Merge master into haskell-updates

2024-11-28 09:53:10 +00:00 · 2023-08-24 00:11:09 +00:00 · 2023-08-24 00:11:09 +00:00 · 4cbc05c435
commit 4cbc05c435
parent 9d97e6da04 dfe898c801
221 changed files with 4195 additions and 5194 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -11007,6 +11007,12 @@
    githubId = 3300322;
    name = "Mitchell Fossen";
  };
+  mfrw = {
+    email = "falakreyaz@gmail.com";
+    github = "mfrw";
+    githubId = 4929861;
+    name = "Muhammad Falak R Wani";
+  };
  mgdelacroix = {
    email = "mgdelacroix@gmail.com";
    github = "mgdelacroix";
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -20,6 +20,8 @@

 - [mautrix-whatsapp](https://docs.mau.fi/bridges/go/whatsapp/index.html) A Matrix-WhatsApp puppeting bridge

+- [hddfancontrol](https://github.com/desbma/hddfancontrol), a service to regulate fan speeds based on hard drive temperature. Available as [services.hddfancontrol](#opt-services.hddfancontrol.enable).
+
 - [GoToSocial](https://gotosocial.org/), an ActivityPub social network server, written in Golang. Available as [services.gotosocial](#opt-services.gotosocial.enable).

 - [Typesense](https://github.com/typesense/typesense), a fast, typo-tolerant search engine for building delightful search experiences. Available as [services.typesense](#opt-services.typesense.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -505,6 +505,7 @@
  ./services/hardware/fancontrol.nix
  ./services/hardware/freefall.nix
  ./services/hardware/fwupd.nix
+  ./services/hardware/hddfancontrol.nix
  ./services/hardware/illum.nix
  ./services/hardware/interception-tools.nix
  ./services/hardware/irqbalance.nix
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@ -5,8 +5,8 @@ let

  parentWrapperDir = dirOf wrapperDir;

-  securityWrapper = pkgs.callPackage ./wrapper.nix {
-    inherit parentWrapperDir;
+  securityWrapper = sourceProg : pkgs.callPackage ./wrapper.nix {
+    inherit sourceProg;
  };

  fileModeType =
@ -91,8 +91,7 @@ let
    , ...
    }:
    ''
-      cp ${securityWrapper}/bin/security-wrapper "$wrapperDir/${program}"
-      echo -n "${source}" > "$wrapperDir/${program}.real"
+      cp ${securityWrapper source}/bin/security-wrapper "$wrapperDir/${program}"

      # Prevent races
      chmod 0000 "$wrapperDir/${program}"
@ -119,8 +118,7 @@ let
    , ...
    }:
    ''
-      cp ${securityWrapper}/bin/security-wrapper "$wrapperDir/${program}"
-      echo -n "${source}" > "$wrapperDir/${program}.real"
+      cp ${securityWrapper source}/bin/security-wrapper "$wrapperDir/${program}"

      # Prevent races
      chmod 0000 "$wrapperDir/${program}"
--- a/nixos/modules/security/wrappers/wrapper.c
+++ b/nixos/modules/security/wrappers/wrapper.c
@ -17,6 +17,10 @@
 #include <syscall.h>
 #include <byteswap.h>

+#ifndef SOURCE_PROG
+#error SOURCE_PROG should be defined via preprocessor commandline
+#endif
+
 // aborts when false, printing the failed expression
 #define ASSERT(expr) ((expr) ? (void) 0 : assert_failure(#expr))
 // aborts when returns non-zero, printing the failed expression and errno
@ -24,10 +28,6 @@

 extern char **environ;

-// The WRAPPER_DIR macro is supplied at compile time so that it cannot
-// be changed at runtime
-static char *wrapper_dir = WRAPPER_DIR;
-
 // Wrapper debug variable name
 static char *wrapper_debug = "WRAPPER_DEBUG";

@ -151,115 +151,20 @@ static int make_caps_ambient(const char *self_path) {
    return 0;
 }

-int readlink_malloc(const char *p, char **ret) {
-    size_t l = FILENAME_MAX+1;
-    int r;
-
-    for (;;) {
-        char *c = calloc(l, sizeof(char));
-        if (!c) {
-            return -ENOMEM;
-        }
-
-        ssize_t n = readlink(p, c, l-1);
-        if (n < 0) {
-            r = -errno;
-            free(c);
-            return r;
-        }
-
-        if ((size_t) n < l-1) {
-            c[n] = 0;
-            *ret = c;
-            return 0;
-        }
-
-        free(c);
-        l *= 2;
-    }
-}
-
 int main(int argc, char **argv) {
    ASSERT(argc >= 1);
-    char *self_path = NULL;
-    int self_path_size = readlink_malloc("/proc/self/exe", &self_path);
-    if (self_path_size < 0) {
-        fprintf(stderr, "cannot readlink /proc/self/exe: %s", strerror(-self_path_size));
-    }
-
-    unsigned int ruid, euid, suid, rgid, egid, sgid;
-    MUSTSUCCEED(getresuid(&ruid, &euid, &suid));
-    MUSTSUCCEED(getresgid(&rgid, &egid, &sgid));
-
-    // If true, then we did not benefit from setuid privilege escalation,
-    // where the original uid is still in ruid and different from euid == suid.
-    int didnt_suid = (ruid == euid) && (euid == suid);
-    // If true, then we did not benefit from setgid privilege escalation
-    int didnt_sgid = (rgid == egid) && (egid == sgid);
-
-
-    // Make sure that we are being executed from the right location,
-    // i.e., `safe_wrapper_dir'.  This is to prevent someone from creating
-    // hard link `X' from some other location, along with a false
-    // `X.real' file, to allow arbitrary programs from being executed
-    // with elevated capabilities.
-    int len = strlen(wrapper_dir);
-    if (len > 0 && '/' == wrapper_dir[len - 1])
-      --len;
-    ASSERT(!strncmp(self_path, wrapper_dir, len));
-    ASSERT('/' == wrapper_dir[0]);
-    ASSERT('/' == self_path[len]);
-
-    // If we got privileges with the fs set[ug]id bit, check that the privilege we
-    // got matches the one one we expected, ie that our effective uid/gid
-    // matches the uid/gid of `self_path`. This ensures that we were executed as
-    // `self_path', and not, say, as some other setuid program.
-    // We don't check that if we did not benefit from the set[ug]id bit, as
-    // can be the case in nosuid mounts or user namespaces.
-    struct stat st;
-    ASSERT(lstat(self_path, &st) != -1);
-
-    // if the wrapper gained privilege with suid, check that we got the uid of the file owner
-    ASSERT(!((st.st_mode & S_ISUID) && !didnt_suid) || (st.st_uid == euid));
-    // if the wrapper gained privilege with sgid, check that we got the gid of the file group
-    ASSERT(!((st.st_mode & S_ISGID) && !didnt_sgid) || (st.st_gid == egid));
-    // same, but with suid instead of euid
-    ASSERT(!((st.st_mode & S_ISUID) && !didnt_suid) || (st.st_uid == suid));
-    ASSERT(!((st.st_mode & S_ISGID) && !didnt_sgid) || (st.st_gid == sgid));
-
-    // And, of course, we shouldn't be writable.
-    ASSERT(!(st.st_mode & (S_IWGRP | S_IWOTH)));
-
-    // Read the path of the real (wrapped) program from <self>.real.
-    char real_fn[PATH_MAX + 10];
-    int real_fn_size = snprintf(real_fn, sizeof(real_fn), "%s.real", self_path);
-    ASSERT(real_fn_size < sizeof(real_fn));
-
-    int fd_self = open(real_fn, O_RDONLY);
-    ASSERT(fd_self != -1);
-
-    char source_prog[PATH_MAX];
-    len = read(fd_self, source_prog, PATH_MAX);
-    ASSERT(len != -1);
-    ASSERT(len < sizeof(source_prog));
-    ASSERT(len > 0);
-    source_prog[len] = 0;
-
-    close(fd_self);

    // Read the capabilities set on the wrapper and raise them in to
    // the ambient set so the program we're wrapping receives the
    // capabilities too!
-    if (make_caps_ambient(self_path) != 0) {
-        free(self_path);
+    if (make_caps_ambient("/proc/self/exe") != 0) {
        return 1;
    }
-    free(self_path);

-    execve(source_prog, argv, environ);
+    execve(SOURCE_PROG, argv, environ);
    
    fprintf(stderr, "%s: cannot run `%s': %s\n",
-        argv[0], source_prog, strerror(errno));
+        argv[0], SOURCE_PROG, strerror(errno));

    return 1;
 }
--- a/nixos/modules/security/wrappers/wrapper.nix
+++ b/nixos/modules/security/wrappers/wrapper.nix
@ -1,4 +1,4 @@
-{ stdenv, linuxHeaders, parentWrapperDir, debug ? false }:
+{ stdenv, linuxHeaders, sourceProg, debug ? false }:
 # For testing:
 # $ nix-build -E 'with import <nixpkgs> {}; pkgs.callPackage ./wrapper.nix { parentWrapperDir = "/run/wrappers"; debug = true; }'
 stdenv.mkDerivation {
@ -7,7 +7,7 @@ stdenv.mkDerivation {
  dontUnpack = true;
  hardeningEnable = [ "pie" ];
  CFLAGS = [
-    ''-DWRAPPER_DIR="${parentWrapperDir}"''
+    ''-DSOURCE_PROG="${sourceProg}"''
  ] ++ (if debug then [
    "-Werror" "-Og" "-g"
  ] else [
--- a/nixos/modules/services/editors/emacs.nix
+++ b/nixos/modules/services/editors/emacs.nix
@ -80,6 +80,15 @@ in
        using the EDITOR environment variable.
      '';
    };
+
+    startWithGraphical = mkOption {
+      type = types.bool;
+      default = config.services.xserver.enable;
+      defaultText = literalExpression "config.services.xserver.enable";
+      description = lib.mdDoc ''
+        Start emacs with the graphical session instead of any session. Without this, emacs clients will not be able to create frames in the graphical session.
+      '';
+    };
  };

  config = mkIf (cfg.enable || cfg.install) {
@ -92,7 +101,13 @@ in
        ExecStop = "${cfg.package}/bin/emacsclient --eval (kill-emacs)";
        Restart = "always";
      };
-    } // optionalAttrs cfg.enable { wantedBy = [ "default.target" ]; };
+
+      unitConfig = optionalAttrs cfg.startWithGraphical {
+        After = "graphical-session.target";
+      };
+    } // optionalAttrs cfg.enable {
+      wantedBy = if cfg.startWithGraphical then [ "graphical-session.target" ] else [ "default.target" ];
+    };

    environment.systemPackages = [ cfg.package editorScript desktopApplicationFile ];

--- a/nixos/modules/services/hardware/hddfancontrol.nix
+++ b/nixos/modules/services/hardware/hddfancontrol.nix
@ -0,0 +1,67 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.hddfancontrol;
+  types = lib.types;
+in
+
+{
+  options = {
+
+    services.hddfancontrol.enable = lib.mkEnableOption "hddfancontrol daemon";
+
+    services.hddfancontrol.disks = lib.mkOption {
+      type = with types; listOf path;
+      default = [];
+      description = lib.mdDoc ''
+        Drive(s) to get temperature from
+      '';
+      example = ["/dev/sda"];
+    };
+
+    services.hddfancontrol.pwmPaths = lib.mkOption {
+      type = with types; listOf path;
+      default = [];
+      description = lib.mdDoc ''
+        PWM filepath(s) to control fan speed (under /sys)
+      '';
+      example = ["/sys/class/hwmon/hwmon2/pwm1"];
+    };
+
+    services.hddfancontrol.smartctl = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Probe temperature using smartctl instead of hddtemp or hdparm
+      '';
+    };
+
+    services.hddfancontrol.extraArgs = lib.mkOption {
+      type = with types; listOf str;
+      default = [];
+      description = lib.mdDoc ''
+        Extra commandline arguments for hddfancontrol
+      '';
+      example = ["--pwm-start-value=32"
+                 "--pwm-stop-value=0"
+                 "--spin-down-time=900"];
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    let args = lib.concatLists [
+      ["-d"] cfg.disks
+      ["-p"] cfg.pwmPaths
+      (lib.optional cfg.smartctl "--smartctl")
+      cfg.extraArgs
+    ]; in {
+      systemd.packages = [pkgs.hddfancontrol];
+
+      systemd.services.hddfancontrol = {
+        enable = true;
+        wantedBy = [ "multi-user.target" ];
+        environment.HDDFANCONTROL_ARGS = lib.escapeShellArgs args;
+      };
+    }
+  );
+}
--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@ -6,7 +6,7 @@ let
  cfg = config.services.tailscale;
  isNetworkd = config.networking.useNetworkd;
 in {
-  meta.maintainers = with maintainers; [ danderson mbaillie twitchyliquid64 ];
+  meta.maintainers = with maintainers; [ danderson mbaillie twitchyliquid64 mfrw ];

  options.services.tailscale = {
    enable = mkEnableOption (lib.mdDoc "Tailscale client daemon");
--- a/nixos/modules/services/networking/twingate.nix
+++ b/nixos/modules/services/networking/twingate.nix
@ -17,7 +17,7 @@ in
    };

    networking.firewall.checkReversePath = lib.mkDefault "loose";
-    services.resolved.enable = !(config.networking.networkmanager.enable);
+    services.resolved.enable = lib.mkIf (!config.networking.networkmanager.enable) true;

    environment.systemPackages = [ cfg.package ]; # For the CLI.
  };
--- a/nixos/modules/services/web-servers/caddy/default.nix
+++ b/nixos/modules/services/web-servers/caddy/default.nix
@ -24,21 +24,26 @@ let
        }
      '';

-  configFile =
-    let
-      Caddyfile = pkgs.writeTextDir "Caddyfile" ''
-        {
-          ${cfg.globalConfig}
-        }
-        ${cfg.extraConfig}
-      '';
+  settingsFormat = pkgs.formats.json { };

-      Caddyfile-formatted = pkgs.runCommand "Caddyfile-formatted" { nativeBuildInputs = [ cfg.package ]; } ''
-        mkdir -p $out
-        cp --no-preserve=mode ${Caddyfile}/Caddyfile $out/Caddyfile
-        caddy fmt --overwrite $out/Caddyfile
-      '';
-    in
+  configFile =
+    if cfg.settings != { } then
+      settingsFormat.generate "caddy.json" cfg.settings
+    else
+      let
+        Caddyfile = pkgs.writeTextDir "Caddyfile" ''
+          {
+            ${cfg.globalConfig}
+          }
+          ${cfg.extraConfig}
+        '';
+
+        Caddyfile-formatted = pkgs.runCommand "Caddyfile-formatted" { nativeBuildInputs = [ cfg.package ]; } ''
+          mkdir -p $out
+          cp --no-preserve=mode ${Caddyfile}/Caddyfile $out/Caddyfile
+          caddy fmt --overwrite $out/Caddyfile
+        '';
+      in
      "${if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform then Caddyfile-formatted else Caddyfile}/Caddyfile";

  etcConfigFile = "caddy/caddy_config";
@ -299,6 +304,27 @@ in
        which could delay the reload essentially indefinitely.
      '';
    };
+
+    settings = mkOption {
+      type = settingsFormat.type;
+      default = {};
+      description = lib.mdDoc ''
+        Structured configuration for Caddy to generate a Caddy JSON configuration file.
+        See <https://caddyserver.com/docs/json/> for available options.
+
+        ::: {.warning}
+        Using a [Caddyfile](https://caddyserver.com/docs/caddyfile) instead of a JSON config is highly recommended by upstream.
+        There are only very few exception to this.
+
+        Please use a Caddyfile via {option}`services.caddy.configFile`, {option}`services.caddy.virtualHosts` or
+        {option}`services.caddy.extraConfig` with {option}`services.caddy.globalConfig` instead.
+        :::
+
+        ::: {.note}
+        Takes presence over most `services.caddy.*` options, such as {option}`services.caddy.configFile` and {option}`services.caddy.virtualHosts`, if specified.
+        :::
+      '';
+    };
  };

  # implementation
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -341,6 +341,7 @@ in {
  hbase2 = handleTest ./hbase.nix { package=pkgs.hbase2; };
  hbase_2_4 = handleTest ./hbase.nix { package=pkgs.hbase_2_4; };
  hbase3 = handleTest ./hbase.nix { package=pkgs.hbase3; };
+  hddfancontrol = handleTest ./hddfancontrol.nix {};
  hedgedoc = handleTest ./hedgedoc.nix {};
  herbstluftwm = handleTest ./herbstluftwm.nix {};
  homepage-dashboard = handleTest ./homepage-dashboard.nix {};
--- a/nixos/tests/caddy.nix
+++ b/nixos/tests/caddy.nix
@ -34,6 +34,20 @@ import ./make-test-python.nix ({ pkgs, ... }: {
          "http://localhost:8081" = { };
        };
      };
+      specialisation.rfc42.configuration = {
+        services.caddy.settings = {
+          apps.http.servers.default = {
+            listen = [ ":80" ];
+            routes = [{
+              handle = [{
+                body = "hello world";
+                handler = "static_response";
+                status_code = 200;
+              }];
+            }];
+          };
+        };
+      };
    };
  };

@ -41,6 +55,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
    let
      justReloadSystem = "${nodes.webserver.system.build.toplevel}/specialisation/config-reload";
      multipleConfigs = "${nodes.webserver.system.build.toplevel}/specialisation/multiple-configs";
+      rfc42Config = "${nodes.webserver.system.build.toplevel}/specialisation/rfc42";
    in
    ''
      url = "http://localhost/example.html"
@ -62,5 +77,12 @@ import ./make-test-python.nix ({ pkgs, ... }: {
          )
          webserver.wait_for_open_port(8080)
          webserver.wait_for_open_port(8081)
+
+      with subtest("rfc42 settings config"):
+          webserver.succeed(
+              "${rfc42Config}/bin/switch-to-configuration test >&2"
+          )
+          webserver.wait_for_open_port(80)
+          webserver.succeed("curl http://localhost | grep hello")
    '';
 })
--- a/nixos/tests/hddfancontrol.nix
+++ b/nixos/tests/hddfancontrol.nix
@ -0,0 +1,44 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "hddfancontrol";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ benley ];
+  };
+
+  nodes.machine = { ... }: {
+    imports = [ ../modules/profiles/minimal.nix ];
+
+    services.hddfancontrol.enable = true;
+    services.hddfancontrol.disks = ["/dev/vda"];
+    services.hddfancontrol.pwmPaths = ["/test/hwmon1/pwm1"];
+    services.hddfancontrol.extraArgs = ["--pwm-start-value=32"
+                                        "--pwm-stop-value=0"];
+
+    systemd.services.hddfancontrol_fixtures = {
+      description = "Install test fixtures for hddfancontrol";
+      serviceConfig = {
+        Type = "oneshot";
+      };
+      script = ''
+        mkdir -p /test/hwmon1
+        echo 255 > /test/hwmon1/pwm1
+        echo 2 > /test/hwmon1/pwm1_enable
+      '';
+      wantedBy = ["hddfancontrol.service"];
+      before = ["hddfancontrol.service"];
+    };
+
+    systemd.services.hddfancontrol.serviceConfig.ReadWritePaths = "/test";
+  };
+
+  # hddfancontrol.service will fail to start because qemu /dev/vda doesn't have
+  # any thermal interfaces, but it should ensure that fans appear to be running
+  # before it aborts.
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("journalctl -eu hddfancontrol.service|grep 'Setting fan speed'")
+    machine.shutdown()
+
+  '';
+
+})
--- a/nixos/tests/os-prober.nix
+++ b/nixos/tests/os-prober.nix
@ -76,6 +76,7 @@ in {
      # nixos-rebuild needs must be included in the VM.
      system.extraDependencies = with pkgs;
        [
+          bintools
          brotli
          brotli.dev
          brotli.lib
--- a/nixos/tests/virtualbox.nix
+++ b/nixos/tests/virtualbox.nix
@ -519,4 +519,4 @@ in mapAttrs (mkVBoxTest false vboxVMs) {
    destroy_vm_test1()
    destroy_vm_test2()
  '';
-} // (lib.optionalAttrs enableUnfree unfreeTests)
+} // (optionalAttrs enableUnfree unfreeTests)
--- a/nixos/tests/wrappers.nix
+++ b/nixos/tests/wrappers.nix
@ -84,6 +84,17 @@ in
      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -g', '0')
      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -rg', '0')

+      # Test that in nonewprivs environment the wrappers simply exec their target.
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -u', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')
+
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -g', '${toString usersGid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')
+
      # We are only testing the permitted set, because it's easiest to look at with capsh.
      machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_CHOWN'))
      machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_SYS_ADMIN'))
--- a/pkgs/applications/audio/miniaudicle/default.nix
+++ b/pkgs/applications/audio/miniaudicle/default.nix
@ -1,13 +1,14 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, qmake
+, wrapQtAppsHook
+, qscintilla-qt6
 , bison
 , flex
 , which
 , alsa-lib
 , libsndfile
-, qt4
-, qscintilla-qt4
 , libpulseaudio
 , libjack2
 , audioBackend ? "pulse" # "pulse", "alsa", or "jack"
@ -15,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "miniaudicle";
-  version = "1.4.2.0";
+  version = "1.5.0.7";

  src = fetchFromGitHub {
    owner = "ccrma";
    repo = "miniAudicle";
-    rev = "miniAudicle-${finalAttrs.version}";
-    hash = "sha256-NENpqgCCGiVzVE6rYqBu2RwkzWSiGHe7dZVwBfSomEo=";
+    rev = "chuck-${finalAttrs.version}";
+    hash = "sha256-CqsajNLcOp7CS5RsVabWM6APnNh4alSKb2/eoZ7F4Ao=";
    fetchSubmodules = true;
  };

@ -37,20 +38,19 @@ stdenv.mkDerivation (finalAttrs: {
    bison
    flex
    which
+    qmake
+    wrapQtAppsHook
  ];

  buildInputs = [
    alsa-lib
    libsndfile
-    qt4
-    qscintilla-qt4
+    qscintilla-qt6
  ] ++ lib.optional (audioBackend == "pulse") libpulseaudio
    ++ lib.optional (audioBackend == "jack")  libjack2;

  buildFlags = [ "linux-${audioBackend}" ];

-  makeFlags = [ "PREFIX=$(out)" ];
-
  meta = with lib; {
    description = "A light-weight integrated development environment for the ChucK digital audio programming language";
    homepage = "https://audicle.cs.princeton.edu/mini/";
--- a/pkgs/applications/audio/sublime-music/default.nix
+++ b/pkgs/applications/audio/sublime-music/default.nix
@ -27,6 +27,17 @@ let
          hash = "sha256-IWTo/P9JRxBQlhtcH3JMJZZrwAA8EALF4dtHajWUc4w=";
        };
      });
+
+      dataclasses-json = super.dataclasses-json.overridePythonAttrs (oldAttrs: rec {
+        version = "0.5.7";
+        src = fetchFromGitHub {
+          owner = "lidatong";
+          repo = "dataclasses-json";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-0tw5Lz+c4ymO+AGpG6THbiALWGBrehC84+yWWk1eafc=";
+        };
+        nativeBuildInputs = [ python3.pkgs.setuptools ];
+      });
    };
  };
 in
--- a/pkgs/applications/audio/vcv-rack/default.nix
+++ b/pkgs/applications/audio/vcv-rack/default.nix
@ -39,14 +39,14 @@ let
  pffft-source = fetchFromBitbucket {
    owner = "jpommier";
    repo = "pffft";
-    rev = "988259a41d1522047a9420e6265a6ba8289c1654";
-    sha256 = "Oq5N02UNXsbhcPUfjMtD0cgqAZsGx9ke9A+ArrenzGE=";
+    rev = "38946c766c1afecfa4c5945af77913e38b3cec31";
+    sha256 = "1w6g9v9fy7bavqacb6qw1nxhcik2w36cvl2d7b0bh68w0pd70j5q";
  };
  fuzzysearchdatabase-source = fetchFromBitbucket {
    owner = "j_norberg";
    repo = "fuzzysearchdatabase";
-    rev = "a3a1bf557b8e6ee58b55fa82ff77ff7a3d141949";
-    sha256 = "13ib72acbxn1cnf66im0v4nlr1464v7j08ra2bprznjmy127xckm";
+    rev = "23122d1ff60d936fd766361a30210c954e0c5449";
+    sha256 = "1s88blx1rn2racmb8n5g0kh1ym7v21573l5m42c4nz266vmrvrvz";
  };
  nanovg-source = fetchFromGitHub {
    owner = "VCVRack";
@ -57,14 +57,14 @@ let
  nanosvg-source = fetchFromGitHub {
    owner = "memononen";
    repo = "nanosvg";
-    rev = "ccdb1995134d340a93fb20e3a3d323ccb3838dd0";
-    sha256 = "ymziU0NgGqxPOKHwGm0QyEdK/8jL/QYk5UdIQ3Tn8jw=";
+    rev = "9da543e8329fdd81b64eb48742d8ccb09377aed1";
+    sha256 = "1pkzv75kavkhrbdd2kvq755jyr0vamgrfr7lc33dq3ipkzmqvs2l";
  };
  osdialog-source = fetchFromGitHub {
    owner = "AndrewBelt";
    repo = "osdialog";
-    rev = "21b9dcc2a1bbdacb9b46da477ffd82a4ce9204b9";
-    sha256 = "+4VCBuQvfiuEUdjFu3IB2FwbHFrDJXTb4vcVg6ZFwSM=";
+    rev = "d0f64f0798c2e47f61d90a5505910ff2d63ca049";
+    sha256 = "1d3058x6wgzw7b0wai792flk7s6ffw0z4n9sl016v91yjwv7ds3a";
  };
  oui-blendish-source = fetchFromGitHub {
    owner = "AndrewBelt";
@ -75,20 +75,20 @@ let
  simde-source = fetchFromGitHub {
    owner = "simd-everywhere";
    repo = "simde";
-    rev = "dd0b662fd8cf4b1617dbbb4d08aa053e512b08e4";
-    sha256 = "1kxwzdlh21scak7wsbb60vwfvndppidj5fgbi26mmh73zsj02mnv";
+    rev = "b309d8951997201e493380a2fd09198c09ae1b4e";
+    sha256 = "1hz8mfbhbiafvim4qrkyvh1yndlhydqkxwhls7cfqa48wkpxfip8";
  };
  tinyexpr-source = fetchFromGitHub {
    owner = "codeplea";
    repo = "tinyexpr";
-    rev = "4e8cc0067a1e2378faae23eb2dfdd21e9e9907c2";
-    sha256 = "1yxkxsw3bc81cjm2knvyr1z9rlzwmjvq5zd125n34xwq568v904d";
+    rev = "74804b8c5d296aad0866bbde6c27e2bc1d85e5f2";
+    sha256 = "0z3r7wfw7p2wwl6wls2nxacirppr2147yz29whxmjaxy89ic1744";
  };
  fundamental-source = fetchFromGitHub {
    owner = "VCVRack";
    repo = "Fundamental";
-    rev = "v2.3.1"; # tip of branch v2
-    sha256 = "1rd5yvdr6k03mc3r2y7wxhmiqd69jfvqmpqagxb83y1mn0zfv0pr";
+    rev = "962547d7651260fb6a04f4d8aafd7c27f0221bee"; # tip of branch v2
+    sha256 = "066gcjkni8ba98vv0di59x3f9piir0vyy5sb53cqrbrl51x853cg";
  };
  vcv-rtaudio = stdenv.mkDerivation rec {
    pname = "vcv-rtaudio";
@ -115,7 +115,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "VCV-Rack";
-  version = "2.3.0";
+  version = "2.4.0";

  desktopItems = [
    (makeDesktopItem {
@ -135,7 +135,7 @@ stdenv.mkDerivation rec {
    owner = "VCVRack";
    repo = "Rack";
    rev = "v${version}";
-    sha256 = "1aj7pcvks1da5ydagyxsdksp31rf8dn0bixw55kn34k0g4ky5jiw";
+    sha256 = "0azrqyx5as4jmk9dxb7cj7x9dha81i0mm9pkvdv944qyccqwg55i";
  };

  patches = [
--- a/pkgs/applications/editors/vim/plugins/aliases.nix
+++ b/pkgs/applications/editors/vim/plugins/aliases.nix
@ -127,6 +127,7 @@ mapAliases (with prev; {
  tlib                = tlib_vim;
  tmux-navigator      = vim-tmux-navigator;
  tmuxNavigator       = vim-tmux-navigator; # backwards compat, added 2014-10-18
+  todo-nvim           = throw "todo-nvim has been removed: abandoned by upstream"; # Added 2023-08-23
  tslime              = tslime-vim;
  unite               = unite-vim;
  UltiSnips           = ultisnips;
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -9977,18 +9977,6 @@ final: prev:
    meta.homepage = "https://github.com/folke/todo-comments.nvim/";
  };

-  todo-nvim = buildVimPluginFrom2Nix {
-    pname = "todo.nvim";
-    version = "2022-02-23";
-    src = fetchFromGitHub {
-      owner = "AmeerTaweel";
-      repo = "todo.nvim";
-      rev = "6bd31dfd64b2730b33aad89423a1055c22fe276a";
-      sha256 = "1887d1bjzixrdinr857cqq4x84760scik04r9mz9zmwdf8nfgh6b";
-    };
-    meta.homepage = "https://github.com/AmeerTaweel/todo.nvim/";
-  };
-
  todo-txt-vim = buildVimPluginFrom2Nix {
    pname = "todo.txt-vim";
    version = "2021-03-20";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -837,7 +837,6 @@ https://github.com/wellle/tmux-complete.vim/,,
 https://github.com/aserowy/tmux.nvim/,HEAD,
 https://github.com/edkolev/tmuxline.vim/,,
 https://github.com/folke/todo-comments.nvim/,,
-https://github.com/AmeerTaweel/todo.nvim/,,
 https://github.com/freitass/todo.txt-vim/,,
 https://github.com/akinsho/toggleterm.nvim/,,
 https://github.com/folke/tokyonight.nvim/,,
@ -874,6 +873,7 @@ https://github.com/catppuccin/vim/,HEAD,catppuccin-vim
 https://github.com/inkarkat/vim-AdvancedSorters/,,vim-advanced-sorters
 https://github.com/Konfekt/vim-CtrlXA/,,
 https://github.com/konfekt/vim-DetectSpellLang/,,
+https://github.com/fadein/vim-figlet/,HEAD,
 https://github.com/dpelle/vim-LanguageTool/,,
 https://github.com/inkarkat/vim-ReplaceWithRegister/,,
 https://github.com/inkarkat/vim-ReplaceWithSameIndentRegister/,,
--- a/pkgs/applications/file-managers/browsr/default.nix
+++ b/pkgs/applications/file-managers/browsr/default.nix
@ -50,6 +50,7 @@ python3.pkgs.buildPythonApplication rec {

  pythonRelaxDeps = [
    "art"
+    "pandas"
    "pymupdf"
    "rich-click"
    "textual"
@ -70,6 +71,5 @@ python3.pkgs.buildPythonApplication rec {
    changelog = "https://github.com/juftin/browsr/releases/tag/${src.rev}";
    license = licenses.mit;
    maintainers = with maintainers; [ figsoda ];
-    broken = versionAtLeast python3.pkgs.pandas.version "2" || versionAtLeast python3.pkgs.pillow.version "10";
  };
 }
--- a/pkgs/applications/file-managers/llama/default.nix
+++ b/pkgs/applications/file-managers/llama/default.nix
@ -1,22 +0,0 @@
-{ buildGoModule, fetchFromGitHub, lib }:
-
-buildGoModule rec {
-  pname = "llama";
-  version = "1.4.0";
-
-  src = fetchFromGitHub {
-    owner = "antonmedv";
-    repo = "llama";
-    rev = "v${version}";
-    sha256 = "sha256-mJUxi2gqTMcodznCUDb2iB6j/p7bMUhhBLtZMbvfE1c=";
-  };
-
-  vendorHash = "sha256-nngto104p/qJpWM1NlmEqcrJThXSeCfcoXCzV1CClYQ=";
-
-  meta = with lib; {
-    description = "Terminal file manager";
-    homepage = "https://github.com/antonmedv/llama";
-    license = licenses.mit;
-    maintainers = with maintainers; [ portothree ];
-  };
-}
--- a/pkgs/applications/file-managers/walk/default.nix
+++ b/pkgs/applications/file-managers/walk/default.nix
@ -0,0 +1,23 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "walk";
+  version = "1.5.2";
+
+  src = fetchFromGitHub {
+    owner = "antonmedv";
+    repo = "walk";
+    rev = "v${version}";
+    hash = "sha256-lcXNGmDCXq73gAWFKHHsIb578b1EhznYaGC0myFQym8=";
+  };
+
+  vendorHash = "sha256-EYwfoTVcgV12xF/cv9O6QgXq9Gtc9qK9EmZNjXS4kC8=";
+
+  meta = with lib; {
+    description = "Terminal file manager";
+    homepage = "https://github.com/antonmedv/walk";
+    license = licenses.mit;
+    maintainers = with maintainers; [ portothree surfaceflinger ];
+    mainProgram = "walk";
+  };
+}
--- a/pkgs/applications/graphics/artem/default.nix
+++ b/pkgs/applications/graphics/artem/default.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "artem";
-  version = "2.0.0";
+  version = "2.0.1_2";

  src = fetchFromGitHub {
    owner = "finefindus";
-    repo = pname;
+    repo = "artem";
    rev = "v${version}";
-    hash = "sha256-liYZloaXN9doNyPO76iCaiZO9ZkNGBm+BxxNX87ZqBM=";
+    hash = "sha256-R7ouOFeLKnTZI6NbAg8SkkSo4zh9AwPiMPNqhPthpCk=";
  };

-  cargoHash = "sha256-fTAuh4jbfNpFaEu1X0LwVA30ghQ6mh5/Afap7gUjzMc=";
+  cargoHash = "sha256-sbIINbuIbu38NrYr87ljJJD7Y9Px0o6Qv/MGX8N54Rc=";

  nativeBuildInputs = [
    installShellFiles
@ -36,6 +36,11 @@ rustPlatform.buildRustPackage rec {
    "--skip=full_file_compare_html"
  ];

+  # Cargo.lock is outdated
+  postConfigure = ''
+    cargo metadata --offline
+  '';
+
  postInstall = ''
    installManPage $releaseDir/build/artem-*/out/artem.1
    installShellCompletion $releaseDir/build/artem-*/out/artem.{bash,fish} \
--- a/pkgs/applications/misc/free42/default.nix
+++ b/pkgs/applications/misc/free42/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "free42";
-  version = "3.0.20";
+  version = "3.0.21";

  src = fetchFromGitHub {
    owner = "thomasokken";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Dqrys7bAkSnpbOF0D17RDYi7q47ExlM75d5OOAnHCVU=";
+    hash = "sha256-zRO0buYfKtybUisWZJRkvLJVLJYZwLcDnT04rnQWy+s=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/kile-wl/default.nix
+++ b/pkgs/applications/misc/kile-wl/default.nix
@ -2,7 +2,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "kile-wl";
-  version = "unstable-2021-09-30";
+  version = "2.0";

  src = fetchFromGitLab {
    owner = "snakedye";
@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
    url = "https://gitlab.com/snakedye/kile.git";
  };

-  cargoSha256 = "sha256-W7rq42Pz+l4TSsR/h2teRTbl3A1zjOcIx6wqgnwyQNA=";
+  cargoSha256 = "sha256-xXliFNm9YDGsAATpMATui7f2IcfKCrB0B7O5dSYuBVQ=";

  nativeBuildInputs = [ scdoc ];

--- a/pkgs/applications/misc/openrgb-plugins/effects/default.nix
+++ b/pkgs/applications/misc/openrgb-plugins/effects/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , qtbase
 , openrgb
 , glib
@ -13,24 +12,16 @@

 stdenv.mkDerivation rec {
  pname = "openrgb-plugin-effects";
-  version = "0.8";
+  version = "0.9";

  src = fetchFromGitLab {
    owner = "OpenRGBDevelopers";
    repo = "OpenRGBEffectsPlugin";
    rev = "release_${version}";
-    hash = "sha256-2F6yeLWgR0wCwIj75+d1Vdk45osqYwRdenK21lcRoOg=";
+    hash = "sha256-8BnHifcFf7ESJgJi/q3ca38zuIVa++BoGlkWxj7gpog=";
    fetchSubmodules = true;
  };

-  patches = [
-    # Add install rule
-    (fetchpatch {
-      url = "https://gitlab.com/OpenRGBDevelopers/OpenRGBEffectsPlugin/-/commit/75f1b3617d9cabfb3b04a7afc75ce0c1b8514bc0.patch";
-      hash = "sha256-X+zMNE3OCZNmUb68S4683r/RbE+CDrI/Jv4BMWPI47E=";
-    })
-  ];
-
  postPatch = ''
    # Use the source of openrgb from nixpkgs instead of the submodule
    rm -r OpenRGB
--- a/pkgs/applications/misc/openrgb-plugins/hardwaresync/default.nix
+++ b/pkgs/applications/misc/openrgb-plugins/hardwaresync/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , qtbase
 , openrgb
 , glib
@ -14,28 +13,15 @@

 stdenv.mkDerivation rec {
  pname = "openrgb-plugin-hardwaresync";
-  version = "0.8";
+  version = "0.9";

  src = fetchFromGitLab {
    owner = "OpenRGBDevelopers";
    repo = "OpenRGBHardwareSyncPlugin";
    rev = "release_${version}";
-    hash = "sha256-P+IitP8pQLUkBdMfcNw4fOggqyFfg6lNlnSfUGjddzo=";
+    hash = "sha256-3sQFiqmXhuavce/6v3XBpp6PAduY7t440nXfbfCX9a0=";
  };

-  patches = [
-    (fetchpatch {
-      name = "use-pkgconfig";
-      url = "https://gitlab.com/OpenRGBDevelopers/OpenRGBHardwareSyncPlugin/-/commit/df2869d679ea43119fb9b174cd0b2cb152022685.patch";
-      hash = "sha256-oBtrHwpvB8Z3xYi4ucDSuw+5WijPEbgBW7vLGELFjfw=";
-    })
-    (fetchpatch {
-      name = "add-install-rule";
-      url = "https://gitlab.com/OpenRGBDevelopers/OpenRGBHardwareSyncPlugin/-/commit/bfbaa0a32ed05112e0cc8b6b2a8229945596e522.patch";
-      hash = "sha256-76UMMzeXnyQRCEE1tGPNR5XSHTT480rQDnJ9hWhfIqY=";
-    })
-  ];
-
  postPatch = ''
    # Use the source of openrgb from nixpkgs instead of the submodule
    rmdir OpenRGB
--- a/pkgs/applications/misc/openrgb/default.nix
+++ b/pkgs/applications/misc/openrgb/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "openrgb";
-  version = "0.8";
+  version = "0.9";

  src = fetchFromGitLab {
    owner = "CalcProgrammer1";
    repo = "OpenRGB";
    rev = "release_${version}";
-    sha256 = "sha256-46dL1D5oVlw6mNuFDCbbrUDmq42yFXV/qFJ1JnPT5/s=";
+    sha256 = "sha256-XBLj4EfupyeVHRc0pVI7hrXFoCNJ7ak2yO0QSfhBsGU=";
  };

  nativeBuildInputs = [ qmake pkg-config wrapQtAppsHook ];
--- a/pkgs/applications/misc/tomato-c/default.nix
+++ b/pkgs/applications/misc/tomato-c/default.nix
@ -0,0 +1,67 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, libnotify
+, makeWrapper
+, mpv
+, ncurses
+, pkg-config
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tomato-c";
+  version = "unstable-2023-08-21";
+
+  src = fetchFromGitHub {
+    owner = "gabrielzschmitz";
+    repo = "Tomato.C";
+    rev = "6e43e85aa15f3d96811311a3950eba8ce9715634";
+    hash = "sha256-RpKkQ7xhM2XqfZdXra0ju0cTBL3Al9NMVQ/oleFydDs=";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace "sudo " ""
+    substituteInPlace notify.c \
+      --replace "/usr/local" "${placeholder "out"}"
+    substituteInPlace util.c \
+      --replace "/usr/local" "${placeholder "out"}"
+    substituteInPlace tomato.desktop \
+      --replace "/usr/local" "${placeholder "out"}"
+  '';
+
+  nativeBuildInputs = [
+    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [
+    libnotify
+    mpv
+    ncurses
+  ];
+
+  installFlags = [
+    "PREFIX=${placeholder "out"}"
+    "CPPFLAGS=$NIX_CFLAGS_COMPILE"
+    "LDFLAGS=$NIX_LDFLAGS"
+  ];
+
+  postFixup = ''
+    for file in $out/bin/*; do
+      wrapProgram $file \
+        --prefix PATH : ${lib.makeBinPath [ libnotify mpv ]}
+    done
+  '';
+
+  strictDeps = true;
+
+  meta = {
+    homepage = "https://github.com/gabrielzschmitz/Tomato.C";
+    description = " A pomodoro timer written in pure C";
+    license = with lib.licenses; [ gpl3Plus ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    mainProgram = "tomato";
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/applications/misc/uni/default.nix
+++ b/pkgs/applications/misc/uni/default.nix
@ -1,4 +1,7 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:

 buildGoModule rec {
  pname = "uni";
@ -7,17 +10,22 @@ buildGoModule rec {
  src = fetchFromGitHub {
    owner = "arp242";
    repo = "uni";
-    rev = "v${version}";
-    sha256 = "kWiglMuJdcD7z2MDfz1MbItB8r9BJ7LUqfPfJa8QkLA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kWiglMuJdcD7z2MDfz1MbItB8r9BJ7LUqfPfJa8QkLA=";
  };

-  vendorSha256 = "6HNFCUSJA6oduCx/SCUQQeCHGS7ohaWRunixdwMurBw=";
+  vendorHash = "sha256-6HNFCUSJA6oduCx/SCUQQeCHGS7ohaWRunixdwMurBw=";

-  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${version}"
+  ];

  meta = with lib; {
    homepage = "https://github.com/arp242/uni";
    description = "Query the Unicode database from the commandline, with good support for emojis";
+    changelog = "https://github.com/arp242/uni/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ chvp ];
  };
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@ -59,6 +59,9 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

+  # https://github.com/NixOS/nixpkgs/issues/245534
+  hardeningDisable = [ "fortify" ];
+
  meta = with lib; {
    description = "Monero (XMR) CPU miner";
    homepage = "https://github.com/xmrig/xmrig";
--- a/pkgs/applications/networking/avalanchego/default.nix
+++ b/pkgs/applications/networking/avalanchego/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "avalanchego";
-  version = "1.10.5";
+  version = "1.10.8";

  src = fetchFromGitHub {
    owner = "ava-labs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-mGie45sIvl8BjBB4JJF/U/OJ7naT6iWjo3l50qZvyaY=";
+    hash = "sha256-1SD+0WkqFGInrFtVmXHz3FuOso7rooeCPMAq9eFOSDg=";
  };

-  vendorHash = "sha256-/pNXCRHtoaJvgYsSMyYB05IKH4wG7hTlEHjuoOuifQ0=";
+  vendorHash = "sha256-7O1ENOZUkt0NPXk0KK+ydbeLB9ht17jBSH+/cmpOg8U=";
  # go mod vendor has a bug, see: https://github.com/golang/go/issues/57529
  proxyVendor = true;

@ -40,6 +40,6 @@ buildGoModule rec {
    homepage = "https://github.com/ava-labs/avalanchego";
    changelog = "https://github.com/ava-labs/avalanchego/releases/tag/v${version}";
    license = licenses.bsd3;
-    maintainers = with maintainers; [ urandom ];
+    maintainers = with maintainers; [ urandom qjoly ];
  };
 }
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@ -7,20 +7,20 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.9.26";
+  version = "0.9.27";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    hash = "sha256-difvEmFfwH7+d2qAcNwTcydP0WHDvHkOSXilaWLrHoM=";
+    hash = "sha256-PVnUfDUj2CazmvNZbRuHUIiP6Ta+3x6aeDSowgzAhiU=";
  };

  CGO_ENABLED = 0;

  nativeBuildInputs = [ installShellFiles ];

-  vendorHash = "sha256-bWiBY3Bo/FpipUHhbsbPNLKxvJF7L0tpuPi0Cb0firU=";
+  vendorHash = "sha256-uByv18e9fLALWoXc8hD4HGv8DFRJejCyzD8tjU5FQn0=";

  # Exclude pkg/get: tests downloading of binaries which fail when sandbox=true
  subPackages = [
--- a/pkgs/applications/networking/cluster/kns/default.nix
+++ b/pkgs/applications/networking/cluster/kns/default.nix
@ -0,0 +1,38 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+, fzf
+, kubectl
+}:
+stdenvNoCC.mkDerivation {
+  pname = "kns";
+  version = "unstable-2023-04-25";
+
+  src = fetchFromGitHub {
+    owner = "blendle";
+    repo = "kns";
+    rev = "86502949c31432bd95895cfb26d1c5893c533d5c";
+    hash = "sha256-8AR/fEKPAfiKCZrp/AyJo3Ic8dH7SfncYZSdQA2GywQ=";
+  };
+
+  strictDeps = true;
+
+  buildInputs = [ fzf kubectl ];
+
+  installPhase = ''
+    runHook preInstall
+
+    substituteInPlace bin/kns bin/ktx --replace fzf ${fzf}/bin/fzf --replace kubectl ${kubectl}/bin/kubectl
+    install -D -m755 -t $out/bin bin/kns bin/ktx
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Kubernetes namespace switcher";
+    homepage = "https://github.com/blendle/kns";
+    license = licenses.isc;
+    maintainers = with maintainers; [ mmlb ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/networking/cluster/kubecfg/default.nix
+++ b/pkgs/applications/networking/cluster/kubecfg/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "kubecfg";
-  version = "0.32.0";
+  version = "0.33.0";

  src = fetchFromGitHub {
    owner = "kubecfg";
    repo = "kubecfg";
    rev = "v${version}";
-    hash = "sha256-qjXc/2QY0PukvhiudukZGhBkovQMutsLg3Juxg1mgTc=";
+    hash = "sha256-a/2qKiqn9en67uJD/jzU3G1k6gT73DTzjY32mi51xSQ=";
  };

-  vendorHash = "sha256-9kVFOEMFjix2WRwGi0jWHPagzXkISucGHmd88vcBJfk=";
+  vendorHash = "sha256-mSYc12pjx34PhMx7jbKD/nPhPaK7jINmUSWxomikx7U=";

  ldflags = [
    "-s"
@ -36,6 +36,6 @@ buildGoModule rec {
    homepage = "https://github.com/kubecfg/kubecfg";
    changelog = "https://github.com/kubecfg/kubecfg/releases/tag/v${version}";
    license = licenses.asl20;
-    maintainers = with maintainers; [ benley ];
+    maintainers = with maintainers; [ benley qjoly ];
  };
 }
--- a/pkgs/applications/networking/cluster/rke2/default.nix
+++ b/pkgs/applications/networking/cluster/rke2/default.nix
@ -35,5 +35,6 @@ buildGoModule rec {
    changelog = "https://github.com/rancher/rke2/releases/tag/v${version}";
    license = licenses.asl20;
    maintainers = with maintainers; [ zimbatm zygot ];
+    mainProgram = "rke2";
  };
 }
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -28,13 +28,13 @@
    "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
  },
  "aiven": {
-    "hash": "sha256-T9d1iMuFqewDVK4EOsF4uCsqZAsThMHaRa7ilGnYXCo=",
+    "hash": "sha256-Nm5flY+BN9PpQY+4LyohFwDfdEPxfVpT/rkfn8aLQyI=",
    "homepage": "https://registry.terraform.io/providers/aiven/aiven",
    "owner": "aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v4.7.0",
+    "rev": "v4.8.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-Fcu4RWgbVyAUr72h8q91HT+LbUh9+4SPDz8Vc4/u5RM="
+    "vendorHash": "sha256-eScN0by/rnCf4+p4g3yhz2kJRyfFyqlVi+0MJXPdzKw="
  },
  "akamai": {
    "hash": "sha256-LGgZF2/YCYpoDOSu0UeuPqK9wGXrvPQE4WUGGS0sx30=",
@ -182,13 +182,13 @@
    "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
  },
  "buildkite": {
-    "hash": "sha256-rcklWodBh5iJjxIjGhEH0l3S9bXUWfBG52V/23o8JDM=",
+    "hash": "sha256-nDJ4XsWvielQYqShBav7g/pZyDcU0jqgemXUqaNJHnA=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v0.24.0",
+    "rev": "v0.25.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-3BtXtXhFyTNQD0J/5hNi0JsPcaIDWUQNEgf6r0VIfMM="
+    "vendorHash": "sha256-C/jT+vcZat8UHXgOhtj+gyl8ttCEb564byp/npI2Ei8="
  },
  "checkly": {
    "hash": "sha256-tOTrAi6hd4HFbHAj0p/LTYdxQl1R1WuQ9L4hzqmDVqI=",
@ -445,13 +445,13 @@
    "vendorHash": null
  },
  "gitlab": {
-    "hash": "sha256-uKImp0kcsLZL1SOAygd/ssJ7pxclUbAcDcEB3ko9Mio=",
+    "hash": "sha256-91hv73KEer3FyS9FWoQ0gV1VwRKZqAu/6fAughmX5D0=",
    "homepage": "https://registry.terraform.io/providers/gitlabhq/gitlab",
    "owner": "gitlabhq",
    "repo": "terraform-provider-gitlab",
-    "rev": "v16.2.0",
+    "rev": "v16.3.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-AVTWTS16d8QsPLLAJeAfgcVDzUBMp+b2oAphaCBqhS0="
+    "vendorHash": "sha256-G7+3vqxdi4i21o1hYj2GVvoCdcmFN3ue1i4fuepucsw="
  },
  "google": {
    "hash": "sha256-tfjrVWj+l9mNdgZ+unu4NW15OAOzViTVmSTzO/ZiqRE=",
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -6,7 +6,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.9.3";
+  version = "3.9.4";
  format = "pyproject";

  # Fetch from GitHub in order to use `requirements.in`
@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "Flexget";
    repo = "Flexget";
    rev = "refs/tags/v${version}";
-    hash = "sha256-IP6rVOrhIWrEWqrA0BCthAbCD2pRNnDzvY7bP4ANTCc=";
+    hash = "sha256-cdmW0VSWjr3rm/1T0uDy1iPm3ojR5wrgRixyjIQhodU=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
+++ b/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
@ -12,17 +12,18 @@
 , dbus-python
 , pyxdg
 , python-olm
+, emoji
 }:

 buildPythonApplication rec {
  pname = "matrix-commander";
-  version = "6.0.1";
+  version = "7.2.0";

  src = fetchFromGitHub {
    owner = "8go";
    repo = "matrix-commander";
    rev = "v${version}";
-    sha256 = "sha256-NSoMGUQjy4TQXdzZcQfO2rUQDsuSzQnoGDpqFiLQHVQ=";
+    hash = "sha256-qL6ARkAWu0FEuYK2e9Z9hMSfK4TW0kGgoIFUfJ8Dgwk=";
  };

  format = "pyproject";
@ -49,6 +50,7 @@ buildPythonApplication rec {
    dbus-python
    pyxdg
    python-olm
+    emoji
  ] ++ matrix-nio.optional-dependencies.e2e;

  meta = with lib; {
--- a/pkgs/applications/science/astronomy/gildas/default.nix
+++ b/pkgs/applications/science/astronomy/gildas/default.nix
@ -7,8 +7,8 @@ let
 in

 stdenv.mkDerivation rec {
-  srcVersion = "feb23a";
-  version = "20230201_a";
+  srcVersion = "aug23a";
+  version = "20230801_a";
  pname = "gildas";

  src = fetchurl {
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    # source code of the previous release to a different directory
    urls = [ "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.xz"
      "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.xz" ];
-    sha256 = "sha256-A6jtcC8QMtJ7YcNaPiOjwNPDGPAjmRA3jZLEt5iBONE=";
+    sha256 = "sha256-jlyv2K1V+510C4uLek4oofm13d40nGJ46wqjW+tjfq4=";
  };

  nativeBuildInputs = [ pkg-config groff perl getopt gfortran which ];
@ -38,14 +38,15 @@ stdenv.mkDerivation rec {
    echo "gag_doc:        $out/share/doc/" >> kernel/etc/gag.dico.lcl
  '';

+  userExec = "astro class greg imager mapping sic";
+
  postInstall=''
    mkdir -p $out/bin
    cp -a ../gildas-exe-${srcVersion}/* $out
    mv $out/$GAG_EXEC_SYSTEM $out/libexec
-    cp admin/wrapper.sh $out/bin/gildas-wrapper.sh
-    chmod 755 $out/bin/gildas-wrapper.sh
-    for i in $out/libexec/bin/* ; do
-      ln -s $out/bin/gildas-wrapper.sh $out/bin/$(basename "$i")
+    for i in ${userExec} ; do
+      cp admin/wrapper.sh $out/bin/$i
+      chmod 755 $out/bin/$i
    done
  '';

--- a/pkgs/applications/science/chemistry/ergoscf/default.nix
+++ b/pkgs/applications/science/chemistry/ergoscf/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ergoscf";
-  version = "3.8";
+  version = "3.8.2";

  src = fetchurl {
    url = "http://www.ergoscf.org/source/tarfiles/ergo-${version}.tar.gz";
-    sha256 = "1s50k2gfs3y6r5kddifn4p0wmj0yk85wm5vf9v3swm1c0h43riix";
+    sha256 = "sha256-U0NVREEZ8HI0Q0ZcbwvZsYA76PWMh7bqgDG1uaUc01c=";
  };

  buildInputs = [ blas lapack ];
--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "cbmc";
-  version = "5.89.0";
+  version = "5.90.0";

  src = fetchFromGitHub {
    owner = "diffblue";
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "sha256-pgZdR1X0aOCfCKAGo2h9bAIO2XTTiWL8ERgandOQj/M=";
+    sha256 = "sha256-c6Ms/IStmKug5nz37TzjeexkY3YfWaUqEKIC2viMK9g=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -103,6 +103,13 @@ stdenv.mkDerivation rec {
      url = "https://github.com/sagemath/sage/commit/1a1b49f814cdf4c4c8d0ac8930610f3fef6af5b0.diff";
      sha256 = "sha256-GqMgoi0tsP7zcCcPumhdsbvhPB6fgw1ufx6gHlc6iSc=";
    })
+
+    # https://github.com/sagemath/sage/pull/36006, positively reviewed
+    (fetchpatch {
+      name = "gmp-6.3-upgrade.patch";
+      url = "https://github.com/sagemath/sage/commit/d88bc3815c0901bfdeaa3e4a31107c084199f614.diff";
+      sha256 = "sha256-dXaEwk2wXxmx02sCw4Vu9mF0ZrydhFD4LRwNAiQsPgM=";
+    })
  ];

  patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
--- a/pkgs/applications/version-management/forgejo/default.nix
+++ b/pkgs/applications/version-management/forgejo/default.nix
@ -39,17 +39,17 @@ let
 in
 buildGoModule rec {
  pname = "forgejo";
-  version = "1.20.2-0";
+  version = "1.20.3-0";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "forgejo";
    repo = "forgejo";
    rev = "v${version}";
-    hash = "sha256-8mFI5Zt2J6EQZqu/qcirFp8WMz+IlrkvHeA+oUb0X5U=";
+    hash = "sha256-pMmP9JJHbaqkHHgtZf2ZgEtXsX97EV0VXiTPT7Lf4P8=";
  };

-  vendorHash = "sha256-ZoFs2T3NNixrbTDdp7fqTgjJ+G8DpkxHW8K6BM8tZ9w=";
+  vendorHash = "sha256-dgtZjsLBwblhdge3BvdbK/mN/TeZKps9K5dJbqomtjo=";

  subPackages = [ "." ];

--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -37,6 +37,7 @@
 , nixosTestRunner ? false
 , doCheck ? false
 , qemu  # for passthru.tests
+, gitUpdater
 }:

 let
@ -48,11 +49,11 @@ stdenv.mkDerivation rec {
    + lib.optionalString xenSupport "-xen"
    + lib.optionalString hostCpuOnly "-host-cpu-only"
    + lib.optionalString nixosTestRunner "-for-vm-tests";
-  version = "8.0.3";
+  version = "8.0.4";

  src = fetchurl {
    url = "https://download.qemu.org/qemu-${version}.tar.xz";
-    hash = "sha256-7PTTLL7505e/yMxQ5NHpKhswJTvzLo7nPHqNz5ojKwk=";
+    hash = "sha256-gcgX3aOK+Vi+W+8abPVbZYuy0/uHwealcd5reyxEUWw=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ]
@ -249,6 +250,12 @@ stdenv.mkDerivation rec {
    tests = {
      qemu-tests = qemu.override { doCheck = true; };
    };
+    updateScript = gitUpdater {
+      # No nicer place to find latest release.
+      url = "https://gitlab.com/qemu-project/qemu.git";
+      rev-prefix = "v";
+      ignoredVersions = "(alpha|beta|rc).*";
+    };
  };

  # Builds in ~3h with 2 cores, and ~20m with a big-parallel builder.
--- a/pkgs/build-support/dotnet/build-dotnet-global-tool/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-global-tool/default.nix
@ -32,7 +32,7 @@ buildDotnetModule (args // {

  useDotnetFromEnv = true;

-  dontBuld = true;
+  dontBuild = true;

  installPhase = ''
    runHook preInstall
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix
@ -83,6 +83,7 @@ in
        shell = stdenv.shell;
        which = "${which}/bin/which";
        dirname = "${coreutils}/bin/dirname";
+        realpath = "${coreutils}/bin/realpath";
      };
    } ./dotnet-fixup-hook.sh) { };
 }
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh
@ -10,7 +10,7 @@ wrapDotnetProgram() {
    if [ ! "${selfContainedBuild-}" ]; then
        if [ "${useDotnetFromEnv-}" ]; then
            # if dotnet CLI is available, set DOTNET_ROOT based on it. Otherwise set to default .NET runtime
-            dotnetRootFlags+=("--run" 'command -v dotnet &>/dev/null && export DOTNET_ROOT="$(@dirname@ "$(@dirname@ "$(@which@ dotnet)")")" || export DOTNET_ROOT="@dotnetRuntime@"')
+            dotnetRootFlags+=("--run" 'command -v dotnet &>/dev/null && export DOTNET_ROOT="$(@dirname@ "$(@realpath@ "$(@which@ dotnet)")")" || export DOTNET_ROOT="@dotnetRuntime@"')
            dotnetRootFlags+=("--suffix" "PATH" ":" "@dotnetRuntime@/bin")
        else
            dotnetRootFlags+=("--set" "DOTNET_ROOT" "@dotnetRuntime@")
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@ -132,6 +132,13 @@ let
    else throw "fetchurl requires a hash for fixed-output derivation: ${lib.concatStringsSep ", " urls_}";
 in

+assert (lib.isList curlOpts) -> lib.warn ''
+    fetchurl for ${toString (builtins.head urls_)}: curlOpts is a list (${lib.generators.toPretty { multiline = false; } curlOpts}), which is not supported anymore.
+    - If you wish to get the same effect as before, for elements with spaces (even if escaped) to expand to multiple curl arguments, use a string argument instead:
+      curlOpts = ${lib.strings.escapeNixString (toString curlOpts)};
+    - If you wish for each list element to be passed as a separate curl argument, allowing arguments to contain spaces, use curlOptsList instead:
+      curlOptsList = [ ${lib.concatMapStringsSep " " lib.strings.escapeNixString curlOpts} ];'' true;
+
 stdenvNoCC.mkDerivation ((
  if (pname != "" && version != "") then
    { inherit pname version; }
@ -161,12 +168,7 @@ stdenvNoCC.mkDerivation ((

  outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";

-  curlOpts = lib.warnIf (lib.isList curlOpts) ''
-    fetchurl for ${toString (builtins.head urls_)}: curlOpts is a list (${lib.generators.toPretty { multiline = false; } curlOpts}), which is not supported anymore.
-    - If you wish to get the same effect as before, for elements with spaces (even if escaped) to expand to multiple curl arguments, use a string argument instead:
-      curlOpts = ${lib.strings.escapeNixString (toString curlOpts)};
-    - If you wish for each list element to be passed as a separate curl argument, allowing arguments to contain spaces, use curlOptsList instead:
-      curlOptsList = [ ${lib.concatMapStringsSep " " lib.strings.escapeNixString curlOpts} ];'' curlOpts;
+  inherit curlOpts;
  curlOptsList = lib.escapeShellArgs curlOptsList;
  inherit showURLs mirrorsFile postFetch downloadToTemp executable;

--- a/pkgs/build-support/fetchzip/default.nix
+++ b/pkgs/build-support/fetchzip/default.nix
@ -7,41 +7,34 @@

 { lib, fetchurl, unzip, glibcLocalesUtf8 }:

-{ # Optionally move the contents of the unpacked tree up one level.
-  stripRoot ? true
+{ name ? "source"
 , url ? ""
 , urls ? []
-, extraPostFetch ? ""
+, nativeBuildInputs ? []
 , postFetch ? ""
-, name ? "source"
-, pname ? ""
-, version ? ""
-, nativeBuildInputs ? [ ]
-, # Allows to set the extension for the intermediate downloaded
-  # file. This can be used as a hint for the unpackCmdHooks to select
-  # an appropriate unpacking tool.
-  extension ? null
+, extraPostFetch ? ""
+
+# Optionally move the contents of the unpacked tree up one level.
+, stripRoot ? true
+# Allows to set the extension for the intermediate downloaded
+# file. This can be used as a hint for the unpackCmdHooks to select
+# an appropriate unpacking tool.
+, extension ? null
+
+# the rest are given to fetchurl as is
 , ... } @ args:

+assert (extraPostFetch != "") -> lib.warn "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub'." true;

-lib.warnIf (extraPostFetch != "") "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub'."
-
-(let
+let
  tmpFilename =
    if extension != null
    then "download.${extension}"
    else baseNameOf (if url != "" then url else builtins.head urls);
 in

-fetchurl ((
-  if (pname != "" && version != "") then
-    {
-      name = "${pname}-${version}";
-      inherit pname version;
-    }
-  else
-    { inherit name; }
-) // {
+fetchurl ({
+  inherit name;
  recursiveHash = true;

  downloadToTemp = true;
@ -61,8 +54,7 @@ fetchurl ((
      mv "$downloadedFile" "$renamed"
      unpackFile "$renamed"
      chmod -R +w "$unpackDir"
-    ''
-    + (if stripRoot then ''
+    '' + (if stripRoot then ''
      if [ $(ls -A "$unpackDir" | wc -l) != 1 ]; then
        echo "error: zip file must contain a single file or directory."
        echo "hint: Pass stripRoot=false; to fetchzip to assume flat list of files."
@ -75,16 +67,11 @@ fetchurl ((
      mv "$unpackDir/$fn" "$out"
    '' else ''
      mv "$unpackDir" "$out"
-    '')
-    + ''
+    '') + ''
      ${postFetch}
-    '' + ''
      ${extraPostFetch}
-    ''
-
-    # Remove non-owner write permissions
-    # Fixes https://github.com/NixOS/nixpkgs/issues/38649
-    + ''
      chmod 755 "$out"
    '';
-} // removeAttrs args [ "stripRoot" "extraPostFetch" "postFetch" "extension" "nativeBuildInputs" ]))
+    # ^ Remove non-owner write permissions
+    # Fixes https://github.com/NixOS/nixpkgs/issues/38649
+} // removeAttrs args [ "stripRoot" "extraPostFetch" "postFetch" "extension" "nativeBuildInputs" ])
--- a/pkgs/data/fonts/sketchybar-app-font/default.nix
+++ b/pkgs/data/fonts/sketchybar-app-font/default.nix
@ -5,11 +5,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "sketchybar-app-font";
-  version = "1.0.13";
+  version = "1.0.14";

  src = fetchurl {
    url = "https://github.com/kvndrsslr/sketchybar-app-font/releases/download/v${finalAttrs.version}/sketchybar-app-font.ttf";
-    hash = "sha256-vlvSrN6yxabKnzPmqI9VNkOdR3yLa1QUieZjOOW6w3c=";
+    hash = "sha256-GPxNMlG6a7newSXorh2RULZ5XHYFmQbcB46C0RytTTU=";
  };

  dontUnpack = true;
--- a/pkgs/data/misc/ddccontrol-db/default.nix
+++ b/pkgs/data/misc/ddccontrol-db/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "ddccontrol-db";
-  version = "20230627";
+  version = "20230727";

  src = fetchFromGitHub {
    owner = "ddccontrol";
    repo = pname;
    rev = version;
-    sha256 = "sha256-gRkYoDDD3QCsfZcpIqNAZBAb/si975vyd0NnlWNHob8=";
+    sha256 = "sha256-TRbFwaYRVHgg7dyg/OFPFkZ9nZ747zaNhnnfMljSOOE=";
  };

  nativeBuildInputs = [ autoreconfHook intltool ];
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@ -3,12 +3,12 @@
 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-domain-list-community";
-    version = "20230810162343";
+    version = "20230815132423";
    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "domain-list-community";
      rev = version;
-      hash = "sha256-RzYFpbiy0ajOjyu9Fdw+aJX9cLbquXzfWiLPaszyxOY=";
+      hash = "sha256-rz7oxcmIQJ9cM7KbQ+zBcBmggGhhhGFad9k0hGLgVgY=";
    };
    vendorHash = "sha256-dYaGR5ZBORANKAYuPAi9i+KQn2OAGDGTZxdyVjkcVi8=";
    meta = with lib; {
--- a/pkgs/desktops/deepin/apps/deepin-camera/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-camera/default.nix
@ -22,13 +22,13 @@

 stdenv.mkDerivation rec {
  pname = "deepin-camera";
-  version = "1.4.13";
+  version = "6.0.2";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    sha256 = "sha256-h4oCxtj9GwaZqioZ4vFx2Cq8a1w7lYQvOhDAd7x9gMU=";
+    hash = "sha256-GQQFwlJNfdsi0GvDRMIorUnlbXrgbYl9H9aBedOm+ZQ=";
  };

  # QLibrary and dlopen work with LD_LIBRARY_PATH
@ -66,7 +66,6 @@ stdenv.mkDerivation rec {
    gstreamer
    gst-plugins-base
    gst-plugins-good
-    gst-plugins-bad
  ]);

  cmakeFlags = [ "-DVERSION=${version}" ];
--- a/pkgs/desktops/deepin/apps/deepin-camera/dont_use_libPath.diff
+++ b/pkgs/desktops/deepin/apps/deepin-camera/dont_use_libPath.diff
@ -1,25 +1,24 @@
+diff --git a/src/src/gstvideowriter.cpp b/src/src/gstvideowriter.cpp
+index c96c8b0..fcc11da 100644
+--- a/src/src/gstvideowriter.cpp
+++ b/src/src/gstvideowriter.cpp
+@@ -282,6 +282,7 @@ void GstVideoWriter::loadAppSrcCaps()
+ 
+ QString GstVideoWriter::libPath(const QString &strlib)
+ {
+    return strlib;
+     QDir  dir;
+     QString path  = QLibraryInfo::location(QLibraryInfo::LibrariesPath);
+     dir.setPath(path);
 diff --git a/src/src/mainwindow.cpp b/src/src/mainwindow.cpp
-index d3c6f5c..4817446 100644
+index d3c6c24..6d313a6 100644
 --- a/src/src/mainwindow.cpp
 +++ b/src/src/mainwindow.cpp
-@@ -781,19 +781,7 @@ void CMainWindow::slotPopupSettingsDialog()
+@@ -784,6 +784,7 @@ void CMainWindow::slotPopupSettingsDialog()
 
 QString CMainWindow::libPath(const QString &strlib)
 {
-    QDir  dir;
-    QString path  = QLibraryInfo::location(QLibraryInfo::LibrariesPath);
-    dir.setPath(path);
-    QStringList list = dir.entryList(QStringList() << (strlib + "*"), QDir::NoDotAndDotDot | QDir::Files); //filter name with strlib
-
-    if (list.contains(strlib))
-        return strlib;
-
-    list.sort();
-    if (list.size() > 0)
-        return list.last();
-
-    return "";
 +    return strlib;
- }
- 
- void CMainWindow::reflushSnapshotLabel()
+     QDir  dir;
+     QString path  = QLibraryInfo::location(QLibraryInfo::LibrariesPath);
+     dir.setPath(path);
--- a/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
@ -1,17 +1,38 @@
-{ lib, mkXfceDerivation, gtk3, libxfce4ui, vte, xfconf, pcre2, libxslt, docbook_xml_dtd_45, docbook_xsl, nixosTests }:
+{ lib
+, mkXfceDerivation
+, glib
+, gtk3
+, libxfce4ui
+, vte
+, xfconf
+, pcre2
+, libxslt
+, docbook_xml_dtd_45
+, docbook_xsl
+, nixosTests
+}:

 mkXfceDerivation {
  category = "apps";
  pname = "xfce4-terminal";
-  version = "1.0.4";
+  version = "1.1.0";

-  sha256 = "sha256-eCb6KB9fFPuYzNLUm/yYrh+0D60ISzasnv/myStImEI=";
+  sha256 = "sha256-ilxiP1Org5/uSQOzfRgODmouH0BmK3CmCJj1kutNuII=";

-  nativeBuildInputs = [ libxslt docbook_xml_dtd_45 docbook_xsl ];
+  nativeBuildInputs = [
+    libxslt
+    docbook_xml_dtd_45
+    docbook_xsl
+  ];

-  buildInputs = [ gtk3 libxfce4ui vte xfconf pcre2 ];
-
-  env.NIX_CFLAGS_COMPILE = "-I${libxfce4ui.dev}/include/xfce4";
+  buildInputs = [
+    glib
+    gtk3
+    libxfce4ui
+    vte
+    xfconf
+    pcre2
+  ];

  passthru.tests.test = nixosTests.terminal-emulators.xfce4-terminal;

--- a/pkgs/development/compilers/assemblyscript/default.nix
+++ b/pkgs/development/compilers/assemblyscript/default.nix
@ -5,13 +5,13 @@

 buildNpmPackage rec {
  pname = "assemblyscript";
-  version = "0.27.8";
+  version = "0.27.9";

  src = fetchFromGitHub {
    owner = "AssemblyScript";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-EwpIUD9+IjJlWOnUEXgvx60i59ftQyHcPTQVWVoOGNQ=";
+    sha256 = "sha256-UOMWUM1wOhX2pR29DSYpPKLnjb1CWrKk6BtyXK7kqDk=";
  };

  npmDepsHash = "sha256-9ILa1qY2GpP2RckcZYcCMmgCwdXIImOm+D8nldeoQL8=";
--- a/pkgs/development/compilers/dotnet/combine-packages.nix
+++ b/pkgs/development/compilers/dotnet/combine-packages.nix
@ -17,16 +17,11 @@ assert lib.assertMsg ((builtins.length dotnetPackages) > 0)
    paths = dotnetPackages;
    pathsToLink = [ "/host" "/packs" "/sdk" "/sdk-manifests" "/shared" "/templates" ];
    ignoreCollisions = true;
-    nativeBuildInputs = [
-      makeWrapper
-    ];
    postBuild = ''
      cp -R ${cli}/{dotnet,share,nix-support} $out/

      mkdir $out/bin
      ln -s $out/dotnet $out/bin/dotnet
-      wrapProgram $out/bin/dotnet \
-        --prefix LD_LIBRARY_PATH : ${cli.icu}/lib
    '';
    passthru = {
      inherit (cli) icu;
--- a/pkgs/development/compilers/gnat-bootstrap/default.nix
+++ b/pkgs/development/compilers/gnat-bootstrap/default.nix
@ -5,17 +5,22 @@

 let
  throwUnsupportedSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
-
-  versionMap = rec {
+in
+stdenv.mkDerivation(finalAttrs:
+  let versionMap =
+    let url = "https://github.com/alire-project/GNAT-FSF-builds/releases/download/gnat-${finalAttrs.version}/gnat-${stdenv.hostPlatform.system}-${finalAttrs.version}.tar.gz";
+    in {
    "11" = {
      gccVersion = "11.2.0";
      alireRevision = "4";
    } // {
      x86_64-darwin = {
+        inherit url;
        hash = "sha256-FmBgD20PPQlX/ddhJliCTb/PRmKxe9z7TFPa2/SK4GY=";
        upstreamTriplet = "x86_64-apple-darwin19.6.0";
      };
      x86_64-linux = {
+        inherit url;
        hash = "sha256-8fMBJp6igH+Md5jE4LMubDmC4GLt4A+bZG/Xcz2LAJQ=";
        upstreamTriplet = "x86_64-pc-linux-gnu";
      };
@ -25,27 +30,26 @@ let
      alireRevision = "2";
    } // {
      x86_64-darwin = {
+        inherit url;
        hash = "sha256-zrcVFvFZMlGUtkG0p1wST6kGInRI64Icdsvkcf25yVs=";
        upstreamTriplet = "x86_64-apple-darwin19.6.0";
      };
      x86_64-linux = {
+        inherit url;
        hash = "sha256-EPDPOOjWJnJsUM7GGxj20/PXumjfLoMIEFX1EDtvWVY=";
        upstreamTriplet = "x86_64-pc-linux-gnu";
      };
    }.${stdenv.hostPlatform.system} or throwUnsupportedSystem;
  };
-
-in with versionMap.${majorVersion};
-
-stdenv.mkDerivation rec {
+  inherit (versionMap.${majorVersion}) gccVersion alireRevision upstreamTriplet;
+in {
  pname = "gnat-bootstrap";
-  inherit gccVersion alireRevision;
+  inherit (versionMap.${majorVersion}) gccVersion alireRevision;

-  version = "${gccVersion}-${alireRevision}";
+  version = "${gccVersion}${lib.optionalString (alireRevision!="") "-"}${alireRevision}";

  src = fetchzip {
-    url = "https://github.com/alire-project/GNAT-FSF-builds/releases/download/gnat-${version}/gnat-${stdenv.hostPlatform.system}-${version}.tar.gz";
-    inherit hash;
+    inherit (versionMap.${majorVersion}) url hash;
  };

  nativeBuildInputs = [
@ -142,4 +146,4 @@ stdenv.mkDerivation rec {
    platforms = [ "x86_64-linux" "x86_64-darwin" ];
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
  };
-}
+})
--- a/pkgs/development/compilers/julia/1.9.nix
+++ b/pkgs/development/compilers/julia/1.9.nix
@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
    done
  '';

-  doInstallCheck = true;
+  doInstallCheck = !stdenv.hostPlatform.isAarch64; # tests are flaky for aarch64-linux on hydra
  installCheckTarget = "testall";

  preInstallCheck = ''
--- a/pkgs/development/compilers/unison/default.nix
+++ b/pkgs/development/compilers/unison/default.nix
@ -11,17 +11,17 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "unison-code-manager";
-  version = "M5c";
+  version = "M5e";

  src = if stdenv.isDarwin then
    fetchurl {
      url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-macos.tar.gz";
-      hash = "sha256-LTpsKwiV0ZxReLcuzoJYuMP1jN6v8M/z6mUqH9s5A+g=";
+      hash = "sha256-jg8/DmIJru2OKZu5WfA7fatKcburPiXnoALifxL26kc=";
    }
  else
    fetchurl {
      url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-linux.tar.gz";
-      hash = "sha256-6gSX8HOv/K4zFTz1O4VvrpWR9+iQyLOO6vIRv6oVw/c=";
+      hash = "sha256-+2dIxqf9b8DfoTUakxA6Qrpb7cAQKCventxDS1sFxjM=";
    };

  # The tarball is just the prebuilt binary, in the archive root.
--- a/pkgs/development/interpreters/rakudo/default.nix
+++ b/pkgs/development/interpreters/rakudo/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "rakudo";
-  version = "2023.06";
+  version = "2023.08";

  src = fetchFromGitHub {
    owner = "rakudo";
    repo = "rakudo";
    rev = version;
-    hash = "sha256-t+zZEokjcDXp8uuHaOHp1R9LuS0Q3CSDOWhbSFXlNaU=";
+    hash = "sha256-wvHMyXMkI2RarmUeC8lKGgy3TNmVQsZo/3D/eS4FUrI=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/interpreters/rakudo/moarvm.nix
+++ b/pkgs/development/interpreters/rakudo/moarvm.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "moarvm";
-  version = "2023.06";
+  version = "2023.08";

  src = fetchFromGitHub {
    owner = "moarvm";
    repo = "moarvm";
    rev = version;
-    hash = "sha256-dMh1KwKh89ZUqIUPHOH9DPgxLWq37kW3hTTwsFe1imM=";
+    hash = "sha256-oYdXzbT+2L/nDySKq8ZYVuVfNgzLDiskwacOM1L4lzw=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/interpreters/rakudo/nqp.nix
+++ b/pkgs/development/interpreters/rakudo/nqp.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "nqp";
-  version = "2023.06";
+  version = "2023.08";

  src = fetchFromGitHub {
    owner = "raku";
    repo = "nqp";
    rev = version;
-    hash = "sha256-VfSVNEBRW6Iz3qUeICFXu3pp92NGgAkOrThXF8a/82A=";
+    hash = "sha256-kVNj6zDT0z6eFxtTovpT1grbl0pygsPKkFoVcFW7baI=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@ -2,17 +2,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "wasmtime";
-  version = "11.0.1";
+  version = "12.0.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-uHnHtviGieNyVQHMHsvHocJqC/n9bc6Mv0Uy6lBIuuQ=";
+    hash = "sha256-6bbz8FH87MahD3R7G3cmsJD0461L4OoCbFejyXsuER0=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-XTpXVBsZvgY2SnTwe1dh/XYmXapu+LQ0etelO8fj7Nc=";
+  cargoHash = "sha256-QbKYnKdJK9zImZDl057l8/Za4A+N82WrqQCzrOsc6fE=";

  cargoBuildFlags = [ "--package" "wasmtime-cli" "--package" "wasmtime-c-api" ];

@ -47,6 +47,7 @@ rustPlatform.buildRustPackage rec {
      "Standalone JIT-style runtime for WebAssembly, using Cranelift";
    homepage = "https://wasmtime.dev/";
    license = licenses.asl20;
+    mainProgram = "wasmtime";
    maintainers = with maintainers; [ ereslibre matthewbauer ];
    platforms = platforms.unix;
    changelog = "https://github.com/bytecodealliance/wasmtime/blob/v${version}/RELEASES.md";
--- a/pkgs/development/libraries/glfw/3.x-wayland-minecraft.nix
+++ b/pkgs/development/libraries/glfw/3.x-wayland-minecraft.nix
@ -0,0 +1,55 @@
+{ stdenv, lib, fetchFromGitHub, fetchpatch2, cmake, extra-cmake-modules
+, libGL, wayland, wayland-protocols, libxkbcommon, libdecor
+}:
+
+stdenv.mkDerivation {
+  version = "unstable-2023-06-01";
+  pname = "glfw-wayland-minecraft";
+
+  src = fetchFromGitHub {
+    owner = "glfw";
+    repo = "GLFW";
+    rev = "3eaf1255b29fdf5c2895856c7be7d7185ef2b241";
+    sha256 = "sha256-UnwuE/3q6I4dS5syagpnqrDEVDK9XSVdyOg7KNkdUUA=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      url = "https://raw.githubusercontent.com/Admicos/minecraft-wayland/15f88a515c63a9716cfdf4090fab8e16543f4ebd/0003-Don-t-crash-on-calls-to-focus-or-icon.patch";
+      hash = "sha256-NZbKh16h+tWXXnz13QcFBFaeGXMNxZKGQb9xJEahFnE=";
+    })
+    (fetchpatch2 {
+      url = "https://raw.githubusercontent.com/Admicos/minecraft-wayland/15f88a515c63a9716cfdf4090fab8e16543f4ebd/0005-Add-warning-about-being-an-unofficial-patch.patch";
+      hash = "sha256-QMUNlnlCeFz5gIVdbM+YXPsrmiOl9cMwuVRSOvlw+T0=";
+    })
+  ];
+
+  propagatedBuildInputs = [ libGL ];
+
+  nativeBuildInputs = [ cmake extra-cmake-modules ];
+
+  buildInputs = [ wayland wayland-protocols libxkbcommon ];
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+    "-DGLFW_BUILD_WAYLAND=ON"
+    "-DGLFW_BUILD_X11=OFF"
+    "-DCMAKE_C_FLAGS=-D_GLFW_EGL_LIBRARY='\"${lib.getLib libGL}/lib/libEGL.so.1\"'"
+  ];
+
+  postPatch = ''
+    substituteInPlace src/wl_init.c \
+      --replace "libxkbcommon.so.0" "${lib.getLib libxkbcommon}/lib/libxkbcommon.so.0"
+
+    substituteInPlace src/wl_init.c \
+      --replace "libdecor-0.so.0" "${lib.getLib libdecor}/lib/libdecor-0.so.0"
+  '';
+
+  meta = with lib; {
+    description = "Multi-platform library for creating OpenGL contexts and managing input, including keyboard, mouse, joystick and time - with patches to support Minecraft on Wayland";
+    homepage = "https://www.glfw.org/";
+    license = licenses.zlib;
+    maintainers = with maintainers; [ Scrumplex ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@ -68,6 +68,9 @@ stdenv.mkDerivation rec {
    GDK_PIXBUF_MODULE_FILE=${gdkPixbufModuleFile} \
    gdk-pixbuf-query-loaders --update-cache

+  ''
+  # Cross-compiled gdk-pixbuf doesn't support thumbnailers
+  + lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
    mkdir -p "$out/bin"
    makeWrapper ${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer "$out/libexec/gdk-pixbuf-thumbnailer-avif" \
      --set GDK_PIXBUF_MODULE_FILE ${gdkPixbufModuleFile}
--- a/pkgs/development/libraries/libcerf/default.nix
+++ b/pkgs/development/libraries/libcerf/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libcerf";
-  version = "2.3";
+  version = "2.4";

  src = fetchurl {
    url = "https://jugit.fz-juelich.de/mlz/libcerf/-/archive/v${version}/libcerf-v${version}.tar.gz";
-    sha256 = "sha256-zO7+5G6EzojQdRAzkLT50Ew05Lw7ltczKSw2g21PcGU=";
+    sha256 = "sha256-CAswrlZMPavjuJJkUira9WR+x1QCFXK+5UkpaXsnbNw=";
  };

  nativeBuildInputs = [ cmake perl ];
--- a/pkgs/development/libraries/qscintilla/default.nix
+++ b/pkgs/development/libraries/qscintilla/default.nix
@ -3,7 +3,7 @@
 , fetchurl
 , unzip
 , qtbase
-, qtmacextras
+, qtmacextras ? null
 , qmake
 , fixDarwinDylibNames
 }:
@ -63,5 +63,7 @@ stdenv.mkDerivation rec {
    license = with licenses; [ gpl3 ]; # and commercial
    maintainers = with maintainers; [ peterhoeg ];
    platforms = platforms.unix;
+    # ld: library not found for -lcups
+    broken = stdenv.isDarwin && lib.versionAtLeast qtbase.version "6";
  };
 }
--- a/pkgs/development/mobile/cordova/default.nix
+++ b/pkgs/development/mobile/cordova/default.nix
@ -0,0 +1,28 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "cordova";
+  version = "12.0.0";
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "cordova-cli";
+    rev = version;
+    hash = "sha256-fEV7NlRcRpyeRplsdXHI2U4/89DsvKQpVwHD5juiNPo=";
+  };
+
+  npmDepsHash = "sha256-ZMxZiwCgqzOBwDXeTfIEwqFVdM9ysWeE5AbX7rUdwIc=";
+
+  dontNpmBuild = true;
+
+  meta = {
+    description = "Build native mobile applications using HTML, CSS and JavaScript";
+    homepage = "https://github.com/apache/cordova-cli";
+    license = lib.licenses.asl20;
+    mainProgram = "cordova";
+    maintainers = with lib.maintainers; [ flosse ];
+  };
+}
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@ -49,23 +49,31 @@ mapAliases {
  balanceofsatoshis = pkgs.balanceofsatoshis; # added 2023-07-31
  bibtex-tidy = pkgs.bibtex-tidy; # added 2023-07-30
  bitwarden-cli = pkgs.bitwarden-cli; # added 2023-07-25
+  inherit (pkgs) btc-rpc-explorer; # added 2023-08-17
+  inherit (pkgs) carbon-now-cli; # added 2023-08-17
  inherit (pkgs) carto; # added 2023-08-17
  castnow = pkgs.castnow; # added 2023-07-30
  inherit (pkgs) clean-css-cli; # added 2023-08-18
  inherit (pkgs) configurable-http-proxy; # added 2023-08-19
+  inherit (pkgs) cordova; # added 2023-08-18
  eask = pkgs.eask; # added 2023-08-17
  inherit (pkgs.elmPackages) elm-test;
  eslint_d = pkgs.eslint_d; # Added 2023-05-26
+  inherit (pkgs) firebase-tools; # added 2023-08-18
  flood = pkgs.flood; # Added 2023-07-25
+  inherit (pkgs) graphqurl; # added 2023-08-19
  gtop = pkgs.gtop; # added 2023-07-31
  inherit (pkgs) htmlhint; # added 2023-08-19
  hueadm = pkgs.hueadm; # added 2023-07-31
+  inherit (pkgs) hyperpotamus; # added 2023-08-19
  immich = pkgs.immich-cli; # added 2023-08-19
  indium = throw "indium was removed because it was broken"; # added 2023-08-19
+  ionic = throw "ionic was replaced by @ionic/cli"; # added 2023-08-19
  inherit (pkgs) javascript-typescript-langserver; # added 2023-08-19
  karma = pkgs.karma-runner; # added 2023-07-29
  manta = pkgs.node-manta; # Added 2023-05-06
  markdownlint-cli = pkgs.markdownlint-cli; # added 2023-07-29
+  inherit (pkgs) markdownlint-cli2; # added 2023-08-22
  readability-cli = pkgs.readability-cli; # Added 2023-06-12
  reveal-md = pkgs.reveal-md; # added 2023-07-31
  s3http = throw "s3http was removed because it was abandoned upstream"; # added 2023-08-18
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@ -29,7 +29,6 @@
  "@webassemblyjs/wasm-text-gen-1.11.1" = "wasmgen";
  "@webassemblyjs/wast-refmt-1.11.1" = "wast-refmt";
  aws-cdk = "cdk";
-  carbon-now-cli = "carbon-now";
  cdk8s-cli = "cdk8s";
  cdktf-cli = "cdktf";
  clipboard-cli = "clipboard";
@ -40,7 +39,6 @@
  dockerfile-language-server-nodejs = "docker-langserver";
  fast-cli = "fast";
  fauna-shell = "fauna";
-  firebase-tools = "firebase";
  fkill-cli = "fkill";
  fleek-cli = "fleek";
  git-run = "gr";
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -39,8 +39,6 @@
 , "bower2nix"
 , "browserify"
 , "browser-sync"
-, "btc-rpc-explorer"
-, "carbon-now-cli"
 , "cdk8s-cli"
 , "cdktf-cli"
 , "clipboard-cli"
@ -100,7 +98,6 @@
 , "coinmon"
 , "concurrently"
 , "conventional-changelog-cli"
-, "cordova"
 , "cpy-cli"
 , "create-cycle-app"
 , "create-react-app"
@ -127,7 +124,6 @@
 , "expo-cli"
 , "fast-cli"
 , "fauna-shell"
-, "firebase-tools"
 , "fixjson"
 , "fkill-cli"
 , "fleek-cli"
@ -148,7 +144,6 @@
 , "graphql"
 , "graphql-cli"
 , "graphql-language-service-cli"
-, "graphqurl"
 , "grunt-cli"
 , "makam"
 , "meshcommander"
@ -161,13 +156,11 @@
 , "hsd"
 , "hs-airdrop"
 , "hs-client"
-, "hyperpotamus"
 , "ijavascript"
 , "inliner"
 , "imapnotify"
 , "insect"
 , "intelephense"
-, "ionic"
 , "jake"
 , "joplin"
 , "js-beautify"
@ -196,7 +189,6 @@
 , "lua-fmt"
 , "lv_font_conv"
 , "madoko"
-, "markdownlint-cli2"
 , "markdown-link-check"
 , {"markdown-preview-nvim": "../../applications/editors/vim/plugins/markdown-preview-nvim"}
 , "mastodon-bot"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@ -92,17 +92,6 @@ final: prev: {
    '';
  };

-  carbon-now-cli = prev.carbon-now-cli.override {
-    nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
-    prePatch = ''
-      export PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=1
-    '';
-    postInstall = ''
-      wrapProgram $out/bin/carbon-now \
-        --set PUPPETEER_EXECUTABLE_PATH ${pkgs.chromium.outPath}/bin/chromium
-    '';
-  };
-
  coc-imselect = prev.coc-imselect.override (oldAttrs: {
    meta = oldAttrs.meta // { broken = since "10"; };
  });
@ -136,9 +125,6 @@ final: prev: {
    '';
  };

-  firebase-tools = prev.firebase-tools.override {
-    nativeBuildInputs = lib.optionals stdenv.isDarwin  [ pkgs.xcbuild ];
-  };

  git-ssb = prev.git-ssb.override (oldAttrs: {
    buildInputs = [ final.node-gyp-build ];
--- a/pkgs/development/ocaml-modules/ppx_deriving/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_deriving/default.nix
@ -10,22 +10,18 @@
 , ounit
 , ounit2
 , ocaml-migrate-parsetree
-, ocaml-migrate-parsetree-2
 }:

 let params =
  if lib.versionAtLeast ppxlib.version "0.20" then {
    version = "5.2.1";
    sha256 = "11h75dsbv3rs03pl67hdd3lbim7wjzh257ij9c75fcknbfr5ysz9";
-    useOMP2 = true;
  } else if lib.versionAtLeast ppxlib.version "0.15" then {
    version = "5.1";
    sha256 = "1i64fd7qrfzbam5hfbl01r0sx4iihsahcwqj13smmrjlnwi3nkxh";
-    useOMP2 = false;
  } else {
    version = "5.0";
    sha256 = "0fkzrn4pdyvf1kl0nwvhqidq01pnq3ql8zk1jd56hb0cxaw851w3";
-    useOMP2 = false;
  }
 ; in

@ -33,8 +29,6 @@ buildDunePackage rec {
  pname = "ppx_deriving";
  inherit (params) version;

-  duneVersion = "3";
-
  src = fetchurl {
    url = "https://github.com/ocaml-ppx/ppx_deriving/releases/download/v${version}/ppx_deriving-v${version}.tbz";
    inherit (params) sha256;
@ -44,10 +38,8 @@ buildDunePackage rec {

  nativeBuildInputs = [ cppo ];
  buildInputs = [ findlib ppxlib ];
-  propagatedBuildInputs = [
-    (if params.useOMP2
-    then ocaml-migrate-parsetree-2
-    else ocaml-migrate-parsetree)
+  propagatedBuildInputs =
+    lib.optional (lib.versionOlder version "5.2") ocaml-migrate-parsetree ++ [
    ppx_derivers
    result
  ];
--- a/pkgs/development/php-packages/psalm/default.nix
+++ b/pkgs/development/php-packages/psalm/default.nix
@ -2,14 +2,14 @@

 let
  pname = "psalm";
-  version = "5.13.1";
+  version = "5.15.0";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/vimeo/psalm/releases/download/${version}/psalm.phar";
-    sha256 = "sha256-kMNL44Ma0A3RBYxLUGl6kXvOppZ8FKt2ETb2ZaqsOsY=";
+    sha256 = "sha256-eAvogKsnvXMNUZHh44RPHpd0iMqEY9fzqJvXPT7SE1A=";
  };

  dontUnpack = true;
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.64";
+  version = "9.2.65";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-KUJpcP7bf8BjmB/QojTQHSwkmzW0bN4nJaD8GcNbcyE=";
+    hash = "sha256-Bli+zrxMbRY2dzAx25ap3DhROIFTlk+TGpAfrHiMxPc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aioflo/default.nix
+++ b/pkgs/development/python-modules/aioflo/default.nix
@ -3,6 +3,7 @@
 , aresponses
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , poetry-core
 , pytest-aiohttp
 , pytest-asyncio
@ -24,6 +25,20 @@ buildPythonPackage rec {
    hash = "sha256-7NrOoc1gi8YzZaKvCnHnzAKPlMnMhqxjdyZGN5H/8TQ=";
  };

+  patches = [
+    # This patch removes references to setuptools and wheel that are no longer
+    # necessary and changes poetry to poetry-core, so that we don't need to add
+    # unnecessary nativeBuildInputs.
+    #
+    #   https://github.com/bachya/aioflo/pull/65
+    #
+    (fetchpatch {
+      name = "clean-up-build-dependencies.patch";
+      url = "https://github.com/bachya/aioflo/commit/f38d3f6427777ab0eeb56177943679e2570f0634.patch";
+      hash = "sha256-iLgklhEZ61rrdzQoO6rp1HGZcqLsqGNitwIiPNLNHQ4=";
+    })
+  ];
+
  nativeBuildInputs = [
    poetry-core
  ];
@ -32,6 +47,8 @@ buildPythonPackage rec {
    aiohttp
  ];

+  __darwinAllowLocalNetworking = true;
+
  nativeCheckInputs = [
    aresponses
    pytest-aiohttp
--- a/pkgs/development/python-modules/aioguardian/default.nix
+++ b/pkgs/development/python-modules/aioguardian/default.nix
@ -5,6 +5,7 @@
 , buildPythonPackage
 , docutils
 , fetchFromGitHub
+, fetchpatch
 , poetry-core
 , pytest-aiohttp
 , pytest-asyncio
@ -27,6 +28,20 @@ buildPythonPackage rec {
    hash = "sha256-plgO+pyKmG0mYnFZxDcrENcuEg5AG2Og2xWipzuzyHo=";
  };

+  patches = [
+    # This patch removes references to setuptools and wheel that are no longer
+    # necessary and changes poetry to poetry-core, so that we don't need to add
+    # unnecessary nativeBuildInputs.
+    #
+    #   https://github.com/bachya/aioguardian/pull/288
+    #
+    (fetchpatch {
+      name = "clean-up-build-dependencies.patch";
+      url = "https://github.com/bachya/aioguardian/commit/ffaad4b396645f599815010995fb71ca976e761e.patch";
+      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
+    })
+  ];
+
  nativeBuildInputs = [
    poetry-core
  ];
--- a/pkgs/development/python-modules/aionotion/default.nix
+++ b/pkgs/development/python-modules/aionotion/default.nix
@ -3,6 +3,7 @@
 , aresponses
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , poetry-core
 , pydantic
 , pytest-aiohttp
@ -26,6 +27,20 @@ buildPythonPackage rec {
    hash = "sha256-/2sF8m5R8YXkP89bi5zR3h13r5LrFOl1OsixAcX0D4o=";
  };

+  patches = [
+    # This patch removes references to setuptools and wheel that are no longer
+    # necessary and changes poetry to poetry-core, so that we don't need to add
+    # unnecessary nativeBuildInputs.
+    #
+    #   https://github.com/bachya/aionotion/pull/269
+    #
+    (fetchpatch {
+      name = "clean-up-build-dependencies.patch";
+      url = "https://github.com/bachya/aionotion/commit/53c7285110d12810f9b43284295f71d052a81b83.patch";
+      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
+    })
+  ];
+
  nativeBuildInputs = [
    poetry-core
  ];
@ -35,6 +50,8 @@ buildPythonPackage rec {
    pydantic
  ];

+  __darwinAllowLocalNetworking = true;
+
  nativeCheckInputs = [
    aresponses
    pytest-aiohttp
--- a/pkgs/development/python-modules/aiopurpleair/default.nix
+++ b/pkgs/development/python-modules/aiopurpleair/default.nix
@ -3,6 +3,7 @@
 , aresponses
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , poetry-core
 , pydantic
 , pytest-aiohttp
@ -25,6 +26,20 @@ buildPythonPackage rec {
    hash = "sha256-YmJH4brWkTpgzyHwu9UnIWrY5qlDCmMtvF+KxQFXwfk=";
  };

+  patches = [
+    # This patch removes references to setuptools and wheel that are no longer
+    # necessary and changes poetry to poetry-core, so that we don't need to add
+    # unnecessary nativeBuildInputs.
+    #
+    #   https://github.com/bachya/aiopurpleair/pull/207
+    #
+    (fetchpatch {
+      name = "clean-up-build-dependencies.patch";
+      url = "https://github.com/bachya/aiopurpleair/commit/8c704c51ea50da266f52a7f53198d29d643b30c5.patch";
+      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace pyproject.toml \
      --replace 'pydantic = "^1.10.2"' 'pydantic = "*"'
@ -39,6 +54,8 @@ buildPythonPackage rec {
    pydantic
  ];

+  __darwinAllowLocalNetworking = true;
+
  nativeCheckInputs = [
    aresponses
    pytest-aiohttp
--- a/pkgs/development/python-modules/aioquic-mitmproxy/default.nix
+++ b/pkgs/development/python-modules/aioquic-mitmproxy/default.nix
@ -0,0 +1,51 @@
+{ lib
+, buildPythonPackage
+, certifi
+, cryptography
+, fetchFromGitHub
+, pylsqpack
+, pyopenssl
+, pytestCheckHook
+, setuptools
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "aioquic-mitmproxy";
+  version = "0.9.20.3";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "meitinger";
+    repo = "aioquic_mitmproxy";
+    rev = "refs/tags/${version}";
+    hash = "sha256-VcIbtrcA0dBEE52ZD90IbXoh6L3wDUbr2kFJikts6+w=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    certifi
+    cryptography
+    pylsqpack
+    pyopenssl
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "aioquic"
+  ];
+
+  meta = with lib; {
+    description = "QUIC and HTTP/3 implementation in Python";
+    homepage = "https://github.com/meitinger/aioquic_mitmproxy";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/aiorecollect/default.nix
+++ b/pkgs/development/python-modules/aiorecollect/default.nix
@ -3,6 +3,7 @@
 , aresponses
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , freezegun
 , poetry-core
 , pytest-asyncio
@ -12,7 +13,7 @@

 buildPythonPackage rec {
  pname = "aiorecollect";
-  version = "2022.10.0";
+  version = "2023.08.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -21,9 +22,29 @@ buildPythonPackage rec {
    owner = "bachya";
    repo = pname;
    rev = version;
-    hash = "sha256-JIh6jr4pFXGZTUi6K7VsymaCxCrTNBevk9xo9TsrFnM=";
+    hash = "sha256-oTkWirq3w0DgQWWe0ziK+ry4pg6j6SQbBESLG4xgDE4=";
  };

+  patches = [
+    # This patch removes references to setuptools and wheel that are no longer
+    # necessary and changes poetry to poetry-core, so that we don't need to add
+    # unnecessary nativeBuildInputs.
+    #
+    #   https://github.com/bachya/aiorecollect/pull/207
+    #
+    (fetchpatch {
+      name = "clean-up-dependencies.patch";
+      url = "https://github.com/bachya/aiorecollect/commit/0bfddead1c1b176be4d599b8e12ed608eac97b8b.patch";
+      hash = "sha256-w/LAtyuyYsAAukDeIy8XLlp9QrydC1Wmi2zxEj1Zdm8=";
+      includes = [ "pyproject.toml" ];
+    })
+  ];
+
+  postPatch = ''
+    # this is not used directly by the project
+    sed -i '/certifi =/d' pyproject.toml
+  '';
+
  nativeBuildInputs = [
    poetry-core
  ];
@ -32,6 +53,8 @@ buildPythonPackage rec {
    aiohttp
  ];

+  __darwinAllowLocalNetworking = true;
+
  nativeCheckInputs = [
    aresponses
    freezegun
--- a/pkgs/development/python-modules/aioridwell/default.nix
+++ b/pkgs/development/python-modules/aioridwell/default.nix
@ -3,6 +3,7 @@
 , aresponses
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , freezegun
 , poetry-core
 , pyjwt
@ -29,6 +30,20 @@ buildPythonPackage rec {
    hash = "sha256-8EPELXxSq+B9o9eMFeM5ZPVYTa1+kT/S6cO7hKtD18s=";
  };

+  patches = [
+    # This patch removes references to setuptools and wheel that are no longer
+    # necessary and changes poetry to poetry-core, so that we don't need to add
+    # unnecessary nativeBuildInputs.
+    #
+    #   https://github.com/bachya/aioridwell/pull/234
+    #
+    (fetchpatch {
+      name = "clean-up-build-dependencies.patch";
+      url = "https://github.com/bachya/aioridwell/commit/79a9dd7462dcfeb0833abca73a1f184827120a6f.patch";
+      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
+    })
+  ];
+
  nativeBuildInputs = [
    poetry-core
  ];
@ -40,6 +55,8 @@ buildPythonPackage rec {
    titlecase
  ];

+  __darwinAllowLocalNetworking = true;
+
  nativeCheckInputs = [
    aresponses
    freezegun
--- a/pkgs/development/python-modules/aiosomecomfort/default.nix
+++ b/pkgs/development/python-modules/aiosomecomfort/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "aiosomecomfort";
-  version = "0.0.15";
+  version = "0.0.16";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "mkmer";
    repo = "AIOSomecomfort";
    rev = "refs/tags/${version}";
-    hash = "sha256-G7A5XXAElPFkuRM5bEcKqqn14tjJLn2lkYyqBtm5giM=";
+    hash = "sha256-GwnlaPy+pIJOL3szOebH0a0ytVMOeUI4dM8D629RuEU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aiowatttime/default.nix
+++ b/pkgs/development/python-modules/aiowatttime/default.nix
@ -3,6 +3,7 @@
 , aresponses
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , poetry-core
 , pytest-aiohttp
 , pytest-asyncio
@ -24,6 +25,20 @@ buildPythonPackage rec {
    hash = "sha256-rqmsUvVwXC/XkR/v2d9d3t7u6Poms4ORiOci41ajXIo=";
  };

+  patches = [
+    # This patch removes references to setuptools and wheel that are no longer
+    # necessary and changes poetry to poetry-core, so that we don't need to add
+    # unnecessary nativeBuildInputs.
+    #
+    #   https://github.com/bachya/aiowatttime/pull/206
+    #
+    (fetchpatch {
+      name = "clean-up-build-dependencies.patch";
+      url = "https://github.com/bachya/aiowatttime/commit/c3cd53f794964c5435148caacd04f4e0ab8f550a.patch";
+      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
+    })
+  ];
+
  nativeBuildInputs = [
    poetry-core
  ];
@ -32,6 +47,8 @@ buildPythonPackage rec {
    aiohttp
  ];

+  __darwinAllowLocalNetworking = true;
+
  nativeCheckInputs = [
    aresponses
    pytest-aiohttp
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.64";
+  version = "9.2.65";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-NQopPg7ZAKkbq6T/1U8VYT/9oRz9ssg5yqTBpInNHNk=";
+    hash = "sha256-atVmXsgMIRpmOXgNoatWkk9ID14f9rMJMT6+CWmvbY4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/apscheduler/default.nix
+++ b/pkgs/development/python-modules/apscheduler/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "apscheduler";
-  version = "3.10.1";
+  version = "3.10.4";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -26,7 +26,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "APScheduler";
    inherit version;
-    hash = "sha256-ApOTfY9gUaD0kzWUQMGhuT6ILFfa8Bl6/v8Ocnd3uW4=";
+    hash = "sha256-5t8HGyfZvomOSGvHlAp75QtK8unafAjwdEqW1L1M70o=";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.64";
+  version = "9.2.65";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-/3dc0p6xDFvv8VwFi5hxiXveiWYr9w3s0PwMv3uV2yw=";
+    hash = "sha256-g+inF8eswHNLV6bBVRpyLf6H8PjmPduv7I2svAVEG5U=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "atlassian-python-api";
-  version = "3.40.0";
+  version = "3.41.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "atlassian-api";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-2yY1shsdlX40FJV3K7nT6HfKKI14/3zH8dOEnJeTahw=";
+    hash = "sha256-f1i4kX9lZ8ozv/jLzvu1XbCn+BheMn8SQE1mtivaEG8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/browser-cookie3/default.nix
+++ b/pkgs/development/python-modules/browser-cookie3/default.nix
@ -1,5 +1,4 @@
-{ stdenv
-, lib
+{ lib
 , fetchPypi
 , buildPythonPackage
 , pythonOlder
@ -43,6 +42,5 @@ buildPythonPackage rec {
    changelog = "https://github.com/borisbabic/browser_cookie3/blob/master/CHANGELOG.md";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ borisbabic ];
-    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.64";
+  version = "9.2.65";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-vx4wFZdycXow/t2LT4t1kO81JPvsB1mQF1GWgYRZiWs=";
+    hash = "sha256-/Ou2Kl7Fw5QpzoibNOKJPnAwRsR3EDtYypCrOQc7yjI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -16,7 +16,7 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.64";
+  version = "9.2.65";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
@ -38,7 +38,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-wF3T8Kr09jqe4b/qctKXzFAnaTTtOkceHEoEN8J0mTs=";
+    hash = "sha256-reJRy2KNk4YrkPkVH7eitMVS7V9MPTZNjo9+Wmgx5vQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/click-help-colors/default.nix
+++ b/pkgs/development/python-modules/click-help-colors/default.nix
@ -1,27 +1,40 @@
-{ lib, fetchPypi, buildPythonPackage
-, click, pytestCheckHook
+{ lib
+, fetchPypi
+, buildPythonPackage
+, click
+, pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "click-help-colors";
-  version = "0.9.1";
+  version = "0.9.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "78cbcf30cfa81c5fc2a52f49220121e1a8190cd19197d9245997605d3405824d";
+    hash = "sha256-dWJF5ULSkia7O8BWv6WIhvISuiuC9OjPX8iEF2rJbXI=";
  };

-  propagatedBuildInputs = [ click ];
+  propagatedBuildInputs = [
+    click
+  ];

-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];

-  pythonImportsCheck = [ "click_help_colors" ];
+  pythonImportsCheck = [
+    "click_help_colors"
+  ];

  meta = with lib; {
    description = "Colorization of help messages in Click";
-    homepage    = "https://github.com/r-m-n/click-help-colors";
-    license     = licenses.mit;
-    platforms   = platforms.unix;
+    homepage = "https://github.com/click-contrib/click-help-colors";
+    changelog = "https://github.com/click-contrib/click-help-colors/blob/${version}/CHANGES.rst";
+    license = licenses.mit;
    maintainers = with maintainers; [ freezeboy ];
  };
 }
--- a/pkgs/development/python-modules/cmsis-pack-manager/default.nix
+++ b/pkgs/development/python-modules/cmsis-pack-manager/default.nix
@ -1,5 +1,5 @@
 { lib
-, fetchPypi
+, fetchFromGitHub
 , rustPlatform
 , cffi
 , libiconv
@ -15,17 +15,20 @@
 }:

 buildPythonPackage rec {
-  pname = "cmsis_pack_manager";
+  pname = "cmsis-pack-manager";
  version = "0.5.2";
+  format = "pyproject";

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-sVfyz9D7/0anIp0bEPp1EJkERDbNJ3dCcydLbty1KsQ=";
+  src = fetchFromGitHub {
+    owner = "pyocd";
+    repo = "cmsis-pack-manager";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-PeyJf3TGUxv8/MKIQUgWrenrK4Hb+4cvtDA2h3r6kGg=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
-    sha256 = "dO4qw5Jx0exwb4RuOhu6qvGxQZ+LayHtXDHZKADLTEI=";
+    hash = "sha256-dO4qw5Jx0exwb4RuOhu6qvGxQZ+LayHtXDHZKADLTEI=";
  };

  nativeBuildInputs = [ rustPlatform.cargoSetupHook rustPlatform.maturinBuildHook ];
@ -35,10 +38,10 @@ buildPythonPackage rec {
  propagatedBuildInputs = [ appdirs pyyaml ];
  nativeCheckInputs = [ hypothesis jinja2 pytestCheckHook unzip ];

-  format = "pyproject";
-
+  # remove cmsis_pack_manager source directory so that binaries can be imported
+  # from the installed wheel instead
  preCheck = ''
-    unzip $dist/*.whl cmsis_pack_manager/cmsis_pack_manager/native.so
+    rm -r cmsis_pack_manager
  '';

  disabledTests = [
--- a/Show More
+++ b/Show More