Merge master into haskell-updates

2024-11-26 17:03:01 +00:00 · 2022-11-28 00:13:34 +00:00 · 2022-11-28 00:13:34 +00:00 · 4580143b9e
commit 4580143b9e
parent 42d1913978 c4746613d8
214 changed files with 3237 additions and 2085 deletions
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@ -26,7 +26,7 @@ jobs:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Create backport PRs
-        uses: zeebe-io/backport-action@v0.0.8
+        uses: zeebe-io/backport-action@v0.0.9
        with:
          # Config README: https://github.com/zeebe-io/backport-action#backport-action
          github_token: ${{ secrets.GITHUB_TOKEN }}
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3294,6 +3294,15 @@
      fingerprint = "4E35 F2E5 2132 D654 E815  A672 DB2C BC24 2868 6000";
    }];
  };
+  deejayem = {
+    email = "nixpkgs.bu5hq@simplelogin.com";
+    github = "deejayem";
+    githubId = 2564003;
+    name = "David Morgan";
+    keys = [{
+      fingerprint = "9B43 6B14 77A8 79C2 6CDB  6604 C171 2510 02C2 00F2";
+    }];
+  };
  deepfire = {
    email = "_deepfire@feelingofgreen.ru";
    github = "deepfire";
@ -9665,6 +9674,15 @@
    githubId = 6783654;
    name = "Nadrieril Feneanar";
  };
+  nagy = {
+    email = "danielnagy@posteo.de";
+    github = "nagy";
+    githubId = 692274;
+    name = "Daniel Nagy";
+    keys = [{
+      fingerprint = "F6AE 2C60 9196 A1BC ECD8  7108 1B8E 8DCB 576F B671";
+    }];
+  };
  nalbyuites = {
    email = "ashijit007@gmail.com";
    github = "nalbyuites";
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -141,7 +141,7 @@
      </listitem>
      <listitem>
        <para>
-          PHP 8.2.0 RC 6 is available.
+          PHP 8.2.0 RC 7 is available.
        </para>
      </listitem>
      <listitem>
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -57,7 +57,7 @@ In addition to numerous new and upgraded packages, this release has the followin
  `mod_php` usage we still enable `ZTS` (Zend Thread Safe). This has been a
  common practice for a long time in other distributions.

- PHP 8.2.0 RC 6 is available.
+- PHP 8.2.0 RC 7 is available.

 - `protonup` has been aliased to and replaced by `protonup-ng` due to upstream not maintaining it.

@ -484,12 +484,12 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).

 - Add udev rules for the Teensy family of microcontrollers.

- The Qt QML disk cache is now disabled by default. This fixes a 
-  long-standing issue where updating Qt/KDE apps would sometimes cause 
-  them to crash or behave strangely without explanation. Those concerned 
-  about the small (~10%) performance hit to application startup can 
-  re-enable the cache (and expose themselves to gremlins) by setting the 
-  envrionment variable `QML_FORCE_DISK_CACHE` to `1` using e.g. the 
+- The Qt QML disk cache is now disabled by default. This fixes a
+  long-standing issue where updating Qt/KDE apps would sometimes cause
+  them to crash or behave strangely without explanation. Those concerned
+  about the small (~10%) performance hit to application startup can
+  re-enable the cache (and expose themselves to gremlins) by setting the
+  envrionment variable `QML_FORCE_DISK_CACHE` to `1` using e.g. the
  `environment.sessionVariables` NixOS option.

 - systemd-oomd is enabled by default. Depending on which systemd units have
--- a/nixos/modules/services/misc/pinnwand.nix
+++ b/nixos/modules/services/misc/pinnwand.nix
@ -19,29 +19,66 @@ in
    };

    settings = mkOption {
-      type = format.type;
+      default = {};
      description = lib.mdDoc ''
        Your {file}`pinnwand.toml` as a Nix attribute set. Look up
-        possible options in the [pinnwand.toml-example](https://github.com/supakeen/pinnwand/blob/master/pinnwand.toml-example).
+        possible options in the [documentation](https://pinnwand.readthedocs.io/en/v${pkgs.pinnwand.version}/configuration.html).
      '';
-      default = {};
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          database_uri = mkOption {
+            type = types.str;
+            default = "sqlite:////var/lib/pinnwand/pinnwand.db";
+            example = "sqlite:///:memory";
+            description = lib.mdDoc ''
+              Database URI compatible with [SQLAlchemyhttps://docs.sqlalchemy.org/en/14/core/engines.html#database-urls].
+
+              Additional packages may need to be introduced into the environment for certain databases.
+            '';
+          };
+
+          paste_size = mkOption {
+            type = types.ints.positive;
+            default = 262144;
+            example = 524288;
+            description = lib.mdDoc ''
+              Maximum size of a paste in bytes.
+            '';
+          };
+          paste_help = mkOption {
+            type = types.str;
+            default = ''
+              <p>Welcome to pinnwand, this site is a pastebin. It allows you to share code with others. If you write code in the text area below and press the paste button you will be given a link you can share with others so they can view your code as well.</p><p>People with the link can view your pasted code, only you can remove your paste and it expires automatically. Note that anyone could guess the URI to your paste so don't rely on it being private.</p>
+              '';
+            description = lib.mdDoc ''
+              Raw HTML help text shown in the header area.
+            '';
+          };
+          footer = mkOption {
+            type = types.str;
+            default = ''
+              View <a href="//github.com/supakeen/pinnwand" target="_BLANK">source code</a>, the <a href="/removal">removal</a> or <a href="/expiry">expiry</a> stories, or read the <a href="/about">about</a> page.
+            '';
+            description = lib.mdDoc ''
+              The footer in raw HTML.
+            '';
+          };
+        };
+      };
    };
  };

  config = mkIf cfg.enable {
-    services.pinnwand.settings = {
-      database_uri = mkDefault "sqlite:////var/lib/pinnwand/pinnwand.db";
-      paste_size = mkDefault 262144;
-      paste_help = mkDefault ''
-        <p>Welcome to pinnwand, this site is a pastebin. It allows you to share code with others. If you write code in the text area below and press the paste button you will be given a link you can share with others so they can view your code as well.</p><p>People with the link can view your pasted code, only you can remove your paste and it expires automatically. Note that anyone could guess the URI to your paste so don't rely on it being private.</p>
-      '';
-      footer = mkDefault ''
-        View <a href="//github.com/supakeen/pinnwand" target="_BLANK">source code</a>, the <a href="/removal">removal</a> or <a href="/expiry">expiry</a> stories, or read the <a href="/about">about</a> page.
-      '';
-    };
+    systemd.services.pinnwand = {
+      description = "Pinnwannd HTTP Server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];

-    systemd.services = let
-      hardeningOptions = {
+      unitConfig.Documentation = "https://pinnwand.readthedocs.io/en/latest/";
+
+      serviceConfig = {
+        ExecStart = "${pkgs.pinnwand}/bin/pinnwand --configuration-path ${configFile} http --port ${toString cfg.port}";
        User = "pinnwand";
        DynamicUser = true;

@ -72,32 +109,14 @@ in
        RestrictNamespaces = true;
        RestrictRealtime = true;
        SystemCallArchitectures = "native";
-        SystemCallFilter = "@system-service";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
        UMask = "0077";
      };
-
-      command = "${pkgs.pinnwand}/bin/pinnwand --configuration-path ${configFile}";
-    in {
-      pinnwand = {
-        description = "Pinnwannd HTTP Server";
-        after = [ "network.target" ];
-        wantedBy = [ "multi-user.target" ];
-
-        unitConfig.Documentation = "https://pinnwand.readthedocs.io/en/latest/";
-
-        serviceConfig = {
-          ExecStart = "${command} http --port ${toString(cfg.port)}";
-        } // hardeningOptions;
-      };
-
-      pinnwand-reaper = {
-        description = "Pinnwand Reaper";
-        startAt = "daily";
-
-        serviceConfig = {
-          ExecStart = "${command} -vvvv reap";  # verbosity increased to show number of deleted pastes
-        } // hardeningOptions;
-      };
    };
  };
+
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -192,6 +192,14 @@ let

      server_tokens ${if cfg.serverTokens then "on" else "off"};

+      ${optionalString (cfg.proxyCache.enable) ''
+        proxy_cache_path /var/cache/nginx keys_zone=${cfg.proxyCache.keysZoneName}:${cfg.proxyCache.keysZoneSize}
+                                          levels=${cfg.proxyCache.levels}
+                                          use_temp_path=${if cfg.proxyCache.useTempPath then "on" else "off"}
+                                          inactive=${cfg.proxyCache.inactive}
+                                          max_size=${cfg.proxyCache.maxSize};
+      ''}
+
      ${cfg.commonHttpConfig}

      ${vhosts}
@ -707,6 +715,72 @@ in
          '';
      };

+      proxyCache = mkOption {
+        type = types.submodule {
+          options = {
+            enable = mkEnableOption (lib.mdDoc "Enable proxy cache");
+
+            keysZoneName = mkOption {
+              type = types.str;
+              default = "cache";
+              example = "my_cache";
+              description = lib.mdDoc "Set name to shared memory zone.";
+            };
+
+            keysZoneSize = mkOption {
+              type = types.str;
+              default = "10m";
+              example = "32m";
+              description = lib.mdDoc "Set size to shared memory zone.";
+            };
+
+            levels = mkOption {
+              type = types.str;
+              default = "1:2";
+              example = "1:2:2";
+              description = lib.mdDoc ''
+                The levels parameter defines structure of subdirectories in cache: from
+                1 to 3, each level accepts values 1 or 2. Сan be used any combination of
+                1 and 2 in these formats: x, x:x and x:x:x.
+              '';
+            };
+
+            useTempPath = mkOption {
+              type = types.bool;
+              default = false;
+              example = true;
+              description = lib.mdDoc ''
+                Nginx first writes files that are destined for the cache to a temporary
+                storage area, and the use_temp_path=off directive instructs Nginx to
+                write them to the same directories where they will be cached. Recommended
+                that you set this parameter to off to avoid unnecessary copying of data
+                between file systems.
+              '';
+            };
+
+            inactive = mkOption {
+              type = types.str;
+              default = "10m";
+              example = "1d";
+              description = lib.mdDoc ''
+                Cached data that has not been accessed for the time specified by
+                the inactive parameter is removed from the cache, regardless of
+                its freshness.
+              '';
+            };
+
+            maxSize = mkOption {
+              type = types.str;
+              default = "1g";
+              example = "2048m";
+              description = lib.mdDoc "Set maximum cache size";
+            };
+          };
+        };
+        default = {};
+        description = lib.mdDoc "Configure proxy cache";
+      };
+
      resolver = mkOption {
        type = types.submodule {
          options = {
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@ -33,7 +33,7 @@ let
      mountPoint = mkOption {
        example = "/mnt/usb";
        type = nonEmptyWithoutTrailingSlash;
-        description = lib.mdDoc "Location of the mounted the file system.";
+        description = lib.mdDoc "Location of the mounted file system.";
      };

      device = mkOption {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -586,6 +586,7 @@ in {
  sourcehut = handleTest ./sourcehut.nix {};
  spacecookie = handleTest ./spacecookie.nix {};
  spark = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./spark {};
+  sqlite3-to-mysql = handleTest ./sqlite3-to-mysql.nix {};
  sslh = handleTest ./sslh.nix {};
  sssd = handleTestOn ["x86_64-linux"] ./sssd.nix {};
  sssd-ldap = handleTestOn ["x86_64-linux"] ./sssd-ldap.nix {};
--- a/nixos/tests/pinnwand.nix
+++ b/nixos/tests/pinnwand.nix
@ -1,27 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ...}:
 let
-  pythonEnv = pkgs.python3.withPackages (py: with py; [ appdirs toml ]);
-
  port = 8000;
  baseUrl = "http://server:${toString port}";
-
-  configureSteck = pkgs.writeScript "configure.py" ''
-    #!${pythonEnv.interpreter}
-    import appdirs
-    import toml
-    import os
-
-    CONFIG = {
-      "base": "${baseUrl}/",
-      "confirm": False,
-      "magic": True,
-      "ignore": True
-    }
-
-    os.makedirs(appdirs.user_config_dir('steck'))
-    with open(os.path.join(appdirs.user_config_dir('steck'), 'steck.toml'), "w") as fd:
-        toml.dump(CONFIG, fd)
-    '';
 in
 {
  name = "pinnwand";
@ -44,7 +24,32 @@ in

    client = { pkgs, ... }:
    {
-      environment.systemPackages = [ pkgs.steck ];
+      environment.systemPackages = [
+        pkgs.steck
+
+        (pkgs.writers.writePython3Bin "setup-steck.py" {
+          libraries = with pkgs.python3.pkgs; [ appdirs toml ];
+          flakeIgnore = [
+            "E501"
+          ];
+        }
+        ''
+          import appdirs
+          import toml
+          import os
+
+          CONFIG = {
+              "base": "${baseUrl}/",
+              "confirm": False,
+              "magic": True,
+              "ignore": True
+          }
+
+          os.makedirs(appdirs.user_config_dir('steck'))
+          with open(os.path.join(appdirs.user_config_dir('steck'), 'steck.toml'), "w") as fd:
+              toml.dump(CONFIG, fd)
+        '')
+      ];
    };
  };

@ -55,7 +60,7 @@ in
    client.wait_for_unit("network.target")

    # create steck.toml config file
-    client.succeed("${configureSteck}")
+    client.succeed("setup-steck.py")

    # wait until the server running pinnwand is reachable
    client.wait_until_succeeds("ping -c1 server")
@ -75,12 +80,6 @@ in
        if line.startswith("Removal link:"):
            removal_link = line.split(":", 1)[1]

-
-    # start the reaper, it shouldn't do anything meaningful here
-    server.systemctl("start pinnwand-reaper.service")
-    server.wait_until_fails("systemctl is-active -q pinnwand-reaper.service")
-    server.log(server.execute("journalctl -u pinnwand-reaper -e --no-pager")[1])
-
    # check whether paste matches what we sent
    client.succeed(f"curl {raw_url} > /tmp/machine-id")
    client.succeed("diff /tmp/machine-id /etc/machine-id")
@ -89,6 +88,6 @@ in
    client.succeed(f"curl {removal_link}")
    client.fail(f"curl --fail {raw_url}")

-    server.log(server.succeed("systemd-analyze security pinnwand"))
+    server.log(server.execute("systemd-analyze security pinnwand | grep '✗'")[1])
  '';
 })
--- a/nixos/tests/sqlite3-to-mysql.nix
+++ b/nixos/tests/sqlite3-to-mysql.nix
@ -0,0 +1,65 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+
+/*
+  This test suite replaces the typical pytestCheckHook function in
+  sqlite3-to-mysql due to the need of a running mysql instance.
+*/
+
+{
+  name = "sqlite3-to-mysql";
+  meta.maintainers = with lib.maintainers; [ gador ];
+
+  nodes.machine = { pkgs, ... }: {
+    environment.systemPackages = with pkgs; [
+      sqlite3-to-mysql
+      # create one coherent python environment
+      (python3.withPackages
+        (ps: sqlite3-to-mysql.propagatedBuildInputs ++
+          [
+            python3Packages.pytest
+            python3Packages.pytest-mock
+            python3Packages.pytest-timeout
+            python3Packages.factory_boy
+            python3Packages.docker # only needed so import does not fail
+            sqlite3-to-mysql
+          ])
+      )
+    ];
+    services.mysql = {
+      package = pkgs.mariadb;
+      enable = true;
+      # from https://github.com/techouse/sqlite3-to-mysql/blob/master/tests/conftest.py
+      # and https://github.com/techouse/sqlite3-to-mysql/blob/master/.github/workflows/test.yml
+      initialScript = pkgs.writeText "mysql-init.sql" ''
+        create database test_db DEFAULT CHARACTER SET utf8mb4;
+        create user tester identified by 'testpass';
+        grant all on test_db.* to tester;
+        create user tester@localhost identified by 'testpass';
+        grant all on test_db.* to tester@localhost;
+      '';
+      settings = {
+        mysqld = {
+          character-set-server = "utf8mb4";
+          collation-server = "utf8mb4_unicode_ci";
+          log_warnings = 1;
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("mysql")
+
+    machine.succeed(
+         "sqlite3mysql --version | grep ${pkgs.sqlite3-to-mysql.version}"
+    )
+
+    # invalid_database_name: assert '1045 (28000): Access denied' in "1044 (42000): Access denied [...]
+    # invalid_database_user: does not return non-zero exit for some reason
+    # test_version: has problems importing sqlite3_to_mysql and determining the version
+    machine.succeed(
+         "cd ${pkgs.sqlite3-to-mysql.src} \
+          && pytest -v --no-docker -k \"not test_invalid_database_name and not test_invalid_database_user and not test_version\""
+    )
+  '';
+})
--- a/nixos/tests/stratis/encryption.nix
+++ b/nixos/tests/stratis/encryption.nix
@ -26,8 +26,7 @@ import ../make-test-python.nix ({ pkgs, ... }:
        # test rebinding encrypted pool
        machine.succeed("stratis pool rebind keyring  testpool testkey2")
        # test restarting encrypted pool
-        uuid = machine.succeed("stratis pool list | grep -oE '[0-9a-fA-F-]{36}'").rstrip('\n')
-        machine.succeed(" stratis pool stop   testpool")
-        machine.succeed(f"stratis pool start  {uuid}   --unlock-method keyring")
+        machine.succeed("stratis pool stop   testpool")
+        machine.succeed("stratis pool start  --name testpool --unlock-method keyring")
      '';
  })
--- a/nixos/tests/vector.nix
+++ b/nixos/tests/vector.nix
@ -21,7 +21,7 @@ with pkgs.lib;
              type = "file";
              inputs = [ "journald" ];
              path = "/var/lib/vector/logs.log";
-              encoding = { codec = "ndjson"; };
+              encoding = { codec = "json"; };
            };
          };
        };
--- a/pkgs/applications/audio/aaxtomp3/default.nix
+++ b/pkgs/applications/audio/aaxtomp3/default.nix
@ -0,0 +1,56 @@
+{ coreutils
+, fetchFromGitHub
+, ffmpeg
+, findutils
+, gnugrep
+, gnused
+, jq
+, lame
+, lib
+, makeWrapper
+, mediainfo
+, mp4v2
+, stdenv
+}:
+let
+  runtimeInputs = [
+    coreutils
+    ffmpeg
+    findutils
+    gnugrep
+    gnused
+    jq
+    lame
+    mediainfo
+    mp4v2
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "aaxtomp3";
+  version = "1.3";
+
+  src = fetchFromGitHub {
+    owner = "krumpetpirate";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-7a9ZVvobWH/gPxa3cFiPL+vlu8h1Dxtcq0trm3HzlQg=";
+  };
+
+  dontBuild = false;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    install -Dm755 AAXtoMP3 $out/bin/aaxtomp3
+    wrapProgram $out/bin/aaxtomp3 --prefix PATH : ${lib.makeBinPath runtimeInputs}
+    install -Dm755 interactiveAAXtoMP3 $out/bin/interactiveaaxtomp3
+    wrapProgram $out/bin/interactiveaaxtomp3 --prefix PATH : ${lib.makeBinPath runtimeInputs}
+  '';
+
+  meta = with lib; {
+    description = "Convert Audible's .aax filetype to MP3, FLAC, M4A, or OPUS";
+    homepage = "https://krumpetpirate.github.io/AAXtoMP3";
+    license = licenses.wtfpl;
+    maintainers = with maintainers; [ urandom ];
+  };
+}
--- a/pkgs/applications/audio/netease-music-tui/cargo-lock.patch
+++ b/pkgs/applications/audio/netease-music-tui/cargo-lock.patch
--- a/pkgs/applications/audio/netease-music-tui/default.nix
+++ b/pkgs/applications/audio/netease-music-tui/default.nix
@ -2,13 +2,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "netease-music-tui";
-  version = "0.1.4";
+  version = "0.1.5";

  src = fetchFromGitHub {
    owner = "betta-cyber";
    repo = "netease-music-tui";
    rev = "v${version}";
-    sha256 = "sha256-ILJkejRKG2DRXgR6O2tAFbrbd8HtnLZJmITq7hF41DQ=";
+    sha256 = "sha256-+zRXihWg65DtyX3yD04CsW8aXIvNph36PW2veeg36lg=";
  };

  cargoPatches = [ ./cargo-lock.patch ];
@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ alsa-lib openssl ];

-  cargoSha256 = "sha256-/JQDUtSSkuO9nrYVSkQOaZjps1BUuH8Bc1SMyDSSJS4=";
+  cargoSha256 = "sha256-i+W/KwnqdaHcrdaWYUuCUeFlRKekVuEvFh/pxDolPNU=";

  meta = with lib; {
    homepage = "https://github.com/betta-cyber/netease-music-tui";
--- a/pkgs/applications/audio/pyradio/default.nix
+++ b/pkgs/applications/audio/pyradio/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyradio";
-  version = "0.8.9.28";
+  version = "0.8.9.31";

  src = fetchFromGitHub {
    owner = "coderholic";
    repo = pname;
    rev = "refs/tags/${version}";
-    sha256 = "sha256-0j0AQZk+WEkcRTL/peAxzRw23gThlGtMnqoms2aUCrc=";
+    sha256 = "sha256-9Fc42f0plduihXDDLXWBdt62maxDJ0cwumIvbiMcrGc=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/audio/tauon/default.nix
+++ b/pkgs/applications/audio/tauon/default.nix
@ -25,13 +25,13 @@

 stdenv.mkDerivation rec {
  pname = "tauon";
-  version = "7.4.3";
+  version = "7.4.5";

  src = fetchFromGitHub {
    owner = "Taiko2k";
    repo = "TauonMusicBox";
    rev = "v${version}";
-    sha256 = "sha256-eB4fwW5UvylVslSEvDFdCVYcEK3M2H+8VJGHH13vvA0=";
+    sha256 = "sha256-fxmCLjnYO7ZblEiRoByxuFzw9xFHqbQvne1WNcFnnwI=";
  };

  postUnpack = ''
@ -131,6 +131,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "The Linux desktop music player from the future";
    homepage = "https://tauonmusicbox.rocks/";
+    changelog = "https://github.com/Taiko2k/TauonMusicBox/releases/tag/v${version}";
    license = licenses.gpl3;
    maintainers = with maintainers; [ jansol ];
    platforms = platforms.linux;
--- a/pkgs/applications/backup/ludusavi/default.nix
+++ b/pkgs/applications/backup/ludusavi/default.nix
@ -13,7 +13,7 @@
 , libXrandr
 , libXi
 , gnome
-, kdialog
+, libsForQt5
 }:

 rustPlatform.buildRustPackage rec {
@ -71,7 +71,7 @@ rustPlatform.buildRustPackage rec {
    in
    ''
      patchelf --set-rpath "${libPath}" "$out/bin/$pname"
-      wrapProgram $out/bin/$pname --prefix PATH : ${lib.makeBinPath [ gnome.zenity kdialog ]}
+      wrapProgram $out/bin/$pname --prefix PATH : ${lib.makeBinPath [ gnome.zenity libsForQt5.kdialog ]}
    '';


--- a/pkgs/applications/blockchains/dogecoin/default.nix
+++ b/pkgs/applications/blockchains/dogecoin/default.nix
@ -2,7 +2,7 @@
 , pkg-config, autoreconfHook
 , db5, openssl, boost, zlib, miniupnpc, libevent
 , protobuf, qtbase ? null
-, wrapQtAppsHook ? null, qttools, qmake ? null, qrencode
+, wrapQtAppsHook ? null, qttools ? null, qmake ? null, qrencode
 , withGui, withUpnp ? true, withUtils ? true, withWallet ? true
 , withZmq ? true, zeromq, util-linux ? null, Cocoa ? null }:

--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -1301,6 +1301,7 @@ self: super: {
      "coc-jest"
      "coc-json"
      "coc-lists"
+      "coc-ltex"
      "coc-markdownlint"
      "coc-metals"
      "coc-pairs"
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -874,8 +874,8 @@ let
        mktplcRef = {
          name = "gitlens";
          publisher = "eamodio";
-          version = "12.1.2";
-          sha256 = "0wpmfrfpi6wl9v3dknx2qr2m74azpcw8bvhac21v67w6jxnl3jd9";
+          version = "2022.11.2204";
+          sha256 = "0npr9fymfjnrq7xvfj6fdc04lysz28qncf9r8syv0w9873f3695h";
        };
        meta = with lib; {
          changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@ -1322,8 +1322,8 @@ let
        mktplcRef = {
          name = "todo-tree";
          publisher = "Gruntfuggly";
-          version = "0.0.215";
-          sha256 = "sha256-WK9J6TvmMCLoqeKWh5FVp1mNAXPWVmRvi/iFuLWMylM=";
+          version = "0.0.220";
+          sha256 = "06kzb4msfdv11lij4dwbn1vxdxhvnpfcjqw0gvydgkqjy7dridjk";
        };
        meta = with lib; {
          license = licenses.mit;
@ -1502,8 +1502,8 @@ let
        mktplcRef = {
          name = "svg";
          publisher = "jock";
-          version = "1.4.19";
-          sha256 = "1yl5pxsayplkdqv5jipii7pyj85j2lc4zmibyr69470b6li264rq";
+          version = "1.4.23";
+          sha256 = "11f1g4a8v8330ki4240bvg5zpydagg1dwqfh1sar9ds7p1795ims";
        };
        meta = with lib; {
          license = licenses.mit;
@ -1514,8 +1514,8 @@ let
        mktplcRef = {
          name = "vscode-peacock";
          publisher = "johnpapa";
-          version = "4.0.1";
-          sha256 = "sha256-oYXYOamwacgRqv3+ZREJ1vqRlwMz8LpO+wa6CVEEdbI=";
+          version = "4.2.2";
+          sha256 = "1z9crpz025ha9hgc9mxxg3vyrsfpf9d16zm1vrf4q592j9156d2m";
        };
        meta = with lib; {
          license = licenses.mit;
@ -1812,8 +1812,8 @@ let
        mktplcRef = {
          name = "vscode-docker";
          publisher = "ms-azuretools";
-          version = "1.22.1";
-          sha256 = "1ix363fjxi9g450rs3ghx44z3hppvasf0xpzgha93m90djd7ai52";
+          version = "1.22.2";
+          sha256 = "13scns5iazzsjx8rli311ym2z8i8f4nvbcd5w8hqj5z0rzsds6xi";
        };
        meta = {
          license = lib.licenses.mit;
@ -1876,8 +1876,8 @@ let
        mktplcRef = {
          name = "PowerShell";
          publisher = "ms-vscode";
-          version = "2022.7.2";
-          sha256 = "sha256-YL90dRmOvfbizT+hfkNu267JtG122LTMS9MHCfaMzkk=";
+          version = "2022.11.0";
+          sha256 = "01pq84rqh2q6rd0ljfql37q6i1kg597qy0mr7fiz5ddi15zcfn19";
        };
        meta = with lib; {
          description = "A Visual Studio Code extension for PowerShell language support";
@ -2117,8 +2117,8 @@ let
        mktplcRef = {
          name = "vscode-yaml";
          publisher = "redhat";
-          version = "1.9.1";
-          sha256 = "10m70sahl7vf8y82gqz9yk6bk4k4b923xn5rk7fax1nqw0pkln2w";
+          version = "1.11.10112022";
+          sha256 = "0i53n9whcfpds9496r4pa27j3zmd4jc1kpkf4m4rfxzswwngg47x";
        };
        meta = {
          license = lib.licenses.mit;
@ -2173,8 +2173,8 @@ let
        mktplcRef = {
          name = "material-icon-theme";
          publisher = "PKief";
-          version = "4.19.0";
-          sha256 = "1azkkp4bnd7n8v0m4325hfrr6p6ikid88xbxaanypji25pnyq5a4";
+          version = "4.22.0";
+          sha256 = "0irrivfidgjqfd205gh27r2ccj2anvqgvq7lfaaf92wrrc2zvlsk";
        };
        meta = {
          license = lib.licenses.mit;
--- a/pkgs/applications/emulators/sameboy/default.nix
+++ b/pkgs/applications/emulators/sameboy/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, gtk3, rgbds, SDL2, wrapGAppsHook, glib }:
+{ lib, stdenv, fetchpatch, fetchFromGitHub, gtk3, rgbds, SDL2, wrapGAppsHook, glib }:

 stdenv.mkDerivation rec {
  pname = "sameboy";
@ -16,6 +16,13 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ rgbds glib wrapGAppsHook ];
  buildInputs = [ SDL2 ];

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/LIJI32/SameBoy/commit/c0966ceebaf1cf2518427ffa3c0189d8f96ab5aa.patch";
+      hash = "sha256-2o/aWimtAKqay7SGq5Q9vLDcQKqV6Bn2xJtnjACrLUw=";
+    })
+  ];
+
  makeFlags = [
    "CONF=release"
    "FREEDESKTOP=true"
--- a/pkgs/applications/graphics/exrdisplay/default.nix
+++ b/pkgs/applications/graphics/exrdisplay/default.nix
@ -1,29 +0,0 @@
-{ lib, stdenv, fetchurl, pkg-config, fltk, openexr, libGLU, libGL, ctl }:
-
-stdenv.mkDerivation rec {
-  pname = "openexr_viewers";
-  version = "2.2.1";
-
-  src = fetchurl {
-    url = "mirror://savannah/openexr/openexr_viewers-${version}.tar.gz";
-    sha256 = "1ixx2wbjp4rvsf7h3bkja010gl1ihjrcjzy7h20jnn47ikg12vj8";
-  };
-
-  configurePhase = ''
-    ./configure --prefix=$out --with-fltk-config=${fltk}/bin/fltk-config
-  '';
-
-  buildPhase = ''
-    make LDFLAGS="`fltk-config --ldflags` -lGL -lfltk_gl"
-  '';
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openexr fltk libGLU libGL ctl ];
-
-  meta = {
-    description = "Application for viewing OpenEXR images on a display at various exposure settings";
-    homepage = "http://openexr.com";
-    platforms = lib.platforms.linux;
-    license = lib.licenses.bsd3;
-  };
-}
--- a/pkgs/applications/graphics/screencloud/default.nix
+++ b/pkgs/applications/graphics/screencloud/default.nix
@ -1,76 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, cmake, qt4, quazip, qt-mobility, qxt, python2Packages }:
-
-with lib;
-stdenv.mkDerivation rec {
-  pname = "screencloud";
-  version = "1.2.0";
-
-  # API Keys. According to the author of the AUR package, these are only used
-  # for tracking usage.
-  consumerKey = "23e747012c68601f27ab69c6de129ed70552d55b6";
-  consumerSecret = "4701cb00c1bd357bbcae7c3d713dd216";
-
-  src = fetchFromGitHub {
-    owner = "olav-st";
-    repo = "screencloud";
-    rev = "v${version}";
-    sha256 = "1s0dxa1sa37nvna5nfqdsp294810favj68qb7ghl78qna7zw0cim";
-  };
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ qt4 quazip qt-mobility qxt python2Packages.python python2Packages.pycrypto ];
-
-  patchPhase = ''
-    # Required to make the configure script work. Normally, screencloud's
-    # CMakeLists file sets the install prefix to /opt by force. This is stupid
-    # and breaks nix, so we force it to install where we want. Please don't
-    # write CMakeLists files like this, as things like this are why we can't
-    # have nice things.
-    substituteInPlace "CMakeLists.txt" --replace "set(CMAKE_INSTALL_PREFIX \"/opt\")" ""
-  '';
-
-  # We need to append /opt to our CMAKE_INSTALL_PREFIX, so we tell the Nix not
-  # to add the argument for us.
-  dontAddPrefix = true;
-
-  cmakeFlags = [
-    "-DQXT_QXTCORE_INCLUDE_DIR=${qxt}/include/QxtCore"
-    "-DQXT_QXTCORE_LIB_RELEASE=${qxt}/lib/libQxtCore.so"
-    "-DQXT_QXTGUI_INCLUDE_DIR=${qxt}/include/QxtGui"
-    "-DQXT_QXTGUI_LIB_RELEASE=${qxt}/lib/libQxtGui.so"
-    "-DCONSUMER_KEY_SCREENCLOUD=${consumerKey}"
-    "-DCONSUMER_SECRET_SCREENCLOUD=${consumerSecret}"
-  ];
-
-  setSourceRoot = ''
-    sourceRoot=$(echo */screencloud)
-  '';
-
-  preConfigure = ''
-    # This needs to be set in preConfigure instead of cmakeFlags in order to
-    # access the $prefix environment variable.
-    export cmakeFlags="-DCMAKE_INSTALL_PREFIX=$prefix/opt $cmakeFlags"
-  '';
-
-  # There are a number of issues with screencloud's installation. We need to add
-  # pycrypto to the PYTHONPATH so that the SFTP plugin will work properly; and
-  # we need to move the libPythonQt library into a folder where it can actually
-  # be found.
-  postInstall = ''
-    patchShebangs $prefix/opt/screencloud/screencloud.sh
-    substituteInPlace "$prefix/opt/screencloud/screencloud.sh" --replace "/opt" "$prefix/opt"
-    sed -i "2 i\export PYTHONPATH=$(toPythonPath ${python2Packages.pycrypto}):\$PYTHONPATH" "$prefix/opt/screencloud/screencloud.sh"
-    mkdir $prefix/bin
-    mkdir $prefix/lib
-    ln -s $prefix/opt/screencloud/screencloud.sh $prefix/bin/screencloud
-    ln -s $prefix/opt/screencloud/libPythonQt.so $prefix/lib/libPythonQt.so
-  '';
-
-  meta = {
-    homepage = "https://screencloud.net/";
-    description = "Client for Screencloud, an easy to use screenshot sharing tool";
-    license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ forkk ];
-    platforms = with lib.platforms; linux;
-  };
-}
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.106.0";
+  version = "0.107.0";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Dyre/ou0kjEqbq8WGGM/n8+JBTMNslbnmj+5clYJUHs=";
+    sha256 = "sha256-8Ru1T6GSz5TfMxFvUU2QgpiWNLJK+ky723qc3flrDIw=";
  };

-  vendorSha256 = "sha256-dhsGGu4uNrqKv6szGqruAcI2UTbbXknKaKk5pVCQB5A=";
+  vendorSha256 = "sha256-92QLkSUrwMEZ/8pIeOj4KKtC47oN+ITxJnpp7Fb0Z10=";

  doCheck = false;

--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@ -123,13 +123,13 @@ rec {

  gammastep = mkRedshift rec {
    pname = "gammastep";
-    version = "2.0.8";
+    version = "2.0.9";

    src = fetchFromGitLab {
      owner = "chinstrap";
      repo = pname;
      rev = "v${version}";
-      sha256 = "071f3iqdbblb3awnx48j19kspk6l2g3658za80i2mf4gacgq9fm1";
+      sha256 = "sha256-EdVLBBIEjMu+yy9rmcxQf4zdW47spUz5SbBDbhmLjOU=";
    };

    meta = redshift.meta // {
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.14.2";
+  version = "2.14.3";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-dcLzD+dzQ6Uj4XlXT4bKFniS/ZB9MBrqxEzM6SwnPes=";
+    sha256 = "sha256-7bCl8VfkMhoTBnr+O+oBYQeSV2sRwlP/qUkNkYerZdU=";
  };

  vendorSha256 = "sha256-E2Q+mXojMb8E0zSnaCOl9xp5QLeYcuTXjhcp3Hc8gH4=";
--- a/pkgs/applications/misc/tippecanoe/default.nix
+++ b/pkgs/applications/misc/tippecanoe/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tippecanoe";
-  version = "2.13.0";
+  version = "2.13.1";

  src = fetchFromGitHub {
    owner = "felt";
    repo = "tippecanoe";
    rev = finalAttrs.version;
-    hash = "sha256-YgmePs0GxygR0hvcnRngzW77QZTOygSYvRaYk6oCVls=";
+    hash = "sha256-cDNaZ3ZYCUWg30Td1hlzzaB46tI7cFZLvgwCAZN72QI=";
  };

  buildInputs = [ sqlite zlib ];
--- a/pkgs/applications/misc/tty-share/default.nix
+++ b/pkgs/applications/misc/tty-share/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "tty-share";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "elisescu";
    repo = "tty-share";
    rev = "v${version}";
-    sha256 = "sha256-/oK2m2kxmF9HHYfTK6NlZxKKkDS7Oay+ed7jR/+szs0=";
+    sha256 = "sha256-7rNSBpiZslUGWw0P/Q1zRtNxo9MN8Vq6hG8pD6bJIsA=";
  };

  # Upstream has a `./vendor` directory with all deps which we rely upon.
--- a/pkgs/applications/misc/tut/default.nix
+++ b/pkgs/applications/misc/tut/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "tut";
-  version = "1.0.19";
+  version = "1.0.22";

  src = fetchFromGitHub {
    owner = "RasmusLindroth";
    repo = pname;
    rev = version;
-    sha256 = "sha256-lT/3KXxrZYOK/oGrlorQUIv8J7tAfME0hRb1bwN+nXA=";
+    sha256 = "sha256-wFK5dFGD25KtBn4gujgvDu8zZWQ8XH1peEbpLa+6n8A=";
  };

-  vendorSha256 = "sha256-O7tre7eSGlB9mnf/9aNbe/Ji0ecmJyuLuaWKARskCjI=";
+  vendorSha256 = "sha256-HZrchLQ1861MYWDiiegXLNMDsDUzRNzLA7MoULBai+4=";

  meta = with lib; {
    description = "A TUI for Mastodon with vim inspired keys";
--- a/pkgs/applications/misc/xygrib/default.nix
+++ b/pkgs/applications/misc/xygrib/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, wrapQtAppsHook, cmake, bzip2, qtbase, qttools, libnova, proj_7, libpng, openjpeg }:

 stdenv.mkDerivation rec {
-  version = "1.2.6.1";
+  version = "unstable-2022-05-16";
  pname = "xygrib";

  src = fetchFromGitHub {
    owner = "opengribs";
    repo = "XyGrib";
-    rev = "v${version}";
-    sha256 = "0xzsm8pr0zjk3f8j880fg5n82jyxn8xf1330qmmq1fqv7rsrg9ia";
+    rev = "88c425ca2d7f4ba5d7ab75bfa25e177bee02d310";
+    sha256 = "sha256-qMMeRYIQqJpVRE3YjbXIiXHwS/CHs9l2QihszwQIr/A=";
  };

  nativeBuildInputs = [ cmake qttools wrapQtAppsHook ];
@ -38,6 +38,6 @@ stdenv.mkDerivation rec {
    '';
    license = licenses.gpl3;
    platforms = platforms.all;
-    maintainers = with maintainers; [ j03 SuperSandro2000 ];
+    maintainers = with maintainers; [ j03 ];
  };
 }
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -295,7 +295,14 @@ let
      chrome_pgo_phase = 0;
      clang_base_path = "${llvmPackages.clang}";
      use_qt = false;
+    } // optionalAttrs (!chromiumVersionAtLeast "108") {
      use_system_libwayland_server = true;
+    } // optionalAttrs (chromiumVersionAtLeast "108") {
+      # The default has changed to false. We'll build with libwayland from
+      # Nixpkgs for now but might want to eventually use the bundled libwayland
+      # as well to avoid incompatibilities (if this continues to be a problem
+      # from time to time):
+      use_system_libwayland = true;
    } // optionalAttrs proprietaryCodecs {
      # enable support for the H.264 codec
      proprietary_codecs = true;
--- a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "tektoncd-cli";
-  version = "0.27.0";
+  version = "0.28.0";

  src = fetchFromGitHub {
    owner = "tektoncd";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-zLPZueKdUNauIzqXOV773SZ/RWg7UuMNeJHr7z6ZJ+E=";
+    sha256 = "sha256-8OW0n6aS7bDDbzbrMfJLL8Yvq3vJg47qHQB4zY0xxAw=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.40.2";
+  version = "0.41.0";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-wNedd6C4NPLPw8CA1tyKx2MWsKatFbN4xt3Us2SC/ME=";
+    sha256 = "sha256-1if7Z+4Lr5eevf1NUJn//pcVU3Ts/FznDd/604aJO/c=";
  };

  vendorSha256 = "sha256-Qc0FnNxyErtieVvEj/eKPW5PpvYFwiYtv+ReJTVFAPA=";
--- a/pkgs/applications/networking/diswall/default.nix
+++ b/pkgs/applications/networking/diswall/default.nix
@ -0,0 +1,33 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "diswall";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "dis-works";
+    repo = "diswall-rs";
+    rev = "v${version}";
+    sha256 = "sha256-zT8RRg+Ver7dYtJL9htrZ8nXoD0V7IvdIqHTKDmbZ7c=";
+  };
+
+  cargoSha256 = "sha256-N+w1OiCy3scahFdYI49GpL301t1qNd/X4fdLMoQE/2s=";
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Distributed firewall";
+    longDescription = ''
+      Diswall (distributed firewall) - a client of distributed firewall
+      working on many servers and using NATS for the transport level.
+      Its purpose - blocking IPs with a blink of the eye on all servers
+      in any infrastructure when some IP checks any of the closed ports
+      of anyone of these servers. Therefore, diswall provides good
+      protection of whole infrastructure (as anti-shodan) preventing
+      intruder to get any system information.
+    '';
+    homepage = "https://www.diswall.stream";
+    license = with licenses; [ gpl3 ];
+    maintainers = with maintainers; [ izorkin ];
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/element/element-web.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-web.nix
@ -16,7 +16,6 @@ let
  pinData = lib.importJSON ./pin.json;
  noPhoningHome = {
    disable_guests = true; # disable automatic guest account registration at matrix.org
-    piwik = false; # disable analytics
  };

  unwrapped = stdenv.mkDerivation rec {
--- a/pkgs/applications/networking/maestral-qt/default.nix
+++ b/pkgs/applications/networking/maestral-qt/default.nix
@ -56,9 +56,11 @@ python3.pkgs.buildPythonApplication rec {

  meta = with lib; {
    description = "GUI front-end for maestral (an open-source Dropbox client) for Linux";
+    homepage = "https://maestral.app";
+    changelog = "https://github.com/samschott/maestral/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ peterhoeg sfrijters ];
    platforms = platforms.linux;
-    homepage = "https://maestral.app";
+    mainProgram = "maestral_qt";
  };
 }
--- a/pkgs/applications/networking/p2p/freenet/default.nix
+++ b/pkgs/applications/networking/p2p/freenet/default.nix
@ -1,72 +1,64 @@
-{ lib, stdenv, fetchurl, fetchFromGitHub, ant, jdk, bash, coreutils, substituteAll }:
+{ lib, stdenv, fetchurl, jdk, bash, coreutils, substituteAll }:

 let
-  freenet_ext = fetchurl {
-    url = "https://downloads.freenetproject.org/latest/freenet-ext.jar";
-    sha256 = "17ypljdvazgx2z6hhswny1lxfrknysz3x6igx8vl3xgdpvbb7wij";
+  version = "build01494";
+  jna = fetchurl {
+    url = "https://github.com/freenet/fred/releases/download/${version}/jna-4.5.2.jar";
+    sha256 = "sha256-DI63rPZyYWVteQBRkd66ujtr9d1gpDc1okVCk4Hb7P8=";
+  };
+  jna_platform = fetchurl {
+    url = "https://github.com/freenet/fred/releases/download/${version}/jna-platform-4.5.2.jar";
+    sha256 = "sha256-8dAMFn2JIcbiPGJu+fHDrgvkc8lcaP+gErx65VqH4tY=";
+  };
+  freenet_ext = fetchurl {
+    url = "https://github.com/freenet/fred/releases/download/${version}/freenet-ext.jar";
+    sha256 = "sha256-MvKz1r7t9UE36i+aPr72dmbXafCWawjNF/19tZuk158=";
  };
-
-  bcprov_version = "jdk15on-154";
  bcprov = fetchurl {
-    url = "https://www.bouncycastle.org/download/bcprov-ext-${bcprov_version}.jar";
-    sha256 = "0abmhg2h44g8c5p7skzqwfxj8xwcjh9vs84mc0hr78k1am0633jk";
+    url = "https://github.com/freenet/fred/releases/download/${version}/bcprov-jdk15on-1.59.jar";
+    sha256 = "sha256-HDHkTjMdJeRtKTs+juLQcCimfbAR50yyRDKFrtHVnIU=";
  };
  seednodes = fetchurl {
    url = "https://downloads.freenetproject.org/alpha/opennet/seednodes.fref";
    sha256 = "08awwr8n80b4cdzzb3y8hf2fzkr1f2ly4nlq779d6pvi5jymqdvv";
  };
-  version = "build01480";

  freenet-jars = stdenv.mkDerivation {
    pname = "freenet-jars";
    inherit version;

-    src = fetchFromGitHub {
-      owner = "freenet";
-      repo = "fred";
-      rev = version;
-      sha256 = "0wddkfyhsgs7bcq9svicz6l0a35yv82yqzmji3c345hg4hbch3kb";
+    src = fetchurl {
+      url = "https://github.com/freenet/fred/releases/download/${version}/freenet.jar";
+      sha256 = "sha256-1Pjc8Ob4EN7N05QkGTMKBn7z3myTDaQ98N48nNSLstg=";
    };

-    patchPhase = ''
-      cp ${freenet_ext} lib/freenet/freenet-ext.jar
-      cp ${bcprov} lib/bcprov-${bcprov_version}.jar
-
-      sed '/antcall.*-ext/d' -i build.xml
-      sed 's/@unknown@/${version}/g' -i build-clean.xml
-    '';
-
-    buildInputs = [ ant jdk ];
-
-    buildPhase = "ant package-only";
+    dontUnpack = true;

    installPhase = ''
      mkdir -p $out/share/freenet
-      cp lib/bcprov-${bcprov_version}.jar $out/share/freenet
-      cp lib/freenet/freenet-ext.jar $out/share/freenet
-      cp dist/freenet.jar $out/share/freenet
+      ln -s ${bcprov} $out/share/freenet/bcprov.jar
+      ln -s ${freenet_ext} $out/share/freenet/freenet-ext.jar
+      ln -s ${jna_platform} $out/share/freenet/jna_platform.jar
+      ln -s ${jna} $out/share/freenet/jna.jar
+      ln -s $src $out/share/freenet/freenet.jar
    '';
  };

 in stdenv.mkDerivation {
-  name = "freenet-${version}";
+  pname = "freenet";
  inherit version;

  src = substituteAll {
    src = ./freenetWrapper;
-    inherit bash coreutils seednodes bcprov_version;
+    inherit bash coreutils jdk seednodes;
    freenet = freenet-jars;
-    jre = jdk.jre;
  };

-  jars = freenet-jars;
-
  dontUnpack = true;

  installPhase = ''
    mkdir -p $out/bin
-    cp $src $out/bin/freenet
-    chmod +x $out/bin/freenet
+    install -Dm555 $src $out/bin/freenet
    ln -s ${freenet-jars}/share $out/share
  '';

@ -75,7 +67,7 @@ in stdenv.mkDerivation {
    homepage = "https://freenetproject.org/";
    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
    license = lib.licenses.gpl2Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ nagy ];
    platforms = with lib.platforms; linux;
  };
 }
--- a/pkgs/applications/networking/p2p/freenet/freenetWrapper
+++ b/pkgs/applications/networking/p2p/freenet/freenetWrapper
@ -1,18 +1,17 @@
 #! @bash@/bin/bash
-
+set -eo pipefail
 PATH=@coreutils@/bin:$PATH
+export CLASSPATH=@freenet@/share/freenet/bcprov.jar:@freenet@/share/freenet/freenet-ext.jar:@freenet@/share/freenet/jna_platform.jar:@freenet@/share/freenet/jna.jar:@freenet@/share/freenet/freenet.jar

 export FREENET_HOME="$HOME/.local/share/freenet"
-if [ -n "$XDG_DATA_HOME" ]
-  then export FREENET_HOME="$XDG_DATA_HOME/freenet"
+if [ -n "$XDG_DATA_HOME" ] ; then
+  FREENET_HOME="$XDG_DATA_HOME/freenet"
 fi

-if [ ! -d $FREENET_HOME ]; then
-  mkdir -p $FREENET_HOME
-fi
+mkdir -p -- $FREENET_HOME

-cp -u @seednodes@ $FREENET_HOME/seednodes.fref
-chmod u+rw $FREENET_HOME/seednodes.fref
+cp -u -- @seednodes@ $FREENET_HOME/seednodes.fref
+chmod u+rw -- $FREENET_HOME/seednodes.fref

-cd $FREENET_HOME
-@jre@/bin/java -cp @freenet@/share/freenet/bcprov-@bcprov_version@.jar:@freenet@/share/freenet/freenet-ext.jar:@freenet@/share/freenet/freenet.jar -Xmx1024M freenet.node.NodeStarter
+cd -- $FREENET_HOME
+exec @jdk@/bin/java -Xmx1024M freenet.node.NodeStarter "$@"
--- a/pkgs/applications/office/cb2bib/default.nix
+++ b/pkgs/applications/office/cb2bib/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, qmake, qtbase, qtwebkit, qtx11extras, lzo, libX11 }:
+{ lib, stdenv, fetchurl, qmake, qtbase, qtwebkit, qtx11extras, lzo, libX11, wrapQtAppsHook }:

 stdenv.mkDerivation rec {
  pname = "cb2bib";
@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
    sha256 = "0gv7cnxi84lr6d5y71pd67h0ilmf5c88j1jxgyn9dvj19smrv99h";
  };
  buildInputs = [ qtbase qtwebkit qtx11extras lzo libX11 ];
-  nativeBuildInputs = [ qmake ];
+  nativeBuildInputs = [ qmake wrapQtAppsHook ];

  configurePhase = ''
    runHook preConfigure
@ -16,8 +16,6 @@ stdenv.mkDerivation rec {
    runHook postConfigure
  '';

-  dontWrapQtApps = true;
-
  meta = with lib; {
    description = "Rapidly extract unformatted, or unstandardized bibliographic references from email alerts, journal Web pages and PDF files";
    homepage = "http://www.molspaces.com/d_cb2bib-overview.php";
--- a/pkgs/applications/office/tagainijisho/default.nix
+++ b/pkgs/applications/office/tagainijisho/default.nix
@ -1,11 +1,11 @@
 { lib, mkDerivation, fetchzip, qtbase, qttools, cmake, sqlite }:
 mkDerivation rec {
  pname = "tagainijisho";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchzip {
    url = "https://github.com/Gnurou/tagainijisho/releases/download/${version}/tagainijisho-${version}.tar.gz";
-    hash = "sha256-NYmvkjGl+lgFh4PPWGxitupYJ2DOyCBAYlITGb3FMj8=";
+    hash = "sha256-CTDMoYGbVE4W0SDerW//aAdUVsySWFQycSy0I3a9+94=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/science/machine-learning/streamlit/default.nix
+++ b/pkgs/applications/science/machine-learning/streamlit/default.nix
@ -1,41 +1,41 @@
 {
  # Nix
-  lib,
-  buildPythonApplication,
-  fetchPypi,
-
-  # Build inputs
-  altair,
-  blinker,
-  click,
-  cachetools,
-  GitPython,
-  importlib-metadata,
-  jinja2,
-  pillow,
-  pyarrow,
-  pydeck,
-  pympler,
-  protobuf,
-  requests,
-  rich,
-  semver,
-  setuptools,
-  toml,
-  tornado,
-  tzlocal,
-  validators,
-  watchdog,
+  lib
+, buildPythonApplication
+, fetchPypi
+, # Build inputs
+  altair
+, blinker
+, click
+, cachetools
+, GitPython
+, importlib-metadata
+, jinja2
+, pillow
+, pyarrow
+, pydeck
+, pympler
+, protobuf3
+, requests
+, rich
+, semver
+, setuptools
+, toml
+, tornado
+, tzlocal
+, validators
+, watchdog
+,
 }:

 buildPythonApplication rec {
  pname = "streamlit";
-  version = "1.13.0";
-  format = "wheel";  # source currently requires pipenv
+  version = "1.15.0";
+  format = "wheel"; # source currently requires pipenv

  src = fetchPypi {
    inherit pname version format;
-    hash = "sha256-MjGm9CT4p/Nl3J5G1Pu2ajY0/VcMdHabimn3ktkoXTo=";
+    hash = "sha256-QtBr3INWBwCBab+FzmvzrjGjwVVHC8NCET9wtRVeVbc=";
  };

  propagatedBuildInputs = [
@ -47,7 +47,7 @@ buildPythonApplication rec {
    importlib-metadata
    jinja2
    pillow
-    protobuf
+    protobuf3
    pyarrow
    pydeck
    pympler
@ -63,7 +63,7 @@ buildPythonApplication rec {
  ];

  postInstall = ''
-      rm $out/bin/streamlit.cmd # remove windows helper
+    rm $out/bin/streamlit.cmd # remove windows helper
  '';

  meta = with lib; {
--- a/pkgs/applications/science/math/pari/default.nix
+++ b/pkgs/applications/science/math/pari/default.nix
@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
    "--with-gmp=${lib.getDev gmp}"
    "--with-readline=${lib.getDev readline}"
  ]
-  ++ lib.optional stdenv.isDarwin "--host=x86_64-darwin"
+  ++ lib.optional stdenv.isDarwin "--host=${stdenv.system}"
  ++ lib.optional withThread "--mt=pthread";

  preConfigure = ''
@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
  '';

  postConfigure = lib.optionalString stdenv.isDarwin ''
-    echo 'echo x86_64-darwin' > config/arch-osname
+    echo 'echo ${stdenv.system}' > config/arch-osname
  '';

  makeFlags = [ "all" ];
@ -83,7 +83,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ ertes ] ++ teams.sage.members;
    platforms = platforms.linux ++ platforms.darwin;
-    broken = stdenv.isDarwin && stdenv.isAarch64;
    mainProgram = "gp";
  };
 }
--- a/pkgs/applications/science/misc/graphia/default.nix
+++ b/pkgs/applications/science/misc/graphia/default.nix
@ -2,6 +2,7 @@
 , lib
 , cmake
 , fetchFromGitHub
+, fetchpatch
 , wrapQtAppsHook
 , qtbase
 , qtquickcontrols2
@ -10,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "graphia";
-  version = "3.1";
+  version = "3.2";

  src = fetchFromGitHub {
    owner = "graphia-app";
    repo = "graphia";
    rev = version;
-    sha256 = "sha256-mqoK5y2h0JSiE9VtwawCgc1+qETzuefLVUpgFPcNFnk=";
+    sha256 = "sha256-9kohXLXF4F/qoHm8qmvPM1y9ak0Thb4xvgKJlVuOPTg=";
  };

  patches = [
@ -24,6 +25,12 @@ stdenv.mkDerivation rec {
    # https://github.com/pytorch/pytorch/issues/70297
    # https://github.com/google/breakpad/commit/605c51ed96ad44b34c457bbca320e74e194c317e
    ./breakpad-sigstksz.patch
+
+    # FIXME: backport patch fixing build with Qt 5.15, remove for next release
+    (fetchpatch {
+      url = "https://github.com/graphia-app/graphia/commit/4b51bb8d465afa7ed0b2b30cb1c5e1c6af95976f.patch";
+      hash = "sha256-GDJAFLxQlRWKvcOgqqPYV/aVTRM7+KDjW7Zp9l7SuyM=";
+    })
  ];

  nativeBuildInputs = [
--- a/pkgs/applications/version-management/fnc/default.nix
+++ b/pkgs/applications/version-management/fnc/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "fnc";
-  version = "0.12";
+  version = "0.13";

  src = fetchurl {
    url = "https://fnc.bsdbox.org/tarball/${version}/fnc-${version}.tar.gz";
-    sha256 = "05cg8id4d1ia8y60y3x23167bl1rn2fdpkf1jfj3aklhlihvkbxd";
+    sha256 = "126aklsjfqmrj0f9p1g6sdlqhwnbfhyn0lq2c9pidfnhppa7sz95";
  };

  buildInputs = [ libiconv ncurses zlib ];
--- a/pkgs/applications/version-management/git-and-tools/git-team/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-team/default.nix
@ -1,49 +1,39 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
-, fetchpatch
+, go-mockery
 , installShellFiles
 }:

 buildGoModule rec {
  pname = "git-team";
-  version = "1.7.0";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "hekmekk";
    repo = "git-team";
    rev = "v${version}";
-    hash = "sha256-pHKfehPyy01uVN6kjjPGtdkltw7FJ+HmIlwGs4iRhVo=";
+    hash = "sha256-LZR30zqwit/xydQbpGm1LXd/tno/sTCaftgjVkVS6ZY=";
  };

-  patches = [
-    (fetchpatch {
-      name = "1-update-dependencies-for-go-1.18.patch";
-      url = "https://github.com/hekmekk/git-team/commit/d8632d9938379293521f9b3f2a93df680dd13a31.patch";
-      hash = "sha256-hlmjPf3qp8WPNSH+GgkqATDiKIRzo+t81Npkptw8vgI=";
-    })
-    (fetchpatch {
-      name = "2-update-dependencies-for-go-1.18.patch";
-      url = "https://github.com/hekmekk/git-team/commit/f6acc96c2ffe76c527f2f2897b368cbb631d738c.patch";
-      hash = "sha256-Pe+UAK9N1NpXhFGYv9l1iZ1/fCCqnT8OSgKdt/vUqO4=";
-    })
-    (fetchpatch {
-      name = "3-update-dependencies-for-go-1.18.patch";
-      url = "https://github.com/hekmekk/git-team/commit/2f38137298e4749a8dfe37e085015360949e73ad.patch";
-      hash = "sha256-+6C8jp/qwYVmbL+SpV9FJIVyBRvX4tXBcoHMB//nNTk=";
-    })
+  vendorHash = "sha256-NTOUL1oE2IhgLyYYHwRCMW5yCxIRxUwqkfuhSSBXf6A=";
+
+  nativeBuildInputs = [
+    go-mockery
+    installShellFiles
  ];

-  vendorSha256 = "sha256-GdwksPmYEGTq/FkG/rvn3o0zMKU1cSkpgZ+GrfVgLWM=";
-
-  nativeBuildInputs = [ installShellFiles ];
+  preBuild = ''
+    mockery --dir=src/ --all --keeptree
+  '';

  postInstall = ''
-    go run main.go --generate-man-page > ${pname}.1
-    installManPage ${pname}.1
+    go run main.go --generate-man-page > git-team.1
+    installManPage git-team.1

-    # Currently only bash completions are provided
-    installShellCompletion --cmd git-team --bash <($out/bin/git-team completion bash)
+    installShellCompletion --cmd git-team \
+      --bash <($out/bin/git-team completion bash) \
+      --zsh <($out/bin/git-team completion zsh)
  '';

  meta = with lib; {
--- a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "lefthook";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "evilmartians";
    repo = "lefthook";
-    sha256 = "sha256-ZMqqiPSNNJw9t3p5h/GUHa9cvl9LcJ4u0HMf1ag8qCc=";
+    sha256 = "sha256-66exuMb0dUQWRhcDUU7mAJ06yD/acKX96KIQwMEU6xM=";
  };

  vendorSha256 = "sha256-NTZz0EDIjGdh8dD9jxbNVdWb7NFJsdtnMp7H6Ni0EbQ=";
--- a/pkgs/applications/version-management/gitoxide/default.nix
+++ b/pkgs/applications/version-management/gitoxide/default.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gitoxide";
-  version = "0.18.0";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "Byron";
    repo = "gitoxide";
    rev = "v${version}";
-    sha256 = "sha256-VB7v51YW4aA5WHVD5ZWFzv9hQskjQeqMzm+pQ9glODg=";
+    sha256 = "sha256-GGXujTn5Xb63vKIycj5o9+PCsMN1Kp3RCSg1wiM31qA=";
  };

-  cargoSha256 = "sha256-uII6o/cJktpUFxROuu11dNSXx0p6phVVqszmbYK9Rd0=";
+  cargoSha256 = "sha256-MAZhrd9CtFOIAaUUbXplBo+eo6Zaws2LIRkPoX4HztE=";

  nativeBuildInputs = [ cmake pkg-config ];
  buildInputs = if stdenv.isDarwin
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@ -21,11 +21,11 @@ let

  self = python3Packages.buildPythonApplication rec {
    pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.3.0";
+    version = "6.3.1";

    src = fetchurl {
      url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-iAOZtVSh3mQQFs5fNbiEDXXxjWh7mrHDWNrAWK1m5pg=";
+      sha256 = "sha256-bDmrhzKUjYnPEgh1HdfYXUBCqoIVOXdFG56xM2dYUHI=";
    };

    format = "other";
@ -35,7 +35,7 @@ let
    cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
      inherit src;
      name = "mercurial-${version}";
-      sha256 = "sha256-VfIZ1bV8bhjjBL4KNjToPuu8gg9TkChziH2rRKhdRXE=";
+      sha256 = "sha256-UZ/ZSZkAedrm3iUkaQu6zvfX4bhrYDlwR9L9ytf38ZY=";
      sourceRoot = "mercurial-${version}/rust";
    } else null;
    cargoRoot = if rustSupport then "rust" else null;
@ -157,9 +157,9 @@ let
    # https://bz.mercurial-scm.org/show_bug.cgi?id=6727
    test-patchbomb-tls.t

-    # Test broken with recent versions of git due to default policy change
-    # https://foss.heptapod.net/mercurial/mercurial-devel/-/merge_requests/302
-    test-convert-git.t
+    # Test wanting TLS 1.0 and 1.1, not available with OpenSSL v3.
+    # https://bz.mercurial-scm.org/show_bug.cgi?id=6760
+    test-https.t
    EOF

    export HGTEST_REAL_HG="${mercurial}/bin/hg"
--- a/pkgs/applications/video/mythtv/default.nix
+++ b/pkgs/applications/video/mythtv/default.nix
@ -1,32 +1,41 @@
-{ lib, mkDerivation, fetchFromGitHub, which, qtbase, qtwebkit, qtscript, xlibsWrapper
+{ lib, mkDerivation, fetchFromGitHub, fetchpatch, which, qtbase, qtwebkit, qtscript, xlibsWrapper
 , libpulseaudio, fftwSinglePrec , lame, zlib, libGLU, libGL, alsa-lib, freetype
 , perl, pkg-config , libsamplerate, libbluray, lzo, libX11, libXv, libXrandr, libXvMC, libXinerama, libXxf86vm
-, libXmu , yasm, libuuid, taglib, libtool, autoconf, automake, file, exiv2, linuxHeaders
+, libXmu , yasm, libuuid, taglib, libtool, autoconf, automake, file, exiv2, linuxHeaders, soundtouch, libzip
+, withWebKit ? false
 }:

 mkDerivation rec {
  pname = "mythtv";
-  version = "31.0";
+  version = "32.0";

  src = fetchFromGitHub {
    owner = "MythTV";
    repo = "mythtv";
    rev = "v${version}";
-    sha256 = "092w5kvc1gjz6jd2lk2jhcazasz2h3xh0i5iq80k8x3znyp4i6v5";
+    sha256 = "0i4fs3rbk1jggh62wflpa2l03na9i1ihpz2vsdic9vfahqqjxff1";
  };

  patches = [
-    # Disables OS detection used while checking if enforce_wshadow should be disabled.
-    ./disable-os-detection.patch
+    # Disable sourcing /etc/os-release
+    ./dont-source-os-release.patch
+
+    # Fix QMake variable substitution syntax - MythTV/mythtv#550
+    (fetchpatch {
+      name = "fix-qmake-var-syntax.patch";
+      url = "https://github.com/MythTV/mythtv/commit/a8da7f7e7ec069164adbef65a8104adc9bb52e36.patch";
+      stripLen = 1;
+      hash = "sha256-JfRME00YNNjl6SKs1HBa0wBa/lR/Rt3zbQtWhsC36JM=";
+    })
  ];

  setSourceRoot = "sourceRoot=$(echo */mythtv)";

  buildInputs = [
-    freetype qtbase qtwebkit qtscript lame zlib xlibsWrapper libGLU libGL
+    freetype qtbase qtscript lame zlib xlibsWrapper libGLU libGL
    perl libsamplerate libbluray lzo alsa-lib libpulseaudio fftwSinglePrec libX11 libXv libXrandr libXvMC
-    libXmu libXinerama libXxf86vm libXmu libuuid taglib exiv2
-  ];
+    libXmu libXinerama libXxf86vm libXmu libuuid taglib exiv2 soundtouch libzip
+  ] ++ lib.optional withWebKit qtwebkit;
  nativeBuildInputs = [ pkg-config which yasm libtool autoconf automake file ];

  configureFlags =
--- a/pkgs/applications/video/mythtv/disable-os-detection.patch
+++ b/pkgs/applications/video/mythtv/disable-os-detection.patch
@ -1,31 +0,0 @@
--- a/configure	2020-07-21 20:50:58.653989766 +0200
-+++ b/configure	2020-07-21 20:52:21.236610586 +0200
-@@ -6537,17 +6537,17 @@
-                 }
- 
- enable enforce_wshadow
-case $target_os in
-    android)
-        disable enforce_wshadow
-        ;;
-    linux)
-        . /etc/os-release
-        if test $ID = "centos"; then
-            disable enforce_wshadow
-        fi
-        ;;
-esac
-+#case $target_os in
-+#    android)
-+#        disable enforce_wshadow
-+#        ;;
-+#    linux)
-+#        . /etc/os-release
-+#        if test $ID = "centos"; then
-+#            disable enforce_wshadow
-+#        fi
-+#        ;;
-+#esac
- 
- if $(pkg-config --exists Qt5WebKit) || $(pkg-config --exists QtWebKit) ; then
-     enable qtwebkit
--- a/pkgs/applications/video/mythtv/dont-source-os-release.patch
+++ b/pkgs/applications/video/mythtv/dont-source-os-release.patch
@ -0,0 +1,15 @@
+--- a/configure
+++ b/configure
+@@ -5894,9 +5894,9 @@ else
+     die "ERROR: cannot find soundtouch 1.8.0 or later."
+ fi
+ 
+-if [ $target_os = "linux" ] ; then
+-    . /etc/os-release
+-fi
+# if [ $target_os = "linux" ] ; then
+#     . /etc/os-release
+# fi
+ 
+ # libudfread
+ if enabled system_libudfread ; then
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "docker-compose";
-  version = "2.12.2";
+  version = "2.13.0";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "compose";
    rev = "v${version}";
-    sha256 = "sha256-QyxWoq3hGFLm27tba5BL3xcnNCOAmY+rbGBtwREZPJA=";
+    sha256 = "sha256-m0lDnVu6T8P1di8DeQYAKBA6Y+4iSqmc0nE3iBHY5+M=";
  };

  postPatch = ''
@ -16,7 +16,7 @@ buildGoModule rec {
    rm -rf e2e/
  '';

-  vendorSha256 = "sha256-QlzneikTMBUpKJiyVrN+A6CctsVvdoTOOMDjJqIF3a8=";
+  vendorSha256 = "sha256-xigDihg2SvvcFSrKYlo5VluqhqK9xzWVbrsBvsJsLXA=";

  ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];

--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "nixpacks";
-  version = "0.14.0";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-az4DllTkGP80Jf0NeaKrBI0zz56chPizJGu97cqXrJ4=";
+    sha256 = "sha256-c1AqqbeBKXfXUKgalbo5OXc0oVyQyntqwmpB0AFlwRs=";
  };

-  cargoSha256 = "sha256-ghbJBhoU41yJ3qZBaKzEybNuCLdSqoL30+1h9d56b4A=";
+  cargoSha256 = "sha256-SybFjc1oyfJpen+KH2xj/u3i1S5SLiprwkUPp9IpMfc=";

  # skip test due FHS dependency
  doCheck = false;
--- a/pkgs/applications/window-managers/picom/default.nix
+++ b/pkgs/applications/window-managers/picom/default.nix
@ -32,13 +32,13 @@

 stdenv.mkDerivation rec {
  pname = "picom";
-  version = "10";
+  version = "10.1";

  src = fetchFromGitHub {
    owner = "yshui";
    repo = "picom";
    rev = "v${version}";
-    sha256 = "sha256-ACQBgAYtJ4OOQIismNYJB3z426GmlyUtXXbH06eRsgg=";
+    hash = "sha256-EYNLLAz7CkbVGv2XMT+73RR58HzxG+Gy7b5x1qahAgo=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/window-managers/sway/lock.nix
+++ b/pkgs/applications/window-managers/sway/lock.nix
@ -5,24 +5,15 @@

 stdenv.mkDerivation rec {
  pname = "swaylock";
-  version = "1.6";
+  version = "1.7";

  src = fetchFromGitHub {
    owner = "swaywm";
    repo = "swaylock";
    rev = version;
-    sha256 = "sha256-VVGgidmSQWKxZNx9Cd6z52apxpxVfmX3Ut/G9kzfDcY=";
+    hash = "sha256-xbcVsnE0DecC+g49NOBNpqPl5JTtuxUUc7KinKhi5TE=";
  };

-  patches = [
-    # remove once when updating to 1.7
-    # https://github.com/swaywm/swaylock/pull/235
-    (fetchpatch {
-      url = "https://github.com/swaywm/swaylock/commit/5a1e6ad79aa7d79b32d36cda39400f3e889b8f8f.diff";
-      sha256 = "sha256-ZcZVImUzvng7sluC6q2B5UL8sVunLe4PIfc+tyw48RQ=";
-    })
-  ];
-
  strictDeps = true;
  depsBuildBuild = [ pkg-config ];
  nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-scanner ];
--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@ -61,6 +61,14 @@ rec {
    (args // {
      inherit name extraPkgs;
      src = extract { inherit name src; };
+
+      # passthru src to make nix-update work
+      # hack to keep the origin position (unsafeGetAttrPos)
+      passthru = lib.pipe args [
+        lib.attrNames
+        (lib.remove "src")
+        (removeAttrs args)
+      ] // args.passthru or { };
    });

  defaultFhsEnvArgs = {
@ -71,7 +79,6 @@ rec {
      gtk3
      bashInteractive
      gnome.zenity
-      python2
      xorg.xrandr
      which
      perl
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -19,7 +19,6 @@
 , pigz
 , rsync
 , runCommand
-, runCommandNoCC
 , runtimeShell
 , shadow
 , skopeo
--- a/pkgs/build-support/fetchurl/tests.nix
+++ b/pkgs/build-support/fetchurl/tests.nix
@ -1,8 +1,8 @@
-{ invalidateFetcherByDrvHash, fetchurl, jq, moreutils, ... }: {
+{ testers, fetchurl, jq, moreutils, ... }: {
  # Tests that we can send custom headers with spaces in them
  header =
    let headerValue = "Test '\" <- These are some quotes";
-    in invalidateFetcherByDrvHash fetchurl {
+    in testers.invalidateFetcherByDrvHash fetchurl {
      url = "https://httpbin.org/headers";
      sha256 = builtins.hashString "sha256" (headerValue + "\n");
      curlOptsList = [ "-H" "Hello: ${headerValue}" ];
--- a/pkgs/data/fonts/tlwg/default.nix
+++ b/pkgs/data/fonts/tlwg/default.nix
@ -1,22 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, fontforge }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, autoconf-archive, fontforge }:

 stdenv.mkDerivation rec {
  pname = "tlwg";
-  version = "0.6.4";
+  version = "0.7.3";

  src = fetchFromGitHub {
    owner = "tlwg";
    repo = "fonts-tlwg";
    rev = "v${version}";
-    sha256 = "13bx98ygyyizb15ybdv3856lkxhx1fss8f7aiqmp0lk9zgw4mqyk";
+    sha256 = "hWiH5KJnYTdcrm+Kzn9HUQry8ry3SKzjA6/0536kCLQ=";
  };

-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook autoconf-archive ];

  buildInputs = [ fontforge ];

-  preAutoreconf = "echo ${version} > VERSION";
-
  meta = with lib; {
    description = "A collection of Thai scalable fonts available under free licenses";
    homepage = "https://linux.thai.net/projects/fonts-tlwg";
--- a/pkgs/data/icons/tela-circle-icon-theme/default.nix
+++ b/pkgs/data/icons/tela-circle-icon-theme/default.nix
@ -2,7 +2,7 @@
 , stdenvNoCC
 , fetchFromGitHub
 , adwaita-icon-theme
-, breeze-icons
+, libsForQt5
 , gtk3
 , hicolor-icon-theme
 , jdupes
@ -35,7 +35,7 @@ stdenvNoCC.mkDerivation rec {

  propagatedBuildInputs = [
    adwaita-icon-theme
-    breeze-icons
+    libsForQt5.breeze-icons
    hicolor-icon-theme
  ];

--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "v2ray-geoip";
-  version = "202211170054";
+  version = "202211240054";

  src = fetchFromGitHub {
    owner = "v2fly";
    repo = "geoip";
-    rev = "e01c82114de0b2f3a2e8c80c78fc22e8fb71f68a";
-    sha256 = "sha256-T94G1s3vTkh0pd2ByOpOwJDPn7geaHbnBB7w1K9qwps=";
+    rev = "1887d855ed4b4b92999d3afecf71f43358029369";
+    sha256 = "sha256-WozqLA/akUF7T0LyR/nQkTxuZPNCpYarOQG5zQwGAMk=";
  };

  installPhase = ''
--- a/pkgs/development/compilers/llvm/rocm/llvm.nix
+++ b/pkgs/development/compilers/llvm/rocm/llvm.nix
@ -41,7 +41,7 @@ in stdenv.mkDerivation (finalAttrs: {
    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON" # Needed by rustc
    "-DLLVM_TARGETS_TO_BUILD=AMDGPU;${llvmNativeTarget}"
-    "-DLLVM_ENABLE_PROJECTS=clang;lld;compiler-rt"
+    "-DLLVM_ENABLE_PROJECTS=clang;lld;compiler-rt;clang-tools-extra"
  ]
  ++ lib.optionals enableManpages [
    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
--- a/pkgs/development/compilers/rgbds/default.nix
+++ b/pkgs/development/compilers/rgbds/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "rgbds";
-  version = "0.5.2";
+  version = "0.6.0";
  src = fetchFromGitHub {
    owner = "gbdev";
    repo = "rgbds";
    rev = "v${version}";
-    sha256 = "sha256-/GjxdB3Nt+XuKKQWjU12mS91U4FFoeP+9t0L+HsB/o8=";
+    sha256 = "sha256-2nyjI6z6W959/Yc8EwdQVmGnG0PKwsndPLmeDlNpj18=";
  };
  nativeBuildInputs = [ bison flex pkg-config ];
  buildInputs = [ libpng ];
--- a/pkgs/development/interpreters/php/8.0.nix
+++ b/pkgs/development/interpreters/php/8.0.nix
@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "8.0.25";
-    hash = "sha256-CdcWvOtbPbdtkCOxDBaB674EDlH0wY39Nfn/i3O7z4w=";
+    version = "8.0.26";
+    hash = "sha256-bfh6+W8nWnWIns5uP+ShOr2Tp2epmShjvcDpDx6Ifuc=";
  });

 in
--- a/pkgs/development/interpreters/php/8.1.nix
+++ b/pkgs/development/interpreters/php/8.1.nix
@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "8.1.12";
-    hash = "sha256-+H1z6Rf6z3jee83lP8L6pNTb4Eh6lAbhq2jIro8z6wM=";
+    version = "8.1.13";
+    hash = "sha256-k/z9+qo9CUoP2xjOCNIPINUm7j8HoUaoqOyCzgCyN8o=";
  });

 in
--- a/pkgs/development/interpreters/php/8.2.nix
+++ b/pkgs/development/interpreters/php/8.2.nix
@ -1,13 +1,13 @@
 { callPackage, lib, stdenv, fetchurl, ... }@_args:

 let
-  hash = "sha256-sbT8sIwle3OugXxqLZO3jKXlrOQsX1iH7WRH8G+nv8Y=";
+  hash = "sha256-MSBENMUl+F5k9manZvYjRDY3YWsYToZSQU9hmhJ8Xvc=";

  base = callPackage ./generic.nix (_args // {
    version = "8.2.0";
    phpAttrsOverrides = attrs: attrs // {
      src = fetchurl {
-        url = "https://downloads.php.net/~sergey/php-8.2.0RC6.tar.xz";
+        url = "https://downloads.php.net/~pierrick/php-8.2.0RC7.tar.xz";
        inherit hash;
      };
    };
--- a/pkgs/development/libraries/audio/lvtk/default.nix
+++ b/pkgs/development/libraries/audio/lvtk/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, boost, gtkmm2, lv2, pkg-config, python2, wafHook }:
+{ lib, stdenv, fetchFromGitHub, boost, gtkmm2, lv2, pkg-config, python3, wafHook }:

 stdenv.mkDerivation rec {
  pname = "lvtk";
@ -11,14 +11,20 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-6IoyhBig3Nvc4Y8F0w8b1up6sn8O2RmoUVaBQ//+Aaw=";
  };

-  nativeBuildInputs = [ pkg-config python2 wafHook ];
+  nativeBuildInputs = [ pkg-config python3 wafHook ];
  buildInputs = [ boost gtkmm2 lv2 ];

  enableParallelBuilding = true;

-  # Fix including the boost libraries during linking
  postPatch = ''
+    # Fix including the boost libraries during linking
    sed -i '/target[ ]*= "ttl2c"/ ilib=["boost_system"],' tools/wscript_build
+
+    # don't use bundled waf
+    rm waf
+
+    # remove (useless) python2 based print
+    sed -e '/print/d' -i wscript
  '';

  wafConfigureFlags = [
--- a/pkgs/development/libraries/drogon/default.nix
+++ b/pkgs/development/libraries/drogon/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "drogon";
-  version = "1.8.1";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "drogonframework";
    repo = "drogon";
    rev = "v${version}";
-    sha256 = "sha256-XzSJABYuZaYlNL12bi0ykQ1OyNsvB1AQiSTBPWiTNYU=";
+    sha256 = "sha256-IpECYpPuheoLelEdgV+J26b+95fMfRmeQ44q6JvqRtw=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@ -154,7 +154,7 @@
 *  Darwin frameworks
 */
 , Cocoa, CoreAudio, CoreServices, AVFoundation, MediaToolbox
-, VideoDecodeAcceleration
+, VideoDecodeAcceleration, VideoToolbox
 }:

 /* Maintainer notes:
@ -454,7 +454,7 @@ stdenv.mkDerivation rec {
    ++ optional (nvdec || nvenc) nv-codec-headers
    ++ optional cuda-llvm clang
    ++ optionals stdenv.isDarwin [ Cocoa CoreServices CoreAudio AVFoundation
-                                   MediaToolbox VideoDecodeAcceleration
+                                   MediaToolbox VideoDecodeAcceleration VideoToolbox
                                   libiconv ];

  buildFlags = [ "all" ]
--- a/pkgs/development/libraries/gjs/default.nix
+++ b/pkgs/development/libraries/gjs/default.nix
@ -79,7 +79,7 @@ in stdenv.mkDerivation rec {

  mesonFlags = [
    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
-  ] ++ lib.optionals (!stdenv.isLinux) [
+  ] ++ lib.optionals (!stdenv.isLinux || stdenv.hostPlatform.isMusl) [
    "-Dprofiler=disabled"
  ];

@ -88,6 +88,9 @@ in stdenv.mkDerivation rec {
  postPatch = ''
    patchShebangs build/choose-tests-locale.sh
    substituteInPlace installed-tests/debugger-test.sh --subst-var-by gjsConsole $out/bin/gjs-console
+  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+    substituteInPlace installed-tests/js/meson.build \
+      --replace "'Encoding'," "#'Encoding',"
  '';

  preCheck = ''
--- a/pkgs/development/libraries/hipsparse/default.nix
+++ b/pkgs/development/libraries/hipsparse/default.nix
@ -11,22 +11,14 @@
 , hip
 , gfortran
 , git
-, fetchzip ? null
 , gtest ? null
 , buildTests ? false
 }:

-assert buildTests -> fetchzip != null;
 assert buildTests -> gtest != null;

 # This can also use cuSPARSE as a backend instead of rocSPARSE
-let
-  matrices = lib.optionalAttrs buildTests import ./deps.nix {
-    inherit fetchzip;
-    mirror1 = "https://sparse.tamu.edu/MM";
-    mirror2 = "https://www.cise.ufl.edu/research/sparse/MM";
-  };
-in stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "hipsparse";
  repoVersion = "2.3.1";
  rocmVersion = "5.3.3";
@ -81,25 +73,25 @@ in stdenv.mkDerivation (finalAttrs: {
  '' + lib.optionalString buildTests ''
    mkdir -p matrices

-    ln -s ${matrices.matrix-01}/*.mtx matrices
-    ln -s ${matrices.matrix-02}/*.mtx matrices
-    ln -s ${matrices.matrix-03}/*.mtx matrices
-    ln -s ${matrices.matrix-04}/*.mtx matrices
-    ln -s ${matrices.matrix-05}/*.mtx matrices
-    ln -s ${matrices.matrix-06}/*.mtx matrices
-    ln -s ${matrices.matrix-07}/*.mtx matrices
-    ln -s ${matrices.matrix-08}/*.mtx matrices
-    ln -s ${matrices.matrix-09}/*.mtx matrices
-    ln -s ${matrices.matrix-10}/*.mtx matrices
-    ln -s ${matrices.matrix-11}/*.mtx matrices
-    ln -s ${matrices.matrix-12}/*.mtx matrices
-    ln -s ${matrices.matrix-13}/*.mtx matrices
-    ln -s ${matrices.matrix-14}/*.mtx matrices
-    ln -s ${matrices.matrix-15}/*.mtx matrices
-    ln -s ${matrices.matrix-16}/*.mtx matrices
-    ln -s ${matrices.matrix-17}/*.mtx matrices
-    ln -s ${matrices.matrix-18}/*.mtx matrices
-    ln -s ${matrices.matrix-19}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-01}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-02}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-03}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-04}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-05}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-06}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-07}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-08}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-09}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-10}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-11}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-12}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-13}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-14}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-15}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-16}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-17}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-18}/*.mtx matrices
+    ln -s ${rocsparse.passthru.matrices.matrix-19}/*.mtx matrices

    # Not used by the original cmake, causes an error
    rm matrices/*_b.mtx
--- a/pkgs/development/libraries/hipsparse/deps.nix
+++ b/pkgs/development/libraries/hipsparse/deps.nix
@ -1,177 +0,0 @@
-{ fetchzip
-, mirror1
-, mirror2
-}:
-
-{
-  matrix-01 = fetchzip {
-    sha256 = "sha256-AHur5ZIDZTFRrO2GV0ieXrffq4KUiGWiZ59pv0fUtEQ=";
-
-    urls = [
-      "${mirror1}/SNAP/amazon0312.tar.gz"
-      "${mirror2}/SNAP/amazon0312.tar.gz"
-    ];
-  };
-
-  matrix-02 = fetchzip {
-    sha256 = "sha256-0rSxaN4lQcdaCLsvlgicG70FXUxXeERPiEmQ4MzbRdE=";
-
-    urls = [
-      "${mirror1}/Muite/Chebyshev4.tar.gz"
-      "${mirror2}/Muite/Chebyshev4.tar.gz"
-    ];
-  };
-
-  matrix-03 = fetchzip {
-    sha256 = "sha256-hDzDWDUnHEyFedX/tMNq83ZH8uWyM4xtZYUUAD3rizo=";
-
-    urls = [
-      "${mirror1}/FEMLAB/sme3Dc.tar.gz"
-      "${mirror2}/FEMLAB/sme3Dc.tar.gz"
-    ];
-  };
-
-  matrix-04 = fetchzip {
-    sha256 = "sha256-GmN2yOt/MoX01rKe05aTyB3ypUP4YbQGOITZ0BqPmC0=";
-
-    urls = [
-      "${mirror1}/Williams/webbase-1M.tar.gz"
-      "${mirror2}/Williams/webbase-1M.tar.gz"
-    ];
-  };
-
-  matrix-05 = fetchzip {
-    sha256 = "sha256-gQNjfVyWzNM9RwImJGhkhahRmZz74LzDs1oijL7mI7k=";
-
-    urls = [
-      "${mirror1}/Williams/mac_econ_fwd500.tar.gz"
-      "${mirror2}/Williams/mac_econ_fwd500.tar.gz"
-    ];
-  };
-
-  matrix-06 = fetchzip {
-    sha256 = "sha256-87cdZjntNcTuz5BtO59irhcuRbPllWSbhCEX3Td02qc=";
-
-    urls = [
-      "${mirror1}/Williams/mc2depi.tar.gz"
-      "${mirror2}/Williams/mc2depi.tar.gz"
-    ];
-  };
-
-  matrix-07 = fetchzip {
-    sha256 = "sha256-WRamuJX3D8Tm+k0q67RjUDG3DeNAxhKiaPkk5afY5eU=";
-
-    urls = [
-      "${mirror1}/Bova/rma10.tar.gz"
-      "${mirror2}/Bova/rma10.tar.gz"
-    ];
-  };
-
-  matrix-08 = fetchzip {
-    sha256 = "sha256-5dhkm293Mc3lzakKxHy5W5XIn4Rw+gihVh7gyrjEHXo=";
-
-    urls = [
-      "${mirror1}/JGD_BIBD/bibd_22_8.tar.gz"
-      "${mirror2}/JGD_BIBD/bibd_22_8.tar.gz"
-    ];
-  };
-
-  matrix-09 = fetchzip {
-    sha256 = "sha256-czjLWCjXAjZCk5TGYHaEkwSAzQu3TQ3QyB6eNKR4G88=";
-
-    urls = [
-      "${mirror1}/Hamm/scircuit.tar.gz"
-      "${mirror2}/Hamm/scircuit.tar.gz"
-    ];
-  };
-
-  matrix-10 = fetchzip {
-    sha256 = "sha256-bYuLnJViAIcIejAkh69/bsNAVIDU4wfTLtD+nmHd6FM=";
-
-    urls = [
-      "${mirror1}/Sandia/ASIC_320k.tar.gz"
-      "${mirror2}/Sandia/ASIC_320k.tar.gz"
-    ];
-  };
-
-  matrix-11 = fetchzip {
-    sha256 = "sha256-aDwn8P1khYjo2Agbq5m9ZBInJUxf/knJNvyptt0fak0=";
-
-    urls = [
-      "${mirror1}/GHS_psdef/bmwcra_1.tar.gz"
-      "${mirror2}/GHS_psdef/bmwcra_1.tar.gz"
-    ];
-  };
-
-  matrix-12 = fetchzip {
-    sha256 = "sha256-8OJqA/byhlAZd869TPUzZFdsOiwOoRGfKyhM+RMjXoY=";
-
-    urls = [
-      "${mirror1}/HB/nos1.tar.gz"
-      "${mirror2}/HB/nos1.tar.gz"
-    ];
-  };
-
-  matrix-13 = fetchzip {
-    sha256 = "sha256-FS0rKqmg+uHwsM/yGfQLBdd7LH/rUrdutkNGBD/Mh1I=";
-
-    urls = [
-      "${mirror1}/HB/nos2.tar.gz"
-      "${mirror2}/HB/nos2.tar.gz"
-    ];
-  };
-
-  matrix-14 = fetchzip {
-    sha256 = "sha256-DANnlrNJikrI7Pst9vRedtbuxepyHmCIu2yhltc4Qcs=";
-
-    urls = [
-      "${mirror1}/HB/nos3.tar.gz"
-      "${mirror2}/HB/nos3.tar.gz"
-    ];
-  };
-
-  matrix-15 = fetchzip {
-    sha256 = "sha256-21mUgqjWGUfYgiWwSrKh9vH8Vdt3xzcefmqYNYRpxiY=";
-
-    urls = [
-      "${mirror1}/HB/nos4.tar.gz"
-      "${mirror2}/HB/nos4.tar.gz"
-    ];
-  };
-
-  matrix-16 = fetchzip {
-    sha256 = "sha256-FOuXvGqBBFNkVS6cexmkluret54hCfCOdK+DOZllE4c=";
-
-    urls = [
-      "${mirror1}/HB/nos5.tar.gz"
-      "${mirror2}/HB/nos5.tar.gz"
-    ];
-  };
-
-  matrix-17 = fetchzip {
-    sha256 = "sha256-+7NI1rA/qQxYPpjXKHvAaCZ+LSaAJ4xuJvMRMBEUYxg=";
-
-    urls = [
-      "${mirror1}/HB/nos6.tar.gz"
-      "${mirror2}/HB/nos6.tar.gz"
-    ];
-  };
-
-  matrix-18 = fetchzip {
-    sha256 = "sha256-q3NxJjbwGGcFiQ9nhWfUKgZmdVwCfPmgQoqy0AqOsNc=";
-
-    urls = [
-      "${mirror1}/HB/nos7.tar.gz"
-      "${mirror2}/HB/nos7.tar.gz"
-    ];
-  };
-
-  matrix-19 = fetchzip {
-    sha256 = "sha256-0GAN6qmVfD+tprIigzuUUUwm5KVhkN9X65wMEvFltDY=";
-
-    urls = [
-      "${mirror1}/DNVS/shipsec1.tar.gz"
-      "${mirror2}/DNVS/shipsec1.tar.gz"
-    ];
-  };
-}
--- a/pkgs/development/libraries/hotpatch/default.nix
+++ b/pkgs/development/libraries/hotpatch/default.nix
@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
    LD_LIBRARY_PATH=$(pwd)/src make test
  '';

+  patches = [ ./no-loader-test.patch ];
+
  meta = with lib; {
    description = "Hot patching executables on Linux using .so file injection";
    homepage = src.meta.homepage;
--- a/pkgs/development/libraries/hotpatch/no-loader-test.patch
+++ b/pkgs/development/libraries/hotpatch/no-loader-test.patch
@ -0,0 +1,25 @@
+diff --git a/test/loader.c b/test/loader.c
+index 4e3dfdc..7f98d94 100644
+--- a/test/loader.c
+++ b/test/loader.c
+@@ -54,20 +54,6 @@ int main(int argc, char **argv)
+ 	assert(ret < 0);
+ 	ret = ld_find_library(maps, mapnum, "libc", false, NULL, 6);
+ 	assert(ret >= 0);
+-#if __WORDSIZE == 64
+-	ret = ld_find_library(maps, mapnum, "/lib64/ld-linux-x86-64.so.2",
+-						  true, NULL, 6);
+-	assert(ret >= 0);
+-	ret = ld_find_library(maps, mapnum, "/lib/ld-linux-x86-64.so.2",
+-						  false, NULL, 6);
+-#else
+-	ret = ld_find_library(maps, mapnum, "/lib/ld-linux.so.2",
+-						  true, NULL, 6);
+-	assert(ret >= 0);
+-	ret = ld_find_library(maps, mapnum, "/lib32/ld-linux.so.2",
+-						  false, NULL, 6);
+-#endif
+-	assert(ret < 0);
+ 	ld_free_maps(maps, mapnum);
+     return 0;
+ }
--- a/pkgs/development/libraries/java/commons/bcel/default.nix
+++ b/pkgs/development/libraries/java/commons/bcel/default.nix
@ -1,18 +1,18 @@
 {lib, stdenv, fetchurl}:

 stdenv.mkDerivation rec {
-  version = "5.2";
+  version = "6.6.1";
  pname = "commons-bcel";

  src = fetchurl {
-    url    = "mirror://apache/commons/bcel/binaries/bcel-${version}.tar.gz";
-    sha256 = "13ppnd6afljdjq21jpn4ik2h1yxq8k2kg21ghi0lyb1yap1rd7k6";
+    url    = "mirror://apache/commons/bcel/binaries/bcel-${version}-bin.tar.gz";
+    sha256 = "sha256-bwbERZqnmXD2LzGilDZYsr7BPQoTeZDwDU/8/AjAdP4=";
  };

  installPhase = ''
    tar xf ${src}
    mkdir -p $out/share/java
-    cp bcel-5.2.jar $out/share/java/
+    cp bcel-${version}.jar $out/share/java/
  '';

  meta = {
--- a/pkgs/development/libraries/libcdio/default.nix
+++ b/pkgs/development/libraries/libcdio/default.nix
@ -17,6 +17,13 @@ stdenv.mkDerivation rec {
      url = "https://savannah.gnu.org/patch/download.php?file_id=52179";
      sha256 = "1v15gxhpi4bgcr12pb3d9c3hiwj0drvc832vic7sham34lhjmcbb";
    })
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    (fetchpatch {
+      name = "musl-realpath-test.patch";
+      url = "https://git.alpinelinux.org/aports/plain/community/libcdio/disable-broken-test.patch?id=058a8695c12ae13b40c981ee98809352490b6155";
+      includes = [ "test/driver/realpath.c" ];
+      sha256 = "sha256-6j2bjMed2l+TFZ5emjCcozzF/kkGA8FVifJB8U7QceU=";
+    })
  ];

  postPatch = ''
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "libdeltachat";
-  version = "1.101.0";
+  version = "1.102.0";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-core-rust";
    rev = version;
-    hash = "sha256-EhFxun80s5tNZT4d7vbszTfHbYK9X3PohsQl20wRzlg=";
+    hash = "sha256-xw/lUNs39nkBrydpcgUBL3j6XrZFafKslxx6zUiElWw=";
  };

  patches = [
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-8uu4i4WfW9pmdLAWWUU1QP09B1/ws+DeVf8baYfikw4=";
+    hash = "sha256-CiqYKFABHcFSjYUH/qop1xWCoygQJajI7nhv04ElD10=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libeatmydata/default.nix
+++ b/pkgs/development/libraries/libeatmydata/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, strace, which }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, strace, which }:

 stdenv.mkDerivation rec {
  pname = "libeatmydata";
@ -11,7 +11,16 @@ stdenv.mkDerivation rec {
    sha256 = "0sx803h46i81h67xbpd3c7ky0nhaw4gij214nsx4lqig70223v9r";
  };

-  patches = [ ./find-shell-lib.patch ];
+  patches = [
+    ./find-shell-lib.patch
+
+    # Fixes "error: redefinition of 'open'" on musl
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/861ac185a6b60134292ff93d40e40b5391d0aa8e/srcpkgs/libeatmydata/patches/musl.patch";
+      stripLen = 1;
+      sha256 = "sha256-yfMfISbYL7r/R2C9hYPjvGcpUB553QSiW0rMrxG11Oo=";
+    })
+  ];

  patchFlags = [ "-p0" ];

--- a/pkgs/development/libraries/miopen/default.nix
+++ b/pkgs/development/libraries/miopen/default.nix
@ -0,0 +1,215 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, writeScript
+, pkg-config
+, cmake
+, rocm-cmake
+, rocm-runtime
+, rocm-device-libs
+, rocm-comgr
+, rocm-opencl-runtime
+, rocblas
+, rocmlir
+, hip
+, clang
+, clang-ocl
+, llvm
+, miopengemm
+, composable_kernel
+, half
+, boost
+, sqlite
+, bzip2
+, texlive ? null
+, doxygen ? null
+, sphinx ? null
+, python3Packages ? null
+, zlib ? null
+, fetchurl ? null
+, buildDocs ? false
+, buildTests ? false
+# LFS isn't working, so we will manually fetch these
+# This isn't strictly required, but is recommended
+# https://github.com/ROCmSoftwarePlatform/MIOpen/issues/1373
+, fetchKDBs ? true
+, useOpenCL ? false
+}:
+
+assert buildDocs -> texlive != null;
+assert buildDocs -> doxygen != null;
+assert buildDocs -> sphinx != null;
+assert buildDocs -> python3Packages != null;
+assert buildTests -> zlib != null;
+assert fetchKDBs -> fetchurl != null;
+
+let
+  latex = lib.optionalAttrs buildDocs (texlive.combine {
+    inherit (texlive) scheme-small
+    latexmk
+    tex-gyre
+    fncychap
+    wrapfig
+    capt-of
+    framed
+    needspace
+    tabulary
+    varwidth
+    titlesec;
+  });
+
+  kdbs = lib.optionalAttrs fetchKDBs import ./deps.nix {
+    inherit fetchurl;
+    mirror = "https://repo.radeon.com/rocm/miopen-kernel/rel-5.0";
+  };
+in stdenv.mkDerivation (finalAttrs: {
+  pname = "miopen";
+  # We have to manually specify the repoVersion for now
+  # Find the github release or `-- MIOpen_VERSION= X.X.X` in the build log
+  repoVersion = "2.18.0";
+  rocmVersion = "5.3.3";
+  version = "${finalAttrs.repoVersion}-${finalAttrs.rocmVersion}";
+
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildDocs [
+    "doc"
+  ] ++ lib.optionals buildTests [
+    "test"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "ROCmSoftwarePlatform";
+    repo = "MIOpen";
+    rev = "rocm-${finalAttrs.rocmVersion}";
+    hash = "sha256-5/JitdGJ0afzK4pGOOywRLsB3/Thc6/71sRkKIxf2Lg=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    rocm-cmake
+    hip
+    clang
+    llvm
+  ];
+
+  buildInputs = [
+    rocm-runtime
+    rocm-device-libs
+    rocm-comgr
+    rocm-opencl-runtime
+    rocblas
+    rocmlir
+    clang-ocl
+    miopengemm
+    composable_kernel
+    half
+    boost
+    sqlite
+    bzip2
+  ] ++ lib.optionals buildDocs [
+    latex
+    doxygen
+    sphinx
+    python3Packages.sphinx_rtd_theme
+    python3Packages.breathe
+    python3Packages.myst-parser
+  ] ++ lib.optionals buildTests [
+    zlib
+  ];
+
+  cmakeFlags = [
+    "-DMIOPEN_USE_MIOPENGEMM=ON"
+    # Manually define CMAKE_INSTALL_<DIR>
+    # See: https://github.com/NixOS/nixpkgs/pull/197838
+    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ] ++ lib.optionals (!useOpenCL) [
+    "-DCMAKE_C_COMPILER=hipcc"
+    "-DCMAKE_CXX_COMPILER=hipcc"
+    "-DMIOPEN_BACKEND=HIP"
+  ] ++ lib.optionals useOpenCL [
+    "-DCMAKE_C_COMPILER=${clang}/bin/clang"
+    "-DCMAKE_CXX_COMPILER=${clang}/bin/clang++"
+    "-DMIOPEN_BACKEND=OpenCL"
+  ] ++ lib.optionals buildTests [
+    "-DBUILD_TESTS=ON"
+    "-DMIOPEN_TEST_ALL=ON"
+    "-DMIOPEN_TEST_GFX900=ON"
+    "-DMIOPEN_TEST_GFX906=ON"
+    "-DMIOPEN_TEST_GFX908=ON"
+    "-DMIOPEN_TEST_GFX90A=ON"
+    "-DMIOPEN_TEST_GFX103X=ON"
+  ];
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace "enable_testing()" "" \
+      --replace "MIOPEN_HIP_COMPILER MATCHES \".*clang\\\\+\\\\+$\"" "true" \
+      --replace "/opt/rocm/hip" "${hip}" \
+      --replace "/opt/rocm/llvm" "${llvm}" \
+      --replace "3 REQUIRED PATHS /opt/rocm)" "3 REQUIRED PATHS ${hip})" \
+      --replace "hip REQUIRED PATHS /opt/rocm" "hip REQUIRED PATHS ${hip}" \
+      --replace "rocblas REQUIRED PATHS /opt/rocm" "rocblas REQUIRED PATHS ${rocblas}" \
+      --replace "miopengemm PATHS /opt/rocm" "miopengemm PATHS ${miopengemm}" \
+      --replace "set(MIOPEN_TIDY_ERRORS ALL)" "" # Fix clang-tidy at some point
+  '' + lib.optionalString (!buildTests) ''
+    substituteInPlace CMakeLists.txt \
+      --replace "add_subdirectory(test)" ""
+  '' + lib.optionalString fetchKDBs ''
+    cp -a ${kdbs.gfx1030_36} src/kernels/gfx1030_36.kdb
+    cp -a ${kdbs.gfx900_56} src/kernels/gfx900_56.kdb
+    cp -a ${kdbs.gfx900_64} src/kernels/gfx900_64.kdb
+    cp -a ${kdbs.gfx906_60} src/kernels/gfx906_60.kdb
+    cp -a ${kdbs.gfx906_64} src/kernels/gfx906_64.kdb
+    cp -a ${kdbs.gfx90878} src/kernels/gfx90878.kdb
+    cp -a ${kdbs.gfx90a68} src/kernels/gfx90a68.kdb
+    cp -a ${kdbs.gfx90a6e} src/kernels/gfx90a6e.kdb
+  '';
+
+  # Unfortunately, it seems like we have to call make on these manually
+  postBuild = lib.optionalString buildDocs ''
+    export HOME=$(mktemp -d)
+    make doc
+  '' + lib.optionalString buildTests ''
+    make -j$NIX_BUILD_CORES check
+  '';
+
+  postInstall = ''
+    rm $out/bin/install_precompiled_kernels.sh
+  '' + lib.optionalString buildTests ''
+    mkdir -p $test/bin
+    mv bin/test_* $test/bin
+    patchelf --set-rpath ${lib.makeLibraryPath (finalAttrs.nativeBuildInputs ++ finalAttrs.buildInputs)}:$out/lib $test/bin/*
+  '';
+
+  postFixup = lib.optionalString (buildDocs && !useOpenCL) ''
+    export docDir=$doc/share/doc/miopen-hip
+  '' + lib.optionalString (buildDocs && useOpenCL) ''
+    export docDir=$doc/share/doc/miopen-opencl
+  '' + lib.optionalString buildDocs ''
+    mkdir -p $docDir
+    mv ../doc/html $docDir
+    mv ../doc/pdf/miopen.pdf $docDir
+  '';
+
+  passthru.updateScript = writeScript "update.sh" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl jq common-updater-scripts
+    rocmVersion="$(curl -sL "https://api.github.com/repos/ROCmSoftwarePlatform/MIOpen/releases?per_page=1" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
+    update-source-version miopen "$rocmVersion" --ignore-same-hash --version-key=rocmVersion
+  '';
+
+  meta = with lib; {
+    description = "Machine intelligence library for ROCm";
+    homepage = "https://github.com/ROCmSoftwarePlatform/MIOpen";
+    license = with licenses; [ mit ];
+    maintainers = teams.rocm.members;
+    broken = finalAttrs.rocmVersion != hip.version;
+    # MIOpen will produce a very large output due to KDBs fetched
+    # Also possibly in the future because of KDB generation
+    hydraPlatforms = [ ];
+  };
+})
--- a/pkgs/development/libraries/miopen/deps.nix
+++ b/pkgs/development/libraries/miopen/deps.nix
@ -0,0 +1,45 @@
+{ fetchurl
+, mirror
+}:
+
+{
+  gfx1030_36 = fetchurl {
+    sha256 = "sha256-zEXDLkRWAHS15LDA5IRyqG5rO7HHPBiVgPlQ8JjSqNc=";
+    url = "${mirror}/gfx1030_36.kdb";
+  };
+
+  gfx900_56 = fetchurl {
+    sha256 = "sha256-ZTqUPhVKcQzjO6bxykvZMJk1VZh31dRVs+XqcxEtmeI=";
+    url = "${mirror}/gfx900_56.kdb";
+  };
+
+  gfx900_64 = fetchurl {
+    sha256 = "sha256-ZTqUPhVKcQzjO6bxykvZMJk1VZh31dRVs+XqcxEtmeI=";
+    url = "${mirror}/gfx900_64.kdb";
+  };
+
+  gfx906_60 = fetchurl {
+    sha256 = "sha256-U6pDo8ICfs6fVIEqRziWeE5/4Vzvu41JkcRVn3ou1e4=";
+    url = "${mirror}/gfx906_60.kdb";
+  };
+
+  gfx906_64 = fetchurl {
+    sha256 = "sha256-U6pDo8ICfs6fVIEqRziWeE5/4Vzvu41JkcRVn3ou1e4=";
+    url = "${mirror}/gfx906_64.kdb";
+  };
+
+  gfx90878 = fetchurl {
+    sha256 = "sha256-r7DRhNH+jHUXAu64b9vWsZzGD4w5oSHnxH0l2RN0qlQ=";
+    url = "${mirror}/gfx90878.kdb";
+  };
+
+  gfx90a68 = fetchurl {
+    sha256 = "sha256-NT//zIPTbzsPJyaVycxwU6BcMTzGc/d+Z4Ab9FImDko=";
+    url = "${mirror}/gfx90a68.kdb";
+  };
+
+  gfx90a6e = fetchurl {
+    sha256 = "sha256-ENZHbf+/MGYgSTpALKh2meuZPNhH5bG+WrW/jzvGpBs=";
+    url = "${mirror}/gfx90a6e.kdb";
+  };
+}
--- a/pkgs/development/libraries/rocrand/default.nix
+++ b/pkgs/development/libraries/rocrand/default.nix
@ -0,0 +1,100 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, writeScript
+, cmake
+, rocm-cmake
+, rocm-runtime
+, rocm-device-libs
+, rocm-comgr
+, hip
+, gtest ? null
+, gbenchmark ? null
+, buildTests ? false
+, buildBenchmarks ? false
+}:
+
+assert buildTests -> gtest != null;
+assert buildBenchmarks -> gbenchmark != null;
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "rocrand";
+  repoVersion = "2.10.15";
+  rocmVersion = "5.3.3";
+  version = "${finalAttrs.repoVersion}-${finalAttrs.rocmVersion}";
+
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildTests [
+    "test"
+  ] ++ lib.optionals buildBenchmarks [
+    "benchmark"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "ROCmSoftwarePlatform";
+    repo = "rocRAND";
+    rev = "rocm-${finalAttrs.rocmVersion}";
+    hash = "sha256-awQLqPmhVxegrqqSoC8fiCQJ33bPKZlljSAXnHVcIZo=";
+    fetchSubmodules = true; # For inline hipRAND
+  };
+
+  nativeBuildInputs = [
+    cmake
+    rocm-cmake
+    hip
+  ];
+
+  buildInputs = [
+    rocm-runtime
+    rocm-device-libs
+    rocm-comgr
+  ] ++ lib.optionals buildTests [
+    gtest
+  ] ++ lib.optionals buildBenchmarks [
+    gbenchmark
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_C_COMPILER=hipcc"
+    "-DCMAKE_CXX_COMPILER=hipcc"
+    "-DHIP_ROOT_DIR=${hip}"
+    # Manually define CMAKE_INSTALL_<DIR>
+    # See: https://github.com/NixOS/nixpkgs/pull/197838
+    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ] ++ lib.optionals buildTests [
+    "-DBUILD_TEST=ON"
+  ] ++ lib.optionals buildBenchmarks [
+    "-DBUILD_BENCHMARK=ON"
+  ];
+
+  postInstall = lib.optionalString buildTests ''
+    mkdir -p $test/bin
+    mv $out/bin/test_* $test/bin
+  '' + lib.optionalString buildBenchmarks ''
+    mkdir -p $benchmark/bin
+    mv $out/bin/benchmark_* $benchmark/bin
+  '' + lib.optionalString (buildTests || buildBenchmarks) ''
+    rmdir $out/bin
+  '';
+
+  passthru.updateScript = writeScript "update.sh" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl jq common-updater-scripts
+    json="$(curl -sL "https://api.github.com/repos/ROCmSoftwarePlatform/rocRAND/releases?per_page=1")"
+    repoVersion="$(echo "$json" | jq '.[0].name | split(" ") | .[1]' --raw-output)"
+    rocmVersion="$(echo "$json" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
+    update-source-version rocrand "$repoVersion" --ignore-same-hash --version-key=repoVersion
+    update-source-version rocrand "$rocmVersion" --ignore-same-hash --version-key=rocmVersion
+  '';
+
+  meta = with lib; {
+    description = "Generate pseudo-random and quasi-random numbers";
+    homepage = "https://github.com/ROCmSoftwarePlatform/rocRAND";
+    license = with licenses; [ mit ];
+    maintainers = teams.rocm.members;
+    broken = finalAttrs.rocmVersion != hip.version;
+  };
+})
--- a/pkgs/development/libraries/rocsparse/default.nix
+++ b/pkgs/development/libraries/rocsparse/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchzip
 , writeScript
 , cmake
 , rocm-cmake
@ -11,7 +12,6 @@
 , hip
 , gfortran
 , git
-, fetchzip ? null
 , gtest ? null
 , boost ? null
 , python3Packages ? null
@ -19,18 +19,11 @@
 , buildBenchmarks ? false # Seems to depend on tests
 }:

-assert (buildTests || buildBenchmarks) -> fetchzip != null;
 assert (buildTests || buildBenchmarks) -> gtest != null;
 assert (buildTests || buildBenchmarks) -> boost != null;
 assert (buildTests || buildBenchmarks) -> python3Packages != null;

-let
-  matrices = lib.optionalAttrs (buildTests || buildBenchmarks) import ./deps.nix {
-    inherit fetchzip;
-    mirror1 = "https://sparse.tamu.edu/MM";
-    mirror2 = "https://www.cise.ufl.edu/research/sparse/MM";
-  };
-in stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "rocsparse";
  repoVersion = "2.3.2";
  rocmVersion = "5.3.3";
@ -90,30 +83,30 @@ in stdenv.mkDerivation (finalAttrs: {
  postPatch = lib.optionalString (buildTests || buildBenchmarks) ''
    mkdir -p matrices

-    ln -s ${matrices.matrix-01}/*.mtx matrices
-    ln -s ${matrices.matrix-02}/*.mtx matrices
-    ln -s ${matrices.matrix-03}/*.mtx matrices
-    ln -s ${matrices.matrix-04}/*.mtx matrices
-    ln -s ${matrices.matrix-05}/*.mtx matrices
-    ln -s ${matrices.matrix-06}/*.mtx matrices
-    ln -s ${matrices.matrix-07}/*.mtx matrices
-    ln -s ${matrices.matrix-08}/*.mtx matrices
-    ln -s ${matrices.matrix-09}/*.mtx matrices
-    ln -s ${matrices.matrix-10}/*.mtx matrices
-    ln -s ${matrices.matrix-11}/*.mtx matrices
-    ln -s ${matrices.matrix-12}/*.mtx matrices
-    ln -s ${matrices.matrix-13}/*.mtx matrices
-    ln -s ${matrices.matrix-14}/*.mtx matrices
-    ln -s ${matrices.matrix-15}/*.mtx matrices
-    ln -s ${matrices.matrix-16}/*.mtx matrices
-    ln -s ${matrices.matrix-17}/*.mtx matrices
-    ln -s ${matrices.matrix-18}/*.mtx matrices
-    ln -s ${matrices.matrix-19}/*.mtx matrices
-    ln -s ${matrices.matrix-20}/*.mtx matrices
-    ln -s ${matrices.matrix-21}/*.mtx matrices
-    ln -s ${matrices.matrix-22}/*.mtx matrices
-    ln -s ${matrices.matrix-23}/*.mtx matrices
-    ln -s ${matrices.matrix-24}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-01}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-02}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-03}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-04}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-05}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-06}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-07}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-08}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-09}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-10}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-11}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-12}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-13}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-14}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-15}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-16}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-17}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-18}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-19}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-20}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-21}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-22}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-23}/*.mtx matrices
+    ln -s ${finalAttrs.passthru.matrices.matrix-24}/*.mtx matrices

    # Not used by the original cmake, causes an error
    rm matrices/*_b.mtx
@ -140,15 +133,23 @@ in stdenv.mkDerivation (finalAttrs: {
    rmdir $out/bin
  '';

-  passthru.updateScript = writeScript "update.sh" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p curl jq common-updater-scripts
-    json="$(curl -sL "https://api.github.com/repos/ROCmSoftwarePlatform/rocSPARSE/releases?per_page=1")"
-    repoVersion="$(echo "$json" | jq '.[0].name | split(" ") | .[1]' --raw-output)"
-    rocmVersion="$(echo "$json" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
-    update-source-version rocsparse "$repoVersion" --ignore-same-hash --version-key=repoVersion
-    update-source-version rocsparse "$rocmVersion" --ignore-same-hash --version-key=rocmVersion
-  '';
+  passthru = {
+    matrices = import ./deps.nix {
+      inherit fetchzip;
+      mirror1 = "https://sparse.tamu.edu/MM";
+      mirror2 = "https://www.cise.ufl.edu/research/sparse/MM";
+    };
+
+    updateScript = writeScript "update.sh" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl jq common-updater-scripts
+      json="$(curl -sL "https://api.github.com/repos/ROCmSoftwarePlatform/rocSPARSE/releases?per_page=1")"
+      repoVersion="$(echo "$json" | jq '.[0].name | split(" ") | .[1]' --raw-output)"
+      rocmVersion="$(echo "$json" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
+      update-source-version rocsparse "$repoVersion" --ignore-same-hash --version-key=repoVersion
+      update-source-version rocsparse "$rocmVersion" --ignore-same-hash --version-key=rocmVersion
+    '';
+  };

  meta = with lib; {
    description = "ROCm SPARSE implementation";
--- a/pkgs/development/libraries/rocwmma/0000-dont-fetch-googletest.patch
+++ b/pkgs/development/libraries/rocwmma/0000-dont-fetch-googletest.patch
@ -0,0 +1,19 @@
+diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
+index 7e0f2c8..db54eab 100644
+--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
+@@ -31,14 +31,6 @@ cmake_dependent_option( ROCWMMA_BUILD_BENCHMARK_TESTS "Build benchmarking tests"
+ cmake_dependent_option( ROCWMMA_BUILD_EXTENDED_TESTS "Build extended test parameter coverage" OFF "ROCWMMA_BUILD_TESTS" OFF )
+ 
+ # Test/benchmark requires additional dependencies
+-include( FetchContent )
+-
+-FetchContent_Declare(
+-  googletest
+-  URL https://github.com/google/googletest/archive/609281088cfefc76f9d0ce82e1ff6c30cc3591e5.zip
+-)
+-FetchContent_MakeAvailable(googletest)
+-
+ include(GoogleTest)
+ 
+ set(ROCWMMA_TEST_INCLUDE_DIR ${CMAKE_CURRENT_SOURCE_DIR})
--- a/pkgs/development/libraries/rocwmma/default.nix
+++ b/pkgs/development/libraries/rocwmma/default.nix
@ -0,0 +1,157 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, writeScript
+, cmake
+, rocm-cmake
+, hip
+, openmp
+, gtest ? null
+, rocblas ? null
+, texlive ? null
+, doxygen ? null
+, sphinx ? null
+, python3Packages ? null
+, buildTests ? false
+, buildSamples ? false
+, buildDocs ? false
+, gpuTargets ? null # gpuTargets = [ "gfx908:xnack-" "gfx90a:xnack-" "gfx90a:xnack+" ... ]
+}:
+
+assert buildTests -> gtest != null;
+assert buildTests -> rocblas != null;
+assert buildDocs -> texlive != null;
+assert buildDocs -> doxygen != null;
+assert buildDocs -> sphinx != null;
+assert buildDocs -> python3Packages != null;
+
+# Building tests isn't working for now
+# undefined reference to symbol '_ZTIN7testing4TestE'
+assert buildTests == false;
+
+let
+  latex = lib.optionalAttrs buildDocs (texlive.combine {
+    inherit (texlive) scheme-small
+    latexmk
+    tex-gyre
+    fncychap
+    wrapfig
+    capt-of
+    framed
+    needspace
+    tabulary
+    varwidth
+    titlesec;
+  });
+in stdenv.mkDerivation (finalAttrs: {
+  pname = "rocwmma";
+  repoVersion = "0.8";
+  rocmVersion = "5.3.3";
+  version = "${finalAttrs.repoVersion}-${finalAttrs.rocmVersion}";
+
+  outputs = [
+    "out"
+  ] ++ lib.optionals buildTests [
+    "test"
+  ] ++ lib.optionals buildSamples [
+    "sample"
+  ] ++ lib.optionals buildDocs [
+    "docs"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "ROCmSoftwarePlatform";
+    repo = "rocWMMA";
+    rev = "rocm-${finalAttrs.rocmVersion}";
+    hash = "sha256-wU3R1XGTy7uFbceUyE0wy+XayicuyJIVfd1ih6pbTN0=";
+  };
+
+  patches = lib.optionals buildTests [
+    ./0000-dont-fetch-googletest.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    rocm-cmake
+    hip
+  ];
+
+  buildInputs = [
+    openmp
+  ] ++ lib.optionals buildTests [
+    gtest
+    rocblas
+  ] ++ lib.optionals buildDocs [
+    latex
+    doxygen
+    sphinx
+    python3Packages.sphinx_rtd_theme
+    python3Packages.breathe
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_CXX_COMPILER=hipcc"
+    "-DROCWMMA_BUILD_TESTS=${if buildTests then "ON" else "OFF"}"
+    "-DROCWMMA_BUILD_SAMPLES=${if buildSamples then "ON" else "OFF"}"
+    # Manually define CMAKE_INSTALL_<DIR>
+    # See: https://github.com/NixOS/nixpkgs/pull/197838
+    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ] ++ lib.optionals (gpuTargets != null) [
+    "-DGPU_TARGETS=${lib.strings.concatStringsSep ";" gpuTargets}"
+  ] ++ lib.optionals buildTests [
+    "-DROCWMMA_BUILD_VALIDATION_TESTS=ON"
+    "-DROCWMMA_BUILD_BENCHMARK_TESTS=ON"
+    "-DROCWMMA_BUILD_EXTENDED_TESTS=ON"
+    "-DROCWMMA_VALIDATE_WITH_ROCBLAS=ON"
+    "-DROCWMMA_BENCHMARK_WITH_ROCBLAS=ON"
+  ];
+
+  postPatch = lib.optionalString buildDocs ''
+    patchShebangs docs/*.sh
+  '';
+
+  # Unfortunately, it seems like we have to call make on this manually
+  # -DROCWMMA_BUILD_DOCS=ON is invalid, despite being on the README
+  postBuild = lib.optionalString buildDocs ''
+    export HOME=$(mktemp -d)
+    ../docs/run_doc.sh
+  '';
+
+  postInstall = lib.optionalString buildTests ''
+    mkdir -p $test/bin
+    mv $out/bin/*_test* $test/bin
+  '' + lib.optionalString buildSamples ''
+    mkdir -p $sample/bin
+    mv $out/bin/sgemmv $sample/bin
+    mv $out/bin/simple_gemm $sample/bin
+    mv $out/bin/simple_dlrm $sample/bin
+  '' + lib.optionalString (buildTests || buildSamples) ''
+    rmdir $out/bin
+  '';
+
+  postFixup = lib.optionalString buildDocs ''
+    mkdir -p $docs/share/doc/rocwmma
+    mv ../docs/source/_build/html $docs/share/doc/rocwmma
+    mv ../docs/source/_build/latex/rocWMMA.pdf $docs/share/doc/rocwmma
+  '';
+
+  passthru.updateScript = writeScript "update.sh" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl jq common-updater-scripts
+    json="$(curl -sL "https://api.github.com/repos/ROCmSoftwarePlatform/rocWMMA/releases?per_page=1")"
+    repoVersion="$(echo "$json" | jq '.[0].name | split(" ") | .[1]' --raw-output)"
+    rocmVersion="$(echo "$json" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
+    update-source-version rocwmma "$repoVersion" --ignore-same-hash --version-key=repoVersion
+    update-source-version rocwmma "$rocmVersion" --ignore-same-hash --version-key=rocmVersion
+  '';
+
+  meta = with lib; {
+    description = "Mixed precision matrix multiplication and accumulation";
+    homepage = "https://github.com/ROCmSoftwarePlatform/rocWMMA";
+    license = with licenses; [ mit ];
+    maintainers = teams.rocm.members;
+    broken = finalAttrs.rocmVersion != hip.version;
+  };
+})
--- a/pkgs/development/libraries/simdjson/default.nix
+++ b/pkgs/development/libraries/simdjson/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "simdjson";
-  version = "3.0.0";
+  version = "3.0.1";

  src = fetchFromGitHub {
    owner = "simdjson";
    repo = "simdjson";
    rev = "v${version}";
-    sha256 = "sha256-Ub0gHxnc4ljVqbAWuFJYBuhA4FjX4ypg1gaPXUrcWkE=";
+    sha256 = "sha256-e5u9+H4rILIDpnZxzVV9wbjhR9tRqnf11i2Kn39DTzo=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/speedtest-exporter/default.nix
+++ b/pkgs/development/libraries/speedtest-exporter/default.nix
@ -0,0 +1,26 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "speedtest-exporter";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "nlamirault";
+    repo = "speedtest_exporter";
+    rev = "v${version}";
+    hash = "sha256-WIMDv63sHyZVw3Ct5LFXCIufj7sU2H81n+hT/NiPMeQ=";
+  };
+
+  vendorHash = "sha256-Lm73pZzdNZv7J+vKrtQXxm4HiAuB9lugKT/oanmD0HM=";
+
+  meta = with lib; {
+    description = "Prometheus exporter for Speedtest metrics";
+    homepage = "https://github.com/nlamirault/speedtest_exporter";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ urandom ];
+    mainProgram = "speedtest_exporter";
+  };
+}
--- a/pkgs/development/libraries/spice-gtk/default.nix
+++ b/pkgs/development/libraries/spice-gtk/default.nix
@ -137,6 +137,8 @@ stdenv.mkDerivation rec {
    "-Dpolkit=disabled"
  ] ++ lib.optionals (!stdenv.isLinux) [
    "-Dlibcap-ng=disabled"
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    "-Dcoroutine=gthread" # Fixes "Function missing:makecontext"
  ];

  meta = with lib; {
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@ -497,7 +497,7 @@ with prev;

    # we override 'luarocks test' because otherwise neovim doesn't find/load the plenary plugin
    checkPhase = ''
-      export LIBSQLITE="${sqlite.out}/lib/libsqlite3.so"
+      export LIBSQLITE="${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}"
      export HOME="$TMPDIR";

      nvim --headless -i NONE \
--- a/pkgs/development/python-modules/aiokafka/default.nix
+++ b/pkgs/development/python-modules/aiokafka/default.nix
@ -1,23 +1,30 @@
 { lib
+, async-timeout
 , buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-, dataclasses
-, kafka-python
 , cython
+, fetchFromGitHub
+, gssapi
+, kafka-python
+, lz4
+, packaging
+, python-snappy
+, pythonOlder
 , zlib
+, zstandard
 }:

 buildPythonPackage rec {
  pname = "aiokafka";
-  version = "0.7.2";
-  disabled = pythonOlder "3.6";
+  version = "0.8.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "aio-libs";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-D+91k4zVg28qPbWIrvyXi6WtDs1jeJt9jFGsrSBA3cs=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-g7xUB5RfjG4G7J9Upj3KXKSePa+VDit1Zf8pWHfui1o=";
  };

  nativeBuildInputs = [
@ -29,20 +36,38 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
+    async-timeout
    kafka-python
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
+    packaging
  ];

-  # checks require running kafka server
+  passthru.optional-dependencies = {
+    snappy = [
+      python-snappy
+    ];
+    lz4 = [
+      lz4
+    ];
+    zstd = [
+      zstandard
+    ];
+    gssapi = [
+      gssapi
+    ];
+  };
+
+  # Checks require running Kafka server
  doCheck = false;

-  pythonImportsCheck = [ "aiokafka" ];
+  pythonImportsCheck = [
+    "aiokafka"
+  ];

  meta = with lib; {
    description = "Kafka integration with asyncio";
    homepage = "https://aiokafka.readthedocs.org";
+    changelog = "https://github.com/aio-libs/aiokafka/releases/tag/v${version}";
    license = licenses.asl20;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
  };
 }
--- a/pkgs/development/python-modules/aiolifx-themes/default.nix
+++ b/pkgs/development/python-modules/aiolifx-themes/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "aiolifx-themes";
-  version = "0.2.0";
+  version = "0.2.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -20,8 +20,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "Djelibeybi";
    repo = "aiolifx-themes";
-    rev = "v${version}";
-    hash = "sha256:17498vdg8i20hk4i8hzc67qaj206ik3s1zn1k70plsjr9zlgs6vz";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-sWEWfsew758jl6vLB7AQQ3nA83BFHF7YPy1ZaoPt45Y=";
  };

  prePatch = ''
@ -52,6 +52,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Color themes for LIFX lights running on aiolifx";
    homepage = "https://github.com/Djelibeybi/aiolifx-themes";
+    changelog = "https://github.com/Djelibeybi/aiolifx-themes/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ lukegb ];
  };
--- a/pkgs/development/python-modules/ansible-lint/default.nix
+++ b/pkgs/development/python-modules/ansible-lint/default.nix
@ -22,13 +22,13 @@

 buildPythonPackage rec {
  pname = "ansible-lint";
-  version = "6.8.6";
+  version = "6.9.0";
  format = "pyproject";
  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-Fx/o2tYgeLmBm1x01g61r6ow6py5ybqHBhSeVsVam24=";
+    sha256 = "sha256-FO+RmSDErMmAVH3tC9Qjp6J6CyMnc45ZM0P0RvOxJsY=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
+++ b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
@ -7,11 +7,12 @@
 , pyric
 , pytestCheckHook
 , pythonOlder
+, usb-devices
 }:

 buildPythonPackage rec {
  pname = "bluetooth-auto-recovery";
-  version = "0.4.0";
+  version = "0.5.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -20,7 +21,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-juGrrUqPgg1bJsMZP0iitp0NW/XrCxNq/+/fx5QNkQ4=";
+    hash = "sha256-LvLav3OCud1EZe3JXvjbuuKU9xtd6ywrx6pZLLP0N/A=";
  };

  nativeBuildInputs = [
@ -31,6 +32,7 @@ buildPythonPackage rec {
    async-timeout
    btsocket
    pyric
+    usb-devices
  ];

  checkInputs = [
--- a/pkgs/development/python-modules/can/default.nix
+++ b/pkgs/development/python-modules/can/default.nix
@ -12,42 +12,54 @@
 , pythonOlder
 , typing-extensions
 , wrapt
+, uptime
 }:

 buildPythonPackage rec {
-  pname = "python-can";
-  version = "4.0.0";
+  pname = "can";
+  version = "4.1.0";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "hardbyte";
-    repo = pname;
-    rev = version;
-    hash = "sha256-/z7zBfVbO7x4UtzWOXolH2YrtYWgsvRLObWwz8sqOEc=";
+    repo = "python-can";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-jNy47SapujTF3ReJtIbwUY53IftIH4cXZjkzHrnZMFQ=";
  };

+  postPatch = ''
+    substituteInPlace tox.ini \
+      --replace " --cov=can --cov-config=tox.ini --cov-report=lcov --cov-report=term" ""
+  '';
+
  propagatedBuildInputs = [
    msgpack
    packaging
-    pyserial
    typing-extensions
    wrapt
  ];

+  passthru.optional-dependencies = {
+    serial = [
+      pyserial
+    ];
+    seeedstudio = [
+      pyserial
+    ];
+    pcan = [
+      uptime
+    ];
+  };
+
  checkInputs = [
    future
    hypothesis
    parameterized
    pytest-timeout
    pytestCheckHook
-  ];
-
-  postPatch = ''
-    substituteInPlace tox.ini \
-      --replace " --cov=can --cov-config=tox.ini --cov-report=xml --cov-report=term" ""
-  '';
+  ] ++ passthru.optional-dependencies.serial;

  disabledTestPaths = [
    # We don't support all interfaces
@ -74,6 +86,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "CAN support for Python";
    homepage = "https://python-can.readthedocs.io";
+    changelog = "https://github.com/hardbyte/python-can/releases/tag/v${version}";
    license = licenses.lgpl3Only;
    maintainers = with maintainers; [ fab sorki ];
  };
--- a/pkgs/development/python-modules/cryptography/cryptography-py27-warning.patch
+++ b/pkgs/development/python-modules/cryptography/cryptography-py27-warning.patch
@ -1,14 +0,0 @@
-Delete the warning that breaks tests of dependent projects.
-
--- a/src/cryptography/__init__.py
-+++ b/src/cryptography/__init__.py
-@@ -33,9 +32,0 @@ __all__ = [
-
-if sys.version_info[0] == 2:
-    warnings.warn(
-        "Python 2 is no longer supported by the Python core team. Support for "
-        "it is now deprecated in cryptography, and will be removed in the "
-        "next release.",
-        CryptographyDeprecationWarning,
-        stacklevel=2,
-    )
--- a/pkgs/development/python-modules/databases/default.nix
+++ b/pkgs/development/python-modules/databases/default.nix
@ -1,42 +1,61 @@
 { lib
+, aiomysql
+, aiopg
+, aiosqlite
+, asyncmy
+, asyncpg
 , buildPythonPackage
 , fetchFromGitHub
-, sqlalchemy
-, aiocontextvars
-, aiopg
-, pythonOlder
 , pytestCheckHook
-, pymysql
-, asyncpg
-, aiomysql
-, aiosqlite
+, pythonOlder
+, sqlalchemy
 }:

 buildPythonPackage rec {
  pname = "databases";
-  version = "0.6.1";
+  version = "0.6.2";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "encode";
    repo = pname;
-    rev = version;
-    hash = "sha256-kHsA9XpolGmtuAGzRTj61igooLG9/LBQyv7TtuqiJ/A=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-3zgHfYGiO2xWualLa4h8A85qjC32ILadw/47Ul1GTmM=";
  };

  propagatedBuildInputs = [
-    aiopg
-    aiomysql
-    aiosqlite
-    asyncpg
-    pymysql
    sqlalchemy
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    aiocontextvars
  ];

+  passthru.optional-dependencies = {
+    postgresql = [
+      asyncpg
+    ];
+    asyncpg = [
+      asyncpg
+    ];
+    aiopg = [
+      aiopg
+    ];
+    mysql = [
+      aiomysql
+    ];
+    aiomysql = [
+      aiomysql
+    ];
+    asyncmy = [
+      asyncmy
+    ];
+    sqlite = [
+      aiosqlite
+    ];
+    aiosqlite = [
+      aiosqlite
+    ];
+  };
+
  checkInputs = [
    pytestCheckHook
  ];
@ -56,6 +75,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Async database support for Python";
    homepage = "https://github.com/encode/databases";
+    changelog = "https://github.com/encode/databases/releases/tag/${version}";
    license = licenses.bsd3;
    maintainers = with maintainers; [ costrouc ];
  };
--- a/pkgs/development/python-modules/elastic-apm/default.nix
+++ b/pkgs/development/python-modules/elastic-apm/default.nix
@ -24,11 +24,12 @@
 , tornado
 , urllib3
 , webob
+, wrapt
 }:

 buildPythonPackage rec {
  pname = "elastic-apm";
-  version = "6.12.0";
+  version = "6.13.2";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -37,7 +38,7 @@ buildPythonPackage rec {
    owner = "elastic";
    repo = "apm-agent-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-tAX96aOPuwtchLk5A1ANuZI5w5H9/yX3Zj9bRSyHv90=";
+    hash = "sha256-HbIra8Cxgn/2xOVEvtcc7rMtSLBmWMxxHlIM44Oy+8U=";
  };

  propagatedBuildInputs = [
@ -48,6 +49,7 @@ buildPythonPackage rec {
    starlette
    tornado
    urllib3
+    wrapt
  ];

  checkInputs = [
@ -84,6 +86,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python agent for the Elastic APM";
    homepage = "https://github.com/elastic/apm-agent-python";
+    changelog = "https://github.com/elastic/apm-agent-python/releases/tag/v${version}";
    license = with licenses; [ bsd3 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/exif/default.nix
+++ b/pkgs/development/python-modules/exif/default.nix
@ -2,25 +2,22 @@

 buildPythonPackage rec {
  pname = "exif";
-  version = "1.2.0";
+  version = "1.3.5";
  disabled = !isPy3k;

  src = fetchFromGitLab {
    owner = "TNThieding";
    repo = "exif";
-    rev = "686857c677f489759db90b1ad61fa1cc1cac5f9a";
-    sha256 = "0z2if23kmi0iyxviz32mlqs997i3dqpqfz6nznlwkhkkb6rkwwnh";
+    rev = "v${version}";
+    sha256 = "sha256-XSORawioXo8oPVZ3Jnxqa6GFIxnQZMT0vJitdmpBj0E=";
  };

  propagatedBuildInputs = [ plum-py ];

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "plum-py==0.3.1" "plum-py>=0.3.1"
-  '';
-
  checkInputs = [ pytestCheckHook baseline ];

+  pythonImportsCheck = [ "exif" ];
+
  meta = with lib; {
    description = "Read and modify image EXIF metadata using Python";
    homepage    = "https://gitlab.com/TNThieding/exif";
--- a/pkgs/development/python-modules/flake8-import-order/default.nix
+++ b/pkgs/development/python-modules/flake8-import-order/default.nix
@ -1,25 +1,45 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, enum34, pycodestyle, pytest, flake8, pylama }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, flake8
+, pycodestyle
+, pylama
+, pytestCheckHook
+, pythonOlder
+}:

 buildPythonPackage rec {
  pname = "flake8-import-order";
-  version = "0.18.1";
+  version = "0.18.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "14kfvsagqc6lrplvf3x58ia6x744bk8fj91wmk0hcipa8naw73d2";
+    hash = "sha256-4jlB+JLaPgwJ1xG6u7DHO8c1JC6bIWtyZhZ1ipINkA4=";
  };

-  propagatedBuildInputs = [ pycodestyle ] ++ lib.optional (!isPy3k) enum34;
+  propagatedBuildInputs = [
+    pycodestyle
+  ];

-  checkInputs = [ pytest flake8 pycodestyle pylama ];
+  checkInputs = [
+    flake8
+    pycodestyle
+    pylama
+    pytestCheckHook
+  ];

-  checkPhase = ''
-    pytest --strict
-  '';
+  pythonImportsCheck = [
+    "flake8_import_order"
+  ];

  meta = with lib; {
    description = "Flake8 and pylama plugin that checks the ordering of import statements";
    homepage = "https://github.com/PyCQA/flake8-import-order";
+    changelog = "https://github.com/PyCQA/flake8-import-order/blob/${version}/CHANGELOG.rst";
    license = with licenses; [ lgpl3 mit ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/geomet/default.nix
+++ b/pkgs/development/python-modules/geomet/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "geomet";
-  version = "0.3.1";
+  version = "1.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "geomet";
    repo = "geomet";
    rev = "refs/tags/${version}";
-    hash = "sha256-7QfvGQlg4nTr1rwTyvTNm6n/jFptLtpBKMjjQj6OXCQ=";
+    hash = "sha256-dN0d6wu5FqL/5FQrpQn+wlyEvp52pa5dkxLu3j3bxnw=";
  };

  propagatedBuildInputs = [
@ -32,6 +32,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Convert GeoJSON to WKT/WKB (Well-Known Text/Binary) and vice versa";
    homepage = "https://github.com/geomet/geomet";
+    changelog = "https://github.com/geomet/geomet/releases/tag/${version}";
    license = licenses.asl20;
    maintainers = with maintainers; [ turion ris ];
  };
--- a/Show More
+++ b/Show More