      };
    };

@ -128,19 +128,19 @@ let
  gpuSrcs = {
    "3.9" = fetchurl {
      url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp39-cp39-manylinux2014_x86_64.whl";
-      hash = "sha256-WB5Vbr/XeYKXCP/3DIXF20jR6/1xE3huX1h5ow8ETl0=";
+      hash = "sha256-VM2HuyMnG+hzrsTQEB5KJpqpBXyyp+eV1LVxmY1ZCGU=";
    };
    "3.10" = fetchurl {
      url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp310-cp310-manylinux2014_x86_64.whl";
-      hash = "sha256-zfN0n31+5GohwBkeQrqHus4qOyhM/GEdqG6KUupCZ4o=";
+      hash = "sha256-TLq3z3T2fjTcO3ESahboKG33mrOpjtj9C92f4d4nJKo=";
    };
    "3.11" = fetchurl {
      url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp311-cp311-manylinux2014_x86_64.whl";
-      hash = "sha256-Q8ZtF2GCrG30GFbCeCZTWPmW2TBybeXzh2u+NRiYpx4=";
+      hash = "sha256-CUXwyJq0HOo2j3Sw+NguBCnFkDuJpc3wfZUc90yyhOY=";
    };
    "3.12" = fetchurl {
      url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp312-cp312-manylinux2014_x86_64.whl";
-      hash = "sha256-lphkSDOJ9SwbO0hp/xC1bYn5fWgth9A9Iwsc9zV0buI=";
+      hash = "sha256-bAR8FLtiqufU+rL2a1q9c61CjH1eXxGTNGnDUkHlDBA=";
    };
  };

--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@ -54,7 +54,7 @@ let
  inherit (cudaPackages) backendStdenv cudatoolkit cudaFlags cudnn nccl;

  pname = "jaxlib";
-  version = "0.4.19";
+  version = "0.4.20";

  meta = with lib; {
    description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
@ -95,7 +95,6 @@ let
    "absl_py"
    "astor_archive"
    "astunparse_archive"
-    "boringssl"
    # Not packaged in nixpkgs
    # "com_github_googleapis_googleapis"
    # "com_github_googlecloudplatform_google_cloud_cpp"
@ -151,7 +150,7 @@ let
      repo = "jax";
      # google/jax contains tags for jax and jaxlib. Only use jaxlib tags!
      rev = "refs/tags/${pname}-v${version}";
-      hash = "sha256-l5uLPqhg/hqtO9oJSaioow5cH/0jKHDVziGezkfnVcc=";
+      hash = "sha256-WLYXUtchOaA6SGnKuVhN9CmV06xMCLQTEuEtL13ttZU=";
    };

    nativeBuildInputs = [
@ -264,10 +263,10 @@ let
      ];

      sha256 = (if cudaSupport then {
-        x86_64-linux = "sha256-Hw4uFvltH7nlNN3qAEcQ+IR2FAOjRkvwyWA3rCPi7Vo=";
+        x86_64-linux = "sha256-QczClHxHElLZCqIZlHc3z3DXJ7rZQJaMs2XIb+lxarI=";
      } else {
-        x86_64-linux = "sha256-LEugnFwTV3EyeTZWgMvXzHbgeDPdmuT3daXCXJRMYVY=";
-        aarch64-linux = "sha256-59rv/3RjD8pnveBDZ33xZoNQxLmnhMocsKMgVfYoO70=";
+        x86_64-linux = "sha256-mqiJe4u0NYh1PKCbQfbo0U2e9/kYiBqj98d+BPHFSxQ=";
+        aarch64-linux = "sha256-EuLqamVBJ+qoVMCFIYUT846AghltZolfLGdtO9UeXSM=";
      }).${stdenv.system} or (throw "jaxlib: unsupported system: ${stdenv.system}");
    };

@ -293,13 +292,7 @@ let
          --replace "/usr/bin/install_name_tool" "${cctools}/bin/install_name_tool"
        substituteInPlace ../output/external/rules_cc/cc/private/toolchain/unix_cc_configure.bzl \
          --replace "/usr/bin/libtool" "${cctools}/bin/libtool"
-      '' + (if stdenv.cc.isGNU then ''
-        sed -i 's@-lprotobuf@-l:libprotobuf.a@' ../output/external/xla/third_party/systemlibs/protobuf.BUILD
-        sed -i 's@-lprotoc@-l:libprotoc.a@' ../output/external/xla/third_party/systemlibs/protobuf.BUILD
-      '' else if stdenv.cc.isClang then ''
-        sed -i 's@-lprotobuf@${pkgs.protobuf}/lib/libprotobuf.a@' ../output/external/xla/third_party/systemlibs/protobuf.BUILD
-        sed -i 's@-lprotoc@${pkgs.protobuf}/lib/libprotoc.a@' ../output/external/xla/third_party/systemlibs/protobuf.BUILD
-      '' else throw "Unsupported stdenv.cc: ${stdenv.cc}");
+      '';
    };

    inherit meta;
--- a/pkgs/development/python-modules/opensearch-py/default.nix
+++ b/pkgs/development/python-modules/opensearch-py/default.nix
@ -1,53 +1,81 @@
-{ aiohttp
-, botocore
+{ lib
 , buildPythonPackage
-, certifi
 , fetchFromGitHub
-, lib
+
+# build-system
+, setuptools
+
+# dependencies
+, certifi
+, python-dateutil
+, requests
+, six
+, urllib3
+
+# optional-dependencies
+, aiohttp
+
+# tests
+, botocore
 , mock
 , pytest-asyncio
+, pytest-mock
 , pytestCheckHook
 , pyyaml
-, requests
-, urllib3
+, pytz
 }:

 buildPythonPackage rec {
  pname = "opensearch-py";
-  version = "2.3.2";
-  format = "setuptools";
+  version = "2.4.1";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "opensearch-project";
    repo = "opensearch-py";
    rev = "refs/tags/v${version}";
-    hash = "sha256-MkrYCi/iz1OqqrwCZknfcZSEyZNPj+CZFiMycJQk+aQ=";
+    hash = "sha256-nfKUJjB3yAUGiCSLK3xXHQmtDenVZpLjgICR2hMv1aA=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
-    botocore
    certifi
+    python-dateutil
    requests
+    six
    urllib3
  ];

+  passthru.optional-dependencies.async = [
+    aiohttp
+  ];
+
  nativeCheckInputs = [
+    botocore
    mock
    pytest-asyncio
+    pytest-mock
    pytestCheckHook
    pyyaml
+    pytz
  ] ++ passthru.optional-dependencies.async;

  disabledTestPaths = [
    # require network
    "test_opensearchpy/test_async/test_connection.py"
    "test_opensearchpy/test_async/test_server"
-    "test_opensearchpy/test_connection.py"
    "test_opensearchpy/test_server"
    "test_opensearchpy/test_server_secured"
  ];

-  passthru.optional-dependencies.async = [ aiohttp ];
+  disabledTests = [
+    # finds our ca-bundle, but expects something else (/path/to/clientcert/dir or None)
+    "test_ca_certs_ssl_cert_dir"
+    "test_no_ca_certs"
+  ];

  meta = {
    description = "Python low-level client for OpenSearch";
--- a/pkgs/development/python-modules/psycopg/default.nix
+++ b/pkgs/development/python-modules/psycopg/default.nix
@ -50,6 +50,14 @@ let
      libpq = "${postgresql.lib}/lib/libpq${stdenv.hostPlatform.extensions.sharedLibrary}";
      libc = "${stdenv.cc.libc}/lib/libc.so.6";
    })
+
+    # https://github.com/psycopg/psycopg/pull/669
+    # mark some tests as timing remove on next version update
+    (fetchpatch {
+      name = "mark_tests_as_timing.patch";
+      url = "https://github.com/psycopg/psycopg/commit/00a3c640dd836328ba15931b400b012171f648c2.patch";
+      hash = "sha256-DoVZv1yy9gHOKl0AdVLir+C+UztJZVjboLhS5af2944=";
+    })
  ];

  baseMeta = {
--- a/pkgs/development/python-modules/pynvim-pp/default.nix
+++ b/pkgs/development/python-modules/pynvim-pp/default.nix
@ -7,15 +7,14 @@

 buildPythonPackage {
  pname = "pynvim-pp";
-  version = "unstable-2023-07-09";
-
-  format = "pyproject";
+  version = "unstable-2023-08-03";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "ms-jpq";
    repo = "pynvim_pp";
-    rev = "93aa25bf3ee039c4eb85f402d6adf6977033013b";
-    hash = "sha256-gZvIiFpP+eMLD8/xodY7ywWxhWXtethXviVRedW/bgo=";
+    rev = "40d0f6053ddbba61f53505eebb0290cfb661661b";
+    hash = "sha256-4jeYE9HL+PQZuJq5nyf9CgL4UrRWm3ifLL/vfygLOwc=";
  };

  nativeBuildInputs = [ setuptools ];
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "pyvex";
-  version = "9.2.76";
+  version = "9.2.77";
  pyproject = true;

  disabled = pythonOlder "3.11";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-JlwqxKJaJ3sk2mROUOaF0N5d4V7LM43VqEXnuSO45BY=";
+    hash = "sha256-kVMhzdTYwra8G/4gg1G853vUr7YHxxt/zXus/SXMkXc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "rns";
-  version = "0.6.7";
+  version = "0.6.8";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "markqvist";
    repo = "Reticulum";
    rev = "refs/tags/${version}";
-    hash = "sha256-u5GMCM9HyrblGbmIvfDWTfIAV8Zpn8tF0oOaolFtQMk=";
+    hash = "sha256-MDD0Vs5XIWqxKHbrAa0vXJRd8uYZDlr//hP1NBf4b7U=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "slack-sdk";
-  version = "3.23.0";
+  version = "3.23.1";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -29,7 +29,7 @@ buildPythonPackage rec {
    owner = "slackapi";
    repo = "python-slack-sdk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-OsPwLOnmN3kvPmbM6lOaiTWwWvy7b9pgn1X536dCkWk=";
+    hash = "sha256-lqB4eljM/JLyvVHeT7LnYgjG3AP3i9le2IxUI31aK6o=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/sphinxext-opengraph/default.nix
+++ b/pkgs/development/python-modules/sphinxext-opengraph/default.nix
@ -11,16 +11,16 @@

 buildPythonPackage rec {
  pname = "sphinxext-opengraph";
-  version = "0.8.2";
+  version = "0.9.0";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "wpilibsuite";
    repo = "sphinxext-opengraph";
    rev = "refs/tags/v${version}";
-    hash = "sha256-SrZTtVzEp4E87fzisWKHl8iRP49PWt5kkJq62CqXrBc=";
+    hash = "sha256-ZLIxbFgayG+WVvSXu74eZJ/PbSHg6dzkkIr1OBry4DE=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
@ -29,15 +29,20 @@ buildPythonPackage rec {
    setuptools-scm
  ];

+  passthru.optional-dependencies = {
+    social_cards_generation = [
+      matplotlib
+    ];
+  };
+
  propagatedBuildInputs = [
    sphinx
-    matplotlib
  ];

  nativeCheckInputs = [
    pytestCheckHook
    beautifulsoup4
-  ];
+  ] ++ passthru.optional-dependencies.social_cards_generation;

  pythonImportsCheck = [ "sphinxext.opengraph" ];

--- a/pkgs/development/python-modules/std2/default.nix
+++ b/pkgs/development/python-modules/std2/default.nix
@ -6,15 +6,14 @@

 buildPythonPackage {
  pname = "std2";
-  version = "unstable-2023-07-09";
-
-  format = "pyproject";
+  version = "unstable-2023-10-07";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "ms-jpq";
    repo = "std2";
-    rev = "2d5594b40585ecae60ce5175bee68cc8b3085ee6";
-    hash = "sha256-phGIWow7PGOtS1Pre1Gz0Xg6izGp6BiUTmze5jI/BwY=";
+    rev = "6332e559ee51c3a7c956804afdd7e1cc6ad47965";
+    hash = "sha256-huN7P/Ws6anrFXDG7L5xxMenS25BHquV9cMi1s7WFJ4=";
  };

  nativeBuildInputs = [ setuptools ];
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "checkov";
-  version = "3.0.32";
+  version = "3.0.36";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = "checkov";
    rev = "refs/tags/${version}";
-    hash = "sha256-YOZ7F/bxbnBh3mhiFL3cMMAc3qeOMab48LcvYeJgfrg=";
+    hash = "sha256-MrzCqR1+IJAv81fbuaNygGejRF4EzIZWPutL5qLluhU=";
  };

  patches = [
--- a/Show More
+++ b/Show More