Merge remote-tracking branch 'origin/staging-next' into staging

Conflicts: - pkgs/development/compilers/llvm/10/clang/default.nix - pkgs/development/compilers/llvm/8/clang/default.nix
2025-02-20 11:05:14 +00:00 · 2024-02-01 12:24:57 +01:00 · 2024-02-01 12:24:57 +01:00 · 27fa02d0f1
commit 27fa02d0f1
parent a7e73864b4 2c582510db
472 changed files with 5031 additions and 8422 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -325,6 +325,9 @@ pkgs/applications/version-management/forgejo @bendlas @emilylange
 /pkgs/build-support/node/fetch-npm-deps         @lilyinstarlight @winterqt
 /doc/languages-frameworks/javascript.section.md @lilyinstarlight @winterqt

+# environment.noXlibs option aka NoX
+/nixos/modules/config/no-x-libs.nix  @SuperSandro2000
+
 # OCaml
 /pkgs/build-support/ocaml           @ulrikstrid
 /pkgs/development/compilers/ocaml   @ulrikstrid
--- a/doc/hooks/python.section.md
+++ b/doc/hooks/python.section.md
@ -1,3 +1,3 @@
 # Python {#setup-hook-python}

-Adds the `lib/${python.libPrefix}/site-packages` subdirectory of each build input to the `PYTHONPATH` environment variable.
+Adds the `python.sitePackages` subdirectory (i.e. `lib/pythonX.Y/site-packages`) of each build input to the `PYTHONPATH` environment variable.
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@ -1229,10 +1229,12 @@ in
  in

  {
-    haskell = lib.recursiveUpdate prev.haskell {
-      compiler.${ghcName} = prev.haskell.compiler.${ghcName}.override {
-        # Unfortunately, the GHC setting is named differently for historical reasons
-        enableProfiledLibs = enableProfiling;
+    haskell = prev.haskell // {
+      compiler = prev.haskell.compiler // {
+        ${ghcName} = prev.haskell.compiler.${ghcName}.override {
+          # Unfortunately, the GHC setting is named differently for historical reasons
+          enableProfiledLibs = enableProfiling;
+        };
      };
    };
  })
@ -1244,31 +1246,33 @@ in
  in

  {
-    haskell = lib.recursiveUpdate prev.haskell {
-      packages.${ghcName} = prev.haskell.packages.${ghcName}.override {
-        overrides = hfinal: hprev: {
-          mkDerivation = args: hprev.mkDerivation (args // {
-            # Since we are forcing our ideas upon mkDerivation, this change will
-            # affect every package in the package set.
-            enableLibraryProfiling = enableProfiling;
+    haskell = prev.haskell // {
+      packages = prev.haskell.packages // {
+        ${ghcName} = prev.haskell.packages.${ghcName}.override {
+          overrides = hfinal: hprev: {
+            mkDerivation = args: hprev.mkDerivation (args // {
+              # Since we are forcing our ideas upon mkDerivation, this change will
+              # affect every package in the package set.
+              enableLibraryProfiling = enableProfiling;

-            # To actually use profiling on an executable, executable profiling
-            # needs to be enabled for the executable you want to profile. You
-            # can either do this globally or…
-            enableExecutableProfiling = enableProfiling;
-          });
+              # To actually use profiling on an executable, executable profiling
+              # needs to be enabled for the executable you want to profile. You
+              # can either do this globally or…
+              enableExecutableProfiling = enableProfiling;
+            });

-          # …only for the package that contains an executable you want to profile.
-          # That saves on unnecessary rebuilds for packages that you only depend
-          # on for their library, but also contain executables (e.g. pandoc).
-          my-executable = haskellLib.enableExecutableProfiling hprev.my-executable;
+            # …only for the package that contains an executable you want to profile.
+            # That saves on unnecessary rebuilds for packages that you only depend
+            # on for their library, but also contain executables (e.g. pandoc).
+            my-executable = haskellLib.enableExecutableProfiling hprev.my-executable;

-          # If you are disabling profiling to save on build time, but want to
-          # retain the ability to substitute from the binary cache. Drop the
-          # override for mkDerivation above and instead have an override like
-          # this for the specific packages you are building locally and want
-          # to make cheaper to build.
-          my-library = haskellLib.disableLibraryProfiling hprev.my-library;
+            # If you are disabling profiling to save on build time, but want to
+            # retain the ability to substitute from the binary cache. Drop the
+            # override for mkDerivation above and instead have an override like
+            # this for the specific packages you are building locally and want
+            # to make cheaper to build.
+            my-library = haskellLib.disableLibraryProfiling hprev.my-library;
+          };
        };
      };
    };
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@ -101,6 +101,7 @@ checkConfigError 'It seems as if you.re trying to declare an option by placing i
 checkConfigError 'It seems as if you.re trying to declare an option by placing it into .config. rather than .options.' config.nest.wrong2 ./error-mkOption-in-config.nix
 checkConfigError 'The option .sub.wrong2. does not exist. Definition values:' config.sub ./error-mkOption-in-submodule-config.nix
 checkConfigError '.*This can happen if you e.g. declared your options in .types.submodule.' config.sub ./error-mkOption-in-submodule-config.nix
+checkConfigError '.*A definition for option .bad. is not of type .non-empty .list of .submodule...\.' config.bad ./error-nonEmptyListOf-submodule.nix

 # types.pathInStore
 checkConfigOutput '".*/store/0lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv"' config.pathInStore.ok1 ./types.nix
--- a/lib/tests/modules/error-nonEmptyListOf-submodule.nix
+++ b/lib/tests/modules/error-nonEmptyListOf-submodule.nix
@ -0,0 +1,7 @@
+{ lib, ... }:
+{
+  options.bad = lib.mkOption {
+    type = lib.types.nonEmptyListOf (lib.types.submodule { });
+    default = [ ];
+  };
+}
--- a/lib/types.nix
+++ b/lib/types.nix
@ -557,6 +557,7 @@ rec {
      in list // {
        description = "non-empty ${optionDescriptionPhrase (class: class == "noun") list}";
        emptyValue = { }; # no .value attr, meaning unset
+        substSubModules = m: nonEmptyListOf (elemType.substSubModules m);
      };

    attrsOf = elemType: mkOptionType rec {
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -60,6 +60,12 @@
    See `./scripts/check-maintainer-github-handles.sh` for an example on how to work with this data.
 */
 {
+  _0b11stan = {
+    name = "Tristan Auvinet Pinaudeau";
+    email = "tristan@tic.sh";
+    github = "0b11stan";
+    githubId = 27831931;
+  };
  _0qq = {
    email = "0qqw0qqw@gmail.com";
    github = "0qq";
@ -3347,6 +3353,13 @@
    githubId = 4526429;
    name = "Philipp Dargel";
  };
+  chito = {
+    email = "iamchito@protonmail.com";
+    github = "chitochi";
+    githubId = 153365419;
+    matrix = "@chito:nichijou.dev";
+    name = "Chito";
+  };
  chivay = {
    email = "hubert.jasudowicz@gmail.com";
    github = "chivay";
@ -10094,6 +10107,12 @@
    githubId = 264372;
    name = "Jan van den Berg";
  };
+  koppor = {
+    email = "kopp.dev@gmail.com";
+    github = "koppor";
+    githubId = 1366654;
+    name = "Oliver Kopp";
+  };
  koral = {
    email = "koral@mailoo.org";
    github = "k0ral";
@ -13121,6 +13140,12 @@
    githubId = 1222539;
    name = "Roman Naumann";
  };
+  nanotwerp = {
+    email = "nanotwerp@gmail.com";
+    github = "nanotwerp";
+    githubId = 17240342;
+    name = "Nano Twerpus";
+  };
  naphta = {
    github = "naphta";
    githubId = 6709831;
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -46,12 +46,16 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [Guix](https://guix.gnu.org), a functional package manager inspired by Nix. Available as [services.guix](#opt-services.guix.enable).

+- [pyLoad](https://pyload.net/), a FOSS download manager written in Python. Available as [services.pyload](#opt-services.pyload.enable)
+
 - [maubot](https://github.com/maubot/maubot), a plugin-based Matrix bot framework. Available as [services.maubot](#opt-services.maubot.enable).

 - systemd's gateway, upload, and remote services, which provides ways of sending journals across the network. Enable using [services.journald.gateway](#opt-services.journald.gateway.enable), [services.journald.upload](#opt-services.journald.upload.enable), and [services.journald.remote](#opt-services.journald.remote.enable).

 - [GNS3](https://www.gns3.com/), a network software emulator. Available as [services.gns3-server](#opt-services.gns3-server.enable).

+- [pretalx](https://github.com/pretalx/pretalx), a conference planning tool. Available as [services.pretalx](#opt-services.pretalx.enable).
+
 - [rspamd-trainer](https://gitlab.com/onlime/rspamd-trainer), script triggered by a helper which reads mails from a specific mail inbox and feeds them into rspamd for spam/ham training.

 - [ollama](https://ollama.ai), server for running large language models locally.
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@ -109,6 +109,7 @@ rec {
      recurse = prefix: item:
        if item ? ${attr} then
          nameValuePair prefix item.${attr}
+        else if isDerivation item then []
        else if isAttrs item then
          map (name:
            let
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@ -37,6 +37,7 @@ with lib;
      ghostscript = super.ghostscript.override { cupsSupport = false; x11Support = false; };
      gjs = super.gjs.overrideAttrs { doCheck = false; installTests = false; }; # avoid test dependency on gtk3
      gobject-introspection = super.gobject-introspection.override { x11Support = false; };
+      gpg-tui = super.gpg-tui.override { x11Support = false; };
      gpsd = super.gpsd.override { guiSupport = false; };
      graphviz = super.graphviz-nox;
      gst_all_1 = super.gst_all_1 // {
--- a/nixos/modules/image/repart-image.nix
+++ b/nixos/modules/image/repart-image.nix
@ -32,6 +32,7 @@
 , split
 , seed
 , definitionsDirectory
+, sectorSize
 }:

 let
@ -94,6 +95,7 @@ runCommand imageFileBasename
    --definitions="$amendedRepartDefinitions" \
    --split="${lib.boolToString split}" \
    --json=pretty \
+    ${lib.optionalString (sectorSize != null) "--sector-size=${toString sectorSize}"} \
    ${imageFileBasename}.raw \
    | tee repart-output.json

--- a/nixos/modules/image/repart.nix
+++ b/nixos/modules/image/repart.nix
@ -135,6 +135,16 @@ in
      '';
    };

+    sectorSize = lib.mkOption {
+      type = with lib.types; nullOr int;
+      default = 512;
+      example = lib.literalExpression "4096";
+      description = lib.mdDoc ''
+        The sector size of the disk image produced by systemd-repart. This
+        value must be a power of 2 between 512 and 4096.
+      '';
+    };
+
    package = lib.mkPackageOption pkgs "systemd-repart" {
      # We use buildPackages so that repart images are built with the build
      # platform's systemd, allowing for cross-compiled systems to work.
@ -232,7 +242,7 @@ in
      in
      pkgs.callPackage ./repart-image.nix {
        systemd = cfg.package;
-        inherit (cfg) imageFileBasename compression split seed;
+        inherit (cfg) imageFileBasename compression split seed sectorSize;
        inherit fileSystems definitionsDirectory partitions;
      };

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1062,6 +1062,7 @@
  ./services/networking/openvpn.nix
  ./services/networking/ostinato.nix
  ./services/networking/owamp.nix
+  ./services/networking/pyload.nix
  ./services/networking/pdns-recursor.nix
  ./services/networking/pdnsd.nix
  ./services/networking/peroxide.nix
@ -1342,6 +1343,7 @@
  ./services/web-apps/plantuml-server.nix
  ./services/web-apps/plausible.nix
  ./services/web-apps/powerdns-admin.nix
+  ./services/web-apps/pretalx.nix
  ./services/web-apps/prosody-filer.nix
  ./services/web-apps/restya-board.nix
  ./services/web-apps/rimgo.nix
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@ -867,9 +867,6 @@ let
          { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; settings = {
            no-autostart = cfg.gnupg.noAutostart;
          }; }
-          { name = "cgfs"; enable = config.virtualisation.lxc.lxcfs.enable; control = "optional"; modulePath = "${pkgs.lxc}/lib/security/pam_cgfs.so"; args = [
-            "-c" "all"
-          ]; }
        ];
      };
    };
--- a/nixos/modules/services/hardware/acpid.nix
+++ b/nixos/modules/services/hardware/acpid.nix
@ -135,7 +135,6 @@ in
      wantedBy = [ "multi-user.target" ];

      serviceConfig = {
-        PrivateNetwork = true;
        ExecStart = escapeShellArgs
          ([ "${pkgs.acpid}/bin/acpid"
             "--foreground"
--- a/nixos/modules/services/misc/packagekit.nix
+++ b/nixos/modules/services/misc/packagekit.nix
@ -13,7 +13,7 @@ let
    (iniFmt.generate "PackageKit.conf" (recursiveUpdate
      {
        Daemon = {
-          DefaultBackend = "nix";
+          DefaultBackend = "test_nop";
          KeepCache = false;
        };
      }
@ -35,7 +35,7 @@ let
 in
 {
  imports = [
-    (mkRemovedOptionModule [ "services" "packagekit" "backend" ] "Always set to Nix.")
+    (mkRemovedOptionModule [ "services" "packagekit" "backend" ] "Always set to test_nop, Nix backend is broken see #177946.")
  ];

  options.services.packagekit = {
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@ -141,12 +141,12 @@ in
        `''${dataDir}/paperless-manage createsuperuser`.

        The default superuser name is `admin`. To change it, set
-        option {option}`extraConfig.PAPERLESS_ADMIN_USER`.
+        option {option}`settings.PAPERLESS_ADMIN_USER`.
        WARNING: When changing the superuser name after the initial setup, the old superuser
        will continue to exist.

        To disable login for the web interface, set the following:
-        `extraConfig.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";`.
+        `settings.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";`.
        WARNING: Only use this on a trusted system without internet access to Paperless.
      '';
    };
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -60,7 +60,6 @@ let
    "node"
    "nut"
    "openldap"
-    "openvpn"
    "pgbouncer"
    "php-fpm"
    "pihole"
--- a/nixos/modules/services/monitoring/prometheus/exporters/openvpn.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/openvpn.nix
@ -1,39 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-let
-  cfg = config.services.prometheus.exporters.openvpn;
-in {
-  port = 9176;
-  extraOpts = {
-    statusPaths = mkOption {
-      type = types.listOf types.str;
-      description = lib.mdDoc ''
-        Paths to OpenVPN status files. Please configure the OpenVPN option
-        `status` accordingly.
-      '';
-    };
-    telemetryPath = mkOption {
-      type = types.str;
-      default = "/metrics";
-      description = lib.mdDoc ''
-        Path under which to expose metrics.
-      '';
-    };
-  };
-
-  serviceOpts = {
-    serviceConfig = {
-      PrivateDevices = true;
-      ProtectKernelModules = true;
-      NoNewPrivileges = true;
-      ExecStart = ''
-        ${pkgs.prometheus-openvpn-exporter}/bin/openvpn_exporter \
-          -openvpn.status_paths "${concatStringsSep "," cfg.statusPaths}" \
-          -web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
-          -web.telemetry-path ${cfg.telemetryPath}
-      '';
-    };
-  };
-}
--- a/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
@ -3,6 +3,7 @@
 with lib;

 let
+  logPrefix = "services.prometheus.exporters.snmp";
  cfg = config.services.prometheus.exporters.snmp;

  # This ensures that we can deal with string paths, path types and
--- a/nixos/modules/services/networking/pyload.nix
+++ b/nixos/modules/services/networking/pyload.nix
@ -0,0 +1,147 @@
+{ config, lib, pkgs, utils, ... }:
+let
+  cfg = config.services.pyload;
+
+  stateDir = "/var/lib/pyload";
+in
+{
+  meta.maintainers = with lib.maintainers; [ ambroisie ];
+
+  options = with lib; {
+    services.pyload = {
+      enable = mkEnableOption "pyLoad download manager";
+
+      package = mkPackageOption pkgs "pyLoad" { default = [ "pyload-ng" ]; };
+
+      listenAddress = mkOption {
+        type = types.str;
+        default = "localhost";
+        example = "0.0.0.0";
+        description = "Address to listen on for the web UI.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 8000;
+        example = 9876;
+        description = "Port to listen on for the web UI.";
+      };
+
+      downloadDirectory = mkOption {
+        type = types.path;
+        default = "${stateDir}/downloads";
+        example = "/mnt/downloads";
+        description = "Directory to store downloads.";
+      };
+
+      credentialsFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/run/secrets/pyload-credentials.env";
+        description = ''
+          File containing {env}`PYLOAD_DEFAULT_USERNAME` and
+          {env}`PYLOAD_DEFAULT_PASSWORD` in the format of an `EnvironmentFile=`,
+          as described by {manpage}`systemd.exec(5)`.
+
+          If not given, they default to the username/password combo of
+          pyload/pyload.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.tmpfiles.settings.pyload = {
+      ${cfg.downloadDirectory}.d = { };
+    };
+
+    systemd.services.pyload = {
+      description = "pyLoad download manager";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      # NOTE: unlike what the documentation says, it looks like `HOME` is not
+      # defined with this service definition...
+      # Since pyload tries to do the equivalent of `cd ~`, it needs to be able
+      # to resolve $HOME, which fails when `RootDirectory` is set.
+      # FIXME: check if `SetLoginEnvironment` fixes this issue in version 255
+      environment = {
+        HOME = stateDir;
+        PYLOAD__WEBUI__HOST = cfg.listenAddress;
+        PYLOAD__WEBUI__PORT = builtins.toString cfg.port;
+      };
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs [
+          (lib.getExe cfg.package)
+          "--userdir"
+          "${stateDir}/config"
+          "--storagedir"
+          cfg.downloadDirectory
+        ];
+
+        User = "pyload";
+        Group = "pyload";
+        DynamicUser = true;
+
+        EnvironmentFile = lib.optional (cfg.credentialsFile != null) cfg.credentialsFile;
+
+        StateDirectory = "pyload";
+        WorkingDirectory = stateDir;
+        RuntimeDirectory = "pyload";
+        RuntimeDirectoryMode = "0700";
+        RootDirectory = "/run/pyload";
+        BindReadOnlyPaths = [
+          builtins.storeDir # Needed to run the python interpreter
+        ];
+        BindPaths = [
+          cfg.downloadDirectory
+        ];
+
+        # Hardening options
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
+        UMask = "0002";
+        CapabilityBoundingSet = [
+          "~CAP_BLOCK_SUSPEND"
+          "~CAP_BPF"
+          "~CAP_CHOWN"
+          "~CAP_IPC_LOCK"
+          "~CAP_KILL"
+          "~CAP_LEASE"
+          "~CAP_LINUX_IMMUTABLE"
+          "~CAP_NET_ADMIN"
+          "~CAP_SYS_ADMIN"
+          "~CAP_SYS_BOOT"
+          "~CAP_SYS_CHROOT"
+          "~CAP_SYS_NICE"
+          "~CAP_SYS_PACCT"
+          "~CAP_SYS_PTRACE"
+          "~CAP_SYS_RESOURCE"
+          "~CAP_SYS_TTY_CONFIG"
+        ];
+      };
+    };
+  };
+}
--- a/nixos/modules/services/networking/seafile.nix
+++ b/nixos/modules/services/networking/seafile.nix
@ -32,7 +32,8 @@ let
  dataDir = "${seafRoot}/data";
  seahubDir = "${seafRoot}/seahub";

-in {
+in
+{

  ###### Interface

@ -147,146 +148,151 @@ in {
      description = "Seafile components";
    };

-    systemd.services = let
-      securityOptions = {
-        ProtectHome = true;
-        PrivateUsers = true;
-        PrivateDevices = true;
-        ProtectClock = true;
-        ProtectHostname = true;
-        ProtectProc = "invisible";
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectKernelLogs = true;
-        ProtectControlGroups = true;
-        RestrictNamespaces = true;
-        LockPersonality = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        MemoryDenyWriteExecute = true;
-        SystemCallArchitectures = "native";
-        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" ];
-      };
-    in {
-      seaf-server = {
-        description = "Seafile server";
-        partOf = [ "seafile.target" ];
-        after = [ "network.target" ];
-        wantedBy = [ "seafile.target" ];
-        restartTriggers = [ ccnetConf seafileConf ];
-        path = [ pkgs.sqlite ];
-        serviceConfig = securityOptions // {
-          User = "seafile";
-          Group = "seafile";
-          DynamicUser = true;
-          StateDirectory = "seafile";
-          RuntimeDirectory = "seafile";
-          LogsDirectory = "seafile";
-          ConfigurationDirectory = "seafile";
-          ExecStart = ''
-            ${cfg.seafilePackage}/bin/seaf-server \
-            --foreground \
-            -F /etc/seafile \
-            -c ${ccnetDir} \
-            -d ${dataDir} \
-            -l /var/log/seafile/server.log \
-            -P /run/seafile/server.pid \
-            -p /run/seafile
+    systemd.services =
+      let
+        securityOptions = {
+          ProtectHome = true;
+          PrivateUsers = true;
+          PrivateDevices = true;
+          ProtectClock = true;
+          ProtectHostname = true;
+          ProtectProc = "invisible";
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          RestrictNamespaces = true;
+          LockPersonality = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          MemoryDenyWriteExecute = true;
+          SystemCallArchitectures = "native";
+          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" ];
+        };
+      in
+      {
+        seaf-server = {
+          description = "Seafile server";
+          partOf = [ "seafile.target" ];
+          after = [ "network.target" ];
+          wantedBy = [ "seafile.target" ];
+          restartTriggers = [ ccnetConf seafileConf ];
+          path = [ pkgs.sqlite ];
+          serviceConfig = securityOptions // {
+            User = "seafile";
+            Group = "seafile";
+            DynamicUser = true;
+            StateDirectory = "seafile";
+            RuntimeDirectory = "seafile";
+            LogsDirectory = "seafile";
+            ConfigurationDirectory = "seafile";
+            ExecStart = ''
+              ${cfg.seafilePackage}/bin/seaf-server \
+              --foreground \
+              -F /etc/seafile \
+              -c ${ccnetDir} \
+              -d ${dataDir} \
+              -l /var/log/seafile/server.log \
+              -P /run/seafile/server.pid \
+              -p /run/seafile
+            '';
+          };
+          preStart = ''
+            if [ ! -f "${seafRoot}/server-setup" ]; then
+                mkdir -p ${dataDir}/library-template
+                mkdir -p ${ccnetDir}/{GroupMgr,misc,OrgMgr,PeerMgr}
+                sqlite3 ${ccnetDir}/GroupMgr/groupmgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/groupmgr.sql"
+                sqlite3 ${ccnetDir}/misc/config.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/config.sql"
+                sqlite3 ${ccnetDir}/OrgMgr/orgmgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/org.sql"
+                sqlite3 ${ccnetDir}/PeerMgr/usermgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/user.sql"
+                sqlite3 ${dataDir}/seafile.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/seafile.sql"
+                echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
+            fi
+            # checking for upgrades and handling them
+            installedMajor=$(cat "${seafRoot}/server-setup" | cut -d"-" -f1 | cut -d"." -f1)
+            installedMinor=$(cat "${seafRoot}/server-setup" | cut -d"-" -f1 | cut -d"." -f2)
+            pkgMajor=$(echo "${cfg.seafilePackage.version}" | cut -d"." -f1)
+            pkgMinor=$(echo "${cfg.seafilePackage.version}" | cut -d"." -f2)
+
+            if [[ $installedMajor == $pkgMajor && $installedMinor == $pkgMinor ]]; then
+               :
+            elif [[ $installedMajor == 8 && $installedMinor == 0 && $pkgMajor == 9 && $pkgMinor == 0 ]]; then
+                # Upgrade from 8.0 to 9.0
+                sqlite3 ${dataDir}/seafile.db ".read ${pkgs.seahub}/scripts/upgrade/sql/9.0.0/sqlite3/seafile.sql"
+                echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
+            elif [[ $installedMajor == 9 && $installedMinor == 0 && $pkgMajor == 10 && $pkgMinor == 0 ]]; then
+                # Upgrade from 9.0 to 10.0
+                sqlite3 ${dataDir}/seafile.db ".read ${pkgs.seahub}/scripts/upgrade/sql/10.0.0/sqlite3/seafile.sql"
+                echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
+            else
+                echo "Unsupported upgrade" >&2
+                exit 1
+            fi
          '';
        };
-        preStart = ''
-          if [ ! -f "${seafRoot}/server-setup" ]; then
-              mkdir -p ${dataDir}/library-template
-              mkdir -p ${ccnetDir}/{GroupMgr,misc,OrgMgr,PeerMgr}
-              sqlite3 ${ccnetDir}/GroupMgr/groupmgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/groupmgr.sql"
-              sqlite3 ${ccnetDir}/misc/config.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/config.sql"
-              sqlite3 ${ccnetDir}/OrgMgr/orgmgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/org.sql"
-              sqlite3 ${ccnetDir}/PeerMgr/usermgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/user.sql"
-              sqlite3 ${dataDir}/seafile.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/seafile.sql"
-              echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
-          fi
-          # checking for upgrades and handling them
-          # WARNING: needs to be extended to actually handle major version migrations
-          installedMajor=$(cat "${seafRoot}/server-setup" | cut -d"-" -f1 | cut -d"." -f1)
-          installedMinor=$(cat "${seafRoot}/server-setup" | cut -d"-" -f1 | cut -d"." -f2)
-          pkgMajor=$(echo "${cfg.seafilePackage.version}" | cut -d"." -f1)
-          pkgMinor=$(echo "${cfg.seafilePackage.version}" | cut -d"." -f2)

-          if [[ $installedMajor == $pkgMajor && $installedMinor == $pkgMinor ]]; then
-             :
-          elif [[ $installedMajor == 8 && $installedMinor == 0 && $pkgMajor == 9 && $pkgMinor == 0 ]]; then
-              # Upgrade from 8.0 to 9.0
-              sqlite3 ${dataDir}/seafile.db ".read ${pkgs.seahub}/scripts/upgrade/sql/9.0.0/sqlite3/seafile.sql"
-              echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
-          else
-              echo "Unsupported upgrade" >&2
-              exit 1
-          fi
-        '';
-      };
-
-      seahub = {
-        description = "Seafile Server Web Frontend";
-        wantedBy = [ "seafile.target" ];
-        partOf = [ "seafile.target" ];
-        after = [ "network.target" "seaf-server.service" ];
-        requires = [ "seaf-server.service" ];
-        restartTriggers = [ seahubSettings ];
-        environment = {
-          PYTHONPATH = "${pkgs.seahub.pythonPath}:${pkgs.seahub}/thirdpart:${pkgs.seahub}";
-          DJANGO_SETTINGS_MODULE = "seahub.settings";
-          CCNET_CONF_DIR = ccnetDir;
-          SEAFILE_CONF_DIR = dataDir;
-          SEAFILE_CENTRAL_CONF_DIR = "/etc/seafile";
-          SEAFILE_RPC_PIPE_PATH = "/run/seafile";
-          SEAHUB_LOG_DIR = "/var/log/seafile";
-        };
-        serviceConfig = securityOptions // {
-          User = "seafile";
-          Group = "seafile";
-          DynamicUser = true;
-          RuntimeDirectory = "seahub";
-          StateDirectory = "seafile";
-          LogsDirectory = "seafile";
-          ConfigurationDirectory = "seafile";
-          ExecStart = ''
-            ${pkgs.seahub.python.pkgs.gunicorn}/bin/gunicorn seahub.wsgi:application \
-            --name seahub \
-            --workers ${toString cfg.workers} \
-            --log-level=info \
-            --preload \
-            --timeout=1200 \
-            --limit-request-line=8190 \
-            --bind unix:/run/seahub/gunicorn.sock
+        seahub = {
+          description = "Seafile Server Web Frontend";
+          wantedBy = [ "seafile.target" ];
+          partOf = [ "seafile.target" ];
+          after = [ "network.target" "seaf-server.service" ];
+          requires = [ "seaf-server.service" ];
+          restartTriggers = [ seahubSettings ];
+          environment = {
+            PYTHONPATH = "${pkgs.seahub.pythonPath}:${pkgs.seahub}/thirdpart:${pkgs.seahub}";
+            DJANGO_SETTINGS_MODULE = "seahub.settings";
+            CCNET_CONF_DIR = ccnetDir;
+            SEAFILE_CONF_DIR = dataDir;
+            SEAFILE_CENTRAL_CONF_DIR = "/etc/seafile";
+            SEAFILE_RPC_PIPE_PATH = "/run/seafile";
+            SEAHUB_LOG_DIR = "/var/log/seafile";
+          };
+          serviceConfig = securityOptions // {
+            User = "seafile";
+            Group = "seafile";
+            DynamicUser = true;
+            RuntimeDirectory = "seahub";
+            StateDirectory = "seafile";
+            LogsDirectory = "seafile";
+            ConfigurationDirectory = "seafile";
+            ExecStart = ''
+              ${pkgs.seahub.python.pkgs.gunicorn}/bin/gunicorn seahub.wsgi:application \
+              --name seahub \
+              --workers ${toString cfg.workers} \
+              --log-level=info \
+              --preload \
+              --timeout=1200 \
+              --limit-request-line=8190 \
+              --bind unix:/run/seahub/gunicorn.sock
+            '';
+          };
+          preStart = ''
+            mkdir -p ${seahubDir}/media
+            # Link all media except avatars
+            for m in `find ${pkgs.seahub}/media/ -maxdepth 1 -not -name "avatars"`; do
+              ln -sf $m ${seahubDir}/media/
+            done
+            if [ ! -e "${seafRoot}/.seahubSecret" ]; then
+                ${pkgs.seahub.python}/bin/python ${pkgs.seahub}/tools/secret_key_generator.py > ${seafRoot}/.seahubSecret
+                chmod 400 ${seafRoot}/.seahubSecret
+            fi
+            if [ ! -f "${seafRoot}/seahub-setup" ]; then
+                # avatars directory should be writable
+                install -D -t ${seahubDir}/media/avatars/ ${pkgs.seahub}/media/avatars/default.png
+                install -D -t ${seahubDir}/media/avatars/groups ${pkgs.seahub}/media/avatars/groups/default.png
+                # init database
+                ${pkgs.seahub}/manage.py migrate
+                # create admin account
+                ${pkgs.expect}/bin/expect -c 'spawn ${pkgs.seahub}/manage.py createsuperuser --email=${cfg.adminEmail}; expect "Password: "; send "${cfg.initialAdminPassword}\r"; expect "Password (again): "; send "${cfg.initialAdminPassword}\r"; expect "Superuser created successfully."'
+                echo "${pkgs.seahub.version}-sqlite" > "${seafRoot}/seahub-setup"
+            fi
+            if [ $(cat "${seafRoot}/seahub-setup" | cut -d"-" -f1) != "${pkgs.seahub.version}" ]; then
+                # update database
+                ${pkgs.seahub}/manage.py migrate
+                echo "${pkgs.seahub.version}-sqlite" > "${seafRoot}/seahub-setup"
+            fi
          '';
        };
-        preStart = ''
-          mkdir -p ${seahubDir}/media
-          # Link all media except avatars
-          for m in `find ${pkgs.seahub}/media/ -maxdepth 1 -not -name "avatars"`; do
-            ln -sf $m ${seahubDir}/media/
-          done
-          if [ ! -e "${seafRoot}/.seahubSecret" ]; then
-              ${pkgs.seahub.python}/bin/python ${pkgs.seahub}/tools/secret_key_generator.py > ${seafRoot}/.seahubSecret
-              chmod 400 ${seafRoot}/.seahubSecret
-          fi
-          if [ ! -f "${seafRoot}/seahub-setup" ]; then
-              # avatars directory should be writable
-              install -D -t ${seahubDir}/media/avatars/ ${pkgs.seahub}/media/avatars/default.png
-              install -D -t ${seahubDir}/media/avatars/groups ${pkgs.seahub}/media/avatars/groups/default.png
-              # init database
-              ${pkgs.seahub}/manage.py migrate
-              # create admin account
-              ${pkgs.expect}/bin/expect -c 'spawn ${pkgs.seahub}/manage.py createsuperuser --email=${cfg.adminEmail}; expect "Password: "; send "${cfg.initialAdminPassword}\r"; expect "Password (again): "; send "${cfg.initialAdminPassword}\r"; expect "Superuser created successfully."'
-              echo "${pkgs.seahub.version}-sqlite" > "${seafRoot}/seahub-setup"
-          fi
-          if [ $(cat "${seafRoot}/seahub-setup" | cut -d"-" -f1) != "${pkgs.seahub.version}" ]; then
-              # update database
-              ${pkgs.seahub}/manage.py migrate
-              echo "${pkgs.seahub.version}-sqlite" > "${seafRoot}/seahub-setup"
-          fi
-        '';
      };
-    };
  };
 }
--- a/nixos/modules/services/networking/strongswan-swanctl/module.nix
+++ b/nixos/modules/services/networking/strongswan-swanctl/module.nix
@ -5,6 +5,9 @@ with (import ./param-lib.nix lib);

 let
  cfg = config.services.strongswan-swanctl;
+  configFile = pkgs.writeText "swanctl.conf"
+      ( (paramsToConf cfg.swanctl swanctlParams)
+      + (concatMapStrings (i: "\ninclude ${i}") cfg.includes));
  swanctlParams = import ./swanctl-params.nix lib;
 in  {
  options.services.strongswan-swanctl = {
@ -21,6 +24,13 @@ in  {
    };

    swanctl = paramsToOptions swanctlParams;
+    includes = mkOption {
+      type = types.listOf types.path;
+      default = [];
+      description = ''
+        Extra configuration files to include in the swanctl configuration. This can be used to provide secret values from outside the nix store.
+      '';
+    };
  };

  config = mkIf cfg.enable {
@ -31,8 +41,7 @@ in  {
      }
    ];

-    environment.etc."swanctl/swanctl.conf".text =
-      paramsToConf cfg.swanctl swanctlParams;
+    environment.etc."swanctl/swanctl.conf".source = configFile;

    # The swanctl command complains when the following directories don't exist:
    # See: https://wiki.strongswan.org/projects/strongswan/wiki/Swanctldirectory
--- a/nixos/modules/services/web-apps/photoprism.nix
+++ b/nixos/modules/services/web-apps/photoprism.nix
@ -18,6 +18,9 @@ let
    in
    pkgs.writeShellScript "manage" ''
      ${setupEnv}
+      eval "$(${config.systemd.package}/bin/systemctl show -pUID,MainPID photoprism.service | ${pkgs.gnused}/bin/sed "s/UID/ServiceUID/")"
+      exec ${pkgs.util-linux}/bin/nsenter \
+        -t $MainPID -m -S $ServiceUID -G $ServiceUID --wdns=${cfg.storagePath} \
      exec ${cfg.package}/bin/photoprism "$@"
    '';
 in
--- a/nixos/modules/services/web-apps/pretalx.nix
+++ b/nixos/modules/services/web-apps/pretalx.nix
@ -0,0 +1,415 @@
+{ config
+, lib
+, pkgs
+, utils
+, ...
+}:
+
+let
+  cfg = config.services.pretalx;
+  format = pkgs.formats.ini { };
+
+  configFile = format.generate "pretalx.cfg" cfg.settings;
+
+  extras = cfg.package.optional-dependencies.redis
+    ++ lib.optionals (cfg.settings.database.backend == "mysql") cfg.package.optional-dependencies.mysql
+    ++ lib.optionals (cfg.settings.database.backend == "postgresql") cfg.package.optional-dependencies.postgres;
+
+  pythonEnv = cfg.package.python.buildEnv.override {
+    extraLibs = [ (cfg.package.python.pkgs.toPythonModule cfg.package) ]
+      ++ (with cfg.package.python.pkgs; [ gunicorn ]
+      ++ lib.optional cfg.celery.enable celery) ++ extras;
+  };
+in
+
+{
+  meta = with lib; {
+    maintainers = teams.c3d2.members;
+  };
+
+  options.services.pretalx = {
+    enable = lib.mkEnableOption (lib.mdDoc "pretalx");
+
+    package = lib.mkPackageOptionMD pkgs "pretalx" {};
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "pretalx";
+      description = "Group under which pretalx should run.";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "pretalx";
+      description = "User under which pretalx should run.";
+    };
+
+    gunicorn.extraArgs = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = [
+        "--name=pretalx"
+      ];
+      example = [
+        "--name=pretalx"
+        "--workers=4"
+        "--max-requests=1200"
+        "--max-requests-jitter=50"
+        "--log-level=info"
+      ];
+      description = lib.mdDoc ''
+        Extra arguments to pass to gunicorn.
+        See <https://docs.pretalx.org/administrator/installation.html#step-6-starting-pretalx-as-a-service> for details.
+      '';
+      apply = lib.escapeShellArgs;
+    };
+
+    celery = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        example = false;
+        description = lib.mdDoc ''
+          Whether to set up celery as an asynchronous task runner.
+        '';
+      };
+
+      extraArgs = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = [ ];
+        description = lib.mdDoc ''
+          Extra arguments to pass to celery.
+
+          See <https://docs.celeryq.dev/en/stable/reference/cli.html#celery-worker> for more info.
+        '';
+        apply = utils.escapeSystemdExecArgs;
+      };
+    };
+
+    nginx = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        example = false;
+        description = lib.mdDoc ''
+          Whether to set up an nginx virtual host.
+        '';
+      };
+
+      domain = lib.mkOption {
+        type = lib.types.str;
+        example = "talks.example.com";
+        description = lib.mdDoc ''
+          The domain name under which to set up the virtual host.
+        '';
+      };
+    };
+
+    database.createLocally = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      example = false;
+      description = lib.mdDoc ''
+        Whether to automatically set up the database on the local DBMS instance.
+
+        Currently only supported for PostgreSQL. Not required for sqlite.
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = format.type;
+        options = {
+          database = {
+            backend = lib.mkOption {
+              type = lib.types.enum [
+                "postgresql"
+              ];
+              default = "postgresql";
+              description = lib.mdDoc ''
+                Database backend to use.
+
+                Currently only PostgreSQL gets tested, and as such we don't support any other DBMS.
+              '';
+              readOnly = true; # only postgres supported right now
+            };
+
+            host = lib.mkOption {
+              type = with lib.types; nullOr types.path;
+              default = if cfg.settings.database.backend == "postgresql" then "/run/postgresql"
+                else if cfg.settings.database.backend == "mysql" then "/run/mysqld/mysqld.sock"
+                else null;
+              defaultText = lib.literalExpression ''
+                if config.services.pretalx.settings..database.backend == "postgresql" then "/run/postgresql"
+                else if config.services.pretalx.settings.database.backend == "mysql" then "/run/mysqld/mysqld.sock"
+                else null
+              '';
+              description = lib.mdDoc ''
+                Database host or socket path.
+              '';
+            };
+
+            name = lib.mkOption {
+              type = lib.types.str;
+              default = "pretalx";
+              description = lib.mdDoc ''
+                Database name.
+              '';
+            };
+
+            user = lib.mkOption {
+              type = lib.types.str;
+              default = "pretalx";
+              description = lib.mdDoc ''
+                Database username.
+              '';
+            };
+          };
+
+          filesystem = {
+            data = lib.mkOption {
+              type = lib.types.path;
+              default = "/var/lib/pretalx";
+              description = lib.mdDoc ''
+                Base path for all other storage paths.
+              '';
+            };
+            logs = lib.mkOption {
+              type = lib.types.path;
+              default = "/var/log/pretalx";
+              description = lib.mdDoc ''
+                Path to the log directory, that pretalx logs message to.
+              '';
+            };
+            static = lib.mkOption {
+              type = lib.types.path;
+              default = "${cfg.package.static}/";
+              defaultText = lib.literalExpression "\${config.services.pretalx.package}.static}/";
+              readOnly = true;
+              description = lib.mdDoc ''
+                Path to the directory that contains static files.
+              '';
+            };
+          };
+
+          celery = {
+            backend = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = lib.optionalString cfg.celery.enable "redis+socket://${config.services.redis.servers.pretalx.unixSocket}?virtual_host=1";
+              defaultText = lib.literalExpression ''
+                optionalString config.services.pretalx.celery.enable "redis+socket://''${config.services.redis.servers.pretalx.unixSocket}?virtual_host=1"
+              '';
+              description = lib.mdDoc ''
+                URI to the celery backend used for the asynchronous job queue.
+              '';
+            };
+
+            broker = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = lib.optionalString cfg.celery.enable "redis+socket://${config.services.redis.servers.pretalx.unixSocket}?virtual_host=2";
+              defaultText = lib.literalExpression ''
+                optionalString config.services.pretalx.celery.enable "redis+socket://''${config.services.redis.servers.pretalx.unixSocket}?virtual_host=2"
+              '';
+              description = lib.mdDoc ''
+                URI to the celery broker used for the asynchronous job queue.
+              '';
+            };
+          };
+
+          redis = {
+            location = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = "unix://${config.services.redis.servers.pretalx.unixSocket}?db=0";
+              defaultText = lib.literalExpression ''
+                "unix://''${config.services.redis.servers.pretalx.unixSocket}?db=0"
+              '';
+              description = lib.mdDoc ''
+                URI to the redis server, used to speed up locking, caching and session storage.
+              '';
+            };
+
+            session = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              example = false;
+              description = lib.mdDoc ''
+                Whether to use redis as the session storage.
+              '';
+            };
+          };
+
+          site = {
+            url = lib.mkOption {
+              type = lib.types.str;
+              default = "https://${cfg.nginx.domain}";
+              defaultText = lib.literalExpression "https://\${config.services.pretalx.nginx.domain}";
+              example = "https://talks.example.com";
+              description = lib.mdDoc ''
+                The base URI below which your pretalx instance will be reachable.
+              '';
+            };
+          };
+        };
+      };
+      default = { };
+      description = lib.mdDoc ''
+        pretalx configuration as a Nix attribute set. All settings can also be passed
+        from the environment.
+
+        See <https://docs.pretalx.org/administrator/configure.html> for possible options.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # https://docs.pretalx.org/administrator/installation.html
+
+    environment.systemPackages = [
+      (pkgs.writeScriptBin "pretalx-manage" ''
+        cd ${cfg.settings.filesystem.data}
+        sudo=exec
+        if [[ "$USER" != ${cfg.user} ]]; then
+          sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} --preserve-env=PRETALX_CONFIG_FILE'
+        fi
+        export PRETALX_CONFIG_FILE=${configFile}
+        $sudo ${lib.getExe' pythonEnv "pretalx-manage"} "$@"
+      '')
+    ];
+
+    services = {
+      nginx = lib.mkIf cfg.nginx.enable {
+        enable = true;
+        recommendedGzipSettings = lib.mkDefault true;
+        recommendedOptimisation = lib.mkDefault true;
+        recommendedProxySettings = lib.mkDefault true;
+        recommendedTlsSettings = lib.mkDefault true;
+        upstreams.pretalx.servers."unix:/run/pretalx/pretalx.sock" = { };
+        virtualHosts.${cfg.nginx.domain} = {
+          # https://docs.pretalx.org/administrator/installation.html#step-7-ssl
+          extraConfig = ''
+            more_set_headers Referrer-Policy same-origin;
+            more_set_headers X-Content-Type-Options nosniff;
+          '';
+          locations = {
+            "/".proxyPass = "http://pretalx";
+            "/media/" = {
+              alias = "${cfg.settings.filesystem.data}/data/media/";
+              extraConfig = ''
+                access_log off;
+                more_set_headers Content-Disposition 'attachment; filename="$1"';
+                expires 7d;
+              '';
+            };
+            "/static/" = {
+              alias = cfg.settings.filesystem.static;
+              extraConfig = ''
+                access_log off;
+                more_set_headers Cache-Control "public";
+                expires 365d;
+              '';
+            };
+          };
+        };
+      };
+
+      postgresql = lib.mkIf (cfg.database.createLocally && cfg.settings.database.backend == "postgresql") {
+        enable = true;
+        ensureUsers = [ {
+          name = cfg.settings.database.user;
+          ensureDBOwnership = true;
+        } ];
+        ensureDatabases = [ cfg.settings.database.name ];
+      };
+
+      redis.servers.pretalx.enable = true;
+    };
+
+    systemd.services = let
+      commonUnitConfig = {
+        environment.PRETALX_CONFIG_FILE = configFile;
+        serviceConfig = {
+          User = "pretalx";
+          Group = "pretalx";
+          StateDirectory = [ "pretalx" "pretalx/media" ];
+          LogsDirectory = "pretalx";
+          WorkingDirectory = cfg.settings.filesystem.data;
+          SupplementaryGroups = [ "redis-pretalx" ];
+        };
+      };
+    in {
+      pretalx-web = lib.recursiveUpdate commonUnitConfig {
+        description = "pretalx web service";
+        after = [
+          "network.target"
+          "redis-pretalx.service"
+        ] ++ lib.optionals (cfg.settings.database.backend == "postgresql") [
+          "postgresql.service"
+        ] ++ lib.optionals (cfg.settings.database.backend == "mysql") [
+          "mysql.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        preStart = ''
+          versionFile="${cfg.settings.filesystem.data}/.version"
+          version=$(cat "$versionFile" 2>/dev/null || echo 0)
+
+          if [[ $version != ${cfg.package.version} ]]; then
+            ${lib.getExe' pythonEnv "pretalx-manage"} migrate
+
+            echo "${cfg.package.version}" > "$versionFile"
+          fi
+        '';
+        serviceConfig = {
+          ExecStart = "${lib.getExe' pythonEnv "gunicorn"} --bind unix:/run/pretalx/pretalx.sock ${cfg.gunicorn.extraArgs} pretalx.wsgi";
+          RuntimeDirectory = "pretalx";
+        };
+      };
+
+      pretalx-periodic = lib.recursiveUpdate commonUnitConfig {
+        description = "pretalx periodic task runner";
+        # every 15 minutes
+        startAt = [ "*:3,18,33,48" ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${lib.getExe' pythonEnv "pretalx-manage"} runperiodic";
+        };
+      };
+
+      pretalx-clear-sessions = lib.recursiveUpdate commonUnitConfig {
+        description = "pretalx session pruning";
+        startAt = [ "monthly" ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${lib.getExe' pythonEnv "pretalx-manage"} clearsessions";
+        };
+      };
+
+      pretalx-worker = lib.mkIf cfg.celery.enable (lib.recursiveUpdate commonUnitConfig {
+        description = "pretalx asynchronous job runner";
+        after = [
+          "network.target"
+          "redis-pretalx.service"
+        ] ++ lib.optionals (cfg.settings.database.backend == "postgresql") [
+          "postgresql.service"
+        ] ++ lib.optionals (cfg.settings.database.backend == "mysql") [
+          "mysql.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.ExecStart = "${lib.getExe' pythonEnv "celery"} -A pretalx.celery_app worker ${cfg.celery.extraArgs}";
+      });
+    };
+
+    systemd.sockets.pretalx-web.socketConfig = {
+      ListenStream = "/run/pretalx/pretalx.sock";
+      SocketUser = "nginx";
+    };
+
+    users = {
+      groups."${cfg.group}" = {};
+      users."${cfg.user}" = {
+        isSystemUser = true;
+        createHome = true;
+        home = cfg.settings.filesystem.data;
+        inherit (cfg) group;
+      };
+    };
+  };
+}
--- a/nixos/modules/services/x11/desktop-managers/deepin.nix
+++ b/nixos/modules/services/x11/desktop-managers/deepin.nix
@ -96,18 +96,10 @@ in
        "/share/dde-daemon"
        "/share/dsg"
        "/share/deepin-themes"
+        "/share/deepin"
      ];

      environment.etc = {
-        "distribution.info".text = ''
-          [Distribution]
-          Name=NixOS
-          WebsiteName=www.nixos.org
-          Website=https://www.nixos.org
-          Logo=${pkgs.nixos-icons}/share/icons/hicolor/96x96/apps/nix-snowflake.png
-          LogoLight=${pkgs.nixos-icons}/share/icons/hicolor/32x32/apps/nix-snowflake.png
-          LogoTransparent=${pkgs.deepin.deepin-desktop-base}/share/pixmaps/distribution_logo_transparent.svg
-        '';
        "deepin-installer.conf".text = ''
          system_info_vendor_name="Copyright (c) 2003-2023 NixOS contributors"
        '';
@ -156,6 +148,7 @@ in
            deepin-sound-theme
            deepin-gtk-theme
            deepin-wallpapers
+            deepin-desktop-base

            startdde
            dde-dock
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -185,6 +185,8 @@ in
        };
      };

+      qt.enable = true;
+
      environment.systemPackages =
        with pkgs.plasma5Packages;
        let
@ -253,6 +255,9 @@ in
            plasma-integration
            polkit-kde-agent

+            qqc2-breeze-style
+            qqc2-desktop-style
+
            plasma-desktop
            plasma-workspace
            plasma-workspace-wallpapers
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@ -18,7 +18,7 @@ from dataclasses import dataclass
 # These values will be replaced with actual values during the package build
 EFI_SYS_MOUNT_POINT = "@efiSysMountPoint@"
 TIMEOUT = "@timeout@"
-EDITOR = bool("@editor@")
+EDITOR = "@editor@" == "1"
 CONSOLE_MODE = "@consoleMode@"
 BOOTSPEC_TOOLS = "@bootspecTools@"
 DISTRO_NAME = "@distroName@"
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@ -22,11 +22,9 @@ let

    timeout = optionalString (config.boot.loader.timeout != null) config.boot.loader.timeout;

-    editor = if cfg.editor then "True" else "False";
-
    configurationLimit = if cfg.configurationLimit == null then 0 else cfg.configurationLimit;

-    inherit (cfg) consoleMode graceful;
+    inherit (cfg) consoleMode graceful editor;

    inherit (efi) efiSysMountPoint canTouchEfiVariables;

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -390,6 +390,7 @@ in {
  installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
  invidious = handleTest ./invidious.nix {};
  livebook-service = handleTest ./livebook-service.nix {};
+  pyload = handleTest ./pyload.nix {};
  oci-containers = handleTestOn ["aarch64-linux" "x86_64-linux"] ./oci-containers.nix {};
  odoo = handleTest ./odoo.nix {};
  odoo15 = handleTest ./odoo.nix { package = pkgs.odoo15; };
@ -712,6 +713,7 @@ in {
  power-profiles-daemon = handleTest ./power-profiles-daemon.nix {};
  pppd = handleTest ./pppd.nix {};
  predictable-interface-names = handleTest ./predictable-interface-names.nix {};
+  pretalx = runTest ./web-apps/pretalx.nix;
  printing-socket = handleTest ./printing.nix { socket = true; };
  printing-service = handleTest ./printing.nix { socket = false; };
  privoxy = handleTest ./privoxy.nix {};
@ -762,6 +764,7 @@ in {
  sabnzbd = handleTest ./sabnzbd.nix {};
  samba = handleTest ./samba.nix {};
  samba-wsdd = handleTest ./samba-wsdd.nix {};
+  sane = handleTest ./sane.nix {};
  sanoid = handleTest ./sanoid.nix {};
  scaphandre = handleTest ./scaphandre.nix {};
  schleuder = handleTest ./schleuder.nix {};
--- a/nixos/tests/appliance-repart-image.nix
+++ b/nixos/tests/appliance-repart-image.nix
@ -40,6 +40,8 @@ in

    image.repart = {
      name = "appliance-gpt-image";
+      # OVMF does not work with the default repart sector size of 4096
+      sectorSize = 512;
      partitions = {
        "esp" = {
          contents =
--- a/nixos/tests/nixos-rebuild-target-host.nix
+++ b/nixos/tests/nixos-rebuild-target-host.nix
@ -132,5 +132,10 @@ import ./make-test-python.nix ({ pkgs, ... }: {
        deployer.succeed("passh -c 3 -C -p ${nodes.target.users.users.bob.password} -P \"\[sudo\] password\" nixos-rebuild switch -I nixos-config=/root/configuration-3.nix --target-host bob@target --use-remote-sudo &>/dev/console")
        target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
        assert target_hostname == "config-3-deployed", f"{target_hostname=}"
+
+      with subtest("Deploy works with very long TMPDIR"):
+        tmp_dir = "/var/folder/veryveryveryveryverylongpathnamethatdoesnotworkwithcontrolpath"
+        deployer.succeed(f"mkdir -p {tmp_dir}")
+        deployer.succeed(f"TMPDIR={tmp_dir} nixos-rebuild switch -I nixos-config=/root/configuration-1.nix --target-host root@target &>/dev/console")
    '';
 })
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -942,31 +942,6 @@ let
      '';
    };

-    openvpn = {
-      exporterConfig = {
-        enable = true;
-        group = "openvpn";
-        statusPaths = [ "/run/openvpn-test" ];
-      };
-      metricProvider = {
-        users.groups.openvpn = { };
-        services.openvpn.servers.test = {
-          config = ''
-            dev tun
-            status /run/openvpn-test
-            status-version 3
-          '';
-          up = "chmod g+r /run/openvpn-test";
-        };
-        systemd.services."openvpn-test".serviceConfig.Group = "openvpn";
-      };
-      exporterTest = ''
-        wait_for_unit("openvpn-test.service")
-        wait_for_unit("prometheus-openvpn-exporter.service")
-        succeed("curl -sSf http://localhost:9176/metrics | grep 'openvpn_up{.*} 1'")
-      '';
-    };
-
    pgbouncer = {
      exporterConfig = {
        enable = true;
--- a/nixos/tests/pyload.nix
+++ b/nixos/tests/pyload.nix
@ -0,0 +1,33 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "pyload";
+  meta.maintainers = with lib.maintainers; [ ambroisie ];
+
+  nodes = {
+    machine = { ... }: {
+      services.pyload = {
+        enable = true;
+
+        listenAddress = "0.0.0.0";
+        port = 9876;
+      };
+
+      networking.firewall.allowedTCPPorts = [ 9876 ];
+    };
+
+    client = { };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("pyload.service")
+
+    with subtest("Web interface accessible locally"):
+        machine.wait_until_succeeds("curl -fs localhost:9876")
+
+    client.wait_for_unit("network.target")
+
+    with subtest("Web interface accessible from a different machine"):
+        client.wait_until_succeeds("curl -fs machine:9876")
+  '';
+})
--- a/nixos/tests/sane.nix
+++ b/nixos/tests/sane.nix
@ -0,0 +1,85 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+/*
+  SANE NixOS test
+  ===============
+  SANE is intrisically tied to hardware, so testing it is not straightforward.
+  However:
+  - a fake webcam can be created with v4l2loopback
+  - sane has a backend (v4l) to use a webcam as a scanner
+  This test creates a webcam /dev/video0, streams a still image with some text
+  through this webcam, uses SANE to scan from the webcam, and uses OCR to check
+  that the expected text was scanned.
+*/
+let
+  text = "66263666188646651519653683416";
+  fontsConf = pkgs.makeFontsConf {
+    fontDirectories = [
+      pkgs.dejavu_fonts.minimal
+    ];
+  };
+  # an image with black on white text spelling "${text}"
+  # for some reason, the test fails if it's jpg instead of png
+  # the font is quite large to make OCR easier
+  image = pkgs.runCommand "image.png"
+    {
+      # only imagemagickBig can render text
+      nativeBuildInputs = [ pkgs.imagemagickBig ];
+      FONTCONFIG_FILE = fontsConf;
+    } ''
+    magick -pointsize 100 label:${text} $out
+  '';
+in
+{
+  name = "sane";
+  nodes.machine = { pkgs, config, ... }: {
+    boot = {
+      # create /dev/video0 as a fake webcam whose content is filled by ffmpeg
+      extraModprobeConfig = ''
+        options v4l2loopback devices=1 max_buffers=2 exclusive_caps=1 card_label=VirtualCam
+      '';
+      kernelModules = [ "v4l2loopback" ];
+      extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
+    };
+    systemd.services.fake-webcam = {
+      wantedBy = [ "multi-user.target" ];
+      description = "fill /dev/video0 with ${image}";
+      /* HACK: /dev/video0 is a v4l2 only device, it misses one single v4l1
+      ioctl, VIDIOCSPICT. But sane only supports v4l1, so it will log that this
+      ioctl failed, and assume that the pixel format is Y8 (gray). So we tell
+      ffmpeg to produce this pixel format.
+      */
+      serviceConfig.ExecStart = [ "${pkgs.ffmpeg}/bin/ffmpeg -framerate 30 -re -stream_loop -1 -i ${image} -f v4l2 -pix_fmt gray /dev/video0" ];
+    };
+    hardware.sane.enable = true;
+    system.extraDependencies = [ image ];
+    environment.systemPackages = [
+      pkgs.fswebcam
+      pkgs.tesseract
+      pkgs.v4l-utils
+    ];
+    environment.variables.SANE_DEBUG_V4L = "128";
+  };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("fake-webcam.service")
+
+    # the device only appears when ffmpeg starts producing frames
+    machine.wait_until_succeeds("scanimage -L | grep /dev/video0")
+
+    machine.succeed("scanimage -L >&2")
+
+    with subtest("debugging: /dev/video0 works"):
+      machine.succeed("v4l2-ctl --all >&2")
+      machine.succeed("fswebcam --no-banner /tmp/webcam.jpg")
+      machine.copy_from_vm("/tmp/webcam.jpg", "webcam")
+
+    # scan with the webcam
+    machine.succeed("scanimage -o /tmp/scan.png >&2")
+    machine.copy_from_vm("/tmp/scan.png", "scan")
+
+    # the image should contain "${text}"
+    output = machine.succeed("tesseract /tmp/scan.png -")
+    print(output)
+    assert "${text}" in output, f"expected text ${text} was not found, OCR found {output!r}"
+  '';
+})
--- a/nixos/tests/web-apps/pretalx.nix
+++ b/nixos/tests/web-apps/pretalx.nix
@ -0,0 +1,31 @@
+{ lib, ... }:
+
+{
+  name = "pretalx";
+  meta.maintainers = lib.teams.c3d2.members;
+
+  nodes = {
+    pretalx = {
+      networking.extraHosts = ''
+        127.0.0.1 talks.local
+      '';
+
+      services.pretalx = {
+        enable = true;
+        nginx.domain = "talks.local";
+        settings = {
+          site.url = "http://talks.local";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    pretalx.wait_for_unit("pretalx-web.service")
+    pretalx.wait_for_unit("pretalx-worker.service")
+
+    pretalx.wait_until_succeeds("curl -q --fail http://talks.local/orga/")
+  '';
+}
--- a/nixos/tests/zfs.nix
+++ b/nixos/tests/zfs.nix
@ -8,12 +8,9 @@ with import ../lib/testing-python.nix { inherit system pkgs; };
 let

  makeZfsTest = name:
-    { kernelPackage ? if enableUnstable
-                      then pkgs.zfsUnstable.latestCompatibleLinuxPackages
-                      else pkgs.linuxPackages
-    , enableUnstable ? false
+    { kernelPackages
    , enableSystemdStage1 ? false
-    , zfsPackage ? if enableUnstable then pkgs.zfs else pkgs.zfsUnstable
+    , zfsPackage
    , extraTest ? ""
    }:
    makeTest {
@ -35,7 +32,7 @@ let
        boot.loader.timeout = 0;
        boot.loader.efi.canTouchEfiVariables = true;
        networking.hostId = "deadbeef";
-        boot.kernelPackages = kernelPackage;
+        boot.kernelPackages = kernelPackages;
        boot.zfs.package = zfsPackage;
        boot.supportedFilesystems = [ "zfs" ];
        boot.initrd.systemd.enable = enableSystemdStage1;
@ -197,16 +194,22 @@ in {
  # maintainer: @raitobezarius
  series_2_1 = makeZfsTest "2.1-series" {
    zfsPackage = pkgs.zfs_2_1;
+    kernelPackages = pkgs.linuxPackages;
  };

-  stable = makeZfsTest "stable" { };
-
-  unstable = makeZfsTest "unstable" {
-    enableUnstable = true;
+  stable = makeZfsTest "stable" {
+    zfsPackage = pkgs.zfsStable;
+    kernelPackages = pkgs.linuxPackages;
  };

-  unstableWithSystemdStage1 = makeZfsTest "unstable" {
-    enableUnstable = true;
+  unstable = makeZfsTest "unstable" rec {
+    zfsPackage = pkgs.zfsUnstable;
+    kernelPackages = zfsPackage.latestCompatibleLinuxPackages;
+  };
+
+  unstableWithSystemdStage1 = makeZfsTest "unstable" rec {
+    zfsPackage = pkgs.zfsUnstable;
+    kernelPackages = zfsPackage.latestCompatibleLinuxPackages;
    enableSystemdStage1 = true;
  };

--- a/pkgs/applications/audio/ledfx/default.nix
+++ b/pkgs/applications/audio/ledfx/default.nix
@ -5,12 +5,12 @@

 python3.pkgs.buildPythonPackage rec {
  pname = "ledfx";
-  version = "2.0.89";
+  version = "2.0.90";
  pyproject= true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-PBOj6u0TukT6wRKMQML4+XNQQZvsGyRzXBk9YsISst4=";
+    hash = "sha256-ZlZtC0bi9ZUf/1D9hUxxhdix6F8l7Lg5IUOOg+JHGYU=";
  };

  pythonRelaxDeps = true;
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mympd";
-  version = "13.0.6";
+  version = "14.0.0";

  src = fetchFromGitHub {
    owner = "jcorporation";
    repo = "myMPD";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-7yqpm2qMDHWVM5m5FueYlkEFY+VIW8Cx+aRa1iY2vZ4=";
+    sha256 = "sha256-srwLnoQSPex7/PtgF6RWpJM39fpOqN3wze5ABSRTIRA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/netease-music-tui/default.nix
+++ b/pkgs/applications/audio/netease-music-tui/default.nix
@ -29,5 +29,6 @@ rustPlatform.buildRustPackage rec {
    description = "netease cloud music terminal client by rust";
    maintainers = with maintainers; [ vonfry ];
    license = licenses.mit;
+    mainProgram = "ncmt";
  };
 }
--- a/pkgs/applications/audio/polyphone/default.nix
+++ b/pkgs/applications/audio/polyphone/default.nix
@ -29,8 +29,13 @@ mkDerivation rec {
  '';

  installPhase = ''
+    runHook preInstall
    install -d $out/bin
    install -m755 bin/polyphone $out/bin/
+
+    install -Dm444 ./contrib/com.polyphone_soundfonts.polyphone.desktop -t $out/share/applications/
+    install -Dm444 ./contrib/polyphone.svg -t $out/share/icons/hicolor/scalable/apps/
+    runHook postInstall
  '';

  qmakeFlags = [
--- a/pkgs/applications/audio/psst/default.nix
+++ b/pkgs/applications/audio/psst/default.nix
@ -16,13 +16,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "psst";
-  version = "unstable-2024-01-12";
+  version = "unstable-2024-01-28";

  src = fetchFromGitHub {
    owner = "jpochyla";
    repo = pname;
-    rev = "c70ace50e8c50c38dc6c4ea1156de2b50e6e76b5";
-    hash = "sha256-WCtD06fZHdn0kT5SDE7aTUZvQlX9OBSAqHu+qopBzTM=";
+    rev = "38422b1795c98d8d0e3bc8dc479d12f8d5bd7154";
+    hash = "sha256-VTbjlSfkbon38IPBCazwrZtWR8dH9mE0sSVIlmxcUks=";
  };

  cargoLock = {
--- a/pkgs/applications/audio/psst/make-build-reproducible.patch
+++ b/pkgs/applications/audio/psst/make-build-reproducible.patch
@ -51,7 +51,7 @@ index fcbd491..2d71ee3 100644
 -pub const GIT_VERSION: &str = git_version!();
 -pub const BUILD_TIME: &str = include!(concat!(env!("OUT_DIR"), "/build-time.txt"));
 -pub const REMOTE_URL: &str = include!(concat!(env!("OUT_DIR"), "/remote-url.txt"));
-+pub const GIT_VERSION: &str = "c70ace50e8c50c38dc6c4ea1156de2b50e6e76b5";
+pub const GIT_VERSION: &str = "38422b1795c98d8d0e3bc8dc479d12f8d5bd7154";
 +pub const BUILD_TIME: &str = "1970-01-01 00:00:00";
 +pub const REMOTE_URL: &str = "https://github.com/jpochyla/psst";
 
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -18,8 +18,8 @@ let
    sha256Hash = "sha256-cFEPgFAKkFx0d7PC4fTElTQVrBZMQs0RL3wR+hqTh2I=";
  };
  latestVersion = {
-    version = "2023.3.1.5"; # "Android Studio Jellyfish | 2023.3.1 Canary 5"
-    sha256Hash = "sha256-cxlACtSpDBoM5KHAWCEvqPbuKnvH7aDzOo3P+Folgqk=";
+    version = "2023.3.1.7"; # "Android Studio Jellyfish | 2023.3.1 Canary 7"
+    sha256Hash = "sha256-PnhqSKgxs0XQ5cm/PB11Oms2p1aAibXKe52QC+8lX8c=";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/typora/default.nix
+++ b/pkgs/applications/editors/typora/default.nix
@ -22,10 +22,10 @@

 let
  pname = "typora";
-  version = "1.8.6";
+  version = "1.8.9";
  src = fetchurl {
    url = "https://download.typora.io/linux/typora_${version}_amd64.deb";
-    hash = "sha256-5hA9wEP3Hf3RxYC6KKe6JCiMEYKIHk9YhcA9tnSvirc=";
+    hash = "sha256-1FAVY9NSvpZOCZJmNadx5ZlqfaCc2N3D+T/08F4TOzY=";
  };

  typoraBase = stdenv.mkDerivation {
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -985,8 +985,8 @@ let
        mktplcRef = {
          name = "vscode-eslint";
          publisher = "dbaeumer";
-          version = "2.4.2";
-          sha256 = "sha256-eIjaiVQ7PNJUtOiZlM+lw6VmW07FbMWPtY7UoedWtbw=";
+          version = "2.4.4";
+          sha256 = "sha256-NJGsMme/+4bvED/93SGojYTH03EZbtKe5LyvocywILA=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/dbaeumer.vscode-eslint/changelog";
@ -3235,11 +3235,12 @@ let
        mktplcRef = {
          name = "crates";
          publisher = "serayuzgur";
-          version = "0.6.5";
-          sha256 = "sha256-HgqM4PKGk3R5MLY4cVjKxv79p5KlOkVDeDbv7/6FmpM=";
+          version = "0.6.6";
+          sha256 = "sha256-HXoH1IgMLniq0kxHs2snym4rerScu9qCqUaqwEC+O/E=";
        };
        meta = {
          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.wackbyte ];
        };
      };

--- a/pkgs/applications/emulators/fceux/default.nix
+++ b/pkgs/applications/emulators/fceux/default.nix
@ -1,24 +1,24 @@
 { lib
-, stdenv
-, fetchFromGitHub
 , SDL2
 , cmake
+, fetchFromGitHub
 , lua
 , minizip
 , pkg-config
+, stdenv
 , wrapQtAppsHook
 , x264
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "fceux";
-  version = "2.6.4";
+  version = "2.6.6-unstable-2024-01-19";

  src = fetchFromGitHub {
    owner = "TASEmulators";
    repo = "fceux";
-    rev = "fceux-${finalAttrs.version}";
-    hash = "sha256-Q6r/iBlmi0z40+U6OLZCahS0io4IBBGZMP1mJH7szRM=";
+    rev = "2fce5ffe745bb89be471e450d9cd6284cd5614d9";
+    hash = "sha256-5uUTw7ZkmBrGuntSQFNAp1Xz69ANmmIxNGd0/enPoW8=";
  };

  nativeBuildInputs = [
@ -34,11 +34,12 @@ stdenv.mkDerivation (finalAttrs: {
    x264
  ];

-  meta = with lib; {
+  meta = {
    homepage = "http://www.fceux.com/";
    description = "A Nintendo Entertainment System (NES) Emulator";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ sbruder ];
-    platforms = platforms.linux;
+    changelog = "https://github.com/TASEmulators/blob/fceux/${finalAttrs.src.rev}/changelog.txt";
+    license = with lib.licenses; [ gpl2Plus ];
+    maintainers = with lib.maintainers; [ AndersonTorres sbruder ];
+    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/applications/emulators/yuzu/compat-list.nix
+++ b/pkgs/applications/emulators/yuzu/compat-list.nix
@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, unstableGitUpdater }:
 stdenv.mkDerivation {
  pname = "yuzu-compatibility-list";
-  version = "unstable-2024-01-27";
+  version = "unstable-2024-01-30";

  src = fetchFromGitHub {
    owner = "flathub";
    repo = "org.yuzu_emu.yuzu";
-    rev = "c01bdbbfda3e2558930fcced63b6d02b646f881b";
-    hash = "sha256-TDmzBxeJq4gJvU88hJaXN7U3PYOqI1OrkenlH1GJo8g=";
+    rev = "82194fa23ec35545ade47cc3dc2035b2b07badcb";
+    hash = "sha256-LsQZml8I43fZDFACtVZpc76/62Pv11Z6bm8w/9hTHdI=";
  };

  buildCommand = ''
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@ -77,14 +77,14 @@ let
    urllib3
  ];
 in mkDerivation rec {
-  version = "3.34.2";
+  version = "3.34.3";
  pname = "qgis-unwrapped";

  src = fetchFromGitHub {
    owner = "qgis";
    repo = "QGIS";
    rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-RKxIJpp0lmRqyMYJuX2U4/GJh0FTnklFOcUft6LsuHc=";
+    hash = "sha256-uf4qUalY6LxPykgUt/atHBTu+A6ITrcnfez/jwVMLvA=";
  };

  passthru = {
--- a/pkgs/applications/graphics/sane/backends/default.nix
+++ b/pkgs/applications/graphics/sane/backends/default.nix
@ -3,6 +3,7 @@
 , avahi, libgphoto2, libieee1284, libjpeg, libpng, libtiff, libusb1, libv4l, net-snmp
 , curl, systemd, libxml2, poppler, gawk
 , sane-drivers
+, nixosTests

 # List of { src name backend } attibute sets - see installFirmware below:
 , extraFirmware ? []
@ -132,6 +133,10 @@ stdenv.mkDerivation {
  # https://github.com/NixOS/nixpkgs/issues/224569
  enableParallelInstalling = false;

+  passthru.tests = {
+    inherit (nixosTests) sane;
+  };
+
  meta = with lib; {
    description = "SANE (Scanner Access Now Easy) backends";
    longDescription = ''
--- a/pkgs/applications/misc/diffuse/default.nix
+++ b/pkgs/applications/misc/diffuse/default.nix
@ -14,13 +14,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "diffuse";
-  version = "0.8.2";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "MightyCreak";
    repo = "diffuse";
    rev = "v${version}";
-    sha256 = "aGg5uh9KitVP2bBUizgGIZWvzTxfJGid0WUGVNyHdlk=";
+    sha256 = "6GdUtdVhhIQL1cD9/e7Byv37PVKXmzVWhJC6GROK7OA=";
  };

  format = "other";
--- a/pkgs/applications/misc/gramps/default.nix
+++ b/pkgs/applications/misc/gramps/default.nix
@ -1,18 +1,48 @@
-{ lib, fetchFromGitHub, gtk3, pythonPackages, intltool, gexiv2,
-  pango, gobject-introspection, wrapGAppsHook, gettext,
-# Optional packages:
- enableOSM ? true, osm-gps-map, glib-networking,
- enableGraphviz ? true, graphviz,
- enableGhostscript ? true, ghostscript
- }:
+{ lib
+, fetchpatch
+, fetchFromGitHub
+, gtk3
+, pythonPackages
+, glibcLocales
+, intltool
+, gexiv2
+, pango
+, gobject-introspection
+, wrapGAppsHook
+, gettext
+, # Optional packages:
+  enableOSM ? true
+, osm-gps-map
+, glib-networking
+, enableGraphviz ? true
+, graphviz
+, enableGhostscript ? true
+, ghostscript
+}:

 let
  inherit (pythonPackages) python buildPythonApplication;
-in buildPythonApplication rec {
-  version = "5.1.4";
+in
+buildPythonApplication rec {
+  version = "5.1.6";
  pname = "gramps";
+  pyproject = true;
+
+  nativeBuildInputs = [
+    wrapGAppsHook
+    intltool
+    gettext
+    gobject-introspection
+    pythonPackages.setuptools
+  ];
+
+  nativeCheckInputs = [
+    glibcLocales
+    pythonPackages.jsonschema
+    pythonPackages.mock
+    pythonPackages.lxml
+  ];

-  nativeBuildInputs = [ wrapGAppsHook intltool gettext gobject-introspection ];
  buildInputs = [ gtk3 pango gexiv2 ]
    # Map support
    ++ lib.optionals enableOSM [ osm-gps-map glib-networking ]
@ -26,35 +56,53 @@ in buildPythonApplication rec {
    owner = "gramps-project";
    repo = "gramps";
    rev = "v${version}";
-    sha256 = "00358nzyw686ypqv45imc5k9frcqnhla0hpx9ynna3iy6iz5006x";
+    hash = "sha256-BerkDXdFYfZ3rV5AeMo/uk53IN2U5z4GFs757Ar26v0=";
  };

-  pythonPath = with pythonPackages; [ bsddb3 pyicu pygobject3 pycairo ];
+  pythonPath = with pythonPackages; [
+    bsddb3
+    pyicu
+    pygobject3
+    pycairo
+  ];
+
+  patches = [
+    # fix for running tests with a temporary home - remove next release
+    # https://gramps-project.org/bugs/view.php?id=12577
+    (fetchpatch {
+      url = "https://github.com/gramps-project/gramps/commit/1e95d8a6b5193d655d8caec1e6ab13628ad123db.patch";
+      hash = "sha256-2riWB13Yl+tk9+Tuo0YDLoxY2Rc0xrJKfb+ZU7Puzxk=";
+    })
+  ];

  # Same installPhase as in buildPythonApplication but without --old-and-unmanageble
  # install flag.
  installPhase = ''
    runHook preInstall

-    mkdir -p "$out/lib/${python.libPrefix}/site-packages"
+    mkdir -p "$out/${python.sitePackages}"

-    export PYTHONPATH="$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
+    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"

    ${python}/bin/${python.executable} setup.py install \
-      --install-lib=$out/lib/${python.libPrefix}/site-packages \
+      --install-lib=$out/${python.sitePackages} \
      --prefix="$out"

-    eapth="$out/lib/${python.libPrefix}"/site-packages/easy-install.pth
+    eapth="$out/${python.sitePackages}/easy-install.pth"
    if [ -e "$eapth" ]; then
        # move colliding easy_install.pth to specifically named one
        mv "$eapth" $(dirname "$eapth")/${pname}-${version}.pth
    fi

-    rm -f "$out/lib/${python.libPrefix}"/site-packages/site.py*
+    rm -f "$out/${python.sitePackages}"/site.py*

    runHook postInstall
  '';

+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
+
  # https://github.com/NixOS/nixpkgs/issues/149812
  # https://nixos.org/manual/nixpkgs/stable/#ssec-gnome-hooks-gobject-introspection
  strictDeps = false;
@ -62,6 +110,15 @@ in buildPythonApplication rec {
  meta = with lib; {
    description = "Genealogy software";
    homepage = "https://gramps-project.org";
-    license = licenses.gpl2;
+    maintainers = with maintainers; [ jk pinpox ];
+    changelog = "https://github.com/gramps-project/gramps/blob/v${version}/ChangeLog";
+    longDescription = ''
+      Every person has their own story but they are also part of a collective
+      family history. Gramps gives you the ability to record the many details of
+      an individual's life as well as the complex relationships between various
+      people, places and events. All of your research is kept organized,
+      searchable and as precise as you need it to be.
+    '';
+    license = licenses.gpl2Plus;
  };
 }
--- a/pkgs/applications/misc/khal/default.nix
+++ b/pkgs/applications/misc/khal/default.nix
@ -24,9 +24,7 @@ let
    };
  };
 in
-with py.pkgs;
-
-buildPythonApplication rec {
+py.pkgs.buildPythonApplication rec {
  pname = "khal";
  version = "0.11.2";
  pyproject = true;
@ -41,8 +39,7 @@ buildPythonApplication rec {
  nativeBuildInputs = [
    glibcLocales
    installShellFiles
-  ] ++ (with python3.pkgs; [
-    setuptools
+  ] ++ (with py.pkgs; [
    setuptools-scm
    sphinx
    sphinxcontrib-newsfeed
@ -66,7 +63,7 @@ buildPythonApplication rec {
    urwid
  ];

-  nativeCheckInputs = with python3.pkgs;[
+  nativeCheckInputs = with py.pkgs;[
    freezegun
    hypothesis
    packaging
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@ -71,6 +71,7 @@ in {
    homepage = "https://github.com/logseq/logseq";
    changelog = "https://github.com/logseq/logseq/releases/tag/${version}";
    license = lib.licenses.agpl3Plus;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    maintainers = with lib.maintainers; [ ];
    platforms = [ "x86_64-linux" ];
  };
--- a/pkgs/applications/misc/loxodo/default.nix
+++ b/pkgs/applications/misc/loxodo/default.nix
@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication {
    [Desktop Entry]
    Type=Application
    Exec=$out/bin/loxodo
-    Icon=$out/lib/${python3.libPrefix}/site-packages/resources/loxodo-icon.png
+    Icon=$out/${python3.sitePackages}/resources/loxodo-icon.png
    Name=Loxodo
    GenericName=Password Vault
    Categories=Application;Other;
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@ -9,6 +9,7 @@
 , cereal
 , cgal
 , curl
+, darwin
 , dbus
 , eigen
 , expat
@ -111,6 +112,8 @@ stdenv.mkDerivation (finalAttrs: {
    catch2
  ] ++ lib.optionals withSystemd [
    systemd
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk_11_0.frameworks.CoreWLAN
  ];

  separateDebugInfo = true;
@ -190,6 +193,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/prusa3d/PrusaSlicer";
    license = licenses.agpl3;
    maintainers = with maintainers; [ moredread tweber tmarkus ];
+    platforms = platforms.unix;
  } // lib.optionalAttrs (stdenv.isDarwin) {
    mainProgram = "PrusaSlicer";
  };
--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@ -3,9 +3,7 @@
 , fetchurl
 , makeWrapper
 , makeDesktopItem
-# sweethome3d 6.5.2 does not yet fully build&run with jdk 9 and later?
-, jdk8
-, jre8
+, jdk
 , ant
 , gtk3
 , gsettings-desktop-schemas
@ -13,6 +11,7 @@
 , autoPatchelfHook
 , libXxf86vm
 , unzip
+, libGL
 }:

 let
@ -42,7 +41,7 @@ let
    };

    postPatch = ''
-      addAutoPatchelfSearchPath ${jre8}/lib/openjdk/jre/lib/
+      addAutoPatchelfSearchPath ${jdk}/lib/openjdk/lib/
      autoPatchelf lib

      # Nix cannot see the runtime references to the paths we just patched in
@ -52,7 +51,7 @@ let
    '';

    nativeBuildInputs = [ makeWrapper unzip autoPatchelfHook ];
-    buildInputs = [ ant jdk8 p7zip gtk3 gsettings-desktop-schemas libXxf86vm ];
+    buildInputs = [ ant jdk p7zip gtk3 gsettings-desktop-schemas libXxf86vm ];

    buildPhase = ''
      runHook preBuild
@ -75,13 +74,9 @@ let

      cp "${sweethome3dItem}/share/applications/"* $out/share/applications

-      # MESA_GL_VERSION_OVERRIDE is needed since the update from MESA 19.3.3 to 20.0.2:
-      # without it a "Profiles [GL4bc, GL3bc, GL2, GLES1] not available on device null"
-      # exception is thrown on startup.
-      # https://discourse.nixos.org/t/glx-not-recognised-after-mesa-update/6753
-      makeWrapper ${jre8}/bin/java $out/bin/$exec \
-        --set MESA_GL_VERSION_OVERRIDE 2.1 \
+      makeWrapper ${jdk}/bin/java $out/bin/$exec \
        --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:${gtk3.out}/share:${gsettings-desktop-schemas}/share:$out/share:$GSETTINGS_SCHEMAS_PATH" \
+        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
        --add-flags "-Dsun.java2d.opengl=true -jar $out/share/java/${module}-${version}.jar -cp $out/share/java/Furniture.jar:$out/share/java/Textures.jar:$out/share/java/Help.jar -d${toString stdenv.hostPlatform.parsed.cpu.bits}"


@ -102,6 +97,7 @@ let
      inherit license;
      maintainers = [ lib.maintainers.edwtjo ];
      platforms = lib.platforms.linux;
+      mainProgram = exec;
    };
  };

--- a/pkgs/applications/misc/sweethome3d/editors.nix
+++ b/pkgs/applications/misc/sweethome3d/editors.nix
@ -3,9 +3,7 @@
 , fetchurl
 , makeWrapper
 , makeDesktopItem
-# sweethome3d 6.5.2 does not yet fully build&run with jdk 9 and later?
-, jdk8
-, jre8
+, jdk
 , ant
 , gtk3
 , gsettings-desktop-schemas
@ -44,7 +42,7 @@ let
    };

    nativeBuildInputs = [ makeWrapper unzip ];
-    buildInputs = [ ant jre8 jdk8 gtk3 gsettings-desktop-schemas ];
+    buildInputs = [ ant jdk gtk3 gsettings-desktop-schemas ];

    postPatch = ''
      sed -i -e 's,../SweetHome3D,${applicationSrc},g' build.xml
@ -54,7 +52,7 @@ let
    buildPhase = ''
      runHook preBuild

-      ant -lib ${applicationSrc}/libtest -lib ${applicationSrc}/lib -lib ${jdk8}/lib
+      ant -lib ${applicationSrc}/libtest -lib ${applicationSrc}/lib -lib ${jdk}/lib

      runHook postBuild
    '';
@ -64,7 +62,7 @@ let
      mkdir -p $out/share/{java,applications}
      cp ${module}-${version}.jar $out/share/java/.
      cp "${editorItem}/share/applications/"* $out/share/applications
-      makeWrapper ${jre8}/bin/java $out/bin/$exec \
+      makeWrapper ${jdk}/bin/java $out/bin/$exec \
        --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:${gtk3.out}/share:${gsettings-desktop-schemas}/share:$out/share:$GSETTINGS_SCHEMAS_PATH" \
        --add-flags "-jar $out/share/java/${module}-${version}.jar -d${toString stdenv.hostPlatform.parsed.cpu.bits}"
    '';
@ -77,6 +75,7 @@ let
      inherit license;
      maintainers = [ lib.maintainers.edwtjo ];
      platforms = lib.platforms.linux;
+      mainProgram = exec;
    };

  };
--- a/pkgs/applications/misc/wmenu/default.nix
+++ b/pkgs/applications/misc/wmenu/default.nix
@ -15,7 +15,7 @@

 stdenv.mkDerivation rec {
  pname = "wmenu";
-  version = "0.1.4";
+  version = "0.1.6";

  strictDeps = true;

@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    owner = "~adnano";
    repo = "wmenu";
    rev = version;
-    hash = "sha256-aB23wi8kLBKAvQv2UPsfqVMCjakdsM6AzH8LgGv3HPs=";
+    hash = "sha256-Xsnf7T39up6E5kzV37sM9j3PpA2eqxItbGt+tOfjsjE=";
  };

  nativeBuildInputs = [ pkg-config meson ninja ];
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -292,6 +292,9 @@ buildStdenv.mkDerivation {
    # Runs autoconf through ./mach configure in configurePhase
    configureScript="$(realpath ./mach) configure"

+    # Set reproducible build date; https://bugzilla.mozilla.org/show_bug.cgi?id=885777#c21
+    export MOZ_BUILD_DATE=$(head -n1 sourcestamp.txt)
+
    # Set predictable directories for build and state
    export MOZ_OBJDIR=$(pwd)/mozobj
    export MOZBUILD_STATE_PATH=$(pwd)/mozbuild
--- a/pkgs/applications/networking/browsers/microsoft-edge/default.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
@ -1,20 +1,20 @@
 {
  stable = import ./browser.nix {
    channel = "stable";
-    version = "120.0.2210.144";
+    version = "121.0.2277.83";
    revision = "1";
-    hash = "sha256-O/7LdopcMfSYx8cg9BNDU6KxbPfnF9rYXD7Q6jugBLU=";
+    hash = "sha256-WuDu44elNlkYZEtol+TZNpcRAkAq8HHATYCc9Or/bvU=";
  };
  beta = import ./browser.nix {
    channel = "beta";
-    version = "121.0.2277.71";
+    version = "121.0.2277.83";
    revision = "1";
-    hash = "sha256-PsfUZJ5ftHxSFGaXjzFMEff7Czfq88yL31mqNkFilNM=";
+    hash = "sha256-eW8Bpcjw1aY5lMqsGCJ3hORVLhzW8Fmaio+kpSOzPeU=";
  };
  dev = import ./browser.nix {
    channel = "dev";
-    version = "122.0.2348.0";
+    version = "122.0.2353.0";
    revision = "1";
-    hash = "sha256-Vsnrc43d70fLDncMeQeYhZJhnYex2LsIV1U2KPlkP9U=";
+    hash = "sha256-llLaq13SU4ZpqhOYK0hy6ZD6amAqijStk8TIHX3gydQ=";
  };
 }
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cilium-cli";
-  version = "0.15.20";
+  version = "0.15.21";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-uwHy1Wdf9/BXfPgBFc0Lkd3tewqY/+MjqaFnb8dFnH0=";
+    hash = "sha256-jagNtaR7YAOdvy/yJrIRQfr8UQTrEoVrPLaGklt8mUk=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/kubecm/default.nix
+++ b/pkgs/applications/networking/cluster/kubecm/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubecm";
-  version = "0.27.1";
+  version = "0.28.0";

  src = fetchFromGitHub {
    owner = "sunny0826";
    repo = "kubecm";
    rev = "v${version}";
-    hash = "sha256-Fg+jlnYkdv9Vfj94lxfmhoc6pyM0EAqwIBepFXYoO5M=";
+    hash = "sha256-v2frNvJUvDjPhV1RCR3DHk04kYEqP6hMXeA4j3cWlss=";
  };

-  vendorHash = "sha256-wj/IHNN8r6pwkKk0ZmpRjxr5nE2c+iypjCsZb+i5vwo=";
+  vendorHash = "sha256-uM9/rqu5WOXK6bqxhtmje+Zd9dtdv3qwt+Xr0SJHjPs=";
  ldflags = [ "-s" "-w" "-X github.com/sunny0826/kubecm/version.Version=${version}"];

  doCheck = false;
--- a/pkgs/applications/networking/cluster/kubergrunt/default.nix
+++ b/pkgs/applications/networking/cluster/kubergrunt/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubergrunt";
-  version = "0.14.0";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = "kubergrunt";
    rev = "v${version}";
-    sha256 = "sha256-2wyqCiP+hb5dLdaS322eo2yMSTjcQb+eBvr3HRnaTD0=";
+    sha256 = "sha256-bPZZzvbHynW0FtfmE78agBDADmCyBS2a4E/K+tJHkQY=";
  };

-  vendorHash = "sha256-cr3VVS+ASg3vmppvTYpaOLJNHDN0b+C9uSln7jeqTX4=";
+  vendorHash = "sha256-K24y41qpuyBHqljUAtNQu3H8BNqznxYOsvEVo+57OtY=";

  # Disable tests since it requires network access and relies on the
  # presence of certain AWS infrastructure
--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "nerdctl";
-  version = "1.7.2";
+  version = "1.7.3";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-6YMDGvNl1uNMWR1xTPRjYGwaKXC5c4oUy88VRY2Bedw=";
+    hash = "sha256-Y76H/88/esziIermnzfOS48FLBRnVBN8u4C381n184M=";
  };

-  vendorHash = "sha256-tXLuOZUoMhVfhhYxnxNw+nYofhEFMKI1b94lVPySd3E=";
+  vendorHash = "sha256-oiBgZQtqFwq189h/Bb4CrFhs4RDYUoEEOjrccujGclU=";

  nativeBuildInputs = [ makeWrapper installShellFiles ];

--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -167,9 +167,9 @@ rec {
  mkTerraform = attrs: pluggable (generic attrs);

  terraform_1 = mkTerraform {
-    version = "1.7.1";
-    hash = "sha256-e+YXOqXgiUXtm6P8PulZowRK0OLA8ekmS+MZRQP/srg=";
-    vendorHash = "sha256-77W0x6DENB+U3yB4LI3PwJU9bTuH7Eqz2a9FNoERuJg=";
+    version = "1.7.2";
+    hash = "sha256-jTzZWmYeKF87Er2i7XHquM8oQyF4q/qoBf4DdMqv7L8=";
+    vendorHash = "sha256-DI4YTjdFFvfby8ExEY3KoK4J9YKK5LPpMbelzFMDVVs=";
    patches = [ ./provider-path-0_15.patch ];
    passthru = {
      inherit plugins;
--- a/pkgs/applications/networking/cluster/tilt/assets.nix
+++ b/pkgs/applications/networking/cluster/tilt/assets.nix
@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation rec {

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = "${src}/web/yarn.lock";
-    hash = "sha256-UTxglGn3eIgahZg4kxolg2f2MTReCL4r/GyWNg4105E=";
+    hash = "sha256-0JpoAQKRmU7P1bzYNR/vqtPjOOSw8wSlNjXl2f6uBrw=";
  };

  configurePhase = ''
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@ -5,13 +5,13 @@ let args = rec {
      /* Do not use "dev" as a version. If you do, Tilt will consider itself
        running in development environment and try to serve assets from the
        source tree, which is not there once build completes.  */
-      version = "0.33.6";
+      version = "0.33.10";

      src = fetchFromGitHub {
        owner = "tilt-dev";
        repo = "tilt";
        rev = "v${version}";
-        hash = "sha256-WtE8ExUKFRtdYeg0+My/DB+L/qT+J1EaKHKChNjC5oI=";
+        hash = "sha256-LPb2tC3xIGhjiLYkTU+NBIUoqiicO2ORM6Nt1eTnwQs=";
      };
    };

--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.282";
+  version = "1.2.284";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    hash = "sha256-hlI9OLvirkY5LrcK21mcXe32d+X4s/SRelWWKZrcdu4=";
+    hash = "sha256-02dvkz8lgvbiTZ194pv5UruKgB5+BtDbogAkEOfzpaA=";
  };

-  vendorHash = "sha256-1rurHe3jFs+jOZhqBlH/IOoEyCEZoNpzBYnYC/UqYAU=";
+  vendorHash = "sha256-u7E+4VK3D36ipAqQVPeIyAhv/1JvgMHEuUUiQH/43ME=";

  proxyVendor = true;

--- a/pkgs/applications/networking/deck/default.nix
+++ b/pkgs/applications/networking/deck/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "deck";
-  version = "1.32.0";
+  version = "1.32.1";

  src = fetchFromGitHub {
    owner = "Kong";
    repo = "deck";
    rev = "v${version}";
-    hash = "sha256-h0dZXIrQm8RlfNnIHU4P0iFelWmkXVqkBmyyrA3/EgY=";
+    hash = "sha256-7lE/Wnrlv3L6V1ex+357q6XXpdx0810m1rKkqITowXY=";
  };

  nativeBuildInputs = [ installShellFiles ];
@ -21,7 +21,7 @@ buildGoModule rec {
  ];

  proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-0KEQ03lls8ZEbhMEcKiZ1jFIbBtXnlCE/mkYHrZdWv8=";
+  vendorHash = "sha256-D260T3E0aufOAqlN918SChv3aNDCFHfe2e0It1pcPiU=";

  postInstall = ''
    installShellCompletion --cmd deck \
--- a/pkgs/applications/networking/firewalld/default.nix
+++ b/pkgs/applications/networking/firewalld/default.nix
@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "firewalld";
-  version = "2.1.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "firewalld";
    repo = "firewalld";
    rev = "v${version}";
-    sha256 = "sha256-3kP8Z8YtIcLHOFj9gqspSClsxWiefOqZlJQ5OzNZPeY=";
+    sha256 = "sha256-+EDJrHryO1pXkuKnQdh8hGyi8/TOkb3ZLulQkiaOOqs=";
  };

  patches = [
--- a/pkgs/applications/networking/instant-messengers/beeper/default.nix
+++ b/pkgs/applications/networking/instant-messengers/beeper/default.nix
@ -11,11 +11,11 @@
 }:
 let
  pname = "beeper";
-  version = "3.92.23";
+  version = "3.93.36";
  name = "${pname}-${version}";
  src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.92.23-build-240111az2vz7kii-x86_64.AppImage";
-    hash = "sha256-M+3mJ+X/yr6yONOpdnCRECbswYlSuhlqqbg2d6Px/7s=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.93.36-build-2401269p8vcb695-x86_64.AppImage";
+    hash = "sha256-3pOOAI4/BWdbWfPweRx5I2KRi9VOgJ5vcQ89FTJhPak=";
  };
  appimage = appimageTools.wrapType2 {
    inherit version pname src;
--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@ -29,7 +29,7 @@

 stdenv.mkDerivation rec {
  pname = "chatty";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
    repo = "Chatty";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-jyG6kubXTyHUw2F+MfjJiQ0us4PrbavF5PJS5Pg46Mw=";
+    hash = "sha256-5IkQnXAKl0duy/B6+z7PXYv5zxakxJCgQhWBw5wioWg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -2,7 +2,7 @@
 let
  versions =
    if stdenv.isLinux then {
-      stable = "0.0.41";
+      stable = "0.0.42";
      ptb = "0.0.66";
      canary = "0.0.257";
      development = "0.0.11";
@ -17,7 +17,7 @@ let
    x86_64-linux = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-yzCOlYIDvbhJRbiqf5NC2iBT2ezlJP81O/wtkWIEp+U=";
+        hash = "sha256-7can15JhBc6OJAWZMk8uEdt/D1orCKG1MN1WBdTZrI0=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@ -2,11 +2,11 @@

 let
  pname = "rambox";
-  version = "2.2.3";
+  version = "2.3.0";

  src = fetchurl {
    url = "https://github.com/ramboxapp/download/releases/download/v${version}/Rambox-${version}-linux-x64.AppImage";
-    sha256 = "sha256-V1Sxfgn3fcqW7t7oa1pfnrPYAqHdCLrWUbplE/I789A=";
+    sha256 = "sha256-PmTiXQp+AkTwCKisH1tR6B1+cHPx25P8FAAlLvKEb3w=";
  };

  desktopItem = (makeDesktopItem {
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
  pname = "signal-desktop";
  dir = "Signal";
-  version = "6.42.0";
+  version = "6.44.0";
  url = "https://github.com/0mniteck/Signal-Desktop-Mobian/raw/${version}/builds/release/signal-desktop_${version}_arm64.deb";
-  hash = "sha256-kr8FM+EAtL/7TrgJlI33oDd4CPGMJ+F2PpQCR4OL6j4=";
+  hash = "sha256-M4Xiy8cDQciMzgGl1/eeKZjEaelVtkk6JXJYBP4ua2s=";
 }
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix {} rec {
  pname = "signal-desktop";
  dir = "Signal";
-  version = "6.44.0";
+  version = "6.45.1";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-04KhjExUx+X2/vxSlobVOk9A50XwTlXcdVuttnUmJEw=";
+  hash = "sha256-yDXtWm+HFzqLTsa7gxy8e7ObVn7lrRewoHMyDGlmZkY=";
 }
--- a/pkgs/applications/networking/mkchromecast/default.nix
+++ b/pkgs/applications/networking/mkchromecast/default.nix
@ -70,11 +70,11 @@ python3Packages.buildPythonApplication {
  ];

  postInstall = ''
-    substituteInPlace $out/lib/${python3Packages.python.libPrefix}/site-packages/mkchromecast/video.py \
+    substituteInPlace $out/${python3Packages.python.sitePackages}/mkchromecast/video.py \
      --replace '/usr/share/mkchromecast/nodejs/' '${placeholder "out"}/share/mkchromecast/nodejs/'
  '' + lib.optionalString stdenv.isDarwin ''
    install -Dm 755 -t $out/bin bin/audiodevice
-    substituteInPlace $out/lib/${python3Packages.python.libPrefix}/site-packages/mkchromecast/audio_devices.py \
+    substituteInPlace $out/${python3Packages.python.sitePackages}/mkchromecast/audio_devices.py \
      --replace './bin/audiodevice' '${placeholder "out"}/bin/audiodevice'
  '';

--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@ -26,7 +26,7 @@

 stdenv.mkDerivation rec {
  pname = "nextcloud-client";
-  version = "3.11.0";
+  version = "3.11.1";

  outputs = [ "out" "dev" ];

@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
    owner = "nextcloud";
    repo = "desktop";
    rev = "v${version}";
-    hash = "sha256-rqSnCIsXQDf3cNQn4ofjGQkCgwYGyDau/WWUPHziNp4=";
+    hash = "sha256-gskFI6nxRb5lx6EwWuqghqg7NmCaj0JS7PpV0i4qUqQ=";
  };

  patches = [
--- a/pkgs/applications/networking/p2p/deluge/default.nix
+++ b/pkgs/applications/networking/p2p/deluge/default.nix
@ -77,7 +77,7 @@ let
        install -Dm444 -t $out/share/applications deluge/ui/data/share/applications/deluge.desktop
      '' else ''
        rm -r $out/bin/deluge-gtk
-        rm -r $out/lib/${python3Packages.python.libPrefix}/site-packages/deluge/ui/gtk3
+        rm -r $out/${python3Packages.python.sitePackages}/deluge/ui/gtk3
        rm -r $out/share/{icons,man/man1/deluge-gtk*,pixmaps}
      '');

--- a/pkgs/applications/networking/pyload-ng/declarative-default-user.patch
+++ b/pkgs/applications/networking/pyload-ng/declarative-default-user.patch
@ -0,0 +1,15 @@
+diff --git a/src/pyload/core/__init__.py b/src/pyload/core/__init__.py
+index 4324fc700..f7fcd66ec 100644
+--- a/src/pyload/core/__init__.py
+++ b/src/pyload/core/__init__.py
+@@ -46,8 +46,8 @@ class Exit(Exception):
+ #  improve external scripts
+ class Core:
+     LOCALE_DOMAIN = APPID
+-    DEFAULT_USERNAME = APPID
+-    DEFAULT_PASSWORD = APPID
+    DEFAULT_USERNAME = os.getenv("PYLOAD_DEFAULT_USERNAME", APPID)
+    DEFAULT_PASSWORD = os.getenv("PYLOAD_DEFAULT_PASSWORD", APPID)
+     DEFAULT_DATADIR = os.path.join(
+         os.getenv("APPDATA") or USERHOMEDIR, "pyLoad" if os.name == "nt" else ".pyload"
+     )
--- a/pkgs/applications/networking/pyload-ng/declarative-env-config.patch
+++ b/pkgs/applications/networking/pyload-ng/declarative-env-config.patch
@ -0,0 +1,18 @@
+diff --git a/src/pyload/core/__init__.py b/src/pyload/core/__init__.py
+index 4324fc700..5d915a85e 100644
+--- a/src/pyload/core/__init__.py
+++ b/src/pyload/core/__init__.py
+@@ -128,6 +128,13 @@ class Core:
+         else:
+             self._debug = max(0, int(debug))
+
+        # Allow setting any option declaratively, for the NixOS module
+        for env, value in os.environ.items():
+            if not env.startswith("PYLOAD__"):
+                continue
+            section, opt = env.removeprefix("PYLOAD__").lower().split("__")
+            self.config.set(section, opt, value)
+
+         # If no argument set, read storage dir from config file,
+         # otherwise save setting to config dir
+         if storagedir is None:
--- a/pkgs/applications/networking/pyload-ng/default.nix
+++ b/pkgs/applications/networking/pyload-ng/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchPypi, python3 }:
+{ lib, fetchPypi, nixosTests, python3 }:

 python3.pkgs.buildPythonApplication rec {
  version = "0.5.0b3.dev75";
@ -10,6 +10,14 @@ python3.pkgs.buildPythonApplication rec {
    hash = "sha256-1lPIKkZESonDaVCnac0iUu/gCqXVDBhNZrk5S0eC6F0=";
  };

+  patches = [
+    # Makes it possible to change the default username/password in the module
+    ./declarative-default-user.patch
+    # Makes it possible to change the configuration through environment variables
+    # in the NixOS module (aimed mostly at listen address/port)
+    ./declarative-env-config.patch
+  ];
+
  postPatch = ''
    # relax version bounds
    sed -i 's/\([A-z0-9]*\)~=.*$/\1/' setup.cfg
@ -35,14 +43,20 @@ python3.pkgs.buildPythonApplication rec {
    setuptools
  ];

-  passthru.optional-dependencies = {
-    plugins = with python3.pkgs; [
-      beautifulsoup4 # for some plugins
-      colorlog # colorful console logging
-      pillow # for some CAPTCHA plugin
-      send2trash # send some files to trash instead of deleting them
-      slixmpp # XMPP plugin
-    ];
+  passthru = {
+    optional-dependencies = {
+      plugins = with python3.pkgs; [
+        beautifulsoup4 # for some plugins
+        colorlog # colorful console logging
+        pillow # for some CAPTCHA plugin
+        send2trash # send some files to trash instead of deleting them
+        slixmpp # XMPP plugin
+      ];
+    };
+
+    tests = {
+      inherit (nixosTests) pyload;
+    };
  };

  meta = with lib; {
--- a/pkgs/applications/networking/qv2ray/default.nix
+++ b/pkgs/applications/networking/qv2ray/default.nix
@ -5,7 +5,6 @@
 , symlinkJoin
 , qttools
 , cmake
-, clang_8
 , grpc
 , protobuf
 , openssl
@ -68,8 +67,7 @@ mkDerivation rec {
    pkg-config
    qttools
    curl
-    # The default clang_7 will result in reproducible ICE.
-  ] ++ lib.optional (stdenv.isDarwin) clang_8;
+  ];

  meta = with lib; {
    description = "An GUI frontend to v2ray";
--- a/pkgs/applications/networking/seahub/default.nix
+++ b/pkgs/applications/networking/seahub/default.nix
@ -6,29 +6,22 @@
 , nixosTests
 }:
 let
-  # Seahub 8.x.x does not support django-webpack-loader >=1.x.x
  python = python3.override {
    packageOverrides = self: super: {
-      django-webpack-loader = super.django-webpack-loader.overridePythonAttrs (old: rec {
-        version = "0.7.0";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-ejyIIBqlRIH5OZRlYVy+e5rs6AgUlqbQKHt8uOIy9Ec=";
-        };
-      });
+      django = super.django_3;
    };
  };
 in
 python.pkgs.buildPythonApplication rec {
  pname = "seahub";
-  version = "9.0.10";
+  version = "10.0.1";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "haiwen";
    repo = "seahub";
-    rev = "5971bf25fe67d94ec4d9f53b785c15a098113620"; # using a fixed revision because upstream may re-tag releases :/
-    sha256 = "sha256-7Exvm3EShb/1EqwA4wzWB9zCdv0P/ISmjKSoqtOMnqk=";
+    rev = "e8c02236c0eaca6dde009872745f089da4b77e6e"; # using a fixed revision because upstream may re-tag releases :/
+    sha256 = "sha256-7JXWKEFqCsC+ZByhvyP8AmDpajT3hpgyYDNUqc3wXyg=";
  };

  patches = [
--- a/pkgs/applications/office/libreoffice/darwin/default.nix
+++ b/pkgs/applications/office/libreoffice/darwin/default.nix
@ -75,6 +75,7 @@ stdenvNoCC.mkDerivation {
    homepage = "https://libreoffice.org/";
    license = licenses.lgpl3;
    maintainers = with maintainers; [ tricktron ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    platforms = [ "x86_64-darwin" "aarch64-darwin" ];
  };
 }
--- a/pkgs/applications/office/paperwork/paperwork-gtk.nix
+++ b/pkgs/applications/office/paperwork/paperwork-gtk.nix
@ -64,7 +64,7 @@ python3Packages.buildPythonApplication rec {
    # fixes [WARNING] [openpaperwork_core.resources.setuptools] Failed to find
    # resource file paperwork_gtk.icon.out/paperwork_128.png, tried at path
    # /nix/store/3n5lz6y8k9yks76f0nar3smc8djan3xr-paperwork-2.0.2/lib/python3.8/site-packages/paperwork_gtk/icon/out/paperwork_128.png.
-    site=$out/lib/${python3Packages.python.libPrefix}/site-packages/paperwork_gtk
+    site=$out/${python3Packages.python.sitePackages}/paperwork_gtk
    for i in $site/data/paperwork_*.png; do
      ln -s $i $site/icon/out;
    done
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -19,14 +19,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "24.1.4";
+  version = "24.1.5";
 in
 stdenv.mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-RWAg89rbmoOSzOu9YjAkDluyPiYjT6f8gmri5AAHyww=";
+    hash = "sha256-iw3MdsS1i7B8RXZk2GXwiOReSUC1IX5z0MTEk9B4nMM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@ -153,5 +153,6 @@ stdenv.mkDerivation rec {
    license = licenses.agpl3Only;
    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ i077 ];
+    mainProgram = "zotero";
  };
 }
--- a/pkgs/applications/radio/gnuradio/3.8.nix
+++ b/pkgs/applications/radio/gnuradio/3.8.nix
@ -244,6 +244,8 @@ stdenv.mkDerivation (finalAttrs: (shared // {
    rm gr-fec/python/fec/qa_polar_encoder.py
    rm gr-fec/python/fec/qa_polar_encoder_systematic.py
    rm gr-filter/python/filter/qa_freq_xlating_fft_filter.py
+    # Failed with libstdc++ from GCC 13
+    rm gr-filter/python/filter/qa_filterbank.py
  '';
  patches = [
    # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
--- a/pkgs/applications/radio/gnuradio/3.9.nix
+++ b/pkgs/applications/radio/gnuradio/3.9.nix
@ -1,4 +1,5 @@
 { lib, stdenv
+, fetchpatch
 , fetchFromGitHub
 , cmake
 # Remove gcc and python references
@ -277,6 +278,11 @@ stdenv.mkDerivation (finalAttrs: (shared // {
  patches = [
    # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
    ./modtool-newmod-permissions.3_9.patch
+    # Fix compilation with GCC 13
+    (fetchpatch {
+      url = "https://github.com/gnuradio/gnuradio/commit/fe1b3592776c26e349e9985d47d3178568dfe6ec.patch";
+      hash = "sha256-bu6fJuUo/i4kM+cZqSw8moB0ymoSVooLfwUIW+WDpWI=";
+    })
  ];
  passthru = shared.passthru // {
    # Deps that are potentially overridden and are used inside GR plugins - the same version must
--- a/pkgs/applications/science/biology/deeptools/default.nix
+++ b/pkgs/applications/science/biology/deeptools/default.nix
@ -1,19 +1,25 @@
-{ lib, python, fetchFromGitHub }:
-with python.pkgs;
-buildPythonApplication rec {
-  pname = "deepTools";
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "deeptools";
  version = "3.5.4";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "deeptools";
    repo = "deepTools";
    rev = version;
-    sha256 = "sha256-A8YdlMptmJyxWW0EYLjXFIWjIO/mttEC7VYdlCe9MaI=";
+    hash = "sha256-A8YdlMptmJyxWW0EYLjXFIWjIO/mttEC7VYdlCe9MaI=";
  };

-  format = "pyproject";
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3.pkgs; [
    numpy
    numpydoc
    scipy
@ -26,7 +32,21 @@ buildPythonApplication rec {
    importlib-metadata
  ];

-  nativeCheckInputs = [ pytest ];
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export PATH="$out/bin:$PATH"
+  '';
+
+  disabledTestPaths = [
+    # tests trip on `len(sys.argv) == 1`
+    "deeptools/test/test_bigwigAverage.py"
+    "deeptools/test/test_bigwigCompare_and_multiBigwigSummary.py"
+    "deeptools/test/test_heatmapper.py"
+    "deeptools/test/test_multiBamSummary.py"
+  ];

  meta = with lib; {
    homepage = "https://deeptools.readthedocs.io/en/develop";
--- a/pkgs/applications/science/biology/obitools/obitools3.nix
+++ b/pkgs/applications/science/biology/obitools/obitools3.nix
@ -17,8 +17,8 @@ python3Packages.buildPythonApplication rec {
  '';

  preBuild = ''
-    substituteInPlace src/CMakeLists.txt --replace \$'{PYTHONLIB}' "$out/lib/${python3.libPrefix}/site-packages";
-    export NIX_CFLAGS_COMPILE="-L $out/lib/${python3.libPrefix}/site-packages $NIX_CFLAGS_COMPILE"
+    substituteInPlace src/CMakeLists.txt --replace \$'{PYTHONLIB}' "$out/${python3.sitePackages}";
+    export NIX_CFLAGS_COMPILE="-L $out/${python3.sitePackages} $NIX_CFLAGS_COMPILE"
  '';

  dontConfigure = true;
--- a/pkgs/applications/science/chemistry/mopac/default.nix
+++ b/pkgs/applications/science/chemistry/mopac/default.nix
@ -12,13 +12,13 @@ assert blas.isILP64 == lapack.isILP64;

 stdenv.mkDerivation rec {
  pname = "mopac";
-  version = "22.1.0";
+  version = "22.1.1";

  src = fetchFromGitHub {
    owner = "openmopac";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-4jQ0WCHK07CXWUPj5Z1zSXObKxnitMj+FJQbLDiS2Dc=";
+    hash = "sha256-tdVb/u89EBggfG3Ofz1ICBE2ug4fbMsUWAILwJP9Ito=";
  };

  nativeBuildInputs = [ gfortran cmake ];
--- a/pkgs/applications/science/chemistry/octopus/default.nix
+++ b/pkgs/applications/science/chemistry/octopus/default.nix
@ -1,5 +1,23 @@
-{ lib, stdenv, fetchFromGitLab, gfortran, which, perl, procps
-, libyaml, libxc, fftw, blas, lapack, gsl, netcdf, arpack, autoreconfHook
+{ lib
+, stdenv
+, fetchFromGitLab
+, gfortran
+, which
+, perl
+, procps
+, libvdwxc
+, libyaml
+, libxc
+, fftw
+, blas
+, lapack
+, gsl
+, netcdf
+, arpack
+, autoreconfHook
+, scalapack
+, mpi
+, enableMpi ? true
 , python3
 , enableFma ? stdenv.hostPlatform.fmaSupport
 , enableFma4 ? stdenv.hostPlatform.fma4Support
@ -38,8 +56,12 @@ stdenv.mkDerivation rec {
    fftw
    netcdf
    arpack
+    libvdwxc
    (python3.withPackages (ps: [ ps.pyyaml ]))
-  ];
+  ] ++ lib.optional enableMpi scalapack;
+
+  propagatedBuildInputs = lib.optional enableMpi mpi;
+  propagatedUserEnvPkgs = lib.optional enableMpi mpi;

  configureFlags = with lib; [
    "--with-yaml-prefix=${lib.getDev libyaml}"
@ -48,12 +70,22 @@ stdenv.mkDerivation rec {
    "--with-fftw-prefix=${lib.getDev fftw}"
    "--with-gsl-prefix=${lib.getDev gsl}"
    "--with-libxc-prefix=${lib.getDev libxc}"
+    "--with-libvdwxc"
    "--enable-openmp"
-  ] ++ optional enableFma "--enable-fma3"
-    ++ optional enableFma4 "--enable-fma4"
-    ++ optional enableAvx "--enable-avx"
-    ++ optional enableAvx512 "--enable-avx512";
+  ]
+  ++ optional enableFma "--enable-fma3"
+  ++ optional enableFma4 "--enable-fma4"
+  ++ optional enableAvx "--enable-avx"
+  ++ optional enableAvx512 "--enable-avx512"
+  ++ optionals enableMpi [
+    "--enable-mpi"
+    "--with-scalapack=-lscalapack"
+    "CC=mpicc"
+    "FC=mpif90"
+  ];

+
+  nativeCheckInputs = lib.optional.enableMpi mpi;
  doCheck = false;
  checkTarget = "check-short";

@ -67,6 +99,8 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  passthru = lib.attrsets.optionalAttrs enableMpi { inherit mpi; };
+
  meta = with lib; {
    description = "Real-space time dependent density-functional theory code";
    homepage = "https://octopus-code.org";
--- a/pkgs/applications/science/electronics/kicad/versions.nix
+++ b/pkgs/applications/science/electronics/kicad/versions.nix
@ -3,23 +3,23 @@
 {
  "kicad" = {
    kicadVersion = {
-      version =			"7.0.9";
+      version =			"7.0.10";
      src = {
-        rev =			"1c81053cc40579ecd5febef1aeb1164008039deb";
-        sha256 =		"1hq9rba1gcks14zwbr8nbicpsil4imslgfch6ll33fhizbks3fq4";
+        rev =			"7daac78752749fc919e932be6156914aa83c926f";
+        sha256 =		"0z459yi0s02mwdgbr3xxw43gn9yjhvfkjnsxmns5mksgzsr5nmhh";
      };
    };
    libVersion = {
-      version =			"7.0.9";
+      version =			"7.0.10";
      libSources = {
-        symbols.rev =		"1ed4ed6c0696e50165b8e3d7978136a05db2d7c3";
-        symbols.sha256 =	"0ynsnjq3z126cjkgm1fjbjvdvpc0walnr42ya9dv46l27kxy2j77";
-        templates.rev =		"856bacc6782ea8c9bcb5a49a2d438a4689e0579b";
-        templates.sha256 =	"11582ldnv7hkljmhaym83962kixq1hjbfmdrn5laq7l4jk3l19vh";
-        footprints.rev =	"fe7b9aec7635caabbaa85fa8a15b85038394099b";
-        footprints.sha256 =	"16a4c2xs4i8wbm01a901yxabxk0qdsjkzlccfawddv82bkh4b87h";
-        packages3d.rev =	"5bc66f3c0f6dabf09df6c5188b8d955968500eab";
-        packages3d.sha256 =	"1cly28vc07i54v487zbb8d1h70nrd3naxvq146b0xnbrjwnd2q28";
+        symbols.rev =		"eedf6c9ddac2816023e817d4dc91032f9d7390b9";
+        symbols.sha256 =	"0nlgmxf9z1vf4g350dfkxql1dawgmw275wqxkgszsfxmhdfpmi9v";
+        templates.rev =		"9ce98cc45f3778e05c404edebf0f98de5c247ffe";
+        templates.sha256 =	"0mykfwwik7472i4r0isc5szj3dnmvd0538p0vlmzh4rcgj3pj3vm";
+        footprints.rev =	"7061fc9847ecc1b838e60dc6826db534028494f6";
+        footprints.sha256 =	"1az6fzh1lma71mj12bc4bblnmzjayrxhkb8w9rjvlhvvgv33cdmy";
+        packages3d.rev =	"d7345b34daaa23acf0d4506ed937fb424b5b18cd";
+        packages3d.sha256 =	"0xzyi4mgyifwc6dppdzh6jq294mkj0a71cwkqw2ymz1kfbksw626";
      };
    };
  };
--- a/pkgs/applications/science/logic/btor2tools/default.nix
+++ b/pkgs/applications/science/logic/btor2tools/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, cmake, fetchFromGitHub, fixDarwinDylibNames }:
+{ lib, stdenv, cmake, fetchFromGitHub, fetchpatch, fixDarwinDylibNames }:

 stdenv.mkDerivation rec {
  pname = "btor2tools";
@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
    sha256 = "0mfqmkgvyw8fa2c09kww107dmk180ch1hp98r5kv41vnc04iqb0s";
  };

+  patches = [
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/Boolector/btor2tools/commit/037f1fa88fb439dca6f648ad48a3463256d69d8b.patch";
+      hash = "sha256-FX1yy9XdUs1tAReOxhEzNHu48DrISzNNMSYoIrhHoFY=";
+    })
+  ];
+
  nativeBuildInputs = [ cmake ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;

  installPhase = ''
--- a/pkgs/applications/science/logic/egglog/Cargo.lock
+++ b/pkgs/applications/science/logic/egglog/Cargo.lock
@ -4,9 +4,9 @@ version = 3

 [[package]]
 name = "ahash"
-version = "0.7.6"
+version = "0.7.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+checksum = "5a824f2aa7e75a0c98c5a504fceb80649e9c35265d44525b5f94de4771a395cd"
 dependencies = [
 "getrandom",
 "once_cell",
@ -15,56 +15,56 @@ dependencies = [

 [[package]]
 name = "ahash"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
+checksum = "91429305e9f0a25f6205c5b8e0d2db09e0708a7a6df0f42212bb56c32c8ac97a"
 dependencies = [
 "cfg-if 1.0.0",
 "once_cell",
 "version_check",
+ "zerocopy",
 ]

 [[package]]
 name = "aho-corasick"
-version = "1.0.2"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43f6cb1bf222025340178f382c426f13757b2960e89779dfcb319c32542a5a41"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
 "memchr",
 ]

 [[package]]
 name = "allocator-api2"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56fc6cf8dc8c4158eed8649f9b8b0ea1518eb62b544fe9490d66fa0b349eafe9"
+checksum = "0942ffc6dcaadf03badf6e6a2d0228460359d5e34b57ccdc720b7382dfbd5ec5"

 [[package]]
 name = "anstream"
-version = "0.3.2"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ca84f3628370c59db74ee214b3263d58f9aadd9b4fe7e711fd87dc452b7f163"
+checksum = "2ab91ebe16eb252986481c5b62f6098f3b698a45e34b5b98200cf20dd2484a44"
 dependencies = [
 "anstyle",
 "anstyle-parse",
 "anstyle-query",
 "anstyle-wincon",
 "colorchoice",
- "is-terminal",
 "utf8parse",
 ]

 [[package]]
 name = "anstyle"
-version = "1.0.1"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a30da5c5f2d5e72842e00bcb57657162cdabef0931f40e2deb9b4140440cecd"
+checksum = "7079075b41f533b8c61d2a4d073c4676e1f8b249ff94a393b0595db304e0dd87"

 [[package]]
 name = "anstyle-parse"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "938874ff5980b03a87c5524b3ae5b59cf99b1d6bc836848df7bc5ada9643c333"
+checksum = "317b9a89c1868f5ea6ff1d9539a69f45dffc21ce321ac1fd1160dfa48c8e2140"
 dependencies = [
 "utf8parse",
 ]
@ -80,9 +80,9 @@ dependencies = [

 [[package]]
 name = "anstyle-wincon"
-version = "1.0.1"
+version = "3.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "180abfa45703aebe0093f79badacc01b8fd4ea2e35118747e5811127f926e188"
+checksum = "f0699d10d2f4d628a98ee7b57b289abbc98ff3bad977cb3152709d4bf2330628"
 dependencies = [
 "anstyle",
 "windows-sys",
@ -126,9 +126,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"

 [[package]]
 name = "bitflags"
-version = "2.3.3"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630be753d4e58660abd17930c71b647fe46c27ea6b63cc59e1e3851406972e42"
+checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"

 [[package]]
 name = "block-buffer"
@ -141,15 +141,9 @@ dependencies = [

 [[package]]
 name = "bumpalo"
-version = "3.13.0"
+version = "3.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3e2c3daef883ecc1b5d58c15adae93470a91d425f3532ba1695849656af3fc1"
-
-[[package]]
-name = "cc"
-version = "1.0.79"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"

 [[package]]
 name = "cfg-if"
@ -165,20 +159,19 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"

 [[package]]
 name = "clap"
-version = "4.3.11"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1640e5cc7fb47dbb8338fd471b105e7ed6c3cb2aeb00c2e067127ffd3764a05d"
+checksum = "ac495e00dcec98c83465d5ad66c5c4fabd652fd6686e7c6269b117e729a6f17b"
 dependencies = [
 "clap_builder",
 "clap_derive",
- "once_cell",
 ]

 [[package]]
 name = "clap_builder"
-version = "4.3.11"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98c59138d527eeaf9b53f35a77fcc1fad9d883116070c63d5de1c7dc7b00c72b"
+checksum = "c77ed9a32a62e6ca27175d00d29d05ca32e396ea1eb5fb01d8256b669cec7663"
 dependencies = [
 "anstream",
 "anstyle",
@ -188,21 +181,21 @@ dependencies = [

 [[package]]
 name = "clap_derive"
-version = "4.3.2"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8cd2b2a819ad6eec39e8f1d6b53001af1e5469f8c177579cdaeb313115b825f"
+checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
 dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn 2.0.25",
+ "syn 2.0.38",
 ]

 [[package]]
 name = "clap_lex"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2da6da31387c7e4ef160ffab6d5e7f00c42626fe39aea70a7b0f1773f7dd6c1b"
+checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"

 [[package]]
 name = "colorchoice"
@ -222,9 +215,9 @@ dependencies = [

 [[package]]
 name = "cpufeatures"
-version = "0.2.9"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
+checksum = "ce420fe07aecd3e67c5f910618fe65e94158f6dcc0adf44e00d69ce2bdfe0fd0"
 dependencies = [
 "libc",
 ]
@ -304,10 +297,11 @@ dependencies = [
 "clap",
 "egraph-serialize",
 "env_logger",
+ "generic_symbolic_expressions",
 "getrandom",
 "glob",
- "hashbrown 0.14.0",
- "indexmap 2.0.0",
+ "hashbrown 0.14.2",
+ "indexmap",
 "instant",
 "lalrpop",
 "lalrpop-util",
@ -323,17 +317,17 @@ dependencies = [
 "serde_json",
 "smallvec",
 "symbol_table",
- "symbolic_expressions",
 "thiserror",
 ]

 [[package]]
 name = "egraph-serialize"
 version = "0.1.0"
-source = "git+https://github.com/egraphs-good/egraph-serialize?rev=e406ffcec8c6e841089fd3e4f9b76c35ce448950#e406ffcec8c6e841089fd3e4f9b76c35ce448950"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a41150f383849cfc16ae6230f592112b3c0a2c0e3ec43eb0b09db037bfcce703"
 dependencies = [
 "graphviz-rust",
- "indexmap 2.0.0",
+ "indexmap",
 "once_cell",
 "ordered-float",
 "serde",
@ -342,9 +336,9 @@ dependencies = [

 [[package]]
 name = "either"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"

 [[package]]
 name = "ena"
@ -376,30 +370,19 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"

 [[package]]
 name = "errno"
-version = "0.3.1"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
+checksum = "ac3e13f66a2f95e32a39eaa81f6b95d42878ca0e1db0c7543723dfe12557e860"
 dependencies = [
- "errno-dragonfly",
 "libc",
 "windows-sys",
 ]

-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
-
 [[package]]
 name = "fastrand"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6999dc1837253364c2ebb0704ba97994bd874e8f195d665c50b7548f6ea92764"
+checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"

 [[package]]
 name = "fixedbitset"
@ -417,6 +400,11 @@ dependencies = [
 "version_check",
 ]

+[[package]]
+name = "generic_symbolic_expressions"
+version = "5.0.3"
+source = "git+https://github.com/oflatt/symbolic-expressions?rev=655b6a4c06b4b3d3b2300e17779860b4abe440f0#655b6a4c06b4b3d3b2300e17779860b4abe440f0"
+
 [[package]]
 name = "getrandom"
 version = "0.2.10"
@ -458,16 +446,16 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 dependencies = [
- "ahash 0.7.6",
+ "ahash 0.7.7",
 ]

 [[package]]
 name = "hashbrown"
-version = "0.14.0"
+version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
+checksum = "f93e7192158dbcda357bdec5fb5788eebf8bbac027f3f33e719d29135ae84156"
 dependencies = [
- "ahash 0.8.3",
+ "ahash 0.8.6",
 "allocator-api2",
 ]

@ -479,9 +467,9 @@ checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"

 [[package]]
 name = "hermit-abi"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
+checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"

 [[package]]
 name = "humantime"
@ -491,22 +479,12 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"

 [[package]]
 name = "indexmap"
-version = "1.9.3"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5477fe2230a79769d8dc68e0eabf5437907c0457a5614a9e8dddb67f65eb65d"
+checksum = "8adf3ddd720272c6ea8bf59463c04e0f93d0bbf7c5439b691bca2987e0270897"
 dependencies = [
 "equivalent",
- "hashbrown 0.14.0",
+ "hashbrown 0.14.2",
 "serde",
 ]

@ -595,7 +573,7 @@ dependencies = [
 "petgraph",
 "pico-args",
 "regex",
- "regex-syntax",
+ "regex-syntax 0.7.5",
 "string_cache",
 "term",
 "tiny-keccak",
@ -619,9 +597,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"

 [[package]]
 name = "libc"
-version = "0.2.147"
+version = "0.2.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"

 [[package]]
 name = "libtest-mimic"
@ -636,15 +614,15 @@ dependencies = [

 [[package]]
 name = "linux-raw-sys"
-version = "0.4.3"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09fc20d2ca12cb9f044c93e3bd6d32d523e6e2ec3db4f7b2939cd99026ecd3f0"
+checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"

 [[package]]
 name = "lock_api"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
 dependencies = [
 "autocfg",
 "scopeguard",
@ -652,15 +630,15 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b06a4cde4c0f271a446782e3eff8de789548ce57dbc8eca9292c27f4a42004b4"
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"

 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"

 [[package]]
 name = "memory_units"
@ -676,9 +654,9 @@ checksum = "e4a24736216ec316047a1fc4252e27dabb04218aa4a3f37c6e7ddbf1f9782b54"

 [[package]]
 name = "num-bigint"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f93ab6289c7b344a8a9f60f88d80aa20032336fe78da341afc91c8a2341fc75f"
+checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
 dependencies = [
 "autocfg",
 "num-integer",
@ -709,9 +687,9 @@ dependencies = [

 [[package]]
 name = "num-traits"
-version = "0.2.15"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
 dependencies = [
 "autocfg",
 ]
@ -734,9 +712,9 @@ checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"

 [[package]]
 name = "ordered-float"
-version = "3.7.0"
+version = "3.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fc2dbde8f8a79f2102cc474ceb0ad68e3b80b85289ea62389b60e66777e4213"
+checksum = "f1e1c390732d15f1d48471625cd92d154e66db2c56645e29a9cd26f4699f72dc"
 dependencies = [
 "num-traits",
 "rand",
@ -755,32 +733,33 @@ dependencies = [

 [[package]]
 name = "parking_lot_core"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
 dependencies = [
 "cfg-if 1.0.0",
 "libc",
- "redox_syscall 0.3.5",
+ "redox_syscall 0.4.1",
 "smallvec",
 "windows-targets",
 ]

 [[package]]
 name = "pest"
-version = "2.7.2"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1acb4a4365a13f749a93f1a094a7805e5cfa0955373a9de860d962eaa3a5fe5a"
+checksum = "ae9cee2a55a544be8b89dc6848072af97a20f2422603c10865be2a42b580fff5"
 dependencies = [
+ "memchr",
 "thiserror",
 "ucd-trie",
 ]

 [[package]]
 name = "pest_derive"
-version = "2.7.2"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "666d00490d4ac815001da55838c500eafb0320019bbaa44444137c48b443a853"
+checksum = "81d78524685f5ef2a3b3bd1cafbc9fcabb036253d9b1463e726a91cd16e2dfc2"
 dependencies = [
 "pest",
 "pest_generator",
@ -788,22 +767,22 @@ dependencies = [

 [[package]]
 name = "pest_generator"
-version = "2.7.2"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ca01446f50dbda87c1786af8770d535423fa8a53aec03b8f4e3d7eb10e0929"
+checksum = "68bd1206e71118b5356dae5ddc61c8b11e28b09ef6a31acbd15ea48a28e0c227"
 dependencies = [
 "pest",
 "pest_meta",
 "proc-macro2",
 "quote",
- "syn 2.0.25",
+ "syn 2.0.38",
 ]

 [[package]]
 name = "pest_meta"
-version = "2.7.2"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56af0a30af74d0445c0bf6d9d051c979b516a1a5af790d251daee76005420a48"
+checksum = "7c747191d4ad9e4a4ab9c8798f1e82a39affe7ef9648390b7e5548d18e099de6"
 dependencies = [
 "once_cell",
 "pest",
@ -812,12 +791,12 @@ dependencies = [

 [[package]]
 name = "petgraph"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dd7d28ee937e54fe3080c91faa1c3a46c06de6252988a7f4592ba2310ef22a4"
+checksum = "e1d3afd2628e69da2be385eb6f2fd57c8ac7977ceeff6dc166ff1657b0e386a9"
 dependencies = [
 "fixedbitset",
- "indexmap 1.9.3",
+ "indexmap",
 ]

 [[package]]
@ -849,18 +828,18 @@ checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"

 [[package]]
 name = "proc-macro2"
-version = "1.0.64"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78803b62cbf1f46fde80d7c0e803111524b9877184cfe7c3033659490ac7a7da"
+checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
 dependencies = [
 "unicode-ident",
 ]

 [[package]]
 name = "quote"
-version = "1.0.29"
+version = "1.0.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "573015e8ab27661678357f27dc26460738fd2b6c86e46f386fde94cb5d913105"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
 dependencies = [
 "proc-macro2",
 ]
@ -908,9 +887,9 @@ dependencies = [

 [[package]]
 name = "redox_syscall"
-version = "0.3.5"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
 "bitflags 1.3.2",
 ]
@ -928,32 +907,38 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.9.1"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2eae68fc220f7cf2532e4494aded17545fce192d59cd996e0fe7887f4ceb575"
+checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
 dependencies = [
 "aho-corasick",
 "memchr",
 "regex-automata",
- "regex-syntax",
+ "regex-syntax 0.8.2",
 ]

 [[package]]
 name = "regex-automata"
-version = "0.3.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83d3daa6976cffb758ec878f108ba0e062a45b2d6ca3a2cca965338855476caf"
+checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
 dependencies = [
 "aho-corasick",
 "memchr",
- "regex-syntax",
+ "regex-syntax 0.8.2",
 ]

 [[package]]
 name = "regex-syntax"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5ea92a5b6195c6ef2a0295ea818b312502c6fc94dde986c5553242e18fd4ce2"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"

 [[package]]
 name = "rustc-hash"
@ -963,11 +948,11 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"

 [[package]]
 name = "rustix"
-version = "0.38.4"
+version = "0.38.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a962918ea88d644592894bc6dc55acc6c0956488adcebbfb6e273506b7fd6e5"
+checksum = "2b426b0506e5d50a7d8dafcf2e81471400deb602392c7dd110815afb4eaf02a3"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.1",
 "errno",
 "libc",
 "linux-raw-sys",
@ -976,9 +961,9 @@ dependencies = [

 [[package]]
 name = "rustversion"
-version = "1.0.13"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc31bd9b61a32c31f9650d18add92aa83a49ba979c143eefd27fe7177b05bd5f"
+checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"

 [[package]]
 name = "ryu"
@ -988,37 +973,37 @@ checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"

 [[package]]
 name = "scopeguard"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

 [[package]]
 name = "serde"
-version = "1.0.171"
+version = "1.0.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30e27d1e4fd7659406c492fd6cfaf2066ba8773de45ca75e855590f856dc34a9"
+checksum = "91d3c334ca1ee894a2c6f6ad698fe8c435b76d504b13d436f0685d648d6d96f7"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.171"
+version = "1.0.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389894603bd18c46fa56231694f8d827779c0951a667087194cf9de94ed24682"
+checksum = "67c5609f394e5c2bd7fc51efda478004ea80ef42fee983d5c67a65e34f32c0e3"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.25",
+ "syn 2.0.38",
 ]

 [[package]]
 name = "serde_json"
-version = "1.0.103"
+version = "1.0.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d03b412469450d4404fe8499a268edd7f8b79fecb074b0d812ad64ca21f4031b"
+checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
 dependencies = [
- "indexmap 2.0.0",
+ "indexmap",
 "itoa",
 "ryu",
 "serde",
@ -1026,9 +1011,9 @@ dependencies = [

 [[package]]
 name = "sha2"
-version = "0.10.7"
+version = "0.10.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479fb9d862239e610720565ca91403019f2f00410f1864c5aa7479b950a76ed8"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
 dependencies = [
 "cfg-if 1.0.0",
 "cpufeatures",
@ -1037,15 +1022,15 @@ dependencies = [

 [[package]]
 name = "siphasher"
-version = "0.3.10"
+version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bd3e3206899af3f8b12af284fafc038cc1dc2b41d1b89dd17297221c5d225de"
+checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"

 [[package]]
 name = "smallvec"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
+checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"

 [[package]]
 name = "string_cache"
@ -1068,18 +1053,14 @@ checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"

 [[package]]
 name = "symbol_table"
-version = "0.2.0"
-source = "git+https://github.com/mwillsey/symbol_table?rev=acddcf8938d1b4ed2fce048c9d83c30203d404b9#acddcf8938d1b4ed2fce048c9d83c30203d404b9"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "828f672b631c220bf6ea8a1d3b82c7d0fc998e5ba8373383d8604bc1e2a6245a"
 dependencies = [
- "ahash 0.7.6",
+ "ahash 0.7.7",
 "hashbrown 0.12.3",
 ]

-[[package]]
-name = "symbolic_expressions"
-version = "5.0.3"
-source = "git+https://github.com/oflatt/symbolic-expressions?rev=4c0ea5ca008f972450b2af72387e64d2c1c6a791#4c0ea5ca008f972450b2af72387e64d2c1c6a791"
-
 [[package]]
 name = "syn"
 version = "1.0.109"
@ -1093,9 +1074,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "2.0.25"
+version = "2.0.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15e3fc8c0c74267e2df136e5e5fb656a464158aa57624053375eb9c8c6e25ae2"
+checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
 dependencies = [
 "proc-macro2",
 "quote",
@ -1104,13 +1085,13 @@ dependencies = [

 [[package]]
 name = "tempfile"
-version = "3.7.1"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc02fddf48964c42031a0b3fe0428320ecf3a73c401040fc0096f97794310651"
+checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
 dependencies = [
 "cfg-if 1.0.0",
 "fastrand",
- "redox_syscall 0.3.5",
+ "redox_syscall 0.4.1",
 "rustix",
 "windows-sys",
 ]
@ -1128,31 +1109,31 @@ dependencies = [

 [[package]]
 name = "termcolor"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
+checksum = "6093bad37da69aab9d123a8091e4be0aa4a03e4d601ec641c327398315f62b64"
 dependencies = [
 "winapi-util",
 ]

 [[package]]
 name = "thiserror"
-version = "1.0.43"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a35fc5b8971143ca348fa6df4f024d4d55264f3468c71ad1c2f365b0a4d58c42"
+checksum = "f9a7210f5c9a7156bb50aa36aed4c95afb51df0df00713949448cf9e97d382d2"
 dependencies = [
 "thiserror-impl",
 ]

 [[package]]
 name = "thiserror-impl"
-version = "1.0.43"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "463fe12d7993d3b327787537ce8dd4dfa058de32fc2b195ef3cde03dc4771e8f"
+checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.25",
+ "syn 2.0.38",
 ]

 [[package]]
@ -1175,9 +1156,9 @@ dependencies = [

 [[package]]
 name = "typenum"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"

 [[package]]
 name = "ucd-trie"
@ -1187,9 +1168,9 @@ checksum = "ed646292ffc8188ef8ea4d1e0e0150fb15a5c2e12ad9b8fc191ae7a8a7f3c4b9"

 [[package]]
 name = "unicode-ident"
-version = "1.0.10"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22049a19f4a68748a168c0fc439f9516686aa045927ff767eca0a85101fb6e73"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"

 [[package]]
 name = "unicode-xid"
@ -1236,7 +1217,7 @@ dependencies = [
 "once_cell",
 "proc-macro2",
 "quote",
- "syn 2.0.25",
+ "syn 2.0.38",
 "wasm-bindgen-shared",
 ]

@ -1258,7 +1239,7 @@ checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.25",
+ "syn 2.0.38",
 "wasm-bindgen-backend",
 "wasm-bindgen-shared",
 ]
@ -1334,9 +1315,9 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"

 [[package]]
 name = "winapi-util"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
 dependencies = [
 "winapi",
 ]
@ -1358,9 +1339,9 @@ dependencies = [

 [[package]]
 name = "windows-targets"
-version = "0.48.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05d4b17490f70499f20b9e791dcf6a299785ce8af4d709018206dc5b4953e95f"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
 "windows_aarch64_gnullvm",
 "windows_aarch64_msvc",
@ -1373,42 +1354,62 @@ dependencies = [

 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"

 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"

 [[package]]
 name = "windows_i686_gnu"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"

 [[package]]
 name = "windows_i686_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"

 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"

 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"

 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "zerocopy"
+version = "0.7.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd66a62464e3ffd4e37bd09950c2b9dd6c4f8767380fabba0d523f9a775bc85a"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "255c4596d41e6916ced49cfafea18727b24d67878fa180ddfd69b9df34fd1726"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.38",
+]
--- a/pkgs/applications/science/logic/egglog/default.nix
+++ b/pkgs/applications/science/logic/egglog/default.nix
@ -5,21 +5,21 @@

 rustPlatform.buildRustPackage {
  pname = "egglog";
-  version = "unstable-2023-09-12";
+  version = "0-unstable-2024-01-26";

  src = fetchFromGitHub {
    owner = "egraphs-good";
    repo = "egglog";
-    rev = "4d67f262a6f27aa5cfb62a2cfc7df968959105df";
-    hash = "sha256-1mc7dW2pgaK4D7ZmlSHohb+6lcr7M9SRLUV/Dod8Rv0=";
+    rev = "b78f69ca1f7187c363bb31271c8e8958f477f15d";
+    hash = "sha256-/1ktyz8wU1yLTdAFPnupK6jUFjiK6nQfotGRNOWiOsA=";
  };

+  useNextest = true;
+
  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "egraph-serialize-0.1.0" = "sha256-sdkn7lmtmbLwAopabLWkrD6GjM3LIHseysuvwPz26G4=";
-      "symbol_table-0.2.0" = "sha256-f9UclMOUig+N5L3ibBXou0pJ4S/CQqtaji7tnebVbis=";
-      "symbolic_expressions-5.0.3" = "sha256-mSxnhveAItlTktQC4hM8o6TYjgtCUgkdZj7i6MR4Oeo=";
+      "generic_symbolic_expressions-5.0.3" = "sha256-UX6fS470YJMdNnn0GR3earMGQK3p/YvaFia7IEvGGKg=";
    };
  };

--- a/pkgs/applications/science/logic/z3/default.nix
+++ b/pkgs/applications/science/logic/z3/default.nix
@ -89,8 +89,8 @@ let common = { version, sha256, patches ? [ ], tag ? "z3" }:
 in
 {
  z3_4_12 = common {
-    version = "4.12.4";
-    sha256 = "sha256-cxl7D47dRn+uMVOHbF0avj5+ZFWjaJ7lXj/8l6r9q2I=";
+    version = "4.12.5";
+    sha256 = "sha256-Qj9w5s02OSMQ2qA7HG7xNqQGaUacA1d4zbOHynq5k+A=";
  };
  z3_4_11 = common {
    version = "4.11.2";
--- a/Show More
+++ b/Show More