Merge staging-next into staging

2024-10-31 06:31:20 +00:00 · 2023-02-27 18:02:06 +00:00 · 2023-02-27 18:02:06 +00:00 · 40707bbbb3
commit 40707bbbb3
parent 60a2f64123 b7f5d288c6
99 changed files with 747 additions and 575 deletions
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -1019,7 +1019,7 @@ buildPythonPackage rec {

 The `buildPythonPackage` mainly does four things:

-* In the `buildPhase`, it calls `${python.interpreter} setup.py bdist_wheel` to
+* In the `buildPhase`, it calls `${python.pythonForBuild.interpreter} setup.py bdist_wheel` to
  build a wheel binary zipfile.
 * In the `installPhase`, it installs the wheel file using `pip install *.whl`.
 * In the `postFixup` phase, the `wrapPythonPrograms` bash function is called to
@ -1546,7 +1546,7 @@ of such package using the feature is `pkgs/tools/X11/xpra/default.nix`.
 As workaround install it as an extra `preInstall` step:

 ```shell
-${python.interpreter} setup.py install_data --install-dir=$out --root=$out
+${python.pythonForBuild.interpreter} setup.py install_data --install-dir=$out --root=$out
 sed -i '/ = data\_files/d' setup.py
 ```

--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@ -135,7 +135,7 @@ in
      }
      {
        assertion = (cfg.configFile != null) != (cfg.settings != null);
-        message = "You need to either specify services.klipper.settings or services.klipper.defaultConfig.";
+        message = "You need to either specify services.klipper.settings or services.klipper.configFile.";
      }
    ];

--- a/nixos/modules/services/search/opensearch.nix
+++ b/nixos/modules/services/search/opensearch.nix
@ -199,12 +199,16 @@ in
              # java.security.AccessControlException:
              # access denied ("java.io.FilePermission" "/var/lib/opensearch/config/opensearch.yml" "read")

+              rm -f ${configDir}/opensearch.yml
              cp ${opensearchYml} ${configDir}/opensearch.yml

              # Make sure the logging configuration for old OpenSearch versions is removed:
              rm -f "${configDir}/logging.yml"
+              rm -f ${configDir}/${loggingConfigFilename}
              cp ${loggingConfigFile} ${configDir}/${loggingConfigFilename}
              mkdir -p ${configDir}/scripts
+
+              rm -f ${configDir}/jvm.options
              cp ${cfg.package}/config/jvm.options ${configDir}/jvm.options

              # redirect jvm logs to the data directory
--- a/pkgs/applications/audio/opustags/default.nix
+++ b/pkgs/applications/audio/opustags/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "opustags";
-  version = "1.6.0";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "fmang";
    repo = "opustags";
    rev = version;
-    sha256 = "1wsfw713rhi2gg5xc04cx5i31hlw0l3wdflj3r1y8w45bdk6ag1z";
+    sha256 = "sha256-vGMRzw46X3DNRIvlI9XEKoDwiJsVL0v9Nfn8pbszRbw=";
  };

  buildInputs = [ libogg ];
--- a/pkgs/applications/audio/pyradio/default.nix
+++ b/pkgs/applications/audio/pyradio/default.nix
@ -6,13 +6,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyradio";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "coderholic";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-8Kr+DRbkTKvhetIIs4htOHlIXGLpoe+T+0yxjm/JcWk=";
+    hash = "sha256-tu/qlrbTcUCIRF15x9ATKHH+LDy1OsGJpo5x+CerTKg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@ -12,13 +12,13 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "polkadot";
-  version = "0.9.37";
+  version = "0.9.38";

  src = fetchFromGitHub {
    owner = "paritytech";
    repo = "polkadot";
    rev = "v${version}";
-    hash = "sha256-/mgJNjliPUmMkhT/1oiX9+BJHfY3SMsKfFv9HCyWRQQ=";
+    hash = "sha256-qS9LZ9KBjOw7hEkUzu7eZFj6ZwbkCDxoqA7FPXb13o4=";

    # the build process of polkadot requires a .git folder in order to determine
    # the git commit hash that is being built and add it to the version string.
@ -34,7 +34,7 @@ rustPlatform.buildRustPackage rec {
    '';
  };

-  cargoHash = "sha256-o+APFYKgA3zjQSGrkpnyf5LEBBqvZtcfWlzCk6nL02A=";
+  cargoHash = "sha256-4BOgG/NzSppTeEtoEVxqlYjV4FGkNFMeF+qCJwPz+7o=";

  buildInputs = lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];

--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -149,7 +149,7 @@ stdenv.mkDerivation rec {
    export XDG_DATA_HOME=$out/share
    export XDG_UTILS_INSTALL_MODE="user"

-    ${python3Packages.python.interpreter} setup.py install --root=$out \
+    ${python3Packages.python.pythonForBuild.interpreter} setup.py install --root=$out \
      --prefix=$out \
      --libdir=$out/lib \
      --staging-root=$out \
--- a/pkgs/applications/misc/copyq/default.nix
+++ b/pkgs/applications/misc/copyq/default.nix
@ -58,5 +58,6 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ artturin ];
    # NOTE: CopyQ supports windows and osx, but I cannot test these.
    platforms = platforms.linux;
+    mainProgram = "copyq";
  };
 }
--- a/pkgs/applications/misc/dbx/default.nix
+++ b/pkgs/applications/misc/dbx/default.nix
@ -6,16 +6,22 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "dbx";
-  version = "0.7.6";
+  version = "0.8.8";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "databrickslabs";
    repo = "dbx";
-    rev = "v${version}";
-    hash = "sha256-P/cniy0xYaDoUbKdvV7KCubCpmOAhYp3cg2VBRA+a6I=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-nx6fz+atlnB/KxdznnZArHpyv41cuBDQauG0irq1Zyc=";
  };

+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "mlflow-skinny>=1.28.0,<3.0.0" "mlflow" \
+      --replace "rich==12.6.0" "rich"
+  '';
+
  propagatedBuildInputs = with python3.pkgs; [
    aiohttp
    click
@ -34,6 +40,19 @@ python3.pkgs.buildPythonApplication rec {
    watchdog
  ] ++ typer.optional-dependencies.all;

+  passthru.optional-dependencies = with python3.pkgs; {
+    aws = [
+      boto3
+    ];
+    azure = [
+      azure-storage-blob
+      azure-identity
+    ];
+    gcp = [
+      google-cloud-storage
+    ];
+  };
+
  nativeCheckInputs = [
    git
  ] ++ (with python3.pkgs; [
@ -43,12 +62,6 @@ python3.pkgs.buildPythonApplication rec {
    pytestCheckHook
  ]);

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "mlflow-skinny>=1.28.0,<=2.0.0" "mlflow" \
-      --replace "rich==12.5.1" "rich"
-  '';
-
  preCheck = ''
    export HOME=$(mktemp -d)
    export PATH="$PATH:$out/bin"
@ -73,6 +86,7 @@ python3.pkgs.buildPythonApplication rec {
  meta = with lib; {
    description = "CLI tool for advanced Databricks jobs management";
    homepage = "https://github.com/databrickslabs/dbx";
+    changelog = "https://github.com/databrickslabs/dbx/blob/v${version}/CHANGELOG.md";
    license = licenses.databricks-dbx;
    maintainers = with maintainers; [ GuillaumeDesforges ];
  };
--- a/pkgs/applications/networking/cluster/kaniko/default.nix
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@ -47,7 +47,7 @@ buildGoModule rec {
    homepage = "https://github.com/GoogleContainerTools/kaniko";
    license = lib.licenses.asl20;
    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.superherointj ];
+    maintainers = with lib.maintainers; [ jk superherointj ];
    mainProgram = "executor";
  };
 }
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@ -2,7 +2,7 @@

 (callPackage ./generic.nix { }) {
  channel = "edge";
-  version = "23.2.2";
-  sha256 = "1ylimwxp5b7dp14kjl5jimpjiqh5vh83cfah226kxndb6k64i7h8";
-  vendorSha256 = "sha256-UWzWBZBzoq4Mzqk3ukvGAcXqiSeJV/V3K2V1GOA9vwc=";
+  version = "23.2.3";
+  sha256 = "0lqbsh3237hh1rifi7w3h1mq4m6cnpxvb1h3dxghv5sblyivqfz9";
+  vendorSha256 = "sha256-gZ9t10Lj0wXeVBfmxKax9FYrcNL+ZEJOqhQfYw9Qwzw=";
 }
--- a/pkgs/applications/networking/mailreaders/afew/default.nix
+++ b/pkgs/applications/networking/mailreaders/afew/default.nix
@ -26,7 +26,7 @@ python3Packages.buildPythonApplication rec {
  outputs = [ "out" "doc" ];

  postBuild =  ''
-    ${python3Packages.python.interpreter} setup.py build_sphinx -b html,man
+    ${python3Packages.python.pythonForBuild.interpreter} setup.py build_sphinx -b html,man
  '';

  postInstall = ''
--- a/pkgs/applications/networking/p2p/zeronet-conservancy/default.nix
+++ b/pkgs/applications/networking/p2p/zeronet-conservancy/default.nix
@ -23,7 +23,7 @@ python3Packages.buildPythonApplication rec {
  ];

  buildPhase = ''
-    ${python3Packages.python.interpreter} -O -m compileall .
+    ${python3Packages.python.pythonForBuild.interpreter} -O -m compileall .
  '';

  installPhase = ''
--- a/pkgs/applications/networking/p2p/zeronet/default.nix
+++ b/pkgs/applications/networking/p2p/zeronet/default.nix
@ -18,7 +18,7 @@ python3Packages.buildPythonApplication rec {
  ];

  buildPhase = ''
-    ${python3Packages.python.interpreter} -O -m compileall .
+    ${python3Packages.python.pythonForBuild.interpreter} -O -m compileall .
  '';

  installPhase = ''
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@ -244,13 +244,13 @@ python.pkgs.buildPythonApplication rec {
  postBuild = ''
    # Compile manually because `pythonRecompileBytecodeHook` only works
    # for files in `python.sitePackages`
-    ${python.interpreter} -OO -m compileall src
+    ${python.pythonForBuild.interpreter} -OO -m compileall src

    # Collect static files
-    ${python.interpreter} src/manage.py collectstatic --clear --no-input
+    ${python.pythonForBuild.interpreter} src/manage.py collectstatic --clear --no-input

    # Compile string translations using gettext
-    ${python.interpreter} src/manage.py compilemessages
+    ${python.pythonForBuild.interpreter} src/manage.py compilemessages
  '';

  installPhase = ''
--- a/pkgs/applications/science/biology/bcftools/default.nix
+++ b/pkgs/applications/science/biology/bcftools/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "bcftools";
-  version = "1.16";
+  version = "1.17";

  src = fetchurl {
    url = "https://github.com/samtools/bcftools/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-kL9kfJrXnhCiQ7gFjIc94Ff9cBLiUNWuZXSDl4ei7NY=";
+    sha256 = "sha256-AfddjnAdhbLHWRckEgCcwE8pthYWrOL6dRFhI95Flsw=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/biology/quast/default.nix
+++ b/pkgs/applications/science/biology/quast/default.nix
@ -27,7 +27,7 @@ pythonPackages.buildPythonApplication rec {
      --replace "/bin/bash" "${bash}/bin/bash"
    mkdir -p "$out/${python.sitePackages}"
    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
-    ${python.interpreter} setup.py install \
+    ${python.pythonForBuild.interpreter} setup.py install \
      --install-lib=$out/${python.sitePackages} \
      --prefix="$out"
  '';
--- a/pkgs/applications/science/logic/z3/default.nix
+++ b/pkgs/applications/science/logic/z3/default.nix
@ -47,7 +47,7 @@ let common = { version, sha256, patches ? [ ], tag ? "z3" }:

    configurePhase = concatStringsSep " "
      (
-        [ "${python.interpreter} scripts/mk_make.py --prefix=$out" ]
+        [ "${python.pythonForBuild.interpreter} scripts/mk_make.py --prefix=$out" ]
          ++ optional javaBindings "--java"
          ++ optional ocamlBindings "--ml"
          ++ optional pythonBindings "--python --pypkgdir=$out/${python.sitePackages}"
--- a/pkgs/applications/terminal-emulators/wezterm/default.nix
+++ b/pkgs/applications/terminal-emulators/wezterm/default.nix
@ -27,6 +27,7 @@
 , UserNotifications
 , nixosTests
 , runCommand
+, vulkan-loader
 }:

 rustPlatform.buildRustPackage rec {
@ -106,7 +107,10 @@ rustPlatform.buildRustPackage rec {
  '';

  preFixup = lib.optionalString stdenv.isLinux ''
-    patchelf --add-needed "${libGL}/lib/libEGL.so.1" $out/bin/wezterm-gui
+    patchelf \
+      --add-needed "${libGL}/lib/libEGL.so.1" \
+      --add-needed "${vulkan-loader}/lib/libvulkan.so.1" \
+      $out/bin/wezterm-gui
  '' + lib.optionalString stdenv.isDarwin ''
    mkdir -p "$out/Applications"
    OUT_APP="$out/Applications/WezTerm.app"
--- a/pkgs/applications/window-managers/weston/default.nix
+++ b/pkgs/applications/window-managers/weston/default.nix
@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
    sha256 = "078y14ff9wmmbzq314f7bq1bxx0rc12xy4j362n60iamr56qs4x6";
  };

+  depsBuildBuild = [ pkg-config ];
  nativeBuildInputs = [ meson ninja pkg-config python3 wayland-scanner ];
  buildInputs = [
    cairo colord dbus freerdp lcms2 libGL libXcursor libdrm libevdev libinput
--- a/pkgs/data/misc/wireless-regdb/default.nix
+++ b/pkgs/data/misc/wireless-regdb/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "wireless-regdb";
-  version = "2022.08.12";
+  version = "2023.02.13";

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-Wcj30Xlm23Gyf5DnNe6PW0LKNSdpSoxebptWvTecO4Q=";
+    sha256 = "sha256-/oHoqGlNxHU6RQh6HEx+G0je5aWfX3ls43TqVQ8LLnM=";
  };

  dontBuild = true;
--- a/pkgs/development/interpreters/renpy/default.nix
+++ b/pkgs/development/interpreters/renpy/default.nix
@ -59,14 +59,14 @@ stdenv.mkDerivation rec {

  buildPhase = with python3.pkgs; ''
    runHook preBuild
-    ${python.interpreter} module/setup.py build --parallel=$NIX_BUILD_CORES
+    ${python.pythonForBuild.interpreter} module/setup.py build --parallel=$NIX_BUILD_CORES
    runHook postBuild
  '';

  installPhase = with python3.pkgs; ''
    runHook preInstall

-    ${python.interpreter} module/setup.py install --prefix=$out
+    ${python.pythonForBuild.interpreter} module/setup.py install --prefix=$out
    mkdir -p $out/share/renpy
    cp -vr sdk-fonts gui launcher renpy the_question tutorial renpy.py $out/share/renpy

--- a/pkgs/development/libraries/ldb/default.nix
+++ b/pkgs/development/libraries/ldb/default.nix
@ -63,6 +63,11 @@ stdenv.mkDerivation rec {
    "--without-ldb-lmdb"
  ];

+  # python-config from build Python gives incorrect values when cross-compiling.
+  # If python-config is not found, the build falls back to using the sysconfig
+  # module, which works correctly in all cases.
+  PYTHON_CONFIG = "/invalid";
+
  stripDebugList = [ "bin" "lib" "modules" ];

  meta = with lib; {
--- a/pkgs/development/libraries/libwacom/surface.nix
+++ b/pkgs/development/libraries/libwacom/surface.nix
@ -0,0 +1,37 @@
+{ lib
+, fetchFromGitHub
+, libwacom
+}:
+
+let
+  libwacom-surface = fetchFromGitHub {
+    owner = "linux-surface";
+    repo = "libwacom-surface";
+    rev = "v2.6.0-1";
+    hash = "sha256-4UOO9LMyCJd4LkqU0uva/0Xc44fIVdIQi27tJOtNEFk=";
+  };
+in libwacom.overrideAttrs (old: {
+  pname = "libwacom-surface";
+
+  # These patches will not be included upstream:
+  # https://github.com/linux-surface/libwacom/issues/2
+  patches = old.patches or [ ] ++ map (p: "${libwacom-surface}/patches/v2/${p}") [
+    "0001-Add-support-for-BUS_VIRTUAL.patch"
+    "0002-Add-support-for-Intel-Management-Engine-bus.patch"
+    "0003-data-Add-Microsoft-Surface-Pro-3.patch"
+    "0004-data-Add-Microsoft-Surface-Pro-4.patch"
+    "0005-data-Add-Microsoft-Surface-Pro-5.patch"
+    "0006-data-Add-Microsoft-Surface-Pro-6.patch"
+    "0007-data-Add-Microsoft-Surface-Pro-7.patch"
+    "0008-data-Add-Microsoft-Surface-Book.patch"
+    "0009-data-Add-Microsoft-Surface-Book-2-13.5.patch"
+    "0010-data-Add-Microsoft-Surface-Book-2-15.patch"
+    "0011-data-Add-Microsoft-Surface-Book-3-13.5.patch"
+    "0012-data-Add-Microsoft-Surface-Book-3-15.patch"
+  ];
+
+  meta = old.meta // {
+    homepage = "https://github.com/linux-surface/libwacom-surface";
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+})
--- a/pkgs/development/libraries/rocblas/default.nix
+++ b/pkgs/development/libraries/rocblas/default.nix
@ -27,7 +27,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rocblas";
-  version = "5.4.2";
+  version = "5.4.3";

  outputs = [
    "out"
@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "ROCmSoftwarePlatform";
    repo = "rocBLAS";
    rev = "rocm-${finalAttrs.version}";
-    hash = "sha256-4art8/KwH2KDLwSYcyzn/m/xwdg5wQQvgHks73aB+60=";
+    hash = "sha256-XhYpzBXviMnUdbF6lZi9g0LARKpzWLtDxJxLI3MuHiM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/science/chemistry/openmm/default.nix
+++ b/pkgs/development/libraries/science/chemistry/openmm/default.nix
@ -82,8 +82,8 @@ stdenv.mkDerivation rec {
      export OPENMM_LIB_PATH=$out/lib
      export OPENMM_INCLUDE_PATH=$out/include
      cd python
-      ${python3Packages.python.interpreter} setup.py build
-      ${python3Packages.python.interpreter} setup.py install --prefix=$out
+      ${python3Packages.python.pythonForBuild.interpreter} setup.py build
+      ${python3Packages.python.pythonForBuild.interpreter} setup.py install --prefix=$out
    '';

  postFixup = ''
--- a/pkgs/development/ocaml-modules/base64/default.nix
+++ b/pkgs/development/ocaml-modules/base64/default.nix
@ -2,13 +2,14 @@

 buildDunePackage rec {
  pname = "base64";
-  version = "3.5.0";
+  version = "3.5.1";

  minimalOCamlVersion = "4.03";
+  duneVersion = "3";

  src = fetchurl {
-    url = "https://github.com/mirage/ocaml-base64/releases/download/v${version}/base64-v${version}.tbz";
-    sha256 = "sha256-WJ3pwAV46/54QZismBjTWGxHSyMWts0+HEbMsfYq46Q=";
+    url = "https://github.com/mirage/ocaml-base64/releases/download/v${version}/base64-${version}.tbz";
+    hash = "sha256-2P7apZvRL+rnrMCLWSjdR4qsUj9MqNJARw0lAGUcZe0=";
  };

  nativeBuildInputs = [ findlib ];
--- a/pkgs/development/ocaml-modules/bistro/default.nix
+++ b/pkgs/development/ocaml-modules/bistro/default.nix
@ -20,7 +20,7 @@ buildDunePackage rec {
  pname = "bistro";
  version = "unstable-2022-05-07";

-  useDune2 = true;
+  duneVersion = "3";

  src = fetchFromGitHub {
    owner = "pveber";
--- a/pkgs/development/ocaml-modules/emile/default.nix
+++ b/pkgs/development/ocaml-modules/emile/default.nix
@ -15,11 +15,12 @@ buildDunePackage rec {
  pname = "emile";
  version = "1.1";

-  useDune2 = true;
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";

  src = fetchurl {
    url = "https://github.com/dinosaure/emile/releases/download/v${version}/emile-v${version}.tbz";
-    sha256 = "0r1141makr0b900aby1gn0fccjv1qcqgyxib3bzq8fxmjqwjan8p";
+    hash = "sha256:0r1141makr0b900aby1gn0fccjv1qcqgyxib3bzq8fxmjqwjan8p";
  };

  buildInputs = [ cmdliner ];
@ -32,10 +33,7 @@ buildDunePackage rec {
    uutf
  ];

-  # technically emile is available for ocaml >= 4.03, but alcotest
-  # and angstrom (fmt) are only available for >= 4.08. Disabling
-  # tests for < 4.08 at least improves the error message
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
  checkInputs = [ alcotest ];

  meta = with lib; {
--- a/pkgs/development/ocaml-modules/h2/default.nix
+++ b/pkgs/development/ocaml-modules/h2/default.nix
@ -30,6 +30,7 @@ buildDunePackage rec {
    src
    ;

+  duneVersion = "3";
  minimalOCamlVersion = "4.06";

  propagatedBuildInputs = [
--- a/pkgs/development/ocaml-modules/index/default.nix
+++ b/pkgs/development/ocaml-modules/index/default.nix
@ -10,10 +10,11 @@ buildDunePackage rec {

  src = fetchurl {
    url = "https://github.com/mirage/index/releases/download/${version}/index-${version}.tbz";
-    sha256 = "sha256-rPwNzqkWqDak2mDTDIBqIvachY1vfOIzFmwaXjZea+4=";
+    hash = "sha256-rPwNzqkWqDak2mDTDIBqIvachY1vfOIzFmwaXjZea+4=";
  };

  minimalOCamlVersion = "4.08";
+  duneVersion = "3";

  buildInputs = [
    stdlib-shims
--- a/pkgs/development/ocaml-modules/otr/default.nix
+++ b/pkgs/development/ocaml-modules/otr/default.nix
@ -6,14 +6,14 @@ buildDunePackage rec {
  pname = "otr";
  version = "0.3.10";

-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.08";

  src = fetchurl {
    url = "https://github.com/hannesm/ocaml-otr/releases/download/v${version}/otr-v${version}.tbz";
-    sha256 = "0dssc7p6s7z53n0mddyipjghzr8ld8bb7alaxqrx9gdpspwab1gq";
+    hash = "sha256:0dssc7p6s7z53n0mddyipjghzr8ld8bb7alaxqrx9gdpspwab1gq";
  };

-  useDune2 = true;
+  duneVersion = "3";

  propagatedBuildInputs = [ cstruct sexplib0 mirage-crypto mirage-crypto-pk
                            astring base64 ];
--- a/pkgs/development/ocaml-modules/progress/default.nix
+++ b/pkgs/development/ocaml-modules/progress/default.nix
@ -7,7 +7,7 @@ buildDunePackage rec {
  pname = "progress";

  minimalOCamlVersion = "4.08";
-  useDune2 = true;
+  duneVersion = "3";

  inherit (terminal) version src;

--- a/pkgs/development/ocaml-modules/repr/default.nix
+++ b/pkgs/development/ocaml-modules/repr/default.nix
@ -8,10 +8,11 @@ buildDunePackage rec {
    owner = "mirage";
    repo = "repr";
    rev = version;
-    sha256 = "sha256-jF8KmaG07CT26O/1ANc6s1yHFJqhXDtd0jgTA04tIgw=";
+    hash = "sha256-jF8KmaG07CT26O/1ANc6s1yHFJqhXDtd0jgTA04tIgw=";
  };

  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
  strictDeps = true;

  propagatedBuildInputs = [
--- a/pkgs/development/ocaml-modules/repr/ppx.nix
+++ b/pkgs/development/ocaml-modules/repr/ppx.nix
@ -4,6 +4,7 @@ buildDunePackage {
  pname = "ppx_repr";

  inherit (repr) src version strictDeps;
+  duneVersion = "3";

  propagatedBuildInputs = [
    ppx_deriving
--- a/pkgs/development/python-modules/apispec/default.nix
+++ b/pkgs/development/python-modules/apispec/default.nix
@ -4,6 +4,7 @@
 , marshmallow
 , mock
 , openapi-spec-validator
+, packaging
 , prance
 , pytestCheckHook
 , pythonOlder
@ -23,16 +24,26 @@ buildPythonPackage rec {
  };

  propagatedBuildInputs = [
-    pyyaml
-    prance
+    packaging
  ];

+  passthru.optional-dependencies = {
+    marshmallow = [
+      marshmallow
+    ];
+    yaml = [
+      pyyaml
+    ];
+    validation = [
+      openapi-spec-validator
+      prance
+    ];
+  };
+
  nativeCheckInputs = [
-    openapi-spec-validator
-    marshmallow
    mock
    pytestCheckHook
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);

  pythonImportsCheck = [
    "apispec"
--- a/pkgs/development/python-modules/bash_kernel/default.nix
+++ b/pkgs/development/python-modules/bash_kernel/default.nix
@ -43,7 +43,7 @@ buildPythonPackage rec {
  '';

  postInstall = ''
-    ${python.interpreter} -m bash_kernel.install --prefix $out
+    ${python.pythonForBuild.interpreter} -m bash_kernel.install --prefix $out
  '';

  meta = {
--- a/pkgs/development/python-modules/bashlex/default.nix
+++ b/pkgs/development/python-modules/bashlex/default.nix
@ -20,7 +20,7 @@ buildPythonPackage rec {

  # workaround https://github.com/idank/bashlex/issues/51
  preBuild = ''
-    ${python.interpreter} -c 'import bashlex'
+    ${python.pythonForBuild.interpreter} -c 'import bashlex'
  '';

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/datasets/default.nix
+++ b/pkgs/development/python-modules/datasets/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "datasets";
-  version = "2.9.0";
+  version = "2.10.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "huggingface";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-A6rrChzHHd7vS1KWlF/EZEjp1CEE0mNn4AlMdSYLD/I=";
+    hash = "sha256-GEH7uk8M5pxYDKzfTRNMlnI5yrLr5K2PuD7CJV/wbu4=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/deal/default.nix
+++ b/pkgs/development/python-modules/deal/default.nix
@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "deal";
-  version = "4.23.7";
+  version = "4.24.0";
  format = "pyproject";
  disabled = pythonOlder "3.7";

@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "life4";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-RWbMitgrU8VUsOgarBKYDNPIa/AwifvBURUytiGzeVo=";
+    hash = "sha256-5gd46SMucH0rek9talMJ74TMRRvUm5Up6pCusUIHDjE=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/django-cacheops/default.nix
+++ b/pkgs/development/python-modules/django-cacheops/default.nix
@ -7,6 +7,7 @@
 , pytest-django
 , pytestCheckHook
 , pythonOlder
+, six
 }:

 buildPythonPackage rec {
@ -25,6 +26,7 @@ buildPythonPackage rec {
    django
    funcy
    redis
+    six
  ];

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/flask-appbuilder/default.nix
+++ b/pkgs/development/python-modules/flask-appbuilder/default.nix
@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
 , apispec
 , colorama
 , click
@ -27,7 +26,7 @@

 buildPythonPackage rec {
  pname = "flask-appbuilder";
-  version = "4.1.3";
+  version = "4.2.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -35,23 +34,9 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "Flask-AppBuilder";
    inherit version;
-    hash = "sha256-8NaTr0RcnsVik/AB4g8QL+FkcRlgkkASFe8fXIvFt/A=";
+    hash = "sha256-rZbu0Bif5pOa/zu6MCrbGJpkqUdYzWyVgp6tqRzGyIc=";
  };

-  patches = [
-    (fetchpatch {
-      # https://github.com/dpgaspar/Flask-AppBuilder/pull/1734
-      name = "flask-appbuilder-wtf3.patch";
-      url = "https://github.com/dpgaspar/Flask-AppBuilder/commit/bccb3d719cd3ceb872fe74a9ab304d74664fbf43.patch";
-      hash = "sha256-24mlS3HIs77wKOlwdHah5oks31OOmCBHmcafZT2ITOc=";
-      excludes = [
-        "requirements.txt"
-        "setup.py"
-        "examples/employees/app/views.py"
-      ];
-    })
-  ];
-
  propagatedBuildInputs = [
    apispec
    colorama
@ -73,13 +58,13 @@ buildPythonPackage rec {
    pyjwt
    pyyaml
    sqlalchemy-utils
-  ];
+  ] ++ apispec.optional-dependencies.yaml;

  postPatch = ''
    substituteInPlace setup.py \
-      --replace "apispec[yaml]>=3.3, <4" "apispec[yaml] >=3.3" \
-      --replace "Flask-WTF>=0.14.2, <1.0.0" "Flask-WTF" \
-      --replace "WTForms<3.0.0" "WTForms" \
+      --replace "apispec[yaml]>=3.3, <6" "apispec[yaml]" \
+      --replace "Flask-SQLAlchemy>=2.4, <3" "Flask-SQLAlchemy" \
+      --replace "Flask-Babel>=1, <3" "Flask-Babel" \
      --replace "marshmallow-sqlalchemy>=0.22.0, <0.27.0" "marshmallow-sqlalchemy" \
      --replace "prison>=0.2.1, <1.0.0" "prison"
  '';
@ -94,7 +79,10 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Application development framework, built on top of Flask";
    homepage = "https://github.com/dpgaspar/flask-appbuilder/";
+    changelog = "https://github.com/dpgaspar/Flask-AppBuilder/blob/v${version}/CHANGELOG.rst";
    license = licenses.bsd3;
    maintainers = with maintainers; [ costrouc ];
+    # Support for flask-sqlalchemy >= 3.0 is missing, https://github.com/dpgaspar/Flask-AppBuilder/pull/1940
+    broken = true;
  };
 }
--- a/pkgs/development/python-modules/flask-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/flask-sqlalchemy/default.nix
@ -1,12 +1,12 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pdm-pep517
 , flask
 , mock
-, sqlalchemy
+, pdm-pep517
 , pytestCheckHook
 , pythonOlder
+, sqlalchemy
 }:

 buildPythonPackage rec {
--- a/pkgs/development/python-modules/geoip2/default.nix
+++ b/pkgs/development/python-modules/geoip2/default.nix
@ -1,28 +1,35 @@
-{ buildPythonPackage, lib, fetchPypi, pythonOlder
+{ lib
 , aiohttp
+, buildPythonPackage
+, fetchPypi
 , maxminddb
 , mocket
+, pytestCheckHook
+, pythonAtLeast
+, pythonOlder
 , requests
 , requests-mock
 , urllib3
-, pytestCheckHook
 }:

 buildPythonPackage rec {
-  version = "4.6.0";
  pname = "geoip2";
+  version = "4.6.0";
+  format = "setuptools";
+
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-8OgLzoCwa7OL0Iv0h31ahONU6TIJXmzPtNJ7tZj6T4M=";
+    hash = "sha256-8OgLzoCwa7OL0Iv0h31ahONU6TIJXmzPtNJ7tZj6T4M=";
  };

-  patchPhase = ''
-    substituteInPlace requirements.txt --replace "requests>=2.24.0,<3.0.0" "requests"
-  '';
-
-  propagatedBuildInputs = [ aiohttp maxminddb requests urllib3 ];
+  propagatedBuildInputs = [
+    aiohttp
+    maxminddb
+    requests
+    urllib3
+  ];

  nativeCheckInputs = [
    mocket
@ -30,11 +37,21 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [ "geoip2" ];
+  pythonImportsCheck = [
+    "geoip2"
+  ];
+
+  disabledTests = lib.optionals (pythonAtLeast "3.11") [
+    # https://github.com/maxmind/GeoIP2-python/pull/136
+    "TestAsyncClient"
+  ] ++ lib.optionals (pythonAtLeast "3.10") [
+    "test_request"
+  ];

  meta = with lib; {
    description = "GeoIP2 webservice client and database reader";
    homepage = "https://github.com/maxmind/GeoIP2-python";
+    changelog = "https://github.com/maxmind/GeoIP2-python/blob/v${version}/HISTORY.rst";
    license = licenses.asl20;
    maintainers = with maintainers; [ ];
  };
--- a/pkgs/development/python-modules/karton-dashboard/default.nix
+++ b/pkgs/development/python-modules/karton-dashboard/default.nix
@ -8,6 +8,7 @@
 , networkx
 , prometheus-client
 , pythonOlder
+, pythonRelaxDepsHook
 }:

 buildPythonPackage rec {
@ -25,6 +26,7 @@ buildPythonPackage rec {
  };

  patches = [
+    # Allow later mistune, https://github.com/CERT-Polska/karton-dashboard/pull/68
    (fetchpatch {
      name = "update-mistune.patch";
      url = "https://github.com/CERT-Polska/karton-dashboard/commit/d0a2a1ffd21e9066acca77434acaff7b20e460d0.patch";
@ -32,6 +34,17 @@ buildPythonPackage rec {
    })
  ];

+  pythonRelaxDeps = [
+    "Flask"
+    "mistune"
+    "networkx"
+    "prometheus-client"
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
  propagatedBuildInputs = [
    flask
    karton-core
@ -40,13 +53,6 @@ buildPythonPackage rec {
    prometheus-client
  ];

-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "Flask==2.0.3" "Flask" \
-      --replace "networkx==2.6.3" "networkx" \
-      --replace "prometheus_client==0.11.0" "prometheus_client"
-  '';
-
  # Project has no tests. pythonImportsCheck requires MinIO configuration
  doCheck = false;

--- a/pkgs/development/python-modules/manimpango/default.nix
+++ b/pkgs/development/python-modules/manimpango/default.nix
@ -49,7 +49,7 @@ buildPythonPackage rec {
  '';

  preBuild = ''
-    ${python.interpreter} setup.py build_ext --inplace
+    ${python.pythonForBuild.interpreter} setup.py build_ext --inplace
  '';

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/mocket/default.nix
+++ b/pkgs/development/python-modules/mocket/default.nix
@ -1,62 +1,69 @@
 { lib
-, buildPythonPackage
-, fetchPypi
-, pythonOlder
-, isPy3k
-, decorator
-, http-parser
-, python-magic
-, urllib3
-, pytestCheckHook
-, pytest-mock
 , aiohttp
+, asgiref
+, buildPythonPackage
+, decorator
 , fastapi
+, fetchPypi
 , gevent
+, httptools
 , httpx
+, isPy3k
+, pook
+, pytest-mock
+, pytestCheckHook
+, python-magic
+, pythonOlder
 , redis
 , requests
 , sure
-, pook
+, urllib3
 }:

 buildPythonPackage rec {
  pname = "mocket";
-  version = "3.10.9";
-  disabled = !isPy3k;
+  version = "3.11.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-fAVw5WvpJOITQWqA8Y6Xi7QbaunZ1WGXxAuUMXbh+Aw=";
+    hash = "sha256-OIdLP3hHnPZ9MqrHt6G5t2SSO342+jTACgzxM6RjVYM=";
  };

  propagatedBuildInputs = [
    decorator
-    http-parser
+    httptools
    python-magic
    urllib3
  ];

+  passthru.optional-dependencies = {
+    pook = [
+      pook
+    ];
+  };
+
  nativeCheckInputs = [
-    pytestCheckHook
-    pytest-mock
    aiohttp
+    asgiref
    fastapi
    gevent
    httpx
+    pytest-mock
+    pytestCheckHook
    redis
    requests
    sure
-    pook
-  ];
+  ] ++ passthru.optional-dependencies.pook;

-  # skip http tests
+  # Skip http tests
  SKIP_TRUE_HTTP = true;
-  pytestFlagsArray = [
+
+  disabledTestPaths = [
    # Requires a live Redis instance
-    "--ignore=tests/main/test_redis.py"
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    # Uses IsolatedAsyncioTestCase which is only available >= 3.8
-    "--ignore=tests/tests38/test_http_aiohttp.py"
+    "tests/main/test_redis.py"
  ];

  disabledTests = [
@ -74,11 +81,14 @@ buildPythonPackage rec {
    "test_gethostbyname"
  ];

-  pythonImportsCheck = [ "mocket" ];
+  pythonImportsCheck = [
+    "mocket"
+  ];

  meta = with lib; {
-    description = "A socket mock framework - for all kinds of socket animals, web-clients included";
+    description = "A socket mock framework for all kinds of sockets including web-clients";
    homepage = "https://github.com/mindflayer/python-mocket";
+    changelog = "https://github.com/mindflayer/python-mocket/releases/tag/${version}";
    license = licenses.bsd3;
    maintainers = with maintainers; [ hexa ];
  };
--- a/pkgs/development/python-modules/oci/default.nix
+++ b/pkgs/development/python-modules/oci/default.nix
@ -7,23 +7,33 @@
 , pyopenssl
 , python-dateutil
 , pythonOlder
+, pythonRelaxDepsHook
 , pytz
 }:

 buildPythonPackage rec {
  pname = "oci";
-  version = "2.92.0";
+  version = "2.93.0";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "oracle";
    repo = "oci-python-sdk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-evxY/1MhSCZOTjhH/2tI5amnZpd+fCdSdFBD4W9uZ+c=";
+    hash = "sha256-yH9SCrTASP+O9VLVs6tliteCOWi+Pc7nDOgiboHQE4s=";
  };

+  pythonRelaxDeps = [
+    "cryptography"
+    "pyOpenSSL"
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
  propagatedBuildInputs = [
    certifi
    circuitbreaker
@ -33,13 +43,6 @@ buildPythonPackage rec {
    pytz
  ];

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "configparser==4.0.2 ; python_version < '3'" "" \
-      --replace "cryptography>=3.2.1,<=37.0.2" "cryptography" \
-      --replace "pyOpenSSL>=17.5.0,<=22.0.0" "pyOpenSSL"
-  '';
-
  # Tests fail: https://github.com/oracle/oci-python-sdk/issues/164
  doCheck = false;

@ -49,7 +52,8 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Oracle Cloud Infrastructure Python SDK";
-    homepage = "https://oracle-cloud-infrastructure-python-sdk.readthedocs.io/";
+    homepage = "https://github.com/oracle/oci-python-sdk";
+    changelog = "https://github.com/oracle/oci-python-sdk/blob/v${version}/CHANGELOG.rst";
    license = with licenses; [ asl20 /* or */ upl ];
    maintainers = with maintainers; [ ilian ];
  };
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "peaqevcore";
-  version = "12.2.0";
+  version = "12.2.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-C7LF3mJwmu6mBA0Od2L1P0RxJWckC74irNuRkE9kxfY=";
+    hash = "sha256-WOuKGVrNZzvY7F0Mvj3MjSdTu47c5Y11ySe1qorzlWE=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pyairvisual/default.nix
+++ b/pkgs/development/python-modules/pyairvisual/default.nix
@ -1,7 +1,6 @@
 { lib
 , aiohttp
 , aresponses
-, asynctest
 , buildPythonPackage
 , fetchFromGitHub
 , numpy
@ -23,7 +22,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "bachya";
    repo = pname;
-    rev = version;
+    rev = "refs/tags/${version}";
    hash = "sha256-xzTho4HsIU2YLURz9DfFfaRL3tsrtVi8n5IA2bRkyzw=";
  };

@ -39,10 +38,10 @@ buildPythonPackage rec {

  nativeCheckInputs = [
    aresponses
-    asynctest
    pytest-aiohttp
    pytest-asyncio
    pytestCheckHook
+    pytestCheckHook
  ];

  disabledTestPaths = [
--- a/pkgs/development/python-modules/pycuda/default.nix
+++ b/pkgs/development/python-modules/pycuda/default.nix
@ -32,7 +32,7 @@ buildPythonPackage rec {
  };

  preConfigure = with lib.versions; ''
-    ${python.interpreter} configure.py --boost-inc-dir=${boost.dev}/include \
+    ${python.pythonForBuild.interpreter} configure.py --boost-inc-dir=${boost.dev}/include \
                          --boost-lib-dir=${boost}/lib \
                          --no-use-shipped-boost \
                          --boost-python-libname=boost_python${major python.version}${minor python.version} \
--- a/pkgs/development/python-modules/pygame/default.nix
+++ b/pkgs/development/python-modules/pygame/default.nix
@ -52,7 +52,7 @@ buildPythonPackage rec {
  ];

  preConfigure = ''
-    ${python.interpreter} buildconfig/config.py
+    ${python.pythonForBuild.interpreter} buildconfig/config.py
  '';

  checkPhase = ''
--- a/pkgs/development/python-modules/pygeos/default.nix
+++ b/pkgs/development/python-modules/pygeos/default.nix
@ -30,8 +30,8 @@ buildPythonPackage rec {
  # for the package to function. Therefore override of buildPhase was
  # necessary.
  buildPhase = ''
-    ${python.interpreter} setup.py build_ext --inplace
-    ${python.interpreter} setup.py bdist_wheel
+    ${python.pythonForBuild.interpreter} setup.py build_ext --inplace
+    ${python.pythonForBuild.interpreter} setup.py bdist_wheel
  '';

  nativeCheckInputs = [
@ -50,4 +50,3 @@ buildPythonPackage rec {
    maintainers = with maintainers; [ nialov ];
  };
 }
-
--- a/pkgs/development/python-modules/pymunk/default.nix
+++ b/pkgs/development/python-modules/pymunk/default.nix
@ -31,7 +31,7 @@ buildPythonPackage rec {
  ];

  preBuild = ''
-    ${python.interpreter} setup.py build_ext --inplace
+    ${python.pythonForBuild.interpreter} setup.py build_ext --inplace
  '';

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/pyqt/4.x.nix
+++ b/pkgs/development/python-modules/pyqt/4.x.nix
@ -27,7 +27,7 @@ buildPythonPackage rec {
    ''}

    chmod +x configure.py
-    sed -i '1i#!${python.interpreter}' configure.py
+    sed -i '1i#!${python.pythonForBuild.interpreter}' configure.py
  '';

  configureScript = "./configure.py";
--- a/pkgs/development/python-modules/pyside2/default.nix
+++ b/pkgs/development/python-modules/pyside2/default.nix
@ -70,7 +70,7 @@ stdenv.mkDerivation rec {

  postInstall = ''
    cd ../../..
-    ${python.interpreter} setup.py egg_info --build-type=pyside2
+    ${python.pythonForBuild.interpreter} setup.py egg_info --build-type=pyside2
    cp -r PySide2.egg-info $out/${python.sitePackages}/
  '';

--- a/pkgs/development/python-modules/pysvn/default.nix
+++ b/pkgs/development/python-modules/pysvn/default.nix
@ -37,8 +37,8 @@ buildPythonPackage rec {

  preConfigure = ''
    cd Source
-    ${python.interpreter} setup.py backport
-    ${python.interpreter} setup.py configure \
+    ${python.pythonForBuild.interpreter} setup.py backport
+    ${python.pythonForBuild.interpreter} setup.py configure \
      --apr-inc-dir=${apr.dev}/include \
      --apu-inc-dir=${aprutil.dev}/include \
      --pycxx-dir=${pycxx.dev}/include \
--- a/pkgs/development/python-modules/python-efl/default.nix
+++ b/pkgs/development/python-modules/python-efl/default.nix
@ -31,11 +31,11 @@ buildPythonPackage rec {
  '';

  preBuild = ''
-    ${python.interpreter} setup.py build_ext
+    ${python.pythonForBuild.interpreter} setup.py build_ext
  '';

  installPhase = ''
-    ${python.interpreter} setup.py install --prefix=$out --single-version-externally-managed
+    ${python.pythonForBuild.interpreter} setup.py install --prefix=$out --single-version-externally-managed
  '';

  doCheck = false;
--- a/pkgs/development/python-modules/python-fontconfig/default.nix
+++ b/pkgs/development/python-modules/python-fontconfig/default.nix
@ -17,7 +17,7 @@ in buildPythonPackage rec {
  nativeBuildInputs = [ cython ];

  preBuild = ''
-    ${python.interpreter} setup.py build_ext -i
+    ${python.pythonForBuild.interpreter} setup.py build_ext -i
  '';

  checkPhase = ''
--- a/pkgs/development/python-modules/pywayland/default.nix
+++ b/pkgs/development/python-modules/pywayland/default.nix
@ -24,7 +24,7 @@ buildPythonPackage rec {
  nativeCheckInputs = [ pytestCheckHook ];

  postBuild = ''
-    ${python.interpreter} pywayland/ffi_build.py
+    ${python.pythonForBuild.interpreter} pywayland/ffi_build.py
  '';

  # Tests need this to create sockets
--- a/pkgs/development/python-modules/pywlroots/default.nix
+++ b/pkgs/development/python-modules/pywlroots/default.nix
@ -36,7 +36,7 @@ buildPythonPackage rec {
  nativeCheckInputs = [ pytestCheckHook ];

  postBuild = ''
-    ${python.interpreter} wlroots/ffi_build.py
+    ${python.pythonForBuild.interpreter} wlroots/ffi_build.py
  '';

  pythonImportsCheck = [ "wlroots" ];
--- a/pkgs/development/python-modules/shap/default.nix
+++ b/pkgs/development/python-modules/shap/default.nix
@ -146,8 +146,12 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "A unified approach to explain the output of any machine learning model";
    homepage = "https://github.com/slundberg/shap";
+    changelog = "https://github.com/slundberg/shap/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ evax ];
    platforms = platforms.unix;
+    # No support for scikit-learn > 1.2
+    # https://github.com/slundberg/shap/issues/2866
+    broken = true;
  };
 }
--- a/pkgs/development/python-modules/shiboken2/default.nix
+++ b/pkgs/development/python-modules/shiboken2/default.nix
@ -45,7 +45,7 @@ stdenv.mkDerivation {

  postInstall = ''
    cd ../../..
-    ${python.interpreter} setup.py egg_info --build-type=shiboken2
+    ${python.pythonForBuild.interpreter} setup.py egg_info --build-type=shiboken2
    cp -r shiboken2.egg-info $out/${python.sitePackages}/
    rm $out/bin/shiboken_tool.py
  '';
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@ -219,7 +219,7 @@ in buildPythonPackage rec {

  preBuild = ''
    export MAX_JOBS=$NIX_BUILD_CORES
-    ${python.interpreter} setup.py build --cmake-only
+    ${python.pythonForBuild.interpreter} setup.py build --cmake-only
    ${cmake}/bin/cmake build
  '';

--- a/pkgs/development/python-modules/wordcloud/default.nix
+++ b/pkgs/development/python-modules/wordcloud/default.nix
@ -13,16 +13,16 @@

 buildPythonPackage rec {
  pname = "wordcloud";
-  version = "1.8.1";
+  version = "unstable-2023-01-04";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "amueller";
-    repo = pname;
-    rev = version;
-    hash = "sha256-4EFQfv+Jn9EngUAyDoJP0yv9zr9Tnbrdwq1YzDacB9Q=";
+    repo = "word_cloud";
+    rev = "dbf7ab7753a36e1c12c0e1b36aeeece5023f39f9";
+    hash = "sha256-ogSkVcPUth7bh7mxwdDmF/Fc2ySDxbLA8ArmBNnPvw8=";
  };

  nativeBuildInputs = [
@ -40,14 +40,6 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  patches = [
-    (fetchpatch {
-      # https://github.com/amueller/word_cloud/pull/616
-      url = "https://github.com/amueller/word_cloud/commit/858a8ac4b5b08494c1d25d9e0b35dd995151a1e5.patch";
-      sha256 = "sha256-+aDTMPtOibVwjPrRLxel0y4JFD5ERB2bmJi4zRf/asg=";
-    })
-  ];
-
  postPatch = ''
    substituteInPlace setup.cfg \
      --replace " --cov --cov-report xml --tb=short" ""
--- a/pkgs/development/python-modules/wxPython/4.0.nix
+++ b/pkgs/development/python-modules/wxPython/4.0.nix
@ -69,11 +69,11 @@ buildPythonPackage rec {
  '';

  buildPhase = ''
-    ${python.interpreter} build.py -v --use_syswx dox etg --nodoc sip build_py
+    ${python.pythonForBuild.interpreter} build.py -v --use_syswx dox etg --nodoc sip build_py
  '';

  installPhase = ''
-    ${python.interpreter} setup.py install --skip-build --prefix=$out
+    ${python.pythonForBuild.interpreter} setup.py install --skip-build --prefix=$out
  '';

  passthru = { wxWidgets = wxGTK; };
--- a/pkgs/development/python-modules/wxPython/4.1.nix
+++ b/pkgs/development/python-modules/wxPython/4.1.nix
@ -129,11 +129,11 @@ buildPythonPackage rec {
  '';

  buildPhase = ''
-    ${python.interpreter} build.py -v build_wx dox etg --nodoc sip build_py
+    ${python.pythonForBuild.interpreter} build.py -v build_wx dox etg --nodoc sip build_py
  '';

  installPhase = ''
-    ${python.interpreter} setup.py install --skip-build --prefix=$out
+    ${python.pythonForBuild.interpreter} setup.py install --skip-build --prefix=$out
    wrapPythonPrograms
  '';

--- a/pkgs/development/python-modules/wxPython/4.2.nix
+++ b/pkgs/development/python-modules/wxPython/4.2.nix
@ -102,7 +102,7 @@ buildPythonPackage rec {
    export PATH="${wxGTK}/bin:$PATH"
    export SDL_CONFIG="${SDL.dev}/bin/sdl-config"

-    ${python.interpreter} build.py -v --use_syswx dox etg sip --nodoc build_py
+    ${python.pythonForBuild.interpreter} build.py -v --use_syswx dox etg sip --nodoc build_py

    runHook postBuild
  '';
@ -111,7 +111,7 @@ buildPythonPackage rec {
  installPhase = ''
    runHook preInstall

-    ${python.interpreter} setup.py install --skip-build --prefix=$out
+    ${python.pythonForBuild.interpreter} setup.py install --skip-build --prefix=$out
    wrapPythonPrograms

    runHook postInstall
--- a/pkgs/development/python-modules/xattr/default.nix
+++ b/pkgs/development/python-modules/xattr/default.nix
@ -26,7 +26,7 @@ buildPythonPackage rec {
  doCheck = false;

  postBuild = ''
-    ${python.interpreter} -m compileall -f xattr
+    ${python.pythonForBuild.interpreter} -m compileall -f xattr
  '';

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/xkbcommon/default.nix
+++ b/pkgs/development/python-modules/xkbcommon/default.nix
@ -24,7 +24,7 @@ buildPythonPackage rec {
  nativeCheckInputs = [ pytestCheckHook ];

  postBuild = ''
-    ${python.interpreter} xkbcommon/ffi_build.py
+    ${python.pythonForBuild.interpreter} xkbcommon/ffi_build.py
  '';

  pythonImportsCheck = [ "xkbcommon" ];
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "cppcheck";
-  version = "2.10";
+  version = "2.10.1";

  src = fetchFromGitHub {
    owner = "danmar";
    repo = "cppcheck";
    rev = version;
-    hash = "sha256-Ss35foFlh4sw6TxMp++0b9E5KDUjBpDPuWIHsak8OGY=";
+    hash = "sha256-tN7MYMRBakdL++ZeY2u9s2B2wyAU7iaOB/hsv2GXI6s=";
  };

  buildInputs = [ pcre (python3.withPackages (ps: [ps.pygments])) ];
--- a/pkgs/development/tools/electron/binary/default.nix
+++ b/pkgs/development/tools/electron/binary/default.nix
@ -24,9 +24,9 @@ let
 in
 rec {

-  electron = electron_23;
+  electron-bin = electron_23-bin;

-  electron_9 = mkElectron "9.4.4" {
+  electron_9-bin = mkElectron "9.4.4" {
    x86_64-linux = "781d6ca834d415c71078e1c2c198faba926d6fce19e31448bbf4450869135450";
    x86_64-darwin = "f41c0bf874ddbba00c3d6989d07f74155a236e2d5a3eaf3d1d19ef8d3eb2256c";
    i686-linux = "40e37f8f908a81c9fac1073fe22309cd6df2d68e685f83274c6d2f0959004187";
@ -35,7 +35,7 @@ rec {
    headers = "0yx8mkrm15ha977hzh7g2sc5fab9sdvlk1bk3yxignhxrqqbw885";
  };

-  electron_10 = mkElectron "10.4.7" {
+  electron_10-bin = mkElectron "10.4.7" {
    x86_64-linux = "e3ea75fcedce588c6b59cfa3a6e46ba67b789e14dc2e5b9dfe1ddf3f82b0f995";
    x86_64-darwin = "8f01e020563b7fce68dc2e3d4bbf419320d13b088e89eb64f9645e9d73ad88fb";
    i686-linux = "dd7fde9b3993538333ec701101554050b27d0b680196d0883ab563e8e696fc79";
@ -44,7 +44,7 @@ rec {
    headers = "01x6a0r2jawjpl09ixgzap3g0z6znj34hsnnhzanavkbds0ri4k6";
  };

-  electron_11 = mkElectron "11.5.0" {
+  electron_11-bin = mkElectron "11.5.0" {
    x86_64-linux = "613ef8ac00c5abda425dfa48778a68f58a2e9c7c1f82539bb1a41afabbd6193f";
    x86_64-darwin = "32937dca29fc397f0b15dbab720ed3edb88eee24f00f911984b307bf12dc8fd5";
    i686-linux = "cd154c56d02d7b1f16e2bcd5650bddf0de9141fdbb8248adc64f6d607e5fb725";
@ -54,7 +54,7 @@ rec {
    headers = "1zkdgpjrh1dc9j8qyrrrh49v24960yhvwi2c530qbpf2azgqj71b";
  };

-  electron_12 = mkElectron "12.2.3" {
+  electron_12-bin = mkElectron "12.2.3" {
    armv7l-linux = "4de83c34987ac7b3b2d0c8c84f27f9a34d9ea2764ae1e54fb609a95064e7e71a";
    aarch64-linux = "d29d234c09ba810d89ed1fba9e405b6975916ea208d001348379f89b50d1835c";
    x86_64-linux = "deae6d0941762147716b8298476080d961df2a32d0f6f57b244cbe3a2553cd24";
@ -64,7 +64,7 @@ rec {
    headers = "1idam1xirxqxqg4g7n33kdx2skk0r351m00g59a8yx9z82g06ah9";
  };

-  electron_13 = mkElectron "13.6.9" {
+  electron_13-bin = mkElectron "13.6.9" {
    armv7l-linux = "e70cf80ac17850f3291c19a89235c59a7a6e0c791e7965805872ce584479c419";
    aarch64-linux = "cb570f77e46403a75b99740c41b297154f057dc3b9aa75fd235dccc5619972cf";
    x86_64-linux = "5e29701394041ba2acd8a9bb042d77967c399b8fe007d7ffbd1d3e6bfdb9eb8a";
@ -74,7 +74,7 @@ rec {
    headers = "0vvizddmhprprbdf6bklasz6amwc254bpc9j0zlx23d1pgyxpnhc";
  };

-  electron_14 = mkElectron "14.2.9" {
+  electron_14-bin = mkElectron "14.2.9" {
    armv7l-linux = "02ae6cd9ec9c2dcb2f550923576a0c851fff3e796a5048dd3806947c541fd564";
    aarch64-linux = "631ba0f716d0272931418de42468114360bd21ec72875605fc32d67620743d2c";
    x86_64-linux = "0a62a41e8ac4592aba347c82f9c40f3fb4c84c7d00b6bb9501d02375cd49cb7d";
@ -84,7 +84,7 @@ rec {
    headers = "181b2agnf4b5s81p2rdnd6wkw9c2ri4cv1x0wwf7rj60axvzvydm";
  };

-  electron_15 = mkElectron "15.5.2" {
+  electron_15-bin = mkElectron "15.5.2" {
    armv7l-linux = "da434095fd7cc17d85ebca5eab3510ec7ff73ace4edc933fe2f27a716ca711c0";
    aarch64-linux = "bcec3f962c7acefc8690680a19df9d83721db7e5db55c7b7a8946365139457a6";
    x86_64-linux = "a4a95888c313dbe279f5f9d9dfd99f56a2a1b6b905fb6cba3b284322fe19a530";
@ -94,7 +94,7 @@ rec {
    headers = "0jbxazkjkm8g8b8d0ini2l4q9z7885mz5vyj74lf85lqdfqzgzc0";
  };

-  electron_16 = mkElectron "16.2.3" {
+  electron_16-bin = mkElectron "16.2.3" {
    armv7l-linux = "9b442b17349dcec08e6efadecf9d338a7f4b2955635fed2a78374af850ceee5d";
    aarch64-linux = "eec581d162b494a7bcba4b0221f3beac9f359b48fb8612c83ce6ad7ac63094cd";
    x86_64-linux = "2c032baff08b40f106dfcd86e7b63c6275f13e64d26b8c301af704563edf8600";
@ -104,7 +104,7 @@ rec {
    headers = "1a9kb89iigwmahjwq14i74rr6gj21gmpc106pg0il73c50khaxpz";
  };

-  electron_17 = mkElectron "17.4.1" {
+  electron_17-bin = mkElectron "17.4.1" {
    armv7l-linux = "d1329468cb21039fb5b503fc813381f9be4d43422383b44f859b450be0e4200c";
    aarch64-linux = "70d29bca5f884753341a11b0445ccf159c0f43dfae16eb60c53946582c3128b0";
    x86_64-linux = "f9437a86947c418d92eabea14b268dcc4a5dde74cc6927530c1e9195e4aeddf8";
@ -114,7 +114,7 @@ rec {
    headers = "064qnwv6gqn502r1cv7vi6ahvgyxcqq7mv0rmk2bxfpkr5x6hgmh";
  };

-  electron_18 = mkElectron "18.1.0" {
+  electron_18-bin = mkElectron "18.1.0" {
    armv7l-linux = "c2296f3f68938aab4cef07b747d2dd28973625b6717163b9c51fbcf1509fd8ff";
    aarch64-linux = "13bd4998d0d86ccf4cb87d11f9581d5a6063b4585fc4828e130054527dfb9179";
    x86_64-linux = "7f95069d58e6843e6ae2b8f02619d4dcef7db4c35bd6e90b903268d83b939fba";
@ -124,7 +124,7 @@ rec {
    headers = "0gl30q2igr9c8sjlhyj5w57dm5navpkas5hnz9yl7sasbx66v10v";
  };

-  electron_19 = mkElectron "19.0.7" {
+  electron_19-bin = mkElectron "19.0.7" {
    armv7l-linux = "d6a6d2d7c0d658695783137d032a50f20843cdfe6582ef985451d741eef4dd32";
    aarch64-linux = "58685d21bb92c2667d20063ab12aabc2e5c2518f3eda84e98a0fa2306456ce57";
    x86_64-linux = "a4c20a068c54c238ae8c440ab8f46d39eda4168d6aa8cffcaae406800b539983";
@ -133,7 +133,7 @@ rec {
    headers = "09dbx4qh0rgp5mdm6srz6fgx12zq6b9jqq1k6l3gzyvwigi3wny1";
  };

-  electron_20 = mkElectron "20.3.11" {
+  electron_20-bin = mkElectron "20.3.11" {
    armv7l-linux = "709b9eb958e9488f6375811041179556b9cd0b8fc1eab6b899ef4a89423f98b2";
    aarch64-linux = "0f488ac9eeda2baa4c4e571fd75ac8e055dac9dcdf83051164232b1005a29224";
    x86_64-linux = "7899bf391ae35e10d78a5da622e506dd4ae859cd8c18953cd2dc54f1a5e5225e";
@ -142,7 +142,7 @@ rec {
    headers = "06s4z2hs9sbri4jsjrgybq0sn7rrx7zf3iwfg8da1wb6ahwqcd7w";
  };

-  electron_21 = mkElectron "21.4.0" {
+  electron_21-bin = mkElectron "21.4.0" {
    armv7l-linux = "20ed4fab8b2046e10c999592ea06cd6ef13bc5826bcd7e8874c6e5e3b3cdb5b7";
    aarch64-linux = "5841060f67c23371f2739e043b51f56d04125fe781cc50e298590247477eacf2";
    x86_64-linux = "1c0da48b2b9d1fb320577429298397d67d94fbf5864d6a4f3c6eeadee3114f2e";
@ -151,7 +151,7 @@ rec {
    headers = "0zvwd3gz5y3yq5jgkswnarv75j05lfaz58w37fidq5aib1hi50hn";
  };

-  electron_22 = mkElectron "22.1.0" {
+  electron_22-bin = mkElectron "22.1.0" {
    armv7l-linux = "9bad02cd8e8604400eb90d9bd8fa58b6e400321cea8db7e774908611f4fca2a2";
    aarch64-linux = "1d3e0011761f5ba05faf994a7f78cf518e49e0fef7e4528853e1bff9378d02cf";
    x86_64-linux = "543e5fa7f2b602c3cd7e62a358441faf6f490e738de9b0bd796ad65d6bbd35ee";
@ -160,7 +160,7 @@ rec {
    headers = "1vydsk4fxk5hlpcs0r1s21gdr1kvxip8qc88ncs5w7ybqg31hzsh";
  };

-  electron_23 = mkElectron "23.1.1" {
+  electron_23-bin = mkElectron "23.1.1" {
    armv7l-linux = "0f2db28e672021b3c03309155e36d94ec59c7541497847140d500fdec45baf09";
    aarch64-linux = "5b5b6bf0a40d063e2a21e2868f3f97ce08a400690389355f2b68d606d4ae614f";
    x86_64-linux = "4e820dc1ca957fbe9dbd168925ddf496b9b14c2001bbe5362159411a6bed0cea";
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
--- a/pkgs/development/tools/electron/binary/print-hashes.sh
+++ b/pkgs/development/tools/electron/binary/print-hashes.sh
--- a/pkgs/development/tools/fdroidserver/default.nix
+++ b/pkgs/development/tools/fdroidserver/default.nix
@ -21,7 +21,7 @@ python.pkgs.buildPythonApplication rec {
  '';

  preConfigure = ''
-    ${python.interpreter} setup.py compile_catalog
+    ${python.pythonForBuild.interpreter} setup.py compile_catalog
  '';

  postInstall = ''
--- a/pkgs/development/tools/micronaut/default.nix
+++ b/pkgs/development/tools/micronaut/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "micronaut";
-  version = "3.8.4";
+  version = "3.8.5";

  src = fetchzip {
    url = "https://github.com/micronaut-projects/micronaut-starter/releases/download/v${version}/micronaut-cli-${version}.zip";
-    sha256 = "sha256-PbTuhJ+l3s+vwo5Y93GpQIah71zah5aFgV/pBSyJDKY=";
+    sha256 = "sha256-u7Hwj/RYE8pZkIVulJrwdC1kxhTGl3P5DEug6v5lMvg=";
  };

  nativeBuildInputs = [ makeWrapper installShellFiles ];
--- a/pkgs/development/tools/misc/docopts/default.nix
+++ b/pkgs/development/tools/misc/docopts/default.nix
@ -26,6 +26,6 @@ buildGoPackage rec {
    description = "docopt CLI tool for shell scripting";
    license = licenses.mit;
    maintainers = [ maintainers.confus ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/tools/misc/ycmd/default.nix
+++ b/pkgs/development/tools/misc/ycmd/default.nix
@ -29,7 +29,7 @@ stdenv.mkDerivation {

  buildPhase = ''
    export EXTRA_CMAKE_ARGS="-DPATH_TO_LLVM_ROOT=${llvmPackages.libllvm} -DUSE_SYSTEM_ABSEIL=true"
-    ${python.interpreter} build.py --system-libclang --clang-completer --ninja
+    ${python.pythonForBuild.interpreter} build.py --system-libclang --clang-completer --ninja
  '';

  dontConfigure = true;
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "typos";
-  version = "1.13.10";
+  version = "1.13.12";

  src = fetchFromGitHub {
    owner = "crate-ci";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-+TNKHyLqW/R/YEpynr4twvQpgeOxbyIlgQjaQarSB8M=";
+    hash = "sha256-SP2Di3kAcrAriZ4E7aPSBAZm46REIW82LrbWSmKhA5k=";
  };

-  cargoHash = "sha256-7D9oyQK9VWOSAI9jSYZn7t8ll4sILpugroLWlST4Eok=";
+  cargoHash = "sha256-3ExXZ7lUnT/54TUembKk47OUVpAzHrWPAro2CcXiYmU=";

  meta = with lib; {
    description = "Source code spell checker";
--- a/pkgs/development/tools/wrangler_1/default.nix
+++ b/pkgs/development/tools/wrangler_1/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "wrangler";
-  version = "1.20.0";
+  version = "1.21.0";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "wrangler";
    rev = "v${version}";
-    sha256 = "sha256-miXgzBaqCcFHRlot2uUKyH+GP2JTMOhFrReXZUl0ms0=";
+    sha256 = "sha256-GfuU+g4tPU3TorzymEa9q8n4uKYsG0ZTz8rJirGOLfQ=";
  };

-  cargoSha256 = "sha256-DJefvaUc1quh43q1eZ5B76V3TEv9vNsxuUKaABWiTCo=";
+  cargoHash = "sha256-tPLqDm6kOVBKrLvhgZ9xD6vVBNjBBk9uLF7WOPgz8qE=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/games/vassal/default.nix
+++ b/pkgs/games/vassal/default.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "VASSAL";
-  version = "3.6.11";
+  version = "3.6.12";

  src = fetchzip {
    url = "https://github.com/vassalengine/vassal/releases/download/${version}/${pname}-${version}-linux.tar.bz2";
-    sha256 = "sha256-t05rwP33/V2S5pkWjv87GmPHtYCMrMxT3o3cOrwytK4=";
+    sha256 = "sha256-NSGadwVn1/nvHiJFENBPDsOUPwesunZMsvn+ms7u4Sw=";
  };

  buildInputs = [
--- a/pkgs/os-specific/linux/libnl/default.nix
+++ b/pkgs/os-specific/linux/libnl/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {

  postBuild = lib.optionalString (pythonSupport) ''
      cd python
-      ${python.interpreter} setup.py install --prefix=../pythonlib
+      ${python.pythonForBuild.interpreter} setup.py install --prefix=../pythonlib
      cd -
  '';

--- a/pkgs/servers/home-assistant/intents.nix
+++ b/pkgs/servers/home-assistant/intents.nix
@ -45,7 +45,7 @@ buildPythonPackage rec {
  postInstall = ''
    pushd ..
    # https://github.com/home-assistant/intents/blob/main/script/package#L18
-    ${python.interpreter} -m script.intentfest merged_output $out/${python.sitePackages}/home_assistant_intents/data
+    ${python.pythonForBuild.interpreter} -m script.intentfest merged_output $out/${python.sitePackages}/home_assistant_intents/data
    popd
  '';

--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@ -15,16 +15,16 @@ let
 in
 buildGoModule rec {
  pname = "minio";
-  version = "2023-02-17T17-52-43Z";
+  version = "2023-02-22T18-23-45Z";

  src = fetchFromGitHub {
    owner = "minio";
    repo = "minio";
    rev = "RELEASE.${version}";
-    sha256 = "sha256-AVqGzb3abJotsHdUw7MScjut1E+5ZX2NrvQKQ0ck2lY=";
+    sha256 = "sha256-Y11jqZiQUu0/YcrIGFJ2nOkPRG97sflluO3J0BJZ6kQ=";
  };

-  vendorHash = "sha256-Bg0AO2hV8dqOuSN9NJsdXbE/YVpYvU/3OkB+E83/QHU=";
+  vendorHash = "sha256-9QYRUCD2iR2jx8G1FbkQqqPqIuXKxAKDy9whMRhOVP4=";

  doCheck = false;

--- a/pkgs/servers/monitoring/prometheus/haproxy-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/haproxy-exporter.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "haproxy_exporter";
-  version = "0.14.0";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "prometheus";
    repo = "haproxy_exporter";
    rev = "v${version}";
-    sha256 = "sha256-u5o8XpKkuaNzAZAdA33GLd0QJSpqnkEbI8gW22G7FcY=";
+    sha256 = "sha256-hpZnMvHAAEbvzASK3OgfG34AhPkCdRM7eOm15PRemkA=";
  };

-  vendorSha256 = "sha256-lDoW1rkOn2YkEf3QZdWBpm5fdzjkbER35XnXFr57D8c=";
+  vendorHash = "sha256-s9UVtV8N2SJ1ik864P6p2hPXJ2jstFY/XnWt9fuCDo0=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/servers/nosql/ferretdb/default.nix
+++ b/pkgs/servers/nosql/ferretdb/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "ferretdb";
-  version = "0.9.1";
+  version = "0.9.2";

  src = fetchFromGitHub {
    owner = "FerretDB";
    repo = "FerretDB";
    rev = "v${version}";
-    sha256 = "sha256-iqoz7axU5U6MdRl8I2vS3Nh37XZZPI4bRb3oFxpQs6M=";
+    sha256 = "sha256-lJlj5GNgrllcaEednxVCmMPHG2aU4z3mKkm9t0cO5Tk=";
  };

  postPatch = ''
@ -19,7 +19,7 @@ buildGoModule rec {
    echo nixpkgs     > build/version/package.txt
  '';

-  vendorSha256 = "sha256-qtxR1vk/EZZmCRP1Z+EFObfMbQXKiRaSiI1Dsv268b8=";
+  vendorSha256 = "sha256-I5ucq3K0lRsokG9lahmBUH9mIYa5tgHnL+vxKSzW1hw=";

  CGO_ENABLED = 0;

@ -31,6 +31,6 @@ buildGoModule rec {
    description = "A truly Open Source MongoDB alternative";
    homepage = "https://www.ferretdb.io/";
    license = licenses.asl20;
-    maintainers = with maintainers; [ dit7ya noisersup ];
+    maintainers = with maintainers; [ dit7ya noisersup julienmalka ];
  };
 }
--- a/pkgs/servers/search/khoj/default.nix
+++ b/pkgs/servers/search/khoj/default.nix
@ -1,27 +1,56 @@
 { lib
 , fetchFromGitHub
-, python3Packages
+, python3
 , qt6
 }:

-python3Packages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "khoj";
-  version = "0.2.6";
-  format = "setuptools";
+  version = "0.3.0";
+  format = "pyproject";

  src = fetchFromGitHub {
    owner = "debanjum";
    repo = "khoj";
    rev = "refs/tags/${version}";
-    hash = "sha256-QcxP+USj7vlLKPno2mV53nFonZM38VzL8D4zY6d8y3k=";
+    hash = "sha256-9kKK0DXpLfPB2LMnYcC6BKgZaoRsNHBZVe4thI7b9tk=";
  };

-  propagatedBuildInputs = with python3Packages; [
-    aiofiles
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "dateparser == 1.1.1" "dateparser" \
+      --replace "defusedxml == 0.7.1" ""defusedxml"" \
+      --replace "fastapi == 0.77.1" "fastapi" \
+      --replace "jinja2 == 3.1.2" "jinja2" \
+      --replace "openai == 0.20.0" "openai" \
+      --replace "pillow == 9.3.0" "pillow" \
+      --replace "pydantic == 1.9.1" "pydantic" \
+      --replace "pyyaml == 6.0" "pyyaml" \
+      --replace "pyqt6 == 6.3.1" "pyqt6" \
+      --replace "rich >= 13.3.1" "rich" \
+      --replace "schedule == 1.1.0" "schedule" \
+      --replace "sentence-transformers == 2.2.2" "sentence-transformers" \
+      --replace "torch == 1.13.1" "torch" \
+      --replace "uvicorn == 0.17.6" "uvicorn"
+  '';
+
+  nativeBuildInputs = with python3.pkgs; [
+    hatch-vcs
+    hatchling
+  ] ++ (with qt6; [
+    wrapQtAppsHook
+  ]);
+
+  buildInputs = with qt6; [
+    qtwayland
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
    dateparser
    defusedxml
    fastapi
-    huggingface-hub
    jinja2
    numpy
    openai
@ -29,46 +58,52 @@ python3Packages.buildPythonApplication rec {
    pydantic
    pyqt6
    pyyaml
+    rich
    schedule
    sentence-transformers
    torch
-    torchvision
-    transformers
    uvicorn
  ];

-  buildInputs = with qt6; [
-    qtwayland
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
  ];

-  nativeBuildInputs = with qt6; [
-    wrapQtAppsHook
-  ];
-
-  checkInputs = with python3Packages; [
-    pytest
-  ];
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "aiofiles == 0.8.0" "aiofiles >= 0.8.0" \
-      --replace "openai == 0.20.0" "openai >= 0.20.0" \
-      --replace "pytest == 7.1.2" "pytest >= 7.1.2" \
-      --replace "fastapi == 0.77.1" "fastapi >= 0.77.1" \
-      --replace "numpy == 1.22.4" "numpy >= 1.22.4" \
-      --replace "huggingface_hub == 0.8.1" "huggingface_hub >= 0.8.1" \
-      --replace "dateparser == 1.1.1" "dateparser >= 1.1.1" \
-      --replace "sentence-transformers == 2.1.0" "sentence-transformers >= 2.1.0" \
-      --replace "transformers == 4.21.0" "transformers >= 4.21.0" \
-      --replace "torchvision == 0.14.1" "torchvision" \
-      --replace "pydantic == 1.9.1" "pydantic >= 1.9.1" \
-      --replace "pyqt6 == 6.3.1" "pyqt6 >= 6.3.1" \
-      --replace "uvicorn == 0.17.6" "uvicorn >= 0.17.6"
+  preCheck = ''
+    export HOME=$(mktemp -d)
  '';

+  pythonImportsCheck = [
+    "khoj"
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "test_search_with_valid_content_type"
+    "test_update_with_valid_content_type"
+    "test_regenerate_with_valid_content_type"
+    "test_image_search"
+    "test_notes_search"
+    "test_notes_search_with_only_filters"
+    "test_notes_search_with_include_filter"
+    "test_notes_search_with_exclude_filter"
+    "test_image_metadata"
+    "test_image_search"
+    "test_image_search_query_truncated"
+    "test_image_search_by_filepath"
+    "test_asymmetric_setup_with_missing_file_raises_error"
+    "test_asymmetric_setup_with_empty_file_raises_error"
+    "test_asymmetric_reload"
+    "test_asymmetric_setup"
+    "test_asymmetric_search"
+    "test_entry_chunking_by_max_tokens"
+    "test_incremental_update"
+  ];
+
  meta = with lib; {
    description = "Natural Language Search Assistant for your Org-Mode and Markdown notes, Beancount transactions and Photos";
    homepage = "https://github.com/debanjum/khoj";
+    changelog = "https://github.com/debanjum/khoj/releases/tag/${version}";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ dit7ya ];
  };
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@ -25,16 +25,22 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
  pname = "awscli2";
-  version = "2.10.1"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.10.3"; # N.B: if you change this, check if overrides are still up-to-date
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cli";
    rev = version;
-    hash = "sha256-omg4WNX/DegN6xjHBBGwEijqtvd/b9VfcCC71KfXq98=";
+    hash = "sha256-ogwJTsd2xrWp54utcyG1QO7hGxBC6S4hVlmmGESyPBQ=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "distro>=1.5.0,<1.6.0" "distro>=1.5.0" \
+      --replace "cryptography>=3.3.2,<38.0.5" "cryptography>=3.3.2"
+  '';
+
  nativeBuildInputs = [
    flit-core
  ];
@ -63,10 +69,6 @@ with py.pkgs; buildPythonApplication rec {
    pytestCheckHook
  ];

-  postPatch = ''
-    substituteInPlace pyproject.toml --replace "distro>=1.5.0,<1.6.0" "distro>=1.5.0"
-  '';
-
  postInstall = ''
    mkdir -p $out/${python3.sitePackages}/awscli/data
    ${python3.interpreter} scripts/gen-ac-index --index-location $out/${python3.sitePackages}/awscli/data/ac.index
--- a/pkgs/tools/audio/tts/default.nix
+++ b/pkgs/tools/audio/tts/default.nix
@ -95,7 +95,7 @@ python.pkgs.buildPythonApplication rec {
    # cython modules are not installed for some reasons
    (
      cd TTS/tts/utils/monotonic_align
-      ${python.interpreter} setup.py install --prefix=$out
+      ${python.pythonForBuild.interpreter} setup.py install --prefix=$out
    )
  '';

--- a/pkgs/tools/backup/s3ql/default.nix
+++ b/pkgs/tools/backup/s3ql/default.nix
@ -18,7 +18,7 @@ python3Packages.buildPythonApplication rec {
  ];

  preBuild = ''
-    ${python3Packages.python.interpreter} ./setup.py build_cython build_ext --inplace
+    ${python3Packages.python.pythonForBuild.interpreter} ./setup.py build_cython build_ext --inplace
  '';

  checkPhase = ''
--- a/pkgs/tools/misc/colord/default.nix
+++ b/pkgs/tools/misc/colord/default.nix
@ -15,6 +15,7 @@
 , gobject-introspection
 , argyllcms
 , meson
+, mesonEmulatorHook
 , ninja
 , vala
 , libgudev
@ -75,6 +76,8 @@ stdenv.mkDerivation rec {
    shared-mime-info
    vala
    wrapGAppsNoGuiHook
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
  ];

  buildInputs = [
--- a/pkgs/tools/misc/ntfy-sh/default.nix
+++ b/pkgs/tools/misc/ntfy-sh/default.nix
@ -10,16 +10,16 @@ let
 in
 buildGoModule rec {
  pname = "ntfy-sh";
-  version = "2.0.1";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "binwiederhier";
    repo = "ntfy";
    rev = "v${version}";
-    sha256 = "sha256-r5MAffvQVya6VWzdO3NPVBAekeZQllxtpS5A06EQnI4=";
+    sha256 = "sha256-xtQO9E5qt2g3JMXmqePnfEsvvOIlgZqAup9DkJJ0ClI=";
  };

-  vendorSha256 = "sha256-QUUZX9UnLnhyYrbws9pGfN/gqbwt7CeJNYlsPsLRb6g=";
+  vendorSha256 = "sha256-kfXan6LAVJ4ka34nP7ObAB2uISyQT9QrymOFFderdlQ=";

  doCheck = false;

--- a/pkgs/tools/misc/ntfy-sh/node-packages.nix
+++ b/pkgs/tools/misc/ntfy-sh/node-packages.nix
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "i2pd";
-  version = "2.46.0";
+  version = "2.46.1";

  src = fetchFromGitHub {
    owner = "PurpleI2P";
    repo = pname;
    rev = version;
-    sha256 = "sha256-KK4fYMcLkmdZxLkNloVvkYoFrWDi8N5rRmsSGxUxwC4=";
+    sha256 = "sha256-9qk3oRNM/xmKQQGIx44R79JYUK/J7rOrR+la+lnu74s=";
  };

  buildInputs = [ boost zlib openssl ]
--- a/pkgs/tools/security/govulncheck/default.nix
+++ b/pkgs/tools/security/govulncheck/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "govulncheck";
-  version = "unstable-2022-09-02";
+  version = "unstable-2023-02-17";

  src = fetchFromGitHub {
    owner = "golang";
    repo = "vuln";
-    rev = "27dd78d2ca392c1738e54efe513a2ecb7bf46000";
-    sha256 = "sha256-G35y1V4W1nLZ+QGvIQwER9whBIBDFUVptrHx78orcI0=";
+    rev = "b91abcc5ae3c412965b4c8131c4373040c69e1b7";
+    sha256 = "sha256-DYeG7SbjoH7rLD+Q0/5VC85bT2x7YxB4tAj1wmHkI4A=";
  };

-  vendorSha256 = "sha256-9FH9nq5cEyhMxrrvfQAOWZ4aThMsU0HwlI+0W0uVHZ4=";
+  vendorSha256 = "sha256-+luU71QHNs7xxXQOLtd+Ka8+ETv5sA+gv+4g7Ogm5TI=";

  subPackages = [ "cmd/govulncheck" ];

@ -30,12 +30,14 @@ buildGoModule rec {
    rm vulncheck/binary_test.go
    # - just have resolution issues
    rm vulncheck/{source,vulncheck}_test.go
+    rm internal/govulncheck/callstacks_test.go
  '';

  ldflags = [ "-s" "-w" ];

  meta = with lib; {
    homepage = "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck";
+    downloadPage = "https://github.com/golang/vuln";
    description = "The database client and tools for the Go vulnerability database, also known as vuln";
    longDescription = ''
      Govulncheck reports known vulnerabilities that affect Go code. It uses
--- a/pkgs/tools/security/tpm2-tools/default.nix
+++ b/pkgs/tools/security/tpm2-tools/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  pname = "tpm2-tools";
-  version = "5.4";
+  version = "5.5";

  src = fetchurl {
    url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-9jVx0j7dltAkoiRTJry5o2+sLPia71psBaOwhS0pLJk=";
+    sha256 = "sha256-H9tJxzBTe/2u0IiISIGmHjv9Eh6VfsC9zu7AJhI2wSM=";
  };

  nativeBuildInputs = [ pandoc pkg-config makeWrapper ];
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "trufflehog";
-  version = "3.28.0";
+  version = "3.28.1";

  src = fetchFromGitHub {
    owner = "trufflesecurity";
    repo = "trufflehog";
    rev = "refs/tags/v${version}";
-    hash = "sha256-qag8e7m4mfHmaeMg//sAZpiHTIoXt1vQMKv5PdtvvKc=";
+    hash = "sha256-sLADYTjC2jXhKkZbq1ft61SDLjY6xpQjwlhS3XkitBo=";
  };

-  vendorHash = "sha256-CVCAP2JMfLN23Sgf2d+CSK4uetomWzPUX0BRmutW7pI=";
+  vendorHash = "sha256-+N/aF/aDufOzejpsd49EtkAJGqPZd666KHL0khmS+OA=";

  # Test cases run git clone and require network access
  doCheck = false;
--- a/pkgs/tools/video/xjadeo/default.nix
+++ b/pkgs/tools/video/xjadeo/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "xjadeo";
-  version = "0.8.11";
+  version = "0.8.12";

  src = fetchFromGitHub {
    owner = "x42";
    repo = "xjadeo";
    rev = "v${version}";
-    sha256 = "sha256-S8eIkmfjwpcILZc+by0Mk4VPRUlbJT0GBe8NlJ1F9EI=";
+    sha256 = "sha256-VPmVoCoVyljzqtbkuT3e6jhXClP708V/6zy1bVoET7c=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -17185,23 +17185,40 @@ with pkgs;

  aws-adfs = with python3Packages; toPythonApplication aws-adfs;

-  inherit (callPackages ../development/tools/electron { })
-    electron
-    electron_9
-    electron_10
-    electron_11
-    electron_12
-    electron_13
-    electron_14
-    electron_15
-    electron_16
-    electron_17
-    electron_18
-    electron_19
-    electron_20
-    electron_21
-    electron_22
-    electron_23;
+  inherit (callPackages ../development/tools/electron/binary { })
+    electron-bin
+    electron_9-bin
+    electron_10-bin
+    electron_11-bin
+    electron_12-bin
+    electron_13-bin
+    electron_14-bin
+    electron_15-bin
+    electron_16-bin
+    electron_17-bin
+    electron_18-bin
+    electron_19-bin
+    electron_20-bin
+    electron_21-bin
+    electron_22-bin
+    electron_23-bin;
+
+  electron = electron-bin;
+  electron_9 = electron_9-bin;
+  electron_10 = electron_10-bin;
+  electron_11 = electron_11-bin;
+  electron_12 = electron_12-bin;
+  electron_13 = electron_13-bin;
+  electron_14 = electron_14-bin;
+  electron_15 = electron_15-bin;
+  electron_16 = electron_16-bin;
+  electron_17 = electron_17-bin;
+  electron_18 = electron_18-bin;
+  electron_19 = electron_19-bin;
+  electron_20 = electron_20-bin;
+  electron_21 = electron_21-bin;
+  electron_22 = electron_22-bin;
+  electron_23 = electron_23-bin;

  autobuild = callPackage ../development/tools/misc/autobuild { };

@ -22126,6 +22143,8 @@ with pkgs;

  libwacom = callPackage ../development/libraries/libwacom { };

+  libwacom-surface = callPackage ../development/libraries/libwacom/surface.nix { };
+
  lightning = callPackage ../development/libraries/lightning { };

  lightlocker = callPackage ../misc/screensavers/light-locker { };