Merge master into staging-next

maintainers/maintainer-list.nix

@@ -1417,6 +1417,11 @@
       fingerprint = "BF8B F725 DA30 E53E 7F11  4ED8 AAA5 0652 F047 9205";
     }];
   };
+  appsforartists = {
+    github = "appsforartists";
+    githubId = 926648;
+    name = "Brenton Simpson";
+  };
   apraga = {
     email = "alexis.praga@proton.me";
     github = "apraga";
@@ -3536,6 +3541,12 @@
     githubId = 46303707;
     name = "Christian Lütke-Stetzkamp";
   };
+  clr-cera = {
+    email = "clrcera05@gmail.com";
+    github = "clr-cera";
+    githubId = 93736542;
+    name = "Clr";
+  };
   cmacrae = {
     email = "hi@cmacr.ae";
     github = "cmacrae";
@@ -4687,6 +4698,16 @@
     githubId = 32810399;
     name = "Diffumist";
   };
+  diogotcorreia = {
+    name = "Diogo Correia";
+    email = "me@diogotc.com";
+    matrix = "@dtc:diogotc.com";
+    github = "diogotcorreia";
+    githubId = 7467891;
+    keys = [{
+      fingerprint = "111F 91B7 5F61 99D8 985B  4C70 12CF 31FD FF17 2B77";
+    }];
+  };
   diogox = {
     name = "Diogo Xavier";
     github = "diogox";

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -215,6 +215,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `services.zfs.zed.enableMail` now uses the global `sendmail` wrapper defined by an email module
   (such as msmtp or Postfix). It no longer requires using a special ZFS build with email support.
 
+- `nextcloud-setup.service` no longer changes the group of each file & directory inside `/var/lib/nextcloud/{config,data,store-apps}` if one of these directories has the wrong owner group. This was part of transitioning the group used for `/var/lib/nextcloud`, but isn't necessary anymore.
+
 - The `krb5` module has been rewritten and moved to `security.krb5`, moving all options but `security.krb5.enable` and `security.krb5.package` into `security.krb5.settings`.
 
 - Gitea 1.21 upgrade has several breaking changes, including:

nixos/modules/services/continuous-integration/github-runner/options.nix

@@ -153,6 +153,7 @@ with lib;
     type = types.attrs;
     description = lib.mdDoc ''
       Modify the systemd service. Can be used to, e.g., adjust the sandboxing options.
+      See {manpage}`systemd.exec(5)` for more options.
     '';
     example = {
       ProtectHome = false;

nixos/modules/services/mail/dovecot.nix

@@ -119,9 +119,10 @@ let
     ''
       plugin {
         sieve_plugins = ${concatStringsSep " " cfg.sieve.plugins}
-        sieve_extensions = ${concatStringsSep " " (map (el: "+${el}") cfg.sieve.extensions)}
-        sieve_global_extensions = ${concatStringsSep " " (map (el: "+${el}") cfg.sieve.globalExtensions)}
     ''
+    (optionalString (cfg.sieve.extensions != []) ''sieve_extensions = ${concatMapStringsSep " " (el: "+${el}") cfg.sieve.extensions}'')
+    (optionalString (cfg.sieve.globalExtensions != []) ''sieve_global_extensions = ${concatMapStringsSep " " (el: "+${el}") cfg.sieve.globalExtensions}'')
+
     (optionalString (cfg.imapsieve.mailbox != []) ''
       ${
         concatStringsSep "\n" (flatten (imap1 (

nixos/modules/services/web-apps/nextcloud.nix

@@ -99,11 +99,101 @@ let
   mysqlLocal = cfg.database.createLocally && cfg.config.dbtype == "mysql";
   pgsqlLocal = cfg.database.createLocally && cfg.config.dbtype == "pgsql";
 
-  # https://github.com/nextcloud/documentation/pull/11179
+  nextcloudGreaterOrEqualThan = versionAtLeast cfg.package.version;
-  ocmProviderIsNotAStaticDirAnymore = versionAtLeast cfg.package.version "27.1.2"
+  nextcloudOlderThan = versionOlder cfg.package.version;
-    || (versionOlder cfg.package.version "27.0.0"
-      && versionAtLeast cfg.package.version "26.0.8");
 
+  # https://github.com/nextcloud/documentation/pull/11179
+  ocmProviderIsNotAStaticDirAnymore = nextcloudGreaterOrEqualThan "27.1.2"
+    || (nextcloudOlderThan "27.0.0" && nextcloudGreaterOrEqualThan "26.0.8");
+
+  overrideConfig = let
+    c = cfg.config;
+    requiresReadSecretFunction = c.dbpassFile != null || c.objectstore.s3.enable;
+    objectstoreConfig = let s3 = c.objectstore.s3; in optionalString s3.enable ''
+      'objectstore' => [
+        'class' => '\\OC\\Files\\ObjectStore\\S3',
+        'arguments' => [
+          'bucket' => '${s3.bucket}',
+          'autocreate' => ${boolToString s3.autocreate},
+          'key' => '${s3.key}',
+          'secret' => nix_read_secret('${s3.secretFile}'),
+          ${optionalString (s3.hostname != null) "'hostname' => '${s3.hostname}',"}
+          ${optionalString (s3.port != null) "'port' => ${toString s3.port},"}
+          'use_ssl' => ${boolToString s3.useSsl},
+          ${optionalString (s3.region != null) "'region' => '${s3.region}',"}
+          'use_path_style' => ${boolToString s3.usePathStyle},
+          ${optionalString (s3.sseCKeyFile != null) "'sse_c_key' => nix_read_secret('${s3.sseCKeyFile}'),"}
+        ],
+      ]
+    '';
+    showAppStoreSetting = cfg.appstoreEnable != null || cfg.extraApps != {};
+    renderedAppStoreSetting =
+      let
+        x = cfg.appstoreEnable;
+      in
+        if x == null then "false"
+        else boolToString x;
+    mkAppStoreConfig = name: { enabled, writable, ... }: optionalString enabled ''
+      [ 'path' => '${webroot}/${name}', 'url' => '/${name}', 'writable' => ${boolToString writable} ],
+    '';
+  in pkgs.writeText "nextcloud-config.php" ''
+    <?php
+    ${optionalString requiresReadSecretFunction ''
+      function nix_read_secret($file) {
+        if (!file_exists($file)) {
+          throw new \RuntimeException(sprintf(
+            "Cannot start Nextcloud, secret file %s set by NixOS doesn't seem to "
+            . "exist! Please make sure that the file exists and has appropriate "
+            . "permissions for user & group 'nextcloud'!",
+            $file
+          ));
+        }
+        return trim(file_get_contents($file));
+      }''}
+    function nix_decode_json_file($file, $error) {
+      if (!file_exists($file)) {
+        throw new \RuntimeException(sprintf($error, $file));
+      }
+      $decoded = json_decode(file_get_contents($file), true);
+
+      if (json_last_error() !== JSON_ERROR_NONE) {
+        throw new \RuntimeException(sprintf("Cannot decode %s, because: %s", $file, json_last_error_msg()));
+      }
+
+      return $decoded;
+    }
+    $CONFIG = [
+      'apps_paths' => [
+        ${concatStrings (mapAttrsToList mkAppStoreConfig appStores)}
+      ],
+      ${optionalString (showAppStoreSetting) "'appstoreenabled' => ${renderedAppStoreSetting},"}
+      ${optionalString cfg.caching.apcu "'memcache.local' => '\\OC\\Memcache\\APCu',"}
+      ${optionalString (c.dbname != null) "'dbname' => '${c.dbname}',"}
+      ${optionalString (c.dbhost != null) "'dbhost' => '${c.dbhost}',"}
+      ${optionalString (c.dbuser != null) "'dbuser' => '${c.dbuser}',"}
+      ${optionalString (c.dbtableprefix != null) "'dbtableprefix' => '${toString c.dbtableprefix}',"}
+      ${optionalString (c.dbpassFile != null) ''
+          'dbpassword' => nix_read_secret(
+            "${c.dbpassFile}"
+          ),
+        ''
+      }
+      'dbtype' => '${c.dbtype}',
+      ${objectstoreConfig}
+    ];
+
+    $CONFIG = array_replace_recursive($CONFIG, nix_decode_json_file(
+      "${jsonFormat.generate "nextcloud-extraOptions.json" cfg.extraOptions}",
+      "impossible: this should never happen (decoding generated extraOptions file %s failed)"
+    ));
+
+    ${optionalString (cfg.secretFile != null) ''
+      $CONFIG = array_replace_recursive($CONFIG, nix_decode_json_file(
+        "${cfg.secretFile}",
+        "Cannot start Nextcloud, secrets file %s set by NixOS doesn't exist!"
+      ));
+    ''}
+  '';
 in {
 
   imports = [
@@ -787,107 +877,23 @@ in {
         timerConfig.Unit = "nextcloud-cron.service";
       };
 
-      systemd.tmpfiles.rules = ["d ${cfg.home} 0750 nextcloud nextcloud"];
+      systemd.tmpfiles.rules = map (dir: "d ${dir} 0750 nextcloud nextcloud - -") [
+        "${cfg.home}"
+        "${datadir}/config"
+        "${datadir}/data"
+        "${cfg.home}/store-apps"
+      ] ++ [
+        "L+ ${datadir}/config/override.config.php - - - - ${overrideConfig}"
+      ];
 
       systemd.services = {
         # When upgrading the Nextcloud package, Nextcloud can report errors such as
         # "The files of the app [all apps in /var/lib/nextcloud/apps] were not replaced correctly"
         # Restarting phpfpm on Nextcloud package update fixes these issues (but this is a workaround).
-        phpfpm-nextcloud.restartTriggers = [ webroot ];
+        phpfpm-nextcloud.restartTriggers = [ webroot overrideConfig ];
 
         nextcloud-setup = let
           c = cfg.config;
-          requiresReadSecretFunction = c.dbpassFile != null || c.objectstore.s3.enable;
-          objectstoreConfig = let s3 = c.objectstore.s3; in optionalString s3.enable ''
-            'objectstore' => [
-              'class' => '\\OC\\Files\\ObjectStore\\S3',
-              'arguments' => [
-                'bucket' => '${s3.bucket}',
-                'autocreate' => ${boolToString s3.autocreate},
-                'key' => '${s3.key}',
-                'secret' => nix_read_secret('${s3.secretFile}'),
-                ${optionalString (s3.hostname != null) "'hostname' => '${s3.hostname}',"}
-                ${optionalString (s3.port != null) "'port' => ${toString s3.port},"}
-                'use_ssl' => ${boolToString s3.useSsl},
-                ${optionalString (s3.region != null) "'region' => '${s3.region}',"}
-                'use_path_style' => ${boolToString s3.usePathStyle},
-                ${optionalString (s3.sseCKeyFile != null) "'sse_c_key' => nix_read_secret('${s3.sseCKeyFile}'),"}
-              ],
-            ]
-          '';
-
-          showAppStoreSetting = cfg.appstoreEnable != null || cfg.extraApps != {};
-          renderedAppStoreSetting =
-            let
-              x = cfg.appstoreEnable;
-            in
-              if x == null then "false"
-              else boolToString x;
-
-          nextcloudGreaterOrEqualThan = req: versionAtLeast cfg.package.version req;
-
-          mkAppStoreConfig = name: { enabled, writable, ... }: optionalString enabled ''
-            [ 'path' => '${webroot}/${name}', 'url' => '/${name}', 'writable' => ${boolToString writable} ],
-          '';
-
-          overrideConfig = pkgs.writeText "nextcloud-config.php" ''
-            <?php
-            ${optionalString requiresReadSecretFunction ''
-              function nix_read_secret($file) {
-                if (!file_exists($file)) {
-                  throw new \RuntimeException(sprintf(
-                    "Cannot start Nextcloud, secret file %s set by NixOS doesn't seem to "
-                    . "exist! Please make sure that the file exists and has appropriate "
-                    . "permissions for user & group 'nextcloud'!",
-                    $file
-                  ));
-                }
-                return trim(file_get_contents($file));
-              }''}
-            function nix_decode_json_file($file, $error) {
-              if (!file_exists($file)) {
-                throw new \RuntimeException(sprintf($error, $file));
-              }
-              $decoded = json_decode(file_get_contents($file), true);
-
-              if (json_last_error() !== JSON_ERROR_NONE) {
-                throw new \RuntimeException(sprintf("Cannot decode %s, because: %s", $file, json_last_error_msg()));
-              }
-
-              return $decoded;
-            }
-            $CONFIG = [
-              'apps_paths' => [
-                ${concatStrings (mapAttrsToList mkAppStoreConfig appStores)}
-              ],
-              ${optionalString (showAppStoreSetting) "'appstoreenabled' => ${renderedAppStoreSetting},"}
-              ${optionalString cfg.caching.apcu "'memcache.local' => '\\OC\\Memcache\\APCu',"}
-              ${optionalString (c.dbname != null) "'dbname' => '${c.dbname}',"}
-              ${optionalString (c.dbhost != null) "'dbhost' => '${c.dbhost}',"}
-              ${optionalString (c.dbuser != null) "'dbuser' => '${c.dbuser}',"}
-              ${optionalString (c.dbtableprefix != null) "'dbtableprefix' => '${toString c.dbtableprefix}',"}
-              ${optionalString (c.dbpassFile != null) ''
-                  'dbpassword' => nix_read_secret(
-                    "${c.dbpassFile}"
-                  ),
-                ''
-              }
-              'dbtype' => '${c.dbtype}',
-              ${objectstoreConfig}
-            ];
-
-            $CONFIG = array_replace_recursive($CONFIG, nix_decode_json_file(
-              "${jsonFormat.generate "nextcloud-extraOptions.json" cfg.extraOptions}",
-              "impossible: this should never happen (decoding generated extraOptions file %s failed)"
-            ));
-
-            ${optionalString (cfg.secretFile != null) ''
-              $CONFIG = array_replace_recursive($CONFIG, nix_decode_json_file(
-                "${cfg.secretFile}",
-                "Cannot start Nextcloud, secrets file %s set by NixOS doesn't exist!"
-              ));
-            ''}
-          '';
           occInstallCmd = let
             mkExport = { arg, value }: "export ${arg}=${value}";
             dbpass = {
@@ -932,6 +938,7 @@ in {
           after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
           requires = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
           path = [ occ ];
+          restartTriggers = [ overrideConfig ];
           script = ''
             ${optionalString (c.dbpassFile != null) ''
               if [ ! -r "${c.dbpassFile}" ]; then
@@ -959,18 +966,6 @@ in {
               fi
             '') [ "nix-apps" "apps" ]}
 
-            # create nextcloud directories.
-            # if the directories exist already with wrong permissions, we fix that
-            for dir in ${datadir}/config ${datadir}/data ${cfg.home}/store-apps; do
-              if [ ! -e $dir ]; then
-                install -o nextcloud -g nextcloud -d $dir
-              elif [ $(stat -c "%G" $dir) != "nextcloud" ]; then
-                chgrp -R nextcloud $dir
-              fi
-            done
-
-            ln -sf ${overrideConfig} ${datadir}/config/override.config.php
-
             # Do not install if already installed
             if [[ ! -e ${datadir}/config/config.php ]]; then
               ${occInstallCmd}

nixos/modules/system/boot/resolved.nix

@@ -95,6 +95,29 @@ in
       '';
     };
 
+    services.resolved.dnsovertls = mkOption {
+      default = "false";
+      example = "true";
+      type = types.enum [ "true" "opportunistic" "false" ];
+      description = lib.mdDoc ''
+        If set to
+        - `"true"`:
+            all DNS lookups will be encrypted. This requires
+            that the DNS server supports DNS-over-TLS and
+            has a valid certificate. If the hostname was specified
+            via the `address#hostname` format in {option}`services.resolved.domains`
+            then the specified hostname is used to validate its certificate.
+        - `"opportunistic"`:
+            all DNS lookups will attempt to be encrypted, but will fallback
+            to unecrypted requests if the server does not support DNS-over-TLS.
+            Note that this mode does allow for a malicious party to conduct a
+            downgrade attack by immitating the DNS server and pretending to not
+            support encryption.
+        - `"false"`:
+            all DNS lookups are done unencrypted.
+      '';
+    };
+
     services.resolved.extraConfig = mkOption {
       default = "";
       type = types.lines;
@@ -141,6 +164,7 @@ in
           "Domains=${concatStringsSep " " cfg.domains}"}
         LLMNR=${cfg.llmnr}
         DNSSEC=${cfg.dnssec}
+        DNSOverTLS=${cfg.dnsovertls}
         ${config.services.resolved.extraConfig}
       '';
 

pkgs/applications/audio/lyrebird/default.nix

@@ -20,7 +20,7 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "lyrebird";
-  version = "1.1.0";
+  version = "1.2.0";
 
   format = "other";
   doCheck = false;
@@ -28,8 +28,8 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "chxrlt";
     repo = "lyrebird";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "0wmnww2wi8bb9m8jgc18n04gjia8pf9klmvij0w98xz11l6kxb13";
+    sha256 = "sha256-VIYcOxvSpzRvJMzEv2i5b7t0WMF7aQxB4Y1jfvuZN/Y=";
   };
 
   propagatedBuildInputs = with python3Packages; [ toml pygobject3 ];

pkgs/applications/audio/mopidy/podcast.nix

@@ -2,12 +2,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "mopidy-podcast";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchPypi {
     inherit version;
     pname = "Mopidy-Podcast";
-    sha256 = "1z2b523yvdpcf8p7m7kczrvaw045lmxzhq4qj00dflxa2yw61qxr";
+    sha256 = "sha256-grNPVEVM2PlpYhBXe6sabFjWVB9+q+apIRjcHUxH52A=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/file-managers/clifm/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clifm";
-  version = "1.15";
+  version = "1.16";
 
   src = fetchFromGitHub {
     owner = "leo-arch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4Z2u1APNfJ9Ai95MMWb5FCUgCA2Hrbp+5eBJZD3tN+U=";
+    sha256 = "sha256-tjxsJv5w0Rvk2XYisncytcRdZLRnOSDJmNJN4kkzr7U=";
   };
 
   buildInputs = [ libcap acl file readline python3];
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/leo-arch/clifm";
     description = "CliFM is a CLI-based, shell-like, and non-curses terminal file manager written in C: simple, fast, extensible, and lightweight as hell";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ nadir-ishiguro ];
     platforms = platforms.unix;
   };
 }

pkgs/applications/graphics/photoqt/default.nix

@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "photoqt";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchurl {
     url = "https://photoqt.org/pkgs/photoqt-${version}.tar.gz";
-    hash = "sha256-vxQZFlS4C+Dg9I6BKeMUFOYHz74d28gbhJlIpxSKTvs=";
+    hash = "sha256-OUqsyvmv6ccJDzcWAeS1OOmK2eXOCEgGktz6GEUzoA8=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/calibre/default.nix

@@ -32,11 +32,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "7.3.0";
+  version = "7.4.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-fBdLXSRJMBVfQOfuqOqHzgHS8fXYq2x5J181pKZhASo=";
+    hash = "sha256-xYMz0V3eBKAZNtV/8TqRmaaTQK6LeVRjZ1fakCoUSB8=";
   };
 
   patches = [

pkgs/applications/misc/pairdrop/default.nix

@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "pairdrop";
-  version = "1.10.3";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "schlagmichdoch";
     repo = "PairDrop";
     rev = "v${version}";
-    hash = "sha256-0trhkaxDWk5zlHN/Mtk/RNeeIeXyOg2QcnSO1kTsNqE=";
+    hash = "sha256-AOFATOCLf2KigeqoUzIfNngyeDesNrThRzxFvqtsXBs=";
   };
 
-  npmDepsHash = "sha256-CjRTHH/2Hz5RZ83/4p//Q2L/CB48yRXSB08QxRox2bI=";
+  npmDepsHash = "sha256-3nKjmC5eizoV/mrKDBhsSlVQxEHyIsWR6KHFwZhBugI=";
 
   dontNpmBuild = true;
 

pkgs/applications/misc/process-compose/default.nix

@@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
   pname = "process-compose";
-  version = "0.77.8";
+  version = "0.80.0";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-9kDKNzehVcf+FF7OZoMdftp+uVoZ0Zu3ML3Tlor7Qc8=";
+    hash = "sha256-9a850AKcHpKaZJ5C7l8y2dz6zHWyoZ7dIdEqtmXN3ww=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;

pkgs/applications/misc/timew-sync-server/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "timew-sync-server";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "timewarrior-synchronize";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-GaDcnPJBcDJ3AQaHzifDgdl0QT4GSbAOIqp4RrAcO3M=";
+    hash = "sha256-3THRP+hydvq/dnxzUOFGeuu8//qL7pFN0RHJVxzgibI=";
   };
 
-  vendorHash = "sha256-iROqiRWkHG6N6kivUmgmu6sg14JDdG4f98BdR7CL1gs=";
+  vendorHash = "sha256-w7I8PDQQeICDPln2Naf6whOg9qqOniTH/xs1/9luIVc=";
 
   meta = with lib; {
     homepage = "https://github.com/timewarrior-synchronize/timew-sync-server";

pkgs/applications/misc/visidata/default.nix

@@ -45,13 +45,13 @@
 }:
 buildPythonApplication rec {
   pname = "visidata";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "saulpw";
     repo = "visidata";
     rev = "v${version}";
-    hash = "sha256-3/ACuUPj0XjbWuA8/iQQAMhLYAv5Lc/5AyyKmqjhBmc=";
+    hash = "sha256-gplrkrFTIP6TLvk1YazD5roDzsPvDtOXLlTOmTio52s=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/networking/cluster/argocd/default.nix

@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.9.3";
+  version = "2.9.5";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    hash = "sha256-GaY4Cw/LlSwy35umbB4epXt6ev8ya19UjHRwhDwilqU=";
+    hash = "sha256-Os3C4+pdmbUCu1ok4MFFr4OZNdoODf4lFWRd7L9t3mM=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-2TNBbxNX4HGdRqbOEDrLBkWgw+0lyIrdxnVcbip3N6c=";
+  vendorHash = "sha256-3IplGJvGFtEYVgPU2/G9XStmGqie+8/gKPlvBI1L4MI=";
 
   # Set target as ./cmd per cli-local
   # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227

pkgs/applications/networking/cluster/helm/default.nix

@@ -20,9 +20,24 @@ buildGoModule rec {
     "-X helm.sh/helm/v3/internal/version.gitCommit=${src.rev}"
   ];
 
+  preBuild = ''
+    # set k8s version to client-go version, to match upstream
+    K8S_MODULES_VER="$(go list -f '{{.Version}}' -m k8s.io/client-go)"
+    K8S_MODULES_MAJOR_VER="$(($(cut -d. -f1 <<<"$K8S_MODULES_VER") + 1))"
+    K8S_MODULES_MINOR_VER="$(cut -d. -f2 <<<"$K8S_MODULES_VER")"
+    old_ldflags="''${ldflags}"
+    ldflags="''${ldflags} -X helm.sh/helm/v3/pkg/lint/rules.k8sVersionMajor=''${K8S_MODULES_MAJOR_VER}"
+    ldflags="''${ldflags} -X helm.sh/helm/v3/pkg/lint/rules.k8sVersionMinor=''${K8S_MODULES_MINOR_VER}"
+    ldflags="''${ldflags} -X helm.sh/helm/v3/pkg/chartutil.k8sVersionMajor=''${K8S_MODULES_MAJOR_VER}"
+    ldflags="''${ldflags} -X helm.sh/helm/v3/pkg/chartutil.k8sVersionMinor=''${K8S_MODULES_MINOR_VER}"
+  '';
+
   __darwinAllowLocalNetworking = true;
 
   preCheck = ''
+    # restore ldflags for tests
+    ldflags="''${old_ldflags}"
+
     # skipping version tests because they require dot git directory
     substituteInPlace cmd/helm/version_test.go \
       --replace "TestVersion" "SkipVersion"

pkgs/applications/networking/cluster/roxctl/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "roxctl";
-  version = "4.3.2";
+  version = "4.3.3";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "stackrox";
     rev = version;
-    sha256 = "sha256-uVpWOUSBbq8r8UBPHHIkn2WVJ0KDX3J0o8cEhn1G9KM=";
+    sha256 = "sha256-G+BmcGrVxZmVHNl2VsN7nankEIB7uV/PFpQekipdT3c=";
   };
 
   vendorHash = "sha256-Jzv4ozR8RJiwkgVGGq6dlV/7rbBLq8hFe/Pm4SJZCkU=";

pkgs/applications/networking/gns3/default.nix

@@ -12,25 +12,25 @@ in {
 
   guiStable = mkGui {
     channel = "stable";
-    version = "2.2.44.1";
+    version = "2.2.45";
-    hash = "sha256-Ae1Yij81/rhZOMMfLYaQKR4Dxx1gDGZBpBj0gLCSToI=";
+    hash = "sha256-SMnhPz5zTPtidy/BIvauDM60WgDLG+NIr9rdUrQhz0A=";
   };
 
   guiPreview = mkGui {
     channel = "stable";
-    version = "2.2.44.1";
+    version = "2.2.45";
-    hash = "sha256-Ae1Yij81/rhZOMMfLYaQKR4Dxx1gDGZBpBj0gLCSToI=";
+    hash = "sha256-SMnhPz5zTPtidy/BIvauDM60WgDLG+NIr9rdUrQhz0A=";
   };
 
   serverStable = mkServer {
     channel = "stable";
-    version = "2.2.44.1";
+    version = "2.2.45";
-    hash = "sha256-YtYXTEZj5009L8OU7jdhegYu5Xll3jZAW6NJFWOvxHQ=";
+    hash = "sha256-1GwhZEPfRW1e+enJipy7YOnA4QzeqZ7aCG92GrsZhms=";
   };
 
   serverPreview = mkServer {
     channel = "stable";
-    version = "2.2.44.1";
+    version = "2.2.45";
-    hash = "sha256-YtYXTEZj5009L8OU7jdhegYu5Xll3jZAW6NJFWOvxHQ=";
+    hash = "sha256-1GwhZEPfRW1e+enJipy7YOnA4QzeqZ7aCG92GrsZhms=";
   };
 }

pkgs/applications/networking/instant-messengers/fluffychat/default.nix

@@ -39,6 +39,7 @@ flutter313.buildFlutterApplication (rec {
     description = "Chat with your friends (matrix client)";
     homepage = "https://fluffychat.im/";
     license = licenses.agpl3Plus;
+    mainProgram = "fluffychat";
     maintainers = with maintainers; [ mkg20001 gilice ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];
     sourceProvenance = [ sourceTypes.fromSource ];
@@ -54,7 +55,7 @@ flutter313.buildFlutterApplication (rec {
 
   desktopItem = makeDesktopItem {
     name = "Fluffychat";
-    exec = "@out@/bin/fluffychat";
+    exec = "fluffychat";
     icon = "fluffychat";
     desktopName = "Fluffychat";
     genericName = "Chat with your friends (matrix client)";
@@ -73,8 +74,6 @@ flutter313.buildFlutterApplication (rec {
       mkdir -p $D
       convert $FAV -resize ''${size}x''${size} $D/fluffychat.png
     done
-    substituteInPlace $out/share/applications/*.desktop \
-      --subst-var out
 
     patchelf --add-rpath ${libwebrtcRpath} $out/app/lib/libwebrtc.so
   '';

pkgs/applications/radio/freedv/default.nix

@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freedv";
-  version = "1.9.7.1";
+  version = "1.9.7.2";
 
   src = fetchFromGitHub {
     owner = "drowe67";
     repo = "freedv-gui";
     rev = "v${version}";
-    hash = "sha256-cjqemWCjZr/1EOjUTsF4y03tvjQqquBLXxU0DG8OIFU=";
+    hash = "sha256-JbLP65fC6uHrHXpSUwtgYHB+VLfheo5RU3C44lx8QlQ=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''

pkgs/applications/version-management/sapling/default.nix

@@ -48,7 +48,7 @@ let
     owner = "facebook";
     repo = "sapling";
     rev = version;
-    hash = "sha256-+LxvPJkyq/6gtcBQepZ5pVGXP1/h30zhCHVfUGPUzFE=";
+    hash = "sha256-uzev4x9jY6foop35z4dvUMIfjRtRqhNFDVFpagOosAc";
   };
 
   addonsSrc = "${src}/addons";
@@ -56,7 +56,7 @@ let
   # Fetches the Yarn modules in Nix to to be used as an offline cache
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${addonsSrc}/yarn.lock";
-    sha256 = "sha256-3JFrVk78EiNVLLXkCFbuRnXwYHNfVv1pBPBS1yCHtPU=";
+    sha256 = "sha256-3JFrVk78EiNVLLXkCFbuRnXwYHNfVv1pBPBS1yCHtPU";
   };
 
   # Builds the NodeJS server that runs with `sl web`
@@ -113,10 +113,10 @@ python3Packages.buildPythonApplication {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "abomonation-0.7.3+smallvec1" = "sha256-AxEXR6GC8gHjycIPOfoViP7KceM29p2ZISIt4iwJzvM=";
-      "cloned-0.1.0" = "sha256-dtAyQq6fgxvr1RXPQHGiCQesvitsKpVkis4c50uolLc=";
+      "cloned-0.1.0" = "sha256-mzAqjM8qovZAd4ZF0GDuD0Ns/UztAO1pAJhukuKc5a0=";
-      "fb303_core-0.0.0" = "sha256-j+4zPXxewRxJsPQaAfvcpSkGNKw3d+inVL45Ibo7Q4E=";
+      "fb303_core-0.0.0" = "sha256-x8I0Lty+sRclpkNMqTMc29J46z/vMsVwOUS3EX7Shes=";
-      "fbthrift-0.0.1+unstable" = "sha256-fsIL07PFu645eJFttIJU4sRSjIVuA4BMJ6kYAA0BpwY=";
+      "fbthrift-0.0.1+unstable" = "sha256-yTS1wkh8tETZ4K43V0G+TbkN5jgSlXT0endDPBHa1Ps=";
-      "serde_bser-0.3.1" = "sha256-h50EJL6twJwK90sBXu40Oap4SfiT4kQAK1+bA8XKdHw=";
+      "serde_bser-0.3.1" = "sha256-vvMCa6mlcr+xazxZVl2bcF8/r+ufzZmiQ79KofZGWrA=";
     };
   };
   postPatch = ''

pkgs/applications/version-management/sapling/deps.json

@@ -1,5 +1,5 @@
 {
   "links": [],
-  "version": "0.2.20231113-145254+995db0d6",
+  "version": "0.2.20240116-133042+8acecb66",
-  "versionHash": "214505116687308775"
+  "versionHash": "11094621090461381576"
 }

pkgs/applications/video/flirc/default.nix

@@ -1,23 +1,28 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchurl
 , autoPatchelfHook
+, wrapQtAppsHook
 , hidapi
 , readline
 , qtsvg
 , qtxmlpatterns
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation {
   pname = "flirc";
-  version = "3.24.3";
+  version = "3.27.10";
 
   src = fetchurl {
-    url = "https://web.archive.org/web/20211021211803/http://apt.flirc.tv/arch/x86_64/flirc.latest.x86_64.tar.gz";
+    url = "https://web.archive.org/web/20240110170238/http://apt.flirc.tv/arch/x86_64/flirc.latest.x86_64.tar.gz";
-    sha256 = "0p4pp7j70lbw6m25lmjg6ibc67r6jcy7qs3kki9f86ji1jvrxpga";
+    hash = "sha256-iTr4vzFQ/+dsbsYD6sc8aTHctTkLKf5HnHBnO7cX5qc=";
   };
 
-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = [
+    autoPatchelfHook
+    wrapQtAppsHook
+  ];
+
   buildInputs = [
     hidapi
     readline

pkgs/applications/video/streamlink/default.nix

@@ -6,12 +6,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "streamlink";
-  version = "6.5.0";
+  version = "6.5.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-j01hWTvM4Q+NXoTKlWqsT6Y5wKNJ5983mDQ3Oog5Zu0=";
+    hash = "sha256-IH+0zpnDW/6xuPfHa5bPy0B2rWiBxh6upVPC7BPZfFc=";
   };
 
   nativeCheckInputs = with python3Packages; [

pkgs/by-name/ca/candy-icons/package.nix

@@ -0,0 +1,41 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gtk3
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "candy-icons";
+  version = "unstable-2023-12-31";
+
+  src = fetchFromGitHub {
+    owner = "EliverLara";
+    repo = "candy-icons";
+    rev = "e4464d7b4d8e1821025447b2064b6a8f5c4c8c89";
+    hash = "sha256-XdYjxWf8R4b1GK2iFQnoEOWykc19ZT37ki83WeESQBM=";
+  };
+
+  nativeBuildInputs = [
+    gtk3
+  ];
+
+  dontDropIconThemeCache = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/icons/candy-icons
+    cp -r . $out/share/icons/candy-icons
+    gtk-update-icon-cache $out/share/icons/candy-icons
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/EliverLara/candy-icons";
+    description = "An icon theme colored with sweet gradients";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ clr-cera ];
+  };
+}

pkgs/by-name/ce/centrifugo/package.nix

@@ -14,16 +14,16 @@ let
 in
 buildGoModule rec {
   pname = "centrifugo";
-  version = "5.2.0";
+  version = "5.2.1";
 
   src = fetchFromGitHub {
     owner = "centrifugal";
     repo = "centrifugo";
     rev = "v${version}";
-    hash = "sha256-lD7hUCXHH1nUN58rbn/p8BnVahEwF/jKrAtjwuXB4PM=";
+    hash = "sha256-6N7/YTL18plTbpUr7rn7wzpKNmRqz4hqGTTZ02DpWcs=";
   };
 
-  vendorHash = "sha256-s92P4PoYN2/L7pwGT0d/0E/KUNR1GT9DUhtHjAncNf4=";
+  vendorHash = "sha256-4cBHX7Vhfpd5Z0rZmY0Cl0vgLK2WczKcFhHheBA68aA=";
 
   ldflags = [
     "-s"

pkgs/by-name/co/cosmic-icons/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "cosmic-icons";
-  version = "unstable-2023-08-30";
+  version = "unstable-2023-11-28";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
-    rev = "14d8e2048087be1ad444f9b3ebb75885509f72c6";
+    rev = "1e328dacc117c21000a000a3170a801f467f3c2b";
-    sha256 = "sha256-WbdgHmTn403x95x9wEYL0T9ksbN+YLzEB2yE0UrF9T0=";
+    sha256 = "sha256-QmCHkqSPWfZhofh4ieJhl4yjt0R4J15+xElbszHS/4M=";
   };
 
   nativeBuildInputs = [ just ];

pkgs/by-name/ek/eksctl/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.167.0";
+  version = "0.168.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-8CxXfjYN9i2AxuKeYmmYN0TQROGkurfmzbqU+aOMbTY=";
+    hash = "sha256-npnsBWhs9GJXBFvEPt+8QVdHIUj/fQ6GpYpbXyVQG3U=";
   };
 
   vendorHash = "sha256-cuLzn0OZ5VC+RWGsJ8DCdJN8wm0DrsjH55K/cnyuqB8=";

pkgs/by-name/ne/netclient/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "netclient";
-  version = "0.21.2";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "gravitl";
     repo = "netclient";
     rev = "v${version}";
-    hash = "sha256-yUyC6QTNhTNN/npGXiwS7M6cGKjh4H9vR8/z2/Sckz4=";
+    hash = "sha256-7raWk4Y/ZrSaGKPLrrnD49aDALkZ+Nxycd+px8Eks10=";
   };
 
-  vendorHash = "sha256-cnzdqSd3KOITOAH++zxKTqvUzjFxszf/rwkCF6vDpMc=";
+  vendorHash = "sha256-lRXZ9iSWQEKWmeQV1ei/G4+HvqhW9U8yUv1Qb/d2jvY=";
 
   buildInputs = lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Cocoa
     ++ lib.optional stdenv.isLinux libX11;

pkgs/by-name/pa/paralus-cli/package.nix

@@ -0,0 +1,40 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, paralus-cli
+, testers
+}:
+
+buildGoModule rec {
+  pname = "paralus-cli";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    repo = "cli";
+    owner = "paralus";
+    rev = "v${version}";
+    hash = "sha256-2lTT53VTvwcxYSn9koLKMIc7pmAdrOmeuBvAHjMkqu0=";
+  };
+
+  vendorHash = "sha256-M4ur9V2HP/bxG4LzM4xoGdzd4l54pc8pjWiT5GQ3X04=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+    "-X main.buildNum=${version}"
+  ];
+
+  meta = with lib; {
+    description = "Command Line Interface tool for Paralus";
+    longDescription = ''
+      Paralus is a free, open source tool that enables controlled, audited access to Kubernetes infrastructure.
+      It comes with just-in-time service account creation and user-level credential management that integrates
+      with your RBAC and SSO. Ships as a GUI, API, and CLI.
+    '';
+    homepage = "https://www.paralus.io/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ kashw2 ];
+    mainProgram = "paralus";
+  };
+}

pkgs/by-name/po/polylux2pdfpc/package.nix

@@ -0,0 +1,34 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, nix-update-script
+}:
+
+let
+  dirname = "pdfpc-extractor";
+in
+rustPlatform.buildRustPackage rec {
+  pname = "polylux2pdfpc";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "andreasKroepelin";
+    repo = "polylux";
+    rev = "v${version}";
+    sparseCheckout = [ dirname ];
+    hash = "sha256-GefX7XsUfOMCp2THstSizRGpKAoq7yquVukWQjGuFgc=";
+  };
+  sourceRoot = "${src.name}/${dirname}";
+
+  cargoHash = "sha256-vmCaQxPkzz1ZVmtX7L3VeQb3kWhVqyPoQ1NrTSiJN9Y=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "A tool to make pdfpc interpret slides created by polylux correctly";
+    homepage = "https://github.com/andreasKroepelin/polylux/tree/main/pdfpc-extractor";
+    license = licenses.mit;
+    mainProgram = "polylux2pdfpc";
+    maintainers = [ maintainers.diogotcorreia ];
+  };
+}

pkgs/by-name/py/pyprland/package.nix

@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyprland";
-  version = "1.6.11";
+  version = "1.7.0";
   format = "pyproject";
 
   disabled = python3Packages.pythonOlder "3.10";
@@ -10,8 +10,8 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "hyprland-community";
     repo = "pyprland";
-    rev = version;
+    rev = "refs/tags/${version}";
-    hash = "sha256-intrvN6sPaokcY9If2GZvDaFdDFcHg4hO7LXXu0pLXU=";
+    hash = "sha256-xegMT8+rUMJ8mJDpMT4aLNFy4Atd1Qoe+40OxiociiE=";
   };
 
   nativeBuildInputs = with python3Packages; [ poetry-core ];

pkgs/by-name/st/stella/package.nix

@@ -1,30 +1,35 @@
 { lib
-, stdenv
-, fetchFromGitHub
-, pkg-config
 , SDL2
+, fetchFromGitHub
+, sqlite
+, pkg-config
+, stdenv
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "stella";
-  version = "6.7";
+  version = "6.7.1";
 
   src = fetchFromGitHub {
     owner = "stella-emu";
-    repo = pname;
+    repo = "stella";
-    rev = version;
+    rev = finalAttrs.version;
-    hash = "sha256-E8vbBbsVMOSY3iSSE+UCwBwmfHU7Efmre1cYlexVZ+E=";
+    hash = "sha256-4z6rFF6XqfyS9zZ4ByvTZi7cSqxpF4EcLffPbId5ppg=";
   };
 
   nativeBuildInputs = [
+    SDL2
     pkg-config
   ];
 
   buildInputs = [
     SDL2
+    sqlite
   ];
 
-  meta = with lib;{
+  strictDeps = true;
+
+  meta = {
     homepage = "https://stella-emu.github.io/";
     description = "An open-source Atari 2600 VCS emulator";
     longDescription = ''
@@ -38,8 +43,10 @@ stdenv.mkDerivation rec {
 
       As of its 3.5 release, Stella is officially donationware.
     '';
-    license = licenses.gpl2Plus;
+    changelog = "https://github.com/stella-emu/stella/releases/tag/${finalAttrs.src.rev}";
-    maintainers = with maintainers; [ AndersonTorres ];
+    license = with lib.licenses; [ gpl2Plus ];
-    platforms = platforms.unix;
+    mainProgram = "stella";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/ty/typodermic-free-fonts/package.nix

@@ -0,0 +1,33 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation {
+  pname = "typodermic-free-fonts";
+  version = "2023a";
+
+  src = fetchzip {
+    url =
+      "https://typodermicfonts.com/wp-content/uploads/2023/01/typodermic-free-fonts-2023a.zip";
+    hash = "sha256-+1TPZkeiMMV0Qmk7ERgJjVVNFar9bMISbAd23H8fwFo=";
+    curlOptsList = [ "--user-agent" "Mozilla/5.0" ]; # unbreak their wordpress
+    stripRoot = false;
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/fonts
+    cp -a "$src/Typodermic Fonts" "$out/share/fonts/opentype"
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://typodermicfonts.com/";
+    description = "Typodermic fonts";
+    maintainers = with lib.maintainers; [ ehmry ];
+    license = lib.licenses.unfree // {
+      fullName = "Font Software for Desktop End User License Agreement";
+      url = "https://typodermicfonts.com/end-user-license-agreement/";
+    }; # Font is fine for use in printing and display but cannot be embbeded.
+  };
+}

pkgs/by-name/ty/typodermic-public-domain/package.nix

@@ -0,0 +1,30 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation {
+  pname = "typodermic-public-domain";
+  version = "2022-11";
+
+  src = fetchzip {
+    url =
+      "https://typodermicfonts.com/wp-content/uploads/2022/11/typodermic-public-domain-2022-11.zip";
+    hash = "sha256-2hqpehQ4zxSvsw2dtom/fkMAayJKNvOdYs+c+rrvJKw=";
+    curlOptsList = [ "--user-agent" "Mozilla/5.0" ]; # unbreak their wordpress
+    stripRoot = false;
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/fonts
+    cp -a "$src/OpenType Fonts" "$out/share/fonts/opentype"
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://typodermicfonts.com/";
+    description = "Vintage Typodermic fonts";
+    maintainers = with lib.maintainers; [ ehmry ];
+    license = lib.licenses.cc0;
+  };
+}

pkgs/by-name/wi/windmill/package.nix

@@ -24,13 +24,13 @@
 
 let
   pname = "windmill";
-  version = "1.219.1";
+  version = "1.246.15";
 
   src = fetchFromGitHub {
     owner = "windmill-labs";
     repo = "windmill";
     rev = "v${version}";
-    hash = "sha256-HGZuIun9PWi3Fv/kX95k4xnXu1L604teWUKXzjVXKF0=";
+    hash = "sha256-5KDSCag70ww1mYvfKf3rg2RTi80rEWZnMTXB+/6VsNM=";
   };
 
   pythonEnv = python3.withPackages (ps: [ ps.pip-tools ]);
@@ -42,7 +42,7 @@ let
 
     sourceRoot = "${src.name}/frontend";
 
-    npmDepsHash = "sha256-1uya/4FjMHTDW/KX1YinhTT/Mb7bJ9XVTWc6cU0oqJ8=";
+    npmDepsHash = "sha256-PdRNjUQdr1NgTO5UaWfH8rJeiFB/VJ6sJkwhpmPo/1A=";
 
     # without these you get a
     # FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory

pkgs/data/fonts/inconsolata/default.nix

@@ -2,23 +2,23 @@
 
 stdenv.mkDerivation {
   pname = "inconsolata";
-  version = "unstable-2021-01-19";
+  version = "3.001";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "fonts";
-    rev = "f113126dc4b9b1473d9354a86129c9d7b837aa1a";
+    rev = "0f203e3740b5eb77e0b179dff1e5869482676782";
-    sha256 = "0safw5prpa63mqcyfw3gr3a535w4c9hg5ayw5pkppiwil7n3pyxs";
+    sha256 = "sha256-Q8eUJ0mkoB245Ifz5ulxx61x4+AqKhG0uqhWF2nSLpw=";
   };
 
   installPhase = ''
-    install -m644 --target $out/share/fonts/truetype/inconsolata -D $src/ofl/inconsolata/*.ttf
+    install -m644 --target $out/share/fonts/truetype/inconsolata -D $src/ofl/inconsolata/static/*.ttf
   '';
 
   meta = with lib; {
     homepage = "https://www.levien.com/type/myfonts/inconsolata.html";
     description = "A monospace font for both screen and print";
-    maintainers = with maintainers; [ mikoim raskin ];
+    maintainers = with maintainers; [ appsforartists mikoim raskin ];
     license = licenses.ofl;
     platforms = platforms.all;
   };

pkgs/development/compilers/fpc/default.nix

@@ -36,11 +36,14 @@ stdenv.mkDerivation rec {
     substituteInPlace fpcsrc/compiler/systems/t_linux.pas --subst-var-by syslibpath "${glibc}/lib"
     # Replace the `codesign --remove-signature` command with a custom script, since `codesign` is not available
     # in nixpkgs
+    # Remove the -no_uuid strip flag which does not work on llvm-strip, only
+    # Apple strip.
     substituteInPlace fpcsrc/compiler/Makefile \
       --replace \
         "\$(CODESIGN) --remove-signature" \
         "${./remove-signature.sh}" \
-      --replace "ifneq (\$(CODESIGN),)" "ifeq (\$(OS_TARGET), darwin)"
+      --replace "ifneq (\$(CODESIGN),)" "ifeq (\$(OS_TARGET), darwin)" \
+      --replace "-no_uuid" ""
   '';
 
   NIX_LDFLAGS = lib.optionalString

pkgs/development/compilers/llvm/10/compiler-rt/default.nix

@@ -126,6 +126,9 @@ stdenv.mkDerivation {
     # "All of the code in the compiler-rt project is dual licensed under the MIT
     # license and the UIUC License (a BSD-like license)":
     license = with lib.licenses; [ mit ncsa ];
-    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
+    broken = stdenv.hostPlatform.system == "aarch64-darwin"
+      # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
+      # https://reviews.llvm.org/D43106#1019077
+      || (stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang);
   };
 }

pkgs/development/compilers/llvm/11/compiler-rt/default.nix

@@ -135,6 +135,6 @@ stdenv.mkDerivation {
     license = with lib.licenses; [ mit ncsa ];
     # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
     # https://reviews.llvm.org/D43106#1019077
-    broken = stdenv.hostPlatform.isRiscV && stdenv.hostPlatform.is32bit && !stdenv.cc.isClang;
+    broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
   };
 }

pkgs/development/compilers/llvm/12/compiler-rt/default.nix

@@ -124,5 +124,8 @@ stdenv.mkDerivation {
     # "All of the code in the compiler-rt project is dual licensed under the MIT
     # license and the UIUC License (a BSD-like license)":
     license = with lib.licenses; [ mit ncsa ];
+    # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
+    # https://reviews.llvm.org/D43106#1019077
+    broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
   };
 }

pkgs/development/compilers/llvm/13/compiler-rt/default.nix

@@ -131,5 +131,8 @@ stdenv.mkDerivation {
     # "All of the code in the compiler-rt project is dual licensed under the MIT
     # license and the UIUC License (a BSD-like license)":
     license = with lib.licenses; [ mit ncsa ];
+    # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
+    # https://reviews.llvm.org/D43106#1019077
+    broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
   };
 }

pkgs/development/compilers/llvm/14/compiler-rt/default.nix

@@ -139,5 +139,8 @@ stdenv.mkDerivation {
     # "All of the code in the compiler-rt project is dual licensed under the MIT
     # license and the UIUC License (a BSD-like license)":
     license = with lib.licenses; [ mit ncsa ];
+    # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
+    # https://reviews.llvm.org/D43106#1019077
+    broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
   };
 }

pkgs/development/compilers/llvm/15/compiler-rt/default.nix

@@ -138,5 +138,8 @@ stdenv.mkDerivation {
     # "All of the code in the compiler-rt project is dual licensed under the MIT
     # license and the UIUC License (a BSD-like license)":
     license = with lib.licenses; [ mit ncsa ];
+    # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
+    # https://reviews.llvm.org/D43106#1019077
+    broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
   };
 }

pkgs/development/compilers/llvm/16/compiler-rt/default.nix

@@ -152,5 +152,8 @@ stdenv.mkDerivation {
     # "All of the code in the compiler-rt project is dual licensed under the MIT
     # license and the UIUC License (a BSD-like license)":
     license = with lib.licenses; [ mit ncsa ];
+    # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
+    # https://reviews.llvm.org/D43106#1019077
+    broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
   };
 }

pkgs/development/compilers/llvm/17/compiler-rt/default.nix

@@ -152,5 +152,8 @@ stdenv.mkDerivation {
     # "All of the code in the compiler-rt project is dual licensed under the MIT
     # license and the UIUC License (a BSD-like license)":
     license = with lib.licenses; [ mit ncsa ];
+    # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
+    # https://reviews.llvm.org/D43106#1019077
+    broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
   };
 }

pkgs/development/compilers/llvm/9/compiler-rt/default.nix

@@ -115,6 +115,9 @@ stdenv.mkDerivation {
     # "All of the code in the compiler-rt project is dual licensed under the MIT
     # license and the UIUC License (a BSD-like license)":
     license = with lib.licenses; [ mit ncsa ];
-    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
+    broken = stdenv.hostPlatform.system == "aarch64-darwin"
+      # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
+      # https://reviews.llvm.org/D43106#1019077
+      || (stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang);
   };
 }

pkgs/development/compilers/llvm/git/compiler-rt/default.nix

@@ -152,5 +152,8 @@ stdenv.mkDerivation {
     # "All of the code in the compiler-rt project is dual licensed under the MIT
     # license and the UIUC License (a BSD-like license)":
     license = with lib.licenses; [ mit ncsa ];
+    # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
+    # https://reviews.llvm.org/D43106#1019077
+    broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
   };
 }

pkgs/development/compilers/yosys/default.nix

@@ -77,13 +77,13 @@ let
 
 in stdenv.mkDerivation (finalAttrs: {
   pname   = "yosys";
-  version = "0.36";
+  version = "0.37";
 
   src = fetchFromGitHub {
     owner = "YosysHQ";
     repo  = "yosys";
     rev   = "refs/tags/${finalAttrs.pname}-${finalAttrs.version}";
-    hash  = "sha256-jcaXn77OuKeC3AQTicILP3ABkJ3qBccM+uGbj1wn2Vw=";
+    hash  = "sha256-JRztXMZMBFhdZMeVHkRxFulRrFzyuNaLzcRlmgAz6Gc=";
   };
 
   enableParallelBuilding = true;

pkgs/development/compilers/yosys/fix-clang-build.patch

@@ -1,5 +1,3 @@
-diff --git a/Makefile b/Makefile
-index fa95b7b70..4d15ed721 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -215,7 +215,7 @@ ABC_ARCHFLAGS += "-DABC_NO_RLIMIT"
@@ -11,8 +9,17 @@ index fa95b7b70..4d15ed721 100644
  LD = clang++
  CXXFLAGS += -std=$(CXXSTD) -Os
  ABCMKARGS += ARCHFLAGS="-DABC_USE_STDINT_H -Wno-c++11-narrowing $(ABC_ARCHFLAGS)"
-diff --git a/tests/fmt/run-test.sh b/tests/fmt/run-test.sh
+--- a/tests/cxxrtl/run-test.sh
-index 914a72347..bc0b129d2 100644
++++ b/tests/cxxrtl/run-test.sh
+@@ -5,7 +5,7 @@ set -ex
+ run_subtest () {
+     local subtest=$1; shift
+ 
+-    ${CC:-gcc} -std=c++11 -O2 -o cxxrtl-test-${subtest} -I../../backends/cxxrtl/runtime test_${subtest}.cc -lstdc++
++    ${CXX:-gcc} -std=c++11 -O2 -o cxxrtl-test-${subtest} -I../../backends/cxxrtl/runtime test_${subtest}.cc -lstdc++
+     ./cxxrtl-test-${subtest}
+ }
+ 
 --- a/tests/fmt/run-test.sh
 +++ b/tests/fmt/run-test.sh
 @@ -51,7 +51,7 @@ test_cxxrtl () {

pkgs/development/interpreters/janet/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "janet";
-  version = "1.32.1";
+  version = "1.33.0";
 
   src = fetchFromGitHub {
     owner = "janet-lang";
     repo = "janet";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-24d9N59pTfQATWmAZN4dAFT8RTTlUlBPKokcQ/Fd2No=";
+    hash = "sha256-kXbJtWxvysC4hLkgVyPpkunFhN+2iVu+S+LCo5ikj5s=";
   };
 
   postPatch = ''

pkgs/development/libraries/ogre/default.nix

@@ -6,7 +6,6 @@
 , unzip
 , SDL2
 , boost
-, freeimage
 , freetype
 , libpng
 , ois
@@ -55,7 +54,6 @@ let
     buildInputs = [
       SDL2
       boost
-      freeimage
       freetype
       libpng
       ois

pkgs/development/python-modules/aiopvapi/default.nix

@@ -1,16 +1,16 @@
 { lib
 , aiohttp
-, async-timeout
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "aiopvapi";
   version = "3.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -21,9 +21,18 @@ buildPythonPackage rec {
     hash = "sha256-+jhfp8gLEmL8TGPPN7QY8lw1SkV4sMSDb4VSq2OJ6PU=";
   };
 
+  postPatch = ''
+    # https://github.com/sander76/aio-powerview-api/pull/31
+    substituteInPlace setup.py \
+      --replace '"asyncio", ' ""
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     aiohttp
-    async-timeout
   ];
 
   nativeCheckInputs = [
@@ -34,9 +43,20 @@ buildPythonPackage rec {
     "aiopvapi"
   ];
 
+  disabledTestPaths = [
+    # https://github.com/sander76/aio-powerview-api/issues/32
+    "tests/test_shade.py"
+    "tests/test_scene.py"
+    "tests/test_room.py"
+    "tests/test_apiresource.py"
+    "tests/test_hub.py"
+    "tests/test_scene_members.py"
+  ];
+
   meta = with lib; {
     description = "Python API for the PowerView API";
     homepage = "https://github.com/sander76/aio-powerview-api";
+    changelog = "https://github.com/sander76/aio-powerview-api/releases/tag/v${version}";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/dask-awkward/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dask-awkward";
-  version = "2024.1.1";
+  version = "2024.1.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "dask-contrib";
     repo = "dask-awkward";
     rev = "refs/tags/${version}";
-    hash = "sha256-8nha0h1f/pLl7YmUc5HzlqwNRE/gRpRV2PudkddMHqg=";
+    hash = "sha256-5UyB/qFfQPLA1N3L6NipW6+FzI0x6hZXu6ickAktlYw=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/dynalite-devices/default.nix

@@ -43,7 +43,7 @@ buildPythonPackage rec {
   ];
 
   # it would use the erroneous tag v0.47
-  passthru.skipBulkUpdate = false;
+  passthru.skipBulkUpdate = true;
 
   meta = with lib; {
     description = "An unofficial Dynalite DyNET interface creating devices";

pkgs/development/python-modules/habluetooth/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "habluetooth";
-  version = "2.2.0";
+  version = "2.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "habluetooth";
     rev = "refs/tags/v${version}";
-    hash = "sha256-iFMs4FXl82ZkOKNad0XY8Ci9gHwdkyzP5LiYJ4/uyzY=";
+    hash = "sha256-oPdKmaj2wKgOQw7QYwOQc8efcNtQiGryZgNJ+bbB6L8=";
   };
 
   postPatch = ''

pkgs/development/python-modules/optimum/default.nix

@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "optimum";
-  version = "1.16.1";
+  version = "1.16.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "optimum";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UlxArfNK4Ialodpne5GY7GuWGUBcLbSjAidL67Li0S0=";
+    hash = "sha256-bEwCUPZJT1UTD8mQJKg+Nwag6kpn4076uyKocKI/+/M=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pip-api/default.nix

@@ -1,25 +1,32 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pip
 , pretend
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , virtualenv
 }:
 
 buildPythonPackage rec {
   pname = "pip-api";
-  version = "0.0.30";
+  version = "0.0.31";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
+  src = fetchFromGitHub {
-    inherit pname version;
+    owner = "di";
-    hash = "sha256-oF3yx6qbcVc3S89Cc1RCAaDHuuYKnGW8+E85We84lvM=";
+    repo = "pip-api";
+    rev = "refs/tags/${version}";
+    hash = "sha256-WFyrEEfrGwsITYzQaukwmz5ml+I6zlMddINTkGeNUTM=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pip
   ];
@@ -46,6 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Importable pip API";
     homepage = "https://github.com/di/pip-api";
+    changelog = "https://github.com/di/pip-api/blob/${version}/CHANGELOG";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/pyatspi/default.nix

@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "pyatspi";
-  version = "2.46.0";
+  version = "2.46.1";
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1FSJzz1HqhULGjXolJs7MQNfjCB15YjSa278Yllwxi4=";
+    sha256 = "+R9qV0NOnAfRPVxL+BndeOjuYFqsKuRdjGTCgRT7BBs=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/development/python-modules/reuse/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "reuse";
-  version = "2.1.0";
+  version = "3.0.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "fsfe";
     repo = "reuse-tool";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MEQiuBxe/ctHlAnmLhQY4QH62uAcHb7CGfZz+iZCRSk=";
+    hash = "sha256-hDvOT9BP/E95FTa8rvtdxQoEDYgfMAkCSbX5KKV3qbQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/ufo2ft/default.nix

@@ -1,28 +1,25 @@
 { lib
-, buildPythonPackage
-, fetchPypi
-
-# build
-, setuptools-scm
-
-# runtime
 , booleanoperations
+, buildPythonPackage
 , cffsubr
 , compreffor
 , cu2qu
 , defcon
+, fetchPypi
 , fonttools
+, pytestCheckHook
+, pythonOlder
+, setuptools-scm
 , skia-pathops
 , ufolib2
-
-# tests
-, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "ufo2ft";
   version = "2.33.4";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
@@ -50,19 +47,27 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [
+  disabledTests = [
     # Do not depend on skia.
-    "--deselect=tests/integration_test.py::IntegrationTest::test_removeOverlaps_CFF_pathops"
+    "test_removeOverlaps_CFF_pathops"
-    "--deselect=tests/integration_test.py::IntegrationTest::test_removeOverlaps_pathops"
+    "test_removeOverlaps_pathops"
-    "--deselect=tests/preProcessor_test.py::TTFPreProcessorTest::test_custom_filters_as_argument"
+    "test_custom_filters_as_argument"
-    "--deselect=tests/preProcessor_test.py::TTFInterpolatablePreProcessorTest::test_custom_filters_as_argument"
+    "test_custom_filters_as_argument"
+    # Some integration tests fail
+    "test_compileVariableCFF2"
+    "test_compileVariableTTF"
+    "test_drop_glyph_names_variable"
+    "test_drop_glyph_names_variable"
   ];
 
-  pythonImportsCheck = [ "ufo2ft" ];
+  pythonImportsCheck = [
+    "ufo2ft"
+  ];
 
   meta = with lib; {
     description = "Bridge from UFOs to FontTools objects";
     homepage = "https://github.com/googlefonts/ufo2ft";
+    changelog = "https://github.com/googlefonts/ufo2ft/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };

pkgs/development/tools/database/dbmate/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "2.10.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gJ1kYedws20C669Gonmsui59a/TvPXawqkx5k4pPn8M=";
+    hash = "sha256-kY91ToCEl1bNdeIKDAAR3q7053oyFhx+THre7Syw96g=";
   };
 
-  vendorHash = "sha256-JjFBUjSbHnJE7FPa11lQBx7Dvv7uBkuvLYqeuaDkHJM=";
+  vendorHash = "sha256-z33Ayxc/ftNHh5zunDu0AlamuoSglX4aqOKQLuYT3+s=";
 
   doCheck = false;
 

pkgs/development/tools/jql/default.nix

@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jql";
-  version = "7.1.2";
+  version = "7.1.3";
 
   src = fetchFromGitHub {
     owner = "yamafaktory";
     repo = pname;
     rev = "jql-v${version}";
-    hash = "sha256-gdHxaQkJJw/cvnWhAodp57VIfW5oehNE7/zGs7B5Akg=";
+    hash = "sha256-UiIIPA4JREWniNOcqMW2jnfaEDpkT1jbdv3whr49Gqg=";
   };
 
-  cargoHash = "sha256-urFwYHlHhxOmSBSpfEJV/3sg40r8CTnAOjjLqQ/GXeY=";
+  cargoHash = "sha256-9ApucHYFHBritAdylzQuUDa47yG8dAeIQwPezXP3BXY=";
 
   meta = with lib; {
     description = "A JSON Query Language CLI tool built with Rust";

pkgs/development/tools/package-project-cmake/default.nix

@@ -5,13 +5,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "package-project-cmake";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "TheLartians";
     repo = "PackageProject.cmake";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-E7WZSYDlss5bidbiWL1uX41Oh6JxBRtfhYsFU19kzIw=";
+    hash = "sha256-2u7H2ZR7eQ6eoRIVZ1WBxw9K93E8BVYErZNDe1Jl8rg=";
   };
 
   dontConfigure = true;

pkgs/development/tools/rust/cargo-show-asm/test-basic-x86_64.nix

@@ -9,7 +9,7 @@ name = "add"
 version = "0.0.0"
 EOF
   cat >src/lib.rs <<EOF
-pub fn add(a: u32, b: u32) -> u32 { a + b }
+#[inline(never)] pub fn add(a: u32, b: u32) -> u32 { a + b }
 EOF
 
   [[ "$(cargo asm add::add | tee /dev/stderr)" == *"lea eax, "* ]]

pkgs/development/tools/rust/rust-analyzer/default.nix

@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2024-01-08";
+  version = "2024-01-15";
-  cargoSha256 = "sha256-TzY+A0QvtSionE1bL9NHFJzuovUW7N4HCGxLz81CInU=";
+  cargoSha256 = "sha256-TVHMoGp7MiY8zyMbBQIbEMS4KbsqJP4WSl8snIvewCQ=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    sha256 = "sha256-fVi0wlgFjp/bXz1LxvbiBB07Aj5ZnNq2xsvrCzDpIDc=";
+    sha256 = "sha256-H3RdtMxH8moTInVmracgtF8bgFpaEE3zYoSkuv7PBs0=";
   };
 
   cargoBuildFlags = [ "--bin" "rust-analyzer" "--bin" "rust-analyzer-proc-macro-srv" ];

pkgs/development/web/bun/default.nix

@@ -12,7 +12,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.0.23";
+  version = "1.0.24";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -51,19 +51,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-qWg2WdWQHAYXLkIQd2RPQ2j1Bo3qKHhlxcFaqDIxcks=";
+        hash = "sha256-emp0SXua/XdgVfbEemahRabl9K1MV2HfY/j4iInCUu4=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-nojMZknNXG+pMsSWx7SkkcAweeXtF3W+XC8+QvQHtD4=";
+        hash = "sha256-92el7Z80IA37CJfj9XckG4JstAKI+36Z8/rA3SgukZg=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64.zip";
-        hash = "sha256-MQjeSKVYtKwVMq9p2NLZZPaxdEJJYzDLQ6xusR8qZGM=";
+        hash = "sha256-Gpa+wgKoDKKuVO8ZkwucBs1yfVw+34L8Qhv3FuyK8go=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-IPQ4W8B4prlLljf7OviGpYtqNxSxMB1kHCMOrnbxldw=";
+        hash = "sha256-8uHTAGCJ6fZ2CdN8GUSfOrSUyu1lIUXAL73ezx/7tV8=";
       };
     };
     updateScript = writeShellScript "update-bun" ''

pkgs/games/stuntrally/default.nix

@@ -48,6 +48,13 @@ stdenv.mkDerivation rec {
     hash = "sha256-fglm1FetFGHM/qGTtpxDb8+k2iAREn5DQR5GPujuLms=";
   };
 
+  postPatch = ''
+    substituteInPlace config/*-default.cfg \
+      --replace "screenshot_png = off" "screenshot_png = on"
+    substituteInPlace source/*/BaseApp_Create.cpp \
+      --replace "Codec_FreeImage" "Codec_STBI"
+  '';
+
   preConfigure = ''
     rmdir data/tracks
     ln -s ${tracks}/ data/tracks

pkgs/games/unciv/default.nix

@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "4.9.13";
+  version = "4.9.19";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-AQHhqxnNTNArXYlqpNcUMDRVb/IAR3dCYue+y0wPAw8=";
+    hash = "sha256-C591QKk36v4GAO2oXLOHE4B2RpOObtriN6EPC+xXKnc=";
   };
 
   dontUnpack = true;

pkgs/os-specific/linux/firmware/sof-firmware/default.nix

@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sof-firmware";
-  version = "2.2.6";
+  version = "2023.12";
 
   src = fetchurl {
-    url = "https://github.com/thesofproject/sof-bin/releases/download/v${version}/sof-bin-v${version}.tar.gz";
+    url = "https://github.com/thesofproject/sof-bin/releases/download/v${version}/sof-bin-${version}.tar.gz";
-    sha256 = "sha256-kyLCp2NtAoRcOyaYTVirj3jWP/THZtCEwxlqWF4ACQU=";
+    sha256 = "sha256-VeR+tj5iSNvat9ojK7HjHKLnFVs33BFvbcWxc8ujUDs=";
   };
 
   dontFixup = true; # binaries must not be stripped or patchelfed
@@ -17,8 +17,10 @@ stdenvNoCC.mkDerivation rec {
   installPhase = ''
     runHook preInstall
     mkdir -p $out/lib/firmware/intel
-    cp -av sof-v${version} $out/lib/firmware/intel/sof
+    cp -av sof $out/lib/firmware/intel/sof
-    cp -av sof-tplg-v${version} $out/lib/firmware/intel/sof-tplg
+    cp -av sof-tplg $out/lib/firmware/intel/sof-tplg
+    cp -av sof-ace-tplg $out/lib/firmware/intel/sof-ace-tplg
+    cp -av sof-ipc4 $out/lib/firmware/intel/sof-ipc4
     runHook postInstall
   '';
 

pkgs/os-specific/linux/health-check/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "health-check";
-  version = "0.03.12";
+  version = "0.04.00";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-LuUCs6GLaxI5ywv6dr8dlvAXfcLbr1t7y6s/pb6JDpg=";
+    hash = "sha256-CPKXpPpdagq3UnTk8Z58WtSPek8L79totKX+Uh6foVg=";
   };
 
   buildInputs = [ json_c libbsd ];

pkgs/os-specific/linux/kernel/hardened/patches.json

@@ -2,52 +2,52 @@
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.304-hardened1.patch",
+            "name": "linux-hardened-4.19.305-hardened1.patch",
-            "sha256": "0bv6abcx8sknhsnijs176yq7q2mgrlyrv5xysnxa0l6wqpl2gqif",
+            "sha256": "1lrz04mxcp82qmfmwsahi5amv9j5j5qv7xjq9jcrycwcj0ljrfcv",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.304-hardened1/linux-hardened-4.19.304-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.305-hardened1/linux-hardened-4.19.305-hardened1.patch"
         },
-        "sha256": "165mljr8v1cf4vf4a4b44hx089rprkssvi2azq5wbxxg3basbind",
+        "sha256": "1s6srmhd3visqchshg566c7gq5wnxr3m74854kxksqhhfif450ns",
-        "version": "4.19.304"
+        "version": "4.19.305"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.206-hardened1.patch",
+            "name": "linux-hardened-5.10.208-hardened1.patch",
-            "sha256": "14xmp28grpwpgrsg88bnv164kk54k6akw5jydrs8447mqfyw7sqr",
+            "sha256": "0aniccfyi81wwfzva3i2vxairnkdwrypislphf8r9wg49sya2z7f",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.206-hardened1/linux-hardened-5.10.206-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.208-hardened1/linux-hardened-5.10.208-hardened1.patch"
         },
-        "sha256": "0ns8qxcrxj9i76b93xcghl002l8vbkg7ksd435sikig62qr62gf4",
+        "sha256": "0vpvy47cmcinhs76cjl2n81zrlhbqgpi4v29izn2hzsl15x189ch",
-        "version": "5.10.206"
+        "version": "5.10.208"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.146-hardened1.patch",
+            "name": "linux-hardened-5.15.147-hardened1.patch",
-            "sha256": "0cd8gzixkc89n647g108f9r9dn8a3vw9ajdh4g7w7bq6vq71gglj",
+            "sha256": "1z37g4gwxhdsbqh0yy7m9wlglayrmypsrdjgx0vk3shgvaiwx2il",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.146-hardened1/linux-hardened-5.15.146-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.147-hardened1/linux-hardened-5.15.147-hardened1.patch"
         },
-        "sha256": "14nijbspmzd4r38l8cpl4vn9dhawzcfnhyc0gnaxl2m8l9gpm02s",
+        "sha256": "1m7wznqiakarpar4a0nbwxql0hkvds0s79zx3r1xn0fj4mbfdhan",
-        "version": "5.15.146"
+        "version": "5.15.147"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.266-hardened1.patch",
+            "name": "linux-hardened-5.4.267-hardened1.patch",
-            "sha256": "1gbyxz788j5lirjc62b56didnwq5s69cfindzndsj1r5wm0hknp4",
+            "sha256": "12jyk0dmrs8kmmh8ca4s3jr2pk6m0izhm5yvncgjwff3xybzyj5p",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.266-hardened1/linux-hardened-5.4.266-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.267-hardened1/linux-hardened-5.4.267-hardened1.patch"
         },
-        "sha256": "1dmcn9i3nvf1gldm1a32gnl5ybwbk2lizb3wa4gc06g7dxz2y1ys",
+        "sha256": "0hqw8ww7y9mjrh1wgdkiwk8llxpf4lxwmsmzxm8j4l615kpqvlj2",
-        "version": "5.4.266"
+        "version": "5.4.267"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.72-hardened1.patch",
+            "name": "linux-hardened-6.1.73-hardened1.patch",
-            "sha256": "0zp6i44y3fi2xsk4jbwhk8w688ci34p5ymmk3kkb8s1cvhqzgddy",
+            "sha256": "02w9cbsql70kkjyvny65f2375q0c4n1rx7gsm7sd61h2hwki2ykp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.72-hardened1/linux-hardened-6.1.72-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.73-hardened1/linux-hardened-6.1.73-hardened1.patch"
         },
-        "sha256": "09h9kzv2xfrn369ynl09dfnjl9025b9vpkcxg75gyp63fy8fdp4q",
+        "sha256": "11vyblm4nkjncdi3akcyizw7jkyxsqn2mjixc51f7kgiddq4ibbc",
-        "version": "6.1.72"
+        "version": "6.1.73"
     },
     "6.5": {
         "patch": {
@@ -62,11 +62,11 @@
     "6.6": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.6.11-hardened1.patch",
+            "name": "linux-hardened-6.6.12-hardened1.patch",
-            "sha256": "07l4fvc115iqiwbaq916g1l1jpmcg8injr5z5dx6jp2h635w72n3",
+            "sha256": "1avlbsf9z1q606wan1wkmgh7qwgzq7r8m2lk6glxhhv54chxv5k9",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.11-hardened1/linux-hardened-6.6.11-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.12-hardened1/linux-hardened-6.6.12-hardened1.patch"
         },
-        "sha256": "0lhyczcj1fhh52fjf06ikp5yh7kxc1qymsw44rv6v25vc6kfbqmg",
+        "sha256": "01a6czk6xz9syxvkb2yhbn3vypqy2mnjq7ni84x4nklw7n6frmqz",
-        "version": "6.6.11"
+        "version": "6.6.12"
     }
 }

pkgs/os-specific/linux/kernel/kernels-org.json

@@ -8,8 +8,8 @@
         "hash": "sha256:1dfbbydmayfj9npx3z0g38p574pmcx3qgs49dv0npigl48wd9yvq"
     },
     "6.1": {
-        "version": "6.1.73",
+        "version": "6.1.74",
-        "hash": "sha256:11vyblm4nkjncdi3akcyizw7jkyxsqn2mjixc51f7kgiddq4ibbc"
+        "hash": "sha256:08i0pgmmdnrmlha6ncl6if39rqg44c9dqyggf0swxlmfkzbx3yxp"
     },
     "5.15": {
         "version": "5.15.147",
@@ -28,11 +28,11 @@
         "hash": "sha256:1s6srmhd3visqchshg566c7gq5wnxr3m74854kxksqhhfif450ns"
     },
     "6.6": {
-        "version": "6.6.12",
+        "version": "6.6.13",
-        "hash": "sha256:01a6czk6xz9syxvkb2yhbn3vypqy2mnjq7ni84x4nklw7n6frmqz"
+        "hash": "sha256:1g60hblf4mywq3rivkqmz2n7a9arinxwh4g4n4x4xb8ysiyrxf48"
     },
     "6.7": {
-        "version": "6.7",
+        "version": "6.7.1",
-        "hash": "sha256:0s8hbcsg7fdvspqam8kzcxygjsznr4zfi60nqgc81l3n4m518cgg"
+        "hash": "sha256:1hv8mma3i6zhjix5k2g12jmajqy29c1xjfjkllmj18l6irbgmkqy"
     }
 }

pkgs/os-specific/linux/kernel/linux-rt-6.1.nix

@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.70-rt21"; # updated by ./update-rt.sh
+  version = "6.1.73-rt22"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "1vxgardfm2fi4c7zkxpljqicllfqqnp835a9lyb7dh2nchk6a4zd";
+    sha256 = "11vyblm4nkjncdi3akcyizw7jkyxsqn2mjixc51f7kgiddq4ibbc";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "03lb5s16f7j7s7qvh55mxiv6a6rdnx2j8cyy6c6v4naaq9s82lgn";
+      sha256 = "1hl7y2sab21l81nl165b77jhfjhpcc1gvz64fs2yjjp4q2qih4b0";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 

pkgs/os-specific/linux/systemd/default.nix

@@ -88,7 +88,11 @@
 , withAnalyze ? true
 , withApparmor ? true
 , withAudit ? true
-, withBootloader ? withEfi && !stdenv.hostPlatform.isMusl # compiles systemd-boot, assumes EFI is available.
+  # compiles systemd-boot, assumes EFI is available.
+, withBootloader ? withEfi
+    && !stdenv.hostPlatform.isMusl
+    # "Unknown 64-bit data model"
+    && !stdenv.hostPlatform.isRiscV32
 , withCompression ? true  # adds bzip2, lz4, xz and zstd
 , withCoredump ? true
 , withCryptsetup ? true
@@ -108,6 +112,8 @@
     && !stdenv.hostPlatform.isMips64   # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
     # can't find gnu/stubs-32.h
     && (stdenv.hostPlatform.isPower64 -> stdenv.hostPlatform.isBigEndian)
+    # https://reviews.llvm.org/D43106#1019077
+    && (stdenv.hostPlatform.isRiscV32 -> stdenv.cc.isClang)
     # buildPackages.targetPackages.llvmPackages is the same as llvmPackages,
     # but we do it this way to avoid taking llvmPackages as an input, and
     # risking making it too easy to ignore the above comment about llvmPackages.

pkgs/servers/elasticmq-server-bin/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "elasticmq-server";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchurl {
     url = "https://s3-eu-west-1.amazonaws.com/softwaremill-public/${finalAttrs.pname}-${finalAttrs.version}.jar";
-    sha256 = "sha256-kkRHJuA9ogPzm8XFxmKNsakawcVVVj9b7gWicLZE/mM=";
+    sha256 = "sha256-LjaabD9Ax0Jy1OJgEX2TWctEfsK7jlzWKAOq6RCVeqQ=";
   };
 
   # don't do anything?

pkgs/servers/http/jetty/11.x.nix

@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "11.0.18";
+  version = "11.0.19";
-  hash = "sha256-HxtO2r6YWo6+MAYUgk7dNSPDqQZoyO9t/8NdI5pPkL4=";
+  hash = "sha256-CJpJSeIuFNiduCpiSoa52vYIncWn5/tMEgMVslJCcy0=";
 }

pkgs/servers/http/jetty/12.x.nix

@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "12.0.3";
+  version = "12.0.5";
-  hash = "sha256-Z/jJKKzoqTPZnoFOMwbpSd/Kd1w+rXloKH+aw6aNrKs=";
+  hash = "sha256-TnKoDgn59t0m5dBuMISQPpQrIFcTsv77V/KXJabpsyA=";
 }

pkgs/servers/monitoring/grafana-agent/default.nix

@@ -14,16 +14,16 @@
 
 buildGoModule rec {
   pname = "grafana-agent";
-  version = "0.39.0";
+  version = "0.39.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "agent";
     rev = "v${version}";
-    hash = "sha256-mUPWww7RnrCwJKGWXIsX7vnTmxj2h31AzM8a0eKa15g=";
+    hash = "sha256-GUsLscLbDnHBO+BWiuo/qCxrV+mW5XUlLpqj8iWUxzo=";
   };
 
-  vendorHash = "sha256-nOuinJXTiTumHlOWcuGTBcrw9ArIdb/R8jIT/5+i0vM=";
+  vendorHash = "sha256-lC6ESGT0dheATVDjJZxDP8YU4RtJMEfTJSyETDtGzTc=";
   proxyVendor = true; # darwin/linux hash mismatch
 
   frontendYarnOfflineCache = fetchYarnDeps {

pkgs/servers/search/meilisearch/default.nix

@@ -3,6 +3,7 @@
 , rustPlatform
 , fetchFromGitHub
 , Security
+, SystemConfiguration
 , nixosTests
 , nix-update-script
 }:
@@ -40,7 +41,7 @@ rustPlatform.buildRustPackage {
   buildNoDefaultFeatures = true;
 
   buildInputs = lib.optionals stdenv.isDarwin [
-    Security
+    Security SystemConfiguration
   ];
 
   passthru = {

pkgs/shells/nushell/nu_scripts/default.nix

@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nu_scripts";
-  version = "unstable-2024-01-05";
+  version = "unstable-2024-01-17";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = pname;
-    rev = "06327787549c41c93f8079cb034305d666479587";
+    rev = "e5176370f68fb028ba0b5c83c83dac8d796b9d8e";
-    hash = "sha256-O7wBMsq1Ds5Re5PakxQoDNnJg0VOdz1yKKanv4Q42SA=";
+    hash = "sha256-aQpyZkVm5/ono7xxtYBTSr4xSdnq/9NJeYTfUyskS8U=";
   };
 
   installPhase = ''

pkgs/tools/backup/gyb/default.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gyb";
-  version = "1.74";
+  version = "1.80";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "GAM-team";
     repo = "got-your-back";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-JUI9BIDg7Z6z5ZtwBMsgTbYXp9w0jd1DKFAa1XjeEtQ=";
+    sha256 = "sha256-4xElzhf9R6qnzr4oyZktQy/ym2vEjR9MrHnLYxBiAOg=";
   };
 
   propagatedBuildInputs = with python3Packages; [

pkgs/tools/games/pocket-updater-utility/default.nix

@@ -12,13 +12,13 @@
 
 buildDotnetModule rec {
   pname = "pocket-updater-utility";
-  version = "2.43.0";
+  version = "2.43.1";
 
   src = fetchFromGitHub {
     owner = "mattpannella";
     repo = "${pname}";
     rev = "${version}";
-    hash = "sha256-mizKR3hS8s1we+jJ1bQQpFzRMjHFv4UAiINUpfnWnwI=";
+    hash = "sha256-ur7BEsG4MIEcdiRt5BkK4GCa7aVkrh2Djd10KhaWf3U=";
   };
 
   buildInputs = [

pkgs/tools/graphics/textplots/default.nix

@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "textplots";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-DtDxD3b8idYOBcHKkLbOy6NUU0bjWzDySGoW8uOT4xc=";
+    hash = "sha256-83EAe6O8ETsuGJ5MK6kt68OnJL+r+BAYkFzvzlxHyp4=";
   };
 
-  cargoHash = "sha256-tXqonC4qawS6eu9dPt/6/TVYCjTroG+9XikmYQHCLdA=";
+  cargoHash = "sha256-O47b00PGRXTWWxywitS2V15gXahzgjNvFKUvE+VMXaM=";
 
   buildFeatures = [ "tool" ];
 

pkgs/tools/misc/diffoscope/default.nix

@@ -219,7 +219,7 @@ python3.pkgs.buildPythonApplication rec {
     # oggvideotools is broken on Darwin, please put it back when it will be fixed?
     ++ lib.optionals stdenv.isLinux [ oggvideotools ]
     # This doesn't work on aarch64-darwin
-    ++ lib.optionals (stdenv.hostPlatform != "aarch64-darwin") [ gnumeric ]
+    ++ lib.optionals (stdenv.hostPlatform.system != "aarch64-darwin") [ gnumeric ]
   ));
 
   nativeCheckInputs = with python3.pkgs; [
@@ -248,6 +248,15 @@ python3.pkgs.buildPythonApplication rec {
     "test_non_unicode_filename"
     "test_listing"
     "test_symlink_root"
+
+    # Appears to be a sandbox related issue
+    "test_trim_stderr_in_command"
+    # Seems to be a bug caused by having different versions of rdata than
+    # expected. Will file upstream.
+    "test_item_rdb"
+    # Caused by getting an otool command instead of llvm-objdump. Could be Nix
+    # setup, could be upstream bug. Will file upstream.
+    "test_libmix_differences"
   ];
 
   disabledTestPaths = [

pkgs/tools/misc/moar/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "moar";
-  version = "1.22.2";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fS+HmLnqs3haQ/cv768zSY62CcqONCkTF/GpUsPNX0c=";
+    hash = "sha256-tnFJKHrK1QlACYsiLlc5EX3du4H+nekEaeV+7wUsx48=";
   };
 
   vendorHash = "sha256-1u/2OlMX2FuZaxWnpU4n5r/4xKe+rK++GoCJiSq/BdE=";

pkgs/tools/networking/swagger-codegen3/default.nix

@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, jre, makeWrapper, testers, swagger-codegen3 }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.51";
+  version = "3.0.52";
   pname = "swagger-codegen";
 
   jarfilename = "${pname}-cli-${version}.jar";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://maven/io/swagger/codegen/v3/${pname}-cli/${version}/${jarfilename}";
-    sha256 = "sha256-gdzxPtr5HGt9PCKPe6Y1GRoorwDmDjfs/P45HubLQks=";
+    sha256 = "sha256-bBiETNzgySrOSFUB6356jiwDhwQ34QrOf2KdP5lv3Yg=";
   };
 
   dontUnpack = true;

pkgs/tools/security/cdxgen/default.nix

@@ -5,16 +5,16 @@
 
 buildNpmPackage rec {
   pname = "cdxgen";
-  version = "9.10.2";
+  version = "9.11.1";
 
   src = fetchFromGitHub {
     owner = "AppThreat";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-d4abSPP0dLi5xzq1CYxi1MSKogrQ+YcZjmlUEr5+oBQ=";
+    sha256 = "sha256-UrwC6T0XJeEETMtwphLWAnN7grWPI/O4aa3IKrWMhOM=";
   };
 
-  npmDepsHash = "sha256-KLI6wJrP2s2UWkSC5zmFuC2sa2owRgAhnR4UVrI0ThY=";
+  npmDepsHash = "sha256-RbHauQkggFlIoIgDdC7A4Y/O4viTsDWNB2MPeDi8oZc=";
 
   dontNpmBuild = true;
 

pkgs/tools/security/hfinger/default.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "hfinger";
-  version = "0.2.1";
+  version = "0.2.2";
   disabled = python3.pythonOlder "3.3";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "sha256-QKnrprDDBq+D8N1brkqgcfK4E+6ssvgPtRaSxkF0C84=";
+    sha256 = "sha256-gxwirAqtY4R3KDHyNmDIknABO+SFuoDua9nm1UyXbxA=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [

pkgs/tools/security/step-cli/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "step-cli";
-  version = "0.25.1";
+  version = "0.25.2";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Lltlvr/Hvh2W8MiB5WC3RmQcHg6kRPau7Fvvaqm60MQ=";
+    hash = "sha256-umo0f4cXxnxg3xH1aHeJE2brUT9w+Gp+0Qzq4zIQ8oI=";
   };
 
   ldflags = [
@@ -25,7 +25,7 @@ buildGoModule rec {
     rm command/certificate/remote_test.go
   '';
 
-  vendorHash = "sha256-dhJrDhMnPb985W3YP7+W8GHuMpkkZJcxks27TThj2YE=";
+  vendorHash = "sha256-R9UJHXs35/yvwlqu1iR3lJN/w8DWMqw48Kc+7JKfD7I=";
 
   meta = with lib; {
     description = "A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc";

pkgs/tools/text/xml/xq/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "xq";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "sibprogrammer";
     repo = "xq";
     rev = "v${version}";
-    hash = "sha256-Zg1ARyDXklKBR5WhqRakWT/KcG5796h2MxsBjPCWSjs=";
+    hash = "sha256-g1d5sS3tgxP2VRogWG/5OXezDsJuQ6e724te+Oj3r24=";
   };
 
-  vendorHash = "sha256-NNhndc604B0nGnToS7MtQzpn3t3xPl5DlkCafc/EyKE=";
+  vendorHash = "sha256-Oy/BBE6qCKJQRNDn6UiBr+/Psgi3A9Eaytmbmjt7eq8=";
 
   ldflags = [
     "-s"

pkgs/tools/typesetting/soupault/default.nix

@@ -8,7 +8,7 @@
 let
   pname = "soupault";
 
-  version = "4.7.0";
+  version = "4.8.0";
 in
 ocamlPackages.buildDunePackage {
   inherit pname version;
@@ -20,7 +20,7 @@ ocamlPackages.buildDunePackage {
     owner = "PataphysicalSociety";
     repo = pname;
     rev = version;
-    sha256 = "nwXyOwDUbkMnyHPrvCvmToyONdbg5kJm2mt5rWrB6HA=";
+    hash = "sha256-/QpT0zgrfMgRKjHyLHugaAlICpPkqaQ7f8fFAL0P02Y=";
   };
 
   buildInputs = with ocamlPackages; [

pkgs/top-level/all-packages.nix

@@ -2849,8 +2849,6 @@ with pkgs;
     withGtk = true;
   };
 
-  stella = callPackage ../applications/emulators/stella { };
-
   tamatool = callPackage ../applications/emulators/tamatool { };
 
   termtekst = callPackage ../applications/emulators/termtekst { };
@@ -3836,7 +3834,7 @@ with pkgs;
   flavours = callPackage ../applications/misc/flavours { };
 
   flirc = libsForQt5.callPackage ../applications/video/flirc {
-    readline = readline63;
+    readline = readline70;
   };
 
   flood = callPackage ../applications/networking/p2p/flood { };
@@ -10188,7 +10186,7 @@ with pkgs;
   };
 
   meilisearch = callPackage ../servers/search/meilisearch {
-    inherit (darwin.apple_sdk_11_0.frameworks) Security;
+    inherit (darwin.apple_sdk_11_0.frameworks) Security SystemConfiguration;
   };
 
   memtester = callPackage ../tools/system/memtester { };