Merge master into staging-next

2024-11-24 07:53:19 +00:00 · 2023-07-08 12:01:04 +00:00 · 2023-07-08 12:01:04 +00:00 · 3ab86b3cfa
commit 3ab86b3cfa
parent cc1af72ece 49413e25e0
92 changed files with 2256 additions and 2179 deletions
--- a/doc/builders/special/fhs-environments.section.md
+++ b/doc/builders/special/fhs-environments.section.md
@ -11,6 +11,8 @@ Accepted arguments are:
        Packages to be installed for the main host's architecture (i.e. x86_64 on x86_64 installations). Along with libraries binaries are also installed.
 - `multiPkgs`
        Packages to be installed for all architectures supported by a host (i.e. i686 and x86_64 on x86_64 installations). Only libraries are installed by default.
+- `multiArch`
+        Whether to install 32bit multiPkgs into the FHSEnv in 64bit environments
 - `extraBuildCommands`
        Additional commands to be executed for finalizing the directory structure.
 - `extraBuildCommandsMulti`
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@ -196,12 +196,14 @@ buildNpmPackage rec {
 * `npmDepsHash`: The output hash of the dependencies for this project. Can be calculated in advance with [`prefetch-npm-deps`](#javascript-buildNpmPackage-prefetch-npm-deps).
 * `makeCacheWritable`: Whether to make the cache writable prior to installing dependencies. Don't set this unless npm tries to write to the cache directory, as it can slow down the build.
 * `npmBuildScript`: The script to run to build the project. Defaults to `"build"`.
+* `npmWorkspace`: The workspace directory within the project to build and install.
 * `dontNpmBuild`: Option to disable running the build script. Set to `true` if the package does not have a build script. Defaults to `false`. Alternatively, setting `buildPhase` explicitly also disables this.
 * `dontNpmInstall`: Option to disable running `npm install`. Defaults to `false`. Alternatively, setting `installPhase` explicitly also disables this.
 * `npmFlags`: Flags to pass to all npm commands.
-* `npmInstallFlags`: Flags to pass to `npm ci` and `npm prune`.
+* `npmInstallFlags`: Flags to pass to `npm ci`.
 * `npmBuildFlags`: Flags to pass to `npm run ${npmBuildScript}`.
 * `npmPackFlags`: Flags to pass to `npm pack`.
+* `npmPruneFlags`: Flags to pass to `npm prune`. Defaults to the value of `npmInstallFlags`.

 #### prefetch-npm-deps {#javascript-buildNpmPackage-prefetch-npm-deps}

--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@ -268,6 +268,17 @@ in
    environment.systemPackages = [ sddm ];
    services.dbus.packages = [ sddm ];

+    # We're not using the upstream unit, so copy these: https://github.com/sddm/sddm/blob/develop/services/sddm.service.in
+    systemd.services.display-manager.after = [
+      "systemd-user-sessions.service"
+      "getty@tty7.service"
+      "plymouth-quit.service"
+      "systemd-logind.service"
+    ];
+    systemd.services.display-manager.conflicts = [
+      "getty@tty7.service"
+    ];
+
    # To enable user switching, allow sddm to allocate TTYs/displays dynamically.
    services.xserver.tty = null;
    services.xserver.display = null;
--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@ -85,6 +85,14 @@ in {
          considered failed and systemd will attempt to restart it.
        '';
      };
+
+      ui = {
+        enable = lib.mkEnableOption (lib.mdDoc ''
+          Enables the (experimental) LXD UI.
+        '');
+
+        package = mkPackageOption pkgs.lxd "ui" { };
+      };
    };
  };

@ -143,6 +151,10 @@ in {
      path = [ pkgs.util-linux ]
        ++ optional cfg.zfsSupport config.boot.zfs.package;

+      environment = mkIf (cfg.ui.enable) {
+        "LXD_UI" = cfg.ui.package;
+      };
+
      serviceConfig = {
        ExecStart = "@${cfg.package}/bin/lxd lxd --group lxd";
        ExecStartPost = "${cfg.package}/bin/lxd waitready --timeout=${cfg.startTimeout}";
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -436,6 +436,7 @@ in {
  lxd = handleTest ./lxd.nix {};
  lxd-nftables = handleTest ./lxd-nftables.nix {};
  lxd-image-server = handleTest ./lxd-image-server.nix {};
+  lxd-ui = handleTest ./lxd-ui.nix {};
  #logstash = handleTest ./logstash.nix {};
  lorri = handleTest ./lorri/default.nix {};
  maddy = discoverTests (import ./maddy { inherit handleTest; });
--- a/nixos/tests/lxd-ui.nix
+++ b/nixos/tests/lxd-ui.nix
@ -0,0 +1,35 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "lxd-ui";
+
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jnsgruk ];
+  };
+
+  nodes.machine = { lib, ... }: {
+    virtualisation = {
+      lxd.enable = true;
+      lxd.ui.enable = true;
+    };
+
+    environment.systemPackages = [ pkgs.curl ];
+  };
+
+  testScript = ''
+    machine.wait_for_unit("sockets.target")
+    machine.wait_for_unit("lxd.service")
+    machine.wait_for_file("/var/lib/lxd/unix.socket")
+
+    # Wait for lxd to settle
+    machine.succeed("lxd waitready")
+
+    # Configure LXC listen address
+    machine.succeed("lxc config set core.https_address :8443")
+    machine.succeed("systemctl restart lxd")
+
+    # Check that the LXD_UI environment variable is populated in the systemd unit
+    machine.succeed("cat /etc/systemd/system/lxd.service | grep 'LXD_UI'")
+
+    # Ensure the endpoint returns an HTML page with 'LXD UI' in the title
+    machine.succeed("curl -kLs https://localhost:8443/ui | grep '<title>LXD UI</title>'")
+  '';
+})
--- a/nixos/tests/sddm.nix
+++ b/nixos/tests/sddm.nix
@ -23,14 +23,14 @@ let
      enableOCR = true;

      testScript = { nodes, ... }: let
-        user = nodes.machine.config.users.users.alice;
+        user = nodes.machine.users.users.alice;
      in ''
        start_all()
        machine.wait_for_text("(?i)select your user")
        machine.screenshot("sddm")
        machine.send_chars("${user.password}\n")
-        machine.wait_for_file("${user.home}/.Xauthority")
-        machine.succeed("xauth merge ${user.home}/.Xauthority")
+        machine.wait_for_file("/tmp/xauth_*")
+        machine.succeed("xauth merge /tmp/xauth_*")
        machine.wait_for_window("^IceWM ")
      '';
    };
@ -55,12 +55,10 @@ let
        services.xserver.windowManager.icewm.enable = true;
      };

-      testScript = { nodes, ... }: let
-        user = nodes.machine.config.users.users.alice;
-      in ''
+      testScript = { nodes, ... }: ''
        start_all()
-        machine.wait_for_file("${user.home}/.Xauthority")
-        machine.succeed("xauth merge ${user.home}/.Xauthority")
+        machine.wait_for_file("/tmp/xauth_*")
+        machine.succeed("xauth merge /tmp/xauth_*")
        machine.wait_for_window("^IceWM ")
      '';
    };
--- a/pkgs/applications/audio/plexamp/default.nix
+++ b/pkgs/applications/audio/plexamp/default.nix
@ -16,7 +16,7 @@ let
 in appimageTools.wrapType2 {
  inherit pname version src;

-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
  extraPkgs = pkgs: appimageTools.defaultFhsEnvArgs.multiPkgs pkgs ++ [ pkgs.bash ];

  extraInstallCommands = ''
--- a/pkgs/applications/audio/ptcollab/default.nix
+++ b/pkgs/applications/audio/ptcollab/default.nix
@ -14,13 +14,13 @@

 mkDerivation rec {
  pname = "ptcollab";
-  version = "0.6.4.6";
+  version = "0.6.4.7";

  src = fetchFromGitHub {
    owner = "yuxshao";
    repo = "ptcollab";
    rev = "v${version}";
-    hash = "sha256-G0QQV0mvrrBAC2LSy45/NnEbHHA8/E0SZKJXvuVidRE=";
+    hash = "sha256-KYNov/HbKM2d8VVO8iyWA3XWFDE9iWeKkRCNC1xlPNw=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/blockchains/mycrypto/default.nix
+++ b/pkgs/applications/blockchains/mycrypto/default.nix
@ -28,7 +28,7 @@ let
 in appimageTools.wrapType2 rec {
  inherit name src;

-  multiPkgs = null; # no p32bit needed
+  multiArch = false; # no p32bit needed
  extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;

  extraInstallCommands = ''
--- a/pkgs/applications/display-managers/sddm/default.nix
+++ b/pkgs/applications/display-managers/sddm/default.nix
@ -1,59 +1,44 @@
-{ mkDerivation, lib, fetchFromGitHub, fetchpatch
-, cmake, extra-cmake-modules, pkg-config, libxcb, libpthreadstubs
-, libXdmcp, libXau, qtbase, qtdeclarative, qtquickcontrols2, qttools, pam, systemd
+{ mkDerivation, lib, fetchFromGitHub
+, cmake, extra-cmake-modules, pkg-config, qttools
+, libxcb, libXau, pam, qtbase, qtdeclarative, qtquickcontrols2, systemd, xkeyboardconfig
 }:
-
-let
-  version = "0.19.0";
-
-in mkDerivation {
+mkDerivation rec {
  pname = "sddm";
-  inherit version;
+  version = "0.20.0";

  src = fetchFromGitHub {
    owner = "sddm";
    repo = "sddm";
    rev = "v${version}";
-    sha256 = "1s6icb5r1n6grfs137gdzfrcvwsb3hvlhib2zh6931x8pkl1qvxa";
+    hash = "sha256-ctZln1yQov+p/outkQhcWZp46IKITC04e22RfePwEM4=";
  };

  patches = [
    ./sddm-ignore-config-mtime.patch
    ./sddm-default-session.patch
-    # Load `/etc/profile` for `environment.variables` with zsh default shell.
-    # See: https://github.com/sddm/sddm/pull/1382
-    (fetchpatch {
-      url = "https://github.com/sddm/sddm/commit/e1dedeeab6de565e043f26ac16033e613c222ef9.patch";
-      sha256 = "sha256-OPyrUI3bbH+PGDBfoL4Ohb4wIvmy9TeYZhE0JxR/D58=";
-    })
-    # Fix build with Qt 5.15.3
-    # See: https://github.com/sddm/sddm/pull/1325
-    (fetchpatch {
-      url = "https://github.com/sddm/sddm/commit/e93bf95c54ad8c2a1604f8d7be05339164b19308.patch";
-      sha256 = "sha256:1rh6sdvzivjcl5b05fczarvxhgpjhi7019hvf2gadnwgwdg104r4";
-    })
-    # Fix fails to start while starting X server
-    # See: https://github.com/sddm/sddm/pull/1324
-    (fetchpatch {
-      url = "https://github.com/sddm/sddm/commit/adfaa222fdfa6115ea2b320b0bbc2126db9270a5.patch";
-      sha256 = "sha256-q/YLlAjxluzHMKUUQglLo3RyyhERQGPHXGr56+4R9VU=";
-    })
  ];

-  postPatch =
-    # Fix missing include for gettimeofday()
-    ''
-      sed -e '1i#include <sys/time.h>' -i src/helper/HelperApp.cpp
-    '';
+  postPatch = ''
+    substituteInPlace src/greeter/waylandkeyboardbackend.cpp \
+      --replace "/usr/share/X11/xkb/rules/evdev.xml" "${xkeyboardconfig}/share/X11/xkb/rules/evdev.xml"
+  '';

  nativeBuildInputs = [ cmake extra-cmake-modules pkg-config qttools ];

  buildInputs = [
-    libxcb libpthreadstubs libXdmcp libXau pam qtbase qtdeclarative qtquickcontrols2 systemd
+    libxcb
+    libXau
+    pam
+    qtbase
+    qtdeclarative
+    qtquickcontrols2
+    systemd
  ];

  cmakeFlags = [
    "-DCONFIG_FILE=/etc/sddm.conf"
+    "-DCONFIG_DIR=/etc/sddm.conf.d"
+
    # Set UID_MIN and UID_MAX so that the build script won't try
    # to read them from /etc/login.defs (fails in chroot).
    # The values come from NixOS; they may not be appropriate
@ -62,9 +47,15 @@ in mkDerivation {
    "-DUID_MIN=1000"
    "-DUID_MAX=29999"

+    # we still want to run the DM on VT 7 for the time being, as 1-6 are
+    # occupied by getties by default
+    "-DSDDM_INITIAL_VT=7"
+
    "-DQT_IMPORTS_DIR=${placeholder "out"}/${qtbase.qtQmlPrefix}"
    "-DCMAKE_INSTALL_SYSCONFDIR=${placeholder "out"}/etc"
    "-DSYSTEMD_SYSTEM_UNIT_DIR=${placeholder "out"}/lib/systemd/system"
+    "-DSYSTEMD_SYSUSERS_DIR=${placeholder "out"}/lib/sysusers.d"
+    "-DSYSTEMD_TMPFILES_DIR=${placeholder "out"}/lib/tmpfiles.d"
    "-DDBUS_CONFIG_DIR=${placeholder "out"}/share/dbus-1/system.d"
  ];

--- a/pkgs/applications/display-managers/sddm/sddm-default-session.patch
+++ b/pkgs/applications/display-managers/sddm/sddm-default-session.patch
@ -1,38 +1,39 @@
 diff --git a/src/common/Configuration.h b/src/common/Configuration.h
-index cf44a62..7bb9c03 100644
+index 54bcace..49cf5cb 100644
 --- a/src/common/Configuration.h
 +++ b/src/common/Configuration.h
-@@ -44,6 +44,7 @@ namespace SDDM {
-                                                                                                    "NOTE: Currently ignored if autologin is enabled."));
+@@ -48,6 +48,8 @@ namespace SDDM {
         Entry(InputMethod,         QString,     QStringLiteral("qtvirtualkeyboard"),                   _S("Input method module"));
         Entry(Namespaces,          QStringList, QStringList(),                                  _S("Comma-separated list of Linux namespaces for user session to enter"));
+         Entry(GreeterEnvironment,  QStringList, QStringList(),                                  _S("Comma-separated list of environment variables to be set"));
 +        Entry(DefaultSession,      QString,     QString(),                                      _S("System-wide default session"));
+
         //  Name   Entries (but it's a regular class again)
         Section(Theme,
             Entry(ThemeDir,            QString,     _S(DATA_INSTALL_DIR "/themes"),             _S("Theme directory path"));
 diff --git a/src/greeter/SessionModel.cpp b/src/greeter/SessionModel.cpp
-index 1953c76..54fe2f2 100644
+index d8698b7..df3e3c4 100644
 --- a/src/greeter/SessionModel.cpp
 +++ b/src/greeter/SessionModel.cpp
-@@ -43,6 +43,7 @@ namespace SDDM {
-         beginResetModel();
-         populate(Session::WaylandSession, mainConfig.Wayland.SessionDir.get());
+@@ -49,6 +49,7 @@ namespace SDDM {
+         if (dri_active)
+             populate(Session::WaylandSession, mainConfig.Wayland.SessionDir.get());
         populate(Session::X11Session, mainConfig.X11.SessionDir.get());
 +        selectDefaultSession();
         endResetModel();
- 
+
         // refresh everytime a file is changed, added or removed
-@@ -52,6 +53,7 @@ namespace SDDM {
-             d->sessions.clear();
-             populate(Session::WaylandSession, mainConfig.Wayland.SessionDir.get());
+@@ -62,6 +63,7 @@ namespace SDDM {
+             if (dri_active)
+                 populate(Session::WaylandSession, mainConfig.Wayland.SessionDir.get());
             populate(Session::X11Session, mainConfig.X11.SessionDir.get());
 +            selectDefaultSession();
             endResetModel();
         });
-         watcher->addPath(mainConfig.Wayland.SessionDir.get());
-@@ -149,11 +151,25 @@ namespace SDDM {
-             else
+         watcher->addPaths(mainConfig.Wayland.SessionDir.get());
+@@ -164,11 +166,25 @@ namespace SDDM {
                 delete si;
+             }
         }
 +    }
 +
@ -58,14 +59,13 @@ index 1953c76..54fe2f2 100644
         }
     }
 diff --git a/src/greeter/SessionModel.h b/src/greeter/SessionModel.h
-index 2e2efa9..a93315c 100644
+index 8f4d539..02f77ce 100644
 --- a/src/greeter/SessionModel.h
 +++ b/src/greeter/SessionModel.h
-@@ -58,6 +58,7 @@ namespace SDDM {
+@@ -59,6 +59,7 @@ namespace SDDM {
         SessionModelPrivate *d { nullptr };
- 
-         void populate(Session::Type type, const QString &path);
+
+         void populate(Session::Type type, const QStringList &dirPaths);
 +        void selectDefaultSession();
     };
 }
- 
--- a/pkgs/applications/editors/standardnotes/default.nix
+++ b/pkgs/applications/editors/standardnotes/default.nix
@ -1,38 +1,45 @@
-{ callPackage, lib, stdenv, appimageTools, autoPatchelfHook, desktop-file-utils
-, fetchurl, libsecret  }:
+{ lib, stdenv, fetchurl, dpkg, makeWrapper, electron, libsecret
+, desktop-file-utils , callPackage }:

 let
+
  srcjson = builtins.fromJSON (builtins.readFile ./src.json);
-  version = srcjson.version;
-  pname = "standardnotes";
-  name = "${pname}-${version}";
+
  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

-  src = fetchurl (srcjson.appimage.${stdenv.hostPlatform.system} or throwSystem);
+in

-  appimageContents = appimageTools.extract {
-    inherit name src;
-  };
+stdenv.mkDerivation rec {

-  nativeBuildInputs = [ autoPatchelfHook desktop-file-utils ];
+  pname = "standardnotes";

-in appimageTools.wrapType2 rec {
-  inherit name src;
+  src = fetchurl (srcjson.deb.${stdenv.hostPlatform.system} or throwSystem);

-  extraPkgs = pkgs: with pkgs; [
-    libsecret
-  ];
+  inherit (srcjson) version;

-  extraInstallCommands = ''
-    # directory in /nix/store so readonly
-    cd $out
-    chmod -R +w $out
-    mv $out/bin/${name} $out/bin/${pname}
+  dontConfigure = true;
+
+  dontBuild = true;
+
+  nativeBuildInputs = [ makeWrapper dpkg desktop-file-utils ];
+
+  unpackPhase = "dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/standardnotes
+    cp -R usr/share/{applications,icons} $out/share
+    cp -R opt/Standard\ Notes/resources/app.asar $out/share/standardnotes/
+
+    makeWrapper ${electron}/bin/electron $out/bin/standardnotes \
+      --add-flags $out/share/standardnotes/app.asar \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libsecret stdenv.cc.cc.lib ]}

-    # fixup and install desktop file
    ${desktop-file-utils}/bin/desktop-file-install --dir $out/share/applications \
-      --set-key Exec --set-value ${pname} ${appimageContents}/standard-notes.desktop
-    ln -s ${appimageContents}/usr/share/icons share
+      --set-key Exec --set-value standardnotes usr/share/applications/standard-notes.desktop
+
+    runHook postInstall
  '';

  passthru.updateScript = callPackage ./update.nix {};
@ -47,6 +54,6 @@ in appimageTools.wrapType2 rec {
    license = licenses.agpl3;
    maintainers = with maintainers; [ mgregoire chuangzhu squalus ];
    sourceProvenance = [ sourceTypes.binaryNativeCode ];
-    platforms = builtins.attrNames srcjson.appimage;
+    platforms = builtins.attrNames srcjson.deb;
  };
 }
--- a/pkgs/applications/editors/standardnotes/src.json
+++ b/pkgs/applications/editors/standardnotes/src.json
@ -1,13 +1,13 @@
 {
  "version": "3.162.8",
-  "appimage": {
+  "deb": {
    "x86_64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.162.8/standard-notes-3.162.8-linux-x86_64.AppImage",
-      "hash": "sha512-+JoY/x99RDLLjERaFhye0Bsg5FWFAgTPr6tqjXOYjHYuztYhmOZnieIGF8hS0iZsSPoQG9mm2mUVOTEHhXvm8A=="
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.162.8/standard-notes-3.162.8-linux-amd64.deb",
+      "hash": "sha512-XxSz1ZXCVzNBqX5BQ4nytFla1igEttV/pQ40r3HW6BQfy6yprQqmQ94OMJSx7kpfeQpxnwBMOUsA58QM3W7y1w=="
    },
    "aarch64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.162.8/standard-notes-3.162.8-linux-arm64.AppImage",
-      "hash": "sha512-7/oHUJQBlTr4mL8ETESW6PC9rWewAUGHLtdCwNmnhh9zTBWxc0jO8fLikDDql5vrlCCGhZqmnmmlvMGNFFLBdw=="
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.162.8/standard-notes-3.162.8-linux-arm64.deb",
+      "hash": "sha512-Y1+89UaPfB+UKiVg3JWo3zwH1rFnjdKuU1CBwIjMblzf1775gEMXicU0n+6FpWTphcVmEeah9VISoq0oBHNHtg=="
    }
  }
 }
--- a/pkgs/applications/editors/standardnotes/update.nix
+++ b/pkgs/applications/editors/standardnotes/update.nix
@ -31,7 +31,7 @@ writeScript "update-standardnotes" ''
  fi

  function getDownloadUrl() {
-    jq -r ".assets[] | select(.name==\"standard-notes-$newVersion-$1.AppImage\") | .browser_download_url" < "$jsonPath"
+    jq -r ".assets[] | select(.name==\"standard-notes-$newVersion-$1.deb\") | .browser_download_url" < "$jsonPath"
  }

  function setJsonKey() {
@ -44,11 +44,11 @@ writeScript "update-standardnotes" ''
    url=$(getDownloadUrl "$upstreamPlatform")
    hash=$(nix-prefetch-url "$url" --type sha512)
    sriHash=$(nix hash to-sri --type sha512 $hash)
-    setJsonKey .appimage[\""$nixPlatform"\"].url "$url"
-    setJsonKey .appimage[\""$nixPlatform"\"].hash "$sriHash"
+    setJsonKey .deb[\""$nixPlatform"\"].url "$url"
+    setJsonKey .deb[\""$nixPlatform"\"].hash "$sriHash"
  }

-  updatePlatform x86_64-linux linux-x86_64
+  updatePlatform x86_64-linux linux-amd64
  updatePlatform aarch64-linux linux-arm64
  setJsonKey .version "$newVersion"
 ''
--- a/pkgs/applications/graphics/oculante/Cargo.lock
+++ b/pkgs/applications/graphics/oculante/Cargo.lock
@ -316,9 +316,9 @@ dependencies = [

 [[package]]
 name = "bitstream-io"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d28070975aaf4ef1fd0bd1f29b739c06c2cdd9972e090617fb6dca3b2cb564e"
+checksum = "82704769cb85a22df2c54d6bdd6a158b7931d256cf3248a07d6ecbe9d58b31d7"

 [[package]]
 name = "block"
@ -2021,9 +2021,9 @@ checksum = "28b29a3cd74f0f4598934efe3aeba42bae0eb4680554128851ebbecb02af14e6"

 [[package]]
 name = "is-terminal"
-version = "0.4.8"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24fddda5af7e54bf7da53067d6e802dbcc381d0a8eef629df528e3ebf68755cb"
+checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
 dependencies = [
 "hermit-abi 0.3.2",
 "rustix 0.38.3",
@ -3016,6 +3016,17 @@ dependencies = [
 "syn 1.0.109",
 ]

+[[package]]
+name = "num-derive"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e6a0fd4f737c707bd9086cc16c925f294943eb62eb71499e9fd4cf71f8b9f4e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.23",
+]
+
 [[package]]
 name = "num-integer"
 version = "0.1.45"
@ -3181,7 +3192,7 @@ dependencies = [

 [[package]]
 name = "oculante"
-version = "0.6.67"
+version = "0.6.68"
 dependencies = [
 "anyhow",
 "arboard",
@ -3710,7 +3721,7 @@ dependencies = [
 "nasm-rs",
 "new_debug_unreachable",
 "noop_proc_macro",
- "num-derive",
+ "num-derive 0.3.3",
 "num-traits 0.2.15",
 "once_cell",
 "paste",
@ -4032,9 +4043,9 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.21.2"
+version = "0.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e32ca28af694bc1bbf399c33a516dbdf1c90090b8ab23c2bc24f834aa2247f5f"
+checksum = "b19faa85ecb5197342b54f987b142fb3e30d0c90da40f80ef4fa9a726e6676ed"
 dependencies = [
 "log",
 "ring",
@ -4053,9 +4064,9 @@ dependencies = [

 [[package]]
 name = "rustls-webpki"
-version = "0.100.1"
+version = "0.101.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6207cd5ed3d8dca7816f8f3725513a34609c0c765bf652b8c3cb4cfd87db46b"
+checksum = "15f36a6828982f422756984e47912a7a51dcbc2a197aa791158f8ca61cd8204e"
 dependencies = [
 "ring",
 "untrusted",
@ -4185,18 +4196,18 @@ dependencies = [

 [[package]]
 name = "serde"
-version = "1.0.166"
+version = "1.0.167"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d01b7404f9d441d3ad40e6a636a7782c377d2abdbe4fa2440e2edcc2f4f10db8"
+checksum = "7daf513456463b42aa1d94cff7e0c24d682b429f020b9afa4f5ba5c40a22b237"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.166"
+version = "1.0.167"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dd83d6dde2b6b2d466e14d9d1acce8816dedee94f735eac6395808b3483c6d6"
+checksum = "b69b106b68bc8054f0e974e70d19984040f8a5cf9215ca82626ea4853f82c4b9"
 dependencies = [
 "proc-macro2",
 "quote",
@ -4331,9 +4342,9 @@ dependencies = [

 [[package]]
 name = "smallvec"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0"
+checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"

 [[package]]
 name = "smithay-client-toolkit"
@ -4509,7 +4520,7 @@ dependencies = [
 "cfg-expr",
 "heck",
 "pkg-config",
- "toml 0.7.5",
+ "toml 0.7.6",
 "version-compare",
 ]

@ -4550,18 +4561,18 @@ checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"

 [[package]]
 name = "thiserror"
-version = "1.0.41"
+version = "1.0.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c16a64ba9387ef3fdae4f9c1a7f07a0997fce91985c0336f1ddc1822b3b37802"
+checksum = "a35fc5b8971143ca348fa6df4f024d4d55264f3468c71ad1c2f365b0a4d58c42"
 dependencies = [
 "thiserror-impl",
 ]

 [[package]]
 name = "thiserror-impl"
-version = "1.0.41"
+version = "1.0.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d14928354b01c4d6a4f0e549069adef399a284e7995c7ccca94e8a07a5346c59"
+checksum = "463fe12d7993d3b327787537ce8dd4dfa058de32fc2b195ef3cde03dc4771e8f"
 dependencies = [
 "proc-macro2",
 "quote",
@ -4719,9 +4730,9 @@ dependencies = [

 [[package]]
 name = "toml"
-version = "0.7.5"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ebafdf5ad1220cb59e7d17cf4d2c72015297b75b19a10472f99b89225089240"
+checksum = "c17e963a819c331dcacd7ab957d80bc2b9a9c1e71c804826d2f283dd65306542"
 dependencies = [
 "serde",
 "serde_spanned",
@ -4740,9 +4751,9 @@ dependencies = [

 [[package]]
 name = "toml_edit"
-version = "0.19.11"
+version = "0.19.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "266f016b7f039eec8a1a80dfe6156b633d208b9fccca5e4db1d6775b0c4e34a7"
+checksum = "c500344a19072298cd05a7224b3c0c629348b78692bf48466c5238656e315a78"
 dependencies = [
 "indexmap 2.0.0",
 "serde",
@ -4987,13 +4998,13 @@ dependencies = [

 [[package]]
 name = "v_frame"
-version = "0.3.4"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3753f70d50a77f5d381103ba2693a889fed0d84273dd5cbdf4eb8bda720f0c6"
+checksum = "bec8189c996a12ac77c50065f9c9f64961e56eb940d0ae1a4ccc7bea238bb4bc"
 dependencies = [
 "cfg-if 1.0.0",
 "noop_proc_macro",
- "num-derive",
+ "num-derive 0.4.0",
 "num-traits 0.2.15",
 "rust_hawktracer",
 ]
@ -5535,9 +5546,9 @@ dependencies = [

 [[package]]
 name = "winnow"
-version = "0.4.7"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca0ace3845f0d96209f0375e6d367e3eb87eb65d27d445bdc9f1843a26f39448"
+checksum = "a9482fe6ceabdf32f3966bfdd350ba69256a97c30253dc616fe0005af24f164e"
 dependencies = [
 "memchr",
 ]
--- a/pkgs/applications/graphics/oculante/default.nix
+++ b/pkgs/applications/graphics/oculante/default.nix
@ -21,13 +21,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "oculante";
-  version = "0.6.67";
+  version = "0.6.68";

  src = fetchFromGitHub {
    owner = "woelper";
    repo = pname;
    rev = version;
-    hash = "sha256-SpHv6bZff3Z5SnOjamOFf8SRuUlovsLXSFOrqYtNwEs=";
+    hash = "sha256-afkRId4PuRKnnloFLh2rD+npcCCUqDngKcnWbEf+6vk=";
  };

  cargoLock = {
--- a/pkgs/applications/misc/bottles/fhsenv.nix
+++ b/pkgs/applications/misc/bottles/fhsenv.nix
@ -7,6 +7,9 @@
 }:

 let fhsEnv = {
+  # Many WINE games need 32bit
+  multiArch = true;
+
  targetPkgs = pkgs: with pkgs; [
    bottles-unwrapped
    # This only allows to enable the toggle, vkBasalt won't work if not installed with environment.systemPackages (or nix-env)
--- a/pkgs/applications/misc/chrysalis/default.nix
+++ b/pkgs/applications/misc/chrysalis/default.nix
@ -14,7 +14,7 @@ in appimageTools.wrapAppImage rec {
    };
  };

-  multiPkgs = null;
+  multiArch = false;
  extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [
    p.glib
  ];
--- a/pkgs/applications/misc/joplin-desktop/default.nix
+++ b/pkgs/applications/misc/joplin-desktop/default.nix
@ -47,7 +47,7 @@ let
      export LC_ALL=C.UTF-8
    '';

-    multiPkgs = null; # no 32bit needed
+    multiArch = false; # no 32bit needed
    extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
    extraInstallCommands = ''
      mv $out/bin/{${name},${pname}}
--- a/pkgs/applications/misc/lutris/fhsenv.nix
+++ b/pkgs/applications/misc/lutris/fhsenv.nix
@ -18,6 +18,9 @@ in buildFHSEnv {

  runScript = "lutris";

+  # Many native and WINE games need 32bit
+  multiArch = true;
+
  targetPkgs = pkgs: with pkgs; [
    lutris-unwrapped

--- a/pkgs/applications/misc/marktext/default.nix
+++ b/pkgs/applications/misc/marktext/default.nix
@ -20,7 +20,7 @@ appimageTools.wrapType2 rec {
    export LC_ALL=C.UTF-8
  '';

-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
  extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [
    p.libsecret
    p.xorg.libxkbfile
--- a/pkgs/applications/misc/notable/default.nix
+++ b/pkgs/applications/misc/notable/default.nix
@ -26,7 +26,7 @@ appimageTools.wrapType2 rec {
    export LC_ALL=C.UTF-8
  '';

-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
  extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [ p.at-spi2-atk p.at-spi2-core ];
  extraInstallCommands = ''
    mv $out/bin/{${name},${pname}}
--- a/pkgs/applications/misc/zettlr/default.nix
+++ b/pkgs/applications/misc/zettlr/default.nix
@ -21,7 +21,7 @@ in
 appimageTools.wrapType2 rec {
  inherit name src;

-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ texlive pandoc ];
  extraInstallCommands = ''
    mv $out/bin/{${name},${pname}}
--- a/pkgs/applications/networking/Sylk/default.nix
+++ b/pkgs/applications/networking/Sylk/default.nix
@ -17,7 +17,7 @@ appimageTools.wrapType2 rec {
    export LC_ALL=C.UTF-8
  '';

-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
  extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
  extraInstallCommands = "mv $out/bin/{${name},${pname}}";

--- a/pkgs/applications/networking/browsers/polypane/default.nix
+++ b/pkgs/applications/networking/browsers/polypane/default.nix
@ -16,7 +16,7 @@ let
 in appimageTools.wrapType2 {
  inherit pname src version;

-  multiPkgs = null;
+  multiArch = false;
  extraPkgs = pkgs: appimageTools.defaultFhsEnvArgs.multiPkgs pkgs ++ [ pkgs.bash ];

  extraInstallCommands = ''
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "glooctl";
-  version = "1.14.9";
+  version = "1.14.10";

  src = fetchFromGitHub {
    owner = "solo-io";
    repo = "gloo";
    rev = "v${version}";
-    hash = "sha256-PJvr62slTW3IoauLtRH88BDMpf3qGOWADjj4L4wQBLo=";
+    hash = "sha256-eBfguD4vugGdLj6Qs1VkJVyhXYMrpcqsdTdYEDM86cc=";
  };

  subPackages = [ "projects/gloo/cli/cmd" ];
--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@ -12,13 +12,13 @@

 buildGoModule rec {
  pname = "kubebuilder";
-  version = "3.11.0";
+  version = "3.11.1";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "kubebuilder";
    rev = "v${version}";
-    hash = "sha256-R4piek1mhMy5QPB6weR3F7PiIq0LvwkRAnIndbar9tg=";
+    hash = "sha256-VT9S8Ijf684rowfoU1kvgPSTzR8ZGr3GwxWiYHWLANc=";
  };

  vendorHash = "sha256-5XUYmAfFH6UlLF09PqcSLUxkgZ5iHZGj0Vurab+Jl1g=";
--- a/pkgs/applications/networking/cluster/octant/desktop.nix
+++ b/pkgs/applications/networking/cluster/octant/desktop.nix
@ -27,7 +27,7 @@ let
      export LC_ALL=C.UTF-8
    '';

-    multiPkgs = null; # no 32bit needed
+    multiArch = false; # no 32bit needed
    extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
    extraInstallCommands =
      let appimageContents = appimageTools.extractType2 { inherit name src; }; in
--- a/pkgs/applications/networking/cluster/openlens/default.nix
+++ b/pkgs/applications/networking/cluster/openlens/default.nix
@ -2,11 +2,11 @@

 let
  pname = "openlens";
-  version = "6.5.2-356";
+  version = "6.5.2-366";

  src = fetchurl {
    url = "https://github.com/MuhammedKalkan/OpenLens/releases/download/v${version}/OpenLens-${version}.x86_64.AppImage";
-    sha256 = "sha256-ZOLfnAKZMqO/MkpjX2SQhtBIeWRGTkPBWdAw67a3l9Q=";
+    sha256 = "sha256-ZAltAS/U/xh4kCT7vQ+NHAzWV7z0uE5GMQICHKSdj8k=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -46,11 +46,11 @@
    "vendorHash": "sha256-xZ0pS7XxfYGbG2kEw5FAjABDQZmektaI7OhToiFMXKk="
  },
  "alicloud": {
-    "hash": "sha256-SYzc8mvLdSHWR75+Fy4Egn2BO8t89aowYHhZ6MlyEIU=",
+    "hash": "sha256-F69Otml1zH5TtD6dRPIXc2pOq2aM8NEsTsnmJDQEdxk=",
    "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
    "owner": "aliyun",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.207.1",
+    "rev": "v1.207.2",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -390,13 +390,13 @@
    "vendorHash": null
  },
  "flexibleengine": {
-    "hash": "sha256-WO99FOJ6zZ0GPxoYwH55Ul0HTktH2UZ3yWRrwjk3qA4=",
+    "hash": "sha256-Y7rplfN7acrDWNO9Q4K3WaM5reFxi5ms012+wTm+EF0=",
    "homepage": "https://registry.terraform.io/providers/FlexibleEngineCloud/flexibleengine",
    "owner": "FlexibleEngineCloud",
    "repo": "terraform-provider-flexibleengine",
-    "rev": "v1.38.0",
+    "rev": "v1.39.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DSdE0CkAIJje71/S64no9fMJMUhAnFiK3lWewvcyE14="
+    "vendorHash": "sha256-RqYzqKPzb5GcrzHnEDZC7GaBt1zP8g28Wo3WNAe07Ck="
  },
  "fly": {
    "hash": "sha256-9QB2fbggCKcJz8tkSYgq/X8r+MB2M76VCWXgsHARTkU=",
@ -1034,11 +1034,11 @@
    "vendorHash": null
  },
  "snowflake": {
-    "hash": "sha256-QxqzIaDzVxvxnf10rLWl4CUUIvzWLsSyWHXBg5S1608=",
+    "hash": "sha256-Cou96AjZDi6GTz6i7+x/nJfwHkHrHB9E9g8RzX4/QKo=",
    "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
    "owner": "Snowflake-Labs",
    "repo": "terraform-provider-snowflake",
-    "rev": "v0.67.0",
+    "rev": "v0.68.1",
    "spdx": "MIT",
    "vendorHash": "sha256-ZNkZ2GMSBZHz+L626VqT7pTeb8fSYkaCi84O5ggd1FM="
  },
@ -1106,11 +1106,11 @@
    "vendorHash": "sha256-GNSKSlaFBj2P+z40U+0uwPSOuQBy+9vOVFfPe8p0A24="
  },
  "tencentcloud": {
-    "hash": "sha256-evdKIbPPaHMFOYb77vogr3h8n34fcJf0sJVw5GjaHc8=",
+    "hash": "sha256-BflyXfxfth9wjPCd8aW9maemjjHTzuL8KvxQsvRUKLw=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.81.11",
+    "rev": "v1.81.12",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/applications/networking/station/default.nix
+++ b/pkgs/applications/networking/station/default.nix
@ -20,7 +20,7 @@ in appimageTools.wrapType2 rec {
    export LC_ALL=C.UTF-8
  '';

-  multiPkgs = null;
+  multiArch = false;
  extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
  extraInstallCommands = ''
    mv $out/bin/{${name},${pname}}
--- a/pkgs/applications/office/tusk/default.nix
+++ b/pkgs/applications/office/tusk/default.nix
@ -31,7 +31,7 @@ in appimageTools.wrapType2 rec {
    export LC_ALL=C.UTF-8
  '';

-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
  extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
  extraInstallCommands = ''
    mv $out/bin/{${pname}-${version},${pname}}
--- a/pkgs/applications/video/kodi/addons/urllib3/default.nix
+++ b/pkgs/applications/video/kodi/addons/urllib3/default.nix
@ -3,11 +3,11 @@
 buildKodiAddon rec {
  pname = "urllib3";
  namespace = "script.module.urllib3";
-  version = "1.26.13+matrix.1";
+  version = "1.26.16+matrix.1";

  src = fetchzip {
    url = "https://mirrors.kodi.tv/addons/nexus/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-pymhHS1TqRv9o/3zBtmP8QSLMXSgFYno0VaR+YqhJqY=";
+    sha256 = "sha256-HI99Cle/SpwulbDCVoDNy/0EfHVt4q7+LR60YRMaSFY=";
  };

  passthru = {
--- a/pkgs/applications/window-managers/sway/fx.nix
+++ b/pkgs/applications/window-managers/sway/fx.nix
@ -2,13 +2,13 @@

 sway-unwrapped.overrideAttrs (oldAttrs: rec {
  pname = "swayfx";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "WillPower3309";
    repo = "swayfx";
    rev = version;
-    sha256 = "sha256-Ox+ror8sCc4mFOqZ1H9782hWbkTSUs5IVYEubHuyoJQ=";
+    sha256 = "sha256-Gwewb0yDVhEBrefSSGDf1hLtpWcntzifPCPJQhqLqI0=";
  };

  # This patch was backported into SwayFX
--- a/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
@ -12,6 +12,7 @@
 , profile ? ""
 , targetPkgs ? pkgs: []
 , multiPkgs ? pkgs: []
+, multiArch ? false # Whether to include 32bit packages
 , extraBuildCommands ? ""
 , extraBuildCommandsMulti ? ""
 , extraOutputsToInstall ? []
@ -35,8 +36,8 @@
 let
  inherit (stdenv) is64bit;

-  # use of glibc_multi is only supported on x86_64-linux
-  isMultiBuild  = multiPkgs != null && stdenv.isx86_64 && stdenv.isLinux;
+  # "use of glibc_multi is only supported on x86_64-linux"
+  isMultiBuild = multiArch && stdenv.system == "x86_64-linux";
  isTargetBuild = !isMultiBuild;

  # list of packages (usually programs) which are only be installed for the
@ -51,21 +52,34 @@ let
  # these match the host's architecture, glibc_multi is used for multilib
  # builds. glibcLocales must be before glibc or glibc_multi as otherwiese
  # the wrong LOCALE_ARCHIVE will be used where only C.UTF-8 is available.
-  basePkgs = with pkgs;
-    [ glibcLocales
-      (if isMultiBuild then glibc_multi else glibc)
-      (toString gcc.cc.lib) bashInteractiveFHS coreutils less shadow su
-      gawk diffutils findutils gnused gnugrep
-      gnutar gzip bzip2 xz
-    ];
-  baseMultiPkgs = with pkgsi686Linux;
-    [ (toString gcc.cc.lib)
-    ];
+  basePkgs = with pkgs; [
+    glibcLocales
+    (if isMultiBuild then glibc_multi else glibc)
+    (toString gcc.cc.lib)
+    bashInteractiveFHS
+    coreutils
+    less
+    shadow
+    su
+    gawk
+    diffutils
+    findutils
+    gnused
+    gnugrep
+    gnutar
+    gzip
+    bzip2
+    xz
+  ];
+  baseMultiPkgs = with pkgsi686Linux; [
+    (toString gcc.cc.lib)
+  ];

  ldconfig = writeShellScriptBin "ldconfig" ''
    # due to a glibc bug, 64-bit ldconfig complains about patchelf'd 32-bit libraries, so we're using 32-bit ldconfig
-    exec ${if stdenv.isx86_64 && stdenv.isLinux then pkgsi686Linux.glibc.bin else pkgs.glibc.bin}/bin/ldconfig -f /etc/ld.so.conf -C /etc/ld.so.cache "$@"
+    exec ${if stdenv.system == "x86_64-linux" then pkgsi686Linux.glibc.bin else pkgs.glibc.bin}/bin/ldconfig -f /etc/ld.so.conf -C /etc/ld.so.cache "$@"
  '';
+
  etcProfile = writeText "profile" ''
    export PS1='${name}-chrootenv:\u@\h:\w\$ '
    export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
@ -104,7 +118,7 @@ let
  # Compose /etc for the chroot environment
  etcPkg = runCommandLocal "${name}-chrootenv-etc" { } ''
    mkdir -p $out/etc
-    cd $out/etc
+    pushd $out/etc

    # environment variables
    ln -s ${etcProfile} profile
@ -172,13 +186,18 @@ let
    ln -s lib64 lib

    # copy glibc stuff
-    cp -rsHf ${staticUsrProfileTarget}/lib/32/* lib32/ && chmod u+w -R lib32/
+    cp -rsHf ${staticUsrProfileTarget}/lib/32/* lib32/
+    chmod u+w -R lib32/

    # copy content of multiPaths (32bit libs)
-    [ -d ${staticUsrProfileMulti}/lib ] && cp -rsHf ${staticUsrProfileMulti}/lib/* lib32/ && chmod u+w -R lib32/
+    if [ -d ${staticUsrProfileMulti}/lib ]; then
+      cp -rsHf ${staticUsrProfileMulti}/lib/* lib32/
+      chmod u+w -R lib32/
+    fi

    # copy content of targetPaths (64bit libs)
-    cp -rsHf ${staticUsrProfileTarget}/lib/* lib64/ && chmod u+w -R lib64/
+    cp -rsHf ${staticUsrProfileTarget}/lib/* lib64/
+    chmod u+w -R lib64/

    # symlink 32-bit ld-linux.so
    ln -Ls ${staticUsrProfileTarget}/lib/32/ld-linux.so.2 lib/
@ -191,13 +210,15 @@ let
  # the target profile is the actual profile that will be used for the chroot
  setupTargetProfile = ''
    mkdir -m0755 usr
-    cd usr
+    pushd usr
+
    ${setupLibDirs}
-    ${lib.optionalString isMultiBuild ''
+
+    '' + lib.optionalString isMultiBuild ''
    if [ -d "${staticUsrProfileMulti}/share" ]; then
      cp -rLf ${staticUsrProfileMulti}/share share
    fi
-    ''}
+    '' + ''
    if [ -d "${staticUsrProfileTarget}/share" ]; then
      if [ -d share ]; then
        chmod -R 755 share
@ -223,18 +244,19 @@ let
        ln -s "$i"
      fi
    done
+
+    popd
  '';

 in runCommandLocal "${name}-fhs" {
  passthru = {
-    inherit args multiPaths targetPaths;
+    inherit args multiPaths targetPaths ldconfig;
  };
 } ''
  mkdir -p $out
-  cd $out
+  pushd $out
+
  ${setupTargetProfile}
-  cd $out
  ${extraBuildCommands}
-  cd $out
  ${lib.optionalString isMultiBuild extraBuildCommandsMulti}
 ''
--- a/pkgs/build-support/node/build-npm-package/default.nix
+++ b/pkgs/build-support/node/build-npm-package/default.nix
@ -22,7 +22,7 @@
 , npmBuildScript ? "build"
  # Flags to pass to all npm commands.
 , npmFlags ? [ ]
-  # Flags to pass to `npm ci` and `npm prune`.
+  # Flags to pass to `npm ci`.
 , npmInstallFlags ? [ ]
  # Flags to pass to `npm rebuild`.
 , npmRebuildFlags ? [ ]
@ -30,6 +30,10 @@
 , npmBuildFlags ? [ ]
  # Flags to pass to `npm pack`.
 , npmPackFlags ? [ ]
+  # Flags to pass to `npm prune`.
+, npmPruneFlags ? npmInstallFlags
+  # Value for npm `--workspace` flag and directory in which the files to be installed are found.
+, npmWorkspace ? null
 , ...
 } @ args:

--- a/pkgs/build-support/node/build-npm-package/hooks/npm-build-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-build-hook.sh
@ -14,7 +14,7 @@ npmBuildHook() {
        exit 1
    fi

-    if ! npm run "$npmBuildScript" $npmBuildFlags "${npmBuildFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"; then
+    if ! npm run ${npmWorkspace+--workspace=$npmWorkspace} "$npmBuildScript" $npmBuildFlags "${npmBuildFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"; then
        echo
        echo 'ERROR: `npm build` failed'
        echo
--- a/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
@ -13,8 +13,8 @@ npmInstallHook() {
    while IFS= read -r file; do
        local dest="$packageOut/$(dirname "$file")"
        mkdir -p "$dest"
-        cp "$file" "$dest"
-    done < <(@jq@ --raw-output '.[0].files | map(.path) | join("\n")' <<< "$(npm pack --json --dry-run $npmPackFlags "${npmPackFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}")")
+        cp "${npmWorkspace-.}/$file" "$dest"
+    done < <(@jq@ --raw-output '.[0].files | map(.path) | join("\n")' <<< "$(npm pack --json --dry-run ${npmWorkspace+--workspace=$npmWorkspace} $npmPackFlags "${npmPackFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}")")

    while IFS=" " read -ra bin; do
        mkdir -p "$out/bin"
@ -22,13 +22,13 @@ npmInstallHook() {
    done < <(@jq@ --raw-output '(.bin | type) as $typ | if $typ == "string" then
        .name + " " + .bin
        elif $typ == "object" then .bin | to_entries | map(.key + " " + .value) | join("\n")
-        else "invalid type " + $typ | halt_error end' package.json)
+        else "invalid type " + $typ | halt_error end' "${npmWorkspace-.}/package.json")

    local -r nodeModulesPath="$packageOut/node_modules"

    if [ ! -d "$nodeModulesPath" ]; then
        if [ -z "${dontNpmPrune-}" ]; then
-            npm prune --omit dev --no-save $npmInstallFlags "${npmInstallFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"
+            npm prune --omit=dev --no-save ${npmWorkspace+--workspace=$npmWorkspace} $npmPruneFlags "${npmPruneFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"
        fi

        find node_modules -maxdepth 1 -type d -empty -delete
--- a/pkgs/development/embedded/arduino/arduino-core/chrootenv.nix
+++ b/pkgs/development/embedded/arduino/arduino-core/chrootenv.nix
@ -14,7 +14,7 @@ buildFHSEnv {
        pyserial
      ]))
    ]);
-  multiPkgs = null;
+  multiArch = false;

  extraInstallCommands = ''
    ${lib.optionalString withGui ''
--- a/pkgs/development/libraries/libamqpcpp/default.nix
+++ b/pkgs/development/libraries/libamqpcpp/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libamqpcpp";
-  version = "4.3.25";
+  version = "4.3.26";

  src = fetchFromGitHub {
    owner = "CopernicaMarketingSoftware";
    repo = "AMQP-CPP";
    rev = "v${version}";
-    sha256 = "sha256-9nqp7VM5korICwzZF0XTlC4uKwjSY5MoILVJBzKulPk=";
+    sha256 = "sha256-lHkYoppJ/wo6RRE6V4iN6JXz5OoErJUl4IyrwiCB9FM=";
  };

  buildInputs = [ openssl ];
--- a/pkgs/development/php-packages/inotify/default.nix
+++ b/pkgs/development/php-packages/inotify/default.nix
@ -1,6 +1,5 @@
 { buildPecl
 , lib
-, stdenv
 }:

 buildPecl {
@ -11,11 +10,11 @@ buildPecl {

  doCheck = true;

-  meta = with lib; {
-    broken = stdenv.isDarwin; # no inotify support
+  meta = {
    description = "Inotify bindings for PHP";
-    license = licenses.php301;
    homepage = "https://github.com/arnaud-lb/php-inotify";
-    maintainers = teams.php.members;
+    license = lib.licenses.php301;
+    maintainers = lib.teams.php.members;
+    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@ -19,14 +19,14 @@

 buildPythonPackage rec {
  pname = "apprise";
-  version = "1.4.0";
+  version = "1.4.5";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-4xUFNIVNrFPU8Hg42Mv7Is4NRdQuugX5bWbE9IQ81Vo=";
+    hash = "sha256-t8ZlE8VFZpCimO2IfJAW3tQvFeNl0WFC5yi3T3z/7oI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/bids-validator/default.nix
+++ b/pkgs/development/python-modules/bids-validator/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "bids-validator";
-  version = "1.11.0";
+  version = "1.12.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-QIxWdIt8+Yz3wxgi8zqNicXm59tSVMNFEH6NUnV2/1M=";
+    hash = "sha256-X569N5zfbTg+mDwQU5iGv16kiOTr8rwhKTEl9RCJMRY=";
  };

  # needs packages which are not available in nixpkgs
--- a/pkgs/development/python-modules/casbin/default.nix
+++ b/pkgs/development/python-modules/casbin/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "casbin";
-  version = "1.19.0";
+  version = "1.20.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = "pycasbin";
    rev = "refs/tags/v${version}";
-    hash = "sha256-lIVZhWtGWJutmHgReT4k4G5hJZuD52AaJhwmwTmqHIY=";
+    hash = "sha256-hvnOVyXaC74pMlERZQQlrk5keyWAvE/UONwErJ7RA5c=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/faraday-plugins/default.nix
+++ b/pkgs/development/python-modules/faraday-plugins/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "faraday-plugins";
-  version = "1.12.0";
+  version = "1.12.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "infobyte";
    repo = "faraday_plugins";
    rev = "refs/tags/${version}";
-    hash = "sha256-dtSGNLQUG4Co+p/sPBgKxMhB7drZAMxUas+eH6g/cS8=";
+    hash = "sha256-sDHqBGRJQuAj2zB7hcIy3u5iNCxBHO1ub0eHxfgd7kI=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "hahomematic";
-  version = "2023.6.1";
+  version = "2023.7.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "danielperna84";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-67zl530tvA7h4bpC9qasVsvjzoN9fxtPO9TZmxvABlc=";
+    hash = "sha256-5J/arrr8ymODSqtATJZuKsuOsCDKV9P2v8vN6D22FuE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "pontos";
-  version = "23.7.2";
+  version = "23.7.5";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "greenbone";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-wdnYHpIrSGEOBC1mw8aHXCcSney0IDc1MKSFsbGNjq0=";
+    hash = "sha256-DYlJ/xI/V+T/Am4SASVg/L7/uTAeUVM63aqxyMG6o+4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/python-barcode/default.nix
+++ b/pkgs/development/python-modules/python-barcode/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "python-barcode";
-  version = "0.14.0";
+  version = "0.15.1";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-JBs0qlxctqmImIL5QJsBgpA6LF0ZtCGL42Cc271f/fk=";
+    hash = "sha256-Oxgl+9sR5ZdGbf9ChrTqmx6GpXcXtZ5WOuZ5cm/IVN4=";
  };

  propagatedBuildInputs = [
@ -45,6 +45,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Create standard barcodes with Python";
    homepage = "https://github.com/WhyNotHugo/python-barcode";
+    changelog = "https://github.com/WhyNotHugo/python-barcode/blob/v${version}/docs/changelog.rst";
    license = licenses.mit;
    maintainers = with maintainers; [ wolfangaukang ];
  };
--- a/pkgs/development/python-modules/rpds-py/default.nix
+++ b/pkgs/development/python-modules/rpds-py/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "rpds-py";
-  version = "0.7.1";
+  version = "0.8.8";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -18,13 +18,13 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "rpds_py";
    inherit version;
-    hash = "sha256-2UC1ZE8U5JscbnkCueyKDHWEEJ+/OA+hgRWDGmQZJ8g=";
+    hash = "sha256-MAuFeXQLBuJGI4tzDmNvMUp9jcR1vhhoZQ9dPdwpoNg=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-BAoE0oRQGf5ze/8uAH6gsFP77lPvOvYy8W9iDrqUn3Q=";
+    hash = "sha256-jg9oos4wqewIHe31c3DixIp6fssk742kqt4taWyOq4U=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/sensor-state-data/default.nix
+++ b/pkgs/development/python-modules/sensor-state-data/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "sensor-state-data";
-  version = "2.16.0";
+  version = "2.16.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-GJmeAhakNCocSR/HtUsSiNsrFdFmUK6eI5U2mHXD/5c=";
+    hash = "sha256-J3QX4utnr64xNMt81kwGX6VJlDz6qe5oz+sjH5JATZQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/sunweg/default.nix
+++ b/pkgs/development/python-modules/sunweg/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "sunweg";
-  version = "1.0.0";
+  version = "2.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "rokam";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-fGaPn4pp1nDL4MX7K8zP2Vq2R/uRtd8rHSaWEG5Ye7s=";
+    hash = "sha256-S92PybN+pReI9WtJr9as95uceicsSMadMQfh9JxsE8U=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/database/beekeeper-studio/default.nix
+++ b/pkgs/development/tools/database/beekeeper-studio/default.nix
@ -18,7 +18,7 @@ in
 appimageTools.wrapType2 {
  inherit name src;

-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
  extraPkgs = pkgs: appimageTools.defaultFhsEnvArgs.multiPkgs pkgs ++ [ pkgs.bash ];

  extraInstallCommands = ''
--- a/pkgs/development/tools/faas-cli/default.nix
+++ b/pkgs/development/tools/faas-cli/default.nix
@ -18,13 +18,13 @@ let
 in
 buildGoModule rec {
  pname = "faas-cli";
-  version = "0.16.7";
+  version = "0.16.11";

  src = fetchFromGitHub {
    owner = "openfaas";
    repo = "faas-cli";
    rev = version;
-    sha256 = "sha256-VI7whlEekFalORlRTX/CEelm2zNi/QTqVgU/XkF3K48=";
+    sha256 = "sha256-B418oQpwB1yhsWRo58TGc2PonTlx3Lrcx1pJrbdJ2KM=";
  };

  vendorHash = null;
--- a/pkgs/development/tools/fastgron/default.nix
+++ b/pkgs/development/tools/fastgron/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fastgron";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "adamritter";
    repo = "fastgron";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-SqJdJnepfX/qHiACjpaTNM+/lApcADCCbcX+BNgXswg=";
+    hash = "sha256-614edimiz+n8Gwr4vYq7PvQmceItfQL2Gt4cYgsxISc=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/tools/jet/default.nix
+++ b/pkgs/development/tools/jet/default.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "jet";
-  version = "0.5.25";
+  version = "0.6.26";

  src = fetchurl {
    url = "https://github.com/borkdude/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-4uXK9MRBXLjfHDNl6KJY1n9b02uXg+BlIr/q1DGeRKU=";
+    sha256 = "sha256-zlSIIZ0YV6ussgAylz8QGmKBi8MwIIMzmloIf4bHvHU=";
  };

  extraNativeImageBuildArgs = [
--- a/pkgs/development/tools/language-servers/lua-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/lua-language-server/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "lua-language-server";
-  version = "3.6.22";
+  version = "3.6.23";

  src = fetchFromGitHub {
    owner = "luals";
    repo = "lua-language-server";
    rev = version;
-    sha256 = "sha256-0A5bbWoZtfL6NLG9nr8u4k1pLP1Fj/+A4ep2uN7x41o=";
+    sha256 = "sha256-tax4Pb99khAMDE6KH288Gihr8McpKg3DHBNVJnPnXbs=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/tools/misc/spruce/default.nix
+++ b/pkgs/development/tools/misc/spruce/default.nix
@ -2,17 +2,16 @@

 buildGoModule rec {
  pname = "spruce";
-  version = "unstable-2022-02-10";
+  version = "1.30.2";

  src = fetchFromGitHub {
    owner = "geofffranks";
    repo = pname;
-    rev = "473931f33fceae90b3f5cfb7616c296343a9559b";
-    sha256 = "sha256-TFyWkoAKmj3KH2pqhVKMtP6QKTtu0s7H5gNP+fotUzg=";
+    rev = "v${version}";
+    hash = "sha256-flY81xiUfOyfdavhF0AyIwrB2G8N6BWltdGMT2uf9Co=";
  };

-  deleteVendor = true;
-  vendorSha256 = "sha256-VeC5c/BgcxK3Qawb2QOhqtfTIgbQbrQj546zX6yPD+s=";
+  vendorHash = null;

  meta = with lib; {
    description = "A BOSH template merge tool";
--- a/pkgs/development/tools/skopeo/default.nix
+++ b/pkgs/development/tools/skopeo/default.nix
@ -18,13 +18,13 @@

 buildGoModule rec {
  pname = "skopeo";
-  version = "1.12.0";
+  version = "1.13.0";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "containers";
    repo = "skopeo";
-    hash = "sha256-a4uM2WjDhjz4zTiM2HWoDHQQ9aT38HV9GNUJAJmZR+w=";
+    hash = "sha256-PSBwwF6tIQ6EZD/nWj5Lw0ifk1aLLJl/qaj5EsksBBo=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/development/web/bloomrpc/default.nix
+++ b/pkgs/development/web/bloomrpc/default.nix
@ -21,7 +21,7 @@ appimageTools.wrapType2 {
    export LC_ALL=C.UTF-8
  '';

-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
  extraPkgs = pkgs: appimageTools.defaultFhsEnvArgs.multiPkgs pkgs ++ [ pkgs.bash ];

  extraInstallCommands = ''
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.1.43";
+  version = "0.1.51";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    hash = "sha256-mvB5TCPkRWDAkDd4PV50EKjtlaZSFqTl6IDMTnPDrng=";
+    hash = "sha256-5wokG37aP15VGRbH14kyVVH1VfKbbvMZrZl7gP0WbSE=";
  };

-  vendorHash = "sha256-2us72JBzLXaxJ6X6T/Hc2y4YVoAJ6YvJVJdO3KzsbkE=";
+  vendorHash = "sha256-7cwe0POozQeeabQQxtnJNWRmM5bWqmzVx/2TDPeoCx8=";

  subPackages = [ "." ];

--- a/pkgs/games/heroic/fhsenv.nix
+++ b/pkgs/games/heroic/fhsenv.nix
@ -9,6 +9,9 @@ buildFHSEnv {

  runScript = "heroic";

+  # Many Wine and native games need 32-bit libraries.
+  multiArch = true;
+
  targetPkgs = pkgs: with pkgs; [
    heroic-unwrapped
    gamemode
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@ -61,6 +61,9 @@ let
 in buildFHSEnv rec {
  name = "steam";

+  # Steam still needs 32bit and various native games do too
+  multiArch = true;
+
  targetPkgs = pkgs: with pkgs; [
    steam
    # License agreement
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@ -2,71 +2,71 @@
    "4.14": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.14.319-hardened1.patch",
-            "sha256": "1dz59az2k1lg5csx70p4nb634cv57b7ij554hkvln7bp6m9cm1ga",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.319-hardened1/linux-hardened-4.14.319-hardened1.patch"
+            "name": "linux-hardened-4.14.320-hardened1.patch",
+            "sha256": "1j457mfkxqzv996brwzxaib43s8fdpd5ngrnj61vs3vf8xcwk186",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.320-hardened1/linux-hardened-4.14.320-hardened1.patch"
        },
-        "sha256": "1y8zp9jkyid4g857nfm7xhsya3d9vx2dni8l7ishn2gl087pb95c",
-        "version": "4.14.319"
+        "sha256": "09bn18jvazkc55bqdjbxy8fbca7vjhi9xl2h02w0sq3f1jf6g0pd",
+        "version": "4.14.320"
    },
    "4.19": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.19.287-hardened1.patch",
-            "sha256": "1my4j6i549xw2zzbxnbaarby7584ysy4l1xgw3x8cc848l2m1iqp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.287-hardened1/linux-hardened-4.19.287-hardened1.patch"
+            "name": "linux-hardened-4.19.288-hardened1.patch",
+            "sha256": "0iw70vp9m7ldq85jfycfaihq2974giwi1d9fdd1yrhljlwzf9y6p",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.288-hardened1/linux-hardened-4.19.288-hardened1.patch"
        },
-        "sha256": "0wracrahi4qm6klsd9bnlwwdcaqbclx2mqc5d7vbvxxzfn69nsi8",
-        "version": "4.19.287"
+        "sha256": "1sz3jp6kx0axdwp0wsq903q1090rbav9d12m5128335m8p2d1srk",
+        "version": "4.19.288"
    },
    "5.10": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.10.185-hardened1.patch",
-            "sha256": "05abqsbsr6mjj0yxwwwf2hwsxd3z3jj2wkj0frd1ygb06njkvpjz",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.185-hardened1/linux-hardened-5.10.185-hardened1.patch"
+            "name": "linux-hardened-5.10.186-hardened1.patch",
+            "sha256": "0k6f2sxk2gy601w0132i5glznhi35wbdpxkqsfgxlr2gi2w021wr",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.186-hardened1/linux-hardened-5.10.186-hardened1.patch"
        },
-        "sha256": "143hghmj4lxiyavndvdmwg5mig8s2i4ffrmd8zwqqwy8ipn641i8",
-        "version": "5.10.185"
+        "sha256": "1qqv91r13akgik1q4jybf8czskxxizk6lpv4rsvjn9sx2dm2jq0y",
+        "version": "5.10.186"
    },
    "5.15": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.15.118-hardened1.patch",
-            "sha256": "07knyxmb0j2bf117md2glyyqj892n4p4jq2ahd8s90fp0x8g6z9a",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.118-hardened1/linux-hardened-5.15.118-hardened1.patch"
+            "name": "linux-hardened-5.15.120-hardened1.patch",
+            "sha256": "0wqnwjww062ykh1y2yrbsy75b0fz8xlkazijgvj3rl14wvccf39x",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.120-hardened1/linux-hardened-5.15.120-hardened1.patch"
        },
-        "sha256": "1cxm7s19l2f38chxrlvx7crvqcygmc77rhsc3lfx3m84vgdg8ssf",
-        "version": "5.15.118"
+        "sha256": "1xl3nrykbxdwv5a9rk0xnb7l61dsyjvkm1ryrdii09vbmsg0i6b4",
+        "version": "5.15.120"
    },
    "5.4": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.4.248-hardened1.patch",
-            "sha256": "0zd1s6xxpv6j2hmm56x4pg9dxakrmkf29x3vv6pjq3hmcp8ihs4s",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.248-hardened1/linux-hardened-5.4.248-hardened1.patch"
+            "name": "linux-hardened-5.4.249-hardened1.patch",
+            "sha256": "11rwyr68wrhjl0cdkvbgcpxwz4bwx3hii9k6xmai7hpds6rb3nsx",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.249-hardened1/linux-hardened-5.4.249-hardened1.patch"
        },
-        "sha256": "0d9yn51rg59k39h0w6wmvjqz9n7najm9x8yb79rparbcwwrd3gis",
-        "version": "5.4.248"
+        "sha256": "079mylc5j7hk5xn59q3z2xydyh88pq7yipn67x3y7nvf5i35hm6w",
+        "version": "5.4.249"
    },
    "6.1": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-6.1.35-hardened1.patch",
-            "sha256": "0s9ld5dnzxyizm8bdv4dc8lh3yfqv45hd65k0sc4swlnb1k96dxb",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.35-hardened1/linux-hardened-6.1.35-hardened1.patch"
+            "name": "linux-hardened-6.1.38-hardened1.patch",
+            "sha256": "0sv8i26xwgw3a36yga79n36a5xbrs3ajn8wdkqn40ydbzp24i0qc",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.38-hardened1/linux-hardened-6.1.38-hardened1.patch"
        },
-        "sha256": "1b16pk0b45k1q53nzbwv6wh0aqn160b1kip8scywf3axpi1q2dmy",
-        "version": "6.1.35"
+        "sha256": "0hrdh1w9z8bgy4cxqsxfkwa01yincfw1mq1bbwm36zczc0dzk97r",
+        "version": "6.1.38"
    },
    "6.3": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-6.3.1-hardened1.patch",
-            "sha256": "0wlp6azlkj9xbkwxyari28ixini0jvw2dl653i7ns4l27p0gmayx",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.3.1-hardened1/linux-hardened-6.3.1-hardened1.patch"
+            "name": "linux-hardened-6.3.12-hardened1.patch",
+            "sha256": "12dqdn2prr0mczwcy48907wpp235n87pl22gwyfilsxcj94x2wrx",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.3.12-hardened1/linux-hardened-6.3.12-hardened1.patch"
        },
-        "sha256": "0aizkgwdmdjrgab67yjfaqcmvfh7wb3b3mdq9qfxpq6mlys0yqkq",
-        "version": "6.3.1"
+        "sha256": "1mvcirkhqnf03cci3jiq077fs9b42a3xdk3zjkpyim3x43ydwzyb",
+        "version": "6.3.12"
    }
 }
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.15.119";
+  version = "5.15.120";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1kygpqf6sgkrwg77sv01di23c3n3rn5d44g8k5apx5106pys19bs";
+    sha256 = "1xl3nrykbxdwv5a9rk0xnb7l61dsyjvkm1ryrdii09vbmsg0i6b4";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "6.1.37";
+  version = "6.1.38";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    hash = "sha256-RsrXEtJhojyOSDo7ebaoS5pfcxqJIckSffNa41zvHoA=";
+    sha256 = "0hrdh1w9z8bgy4cxqsxfkwa01yincfw1mq1bbwm36zczc0dzk97r";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-6.3.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.3.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "6.3.11";
+  version = "6.3.12";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "sha256-HVo/vU1CZbbJYF1cYF2UdnPnZDryiQ5K1clGlA8SPhY=";
+    sha256 = "1mvcirkhqnf03cci3jiq077fs9b42a3xdk3zjkpyim3x43ydwzyb";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-6.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.4.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "6.4.1";
+  version = "6.4.2";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = versions.pad 3 version;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "sha256-DZ2qnxwXb7E7lEf249gOgrSQQ/DTRMJHu/CbTmJb7vM=";
+    sha256 = "0b0623pvf9spb5biv1k4wzjbcj9fyf2svk69fdyb3ibn84ian9m3";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@ -6,7 +6,7 @@
 , ... } @ args:

 let
-  version = "5.10.184-rt90"; # updated by ./update-rt.sh
+  version = "5.10.186-rt91"; # updated by ./update-rt.sh
  branch = lib.versions.majorMinor version;
  kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@ -17,14 +17,14 @@ in buildLinux (args // {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0219qv9rxg4fi7w2s0s9y7ggral40wm2riis58hmg80z3nybxabp";
+    sha256 = "1qqv91r13akgik1q4jybf8czskxxizk6lpv4rsvjn9sx2dm2jq0y";
  };

  kernelPatches = let rt-patch = {
    name = "rt";
    patch = fetchurl {
      url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1cyxlc229j23yqgl65h3hgv51x76h1pppcn6ihicvc50vv7h5mjk";
+      sha256 = "1h5p0p3clq0gmaszvddmfll17adv02wfp2bfrd5x3aigvigwfmjb";
    };
  }; in [ rt-patch ] ++ kernelPatches;

--- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@ -6,7 +6,7 @@
 , ... } @ args:

 let
-  version = "5.15.113-rt64"; # updated by ./update-rt.sh
+  version = "5.15.119-rt65"; # updated by ./update-rt.sh
  branch = lib.versions.majorMinor version;
  kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@ -18,14 +18,14 @@ in buildLinux (args // {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1jmrnd0ri75gl0k80g93zqyg00lbf1gqai3dga383ms92799hkja";
+    sha256 = "1kygpqf6sgkrwg77sv01di23c3n3rn5d44g8k5apx5106pys19bs";
  };

  kernelPatches = let rt-patch = {
    name = "rt";
    patch = fetchurl {
      url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0nxnviivsshs20zh8px657mr31wfsjdy70z793f56bf9s2m4kl31";
+      sha256 = "1lkr3l0gad30brdq7kdgvqr3zz4xrd7ai8jh94di6l5krhi7s1w0";
    };
  }; in [ rt-patch ] ++ kernelPatches;

--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@ -6,7 +6,7 @@
 , ... } @ args:

 let
-  version = "5.4.242-rt81"; # updated by ./update-rt.sh
+  version = "5.4.248-rt83"; # updated by ./update-rt.sh
  branch = lib.versions.majorMinor version;
  kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@ -14,14 +14,14 @@ in buildLinux (args // {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0a7wfi84p74qsnbj1vamz4qxzp94v054jp1csyfl0blz3knrlbql";
+    sha256 = "0d9yn51rg59k39h0w6wmvjqz9n7najm9x8yb79rparbcwwrd3gis";
  };

  kernelPatches = let rt-patch = {
    name = "rt";
    patch = fetchurl {
      url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1wszhzw9ic018x3jiz8x1ffxxg30wpy4db7hja44b661p9fjm1dc";
+      sha256 = "1rr4vnynxwmlgnm5xq1m0xhykh72lkv2lsginbh5nk60k3qwizh2";
    };
  }; in [ rt-patch ] ++ kernelPatches;

--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@ -66,12 +66,4 @@
      hash = "sha256-DYPWgraXPNeFkjtuDYkFXHnCJ4yDewrukM2CCAqC2BE=";
    };
  };
-
-  fix-amdgpu-5_15 = {
-    name = "fix-amdgpu-crash";
-    patch = fetchpatch {
-      url = "https://lore.kernel.org/stable/20230628111636.23300-1-mario.limonciello@amd.com/raw";
-      sha256 = "sha256-eAzy+bMiOJwzssOuvrMu7gmmV3PZezaDuVwwx7zNt6M=";
-    };
-  };
 }
--- a/pkgs/os-specific/linux/sd-switch/default.nix
+++ b/pkgs/os-specific/linux/sd-switch/default.nix
@ -1,17 +1,18 @@
-{ lib, fetchFromGitLab, rustPlatform, pkg-config, dbus }:
+{ lib, fetchFromSourcehut, rustPlatform, pkg-config, dbus }:

-rustPlatform.buildRustPackage rec {
+let version = "0.3.0";
+in rustPlatform.buildRustPackage {
  pname = "sd-switch";
-  version = "0.2.3";
+  inherit version;

-  src = fetchFromGitLab {
-    owner = "rycee";
-    repo = pname;
+  src = fetchFromSourcehut {
+    owner = "~rycee";
+    repo = "sd-switch";
    rev = version;
-    sha256 = "12h2d7v7pdz7b0hrna64561kf35nbpwb2kzxa791xk8raxc2b72k";
+    hash = "sha256-mWrLbCUnoJ3hVtpSU/7dw91U5TLyw5kNchX5nmP9asA=";
  };

-  cargoSha256 = "12ny3cir2nxzrmf4vwq6sgc35dbpq88hav53xqdp44rigdf4vzbs";
+  cargoHash = "sha256-VK+kPX1pGhowbWKkUs1PL0DXIhDXJOFVoIHTtWQcWEs=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ dbus ];
--- a/pkgs/servers/mastodon/gemset.nix
+++ b/pkgs/servers/mastodon/gemset.nix
@ -2637,10 +2637,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ga8yzc9zj45m92ycwnzhzahkwvc3dp3lym5m3f3880hs4jhh7l3";
+      sha256 = "1kymrjdpbmn4yaml3aaqyj1dzj8gqmm9h030dc2rj5mvja7fpi28";
      type = "gem";
    };
-    version = "6.0.1";
+    version = "6.0.2";
  };
  scenic = {
    dependencies = ["activerecord" "railties"];
--- a/pkgs/servers/mastodon/source.nix
+++ b/pkgs/servers/mastodon/source.nix
@ -3,8 +3,8 @@
  src = fetchFromGitHub {
    owner = "mastodon";
    repo = "mastodon";
-    rev = "v4.1.3";
-    sha256 = "F+cpL+ZFfe52f82qtJxuxRCILW3zr6K5OMrvaOgWe58=";
+    rev = "v4.1.4";
+    sha256 = "8ULBO8IdwBzC5dgX3netTHbbRrODX4CropWZWtqWHZw=";
  };
 in applyPatches {
  inherit src;
--- a/pkgs/servers/mastodon/version.nix
+++ b/pkgs/servers/mastodon/version.nix
@ -1 +1 @@
-"4.1.3"
+"4.1.4"
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@ -29,6 +29,7 @@
 , installShellFiles
 , nixosTests
 , gitUpdater
+, callPackage
 }:

 buildGoModule rec {
@ -99,6 +100,8 @@ buildGoModule rec {

  passthru.tests.lxd = nixosTests.lxd;
  passthru.tests.lxd-nftables = nixosTests.lxd-nftables;
+  passthru.tests.lxd-ui = nixosTests.lxd-ui;
+  passthru.ui = callPackage ./ui.nix { };
  passthru.updateScript = gitUpdater {
    url = "https://github.com/lxc/lxd.git";
    rev-prefix = "lxd-";
--- a/pkgs/tools/admin/lxd/package.json
+++ b/pkgs/tools/admin/lxd/package.json
@ -0,0 +1,103 @@
+{
+  "name": "lxd-ui",
+  "version": "0.0.1",
+  "author": "Canonical Webteam",
+  "license": "LGPL-3.0-only",
+  "scripts": {
+    "clean": "rm -rf node_modules yarn-error.log *.log build/ .jekyll-metadata .bundle",
+    "build-html": "cp build/ui/index.html build/index.html",
+    "build": "npx vite build && yarn build-html",
+    "format-js-eslint": "eslint 'src/**/*.{json,jsx,tsx,ts}' 'tests/**/*.ts' --fix",
+    "format-js-prettier": "prettier 'src/**/*.{json,jsx,tsx,ts}' 'tests/**/*.ts' --write",
+    "format-js": "yarn format-js-eslint && yarn format-js-prettier",
+    "lint-scss": "stylelint 'src/**/*.scss'",
+    "lint-js-eslint": "eslint 'src/**/*.{json,tsx,ts}' 'tests/**/*.ts' .eslintrc.js babel.config.js",
+    "lint-js-prettier": "prettier 'src/**/*.{json,tsx,ts}' 'tests/**/*.ts' .eslintrc.js babel.config.js --check",
+    "lint-js": "yarn lint-js-eslint && yarn lint-js-prettier",
+    "hooks-add": "husky install",
+    "hooks-remove": "husky uninstall",
+    "start": "concurrently --kill-others --raw 'vite | grep -v localhost' 'yarn serve'",
+    "serve": "./entrypoint"
+  },
+  "dependencies": {
+    "@canonical/react-components": "0.42.0",
+    "@monaco-editor/react": "^4.4.6",
+    "@tanstack/react-query": "^4.14.5",
+    "@use-it/event-listener": "^0.1.7",
+    "cytoscape": "3.23.0",
+    "cytoscape-popper": "2.0.0",
+    "formik": "2.2.9",
+    "js-yaml": "4.1.0",
+    "lodash.isequal": "4.5.0",
+    "node-forge": "1.3.1",
+    "parse-prometheus-text-format": "1.1.1",
+    "react": "18.2.0",
+    "react-cytoscapejs": "2.0.0",
+    "react-dom": "18.2.0",
+    "react-router-dom": "6.6.1",
+    "react-scripts": "5.0.1",
+    "react-useportal": "^1.0.17",
+    "serve": "14.1.2",
+    "vanilla-framework": "3.15.1",
+    "xterm-addon-fit": "0.6.0",
+    "xterm-for-react": "1.0.4",
+    "yup": "0.32.11"
+  },
+  "devDependencies": {
+    "@babel/core": "7.20.7",
+    "@babel/eslint-parser": "7.19.1",
+    "@babel/preset-env": "7.20.2",
+    "@babel/preset-react": "7.18.6",
+    "@babel/preset-typescript": "7.18.6",
+    "@playwright/test": "^1.29.1",
+    "@types/cytoscape-popper": "2.0.0",
+    "@types/node-forge": "1.3.1",
+    "@types/react": "18.0.26",
+    "@types/react-cytoscapejs": "1.2.2",
+    "@types/react-dom": "18.0.10",
+    "@types/react-router-dom": "5.3.3",
+    "@types/websocket": "1.0.5",
+    "@typescript-eslint/eslint-plugin": "5.48.0",
+    "@typescript-eslint/parser": "5.48.0",
+    "@vitejs/plugin-react": "^3.1.0",
+    "autoprefixer": "10.4.13",
+    "babel-loader": "9.1.0",
+    "babel-plugin-transform-es2015-modules-commonjs": "6.26.2",
+    "concurrently": "7.6.0",
+    "css-loader": "6.7.3",
+    "eslint": "8.31.0",
+    "eslint-config-prettier": "8.6.0",
+    "eslint-plugin-prettier": "4.2.1",
+    "eslint-plugin-react": "7.31.11",
+    "husky": "8.0.0",
+    "lint-staged": "13.1.1",
+    "monaco-editor": "0.36.1",
+    "postcss": "8.4.20",
+    "postcss-cli": "10.1.0",
+    "prettier": "2.8.1",
+    "sass": "1.57.1",
+    "sass-loader": "13.2.0",
+    "style-loader": "3.3.1",
+    "stylelint": "14.16.1",
+    "stylelint-config-prettier": "9.0.4",
+    "stylelint-config-standard-scss": "6.1.0",
+    "stylelint-order": "5.0.0",
+    "stylelint-prettier": "2.0.0",
+    "stylelint-scss": "4.3.0",
+    "ts-loader": "9.4.2",
+    "typescript": "4.9.4",
+    "vite": "^4.1.0",
+    "vite-tsconfig-paths": "4.0.5"
+  },
+  "lint-staged": {
+    "src/**/*.{json,jsx,ts,tsx}": [
+      "eslint",
+      "prettier --check"
+    ],
+    "tests/**/*.{json,jsx,ts,tsx}": [
+      "eslint",
+      "prettier --check"
+    ],
+    "src/**/*.scss": "stylelint"
+  }
+}
--- a/pkgs/tools/admin/lxd/ui.nix
+++ b/pkgs/tools/admin/lxd/ui.nix
@ -0,0 +1,42 @@
+{ mkYarnPackage
+, fetchFromGitHub
+, fetchYarnDeps
+, lib
+}:
+
+mkYarnPackage rec {
+  pname = "lxd-ui";
+  version = "unstable-2023-07-03";
+
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "lxd-ui";
+    rev = "c2e819a027d440cbb1cb9d450aad280dde68e231";
+    sha256 = "sha256-lEzGACSv6CpxnfkOcsdPrH6KRKDkoKv63m8Gsodk8uc=";
+  };
+
+  packageJSON = ./package.json;
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${src}/yarn.lock";
+    sha256 = "sha256-SLkgJDb9lwz/ShZh+H4YKAFRc1BdANWI5ndM2O6NzXE=";
+  };
+
+  buildPhase = ''
+    yarn --offline build
+  '';
+
+  installPhase = ''
+    cp -rv deps/lxd-ui/build/ui/ $out
+  '';
+
+  doDist = false;
+
+  meta = {
+    description = "Web user interface for LXD.";
+    homepage = "https://linuxcontainers.org/lxd/";
+    changelog = "https://github.com/canonical/lxd-ui";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/tools/misc/flexoptix-app/default.nix
+++ b/pkgs/tools/misc/flexoptix-app/default.nix
@ -28,7 +28,7 @@ in appimageTools.wrapAppImage {
  inherit pname version;
  src = appimageContents;

-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
  extraPkgs = { pkgs, ... }@args: [
    pkgs.hidapi
  ] ++ appimageTools.defaultFhsEnvArgs.multiPkgs args;
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
  pname = "goreleaser";
-  version = "1.19.0";
+  version = "1.19.2";

  src = fetchFromGitHub {
    owner = "goreleaser";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-vK/rvI7RTT4gb80G8wG1lA+WlKLWEBG74OetsHBUIhM=";
+    sha256 = "sha256-T8mLbEJ0fGm+rxwFVHziQyq+JcXC0OrThwyDPxcPHB0=";
  };

-  vendorHash = "sha256-56aE/Rd5l0kgEJ79EQbF/6xoKbNvEcp/l67gikhff4Y=";
+  vendorHash = "sha256-2m81ELHWbF9WKEMXmr5E8QReClWdVhPRJ+ZstrM6qY0=";

  ldflags =
    [ "-s" "-w" "-X main.version=${version}" "-X main.builtBy=nixpkgs" ];
--- a/pkgs/tools/misc/grub/add-hidden-menu-entries.patch
+++ b/pkgs/tools/misc/grub/add-hidden-menu-entries.patch
@ -0,0 +1,204 @@
+diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c
+index e9e9d94ef..54e08a1b4 100644
+--- a/grub-core/commands/legacycfg.c
+++ b/grub-core/commands/legacycfg.c
+@@ -143,7 +143,7 @@ legacy_file (const char *filename)
+ 	    args[0] = oldname;
+ 	    grub_normal_add_menu_entry (1, args, NULL, NULL, "legacy",
+ 					NULL, NULL,
+-					entrysrc, 0);
+					entrysrc, 0, 0);
+ 	    grub_free (args);
+ 	    entrysrc[0] = 0;
+ 	    grub_free (oldname);
+@@ -205,7 +205,7 @@ legacy_file (const char *filename)
+ 	}
+       args[0] = entryname;
+       grub_normal_add_menu_entry (1, args, NULL, NULL, NULL,
+-				  NULL, NULL, entrysrc, 0);
+				  NULL, NULL, entrysrc, 0, 0);
+       grub_free (args);
+     }
+ 
+diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
+index 720e6d8ea..50632ccce 100644
+--- a/grub-core/commands/menuentry.c
+++ b/grub-core/commands/menuentry.c
+@@ -78,7 +78,7 @@ grub_normal_add_menu_entry (int argc, const char **args,
+ 			    char **classes, const char *id,
+ 			    const char *users, const char *hotkey,
+ 			    const char *prefix, const char *sourcecode,
+-			    int submenu)
+			    int submenu, int hidden)
+ {
+   int menu_hotkey = 0;
+   char **menu_args = NULL;
+@@ -188,8 +188,11 @@ grub_normal_add_menu_entry (int argc, const char **args,
+   (*last)->args = menu_args;
+   (*last)->sourcecode = menu_sourcecode;
+   (*last)->submenu = submenu;
+  (*last)->hidden = hidden;
+
+  if (!hidden)
+    menu->size++;
+ 
+-  menu->size++;
+   return GRUB_ERR_NONE;
+ 
+  fail:
+@@ -286,7 +289,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+ 				       users,
+ 				       ctxt->state[2].arg, 0,
+ 				       ctxt->state[3].arg,
+-				       ctxt->extcmd->cmd->name[0] == 's');
+				       ctxt->extcmd->cmd->name[0] == 's',
+               ctxt->extcmd->cmd->name[0] == 'h');
+ 
+   src = args[argc - 1];
+   args[argc - 1] = NULL;
+@@ -303,7 +307,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+ 				  ctxt->state[0].args, ctxt->state[4].arg,
+ 				  users,
+ 				  ctxt->state[2].arg, prefix, src + 1,
+-				  ctxt->extcmd->cmd->name[0] == 's');
+				  ctxt->extcmd->cmd->name[0] == 's',
+          ctxt->extcmd->cmd->name[0] == 'h');
+ 
+   src[len - 1] = ch;
+   args[argc - 1] = src;
+@@ -311,7 +316,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+   return r;
+ }
+ 
+-static grub_extcmd_t cmd, cmd_sub;
+static grub_extcmd_t cmd, cmd_sub, cmd_hidden;
+ 
+ void
+ grub_menu_init (void)
+@@ -327,6 +332,12 @@ grub_menu_init (void)
+ 				  | GRUB_COMMAND_FLAG_EXTRACTOR,
+ 				  N_("BLOCK"), N_("Define a submenu."),
+ 				  options);
+  cmd_hidden = grub_register_extcmd ("hiddenentry", grub_cmd_menuentry,
+                  GRUB_COMMAND_FLAG_BLOCKS
+                  | GRUB_COMMAND_ACCEPT_DASH
+                  | GRUB_COMMAND_FLAG_EXTRACTOR,
+                  N_("BLOCK"), N_("Define a hidden menu entry."),
+                  options);
+ }
+ 
+ void
+diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c
+index 6a90e091f..4236f55bc 100644
+--- a/grub-core/normal/menu.c
+++ b/grub-core/normal/menu.c
+@@ -37,6 +37,8 @@
+    entry failing to boot.  */
+ #define DEFAULT_ENTRY_ERROR_DELAY_MS  2500
+ 
+#define MENU_INCLUDE_HIDDEN 0x10000
+
+ grub_err_t (*grub_gfxmenu_try_hook) (int entry, grub_menu_t menu,
+ 				     int nested) = NULL;
+ 
+@@ -80,8 +82,20 @@ grub_menu_get_entry (grub_menu_t menu, int no)
+ {
+   grub_menu_entry_t e;
+ 
+-  for (e = menu->entry_list; e && no > 0; e = e->next, no--)
+-    ;
+  if (no & MENU_INCLUDE_HIDDEN) {
+    no &= ~MENU_INCLUDE_HIDDEN;
+
+    for (e = menu->entry_list; e && no > 0; e = e->next, no--)
+      ;
+  } else {
+    for (e = menu->entry_list; e && no > 0; e = e->next, no--) {
+      /* Skip hidden entries */
+      while (e && e->hidden)
+        e = e->next;
+    }
+    while (e && e->hidden)
+      e = e->next;
+  }
+ 
+   return e;
+ }
+@@ -93,10 +107,10 @@ get_entry_index_by_hotkey (grub_menu_t menu, int hotkey)
+   grub_menu_entry_t entry;
+   int i;
+ 
+-  for (i = 0, entry = menu->entry_list; i < menu->size;
+  for (i = 0, entry = menu->entry_list; entry;
+        i++, entry = entry->next)
+     if (entry->hotkey == hotkey)
+-      return i;
+      return i | MENU_INCLUDE_HIDDEN;
+ 
+   return -1;
+ }
+@@ -509,6 +523,10 @@ get_entry_number (grub_menu_t menu, const char *name)
+       grub_menu_entry_t e = menu->entry_list;
+       int i;
+ 
+       /* Skip hidden entries */
+      while (e && e->hidden)
+        e = e->next;
+
+       grub_errno = GRUB_ERR_NONE;
+ 
+       for (i = 0; e; i++)
+@@ -520,6 +538,10 @@ get_entry_number (grub_menu_t menu, const char *name)
+ 	      break;
+ 	    }
+ 	  e = e->next;
+
+    /* Skip hidden entries */
+    while (e && e->hidden)
+      e = e->next;
+ 	}
+ 
+       if (! e)
+diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
+index b1321eb26..d2e46cac8 100644
+--- a/grub-core/normal/menu_text.c
+++ b/grub-core/normal/menu_text.c
+@@ -289,7 +289,11 @@ print_entries (grub_menu_t menu, const struct menu_viewer_data *data)
+       print_entry (data->geo.first_entry_y + i, data->offset == i,
+ 		   e, data);
+       if (e)
+-	e = e->next;
+	      e = e->next;
+
+      /* Skip hidden entries */
+      while (e && e->hidden)
+        e = e->next;
+     }
+ 
+   grub_term_gotoxy (data->term,
+diff --git a/include/grub/menu.h b/include/grub/menu.h
+index ee2b5e910..eb8a86ba9 100644
+--- a/include/grub/menu.h
+++ b/include/grub/menu.h
+@@ -58,6 +58,8 @@ struct grub_menu_entry
+ 
+   int submenu;
+ 
+  int hidden;
+
+   /* The next element.  */
+   struct grub_menu_entry *next;
+ };
+diff --git a/include/grub/normal.h b/include/grub/normal.h
+index 218cbabcc..bcb412466 100644
+--- a/include/grub/normal.h
+++ b/include/grub/normal.h
+@@ -145,7 +145,7 @@ grub_normal_add_menu_entry (int argc, const char **args, char **classes,
+ 			    const char *id,
+ 			    const char *users, const char *hotkey,
+ 			    const char *prefix, const char *sourcecode,
+-			    int submenu);
+			    int submenu, int hidden);
+ 
+ grub_err_t
+ grub_normal_set_password (const char *user, const char *password);
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@ -1,8 +1,6 @@
-{ lib, stdenv, fetchurl, flex, bison, python3, autoreconfHook, gnulib, libtool, bash
-, gettext, ncurses, libusb-compat-0_1, freetype, qemu, lvm2, unifont, pkg-config
+{ lib, stdenv, runCommand, fetchFromSavannah, flex, bison, python3, autoconf, automake, libtool, bash
+, rsync, gettext, ncurses, libusb-compat-0_1, freetype, qemu, lvm2, unifont, pkg-config
 , buildPackages
-, fetchpatch
-, pkgsBuildBuild
 , nixosTests
 , fuse # only needed for grub-mount
 , runtimeShell
@ -42,8 +40,35 @@ let
  canEfi = lib.any (system: stdenv.hostPlatform.system == system) (lib.mapAttrsToList (name: _: name) efiSystemsBuild);
  inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.mapAttrsToList (name: _: name) pcSystems);

-  version = "2.06";
+  gnulib = fetchFromSavannah {
+    repo = "gnulib";
+    # NOTE: keep in sync with bootstrap.conf!
+    rev = "9f48fb992a3d7e96610c4ce8be969cff2d61a01b";
+    hash = "sha256-mzbF66SNqcSlI+xmjpKpNMwzi13yEWoc1Fl7p4snTto=";
+  };

+  src = fetchFromSavannah {
+    repo = "grub";
+    rev = "6425c12cd77ad51ad24be84c092aefacf0875089";
+    hash = "sha256-PSCa993Reph6w9+leE4a/9E6vIALdOqU3FZEPwasFyk=";
+  };
+
+  # HACK: the translations are stored on a different server,
+  # not versioned and not included in the git repo, so fetch them
+  # and hope they don't change often
+  locales = runCommand "grub-locales" {
+    nativeBuildInputs = [rsync];
+
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    outputHash = "sha256-bQPQ65gAcuUQ8ELB2hKywuXZ0kdC2bBCsUII/b4FkvQ=";
+  }
+  ''
+    mkdir -p po
+    ${src}/linguas.sh
+
+    mv po $out
+  '';
 in (

 assert efiSupport -> canEfi;
@ -52,301 +77,12 @@ assert !(efiSupport && xenSupport);

 stdenv.mkDerivation rec {
  pname = "grub";
-  inherit version;
-
-  src = fetchurl {
-    url = "mirror://gnu/grub/grub-${version}.tar.xz";
-    sha256 = "sha256-t56kSvkbk9F80/6Ava5u1DdwZ4qaWuGSzOqAPrtlfuE=";
-  };
+  version = "unstable-2023-07-03";
+  inherit src;

  patches = [
    ./fix-bash-completion.patch
-    (fetchpatch {
-      name = "Add-hidden-menu-entries.patch";
-      # https://lists.gnu.org/archive/html/grub-devel/2016-04/msg00089.html
-      url = "https://marc.info/?l=grub-devel&m=146193404929072&q=mbox";
-      sha256 = "00wa1q5adiass6i0x7p98vynj9vsz1w0gn1g4dgz89v35mpyw2bi";
-    })
-
-    # Pull upstream patch to fix linkage against binutils-2.36.
-    (fetchpatch {
-      name = "binutils-2.36.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b98275138bf4fc250a1c362dfd2c8b1cf2421701";
-      sha256 = "001m058bsl2pcb0ii84jfm5ias8zgzabrfy6k2cc9w6w1y51ii82";
-    })
-    # Properly handle multiple initrd paths in 30_os-prober
-    # Remove this patch once a new release is cut
-    (fetchpatch {
-      name = "Properly-handle-multiple-initrd-paths-in-os-prober.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=000b5cd04fd228f9741f5dca0491636bc0b89eb8";
-      sha256 = "sha256-Mex3qQ0lW7ZCv7ZI7MSSqbylJXZ5RTbR4Pv1+CJ0ciM=";
-    })
-
-    # Upstreamed patches for flicker-free boot
-    # Remove these patches once a new release is cut
-    (fetchpatch {
-      # term/efi/console: Do not set colorstate until the first text output
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9381dbe045b39bd9395c9ab4276d95b4041ec9fb";
-      sha256 = "sha256-ZFq/PdCYo6aRySZRAfZARO8BmXwGgqeXz+9uNgNJEO8=";
-    })
-    (fetchpatch {
-      # term/efi/console: Do not set cursor until the first text output
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7c316e18301e101e4dcd8abe88c0bed0b1b78857";
-      sha256 = "sha256-WJiK7MqmdStzq77vIDsO60Fu7i9LE/jDYzF4E9FXb7c=";
-    })
-    (fetchpatch {
-      # normal/menu: Don't show "Booting `%s'" msg when auto-booting with TIMEOUT_STYLE_HIDDEN
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5bb4f2b7d665c84bde402d1a528b652a61753380";
-      sha256 = "sha256-lwJPPyq6yj7X1C2RuHfxnwKKstFkWGxcMXuSQqd9Z4I=";
-    })
-    (fetchpatch {
-      # kern/main: Suppress the "Welcome to GRUB!" message in EFI builds
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=3e4cbbeca0ef35097301a1086f85fd0d119e64aa";
-      sha256 = "sha256-cQX4x9V5Y7SU9WACn5FzDjukL2/StAUMMoHY/DRHq+g=";
-    })
-
-    (fetchpatch {
-      name = "CVE-2021-3981.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0adec29674561034771c13e446069b41ef41e4d4";
-      sha256 = "sha256-3vkvWjcSv0hyY2EX3ig2EXEe+XLiRsXYlcd5kpY4wXw=";
-    })
-    # June 2022 security patches
-    # https://lists.gnu.org/archive/html/grub-devel/2022-06/msg00035.html
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.1.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1469983ebb9674753ad333d37087fb8cb20e1dce";
-      sha256 = "sha256-oB4S0jvIXsDPcjIz1E2LKm7gwdvZjywuI1j0P6JQdJg=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.2.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=14ceb3b3ff6db664649138442b6562c114dcf56e";
-      sha256 = "sha256-mKe8gzd0U4PbV8z3TWCdvv7UugEgYaVIkB4dyMrSGEE=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.3.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=04c86e0bb7b58fc2f913f798cdb18934933e532d";
-      sha256 = "sha256-sA+PTlk4hwYOVKRZBHkEskabzmsf47Hi4h3mzWOFjwM=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.4.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6fe755c5c07bb386fda58306bfd19e4a1c974c53";
-      sha256 = "sha256-8zmFocUfnjSyhYitUFDHoilHDnm1NJmhcKwO9dueV3k=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.5.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f1ce0e15e70ea1aafcfa26ad93e7585f65783c6f";
-      sha256 = "sha256-Wrlam6CRPUAHbKqe/X1YLcRxJ2LQTtmQ/Y66gxUlqK4=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.6.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5bff31cdb6b93d738f850834e6291df1d0b136fa";
-      sha256 = "sha256-ReLWSePXjRweymsVAL/uoBgYMWt9vRDcY3iXlDNZT0w=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.7.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=347880a13c239b4c2811c94c9a7cf78b607332e3";
-      sha256 = "sha256-07hpHuJFw95xGoJ/6ej7i6HlCFb2QRxP3arvRjKW4uU=";
-    })
-    ## Needed to apply patch 8
-    (fetchpatch {
-      name = "video-remove-trailing-whitespaces.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1f48917d8ddb490dcdc70176e0f58136b7f7811a";
-      sha256 = "sha256-/yf/LGpwYcQ36KITzmiFfg4BvhcApKbrlFzjKK8V2kI=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.8.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e623866d9286410156e8b9d2c82d6253a1b22d08";
-      sha256 = "sha256-zFxP6JY5Q9s3yJHdkbZ2w+dXFKeOCXjFnQKadB5HLCg=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.9.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=210245129c932dc9e1c2748d9d35524fb95b5042";
-      sha256 = "sha256-FyZhdTlcRVmn7X2hv93RhWP7NOoEMb7ib/DWveyz3Ew=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.10.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=690bee69fae6b4bd911293d6b7e56774e29fdf64";
-      sha256 = "sha256-nOAXxebCW/s5M6sjPKdSdx47/PcH1lc0yYT0flVwoC8=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.11.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d5caac8ab79d068ad9a41030c772d03a4d4fbd7b";
-      sha256 = "sha256-9fGJJkgZ6+E01MJqVTR1qFITx9EAx41Hv9QNfdqBgu0=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.12.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=768ef2199e0265cf455b154f1a80a612f02274c8";
-      sha256 = "sha256-2/JJJux5vqXUc77bi3aXRy8NclbvyD/0e6UN8/6Ui3c=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.13.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=166a4d61448f74745afe1dac2f2cfb85d04909bf";
-      sha256 = "sha256-XxTZ8P8qr4qEXELdHwaRACPeIZ/iixlATLB5RvVQsC8=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.14.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=22a3f97d39f6a10b08ad7fd1cc47c4dcd10413f6";
-      sha256 = "sha256-bzB2gmGvWR2ylvMw779KQ/VHBBMsDNbG96eg9qQlljA=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.15.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=830a9628b2c9e1b6388af624aaf4a80818ed6be0";
-      sha256 = "sha256-8fna2VbbUw8zBx77osaOOHlZFgRrHqwQK87RoUtCF6w=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.16.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=3e4817538de828319ba6d59ced2fbb9b5ca13287";
-      sha256 = "sha256-iCZAyRS/a15x5aJCJBYl9nw6Hc3WRCUG7zF5V+OwDKg=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.17.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f407e34f3871a4c402bbd516e7c28ea193cef1b7";
-      sha256 = "sha256-S45cLZNTWapAodKudUz2fMjnPsW6vbtNz0bIvIBGmu4=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.18.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1b7eef9fa4aaefbf7d0507505c3bb2914e1ad6b";
-      sha256 = "sha256-TWPfEAOePwC77yiVdsTSZIjfsMp7+0XabCz9K3FlV7w=";
-    })
-    ## Needed to apply patch 19
-    (fetchpatch {
-      name = "net-remove-trailing-whitespaces.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e453a4a64392a41bc7b37f890aceb358112d1687";
-      sha256 = "sha256-JCbUB77Y6js5u99uJ9StDxNjjahNy4nO3crK8/GvmPY=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.19.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=96abf4fb9d829f4a405d5df39bc74bbccbd0e322";
-      sha256 = "sha256-6E2MKO5kauFA1TA8YkUgIUusniwHS2Sr44A/a7ZqDCo=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.20.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ee9652031491326736714a988fbbaeab8ef9255c";
-      sha256 = "sha256-E21q+Mj+JBQlUW0pe4zbaoL3ErXmCanyizwAsRYYZHk=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.21.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8f287c3e13da2bf82049e2e464eca7ca4fef0a85";
-      sha256 = "sha256-dZ24RwYsHeUrMuiU7PDgPcw+iK9cOd6q+E0xWXbtTkE=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.22.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad94fffe14be476df5f34a8e5a90ea62a41fe12";
-      sha256 = "sha256-06TyTEvSy19dsnXZZoKBGx7ymJVWogr0NorzLflEwY4=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.23.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ec6bfd3237394c1c7dbf2fd73417173318d22f4b";
-      sha256 = "sha256-NryxSekO8oSxsnv5G9mFZExm4Pwfc778mslyUDuDhlM=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.24.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b26b4c08e7119281ff30d0fb4a6169bd2afa8fe4";
-      sha256 = "sha256-fSH3cxl/76DwkE8dHSR9uao9Vf1sJrhz7SmUSgDNodI=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.25.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4bd9877f62166b7e369773ab92fe24a39f6515f8";
-      sha256 = "sha256-VMtR/sF8F1BMKmJ06ZZEPNH/+l0RySy/E6lVWdCyFKE=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.26.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=deae293f399dde3773cf37dfa9b77ca7e04ef772";
-      sha256 = "sha256-sCC3KE9adavw7jHMTVlxtyuwDFCPRDqT24H3AKUYf68=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.27.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e40b83335bb33d9a2d1c06cc269875b3b3d6c539";
-      sha256 = "sha256-cviCfBkzacAtnHGW87RLshhduE4Ym/v2Vq4h/sZDmZg=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.28.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=11e1cffb7e2492ddac4ab8d19ce466783adbb957";
-      sha256 = "sha256-I1feoneVeU3XkscKfVprWWJfLUnrc5oauMXYDyDxo5M=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.29.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13dce204cf6f3f0f49c9949971052a4c9657c0c0";
-      sha256 = "sha256-DzFHxgR9A8FNZ/y9OMeBvTp1K6J5ePyL06dhHQmk7Ik=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.30.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2f4430cc0a44fd8c8aa7aee5c51887667ad3d6c3";
-      sha256 = "sha256-AufP/10/auO4NMjYQ7yPDDbYShwGaktyQtqJx2Jasz8=";
-    })
-    # October 2022 security patches
-    # https://lists.gnu.org/archive/html/grub-devel/2022-11/msg00059.html
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.1.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f6b6236077f059e64ee315f2d7acb8fa4eda87c5";
-      sha256 = "sha256-pk02iVf/u6CdsVjl8HaFBh0Bt473ZQzz5zBp9SoBLtE=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.2.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c76ec09ae08155df27cd237eaea150b4f02f532";
-      sha256 = "sha256-axbEOH5WFkUroGna2XY1f2kq7+B1Cs6LiubIA2EBdiM=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.3.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=768e1ef2fc159f6e14e7246e4be09363708ac39e";
-      sha256 = "sha256-aKDUVS/Yx1c87NCrt4EG8BlSpkHijUyAJIwbmtzNjD8=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.4.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c51292274ded3259eb04c2f1c8d253ffbdb5216a";
-      sha256 = "sha256-OLNOKuAJuHy2MBMnU2xcYM7AaxmDk9fchXhggoDrxJU=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.5.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=23843fe8947e4da955a05ad3d1858725bfcb56c8";
-      sha256 = "sha256-ptn00nqVJlEb1c6HhoMy9nrBuctH077LM4yXKsK47gc=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.6.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b9396daf1c2e3cdc0a1e69b056852e0769fb24de";
-      sha256 = "sha256-K7XNneDZjLpZh/C908+5uYsB/0oIdgQqmk0yJrdQLG4=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.7.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1d2015598cc7a9fca4b39186273e3519a88e80c7";
-      sha256 = "sha256-s4pZtszH4b/0u85rpzVapZmNQdYEq/wW06SQ3PW/1aU=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.8.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=93a786a00163e50c29f0394df198518617e1c9a5";
-      sha256 = "sha256-R8x557RMAxJ0ZV2jb6zDmwOPVlk6875q37fNpqKsPT0=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.9.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1eac01c147b4d85d2ec4a7e5671fa4345f2e8549";
-      sha256 = "sha256-eOnhmU3pT5cCVnNHcY/BzDjldfs7yh/OGsxa15tGv94=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.10.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=992c06191babc1e109caf40d6a07ec6fdef427af";
-      sha256 = "sha256-kezNKPcLmFXwyZbXtJbaPTIbE8tijmHIzdC2jsKwrNk=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.11.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9d81f71c6b8f55cf20cd56f5fe29c759df9b48cc";
-      sha256 = "sha256-jnniVGy4KvFGFmcOP2YLA46k3cK8vwoByo19ismVUzE=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.12.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=22b77b87e10a3a6c9bb9885415bc9a9c678378e6";
-      sha256 = "sha256-iYTEqN5997I7MVIg82jt/bbEAYhcgq8fNRCNPpY9ze0=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.13.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1514678888595ef41a968a0c69b7ff769edd1e9c";
-      sha256 = "sha256-tgAEoAtaNKJjscjMFkXXiVn59Pa4c+NiQ3iVW6CMrpo=";
-    })
-
-    # fix incompatibility with e2fsprogs 1.47+
-    (fetchpatch {
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7fd5feff97c4b1f446f8fcf6d37aca0c64e7c763";
-      sha256 = "sha256-pejn1bJkC7XnT2ODaxeERHUrMOONoBV6w0wF2Z2ZKWI=";
-    })
+    ./add-hidden-menu-entries.patch
  ];

  postPatch = if kbdcompSupport then ''
@ -357,7 +93,7 @@ stdenv.mkDerivation rec {
  '';

  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ bison flex python3 pkg-config gettext freetype autoreconfHook ];
+  nativeBuildInputs = [ bison flex python3 pkg-config gettext freetype autoconf automake ];
  buildInputs = [ ncurses libusb-compat-0_1 freetype lvm2 fuse libtool bash ]
    ++ lib.optional doCheck qemu
    ++ lib.optional zfsSupport zfs;
@ -368,9 +104,6 @@ stdenv.mkDerivation rec {

  separateDebugInfo = !xenSupport;

-  # Work around a bug in the generated flex lexer (upstream flex bug?)
-  env.NIX_CFLAGS_COMPILE = "-Wno-error";
-
  preConfigure =
    '' for i in "tests/util/"*.in
       do
@ -393,6 +126,18 @@ stdenv.mkDerivation rec {

      patchShebangs .

+      GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION)
+      if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then
+        echo "This version of GRUB requires a different gnulib revision!"
+        echo "We have: ${gnulib.rev}"
+        echo "GRUB needs: $GNULIB_REVISION"
+        exit 1
+      fi
+
+      cp -f --no-preserve=mode ${locales}/* po
+
+      ./bootstrap --no-git --gnulib-srcdir=${gnulib}
+
      substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts'
    '';

--- a/pkgs/tools/misc/pre-commit-hook-ensure-sops/default.nix
+++ b/pkgs/tools/misc/pre-commit-hook-ensure-sops/default.nix
@ -0,0 +1,50 @@
+{ lib
+, python3Packages
+, fetchFromGitHub
+, fetchpatch
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "pre-commit-hook-ensure-sops";
+  version = "1.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "yuvipanda";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-8sMmHNzmYwOmHYSWoZ4rKb/2lKziFmT6ux+s+chd/Do=";
+  };
+
+  patches = [
+    # Add the command-line entrypoint to pyproject.toml
+    # Can be removed after v1.2 release that includes changes
+    (fetchpatch {
+      url =
+        "https://github.com/yuvipanda/pre-commit-hook-ensure-sops/commit/ed88126afa253df6009af7cbe5aa2369f963be1c.patch";
+      hash = "sha256-mMxAoC3WEciO799Rq8gZ2PJ6FT/GbeSpxlr1EPj7r4s=";
+    })
+  ];
+
+  propagatedBuildInputs = [
+    python3Packages.ruamel-yaml
+  ];
+
+  pythonImportsCheck = [
+    "pre_commit_hook_ensure_sops"
+  ];
+
+  # Test entrypoint
+  checkPhase = ''
+    runHook preCheck
+    $out/bin/pre-commit-hook-ensure-sops --help
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "pre-commit hook to ensure that files that should be encrypted with sops are";
+    homepage = "https://github.com/yuvipanda/pre-commit-hook-ensure-sops";
+    maintainers = with maintainers; [ nialov ];
+    license = licenses.bsd3;
+  };
+}
--- a/pkgs/tools/misc/twspace-crawler/default.nix
+++ b/pkgs/tools/misc/twspace-crawler/default.nix
@ -2,16 +2,16 @@

 buildNpmPackage rec {
  pname = "twspace-crawler";
-  version = "1.12.2";
+  version = "1.12.3";

  src = fetchFromGitHub {
    owner = "HitomaruKonpaku";
    repo = "twspace-crawler";
-    rev = "8d325a1c8b811c62d971bc3d43cc1553d621f836"; # version not tagged
-    hash = "sha256-iV+M+x81j+djlCsAGDIG1V+Psrl1dYIv/ZL1EHfcXVs=";
+    rev = "d78caf0da5eb9c493e3d4d8b4ca47d434f4764bb"; # version not tagged
+    hash = "sha256-ONgPGlLRi0z2V1hB15w75GUt2Asc3hrRjuEjNSZc7Bc=";
  };

-  npmDepsHash = "sha256-vzSjcsxsEXyPjPAjJWckrKS6/wi17ZOZkDk5FDY7ZeI=";
+  npmDepsHash = "sha256-Gq1OWJlIIIOHoP0TMscaPXaVpmfexax2EjdTCDPmeQQ=";

  meta = with lib; {
    description = "Script to monitor & download Twitter Spaces 24/7";
--- a/pkgs/tools/misc/vector/Cargo.lock
+++ b/pkgs/tools/misc/vector/Cargo.lock
--- a/pkgs/tools/misc/vector/default.nix
+++ b/pkgs/tools/misc/vector/default.nix
@ -19,20 +19,21 @@
  # nix has a problem with the `?` in the feature list
  # enabling kafka will produce a vector with no features at all
 , enableKafka ? false
-  # TODO investigate adding "vrl-cli" and various "vendor-*"
+  # TODO investigate adding various "vendor-*"
  # "disk-buffer" is using leveldb TODO: investigate how useful
  # it would be, perhaps only for massive scale?
-, features ? ([ "api" "api-client" "enrichment-tables" "sinks" "sources" "sources-dnstap" "transforms" "vrl-cli" ]
+, features ? ([ "api" "api-client" "enrichment-tables" "sinks" "sources" "sources-dnstap" "transforms" "component-validation-runner" ]
    # the second feature flag is passed to the rdkafka dependency
    # building on linux fails without this feature flag (both x86_64 and AArch64)
    ++ lib.optionals enableKafka [ "rdkafka?/gssapi-vendored" ]
    ++ lib.optional stdenv.targetPlatform.isUnix "unix")
+, nixosTests
 , nix-update-script
 }:

 let
  pname = "vector";
-  version = "0.29.1";
+  version = "0.31.0";
 in
 rustPlatform.buildRustPackage {
  inherit pname version;
@ -41,17 +42,18 @@ rustPlatform.buildRustPackage {
    owner = "vectordotdev";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-4WqO7i1xthUU2bTzaS5poTh+wemjvqNAUFIDN73f7kw=";
+    hash = "sha256-+ATOHx+LQLQV4nMdj1FRRvDTqGCTbX9kl290AbY9Vw0=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
+      "aws-config-0.54.1" = "sha256-AVumLhybVbMnEah9/JqiQOQ4R0e2OsbB8WAJ422R6uk=";
      "azure_core-0.5.0" = "sha256-fojO7dhntpymMjV58TtYb7N4UN6rOp30D54x09RDXfQ=";
-      "chrono-0.4.24" = "sha256-SVPRfixSt0m14MmOcmBVseC/moj1DIA3B+m0pvT41K0=";
-      "datadog-filter-0.1.0" = "sha256-CNAIoDyJJo+D2Qzt6Fb2FwpQpzX02XurT8j1gHkz1bE=";
+      "chrono-0.4.26" = "sha256-4aDDfLK9H0tEyKlZVMIIU4NjvF70spVYFrfM3/05e0k=";
      "heim-0.1.0-rc.1" = "sha256-ODKEQ1udt7FlxI5fvoFMG7C2zmM45eeEYDUEaLTsdYo=";
      "nix-0.26.2" = "sha256-uquYvRT56lhupkrESpxwKEimRFhmYvri10n3dj0f2yg=";
+      "ntapi-0.3.7" = "sha256-G6ZCsa3GWiI/FeGKiK9TWkmTxen7nwpXvm5FtjNtjWU=";
      "tokio-util-0.7.4" = "sha256-rAzj44O+GOZhG+o6FVN5qCcG/NWxW8fUpScm+xsRjIs=";
      "tracing-0.2.0" = "sha256-YAxeEofFA43PX2hafh3RY+C81a2v6n1fGzYz2FycC3M=";
    };
@ -110,6 +112,7 @@ rustPlatform.buildRustPackage {

  passthru = {
    inherit features;
+    tests = { inherit (nixosTests) vector; };
    updateScript = nix-update-script { };
  };

--- a/pkgs/tools/misc/vtm/default.nix
+++ b/pkgs/tools/misc/vtm/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "vtm";
-  version = "0.9.9q";
+  version = "0.9.9r";

  src = fetchFromGitHub {
    owner = "netxs-group";
    repo = "vtm";
    rev = "v${version}";
-    sha256 = "sha256-HuKUt2hXE5kGkOknVngVjCWidia4E4csoODTuGwwx7k=";
+    sha256 = "sha256-HVhRzJReIxO4R9ZhI8vPcV29TRVffT/Eq6Z4u1xMpQo=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@ -5,17 +5,17 @@

 buildGoModule rec {
  pname = "cnspec";
-  version = "8.16.0";
+  version = "8.17.0";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    rev = "refs/tags/v${version}";
-    hash = "sha256-aTpE/8nPSnLqcj6KnBi70ZoOlkOXdmsw9INNnoVIjQw=";
+    hash = "sha256-pirU9mJnycr3wlc6lOAVSo0Wpb6q37ewdVcFzFPlr7s=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-pc9m58Sjegr2J+JqcOYu1xo3AZCN+EI2mlXKL14qqRU=";
+  vendorHash = "sha256-y63IWmBJaSUk1A5WRC9sokH+pNDhsc/Es1j50k5or8w=";

  subPackages = [
    "apps/cnspec"
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -8471,17 +8471,7 @@ with pkgs;

  grpc-client-cli = callPackage ../development/tools/misc/grpc-client-cli { };

-  grub2 = callPackage ../tools/misc/grub/default.nix {
-    # update breaks grub2
-    gnulib = pkgs.gnulib.overrideAttrs {
-      version = "20200223";
-      src = fetchgit {
-        url = "https://git.savannah.gnu.org/r/gnulib.git";
-        rev = "292fd5d6ff5ecce81ec3c648f353732a9ece83c0";
-        sha256 = "0hkg3nql8nsll0vrqk4ifda0v4kpi67xz42r8daqsql6c4rciqnw";
-      };
-    };
-  };
+  grub2 = callPackage ../tools/misc/grub/default.nix { };

  grub2_efi = grub2.override {
    efiSupport = true;
@ -11707,6 +11697,8 @@ with pkgs;

  pre-commit = callPackage ../tools/misc/pre-commit { };

+  pre-commit-hook-ensure-sops = callPackage ../tools/misc/pre-commit-hook-ensure-sops { };
+
  pretender = callPackage ../tools/security/pretender { };

  pretty-simple = callPackage ../development/tools/pretty-simple { };
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@ -150,7 +150,6 @@ in {
      kernelPatches = [
        kernelPatches.bridge_stp_helper
        kernelPatches.request_key_helper
-        kernelPatches.fix-amdgpu-5_15
      ];
    };

--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@ -204,16 +204,13 @@ lib.makeScope pkgs.newScope (self: with self; {
  # or php.withExtensions to extend the functionality of the PHP
  # interpreter.
  # The extensions attributes is composed of three sections:
-  # 1. The contrib conditional extensions, which are only available on specific versions or system
+  # 1. The contrib conditional extensions, which are only available on specific PHP versions
  # 2. The contrib extensions available
  # 3. The core extensions
  extensions =
  # Contrib conditional extensions
   lib.optionalAttrs (!(lib.versionAtLeast php.version "8.3")) {
    blackfire = callPackage ../development/tools/misc/blackfire/php-probe.nix { inherit php; };
-  } // lib.optionalAttrs (!stdenv.isDarwin) {
-    # Only available on Linux: https://www.php.net/manual/en/inotify.requirements.php
-    inotify = callPackage ../development/php-packages/inotify { };
  } //
  # Contrib extensions
  {
@ -239,6 +236,8 @@ lib.makeScope pkgs.newScope (self: with self; {

    imagick = callPackage ../development/php-packages/imagick { };

+    inotify = callPackage ../development/php-packages/inotify { };
+
    mailparse = callPackage ../development/php-packages/mailparse { };

    maxminddb = callPackage ../development/php-packages/maxminddb { };