Merge staging-next into staging

2024-11-28 01:43:15 +00:00 · 2023-07-03 06:01:59 +00:00 · 2023-07-03 06:01:59 +00:00 · 61abd839c4
commit 61abd839c4
parent 4457dfe012 c346485305
27 changed files with 369 additions and 229 deletions
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@ -39,3 +39,60 @@ d1c1a0c656ccd8bd3b25d3c4287f2d075faf3cf3

 # fix indentation in meteor default.nix
 a37a6de881ec4c6708e6b88fd16256bbc7f26bbd
+
+# treewide: automatically md-convert option descriptions
+2e751c0772b9d48ff6923569adfa661b030ab6a2
+
+# nixos/*: automatically convert option docs
+087472b1e5230ffc8ba642b1e4f9218adf4634a2
+
+# nixos/*: automatically convert option descriptions
+ef176dcf7e76c3639571d7c6051246c8fbadf12a
+
+# nixos/*: automatically convert option docs to MD
+61e93df1891972bae3e0c97a477bd44e8a477aa0
+
+# nixos/*: convert options with admonitions to MD
+722b99bc0eb57711c0498a86a3f55e6c69cdb05f
+
+# nixos/*: automatically convert option docs
+6039648c50c7c0858b5e506c6298773a98e0f066
+
+# nixos/*: md-convert options with unordered lists
+c915b915b5e466a0b0b2af2906cd4d2380b8a1de
+
+# nixos/*: convert options with listings
+f2ea09ecbe1fa1da32eaa6e036d64ac324a2986f
+
+# nixos/*: convert straggler options to MD
+1d41cff3dc4c8f37bb5841f51fcbff705e169178
+
+# nixos/*: normalize manpage references to single-line form
+423545fe4865d126e86721ba30da116e29c65004
+
+# nixos/documentation: split options doc build
+fc614c37c653637e5475a0b0a987489b4d1f351d
+
+# nixos/*: convert options with admonitions to MD
+722b99bc0eb57711c0498a86a3f55e6c69cdb05f
+
+# nixos/*: convert internal option descriptions to MD
+9547123258f69efd92b54763051d6dc7f3bfcaca
+
+# nixos/*: replace </para><para> with double linebreaks
+694d5b19d30bf66687b42fb77f43ea7cd1002a62
+
+# treewide: add defaultText for options with simple interpolation defaults
+fb0e5be84331188a69b3edd31679ca6576edb75a
+
+# nixos/*: mark pre-existing markdown descriptions as mdDoc
+7e7d68a250f75678451cd44f8c3d585bf750461e
+
+# nixos/*: normalize link format
+3aebb4a2be8821a6d8a695f0908d8567dc00de31
+
+# nixos/*: replace <code> in option docs with <literal>
+16102dce2fbad670bd47dd75c860a8daa5fe47ad
+
+# nixos/*: add trivial defaultText for options with simple defaults
+25124556397ba17bfd70297000270de1e6523b0a
--- a/nixos/modules/services/misc/ntfy-sh.nix
+++ b/nixos/modules/services/misc/ntfy-sh.nix
@ -32,7 +32,25 @@ in
    };

    settings = mkOption {
-      type = types.submodule { freeformType = settingsFormat.type; };
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          base-url = mkOption {
+            type = types.str;
+            example = "https://ntfy.example";
+            description = lib.mdDoc ''
+              Public facing base URL of the service
+
+              This setting is required for any of the following features:
+              - attachments (to return a download URL)
+              - e-mail sending (for the topic URL in the email footer)
+              - iOS push notifications for self-hosted servers
+                (to calculate the Firebase poll_request topic)
+              - Matrix Push Gateway (to validate that the pushkey is correct)
+            '';
+          };
+        };
+      };

      default = { };

--- a/nixos/modules/services/web-apps/lemmy.nix
+++ b/nixos/modules/services/web-apps/lemmy.nix
@ -77,6 +77,11 @@ in
      };
    };

+    secretFile = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      description = lib.mdDoc "Path to a secret JSON configuration file which is merged at runtime with the one generated from {option}`services.lemmy.settings`.";
+    };
  };

  config =
@ -197,11 +202,14 @@ in
        }
      ];

-      systemd.services.lemmy = {
+      systemd.services.lemmy = let
+        configFile = settingsFormat.generate "config.hjson" cfg.settings;
+        mergedConfig = "/run/lemmy/config.hjson";
+      in {
        description = "Lemmy server";

        environment = {
-          LEMMY_CONFIG_LOCATION = "${settingsFormat.generate "config.hjson" cfg.settings}";
+          LEMMY_CONFIG_LOCATION = if cfg.secretFile == null then configFile else mergedConfig;
          LEMMY_DATABASE_URL = if cfg.database.uri != null then cfg.database.uri else (mkIf (cfg.database.createLocally) "postgres:///lemmy?host=/run/postgresql&user=lemmy");
        };

@ -216,10 +224,24 @@ in

        requires = lib.optionals cfg.database.createLocally [ "postgresql.service" ];

+        path = mkIf (cfg.secretFile != null) [ pkgs.jq ];
+
+        # merge the two configs and prevent others from reading the result
+        # if somehow $CREDENTIALS_DIRECTORY is not set we fail
+        preStart = mkIf (cfg.secretFile != null) ''
+          set -u
+          umask 177
+          jq --slurp '.[0] * .[1]' ${lib.escapeShellArg configFile} "$CREDENTIALS_DIRECTORY/secretFile" > ${lib.escapeShellArg mergedConfig}
+        '';
+
        serviceConfig = {
          DynamicUser = true;
          RuntimeDirectory = "lemmy";
          ExecStart = "${cfg.server.package}/bin/lemmy_server";
+          LoadCredential = mkIf (cfg.secretFile != null) "secretFile:${toString cfg.secretFile}";
+          PrivateTmp = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
        };
      };

--- a/nixos/tests/lemmy.nix
+++ b/nixos/tests/lemmy.nix
@ -22,16 +22,24 @@ in
          # Without setup, the /feeds/* and /nodeinfo/* API endpoints won't return 200
          setup = {
            admin_username = "mightyiam";
-            admin_password = "ThisIsWhatIUseEverywhereTryIt";
            site_name = "Lemmy FTW";
            admin_email = "mightyiam@example.com";
          };
          # https://github.com/LemmyNet/lemmy/blob/50efb1d519c63a7007a07f11cc8a11487703c70d/crates/utils/src/settings/mod.rs#L52
          database.uri = "postgres:///lemmy?host=/run/postgresql&user=lemmy";
        };
+        secretFile = /etc/lemmy-config.hjson;
        caddy.enable = true;
      };

+      environment.etc."lemmy-config.hjson".text = ''
+        {
+          "setup": {
+            "admin_password": "ThisIsWhatIUseEverywhereTryIt"
+          }
+        }
+      '';
+
      networking.firewall.allowedTCPPorts = [ 80 ];

      # pict-rs seems to need more than 1025114112 bytes
@ -42,8 +50,14 @@ in
  testScript = ''
    server = ${lemmyNodeName}

-    with subtest("the backend starts and responds"):
+    with subtest("the merged config is secure"):
        server.wait_for_unit("lemmy.service")
+        config_permissions = server.succeed("stat --format %A /run/lemmy/config.hjson").rstrip()
+        assert config_permissions == "-rw-------", f"merged config permissions {config_permissions} are insecure"
+        directory_permissions = server.succeed("stat --format %A /run/lemmy").rstrip()
+        assert directory_permissions[5] == directory_permissions[8] == "-", "merged config can be replaced"
+
+    with subtest("the backend starts and responds"):
        server.wait_for_open_port(${toString backendPort})
        server.succeed("curl --fail localhost:${toString backendPort}/api/v3/site")

--- a/pkgs/applications/blockchains/atomic-swap/default.nix
+++ b/pkgs/applications/blockchains/atomic-swap/default.nix
@ -2,7 +2,7 @@

 let
  pname = "atomic-swap";
-  version = "0.4.0";
+  version = "0.4.1";
 in
 buildGoModule {
  inherit pname version;
@ -11,10 +11,10 @@ buildGoModule {
    owner = "AthanorLabs";
    repo = "atomic-swap";
    rev = "v${version}";
-    hash = "sha256-wVLufTC7WcRELhzebzLgIUvIWklEY+8/C41FluPkya0=";
+    hash = "sha256-CYqYRYLMfvPX8TqyFSRg4ookeIfYGc0HDzu/Ip9Ecsg=";
  };

-  vendorSha256 = "sha256-igHuklt76r7MDxz8TAaFgFdQS7L3DJkMYarAMNVYTC4=";
+  vendorHash = "sha256-igHuklt76r7MDxz8TAaFgFdQS7L3DJkMYarAMNVYTC4=";

  subPackages = [
    "cmd/swapcli"
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@ -2,7 +2,7 @@

 (callPackage ./generic.nix { }) {
  channel = "edge";
-  version = "23.6.2";
-  sha256 = "1jvvywd1m87ivdcwzmi6cc9k4a53wsvmxac4v80rlqvmhaj1jq62";
-  vendorSha256 = "sha256-fBpF4UZaO7EtCzjzF3lg6Hea/tEOmmwRVEwNono32LU=";
+  version = "23.6.3";
+  sha256 = "0h1pwfqf6y3cfhyx1srrr0dv25d5fxk10qfqzx0hl64h2dp6srr6";
+  vendorSha256 = "sha256-1ir+IjyT9P+D3AbPo/7wWyZRFiKqZLJ/hoFUM1jtM0A=";
 }
--- a/pkgs/applications/science/logic/cbmc/0001-Do-not-download-sources-in-cmake.patch
+++ b/pkgs/applications/science/logic/cbmc/0001-Do-not-download-sources-in-cmake.patch
@ -1,49 +1,41 @@
-From fbc1488e8da0175e9c9bdf5892f8a65c71f2a266 Mon Sep 17 00:00:00 2001
+From 206084d2e08198b0b5b67733c407bd3fb74affb1 Mon Sep 17 00:00:00 2001
 From: Jiajie Chen <c@jia.je>
-Date: Fri, 15 Jul 2022 18:33:15 +0800
+Date: Sun, 2 Jul 2023 22:43:27 +0800
 Subject: [PATCH] Do not download sources in cmake

 ---
- src/solvers/CMakeLists.txt | 20 +-------------------
- 1 file changed, 1 insertion(+), 19 deletions(-)
+ src/solvers/CMakeLists.txt | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)

 diff --git a/src/solvers/CMakeLists.txt b/src/solvers/CMakeLists.txt
-index 744def486..5b719a78a 100644
+index 8bfcf4d13c..6ba858a461 100644
 --- a/src/solvers/CMakeLists.txt
 +++ b/src/solvers/CMakeLists.txt
-@@ -106,31 +106,13 @@ elseif("${sat_impl}" STREQUAL "glucose")
- elseif("${sat_impl}" STREQUAL "cadical")
-     message(STATUS "Building solvers with cadical")
+@@ -123,16 +123,6 @@ foreach(SOLVER ${sat_impl})
+     elseif("${SOLVER}" STREQUAL "cadical")
+         message(STATUS "Building solvers with cadical")
 
-    download_project(PROJ cadical
-        URL https://github.com/arminbiere/cadical/archive/rel-1.4.1.tar.gz
-        PATCH_COMMAND true
-        COMMAND CXX=${CMAKE_CXX_COMPILER} ./configure -O3 -s CXXFLAGS=-std=c++14
-        URL_MD5 b44874501a175106424f4bd5de29aa59
-    )
+-        download_project(PROJ cadical
+-            URL https://github.com/arminbiere/cadical/archive/rel-1.5.3.tar.gz
+-            PATCH_COMMAND patch -p1 -i ${CBMC_SOURCE_DIR}/../scripts/cadical-1.5.3-patch
+-            COMMAND cmake -E copy ${CBMC_SOURCE_DIR}/../scripts/cadical_CMakeLists.txt CMakeLists.txt
+-            COMMAND ./configure
+-            URL_MD5 265b1a715000ed3c5b6de36ddd1278a0
+-        )
 -
-     message(STATUS "Building CaDiCaL")
-    execute_process(COMMAND make -j WORKING_DIRECTORY ${cadical_SOURCE_DIR})
- 
-     target_compile_definitions(solvers PUBLIC
-         SATCHECK_CADICAL HAVE_CADICAL
-     )
- 
-    add_library(cadical STATIC IMPORTED)
+-        add_subdirectory(${cadical_SOURCE_DIR} ${cadical_BINARY_DIR})
 -
-    set_target_properties(
-        cadical
-        PROPERTIES IMPORTED_LOCATION ${cadical_SOURCE_DIR}/build/libcadical.a
-    )
-
-    target_include_directories(solvers
-      PUBLIC
-      ${cadical_SOURCE_DIR}/src
-    )
-+    target_include_directories(solvers PUBLIC ${cadical_INCLUDE_DIR})
+         target_compile_definitions(solvers PUBLIC
+             SATCHECK_CADICAL HAVE_CADICAL
+         )
+@@ -140,6 +130,7 @@ foreach(SOLVER ${sat_impl})
+         target_include_directories(solvers
+             PUBLIC
+             ${cadical_SOURCE_DIR}/src
+	    ${cadical_INCLUDE_DIR}
+         )
 
-     target_link_libraries(solvers cadical)
- elseif("${sat_impl}" STREQUAL "ipasir-cadical")
+         target_link_libraries(solvers cadical)
 -- 
-2.35.1
+2.40.1

--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "cbmc";
-  version = "5.76.1";
+  version = "5.86.0";

  src = fetchFromGitHub {
    owner = "diffblue";
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "sha256-OVOoAfoqev33c7pIzBGK9HD+zgji/+BWKD33RYJaSDc=";
+    sha256 = "sha256-7nlon04EAaAmoTme15PNl2RwTfayXo0YokRLtQLN9/s=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "snakemake";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-Y/z7asYSRgDyDWmvfmX4y6fOMSpp0X9uhDx327YF2TI=";
+    hash = "sha256-UfUzvDo5OE1LGCBBGoDpxG96RKOaShbqu5TOOILG3AY=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "24.1.3";
+  version = "24.1.4";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1vn8czdz257p18g85gv7gbhwgvmg9g55i5v9ppxrgf58rv9gk7i3";
-  iosevka-aile = "0nr1wmpkagz0b5mh673pq0ngdcyxcqm8mmmyp9d3c5dxdlp83whw";
-  iosevka-curly = "07biw37b406mdna4cyd3p2l6zfmdd42hjlljdjhsd8s2cjs1iiv9";
-  iosevka-curly-slab = "0xx9m8nfmpdqmxqfj95vppcp0rgyvj1v2v0ra4803jhx2ss8zavj";
-  iosevka-etoile = "1b9rgrgrgka7my31xvphhx8dj9v08bjhhcqyfg773xzdl96804bj";
-  iosevka-slab = "112nhk507j15n44ib66zpblkyw4vgrmb5n08mkiqy6l57f56izly";
-  iosevka-ss01 = "1avbcjadqglzv69whqbsvsx9nqx4sjvxz3svdjy8ayhm1ik3aaj9";
-  iosevka-ss02 = "19dwcv4gsaky7pf6bvglmpxcln524za303ch0q5z3wqapfypayw6";
-  iosevka-ss03 = "09r9sckj02y5k738ph9lg14kf56lgh91d0lm6bp3mvnnsj0xrb1p";
-  iosevka-ss04 = "1qwmw7sa07zrn9vndhifikh5b1ldpyj5xg6iylb65pz5x1ljzma4";
-  iosevka-ss05 = "13l2rdngm0hgwidr74jvvjw3blh24gqlqnj98zv6x3pix4bc1rfi";
-  iosevka-ss06 = "0wjd08yk4d12zd70njk2v7d66152q946vs1fwkjv0c5rxqj3dbpd";
-  iosevka-ss07 = "0j7s2ir6gvqjibi5wvsyn48hj8vkkbdybg7hlg1dcp7pxknffm2z";
-  iosevka-ss08 = "1z7yb5jwi6vs96mlw52gb0m623vj2jrrj0pm4kqwbyqjln676jgd";
-  iosevka-ss09 = "0jy2vjv2zdm73i45a9a5l3ni7l2xc3j2xspj9pcv8f389a69l88j";
-  iosevka-ss10 = "1ff93nb57839mygpa3cm97np3sv688sn1jk8bwgxclnj89v5f5pj";
-  iosevka-ss11 = "1lhf2hn9z8wn9kjwzbdw94m0fzn4bg1siqary9vbcimm44w6b1l3";
-  iosevka-ss12 = "190x4wc1yv95d25v8zf1ylfyfg09hyin35zz4vn3chg9fn7q4kpw";
-  iosevka-ss13 = "08zkgc4hfcgz5csmjp5ysqhpqkdgq8kf0w3mrsv4c2m59n4g21s0";
-  iosevka-ss14 = "0sy8ssf1agcwp5rcm4qcds7i3bkih6i943kz57zvq4ndv7nd877v";
-  iosevka-ss15 = "0qmc3x3m93svxpsarhky9w761ss46viwlwm8ldnlisqpff2pfb57";
-  iosevka-ss16 = "0zxwjgl293vxwd4my1csfwgspad095zkf1ry0f0nvbv1dp659n3p";
-  iosevka-ss17 = "1yp9h55ck93z4d5qdxk2pm9710dwzsd7mxrmfrqimlg2nr677lpb";
-  iosevka-ss18 = "1qk859a5f9saj9xs3bq38h2ahzr3x9bj1rcyazrycg67nbgggjb3";
-  sgr-iosevka = "0b6djhyhlicvimkrygy0311grwkwndwm725ff6gc8hpycckvhgxa";
-  sgr-iosevka-aile = "12mm7awgz9j07a1cr5i4an1lnqr56sw51bp9yz2lwg6kb20sjkdl";
-  sgr-iosevka-curly = "1z0rrjn6cjv543kam01qh1z06jk698g9yk375h3svc4rnm5pbvld";
-  sgr-iosevka-curly-slab = "0yz18fv6hm36p1p6hjasqk1chsn3yfsvqa6ki3nqdpkjmdp012xy";
-  sgr-iosevka-etoile = "1jbljizhzqn7a5pdjdcc3d9dzl3r5y77jafxv1ki51lgcw55f569";
-  sgr-iosevka-fixed = "0an2f869v5b4wpj8r17i4m81y2bzmi9b99v9zx8sd3r4q5dcfq1b";
-  sgr-iosevka-fixed-curly = "0ihxv4c6qj47d97dj4jxcrl63pl86y5ll1a3agmhxg162kqyxgqd";
-  sgr-iosevka-fixed-curly-slab = "1rpycmf0dgpwgp4g26wf2sqhi4fi3kkkv8s9gs1idk3zsdv9m6b3";
-  sgr-iosevka-fixed-slab = "0c4c5yjmcfpmc043rf8bl16qhw1rjvvz1njkrrj5a7nwmx9llnhs";
-  sgr-iosevka-fixed-ss01 = "1jp6icrfvis81rhvlxxmy0xhkpmcbw88s5cb5kl7ff6qfhgil48j";
-  sgr-iosevka-fixed-ss02 = "0c7cbyz6ngn7m4zb9llagqfwcg4hvy6kjdw2pmr4hdzir927x4ar";
-  sgr-iosevka-fixed-ss03 = "0i56kdi6xkp178x6q3pg9q7vc88z6v7vhlp9ch4h6ckij2k32ywi";
-  sgr-iosevka-fixed-ss04 = "0gyqppbv7kfw5dibdkgk4icjyhl9jrmrpr8gpb367g1qbksp4wvv";
-  sgr-iosevka-fixed-ss05 = "1g9c9zmwds2y310zximqkfs5y2gi4rpw8201bllxnhh1gks36r1d";
-  sgr-iosevka-fixed-ss06 = "1hmbdv5dyinrm0a398wxm27893waxlbws4b0h7by075ic7kndx95";
-  sgr-iosevka-fixed-ss07 = "0z6h3zdgf2v2rzv58qb70dmjajx8hj6zaabln29rszk8hq6149q5";
-  sgr-iosevka-fixed-ss08 = "0n7qh7s3lgq7n6q5i18mrd1n5g9hx4plsa8ydyr8qwkjy1jp64v3";
-  sgr-iosevka-fixed-ss09 = "1jyn4kjydj3z71hfdfinfwx0mrsx9fngap43gm1jvy4r9k59sqxy";
-  sgr-iosevka-fixed-ss10 = "1jwz1bfsamdsn64x9l273q0irb3xrqlgmh2w52dzrr640m80f6f1";
-  sgr-iosevka-fixed-ss11 = "0j3rfxj45gw0dwgipi8gilx4bd55990d1rzy6is081246b47avg5";
-  sgr-iosevka-fixed-ss12 = "1y79bs9cll387f01djdg2rl1p9b477x9i2q9rwqc3zafamv68abf";
-  sgr-iosevka-fixed-ss13 = "0zyddk9fcdpryy1fya4z0s54bg0wa1va2aqi1di2cfvz2mz8k5ba";
-  sgr-iosevka-fixed-ss14 = "0qr2af8kwh0mxmnjbfy8mf58sbsz98y0qmprxzpngychrins3aan";
-  sgr-iosevka-fixed-ss15 = "0rv8w6iinn4nc8pwg20nngjndkm12ypkbww391vy4jxaqvi154nw";
-  sgr-iosevka-fixed-ss16 = "19q5y2c4sxkd0bynmwv3xgfad7lyw5ixhpzv3yjlbvzs65hp4wx1";
-  sgr-iosevka-fixed-ss17 = "1jzpywjmgaknr4i3ylrql085zmhny4fcjjf4s5arbjndxp45a7jb";
-  sgr-iosevka-fixed-ss18 = "1qk6p649nlym6qhj6rmmdn68jia2ki5b38jxl3gawhrzmk237as5";
-  sgr-iosevka-slab = "04myif7mkxhsvrs1igzr6fsbbl5rl2zmz68j3fc1rxb7j0a2d2g8";
-  sgr-iosevka-ss01 = "1v0i82kwq18pwcnkcr6rcm4qbs6k9b4l86vqk7mxnwsrhn96h89n";
-  sgr-iosevka-ss02 = "005hf2439996x8x3dms559q1bvf0nzyc6alv7n96xcxqv0x80a8z";
-  sgr-iosevka-ss03 = "0b9gvy5xdkzz0i0h99y1n08w4a29di91jqwc07qvsrz9643iwdc7";
-  sgr-iosevka-ss04 = "09mzibrq8bsls2q4ib7vrbxra6gzwja5ay74ra00rnw73626nq4j";
-  sgr-iosevka-ss05 = "0x2v9aisq64sgbssd7544gvwc22c5gqq8nbibz38mrv8ligm69rp";
-  sgr-iosevka-ss06 = "17lfkczf6jiic1i099xq4r92zxyax0rl6vbh10gn8nv8sj2qg4cz";
-  sgr-iosevka-ss07 = "0l6bdl7k6q2i82asg3745sg41f65gm340cg6h55wqbzdj433i7gk";
-  sgr-iosevka-ss08 = "1ql1fl8mmn46is7j68g9px245pjfpzzi6pa7vqg1l7j2q8v6y76p";
-  sgr-iosevka-ss09 = "0ri8pcd107k5sdzvrrfw5iprbv6pggwv52vp5sysx5ax5vin7m5k";
-  sgr-iosevka-ss10 = "061asrv6dp8vj48q0b0zrl8l34yhgy1d5fga9q4gzwsxy4nvx9nl";
-  sgr-iosevka-ss11 = "0708j7yn7bb18c2hb002v1dmv3gji9l3xgvgr1l2xfkfhhpwpdw7";
-  sgr-iosevka-ss12 = "1sxyrc2j3jrmnl0vlqccan4j1nbzzc004ddafk30bn2shswr9ai0";
-  sgr-iosevka-ss13 = "0w1s9hgv3imbvaxjjq5gbp1yvnhb0f12hj8m8mil2m9wq5r4zj00";
-  sgr-iosevka-ss14 = "0ckcvsmxmx8hq9n90kqvh7dc471h7lph1p6yml601nrkaf7axznp";
-  sgr-iosevka-ss15 = "186br4kfqpk65532g83g4557s2pkyw390z7h8wxvzh5yp2brargy";
-  sgr-iosevka-ss16 = "0mpxxz61bzgm9f8v4gfyqsnhf72d8vv63azqf4dvwxgzk0753xw7";
-  sgr-iosevka-ss17 = "05hi63gkwr0582hmyjk57cfw74hkl6g7kwnnr54vsbb7chgxdz8b";
-  sgr-iosevka-ss18 = "0nrxkihwk52j2s6pyiszr7fs3mcs77d59q5q13hvnismj8w59l3y";
-  sgr-iosevka-term = "022cj2wsbandasqbciaajzakdzx09ks421jc4xxlgms3n3pb13hj";
-  sgr-iosevka-term-curly = "0xvbbsgj3gy6mz0l2mlinknk21cd087h7ca1m4spc5cd9vmfk68f";
-  sgr-iosevka-term-curly-slab = "14b3xi82d1wbpsxp8wm89ri7vzp0d573rlqczjzdnz46a4mjhswy";
-  sgr-iosevka-term-slab = "128bz2w9ys62vah8jggyqkybas0dyg8qi0qskfivzghrc75zwafi";
-  sgr-iosevka-term-ss01 = "1y2dxz4jqzdv01p2b1gxis8vx48z1i59ky7qdkpn6n1n3vs8bfyi";
-  sgr-iosevka-term-ss02 = "07mdzpv32rpdwwzzs7sj4sw47jypxvr1vry3wqnkzbw3fcl2qykw";
-  sgr-iosevka-term-ss03 = "12viva2ykwv9i5pyidq3vds58d88s862c4y3wbp9xhnqlc83fi1y";
-  sgr-iosevka-term-ss04 = "14i25wpzrbz677shm897rc9gnf2g9rpxih3a51hbp6484hssrr4k";
-  sgr-iosevka-term-ss05 = "0bx04sls7gyl356lrm5syb9syd3dh36lrdp1fa34walbg31vzgaq";
-  sgr-iosevka-term-ss06 = "1xl3f0mldwvcnbxc5vylb9w5adzxbxbsrc87472zjynzf409c2vg";
-  sgr-iosevka-term-ss07 = "17b0v7cg6a7l02df0rpwdg67d9frv3sal6xpi1rd9iqjvvnpr2yn";
-  sgr-iosevka-term-ss08 = "023rfyzib3cg8fkb10b38dwpn3fh120b889r84d7gclxqfylw6gc";
-  sgr-iosevka-term-ss09 = "0hrrvg1lsbrlws8xfzqqkh2rzhjp0x7r3lgvi37zk4nj66nl5i4j";
-  sgr-iosevka-term-ss10 = "0s5cq5wd4w48jrg1slhdfvn1wq8rkcp5dbgv1kz75jkdrgf0vhh8";
-  sgr-iosevka-term-ss11 = "0w3nkaxcwc5alapbwdr8xdf1bkzdkaxg0pywrjgb1pq9czjmzalq";
-  sgr-iosevka-term-ss12 = "0i3scgcqrwil45zx0apra4spla96j1b4dfmxisq6mfxpqplf8hvm";
-  sgr-iosevka-term-ss13 = "17q8r47rf7292phj0gwnq6v0fkvh8x9wb04g1g7bfyxl69815iz3";
-  sgr-iosevka-term-ss14 = "0xsr5vbaca5q22qagxf1c8zg6dll8rz3msrkgs4b4z0f1bw8j3zf";
-  sgr-iosevka-term-ss15 = "1w1xikxjhgf968a9bkl8j2ks8pjdc6skk8vb045rx9l7w65cvl43";
-  sgr-iosevka-term-ss16 = "05j9r7n9m0lz6x6nprhmcwglld3fxwwwcxrrna81hbh1sim29c8x";
-  sgr-iosevka-term-ss17 = "0vraskgyp4ab7jav2qgj3lpnm5mjxr1ybd0l72zpy9hw3f8p6snz";
-  sgr-iosevka-term-ss18 = "1qm28bvqi091ywmqrrklqajv9dajmcfsfdvl5hd13z5y1kadvllw";
+  iosevka = "109dh8cz72wycjsw6phhwxgwlqnbwgjmkhhdlxjk85y78ai2kb2z";
+  iosevka-aile = "1bjhczbzzid85zwbvj0m0sv32n5vi5pibaj9vigdh075ydbz6cdc";
+  iosevka-curly = "0jahh3dl01dw5c9m0imqslgzf62ndyv0i743pmprr3wwsxy3lcf2";
+  iosevka-curly-slab = "1xs9glwwd2vphbcxn95cv39h91hnzqwd0cc4rw4lkh2198gimq4d";
+  iosevka-etoile = "0chzkq1c0qacjgg60rsi9vk04vk7gi64kshigizc2aj6viss9nkq";
+  iosevka-slab = "0mxnkhc5skwqf58izjhva2g0faf7hd0bfdfn4dwfp12vl3lh2nar";
+  iosevka-ss01 = "1g6350xmrvrvgg9w89p78adqn7l60f871h3pk198mf991qk50dv1";
+  iosevka-ss02 = "1bpvpcb165f34gj7jcjdaczjplv5flp0f72h61p2qggfz6ladayg";
+  iosevka-ss03 = "1j8p2iaj0kfr522dpvvfakvaz8rkyqjv79gsy7ml169d2f5cjysl";
+  iosevka-ss04 = "1idgx93v0i116pkd2x9mvn4m55z8rf3ybjsm7z59mxqv3llxlzrx";
+  iosevka-ss05 = "0kfwiznijsbsbidi96n445hks6cjxrr26q7psmb24lj1jd82m9cg";
+  iosevka-ss06 = "1wiviy9ivbjba7gbc4myxkykwr793gmgbi1x0mv26di85n1m46d5";
+  iosevka-ss07 = "1pnyj9h40pjpks0irw55xhp1vc3pqfxyw82j1165vvahn14vmag0";
+  iosevka-ss08 = "1hsr8vazhg6qwrz38swil4hjsjn095ryv7c928yndhcnpj7r2hq3";
+  iosevka-ss09 = "0y01fxwcw4dwcgrbd8552yw6g4w86smh6ggj3pc1krzam1vcm3ak";
+  iosevka-ss10 = "0iwrdp1xzrvx4dx3dy87bix0kr9dailkpz9qayn8rkf6gb1v59wd";
+  iosevka-ss11 = "13vhw0bzmhk61p6pljsx5hhr6p2a79ak4b1v3qsfvmlj1p2jjsm6";
+  iosevka-ss12 = "09fgai57l1qi4rpwgaw18hkzyxszxxizq7yb2h9g0xzws6mrymdf";
+  iosevka-ss13 = "0dnmb2r05kvjs5f9frr897d9l9g0c8zdw9azxhxf4npgw3jk5s6x";
+  iosevka-ss14 = "1gc113mvnfbd9vhq6zl4zr163yw94051n09nha2ixsqqciy5z269";
+  iosevka-ss15 = "14ci16l3a4zs7gmj0xl7yf5f1y0dx8x0im1gx3q1gvbqcgki1045";
+  iosevka-ss16 = "0qzzmzsqiw7ndjyzy6x9sk8an667p6v0anq4pbiwyf9fxpl4zq88";
+  iosevka-ss17 = "06hlcan65k5czhryfl4n3rfhh0hxhnr6ga7ghwd9lwwlx22qdvps";
+  iosevka-ss18 = "1iy5whvp4260y5sihrcv9bzf36ig6ic5p6hr0622cghaw0syrzmd";
+  sgr-iosevka = "1nkbn250b6yqzg9bjrl0v15v86y9dklwcvyvmr44p3nq1cwm3k3m";
+  sgr-iosevka-aile = "0b0qv2b14qw38x76003c54xmy2nl2wp0qj6qcy4iglynnds389vp";
+  sgr-iosevka-curly = "1566gj7dqizh8d50vjd9p7p6qgrqdzfx0vqjp7f9g0p2fksh4ybp";
+  sgr-iosevka-curly-slab = "06db180ymg3jd1nbiy7r2hmyhvmgj9w27gkgg5mi68j628c5pyf2";
+  sgr-iosevka-etoile = "02s6zizz4sp3wi4kxa8rc2wsah4x8lqzka2pyx1lw9g2fzk62sa8";
+  sgr-iosevka-fixed = "1zhqg1lq91w39s7c0b716gzq2ckvs3y83vwdkdxjfv4y077ycxf1";
+  sgr-iosevka-fixed-curly = "1q2qv212bvyf0h8wwvl4nk7cnl6j6gks2pp29akqhdk16w0as0gl";
+  sgr-iosevka-fixed-curly-slab = "1ffb7kp4fhcdf7rsbm3nz0g410b07yhl515071nnsn44c8i57562";
+  sgr-iosevka-fixed-slab = "1sin508j12wwgv8ar63baq06h62g2mvrqim8l0ky359iybn0jcb2";
+  sgr-iosevka-fixed-ss01 = "0h8xqzn10xjp408ghqnwm5a6301v2xr3rmglnfvphc7mfy0h4ann";
+  sgr-iosevka-fixed-ss02 = "12y2szhb5pkkczf1jx17z927b0vmvvf2vbg9a0i25kvvnbwr9d0p";
+  sgr-iosevka-fixed-ss03 = "1nhlanzg0qfxhmp7kzhh6brh943w1ib1zlgkl0zy0d9a9amfgg72";
+  sgr-iosevka-fixed-ss04 = "0jnxib9rbnin5b3vskb69pyf3v76r7ygxw32vadsjdfyfi3ya5dr";
+  sgr-iosevka-fixed-ss05 = "1bl6kc0inifs54dyky7p3prq68cif1ak58m0m96my17c9snnl8g7";
+  sgr-iosevka-fixed-ss06 = "0di6f2cgssax0602m8kvbvsmsr1k2h5z3bqa6jcbhw0nh3farnpq";
+  sgr-iosevka-fixed-ss07 = "0spr9yvw2saklgr5cbbk3bs56kbs28jff9mxb58f24qqpzfg0k02";
+  sgr-iosevka-fixed-ss08 = "1jbk0wjr0imvaw3vaf1xr6v3hmsls231x25m1j01v9j406addg64";
+  sgr-iosevka-fixed-ss09 = "05vqwbcq7p0nax1lcqvdxsvsw6yr11xhw7700w51g1l6n9nja5v7";
+  sgr-iosevka-fixed-ss10 = "19w18vpz18klx2530fh0r3q1rm9ik11yk1vbjnqw60d48lk97m0r";
+  sgr-iosevka-fixed-ss11 = "0rvywrk92m20jm41927kr78ln38g2g7h2zgb3nk829y6nbaflm7a";
+  sgr-iosevka-fixed-ss12 = "068iblb35p71w3vh5gmf5d47wc459y6s0k1y0ac5g3nsxki9wdk2";
+  sgr-iosevka-fixed-ss13 = "1zx330j18wf6q539h0fbyskfb3m8vc53rkyzh7xw974xx24084l9";
+  sgr-iosevka-fixed-ss14 = "1s518zmrchizb0wcyqhj1pqy7kq255qv7izgs3w3imr6a6jbh1gg";
+  sgr-iosevka-fixed-ss15 = "0iimmin8k38jqg4qax3dlb5cjw9j3mww225kmdpsvfan2rnacji5";
+  sgr-iosevka-fixed-ss16 = "1ngrpr9fjmv50kf9rykynx1fmzr50ny35ykm1yqanwlsb8nka8zy";
+  sgr-iosevka-fixed-ss17 = "1vhqrwq8hhic7cnij8yngra5cli17pk42j4fgvaprrb44a1dsykm";
+  sgr-iosevka-fixed-ss18 = "1ynvszf76bz5sjsr6dva6c2p8pcp9fakfqn6m51hapixhjp1sjr8";
+  sgr-iosevka-slab = "1hs468pfg1smbkyj1as163lywbmhs0mdj4a6bri7vxj9v78012y2";
+  sgr-iosevka-ss01 = "1gzrzip0qakiikn71mvzh6p3r9glip0g6ia6jflk8qvdkzm8g0pc";
+  sgr-iosevka-ss02 = "0sy4l1h5i21sp5lnnxwn74nahvdgpjlip4f5d4hhp48968hnlvjy";
+  sgr-iosevka-ss03 = "0z1fg1mi9lz8xby8jhwg65dg68nzklkbzl3pcl8bi0gn932k0jjs";
+  sgr-iosevka-ss04 = "11f5x99kxiwzmxv2wh4lnm50k4xycz39pbdv24rxf1d9yanya2cf";
+  sgr-iosevka-ss05 = "1ca9y3vj839hkdbs2vlak6rm6waks45fi8wbssr68dk00p3c1hif";
+  sgr-iosevka-ss06 = "0ahqgjydsc68rc5al5js3pzhc33sl5xchgby2x1lqzkgw4zixnms";
+  sgr-iosevka-ss07 = "06gvfx0j5r4qb3w6sr6rsrs9hi7n1lb7m8h4qys4ry9skam65vbs";
+  sgr-iosevka-ss08 = "0l4lxrbnrzq6cin21z3dw2agrggqzl93qfiqkpc3qxqiq2mx0gqd";
+  sgr-iosevka-ss09 = "0xkmrbgvh0q91zypjp4v3wg9y4kj7gzsnb4j5h4sg9z68cjr0crq";
+  sgr-iosevka-ss10 = "1h190v4kyxhs3bgv98qymhi7zgll4f623bcyc62rdslf393jv0ga";
+  sgr-iosevka-ss11 = "0y83v908rcf2dlqnla8xqj5fzqp6vgrbnriwhvr59kd25aa6vrg5";
+  sgr-iosevka-ss12 = "16q8lwmr0fkk13494jvcv8g9v3nk9gja0njryl25ajj9awq73blc";
+  sgr-iosevka-ss13 = "16l8k51iblsd2wy5ivnfji0ln9mgx23xfs6is8bg699xwzczh5ny";
+  sgr-iosevka-ss14 = "0f0c9cz9g9sc7gm1gvi7lzn0if577k9g6hixx6py15r6b1ygi9rl";
+  sgr-iosevka-ss15 = "08pgi4h8a13zdrcnhaxw2ywh27q7z7j9l638z80d8rbicswrcsgm";
+  sgr-iosevka-ss16 = "1q6lcsqqd1lpgl29czgp86qnqsaw553lb0mj4cck09nzyr8sqfr2";
+  sgr-iosevka-ss17 = "1bgvd9d82rc94j6qpgpcll4a97jkj2cmilcz9k2jfbshdpl1y04c";
+  sgr-iosevka-ss18 = "1ykzsd566rphhsj2rx558f5abr3dgxxplaywl5rqcwn8ipn8wg3h";
+  sgr-iosevka-term = "0kx37k548cxng6ixzb0a4cqw104wp8ija484zrhdp79nn4kx7lh7";
+  sgr-iosevka-term-curly = "00wmfli99asd1lgk84l7al51mmr299yl1ijnvk08apfby8sqh9z9";
+  sgr-iosevka-term-curly-slab = "0rkssp8ganiwl72sp2npv54n3n3g5vkkias45hzb3hgq62byx1ak";
+  sgr-iosevka-term-slab = "019cr9mza25ljg9ws14p8inmlzdpa91nxmsgads4iicf25vc5283";
+  sgr-iosevka-term-ss01 = "157p94cvab0mvfd383zxwf7bsgm9amnclxvcm0qc3fq7z7bxsm00";
+  sgr-iosevka-term-ss02 = "04fvc2f2rhxnz7q6qwv7lragr5mqfja5hjaviq36q235phl9hb83";
+  sgr-iosevka-term-ss03 = "0kvvgdhc7kx9ws2h2n08avgjfkp1v6zgkhlwdjnj10x0wnpqy7sz";
+  sgr-iosevka-term-ss04 = "093nn0n9f4ga966v4ivm57sf85iw1m69k6k8xawam0gxkpbb5yr9";
+  sgr-iosevka-term-ss05 = "0qa4w07fixpip7r7aklvjmmj095d2z8kx5945plzwrp3yw3akj8n";
+  sgr-iosevka-term-ss06 = "0564kx6mvwm1rb6y5zghy7brv2mpq9h7xwjppf7f5wymyz9jizv8";
+  sgr-iosevka-term-ss07 = "0mbg7mxj5di8h6sj9g7ydv2415r2xk2lsjj41l4pi8wmi9h7cmhh";
+  sgr-iosevka-term-ss08 = "1pf7qq1d1dzv872jxqj9p6yivx2iicm8c34y7ll3x8lb1idgljdc";
+  sgr-iosevka-term-ss09 = "1gghck5kmm57pcdpqz4nvvk56h66kpi4bj8qqjpccqdr74f628yx";
+  sgr-iosevka-term-ss10 = "1i0nsq6rsj8196znh8iga40js8pvvbs5hl3zkcdz74al0r4hwrdw";
+  sgr-iosevka-term-ss11 = "1czqgkvmpxcnvnk2vrpka1396bx2zn66ar1zddl92iqdxrq3imnr";
+  sgr-iosevka-term-ss12 = "02bzqkwdl0pcb24xank8gql548pvdvh8395fr0ld8wwl0bd32lz8";
+  sgr-iosevka-term-ss13 = "14csppx9a9wq4ql5mhfc3958dqyd2xnq76ixrdigadf8gngr8qvz";
+  sgr-iosevka-term-ss14 = "07z87bmipidr69ra58q80kzpqa4rc8nhhj3lqrm9q4x0q1w8mrck";
+  sgr-iosevka-term-ss15 = "0q1v2a8z6gcrwkimxc0kzq4ddvyxv2ih5k1h14d03183p186bsih";
+  sgr-iosevka-term-ss16 = "14z9qvlp5cd1g03z78wpz5zqzxi44s1kdxkkwr2r666rkqy0crr0";
+  sgr-iosevka-term-ss17 = "1jclbwbxlfz45m8x4adz6c2bcllza0x3x9pgnzlvcx6a8rbzk55z";
+  sgr-iosevka-term-ss18 = "12abgqq8krx27b7w56gg04hv99wz0bxnx8hmd6naar1nqw97s9mq";
 }
--- a/pkgs/development/beam-modules/elixir-ls/default.nix
+++ b/pkgs/development/beam-modules/elixir-ls/default.nix
@ -4,12 +4,12 @@

 let
  pname = "elixir-ls";
-  version = "0.14.6";
+  version = "0.15.1";
  src = fetchFromGitHub {
    owner = "elixir-lsp";
    repo = "elixir-ls";
    rev = "v${version}";
-    hash = "sha256-O977DZLWPyLafIaOTPZKI4MOtK9E9TDProf2xyk05aI";
+    hash = "sha256-bWR5wKOVE9qPQyFjiaBumsWwG7vv9pFCVvXO4N8a3HA=";
    fetchSubmodules = true;
  };
 in
@ -21,7 +21,7 @@ mixRelease  {
  mixFodDeps = fetchMixDeps {
    pname = "mix-deps-${pname}";
    inherit src version elixir;
-    hash = "sha256-jF1Plkz1D85aWkiNgeBlJmHndhr7us+8+m/gMkXHvDw=";
+    hash = "sha256-7AE6RUD7DLo5uTxPMiUDm9MIBYcrNatrIuILK9jinNk=";
  };

  # elixir-ls is an umbrella app
--- a/pkgs/development/libraries/nng/default.nix
+++ b/pkgs/development/libraries/nng/default.nix
@ -7,8 +7,8 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "nanomsg";
    repo = "nng";
-    rev = "539e559e65cd8f227c45e4b046ac41c0edcf6c32";
-    sha256 = "sha256-86+f0um25Ywn78S2JrV54K7k3O6ots0q2dCco1aK0xM=";
+    rev = "8e1836f57e8bcdb228dd5baadc71dfbf30b544e0";
+    sha256 = "sha256-Q08/Oxv9DLCHp7Hf3NqNa0sHq7qwM6TfGT8gNyiwin8=";
  };

  nativeBuildInputs = [ cmake ninja ]
--- a/pkgs/development/python-modules/jaraco_collections/default.nix
+++ b/pkgs/development/python-modules/jaraco_collections/default.nix
@ -27,7 +27,7 @@ buildPythonPackage rec {
    setuptools-scm
  ];

-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;

  propagatedBuildInputs = [
    jaraco_classes
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@ -17,13 +17,13 @@

 buildGoModule rec {
  pname = "buildah";
-  version = "1.30.0";
+  version = "1.31.0";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "buildah";
    rev = "v${version}";
-    hash = "sha256-h0fipw3lJKy+VkGkh1XbZ6wUOg4001uURoJpjNq7QOs=";
+    hash = "sha256-hnQvpxWIPMlcaIDPEKPHSXUTqbFnfDiTXybRBbFvqDA=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/development/tools/misc/blackfire/php-probe.nix
+++ b/pkgs/development/tools/misc/blackfire/php-probe.nix
@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, dpkg
 , autoPatchelfHook
 , php
 , writeShellScript
@ -18,57 +17,52 @@ let
  hashes = {
    "x86_64-linux" = {
      system = "amd64";
-      sha256 = {
-        "8.1" = "FEb0NBJpwoYaNdEHEn4TkSQR7VShGpHptaDIRKwrmkQ=";
-        "8.2" = "itB0Zm1Mog18F8vIHn9AZMYMzafLQR0v5zcOgqy1ouI=";
+      hash = {
+        "8.1" = "sha256-FEb0NBJpwoYaNdEHEn4TkSQR7VShGpHptaDIRKwrmkQ=";
+        "8.2" = "sha256-itB0Zm1Mog18F8vIHn9AZMYMzafLQR0v5zcOgqy1ouI=";
      };
    };
    "i686-linux" = {
      system = "i386";
-      sha256 = {
-        "8.1" = "0bX2frll0ne6H6o7HNH4TRV2D+NDe11mVvqwhvSDg9E=";
-        "8.2" = "U6zmbEkRr3+9yVwUgQ1+SBNK0zWD92S2KBOHJ1gMmjM=";
+      hash = {
+        "8.1" = "sha256-0bX2frll0ne6H6o7HNH4TRV2D+NDe11mVvqwhvSDg9E=";
+        "8.2" = "sha256-U6zmbEkRr3+9yVwUgQ1+SBNK0zWD92S2KBOHJ1gMmjM=";
      };
    };
    "aarch64-linux" = {
      system = "arm64";
-      sha256 = {
-        "8.1" = "agLQVI3u7ENcWLDRx7YSEBZobRnwEaKAmFpIU5AXhqo=";
-        "8.2" = "Y2bUYaymoZ/Ct5a7K+5U+zNh9ZKUaq0Oal/v04nzuaU=";
+      hash = {
+        "8.1" = "sha256-agLQVI3u7ENcWLDRx7YSEBZobRnwEaKAmFpIU5AXhqo=";
+        "8.2" = "sha256-Y2bUYaymoZ/Ct5a7K+5U+zNh9ZKUaq0Oal/v04nzuaU=";
      };
    };
    "aarch64-darwin" = {
      system = "arm64";
-      sha256 = {
-        "8.1" = "ovTtwXPut9jCvxVyd5mQzrfJPCy+rQvUi4c74NrBzY4=";
-        "8.2" = "8hybE62l8vSwbqpcrnj/lI2Wjy8R3wuO04zwofLi9EY=";
+      hash = {
+        "8.1" = "sha256-ovTtwXPut9jCvxVyd5mQzrfJPCy+rQvUi4c74NrBzY4=";
+        "8.2" = "sha256-8hybE62l8vSwbqpcrnj/lI2Wjy8R3wuO04zwofLi9EY=";
      };
    };
    "x86_64-darwin" = {
      system = "amd64";
-      sha256 = {
-        "8.1" = "WsHH/XJboHeRhxpYY0WtXEJwOsGNFtfexBShC/J7GaQ=";
-        "8.2" = "w3Vu7CTFebn59i1FYVCYHiOadTIPlPCkQ1QHEfvHWig=";
+      hash = {
+        "8.1" = "sha256-WsHH/XJboHeRhxpYY0WtXEJwOsGNFtfexBShC/J7GaQ=";
+        "8.2" = "sha256-w3Vu7CTFebn59i1FYVCYHiOadTIPlPCkQ1QHEfvHWig=";
      };
    };
  };

-  makeSource =
-    {
-      system,
-      phpMajor,
-    }:
-
+  makeSource = { system, phpMajor }:
    let
      isLinux = builtins.match ".+-linux" system != null;
    in
    assert !isLinux -> (phpMajor != null);
    fetchurl {
-      url =
-        "https://packages.blackfire.io/binaries/blackfire-php/${version}/blackfire-php-${if isLinux then "linux" else "darwin"}_${hashes.${system}.system}-php-${builtins.replaceStrings [ "." ] [ "" ] phpMajor}.so";
-      sha256 = hashes.${system}.sha256.${phpMajor};
+      url = "https://packages.blackfire.io/binaries/blackfire-php/${version}/blackfire-php-${if isLinux then "linux" else "darwin"}_${hashes.${system}.system}-php-${builtins.replaceStrings [ "." ] [ "" ] phpMajor}.so";
+      hash = hashes.${system}.hash.${phpMajor};
    };
-self = stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation (finalAttrs: {
  pname = "php-blackfire";
  extensionName = "blackfire";
  inherit version;
@ -76,7 +70,6 @@ self = stdenv.mkDerivation rec {
  src = makeSource {
    system = stdenv.hostPlatform.system;
    inherit phpMajor;
-    inherit (php);
  };

  nativeBuildInputs = lib.optionals stdenv.isLinux [
@ -90,13 +83,13 @@ self = stdenv.mkDerivation rec {
  installPhase = ''
    runHook preInstall

-    install -D ${src} $out/lib/php/extensions/blackfire.so
+    install -D ${finalAttrs.src} $out/lib/php/extensions/blackfire.so

    runHook postInstall
  '';

  passthru = {
-    updateScript = writeShellScript "update-${pname}" ''
+    updateScript = writeShellScript "update-${finalAttrs.pname}" ''
      set -o errexit
      export PATH="${lib.makeBinPath [ curl jq common-updater-scripts ]}"
      NEW_VERSION=$(curl --silent https://blackfire.io/api/v1/releases | jq .probe.php --raw-output)
@ -106,7 +99,7 @@ self = stdenv.mkDerivation rec {
          exit 0
      fi

-      for source in ${lib.concatStringsSep " " (builtins.attrNames passthru.updateables)}; do
+      for source in ${lib.concatStringsSep " " (builtins.attrNames finalAttrs.passthru.updateables)}; do
        update-source-version "$UPDATE_NIX_ATTR_PATH.updateables.$source" "0" "${lib.fakeSha256}"
        update-source-version "$UPDATE_NIX_ATTR_PATH.updateables.$source" "$NEW_VERSION"
      done
@ -115,19 +108,16 @@ self = stdenv.mkDerivation rec {
    # All sources for updating by the update script.
    updateables =
      let
-        createName =
-          path:
-
+        createName = path:
          builtins.replaceStrings [ "." ] [ "_" ] (lib.concatStringsSep "_" path);

-        createSourceParams =
-          path:
-
+        createSourceParams = path:
          let
            # The path will be either [«system» sha256], or [«system» sha256 «phpMajor» «zts»],
            # Let’s skip the sha256.
            rest = builtins.tail (builtins.tail path);
-          in {
+          in
+          {
            system =
              builtins.head path;
            phpMajor =
@ -136,19 +126,15 @@ self = stdenv.mkDerivation rec {
              else builtins.head rest;
          };

-          createUpdateable =
-            path:
-            _value:
+        createUpdateable = path: _value:
+          lib.nameValuePair
+            (createName path)
+            (finalAttrs.self.overrideAttrs (attrs: {
+              src = makeSource (createSourceParams path);
+            }));

-            lib.nameValuePair
-              (createName path)
-              (self.overrideAttrs (attrs: {
-                src = makeSource (createSourceParams path);
-              }));
-
-          hashesOnly =
-            # Filter out all attributes other than hashes.
-            lib.filterAttrsRecursive (name: _value: name != "system") hashes;
+        # Filter out all attributes other than hashes.
+        hashesOnly = lib.filterAttrsRecursive (name: _value: name != "system") hashes;
      in
      builtins.listToAttrs
        # Collect all leaf attributes (containing hashes).
@ -157,14 +143,12 @@ self = stdenv.mkDerivation rec {
          (lib.mapAttrsRecursive createUpdateable hashesOnly));
  };

-  meta = with lib; {
+  meta = {
    description = "Blackfire Profiler PHP module";
    homepage = "https://blackfire.io/";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = with maintainers; [ shyim ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ shyim ];
    platforms = [ "x86_64-linux" "aarch64-linux" "i686-linux" "x86_64-darwin" "aarch64-darwin" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
  };
-};
-in
-self
+})
--- a/pkgs/development/tools/ols/default.nix
+++ b/pkgs/development/tools/ols/default.nix
@ -0,0 +1,51 @@
+{ stdenv, fetchFromGitHub, makeBinaryWrapper, odin, lib }:
+
+stdenv.mkDerivation {
+  pname = "ols";
+  version = "nightly-2023-05-18";
+
+  src = fetchFromGitHub {
+    owner = "DanielGavin";
+    repo = "ols";
+    rev = "fd136199897d5e5c87f6f1fbfd076ed18e41d7b7";
+    hash = "sha256-lRoDSc2bZSuXTam3Q5OOlSD6YAobCFKNRbtQ41Qx5EY=";
+  };
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
+
+  buildInputs = [
+    odin
+  ];
+
+  postPatch = ''
+    patchShebangs build.sh
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    ./build.sh
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp ols $out/bin
+    wrapProgram $out/bin/ols --set-default ODIN_ROOT ${odin}/share
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Language server for the Odin programming language";
+    homepage = "https://github.com/DanielGavin/ols";
+    license = licenses.mit;
+    maintainers = with maintainers; [ astavie ];
+    platforms = odin.meta.platforms;
+  };
+}
--- a/pkgs/misc/cups/drivers/foomatic-db/default.nix
+++ b/pkgs/misc/cups/drivers/foomatic-db/default.nix
@ -13,15 +13,15 @@

 stdenv.mkDerivation rec {
  pname = "foomatic-db";
-  version = "unstable-2023-03-30";
+  version = "unstable-2023-06-30";

  src = fetchFromGitHub {
    # there is also a daily snapshot at the `downloadPage`,
    # but it gets deleted quickly and would provoke 404 errors
    owner = "OpenPrinting";
    repo = "foomatic-db";
-    rev = "d883a215dc062e478c64d4e2eee9b0e39e6c629d";
-    hash = "sha256-eFgHTbj4pNfLG2ftU29FQ8rgRMbX+44UytfoZ4vdgZ4=";
+    rev = "5b916154bcc37d9881f71110b3d5a7e624a67c95";
+    hash = "sha256-mbIVtrmLT8saZga6rIMY55xCQWadV9BSlZR4669wNCs=";
  };

  buildInputs = [ cups cups-filters ghostscript gnused perl ];
--- a/pkgs/misc/opensbi/default.nix
+++ b/pkgs/misc/opensbi/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "opensbi";
-  version = "1.2";
+  version = "1.3";

  src = fetchFromGitHub {
    owner = "riscv-software-src";
    repo = "opensbi";
    rev = "v${version}";
-    sha256 = "sha256-Zcl+SE2nySMycV/ozsl4AvGipRsMblA5mt3oVZ81Z44=";
+    sha256 = "sha256-Dr16fVUGLYGnGYHkjAyqpJxt8p95F0CJIU9ESGWKGWo=";
  };

  postPatch = ''
--- a/pkgs/servers/go-cqhttp/default.nix
+++ b/pkgs/servers/go-cqhttp/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "go-cqhttp";
-  version = "1.0.1";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "Mrs4s";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Vc/k4mb1JramT2l+zu9zZQa65gP5XvgqUEQgle1vX8w=";
+    hash = "sha256-/nmPiB2BHltguAJFHCvtS3oh/BttEH75GhgSa25cI3s=";
  };

-  vendorSha256 = "sha256-tAvo96hIWxkt3rrrPH5fDKwfwuc76Ze0r55R/ZssU4s=";
+  vendorSha256 = "sha256-Oqig/qtdGFO2/t7vvkApqdNhjNnYzEavNpyneAMa10k=";

  meta = with lib; {
    description = "The Golang implementation of OneBot based on Mirai and MiraiGo";
--- a/pkgs/tools/admin/balena-cli/default.nix
+++ b/pkgs/tools/admin/balena-cli/default.nix
@ -15,12 +15,12 @@ let
  }.${system} or throwSystem;

  sha256 = {
-    x86_64-linux = "sha256-5AdMuVHYX41O+iUSUlbHLQkATY2sPb9e8y4pfmvj07U=";
-    x86_64-darwin = "sha256-5GX8dglvEgvWMnIG54G3jPxHUAKlS4E6aDMvvjYGidQ=";
-    aarch64-darwin = "sha256-5GX8dglvEgvWMnIG54G3jPxHUAKlS4E6aDMvvjYGidQ=";
+    x86_64-linux = "sha256-yNyQ3cmy0Rc2+8EygMJwB/kmmmOiyq5V+7dyFFHyaVA=";
+    x86_64-darwin = "sha256-sODceZObYQned+opKQ4BgRZxlJQ12c2D01+FG8JF2N0=";
+    aarch64-darwin = "sha256-sODceZObYQned+opKQ4BgRZxlJQ12c2D01+FG8JF2N0=";
  }.${system} or throwSystem;

-  version = "16.5.0";
+  version = "16.6.2";
  src = fetchzip {
    url = "https://github.com/balena-io/balena-cli/releases/download/v${version}/balena-cli-v${version}-${plat}-standalone.zip";
    inherit sha256;
--- a/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/pkgs/tools/filesystems/gcsfuse/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "gcsfuse";
-  version = "0.42.5";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "googlecloudplatform";
    repo = "gcsfuse";
    rev = "v${version}";
-    hash = "sha256-ME0xoi1KEzw99GmKQeeNHVjIH3UlBnP6/b50xJcPA/I=";
+    hash = "sha256-lG6LZClcb3HTwjSdOfT6dws9v7RgIiF0N2snpi+J9Qk=";
  };

  vendorHash = "sha256-oTELdPPkKBQFBIRhjns6t3wj84RQhDVOi95seNyeeR0=";
--- a/pkgs/tools/misc/steampipe/default.nix
+++ b/pkgs/tools/misc/steampipe/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "steampipe";
-  version = "0.20.6";
+  version = "0.20.7";

  src = fetchFromGitHub {
    owner = "turbot";
    repo = "steampipe";
    rev = "v${version}";
-    sha256 = "sha256-tCuW3iiRb8ptYYz0NiIs5NjEEO+ajejfc7kZj6M31os=";
+    sha256 = "sha256-t9RNrbW7wR2WiUacf6/U4qtcR7ZvDZ+duRQ282ScRmU=";
  };

  vendorHash = "sha256-VuUzo+afUazXH7jaR4Qm5Kfr6qiyHqdGLJWS3MX8oOA=";
--- a/pkgs/tools/networking/dae/default.nix
+++ b/pkgs/tools/networking/dae/default.nix
@ -5,17 +5,17 @@
 }:
 buildGoModule rec {
  pname = "dae";
-  version = "0.1.10.p1";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "daeuniverse";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-pURL2K05cp7/CUkC/rAJAhrQQWfalid53LDDGuQShQ4=";
+    sha256 = "sha256-J2FFD6/+Of1UcBmgzlAfmX5QvEgJY4P1EttlNaqW4P0=";
    fetchSubmodules = true;
  };

-  vendorHash = "sha256-i0z0O0qpirlCsxZNMX2ICLPZ/k6ykyKC21+cg+butEA=";
+  vendorHash = "sha256-2KKlbhJtoHUa02juXuS1QgvDD5LA5Tg/f0hNFscLJIQ=";

  proxyVendor = true;

--- a/pkgs/tools/text/gtree/default.nix
+++ b/pkgs/tools/text/gtree/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "gtree";
-  version = "1.8.5";
+  version = "1.8.6";

  src = fetchFromGitHub {
    owner = "ddddddO";
    repo = "gtree";
    rev = "v${version}";
-    hash = "sha256-1ceSkO7curN4Jl42iSYvcrpZMBdsYpFDpKVGH20N98g=";
+    hash = "sha256-0jRCQsRiJbQQcz8d7rXkAk4W4EurJ5OOcMAUn11k+ko=";
  };

  vendorHash = "sha256-BMfJFR4sqJNNlJ7Y3q2GlXWjMDH+DXhuFQVX5I9Czkc=";
--- a/pkgs/tools/virtualization/govc/default.nix
+++ b/pkgs/tools/virtualization/govc/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "govc";
-  version = "0.30.4";
+  version = "0.30.5";

  subPackages = [ "govc" ];

@ -10,7 +10,7 @@ buildGoModule rec {
    rev = "v${version}";
    owner = "vmware";
    repo = "govmomi";
-    sha256 = "sha256-lYiyZ2sY58bzUtqcM6WIsooLldQAxibASM7xXKAeqJM=";
+    sha256 = "sha256-qnoun4DiiFpGal9uLyW7Vir+zMOpbDRj2fCIWfiAyLU=";
  };

  vendorHash = "sha256-jbGqQITAhyBLoDa3cKU5gK+4WGgoGSCyFtzeoXx8e7k=";
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -27877,6 +27877,8 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) Security;
  };

+  ols = callPackage ../development/tools/ols { };
+
  openpam = callPackage ../development/libraries/openpam { };

  openbsm = callPackage ../development/libraries/openbsm { };