Merge staging-next into staging

2025-02-22 12:04:40 +00:00 · 2022-11-22 00:03:02 +00:00 · 2022-11-22 00:03:02 +00:00 · 66da6215fb
commit 66da6215fb
parent 066c3806b2 eefc53c398
87 changed files with 4217 additions and 3523 deletions
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@ -34,6 +34,10 @@ jobs:
        pairs:
          - from: master
            into: haskell-updates
+          - from: release-22.11
+            into: staging-next-22.11
+          - from: staging-next-22.11
+            into: staging-22.11
          - from: release-22.05
            into: staging-next-22.05
          - from: staging-next-22.05
--- a/.version
+++ b/.version
@ -1 +1 @@
-22.11
+23.05
--- a/doc/builders/fetchers.chapter.md
+++ b/doc/builders/fetchers.chapter.md
@ -100,10 +100,10 @@ stdenv.mkDerivation {
  name = "hello";
  src = fetchgit {
    url = "https://...";
-    sparseCheckout = ''
-      directory/to/be/included
-      another/directory
-    '';
+    sparseCheckout = [
+      "directory/to/be/included"
+      "another/directory"
+    ];
    sha256 = "0000000000000000000000000000000000000000000000000000";
  };
 }
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@ -196,7 +196,7 @@ buildNpmPackage rec {
 * `makeCacheWritable`: Whether to make the cache writable prior to installing dependencies. Don't set this unless npm tries to write to the cache directory, as it can slow down the build.
 * `npmBuildScript`: The script to run to build the project. Defaults to `"build"`.
 * `npmFlags`: Flags to pass to all npm commands.
-* `npmInstallFlags`: Flags to pass to `npm ci`.
+* `npmInstallFlags`: Flags to pass to `npm ci` and `npm prune`.
 * `npmBuildFlags`: Flags to pass to `npm run ${npmBuildScript}`.
 * `npmPackFlags`: Flags to pass to `npm pack`.

--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@ -195,7 +195,7 @@ rec {
     On each release the first letter is bumped and a new animal is chosen
     starting with that new letter.
  */
-  codeName = "Raccoon";
+  codeName = "Stoat";

  /* Returns the current nixpkgs version suffix as string. */
  versionSuffix =
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -14287,6 +14287,12 @@
    githubId = 32751441;
    name = "urlordjames";
  };
+  ursi = {
+    email = "masondeanm@aol.com";
+    github = "ursi";
+    githubId = 17836748;
+    name = "Mason Mackaman";
+  };
  uskudnik = {
    email = "urban.skudnik@gmail.com";
    github = "uskudnik";
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -580,6 +580,15 @@
          future Git update without notice.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>fetchgit</literal> fetcher supports sparse
+          checkouts via the <literal>sparseCheckout</literal> option.
+          This used to accept a multi-line string with
+          directories/patterns to check out, but now requires a list of
+          strings.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>openssh</literal> was updated to version 9.1,
@ -1392,6 +1401,26 @@ services.github-runner.serviceOverrides.SupplementaryGroups = [
          if you intend to add packages to <literal>/bin</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>proxmox.qemuConf.bios</literal> option was added,
+          it corresponds to <literal>Hardware-&gt;BIOS</literal> field
+          in Proxmox web interface. Use
+          <literal>&quot;ovmf&quot;</literal> value to build UEFI image,
+          default value remains <literal>&quot;bios&quot;</literal>. New
+          option <literal>proxmox.partitionTableType</literal> defaults
+          to either <literal>&quot;legacy&quot;</literal> or
+          <literal>&quot;efi&quot;</literal>, depending on the
+          <literal>bios</literal> value. Setting
+          <literal>partitionTableType</literal> to
+          <literal>&quot;hybrid&quot;</literal> results in an image,
+          which supports both methods
+          (<literal>&quot;bios&quot;</literal> and
+          <literal>&quot;ovmf&quot;</literal>), thereby remaining
+          bootable after change to Proxmox
+          <literal>Hardware-&gt;BIOS</literal> field.
+        </para>
+      </listitem>
      <listitem>
        <para>
          memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2.
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@ -0,0 +1,51 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-23.05">
+  <title>Release 23.05 (“Stoat”, 2023.05/??)</title>
+  <para>
+    Support is planned until the end of December 2023, handing over to
+    23.11.
+  </para>
+  <section xml:id="sec-release-23.05-highlights">
+    <title>Highlights</title>
+    <para>
+      In addition to numerous new and upgraded packages, this release
+      has the following highlights:
+    </para>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Create the first release note entry in this section!
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-23.05-new-services">
+    <title>New Services</title>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Create the first release note entry in this section!
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-23.05-incompatibilities">
+    <title>Backward Incompatibilities</title>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Create the first release note entry in this section!
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+  <section xml:id="sec-release-23.05-notable-changes">
+    <title>Other Notable Changes</title>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Create the first release note entry in this section!
+        </para>
+      </listitem>
+    </itemizedlist>
+  </section>
+</section>
--- a/nixos/doc/manual/release-notes/release-notes.xml
+++ b/nixos/doc/manual/release-notes/release-notes.xml
@ -8,6 +8,7 @@
  This section lists the release notes for each stable version of NixOS and
  current unstable revision.
 </para>
+ <xi:include href="../from_md/release-notes/rl-2305.section.xml" />
 <xi:include href="../from_md/release-notes/rl-2211.section.xml" />
 <xi:include href="../from_md/release-notes/rl-2205.section.xml" />
 <xi:include href="../from_md/release-notes/rl-2111.section.xml" />
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -191,6 +191,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).

 - The `fetchgit` fetcher now uses [cone mode](https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalscone_mode_handling) by default for sparse checkouts. [Non-cone mode](https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalsnon_cone_problems) can be enabled by passing `nonConeMode = true`, but note that non-cone mode is deprecated and this option may be removed alongside a future Git update without notice.

+- The `fetchgit` fetcher supports sparse checkouts via the `sparseCheckout` option. This used to accept a multi-line string with directories/patterns to check out, but now requires a list of strings.
+
 - `openssh` was updated to version 9.1, disabling the generation of DSA keys when using `ssh-keygen -A` as they are insecure. Also, `SetEnv` directives in `ssh_config` and `sshd_config` are now first-match-wins

 - `bsp-layout` no longer uses the command `cycle` to switch to other window layouts, as it got replaced by the commands `previous` and `next`.
@ -451,6 +453,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 - `dockerTools.buildImage` deprecates the misunderstood `contents` parameter, in favor of `copyToRoot`.
  Use `copyToRoot = buildEnv { ... };` or similar if you intend to add packages to `/bin`.

+- The `proxmox.qemuConf.bios` option was added, it corresponds to `Hardware->BIOS` field in Proxmox web interface. Use `"ovmf"` value to build UEFI image, default value remains `"bios"`. New option `proxmox.partitionTableType` defaults to either `"legacy"` or `"efi"`, depending on the `bios` value. Setting `partitionTableType` to `"hybrid"` results in an image, which supports both methods (`"bios"` and `"ovmf"`), thereby remaining bootable after change to Proxmox `Hardware->BIOS` field.
+
 - memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2. It is now the upstream version from https://www.memtest.org/, as coreboot's fork is no longer available.

 - Option descriptions, examples, and defaults writting in DocBook are now deprecated. Using CommonMark is preferred and will become the default in a future release.
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -0,0 +1,29 @@
+# Release 23.05 (“Stoat”, 2023.05/??) {#sec-release-23.05}
+
+Support is planned until the end of December 2023, handing over to 23.11.
+
+## Highlights {#sec-release-23.05-highlights}
+
+In addition to numerous new and upgraded packages, this release has the following highlights:
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## New Services {#sec-release-23.05-new-services}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Backward Incompatibilities {#sec-release-23.05-incompatibilities}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Other Notable Changes {#sec-release-23.05-notable-changes}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@ -361,8 +361,10 @@ in {
          fi
          echo 'include "${redisConfStore}"' > "${redisConfRun}"
          ${optionalString (conf.requirePassFile != null) ''
-            {echo -n "requirepass "
-            cat ${escapeShellArg conf.requirePassFile}} >> "${redisConfRun}"
+            {
+              echo -n "requirepass "
+              cat ${escapeShellArg conf.requirePassFile}
+            } >> "${redisConfRun}"
          ''}
        '');
        Type = "notify";
--- a/nixos/modules/services/web-apps/outline.nix
+++ b/nixos/modules/services/web-apps/outline.nix
@ -6,10 +6,10 @@ let
 in
 {
  # See here for a reference of all the options:
-  #   https://github.com/outline/outline/blob/v0.65.2/.env.sample
-  #   https://github.com/outline/outline/blob/v0.65.2/app.json
-  #   https://github.com/outline/outline/blob/v0.65.2/server/env.ts
-  #   https://github.com/outline/outline/blob/v0.65.2/shared/types.ts
+  #   https://github.com/outline/outline/blob/v0.67.0/.env.sample
+  #   https://github.com/outline/outline/blob/v0.67.0/app.json
+  #   https://github.com/outline/outline/blob/v0.67.0/server/env.ts
+  #   https://github.com/outline/outline/blob/v0.67.0/shared/types.ts
  # The order is kept the same here to make updating easier.
  options.services.outline = {
    enable = lib.mkEnableOption (lib.mdDoc "outline");
@ -123,7 +123,7 @@ in
      description = lib.mdDoc ''
        To support uploading of images for avatars and document attachments an
        s3-compatible storage must be provided. AWS S3 is recommended for
-        redundency however if you want to keep all file storage local an
+        redundancy however if you want to keep all file storage local an
        alternative such as [minio](https://github.com/minio/minio)
        can be used.

@ -435,6 +435,16 @@ in
      '';
    };

+    sentryTunnel = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = lib.mdDoc ''
+        Optionally add a
+        [Sentry proxy tunnel](https://docs.sentry.io/platforms/javascript/troubleshooting/#using-the-tunnel-option)
+        for bypassing ad blockers in the UI.
+      '';
+    };
+
    logo = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
@ -621,6 +631,7 @@ in
          DEBUG = cfg.debugOutput;
          GOOGLE_ANALYTICS_ID = lib.optionalString (cfg.googleAnalyticsId != null) cfg.googleAnalyticsId;
          SENTRY_DSN = lib.optionalString (cfg.sentryDsn != null) cfg.sentryDsn;
+          SENTRY_TUNNEL = lib.optionalString (cfg.sentryTunnel != null) cfg.sentryTunnel;
          TEAM_LOGO = lib.optionalString (cfg.logo != null) cfg.logo;
          DEFAULT_LANGUAGE = cfg.defaultLanguage;

--- a/nixos/modules/virtualisation/proxmox-image.nix
+++ b/nixos/modules/virtualisation/proxmox-image.nix
@ -53,6 +53,13 @@ with lib;
          Guest memory in MB
        '';
      };
+      bios = mkOption {
+        type = types.enum [ "seabios" "ovmf" ];
+        default = "seabios";
+        description = ''
+          Select BIOS implementation (seabios = Legacy BIOS, ovmf = UEFI).
+        '';
+      };

      # optional configs
      name = mkOption {
@ -99,6 +106,17 @@ with lib;
        Additional options appended to qemu-server.conf
      '';
    };
+    partitionTableType = mkOption {
+      type = types.enum [ "efi" "hybrid" "legacy" "legacy+gpt" ];
+      description = ''
+        Partition table type to use. See make-disk-image.nix partitionTableType for details.
+        Defaults to 'legacy' for 'proxmox.qemuConf.bios="seabios"' (default), other bios values defaults to 'efi'.
+        Use 'hybrid' to build grub-based hybrid bios+efi images.
+      '';
+      default = if config.proxmox.qemuConf.bios == "seabios" then "legacy" else "efi";
+      defaultText = lib.literalExpression ''if config.proxmox.qemuConf.bios == "seabios" then "legacy" else "efi"'';
+      example = "hybrid";
+    };
    filenameSuffix = mkOption {
      type = types.str;
      default = config.proxmox.qemuConf.name;
@ -122,9 +140,33 @@ with lib;
      ${lib.concatStrings (lib.mapAttrsToList cfgLine properties)}
      #qmdump#map:virtio0:drive-virtio0:local-lvm:raw:
    '';
+    inherit (cfg) partitionTableType;
+    supportEfi = partitionTableType == "efi" || partitionTableType == "hybrid";
+    supportBios = partitionTableType == "legacy" || partitionTableType == "hybrid" || partitionTableType == "legacy+gpt";
+    hasBootPartition = partitionTableType == "efi" || partitionTableType == "hybrid";
+    hasNoFsPartition = partitionTableType == "hybrid" || partitionTableType == "legacy+gpt";
  in {
+    assertions = [
+      {
+        assertion = config.boot.loader.systemd-boot.enable -> config.proxmox.qemuConf.bios == "ovmf";
+        message = "systemd-boot requires 'ovmf' bios";
+      }
+      {
+        assertion = partitionTableType == "efi" -> config.proxmox.qemuConf.bios == "ovmf";
+        message = "'efi' disk partitioning requires 'ovmf' bios";
+      }
+      {
+        assertion = partitionTableType == "legacy" -> config.proxmox.qemuConf.bios == "seabios";
+        message = "'legacy' disk partitioning requires 'seabios' bios";
+      }
+      {
+        assertion = partitionTableType == "legacy+gpt" -> config.proxmox.qemuConf.bios == "seabios";
+        message = "'legacy+gpt' disk partitioning requires 'seabios' bios";
+      }
+    ];
    system.build.VMA = import ../../lib/make-disk-image.nix {
      name = "proxmox-${cfg.filenameSuffix}";
+      inherit partitionTableType;
      postVM = let
        # Build qemu with PVE's patch that adds support for the VMA format
        vma = (pkgs.qemu_kvm.override {
@ -181,7 +223,18 @@ with lib;
    boot = {
      growPartition = true;
      kernelParams = [ "console=ttyS0" ];
-      loader.grub.device = lib.mkDefault "/dev/vda";
+      loader.grub = {
+        device = lib.mkDefault (if (hasNoFsPartition || supportBios) then
+          # Even if there is a separate no-fs partition ("/dev/disk/by-partlabel/no-fs" i.e. "/dev/vda2"),
+          # which will be used the bootloader, do not set it as loader.grub.device.
+          # GRUB installation fails, unless the whole disk is selected.
+          "/dev/vda"
+        else
+          "nodev");
+        efiSupport = lib.mkDefault supportEfi;
+        efiInstallAsRemovable = lib.mkDefault supportEfi;
+      };
+
      loader.timeout = 0;
      initrd.availableKernelModules = [ "uas" "virtio_blk" "virtio_pci" ];
    };
@ -191,6 +244,10 @@ with lib;
      autoResize = true;
      fsType = "ext4";
    };
+    fileSystems."/boot" = lib.mkIf hasBootPartition {
+      device = "/dev/disk/by-label/ESP";
+      fsType = "vfat";
+    };

    services.qemuGuest.enable = lib.mkDefault true;
  };
--- a/pkgs/applications/audio/open-stage-control/default.nix
+++ b/pkgs/applications/audio/open-stage-control/default.nix
@ -16,7 +16,7 @@ buildNpmPackage rec {
    ./package-lock.json.patch
  ];

-  npmDepsHash = "sha256-UF3pZ+SlrgDLqntciXRNbWfpPMtQw1DXl41x9r37QN4=";
+  npmDepsHash = "sha256-SGLcFjPnmhFoeXtP4gfGr4Qa1dTaXwSnzkweEvYW/1k=";

  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/applications/audio/whipper/default.nix
+++ b/pkgs/applications/audio/whipper/default.nix
@ -2,6 +2,7 @@
 , python3
 , fetchFromGitHub
 , fetchpatch
+, installShellFiles
 , libcdio-paranoia
 , cdrdao
 , libsndfile
@ -35,6 +36,8 @@ in python3.pkgs.buildPythonApplication rec {
  ];

  nativeBuildInputs = with python3.pkgs; [
+    installShellFiles
+
    setuptools-scm
    docutils
    setuptoolsCheckHook
@ -65,6 +68,11 @@ in python3.pkgs.buildPythonApplication rec {
    export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
  '';

+  outputs = [ "out" "man" ];
+  postBuild = ''
+    make -C man
+  '';
+
  preCheck = ''
    # disable tests that require internet access
    # https://github.com/JoeLametta/whipper/issues/291
@ -73,6 +81,10 @@ in python3.pkgs.buildPythonApplication rec {
    export HOME=$TMPDIR
  '';

+  postInstall = ''
+    installManPage man/*.1
+  '';
+
  passthru.tests.version = testers.testVersion {
    package = whipper;
    command = "HOME=$TMPDIR whipper --version";
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
@ -62,6 +62,10 @@ let
 in

 {
+  postPatch = ''
+    rm -r parser
+  '';
+
  passthru = {
    inherit builtGrammars allGrammars withPlugins withAllGrammars;

--- a/pkgs/applications/misc/bottles/default.nix
+++ b/pkgs/applications/misc/bottles/default.nix
@ -1,10 +1,28 @@
-{ lib, fetchFromGitHub, gitUpdater
-, meson, ninja, pkg-config, wrapGAppsHook
-, desktop-file-utils, gsettings-desktop-schemas, libnotify, libhandy, webkitgtk
-, python3Packages, gettext
-, appstream-glib, gdk-pixbuf, glib, gobject-introspection, gspell, gtk3, gtksourceview4, gnome
-, steam, xdg-utils, pciutils, cabextract
-, freetype, p7zip, gamemode, mangohud
+{ lib
+, fetchFromGitHub
+, fetchFromGitLab
+, gitUpdater
+, python3Packages
+, blueprint-compiler
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook4
+, appstream-glib
+, desktop-file-utils
+, librsvg
+, gtk4
+, gtksourceview5
+, libadwaita
+, steam
+, cabextract
+, p7zip
+, xdpyinfo
+, imagemagick
+, procps
+, gamescope
+, mangohud
+, vmtouch
 , wine
 , bottlesExtraLibraries ? pkgs: [ ] # extra packages to add to steam.run multiPkgs
 , bottlesExtraPkgs ? pkgs: [ ] # extra packages to add to steam.run targetPkgs
@ -21,75 +39,77 @@ let
 in
 python3Packages.buildPythonApplication rec {
  pname = "bottles";
-  version = "2022.5.28-trento-3";
+  version = "2022.10.14.1";

  src = fetchFromGitHub {
    owner = "bottlesdevs";
    repo = pname;
    rev = version;
-    sha256 = "sha256-KIDLRqDLFTsVAczRpTchnUtKJfVHqbYzf8MhIR5UdYY=";
+    sha256 = "sha256-FO91GSGlc2f3TSLrlmRDPi5p933/Y16tdEpX4RcKhL0=";
  };

+  patches = [ ./vulkan_icd.patch ];
+
  postPatch = ''
    chmod +x build-aux/meson/postinstall.py
    patchShebangs build-aux/meson/postinstall.py

-    substituteInPlace src/backend/wine/winecommand.py \
+    substituteInPlace bottles/backend/wine/winecommand.py \
      --replace \
-        'self.__get_runner()' \
-        '(lambda r: (f"${steam-run}/bin/steam-run {r}", r)[r == "wine" or r == "wine64"])(self.__get_runner())'
-  '';
+        "command = f\"{runner} {command}\"" \
+        "command = f\"{''' if runner == 'wine' or runner == 'wine64' else '${steam-run}/bin/steam-run '}{runner} {command}\"" \
+      --replace \
+        "command = f\"{_picked['entry_point']} {command}\"" \
+        "command = f\"${steam-run}/bin/steam-run {_picked['entry_point']} {command}\""
+    '';

  nativeBuildInputs = [
+    blueprint-compiler
    meson
    ninja
    pkg-config
-    wrapGAppsHook
-    gettext
+    wrapGAppsHook4
+    gtk4 # gtk4-update-icon-cache
    appstream-glib
    desktop-file-utils
  ];

  buildInputs = [
-    gdk-pixbuf
-    glib
-    gobject-introspection
-    gsettings-desktop-schemas
-    gspell
-    gtk3
-    gtksourceview4
-    libhandy
-    libnotify
-    webkitgtk
-    gnome.adwaita-icon-theme
+    librsvg
+    gtk4
+    gtksourceview5
+    libadwaita
  ];

  propagatedBuildInputs = with python3Packages; [
    pyyaml
-    pytoml
    requests
-    pycairo
    pygobject3
-    lxml
-    dbus-python
-    gst-python
-    liblarch
    patool
    markdown
+    fvs
+    pefile
+    urllib3
+    chardet
+    certifi
+    idna
+    pillow
+    orjson
+    icoextract
  ] ++ [
-    steam-run
-    xdg-utils
-    pciutils
    cabextract
-    wine
-    freetype
    p7zip
-    gamemode # programs.gamemode.enable
+    xdpyinfo
+    imagemagick
+    procps
+
+    gamescope
    mangohud
+    vmtouch
+    wine
  ];

  format = "other";
-  strictDeps = false; # broken with gobject-introspection setup hook, see https://github.com/NixOS/nixpkgs/issues/56943
  dontWrapGApps = true; # prevent double wrapping

  preFixup = ''
--- a/pkgs/applications/misc/bottles/vulkan_icd.patch
+++ b/pkgs/applications/misc/bottles/vulkan_icd.patch
@ -0,0 +1,13 @@
+diff --git a/bottles/backend/utils/vulkan.py b/bottles/backend/utils/vulkan.py
+index 6673493..07f70d1 100644
+--- a/bottles/backend/utils/vulkan.py
+++ b/bottles/backend/utils/vulkan.py
+@@ -29,6 +29,8 @@ class VulkanUtils:
+         "/etc/vulkan",
+         "/usr/local/share/vulkan",
+         "/usr/local/etc/vulkan"
+        "/run/opengl-driver/share/vulkan/",
+        "/run/opengl-driver-32/share/vulkan/",
+     ]
+     if "FLATPAK_ID" in os.environ:
+         __vk_icd_dirs += [
--- a/pkgs/applications/misc/keepmenu/default.nix
+++ b/pkgs/applications/misc/keepmenu/default.nix
@ -0,0 +1,36 @@
+{ lib, python3Packages, python3, xvfb-run }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "keepmenu";
+  version = "1.2.2";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "SeVNtONH1bn2hb2pBOVM3Oafrb+jARgfvRe7vUu6Gto=";
+  };
+
+  preConfigure = ''
+    export HOME=$TMPDIR
+    mkdir -p $HOME/.config/keepmenu
+    cp config.ini.example $HOME/.config/keepmenu/config.ini
+  '';
+
+  propagatedBuildInputs = with python3Packages; [
+    pykeepass
+    pynput
+  ];
+
+  checkInputs = [ xvfb-run ];
+  checkPhase = ''
+    xvfb-run python setup.py test
+  '';
+
+  pythonImportsCheck = [ "keepmenu" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/firecat53/keepmenu";
+    description = "Dmenu/Rofi frontend for Keepass databases";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ elliot ];
+  };
+}
--- a/pkgs/applications/misc/nerd-font-patcher/default.nix
+++ b/pkgs/applications/misc/nerd-font-patcher/default.nix
@ -9,10 +9,10 @@ python3Packages.buildPythonApplication rec {
    owner = "ryanoasis";
    repo = "nerd-fonts";
    rev = "v${version}";
-    sparseCheckout = ''
-      font-patcher
-      /src/glyphs
-    '';
+    sparseCheckout = [
+      "font-patcher"
+      "/src/glyphs"
+    ];
    sha256 = "sha256-boZUd1PM8puc9BTgOwCJpkfk6VMdXLsIyp+fQmW/ZqI=";
  };

--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@ -3,7 +3,7 @@
 }:

 let
-  stableVersion = "2.2.34";
+  stableVersion = "2.2.35.1";
  previewVersion = stableVersion;
  addVersion = args:
    let version = if args.stable then stableVersion else previewVersion;
@ -12,23 +12,18 @@ let
  extraArgs = rec {
    mkOverride = attrname: version: sha256:
      self: super: {
-        ${attrname} = super.${attrname}.overridePythonAttrs (oldAttrs: {
+        "${attrname}" = super."${attrname}".overridePythonAttrs (oldAttrs: {
          inherit version;
          src = oldAttrs.src.override {
            inherit version sha256;
          };
        });
      };
-    commonOverrides = [
-      (self: super: {
-        jsonschema = super.jsonschema_3;
-      })
-    ];
  };
  mkGui = args: libsForQt5.callPackage (import ./gui.nix (addVersion args // extraArgs)) { };
  mkServer = args: callPackage (import ./server.nix (addVersion args // extraArgs)) { };
-  guiSrcHash = "sha256-1YsVMrUYI46lJZbPjf3jnOFDr9Hp54m8DVMz9y4dvVc=";
-  serverSrcHash = "sha256-h4d9s+QvqN/EFV97rPRhQiyC06wkZ9C2af9gx1Z/x/8=";
+  guiSrcHash = "sha256-iVvADwIp01HeZoDayvH1dilYRHRkRBTBR3Fh395JBq0=";
+  serverSrcHash = "sha256-41dbiSjvmsDNYr9/rRkeQVOnPSVND34xx1SNknCgHfc=";

 in {
  guiStable = mkGui {
--- a/pkgs/applications/networking/gns3/gui.nix
+++ b/pkgs/applications/networking/gns3/gui.nix
@ -3,25 +3,15 @@
 , version
 , sha256Hash
 , mkOverride
-, commonOverrides
 }:

 { lib
 , python3
 , fetchFromGitHub
 , wrapQtAppsHook
-, packageOverrides ? self: super: {}
 }:

-let
-  defaultOverrides = commonOverrides ++ [
-  ];
-
-  python = python3.override {
-    packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([ packageOverrides ] ++ defaultOverrides);
-  };
-
-in python.pkgs.buildPythonPackage rec {
+python3.pkgs.buildPythonPackage rec {
  pname = "gns3-gui";
  inherit version;

@ -36,7 +26,7 @@ in python.pkgs.buildPythonPackage rec {
    wrapQtAppsHook
  ];

-  propagatedBuildInputs = with python.pkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
    distro
    jsonschema
    psutil
@ -55,10 +45,8 @@ in python.pkgs.buildPythonPackage rec {

  postPatch = ''
    substituteInPlace requirements.txt \
-      --replace "sentry-sdk==" "sentry-sdk>=" \
      --replace "psutil==" "psutil>=" \
-      --replace "distro==" "distro>=" \
-      --replace "setuptools==" "setuptools>="
+      --replace "jsonschema>=4.17.0,<4.18" "jsonschema"
  '';

  meta = with lib; {
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@ -3,24 +3,14 @@
 , version
 , sha256Hash
 , mkOverride
-, commonOverrides
 }:

 { lib
 , python3
 , fetchFromGitHub
-, packageOverrides ? self: super: {}
 }:

-let
-  defaultOverrides = commonOverrides ++ [
-  ];
-
-  python = python3.override {
-    packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([ packageOverrides ] ++ defaultOverrides);
-  };
-
-in python.pkgs.buildPythonApplication {
+python3.pkgs.buildPythonApplication {
  pname = "gns3-server";
  inherit version;

@ -33,23 +23,17 @@ in python.pkgs.buildPythonApplication {

  postPatch = ''
    substituteInPlace requirements.txt \
-      --replace "aiohttp==" "aiohttp>=" \
-      --replace "aiofiles==" "aiofiles>=" \
-      --replace "Jinja2==" "Jinja2>=" \
-      --replace "sentry-sdk==" "sentry-sdk>=" \
-      --replace "async-timeout==" "async-timeout>=" \
      --replace "psutil==" "psutil>=" \
-      --replace "distro==" "distro>=" \
-      --replace "py-cpuinfo==" "py-cpuinfo>=" \
-      --replace "setuptools==" "setuptools>="
+      --replace "jsonschema>=4.17.0,<4.18" "jsonschema"
  '';

-  propagatedBuildInputs = with python.pkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
    aiofiles
    aiohttp
    aiohttp-cors
    async_generator
    distro
+    importlib-resources
    jinja2
    jsonschema
    multidict
--- a/pkgs/applications/video/jellyfin-mpv-shim/default.nix
+++ b/pkgs/applications/video/jellyfin-mpv-shim/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonApplication
 , fetchPypi
+, gobject-introspection
 , jellyfin-apiclient-python
 , jinja2
 , mpv
@ -9,6 +10,7 @@
 , python-mpv-jsonipc
 , pywebview
 , tkinter
+, wrapGAppsHook
 }:

 buildPythonApplication rec {
@ -20,6 +22,11 @@ buildPythonApplication rec {
    sha256 = "sha256-JiSC6WjrLsWk3/m/EHq7KNXaJ6rqT2fG9TT1jPvYlK0=";
  };

+  nativeBuildInputs = [
+    wrapGAppsHook
+    gobject-introspection
+  ];
+
  propagatedBuildInputs = [
    jellyfin-apiclient-python
    mpv
@ -52,6 +59,12 @@ buildPythonApplication rec {
      --replace "notify_updates: bool = True" "notify_updates: bool = False"
  '';

+  # needed for pystray to access appindicator using GI
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+  dontWrapGApps = true;
+
  # no tests
  doCheck = false;
  pythonImportsCheck = [ "jellyfin_mpv_shim" ];
--- a/pkgs/applications/video/plex-mpv-shim/default.nix
+++ b/pkgs/applications/video/plex-mpv-shim/default.nix
@ -1,4 +1,5 @@
-{ lib, buildPythonApplication, fetchFromGitHub, mpv, requests, python-mpv-jsonipc, pystray, tkinter }:
+{ lib, buildPythonApplication, fetchFromGitHub, mpv, requests, python-mpv-jsonipc, pystray, tkinter
+, wrapGAppsHook, gobject-introspection }:

 buildPythonApplication rec {
  pname = "plex-mpv-shim";
@ -11,8 +12,19 @@ buildPythonApplication rec {
    sha256 = "0hgv9g17dkrh3zbsx27n80yvkgix9j2x0rgg6d3qsf7hp5j3xw4r";
  };

+  nativeBuildInputs = [
+    wrapGAppsHook
+    gobject-introspection
+  ];
+
  propagatedBuildInputs = [ mpv requests python-mpv-jsonipc pystray tkinter ];

+  # needed for pystray to access appindicator using GI
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+  dontWrapGApps = true;
+
  # does not contain tests
  doCheck = false;

--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -547,10 +547,14 @@ rec {
          pure = writeText "${baseName}-config.json" (builtins.toJSON {
            inherit created config;
            architecture = defaultArch;
+            preferLocalBuild = true;
            os = "linux";
          });
          impure = runCommand "${baseName}-config.json"
-            { nativeBuildInputs = [ jq ]; }
+            {
+              nativeBuildInputs = [ jq ];
+              preferLocalBuild = true;
+            }
            ''
              jq ".created = \"$(TZ=utc date --iso-8601="seconds")\"" ${pure} > $out
            '';
@ -925,6 +929,7 @@ rec {
          {
            inherit fromImage maxLayers created;
            imageName = lib.toLower name;
+            preferLocalBuild = true;
            passthru.imageTag =
              if tag != null
              then tag
@ -1015,6 +1020,7 @@ rec {
        result = runCommand "stream-${baseName}"
          {
            inherit (conf) imageName;
+            preferLocalBuild = true;
            passthru = passthru // {
              inherit (conf) imageTag;

--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@ -15,7 +15,7 @@ in
 { url, rev ? "HEAD", md5 ? "", sha256 ? "", hash ? "", leaveDotGit ? deepClone
 , fetchSubmodules ? true, deepClone ? false
 , branchName ? null
-, sparseCheckout ? ""
+, sparseCheckout ? []
 , nonConeMode ? false
 , name ? urlToName url rev
 , # Shell code executed after the file has been fetched
@ -55,13 +55,16 @@ in
 */

 assert deepClone -> leaveDotGit;
-assert nonConeMode -> (sparseCheckout != "");
+assert nonConeMode -> !(sparseCheckout == "" || sparseCheckout == []);

 if md5 != "" then
  throw "fetchgit does not support md5 anymore, please use sha256"
 else if hash != "" && sha256 != "" then
  throw "Only one of sha256 or hash can be set"
 else
+# Added 2022-11-12
+lib.warnIf (builtins.isString sparseCheckout)
+  "Please provide directories/patterns for sparse checkout as a list of strings. Support for passing a (multi-line) string is deprecated and will be removed in the next release."
 stdenvNoCC.mkDerivation {
  inherit name;
  builder = ./builder.sh;
@ -79,7 +82,12 @@ stdenvNoCC.mkDerivation {
  else
    lib.fakeSha256;

-  inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName sparseCheckout nonConeMode postFetch;
+  # git-sparse-checkout(1) says:
+  # > When the --stdin option is provided, the directories or patterns are read
+  # > from standard in as a newline-delimited list instead of from the arguments.
+  sparseCheckout = if builtins.isString sparseCheckout then sparseCheckout else builtins.concatStringsSep "\n" sparseCheckout;
+
+  inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName nonConeMode postFetch;

  postHook = if netrcPhase == null then null else ''
    ${netrcPhase}
--- a/pkgs/build-support/fetchgit/tests.nix
+++ b/pkgs/build-support/fetchgit/tests.nix
@ -12,10 +12,10 @@
    name = "nix-source";
    url = "https://github.com/NixOS/nix";
    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
-    sparseCheckout = ''
-      src
-      tests
-    '';
+    sparseCheckout = [
+      "src"
+      "tests"
+    ];
    sha256 = "sha256-g1PHGTWgAcd/+sXHo1o6AjVWCvC6HiocOfMbMh873LQ=";
  };

@ -23,10 +23,10 @@
    name = "nix-source";
    url = "https://github.com/NixOS/nix";
    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
-    sparseCheckout = ''
-      src
-      tests
-    '';
+    sparseCheckout = [
+      "src"
+      "tests"
+    ];
    nonConeMode = true;
    sha256 = "sha256-FknO6C/PSnMPfhUqObD4vsW4PhkwdmPa9blNzcNvJQ4=";
  };
--- a/pkgs/build-support/fetchgithub/default.nix
+++ b/pkgs/build-support/fetchgithub/default.nix
@ -3,7 +3,7 @@
 { owner, repo, rev, name ? "source"
 , fetchSubmodules ? false, leaveDotGit ? null
 , deepClone ? false, private ? false, forceFetchGit ? false
-, sparseCheckout ? ""
+, sparseCheckout ? []
 , githubBase ? "github.com", varPrefix ? null
 , meta ? { }
 , ... # For hash agility
@ -24,7 +24,7 @@ let
  };
  passthruAttrs = removeAttrs args [ "owner" "repo" "rev" "fetchSubmodules" "forceFetchGit" "private" "githubBase" "varPrefix" ];
  varBase = "NIX${if varPrefix == null then "" else "_${varPrefix}"}_GITHUB_PRIVATE_";
-  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit || (sparseCheckout != "");
+  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit || !(sparseCheckout == "" || sparseCheckout == []);
  # We prefer fetchzip in cases we don't need submodules as the hash
  # is more stable in that case.
  fetcher = if useFetchGit then fetchgit else fetchzip;
--- a/pkgs/build-support/node/build-npm-package/default.nix
+++ b/pkgs/build-support/node/build-npm-package/default.nix
@ -17,7 +17,7 @@
 , npmBuildScript ? "build"
  # Flags to pass to all npm commands.
 , npmFlags ? [ ]
-  # Flags to pass to `npm ci`.
+  # Flags to pass to `npm ci` and `npm prune`.
 , npmInstallFlags ? [ ]
  # Flags to pass to `npm rebuild`.
 , npmRebuildFlags ? [ ]
--- a/pkgs/build-support/node/build-npm-package/hooks/default.nix
+++ b/pkgs/build-support/node/build-npm-package/hooks/default.nix
@ -7,10 +7,11 @@
      substitutions = {
        nodeSrc = srcOnly nodejs;

-        # Specify the stdenv's `diff` and `jq` by abspath to ensure that the user's build
+        # Specify `diff`, `jq`, and `prefetch-npm-deps` by abspath to ensure that the user's build
        # inputs do not cause us to find the wrong binaries.
        diff = "${buildPackages.diffutils}/bin/diff";
        jq = "${buildPackages.jq}/bin/jq";
+        prefetchNpmDeps = "${buildPackages.prefetch-npm-deps}/bin/prefetch-npm-deps";

        nodeVersion = nodejs.version;
        nodeVersionMajor = lib.versions.major nodejs.version;
--- a/pkgs/build-support/node/build-npm-package/hooks/npm-build-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-build-hook.sh
@ -20,6 +20,7 @@ npmBuildHook() {
        echo
        echo "Here are a few things you can try, depending on the error:"
        echo "1. Make sure your build script ($npmBuildScript) exists"
+        echo "  If there is none, set `dontNpmBuild = true`."
        echo '2. If the error being thrown is something similar to "error:0308010C:digital envelope routines::unsupported", add `NODE_OPTIONS = "--openssl-legacy-provider"` to your derivation'
        echo "  See https://github.com/webpack/webpack/issues/14532 for more information."
        echo
--- a/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh
@ -5,9 +5,18 @@ npmConfigHook() {

    echo "Configuring npm"

-    export HOME=$TMPDIR
+    export HOME="$TMPDIR"
    export npm_config_nodedir="@nodeSrc@"

+    if [ -z "${npmDeps-}" ]; then
+        echo
+        echo "ERROR: no dependencies were specified"
+        echo 'Hint: set `npmDeps` if using these hooks individually. If this is happening with `buildNpmPackage`, please open an issue.'
+        echo
+
+        exit 1
+    fi
+
    local -r cacheLockfile="$npmDeps/package-lock.json"
    local -r srcLockfile="$PWD/package-lock.json"

@ -47,15 +56,17 @@ npmConfigHook() {
      exit 1
    fi

+    @prefetchNpmDeps@ --fixup-lockfile "$srcLockfile"
+
    local cachePath

    if [ -z "${makeCacheWritable-}" ]; then
-        cachePath=$npmDeps
+        cachePath="$npmDeps"
    else
        echo "Making cache writable"
        cp -r "$npmDeps" "$TMPDIR/cache"
        chmod -R 700 "$TMPDIR/cache"
-        cachePath=$TMPDIR/cache
+        cachePath="$TMPDIR/cache"
    fi

    npm config set cache "$cachePath"
@ -71,7 +82,7 @@ npmConfigHook() {
        echo "Here are a few things you can try, depending on the error:"
        echo '1. Set `makeCacheWritable = true`'
        echo "  Note that this won't help if npm is complaining about not being able to write to the logs directory -- look above that for the actual error."
-        echo '2. Set `npmInstallFlags = [ "--legacy-peer-deps" ]`'
+        echo '2. Set `npmFlags = [ "--legacy-peer-deps" ]`'
        echo

        exit 1
@ -96,6 +107,8 @@ npmConfigHook() {
      rm node_modules/.meow
    fi

+    patchShebangs node_modules
+
    echo "Finished npmConfigHook"
 }

--- a/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
@ -27,7 +27,7 @@ npmInstallHook() {
    local -r nodeModulesPath="$packageOut/node_modules"

    if [ ! -d "$nodeModulesPath" ]; then
-        npm prune --omit dev
+        npm prune --omit dev $npmInstallFlags "${npmInstallFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"
        find node_modules -maxdepth 1 -type d -empty -delete

        cp -r node_modules "$nodeModulesPath"
--- a/pkgs/build-support/node/fetch-npm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-npm-deps/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenvNoCC, rustPlatform, Security, testers, fetchurl, prefetch-npm-deps, fetchNpmDeps }:
+{ lib, stdenvNoCC, rustPlatform, makeWrapper, Security, gnutar, gzip, testers, fetchurl, prefetch-npm-deps, fetchNpmDeps }:

 {
  prefetch-npm-deps = rustPlatform.buildRustPackage {
@ -16,8 +16,13 @@

    cargoLock.lockFile = ./Cargo.lock;

+    nativeBuildInputs = [ makeWrapper ];
    buildInputs = lib.optional stdenvNoCC.isDarwin Security;

+    postInstall = ''
+      wrapProgram "$out/bin/prefetch-npm-deps" --prefix PATH : ${lib.makeBinPath [ gnutar gzip ]}
+    '';
+
    passthru.tests =
      let
        makeTestSrc = { name, src }: stdenvNoCC.mkDerivation {
@ -46,7 +51,7 @@
            hash = "sha256-uQmc+S+V1co1Rfc4d82PpeXjmd1UqdsG492ADQFcZGA=";
          };

-          hash = "sha256-fk7L9vn8EHJsGJNMAjYZg9h0PT6dAwiahdiEeXVrMB8=";
+          hash = "sha256-wca1QvxUw3OrLStfYN9Co6oVBR1LbfcNUKlDqvObps4=";
        };

        lockfileV2 = makeTest {
@ -57,7 +62,7 @@
            hash = "sha256-qS29tq5QPnGxV+PU40VgMAtdwVLtLyyhG2z9GMeYtC4=";
          };

-          hash = "sha256-s8SpZY/1tKZVd3vt7sA9vsqHvEaNORQBMrSyhWpj048=";
+          hash = "sha256-tuEfyePwlOy2/mOPdXbqJskO6IowvAP4DWg8xSZwbJw=";
        };

        hashPrecedence = makeTest {
@ -68,7 +73,7 @@
            hash = "sha256-1+0AQw9EmbHiMPA/H8OP8XenhrkhLRYBRhmd1cNPFjk=";
          };

-          hash = "sha256-KRxwrEij3bpZ5hbQhX67KYpnY2cRS7u2EVZIWO1FBPM=";
+          hash = "sha256-oItUls7AXcCECuyA+crQO6B0kv4toIr8pBubNwB7kAM=";
        };

        hostedGitDeps = makeTest {
@ -79,7 +84,30 @@
            hash = "sha256-X9mCwPqV5yP0S2GonNvpYnLSLJMd/SUIked+hMRxDpA=";
          };

-          hash = "sha256-oIM05TGHstX1D4k2K4TJ+SHB7H/tNKzxzssqf0GJwvY=";
+          hash = "sha256-5Mg7KDJLMM5e/7BCHGinGAnBRft2ySQzvKW06p3u/0o=";
+        };
+
+        linkDependencies = makeTest {
+          name = "link-dependencies";
+
+          src = fetchurl {
+            url = "https://raw.githubusercontent.com/evcc-io/evcc/0.106.3/package-lock.json";
+            hash = "sha256-6ZTBMyuyPP/63gpQugggHhKVup6OB4hZ2rmSvPJ0yEs=";
+          };
+
+          hash = "sha256-VzQhArHoznYSXUT7l9HkJV4yoSOmoP8eYTLel1QwmB4=";
+        };
+
+        # This package contains both hosted Git shorthand, and a bundled dependency that happens to override an existing one.
+        etherpadLite1818 = makeTest {
+          name = "etherpad-lite-1.8.18";
+
+          src = fetchurl {
+            url = "https://raw.githubusercontent.com/ether/etherpad-lite/1.8.18/src/package-lock.json";
+            hash = "sha256-1fGNxYJi1I4cXK/jinNG+Y6tPEOhP3QAqWOBEQttS9E=";
+          };
+
+          hash = "sha256-8xF8F74nHwL9KPN2QLsxnfvsk0rNCKOZniYJQCD5u/I=";
        };
      };

--- a/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
@ -109,7 +109,7 @@ impl Cache {

        let mut file = File::options().append(true).create(true).open(index_path)?;

-        write!(file, "\n{:x}\t{data}", Sha1::new().chain(&data).finalize())?;
+        write!(file, "{:x}\t{data}", Sha1::new().chain(&data).finalize())?;

        Ok(())
    }
--- a/pkgs/build-support/node/fetch-npm-deps/src/main.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/main.rs
@ -1,19 +1,22 @@
 #![warn(clippy::pedantic)]

 use crate::cacache::Cache;
-use anyhow::anyhow;
+use anyhow::{anyhow, Context};
 use rayon::prelude::*;
 use serde::Deserialize;
+use serde_json::{Map, Value};
 use std::{
-    collections::HashMap,
-    env, fs,
+    collections::{HashMap, HashSet},
+    env, fmt, fs, io,
    path::Path,
-    process::{self, Command},
+    process::{self, Command, Stdio},
 };
 use tempfile::tempdir;
 use url::Url;

 mod cacache;
+#[cfg(test)]
+mod tests;

 #[derive(Deserialize)]
 struct PackageLock {
@ -25,38 +28,93 @@ struct PackageLock {

 #[derive(Deserialize)]
 struct OldPackage {
-    version: String,
-    resolved: Option<String>,
+    version: UrlOrString,
+    #[serde(default)]
+    bundled: bool,
+    resolved: Option<UrlOrString>,
    integrity: Option<String>,
    dependencies: Option<HashMap<String, OldPackage>>,
 }

-#[derive(Deserialize)]
+#[derive(Debug, Deserialize, PartialEq, Eq)]
 struct Package {
-    resolved: Option<Url>,
+    resolved: Option<UrlOrString>,
    integrity: Option<String>,
 }

+#[derive(Debug, Deserialize, PartialEq, Eq)]
+#[serde(untagged)]
+enum UrlOrString {
+    Url(Url),
+    String(String),
+}
+
+impl fmt::Display for UrlOrString {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            UrlOrString::Url(url) => url.fmt(f),
+            UrlOrString::String(string) => string.fmt(f),
+        }
+    }
+}
+
+#[allow(clippy::case_sensitive_file_extension_comparisons)]
 fn to_new_packages(
    old_packages: HashMap<String, OldPackage>,
+    initial_url: &Url,
 ) -> anyhow::Result<HashMap<String, Package>> {
    let mut new = HashMap::new();

-    for (name, package) in old_packages {
+    for (name, mut package) in old_packages {
+        // In some cases, a bundled dependency happens to have the same version as a non-bundled one, causing
+        // the bundled one without a URL to override the entry for the non-bundled instance, which prevents the
+        // dependency from being downloaded.
+        if package.bundled {
+            continue;
+        }
+
+        if let UrlOrString::Url(v) = &package.version {
+            for (scheme, host) in [
+                ("github", "github.com"),
+                ("bitbucket", "bitbucket.org"),
+                ("gitlab", "gitlab.com"),
+            ] {
+                if v.scheme() == scheme {
+                    package.version = {
+                        let mut new_url = initial_url.clone();
+
+                        new_url.set_host(Some(host))?;
+
+                        if v.path().ends_with(".git") {
+                            new_url.set_path(v.path());
+                        } else {
+                            new_url.set_path(&format!("{}.git", v.path()));
+                        }
+
+                        new_url.set_fragment(v.fragment());
+
+                        UrlOrString::Url(new_url)
+                    };
+
+                    break;
+                }
+            }
+        }
+
        new.insert(
            format!("{name}-{}", package.version),
            Package {
-                resolved: if let Ok(url) = Url::parse(&package.version) {
-                    Some(url)
+                resolved: if matches!(package.version, UrlOrString::Url(_)) {
+                    Some(package.version)
                } else {
-                    package.resolved.as_deref().map(Url::parse).transpose()?
+                    package.resolved
                },
                integrity: package.integrity,
            },
        );

        if let Some(dependencies) = package.dependencies {
-            new.extend(to_new_packages(dependencies)?);
+            new.extend(to_new_packages(dependencies, initial_url)?);
        }
    }

@ -184,6 +242,59 @@ fn get_ideal_hash(integrity: &str) -> anyhow::Result<&str> {
    }
 }

+fn get_initial_url() -> anyhow::Result<Url> {
+    Url::parse("git+ssh://git@a.b").context("initial url should be valid")
+}
+
+/// `fixup_lockfile` removes the `integrity` field from Git dependencies.
+///
+/// Git dependencies from specific providers can be retrieved from those providers' automatic tarball features.
+/// When these dependencies are specified with a commit identifier, npm generates a tarball, and inserts the integrity hash of that
+/// tarball into the lockfile.
+///
+/// Thus, we remove this hash, to replace it with our own determinstic copies of dependencies from hosted Git providers.
+fn fixup_lockfile(mut lock: Map<String, Value>) -> anyhow::Result<Option<Map<String, Value>>> {
+    if lock
+        .get("lockfileVersion")
+        .ok_or_else(|| anyhow!("couldn't get lockfile version"))?
+        .as_i64()
+        .ok_or_else(|| anyhow!("lockfile version isn't an int"))?
+        < 2
+    {
+        return Ok(None);
+    }
+
+    let mut fixed = false;
+
+    for package in lock
+        .get_mut("packages")
+        .ok_or_else(|| anyhow!("couldn't get packages"))?
+        .as_object_mut()
+        .ok_or_else(|| anyhow!("packages isn't a map"))?
+        .values_mut()
+    {
+        if let Some(Value::String(resolved)) = package.get("resolved") {
+            if resolved.starts_with("git+ssh://") && package.get("integrity").is_some() {
+                fixed = true;
+
+                package
+                    .as_object_mut()
+                    .ok_or_else(|| anyhow!("package isn't a map"))?
+                    .remove("integrity");
+            }
+        }
+    }
+
+    if fixed {
+        lock.remove("dependencies");
+
+        Ok(Some(lock))
+    } else {
+        Ok(None)
+    }
+}
+
+#[allow(clippy::too_many_lines)]
 fn main() -> anyhow::Result<()> {
    let args = env::args().collect::<Vec<_>>();

@ -195,6 +306,18 @@ fn main() -> anyhow::Result<()> {
        process::exit(1);
    }

+    if args[1] == "--fixup-lockfile" {
+        let lock = serde_json::from_str(&fs::read_to_string(&args[2])?)?;
+
+        if let Some(fixed) = fixup_lockfile(lock)? {
+            println!("Fixing lockfile");
+
+            fs::write(&args[2], serde_json::to_string(&fixed)?)?;
+        }
+
+        return Ok(());
+    }
+
    let lock_content = fs::read_to_string(&args[1])?;
    let lock: PackageLock = serde_json::from_str(&lock_content)?;

@ -213,7 +336,13 @@ fn main() -> anyhow::Result<()> {
    eprintln!("lockfile version: {}", lock.version);

    let packages = match lock.version {
-        1 => lock.dependencies.map(to_new_packages).transpose()?,
+        1 => {
+            let initial_url = get_initial_url()?;
+
+            lock.dependencies
+                .map(|p| to_new_packages(p, &initial_url))
+                .transpose()?
+        }
        2 | 3 => lock.packages,
        _ => panic!(
            "We don't support lockfile version {}, please file an issue.",
@ -225,31 +354,90 @@ fn main() -> anyhow::Result<()> {
        return Ok(());
    }

+    let packages = {
+        let mut seen = HashSet::new();
+        let mut new_packages = HashMap::new();
+
+        for (dep, package) in packages.unwrap().drain() {
+            if let (false, Some(UrlOrString::Url(resolved))) = (dep.is_empty(), &package.resolved) {
+                if !seen.contains(resolved) {
+                    seen.insert(resolved.clone());
+                    new_packages.insert(dep, package);
+                }
+            }
+        }
+
+        new_packages
+    };
+
    let cache = Cache::new(out.join("_cacache"));

    packages
-        .unwrap()
        .into_par_iter()
-        .try_for_each(|(dep, package)| {
-            if dep.is_empty() || package.resolved.is_none() {
-                return Ok::<_, anyhow::Error>(());
-            }
-
+        .try_for_each(|(dep, mut package)| {
            eprintln!("{dep}");

-            let mut resolved = package.resolved.unwrap();
+            let mut resolved = match package.resolved {
+                Some(UrlOrString::Url(url)) => url,
+                _ => unreachable!(),
+            };
+
+            let mut hosted = false;

            if let Some(hosted_git_url) = get_hosted_git_url(&resolved) {
                resolved = hosted_git_url;
+                package.integrity = None;
+                hosted = true;
            }

            let mut data = Vec::new();

-            agent
-                .get(resolved.as_str())
-                .call()?
-                .into_reader()
-                .read_to_end(&mut data)?;
+            let mut body = agent.get(resolved.as_str()).call()?.into_reader();
+
+            if hosted {
+                let workdir = tempdir()?;
+
+                let tar_path = workdir.path().join("package");
+
+                fs::create_dir(&tar_path)?;
+
+                let mut cmd = Command::new("tar")
+                    .args(["--extract", "--gzip", "--strip-components=1", "-C"])
+                    .arg(&tar_path)
+                    .stdin(Stdio::piped())
+                    .spawn()?;
+
+                io::copy(&mut body, &mut cmd.stdin.take().unwrap())?;
+
+                let exit = cmd.wait()?;
+
+                if !exit.success() {
+                    return Err(anyhow!(
+                        "failed to extract tarball for {dep}: tar exited with status code {}",
+                        exit.code().unwrap()
+                    ));
+                }
+
+                data = Command::new("tar")
+                    .args([
+                        "--sort=name",
+                        "--mtime=0",
+                        "--owner=0",
+                        "--group=0",
+                        "--numeric-owner",
+                        "--format=gnu",
+                        "-I",
+                        "gzip -n -9",
+                        "--create",
+                        "-C",
+                    ])
+                    .arg(workdir.path())
+                    .arg("package")
+                    .output()?
+                    .stdout;
+            } else {
+                body.read_to_end(&mut data)?;
+            }

            cache
                .put(
@ -263,7 +451,7 @@ fn main() -> anyhow::Result<()> {
                )
                .map_err(|e| anyhow!("couldn't insert cache entry for {dep}: {e:?}"))?;

-            Ok(())
+            Ok::<_, anyhow::Error>(())
        })?;

    fs::write(out.join("package-lock.json"), lock_content)?;
@ -277,58 +465,3 @@ fn main() -> anyhow::Result<()> {

    Ok(())
 }
-
-#[cfg(test)]
-mod tests {
-    use super::{get_hosted_git_url, get_ideal_hash};
-    use url::Url;
-
-    #[test]
-    fn hosted_git_urls() {
-        for (input, expected) in [
-            (
-                "git+ssh://git@github.com/castlabs/electron-releases.git#fc5f78d046e8d7cdeb66345a2633c383ab41f525",
-                Some("https://codeload.github.com/castlabs/electron-releases/tar.gz/fc5f78d046e8d7cdeb66345a2633c383ab41f525"),
-            ),
-            (
-                "https://user@github.com/foo/bar#fix/bug",
-                Some("https://codeload.github.com/foo/bar/tar.gz/fix/bug")
-            ),
-            (
-                "https://github.com/eligrey/classList.js/archive/1.2.20180112.tar.gz",
-                None
-            ),
-            (
-                "git+ssh://bitbucket.org/foo/bar#branch",
-                Some("https://bitbucket.org/foo/bar/get/branch.tar.gz")
-            ),
-            (
-                "ssh://git@gitlab.com/foo/bar.git#fix/bug",
-                Some("https://gitlab.com/foo/bar/repository/archive.tar.gz?ref=fix/bug")
-            ),
-            (
-                "git+ssh://git.sr.ht/~foo/bar#branch",
-                Some("https://git.sr.ht/~foo/bar/archive/branch.tar.gz")
-            ),
-        ] {
-            assert_eq!(
-                get_hosted_git_url(&Url::parse(input).unwrap()),
-                expected.map(|u| Url::parse(u).unwrap())
-            );
-        }
-    }
-
-    #[test]
-    fn ideal_hashes() {
-        for (input, expected) in [
-            ("sha512-foo sha1-bar", Some("sha512-foo")),
-            ("sha1-bar md5-foo", Some("sha1-bar")),
-            ("sha1-bar", Some("sha1-bar")),
-            ("sha512-foo", Some("sha512-foo")),
-            ("foo-bar sha1-bar", Some("sha1-bar")),
-            ("foo-bar baz-foo", None),
-        ] {
-            assert_eq!(get_ideal_hash(input).ok(), expected);
-        }
-    }
-}
--- a/pkgs/build-support/node/fetch-npm-deps/src/tests.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/tests.rs
@ -0,0 +1,141 @@
+use super::{
+    fixup_lockfile, get_hosted_git_url, get_ideal_hash, get_initial_url, to_new_packages,
+    OldPackage, Package, UrlOrString,
+};
+use serde_json::json;
+use std::collections::HashMap;
+use url::Url;
+
+#[test]
+fn hosted_git_urls() {
+    for (input, expected) in [
+        (
+            "git+ssh://git@github.com/castlabs/electron-releases.git#fc5f78d046e8d7cdeb66345a2633c383ab41f525",
+            Some("https://codeload.github.com/castlabs/electron-releases/tar.gz/fc5f78d046e8d7cdeb66345a2633c383ab41f525"),
+        ),
+        (
+            "https://user@github.com/foo/bar#fix/bug",
+            Some("https://codeload.github.com/foo/bar/tar.gz/fix/bug")
+        ),
+        (
+            "https://github.com/eligrey/classList.js/archive/1.2.20180112.tar.gz",
+            None
+        ),
+        (
+            "git+ssh://bitbucket.org/foo/bar#branch",
+            Some("https://bitbucket.org/foo/bar/get/branch.tar.gz")
+        ),
+        (
+            "ssh://git@gitlab.com/foo/bar.git#fix/bug",
+            Some("https://gitlab.com/foo/bar/repository/archive.tar.gz?ref=fix/bug")
+        ),
+        (
+            "git+ssh://git.sr.ht/~foo/bar#branch",
+            Some("https://git.sr.ht/~foo/bar/archive/branch.tar.gz")
+        ),
+    ] {
+        assert_eq!(
+            get_hosted_git_url(&Url::parse(input).unwrap()),
+            expected.map(|u| Url::parse(u).unwrap())
+        );
+    }
+}
+
+#[test]
+fn ideal_hashes() {
+    for (input, expected) in [
+        ("sha512-foo sha1-bar", Some("sha512-foo")),
+        ("sha1-bar md5-foo", Some("sha1-bar")),
+        ("sha1-bar", Some("sha1-bar")),
+        ("sha512-foo", Some("sha512-foo")),
+        ("foo-bar sha1-bar", Some("sha1-bar")),
+        ("foo-bar baz-foo", None),
+    ] {
+        assert_eq!(get_ideal_hash(input).ok(), expected);
+    }
+}
+
+#[test]
+fn git_shorthand_v1() -> anyhow::Result<()> {
+    let old = {
+        let mut o = HashMap::new();
+        o.insert(
+            String::from("sqlite3"),
+            OldPackage {
+                version: UrlOrString::Url(
+                    Url::parse(
+                        "github:mapbox/node-sqlite3#593c9d498be2510d286349134537e3bf89401c4a",
+                    )
+                    .unwrap(),
+                ),
+                bundled: false,
+                resolved: None,
+                integrity: None,
+                dependencies: None,
+            },
+        );
+        o
+    };
+
+    let initial_url = get_initial_url()?;
+
+    let new = to_new_packages(old, &initial_url)?;
+
+    assert_eq!(new.len(), 1, "new packages map should contain 1 value");
+    assert_eq!(new.into_values().next().unwrap(), Package {
+        resolved: Some(UrlOrString::Url(Url::parse("git+ssh://git@github.com/mapbox/node-sqlite3.git#593c9d498be2510d286349134537e3bf89401c4a").unwrap())),
+        integrity: None
+    });
+
+    Ok(())
+}
+
+#[test]
+fn lockfile_fixup() -> anyhow::Result<()> {
+    let input = json!({
+        "lockfileVersion": 2,
+        "name": "foo",
+        "packages": {
+            "": {
+
+            },
+            "foo": {
+                "resolved": "https://github.com/NixOS/nixpkgs",
+                "integrity": "aaa"
+            },
+            "bar": {
+                "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
+                "integrity": "bbb"
+            }
+        }
+    });
+
+    let expected = json!({
+        "lockfileVersion": 2,
+        "name": "foo",
+        "packages": {
+            "": {
+
+            },
+            "foo": {
+                "resolved": "https://github.com/NixOS/nixpkgs",
+                "integrity": "aaa"
+            },
+            "bar": {
+                "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
+            }
+        }
+    });
+
+    assert_eq!(
+        fixup_lockfile(input.as_object().unwrap().clone())?,
+        Some(expected.as_object().unwrap().clone())
+    );
+
+    assert_eq!(
+        fixup_lockfile(json!({"lockfileVersion": 1}).as_object().unwrap().clone())?,
+        None
+    );
+
+    Ok(())
+}
--- a/pkgs/build-support/references-by-popularity/default.nix
+++ b/pkgs/build-support/references-by-popularity/default.nix
@ -5,6 +5,7 @@ path: runCommand "closure-paths"
 {
  exportReferencesGraph.graph = path;
  __structuredAttrs = true;
+  preferLocalBuild = true;
  PATH = "${coreutils}/bin:${python3}/bin";
  builder = builtins.toFile "builder"
    ''
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@ -71,7 +71,7 @@ let
        owner = "googlefonts";
        repo = "noto-cjk";
        inherit rev sha256;
-        sparseCheckout = "${typeface}/Variable/OTC";
+        sparseCheckout = [ "${typeface}/Variable/OTC" ];
      };

      installPhase = ''
--- a/pkgs/data/icons/beauty-line-icon-theme/default.nix
+++ b/pkgs/data/icons/beauty-line-icon-theme/default.nix
@ -18,9 +18,9 @@ stdenvNoCC.mkDerivation rec {
    owner = "gvolpe";
    repo = pname;
    rev = version;
-    sparseCheckout = ''
-      BeautyLine-V3
-    '';
+    sparseCheckout = [
+      "BeautyLine-V3"
+    ];
    sha256 = "sha256-IkkypAj250+OXbf19TampCnqYsSbJVIjeYlxJoyhpzk=";
  };

--- a/pkgs/data/misc/colemak-dh/default.nix
+++ b/pkgs/data/misc/colemak-dh/default.nix
@ -12,7 +12,7 @@ stdenvNoCC.mkDerivation rec {
    repo  = "mod-dh";
    rev = "e846a5bd24d59ed15ba70b3a9d5363a38ca51d09";
    sha256  = "sha256-RFOpN+tIMfakb7AZN0ock9eq2mytvL0DWedvQV67+ks=";
-    sparseCheckout = "console";
+    sparseCheckout = [ "console" ];
  };

  phases = [ "unpackPhase" "installPhase" ];
--- a/pkgs/development/compilers/julia/1.0.nix
+++ b/pkgs/development/compilers/julia/1.0.nix
@ -1,207 +0,0 @@
-{ lib, stdenv, fetchpatch, fetchurl, fetchzip
-# build tools
-, gfortran, m4, makeWrapper, patchelf, perl, which, python3
-, cmake
-# libjulia dependencies
-, libunwind, readline, utf8proc, zlib
-# standard library dependencies
-, curl, fftwSinglePrec, fftw, gmp, libgit2, mpfr, openlibm, openspecfun, pcre2
-# linear algebra
-, blas, lapack, arpack
-# Darwin frameworks
-, CoreServices, ApplicationServices
-}:
-
-
-let
-  majorVersion = "1";
-  minorVersion = "0";
-  maintenanceVersion = "4";
-  src_sha256 = "1dfx68wbrrzpbh74rla7i2g3r5z6wa1pxq3ahyfm5m27vfyjbkhg";
-
-  libuvVersion = "ed3700c849289ed01fe04273a7bf865340b2bd7e";
-  libuvSha256 = "137w666zsjw1p0ma3lf94d75hr1q45sgkfmbizkyji2qm57cnxjs";
-
-  dsfmtVersion = "2.2.3";
-  dsfmt = fetchurl {
-    url = "http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/SFMT/dSFMT-src-${dsfmtVersion}.tar.gz";
-    sha256 = "03kaqbjbi6viz0n33dk5jlf6ayxqlsq4804n7kwkndiga9s4hd42";
-  };
-
-  libuv = fetchurl {
-    url = "https://api.github.com/repos/JuliaLang/libuv/tarball/${libuvVersion}";
-    sha256 = libuvSha256;
-  };
-
-  rmathVersion = "0.1";
-  rmath-julia = fetchurl {
-    url = "https://api.github.com/repos/JuliaLang/Rmath-julia/tarball/v${rmathVersion}";
-    sha256 = "1qyps217175qhid46l8f5i1v8i82slgp23ia63x2hzxwfmx8617p";
-  };
-
-  virtualenvVersion = "15.0.0";
-  virtualenv = fetchurl {
-    url = "mirror://pypi/v/virtualenv/virtualenv-${virtualenvVersion}.tar.gz";
-    sha256 = "06fw4liazpx5vf3am45q2pdiwrv0id7ckv7n6zmpml29x6vkzmkh";
-  };
-
-  libwhichVersion = "81e9723c0273d78493dc8c8ed570f68d9ce7e89e";
-  libwhich = fetchurl {
-    url = "https://api.github.com/repos/vtjnash/libwhich/tarball/${libwhichVersion}";
-    sha256 = "1p7zg31kpmpbmh1znrk1xrbd074agx13b9q4dcw8n2zrwwdlbz3b";
-  };
-
-  llvmVersion = "6.0.0";
-  llvm = fetchurl {
-    url = "http://releases.llvm.org/6.0.0/llvm-${llvmVersion}.src.tar.xz";
-    sha256 = "0224xvfg6h40y5lrbnb9qaq3grmdc5rg00xq03s1wxjfbf8krx8z";
-  };
-
-  suitesparseVersion = "4.4.5";
-  suitesparse = fetchurl {
-    url = "http://faculty.cse.tamu.edu/davis/SuiteSparse/SuiteSparse-${suitesparseVersion}.tar.gz";
-    sha256 = "1jcbxb8jx5wlcixzf6n5dca2rcfx6mlcms1k2rl5gp67ay3bix43";
-  };
-  version = "${majorVersion}.${minorVersion}.${maintenanceVersion}";
-in
-
-stdenv.mkDerivation rec {
-  pname = "julia";
-  inherit version;
-
-  src = fetchzip {
-    url = "https://github.com/JuliaLang/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = src_sha256;
-  };
-
-  nativeBuildInputs = [ cmake curl gfortran m4 makeWrapper patchelf perl python3 which ];
-  # cmake is only used to build the bundled deps
-  dontUseCmakeConfigure = true;
-
-  # We assert that compatible blas and lapack are used.
-  buildInputs = assert (blas.isILP64 == lapack.isILP64); [
-    arpack fftw fftwSinglePrec gmp libgit2 libunwind mpfr
-    pcre2.dev blas lapack openlibm openspecfun readline utf8proc
-    zlib
-  ]
-  ++ lib.optionals stdenv.isDarwin [CoreServices ApplicationServices]
-  ;
-
-  patches = [
-    ./patches/1.0/use-system-utf8proc-julia-1.0.patch
-  ];
-
-  postPatch = ''
-    patchShebangs . contrib
-    for i in backtrace cmdlineargs; do
-      mv test/$i.jl{,.off}
-      touch test/$i.jl
-    done
-    rm stdlib/Sockets/test/runtests.jl && touch stdlib/Sockets/test/runtests.jl
-    rm stdlib/Distributed/test/runtests.jl && touch stdlib/Distributed/test/runtests.jl
-    sed -e 's/Invalid Content-Type:/invalid Content-Type:/g' -i ./stdlib/LibGit2/test/libgit2.jl
-    sed -e 's/Failed to resolve /failed to resolve /g' -i ./stdlib/LibGit2/test/libgit2.jl
-  '';
-  prePatch = ''
-    mkdir deps/srccache
-    cp "${dsfmt}" "./deps/srccache/dsfmt-${dsfmtVersion}.tar.gz"
-    cp "${rmath-julia}" "./deps/srccache/Rmath-julia-${rmathVersion}.tar.gz"
-    cp "${libuv}" "./deps/srccache/libuv-${libuvVersion}.tar.gz"
-    cp "${virtualenv}" "./deps/srccache/virtualenv-${virtualenvVersion}.tar.gz"
-    cp "${libwhich}" "./deps/srccache/libwhich-${libwhichVersion}.tar.gz"
-    cp "${llvm}" "./deps/srccache/llvm-${llvmVersion}.src.tar.xz"
-    cp "${suitesparse}" "./deps/srccache/SuiteSparse-${suitesparseVersion}.tar.gz"
-  '';
-
-  makeFlags =
-    let
-      arch = lib.head (lib.splitString "-" stdenv.system);
-      march = {
-        x86_64 = stdenv.hostPlatform.gcc.arch or "x86-64";
-        i686 = "pentium4";
-        aarch64 = "armv8-a";
-      }.${arch}
-              or (throw "unsupported architecture: ${arch}");
-      # Julia requires Pentium 4 (SSE2) or better
-      cpuTarget = { x86_64 = "x86-64"; i686 = "pentium4"; aarch64 = "generic"; }.${arch}
-                  or (throw "unsupported architecture: ${arch}");
-    in [
-      "ARCH=${arch}"
-      "MARCH=${march}"
-      "JULIA_CPU_TARGET=${cpuTarget}"
-      "PREFIX=$(out)"
-      "prefix=$(out)"
-      "SHELL=${stdenv.shell}"
-
-      (lib.optionalString (!stdenv.isDarwin) "USE_SYSTEM_BLAS=1")
-      "USE_BLAS64=${if blas.isILP64 then "1" else "0"}"
-
-      "USE_SYSTEM_LAPACK=1"
-
-      "USE_SYSTEM_ARPACK=1"
-      "USE_SYSTEM_FFTW=1"
-      "USE_SYSTEM_GMP=1"
-      "USE_SYSTEM_LIBGIT2=1"
-      "USE_SYSTEM_LIBUNWIND=1"
-
-      # We will probably never do that
-      #"USE_SYSTEM_LLVM=1"
-      "LLVM_VER=6.0.0"
-
-      "USE_SYSTEM_MPFR=1"
-      "USE_SYSTEM_OPENLIBM=1"
-      "USE_SYSTEM_OPENSPECFUN=1"
-      "USE_SYSTEM_PATCHELF=1"
-      "USE_SYSTEM_PCRE=1"
-      "PCRE_CONFIG=${pcre2.dev}/bin/pcre2-config"
-      "PCRE_INCL_PATH=${pcre2.dev}/include/pcre2.h"
-      "USE_SYSTEM_READLINE=1"
-      "USE_SYSTEM_UTF8PROC=1"
-      "USE_SYSTEM_ZLIB=1"
-    ];
-
-  LD_LIBRARY_PATH = assert (blas.isILP64 == lapack.isILP64); (lib.makeLibraryPath [
-    arpack fftw fftwSinglePrec gmp libgit2 mpfr blas lapack openlibm
-    openspecfun pcre2
-  ]);
-
-  doCheck = !stdenv.isDarwin;
-  checkTarget = "testall";
-  # Julia's tests require read/write access to $HOME
-  preCheck = ''
-    export HOME="$NIX_BUILD_TOP"
-  '';
-
-  preBuild = ''
-    sed -e '/^install:/s@[^ ]*/doc/[^ ]*@@' -i Makefile
-    sed -e '/[$](DESTDIR)[$](docdir)/d' -i Makefile
-    export LD_LIBRARY_PATH=${LD_LIBRARY_PATH}
-  '';
-
-  enableParallelBuilding = true;
-
-  postInstall = ''
-    # Symlink shared libraries from LD_LIBRARY_PATH into lib/julia,
-    # as using a wrapper with LD_LIBRARY_PATH causes segmentation
-    # faults when program returns an error:
-    #   $ julia -e 'throw(Error())'
-    find $(echo $LD_LIBRARY_PATH | sed 's|:| |g') -maxdepth 1 -name '*.${if stdenv.isDarwin then "dylib" else "so"}*' | while read lib; do
-      if [[ ! -e $out/lib/julia/$(basename $lib) ]]; then
-        ln -sv $lib $out/lib/julia/$(basename $lib)
-      fi
-    done
-  '';
-
-  passthru = {
-    inherit majorVersion minorVersion maintenanceVersion;
-    site = "share/julia/site/v${majorVersion}.${minorVersion}";
-  };
-
-  meta = {
-    description = "High-level performance-oriented dynamical language for technical computing";
-    homepage = "https://julialang.org/";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ raskin rob garrison ];
-    platforms = [ "i686-linux" "x86_64-linux" "x86_64-darwin" "aarch64-linux" ];
-  };
-}
--- a/pkgs/development/compilers/julia/1.5.nix
+++ b/pkgs/development/compilers/julia/1.5.nix
@ -1,147 +0,0 @@
-{ lib, stdenv, fetchzip
-# build tools
-, gfortran, m4, makeWrapper, patchelf, perl, which, python3, cmake
-# libjulia dependencies
-, libunwind, readline, utf8proc, zlib
-# standard library dependencies
-, curl, fftwSinglePrec, fftw, libgit2, mpfr, openlibm, openspecfun, pcre2
-# linear algebra
-, blas, lapack, arpack
-# Darwin frameworks
-, CoreServices, ApplicationServices
-}:
-
-assert (!blas.isILP64) && (!lapack.isILP64);
-
-with lib;
-
-let
-  majorVersion = "1";
-  minorVersion = "5";
-  maintenanceVersion = "4";
-  src_sha256 = "1ba1v7hakgj95xvhyff0zcp0574qv6vailjl48wl1f8w5k54lsw2";
-  version = "${majorVersion}.${minorVersion}.${maintenanceVersion}";
-in
-
-stdenv.mkDerivation rec {
-  pname = "julia";
-  inherit version;
-
-  src = fetchzip {
-    url = "https://github.com/JuliaLang/julia/releases/download/v${version}/julia-${version}-full.tar.gz";
-    sha256 = src_sha256;
-  };
-
-  patches = [
-    ./patches/1.5/use-system-utf8proc-julia-1.3.patch
-  ];
-
-  postPatch = ''
-    patchShebangs . contrib
-  '';
-
-  dontUseCmakeConfigure = true;
-
-  buildInputs = [
-    arpack fftw fftwSinglePrec libgit2 libunwind mpfr
-    pcre2.dev blas lapack openlibm openspecfun readline utf8proc
-    zlib
-  ] ++ lib.optionals stdenv.isDarwin [CoreServices ApplicationServices];
-
-  nativeBuildInputs = [ curl gfortran m4 makeWrapper patchelf perl python3 which cmake ];
-
-  makeFlags =
-    let
-      arch = head (splitString "-" stdenv.system);
-      march = {
-        x86_64 = stdenv.hostPlatform.gcc.arch or "x86-64";
-        i686 = "pentium4";
-        aarch64 = "armv8-a";
-      }.${arch}
-              or (throw "unsupported architecture: ${arch}");
-      # Julia requires Pentium 4 (SSE2) or better
-      cpuTarget = { x86_64 = "x86-64"; i686 = "pentium4"; aarch64 = "generic"; }.${arch}
-                  or (throw "unsupported architecture: ${arch}");
-    # Julia applies a lot of patches to its dependencies, so for now do not use the system LLVM
-    # https://github.com/JuliaLang/julia/tree/master/deps/patches
-    in [
-      "ARCH=${arch}"
-      "MARCH=${march}"
-      "JULIA_CPU_TARGET=${cpuTarget}"
-      "PREFIX=$(out)"
-      "prefix=$(out)"
-      "SHELL=${stdenv.shell}"
-
-      (lib.optionalString (!stdenv.isDarwin) "USE_SYSTEM_BLAS=1")
-      "USE_BLAS64=${if blas.isILP64 then "1" else "0"}"
-
-      "USE_SYSTEM_LAPACK=1"
-
-      "USE_SYSTEM_ARPACK=1"
-      "USE_SYSTEM_FFTW=1"
-      "USE_SYSTEM_GMP=0"
-      "USE_SYSTEM_LIBGIT2=1"
-      "USE_SYSTEM_LIBUNWIND=1"
-
-      "USE_SYSTEM_MPFR=1"
-      "USE_SYSTEM_OPENLIBM=1"
-      "USE_SYSTEM_OPENSPECFUN=1"
-      "USE_SYSTEM_PATCHELF=1"
-      "USE_SYSTEM_PCRE=1"
-      "PCRE_CONFIG=${pcre2.dev}/bin/pcre2-config"
-      "PCRE_INCL_PATH=${pcre2.dev}/include/pcre2.h"
-      "USE_SYSTEM_READLINE=1"
-      "USE_SYSTEM_UTF8PROC=1"
-      "USE_SYSTEM_ZLIB=1"
-
-      "USE_BINARYBUILDER=0"
-    ];
-
-  LD_LIBRARY_PATH = makeLibraryPath [
-    arpack fftw fftwSinglePrec libgit2 mpfr blas openlibm
-    openspecfun pcre2 lapack
-  ];
-
-  preBuild = ''
-    sed -e '/^install:/s@[^ ]*/doc/[^ ]*@@' -i Makefile
-    sed -e '/[$](DESTDIR)[$](docdir)/d' -i Makefile
-    export LD_LIBRARY_PATH=${LD_LIBRARY_PATH}
-  '';
-
-  enableParallelBuilding = true;
-
-  # Julia's tests require read/write access to $HOME
-  preCheck = ''
-    export HOME="$NIX_BUILD_TOP"
-  '';
-  doCheck = true;
-  checkTarget = "test";
-
-  postInstall = ''
-    # Symlink shared libraries from LD_LIBRARY_PATH into lib/julia,
-    # as using a wrapper with LD_LIBRARY_PATH causes segmentation
-    # faults when program returns an error:
-    #   $ julia -e 'throw(Error())'
-    find $(echo $LD_LIBRARY_PATH | sed 's|:| |g') -maxdepth 1 -name '*.${if stdenv.isDarwin then "dylib" else "so"}*' | while read lib; do
-      if [[ ! -e $out/lib/julia/$(basename $lib) ]]; then
-        ln -sv $lib $out/lib/julia/$(basename $lib)
-      fi
-    done
-  '';
-
-  passthru = {
-    inherit majorVersion minorVersion maintenanceVersion;
-    site = "share/julia/site/v${majorVersion}.${minorVersion}";
-  };
-
-  meta = {
-    description = "High-level performance-oriented dynamical language for technical computing";
-    homepage = "https://julialang.org/";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ raskin rob garrison ];
-    platforms = [ "i686-linux" "x86_64-linux" "x86_64-darwin" "aarch64-linux" ];
-    # Unfortunately, this derivation does not pass Julia's test suite. See
-    # https://github.com/NixOS/nixpkgs/pull/121114.
-    broken = true;
-  };
-}
--- a/pkgs/development/compilers/julia/1.8-bin.nix
+++ b/pkgs/development/compilers/julia/1.8-bin.nix
@ -2,16 +2,16 @@

 stdenv.mkDerivation rec {
  pname = "julia-bin";
-  version = "1.8.2";
+  version = "1.8.3";

  src = {
    x86_64-linux = fetchurl {
      url = "https://julialang-s3.julialang.org/bin/linux/x64/${lib.versions.majorMinor version}/julia-${version}-linux-x86_64.tar.gz";
-      sha256 = "sha256-ZxzzpFC2OnF+Hu3X9pCH44VvAVsuFGy1SSjxmjwF55Y=";
+      sha256 = "sha256-M8Owk1b/qiXTMxw2RrHy1LCZROj5P8uZSVeAG4u/WKk=";
    };
    aarch64-linux = fetchurl {
      url = "https://julialang-s3.julialang.org/bin/linux/aarch64/${lib.versions.majorMinor version}/julia-${version}-linux-aarch64.tar.gz";
-      sha256 = "sha256-+RwnZCj/swrMIJ4Os+cLHJEmDoh+EdS2b1VFCEtTBUc=";
+      sha256 = "sha256-2/+xNKQTtxLUqOHujmZepV7bCGVxmhutmXkSPWQzrMk=";
    };
  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

--- a/pkgs/development/compilers/julia/1.8.nix
+++ b/pkgs/development/compilers/julia/1.8.nix
@ -28,11 +28,11 @@

 stdenv.mkDerivation rec {
  pname = "julia";
-  version = "1.8.2";
+  version = "1.8.3";

  src = fetchurl {
    url = "https://github.com/JuliaLang/julia/releases/download/v${version}/julia-${version}-full.tar.gz";
-    sha256 = "sha256-5Xz8Lm2JF1Ckf3zwNVmk6PchK/VJAPJqnxL9bQCdTKk=";
+    hash = "sha256-UraJWp1K0v422yYe6MTIzJISuDehL5MAL6r1N6IVH1A=";
  };

  patches =
--- a/pkgs/development/compilers/julia/patches/1.0/use-system-utf8proc-julia-1.0.patch
+++ b/pkgs/development/compilers/julia/patches/1.0/use-system-utf8proc-julia-1.0.patch
@ -1,29 +0,0 @@
-From 54a66b5728ec98f44a1768f064509be4fd3f2ef6 Mon Sep 17 00:00:00 2001
-From: Thomas Tuegel <ttuegel@gmail.com>
-Date: Sat, 10 Oct 2015 13:09:48 -0500
-Subject: [PATCH 1/3] use system utf8proc
-
---
- src/flisp/Makefile | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/flisp/Makefile b/src/flisp/Makefile
-index bec8624..5437b5c 100644
--- a/src/flisp/Makefile
-+++ b/src/flisp/Makefile
-@@ -24,9 +24,9 @@ DOBJS = $(SRCS:%.c=$(BUILDDIR)/%.dbg.obj)
- LLTDIR := ../support
- LLT_release := $(BUILDDIR)/$(LLTDIR)/libsupport.a
- LLT_debug := $(BUILDDIR)/$(LLTDIR)/libsupport-debug.a
-LIBFILES_release := $(LLT_release) $(LIBUV) $(LIBUTF8PROC)
-LIBFILES_debug := $(LLT_debug) $(LIBUV) $(LIBUTF8PROC)
-LIBS :=
-+LIBFILES_release := $(LLT_release) $(LIBUV)
-+LIBFILES_debug := $(LLT_debug) $(LIBUV)
-+LIBS := $(LIBUTF8PROC)
- ifneq ($(OS),WINNT)
- LIBS += -lpthread
- endif
-- 
-2.5.2
-
--- a/pkgs/development/compilers/julia/patches/1.5/use-system-utf8proc-julia-1.3.patch
+++ b/pkgs/development/compilers/julia/patches/1.5/use-system-utf8proc-julia-1.3.patch
@ -1,24 +0,0 @@
---
- src/flisp/Makefile | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-
-diff --git a/src/flisp/Makefile b/src/flisp/Makefile
-index d97075e..6bebca7 100644
--- a/src/flisp/Makefile
-+++ b/src/flisp/Makefile
-@@ -32,9 +32,9 @@ OBJS := $(SRCS:%.c=$(BUILDDIR)/%.o)
- DOBJS := $(SRCS:%.c=$(BUILDDIR)/%.dbg.obj)
- LLT_release := $(LLT_BUILDDIR)/libsupport.a
- LLT_debug := $(LLT_BUILDDIR)/libsupport-debug.a
-LIBFILES_release := $(LLT_release) $(LIBUV) $(LIBUTF8PROC)
-LIBFILES_debug := $(LLT_debug) $(LIBUV) $(LIBUTF8PROC)
-LIBS :=
-+LIBFILES_release := $(LLT_release) $(LIBUV)
-+LIBFILES_debug := $(LLT_debug) $(LIBUV)
-+LIBS := $(LIBUTF8PROC)
- ifneq ($(OS),WINNT)
- LIBS += -lpthread
- endif
-
-- 
--- a/pkgs/development/libraries/libmilter/default.nix
+++ b/pkgs/development/libraries/libmilter/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, m4 }:
+{ lib, stdenv, fetchurl, m4, fixDarwinDylibNames }:

 stdenv.mkDerivation rec {
  pname = "libmilter";
@ -34,7 +34,11 @@ stdenv.mkDerivation rec {

  patches = [ ./install.patch ./sharedlib.patch ./glibc-2.30.patch ./darwin.patch ];

-  nativeBuildInputs = [ m4 ];
+  nativeBuildInputs = [ m4 ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    fixDarwinDylibNames $out/lib/libmilter.dylib.1
+  '';

  meta = with lib; {
    description = "Sendmail Milter mail filtering API library";
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
    "--enable-hashes=all"
    "--enable-obsolete-api=glibc"
    "--disable-failure-tokens"
-  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+  ] ++ lib.optionals (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.libc == "bionic") [
    "--disable-werror"
  ];

--- a/pkgs/development/libraries/ntirpc/default.nix
+++ b/pkgs/development/libraries/ntirpc/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "ntirpc";
-  version = "4.0";
+  version = "4.1";

  src = fetchFromGitHub {
    owner = "nfs-ganesha";
    repo = "ntirpc";
    rev = "v${version}";
-    sha256 = "0hffma57b4c7g7862yvfr8bvbsbxh5w383mvjkjv3jpzi01l79yv";
+    sha256 = "sha256-RTuWj795YrXVo3TIiEr3Dy/QmSL5Ch0VVc4gRlDhNTM=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@ -85,6 +85,7 @@ let
        x86_64-linux = "./Configure linux-x86_64";
        x86_64-solaris = "./Configure solaris64-x86_64-gcc";
        riscv64-linux = "./Configure linux64-riscv64";
+        mipsel-linux = "./Configure linux-mips32";
        mips64el-linux =
          if stdenv.hostPlatform.isMips64n64
          then "./Configure linux64-mips64"
--- a/pkgs/development/ocaml-modules/linenoise/default.nix
+++ b/pkgs/development/ocaml-modules/linenoise/default.nix
@ -2,17 +2,15 @@

 buildDunePackage rec {
  pname = "linenoise";
-  version = "1.3.1";
+  version = "1.4.0";

-  useDune2 = true;
-
-  minimumOCamlVersion = "4.02";
+  minimalOCamlVersion = "4.03";

  src = fetchFromGitHub {
    owner = "fxfactorial";
    repo = "ocaml-${pname}";
    rev = "v${version}";
-    sha256 = "sha256-5DlF56reh52Tvbi3wGK8ZrPBAYK0ZTBV3jz8qUsyKGk=";
+    sha256 = "sha256-bIpZ9TO4/j24nQw5nsW7fUF7af5lhd/EmwhQRd0NYb4=";
  };

  propagatedBuildInputs = [ result ];
--- a/pkgs/development/python-modules/aocd/default.nix
+++ b/pkgs/development/python-modules/aocd/default.nix
@ -6,13 +6,13 @@

 buildPythonPackage rec {
  pname = "aocd";
-  version = "1.1.3";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "wimglenn";
    repo = "advent-of-code-data";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-V6byleGCgXc2xfceb+aO0sYwGD6uThE6/8s5NDEjerw=";
+    sha256 = "sha256-Oz1sy+BHekI0ApDKn7hNMDvQrog6EB0JPry7SV5fxig=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/django-hijack/default.nix
+++ b/pkgs/development/python-modules/django-hijack/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "django-hijack";
-  version = "3.2.1";
+  version = "3.2.4";

  # the wheel comes with pre-built assets, allowing us to avoid fighting
  # with npm/webpack/gettext to build them ourselves.
@ -19,7 +19,7 @@ buildPythonPackage rec {
    pname = "django_hijack";
    dist = "py3";
    python = "py3";
-    sha256 = "sha256-sHI3ULJH5bH2n2AKQLHVEkBAYfM5GOC/+0qpKDFOods=";
+    sha256 = "sha256-tSIovIPEszq00Y0PMl/Wlx5YK5MTxLhCpNpHFZDi9rQ=";
  };

  propagatedBuildInputs = [ django django_compat ];
--- a/pkgs/development/python-modules/fvs/default.nix
+++ b/pkgs/development/python-modules/fvs/default.nix
@ -0,0 +1,31 @@
+{ lib, buildPythonPackage, fetchPypi, orjson}:
+
+buildPythonPackage rec {
+  pname = "fvs";
+  version = "0.3.4";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "FVS";
+    extension = "tar.gz";
+    sha256 = "sha256-yYd0HzdwbqB9kexJjBRRYmdsoWtZtcjCNRz0ZJVM5CI=";
+  };
+
+  propagatedBuildInputs = [
+    orjson
+  ];
+
+  # no tests in src
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "fvs"
+  ];
+
+  meta = with lib; {
+    description = "File Versioning System with hash comparison and data storage to create unlinked states that can be deleted";
+    homepage = "https://github.com/mirkobrombin/FVS";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bryanasdev000 ];
+  };
+}
--- a/pkgs/development/python-modules/heatshrink2/default.nix
+++ b/pkgs/development/python-modules/heatshrink2/default.nix
@ -0,0 +1,26 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+}:
+
+buildPythonPackage rec {
+  pname = "heatshrink2";
+  version = "0.11.0";
+
+  src = fetchFromGitHub {
+    owner = "eerimoq";
+    repo = "pyheatshrink";
+    rev = version;
+    fetchSubmodules = true;
+    sha256 = "sha256-P3IofGbW4x+erGCyxIPvD9aNHIJ/GjjWgno4n95SQoQ=";
+  };
+
+  pythonImportsCheck = [ "heatshrink2" ];
+
+  meta = with lib; {
+    description = "Compression using the Heatshrink algorithm in Python 3.";
+    homepage = "https://github.com/eerimoq/pyheatshrink";
+    license = licenses.isc;
+    maintainers = with maintainers; [ prusnak ];
+  };
+}
--- a/pkgs/development/python-modules/icoextract/default.nix
+++ b/pkgs/development/python-modules/icoextract/default.nix
@ -0,0 +1,31 @@
+{ lib, buildPythonPackage, fetchPypi, pefile, pillow}:
+
+buildPythonPackage rec {
+  pname = "icoextract";
+  version = "0.1.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "tar.gz";
+    sha256 = "sha256-x0GEV0PUbkAzoUJgAqup9bHd7iYttGyzIZNdo8KsFyo=";
+  };
+
+  propagatedBuildInputs = [
+    pefile
+    pillow
+  ];
+
+  # tests expect mingw and multiarch
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "icoextract"
+  ];
+
+  meta = with lib; {
+    description = "Extract icons from Windows PE files";
+    homepage = "https://github.com/jlu5/icoextract";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bryanasdev000 ];
+  };
+}
--- a/pkgs/development/python-modules/niapy/default.nix
+++ b/pkgs/development/python-modules/niapy/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "niapy";
-  version = "2.0.3";
+  version = "2.0.4";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "NiaOrg";
    repo = "NiaPy";
    rev = "refs/tags/${version}";
-    hash = "sha256-h3bCitNFjw2WQtsQFR25VJlNVMojdfik+lrPMKwp8Mw=";
+    hash = "sha256-bZ9bONFntNx5tcm/gR/uPS5CqicJX281WsvSno8aVlY=";
  };

  propagatedBuildInputs = [
@ -41,6 +41,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Micro framework for building nature-inspired algorithms";
    homepage = "https://niapy.org/";
+    changelog = "https://github.com/NiaOrg/NiaPy/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/oslo-log/default.nix
+++ b/pkgs/development/python-modules/oslo-log/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "oslo-log";
-  version = "5.0.1";
+  version = "5.0.2";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -25,7 +25,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "oslo.log";
    inherit version;
-    hash = "sha256-+2Xy+dJEI/pt1urY7NIfZlxi4P2fkL8xHkwVO1+Kt+o=";
+    hash = "sha256-5F5zEqpxUooWc2zkUVK+PxrxI/XvYqqB2gRoBVhPzKM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pymilter/default.nix
+++ b/pkgs/development/python-modules/pymilter/default.nix
@ -0,0 +1,40 @@
+{ lib, python, buildPythonPackage, fetchFromGitHub, libmilter, bsddb3, pydns, iana-etc, libredirect }:
+
+buildPythonPackage rec {
+  pname = "pymilter";
+  version = "1.0.5";
+
+  src = fetchFromGitHub {
+    owner = "sdgathman";
+    repo = pname;
+    rev = "${pname}-${version}";
+    hash = "sha256-gZUWEDVZfDRiOOdG3lpiQldHxm/93l8qYVOHOEpHhzQ=";
+  };
+
+  buildInputs = [ libmilter ];
+  propagatedBuildInputs = [ bsddb3 pydns ];
+
+  preBuild = ''
+    sed -i 's/import thread/import _thread as thread/' Milter/greylist.py
+  '';
+
+  # requires /etc/resolv.conf
+  # testpolicy: requires makemap (#100419)
+  #   using exec -a makemap smtpctl results in "unknown group smtpq"
+  preCheck = ''
+    echo "nameserver 127.0.0.1" > resolv.conf
+    export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/resolv.conf=$(realpath resolv.conf)
+    export LD_PRELOAD=${libredirect}/lib/libredirect.so
+    sed -i '/testpolicy/d' test.py
+    rm testpolicy.py
+  '';
+
+  pythonImportsCheck = [ "Milter" ];
+
+  meta = with lib; {
+    homepage = "http://bmsi.com/python/milter.html";
+    description = "Python bindings for libmilter api";
+    maintainers = with maintainers; [ yorickvp ];
+    license = licenses.gpl2;
+  };
+}
--- a/pkgs/development/python-modules/pystray/default.nix
+++ b/pkgs/development/python-modules/pystray/default.nix
@ -1,5 +1,15 @@
-{ lib, buildPythonPackage, fetchFromGitHub
-, pillow, xlib, six, xvfb-run, sphinx }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pillow
+, xlib
+, six
+, xvfb-run
+, sphinx
+, gobject-introspection
+, pygobject3
+, gtk3
+, libayatana-appindicator }:

 buildPythonPackage rec {
  pname = "pystray";
@ -12,8 +22,8 @@ buildPythonPackage rec {
    sha256 = "sha256-8B178MSe4ujlnGBmQhIu+BoAh1doP9V5cL0ermLQTvs=";
  };

-  nativeBuildInputs = [ sphinx ];
-  propagatedBuildInputs = [ pillow xlib six ];
+  nativeBuildInputs = [ gobject-introspection sphinx ];
+  propagatedBuildInputs = [ pillow xlib six pygobject3 gtk3 libayatana-appindicator ];
  checkInputs = [ xvfb-run ];

  checkPhase = ''
--- a/pkgs/development/python-modules/python-datemath/default.nix
+++ b/pkgs/development/python-modules/python-datemath/default.nix
@ -2,9 +2,9 @@
 , arrow
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pythonOlder
 , pytestCheckHook
-, unittest2
 }:

 buildPythonPackage rec {
@ -21,13 +21,20 @@ buildPythonPackage rec {
    sha256 = "sha256-WVWGhyBguE1+KEMQu0N5QxO7IC4rPEJ/2L3VWUCQNi4=";
  };

+  patches = [
+    (fetchpatch {
+      name = "remove-unittest2.patch";
+      url = "https://github.com/nickmaccarthy/python-datemath/commit/781daa0241ed327d5f211f3b62f553f3ee3d86e0.patch";
+      hash = "sha256-WD6fuDaSSNXgYWoaUexiWnofCzEZzercEUlqTvOUT5I=";
+    })
+  ];
+
  propagatedBuildInputs = [
    arrow
  ];

  checkInputs = [
    pytestCheckHook
-    unittest2
  ];

  pytestFlagsArray = [
--- a/pkgs/development/python-modules/unicode-slugify/default.nix
+++ b/pkgs/development/python-modules/unicode-slugify/default.nix
@ -3,8 +3,8 @@
 , fetchPypi
 , nose
 , six
-, unittest2
 , unidecode
+, unittestCheckHook
 }:

 buildPythonPackage rec {
@ -18,7 +18,10 @@ buildPythonPackage rec {

  propagatedBuildInputs = [ six unidecode ];

-  checkInputs = [ nose unittest2 ];
+  checkInputs = [
+    nose
+    unittestCheckHook
+  ];

  meta = with lib; {
    description = "Generates unicode slugs";
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.0.432";
+  version = "0.0.433";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    sha256 = "sha256-nBBvhl5Ls/zKSLFzatCl61Wa1eXDHLwED+Q6o4xMJ5c=";
+    sha256 = "sha256-1dGsCUMa4FFS88sEH8WJdm6KB40lYe5MnjklAwAtyzs=";
  };

  vendorSha256 = "sha256-8Vf9JRahGkp8/5D5oDt0fnbeeLAD0q656XWdUDtceq8=";
--- a/pkgs/games/hexgui/default.nix
+++ b/pkgs/games/hexgui/default.nix
@ -0,0 +1,36 @@
+{ ant
+, fetchFromGitHub
+, jdk
+, lib
+, makeWrapper
+, stdenv
+}:
+stdenv.mkDerivation {
+  pname = "hexgui";
+  version = "unstable-2022-5-30";
+
+  src = fetchFromGitHub {
+    owner = "selinger";
+    repo = "hexgui";
+    rev = "d94ce1d35a22dad28d3e7def4d28e6bebd54da9d";
+    hash = "sha256-1MroFH2JSEZHFigcsw1+xyHJWEnHTvHmRPVirUgwM6I=";
+  };
+
+  nativeBuildInputs = [ ant jdk makeWrapper ];
+  buildPhase = ''
+    ant
+  '';
+
+  installPhase = ''
+    mkdir $out
+    mv bin lib $out
+    wrapProgram $out/bin/hexgui --prefix PATH : ${lib.makeBinPath [ jdk ]}
+  '';
+
+  meta = {
+    description = "GUI for the board game Hex (and Y)";
+    homepage = "https://github.com/selinger/hexgui";
+    license = lib.licenses.gpl3;
+    maintainers = [ lib.maintainers.ursi ];
+  };
+}
--- a/pkgs/games/itch/default.nix
+++ b/pkgs/games/itch/default.nix
@ -41,7 +41,7 @@ stdenvNoCC.mkDerivation rec {
        repo = pname;
        rev = "v${version}";
        hash = "sha256-DZBmf8fe0zw5uiQjNKXw8g/vU2hjNDa87z/7XuhyXog=";
-        inherit sparseCheckout;
+        sparseCheckout = [ sparseCheckout ];
      } + sparseCheckout;

  nativeBuildInputs = [ copyDesktopItems makeWrapper ];
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, gnutls, liburcu, lmdb, libcap_ng, libidn2, libunistring
+{ lib, stdenv, fetchurl, pkg-config, gnutls, liburcu, lmdb, libcap_ng, libidn2, libunistring
 , systemd, nettle, libedit, zlib, libiconv, libintl, libmaxminddb, libbpf, nghttp2, libmnl
 , ngtcp2-gnutls
 , autoreconfHook
@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "knot-dns";
-  version = "3.2.2";
+  version = "3.2.3";

  src = fetchurl {
    url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "cea9c1988cdce7752f88fbe37378f65e83c4e54048978b94fb21a9c92f88788f";
+    sha256 = "f736ef284358923e312f8e1e3c6ce7c97b20965b09eb65705e9f7e3d5e9a9d79";
  };

  outputs = [ "bin" "out" "dev" ];
@ -27,11 +27,6 @@ stdenv.mkDerivation rec {
    # They are later created from NixOS itself.
    ./dont-create-run-time-dirs.patch
    ./runtime-deps.patch
-    # knsupdate: fix segfault due to NULL pointer access when sending an update
-    (fetchpatch {
-      url = "https://gitlab.nic.cz/knot/knot-dns/-/commit/8a6645dab63d8fa7932c7d8f747fe33e8cc97e84.patch";
-      hash = "sha256-qzhSdRH5GqHqN9eLMWbDXmjO4JagsMRSZh3NWRFprao=";
-    })
  ];

  nativeBuildInputs = [ pkg-config autoreconfHook ];
--- a/pkgs/servers/grocy/default.nix
+++ b/pkgs/servers/grocy/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "grocy";
-  version = "3.3.1";
+  version = "3.3.2";

  src = fetchurl {
    url = "https://github.com/grocy/grocy/releases/download/v${version}/grocy_${version}.zip";
-    sha256 = "sha256-XqjYDha9wwfITEDRZsnH/ig+9q1/SfKIwQYg1svUaXM=";
+    sha256 = "sha256-KF4zxrC8rlRUaBKc4iLIt6TSAHMJ+tOWptMsVcixVWs=";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/servers/mail/pypolicyd-spf/default.nix
+++ b/pkgs/servers/mail/pypolicyd-spf/default.nix
@ -1,26 +0,0 @@
-{ lib, buildPythonApplication, fetchurl, pyspf }:
-
-buildPythonApplication rec {
-  pname = "pypolicyd-spf";
-  majorVersion = "2.0";
-  version = "${majorVersion}.2";
-
-  src = fetchurl {
-    url = "https://launchpad.net/pypolicyd-spf/${majorVersion}/${version}/+download/${pname}-${version}.tar.gz";
-    sha256 = "1nm8y1jjgx6mxrbcxrbdnmkf8vglwp0wiw6jipzh641wb24gi76z";
-  };
-
-  propagatedBuildInputs = [ pyspf ];
-
-  preBuild = ''
-    substituteInPlace setup.py --replace "'/etc'" "'$out/etc'"
-  '';
-
-  meta = with lib; {
-    homepage = "https://launchpad.net/pypolicyd-spf/";
-    description = "Postfix policy engine for Sender Policy Framework (SPF) checking";
-    maintainers = with maintainers; [ abbradar ];
-    license = licenses.asl20;
-    platforms = platforms.all;
-  };
-}
--- a/pkgs/servers/mail/spf-engine/default.nix
+++ b/pkgs/servers/mail/spf-engine/default.nix
@ -0,0 +1,30 @@
+{ lib, buildPythonApplication, fetchurl, pyspf, dnspython, authres, pymilter }:
+
+buildPythonApplication rec {
+  pname = "spf-engine";
+  version = "2.9.3";
+
+  src = fetchurl {
+    url = "https://launchpad.net/${pname}/${lib.versions.majorMinor version}/${version}/+download/${pname}-${version}.tar.gz";
+    sha256 = "sha256-w0Nb+L/Os3KPApENoylxCVaCD4FvgmvpfVvwCkt2IDE=";
+  };
+
+  propagatedBuildInputs = [ pyspf dnspython authres pymilter ];
+
+  pythonImportsCheck = [
+    "spf_engine"
+    "spf_engine.milter_spf"
+    "spf_engine.policyd_spf"
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py --replace "'/etc'" "'$out/etc'"
+  '';
+
+  meta = with lib; {
+    homepage = "https://launchpad.net/spf-engine/";
+    description = "Postfix policy engine for Sender Policy Framework (SPF) checking";
+    maintainers = with maintainers; [ abbradar ];
+    license = licenses.asl20;
+  };
+}
--- a/pkgs/servers/mautrix-whatsapp/default.nix
+++ b/pkgs/servers/mautrix-whatsapp/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "mautrix-whatsapp";
-  version = "0.7.1";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "mautrix";
    repo = "whatsapp";
    rev = "v${version}";
-    hash = "sha256-5wZtWFB5y695S4E1Cv8nTSPUy6rPQ/j91w6kI0DAkGs=";
+    hash = "sha256-KeuAxrp4DYy0+K1XYF3FxindYoOHHfwtufwKnic46i8=";
  };

  buildInputs = [ olm ];

-  vendorSha256 = "sha256-v2Zf9nmAzal/nAtbQLunGJR/CUcdbwSUQ1077e7hVrQ=";
+  vendorSha256 = "sha256-oxRxGxYvpO1TeEBAKO1RDwqw4NUSW4XunGdVB6zXjx8=";

  doCheck = false;

--- a/pkgs/servers/nfs-ganesha/default.nix
+++ b/pkgs/servers/nfs-ganesha/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "nfs-ganesha";
-  version = "4.0.12";
+  version = "4.1";

  src = fetchFromGitHub {
    owner = "nfs-ganesha";
    repo = "nfs-ganesha";
    rev = "V${version}";
-    sha256 = "sha256-s6iZcZObBEHvIqyD0niNzuPJf4ENZGw3mhgZZZdj2zc=";
+    sha256 = "sha256-M7lQkO36I4Cwxs49XdxsUVVI2/Nz7fhU36j9fxUuMfM=";
  };

  preConfigure = "cd src";
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "tailscale";
-  version = "1.32.2";
+  version = "1.32.3";

  src = fetchFromGitHub {
    owner = "tailscale";
    repo = "tailscale";
    rev = "v${version}";
-    sha256 = "sha256-CYNHD6TS9KTRftzSn9vAH4QlinqNgU/yZuUYxSvsl/M=";
+    sha256 = "sha256-mM9+qumB7pbP1LIN3ZJRNYHywwASKL4jmsmz5jQGRtg=";
  };
  vendorSha256 = "sha256-VW6FvbgLcokVGunTCHUXKuH5+O6T55hGIP2g5kFfBsE=";

--- a/pkgs/servers/web-apps/outline/default.nix
+++ b/pkgs/servers/web-apps/outline/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "outline";
-  version = "0.66.3";
+  version = "0.67.0";

  src = fetchFromGitHub {
    owner = "outline";
    repo = "outline";
    rev = "v${version}";
-    sha256 = "sha256-2o5rRVOd+dvJOzQFGuuA0PZmmK/wnItcNu8WX9WShQ8=";
+    sha256 = "l7EJkmH/ctP8P937bV5gUqmeKeuH2mjby7Mj/USaCcA=";
  };

  nativeBuildInputs = [ makeWrapper yarn2nix-moretea.fixup_yarn_lock ];
--- a/pkgs/servers/web-apps/outline/yarn.lock
+++ b/pkgs/servers/web-apps/outline/yarn.lock
--- a/pkgs/servers/web-apps/outline/yarn.nix
+++ b/pkgs/servers/web-apps/outline/yarn.nix
--- a/pkgs/servers/web-apps/wiki-js/default.nix
+++ b/pkgs/servers/web-apps/wiki-js/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "wiki-js";
-  version = "2.5.291";
+  version = "2.5.292";

  src = fetchurl {
    url = "https://github.com/Requarks/wiki/releases/download/v${version}/${pname}.tar.gz";
-    sha256 = "sha256-6calNW0IVjL484BssHAu+QwVUdQ7dTvcoSgk8jqckwk=";
+    sha256 = "sha256-45s/XvZx6WvxsxazwLpYjg6vlC07mBBxv6xNThpPFFA=";
  };

  sourceRoot = ".";
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@ -4,6 +4,8 @@
 , less
 , fetchFromGitHub
 , nix-update-script
+, testers
+, awscli2
 }:

 let
@ -32,14 +34,14 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
  pname = "awscli2";
-  version = "2.8.12"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.9.0"; # N.B: if you change this, check if overrides are still up-to-date
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cli";
    rev = version;
-    sha256 = "sha256-OeOSSB0WgVJEszmkXmMkmJNq37sPID7HFaTbXkBUwlI=";
+    sha256 = "sha256-kPMoGOn6ws4DjA9fR9gci7vHPIqOSsgMXa1wCiwN8yU=";
  };

  nativeBuildInputs = [
@ -121,6 +123,11 @@ with py.pkgs; buildPythonApplication rec {
    updateScript = nix-update-script {
      attrPath = pname;
    };
+    tests.version = testers.testVersion {
+      package = awscli2;
+      command = "aws --version";
+      version = version;
+    };
  };

  meta = with lib; {
@ -129,5 +136,6 @@ with py.pkgs; buildPythonApplication rec {
    description = "Unified tool to manage your AWS services";
    license = licenses.asl20;
    maintainers = with maintainers; [ bhipple davegallant bryanasdev000 devusb anthonyroussel ];
+    mainProgram = "aws";
  };
 }
--- a/pkgs/tools/audio/beets/common.nix
+++ b/pkgs/tools/audio/beets/common.nix
@ -6,6 +6,7 @@
 , gst_all_1
 , lib
 , python3Packages
+, sphinxHook
 , runtimeShell
 , writeScript

@ -70,6 +71,7 @@ python3Packages.buildPythonApplication rec {
  # see: https://github.com/NixOS/nixpkgs/issues/56943#issuecomment-1131643663
  nativeBuildInputs = [
    gobject-introspection
+    sphinxHook
  ];

  buildInputs = [
@ -79,6 +81,9 @@ python3Packages.buildPythonApplication rec {
    gst-plugins-ugly
  ]);

+  outputs = [ "out" "doc" "man" ];
+  sphinxBuilders = [ "html" "man" ];
+
  postInstall = ''
    mkdir -p $out/share/zsh/site-functions
    cp extra/_beet $out/share/zsh/site-functions/
--- a/pkgs/tools/backup/dar/default.nix
+++ b/pkgs/tools/backup/dar/default.nix
@ -1,13 +1,20 @@
-{ lib, stdenv, fetchurl
+{ lib, gccStdenv, fetchurl
 , which
 , attr, e2fsprogs
 , curl, libargon2, librsync, libthreadar
 , gpgme, libgcrypt, openssl
 , bzip2, lz4, lzo, xz, zlib
+, CoreFoundation
 }:

 with lib;

+let
+  # Fails to build with clang on Darwin:
+  # error: exception specification of overriding function is more lax than base version
+  stdenv = gccStdenv;
+in
+
 stdenv.mkDerivation rec {
  version = "2.7.7";
  pname = "dar";
@ -25,7 +32,12 @@ stdenv.mkDerivation rec {
    curl librsync libthreadar
    gpgme libargon2 libgcrypt openssl
    bzip2 lz4 lzo xz zlib
-  ] ++ optionals stdenv.isLinux [ attr e2fsprogs ];
+  ] ++ optionals stdenv.isLinux [
+    attr
+    e2fsprogs
+  ] ++ optionals stdenv.isDarwin [
+    CoreFoundation
+  ];

  configureFlags = [
    "--disable-birthtime"
@ -45,7 +57,6 @@ stdenv.mkDerivation rec {
  hardeningDisable = [ "format" ];

  meta = {
-    broken = stdenv.isDarwin;
    homepage = "http://dar.linux.free.fr";
    description = "Disk ARchiver, allows backing up files into indexed archives";
    maintainers = with maintainers; [ izorkin ];
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "goreleaser";
-  version = "1.12.3";
+  version = "1.13.0";

  src = fetchFromGitHub {
    owner = "goreleaser";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-64oivUXAPP0Wo4CYt82Xs/yVhvuiyWVEurZrporCyJw=";
+    sha256 = "sha256-sgYTWiiFsrr+1c3C5GFpwSiGHfYizbjBTcj0JDuZXkE=";
  };

-  vendorSha256 = "sha256-DJwHLitsyHJmZ8FhVAoLTI6HwoHPFAAv8RYmhMwh1Bg=";
+  vendorSha256 = "sha256-UpQ2yFprWdwE67MR5voPjgY7wqrtw/ZQbt05Tbo50XY=";

  ldflags = [
    "-s"
--- a/pkgs/tools/text/xpaste/default.nix
+++ b/pkgs/tools/text/xpaste/default.nix
@ -0,0 +1,41 @@
+{ lib
+, fetchFromGitHub
+, python3Packages
+, fetchpatch
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "xpaste";
+  version = "1.5";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "ossobv";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Z9YxhVP+FUvWET91ob4SPSW+XX7/wzlgPr53vO517L4=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    xlib
+  ];
+
+  patches = [
+    (fetchpatch {
+      # https://github.com/ossobv/xpaste/pull/6
+      name = "fix-function-call-after-wayland-update.patch";
+      url = "https://github.com/ossobv/xpaste/commit/47412738dad4b5fc8bc287ead23c8440bfdc547d.patch";
+      hash = "sha256-t4LZG600AsFTtKjXCxioGcAP4YcHIdQ/fVMIYjsunuA=";
+    })
+  ];
+
+  # no tests, no python module to import, no version output to check
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Paste text into X windows that don't work with selections";
+    homepage = "https://github.com/ossobv/xpaste";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ gador ];
+  };
+}
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -676,8 +676,10 @@ mapAliases ({
  # Julia
  julia_07 = throw "julia_07 has been deprecated in favor of the latest LTS version"; # Added 2020-09-15
  julia_1 = throw "julia_1 has been deprecated in favor of julia_10 as it was ambiguous"; # Added 2021-03-13
+  julia_10 = throw "julia_10 has been deprecated in favor of the latest stable version"; # Added 2022-11-15
  julia_11 = throw "julia_11 has been deprecated in favor of the latest stable version"; # Added 2020-09-15
  julia_13 = throw "julia_13 has been deprecated in favor of the latest stable version"; # Added 2021-03-13
+  julia_15 = throw "julia_15 has been deprecated in favor of the latest stable version"; # Added 2022-11-15
  julia_10-bin = throw "julia_10-bin has been deprecated in favor of the latest LTS version"; # Added 2021-12-02
  julia_17-bin = throw "julia_17-bin has been deprecated in favor of the latest stable version"; # Added 2022-09-04

@ -1233,6 +1235,7 @@ mapAliases ({
  pyload = throw "pyload has been removed from nixpkgs, as it was unmaintained"; # Added 2021-03-21
  pynagsystemd = throw "pynagsystemd was removed as it was unmaintained and incompatible with recent systemd versions. Instead use its fork check_systemd"; # Added 2020-10-24
  pyo3-pack = maturin;
+  pypolicyd-spf = spf-engine; # Added 2022-10-09
  pyrex = throw "pyrex has been removed from nixpkgs as the project is still stuck on python2"; # Added 2022-01-12
  pyrex095 = throw "pyrex has been removed from nixpkgs as the project is still stuck on python2"; # Added 2022-01-12
  pyrex096 = throw "pyrex has been removed from nixpkgs as the project is still stuck on python2"; # Added 2022-01-12
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1479,6 +1479,8 @@ with pkgs;

  xcd = callPackage ../tools/misc/xcd { };

+  xpaste = callPackage ../tools/text/xpaste { };
+
  xrootd = callPackage ../tools/networking/xrootd { };

  xtrt = callPackage ../tools/archivers/xtrt { };
@ -5778,7 +5780,9 @@ with pkgs;

  daq = callPackage ../applications/networking/ids/daq { };

-  dar = callPackage ../tools/backup/dar { };
+  dar = callPackage ../tools/backup/dar {
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation;
+  };

  darkhttpd = callPackage ../servers/http/darkhttpd { };

@ -7807,6 +7811,8 @@ with pkgs;
  hexd = callPackage ../tools/misc/hexd { };
  pixd = callPackage ../tools/misc/pixd { };

+  hexgui = callPackage ../games/hexgui { };
+
  hey = callPackage ../tools/networking/hey { };

  hhpc = callPackage ../tools/misc/hhpc { };
@ -8339,6 +8345,8 @@ with pkgs;

  keepkey_agent = with python3Packages; toPythonApplication keepkey_agent;

+  keepmenu = callPackage ../applications/misc/keepmenu { };
+
  kent = callPackage ../applications/science/biology/kent { };

  keybase = callPackage ../tools/security/keybase {
@ -14519,31 +14527,8 @@ with pkgs;

  juniper = callPackage ../development/compilers/juniper { };

-  julia_10 = callPackage ../development/compilers/julia/1.0.nix {
-    gmp = gmp6;
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices CoreServices;
-    libgit2 = libgit2.overrideAttrs (_: rec {
-      version = "0.27.10";
-      src = fetchFromGitHub {
-        owner = "libgit2";
-        repo = "libgit2";
-        rev = "v${version}";
-        sha256 = "09jz2fzv0zl5058s0g1cpnw87a2rgg8wnjwlygi18i2n9nn6m0ad";
-      };
-      patches = [];
-      meta.knownVulnerabilities = [
-        "CVE-2020-12278"
-        "CVE-2020-12279"
-      ];
-    });
-  };
-
-  julia_15 = callPackage ../development/compilers/julia/1.5.nix {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices CoreServices;
-  };
-
-  julia-lts = julia_10;
-  julia-stable = julia_15;
+  julia-lts = julia_16-bin;
+  julia-stable = julia_18;
  julia = julia-stable;

  julia_16-bin = callPackage ../development/compilers/julia/1.6-bin.nix { };
@ -24404,7 +24389,7 @@ with pkgs;

  pure-ftpd = callPackage ../servers/ftp/pure-ftpd { };

-  pypolicyd-spf = python3.pkgs.callPackage ../servers/mail/pypolicyd-spf { };
+  spf-engine = python3.pkgs.callPackage ../servers/mail/spf-engine { };

  pypiserver = with python3Packages; toPythonApplication pypiserver;

@ -27619,7 +27604,7 @@ with pkgs;
  bonzomatic = callPackage ../applications/editors/bonzomatic { };

  bottles = callPackage ../applications/misc/bottles {
-    wine = wineWowPackages.minimal;
+    wine = null;
  };

  brave = callPackage ../applications/networking/browsers/brave { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -3560,6 +3560,8 @@ self: super: with self; {

  fuzzywuzzy = callPackage ../development/python-modules/fuzzywuzzy { };

+  fvs = callPackage ../development/python-modules/fvs { };
+
  fx2 = callPackage ../development/python-modules/fx2 { };

  g2pkk = callPackage ../development/python-modules/g2pkk { };
@ -4153,6 +4155,8 @@ self: super: with self; {

  heapdict = callPackage ../development/python-modules/heapdict { };

+  heatshrink2 = callPackage ../development/python-modules/heatshrink2 { };
+
  heatzypy = callPackage ../development/python-modules/heatzypy { };

  helpdev = callPackage ../development/python-modules/helpdev { };
@ -4403,6 +4407,8 @@ self: super: with self; {

  idasen = callPackage ../development/python-modules/idasen { };

+  icoextract = callPackage ../development/python-modules/icoextract { };
+
  icontract = callPackage ../development/python-modules/icontract { };

  identify = callPackage ../development/python-modules/identify { };
@ -8142,6 +8148,8 @@ self: super: with self; {

  pymicrobot = callPackage ../development/python-modules/pymicrobot { };

+  pymilter = callPackage ../development/python-modules/pymilter { };
+
  pymitv = callPackage ../development/python-modules/pymitv { };

  pymfy = callPackage ../development/python-modules/pymfy { };
 @ -1 +1 @@
 .11
 .05