Merge staging-next into staging

2024-11-22 15:03:28 +00:00 · 2023-08-22 00:02:25 +00:00 · 2023-08-22 00:02:25 +00:00 · 1f6fb14d17
commit 1f6fb14d17
parent 7946d3b039 9a62f253e4
76 changed files with 1003 additions and 4192 deletions
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@ -281,11 +281,11 @@ rec {
  /* backward compatibility with old uncurried form; deprecated */
  makeScopeWithSplicing =
    splicePackages: newScope: otherSplices: keep: extra: f:
-    makeScopeWithSplicing' {
-      inherit splicePackages newScope otherSplices keep extra f;
-    };
+    makeScopeWithSplicing'
+    { inherit splicePackages newScope; }
+    { inherit otherSplices keep extra f; };

-  /* Like the above, but aims to support cross compilation. It's still ugly, but
+  /* Like makeScope, but aims to support cross compilation. It's still ugly, but
     hopefully it helps a little bit. */
  makeScopeWithSplicing' =
    { splicePackages
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@ -1,7 +1,5 @@
 { config, lib, pkgs, ... }:

-with lib;
-
 let
  cfg = config.services.netbox;
  pythonFmt = pkgs.formats.pythonVars {};
@ -17,7 +15,7 @@ let
  pkg = (cfg.package.overrideAttrs (old: {
    installPhase = old.installPhase + ''
      ln -s ${configFile} $out/opt/netbox/netbox/netbox/configuration.py
-    '' + optionalString cfg.enableLdap ''
+    '' + lib.optionalString cfg.enableLdap ''
      ln -s ${cfg.ldapConfigPath} $out/opt/netbox/netbox/netbox/ldap_config.py
    '';
  })).override {
@ -31,7 +29,7 @@ let

 in {
  options.services.netbox = {
-    enable = mkOption {
+    enable = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = lib.mdDoc ''
@ -66,18 +64,18 @@ in {
      };
    };

-    listenAddress = mkOption {
-      type = types.str;
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
      default = "[::1]";
      description = lib.mdDoc ''
        Address the server will listen on.
      '';
    };

-    package = mkOption {
-      type = types.package;
-      default = if versionAtLeast config.system.stateVersion "23.05" then pkgs.netbox else pkgs.netbox_3_3;
-      defaultText = literalExpression ''
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = if lib.versionAtLeast config.system.stateVersion "23.05" then pkgs.netbox else pkgs.netbox_3_3;
+      defaultText = lib.literalExpression ''
        if versionAtLeast config.system.stateVersion "23.05" then pkgs.netbox else pkgs.netbox_3_3;
      '';
      description = lib.mdDoc ''
@ -85,18 +83,18 @@ in {
      '';
    };

-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
      default = 8001;
      description = lib.mdDoc ''
        Port the server will listen on.
      '';
    };

-    plugins = mkOption {
-      type = types.functionTo (types.listOf types.package);
+    plugins = lib.mkOption {
+      type = with lib.types; functionTo (listOf package);
      default = _: [];
-      defaultText = literalExpression ''
+      defaultText = lib.literalExpression ''
        python3Packages: with python3Packages; [];
      '';
      description = lib.mdDoc ''
@ -104,23 +102,23 @@ in {
      '';
    };

-    dataDir = mkOption {
-      type = types.str;
+    dataDir = lib.mkOption {
+      type = lib.types.str;
      default = "/var/lib/netbox";
      description = lib.mdDoc ''
        Storage path of netbox.
      '';
    };

-    secretKeyFile = mkOption {
-      type = types.path;
+    secretKeyFile = lib.mkOption {
+      type = lib.types.path;
      description = lib.mdDoc ''
        Path to a file containing the secret key.
      '';
    };

-    extraConfig = mkOption {
-      type = types.lines;
+    extraConfig = lib.mkOption {
+      type = lib.types.lines;
      default = "";
      description = lib.mdDoc ''
        Additional lines of configuration appended to the `configuration.py`.
@ -128,8 +126,8 @@ in {
      '';
    };

-    enableLdap = mkOption {
-      type = types.bool;
+    enableLdap = lib.mkOption {
+      type = lib.types.bool;
      default = false;
      description = lib.mdDoc ''
        Enable LDAP-Authentication for Netbox.
@ -138,8 +136,8 @@ in {
      '';
    };

-    ldapConfigPath = mkOption {
-      type = types.path;
+    ldapConfigPath = lib.mkOption {
+      type = lib.types.path;
      default = "";
      description = lib.mdDoc ''
        Path to the Configuration-File for LDAP-Authentication, will be loaded as `ldap_config.py`.
@ -173,15 +171,17 @@ in {
    };
  };

-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
    services.netbox = {
-      plugins = mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+      plugins = lib.mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
      settings = {
        STATIC_ROOT = staticDir;
        MEDIA_ROOT = "${cfg.dataDir}/media";
        REPORTS_ROOT = "${cfg.dataDir}/reports";
        SCRIPTS_ROOT = "${cfg.dataDir}/scripts";

+        GIT_PATH = "${pkgs.gitMinimal}/bin/git";
+
        DATABASE = {
          NAME = "netbox";
          USER = "netbox";
@ -264,39 +264,39 @@ in {
        RestartSec = 30;
      };
    in {
-      netbox-migration = {
-        description = "NetBox migrations";
-        wantedBy = [ "netbox.target" ];
-
-        environment = {
-          PYTHONPATH = pkg.pythonPath;
-        };
-
-        serviceConfig = defaultServiceConfig // {
-          Type = "oneshot";
-          ExecStart = ''
-            ${pkg}/bin/netbox migrate
-          '';
-          PrivateTmp = true;
-        };
-      };
-
      netbox = {
        description = "NetBox WSGI Service";
        documentation = [ "https://docs.netbox.dev/" ];

        wantedBy = [ "netbox.target" ];

-        after = [ "network-online.target" "netbox-migration.service" ];
+        after = [ "network-online.target" ];
        wants = [ "network-online.target" ];

+        environment.PYTHONPATH = pkg.pythonPath;
+
        preStart = ''
+          # On the first run, or on upgrade / downgrade, run migrations and related.
+          # This mostly correspond to upstream NetBox's 'upgrade.sh' script.
+          versionFile="${cfg.dataDir}/version"
+
+          if [[ -e "$versionFile" && "$(cat "$versionFile")" == "${cfg.package.version}" ]]; then
+            exit 0
+          fi
+
+          ${pkg}/bin/netbox migrate
          ${pkg}/bin/netbox trace_paths --no-input
          ${pkg}/bin/netbox collectstatic --no-input
          ${pkg}/bin/netbox remove_stale_contenttypes --no-input
-        '';
+          # TODO: remove the condition when we remove netbox_3_3
+          ${lib.optionalString
+            (lib.versionAtLeast cfg.package.version "3.5.0")
+            "${pkg}/bin/netbox reindex --lazy"}
+          ${pkg}/bin/netbox clearsessions
+          ${pkg}/bin/netbox clearcache

-        environment.PYTHONPATH = pkg.pythonPath;
+          echo "${cfg.package.version}" > "$versionFile"
+        '';

        serviceConfig = defaultServiceConfig // {
          ExecStart = ''
@ -331,7 +331,7 @@ in {

        wantedBy = [ "multi-user.target" ];

-        after = [ "network-online.target" ];
+        after = [ "network-online.target" "netbox.service" ];
        wants = [ "network-online.target" ];

        environment.PYTHONPATH = pkg.pythonPath;
@ -351,7 +351,7 @@ in {

      wantedBy = [ "multi-user.target" ];

-      after = [ "network-online.target" ];
+      after = [ "network-online.target" "netbox.service" ];
      wants = [ "network-online.target" ];

      timerConfig = {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -525,6 +525,7 @@ in {
  networking.scripted = handleTest ./networking.nix { networkd = false; };
  netbox = handleTest ./web-apps/netbox.nix { inherit (pkgs) netbox; };
  netbox_3_3 = handleTest ./web-apps/netbox.nix { netbox = pkgs.netbox_3_3; };
+  netbox-upgrade = handleTest ./web-apps/netbox-upgrade.nix {};
  # TODO: put in networking.nix after the test becomes more complete
  networkingProxy = handleTest ./networking-proxy.nix {};
  nextcloud = handleTest ./nextcloud {};
--- a/nixos/tests/web-apps/netbox-upgrade.nix
+++ b/nixos/tests/web-apps/netbox-upgrade.nix
@ -0,0 +1,85 @@
+import ../make-test-python.nix ({ lib, pkgs, ... }: let
+  oldNetbox = pkgs.netbox_3_3;
+in {
+  name = "netbox-upgrade";
+
+  meta = with lib.maintainers; {
+    maintainers = [ minijackson ];
+  };
+
+  nodes.machine = { config, ... }: {
+    services.netbox = {
+      enable = true;
+      package = oldNetbox;
+      secretKeyFile = pkgs.writeText "secret" ''
+        abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
+      '';
+    };
+
+    services.nginx = {
+      enable = true;
+
+      recommendedProxySettings = true;
+
+      virtualHosts.netbox = {
+        default = true;
+        locations."/".proxyPass = "http://localhost:${toString config.services.netbox.port}";
+        locations."/static/".alias = "/var/lib/netbox/static/";
+      };
+    };
+
+    users.users.nginx.extraGroups = [ "netbox" ];
+
+    networking.firewall.allowedTCPPorts = [ 80 ];
+
+    specialisation.upgrade.configuration.services.netbox.package = lib.mkForce pkgs.netbox;
+  };
+
+  testScript = { nodes, ... }:
+    let
+      apiVersion = version: lib.pipe version [
+        (lib.splitString ".")
+        (lib.take 2)
+        (lib.concatStringsSep ".")
+      ];
+      oldApiVersion = apiVersion oldNetbox.version;
+      newApiVersion = apiVersion pkgs.netbox.version;
+    in
+    ''
+      start_all()
+      machine.wait_for_unit("netbox.target")
+      machine.wait_for_unit("nginx.service")
+      machine.wait_until_succeeds("journalctl --since -1m --unit netbox --grep Listening")
+
+      def api_version(headers):
+          header = [header for header in headers.splitlines() if header.startswith("API-Version:")][0]
+          return header.split()[1]
+
+      def check_api_version(version):
+          headers = machine.succeed(
+            "curl -sSfL http://localhost/api/ --head -H 'Content-Type: application/json'"
+          )
+          assert api_version(headers) == version
+
+      with subtest("NetBox version is the old one"):
+          check_api_version("${oldApiVersion}")
+
+      # Somehow, even though netbox-housekeeping.service has After=netbox.service,
+      # netbox-housekeeping.service and netbox.service still get started at the
+      # same time, making netbox-housekeeping fail (can't really do some house
+      # keeping job if the database is not correctly formed).
+      #
+      # So we don't check that the upgrade went well, we just check that
+      # netbox.service is active, and that netbox-housekeeping can be run
+      # successfully afterwards.
+      #
+      # This is not good UX, but the system should be working nonetheless.
+      machine.execute("${nodes.machine.system.build.toplevel}/specialisation/upgrade/bin/switch-to-configuration test >&2")
+
+      machine.wait_for_unit("netbox.service")
+      machine.succeed("systemctl start netbox-housekeeping.service")
+
+      with subtest("NetBox version is the new one"):
+          check_api_version("${newApiVersion}")
+    '';
+})
--- a/pkgs/applications/graphics/oculante/Cargo.lock
+++ b/pkgs/applications/graphics/oculante/Cargo.lock
--- a/pkgs/applications/graphics/oculante/default.nix
+++ b/pkgs/applications/graphics/oculante/default.nix
@ -21,13 +21,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "oculante";
-  version = "0.6.69";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "woelper";
    repo = pname;
    rev = version;
-    hash = "sha256-xiZyI4TGXtpMoiX6KartjOO+BgbUht22Kg1FIp39m/o=";
+    hash = "sha256-OJKmnH1uJvVnHiuieveDaR+lybpWHC3MZvis0iAKiZU=";
  };

  cargoLock = {
--- a/pkgs/applications/misc/cambrinary/default.nix
+++ b/pkgs/applications/misc/cambrinary/default.nix
@ -0,0 +1,34 @@
+{ lib
+, buildPythonApplication
+, fetchFromGitHub
+, aiohttp
+, beautifulsoup4
+}:
+
+buildPythonApplication rec {
+  pname = "cambrinary";
+  version = "unstable-2023-07-16";
+  format = "flit";
+
+  src = fetchFromGitHub {
+    owner = "xueyuanl";
+    repo = "cambrinary";
+    rev = "f0792ef70654a48a7677b6e1a7dee454b2c0971c";
+    hash = "sha256-wDcvpKAY/6lBjO5h3qKH3+Y2G2gm7spcKCXFMt/bAtE=";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    beautifulsoup4
+  ];
+
+  pythonImportsCheck = [ "cambrinary" ];
+
+  meta = with lib; {
+    description = "Cambridge dictionary in a terminal";
+    homepage = "https://github.com/xueyuanl/cambrinary";
+    license = licenses.gpl3Only;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ azahi ];
+  };
+}
--- a/pkgs/applications/misc/gimoji/default.nix
+++ b/pkgs/applications/misc/gimoji/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gimoji";
-  version = "0.5.1";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "zeenix";
    repo = "gimoji";
    rev = version;
-    hash = "sha256-8aMm6OHDYBGvLYrQmQh33SI3jap6fS7lgOYDn9lWS18=";
+    hash = "sha256-7UzdZsidLHLZBj7mpRJQhvr3VP7HtkKPfAc7dnxS7kE=";
  };

-  cargoHash = "sha256-IENW19FlqWLk7K0+r9IUhXkS7C/wmik2bGDZdRk0jzA=";
+  cargoHash = "sha256-oWImiIUFgy/pKHlZPPd1IWDG5l5LYCWTYJjgEqiXzLA=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.AppKit
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@ -44,7 +44,7 @@

 , cavaSupport ? true
 , evdevSupport ? true
-, hyprlandSupport ? false
+, hyprlandSupport ? true
 , inputSupport ? true
 , jackSupport ? true
 , mpdSupport ? true
@ -89,10 +89,6 @@ stdenv.mkDerivation (finalAttrs: {
    popd
  '';

-  # Patch for workspaces support in wlr/workspaces
-  # See https://wiki.hyprland.org/Useful-Utilities/Status-Bars/#waybar
-  patches = lib.optional hyprlandSupport [ ./hyprland.diff ];
-
  nativeBuildInputs = [
    meson
    ninja
@ -120,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
    wayland
    wlroots
  ]
-  ++ lib.optionals cavaSupport  [
+  ++ lib.optionals cavaSupport [
    SDL2
    alsa-lib
    fftw
@ -166,8 +162,7 @@ stdenv.mkDerivation (finalAttrs: {
    "tests" = runTests;
    "upower_glib" = upowerSupport;
    "wireplumber" = wireplumberSupport;
-  })
-  ++ lib.optional hyprlandSupport (lib.mesonBool "experimental" true);
+  });

  preFixup = lib.optionalString withMediaPlayer ''
    cp $src/resources/custom_modules/mediaplayer.py $out/bin/waybar-mediaplayer.py
@ -189,6 +184,7 @@ stdenv.mkDerivation (finalAttrs: {
      minijackson
      rodrgz
      synthetica
+      khaneliman
    ];
    inherit (wlroots.meta) platforms;
  };
--- a/pkgs/applications/misc/waybar/hyprland.diff
+++ b/pkgs/applications/misc/waybar/hyprland.diff
@ -1,12 +0,0 @@
--- a/src/modules/wlr/workspace_manager.cpp
-+++ b/src/modules/wlr/workspace_manager.cpp
-@@ -523,7 +523,8 @@
-   if (action.empty())
-     return true;
-   else if (action == "activate") {
-    zext_workspace_handle_v1_activate(workspace_handle_);
-+    const std::string command = "hyprctl dispatch workspace " + name_;
-+    system(command.c_str());
-   } else if (action == "close") {
-     zext_workspace_handle_v1_remove(workspace_handle_);
-   } else {
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@ -35,16 +35,16 @@ let
 in
 buildGoModule rec {
  pname = "argo";
-  version = "3.4.8";
+  version = "3.4.10";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-cN1uLy0QHABks99BJqEpLDf2VbYUzLM2iCTTBvcY0es=";
+    hash = "sha256-uhXwCaAVFLlGeqkBbeA5DINo9CjNMzU9rRmOYoYJASI=";
  };

-  vendorHash = "sha256-kO4ME0r3MoOjn+83X+8bbkgF7zL/Id2+hKabQjEob+Y=";
+  vendorHash = "sha256-0563OHMNkKZcmLY1nHS70pbtrufY1d1WNXrxcCl6MKY=";

  doCheck = false;

--- a/pkgs/applications/networking/feedreaders/newsflash/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsflash/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "newsflash";
-  version = "2.3.0";
+  version = "2.3.1";

  src = fetchFromGitLab {
    owner = "news-flash";
    repo = "news_flash_gtk";
    rev = "refs/tags/v.${finalAttrs.version}";
-    sha256 = "sha256-sW2yO6aZqhiyrIT4B8iBmum+36vcQMg4NsFxInJm7hM=";
+    sha256 = "sha256-JUAlDc2mp8M0vjiWcDoyBw/sKCmd4J8e9wEwZoiW0AE=";
  };

  cargoDeps = rustPlatform.importCargoLock {
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -3,7 +3,7 @@ let
  versions = if stdenv.isLinux then {
    stable = "0.0.28";
    ptb = "0.0.44";
-    canary = "0.0.163";
+    canary = "0.0.166";
    development = "0.0.217";
  } else {
    stable = "0.0.273";
@ -24,7 +24,7 @@ let
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        sha256 = "sha256-QLQCv3hlCNZ8Ii/+GWHAZs4enBh+gOUEt+wlrkUP91Q=";
+        sha256 = "sha256-bUbJpaHUf0ALJ1+4ACcVz0kpZpoXi0S4QO5yLiUZSgs=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lib
+{ stdenv, fetchurl, fetchpatch, lib
 , ncurses, openssl, aspell, gnutls, gettext
 , zlib, curl, pkg-config, libgcrypt
 , cmake, libobjc, libresolv, libiconv
@ -46,6 +46,13 @@ let
        hash = "sha256-iA29zo5zs/SAKggsShp8YZQ9vFhn16lWleTkY8ZTWpI=";
      };

+      patches = lib.optional (perlSupport && lib.versionAtLeast perl.version "5.38") (fetchpatch {
+        name = "perl538-locale.patch";
+        url = "https://github.com/weechat/weechat/commit/c5eb982424150894959b978d98dcf6a005eb6c9f.patch";
+        excludes = [ "ChangeLog.adoc" ];
+        sha256 = "sha256-SSDZy4/c12LOxjvFMuJSv6gJEX298wF62/gQLQ/geiU=";
+      });
+
      outputs = [ "out" "man" ] ++ map (p: p.name) enabledPlugins;

      cmakeFlags = with lib; [
--- a/pkgs/applications/radio/abracadabra/default.nix
+++ b/pkgs/applications/radio/abracadabra/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "abracadabra";
-  version = "2.2.1";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "KejPi";
    repo = "AbracaDABra";
    rev = "v${version}";
-    sha256 = "sha256-hK7mRDJqn0ETgHlvZl3m6lRDbsp5v7a8eGBFdm7ihdA=";
+    sha256 = "sha256-VFV2eHBvBdKrI4Zt+GCtAOSZt0++hYDWYR7AN42p85I=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/math/geogebra/geogebra6.nix
+++ b/pkgs/applications/science/math/geogebra/geogebra6.nix
@ -1,7 +1,7 @@
 { lib, stdenv, unzip, fetchurl, electron, makeWrapper, geogebra }:
 let
  pname = "geogebra";
-  version = "6-0-785-0";
+  version = "6-0-794-0";

  srcIcon = geogebra.srcIcon;
  desktopItem = geogebra.desktopItem;
@ -32,7 +32,7 @@ let
        "https://download.geogebra.org/installers/6.0/GeoGebra-Linux64-Portable-${version}.zip"
        "https://web.archive.org/web/20230627211859/https://download.geogebra.org/installers/6.0/GeoGebra-Linux64-Portable-${version}.zip"
      ];
-      hash = "sha256-Yv8pTCKkyM7XMUNV2Pcn/YxWo1MbOTNMQBFuJFhB/uE=";
+      hash = "sha256-sNCq1Xcx/Y5r+SIRiqQYcG9dVsfIC2Ef5KJf+tgfxC8=";
    };

    dontConfigure = true;
--- a/pkgs/applications/version-management/gh/default.nix
+++ b/pkgs/applications/version-management/gh/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gh";
-  version = "2.32.1";
+  version = "2.33.0";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-DfcafkgauO0mlMEJTfR7hjnkY1QJ4dUyrWv/bqJlVAo=";
+    hash = "sha256-BvGZS0n9S3a/QCbzpP2539wj7hN54G5VlJnQVtqdSTk=";
  };

  vendorHash = "sha256-7Izhqma/zukH9M7EvV9I4axefVaTDoNVXQmLx+GjAt0=";
--- a/pkgs/applications/version-management/sapling/gen-deps.py
+++ b/pkgs/applications/version-management/sapling/gen-deps.py
@ -1,18 +1,47 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ requests ])"
+#!nix-shell -i python3 -p cargo -p "python3.withPackages (ps: with ps; [ requests ])"
 import json
+import pathlib
 import re
+import tempfile
+import os
+import shutil
 from hashlib import sha1
 from struct import unpack
 from subprocess import run
+import subprocess

 from requests import get

 # Fetch the latest stable release metadata from GitHub
-latestTag = get("https://api.github.com/repos/facebook/sapling/releases/latest").json()[
-    "tag_name"
-]
+releaseMetadata = get("https://api.github.com/repos/facebook/sapling/releases/latest").json()
+latestTag = releaseMetadata["tag_name"]
+latestTarballURL = releaseMetadata["tarball_url"]

+[_tarballHash, sourceDirectory] = run(
+    ["nix-prefetch-url", "--print-path", "--unpack", latestTarballURL],
+    check=True,
+    text=True,
+    stdout=subprocess.PIPE,
+).stdout.rstrip().splitlines()
+
+def updateCargoLock():
+    with tempfile.TemporaryDirectory() as tempDir:
+        tempDir = pathlib.Path(tempDir)
+
+        # NOTE(strager): We cannot use shutil.tree because it copies the
+        # read-only permissions.
+        for dirpath, dirnames, filenames in os.walk(sourceDirectory):
+            relativeDirpath = os.path.relpath(dirpath, sourceDirectory)
+            for filename in filenames:
+                shutil.copy(os.path.join(dirpath, filename), tempDir / relativeDirpath / filename)
+            for dirname in dirnames:
+                os.mkdir(tempDir / relativeDirpath / dirname)
+
+        run(["cargo", "fetch"], check=True, cwd=tempDir / "eden" / "scm")
+        shutil.copy(tempDir / "eden" / "scm" / "Cargo.lock", "Cargo.lock")
+
+updateCargoLock()

 def nixPrefetchUrl(url):
    return run(
@ -25,9 +54,7 @@ def nixPrefetchUrl(url):

 # Fetch the `setup.py` source and look for instances of assets being downloaded
 # from files.pythonhosted.org.
-setupPy = get(
-    f"https://github.com/facebook/sapling/raw/{latestTag}/eden/scm/setup.py"
-).text
+setupPy = (pathlib.Path(sourceDirectory) / "eden/scm/setup.py").read_text()
 foundUrls = re.findall(r'(https://files\.pythonhosted\.org/packages/[^\s]+)"', setupPy)

 dataDeps = {
--- a/pkgs/applications/version-management/ungit/default.nix
+++ b/pkgs/applications/version-management/ungit/default.nix
@ -0,0 +1,32 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "ungit";
+  version = "1.5.24";
+
+  src = fetchFromGitHub {
+    owner = "FredrikNoren";
+    repo = "ungit";
+    rev = "v${version}";
+    hash = "sha256-4hDg153CVZidmnIGUwxfzL45Yt+GlMyepfMLJbcjdqo=";
+  };
+
+  npmDepsHash = "sha256-Z/vPqJ70NqjABKKa8r24t0sWoPYRVwxH02BNr1yCVNQ=";
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = true;
+    PUPPETEER_SKIP_DOWNLOAD = true;
+  };
+
+  meta = {
+    changelog = "https://github.com/FredrikNoren/ungit/blob/${src.rev}/CHANGELOG.md";
+    description = "Git made easy";
+    homepage = "https://github.com/FredrikNoren/ungit";
+    license = lib.licenses.mit;
+    mainProgram = "ungit";
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "docker-compose";
-  version = "2.20.2";
+  version = "2.20.3";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "compose";
    rev = "v${version}";
-    sha256 = "sha256-i2/cydp3ZLnmutWW3lpoP2jPQIJ8M6nUTgfhOiz6SPk=";
+    sha256 = "sha256-dCcCtQTow8S0dyAD8UT6p64erSAl7oiZdbpYsO4/Z/s=";
  };

  postPatch = ''
@ -16,7 +16,7 @@ buildGoModule rec {
    rm -rf e2e/
  '';

-  vendorHash = "sha256-Njv2wzVQN4ySdU6NFrOwqS+V5f3/b5AMwgv1/vWnlz0=";
+  vendorHash = "sha256-pNCAEuaF4FkSCmW1JcDMxOtVM6mL7dYLtVu4oUBqoS8=";

  ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];

--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@ -87,9 +87,6 @@ let
      runHook preConfigure
      export GOCACHE=$TMPDIR/go-cache
      export GOPATH="$TMPDIR/go"
-      # fixes 'GOPROXY list is not the empty string, but contains no entries'
-      # "https://proxy.golang.org,direct" is the go default
-      export GOPROXY="''${GOPROXY:-"https://proxy.golang.org,direct"}" # respect impureEnvVars
      cd "${modRoot}"
      runHook postConfigure
    '';
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "26.2.0";
+  version = "26.2.1";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1hbh2s718c2abp404rginas3bqlddgw3bl4k3hv6yi76sdd5wmkw";
-  iosevka-aile = "08l7hidkfc9xwavmcvwis7zma1shyqb9p6n2bcwnrs22826hgn0f";
-  iosevka-curly = "0sm77rfhqjf5iwvn8fc7cqr8g7q6nyycal8bqx8h4wyin8mac6ss";
-  iosevka-curly-slab = "1kvakcscpsfkwfgk8j1pk44xzq5lkhp1m6f6q75cpcrbakmfdw0y";
-  iosevka-etoile = "0vgf3jigdysxhp24kzyhhxmi84sxmnvy99r4l4vjk9fhnpzkhv28";
-  iosevka-slab = "127w2ysvv2cnc5zdyz5znwawfmnvpm4by35igkzlcyplgsygdi16";
-  iosevka-ss01 = "0gl79saa0k1x9b01khxip7wmw2lvaf1glcpsj5733ywwiy381k7d";
-  iosevka-ss02 = "0rc4lf7bx61zs17rd9chnszlbzjpdh867mxvv9gwcm5biyn56zxv";
-  iosevka-ss03 = "0vpz5djxbjca1hq233bl78bbaw7wnky3mjgk5va4mbwvscszpq7d";
-  iosevka-ss04 = "06zf1mccd5082a3cqga46g82dm14asv4x7ljnv21nxqwqb54xrar";
-  iosevka-ss05 = "1r5pxm2gyj1s7qvdsnydczqlpwdqc4c27wfh70gj83s6sn0xaszr";
-  iosevka-ss06 = "08cm7zb0ha16ldh7cy337c226s9vjkr14w9b6v025wq2f7l0axv4";
-  iosevka-ss07 = "1qcc19i5m3hkgkp89a02g2xcyx3xbgwdav88fw3cn5cq9cd32nvg";
-  iosevka-ss08 = "1cd2f3aagikdhh8zh54ijfy0qkmkadpxx9ikc65i0mdwqvrq66qs";
-  iosevka-ss09 = "04gwpk1blrhlakg9253l69d2n5xp7bvy6s1va535z08yln6m2zzq";
-  iosevka-ss10 = "1cxazjh94p4dqsfhs7xb0jfdxyg17w0fi6kvns62scprl11spbah";
-  iosevka-ss11 = "1jgxc03vg45hj2y61kp0hplz4b3v13i9x98j3v5m07m5w4pvz92v";
-  iosevka-ss12 = "0i2h2kdrhq610ca8clsmpfn4c71qvm23fpn389c0kxls8wg5z7h4";
-  iosevka-ss13 = "0mxkxa68krhwlpxn00msir4za5zldhqilnzb2rhsbgwsla5vx0y4";
-  iosevka-ss14 = "0fhg8jdkin4m9fj1d96n9521cx7ffz230abcrkgffas8404x4c6l";
-  iosevka-ss15 = "17fxkh3vl9wb7ajyda6dhwzym71i5gn1qzarnaalabqrrg9vg8aq";
-  iosevka-ss16 = "0w3j91963hh6nlnfy6igz5bj7k81gw4grcsvl58p81z3fb4n4wcc";
-  iosevka-ss17 = "04fmk1wwhh9snmpz9k07acjyjibi7d2l7yjlpbzzc0kwy3i7x37z";
-  iosevka-ss18 = "0k90yhz9a44h8r9kiknnxhm94f9s7xk0m074g4wh07ngc80npaqb";
-  sgr-iosevka = "0hiz1a3gjl684m0wq0i328j0ryrpa5436j6g5agfvdsima60dknv";
-  sgr-iosevka-aile = "18jbnig6shvqcvwmpjc9z14z9am9wsl8ybm7mrw7b237jkfy9839";
-  sgr-iosevka-curly = "1ljs1k0xrd91n1n8chcb0jmcpgjjvgc9qwdxnk1i2zbds515hbsh";
-  sgr-iosevka-curly-slab = "1iqngf3a0mkx52ljmxwsd0088x6zpac6dyz9502wfmp5wrp7y4wf";
-  sgr-iosevka-etoile = "0w8zs73xl4arkksb9xd4g8nyf8n90ya0hb0yg35dqzqqdsf9b5mp";
-  sgr-iosevka-fixed = "1j62gdc1d8rcakg1a46q2bhnnlyzvfnmiz0gp8ia91vz51j9s8vy";
-  sgr-iosevka-fixed-curly = "1sdvbyi7h486drvqi1nccz05nn93wzhi6wwn889kgxawrimpbars";
-  sgr-iosevka-fixed-curly-slab = "1q96b285kxih0lrqrmy16hiwniq7vx6f07l3h9xqhinln8g2mvi8";
-  sgr-iosevka-fixed-slab = "14j718phwai25fwgva3xhz816h9gkds3lhnfmrdxmlj1z5rnsk5z";
-  sgr-iosevka-fixed-ss01 = "1gi9hhzsfrjl5bykyswi882blndggb28b0isdhyhvv5rsjpl6vrq";
-  sgr-iosevka-fixed-ss02 = "1l9k878199nclzmfhc52qcll7x7i4fq71mj495sr4024vm7dgns1";
-  sgr-iosevka-fixed-ss03 = "1vpn6sfz8ps64ysxcviwziw2qhazjj94vx962pvahwd991lgdila";
-  sgr-iosevka-fixed-ss04 = "11847shnrdzfgj4rryk22ba16bxmdsj2qf9vah6qnivsdaw9ymc1";
-  sgr-iosevka-fixed-ss05 = "1n2whdxrlmxgvdqhxgq0qyxrnidgbaw2mmw8s3a06qpcpqi20d3v";
-  sgr-iosevka-fixed-ss06 = "15lhkka5slax5c0vawprfdbdhbbiqapv4d2b02w7fp9g8p0s1ljc";
-  sgr-iosevka-fixed-ss07 = "0ijhsmlp66a1la299w5jvrfnykasznybb22fhq7lkjzdn1blgim9";
-  sgr-iosevka-fixed-ss08 = "1q8d54a7a1xq5a1jkc0c8qns6nq3gyldabjaplczq5p79s2j2fca";
-  sgr-iosevka-fixed-ss09 = "1p86b22v8mn5xs9vxyary8jz1jfy0hy1g7yc4lwmslkvxndjvfld";
-  sgr-iosevka-fixed-ss10 = "1y3rlr3b5bfx97mr7kpg2x2wgk88z7jhx0vh3b33d9q4sd626vcr";
-  sgr-iosevka-fixed-ss11 = "0i6zajhdnfml9ja613jmy3gb6als2chrigkjyzxm0aih4wfm7lly";
-  sgr-iosevka-fixed-ss12 = "0f4p7gmb2g991v1858y53wlxvsnd7fmrsp8d9jxj4nlzpl7giazj";
-  sgr-iosevka-fixed-ss13 = "1230ss6fxk5py0fkn3mcdc1ky1jfp31hz8fqlvkwz3vf954yfqj1";
-  sgr-iosevka-fixed-ss14 = "0hhpmby5jzb839yldzlaj90h1d0d53agxcdiphp9vbmrr3mp3ycd";
-  sgr-iosevka-fixed-ss15 = "1dq7f72zi094hvgpdm912f5ijp8nrcxsd78wsk35nllv4cggswma";
-  sgr-iosevka-fixed-ss16 = "0jlbc0xx3pf3bnlw5p7rpjw6a7hj75lhh78c9qldhdxpiyks2jwk";
-  sgr-iosevka-fixed-ss17 = "0vbqwvn604njd09lc8g4nxq6isjpzv984345l76cpz3hhn22a986";
-  sgr-iosevka-fixed-ss18 = "1xznqj1wwvk9rclgr0nx0p5wx1p3a9sbdbigirmifhjn77mrji9c";
-  sgr-iosevka-slab = "0wmh2dg12gd05vsr8jsx4mflczpyw6prvlap173yll0rif80dwxd";
-  sgr-iosevka-ss01 = "0h93n0v2xzph0j2xq289ssi69dvlbqqz0f9yb41khq6bfz2y6ra7";
-  sgr-iosevka-ss02 = "0vk3h1wxdrgjhy999ikmpkakd8xwsad06q3bbk74q2m9ld3m48jl";
-  sgr-iosevka-ss03 = "0bs4nrvzfmmbh7f8liyd94d47kqgz3iw3mbi5q0cavh4vylhlz6c";
-  sgr-iosevka-ss04 = "0dhz9a2nl4ydj0gdxa9xhvbqf68h3d3yr81zh8gxkj2c84g3lyrn";
-  sgr-iosevka-ss05 = "1q9fvi4kpgjxz03c2jlxbxcw8qvj7h20xdmkgk7kgbvkvvrgmyam";
-  sgr-iosevka-ss06 = "09hf8g8hrw2q6lc60x5fdq0xvic0hx2g7y200p5jj2ghdw6jb7zr";
-  sgr-iosevka-ss07 = "09pn58i1gprrvrq1b5i5sc83ly8gpcxds35kj1l4p8x0h5zz5ffr";
-  sgr-iosevka-ss08 = "19lr6zp4j9wrn9xwffqyrrdy35gfl6fk27i03w07gx4hbl1x45nn";
-  sgr-iosevka-ss09 = "06654zmjf406lzbn3q9f1212r5raw56npii5cc0mn6cfka8lhiyb";
-  sgr-iosevka-ss10 = "0qi00x4vmxvzqyh1556f0fgc9cplapnri3vn10ky7pmmypwlzicf";
-  sgr-iosevka-ss11 = "105l97zm4kmacacqdasac601r04cxj2w6vbciamb3id4yjkr5lqq";
-  sgr-iosevka-ss12 = "1sd02jb4wpw0ax7yd0l2lzkdgl6sv7j64myfzmpgf79n38ik3x6c";
-  sgr-iosevka-ss13 = "0jyizpqxbnkf8ac299brahacjxp0h0hzwhaz5bd11439gkwjpff4";
-  sgr-iosevka-ss14 = "02p2fscj5zvypb1mcnhx7cr09dx4d0gmyhnyvlxw3d8l7r600x7k";
-  sgr-iosevka-ss15 = "0ihmgn49i13xki0ikw1acj0p8vg8siyrgr48apq0vfj9d8yb1fnq";
-  sgr-iosevka-ss16 = "0ggaqg0z63x9x1jp4dw4zi3nm44bfq5v3z22fi2fmkrd9w2l3sl8";
-  sgr-iosevka-ss17 = "1bdk2rwqs68738acl1g5afz1vpaq11qfck54vdphidmppg6fflib";
-  sgr-iosevka-ss18 = "0s336j7wi8rys4kc7zpz9xfq3fcvhajlmpjzkb1qhjxwrsxzk2g9";
-  sgr-iosevka-term = "0329698yx6nagmc9pjil5g3bcd4chng4685bllgzwn6751y3w74p";
-  sgr-iosevka-term-curly = "16p82qiqkimy1przl7hxyd9lh7qkff8q8k1y8339gf35drjs0yii";
-  sgr-iosevka-term-curly-slab = "0vqbhaq107ka798jz84r2ipmf68j511dimkrzqwxcy223nmwh5wm";
-  sgr-iosevka-term-slab = "0gb8vk3hf7fj1wj0n14ha01cxwg767xwhklraq8iz4hj71axj9n2";
-  sgr-iosevka-term-ss01 = "1gnbza11zs4c4zalmpf7yz4wqhx322vd7gsaz1c97hszh11az9hl";
-  sgr-iosevka-term-ss02 = "12hfn784lwz7ldw3siqxk47b2j9yrd4lx9xs56cd9p44wdvspiaq";
-  sgr-iosevka-term-ss03 = "0h56ch2hhp70djbp13a9zr99imr6jincqqwkmpn3pm5z9kr82y9b";
-  sgr-iosevka-term-ss04 = "1nnf8pzdra4xqvvwi487f83blpapyfmpjzm0mqpndws11chl6ndw";
-  sgr-iosevka-term-ss05 = "0g3znbjjh1kjm02bmaf28gqdgk7b0l9sx3hcg0pfyfs9iv05fh8a";
-  sgr-iosevka-term-ss06 = "1v7w15k7s0qrm307lkkrmzy3g09q20d6ws7jmbp7xswxvibfhxkl";
-  sgr-iosevka-term-ss07 = "1i3cg20xz230chw3l3q4bzlp6m62563bgy599cfjjp1si2inx734";
-  sgr-iosevka-term-ss08 = "1jspdgrkszgqzzm04q5l21583j6vfh01qv6f0jr2z9235877f2xw";
-  sgr-iosevka-term-ss09 = "0gc201k5z4kfpsdbkn7kn163cpvxasg01gx9brwypkydsr5m8imz";
-  sgr-iosevka-term-ss10 = "0k4q749vgyz1wpxdg2hg7np52h9b1nx50pw9s0k73fl2n45g7559";
-  sgr-iosevka-term-ss11 = "1s2gqdac7ckw574vwbryfab8hgkjr72yf3s2pc4gr5gcyd97863a";
-  sgr-iosevka-term-ss12 = "0js64ad31vi0zcr07qyamyv7my1cz1dym3jiw3dkcrm3lmi6b65d";
-  sgr-iosevka-term-ss13 = "0kz3166n81h7fzif89mad2g2blvm8hd69ww76k3zivx3rzxvl6m6";
-  sgr-iosevka-term-ss14 = "15nah0qmrp0z0x159yyh848yy2874yx9ijyfwy6cvs7ildzd0fkv";
-  sgr-iosevka-term-ss15 = "05p8is5qwji723gxjffx6si1rcsfspizpn0gr6cvdkz9cwcv0sqv";
-  sgr-iosevka-term-ss16 = "0dp22hbvxj4sjmz1hw4qiqf70fj95zr0mw6f38wvy79813101c14";
-  sgr-iosevka-term-ss17 = "1nbv2p8ddajrymm8a5556xjcx5aia6f1zqrgpjsf6pq0qs06x3di";
-  sgr-iosevka-term-ss18 = "115s4lvh3ml374815w3c2649js29ba5vpq375fd24vlysr147zxd";
+  iosevka = "05kmsx5nfllnynq85m4s9smdq0zqxv2gg3k5xd67ba9c0gkyxx17";
+  iosevka-aile = "11qbl5np9wf5n5yy2y6vf830bal96a2lkdhd6xv65b1kqsz6n5bp";
+  iosevka-curly = "1hdr93lfm8mmm3rr6s13vvacp5h4xqyqkr2a6zl18dgm27rhp7gn";
+  iosevka-curly-slab = "0yp06p379n6x9zkh9ljg1n6ia1ydm93cnp5mw8yapnhk604f4cn3";
+  iosevka-etoile = "1yn743abmyifci72jsmr71swkqdy35whcs36b0a3ypakm7qlgkl9";
+  iosevka-slab = "0d7972ja8flg09q28qh36v4xfavnffn2g4zjkgrzm8pxgz3skzwb";
+  iosevka-ss01 = "0ir5dgw8qqzzlihvicmzplvhd4hhlja2986ppyrj8kwkbhjrczry";
+  iosevka-ss02 = "0j5vrhd48hrql1jz9bdf1lqzdg7cv4nb7snl82sh4f19h2k2f2a2";
+  iosevka-ss03 = "15n5kin4p31czns8l3g29hia17c8x61b55n27qbknfb17yici7g9";
+  iosevka-ss04 = "1zaba7z85k75lrh8x46x77c0hp6145dpg1shh05lmgvmgzyx3s02";
+  iosevka-ss05 = "1ybwb3k9gj5icc8qngzlwxvk306xssz3ax7nqlgr1kij1wawbcd7";
+  iosevka-ss06 = "0d7p2kvpr3x4mlh28y13ph8v7xmziyvrksy7m4zkpll0mkxxrcc1";
+  iosevka-ss07 = "1pbvikwa1nrr91aq2an9bav4allxks29ghpss6plm01c2czkjqs3";
+  iosevka-ss08 = "1ilmlqbrxaz9rpparyq7lhg4c6i0hmd4az049js7rq7nif071dhb";
+  iosevka-ss09 = "0f9fycpsq6fqg7x451bca5cfwwnbswmv39sl2i7ia36kmmlsbarm";
+  iosevka-ss10 = "02k9kra2wqjylvblngv1v9qxfw82yhbrk5vx96bfc16jllw6pk69";
+  iosevka-ss11 = "135v3i6am7hd4iwpf1yj3jszpfyzv4n900wgiqy46ld4qdlvyj0b";
+  iosevka-ss12 = "032slrybd0bdnbsrsz2k7p153dcfi6064zhg292n5fk0whv712vg";
+  iosevka-ss13 = "1qm8gk23ix98ciw1xn6kmwq8x3fcrg9yq1rn71v219n0jyria053";
+  iosevka-ss14 = "1s34fva3bq0m0chib56bj085rwgm4d21grhnf9ca4af01i91lvdh";
+  iosevka-ss15 = "0ikd1lfq8xiyqyppxf8hbvsvqdf0fg2g0056qxqa2w6nvw3f70cf";
+  iosevka-ss16 = "0baada586j23mxjl6ail4fdp9p9swrnwi8q5w6gh25kgbr2gf3lp";
+  iosevka-ss17 = "143ydszlic3byk5ps4ysaql72d7pmdzlhds9dcpy6bcv2m5b1bc2";
+  iosevka-ss18 = "1vrpa1ah718jn5xn72r7j26mka656ik1bb31fah3vlridzkjqyxx";
+  sgr-iosevka = "1f2d9d7pyq916frhr5qlzr5hjwjkfpsqcpgp1p0f2g7z4qw8rr2z";
+  sgr-iosevka-aile = "01aym5ykddkypafsj2186plfp9qm0nm5lbj5vra6yiwxmac3s0fi";
+  sgr-iosevka-curly = "13nklbij304vch9xcqgvcwcdchzrf010iln5022am23ny1ip13aw";
+  sgr-iosevka-curly-slab = "0x2n86ysvph7cv2r5m8lm3xwhq4wds2dv2mjcs8nz66n88hvwk8i";
+  sgr-iosevka-etoile = "0c3pfgwlj5nw4xpbvigwjx8z47xxkpikzyaq8a8klabymyvjg0nj";
+  sgr-iosevka-fixed = "1bvy9dv70ywkdhv6jj12mqbi95ljgr6068dmi31ds5rx7cflfrbq";
+  sgr-iosevka-fixed-curly = "0lcizhf935an59hrr71nrk6x0aqy0rw4xcb7n583gm8svkpkhrfc";
+  sgr-iosevka-fixed-curly-slab = "0fz6q3wnk0yniyhpsm07z94s61jc46rps4925wg1nxriyl16fd21";
+  sgr-iosevka-fixed-slab = "05p989w89arj8fylqdjkby9c7jdadnm6yc8xjjwj81wpmlv5is02";
+  sgr-iosevka-fixed-ss01 = "0krq1wamxxcqcfk13fsdi1n2wcxvrx5kcfr95dwmddyhr46f6c8g";
+  sgr-iosevka-fixed-ss02 = "0n9pfa8lfisbz0cgrii2d18sq7bfrg4gbmj4d4ncq2zxcq63y52k";
+  sgr-iosevka-fixed-ss03 = "0xybkybnmqqjkrapm7sm6nr3n7f68chss1rbxp966l7bnq17zlwn";
+  sgr-iosevka-fixed-ss04 = "0hs0jhfnc68xvvzmmhmc32rv4b16qiy21dv0lnrpjwc8hwqww661";
+  sgr-iosevka-fixed-ss05 = "1kxcadk3z362paqian2pi9nv64k35xhhqd6jw52837g4gmq2l6cn";
+  sgr-iosevka-fixed-ss06 = "0d3lx7s99j5bcdkc4a3w0axv1arlj4xrcfffa3a0z1yvj587c1gs";
+  sgr-iosevka-fixed-ss07 = "06cr5h81vzchg2kx980rnw9g8a0iyxs89p15xai1fwjz8v18b6q1";
+  sgr-iosevka-fixed-ss08 = "1ygni8kdnr72m4dlm0inj49x00gj6m09569sk7x1v2q840hlbka4";
+  sgr-iosevka-fixed-ss09 = "0n96481gn66cs7fy43l172f0f5llysny5a8vn9p1gqr30pkjsb1c";
+  sgr-iosevka-fixed-ss10 = "1dd4jwnv8s8h2r4rrsdr3fzhck86rbxz2n3cmqk8ns0ysi81a9j7";
+  sgr-iosevka-fixed-ss11 = "0xaxzl5wv37dypp97wvi4pv3dzlln6pw5y7lf9jqyfxlj9nkx14m";
+  sgr-iosevka-fixed-ss12 = "1lisn7jrfm444309hbf6cyag54hs7gxbdvcs8z92c3v3xl8382j1";
+  sgr-iosevka-fixed-ss13 = "1lvkla942w36plh5bzwi45zw3a8cixa61kyw5q6pj69yybp6hp49";
+  sgr-iosevka-fixed-ss14 = "11racg8i508dgap2pq0rvzc20612d7px7yajsqd7y3mlf8311920";
+  sgr-iosevka-fixed-ss15 = "0vnhp6rm1gd7g9140lgjbpckl6ysaf4cza2h3p2i1m2mxyq8yfi3";
+  sgr-iosevka-fixed-ss16 = "1xkr6afpjqgjj55a8lmzzhfld66iqszh1dig8balg5s95gm6ylnz";
+  sgr-iosevka-fixed-ss17 = "06q9w6vx6dhlfnjs9hsa9k8fzd9zb9v65d9jfwfdzp54i2asrac9";
+  sgr-iosevka-fixed-ss18 = "13vcnny1a0yikimajqjvc9yadrh2l98qm1bnpmpc9fny158n5nks";
+  sgr-iosevka-slab = "15pj76l27g8n93f1bdn5fs3csfhlvcig11hz0x85ffwc8i8dgx60";
+  sgr-iosevka-ss01 = "0x09g6hz70jrijw86s4l2cpff8ln5aljs7p8675wjc2a3lwj3d3j";
+  sgr-iosevka-ss02 = "10dsvi9k65ijkhrxkm2zwmipsq74yh0wgxham70bc3rb323w5vzq";
+  sgr-iosevka-ss03 = "1zccin0dj2w7rykhqb7w30rvi96gp086wln0zd40i10ah8yqw8x7";
+  sgr-iosevka-ss04 = "1hky2b7ls5n3pb0jzgrxfsly126f770jysvfkcq37bpb0f14wrhj";
+  sgr-iosevka-ss05 = "076v20qzcf063hdnx145iwapn884hwcim5ws0qx9qh7l3im9s5w2";
+  sgr-iosevka-ss06 = "1z2qi8crsvxryn3gxn63zw67hm9fz8rygkjypw8nvbz2p64axif5";
+  sgr-iosevka-ss07 = "0v2cgifv6ic2cn1c6rd8lsjiz34rmp6n3flwiq38px9pra0yh7rz";
+  sgr-iosevka-ss08 = "1s7nhfznyz3hqwjh6xs1bkph9s0g7kwd54h2hx5mkagk0cg2xya6";
+  sgr-iosevka-ss09 = "0j3ny30fnbr1vgcfjssln9ry8kpn8yq2nn9gi2x55cxi1gwgnbpl";
+  sgr-iosevka-ss10 = "0wksbv2fj4nw452h7d5nw8gq4vwjhxrw4hxr44xrk4skkwwaakzn";
+  sgr-iosevka-ss11 = "1azscl182xgfx6993rwwbhxbx4pswwwmwbarxmc775668ydifb73";
+  sgr-iosevka-ss12 = "199qf4vmyjql2f1gnqdwsvxgyf8c4nyr5rwyb6d3zwz5kbqdk9cv";
+  sgr-iosevka-ss13 = "0n9s94x5j3gkzcgw2w3lqphm487xs8x10nklwlz24wh6mxp6azza";
+  sgr-iosevka-ss14 = "0dmnd7cfdxv9hbz3q0bir0csblkzpwfqwcz05y4b79f1fjjahiag";
+  sgr-iosevka-ss15 = "036syp2d0w4gy5j7dr813amvaw2b0kr3v6175vv8y9xgy266ldv0";
+  sgr-iosevka-ss16 = "1hcalq0bvpzd6jq37pqxqjmnh2wmwvmc54fajl03rkw0spf8c4j1";
+  sgr-iosevka-ss17 = "154fg69nadpjd5pmnlxf6bbg86w6zpk1nvm9h604017llgz8iwqa";
+  sgr-iosevka-ss18 = "0ywrj6hmhk0hp5kcdy3i6989glbd1g62s8lr2kixbjm4g27d83hd";
+  sgr-iosevka-term = "12v6im4q77cs6c2ff0dfsis2zlcphcxwqjsbpvl9x9cziznv7lnv";
+  sgr-iosevka-term-curly = "1999vm3y28xm6bcp3s1fksvhs8rggra6i5rfxrsh69fy4i5l7z8q";
+  sgr-iosevka-term-curly-slab = "00xjqkilsrykq7my2rh046q1qdcb110dd2lyz0kq40wl1ipxxyy3";
+  sgr-iosevka-term-slab = "174kyc58rb5zrrxqhkmn5ili6vlbffa4n8g68faygajmjqajnr52";
+  sgr-iosevka-term-ss01 = "01l0siyzrwz56m9w8zxf9n09rv1mh0j4l6jqr6vdzqqvgj6h7k5z";
+  sgr-iosevka-term-ss02 = "19rl3pxhs1g2mwfsp64krnfcfkx5x7qfja3fx5h74r1jm3p8insv";
+  sgr-iosevka-term-ss03 = "04vzrfbrpb0xssr6y1cyysfra2z3g9hm4jn65rzcavmd3i1azj7d";
+  sgr-iosevka-term-ss04 = "08zwnsb1d1x5rmbssyknf1fxcc14bpvcjr6qcl8igpi03bpwag27";
+  sgr-iosevka-term-ss05 = "0ichgg8vfifpnd4sjj2f1snphgxk4cqpd7p3w8dbzn1bp7633jna";
+  sgr-iosevka-term-ss06 = "1kdrbq0m1bdfbxwqlfnmvi98dzplc27p10jgbh877b300dpzwmap";
+  sgr-iosevka-term-ss07 = "099aicmxxa3criq768ycgkcm00b6mssxjavwzc3lkq37vic55y80";
+  sgr-iosevka-term-ss08 = "125m0rs16nnvxkldk8vdc7g04lb29ha0a9ip9kway460wvmjqv9x";
+  sgr-iosevka-term-ss09 = "12r3dqm4y19fyd8dqxli1y8wg5cs2qmmngqbkwb66kxbx1hhgpbs";
+  sgr-iosevka-term-ss10 = "0xyfllwx2m5ngr82wn2fvlbz7kj3qwcnqz43l3cfvafl54zppl4z";
+  sgr-iosevka-term-ss11 = "0sa5pp8fz2fb0d4k8rln0d4l0h1mqz6rvhrcfg49ds84g28380ls";
+  sgr-iosevka-term-ss12 = "08ni5rgj4gfpmalqblz5ip36a8wffk9b9igaj6grmhc8q16i88sl";
+  sgr-iosevka-term-ss13 = "0zmzjzhrk2y18jk3m5pb7f2mz1dr9sdrs0pbw20kfsr70km3mv54";
+  sgr-iosevka-term-ss14 = "049yr8s9adawgrqi4z5qy3xz6pbcafvsw9sd6kb0nrgv8w5y6gd1";
+  sgr-iosevka-term-ss15 = "1cyzj976697m452ifvr6yh8ng9wzfs38xlqwcmy26kk5n4dm2xy8";
+  sgr-iosevka-term-ss16 = "0lg9sz029hw54v6qmbv5z80gxgic6zlva4yb0jpnajn8jj9zcdam";
+  sgr-iosevka-term-ss17 = "0lpynm823jrlbs3qvf5apvnzk4h8bc8axqn3cifcd419hq25n55y";
+  sgr-iosevka-term-ss18 = "12bx1d9lmdv9ljqqjmkq2rjpl4hh77c616xyjx4x2q79apznf56n";
 }
--- a/pkgs/development/interpreters/expr/default.nix
+++ b/pkgs/development/interpreters/expr/default.nix
@ -5,18 +5,18 @@

 buildGoModule rec {
  pname = "expr";
-  version = "1.14.1";
+  version = "1.14.3";

  src = fetchFromGitHub {
    owner = "antonmedv";
    repo = "expr";
    rev = "v${version}";
-    hash = "sha256-X55l2pSlwrcxM4JFcd25yfc5AQJPzNrZRHEHPWPevHw=";
+    hash = "sha256-4BYFFuoKI5EdxBrgMi33PgjXL6TI7jOQ8H7jLlNKfks=";
  };

  sourceRoot = "${src.name}/repl";

-  vendorHash = "sha256-pX8Yk/md6I27PPmdwoixSMMbopDjXOOnXyUxq0D97YA=";
+  vendorHash = "sha256-vQmQdPmfZtudnFqqNeMRdbRVytpbcCt/wH1xSTO+cMQ=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/development/libraries/geographiclib/default.nix
+++ b/pkgs/development/libraries/geographiclib/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "geographiclib";
-  version = "2.2";
+  version = "2.3";

  src = fetchFromGitHub {
    owner = "geographiclib";
    repo = "geographiclib";
    rev = "v${version}";
-    hash = "sha256-W2YbeUYr6rjzdufVGzJ1k56uHHMzq8eidDZbRxTyzAU=";
+    hash = "sha256-FVA2y1q0WjRSCltCN2qntWC//Zj94TXO/fTebFfQ9NY=";
  };

  nativeBuildInputs = [ cmake doxygen ];
--- a/pkgs/development/libraries/libime/default.nix
+++ b/pkgs/development/libraries/libime/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , fetchFromGitHub
 , cmake
@ -13,26 +14,26 @@ let
    url = "https://download.fcitx-im.org/data/table.tar.gz";
    sha256 = "1dw7mgbaidv3vqy0sh8dbfv8631d2zwv5mlb7npf69a1f8y0b5k1";
  };
-  arpaVer = "20220810";
+  arpaVer = "20230712";
  arpa = fetchurl {
    url = "https://download.fcitx-im.org/data/lm_sc.arpa-${arpaVer}.tar.xz";
-    sha256 = "sha256-oRvJfSda2vGV+brIVDaK4GzbSg/h7s9Z21rlgGFdtPo=";
+    hash = "sha256-ut1iwWxjc3h6D9qPCc1FLRL2DVhohW9lHO7PGge6ujI=";
  };
-  dictVer = "20220810";
+  dictVer = "20230412";
  dict = fetchurl {
    url = "https://download.fcitx-im.org/data/dict-${dictVer}.tar.xz";
-    sha256 = "sha256-lxdS9BMYgAfo0ZFYwRuFyVXiXXsyHsInXEs69tioXSY=";
+    hash = "sha256-8F/Mr/loeQCqw9mtWoGyCIi1cyAUA/vNm7x5B9npdQc=";
  };
 in
 stdenv.mkDerivation rec {
  pname = "libime";
-  version = "1.0.17";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = "libime";
    rev = version;
-    sha256 = "sha256-mc0Mknqki0pY4oKf8B6H67N+1eMu7wbqF7wES22Kw1A=";
+    sha256 = "sha256-r1Px93Ly7FzcRaPUNTHNcedzHPHocnUj8t8VMZqXkFM=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/libraries/sokol/default.nix
+++ b/pkgs/development/libraries/sokol/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation {
  pname = "sokol";
-  version = "unstable-2022-06-13";
+  version = "unstable-2023-08-04";

  src = fetchFromGitHub {
    owner = "floooh";
    repo = "sokol";
-    rev = "3c7016105f3b7463f0cfc74df8a55642e5448c11";
-    sha256 = "sha256-dKHb6GTp5aJPuWWXI4ZYnhgdXs23gGWyPymGPGwxcLY=";
+    rev = "47d92ff86298fc96b3b84d93d0ee8c8533d3a2d2";
+    sha256 = "sha256-TsM5wK9a2ectrAY8VnrMPaxCNV3e1yW92SBBCHgs+0k=";
  };

  dontBuild = true;
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@ -72,7 +72,12 @@ mapAliases {
  thelounge = pkgs.thelounge; # Added 2023-05-22
  triton = pkgs.triton; # Added 2023-05-06
  typescript = pkgs.typescript; # Added 2023-06-21
+  inherit (pkgs) ungit; # added 2023-08-20
  vscode-langservers-extracted = pkgs.vscode-langservers-extracted; # Added 2023-05-27
  vue-cli = self."@vue/cli"; # added 2023-08-18
+  vue-language-server = self.vls; # added 2023-08-20
+  inherit (pkgs) web-ext; # added 2023-08-20
+  inherit (pkgs) write-good; # added 2023-08-20
+  inherit (pkgs) yo; # added 2023-08-20
  zx = pkgs.zx; # added 2023-08-01
 }
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@ -75,7 +75,6 @@
  vscode-css-languageserver-bin = "css-languageserver";
  vscode-html-languageserver-bin = "html-languageserver";
  vscode-json-languageserver-bin = "json-languageserver";
-  vue-language-server = "vls";
  webtorrent-cli = "webtorrent";
  "@zwave-js/server" = "zwave-server";
 }
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -346,7 +346,6 @@
 , "typescript-language-server"
 , "uglify-js"
 , "undollar"
-, "ungit"
 , "unified-language-server"
 , "vega-cli"
 , "vega-lite"
@ -357,9 +356,7 @@
 , "vscode-html-languageserver-bin"
 , "vscode-json-languageserver"
 , "vscode-json-languageserver-bin"
-, "vue-language-server"
 , "wavedrom-cli"
-, "web-ext"
 , "webpack"
 , "webpack-cli"
 , "webpack-dev-server"
@ -368,11 +365,9 @@
 , "@withgraphite/graphite-cli"
 , "wrangler"
 , "wring"
-, "write-good"
 , "@yaegassy/coc-nginx"
 , "yaml-language-server"
 , "yalc"
 , "yarn"
-, "yo"
 , "@zwave-js/server"
 ]
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/python-modules/basemap/default.nix
+++ b/pkgs/development/python-modules/basemap/default.nix
@ -17,13 +17,13 @@

 buildPythonPackage rec {
  pname = "basemap";
-  version = "1.3.7";
+  version = "1.3.8";

  src = fetchFromGitHub {
    owner = "matplotlib";
    repo = "basemap";
    rev = "refs/tags/v${version}";
-    hash = "sha256-oWKCUARTMCiXDp4SCOOrOUQLUDU4DIzwsmUXCXoDvx0=";
+    hash = "sha256-QH/pC1WIa0XQaDbAhYwKbCeCyxUprJbNyRfguiLjlHI=";
  };

  sourceRoot = "${src.name}/packages/basemap";
--- a/pkgs/development/python-modules/cerberus/default.nix
+++ b/pkgs/development/python-modules/cerberus/default.nix
@ -1,22 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, setuptools
+, poetry-core
 , pytestCheckHook
+, pythonOlder
+, setuptools
 }:

 buildPythonPackage rec {
-  pname = "Cerberus";
-  version = "1.3.4";
+  pname = "cerberus";
+  version = "1.3.5";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "pyeve";
    repo = "cerberus";
-    rev = version;
-    sha256 = "03kj15cf1pbd11mxsik96m5w1m6p0fbdc4ia5ihzmq8rz28razpq";
+    rev = "refs/tags/${version}";
+    hash = "sha256-4sVNM4zHc9nsrntmJVdE9nm47CSF0UOJPPI9z3Z2YDc=";
  };

  propagatedBuildInputs = [
+    poetry-core
    setuptools
  ];

@ -24,23 +30,20 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  preCheck = ''
-    export TESTDIR=$(mktemp -d)
-    cp -R ./cerberus/tests $TESTDIR
-    pushd $TESTDIR
-  '';
-
-  postCheck = ''
-    popd
-  '';
-
  pythonImportsCheck = [
    "cerberus"
  ];

+  disabledTestPaths = [
+    # We don't care about benchmarks
+    "cerberus/benchmarks/"
+  ];
+
  meta = with lib; {
+    description = "Schema and data validation tool for Python dictionaries";
    homepage = "http://python-cerberus.org/";
-    description = "Lightweight, extensible schema and data validation tool for Python dictionaries";
+    changelog = "https://github.com/pyeve/cerberus/blob/${version}/CHANGES.rst";
    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/cert-chain-resolver/default.nix
+++ b/pkgs/development/python-modules/cert-chain-resolver/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "cert-chain-resolver";
-  version = "1.0.1";
+  version = "1.1.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,8 +18,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "rkoopmans";
    repo = "python-certificate-chain-resolver";
-    rev = version;
-    hash = "sha256-NLTRx6J6pjs7lyschHN5KtgrnpQpEyvZ2zz0pSd5sc4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-2itpu/Ap5GNnqAiw3Cp+8rndreWlwfPd+WwM99G7U2E=";
  };

  propagatedBuildInputs = [
@ -45,6 +45,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Resolve / obtain the certificate intermediates of a x509 certificate";
    homepage = "https://github.com/rkoopmans/python-certificate-chain-resolver";
+    changelog = "https://github.com/rkoopmans/python-certificate-chain-resolver/blob/${version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ veehaitch ];
  };
--- a/pkgs/development/python-modules/certomancer/default.nix
+++ b/pkgs/development/python-modules/certomancer/default.nix
@ -1,69 +1,94 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
 , asn1crypto
+, buildPythonPackage
 , click
-, oscrypto
-, pyyaml
-, python-dateutil
-, tzlocal
-, pytest-aiohttp
-, pytz
+, cryptography
+, fetchFromGitHub
 , freezegun
 , jinja2
+, oscrypto
 , pyhanko-certvalidator
+, pytest-aiohttp
+, pytestCheckHook
+, python-dateutil
+, python-pkcs11
+, pythonOlder
+, pytz
+, pyyaml
 , requests
 , requests-mock
+, setuptools
+, tzlocal
 , werkzeug
-, pytestCheckHook
+, wheel
 }:

 buildPythonPackage rec {
  pname = "certomancer";
-  version = "0.9.1";
-  format = "setuptools";
+  version = "0.11.0";
+  format = "pyproject";
+
  disabled = pythonOlder "3.7";

-  # Tests are only available on GitHub
  src = fetchFromGitHub {
    owner = "MatthiasValvekens";
    repo = "certomancer";
-    rev = version;
-    sha256 = "4v2e46ZrzhKXpMULj0vmDRoLOypi030eaADAYjLMg5M=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-UQV0Tk4C5b5iBZ34Je59gK2dLTaJusnpxdyNicIh2Q8=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace ' "pytest-runner",' "" \
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
  propagatedBuildInputs = [
    asn1crypto
    click
    oscrypto
-    pyyaml
    python-dateutil
+    pyyaml
    tzlocal
  ];

-  postPatch = ''
-    substituteInPlace setup.py --replace ", 'pytest-runner'" ""
-  '';
+  passthru.optional-dependencies = {
+    requests-mocker = [
+      requests-mock
+    ];
+    web-api = [
+      jinja2
+      werkzeug
+    ];
+    pkcs12 = [
+      cryptography
+    ];
+    pkcs11 = [
+      python-pkcs11
+    ];
+  };

  nativeCheckInputs = [
    freezegun
-    jinja2
    pyhanko-certvalidator
    pytest-aiohttp
+    pytestCheckHook
    pytz
    requests
-    requests-mock
-    werkzeug
-    pytestCheckHook
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);

  disabledTests = [
    # pyhanko_certvalidator.errors.DisallowedAlgorithmError
    "test_validate"
  ];

-  pythonImportsCheck = [ "certomancer" ];
+  pythonImportsCheck = [
+    "certomancer"
+  ];

  meta = with lib; {
    description = "Quickly construct, mock & deploy PKI test configurations using simple declarative configuration";
--- a/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix
+++ b/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix
@ -17,7 +17,7 @@

 let
  pname = "chacha20poly1305-reuseable";
-  version = "0.3.0";
+  version = "0.4.1";
 in

 buildPythonPackage {
@ -30,7 +30,7 @@ buildPythonPackage {
    owner = "bdraco";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-/bXpwSBFr1IM04GNEczzsnsjdFV4miUAzJkvrQjfIq4=";
+    hash = "sha256-JDkTSJi7QltKAdgkM+aJ33DP2emOAviyCqI/jeapUB8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "dbus-fast";
-  version = "1.92.0";
+  version = "1.93.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-JlR2eoNOsZ/YE313fWAtoxJhlpMnUaDJcFpwA2b6p4c=";
+    hash = "sha256-+L9V9Uk5VRucp3r9zrywXzJOfY/9aeWMep6MTiwngVI=";
  };

  # The project can build both an optimized cython version and an unoptimized
--- a/pkgs/development/python-modules/pex/default.nix
+++ b/pkgs/development/python-modules/pex/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "pex";
-  version = "2.1.142";
+  version = "2.1.143";
  format = "flit";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-+2WJEOL+rtdl9dZmXqkaRRuj7TzDZn93tyZXxPWRaBM=";
+    hash = "sha256-xyYD9oGrlK1kswQ7uiO3/gAJUnelvWv7ZHyzn/g5iCg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyflume/default.nix
+++ b/pkgs/development/python-modules/pyflume/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pyflume";
-  version = "0.7.2";
+  version = "0.8.3";
  format = "setuptools";

  disabled = pythonOlder "3.10";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "ChrisMandich";
    repo = "PyFlume";
    rev = "refs/tags/v${version}";
-    hash = "sha256-wmaOOM8y7LthEgf3Uyv1N4ODviPGSlIQejC01IlhaJw=";
+    hash = "sha256-RtzbAXjMtvKc8vnZIxIJnc6CS+BrYcQgdy5bVaJumg0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
+++ b/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
@ -1,34 +1,38 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
 , aiohttp
 , asn1crypto
+, buildPythonPackage
 , cryptography
+, fetchFromGitHub
 , freezegun
-, oscrypto
-, requests
-, uritools
 , openssl
+, oscrypto
 , pytest-asyncio
 , pytestCheckHook
+, pythonOlder
+, requests
+, setuptools
+, uritools
 }:

 buildPythonPackage rec {
  pname = "pyhanko-certvalidator";
-  version = "0.20.1";
-  format = "setuptools";
+  version = "0.23.0";
+  format = "pyproject";

  disabled = pythonOlder "3.7";

-  # Tests are only available on GitHub
  src = fetchFromGitHub {
    owner = "MatthiasValvekens";
    repo = "certvalidator";
-    rev = version;
-    hash = "sha256-0RSveoSZb7R6d4cMlF1mIrDfnTx2DYNwfTMMtmg+RpM=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-q2YxncyMHmbRmcoLb68huK02CYiKqF2CFRl8vkUfxg4=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    asn1crypto
    cryptography
@ -71,6 +75,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python library for validating X.509 certificates and paths";
    homepage = "https://github.com/MatthiasValvekens/certvalidator";
+    changelog = "https://github.com/MatthiasValvekens/certvalidator/blob/v${version}/changelog.md";
    license = licenses.mit;
    maintainers = with maintainers; [ wolfangaukang ];
  };
--- a/pkgs/development/python-modules/pyhanko/default.nix
+++ b/pkgs/development/python-modules/pyhanko/default.nix
@ -1,49 +1,58 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
+, aiohttp
 , asn1crypto
+, buildPythonPackage
+, certomancer
 , click
 , cryptography
+, defusedxml
+, fetchFromGitHub
+, fonttools
+, freezegun
+, oscrypto
+, pillow
 , pyhanko-certvalidator
+, pytest-aiohttp
+, pytestCheckHook
+, python-barcode
+, python-pae
+, python-pkcs11
+, pythonOlder
 , pytz
 , pyyaml
 , qrcode
 , requests
-, tzlocal
-, certomancer
-, freezegun
-, python-pae
-, pytest-aiohttp
 , requests-mock
-, pytestCheckHook
-
-# optionals
-, defusedxml
-, oscrypto
-, fonttools
+, setuptools
+, tzlocal
 , uharfbuzz
-, pillow
-, python-barcode
-, python-pkcs11
-, aiohttp
+, wheel
 }:

 buildPythonPackage rec {
  pname = "pyhanko";
-  version = "0.17.0";
-  format = "setuptools";
+  version = "0.20.0";
+  format = "pyproject";

  disabled = pythonOlder "3.7";

-  # Tests are only available on GitHub
  src = fetchFromGitHub {
    owner = "MatthiasValvekens";
    repo = "pyHanko";
-    rev = "refs/tags/${version}";
-    hash = "sha256-tvb2zdmIN6MkezmLNkyCcP8EfqxrbPg/FEqgW16Ka6Q=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-mWhkTVhq3bDkOlhUZIBBqwXUuQCXcFHW1haGOGMywzg=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace ' "pytest-runner",' ""
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
  propagatedBuildInputs = [
    asn1crypto
    click
@ -57,7 +66,7 @@ buildPythonPackage rec {
  ];

  passthru.optional-dependencies = {
-    extra_pubkey_algs = [
+    extra-pubkey-algs = [
      oscrypto
    ];
    xmp = [
@ -74,16 +83,11 @@ buildPythonPackage rec {
    pkcs11 = [
      python-pkcs11
    ];
-    async_http = [
+    async-http = [
      aiohttp
    ];
  };

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace ", 'pytest-runner'" "" \
-  '';
-
  nativeCheckInputs = [
    aiohttp
    certomancer
@ -132,6 +136,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Sign and stamp PDF files";
    homepage = "https://github.com/MatthiasValvekens/pyHanko";
+    changelog = "https://github.com/MatthiasValvekens/pyHanko/blob/v${version}/docs/changelog.rst";
    license = licenses.mit;
    maintainers = with maintainers; [ wolfangaukang ];
  };
--- a/pkgs/development/python-modules/vsure/default.nix
+++ b/pkgs/development/python-modules/vsure/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "vsure";
-  version = "2.6.4";
+  version = "2.6.5";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-d9t/zO1ROCndS+5kiFVyDbs+96z7GMHaH6T82b8hl40=";
+    hash = "sha256-2w1D0380ljgRa5NSPAUlUPFTmGzjl79hyLwirmuHmGo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/xkcdpass/default.nix
+++ b/pkgs/development/python-modules/xkcdpass/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "xkcdpass";
-  version = "1.19.3";
+  version = "1.19.4";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-xaLpSHRtpv5QToQEKE9FfY6Y2m31BHxrs/cbGIgunSo=";
+    hash = "sha256-KTXVS0gtGby1Rla9oBy77J7kH/1C0jWlJwX9lcq3D9c=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/yalexs/default.nix
+++ b/pkgs/development/python-modules/yalexs/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "yalexs";
-  version = "1.7.0";
+  version = "1.8.0";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "bdraco";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-Lh+3ZpOAhOQjSLoJTaLY5706I3tKy7pqQE6M1cRCYrw=";
+    hash = "sha256-ZxZIv69HooX6SUIdrtAuhOEVPN7E+E/AZ138XmzIYIE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -22,14 +22,14 @@ with py.pkgs;

 buildPythonApplication rec {
  pname = "checkov";
-  version = "2.4.2";
+  version = "2.4.5";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-PbgNTYrA1fWot+sLgoT9yUa0IImHwyQPSo267w16YmU=";
+    hash = "sha256-hx2aDFIYf+9GplioNs446P654KOvsWO/wOiBmjEbeS4=";
  };

  patches = [
--- a/pkgs/development/tools/continuous-integration/drone/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "drone.io${lib.optionalString (!enableUnfree) "-oss"}";
-  version = "2.18.0";
+  version = "2.20.0";

  src = fetchFromGitHub {
    owner = "harness";
    repo = "drone";
    rev = "v${version}";
-    sha256 = "sha256-fN86wdKe3KWRkVxRK/4L4Gcf8auelAi2e+erANLCCmA=";
+    sha256 = "sha256-YiKULnLSP5wgrYob1t4HssGS9ubSR5dHECIwnAicg8M=";
  };

-  vendorHash = "sha256-3Gjo5i3tLXZNUNdp+CKX5hPxVupH5juUIKzndN2AaBU=";
+  vendorHash = "sha256-3GPe76zcyKItYWedmnAnmN4c1AorQePxxWXkRk0vNpk=";

  tags = lib.optionals (!enableUnfree) [ "oss" "nolimit" ];

--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitLab, fetchurl, bash }:

 let
-  version = "16.2.1";
+  version = "16.3.0";
 in
 buildGoModule rec {
  inherit version;
@ -17,19 +17,18 @@ buildGoModule rec {
  # For patchShebangs
  buildInputs = [ bash ];

-  vendorHash = "sha256-Rzy4R4QR+rPqzhjZlqcuiP3DDLOu9Z2fb42WPaSPR/4=";
+  vendorHash = "sha256-tMhzq9ygUmNi9+mlI9Gvr2nDyG9HQbs8PVusSgadZIE=";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-runner";
    rev = "v${version}";
-    sha256 = "sha256-GMvBZ3H29F4XyisAt3J4VWRwaEIF7ZQ/tI0gKbDTS/E=";
+    sha256 = "sha256-YAnHOIpUN1OuNefjCIccZOLwPNMxVBuCRQgX0Tb5bos=";
  };

  patches = [
    ./fix-shell-path.patch
    ./remove-bash-test.patch
-    ./fix-invalid-host-header.patch # see https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/4249
  ];

  prePatch = ''
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/fix-invalid-host-header.patch
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/fix-invalid-host-header.patch
@ -1,58 +0,0 @@
-From 0087ed1e060cab8341f20a4342c0f750d5bb328b Mon Sep 17 00:00:00 2001
-From: Michael Adler <therisen06@gmail.com>
-Date: Fri, 18 Aug 2023 14:42:49 +0200
-Subject: [PATCH] Backport fix for invalid Host header
-
---
- go.mod | 4 ++--
- go.sum | 8 ++++----
- 2 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/go.mod b/go.mod
-index d93029df7..23e8fd707 100644
--- a/go.mod
-+++ b/go.mod
-@@ -15,12 +15,12 @@ require (
- 	github.com/bmatcuk/doublestar/v4 v4.4.0
- 	github.com/creack/pty v1.1.17
- 	github.com/denisbrodbeck/machineid v1.0.1
-	github.com/docker/cli v23.0.1+incompatible
-+	github.com/docker/cli v24.0.5+incompatible
- 	github.com/docker/distribution v2.8.2+incompatible
- 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0
- 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0
- 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azsecrets v0.11.0
-	github.com/docker/docker v23.0.6+incompatible
-+	github.com/docker/docker v24.0.5+incompatible
- 	github.com/docker/go-connections v0.4.0
- 	github.com/docker/go-units v0.5.0
- 	github.com/docker/machine v0.7.1-0.20170120224952-7b7a141da844
-diff --git a/go.sum b/go.sum
-index fba5228da..0a9d36bef 100644
--- a/go.sum
-+++ b/go.sum
-@@ -497,8 +497,8 @@ github.com/dnaeon/go-vcr v1.1.0/go.mod h1:M7tiix8f0r6mKKJ3Yq/kqU1OYf3MnfmBWVbPx/
- github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
- github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
- github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli v23.0.1+incompatible h1:LRyWITpGzl2C9e9uGxzisptnxAn1zfZKXy13Ul2Q5oM=
-github.com/docker/cli v23.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-+github.com/docker/cli v24.0.5+incompatible h1:WeBimjvS0eKdH4Ygx+ihVq1Q++xg36M/rMi4aXAvodc=
-+github.com/docker/cli v24.0.5+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
- github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
- github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
- github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-@@ -507,8 +507,8 @@ github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4Kfc
- github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
- github.com/docker/docker v20.10.14+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
- github.com/docker/docker v20.10.17+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v23.0.6+incompatible h1:aBD4np894vatVX99UTx/GyOUOK4uEcROwA3+bQhEcoU=
-github.com/docker/docker v23.0.6+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-+github.com/docker/docker v24.0.5+incompatible h1:WmgcE4fxyI6EEXxBRxsHnZXrO1pQ3smi0k/jho4HLeY=
-+github.com/docker/docker v24.0.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
- github.com/docker/docker-credential-helpers v0.6.3 h1:zI2p9+1NQYdnG6sMU26EX4aVGlqbInSQxQXLvzJ4RPQ=
- github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
- github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
-- 
-2.41.0
-
--- a/pkgs/development/tools/misc/pest-ide-tools/default.nix
+++ b/pkgs/development/tools/misc/pest-ide-tools/default.nix
@ -0,0 +1,34 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, nix-update-script
+, pkg-config
+, openssl
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "pest-ide-tools";
+  version = "0.3.3";
+  cargoSha256 = "sha256-TXsRGkhswxxLCPOk1qMTvDjs4de1sClRJMr/0o6u4Pg=";
+
+  src = fetchFromGitHub {
+    owner = "pest-parser";
+    repo = "pest-ide-tools";
+    rev = "v${version}";
+    sha256 = "sha256-XAdQQFU8ZF0zarqCB6WlhpZVNqNyX6e4np4Wjalhobo=";
+  };
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = with lib; {
+    description = "IDE support for Pest, via the LSP.";
+    homepage = "https://pest.rs";
+    license = with licenses; [ mit asl20 ];
+    maintainers = with maintainers; [ nickhu ];
+    mainProgram = "pest-language-server";
+  };
+}
--- a/pkgs/development/tools/tokio-console/cargo-lock.patch
+++ b/pkgs/development/tools/tokio-console/cargo-lock.patch
@ -0,0 +1,13 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index fcbe50c..27d4c30 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -1390,7 +1390,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "tokio-console"
+-version = "0.1.8"
+version = "0.1.9"
+ dependencies = [
+  "atty",
+  "clap",
--- a/pkgs/development/tools/tokio-console/default.nix
+++ b/pkgs/development/tools/tokio-console/default.nix
@ -6,19 +6,21 @@

 rustPlatform.buildRustPackage rec {
  pname = "tokio-console";
-  version = "0.1.7";
+  version = "0.1.9";

  src = fetchFromGitHub {
    owner = "tokio-rs";
    repo = "console";
    rev = "tokio-console-v${version}";
-    sha256 = "sha256-yTNLKpBkzzN0X73CjN/UXRGjAGOnCCgJa6A6loA6baM=";
+    hash = "sha256-zISgEhUmAfHErq4AelbnSwtKjtxYH//pbLUAlPKxQYk=";
  };

-  cargoSha256 = "sha256-K/auhqlL/K6RYE0lHyvSUqK1cOwJBBZD3QTUevZzLXQ=";
+  cargoHash = "sha256-qK8U6BZN7sdBP8CbzsDeewsGulNA/KFVS9vscBxysRg=";

  nativeBuildInputs = [ protobuf ];

+  cargoPatches = [ ./cargo-lock.patch ];
+
  # uses currently unstable tokio features
  RUSTFLAGS = "--cfg tokio_unstable";

@ -32,6 +34,7 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "A debugger for asynchronous Rust code";
    homepage = "https://github.com/tokio-rs/console";
+    mainProgram = "tokio-console";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ max-niederman ];
  };
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "typos";
-  version = "1.16.6";
+  version = "1.16.8";

  src = fetchFromGitHub {
    owner = "crate-ci";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-ZpOIKruxv22e/kMUfU8hY7jJjCadLSo7UEGn+Akx13c=";
+    hash = "sha256-JEXc/yR7QbqaKGHrmc/1ZwFVL0NqAAb5JDhidS0p1Ik=";
  };

-  cargoHash = "sha256-OlblTYN1gG/Lt+ZKB7kEQsxX1WnfC1zuT/nfOVG6eqU=";
+  cargoHash = "sha256-f6BvUc5YVSRZUWEtwUMBnvXwKNFiYbcGzvlplma7Mj4=";

  meta = with lib; {
    description = "Source code spell checker";
--- a/pkgs/development/tools/web-ext/default.nix
+++ b/pkgs/development/tools/web-ext/default.nix
@ -0,0 +1,26 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "web-ext";
+  version = "7.6.2";
+
+  src = fetchFromGitHub {
+    owner = "mozilla";
+    repo = "web-ext";
+    rev = version;
+    hash = "sha256-tFMngcoHFA3QmR0AK68elUVpli37PsVlcL978o7DQCs=";
+  };
+
+  npmDepsHash = "sha256-KPBKUjCxva11w/E+Qhlx+1vikpCL7Hr9MiKenYHEVSU=";
+
+  meta = {
+    description = "A command line tool to help build, run, and test web extensions";
+    homepage = "https://github.com/mozilla/web-ext";
+    license = lib.licenses.mpl20;
+    mainProgram = "web-ext";
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/development/tools/yo/default.nix
+++ b/pkgs/development/tools/yo/default.nix
@ -0,0 +1,28 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "yo";
+  version = "4.3.1";
+
+  src = fetchFromGitHub {
+    owner = "yeoman";
+    repo = "yo";
+    rev = "v${version}";
+    hash = "sha256-vnvcg3hvAYcqS11enBEHtpTwTOy4puY5i/6zPOHCywo=";
+  };
+
+  npmDepsHash = "sha256-QkEPaepvI6NfEEmqnVA4Xx/tByn6goyGWVpoJNMigd8=";
+
+  dontNpmBuild = true;
+
+  meta = {
+    description = "CLI tool for running Yeoman generators";
+    homepage = "https://github.com/yeoman/yo";
+    license = lib.licenses.bsd2;
+    mainProgram = "yo";
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/servers/web-apps/netbox/default.nix
+++ b/pkgs/servers/web-apps/netbox/default.nix
@ -17,20 +17,23 @@ in
      })
    ];

-    tests.netbox = nixosTests.netbox_3_3;
+    tests = {
+      netbox = nixosTests.netbox_3_3;
+      inherit (nixosTests) netbox-upgrade;
+    };
    maintainers = with lib.maintainers; [ n0emis raitobezarius ];
    eol = true;
  };

  netbox = callPackage generic {
-    version = "3.5.6";
-    hash = "sha256-n5EJQcC5uVoL5KjGzF7bLF8c4Wke/YBJpx2V9KZz5Qo=";
+    version = "3.5.7";
+    hash = "sha256-R5P4FOhn7rE6e9H9U3JlE3ms4Svv6ps4c3+ZjE1KwNM=";
    extraPatches = [
      # Allow setting the STATIC_ROOT from within the configuration and setting a custom redis URL
      ./config.patch
    ];
    tests = {
-      inherit (nixosTests) netbox;
+      inherit (nixosTests) netbox netbox-upgrade;
    };

    maintainers = with lib.maintainers; [ minijackson n0emis raitobezarius ];
--- a/pkgs/tools/inputmethods/fcitx5/default.nix
+++ b/pkgs/tools/inputmethods/fcitx5/default.nix
@ -43,23 +43,15 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "fcitx5";
-  version = "5.0.23";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    hash = "sha256-zS25XeNtBN7QIi+Re/p1uLoH/Q4xKAsFrEmgk2LYRu8=";
+    hash = "sha256-tnYyHhldPmMZcygpcOcbaYFQbRQjPr/FlvyYfRylTmQ=";
  };

-  patches = [
-    # Fix compatiblity with fmt 10.0. Remove with the next release
-    (fetchpatch {
-      url = "https://github.com/fcitx/fcitx5/commit/7fb3a5500270877d93b61b11b2a17b9b8f6a506b.patch";
-      hash = "sha256-Z4Sqdyp/doJPTB+hEUrG9vncUP29L/b0yJ/u5ldpnds=";
-    })
-  ];
-
  prePatch = ''
    ln -s ${enDict} src/modules/spell/$(stripHash ${enDict})
  '';
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-anthy.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-anthy.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-anthy";
-  version = "5.0.14";
+  version = "5.1.0";

  src = fetchurl {
    url = "https://download.fcitx-im.org/fcitx5/fcitx5-anthy/${pname}-${version}.tar.xz";
-    sha256 = "sha256-CodNcN9O8i8euGjCfq9m4zVOFgnbje05JUT49rxUp7c=";
+    sha256 = "sha256-tyWxNhCreJaAc+IUH85iayo8OALcY0ytFc7Aa8Ye80M=";
  };

  nativeBuildInputs = [ cmake extra-cmake-modules pkg-config ];
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-chewing.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-chewing.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-chewing";
-  version = "5.0.14";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    sha256 = "sha256-zfaq5pkHcB12iFvXWvvzmX9mpcXAZSri9lVlzfePLAQ=";
+    sha256 = "sha256-Zjwt7JHwCfXlY46qRTXSmXI69fANZNI7DY1ixpMEqPM=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
@ -31,13 +31,13 @@ in

 mkDerivation rec {
  pname = "fcitx5-chinese-addons";
-  version = "5.0.17";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Licj/sZ2rZablsk/ytCZlkdjSHszr31JURrQkXs1BXE=";
+    sha256 = "sha256-Z5X/yKxj8jX/einrebkP6rSCSrKvaQ7vOlbmT1IKXfY=";
  };

  cmakeFlags = [
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-configtool.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-configtool.nix
@ -21,13 +21,13 @@

 mkDerivation rec {
  pname = "fcitx5-configtool";
-  version = "5.0.17";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    sha256 = "sha256-nYHrJBcbaYxZ61OEFfnwTTsZFEBtDJkR0kuYPyTcjio=";
+    sha256 = "sha256-kjoAcoqLJ8XHMI6NUr5DZfltWfX3GPco3VGseze6qbw=";
  };

  cmakeFlags = [
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix
@ -26,13 +26,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-gtk";
-  version = "5.0.23";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    sha256 = "sha256-RMi2D9uqGmvyDIB7eRbr52aahCJ5u21jCyZ9hbCDdKY=";
+    sha256 = "sha256-xVBmFFUnlWqviht/KGFTHCd3xCln/6hyBG72tIHqopc=";
  };

  cmakeFlags = [
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-hangul.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-hangul.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-hangul";
-  version = "5.0.11";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    sha256 = "sha256-VA9LDGMJRJDDCxIsx7wpDgdc2V9cuWlydAq5yiIvpxA=";
+    sha256 = "sha256-3cJLF80oAqGSJvPPyKcHxaWysA9RtWYGgptailYd4dk=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-m17n.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-m17n.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-m17n";
-  version = "5.0.11";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    sha256 = "sha256-MCSJGZGpnOcZ9ZHlUDOPrbfo61HRM4s2xuj8zblyW/8=";
+    sha256 = "sha256-qo3tS0tjQCD7+CoNvjyvhQPAfa38o7/f/MjqRkIL2R0=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
@ -13,13 +13,13 @@

 mkDerivation rec {
  pname = "fcitx5-qt";
-  version = "5.0.17";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Pi5Xb7H/h89OcTzYX7X3Xw8FQIczkWd6rMrbwnHr/L4=";
+    sha256 = "sha256-LWOELt1uo5TtM85ppxt6MK7fvUuocHkWXYjUE1yyOV4=";
  };

  preConfigure = ''
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-rime.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-rime.nix
@ -1,5 +1,6 @@
-{ lib, stdenv
-, fetchFromGitHub
+{ lib
+, stdenv
+, fetchurl
 , pkg-config
 , cmake
 , extra-cmake-modules
@ -13,13 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-rime";
-  version = "5.0.16";
+  version = "5.1.1";

-  src = fetchFromGitHub {
-    owner = "fcitx";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-YAunuxdMlv1KOj2/xXstb/Uhm97G9D9rxb35AbNgMaE=";
+  src = fetchurl {
+    url = "https://download.fcitx-im.org/fcitx5/${pname}/${pname}-${version}.tar.xz";
+    hash = "sha256-qo0m/asTranm70PHPLwWCn/jX+FWNEGRKBRNNW+B28A=";
  };

  cmakeFlags = [
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-skk.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-skk.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-skk";
-  version = "5.0.15";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    sha256 = "sha256-y5GciWJMEFQM8SsqYANXe/SdVq6GEqsfF1yrKKhw0KA=";
+    sha256 = "sha256-N69OyGzJGO27tsR1g06d0EILsX2mpbW/tIgeSLc06OU=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-table-extra.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-table-extra.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-table-extra";
-  version = "5.0.13";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    sha256 = "sha256-/YIZMSCKJlnPL+pmUWfVf8tINKjXKkGAK7rWQ98RRjQ=";
+    sha256 = "sha256-os2C/6r9hz/3MEAny8Klc01cRGIiKD39rdu56kQDCnQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-table-other.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-table-other.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-table-other";
-  version = "5.0.11";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Km0c6so+Ed/lbK9t54stWjlkK70aEcf7EbQm7msPDKM=";
+    sha256 = "sha256-ymHAKaPmQckxM/XHoDOVSzEWpyQGb7zVG21CDwNfyjg=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-unikey.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-unikey.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-unikey";
-  version = "5.0.13";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = "fcitx5-unikey";
    rev = version;
-    sha256 = "sha256-UpCXcgVUGe5/yunLqRNx2H2aLOnD1wJNA8y3q8R4+sY=";
+    sha256 = "sha256-X00/jGtbApWtS9+S6lTXJ0+BK7SUsLA1sKxq0vW1VNE=";
  };

  nativeBuildInputs = [ cmake extra-cmake-modules wrapQtAppsHook ];
--- a/pkgs/tools/inputmethods/fcitx5/update.py
+++ b/pkgs/tools/inputmethods/fcitx5/update.py
@ -1,7 +1,6 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i python3 -p nix-update python3Packages.requests

-from nix_prefetch_github import *
 import requests
 import subprocess

--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@ -1,11 +1,11 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , chafa
 , cmake
 , dbus
 , dconf
+, ddcutil
 , glib
 , imagemagick_light
 , libglvnd
@ -42,23 +42,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fastfetch";
-  version = "2.0.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "fastfetch-cli";
    repo = "fastfetch";
    rev = finalAttrs.version;
-    hash = "sha256-mXbkzPlX1OsK+ahUSJWktV5D7Mo2zkhXgXP54QjbIR4=";
+    hash = "sha256-7Sk2Fd9u5c1XLTd9vl32TpD10M1JeB9V05yF/dF+Sfk=";
  };

-  patches = [
-    # Don't fetch yyjson.
-    (fetchpatch {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-misc/fastfetch/files/fastfetch-2.0.0-dont-fetch-yyjson.patch";
-      hash = "sha256-mOykwXSuad8BrUBmjX39EmQb0/hnKezgmWe8cpAybsw=";
-    })
-  ];
-
  nativeBuildInputs = [
    cmake
    makeBinaryWrapper
@ -74,6 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals stdenv.isLinux [
    dbus
    dconf
+    ddcutil
    glib
    libglvnd
    libpulseaudio
@ -105,6 +98,7 @@ stdenv.mkDerivation (finalAttrs: {

  cmakeFlags = [
    "-DCMAKE_INSTALL_SYSCONFDIR=${placeholder "out"}/etc"
+    "-DENABLE_SYSTEM_YYJSON=YES"
  ];

  postInstall = ''
@ -127,7 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Like neofetch, but much faster because written in C";
    homepage = "https://github.com/fastfetch-cli/fastfetch";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ gerg-l khaneliman ];
+    maintainers = with lib.maintainers; [ gerg-l khaneliman federicoschonborn ];
    platforms = lib.platforms.all;
    mainProgram = "fastfetch";
  };
--- a/pkgs/tools/misc/yubikey-manager/default.nix
+++ b/pkgs/tools/misc/yubikey-manager/default.nix
@ -8,14 +8,14 @@

 python3Packages.buildPythonPackage rec {
  pname = "yubikey-manager";
-  version = "5.1.1";
+  version = "5.2.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "Yubico";
    repo = "yubikey-manager";
    rev = version;
-    hash = "sha256-rF1oOhlZP1EKiqErJ4L/otkoEvW0iA2P4g5MWCKrCO4=";
+    hash = "sha256-33Y2adUuGIDi5gdenkwZJKKKk2NtcHwLzxy1NXhBa9M=";
  };

  postPatch = ''
--- a/pkgs/tools/security/govulncheck/default.nix
+++ b/pkgs/tools/security/govulncheck/default.nix
@ -1,24 +1,32 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:

 buildGoModule rec {
  pname = "govulncheck";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "golang";
    repo = "vuln";
-    rev = "v${version}";
-    sha256 = "sha256-cewQ03dK/k3mXevE09M01Yox/3ZWP6IrG0H4QsZMzy8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-cewQ03dK/k3mXevE09M01Yox/3ZWP6IrG0H4QsZMzy8=";
  };

-  vendorSha256 = "sha256-r9XshbgVA5rppJF46SFYPad344ZHMLWTHTnL6vbIFH8=";
+  vendorHash = "sha256-r9XshbgVA5rppJF46SFYPad344ZHMLWTHTnL6vbIFH8=";

-  subPackages = [ "cmd/govulncheck" ];
+  subPackages = [
+    "cmd/govulncheck"
+  ];

  # Vendoring breaks tests
  doCheck = false;

-  ldflags = [ "-s" "-w" ];
+  ldflags = [
+    "-s"
+    "-w"
+  ];

  meta = with lib; {
    homepage = "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck";
--- a/pkgs/tools/text/write-good/default.nix
+++ b/pkgs/tools/text/write-good/default.nix
@ -0,0 +1,28 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "write-good";
+  version = "1.0.8";
+
+  src = fetchFromGitHub {
+    owner = "btford";
+    repo = "write-good";
+    rev = "v${version}";
+    hash = "sha256-cq3cj2BwoQMKqo3iU2l+PR/2bJIFMSTRsDGQJ06GWXk=";
+  };
+
+  npmDepsHash = "sha256-0M9RzyeINmUPYcLy654iI+/ehElKrhIAibpiSqlXD2A=";
+
+  dontNpmBuild = true;
+
+  meta = {
+    description = "Naive linter for English prose";
+    homepage = "https://github.com/btford/write-good";
+    license = lib.licenses.mit;
+    mainProgram = "write-good";
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1823,6 +1823,7 @@ mapAliases ({
  ### W ###

  wavesurfer = throw "wavesurfer has been removed: depended on snack which has been removed"; # Added 2022-04-21
+  waybar-hyprland = throw "waybar-hyprland has been removed: hyprland support is now built into waybar by default."; # Added 2023-08-21
  way-cooler = throw "way-cooler is abandoned by its author: https://way-cooler.org/blog/2020/01/09/way-cooler-post-mortem.html"; # Added 2020-01-13
  wayfireApplications-unwrapped = throw ''
    'wayfireApplications-unwrapped.wayfire' has been renamed to/replaced by 'wayfire'
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -2458,6 +2458,8 @@ with pkgs;

  transcrypt = callPackage ../applications/version-management/transcrypt { };

+  ungit = callPackage ../applications/version-management/ungit { };
+
  inherit (haskellPackages) git-annex;

  inherit (haskellPackages) git-brunch;
@ -4773,6 +4775,8 @@ with pkgs;

  cambalache = callPackage ../development/tools/cambalache { };

+  cambrinary = python3Packages.callPackage ../applications/misc/cambrinary { };
+
  changedetection-io = callPackage ../servers/web-apps/changedetection-io { };

  clini = callPackage ../tools/misc/clini { };
@ -14452,6 +14456,8 @@ with pkgs;

  wpscan = callPackage ../tools/security/wpscan { };

+  write-good = callPackage ../tools/text/write-good { };
+
  wsmancli = callPackage ../tools/system/wsmancli { };

  wstunnel = haskell.lib.compose.justStaticExecutables haskellPackages.wstunnel;
@ -17255,6 +17261,8 @@ with pkgs;
  opensycl = darwin.apple_sdk_11_0.callPackage ../development/compilers/opensycl { };
  opensyclWithRocm = opensycl.override { rocmSupport = true; };

+  pest-ide-tools = callPackage ../development/tools/misc/pest-ide-tools { };
+
  ravedude = callPackage ../development/tools/rust/ravedude { };

  ra-multiplex = callPackage ../development/tools/rust/ra-multiplex {};
@ -20377,6 +20385,8 @@ with pkgs;

  watson-ruby = callPackage ../development/tools/misc/watson-ruby { };

+  web-ext = callPackage ../development/tools/web-ext { };
+
  webdis = callPackage ../development/tools/database/webdis { };

  xmake = callPackage ../development/tools/build-managers/xmake {
@ -20432,6 +20442,8 @@ with pkgs;
    python = python3;
  };

+  yo = callPackage ../development/tools/yo { };
+
  yodl = callPackage ../development/tools/misc/yodl { };

  yq = python3.pkgs.toPythonApplication python3.pkgs.yq;
@ -32667,10 +32679,6 @@ with pkgs;

  waybar = callPackage ../applications/misc/waybar { };

-  waybar-hyprland = callPackage ../applications/misc/waybar {
-    hyprlandSupport = true;
-  };
-
  waycorner = callPackage ../applications/misc/waycorner { };

  waylock = callPackage ../applications/misc/waylock { };