Merge branch 'master' into staging-next

2025-02-20 11:05:14 +00:00 · 2023-03-24 09:03:44 +01:00 · 2023-03-24 09:03:44 +01:00 · 12dd95fbb1
commit 12dd95fbb1
parent cb10bd6cb3 d4660b45bc
130 changed files with 4239 additions and 2371 deletions
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -187,6 +187,12 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The `services.pipewire.config` options have been removed, as they have basically never worked correctly. All behavior defined by the default configuration can be overridden with drop-in files as necessary - see [below](#sec-release-23.05-migration-pipewire) for details.

+- The catch-all `hardware.video.hidpi.enable` option was removed. Users on high density displays may want to:
+
+  - Set `services.xserver.upscaleDefaultCursor` to upscale the default X11 cursor for higher resolutions
+  - Adjust settings under `fonts.fontconfig` according to preference
+  - Adjust `console.font` according to preference, though the kernel will generally choose a reasonably sized font
+
 - `services.pipewire.media-session` and the `pipewire-media-session` package have been removed, as they are no longer supported upstream. Users are encouraged to use `services.pipewire.wireplumber` instead.

 - The `baget` package and module was removed due to being unmaintained.
@ -270,11 +276,6 @@ In addition to numerous new and upgraded packages, this release has the followin
    [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
    can be directly written as attribute-set in Nix within this option.

- The `hardware.video.hidpi.enable` was renamed to `fonts.optimizeForVeryHighDPI` to be consistent with what it actually does.
-  They disable by default: antialiasing, hinting and LCD filter for subpixel rendering. They can be overridden if you experience problems with font rendering.
-  On Xorg, the default cursor is upscaled.
-  Please see the documentation for the new option to decide if you want to keep it enabled.
-
 - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.

 - `services.grafana` listens only on localhost by default again. This was changed to upstreams default of `0.0.0.0` by accident in the freeform setting conversion.
@ -345,6 +346,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `k3s` can now be configured with an EnvironmentFile for its systemd service, allowing secrets to be provided without ending up in the Nix Store.

+- `boot.initrd.luks.device.<name>` has a new `tryEmptyPassphrase` option, this is useful for OEM's who need to install an encrypted disk with a future settable passphrase
+
 ## Detailed migration information {#sec-release-23.05-migration}

 ### Pipewire configuration overrides {#sec-release-23.05-migration-pipewire}
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@ -7,6 +7,19 @@ This module generates a package containing configuration files and link it in /e
 Fontconfig reads files in folder name / file name order, so the number prepended to the configuration file name decide the order of parsing.
 Low number means high priority.

+NOTE: Please take extreme care when adjusting the default settings of this module.
+People care a lot, and I mean A LOT, about their font rendering, and you will be
+The Person That Broke It if it changes in a way people don't like.
+
+See prior art:
+- https://github.com/NixOS/nixpkgs/pull/194594
+- https://github.com/NixOS/nixpkgs/pull/222236
+- https://github.com/NixOS/nixpkgs/pull/222689
+
+And do not repeat our mistakes.
+
+- @K900, March 2023
+
 */

 { config, pkgs, lib, ... }:
@ -218,6 +231,8 @@ let
    paths = cfg.confPackages;
    ignoreCollisions = true;
  };
+
+  fontconfigNote = "Consider manually configuring fonts.fontconfig according to personal preference.";
 in
 {
  imports = [
@ -229,6 +244,8 @@ in
    (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "dpi" ] "Use display server-specific options")
+    (mkRemovedOptionModule [ "hardware" "video" "hidpi" "enable" ] fontconfigNote)
+    (mkRemovedOptionModule [ "fonts" "optimizeForVeryHighDPI" ] fontconfigNote)
  ] ++ lib.forEach [ "enable" "substitutions" "preset" ]
     (opt: lib.mkRemovedOptionModule [ "fonts" "fontconfig" "ultimate" "${opt}" ] ''
       The fonts.fontconfig.ultimate module and configuration is obsolete.
--- a/nixos/modules/config/fonts/fonts.nix
+++ b/nixos/modules/config/fonts/fonts.nix
@ -13,13 +13,10 @@ let
      pkgs.unifont
      pkgs.noto-fonts-emoji
    ];
-
 in
-
 {
  imports = [
    (mkRemovedOptionModule [ "fonts" "enableCoreFonts" ] "Use fonts.fonts = [ pkgs.corefonts ]; instead.")
-    (mkRenamedOptionModule [ "hardware" "video" "hidpi" "enable" ] [ "fonts" "optimizeForVeryHighDPI" ])
  ];

  options = {
@ -42,33 +39,9 @@ in
          and families and reasonable coverage of Unicode.
        '';
      };
-
-      optimizeForVeryHighDPI = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Optimize configuration for very high-density (>200 DPI) displays:
-            - disable subpixel anti-aliasing
-            - disable hinting
-            - automatically upscale the default X11 cursor
-        '';
-      };
    };

  };

-  config = mkMerge [
-    { fonts.fonts = mkIf cfg.enableDefaultFonts defaultFonts; }
-    (mkIf cfg.optimizeForVeryHighDPI {
-      services.xserver.upscaleDefaultCursor = mkDefault true;
-      # Conforms to the recommendation in fonts/fontconfig.nix
-      # for > 200DPI.
-      fonts.fontconfig = {
-        antialias = mkDefault false;
-        hinting.enable = mkDefault false;
-        subpixel.lcdfilter = mkDefault "none";
-      };
-    })
-  ];
-
+  config = { fonts.fonts = mkIf cfg.enableDefaultFonts defaultFonts; };
 }
--- a/nixos/modules/services/logging/logrotate.nix
+++ b/nixos/modules/services/logging/logrotate.nix
@ -187,7 +187,7 @@ in
          A configuration file automatically generated by NixOS.
        '';
        description = lib.mdDoc ''
-          Override the configuration file used by MySQL. By default,
+          Override the configuration file used by logrotate. By default,
          NixOS generates one automatically from [](#opt-services.logrotate.settings).
        '';
        example = literalExpression ''
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@ -158,6 +158,20 @@ let
      wait_target "header" ${dev.header} || die "${dev.header} is unavailable"
    ''}

+    try_empty_passphrase() {
+        ${if dev.tryEmptyPassphrase then ''
+             echo "Trying empty passphrase!"
+             echo "" | ${csopen}
+             cs_status=$?
+             if [ $cs_status -eq 0 ]; then
+                 return 0
+             else
+                 return 1
+             fi
+        '' else "return 1"}
+    }
+
+
    do_open_passphrase() {
        local passphrase

@ -212,13 +226,27 @@ let
            ${csopen} --key-file=${dev.keyFile} \
              ${optionalString (dev.keyFileSize != null) "--keyfile-size=${toString dev.keyFileSize}"} \
              ${optionalString (dev.keyFileOffset != null) "--keyfile-offset=${toString dev.keyFileOffset}"}
+            cs_status=$?
+            if [ $cs_status -ne 0 ]; then
+              echo "Key File ${dev.keyFile} failed!"
+              if ! try_empty_passphrase; then
+                ${if dev.fallbackToPassword then "echo" else "die"} "${dev.keyFile} is unavailable"
+                echo " - failing back to interactive password prompt"
+                do_open_passphrase
+              fi
+            fi
        else
-            ${if dev.fallbackToPassword then "echo" else "die"} "${dev.keyFile} is unavailable"
-            echo " - failing back to interactive password prompt"
-            do_open_passphrase
+            # If the key file never shows up we should also try the empty passphrase
+            if ! try_empty_passphrase; then
+               ${if dev.fallbackToPassword then "echo" else "die"} "${dev.keyFile} is unavailable"
+               echo " - failing back to interactive password prompt"
+               do_open_passphrase
+            fi
        fi
        '' else ''
-        do_open_passphrase
+           if ! try_empty_passphrase; then
+              do_open_passphrase
+           fi
        ''}
    }

@ -476,6 +504,7 @@ let
  preLVM = filterAttrs (n: v: v.preLVM) luks.devices;
  postLVM = filterAttrs (n: v: !v.preLVM) luks.devices;

+
  stage1Crypttab = pkgs.writeText "initrd-crypttab" (lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: let
    opts = v.crypttabExtraOpts
      ++ optional v.allowDiscards "discard"
@ -483,6 +512,8 @@ let
      ++ optional (v.header != null) "header=${v.header}"
      ++ optional (v.keyFileOffset != null) "keyfile-offset=${toString v.keyFileOffset}"
      ++ optional (v.keyFileSize != null) "keyfile-size=${toString v.keyFileSize}"
+      ++ optional (v.keyFileTimeout != null) "keyfile-timeout=${builtins.toString v.keyFileTimeout}s"
+      ++ optional (v.tryEmptyPassphrase) "try-empty-password=true"
    ;
  in "${n} ${v.device} ${if v.keyFile == null then "-" else v.keyFile} ${lib.concatStringsSep "," opts}") luks.devices));

@ -594,6 +625,25 @@ in
            '';
          };

+          tryEmptyPassphrase = mkOption {
+            default = false;
+            type = types.bool;
+            description = lib.mdDoc ''
+              If keyFile fails then try an empty passphrase first before
+              prompting for password.
+            '';
+          };
+
+          keyFileTimeout = mkOption {
+            default = null;
+            example = 5;
+            type = types.nullOr types.int;
+            description = lib.mdDoc ''
+              The amount of time in seconds for a keyFile to appear before
+              timing out and trying passwords.
+            '';
+          };
+
          keyFileSize = mkOption {
            default = null;
            example = 4096;
@ -889,6 +939,10 @@ in
          message = "boot.initrd.luks.devices.<name>.bypassWorkqueues is not supported for kernels older than 5.9";
        }

+        { assertion = !config.boot.initrd.systemd.enable -> all (x: x.keyFileTimeout == null) (attrValues luks.devices);
+          message = "boot.initrd.luks.devices.<name>.keyFileTimeout is only supported for systemd initrd";
+        }
+
        { assertion = config.boot.initrd.systemd.enable -> all (dev: !dev.fallbackToPassword) (attrValues luks.devices);
          message = "boot.initrd.luks.devices.<name>.fallbackToPassword is implied by systemd stage 1.";
        }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -311,6 +311,7 @@ in {
  influxdb = handleTest ./influxdb.nix {};
  initrd-network-openvpn = handleTest ./initrd-network-openvpn {};
  initrd-network-ssh = handleTest ./initrd-network-ssh {};
+  initrd-luks-empty-passphrase = handleTest ./initrd-luks-empty-passphrase.nix {};
  initrdNetwork = handleTest ./initrd-network.nix {};
  initrd-secrets = handleTest ./initrd-secrets.nix {};
  initrd-secrets-changing = handleTest ./initrd-secrets-changing.nix {};
@ -662,6 +663,7 @@ in {
  systemd-initrd-btrfs-raid = handleTest ./systemd-initrd-btrfs-raid.nix {};
  systemd-initrd-luks-fido2 = handleTest ./systemd-initrd-luks-fido2.nix {};
  systemd-initrd-luks-keyfile = handleTest ./systemd-initrd-luks-keyfile.nix {};
+  systemd-initrd-luks-empty-passphrase = handleTest ./initrd-luks-empty-passphrase.nix { systemdStage1 = true; };
  systemd-initrd-luks-password = handleTest ./systemd-initrd-luks-password.nix {};
  systemd-initrd-luks-tpm2 = handleTest ./systemd-initrd-luks-tpm2.nix {};
  systemd-initrd-modprobe = handleTest ./systemd-initrd-modprobe.nix {};
--- a/nixos/tests/initrd-luks-empty-passphrase.nix
+++ b/nixos/tests/initrd-luks-empty-passphrase.nix
@ -0,0 +1,97 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. {inherit system config; }
+, systemdStage1 ? false }:
+import ./make-test-python.nix ({ lib, pkgs, ... }: let
+
+  keyfile = pkgs.writeText "luks-keyfile" ''
+    MIGHAoGBAJ4rGTSo/ldyjQypd0kuS7k2OSsmQYzMH6TNj3nQ/vIUjDn7fqa3slt2
+    gV6EK3TmTbGc4tzC1v4SWx2m+2Bjdtn4Fs4wiBwn1lbRdC6i5ZYCqasTWIntWn+6
+    FllUkMD5oqjOR/YcboxG8Z3B5sJuvTP9llsF+gnuveWih9dpbBr7AgEC
+  '';
+
+in {
+  name = "initrd-luks-empty-passphrase";
+
+  nodes.machine = { pkgs, ... }: {
+    virtualisation = {
+      emptyDiskImages = [ 512 ];
+      useBootLoader = true;
+      useEFIBoot = true;
+    };
+
+    boot.loader.systemd-boot.enable = true;
+    boot.initrd.systemd = lib.mkIf systemdStage1 {
+      enable = true;
+      emergencyAccess = true;
+    };
+    environment.systemPackages = with pkgs; [ cryptsetup ];
+
+    specialisation.boot-luks-wrong-keyfile.configuration = {
+      boot.initrd.luks.devices = lib.mkVMOverride {
+        cryptroot = {
+          device = "/dev/vdc";
+          keyFile = "/etc/cryptroot.key";
+          tryEmptyPassphrase = true;
+          fallbackToPassword = !systemdStage1;
+        };
+      };
+      virtualisation.bootDevice = "/dev/mapper/cryptroot";
+      boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
+    };
+
+    specialisation.boot-luks-missing-keyfile.configuration = {
+      boot.initrd.luks.devices = lib.mkVMOverride {
+        cryptroot = {
+          device = "/dev/vdc";
+          keyFile = "/etc/cryptroot.key";
+          tryEmptyPassphrase = true;
+          fallbackToPassword = !systemdStage1;
+        };
+      };
+      virtualisation.bootDevice = "/dev/mapper/cryptroot";
+    };
+  };
+
+  testScript = ''
+    # Encrypt key with empty key so boot should try keyfile and then fallback to empty passphrase
+
+
+    def grub_select_boot_luks_wrong_key_file():
+        """
+        Selects "boot-luks" from the GRUB menu
+        to trigger a login request.
+        """
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey ret")
+
+    def grub_select_boot_luks_missing_key_file():
+        """
+        Selects "boot-luks" from the GRUB menu
+        to trigger a login request.
+        """
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey ret")
+
+    # Create encrypted volume
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("echo "" | cryptsetup luksFormat /dev/vdc --batch-mode")
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-wrong-keyfile.conf")
+    machine.succeed("sync")
+    machine.crash()
+
+    # Check if rootfs is on /dev/mapper/cryptroot
+    machine.wait_for_unit("multi-user.target")
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+
+    # Choose boot-luks-missing-keyfile specialisation
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-missing-keyfile.conf")
+    machine.succeed("sync")
+    machine.crash()
+
+    # Check if rootfs is on /dev/mapper/cryptroot
+    machine.wait_for_unit("multi-user.target")
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+  '';
+})
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "lsp-plugins";
-  version = "1.2.5";
+  version = "1.2.6";

  src = fetchurl {
    url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
+    sha256 = "sha256-lNrIsXW3ZNKMFwsl5qowWqK/ZaCaQUAlrSscnsOxvVg=";
  };

  outputs = [ "out" "dev" "doc" ];
@ -19,6 +19,8 @@ stdenv.mkDerivation rec {

  makeFlags = [
    "PREFIX=${placeholder "out"}"
+    "ETCDIR=${placeholder "out"}/etc"
+    "SHAREDDIR=${placeholder "out"}/share"
  ];

  env.NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
@ -34,138 +36,58 @@ stdenv.mkDerivation rec {
  meta = with lib;
    { description = "Collection of open-source audio plugins";
      longDescription = ''
-        Compatible with follwing formats:
+        Compatible with the following formats:

+        - CLAP - set of plugins for Clever Audio Plugins API
        - LADSPA - set of plugins for Linux Audio Developer's Simple Plugin API
        - LV2 - set of plugins and UIs for Linux Audio Developer's Simple Plugin API (LADSPA) version 2
        - LinuxVST - set of plugins and UIs for Steinberg's VST 2.4 format ported on GNU/Linux Platform
        - JACK - Standalone versions for JACK Audio connection Kit with UI

-        Contains the following plugins:
+        Contains the following plugins (https://lsp-plug.in/?page=plugins)

-        - Limiter Mono - Begrenzer Mono
-        - Limiter Stereo - Begrenzer Stereo
-        - Dynamic Processor LeftRight - Dynamikprozessor LeftRight
-        - Dynamic Processor MidSide - Dynamikprozessor MidSide
-        - Dynamic Processor Mono - Dynamikprozessor Mono
-        - Dynamic Processor Stereo - Dynamikprozessor Stereo
-        - Expander LeftRight - Expander LeftRight
-        - Expander MidSide - Expander MidSide
-        - Expander Mono - Expander Mono
-        - Expander Stereo - Expander Stereo
-        - Crossover LeftRight x8 - Frequenzweiche LeftRight x8
-        - Crossover MidSide x8 - Frequenzweiche MidSide x8
-        - Crossover Mono x8 - Frequenzweiche Mono x8
-        - Crossover Stereo x8 - Frequenzweiche Stereo x8
-        - Gate LeftRight - Gate LeftRight
-        - Gate MidSide - Gate MidSide
-        - Gate Mono - Gate Mono
-        - Gate Stereo - Gate Stereo
-        - Graphic Equalizer x16 LeftRight - Grafischer Entzerrer x16 LeftRight
-        - Graphic Equalizer x16 MidSide - Grafischer Entzerrer x16 MidSide
-        - Graphic Equalizer x16 Mono - Grafischer Entzerrer x16 Mono
-        - Graphic Equalizer x16 Stereo - Grafischer Entzerrer x16 Stereo
-        - Graphic Equalizer x32 LeftRight - Grafischer Entzerrer x32 LeftRight
-        - Graphic Equalizer x32 MidSide - Grafischer Entzerrer x32 MidSide
-        - Graphic Equalizer x32 Mono - Grafischer Entzerrer x32 Mono
-        - Graphic Equalizer x32 Stereo - Grafischer Entzerrer x32 Stereo
-        - Impulse Responses Mono - Impulsantworten Mono
-        - Impulse Responses Stereo - Impulsantworten Stereo
-        - Impulse Reverb Mono - Impulsnachhall Mono
-        - Impulse Reverb Stereo - Impulsnachhall Stereo
-        - Sampler Mono - Klangerzeuger Mono
-        - Sampler Stereo - Klangerzeuger Stereo
-        - Compressor LeftRight - Kompressor LeftRight
-        - Compressor MidSide - Kompressor MidSide
-        - Compressor Mono - Kompressor Mono
-        - Compressor Stereo - Kompressor Stereo
-        - Artistic Delay Mono - Künstlerische Verzögerung
-        - Artistic Delay Stereo - Künstlerische Verzögerung
-        - Latency Meter - Latenzmessgerät
-        - Loudness Compensator Mono - Lautstärke Kompensator Mono
-        - Loudness Compensator Stereo - Lautstärke Kompensator Stereo
-        - Multiband Expander LeftRight x8 - Multi-band Expander LeftRight x8
-        - Multiband Expander MidSide x8 - Multi-band Expander MidSide x8
-        - Multiband Expander Mono x8 - Multi-band Expander Mono x8
-        - Multiband Expander Stereo x8 - Multi-band Expander Stereo x8
-        - Multiband Gate LeftRight x8 - Multi-band Gate LeftRight x8
-        - Multiband Gate MidSide x8 - Multi-band Gate MidSide x8
-        - Multiband Gate Mono x8 - Multi-band Gate Mono x8
-        - Multiband Gate Stereo x8 - Multi-band Gate Stereo x8
-        - Multiband Compressor LeftRight x8 - Multi-band Kompressor LeftRight x8
-        - Multiband Compressor MidSide x8 - Multi-band Kompressor MidSide x8
-        - Multiband Compressor Mono x8 - Multi-band Kompressor Mono x8
-        - Multiband Compressor Stereo x8 - Multi-band Kompressor Stereo x8
-        - Oscilloscope x1 - Oscilloscope x1
-        - Oscilloscope x2 - Oscilloscope x2
-        - Oscilloscope x4 - Oscilloscope x4
-        - Oscillator Mono - Oszillator Mono
-        - Parametric Equalizer x16 LeftRight - Parametrischer Entzerrer x16 LeftRight
-        - Parametric Equalizer x16 MidSide - Parametrischer Entzerrer x16 MidSide
-        - Parametric Equalizer x16 Mono - Parametrischer Entzerrer x16 Mono
-        - Parametric Equalizer x16 Stereo - Parametrischer Entzerrer x16 Stereo
-        - Parametric Equalizer x32 LeftRight - Parametrischer Entzerrer x32 LeftRight
-        - Parametric Equalizer x32 MidSide - Parametrischer Entzerrer x32 MidSide
-        - Parametric Equalizer x32 Mono - Parametrischer Entzerrer x32 Mono
-        - Parametric Equalizer x32 Stereo - Parametrischer Entzerrer x32 Stereo
-        - Phase Detector - Phasendetektor
-        - Profiler Mono - Profiler Mono
-        - Profiler Stereo - Profiler Stereo
-        - Room Builder Mono - Raumbaumeister Mono
-        - Room Builder Stereo - Raumbaumeister Stereo
-        - Multi-Sampler x12 DirectOut - Schlagzeug x12 Direktausgabe
-        - Multi-Sampler x12 Stereo - Schlagzeug x12 Stereo
-        - Multi-Sampler x24 DirectOut - Schlagzeug x24 Direktausgabe
-        - Multi-Sampler x24 Stereo - Schlagzeug x24 Stereo
-        - Multi-Sampler x48 DirectOut - Schlagzeug x48 Direktausgabe
-        - Multi-Sampler x48 Stereo - Schlagzeug x48 Stereo
-        - Sidechain Multiband Expander LeftRight x8 - Sidechain Multi-band Expander LeftRight x8
-        - Sidechain Multiband Expander MidSide x8 - Sidechain Multi-band Expander MidSide x8
-        - Sidechain Multiband Expander Mono x8 - Sidechain Multi-band Expander Mono x8
-        - Sidechain Multiband Expander Stereo x8 - Sidechain Multi-band Expander Stereo x8
-        - Sidechain Multiband Gate LeftRight x8 - Sidechain Multi-band Gate LeftRight x8
-        - Sidechain Multiband Gate MidSide x8 - Sidechain Multi-band Gate MidSide x8
-        - Sidechain Multiband Gate Mono x8 - Sidechain Multi-band Gate Mono x8
-        - Sidechain Multiband Gate Stereo x8 - Sidechain Multi-band Gate Stereo x8
-        - Sidechain Multiband Compressor LeftRight x8 - Sidechain Multi-band Kompressor LeftRight x8
-        - Sidechain Multiband Compressor MidSide x8 - Sidechain Multi-band Kompressor MidSide x8
-        - Sidechain Multiband Compressor Mono x8 - Sidechain Multi-band Kompressor Mono x8
-        - Sidechain Multiband Compressor Stereo x8 - Sidechain Multi-band Kompressor Stereo x8
-        - Sidechain Limiter Mono - Sidechain-Begrenzer Mono
-        - Sidechain Limiter Stereo - Sidechain-Begrenzer Stereo
-        - Sidechain Dynamic Processor LeftRight - Sidechain-Dynamikprozessor LeftRight
-        - Sidechain Dynamic Processor MidSide - Sidechain-Dynamikprozessor MidSide
-        - Sidechain Dynamic Processor Mono - Sidechain-Dynamikprozessor Mono
-        - Sidechain Dynamic Processor Stereo - Sidechain-Dynamikprozessor Stereo
-        - Sidechain Expander LeftRight - Sidechain-Expander LeftRight
-        - Sidechain Expander MidSide - Sidechain-Expander MidSide
-        - Sidechain Expander Mono - Sidechain-Expander Mono
-        - Sidechain Expander Stereo - Sidechain-Expander Stereo
-        - Sidechain Gate LeftRight - Sidechain-Gate LeftRight
-        - Sidechain Gate MidSide - Sidechain-Gate MidSide
-        - Sidechain Gate Mono - Sidechain-Gate Mono
-        - Sidechain Gate Stereo - Sidechain-Gate Stereo
-        - Sidechain Compressor LeftRight - Sidechain-Kompressor LeftRight
-        - Sidechain Compressor MidSide - Sidechain-Kompressor MidSide
-        - Sidechain Compressor Mono - Sidechain-Kompressor Mono
-        - Sidechain Compressor Stereo - Sidechain-Kompressor Stereo
-        - Slapback Delay Mono - Slapback-Delay Mono
-        - Slapback Delay Stereo - Slapback-Delay Stereo
-        - Spectrum Analyzer x1 - Spektrumanalysator x1
-        - Spectrum Analyzer x12 - Spektrumanalysator x12
-        - Spectrum Analyzer x16 - Spektrumanalysator x16
-        - Spectrum Analyzer x2 - Spektrumanalysator x2
-        - Spectrum Analyzer x4 - Spektrumanalysator x4
-        - Spectrum Analyzer x8 - Spektrumanalysator x8
-        - Surge Filter Mono - Sprungfilter Mono
-        - Surge Filter Stereo - Sprungfilter Stereo
-        - Trigger MIDI Mono - Triggersensor MIDI Mono
-        - Trigger MIDI Stereo - Triggersensor MIDI Stereo
-        - Trigger Mono - Triggersensor Mono
-        - Trigger Stereo - Triggersensor Stereo
-        - Delay Compensator Mono - Verzögerungsausgleicher Mono
-        - Delay Compensator Stereo - Verzögerungsausgleicher Stereo
-        - Delay Compensator x2 Stereo - Verzögerungsausgleicher x2 Stereo
+        Equalizers:
+        - Graphic Equalizer
+        - Parametric Equalizer
+        Dynamic Processing:
+        - Compressor
+        - Dynamic Processor
+        - Expander
+        - Gate
+        - Limiter
+        Multiband Dynamic Processing:
+        - Multiband Compressor
+        - Multiband Dynamic Processor
+        - Multiband Expander
+        - Multiband Gate
+        Convolution / Reverb processing:
+        - Impulse Responses
+        - Impulse Reverb
+        - Room Builder
+        Delay Effects:
+        - Artistic Delay
+        - Compensation Delay
+        - Slap-back Delay
+        Analyzers:
+        - Oscilloscope
+        - Phase Detector
+        - Spectrum Analyzer
+        Multiband Processing:
+        - Crossover
+        Samplers:
+        - Multisampler
+        - Sampler
+        Generators / Oscillators:
+        - Noise Generator
+        - Oscillator
+        Utilitary Plugins:
+        - A/B Test Plugin
+        - Latency Meter
+        - Loudness Compensator
+        - Mixer
+        - Profiler
+        - Surge Filter
+        - Trigger
      '';
      homepage = "https://lsp-plug.in";
      maintainers = with maintainers; [ magnetophon ];
--- a/pkgs/applications/audio/sonic-lineup/default.nix
+++ b/pkgs/applications/audio/sonic-lineup/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, alsa-lib, boost, bzip2, fftw, fftwFloat, libfishsound
+{ lib, stdenv, fetchurl, fetchpatch2, alsa-lib, boost, bzip2, fftw, fftwFloat, libfishsound
 , libid3tag, liblo, libmad, liboggz, libpulseaudio, libsamplerate
 , libsndfile, lrdf, opusfile, portaudio, rubberband, serd, sord, capnproto
 , wrapQtAppsHook, pkg-config
@ -14,6 +14,16 @@ stdenv.mkDerivation rec {
    sha256 = "0k45k9fawcm4s5yy05x00pgww7j8m7k2cxcc7g0fn9vqy7vcbq9h";
  };

+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/sonic-visualiser/svcore/commit/5a7b517e43b7f0b3f03b7fc3145102cf4e5b0ffc.patch";
+      stripLen = 1;
+      extraPrefix = "svcore/";
+      sha256 = "sha256-DOCdQqCihkR0g/6m90DbJxw00QTpyVmFzCxagrVWKiI=";
+    })
+    ./match-vamp.patch
+  ];
+
  buildInputs =
    [ alsa-lib boost bzip2 fftw fftwFloat libfishsound libid3tag liblo
      libmad liboggz libpulseaudio libsamplerate libsndfile lrdf opusfile
@ -36,7 +46,5 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2Plus;
    maintainers = [ maintainers.vandenoever ];
    platforms = platforms.linux;
-    # undefined reference to `std::__throw_bad_array_new_length()@GLIBCXX_3.4.29'
-    broken = true; # at 2022-09-30
  };
 }
--- a/pkgs/applications/audio/sonic-lineup/match-vamp.patch
+++ b/pkgs/applications/audio/sonic-lineup/match-vamp.patch
@ -0,0 +1,11 @@
+--- a/match/src/FullDTW.h
+++ b/match/src/FullDTW.h
+@@ -83,7 +83,7 @@
+      * against the best-matching subsequence of s1; otherwise it is
+      * against the whole of s1.
+      */
+-    std::vector<size_t> align(const featureseq_t &s1,
+    std::vector<std::size_t> align(const featureseq_t &s1,
+                               const featureseq_t &s2);
+ 
+ private:
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -69,6 +69,17 @@
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-bash";
  };
+  bass = buildGrammar {
+    language = "bass";
+    version = "27f110d";
+    src = fetchFromGitHub {
+      owner = "amaanq";
+      repo = "tree-sitter-bass";
+      rev = "27f110dfe79620993f5493ffa0d0f2fe12d250ed";
+      hash = "sha256-OmYtp2TAsAjw2fgdSezHUrP46b/QXgCbDeJa4ANrtvY=";
+    };
+    meta.homepage = "https://github.com/amaanq/tree-sitter-bass";
+  };
  beancount = buildGrammar {
    language = "beancount";
    version = "f3741a3";
@ -590,12 +601,12 @@
  };
  glimmer = buildGrammar {
    language = "glimmer";
-    version = "40cfb72";
+    version = "bc1c685";
    src = fetchFromGitHub {
      owner = "alexlafroscia";
      repo = "tree-sitter-glimmer";
-      rev = "40cfb72a53654cbd666451ca04ffd500257c7b73";
-      hash = "sha256-h9ZZz6mbkErLIG/BamNRRoRdqmuBO3v17W0uvmpbm7A=";
+      rev = "bc1c685aa6a7caf9e58c5746ab386a1e673eb9af";
+      hash = "sha256-CDXyynCsnmOvOs1rs9e29tNHosywTvGM0UyWVtwMqZ8=";
    };
    meta.homepage = "https://github.com/alexlafroscia/tree-sitter-glimmer";
  };
@ -1597,12 +1608,12 @@
  };
  sql = buildGrammar {
    language = "sql";
-    version = "4cb5b36";
+    version = "d2b64d8";
    src = fetchFromGitHub {
      owner = "derekstride";
      repo = "tree-sitter-sql";
-      rev = "4cb5b36d70687bfe4687c68483b4dacde309ae6f";
-      hash = "sha256-7YkVPuQS8NGcHXHwgFTZ4kWL01AnNeOGxdY8xFISSzY=";
+      rev = "d2b64d85d0cab5edeffe44243134033e6ff07c02";
+      hash = "sha256-Mo87yEF0YGF9t+bXvxuULtlOWAFKyBDjU6rF6eOXLao=";
    };
    meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
  };
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -793,7 +793,7 @@ self: super: {
        pname = "sg-nvim-rust";
        inherit (old) version src;

-        cargoHash = "sha256-z3ZWHhqiJKFzVcFJadfPU6+ELlnvEOAprCyStszegdI=";
+        cargoHash = "sha256-GN7KM3fkeOcqmyUwsPMw499kS/eYqh8pbyPgMv4/NN4=";

        nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -324,6 +324,7 @@ https://github.com/cocopon/iceberg.vim/,,
 https://github.com/idris-hackers/idris-vim/,,
 https://github.com/edwinb/idris2-vim/,,
 https://github.com/lewis6991/impatient.nvim/,,
+https://github.com/smjonas/inc-rename.nvim/,HEAD,
 https://github.com/nishigori/increment-activator/,,
 https://github.com/haya14busa/incsearch-easymotion.vim/,,
 https://github.com/haya14busa/incsearch.vim/,,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2953,6 +2953,24 @@ let
        };
      };

+      vscjava.vscode-gradle = buildVscodeMarketplaceExtension rec {
+        mktplcRef = {
+          name = "vscode-gradle";
+          publisher = "vscjava";
+          version = "3.12.6";
+          sha256 = "sha256-j4JyhNGsRlJmS8Wj38gLpC1gXVvdPx10cgzP8dXmmNo=";
+        };
+
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/vscjava.vscode-gradle/changelog";
+          description = "A Visual Studio Code extension for Gradle build tool";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=vscjava.vscode-gradle";
+          homepage = "https://github.com/microsoft/vscode-gradle";
+          license = lib.licenses.mit;
+          maintainers = with lib.maintainers; [ rhoriguchi ];
+        };
+      };
+
      vscjava.vscode-java-debug = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "vscode-java-debug";
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@ -18,7 +18,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "komikku";
-  version = "1.15.0";
+  version = "1.16.0";

  format = "other";

@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "valos";
    repo = "Komikku";
    rev = "v${version}";
-    hash = "sha256-dmi8a9Gf4ixq5oW6ewDGZYRmxY2qmUrD42DfjskRpHk=";
+    hash = "sha256-SzK86uzdGnNFNtbvw56n3AxjxcCBjHFs9wD98TVggAo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/pick-colour-picker/default.nix
+++ b/pkgs/applications/graphics/pick-colour-picker/default.nix
@ -22,6 +22,11 @@ buildPythonPackage rec {
    fetchSubmodules = false;
  };

+  postPatch = ''
+    sed "s|sys\.prefix|'\.'|g" -i setup.py
+    sed "s|os.environ.get('SNAP'), \"usr\"|'$out'|g" -i pick/__main__.py
+  '';
+
  nativeBuildInputs = [
    gobject-introspection
    wrapGAppsHook
@ -37,16 +42,6 @@ buildPythonPackage rec {
    gtk3
  ];

-  preDistPhases = [ "fixupIconPath" ];
-
-  fixupIconPath = ''
-    pickLoc="$out/${python.sitePackages}/pick"
-    shareLoc=$(echo "$out/${python.sitePackages}/nix/store/"*)
-    mv "$shareLoc/share" "$out/share"
-
-    sed "s|os.environ.get('SNAP'), \"usr\"|'$out'|g" -i "$pickLoc/__main__.py"
-    '';
-
  meta = with lib; {
    homepage = "https://kryogenix.org/code/pick/";
    license = licenses.mit;
--- a/pkgs/applications/misc/ttdl/default.nix
+++ b/pkgs/applications/misc/ttdl/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ttdl";
-  version = "3.6.5";
+  version = "3.7.0";

  src = fetchFromGitHub {
    owner = "VladimirMarkelov";
    repo = "ttdl";
    rev = "v${version}";
-    sha256 = "sha256-mplV++N+us6IntNJsZoH4yyKZ8eYplUYuVJeac0ZIkQ=";
+    sha256 = "sha256-4XmOFoj2kynQZzos/vf0rciJCGfnFLN7f1MG9NU53os=";
  };

-  cargoHash = "sha256-mgvMQjScXCmr3HIQtGJ2YWRUhiSP5resL96LUCe8D+c=";
+  cargoHash = "sha256-9TyEHAlxTNx/ildlqEjuFIKfmUQQFQSVoxcrb2Tg9Ps=";

  meta = with lib; {
    description = "A CLI tool to manage todo lists in todo.txt format";
--- a/pkgs/applications/misc/veracrypt/default.nix
+++ b/pkgs/applications/misc/veracrypt/default.nix
@ -12,6 +12,7 @@
 , exfat
 , ntfs3g
 , btrfs-progs
+, wrapGAppsHook
 }:

 stdenv.mkDerivation rec {
@ -37,7 +38,7 @@ stdenv.mkDerivation rec {

  sourceRoot = "src";

-  nativeBuildInputs = [ makeself pkg-config yasm ];
+  nativeBuildInputs = [ makeself pkg-config yasm wrapGAppsHook ];
  buildInputs = [ fuse lvm2 wxGTK ];

  enableParallelBuilding = true;
--- a/pkgs/applications/misc/watchmate/default.nix
+++ b/pkgs/applications/misc/watchmate/default.nix
@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "watchmate";
-  version = "0.4.3";
+  version = "0.4.4";

  src = fetchFromGitHub {
    owner = "azymohliad";
    repo = "watchmate";
    rev = "v${version}";
-    hash = "sha256-LwtlI6WCOO24w8seUzyhCp51pfEiCM+iL6lu/J6v4PQ=";
+    hash = "sha256-+E1tyDfFSu3J89fXd75bdYxh+Z1zTwKL6AmMTNQBEYY=";
  };

-  cargoHash = "sha256-MD0eWZDpCevBY1Y3Gzgk13qCFtL7QOPDATv8MA+Q5go=";
+  cargoHash = "sha256-xfgO2MInUAidgqN1B7byMIzHD19IzbnBvRMo7Ir10hk=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -1,8 +1,8 @@
 {
  "stable": {
-    "version": "111.0.5563.64",
-    "sha256": "0x20zqwq051a5j76q1c3m0ddf1hhcm6fgz3b7rqrfamjppia0p3x",
-    "sha256bin64": "0rnqrjnybghb4h413cw3f54ga2x76mfmf1fp2nnf59c1yml4r4vf",
+    "version": "111.0.5563.110",
+    "sha256": "0rd7hxa02dy64xwhkwk8v71hqmbvyzcnqldvxpvdr8khn5rnrpa9",
+    "sha256bin64": "18ph8di5g235jrsc0xpwf58f2sx2mmaz25g1921d3fqva8s1vri0",
    "deps": {
      "gn": {
        "version": "2022-12-12",
@ -12,16 +12,16 @@
      }
    },
    "chromedriver": {
-      "version": "111.0.5563.41",
-      "sha256_linux": "160khwa4x6w9gv5vkvalwbx87r6hrql0y0xr7zvxsir1x6rklwm2",
-      "sha256_darwin": "0z5q9r39jd5acyd79yzrkgqkvv3phdkyq4wvdsmhnpypazg072l6",
-      "sha256_darwin_aarch64": "0xiagydqnywzrpqq3i7363zhiywkp8ra9ygb2q1gznb40rx98pbr"
+      "version": "111.0.5563.64",
+      "sha256_linux": "0f4v6hds5wl43hnmqxmzidlg5nqgr4iy04hmrmvzaihsdny3na8s",
+      "sha256_darwin": "0izdp36d4wid5hmz8wcna3gddly7nbkafqqf5k1ikb2jgx9ipp8f",
+      "sha256_darwin_aarch64": "0yzn7bibj36wrc980s9sa8cl0qds01n9i88jk95afx5lk5zb8rgc"
    }
  },
  "beta": {
-    "version": "112.0.5615.29",
-    "sha256": "0k9dn1gzfr2j353ppza1nypj0a4b27p9n742cms3z8583da8kw6p",
-    "sha256bin64": "04m77ndsfygpb1g11iyscvfszgykbr5n3s6bh1shnpkpdbvx3dki",
+    "version": "112.0.5615.39",
+    "sha256": "12q4wxlgcqqflsxvcbx00228l1hjzb940ichywhiwmndxjjdvrgg",
+    "sha256bin64": "0b5c02wlmywhkxgdlnwys1djknicvqxcichxgazgpxbjmr8mmzwv",
    "deps": {
      "gn": {
        "version": "2023-02-17",
@ -45,8 +45,8 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "111.0.5563.65",
-    "sha256": "1wg84pd50zi5268snkiahnp5191c66bqkbvdz2z8azivm95lwqwp",
+    "version": "111.0.5563.111",
+    "sha256": "0r03p8m92fwsi8z1i8qjwllbb68gkspnzwynvmag3jy5kyk4vprv",
    "sha256bin64": null,
    "deps": {
      "gn": {
@ -56,8 +56,8 @@
        "sha256": "1b5fwldfmkkbpp5x63n1dxv0nc965hphc8rm8ah7zg44zscm9z30"
      },
      "ungoogled-patches": {
-        "rev": "111.0.5563.65-1",
-        "sha256": "06mfm2gaz1nbwqhn2jp34pm52rw1q99i9fq7wh19m0qasdpidis9"
+        "rev": "111.0.5563.111-1",
+        "sha256": "1m8kf8af5zjc5mgdccppyfbl6bxlwcnb6rw58q5020a810x7y6f8"
      }
    }
  }
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -20,16 +20,16 @@

 buildGoModule rec {
  pname = "kubernetes";
-  version = "1.26.1";
+  version = "1.26.3";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    rev = "v${version}";
-    sha256 = "sha256-bC2Q4jWBh27bqLGhvG4JcuHIAQmiGz5jDt9Me9qbVpk=";
+    hash = "sha256-dJMfnd82JIPxyVisr5o9s/bC3ZDiolF841pmV4c9LN8=";
  };

-  vendorSha256 = null;
+  vendorHash = null;

  doCheck = false;

--- a/pkgs/applications/networking/cluster/kubeshark/default.nix
+++ b/pkgs/applications/networking/cluster/kubeshark/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubeshark";
-  version = "38.5";
+  version = "39.4";

  src = fetchFromGitHub {
    owner = "kubeshark";
    repo = "kubeshark";
    rev = version;
-    sha256 = "sha256-xu+IcmYNsFBYhb0Grnqyi31LCG/3XhSh1LH8XakQ3Yk=";
+    sha256 = "sha256-Z32FuQPh9wG2XNMAfC9Zg7G9j8btNxTcYRl+Z5f5gM8=";
  };

-  vendorHash = "sha256-o04XIUsHNqOBkvcejASHNz1HDnV6F9t+Q2Hg8eL/Uoc=";
+  vendorHash = "sha256-stpWIqLQ2PTjocuekkOI/D7QvkxX4NI1YTKIh3V6c4c=";

  ldflags = let t = "github.com/kubeshark/kubeshark"; in [
   "-s" "-w"
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -110,13 +110,13 @@
    "vendorHash": null
  },
  "aws": {
-    "hash": "sha256-j+hKWMHnIE6nmRdGHaQxLybeljmheZ7t83NSXVWViZI=",
+    "hash": "sha256-7LN+ezJMoBsH/WiJuVbkVyaOURUHTuY1kJ8gBOebAIM=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
    "owner": "hashicorp",
    "repo": "terraform-provider-aws",
-    "rev": "v4.59.0",
+    "rev": "v4.60.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-TGzTElOmYW6XO4EtMD9MWvdvd1opnFSAVcEA2eYCQdk="
+    "vendorHash": "sha256-ydAQqeaj/XN3VXNpcJAYYOV0iXSQVUraWUZKDoZOyrw="
  },
  "azuread": {
    "hash": "sha256-MGCGfocs16qmJnvMRRD7TRHnPkS17h+oNUkMARAQhLs=",
@ -328,13 +328,13 @@
    "vendorHash": "sha256-Ba4J6LUchqhdZTxcJxTgP20aZVioybIzKvF4j5TDQIk="
  },
  "dnsimple": {
-    "hash": "sha256-8xESl8n/AMURVtnJ9Gd0eZ+flbdLya8RotRBgMF7mBk=",
+    "hash": "sha256-fLYaGjQy4NtXuVePYQ8/dI7W04QM6UV3h6f2qU8hM6k=",
    "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
    "owner": "dnsimple",
    "repo": "terraform-provider-dnsimple",
-    "rev": "v0.16.2",
+    "rev": "v0.16.3",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Id1rL/Mu/aES7OFQ/rQRMmm3D/GSbGofZludqbWffKo="
+    "vendorHash": "sha256-gARkcCVDxamHHyLhUaJ85OGDmUjeOW8LUxVyM348QUY="
  },
  "docker": {
    "hash": "sha256-UyHOI8C0eDV5YllAi9clHp/CEldHjIp3FHHMPy1rK58=",
@ -639,11 +639,11 @@
    "vendorHash": "sha256-lXQHo66b9X0jZhoF+5Ix5qewQGyI82VPJ7gGzc2CHao="
  },
  "kubernetes": {
-    "hash": "sha256-4TUUejEKbnsRmqwdQVhHF+QWW8kReq+ZQQvpcT+YhsQ=",
+    "hash": "sha256-FV5FoEd0zjXa8x77r/z8Tn/I1lZI1NZ4a8yisAuAhNQ=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/kubernetes",
    "owner": "hashicorp",
    "repo": "terraform-provider-kubernetes",
-    "rev": "v2.18.1",
+    "rev": "v2.19.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -856,13 +856,13 @@
    "vendorHash": "sha256-62q67aaOZA3fQmyL8bEHB+W497bcx9Xy7kKrbkjkbaI="
  },
  "opentelekomcloud": {
-    "hash": "sha256-fkEQ4VWGJiPFTA6Wz8AxAiL4DOW+Kewl8T9ywy/yPME=",
+    "hash": "sha256-ZDhihbYH6O6UCU2WOkPE+tcOODkAsbx7v9Vg1wrbklg=",
    "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
    "owner": "opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.33.2",
+    "rev": "v1.34.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-EbUHKM6fKEZk1ey4qTgAd/20OKJu0DoBF0MAOxB7y64="
+    "vendorHash": "sha256-tLtgg6QQiXivDxDVEYeOnLqXobwN7ZFqQrI0d3pUHeE="
  },
  "opsgenie": {
    "hash": "sha256-Wbe+DyK5wKuZZX8yd3DJN+2wT8KZt+YsBwJYKnZnfcI=",
@ -1072,13 +1072,13 @@
    "vendorHash": "sha256-fgvNdBwkz+YHOrLRQSe1D+3/VUhttKkJGzV6cg57g8s="
  },
  "sumologic": {
-    "hash": "sha256-1BwhcyEJs7Xm+p2ChA9K7g+qBzqoh3eyAT9qKMfHB1g=",
+    "hash": "sha256-sJo3dGGtKT+hPo9qVA+2BYkJhNY9N9FrgKpHqdTYrUQ=",
    "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
    "owner": "SumoLogic",
    "repo": "terraform-provider-sumologic",
-    "rev": "v2.21.0",
+    "rev": "v2.22.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-dpMa+XnfavXO0lXiBZOsU+O+5/3a/IMkfzpQcnD/sSw="
+    "vendorHash": "sha256-iNBM4Y24vDGPKyb5cppSogk145F0/pAFmOzEeiWgfLI="
  },
  "tailscale": {
    "hash": "sha256-X3YV640d3pLyKm/v88oEhXfYnox+ksrEWKgiJbYl6gk=",
@ -1108,13 +1108,13 @@
    "vendorHash": null
  },
  "tfe": {
-    "hash": "sha256-eFyRa4T+CqIeOcEYj4DQP6ypR7AROYrGDYuYSqBfKr0=",
+    "hash": "sha256-K0l9oaYkgilz47ErUxio9oJtPHQTWZnKdPpjRZ1SDhg=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
    "owner": "hashicorp",
    "repo": "terraform-provider-tfe",
-    "rev": "v0.42.0",
+    "rev": "v0.43.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-bhAoNJSbrpAzw0qCKIm84h6tFqUWT0JeBs1gJpPeJdU="
+    "vendorHash": "sha256-plYy3INLi/SeKu7R0lDLY1CvRDU7bmZsQKzFtMc2Wu4="
  },
  "thunder": {
    "hash": "sha256-GLyGm9Q+ajuQFIni/OCYvYhpj2fiVYHzkPwbofq/DEs=",
@ -1254,13 +1254,13 @@
    "vendorHash": "sha256-ib1Esx2AO7b9S+v+zzuATgSVHI3HVwbzEeyqhpBz1BQ="
  },
  "yandex": {
-    "hash": "sha256-XT31rLurZAvjE08cAGIkd7pcS1LMdOIU6e60qLrLsXI=",
+    "hash": "sha256-bkKGZAGxeJC5JeVwRB+moChFvTF2zUHxB75H82RSACI=",
    "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
    "owner": "yandex-cloud",
    "proxyVendor": true,
    "repo": "terraform-provider-yandex",
-    "rev": "v0.87.0",
+    "rev": "v0.88.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-r2+ARKvTghscGBhmZpz84vdBudiy2OsmQR03oDz5gbs="
+    "vendorHash": "sha256-X8jQnuTtuN1M2qDYaE0dgOdB2DdgyQashsGb8mZOycQ="
  }
 }
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "dino";
-  version = "0.4.1";
+  version = "0.4.2";

  src = fetchFromGitHub {
    owner = "dino";
    repo = "dino";
    rev = "v${version}";
-    sha256 = "sha256-1czey1/Zn96JneCUnhPMyffG9FVV4bA9aidNB7Ozkpo=";
+    sha256 = "sha256-85Sh3UwoMaa+bpL81gIKtkpCeRl1mXbs8Odux1FURdQ=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/shellhub-agent/default.nix
+++ b/pkgs/applications/networking/shellhub-agent/default.nix
@ -9,18 +9,18 @@

 buildGo120Module rec {
  pname = "shellhub-agent";
-  version = "0.11.6";
+  version = "0.11.7";

  src = fetchFromGitHub {
    owner = "shellhub-io";
    repo = "shellhub";
    rev = "v${version}";
-    sha256 = "eZLQzy3lWwGM6VWFbsJ6JuGC+/dZnoymZgNtM8CPBM4=";
+    sha256 = "d5ESQQgBPUFe2tuCbeFIqiWPpr9wUczbXLc5QdXurXY=";
  };

  modRoot = "./agent";

-  vendorSha256 = "sha256-7kDPo24I58Nh7OiHj6Zy40jAEaXSOmbcczkgJPXBItU=";
+  vendorSha256 = "sha256-/85rIBfFBpXYrsCBDGVzXfAxO6xXQ8uTL2XeEPKQwDQ=";

  ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];

--- a/pkgs/applications/version-management/datalad/default.nix
+++ b/pkgs/applications/version-management/datalad/default.nix
@ -8,7 +8,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "datalad";
    repo = pname;
    rev = version;
-    hash = "sha256-6uWOKsYeNZJ64WqoGHL7AsoK4iZd24TQOJ1ECw+K28Y=";
+    hash = "sha256-F5UFW0/XqntrHclpj3TqoAwuHJbiiv5a7/4MnFoJ1dE=";
  };

  nativeBuildInputs = [ installShellFiles git ];
--- a/pkgs/applications/version-management/dvc/default.nix
+++ b/pkgs/applications/version-management/dvc/default.nix
@ -17,7 +17,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "iterative";
    repo = pname;
    rev = version;
-    hash = "sha256-2h+fy4KMxFrVtKJBtA1RmJDZv0OVm1BxO1akZzAw95Y=";
+    hash = "sha256-P0J+3TNHGqMw3krfs1uLnf8nEiIBK6UrrB37mY+fBA0=";
  };

  postPatch = ''
@ -98,5 +98,6 @@ python3.pkgs.buildPythonApplication rec {
    homepage = "https://dvc.org";
    license = licenses.asl20;
    maintainers = with maintainers; [ cmcdragonkai fab ];
+    broken = true; # requires new python package: dvc-studio-client
  };
 }
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -10,24 +10,24 @@ with lib;

 let
  pname = "gitkraken";
-  version = "9.1.1";
+  version = "9.2.1";

  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchzip {
      url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-      sha256 = "sha256-CbIKdErthpMnVIuv+EJsWBRixMDG8h9aQ2XcmqpzKUc=";
+      sha256 = "sha256-JyfbCFh76b2ZWQ8J1xhsp8LYeFGdgJcUDgBCJWHf0Rk=";
    };

    x86_64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      sha256 = "sha256-J6ruK1UE0A9VG1tUHeSUDEL4wqRmUnOH8ftKHIIQuVc=";
+      sha256 = "sha256-sXWgxl+j78r/OhkMkQMQ6iUPz+SY+QDS4pvLErJTeRQ=";
    };

    aarch64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin-arm64/GitKraken-v${version}.zip";
-      sha256 = "sha256-cjz/pbV+uV6tbhj3NXDfZ93hgxFtNYhFIh6+jG4pFtU=";
+      sha256 = "sha256-1IsNJMfqpi+s2bHkB6Uo6FacvuRdLpkF+ctmi5b2Lto=";
    };
  };

--- a/pkgs/applications/video/olive-editor/default.nix
+++ b/pkgs/applications/video/olive-editor/default.nix
@ -1,34 +1,69 @@
-{ lib, stdenv, fetchFromGitHub
-, pkg-config, which, qmake, wrapQtAppsHook
-, qtmultimedia, frei0r, opencolorio_1, ffmpeg_4, CoreFoundation }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, which
+, frei0r
+, opencolorio
+, ffmpeg_4
+, CoreFoundation
+, cmake
+, wrapQtAppsHook
+, openimageio2
+, openexr_3
+, portaudio
+, imath
+, qtwayland
+, qtmultimedia
+, qttools
+}:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "olive-editor";
-  version = "0.1.2";
+  version = "unstable-2023-03-20";

  src = fetchFromGitHub {
+    fetchSubmodules = true;
    owner = "olive-editor";
    repo = "olive";
-    rev = version;
-    sha256 = "151g6jwhipgbq4llwib92sq23p1s9hm6avr7j4qq3bvykzrm8z1a";
+    rev = "8ca16723613517c41304de318169d27c571b90af";
+    sha256 = "sha256-lL90+8L7J7pjvhbqfeIVF0WKgl6qQzNun8pL9YPL5Is=";
  };

-  patches = [
-    ./q-painter-path.patch
+  cmakeFlags = [
+    "-DBUILD_QT6=1"
  ];

+  # https://github.com/olive-editor/olive/issues/2200
+  patchPhase = ''
+    runHook prePatch
+    substituteInPlace ./app/node/project/serializer/serializer.h \
+      --replace 'QStringRef' 'QStringView'
+    substituteInPlace ./app/node/project/serializer/serializer.cpp \
+      --replace 'QStringRef' 'QStringView'
+    substituteInPlace ./app/node/project/serializer/serializer230220.cpp \
+      --replace 'QStringRef' 'QStringView'
+    runHook postPatch
+  '';
+
  nativeBuildInputs = [
    pkg-config
    which
-    qmake
+    cmake
    wrapQtAppsHook
  ];

  buildInputs = [
    ffmpeg_4
    frei0r
-    opencolorio_1
+    opencolorio
+    openimageio2
+    imath
+    openexr_3
+    portaudio
+    qtwayland
    qtmultimedia
+    qttools
  ] ++ lib.optional stdenv.isDarwin CoreFoundation;

  meta = with lib; {
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -61,13 +61,13 @@ let
 in
 buildGoModule rec {
  pname = "podman";
-  version = "4.4.2";
+  version = "4.4.3";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    rev = "v${version}";
-    hash = "sha256-337PFsPGm7pUgnFeNJKwT+/7AdbWSfCx4kXyAvHyWJQ=";
+    hash = "sha256-s0aGZN4rnyyNLoO3nnAO7KbeD7MYxE9VMOHrQsKGNBk=";
  };

  patches = [
--- a/pkgs/build-support/rust/build-rust-package/sysroot/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/sysroot/default.nix
@ -1,10 +1,10 @@
-{ stdenv, rust, rustPlatform, buildPackages }:
+{ lib, stdenv, rust, rustPlatform, buildPackages }:

 { shortTarget, originalCargoToml, target, RUSTFLAGS }:

 let
  cargoSrc = import ../../sysroot/src.nix {
-    inherit stdenv rustPlatform buildPackages originalCargoToml;
+    inherit lib stdenv rustPlatform buildPackages originalCargoToml;
  };
 in rustPlatform.buildRustPackage {
  inherit target RUSTFLAGS;
@ -14,7 +14,7 @@ in rustPlatform.buildRustPackage {

  RUSTC_BOOTSTRAP = 1;
  __internal_dontAddSysroot = true;
-  cargoSha256 = "0y6dqfhsgk00y3fv5bnjzk0s7i30nwqc1rp0xlrk83hkh80x81mw";
+  cargoSha256 = "sha256-zgkwevitxsu1C4OgGTsqNSc0gDxaNXYK1WPbfER48d0=";

  doCheck = false;

@ -29,4 +29,7 @@ in rustPlatform.buildRustPackage {
    host=${rust.toRustTarget stdenv.buildPlatform}
    cp -r $RUST_SYSROOT/lib/rustlib/$host $out
  '';
+
+  # allows support for cross-compilation
+  meta.platforms = lib.platforms.all;
 }
--- a/pkgs/build-support/rust/replace-workspace-values.py
+++ b/pkgs/build-support/rust/replace-workspace-values.py
@ -63,8 +63,16 @@ def replace_dependencies(


 def main() -> None:
+    top_cargo_toml = load_file(sys.argv[2])
+
+    if "workspace" not in top_cargo_toml:
+        # If top_cargo_toml is not a workspace manifest, then this script was probably
+        # ran on something that does not actually use workspace dependencies
+        print(f"{sys.argv[2]} is not a workspace manifest, doing nothing.")
+        return
+
    crate_manifest = load_file(sys.argv[1])
-    workspace_manifest = load_file(sys.argv[2])["workspace"]
+    workspace_manifest = top_cargo_toml["workspace"]

    if "workspace" in crate_manifest:
        return
--- a/pkgs/build-support/rust/sysroot/Cargo.lock
+++ b/pkgs/build-support/rust/sysroot/Cargo.lock
@ -1,5 +1,7 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
+version = 3
+
 [[package]]
 name = "alloc"
 version = "0.0.0"
@ -10,9 +12,9 @@ dependencies = [

 [[package]]
 name = "compiler_builtins"
-version = "0.1.52"
+version = "0.1.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6591c2442ee984e2b264638a8b5e7ae44fd47b32d28e3a08e2e9c3cdb0c2fb0"
+checksum = "f867ce54c09855ccd135ad4a50c777182a0c7af5ff20a8f537617bd648b10d50"
 dependencies = [
 "rustc-std-workspace-core",
 ]
--- a/pkgs/build-support/rust/sysroot/src.nix
+++ b/pkgs/build-support/rust/sysroot/src.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation {
  + ''
    ${buildPackages.python3.withPackages (ps: with ps; [ toml ])}/bin/python3 ${./cargo.py}
    mkdir -p $out/src
-    touch $out/src/lib.rs
+    echo '#![no_std]' > $out/src/lib.rs
    cp Cargo.toml $out/Cargo.toml
    cp ${./Cargo.lock} $out/Cargo.lock
  '';
--- a/pkgs/desktops/mate/mate-desktop/default.nix
+++ b/pkgs/desktops/mate/mate-desktop/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-desktop";
-  version = "1.26.0";
+  version = "1.26.1";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "18sj8smf0b998m5qvki37hxg0agcx7wmgz9z7cwv6v48i2dnnz2z";
+    sha256 = "EtFmiiesGr1gk1OB0/OYIbuAhGenuKz570WIXXyAohE=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-polkit/default.nix
+++ b/pkgs/desktops/mate/mate-polkit/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-polkit";
-  version = "1.26.0";
+  version = "1.26.1";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0kkjv025l1l8352m5ky1g7hmk7isgi3dnfnh7sqg9pyhml97i9dd";
+    sha256 = "9bewtd/FMwLEBAMkWZjrkSGvP1DnFmagmrc7slRSA1c=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/bootil/default.nix
+++ b/pkgs/development/libraries/bootil/default.nix
@ -39,6 +39,7 @@ stdenv.mkDerivation {
    license = licenses.free;
    maintainers = with maintainers; [ abigailbuccaneer ];
    # Build uses `-msse` and `-mfpmath=sse`
+    platforms = platforms.all;
    badPlatforms = [ "aarch64-linux" ];
  };
 }
--- a/pkgs/development/libraries/imgui/default.nix
+++ b/pkgs/development/libraries/imgui/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "imgui";
-  version = "1.89.3";
+  version = "1.89.4";

  src = fetchFromGitHub {
    owner = "ocornut";
    repo = "imgui";
    rev = "v${version}";
-    sha256 = "sha256-hPUOqXMpjKNuWVo2RUq2Nw5i+p8PE8qmlyATV7y3Lgg=";
+    sha256 = "sha256-iBpJzfU8ATDilU/1zhV9T/1Zy22g8vw81cmkmJ5+6cg=";
  };

  dontBuild = true;
--- a/pkgs/development/libraries/minizip-ng/default.nix
+++ b/pkgs/development/libraries/minizip-ng/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "minizip-ng";
-  version = "3.0.8";
+  version = "3.0.9";

  src = fetchFromGitHub {
    owner = "zlib-ng";
    repo = finalAttrs.pname;
    rev = finalAttrs.version;
-    sha256 = "sha256-Vzp+5fQBJoO1pG7j8LwC2/B/cOgM/exhKyb3zHuy89Y=";
+    sha256 = "sha256-yuHJUy/Ed7dutmosmcbedz5nZoCc5imLDOXikIde8bs=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/mygui/default.nix
+++ b/pkgs/development/libraries/mygui/default.nix
@ -20,13 +20,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mygui";
-  version = "3.4.0";
+  version = "3.4.1";

  src = fetchFromGitHub {
    owner = "MyGUI";
    repo = "mygui";
    rev = "MyGUI${version}";
-    sha256 = "0a4zi8w18pjj813n7kmxldl1d9r1jp0iyhkw7pbqgl8f7qaq994w";
+    hash = "sha256-5u9whibYKPj8tCuhdLOhL4nDisbFAB0NxxdjU/8izb8=";
  };

  patches = [
@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "http://mygui.info/";
    description = "Library for creating GUIs for games and 3D applications";
-    license = licenses.lgpl3Plus;
+    license = licenses.mit;
    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/physics/rivet/default.nix
+++ b/pkgs/development/libraries/physics/rivet/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "rivet";
-  version = "3.1.6";
+  version = "3.1.7";

  src = fetchurl {
    url = "https://www.hepforge.org/archive/rivet/Rivet-${version}.tar.bz2";
-    hash = "sha256-HPbrtqedGBxEHR0MfG1iPEI4F8YQk/NvIa2q4j5nkJA=";
+    hash = "sha256-J8fbvLX9fugcrxNtr06WC8oOwlXZ+hq+YC9NQwhhsno=";
  };

  latex = texlive.combine { inherit (texlive)
--- a/pkgs/development/libraries/rocm-opencl-runtime/default.nix
+++ b/pkgs/development/libraries/rocm-opencl-runtime/default.nix
@ -14,7 +14,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rocm-opencl-runtime";
-  version = "5.4.3";
+  version = "5.4.4";

  src = fetchFromGitHub {
    owner = "RadeonOpenCompute";
--- a/pkgs/development/libraries/science/math/or-tools/default.nix
+++ b/pkgs/development/libraries/science/math/or-tools/default.nix
@ -39,6 +39,12 @@ stdenv.mkDerivation rec {
      url = "https://github.com/google/or-tools/commit/a26602f24781e7bfcc39612568aa9f4010bb9736.patch";
      hash = "sha256-gM0rW0xRXMYaCwltPK0ih5mdo3HtX6mKltJDHe4gbLc=";
    })
+    # Backport fix in cmake test configuration where pip installs newer version from PyPi over local build,
+    #  breaking checkPhase: https://github.com/google/or-tools/issues/3260
+    (fetchpatch {
+      url = "https://github.com/google/or-tools/commit/edd1544375bd55f79168db315151a48faa548fa0.patch";
+      hash = "sha256-S//1YM3IoRCp3Ghg8zMF0XXgIpVmaw4gH8cVb9eUbqM=";
+    })
  ];

  cmakeFlags = [
@ -48,7 +54,7 @@ stdenv.mkDerivation rec {
    "-DFETCH_PYTHON_DEPS=OFF"
    "-DUSE_GLPK=ON"
    "-DUSE_SCIP=OFF"
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ "-DCMAKE_MACOSX_RPATH=OFF" ];
  nativeBuildInputs = [
    cmake
    ensureNewerSourcesForZipFilesHook
@ -104,6 +110,6 @@ stdenv.mkDerivation rec {
      Google's software suite for combinatorial optimization.
    '';
    maintainers = with maintainers; [ andersk ];
-    platforms = with platforms; linux;
+    platforms = with platforms; linux ++ darwin;
  };
 }
--- a/pkgs/development/libraries/sope/default.nix
+++ b/pkgs/development/libraries/sope/default.nix
@ -1,4 +1,4 @@
-{ gnustep, lib, fetchFromGitHub , libxml2, openssl
+{ gnustep, lib, fetchFromGitHub, fetchpatch, libxml2, openssl
 , openldap, mariadb, libmysqlclient, postgresql }:

 gnustep.stdenv.mkDerivation rec {
@ -12,20 +12,36 @@ gnustep.stdenv.mkDerivation rec {
    hash = "sha256-sXIpKdJ5930+W+FsxQ8DZOq/49XWMM1zV8dIzbQdcbc=";
  };

+  patches = [
+    (fetchpatch {
+      name = "sope-no-unnecessary-vars.patch";
+      url = "https://github.com/Alinto/sope/commit/0751a2f11961fd7de4e2728b6e34e9ba4ba5887e.patch";
+      hash = "sha256-1txj8Qehg2N7ZsiYQA2FXI4peQAE3HUwDYkJEP9WnEk=";
+    })
+    (fetchpatch {
+      name = "sope-fix-wformat.patch";
+      url = "https://github.com/Alinto/sope/commit/6adfadd5dd2da4041657ad071892f2c9b1704d22.patch";
+      hash = "sha256-zCbvVdbeBeNo3/cDVdYbyUUC2z8D6Q5ga0plUoMqr98=";
+    })
+  ];
+
  hardeningDisable = [ "format" ];
  nativeBuildInputs = [ gnustep.make ];
-  buildInputs = lib.flatten ([ gnustep.base libxml2 openssl ]
+  buildInputs = [ gnustep.base libxml2 openssl ]
    ++ lib.optional (openldap != null) openldap
    ++ lib.optionals (mariadb != null) [ libmysqlclient mariadb ]
-    ++ lib.optional (postgresql != null) postgresql);
-
-  postPatch = ''
-    # Exclude NIX_ variables
-    sed -i 's/grep GNUSTEP_/grep ^GNUSTEP_/g' configure
-  '';
+    ++ lib.optional (postgresql != null) postgresql;

+  # Configure directories where files are installed to. Everything is automatically
+  # put into $out (thanks GNUstep) apart from the makefiles location which is where
+  # makefiles are read from during build but also where the SOPE makefiles are
+  # installed to in the install phase. We move them over after the installation.
  preConfigure = ''
-    export DESTDIR="$out"
+    mkdir -p /build/Makefiles
+    ln -s ${gnustep.make}/share/GNUstep/Makefiles/* /build/Makefiles
+    cat <<EOF > /build/GNUstep.conf
+    GNUSTEP_MAKEFILES=/build/Makefiles
+    EOF
  '';

  configureFlags = [ "--prefix=" "--disable-debug" "--enable-xml" "--with-ssl=ssl" ]
@ -33,10 +49,12 @@ gnustep.stdenv.mkDerivation rec {
    ++ lib.optional (mariadb != null) "--enable-mysql"
    ++ lib.optional (postgresql != null) "--enable-postgresql";

-  # Yes, this is ugly.
-  preFixup = ''
-    cp -rlPa $out/nix/store/*/* $out
-    rm -rf $out/nix/store
+  env.GNUSTEP_CONFIG_FILE = "/build/GNUstep.conf";
+
+  # Move over the makefiles (see comment over preConfigure)
+  postInstall = ''
+    mkdir -p $out/share/GNUstep/Makefiles
+    find /build/Makefiles -mindepth 1 -maxdepth 1 -not -type l -exec cp -r '{}' $out/share/GNUstep/Makefiles \;
  '';

  meta = with lib; {
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@ -11,6 +11,7 @@
 , withLibraries ? stdenv.isLinux
 , withTests ? stdenv.isLinux
 , libffi
+, epoll-shim
 , withDocumentation ? withLibraries && stdenv.hostPlatform == stdenv.buildPlatform
 , graphviz-nox
 , doxygen
@ -82,6 +83,8 @@ stdenv.mkDerivation rec {
    libxml2
  ] ++ lib.optionals withLibraries [
    libffi
+  ] ++ lib.optionals (withLibraries && !stdenv.hostPlatform.isLinux) [
+    epoll-shim
  ] ++ lib.optionals withDocumentation [
    docbook_xsl
    docbook_xml_dtd_45
--- a/pkgs/development/ocaml-modules/janestreet/0.15.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.15.nix
@ -254,6 +254,15 @@ with self;
    propagatedBuildInputs = [ async_websocket cohttp-async ppx_jane uri-sexp ];
  };

+  cohttp_static_handler = janePackage {
+    duneVersion = "3";
+    pname = "cohttp_static_handler";
+    version = "0.15.0";
+    hash = "sha256-ENaH8ChvjeMc9WeNIhkeNBB7YK9vB4lw95o6FFZI1ys=";
+    meta.description = "A library for easily creating a cohttp handler for static files";
+    propagatedBuildInputs = [ cohttp-async ];
+  };
+
  core = janePackage {
    pname = "core";
    version = "0.15.1";
--- a/pkgs/development/ocaml-modules/magic-trace/default.nix
+++ b/pkgs/development/ocaml-modules/magic-trace/default.nix
@ -0,0 +1,27 @@
+{ lib, fetchFromGitHub, buildDunePackage, async, cohttp_static_handler
+, core_unix, owee, ppx_jane, shell }:
+
+buildDunePackage rec {
+  pname = "magic-trace";
+  version = "1.1.0";
+
+  minimalOCamlVersion = "4.12";
+  duneVersion = "3";
+
+  src = fetchFromGitHub {
+    owner = "janestreet";
+    repo = "magic-trace";
+    rev = "v${version}";
+    sha256 = "sha256-615AOkrbQI6vRosA5Kz3Epipe9f9+Gs9+g3bVl5gzBY=";
+  };
+
+  buildInputs = [ async cohttp_static_handler core_unix owee ppx_jane shell ];
+
+  meta = with lib; {
+    description =
+      "Collects and displays high-resolution traces of what a process is doing";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/janestreet/magic-trace";
+  };
+}
--- a/pkgs/development/ocaml-modules/owee/default.nix
+++ b/pkgs/development/ocaml-modules/owee/default.nix
@ -2,19 +2,20 @@

 buildDunePackage rec {
  minimalOCamlVersion = "4.06";
-  useDune2 = true;
+  duneVersion = "2";
  pname = "owee";
-  version = "0.4";
+  version = "0.6";

  src = fetchurl {
-    url = "https://github.com/let-def/owee/releases/download/v${version}/owee-${version}.tbz";
-    sha256 = "sha256:055bi0yfdki1pqagbhrwmfvigyawjgsmqw04zhpp6hds8513qzvb";
+    url =
+      "https://github.com/let-def/owee/releases/download/v${version}/owee-${version}.tbz";
+    sha256 = "sha256-GwXV5t4GYbDiGwyvQyW8NZoYvn4qXlLnjX331Bj1wjM=";
  };

-  meta = {
+  meta = with lib; {
    description = "An experimental OCaml library to work with DWARF format";
    homepage = "https://github.com/let-def/owee/";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.vbgl ];
+    license = licenses.mit;
+    maintainers = with maintainers; [ vbgl alizter ];
  };
 }
--- a/pkgs/development/ocaml-modules/spacetime_lib/default.nix
+++ b/pkgs/development/ocaml-modules/spacetime_lib/default.nix
@ -6,8 +6,7 @@ lib.throwIfNot (lib.versionAtLeast "4.12" ocaml.version)
 buildDunePackage rec {
  pname = "spacetime_lib";
  version = "0.3.0";
-
-  useDune2 = true;
+  duneVersion = "2";

  src = fetchFromGitHub {
    owner = "lpw25";
@ -16,6 +15,8 @@ buildDunePackage rec {
    sha256 = "0biisgbycr5v3nm5jp8i0h6vq76vzasdjkcgh8yr7fhxc81jgv3p";
  };

+  patches = [ ./spacetime.diff ];
+
  propagatedBuildInputs = [ owee ];

  preConfigure = ''
--- a/pkgs/development/ocaml-modules/spacetime_lib/spacetime.diff
+++ b/pkgs/development/ocaml-modules/spacetime_lib/spacetime.diff
@ -0,0 +1,14 @@
+diff --git a/src/elf_locations.ml b/src/elf_locations.ml
+index a08b359..0db9274 100644
+--- a/src/elf_locations.ml
+++ b/src/elf_locations.ml
+@@ -37,7 +37,8 @@ let resolve_from_dwarf t ~program_counter =
+     | Some section ->
+       let body = Owee_buf.cursor (Owee_elf.section_body t.map section) in
+       let rec aux () =
+-        match Owee_debug_line.read_chunk body with
+        let pointers_to_other_sections = Owee_elf.debug_line_pointers t.map t.sections in
+        match Owee_debug_line.read_chunk body ~pointers_to_other_sections with
+         | None -> ()
+         | Some (header, chunk) ->
+           (* CR-soon mshinwell: fix owee .mli to note that [state] is
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.42";
+  version = "9.2.43";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-45wEnYx2/XvyVlew8rwPFSHZtj6NdZWPEEomkqBLNIw=";
+    hash = "sha256-Nww43TIIWHJo8tKNQoPYWHXzslnsBGftxfTCg3elo6w=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aioharmony/default.nix
+++ b/pkgs/development/python-modules/aioharmony/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "aioharmony";
-  version = "0.2.9";
+  version = "0.2.10";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-T30pLzPWD+5pb0ShkpNdiBFO45RdiMYgCOSg8rx+t+Y=";
+    hash = "sha256-18+38QunEdEGdirQOT+528vYqiqDuUr/CWRQtXKf4rs=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -31,7 +31,7 @@

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.42";
+  version = "9.2.43";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -40,7 +40,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-EbOGAY7aqpWngy8ImdDt8dmJhc1UEiX0I8KY8TSump0=";
+    hash = "sha256-SHUuKF7rT2x7CxF9s6ntxniOjhf7asY7HJeMi38Dqrc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/annexremote/default.nix
+++ b/pkgs/development/python-modules/annexremote/default.nix
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "Lykos153";
    repo = "AnnexRemote";
    rev = "v${version}";
-    sha256 = "08myswj1vqkl4s1glykq6xn76a070nv5mxj0z8ibl6axz89bvypi";
+    sha256 = "sha256-h03gkRAMmOq35zzAq/OuctJwPAbP0Idu4Lmeu0RycDc=";
  };

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.42";
+  version = "9.2.43";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-jDC4nmHg7OCo7mQ7iLeG7OFB1xAQxkKw1WZTyY2FBoY=";
+    hash = "sha256-j+JzLN6ila3PsTtxespvPKyH6NVO8eFncDw9qPFDLyQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/asf-search/default.nix
+++ b/pkgs/development/python-modules/asf-search/default.nix
@ -9,7 +9,6 @@
 , importlib-metadata
 , numpy
 , dateparser
-, jinja2
 , remotezip
 , pytestCheckHook
 , requests-mock
@ -18,7 +17,7 @@

 buildPythonPackage rec {
  pname = "asf-search";
-  version = "6.1.0";
+  version = "6.2.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -27,7 +26,7 @@ buildPythonPackage rec {
    owner = "asfadmin";
    repo = "Discovery-asf_search";
    rev = "refs/tags/v${version}";
-    hash = "sha256-3CnarUqW7/hEo4zvRGLJ+VAY5X+aacBdY1Epef523vY=";
+    hash = "sha256-4RFGhA9xzc1kxSni6rAbevoDkc1bLdQD1II/2xq/uKM=";
  };

  propagatedBuildInputs = [
@ -38,7 +37,6 @@ buildPythonPackage rec {
    importlib-metadata
    numpy
    dateparser
-    jinja2
    remotezip
  ];

@ -56,6 +54,7 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
+    changelog = "https://github.com/asfadmin/Discovery-asf_search/blob/${src.rev}/CHANGELOG.md";
    description = "Python wrapper for the ASF SearchAPI";
    homepage = "https://github.com/asfadmin/Discovery-asf_search";
    license = licenses.bsd3;
--- a/pkgs/development/python-modules/azure-keyvault-keys/default.nix
+++ b/pkgs/development/python-modules/azure-keyvault-keys/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "azure-keyvault-keys";
-  version = "4.7.0";
+  version = "4.8.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -20,7 +20,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    hash = "sha256-9jdA9dwNmxQtitZZCfSoSe9UmiDobf8uwyLBPeBILYw=";
+    hash = "sha256-bAuy94MgKjSj5ex0hm5iEuWRrHEk8DuWadGwm2giS8Q=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/cairo-lang/default.nix
+++ b/pkgs/development/python-modules/cairo-lang/default.nix
@ -31,28 +31,16 @@

 buildPythonPackage rec {
  pname = "cairo-lang";
-  version = "0.10.0";
+  version = "0.10.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchzip {
    url = "https://github.com/starkware-libs/cairo-lang/releases/download/v${version}/cairo-lang-${version}.zip";
-    hash = "sha256-+PE7RSKEGADbue63FoT6UBOwURJs7lBNkL7aNlpSxP8=";
+    hash = "sha256-MNbzDqqNhij9JizozLp9hhQjbRGzWxECOErS3TOPlAA=";
  };

-  # TODO: remove a substantial part when https://github.com/starkware-libs/cairo-lang/pull/88/files is merged.
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "lark-parser" "lark"
-
-    substituteInPlace starkware/cairo/lang/compiler/parser_transformer.py \
-      --replace 'value, meta' 'meta, value' \
-      --replace 'value: Tuple[CommaSeparatedWithNotes], meta' 'meta, value: Tuple[CommaSeparatedWithNotes]'
-    substituteInPlace starkware/cairo/lang/compiler/parser.py \
-      --replace 'standard' 'basic'
-  '';
-
  nativeBuildInputs = [
    pythonRelaxDepsHook
  ];
@ -99,6 +87,10 @@ buildPythonPackage rec {
    "pytest-asyncio"
  ];

+  postFixup = ''
+    chmod +x $out/bin/*
+  '';
+
  # There seems to be no test included in the ZIP release…
  # Cloning from GitHub is harder because they use a custom CMake setup
  # TODO(raitobezarius): upstream was pinged out of band about it.
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.42";
+  version = "9.2.43";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-94FEyPL9zjHBFC8L/Aij8OcS5GiBBEY1Tnm4N7zNW0g=";
+    hash = "sha256-g7kXjoJDzc+MPmGR6dO7mGi3LcJQem6pnLvbuoC9Pxw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -16,7 +16,7 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.42";
+  version = "9.2.43";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
@ -38,7 +38,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-NZPXpL4bnPXJHIPf+Jwt6vE7G43JAjhZhW2xeNSw3R8=";
+    hash = "sha256-GWChdbQRnoD6hRVONLcFNoW9vJO9iWKLnjd8xiA/7jI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/dateparser/default.nix
+++ b/pkgs/development/python-modules/dateparser/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "dateparser";
-  version = "1.1.7";
+  version = "1.1.8";

  disabled = pythonOlder "3.7";

@ -31,7 +31,7 @@ buildPythonPackage rec {
    owner = "scrapinghub";
    repo = "dateparser";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KQCjXuBDBZduNYJITwk1qx7mBp8CJ95ZbFlhrFMkE8w=";
+    hash = "sha256-52g8defF5bsisBv2QoyUymXcf0sljOI9PjeR4l0Pw6k=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/debugpy/default.nix
+++ b/pkgs/development/python-modules/debugpy/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , pythonOlder
+, pythonAtLeast
 , fetchFromGitHub
 , fetchpatch
 , substituteAll
@ -22,13 +23,15 @@ buildPythonPackage rec {
  version = "1.6.6";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
+  # Currently doesn't support 3.11:
+  # https://github.com/microsoft/debugpy/issues/1107
+  disabled = pythonOlder "3.7" || pythonAtLeast "3.11";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "debugpy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-GanRWzGyg0Efa+kuU7Q0IOmO0ohXZIjuz8RZYERTpzo=";
+    hash = "sha256-jEhvpPO3QeKjPiOMxg2xOWitWtZ6UCWyM1WvnbrKnFI=";
  };

  patches = [
--- a/pkgs/development/python-modules/gvm-tools/default.nix
+++ b/pkgs/development/python-modules/gvm-tools/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "gvm-tools";
-  version = "23.2.0";
+  version = "23.3.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "greenbone";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-TwGeLEfP69ZK/fkhS0sB6aPh8aDjg6Tri2mUUzk4jbk=";
+    hash = "sha256-sv34PwOEWGsIgSNpUcqvwjJ+6FSrmpXNB5gc47EjFU0=";
  };

  nativeBuildInputs = [
@ -48,6 +48,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Collection of APIs that help with remote controlling a Greenbone Security Manager";
    homepage = "https://github.com/greenbone/gvm-tools";
+    changelog = "https://github.com/greenbone/gvm-tools/releases/tag/v${version}";
    license = with licenses; [ gpl3Plus ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "mautrix";
-  version = "0.19.6";
+  version = "0.19.7";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -29,8 +29,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "mautrix";
    repo = "python";
-    rev = "v${version}";
-    hash = "sha256-Km6Lh4iKUBwQcsChTrV9yCaPhVBINJotp/5XnPfoOMk=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uL4eNMe+NXyE+kLy87zZPNBDuMnAt3KHT01ryFVfBZU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/myst-docutils/default.nix
+++ b/pkgs/development/python-modules/myst-docutils/default.nix
@ -13,12 +13,12 @@

 buildPythonPackage rec {
  pname = "myst-docutils";
-  version = "0.18.1";
+  version = "1.0.0";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Dxg5TtQaK4plvRmXZa7AqPFIv/jvUOpV8M/BJohiXj0=";
+    hash = "sha256-fbh97Z/5TnnMHj2bGZ4UvJkPpYtrTTcFOgpLWgHUYk0=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "peaqevcore";
-  version = "13.3.0";
+  version = "13.4.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-1faEVqSGhRr+CaRHgZMS093fSC3hBgK2CX0oCxAIjCU=";
+    hash = "sha256-f4Xq68QBcnHZdwZrAwg7QUvZrXYvrflEkh1us48YN/g=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@ -17,16 +17,16 @@

 buildPythonPackage rec {
  pname = "pontos";
-  version = "23.3.5";
+  version = "23.3.6";
  format = "pyproject";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-Eb9mX04ws+FhiRw5j1XsEhjm5ZdYFCbA5pntgb4z//M=";
+    hash = "sha256-cs+UeE5QRL/yzFABpMQ4masbLHwG++Ipu5GidXJ1Y0E=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pvo/default.nix
+++ b/pkgs/development/python-modules/pvo/default.nix
@ -13,16 +13,16 @@

 buildPythonPackage rec {
  pname = "pvo";
-  version = "0.2.2";
+  version = "1.0.0";
  format = "pyproject";

-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";

  src = fetchFromGitHub {
    owner = "frenck";
    repo = "python-pvoutput";
-    rev = "v${version}";
-    hash = "sha256-2/O81MnFYbdOrzLiTSoX7IW+3ZGyyE/tIqgKr/sEaHI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-6oVACUnK8WVlEx047CUXmSXQ0+M3xnSvyMHw5Wttk7M=";
  };

  nativeBuildInputs = [
@ -55,6 +55,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python module to interact with the PVOutput API";
    homepage = "https://github.com/frenck/python-pvoutput";
+    changelog = "https://github.com/frenck/python-pvoutput/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@ -1,10 +1,12 @@
 { lib
+, async-timeout
 , bleak
 , bleak-retry-connector
 , boto3
 , buildPythonPackage
 , cryptography
 , fetchFromGitHub
+, pyopenssl
 , pythonOlder
 , pytestCheckHook
 , requests
@ -12,7 +14,7 @@

 buildPythonPackage rec {
  pname = "pyswitchbot";
-  version = "0.37.3";
+  version = "0.37.4";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -21,14 +23,16 @@ buildPythonPackage rec {
    owner = "Danielhiversen";
    repo = "pySwitchbot";
    rev = "refs/tags/${version}";
-    hash = "sha256-0Kzzyzlxs5PaEHKzJLsconUg4zmgPzWI8LD5UIcKwEY=";
+    hash = "sha256-2P7hj0kfKLPyuKk6ouHJtkWCUT3EC1spQTjBQarwpbU=";
  };

  propagatedBuildInputs = [
+    async-timeout
    bleak
    bleak-retry-connector
    boto3
    cryptography
+    pyopenssl
    requests
  ];

--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "pyvex";
-  version = "9.2.42";
+  version = "9.2.43";
  format = "pyproject";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-5pp66sI15sdavyZD+xrTFqhAgjT89KswBE0MQ09Fdl4=";
+    hash = "sha256-X1lFSbVhHBhQ6Y1pbzjObAISqA6rBTpx0Ww5c6p+3LM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/rpmfile/default.nix
+++ b/pkgs/development/python-modules/rpmfile/default.nix
@ -5,11 +5,11 @@
 }:
 buildPythonPackage rec {
  pname = "rpmfile";
-  version = "1.0.8";
+  version = "1.1.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "e56cfc10e1a7d953b1890d81652a89400c614f4cdd9909464aece434d93c3a3e";
+    sha256 = "sha256-ZxcHe1QxdG2GBIPMNrnJy6Vd8SRgZ4HOtwsks2be8Cs=";
  };

  # Tests access the internet
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "scmrepo";
-  version = "0.1.15";
+  version = "0.1.16";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-Z/W49P1T8XgCmKWLTO/eI7ArAB9QKWUbJWRTlRnjJ7E=";
+    hash = "sha256-d8CwvxWdFhKXzv6mzWh+WIH6VSBsQOpdyc5UIwrh7kg=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/upcloud-api/default.nix
+++ b/pkgs/development/python-modules/upcloud-api/default.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "upcloud-api";
-  version = "2.0.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "UpCloudLtd";
    repo = "upcloud-python-api";
-    rev = "v${version}";
-    sha256 = "1kkgrn97pw4k49ys97hjrvh2j8y2p2r9970v9csgrk5wci4562wm";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-thmrbCpGjlDkHIZwIjRgIVMplaypiKByFS/nS8F2LXA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/vispy/default.nix
+++ b/pkgs/development/python-modules/vispy/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "vispy";
-  version = "0.12.1";
+  version = "0.12.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-4AiBwdD5ssCOtuJuk2GtveijqW54eO5sHhmefFhyIk8=";
+    hash = "sha256-FBwt3MwRWFVbyJ8JAQxLHXVEh+gWNXMz8x55WnFGoCQ=";
  };

  patches = [
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@ -15,13 +15,13 @@

 buildGoModule rec {
  pname = "buildah";
-  version = "1.29.0";
+  version = "1.29.1";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "buildah";
    rev = "v${version}";
-    hash = "sha256-g8Y4ZmQvDbzM7rG1otTxm+SRl/sK3sLM2SOWrBseOPQ=";
+    hash = "sha256-l21mirarWEOd+XxyM0YgfDiA1JSEr/uqREmBS22C9fs=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "clj-kondo";
-  version = "2023.02.17";
+  version = "2023.03.17";

  src = fetchurl {
    url = "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-HVwZZ280ZABgG/LAAaRfq6wYmUF1c2ojR7XLMCwVSk0=";
+    sha256 = "sha256-hI/0kYAQtkDSu8LE8CO6+2zDA6OOK/MdybsLQEPMkCk=";
  };

  extraNativeImageBuildArgs = [
--- a/pkgs/development/tools/coursier/default.nix
+++ b/pkgs/development/tools/coursier/default.nix
@ -1,24 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre, writeScript, common-updater-scripts
 , coreutils, git, gnused, nix, nixfmt }:

-let
+stdenv.mkDerivation rec {
+  pname = "coursier";
  version = "2.1.0-RC6";

-  zshCompletion = fetchurl {
-    url =
-      "https://raw.githubusercontent.com/coursier/coursier/v${version}/modules/cli/src/main/resources/completions/zsh";
-    sha256 = "0afxzrk9w1qinfsz55jjrxydw0fcv6p722g1q955dl7f6xbab1jh";
-  };
-
-  repo = "git@github.com:coursier/coursier.git";
-in stdenv.mkDerivation rec {
-  inherit version;
-
-  pname = "coursier";
-
  src = fetchurl {
-    url =
-      "https://github.com/coursier/coursier/releases/download/v${version}/coursier";
+    url = "https://github.com/coursier/coursier/releases/download/v${version}/coursier";
    sha256 = "0b52qp0jb2bhb649r6cca0yd1cj8wsyp0f1j3pnmir6rizjwkm5q";
  };

@ -28,28 +16,18 @@ in stdenv.mkDerivation rec {
    install -Dm555 $src $out/bin/cs
    patchShebangs $out/bin/cs
    wrapProgram $out/bin/cs --prefix PATH ":" ${jre}/bin
-
-    # copy zsh completion
-    install -Dm755 ${zshCompletion} $out/share/zsh/site-functions/_cs
  '';

  passthru.updateScript = writeScript "update.sh" ''
    #!${stdenv.shell}
    set -o errexit
-    PATH=${
-      lib.makeBinPath [ common-updater-scripts coreutils git gnused nix nixfmt ]
-    }
+    PATH=${lib.makeBinPath [ common-updater-scripts coreutils git gnused nix ]}
    oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion ${pname}" | tr -d '"')"
-    latestTag="$(git -c 'versionsort.suffix=-' ls-remote --exit-code --refs --sort='version:refname' --tags ${repo} 'v*.*.*' | tail --lines=1 | cut --delimiter='/' --fields=3 | sed 's|^v||g')"
+    latestTag="$(git -c 'versionsort.suffix=-' ls-remote --exit-code --refs --sort='version:refname' --tags https://github.com/coursier/coursier.git 'v*.*.*' | tail --lines=1 | cut --delimiter='/' --fields=3 | sed 's|^v||g')"
    if [ "$oldVersion" != "$latestTag" ]; then
      nixpkgs="$(git rev-parse --show-toplevel)"
      default_nix="$nixpkgs/pkgs/development/tools/coursier/default.nix"
      update-source-version ${pname} "$latestTag" --version-key=version --print-changes
-      url="${builtins.head zshCompletion.urls}"
-      completion_url=$(echo $url | sed "s|$oldVersion|$latestTag|g")
-      completion_sha256="$(nix-prefetch-url --type sha256 $completion_url)"
-      sed -i "s|${zshCompletion.outputHash}|$completion_sha256|g" "$default_nix"
-      nixfmt "$default_nix"
    else
      echo "${pname} is already up-to-date"
    fi
@ -57,8 +35,7 @@ in stdenv.mkDerivation rec {

  meta = with lib; {
    homepage = "https://get-coursier.io/";
-    description =
-      "A Scala library to fetch dependencies from Maven / Ivy repositories";
+    description = "Scala library to fetch dependencies from Maven / Ivy repositories";
    license = licenses.asl20;
    maintainers = with maintainers; [ adelbertc nequissimus ];
  };
--- a/pkgs/development/tools/git-ps-rs/default.nix
+++ b/pkgs/development/tools/git-ps-rs/default.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-ps-rs";
-  version = "6.5.0";
+  version = "6.6.0";

  src = fetchFromGitHub {
    owner = "uptech";
    repo = "git-ps-rs";
    rev = version;
-    hash = "sha256-4wSm3H+98ZJZ+fZdLYshPKafRkPq98Pv3Lwh9o0be6U=";
+    hash = "sha256-pWad/OCSoszdEQb6Mb6fD4vsZRagbYa3TKft4IyGg94=";
  };

-  cargoHash = "sha256-1p46xvo7abMPlVP8BeQ1j/8QQpK3kCgbTL3cdidfq04=";
+  cargoHash = "sha256-MoWb6slvcTlLYbUg/5xBuOYT40C9SQeHIJKdBdhqics=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/development/tools/misc/drush/default.nix
+++ b/pkgs/development/tools/misc/drush/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "drush";
-  version = "8.4.11";
+  version = "8.4.12";

  src = fetchurl {
    url = "https://github.com/drush-ops/drush/releases/download/${version}/drush.phar";
-    sha256 = "sha256-4DD16PQHGZzAGwmm/WNeZ/dDKnlQslcb35AkpiJs5tQ=";
+    sha256 = "sha256-YtD9lD621LJJAM/ieL4KWvY4o4Uqo3+FWgjGYGdQQaw=";
  };

  dontUnpack = true;
--- a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
@ -1,10 +1,11 @@
 { pkgs ? import <nixpkgs> { }
 , lib ? pkgs.lib
+, poetry ? null
 , poetryLib ? import ./lib.nix { inherit lib pkgs; stdenv = pkgs.stdenv; }
 }:
 let
  # Poetry2nix version
-  version = "1.39.1";
+  version = "1.40.1";

  inherit (poetryLib) isCompatible readTOML normalizePackageName normalizePackageSet;

@ -27,6 +28,7 @@ let
    , includeBuildSystem ? true
    , groups ? [ ]
    , checkGroups ? [ "dev" ]
+    , extras ? [ "*" ]  # * means all extras, otherwise include the dependencies for a given extra
    }:
    let
      getInputs = attr: attrs.${attr} or [ ];
@ -58,12 +60,26 @@ let

      mkInput = attr: extraInputs: getInputs attr ++ extraInputs;

+      rawDeps = pyProject.tool.poetry."dependencies" or { };
+
+      rawRequiredDeps = lib.filterAttrs (_: v: !(v.optional or false)) rawDeps;
+
+      desiredExtrasDeps = lib.unique
+        (lib.concatMap (extra: pyProject.tool.poetry.extras.${extra}) extras);
+
+      allRawDeps =
+        if extras == [ "*" ] then
+          rawDeps
+        else
+          rawRequiredDeps // lib.getAttrs desiredExtrasDeps rawDeps;
+      checkInputs' = getDeps (pyProject.tool.poetry."dev-dependencies" or { })  # <poetry-1.2.0
+        # >=poetry-1.2.0 dependency groups
+        ++ lib.flatten (map (g: getDeps (pyProject.tool.poetry.group.${g}.dependencies or { })) checkGroups);
    in
    {
      buildInputs = mkInput "buildInputs" (if includeBuildSystem then buildSystemPkgs else [ ]);
      propagatedBuildInputs = mkInput "propagatedBuildInputs" (
-        (getDeps pyProject.tool.poetry."dependencies" or { })
-        ++ (
+        getDeps allRawDeps ++ (
          # >=poetry-1.2.0 dependency groups
          if pyProject.tool.poetry.group or { } != { }
          then lib.flatten (map (g: getDeps pyProject.tool.poetry.group.${g}.dependencies) groups)
@ -71,11 +87,8 @@ let
        )
      );
      nativeBuildInputs = mkInput "nativeBuildInputs" [ ];
-      nativeCheckInputs = mkInput "nativeCheckInputs" (
-        getDeps (pyProject.tool.poetry."dev-dependencies" or { })  # <poetry-1.2.0
-        # >=poetry-1.2.0 dependency groups
-        ++ lib.flatten (map (g: getDeps (pyProject.tool.poetry.group.${g}.dependencies or { })) checkGroups)
-      );
+      checkInputs = mkInput "checkInputs" checkInputs';
+      nativeCheckInputs = mkInput "nativeCheckInputs" checkInputs';
    };


@ -124,6 +137,7 @@ lib.makeScope pkgs.newScope (self: {
    { projectDir ? null
    , pyproject ? projectDir + "/pyproject.toml"
    , poetrylock ? projectDir + "/poetry.lock"
+    , poetrylockPos ? { file = toString poetrylock; line = 0; column = 0; }
    , overrides ? self.defaultPoetryOverrides
    , python ? pkgs.python3
    , pwd ? projectDir
@ -133,6 +147,7 @@ lib.makeScope pkgs.newScope (self: {
    , pyProject ? readTOML pyproject
    , groups ? [ ]
    , checkGroups ? [ "dev" ]
+    , extras ? [ "*" ]
    }:
    let
      /* The default list of poetry2nix override overlays */
@ -193,6 +208,7 @@ lib.makeScope pkgs.newScope (self: {
                  value = self.mkPoetryDep (
                    pkgMeta // {
                      inherit pwd preferWheels;
+                      pos = poetrylockPos;
                      source = pkgMeta.source or null;
                      # Default to files from lock file version 2.0 and fall back to 1.1
                      files = pkgMeta.files or lockFiles.${normalizedName};
@ -221,6 +237,11 @@ lib.makeScope pkgs.newScope (self: {
        (
          [
            # Remove Python packages aliases with non-normalized names to avoid issues with infinite recursion (issue #750).
+            (self: super: {
+              # Upstream nixpkgs uses non canonical names
+              async-generator = super.async-generator or super.async_generator or null;
+            })
+
            (self: super: lib.attrsets.mapAttrs
              (
                name: value:
@ -248,7 +269,7 @@ lib.makeScope pkgs.newScope (self: {
                }
            )

-            # Fix infinite recursion in a lot of packages because of nativeCheckInputs
+            # Fix infinite recursion in a lot of packages because of checkInputs
            (self: super: lib.mapAttrs
              (name: value: (
                if lib.isDerivation value && lib.hasAttr "overridePythonAttrs" value
@ -268,7 +289,7 @@ lib.makeScope pkgs.newScope (self: {
      packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) overlays;
      py = python.override { inherit packageOverrides; self = py; };

-      inputAttrs = mkInputAttrs { inherit py pyProject groups checkGroups; attrs = { }; includeBuildSystem = false; };
+      inputAttrs = mkInputAttrs { inherit py pyProject groups checkGroups extras; attrs = { }; includeBuildSystem = false; };

      requiredPythonModules = python.pkgs.requiredPythonModules;
      /* Include all the nested dependencies which are required for each package.
@ -304,6 +325,7 @@ lib.makeScope pkgs.newScope (self: {
    , editablePackageSources ? { }
    , extraPackages ? ps: [ ]
    , groups ? [ "dev" ]
+    , extras ? [ "*" ]
    }:
    let
      inherit (lib) hasAttr;
@ -336,7 +358,7 @@ lib.makeScope pkgs.newScope (self: {
        excludedEditablePackageNames;

      poetryPython = self.mkPoetryPackages {
-        inherit pyproject poetrylock overrides python pwd preferWheels pyProject groups;
+        inherit pyproject poetrylock overrides python pwd preferWheels pyProject groups extras;
        editablePackageSources = editablePackageSources';
      };

@ -371,11 +393,12 @@ lib.makeScope pkgs.newScope (self: {
    , preferWheels ? false
    , groups ? [ ]
    , checkGroups ? [ "dev" ]
+    , extras ? [ "*" ]
    , ...
    }@attrs:
    let
      poetryPython = self.mkPoetryPackages {
-        inherit pyproject poetrylock overrides python pwd preferWheels groups checkGroups;
+        inherit pyproject poetrylock overrides python pwd preferWheels groups checkGroups extras;
      };
      py = poetryPython.python;

@ -392,7 +415,7 @@ lib.makeScope pkgs.newScope (self: {
      ];
      passedAttrs = builtins.removeAttrs attrs specialAttrs;

-      inputAttrs = mkInputAttrs { inherit py pyProject attrs groups checkGroups; };
+      inputAttrs = mkInputAttrs { inherit py pyProject attrs groups checkGroups extras; };

      app = py.pkgs.buildPythonPackage (
        passedAttrs // inputAttrs // {
@ -481,7 +504,7 @@ lib.makeScope pkgs.newScope (self: {
  /*
    The default list of poetry2nix override overlays

-    Can be overridden by calling defaultPoetryOverrides.overrideOverlay which takes an overlay function
+    Can be overriden by calling defaultPoetryOverrides.overrideOverlay which takes an overlay function
  */
  defaultPoetryOverrides = self.mkDefaultPoetryOverrides (import ./overrides { inherit pkgs lib poetryLib; });

@ -501,8 +524,8 @@ lib.makeScope pkgs.newScope (self: {
      combining it with poetry2nix default overrides
    */
    withDefaults = overlay: [
-      self.defaultPoetryOverrides
      overlay
+      self.defaultPoetryOverrides
    ];
  };
 })
--- a/pkgs/development/tools/poetry2nix/poetry2nix/fetch_from_legacy.py
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/fetch_from_legacy.py
@ -60,6 +60,12 @@ context = ssl.create_default_context()
 context.check_hostname = False
 context.verify_mode = ssl.CERT_NONE

+# Extract out username/password from index_url, if present.
+parsed_url = urlparse(index_url)
+username = parsed_url.username or username
+password = parsed_url.password or password
+index_url = parsed_url._replace(netloc=parsed_url.netloc.rpartition("@")[-1]).geturl()
+
 req = urllib.request.Request(index_url)
 if username and password:
    import base64
--- a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
@ -1,12 +1,14 @@
 { python
+, stdenv
 , buildPackages
 , makeSetupHook
 , wheel
 , pip
 , pkgs
+, lib
 }:
 let
-  callPackage = python.pythonForBuild.pkgs.callPackage;
+  inherit (python.pythonForBuild.pkgs) callPackage;
  pythonInterpreter = python.pythonForBuild.interpreter;
  pythonSitePackages = python.sitePackages;

@ -14,23 +16,27 @@ let
  makeRemoveSpecialDependenciesHook = { fields, kind }:
    nonOverlayedPython.pkgs.callPackage
      (
-        {}:
+        _:
        makeSetupHook
          {
            name = "remove-path-dependencies.sh";
-            propagatedBuildInputs = [ ];
            substitutions = {
              # NOTE: We have to use a non-overlayed Python here because otherwise we run into an infinite recursion
              # because building of tomlkit and its dependencies also use these hooks.
              pythonPath = nonOverlayedPython.pkgs.makePythonPath [ nonOverlayedPython ];
              pythonInterpreter = nonOverlayedPython.interpreter;
              pyprojectPatchScript = "${./pyproject-without-special-deps.py}";
-              fields = fields;
-              kind = kind;
+              inherit fields;
+              inherit kind;
            };
          } ./remove-special-dependencies.sh
      )
      { };
+  makeSetupHookArgs = deps:
+    if lib.elem "propagatedBuildInputs" (builtins.attrNames (builtins.functionArgs makeSetupHook)) then
+      { propagatedBuildInputs = deps; }
+    else
+      { inherit deps; };
 in
 {
  removePathDependenciesHook = makeRemoveSpecialDependenciesHook {
@ -48,23 +54,21 @@ in
    (
      { pip, wheel }:
      makeSetupHook
-        {
+        ({
          name = "pip-build-hook.sh";
-          propagatedBuildInputs = [ pip wheel ];
          substitutions = {
            inherit pythonInterpreter pythonSitePackages;
          };
-        } ./pip-build-hook.sh
+        } // (makeSetupHookArgs [ pip wheel ])) ./pip-build-hook.sh
    )
    { };

  poetry2nixFixupHook = callPackage
    (
-      {}:
+      _:
      makeSetupHook
        {
          name = "fixup-hook.sh";
-          propagatedBuildInputs = [ ];
          substitutions = {
            inherit pythonSitePackages;
            filenames = builtins.concatStringsSep " " [
@ -77,14 +81,51 @@ in
    )
    { };

+  # As of 2023-03 a newer version of packaging introduced a new behaviour where python-requires
+  # cannot contain version wildcards. This behaviour is complaint with PEP440
+  #
+  # The wildcards are a no-op anyway so we can work around this issue by just dropping the precision down to the last known number.
+  poetry2nixPythonRequiresPatchHook = callPackage
+    (
+      _:
+      let
+        # Python pre 3.9 does not contain the ast.unparse method.
+        # We can extract this from Python 3.8 for any
+        unparser = stdenv.mkDerivation {
+          name = "${python.name}-astunparse";
+          inherit (python) src;
+          dontConfigure = true;
+          dontBuild = true;
+
+          installPhase = ''
+            mkdir -p $out/poetry2nix_astunparse
+            cp ./Tools/parser/unparse.py $out/poetry2nix_astunparse/__init__.py
+          '';
+        };
+
+        pythonPath =
+          [ ]
+          ++ lib.optional (lib.versionOlder python.version "3.9") unparser;
+
+      in
+      makeSetupHook
+        {
+          name = "require-python-patch-hook.sh";
+          substitutions = {
+            inherit pythonInterpreter pythonPath;
+            patchScript = ./python-requires-patch-hook.py;
+          };
+        } ./python-requires-patch-hook.sh
+    )
+    { };
+
  # When the "wheel" package itself is a wheel the nixpkgs hook (which pulls in "wheel") leads to infinite recursion
  # It doesn't _really_ depend on wheel though, it just copies the wheel.
  wheelUnpackHook = callPackage
-    ({}:
+    (_:
      makeSetupHook
        {
          name = "wheel-unpack-hook.sh";
-          propagatedBuildInputs = [ ];
        } ./wheel-unpack-hook.sh
    )
    { };
--- a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/python-requires-patch-hook.py
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/python-requires-patch-hook.py
@ -0,0 +1,79 @@
+#!/usr/bin/env python
+import ast
+import sys
+import io
+
+
+# Python2 compat
+if sys.version_info[0] < 3:
+    FileNotFoundError = IOError
+
+
+# Python <= 3.8 compat
+def astunparse(tree):
+    # Use bundled unparse by default
+    if hasattr(ast, "unparse"):
+        return ast.unparse(tree)
+
+    # Use example tool from Python sources for older interpreter versions
+    from poetry2nix_astunparse import Unparser
+
+    buf = io.StringIO()
+    up = Unparser(tree, buf)
+
+    return buf.getvalue()
+
+
+class Rewriter(ast.NodeVisitor):
+    def __init__(self, *args, **kwargs):
+        super(Rewriter, self).__init__(*args, **kwargs)
+        self.modified = False
+
+    def visit_Call(self, node):
+        function_name = ""
+
+        if isinstance(node.func, ast.Name):
+            function_name = node.func.id
+        elif isinstance(node.func, ast.Attribute):
+            function_name = node.func.attr
+        else:
+            return
+
+        if function_name != "setup":
+            return
+
+        for kw in node.keywords:
+            if kw.arg != "python_requires":
+                continue
+
+            value = kw.value
+            if not isinstance(value, ast.Constant):
+                return
+
+            # Rewrite version constraints without wildcard characters.
+            #
+            # Only rewrite the file if the modified value actually differs, as we lose whitespace and comments when rewriting
+            # with the AST module.
+            python_requires = ", ".join(
+                [v.strip().rstrip(".*") for v in value.value.split(",")]
+            )
+            if value.value != python_requires:
+                value.value = python_requires
+                self.modified = True
+
+
+if __name__ == "__main__":
+    sys.path.extend(sys.argv[1:])
+
+    try:
+        with open("setup.py") as f:
+            tree = ast.parse(f.read())
+    except FileNotFoundError:
+        exit(0)
+
+    r = Rewriter()
+    r.visit(tree)
+
+    if r.modified:
+        with open("setup.py", "w") as f:
+            f.write(astunparse(tree))
--- a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/python-requires-patch-hook.sh
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/python-requires-patch-hook.sh
@ -0,0 +1,7 @@
+poetry2nix-python-requires-patch-hook() {
+    if [ -z "${dontFixupPythonRequires-}" ]; then
+        @pythonInterpreter@ @patchScript@ @pythonPath@
+    fi
+}
+
+postPatchHooks+=(poetry2nix-python-requires-patch-hook)
--- a/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
@ -151,7 +151,7 @@ let
        (builtins.filter
          ({ prefix, path }: "NETRC" == prefix)
          builtins.nixPath);
-      netrc_file = lib.optionalString (pathParts != [ ]) (builtins.head pathParts).path;
+      netrc_file = if (pathParts != [ ]) then (builtins.head pathParts).path else "";
    in
    pkgs.runCommand file
      {
--- a/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
@ -7,6 +7,7 @@
 }:
 { name
 , version
+, pos ? __curPos
 , files
 , source
 , dependencies ? { }
@ -45,6 +46,7 @@ pythonPackages.callPackage
      isSource = source != null;
      isGit = isSource && source.type == "git";
      isUrl = isSource && source.type == "url";
+      isWheelUrl = isSource && source.type == "url" && lib.strings.hasSuffix ".whl" source.url;
      isDirectory = isSource && source.type == "directory";
      isFile = isSource && source.type == "file";
      isLegacy = isSource && source.type == "legacy";
@ -61,6 +63,8 @@ pythonPackages.callPackage
              inherit pythonPackages pyProject;
            } else [ ];

+      pname = normalizePackageName name;
+      preferWheel' = preferWheel && pname != "wheel";
      fileInfo =
        let
          isBdist = f: lib.strings.hasSuffix "whl" f.file;
@ -69,7 +73,9 @@ pythonPackages.callPackage
          binaryDist = selectWheel fileCandidates;
          sourceDist = builtins.filter isSdist fileCandidates;
          eggs = builtins.filter isEgg fileCandidates;
-          entries = (if preferWheel then binaryDist ++ sourceDist else sourceDist ++ binaryDist) ++ eggs;
+          # the `wheel` package cannot be built from a wheel, since that requires the wheel package
+          # this causes a circular dependency so we special-case ignore its `preferWheel` attribute value
+          entries = (if preferWheel' then binaryDist ++ sourceDist else sourceDist ++ binaryDist) ++ eggs;
          lockFileEntry = (
            if lib.length entries > 0 then builtins.head entries
            else throw "Missing suitable source/wheel file entry for ${name}"
@ -89,13 +95,12 @@ pythonPackages.callPackage
            else (builtins.elemAt (lib.strings.splitString "-" name) 2);
        };

-      format = if isDirectory || isGit || isUrl then "pyproject" else fileInfo.format;
+      format = if isWheelUrl then "wheel" else if isDirectory || isGit || isUrl then "pyproject" else fileInfo.format;

      hooks = python.pkgs.callPackage ./hooks { };
    in
    buildPythonPackage {
-      pname = normalizePackageName name;
-      version = version;
+      inherit pname version;

      # Circumvent output separation (https://github.com/NixOS/nixpkgs/pull/190487)
      format = if format == "pyproject" then "poetry2nix" else format;
@ -108,6 +113,7 @@ pythonPackages.callPackage
      nativeBuildInputs = [
        hooks.poetry2nixFixupHook
      ]
+      ++ lib.optional (!pythonPackages.isPy27) hooks.poetry2nixPythonRequiresPatchHook
      ++ lib.optional (isLocked && (getManyLinuxDeps fileInfo.name).str != null) autoPatchelfHook
      ++ lib.optionals (format == "wheel") [
        hooks.wheelUnpackHook
@ -147,6 +153,8 @@ pythonPackages.callPackage
        in
        builtins.map (n: pythonPackages.${normalizePackageName n}) depAttrs;

+      inherit pos;
+
      meta = {
        broken = ! isCompatible (poetryLib.getPythonVersion python) python-versions;
        license = [ ];
@ -155,6 +163,7 @@ pythonPackages.callPackage

      passthru = {
        inherit args;
+        preferWheel = preferWheel';
      };

      # We need to retrieve kind from the interpreter and the filename of the package
@ -174,10 +183,17 @@ pythonPackages.callPackage
              }
            ))
          )
+        else if isWheelUrl then
+          builtins.fetchurl
+            {
+              inherit (source) url;
+              sha256 = fileInfo.hash;
+            }
        else if isUrl then
          builtins.fetchTarball
            {
              inherit (source) url;
+              sha256 = fileInfo.hash;
            }
        else if isDirectory then
          (poetryLib.cleanPythonSources { src = localDepPath; })
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
@ -27,7 +27,7 @@ let
                true;
            intendedBuildSystem =
              if attr.buildSystem == "cython" then
-                self.python.pythonForBuild.cython
+                self.python.pythonForBuild.pkgs.cython
              else
                self.${attr.buildSystem};
          in
@ -50,7 +50,7 @@ let
            {
              nativeBuildInputs =
                (old.nativeBuildInputs or [ ])
-                ++ lib.optionals (buildSystem != null) [ buildSystem ]
+                ++ lib.optionals (!(builtins.isNull buildSystem)) [ buildSystem ]
                ++ map (a: self.${a}) extraAttrs;
            }
        )
@ -99,7 +99,7 @@ lib.composeManyExtensions [

    {
      automat = super.automat.overridePythonAttrs (
-        old: {
+        old: lib.optionalAttrs (lib.versionOlder old.version "22.10.0") {
          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.m2r ];
        }
      );
@ -296,7 +296,7 @@ lib.composeManyExtensions [
            old: {
              nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [ pkg-config ];
              buildInputs = old.buildInputs or [ ] ++ [ pkgs.libffi ];
-              prePatch = (old.prePatch or "") + lib.optionalString stdenv.isDarwin ''
+              prePatch = (old.prePatch or "") + lib.optionalString (!(old.src.isWheel or false) && stdenv.isDarwin) ''
                # Remove setup.py impurities
                substituteInPlace setup.py --replace "'-iwithsysroot/usr/include/ffi'" ""
                substituteInPlace setup.py --replace "'/usr/include/ffi'," ""
@ -345,7 +345,7 @@ lib.composeManyExtensions [
          LIB_DIR = "${lib.getLib pkgs.secp256k1}/lib";

          # for actual C toolchain build
-          env.NIX_CFLAGS_COMPILE = "-I ${lib.getDev pkgs.secp256k1}/include";
+          NIX_CFLAGS_COMPILE = "-I ${lib.getDev pkgs.secp256k1}/include";
          NIX_LDFLAGS = "-L ${lib.getLib pkgs.secp256k1}/lib";
        }
      );
@ -382,6 +382,8 @@ lib.composeManyExtensions [
            "38.0.1" = "sha256-o8l13fnfEUvUdDasq3LxSPArozRHKVsZfQg9DNR6M6Q=";
            "38.0.3" = "sha256-lzHLW1N4hZj+nn08NZiPVM/X+SEcIsuZDjEOy0OOkSc=";
            "38.0.4" = "sha256-BN0kOblUwgHj5QBf52RY2Jx0nBn03lwoN1O5PEohbwY=";
+            "39.0.0" = "sha256-clorC0NtGukpE3DnZ84MSdGhJN+qC89DZPITZFuL01Q=";
+            "39.0.2" = "sha256-Admz48/GS2t8diz611Ciin1HKQEyMDEwHxTpJ5tZ1ZA=";
          }.${version} or (
            lib.warn "Unknown cryptography version: '${version}'. Please update getCargoHash." lib.fakeHash
          );
@ -443,6 +445,17 @@ lib.composeManyExtensions [
        buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools ];
      });

+      databricks-connect = super.databricks-connect.overridePythonAttrs (old: {
+        sourceRoot = ".";
+      });
+
+      dbt-extractor = super.dbt-extractor.overridePythonAttrs
+        (
+          old: {
+            nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.cargo pkgs.rustc pkgs.maturin ];
+          }
+        );
+
      dbus-python = super.dbus-python.overridePythonAttrs (old: {
        outputs = [ "out" "dev" ];

@ -457,9 +470,9 @@ lib.composeManyExtensions [

        preConfigure = lib.concatStringsSep "\n" [
          (old.preConfigure or "")
-          (lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11" && stdenv.isDarwin) ''
+          (if (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11" && stdenv.isDarwin) then ''
            MACOSX_DEPLOYMENT_TARGET=10.16
-          '')
+          '' else "")
        ];

        preBuild = old.preBuild or "" + ''
@ -562,6 +575,14 @@ lib.composeManyExtensions [
            )
          ) else super.docutils;

+      duckdb = super.duckdb.overridePythonAttrs (old: {
+        postPatch = lib.optionalString (!(old.src.isWheel or false)) ''
+          substituteInPlace setup.py \
+            --replace 'multiprocessing.cpu_count()' "$NIX_BUILD_CORES" \
+            --replace 'setuptools_scm<7.0.0' 'setuptools_scm'
+        '';
+      });
+
      # Environment markers are not always included (depending on how a dep was defined)
      enum34 = if self.pythonAtLeast "3.4" then null else super.enum34;

@ -608,7 +629,7 @@ lib.composeManyExtensions [

      fancycompleter = super.fancycompleter.overridePythonAttrs (
        old: {
-          postPatch = ''
+          postPatch = lib.optionalString (!(old.src.isWheel or false)) ''
            substituteInPlace setup.py \
              --replace 'setup_requires="setupmeta"' 'setup_requires=[]' \
              --replace 'versioning="devcommit"' 'version="${old.version}"'
@ -636,11 +657,12 @@ lib.composeManyExtensions [

      fiona = super.fiona.overridePythonAttrs (
        old: {
-          format = "setuptools";
-          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.gdal ];
-          nativeBuildInputs = [
-            pkgs.gdal # for gdal-config
-          ];
+          format = lib.optionalString (!(old.src.isWheel or false)) "setuptools";
+          buildInputs = old.buildInputs or [ ] ++ [ pkgs.gdal ];
+          nativeBuildInputs = old.nativeBuildInputs or [ ]
+            ++ lib.optionals ((old.src.isWheel or false) && (!pkgs.stdenv.isDarwin)) [ pkgs.autoPatchelfHook ]
+            # for gdal-config
+            ++ [ pkgs.gdal ];
        }
      );

@ -648,14 +670,28 @@ lib.composeManyExtensions [
        VERSION = old.version;
      });

-      gdal = super.gdal.overridePythonAttrs (
-        old: {
-          preBuild = (old.preBuild or "") + ''
-            substituteInPlace setup.cfg \
-              --replace "../../apps/gdal-config" '${pkgs.gdal}/bin/gdal-config'
-          '';
-        }
-      );
+      gdal =
+        let
+          # Build gdal without python bindings to prevent version mixing
+          # We're only interested in the native libraries, not the python ones
+          # as we build that separately.
+          gdal = pkgs.gdal.overrideAttrs (old: {
+            doInstallCheck = false;
+            doCheck = false;
+            cmakeFlags = (old.cmakeFlags or [ ]) ++ [
+              "-DBUILD_PYTHON_BINDINGS=OFF"
+            ];
+          });
+        in
+        super.gdal.overridePythonAttrs (
+          old: {
+            nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ gdal ];
+            preBuild = (old.preBuild or "") + ''
+              substituteInPlace setup.cfg \
+                --replace "../../apps/gdal-config" '${gdal}/bin/gdal-config'
+            '';
+          }
+        );

      grandalf = super.grandalf.overridePythonAttrs (
        old: {
@ -664,6 +700,34 @@ lib.composeManyExtensions [
        }
      );

+      granian =
+        let
+          getRepoHash = version: {
+            "0.2.1" = "sha256-XEhu6M1hFi3/gAKZcei7KJSrIhhlZhlvZvbfyA6VLR4=";
+            "0.2.2" = "sha256-KWwefJ3CfOUGCgAm7AhFlIxRF9qxNEo3npGOxVJ23FY=";
+            "0.2.3" = "sha256-2JnyO0wxkV49R/0wzDb/PnUWWHi3ckwK4nVe7dWeH1k=";
+            "0.2.4" = "sha256-GdQJvVPsWgC1z7La9h11x2pRAP+L998yImhTFrFT5l8=";
+            "0.2.5" = "sha256-vMXMxss77rmXSjoB53eE8XN2jXyIEf03WoQiDfvhDmw=";
+            "0.2.6" = "sha256-l9W9+KDg/43mc0toEz1n1pqw+oQdiHdAxGlS+KLIGhw=";
+          }.${version};
+          sha256 = getRepoHash super.granian.version;
+        in
+        super.granian.overridePythonAttrs (old: rec {
+          src = pkgs.fetchFromGitHub {
+            owner = "emmett-framework";
+            repo = "granian";
+            rev = "v${old.version}";
+            inherit sha256;
+          };
+          cargoDeps = pkgs.rustPlatform.importCargoLock {
+            lockFile = "${src.out}/Cargo.lock";
+          };
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+            pkgs.rustPlatform.cargoSetupHook
+            pkgs.rustPlatform.maturinBuildHook
+          ];
+        });
+
      gitpython = super.gitpython.overridePythonAttrs (
        old: {
          buildInputs = (old.buildInputs or [ ]) ++ [ self.typing-extensions ];
@ -720,7 +784,7 @@ lib.composeManyExtensions [
                (old.propagatedBuildInputs or [ ])
                ++ lib.optionals mpiSupport [ self.mpi4py self.openssh ]
              ;
-              preBuild = lib.optionalString mpiSupport "export CC=${mpi}/bin/mpicc";
+              preBuild = if mpiSupport then "export CC=${mpi}/bin/mpicc" else "";
              HDF5_DIR = "${pkgs.hdf5}";
              HDF5_MPI = if mpiSupport then "ON" else "OFF";
              # avoid strict pinning of numpy
@ -749,6 +813,18 @@ lib.composeManyExtensions [
        }
      );

+      hikari = super.hikari.overrideAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools ];
+        }
+      );
+
+      hikari-lightbulb = super.hikari-lightbulb.overrideAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools ];
+        }
+      );
+
      horovod = super.horovod.overridePythonAttrs (
        old: {
          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.mpi ];
@ -864,6 +940,15 @@ lib.composeManyExtensions [
        }
      );

+      trio = super.trio.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ])
+          ++ [ self.async-generator self.idna ];
+      });
+
+      jeepney = super.jeepney.overridePythonAttrs (old: {
+        buildInputs = (old.buildInputs or [ ]) ++ [ self.outcome self.trio ];
+      });
+
      jinja2-ansible-filters = super.jinja2-ansible-filters.overridePythonAttrs (
        old: {
          preBuild = (old.preBuild or "") + ''
@ -930,6 +1015,13 @@ lib.composeManyExtensions [
        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools self.wheel ];
      });

+      jupyter-server = super.jupyter-server.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ])
+          ++ [ self.hatchling ];
+        buildInputs = (old.buildInputs or [ ])
+          ++ [ self.hatch-jupyter-builder ];
+      });
+
      jupyterlab-widgets = super.jupyterlab-widgets.overridePythonAttrs (
        old: {
          buildInputs = (old.buildInputs or [ ]) ++ [ self.jupyter-packaging ];
@ -964,6 +1056,15 @@ lib.composeManyExtensions [
        }
      );

+      libarchive = super.libarchive.overridePythonAttrs (old: {
+        buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools ];
+
+        postPatch = ''
+          substituteInPlace libarchive/library.py --replace \
+            "_FILEPATH = find_and_load_library()" "_FILEPATH = '${pkgs.libarchive.lib}/lib/libarchive${stdenv.hostPlatform.extensions.sharedLibrary}'"
+        '';
+      });
+
      libvirt-python = super.libvirt-python.overridePythonAttrs ({ nativeBuildInputs ? [ ], ... }: {
        nativeBuildInputs = nativeBuildInputs ++ [ pkg-config ];
        propagatedBuildInputs = [ pkgs.libvirt ];
@ -1082,6 +1183,8 @@ lib.composeManyExtensions [
            pkgs.ghostscript
          ] ++ lib.optionals stdenv.isDarwin [
            Cocoa
+          ] ++ lib.optionals (lib.versionAtLeast super.matplotlib.version "3.7.0") [
+            self.pybind11
          ];

          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
@ -1137,11 +1240,6 @@ lib.composeManyExtensions [
        }
      );

-      # Calls Cargo at build time for source builds and is really tricky to package
-      maturin = super.maturin.override {
-        preferWheel = true;
-      };
-
      mccabe = super.mccabe.overridePythonAttrs (
        old: {
          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
@ -1308,6 +1406,9 @@ lib.composeManyExtensions [
          preBuild = ''
            ln -s ${cfg} site.cfg
          '';
+          preConfigure = ''
+            export NPY_NUM_BUILD_JOBS=$NIX_BUILD_CORES
+          '';
          passthru = old.passthru // {
            blas = blas;
            inherit blasImplementation cfg;
@ -1353,6 +1454,8 @@ lib.composeManyExtensions [
        autoPatchelfIgnoreMissingDeps = true;
      });

+      openbabel-wheel = super.openbabel-wheel.override { preferWheel = true; };
+
      # Overrides for building packages based on OpenCV
      # These flags are inspired by the opencv 4.x package in nixpkgs
      _opencv-python-override =
@ -1376,14 +1479,14 @@ lib.composeManyExtensions [

      opencv-python = super.opencv-python.overridePythonAttrs self._opencv-python-override;

-      opencv-python-headless = super.opencv-python.overridePythonAttrs self._opencv-python-override;
+      opencv-python-headless = super.opencv-python-headless.overridePythonAttrs self._opencv-python-override;

      opencv-contrib-python = super.opencv-contrib-python.overridePythonAttrs self._opencv-python-override;

      openexr = super.openexr.overridePythonAttrs (
        old: {
          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openexr pkgs.ilmbase ];
-          env.NIX_CFLAGS_COMPILE = toString [ "-I${pkgs.openexr.dev}/include/OpenEXR" "-I${pkgs.ilmbase.dev}/include/OpenEXR" ];
+          NIX_CFLAGS_COMPILE = [ "-I${pkgs.openexr.dev}/include/OpenEXR" "-I${pkgs.ilmbase.dev}/include/OpenEXR" ];
        }
      );

@ -1409,6 +1512,10 @@ lib.composeManyExtensions [
            "3.8.0" = "sha256-8k0DetamwLqkdcg8V/D2J5ja6IJSLi50CE+ZjFa7Hdc=";
            "3.8.1" = "sha256-QXguyDxQHW9Fd3Nhmi5JzSxZQuk3HGPhhh/RGuOTZNY=";
            "3.8.3" = "sha256-oSZO4cN1sJKd0T7pYrKG63is8AZMKaLRZqj5UCVY/14=";
+            "3.8.4" = "sha256-O2W9zO7qHWG+78T+uECICAmecaSIbTTJPktJIPZYElE=";
+            "3.8.5" = "sha256-JtUCJ3TP9EKGcddeyW1e/72k21uKneq9SnZJeLvn9Os=";
+            "3.8.6" = "sha256-8T//q6nQoZhh8oJWDCeQf3gYRew58dXAaxkYELY4CJM=";
+            "3.8.7" = "sha256-JBO8nl0sC+XIn17vI7hC8+nA1HYI9jfvZrl9nCE3k1s=";
          }.${version} or (
            lib.warn "Unknown orjson version: '${version}'. Please update getCargoHash." lib.fakeHash
          );
@ -1444,7 +1551,7 @@ lib.composeManyExtensions [

        # For OSX, we need to add a dependency on libcxx, which provides
        # `complex.h` and other libraries that pandas depends on to build.
-        postPatch = lib.optionalString stdenv.isDarwin ''
+        postPatch = lib.optionalString (!(old.src.isWheel or false) && stdenv.isDarwin) ''
          cpp_sdk="${lib.getDev pkgs.libcxx}/include/c++/v1";
          echo "Adding $cpp_sdk to the setup.py common_include variable"
          substituteInPlace setup.py \
@ -1509,13 +1616,27 @@ lib.composeManyExtensions [
          nativeBuildInputs = (old.nativeBuildInputs or [ ])
            ++ [ pkg-config self.pytest-runner ];
          buildInputs = with pkgs; (old.buildInputs or [ ])
-            ++ [ freetype libjpeg zlib libtiff libwebp tcl lcms2 ]
+            ++ [ freetype libjpeg zlib libtiff libxcrypt libwebp tcl lcms2 ]
            ++ lib.optionals (lib.versionAtLeast old.version "7.1.0") [ xorg.libxcb ]
            ++ lib.optionals (self.isPyPy) [ tk xorg.libX11 ];
          preConfigure = lib.optional (old.format != "wheel") preConfigure;
        }
      );

+      pip-requirements-parser = super.pip-requirements-parser.overridePythonAttrs (old: {
+        dontConfigure = true;
+      });
+
+      pluralizer = super.pluralizer.overridePythonAttrs (old: {
+        preBuild = ''
+          export PYPI_VERSION="${old.version}"
+        '';
+      });
+
+      poethepoet = super.poethepoet.overrideAttrs (old: {
+        propagatedBuildInputs = old.propagatedBuildInputs ++ [ self.poetry ];
+      });
+
      poetry-core = super.poetry-core.overridePythonAttrs (old:
        let
          initFile =
@ -1600,7 +1721,7 @@ lib.composeManyExtensions [
      );

      pyarrow =
-        if lib.versionAtLeast super.pyarrow.version "0.16.0" then
+        if (!super.pyarrow.src.isWheel or false) && lib.versionAtLeast super.pyarrow.version "0.16.0" then
          super.pyarrow.overridePythonAttrs
            (
              old:
@ -1662,7 +1783,7 @@ lib.composeManyExtensions [
          old: {

            nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-              pkgs.meson
+              self.meson
              pkgs.ninja
              pkg-config
            ];
@ -1838,7 +1959,7 @@ lib.composeManyExtensions [
          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ (
            if withApplePCSC then [ PCSC ] else [ pcsclite ]
          );
-          env.NIX_CFLAGS_COMPILE = lib.optionalString (! withApplePCSC)
+          NIX_CFLAGS_COMPILE = lib.optionalString (! withApplePCSC)
            "-I ${lib.getDev pcsclite}/include/PCSC";
          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
            pkgs.swig
@ -1868,6 +1989,18 @@ lib.composeManyExtensions [
        }
      );

+      python-snap7 = super.python-snap7.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
+          pkgs.snap7
+        ];
+
+        postPatch = (old.postPatch or "") + ''
+          echo "Patching find_library call."
+          substituteInPlace snap7/common.py \
+            --replace "find_library('snap7')" "\"${pkgs.snap7}/lib/libsnap7.so\""
+        '';
+      });
+
      pytoml = super.pytoml.overridePythonAttrs (
        old: {
          doCheck = false;
@ -2068,6 +2201,18 @@ lib.composeManyExtensions [
        }
      );

+      recommonmark = super.rich.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.commonmark ];
+        }
+      );
+
+      rich = super.rich.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.commonmark ];
+        }
+      );
+
      rockset = super.rockset.overridePythonAttrs (
        old: {
          postPatch = ''
@ -2098,9 +2243,24 @@ lib.composeManyExtensions [
            "-DPYBIND11_TEST=off"
          ];
          doCheck = false; # Circular test dependency
+
+          # Link include and share so it can be used by packages that use pybind11 through cmake
+          postInstall = ''
+            ln -s $out/${self.python.sitePackages}/pybind11/{include,share} $out/
+          '';
        }
      );

+      rasterio = super.rasterio.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.gdal ];
+      });
+
+      rfc3986-validator = super.rfc3986-validator.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+          self.pytest-runner
+        ];
+      });
+
      rlp = super.rlp.overridePythonAttrs {
        preConfigure = ''
          substituteInPlace setup.py --replace \'setuptools-markdown\' ""
@ -2134,6 +2294,7 @@ lib.composeManyExtensions [
            [ pkgs.gfortran ] ++
            lib.optionals (lib.versionAtLeast super.scipy.version "1.7.0") [ self.pythran ] ++
            lib.optionals (lib.versionAtLeast super.scipy.version "1.9.0") [ self.meson-python pkg-config ];
+          dontUseMesonConfigure = true;
          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pybind11 ];
          setupPyBuildFlags = [ "--fcompiler='gnu95'" ];
          enableParallelBuilding = true;
@ -2185,17 +2346,31 @@ lib.composeManyExtensions [
        '';
      });

+      selenium =
+        let
+          v4orLater = lib.versionAtLeast super.selenium.version "4";
+          selenium = super.selenium.override {
+            # Selenium >=4 is built with Bazel
+            preferWheel = v4orLater;
+          };
+        in
+        selenium.overridePythonAttrs (old: {
+          # Selenium <4 can be installed from sources, with setuptools
+          buildInputs = old.buildInputs ++ (lib.optionals (!v4orLater) [ self.setuptools ]);
+        });
+
      shapely = super.shapely.overridePythonAttrs (
        old: {
-          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.geos ];
-          inherit (pkgs.python3.pkgs.shapely) GEOS_LIBRARY_PATH;
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.geos ];
+
+          GEOS_LIBRARY_PATH = "${pkgs.geos}/lib/libgeos_c${stdenv.hostPlatform.extensions.sharedLibrary}";

          GEOS_LIBC = lib.optionalString (!stdenv.isDarwin) "${lib.getLib stdenv.cc.libc}/lib/libc${stdenv.hostPlatform.extensions.sharedLibrary}.6";

          # Fix library paths
-          postPatch = old.postPatch or "" + ''
+          postPatch = lib.optionalString (!(old.src.isWheel or false)) (old.postPatch or "" + ''
            ${pkgs.python3.interpreter} ${./shapely-rewrite.py} shapely/geos.py
-          '';
+          '');
        }
      );

@ -2410,7 +2585,9 @@ lib.composeManyExtensions [

      # Stop infinite recursion by using bootstrapped pkg from nixpkgs
      bootstrapped-pip = super.bootstrapped-pip.override {
-        wheel = self.python.pkgs.wheel;
+        wheel = ((if self.python.isPy2 then pkgs.python2 else pkgs.python3).pkgs.override {
+          python = self.python;
+        }).wheel;
      };

      watchfiles =
@ -2481,27 +2658,15 @@ lib.composeManyExtensions [
        }
      );

-      wheel =
-        let
-          isWheel = super.wheel.src.isWheel or false;
-          # If "wheel" is a pre-built binary wheel
-          wheelPackage = super.buildPythonPackage {
-            inherit (super.wheel) pname name version src;
-            inherit (pkgs.python3.pkgs.wheel) meta;
-            format = "wheel";
-          };
-          # If "wheel" is built from source
-          sourcePackage = ((
-            pkgs.python3.pkgs.override {
-              python = self.python;
-            }
-          ).wheel.override {
-            inherit (self) buildPythonPackage bootstrapped-pip setuptools;
-          }).overrideAttrs (old: {
-            inherit (super.wheel) pname name version src;
-          });
-        in
-        if isWheel then wheelPackage else sourcePackage;
+      wheel = ((
+        pkgs.python3.pkgs.override {
+          python = self.python;
+        }
+      ).wheel.override {
+        inherit (self) buildPythonPackage bootstrapped-pip setuptools;
+      }).overrideAttrs (old: {
+        inherit (super.wheel) pname name version src;
+      });

      zipp = if super.zipp == null then null else
      super.zipp.overridePythonAttrs (
@ -2600,6 +2765,13 @@ lib.composeManyExtensions [
        }
      );

+      minimal-snowplow-tracker = super.minimal-snowplow-tracker.overridePythonAttrs
+        (
+          old: {
+            nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ super.setuptools ];
+          }
+        );
+
      # nixpkgs has setuptools_scm 4.1.2
      # but newrelic has a seemingly unnecessary version constraint for <4
      # So we patch that out
@ -2686,6 +2858,10 @@ lib.composeManyExtensions [
        '';
      });

+      pyyaml-include = super.pyyaml-include.overridePythonAttrs (old: {
+        SETUPTOOLS_SCM_PRETEND_VERSION = old.version;
+      });
+
      selinux = super.selinux.overridePythonAttrs (old: {
        buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools-scm-git-archive ];
      });
@ -2708,27 +2884,69 @@ lib.composeManyExtensions [
        buildInputs = (old.buildInputs or [ ]) ++ [ self.Babel ];
      });

-      nbconvert = super.nbconvert.overridePythonAttrs (_: {
-        postPatch = lib.optionalString (lib.versionAtLeast self.nbconvert.version "6.5.0") ''
-          substituteInPlace \
-            ./nbconvert/exporters/templateexporter.py \
-            --replace \
-            'root_dirs.extend(jupyter_path())' \
-            'root_dirs.extend(jupyter_path() + [os.path.join("@out@", "share", "jupyter")])' \
-            --subst-var out
-        '' + lib.optionalString (lib.versionAtLeast self.nbconvert.version "7.0") ''
-          substituteInPlace \
-            ./hatch_build.py \
-            --replace \
-            'if self.target_name not in ["wheel", "sdist"]:' \
-            'if True:'
-        '';
+      nbconvert =
+        let
+          patchExporters = lib.optionalString (lib.versionAtLeast self.nbconvert.version "6.5.0") ''
+            substituteInPlace \
+              ./nbconvert/exporters/templateexporter.py \
+              --replace \
+              'root_dirs.extend(jupyter_path())' \
+              'root_dirs.extend(jupyter_path() + [os.path.join("@out@", "share", "jupyter")])' \
+              --subst-var out
+          '';
+        in
+        super.nbconvert.overridePythonAttrs (old: {
+          postPatch = lib.optionalString (!(old.src.isWheel or false)) (
+            patchExporters + lib.optionalString (lib.versionAtLeast self.nbconvert.version "7.0") ''
+              substituteInPlace \
+                ./hatch_build.py \
+                --replace \
+                'if self.target_name not in ["wheel", "sdist"]:' \
+                'if True:'
+            ''
+          );
+          postInstall = lib.optionalString (old.src.isWheel or false) ''
+            pushd $out/${self.python.sitePackages}
+            ${patchExporters}
+            popd
+          '';
+        });
+
+      meson-python = super.meson-python.overridePythonAttrs (old: {
+        dontUseMesonConfigure = true;
      });

      mkdocs = super.mkdocs.overridePythonAttrs (old: {
        propagatedBuildInputs = old.propagatedBuildInputs or [ ] ++ [ self.babel ];
      });
+
+      # patch mkdocstrings to fix jinja2 imports
+      mkdocstrings =
+        let
+          patchJinja2Imports = self.pkgs.fetchpatch {
+            name = "fix-jinja2-imports.patch";
+            url = "https://github.com/mkdocstrings/mkdocstrings/commit/b37722716b1e0ed6393ec71308dfb0f85e142f3b.patch";
+            hash = "sha256-DD1SjEvs5HBlSRLrqP3jhF/yoeWkF7F3VXCD1gyt5Fc=";
+          };
+        in
+        super.mkdocstrings.overridePythonAttrs (
+          old: lib.optionalAttrs
+            (lib.versionAtLeast old.version "0.17" && lib.versionOlder old.version "0.18")
+            {
+              patches = old.patches or [ ] ++ lib.optionals (!(old.src.isWheel or false)) [ patchJinja2Imports ];
+              # strip the first two levels ("a/src/") when patching since we're in site-packages
+              # just above mkdocstrings
+              postInstall = lib.optionalString (old.src.isWheel or false) ''
+                pushd "$out/${self.python.sitePackages}"
+                patch -p2 < "${patchJinja2Imports}"
+                popd
+              '';
+            }
+        );
+
+      y-py = super.y-py.override {
+        preferWheel = true;
+      };
    }
  )
-
 ]
--- a/pkgs/development/tools/poetry2nix/poetry2nix/pep425.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/pep425.nix
@ -106,7 +106,7 @@ let
      filtered = builtins.filter filterWheel filesWithoutSources;
      choose = files:
        let
-          osxMatches = [ "12_0" "11_0" "10_15" "10_12" "10_11" "10_10" "10_9" "10_8" "10_7" "any" ];
+          osxMatches = [ "12_0" "11_0" "10_15" "10_14" "10_12" "10_11" "10_10" "10_9" "10_8" "10_7" "any" ];
          linuxMatches = [ "manylinux1_" "manylinux2010_" "manylinux2014_" "manylinux_" "any" ];
          chooseLinux = x: lib.take 1 (findBestMatches linuxMatches x);
          chooseOSX = x: lib.take 1 (findBestMatches osxMatches x);
--- a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/poetry.lock
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/poetry.lock
--- a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/pyproject.toml
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/pyproject.toml
@ -1,6 +1,6 @@
 [tool.poetry]
 name = "poetry"
-version = "1.3.0"
+version = "1.4.1"
 description = "Python dependency management and packaging made easy."
 authors = [
    "Sébastien Eustace <sebastien@eustace.io>",
@ -47,23 +47,27 @@ generate-setup-file = false
 [tool.poetry.dependencies]
 python = "^3.7"

-poetry-core = "1.4.0"
-poetry-plugin-export = "^1.2.0"
+poetry-core = "1.5.2"
+poetry-plugin-export = "^1.3.0"
 "backports.cached-property" = { version = "^1.0.2", python = "<3.8" }
+build = "^0.10.0"
 cachecontrol = { version = "^0.12.9", extras = ["filecache"] }
 cleo = "^2.0.0"
 crashtest = "^0.4.1"
-dulwich = "^0.20.46"
+dulwich = "^0.21.2"
 filelock = "^3.8.0"
 html5lib = "^1.0"
-importlib-metadata = { version = "^4.4", python = "<3.10" }
+importlib-metadata = { version = ">=4.4", python = "<3.10" }
+installer = "^0.7.0"
 jsonschema = "^4.10.0"
 keyring = "^23.9.0"
+lockfile = "^0.12.2"
 # packaging uses calver, so version is unclamped
 packaging = ">=20.4"
 pexpect = "^4.7.0"
-pkginfo = "^1.5"
+pkginfo = "^1.9.4"
 platformdirs = "^2.5.2"
+pyproject-hooks = "^1.0.0"
 requests = "^2.18"
 requests-toolbelt = ">=0.9.1,<0.11.0"
 shellingham = "^1.5"
@ -74,9 +78,9 @@ tomlkit = ">=0.11.1,<1.0.0,!=0.11.2,!=0.11.3"
 trove-classifiers = ">=2022.5.19"
 # exclude 20.4.5 - 20.4.6 due to https://github.com/pypa/pip/issues/9953
 virtualenv = [
-    { version = "^20.4.3,!=20.4.5,!=20.4.6", markers = "sys_platform != 'win32' or python_version != '3.9'" },
+    { version = "^20.4.3,!=20.4.5,!=20.4.6" },
    # see https://github.com/python-poetry/poetry/pull/6950 for details
-    { version = "^20.4.3,!=20.4.5,!=20.4.6,<20.16.6", markers = "sys_platform == 'win32' and python_version == '3.9'" },
+    { version = "<20.16.6", markers = "sys_platform == 'win32' and python_version == '3.9'" },
 ]
 xattr = { version = "^0.10.0", markers = "sys_platform == 'darwin'" }
 urllib3 = "^1.26.0"
@ -87,18 +91,22 @@ pre-commit = "^2.6"
 [tool.poetry.group.test.dependencies]
 # Cachy frozen to test backwards compatibility for `poetry.utils.cache`.
 cachy = "0.3.0"
-deepdiff = "^5.0"
-flatdict = "^4.0.1"
+deepdiff = [
+    { version = "^6.2" },
+    # avoid orjson, which is required by deepdiff 6.2.3, on FreeBSD
+    # because it requires a rust compiler
+    { version = "<6.2.3", markers = "platform_system == 'FreeBSD'"},
+]
 httpretty = "^1.0"
 pytest = "^7.1"
 pytest-cov = "^4.0"
 pytest-mock = "^3.9"
 pytest-randomly = "^3.12"
-pytest-xdist = { version = "^2.5", extras = ["psutil"] }
+pytest-xdist = { version = "^3.1", extras = ["psutil"] }
 zipp = { version = "^3.4", python = "<3.8" }

 [tool.poetry.group.typing.dependencies]
-mypy = ">=0.990"
+mypy = ">=1.0"
 types-html5lib = ">=1.1.9"
 types-jsonschema = ">=4.9.0"
 types-requests = ">=2.28.8"
@ -161,25 +169,22 @@ enable_error_code = [
 # warning.
 [[tool.mypy.overrides]]
 module = [
-  'poetry.console.commands.self.show.plugins',
-  'poetry.installation.executor',
-  'poetry.mixology.version_solver',
-  'poetry.plugins.plugin_manager',
-  'poetry.repositories.installed_repository',
-  'poetry.utils.env',
+    'poetry.console.commands.self.show.plugins',
+    'poetry.plugins.plugin_manager',
+    'poetry.repositories.installed_repository',
+    'poetry.utils.env',
 ]
 warn_unused_ignores = false

 [[tool.mypy.overrides]]
 module = [
-  'cachecontrol.*',
-  'lockfile.*',
-  'pexpect.*',
-  'pkginfo.*',
-  'requests_toolbelt.*',
-  'shellingham.*',
-  'virtualenv.*',
-  'xattr.*',
+    'cachecontrol.*',
+    'lockfile.*',
+    'pexpect.*',
+    'requests_toolbelt.*',
+    'shellingham.*',
+    'virtualenv.*',
+    'xattr.*',
 ]
 ignore_missing_imports = true

--- a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/src.json
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/src.json
@ -1,8 +1,8 @@
 {
  "owner": "python-poetry",
  "repo": "poetry",
-  "rev": "1.3.0",
-  "sha256": "16ng59ykm7zkjizmwb482y0hawpjjr5mvl0ahjd790xzxcc2bbbv",
+  "rev": "1.4.1",
+  "sha256": "09mqabplg5kprs6qgjj2c2xvm1w43ibsawb18swh3css92s4bm4c",
  "fetchSubmodules": true
 }

--- a/pkgs/development/tools/ruff/Cargo.lock
+++ b/pkgs/development/tools/ruff/Cargo.lock
@ -780,7 +780,7 @@ checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"

 [[package]]
 name = "flake8-to-ruff"
-version = "0.0.258"
+version = "0.0.259"
 dependencies = [
 "anyhow",
 "clap 4.1.8",
@ -1982,7 +1982,7 @@ dependencies = [

 [[package]]
 name = "ruff"
-version = "0.0.258"
+version = "0.0.259"
 dependencies = [
 "anyhow",
 "bisection",
@ -2063,7 +2063,7 @@ dependencies = [

 [[package]]
 name = "ruff_cli"
-version = "0.0.258"
+version = "0.0.259"
 dependencies = [
 "annotate-snippets 0.9.1",
 "anyhow",
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "ruff";
-  version = "0.0.258";
+  version = "0.0.259";

  src = fetchFromGitHub {
    owner = "charliermarsh";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-rlMghh6NmyIJTdjf6xmzVuevXh/OrBqhx+CkvvQwlng=";
+    hash = "sha256-K0EfKG140MDfSg3BVJi9x0q1it5nEeREpkanx2RW1Kw=";
  };

  # We have to use importCargoLock here because `cargo vendor` currently doesn't support workspace
--- a/pkgs/development/tools/rust/cargo-audit/default.nix
+++ b/pkgs/development/tools/rust/cargo-audit/default.nix
@ -9,14 +9,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-audit";
-  version = "0.17.4";
+  version = "0.17.5";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-tglBtgjhZmeZTE8X6wNGI9CS3OsbHxTlPJVN4wjXVgs=";
+    sha256 = "sha256-qsHy4MKQHBzChcOJ9TrlUbEnEtVxlzxDgZlahhDsoxM=";
  };

-  cargoSha256 = "sha256-THoV87GpTuFhO/Qo37n4oascQK/tCaFUa8G2MKxrz+k=";
+  cargoSha256 = "sha256-7uBRybAkexBl3SldV4qudwPZ8JcKCUaAlwbAcT9JXy8=";

  nativeBuildInputs = [
    pkg-config
@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "Audit Cargo.lock files for crates with security vulnerabilities";
    homepage = "https://rustsec.org";
-    changelog = "https://github.com/rustsec/rustsec/blob/cargo-audit/v${version}/cargo-audit/CHANGELOG.md";
+    changelog = "https://github.com/rustsec/rustsec/blob/cargo-audit/${version}/cargo-audit/CHANGELOG.md";
    license = with licenses; [ mit /* or */ asl20 ];
    maintainers = with maintainers; [ basvandijk figsoda jk ];
  };
--- a/pkgs/development/tools/rust/cargo-binstall/default.nix
+++ b/pkgs/development/tools/rust/cargo-binstall/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-binstall";
-  version = "0.21.3";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "cargo-bins";
    repo = "cargo-binstall";
    rev = "v${version}";
-    hash = "sha256-K4NerJSW3ckXMFFnFCMXIqMeevE3Xzr/Wsz9nloolBI=";
+    hash = "sha256-jY5mIbrcX2B0D6ezi1k0mcRAmrSPIoebJFHn3lZ2t9w=";
  };

-  cargoHash = "sha256-YSKnfhSZ885evtEK40QTt90RwtH03aO/aJ6A/DddoVU=";
+  cargoHash = "sha256-+O/+zsiG0wyNKp/2TP5I8EPMf6YPT8VtCD4BXI76J7Q=";

  nativeBuildInputs = [
    pkg-config
@ -43,6 +43,9 @@ rustPlatform.buildRustPackage rec {
    "zstd-thin"
  ];

+  cargoBuildFlags = [ "-p" "cargo-binstall" ];
+  cargoTestFlags = [ "-p" "cargo-binstall" ];
+
  checkFlags = [
    # requires internet access
    "--skip=download::test::test_and_extract"
--- a/pkgs/development/tools/rust/cargo-semver-checks/default.nix
+++ b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-semver-checks";
-  version = "0.18.3";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "obi1kenobi";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-PR8+4SK0Bb7+0fDwdvJBYERvhjWLXRGswNoEdRo5JiM=";
+    sha256 = "sha256-tZ83Lxo7yKpFQrD1rnm/3YaT3MgiVb/jL2OVdt491xg=";
  };

-  cargoSha256 = "sha256-wZR5ylhtdAUvpJ0raTM5IrbdmaHLPAYrAKU31oE8Bbg=";
+  cargoSha256 = "sha256-k0dc/bOkIcLP++ZH+rh01do5kcVDh/8hNGM3MPhg/0g=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-zigbuild";
-  version = "0.16.3";
+  version = "0.16.4";

  src = fetchFromGitHub {
    owner = "messense";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-IqGKK3g56RB9o6i+sJjlod3KuAAB9O7RerQshKoCOfk=";
+    sha256 = "sha256-95cmmYHRS9BS+CtVE/sV2dwmoAk1EKJjX7NulKRuPLs=";
  };

-  cargoSha256 = "sha256-RPOMc0+FwjhewqiMwVxAwg5g7GphOtXW8xMElDyTPUk=";
+  cargoSha256 = "sha256-5zdakF/6pDNWcAw8IXCe4Jl246V/Jdto1FPBFkKy6gg=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/games/unciv/default.nix
+++ b/pkgs/games/unciv/default.nix
@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "unciv";
-  version = "4.5.9";
+  version = "4.5.10";

  src = fetchurl {
    url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-sDrVGQeyhMHurbmdqWBUDepJmdPYajiSrpqvts2view=";
+    hash = "sha256-vV0Ux1TWwDlgDzQyIalMRcktP3SYP2RPacTIY9VV0W8=";
  };

  dontUnpack = true;
--- a/Show More
+++ b/Show More