Merge master into staging-next

2024-11-24 16:03:23 +00:00 · 2023-05-26 18:01:05 +00:00 · 2023-05-26 18:01:05 +00:00 · 73ddcacb58
commit 73ddcacb58
parent a2cd4a67fd d8a74c29c9
55 changed files with 12979 additions and 555 deletions
--- a/doc/languages-frameworks/cuda.section.md
+++ b/doc/languages-frameworks/cuda.section.md
@ -8,7 +8,7 @@ A package set is available for each CUDA version, so for example
 `cudaPackages_11_6`. Within each set is a matching version of the above listed
 packages. Additionally, other versions of the packages that are packaged and
 compatible are available as well. For example, there can be a
-`cudaPackages.cudnn_8_3_2` package.
+`cudaPackages.cudnn_8_3` package.

 To use one or more CUDA packages in an expression, give the expression a `cudaPackages` parameter, and in case CUDA is optional
 ```nix
@ -28,7 +28,7 @@ set.
 ```nix
 mypkg = let
  cudaPackages = cudaPackages_11_5.overrideScope' (final: prev: {
-    cudnn = prev.cudnn_8_3_2;
+    cudnn = prev.cudnn_8_3;
  }});
 in callPackage { inherit cudaPackages; };
 ```
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1857,6 +1857,12 @@
    githubId = 11135;
    name = "Berk D. Demir";
  };
+  bddvlpr = {
+    email = "luna@bddvlpr.com";
+    github = "bddvlpr";
+    githubId = 17461028;
+    name = "Luna Simons";
+  };
  bdesham = {
    email = "benjamin@esham.io";
    github = "bdesham";
@ -17353,10 +17359,10 @@
  };
  yayayayaka = {
    email = "nixpkgs@uwu.is";
-    matrix = "@lara:uwu.is";
+    matrix = "@yaya:uwu.is";
    github = "yayayayaka";
    githubId = 73759599;
-    name = "Lara A.";
+    name = "Yaya";
  };
  ydlr = {
    name = "ydlr";
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -16,4 +16,4 @@

 ## Other Notable Changes {#sec-release-23.11-notable-changes}

- Create the first release note entry in this section!
+- A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.
--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@ -12,7 +12,9 @@ let
  };


-  vlans = map (m: m.virtualisation.vlans) (lib.attrValues config.nodes);
+  vlans = map (m: (
+    m.virtualisation.vlans ++
+    (lib.mapAttrsToList (_: v: v.vlan) m.virtualisation.interfaces))) (lib.attrValues config.nodes);
  vms = map (m: m.system.build.vm) (lib.attrValues config.nodes);

  nodeHostNames =
--- a/nixos/lib/testing/network.nix
+++ b/nixos/lib/testing/network.nix
@ -4,7 +4,7 @@ let
  inherit (lib)
    attrNames concatMap concatMapStrings flip forEach head
    listToAttrs mkDefault mkOption nameValuePair optionalString
-    range types zipListsWith zipLists
+    range toLower types zipListsWith zipLists
    mdDoc
    ;

@ -18,24 +18,41 @@ let

  networkModule = { config, nodes, pkgs, ... }:
    let
-      interfacesNumbered = zipLists config.virtualisation.vlans (range 1 255);
-      interfaces = forEach interfacesNumbered ({ fst, snd }:
-        nameValuePair "eth${toString snd}" {
-          ipv4.addresses =
-            [{
-              address = "192.168.${toString fst}.${toString config.virtualisation.test.nodeNumber}";
+      qemu-common = import ../qemu-common.nix { inherit lib pkgs; };
+
+      # Convert legacy VLANs to named interfaces and merge with explicit interfaces.
+      vlansNumbered = forEach (zipLists config.virtualisation.vlans (range 1 255)) (v: {
+        name = "eth${toString v.snd}";
+        vlan = v.fst;
+        assignIP = true;
+      });
+      explicitInterfaces = lib.mapAttrsToList (n: v: v // { name = n; }) config.virtualisation.interfaces;
+      interfaces = vlansNumbered ++ explicitInterfaces;
+      interfacesNumbered = zipLists interfaces (range 1 255);
+
+      # Automatically assign IP addresses to requested interfaces.
+      assignIPs = lib.filter (i: i.assignIP) interfaces;
+      ipInterfaces = forEach assignIPs (i:
+        nameValuePair i.name { ipv4.addresses =
+          [ { address = "192.168.${toString i.vlan}.${toString config.virtualisation.test.nodeNumber}";
              prefixLength = 24;
            }];
        });

+      qemuOptions = lib.flatten (forEach interfacesNumbered ({ fst, snd }:
+        qemu-common.qemuNICFlags snd fst.vlan config.virtualisation.test.nodeNumber));
+      udevRules = forEach interfacesNumbered ({ fst, snd }:
+        # MAC Addresses for QEMU network devices are lowercase, and udev string comparison is case-sensitive.
+        ''SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="${toLower(qemu-common.qemuNicMac fst.vlan config.virtualisation.test.nodeNumber)}",NAME="${fst.name}"'');
+
      networkConfig =
        {
          networking.hostName = mkDefault config.virtualisation.test.nodeName;

-          networking.interfaces = listToAttrs interfaces;
+          networking.interfaces = listToAttrs ipInterfaces;

          networking.primaryIPAddress =
-            optionalString (interfaces != [ ]) (head (head interfaces).value.ipv4.addresses).address;
+            optionalString (ipInterfaces != [ ]) (head (head ipInterfaces).value.ipv4.addresses).address;

          # Put the IP addresses of all VMs in this machine's
          # /etc/hosts file.  If a machine has multiple
@ -51,16 +68,13 @@ let
                    "${config.networking.hostName}.${config.networking.domain} " +
                  "${config.networking.hostName}\n"));

-          virtualisation.qemu.options =
-            let qemu-common = import ../qemu-common.nix { inherit lib pkgs; };
-            in
-            flip concatMap interfacesNumbered
-              ({ fst, snd }: qemu-common.qemuNICFlags snd fst config.virtualisation.test.nodeNumber);
+          virtualisation.qemu.options = qemuOptions;
+          boot.initrd.services.udev.rules = concatMapStrings (x: x + "\n") udevRules;
        };

    in
    {
-      key = "ip-address";
+      key = "network-interfaces";
      config = networkConfig // {
        # Expose the networkConfig items for tests like nixops
        # that need to recreate the network config.
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -564,7 +564,8 @@ in
    virtualisation.vlans =
      mkOption {
        type = types.listOf types.ints.unsigned;
-        default = [ 1 ];
+        default = if config.virtualisation.interfaces == {} then [ 1 ] else [ ];
+        defaultText = lib.literalExpression ''if config.virtualisation.interfaces == {} then [ 1 ] else [ ]'';
        example = [ 1 2 ];
        description =
          lib.mdDoc ''
@ -579,6 +580,35 @@ in
          '';
      };

+    virtualisation.interfaces = mkOption {
+      default = {};
+      example = {
+        enp1s0.vlan = 1;
+      };
+      description = lib.mdDoc ''
+        Network interfaces to add to the VM.
+      '';
+      type = with types; attrsOf (submodule {
+        options = {
+          vlan = mkOption {
+            type = types.ints.unsigned;
+            description = lib.mdDoc ''
+              VLAN to which the network interface is connected.
+            '';
+          };
+
+          assignIP = mkOption {
+            type = types.bool;
+            default = false;
+            description = lib.mdDoc ''
+              Automatically assign an IP address to the network interface using the same scheme as
+              virtualisation.vlans.
+            '';
+          };
+        };
+      });
+    };
+
    virtualisation.writableStore =
      mkOption {
        type = types.bool;
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@ -93,18 +93,19 @@ let
      name = "Static";
      nodes.router = router;
      nodes.client = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
          defaultGateway = "192.168.1.1";
          defaultGateway6 = "fd00:1234:5678:1::1";
-          interfaces.eth1.ipv4.addresses = mkOverride 0 [
+          interfaces.enp1s0.ipv4.addresses = [
            { address = "192.168.1.2"; prefixLength = 24; }
            { address = "192.168.1.3"; prefixLength = 32; }
            { address = "192.168.1.10"; prefixLength = 32; }
          ];
-          interfaces.eth2.ipv4.addresses = mkOverride 0 [
+          interfaces.enp2s0.ipv4.addresses = [
            { address = "192.168.2.2"; prefixLength = 24; }
          ];
        };
@ -170,12 +171,12 @@ let
        # Disable test driver default config
        networking.interfaces = lib.mkForce {};
        networking.useNetworkd = networkd;
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
      };
      testScript = ''
        start_all()
        client.wait_for_unit("multi-user.target")
-        client.wait_until_succeeds("ip addr show dev eth1 | grep '192.168.1'")
+        client.wait_until_succeeds("ip addr show dev enp1s0 | grep '192.168.1'")
        client.shell_interact()
        client.succeed("ping -c 1 192.168.1.1")
        router.succeed("ping -c 1 192.168.1.1")
@ -187,20 +188,13 @@ let
      name = "SimpleDHCP";
      nodes.router = router;
      nodes.client = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1 = {
-            ipv4.addresses = mkOverride 0 [ ];
-            ipv6.addresses = mkOverride 0 [ ];
-            useDHCP = true;
-          };
-          interfaces.eth2 = {
-            ipv4.addresses = mkOverride 0 [ ];
-            ipv6.addresses = mkOverride 0 [ ];
-            useDHCP = true;
-          };
+          interfaces.enp1s0.useDHCP = true;
+          interfaces.enp2s0.useDHCP = true;
        };
      };
      testScript = { ... }:
@ -211,10 +205,10 @@ let
          router.wait_for_unit("network-online.target")

          with subtest("Wait until we have an ip address on each interface"):
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q '192.168.1'")
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'")
-              client.wait_until_succeeds("ip addr show dev eth2 | grep -q '192.168.2'")
-              client.wait_until_succeeds("ip addr show dev eth2 | grep -q 'fd00:1234:5678:2:'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q '192.168.1'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q 'fd00:1234:5678:1:'")
+              client.wait_until_succeeds("ip addr show dev enp2s0 | grep -q '192.168.2'")
+              client.wait_until_succeeds("ip addr show dev enp2s0 | grep -q 'fd00:1234:5678:2:'")

          with subtest("Test vlan 1"):
              client.wait_until_succeeds("ping -c 1 192.168.1.1")
@ -243,16 +237,15 @@ let
      name = "OneInterfaceDHCP";
      nodes.router = router;
      nodes.client = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1 = {
-            ipv4.addresses = mkOverride 0 [ ];
+          interfaces.enp1s0 = {
            mtu = 1343;
            useDHCP = true;
          };
-          interfaces.eth2.ipv4.addresses = mkOverride 0 [ ];
        };
      };
      testScript = { ... }:
@ -264,10 +257,10 @@ let
              router.wait_for_unit("network.target")

          with subtest("Wait until we have an ip address on each interface"):
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q '192.168.1'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q '192.168.1'")

          with subtest("ensure MTU is set"):
-              assert "mtu 1343" in client.succeed("ip link show dev eth1")
+              assert "mtu 1343" in client.succeed("ip link show dev enp1s0")

          with subtest("Test vlan 1"):
              client.wait_until_succeeds("ping -c 1 192.168.1.1")
@ -286,16 +279,15 @@ let
    };
    bond = let
      node = address: { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
          bonds.bond0 = {
-            interfaces = [ "eth1" "eth2" ];
+            interfaces = [ "enp1s0" "enp2s0" ];
            driverOptions.mode = "802.3ad";
          };
-          interfaces.eth1.ipv4.addresses = mkOverride 0 [ ];
-          interfaces.eth2.ipv4.addresses = mkOverride 0 [ ];
          interfaces.bond0.ipv4.addresses = mkOverride 0
            [ { inherit address; prefixLength = 30; } ];
        };
@ -326,12 +318,11 @@ let
    };
    bridge = let
      node = { address, vlan }: { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ vlan ];
+        virtualisation.interfaces.enp1s0.vlan = vlan;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1.ipv4.addresses = mkOverride 0
-            [ { inherit address; prefixLength = 24; } ];
+          interfaces.enp1s0.ipv4.addresses = [ { inherit address; prefixLength = 24; } ];
        };
      };
    in {
@ -339,11 +330,12 @@ let
      nodes.client1 = node { address = "192.168.1.2"; vlan = 1; };
      nodes.client2 = node { address = "192.168.1.3"; vlan = 2; };
      nodes.router = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          bridges.bridge.interfaces = [ "eth1" "eth2" ];
+          bridges.bridge.interfaces = [ "enp1s0" "enp2s0" ];
          interfaces.eth1.ipv4.addresses = mkOverride 0 [ ];
          interfaces.eth2.ipv4.addresses = mkOverride 0 [ ];
          interfaces.bridge.ipv4.addresses = mkOverride 0
@ -377,7 +369,7 @@ let
      nodes.router = router;
      nodes.client = { pkgs, ... }: with pkgs.lib; {
        environment.systemPackages = [ pkgs.iptables ]; # to debug firewall rules
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
@ -385,14 +377,9 @@ let
          # reverse path filtering rules for the macvlan interface seem
          # to be incorrect, causing the test to fail. Disable temporarily.
          firewall.checkReversePath = false;
-          macvlans.macvlan.interface = "eth1";
-          interfaces.eth1 = {
-            ipv4.addresses = mkOverride 0 [ ];
-            useDHCP = true;
-          };
-          interfaces.macvlan = {
-            useDHCP = true;
-          };
+          macvlans.macvlan.interface = "enp1s0";
+          interfaces.enp1s0.useDHCP = true;
+          interfaces.macvlan.useDHCP = true;
        };
      };
      testScript = { ... }:
@ -404,7 +391,7 @@ let
              router.wait_for_unit("network.target")

          with subtest("Wait until we have an ip address on each interface"):
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q '192.168.1'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q '192.168.1'")
              client.wait_until_succeeds("ip addr show dev macvlan | grep -q '192.168.1'")

          with subtest("Print lots of diagnostic information"):
@ -431,23 +418,22 @@ let
    fou = {
      name = "foo-over-udp";
      nodes.machine = { ... }: {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1.ipv4.addresses = mkOverride 0
-            [ { address = "192.168.1.1"; prefixLength = 24; } ];
+          interfaces.enp1s0.ipv4.addresses = [ { address = "192.168.1.1"; prefixLength = 24; } ];
          fooOverUDP = {
            fou1 = { port = 9001; };
            fou2 = { port = 9002; protocol = 41; };
            fou3 = mkIf (!networkd)
              { port = 9003; local.address = "192.168.1.1"; };
            fou4 = mkIf (!networkd)
-              { port = 9004; local = { address = "192.168.1.1"; dev = "eth1"; }; };
+              { port = 9004; local = { address = "192.168.1.1"; dev = "enp1s0"; }; };
          };
        };
        systemd.services = {
-          fou3-fou-encap.after = optional (!networkd) "network-addresses-eth1.service";
+          fou3-fou-encap.after = optional (!networkd) "network-addresses-enp1s0.service";
        };
      };
      testScript = { ... }:
@ -470,22 +456,22 @@ let
              "gue": None,
              "family": "inet",
              "local": "192.168.1.1",
-              "dev": "eth1",
+              "dev": "enp1s0",
          } in fous, "fou4 exists"
        '';
    };
    sit = let
      node = { address4, remote, address6 }: { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
          sits.sit = {
            inherit remote;
            local = address4;
-            dev = "eth1";
+            dev = "enp1s0";
          };
-          interfaces.eth1.ipv4.addresses = mkOverride 0
+          interfaces.enp1s0.ipv4.addresses = mkOverride 0
            [ { address = address4; prefixLength = 24; } ];
          interfaces.sit.ipv6.addresses = mkOverride 0
            [ { address = address6; prefixLength = 64; } ];
@ -685,10 +671,10 @@ let
    vlan-ping = let
        baseIP = number: "10.10.10.${number}";
        vlanIP = number: "10.1.1.${number}";
-        baseInterface = "eth1";
+        baseInterface = "enp1s0";
        vlanInterface = "vlan42";
        node = number: {pkgs, ... }: with pkgs.lib; {
-          virtualisation.vlans = [ 1 ];
+          virtualisation.interfaces.enp1s0.vlan = 1;
          networking = {
            #useNetworkd = networkd;
            useDHCP = false;
@ -785,12 +771,12 @@ let
    privacy = {
      name = "Privacy";
      nodes.router = { ... }: {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
        boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1.ipv6.addresses = singleton {
+          interfaces.enp1s0.ipv6.addresses = singleton {
            address = "fd00:1234:5678:1::1";
            prefixLength = 64;
          };
@ -798,7 +784,7 @@ let
        services.radvd = {
          enable = true;
          config = ''
-            interface eth1 {
+            interface enp1s0 {
              AdvSendAdvert on;
              AdvManagedFlag on;
              AdvOtherConfigFlag on;
@ -812,11 +798,11 @@ let
        };
      };
      nodes.client_with_privacy = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1 = {
+          interfaces.enp1s0 = {
            tempAddress = "default";
            ipv4.addresses = mkOverride 0 [ ];
            ipv6.addresses = mkOverride 0 [ ];
@ -825,11 +811,11 @@ let
        };
      };
      nodes.client = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
        networking = {
          useNetworkd = networkd;
          useDHCP = false;
-          interfaces.eth1 = {
+          interfaces.enp1s0 = {
            tempAddress = "enabled";
            ipv4.addresses = mkOverride 0 [ ];
            ipv6.addresses = mkOverride 0 [ ];
@ -847,9 +833,9 @@ let

          with subtest("Wait until we have an ip address"):
              client_with_privacy.wait_until_succeeds(
-                  "ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'"
+                  "ip addr show dev enp1s0 | grep -q 'fd00:1234:5678:1:'"
              )
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q 'fd00:1234:5678:1:'")

          with subtest("Test vlan 1"):
              client_with_privacy.wait_until_succeeds("ping -c 1 fd00:1234:5678:1::1")
@ -947,7 +933,7 @@ let
            ), "The IPv6 routing table has not been properly cleaned:\n{}".format(ipv6Residue)
      '';
    };
-    rename = {
+    rename = if networkd then {
      name = "RenameInterface";
      nodes.machine = { pkgs, ... }: {
        virtualisation.vlans = [ 1 ];
@ -955,23 +941,20 @@ let
          useNetworkd = networkd;
          useDHCP = false;
        };
-      } //
-      (if networkd
-       then { systemd.network.links."10-custom_name" = {
-                matchConfig.MACAddress = "52:54:00:12:01:01";
-                linkConfig.Name = "custom_name";
-              };
-            }
-       else { boot.initrd.services.udev.rules = ''
-               SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="52:54:00:12:01:01", KERNEL=="eth*", NAME="custom_name"
-              '';
-            });
+        systemd.network.links."10-custom_name" = {
+          matchConfig.MACAddress = "52:54:00:12:01:01";
+          linkConfig.Name = "custom_name";
+        };
+      };
      testScript = ''
        machine.succeed("udevadm settle")
        print(machine.succeed("ip link show dev custom_name"))
      '';
-    };
+    } else {
+      name = "RenameInterface";
      nodes = { };
+      testScript = "";
+    };
    # even with disabled networkd, systemd.network.links should work
    # (as it's handled by udev, not networkd)
    link = {
@ -1015,6 +998,21 @@ let
        machine.fail("ip address show wlan0 | grep -q ${testMac}")
      '';
    };
+    caseSensitiveRenaming = {
+      name = "CaseSensitiveRenaming";
+      nodes.machine = { pkgs, ... }: {
+        virtualisation.interfaces.enCustom.vlan = 11;
+        networking = {
+          useNetworkd = networkd;
+          useDHCP = false;
+        };
+      };
+      testScript = ''
+        machine.succeed("udevadm settle")
+        print(machine.succeed("ip link show dev enCustom"))
+        machine.wait_until_succeeds("ip link show dev enCustom | grep -q '52:54:00:12:0b:01")
+      '';
+    };
  };

 in mapAttrs (const (attrs: makeTest (attrs // {
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -126,12 +126,12 @@
  };
  c = buildGrammar {
    language = "c";
-    version = "0.0.0+rev=cac392a";
+    version = "0.0.0+rev=a015709";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-c";
-      rev = "cac392ac3d7d365c469971b117e92a0df3bc8305";
-      hash = "sha256-ck6OEjljRReUl10W6yLu1dxa8ln8n8GMUz01BDj/kFk=";
+      rev = "a015709e7d1bb4f823a2fc53175e0cbee96c1c3e";
+      hash = "sha256-q+jXkhhk46NoKAxVj7fWiUZ2iosW1bRJ0A244Cf4zCA=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-c";
  };
@ -258,12 +258,12 @@
  };
  cuda = buildGrammar {
    language = "cuda";
-    version = "0.0.0+rev=7f6b482";
+    version = "0.0.0+rev=9c20a31";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-cuda";
-      rev = "7f6b48249b8500d506bd424cfa8e4c9d83e17754";
-      hash = "sha256-A9AI3S/wToFvkj0Oe4UQ/B30r1a/tdgqRuObxazZlHs=";
+      rev = "9c20a3120c405db9efda9349cd005c29f2aace3c";
+      hash = "sha256-LOCC9Si6RFlxK3TQrApYjAquuhYFp2empRnZMwVSO30=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-cuda";
  };
@ -1597,12 +1597,12 @@
  };
  scala = buildGrammar {
    language = "scala";
-    version = "0.0.0+rev=78ae129";
+    version = "0.0.0+rev=5aefc0a";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-scala";
-      rev = "78ae129292990224bcae025e7d3f4873a88f772d";
-      hash = "sha256-g9jx06MvdMdAk12dK0yFwTP0gkqsd+efQbPAxD47pnU=";
+      rev = "5aefc0ae4c174fa74d6e973faefa28692e081954";
+      hash = "sha256-3FV3MuOx/sZ6NqeewbKhrhUFfnc1mjWpF3TetAlkkBg=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-scala";
  };
@ -1685,12 +1685,12 @@
  };
  sql = buildGrammar {
    language = "sql";
-    version = "0.0.0+rev=721087c";
+    version = "0.0.0+rev=63a6bad";
    src = fetchFromGitHub {
      owner = "derekstride";
      repo = "tree-sitter-sql";
-      rev = "721087c8819cda10ca37f974e914ab9be46b290f";
-      hash = "sha256-R23co3mAH6ToFzfgnq9PWyX/uu15vbnMAB+dRVB00oI=";
+      rev = "63a6bad6d4ca2192cf252e10db73627414546732";
+      hash = "sha256-M7+uDzqTqUcYAvRBeO9ncaFlRGa5iRBPurnwyjdr9Lw=";
    };
    meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
  };
@ -1774,13 +1774,13 @@
  };
  t32 = buildGrammar {
    language = "t32";
-    version = "0.0.0+rev=c5ab392";
+    version = "0.0.0+rev=b4dca35";
    src = fetchFromGitea {
      domain = "codeberg.org";
      owner = "xasc";
      repo = "tree-sitter-t32";
-      rev = "c5ab392fece192875d2206da487449b856afcdef";
-      hash = "sha256-OalZs7pP00j3qyQv7mwVx1/jnoM91ZbqwEC17iTxZ/4=";
+      rev = "b4dca3527463274de1f3263c0e1c329bc3b4f514";
+      hash = "sha256-qWtlk7r6UmEEsbz6k7eGTv4WdWbcaUn2rUQsQ4SxqJA=";
    };
    meta.homepage = "https://codeberg.org/xasc/tree-sitter-t32";
  };
--- a/pkgs/applications/networking/cluster/kyverno/default.nix
+++ b/pkgs/applications/networking/cluster/kyverno/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kyverno";
-  version = "1.9.3";
+  version = "1.9.4";

  src = fetchFromGitHub {
    owner = "kyverno";
    repo = "kyverno";
    rev = "v${version}";
-    sha256 = "sha256-SiupfSBdk006xSCdQS1peLABZc+LNjMXxL5wr6R+aTc=";
+    sha256 = "sha256-rpqhDnXxbWKa1WB7WBS6Ri7XiPWv3e0evCXFSBcaD6c=";
  };

  ldflags = [
--- a/pkgs/applications/science/math/caffe/default.nix
+++ b/pkgs/applications/science/math/caffe/default.nix
@ -27,7 +27,7 @@ let
  # Earlier versions of cudatoolkit use pre-8.x CUDNN, so we use the default.
  cudnn = if lib.versionOlder cudatoolkit.version "10.1"
    then cudaPackages.cudnn
-    else cudaPackages.cudnn_7_6_5;
+    else cudaPackages.cudnn_7_6;
 in

 assert leveldbSupport -> (leveldb != null && snappy != null);
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@ -230,7 +230,7 @@ rec {


  */
-  writeScriptBin = name: text: writeTextFile {inherit name text; executable = true; destination = "/bin/${name}";};
+  writeScriptBin = name: text: writeTextFile {inherit name text; executable = true; destination = "/bin/${name}"; meta.mainProgram = name;};

  /*
    Similar to writeScript. Writes a Shell script and checks its syntax.
@ -288,6 +288,7 @@ rec {
      checkPhase = ''
        ${stdenv.shellDryRun} "$target"
      '';
+      meta.mainProgram = name;
    };

  /*
--- a/pkgs/development/compilers/cudatoolkit/common.nix
+++ b/pkgs/development/compilers/cudatoolkit/common.nix
@ -291,6 +291,10 @@ backendStdenv.mkDerivation rec {
  '' + lib.optionalString (lib.versionOlder version "8.0") ''
    # Hack to fix building against recent Glibc/GCC.
    echo "NIX_CFLAGS_COMPILE+=' -D_FORCE_INLINES'" >> $out/nix-support/setup-hook
+  ''
+  # 11.8 includes a broken symlink, include/include, pointing to targets/x86_64-linux/include
+  + lib.optionalString (lib.versions.majorMinor version == "11.8") ''
+    rm $out/include/include
  '' + ''
    runHook postInstall
  '';
--- a/pkgs/development/libraries/doctest/default.nix
+++ b/pkgs/development/libraries/doctest/default.nix
@ -2,17 +2,19 @@

 stdenv.mkDerivation rec {
  pname = "doctest";
-  version = "2.4.9";
+  version = "2.4.11";

  src = fetchFromGitHub {
    owner = "doctest";
    repo = "doctest";
    rev = "v${version}";
-    sha256 = "sha256-ugmkeX2PN4xzxAZpWgswl4zd2u125Q/ADSKzqTfnd94=";
+    sha256 = "sha256-hotO6QVpPn8unYTaQHFgi40A3oLUd++I3aTe293e4Aw=";
  };

  nativeBuildInputs = [ cmake ];

+  doCheck = true;
+
  meta = with lib; {
    homepage = "https://github.com/doctest/doctest";
    description = "The fastest feature-rich C++11/14/17/20 single-header testing framework";
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@ -47,6 +47,7 @@ let
          ./patches/0004-qtbase-fix-locating-tzdir-on-NixOS.patch
          ./patches/0005-qtbase-deal-with-a-font-face-at-index-0-as-Regular-f.patch
          ./patches/0006-qtbase-qt-cmake-always-use-cmake-from-path.patch
+          ./patches/0007-qtbase-find-qt-tools-in-QTTOOLSPATH.patch
        ];
      };
      env = callPackage ./qt-env.nix { };
--- a/pkgs/development/libraries/qt-6/hooks/qtbase-setup-hook.sh
+++ b/pkgs/development/libraries/qt-6/hooks/qtbase-setup-hook.sh
@ -49,6 +49,20 @@ else # Only set up Qt once.
    }
    envBuildHostHooks+=(qmakePathHook)

+    export QTTOOLSPATH=
+
+    declare -Ag qttoolsPathSeen=()
+    qtToolsHook() {
+        # Skip this path if we have seen it before.
+        # MUST use 'if' because 'qttoolsPathSeen[$]' may be unset.
+        if [ -n "${qttoolsPathSeen[$1]-}" ]; then return; fi
+        qttoolsPathSeen[$1]=1
+        if [ -d "$1/libexec" ]; then
+            QTTOOLSPATH="${QTTOOLSPATH}${QTTOOLSPATH:+:}$1/libexec"
+        fi
+    }
+    addEnvHooks "$hostOffset" qtToolsHook
+
    postPatchMkspecs() {
        # Prevent this hook from running multiple times
        dontPatchMkspecs=1
--- a/pkgs/development/libraries/qt-6/modules/qtdoc.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdoc.nix
@ -1,9 +1,26 @@
 { qtModule
 , qtdeclarative
+, qtbase
+, qttools
 }:

 qtModule {
  pname = "qtdoc";
+  # avoid fix-qt-builtin-paths hook substitute QT_INSTALL_DOCS to qtdoc's path
+  postPatch = ''
+    for file in $(grep -rl '$QT_INSTALL_DOCS'); do
+      substituteInPlace $file \
+          --replace '$QT_INSTALL_DOCS' "${qtbase}/share/doc"
+    done
+  '';
+  nativeBuildInputs = [ qttools ];
  qtInputs = [ qtdeclarative ];
+  cmakeFlags = [
+    "-DCMAKE_MESSAGE_LOG_LEVEL=STATUS"
+  ];
+  dontUseNinjaBuild = true;
+  buildFlags = [ "docs" ];
+  dontUseNinjaInstall = true;
+  installFlags = [ "install_docs" ];
  outputs = [ "out" ];
 }
--- a/pkgs/development/libraries/qt-6/modules/qttools.nix
+++ b/pkgs/development/libraries/qt-6/modules/qttools.nix
@ -3,12 +3,16 @@
 , lib
 , qtbase
 , qtdeclarative
+, llvmPackages
 , cups
-, substituteAll
 }:

 qtModule {
  pname = "qttools";
+  buildInputs = [
+    llvmPackages.libclang
+    llvmPackages.llvm
+  ];
  qtInputs = [ qtbase qtdeclarative ];
  propagatedBuildInputs = lib.optionals stdenv.isDarwin [ cups ];
  patches = [
--- a/pkgs/development/libraries/qt-6/patches/0007-qtbase-find-qt-tools-in-QTTOOLSPATH.patch
+++ b/pkgs/development/libraries/qt-6/patches/0007-qtbase-find-qt-tools-in-QTTOOLSPATH.patch
@ -0,0 +1,46 @@
+From 31d808a7b0d52a01c3f2875202cd29410a94b39a Mon Sep 17 00:00:00 2001
+From: rewine <luhongxu@deepin.org>
+Date: Wed, 29 Mar 2023 11:51:33 +0800
+Subject: [PATCH] qtbase-find-tools-in-PATH
+
+1. find qt's tools in `QTTOOLSPATH` env
+   qt assumes that all components use the same install prefix
+   we can't get the real prefix for qttools when build qtbase
+   we will add /libexec to `QTTOOLSPATH` in qtToolsHook
+   find_path will also search in 'PATH' by default
+   see `CMAKE_FIND_USE_SYSTEM_ENVIRONMENT_PATH`
+
+2. disable tool_dependencies_enabled
+   We can guarantee the build order of qt components in nixpkgs
+   tools in qttools always build before qtdoc
+   qdoc_bin is not a build target now, since we find it in `QTTOOLSPATH`
+
+---
+ cmake/QtDocsHelpers.cmake | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/cmake/QtDocsHelpers.cmake b/cmake/QtDocsHelpers.cmake
+index 48ed5a32..9409d22d 100644
+--- a/cmake/QtDocsHelpers.cmake
+++ b/cmake/QtDocsHelpers.cmake
+@@ -47,9 +47,14 @@ function(qt_internal_add_docs)
+         set(doc_tools_libexec "${QT_BUILD_INTERNALS_RELOCATABLE_INSTALL_PREFIX}/${INSTALL_LIBEXECDIR}")
+     endif()
+ 
+-    set(qdoc_bin "${doc_tools_bin}/qdoc${CMAKE_EXECUTABLE_SUFFIX}")
+-    set(qtattributionsscanner_bin "${doc_tools_libexec}/qtattributionsscanner${CMAKE_EXECUTABLE_SUFFIX}")
+-    set(qhelpgenerator_bin "${doc_tools_libexec}/qhelpgenerator${CMAKE_EXECUTABLE_SUFFIX}")
+    set(tool_dependencies_enabled FALSE)
+
+    find_path(qdoc_path name qdoc PATHS ENV QTTOOLSPATH)
+    find_path(qtattributionsscanner_path name qtattributionsscanner PATHS ENV QTTOOLSPATH)
+    find_path(qhelpgenerator_path name qhelpgenerator PATHS ENV QTTOOLSPATH)
+    set(qdoc_bin "${qdoc_path}/qdoc${CMAKE_EXECUTABLE_SUFFIX}")
+    set(qtattributionsscanner_bin "${qtattributionsscanner_path}/qtattributionsscanner${CMAKE_EXECUTABLE_SUFFIX}")
+    set(qhelpgenerator_bin "${qhelpgenerator_path}/qhelpgenerator${CMAKE_EXECUTABLE_SUFFIX}")
+ 
+     get_target_property(target_type ${target} TYPE)
+     if (NOT target_type STREQUAL "INTERFACE_LIBRARY")
+-- 
+2.38.1
+
--- a/pkgs/development/libraries/science/math/cudnn/extension.nix
+++ b/pkgs/development/libraries/science/math/cudnn/extension.nix
@ -11,29 +11,23 @@
 final: prev: let
  inherit (final) callPackage;
  inherit (prev) cudaVersion;
-  inherit (prev.lib) attrsets lists versions strings trivial;
-
-  # Utilities
-  # majorMinorPatch :: String -> String
-  majorMinorPatch = (trivial.flip trivial.pipe) [
-    (versions.splitVersion)
-    (lists.take 3)
-    (strings.concatStringsSep ".")
-  ];
+  inherit (prev.lib) attrsets lists versions;
+  inherit (prev.lib.strings) replaceStrings versionAtLeast versionOlder;

  # Compute versioned attribute name to be used in this package set
+  # Patch version changes should not break the build, so we only use major and minor
  # computeName :: String -> String
-  computeName = version: "cudnn_${strings.replaceStrings ["."] ["_"] (majorMinorPatch version)}";
+  computeName = version: "cudnn_${replaceStrings ["."] ["_"] (versions.majorMinor version)}";

  # Check whether a CUDNN release supports our CUDA version
  # Thankfully we're able to do lexicographic comparison on the version strings
  # isSupported :: Release -> Bool
  isSupported = release:
-    strings.versionAtLeast cudaVersion release.minCudaVersion
-    && strings.versionAtLeast release.maxCudaVersion cudaVersion;
+    versionAtLeast cudaVersion release.minCudaVersion
+    && versionAtLeast release.maxCudaVersion cudaVersion;

  # useCudatoolkitRunfile :: Bool
-  useCudatoolkitRunfile = strings.versionOlder cudaVersion "11.3.999";
+  useCudatoolkitRunfile = versionOlder cudaVersion "11.3.999";

  # buildCuDnnPackage :: Release -> Derivation
  buildCuDnnPackage = callPackage ./generic.nix {inherit useCudatoolkitRunfile;};
--- a/pkgs/development/libraries/science/math/cudnn/releases.nix
+++ b/pkgs/development/libraries/science/math/cudnn/releases.nix
@ -155,17 +155,31 @@
    hash = "sha256-l2xMunIzyXrnQAavq1Fyl2MAukD1slCiH4z3H1nJ920=";
  }
  {
-    version = "8.8.0.121";
+    version = "8.8.1.3";
    minCudaVersion = "11.0";
    maxCudaVersion = "11.8";
-    url = "https://developer.download.nvidia.com/compute/cudnn/redist/cudnn/linux-x86_64/cudnn-linux-x86_64-8.8.0.121_cuda11-archive.tar.xz";
-    hash = "sha256-YgRkdgdtG0VfsT+3izjTSWusr7/bsElPszkiQKBEZuo=";
+    url = "https://developer.download.nvidia.com/compute/cudnn/redist/cudnn/linux-x86_64/cudnn-linux-x86_64-8.8.1.3_cuda11-archive.tar.xz";
+    hash = "sha256-r3WEyuDMVSS1kT7wjCm6YVQRPGDrCjegWQqRtRWoqPk=";
  }
  {
-    version = "8.8.0.121";
+    version = "8.8.1.3";
    minCudaVersion = "12.0";
    maxCudaVersion = "12.0";
-    url = "https://developer.download.nvidia.com/compute/cudnn/redist/cudnn/linux-x86_64/cudnn-linux-x86_64-8.8.0.121_cuda12-archive.tar.xz";
-    hash = "sha256-oHkrZmyq9ZOp3UEwl5V4/Tp4Iw9EB2RcKVcA7456qvI=";
+    url = "https://developer.download.nvidia.com/compute/cudnn/redist/cudnn/linux-x86_64/cudnn-linux-x86_64-8.8.1.3_cuda12-archive.tar.xz";
+    hash = "sha256-edd6dpx+cXWrx7XC7VxJQUjAYYqGQThyLIh/lcYjd3w=";
+  }
+  {
+    version = "8.9.1.23";
+    minCudaVersion = "11.0";
+    maxCudaVersion = "11.8";
+    url = "https://developer.download.nvidia.com/compute/cudnn/redist/cudnn/linux-x86_64/cudnn-linux-x86_64-8.9.1.23_cuda11-archive.tar.xz";
+    hash = "sha256-ptmIcmfihZDJ25XOZcvpamaN8DUjOLfTN+BTLe0zSFw=";
+  }
+  {
+    version = "8.9.1.23";
+    minCudaVersion = "12.0";
+    maxCudaVersion = "12.1";
+    url = "https://developer.download.nvidia.com/compute/cudnn/redist/cudnn/linux-x86_64/cudnn-linux-x86_64-8.9.1.23_cuda12-archive.tar.xz";
+    hash = "sha256-NRY8XFQr4MURc4sn4lI1GTy+7cXg4AbkSxzerxki6D4=";
  }
 ]
--- a/pkgs/development/libraries/science/math/mkl/default.nix
+++ b/pkgs/development/libraries/science/math/mkl/default.nix
@ -124,7 +124,7 @@ in stdenvNoCC.mkDerivation ({
  '' +
    (if enableStatic then ''
      install -Dm0644 -t $out/lib opt/intel/oneapi/mkl/${mklVersion}/lib/${lib.optionalString stdenvNoCC.isLinux "intel64"}/*.a
-      install -Dm0644 -t $out/lib/pkgconfig opt/intel/oneapi/mkl/${mklVersion}/tools/pkgconfig/*.pc
+      install -Dm0644 -t $out/lib/pkgconfig opt/intel/oneapi/mkl/${mklVersion}/lib/pkgconfig/*.pc
    '' else ''
      cp opt/intel/oneapi/mkl/${mklVersion}/lib/${lib.optionalString stdenvNoCC.isLinux "intel64"}/*${shlibExt}* $out/lib
      install -Dm0644 -t $out/lib/pkgconfig opt/intel/oneapi/mkl/${mklVersion}/lib/pkgconfig/*dynamic*.pc
--- a/pkgs/development/libraries/taco/default.nix
+++ b/pkgs/development/libraries/taco/default.nix
@ -0,0 +1,54 @@
+{ stdenv
+, lib
+, fetchgit
+, cmake
+, llvmPackages
+, enablePython ? false
+, python ? null
+}:
+
+let pyEnv = python.withPackages (p: with p; [ numpy scipy ]);
+
+in stdenv.mkDerivation rec {
+  pname = "taco";
+  version = "unstable-2022-08-02";
+
+  src = fetchgit {
+    url = "https://github.com/tensor-compiler/${pname}.git";
+    rev = "2b8ece4c230a5f0f0a74bc6f48e28edfb6c1c95e";
+    fetchSubmodules = true;
+    hash = "sha256-PnBocyRLiLALuVS3Gkt/yJeslCMKyK4zdsBI8BFaTSg=";
+  };
+
+  # Remove test cases from cmake build as they violate modern C++ expectations
+  patches = [ ./taco.patch ];
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = lib.optional stdenv.isDarwin llvmPackages.openmp;
+
+  propagatedBuildInputs = lib.optional enablePython pyEnv;
+
+  cmakeFlags = [
+    "-DOPENMP=ON"
+  ] ++ lib.optional enablePython "-DPYTHON=ON" ;
+
+  postInstall = lib.strings.optionalString enablePython ''
+    mkdir -p $out/${python.sitePackages}
+    cp -r lib/pytaco $out/${python.sitePackages}/.
+  '';
+
+  # The standard CMake test suite fails a single test of the CLI interface.
+  doCheck = false;
+
+  # Cython somehow gets built with references to /build/.
+  # However, the python module works flawlessly.
+  dontFixup = enablePython;
+
+  meta = with lib; {
+    description = "Computes sparse tensor expressions on CPUs and GPUs";
+    license = licenses.mit;
+    homepage = "https://github.com/tensor-compiler/taco";
+    maintainers = [ maintainers.sheepforce ];
+  };
+}
--- a/pkgs/development/libraries/taco/taco.patch
+++ b/pkgs/development/libraries/taco/taco.patch
@ -0,0 +1,13 @@
+diff --git a/test/tests-tensor_types.cpp b/test/tests-tensor_types.cpp
+index 39d1b30a..c507da81 100644
+--- a/test/tests-tensor_types.cpp
+++ b/test/tests-tensor_types.cpp
+@@ -45,7 +45,7 @@ TYPED_TEST_P(VectorTensorTest, types) {
+   ASSERT_EQ(t, a.getComponentType());
+   ASSERT_EQ(1, a.getOrder());
+   ASSERT_EQ(5, a.getDimension(0));
+-  map<vector<int>,TypeParam> vals = {{{0}, 1.0}, {{2}, 2.0}};
+  map<vector<int>,TypeParam> vals = {{{0}, (TypeParam)1.0}, {{2}, (TypeParam)2.0}};
+   for (auto& val : vals) {
+     a.insert(val.first, val.second);
+   }
--- a/pkgs/development/python-modules/guestfs/default.nix
+++ b/pkgs/development/python-modules/guestfs/default.nix
@ -20,5 +20,6 @@ buildPythonPackage rec {
    description = "Use libguestfs from Python";
    license = licenses.lgpl2Plus;
    maintainers = with maintainers; [ grahamc ];
+    inherit (libguestfs.meta) platforms;
  };
 }
--- a/pkgs/development/python-modules/owslib/default.nix
+++ b/pkgs/development/python-modules/owslib/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "owslib";
-  version = "0.28.1";
+  version = "0.29.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "geopython";
    repo = "OWSLib";
    rev = "refs/tags/${version}";
-    hash = "sha256-qiH6teCJ/4oftSRyBTtiJdlmJn02VwacU72dWi6OXdc=";
+    hash = "sha256-dbL4VdnPszwiDO+UjluuyqeBRMKojTnZPEFKEYiIWS0=";
  };

  postPatch = ''
@ -61,6 +61,7 @@ buildPythonPackage rec {
    "test_wfs_200_remotemd"
    "test_wms_130_remotemd"
    "test_wmts_example_informatievlaanderen"
+    "test_opensearch_creodias"
  ] ++ lib.optionals stdenv.isDarwin [
    "test_ogcapi_records_pygeoapi"
    "test_wms_getfeatureinfo_130"
@ -71,6 +72,6 @@ buildPythonPackage rec {
    homepage = "https://www.osgeo.org/projects/owslib/";
    changelog = "https://github.com/geopython/OWSLib/blob/${version}/CHANGES.rst";
    license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
+    maintainers = teams.geospatial.members;
  };
 }
--- a/pkgs/development/python-modules/pyxattr/default.nix
+++ b/pkgs/development/python-modules/pyxattr/default.nix
@ -21,5 +21,6 @@ buildPythonPackage rec {
    meta = with lib; {
      description = "A Python extension module which gives access to the extended attributes for filesystem objects available in some operating systems";
      license = licenses.lgpl21Plus;
+      inherit (pkgs.attr.meta) platforms;
    };
 }
--- a/pkgs/development/python-modules/stopit/default.nix
+++ b/pkgs/development/python-modules/stopit/default.nix
@ -1,6 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
+
 }:

 buildPythonPackage rec {
@ -15,6 +17,10 @@ buildPythonPackage rec {
    hash = "sha256-uXJUA70JOGWT2NmS6S7fPrTWAJZ0mZ/hICahIUzjfbw=";
  };

+  propagatedBuildInputs = [
+    setuptools # for pkg_resources
+  ];
+
  pythonImportsCheck = [ "stopit" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@ -65,10 +65,10 @@ assert !cudaSupport || magma.cudaPackages.cudatoolkit == cudatoolkit;
 let
  setBool = v: if v then "1" else "0";

-  # https://github.com/pytorch/pytorch/blob/v1.13.1/torch/utils/cpp_extension.py#L1751
+  # https://github.com/pytorch/pytorch/blob/v2.0.1/torch/utils/cpp_extension.py#L1744
  supportedTorchCudaCapabilities =
    let
-      real = ["3.5" "3.7" "5.0" "5.2" "5.3" "6.0" "6.1" "6.2" "7.0" "7.2" "7.5" "8.0" "8.6"];
+      real = ["3.5" "3.7" "5.0" "5.2" "5.3" "6.0" "6.1" "6.2" "7.0" "7.2" "7.5" "8.0" "8.6" "8.9" "9.0"];
      ptx = lists.map (x: "${x}+PTX") real;
    in
    real ++ ptx;
--- a/pkgs/development/tools/build-managers/scala-cli/sources.json
+++ b/pkgs/development/tools/build-managers/scala-cli/sources.json
@ -1,21 +1,21 @@
 {
-  "version": "1.0.0-RC2",
+  "version": "1.0.0",
  "assets": {
    "aarch64-darwin": {
      "asset": "scala-cli-aarch64-apple-darwin.gz",
-      "sha256": "1wrr1s3dhymvcz5j0vbd038p3yd2d5q3bgb0590wing04hc4hl6s"
+      "sha256": "0lkgfcbwmrrxvdyi76zgj2mbz6nyzc0raq4sd1lcyiyavnr3mxgq"
    },
    "aarch64-linux": {
      "asset": "scala-cli-aarch64-pc-linux.gz",
-      "sha256": "008g95srb34286akk2cbnz1qf5pw9qaws1cppynxzbzpcj3jx5mk"
+      "sha256": "1z7i2jq8lrrnw4wj78xb5c49nrbilr3yi1mda9vanssdy8x27ybh"
    },
    "x86_64-darwin": {
      "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "00ifbdp6lxpbwk3yjqy6scywarl44rn1f54jds4xfvh6i22bga1g"
+      "sha256": "1qgqp0cybijbz4nryrsb1x48kf0sja35rvmv1skg8m6ld7hwkn9s"
    },
    "x86_64-linux": {
      "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "14kk1z7fx8j3kwlhnadhvclnccbnwr97xiw8w2g6nd19b95hnfnf"
+      "sha256": "0z94spyx8x9p0jzaq90vm6yrycyvfi11w1lpv9fzlwldpzk50lq8"
    }
  }
 }
--- a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "cirrus-cli";
-  version = "0.98.0";
+  version = "0.99.0";

  src = fetchFromGitHub {
    owner = "cirruslabs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-cuStFYtHBNnKkBTUs8QU0JOdgfQ68ZmV25XHOfYJKKQ=";
+    sha256 = "sha256-ekNdifSAwB2w5xys1B4eexgqlXwpkkvxJ6FQNTkIQEw=";
  };

  vendorHash = "sha256-BtcuqdVOOBG/yPdKaj+8nCvg050F/s/davblLUval+o=";
--- a/pkgs/development/tools/protoc-gen-rust/default.nix
+++ b/pkgs/development/tools/protoc-gen-rust/default.nix
@ -6,15 +6,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "protoc-gen-rust";
-  version = "3.1.0";
+  version = "3.2.0";

  src = fetchCrate {
    inherit version;
    pname = "protobuf-codegen";
-    sha256 = "sha256-DaydUuENqmN812BgQmpewRPhkq9lT6+g+VPuytLc25Y=";
+    sha256 = "sha256-9Rf7GI/qxoqlISD169TJwUVAdJn8TpxTXDNxiQra2UY=";
  };

-  cargoSha256 = "sha256-kzc2Wd+Y3mNmOHxRj5R1LIbvXz5NyGcRnz2e0jdfdPg=";
+  cargoSha256 = "sha256-i1ZIEbU6tw7xA1w+ffD/h1HIkOwVep9wQJys9Bydvv0=";

  cargoBuildFlags = ["--bin" pname];

--- a/pkgs/misc/cups/filters.nix
+++ b/pkgs/misc/cups/filters.nix
@ -6,6 +6,7 @@
 , dbus
 , dejavu_fonts
 , fetchurl
+, fetchpatch
 , fontconfig
 , gawk
 , ghostscript
@ -40,6 +41,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-qQfsdp+7cu+/v5tUCyUKCOM7bjc6inw0P5hA+6TQR4s=";
  };

+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-24805.patch";
+      url = "https://github.com/OpenPrinting/cups-filters/commit/93e60d3df358c0ae6f3dba79e1c9684657683d89.patch";
+      hash = "sha256-KgWTYFr2uShL040azzE+KaNyBPy7Gs/hCnEgQmmPCys=";
+    })
+  ];
+
  nativeBuildInputs = [ pkg-config makeWrapper ];

  buildInputs = [
--- a/pkgs/os-specific/linux/kernel/linux-6.2.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.2.nix
@ -1,18 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "6.2.16";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = versions.pad 3 version;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "04w76lfkfiq7z4dl3cnq6yiqmiwjayhw3n7n81hv8d3919w0vzq6";
-  };
-} // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/make-maple-state-reusable-after-mas_empty_area.patch
+++ b/pkgs/os-specific/linux/kernel/make-maple-state-reusable-after-mas_empty_area.patch
@ -1,21 +0,0 @@
--- a/lib/maple_tree.c
-+++ b/lib/maple_tree.c
-@@ -5317,15 +5317,9 @@
- 
- 	mt = mte_node_type(mas->node);
- 	pivots = ma_pivots(mas_mn(mas), mt);
-	if (offset)
-		mas->min = pivots[offset - 1] + 1;
-
-	if (offset < mt_pivots[mt])
-		mas->max = pivots[offset];
-
-	if (mas->index < mas->min)
-		mas->index = mas->min;
-
-+	min = mas_safe_min(mas, pivots, offset);
-+	if (mas->index < min)
-+		mas->index = min;
- 	mas->last = mas->index + size - 1;
- 	return 0;
- }
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@ -58,12 +58,6 @@
    patch = ./export-rt-sched-migrate.patch;
  };

-  # https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/patch/?id=39bf07d812b888b23983a9443ad967ca9b61551d
-  make-maple-state-reusable-after-mas_empty_area = {
-    name = "make-maple-state-reusable-after-mas_empty_area";
-    patch = ./make-maple-state-reusable-after-mas_empty_area.patch;
-  };
-
  fix-em-ice-bonding = {
    name = "fix-em-ice-bonding";
    patch = ./fix-em-ice-bonding.patch;
--- a/pkgs/os-specific/linux/zfs/stable.nix
+++ b/pkgs/os-specific/linux/zfs/stable.nix
@ -14,10 +14,7 @@ callPackage ./generic.nix args {
    if stdenv'.isx86_64
    then kernel.kernelOlder "6.3"
    else kernel.kernelOlder "6.2";
-  latestCompatibleLinuxPackages =
-    if stdenv'.isx86_64
-    then linuxKernel.packages.linux_6_2
-    else linuxKernel.packages.linux_6_1;
+  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_1;

  # this package should point to the latest release.
  version = "2.1.11";
--- a/pkgs/os-specific/linux/zfs/unstable.nix
+++ b/pkgs/os-specific/linux/zfs/unstable.nix
@ -16,10 +16,7 @@ callPackage ./generic.nix args {
  kernelCompatible = if stdenv'.isx86_64
    then kernel.kernelOlder "6.3"
    else kernel.kernelOlder "6.2";
-  latestCompatibleLinuxPackages =
-    if stdenv'.isx86_64
-    then linuxKernel.packages.linux_6_2
-    else linuxKernel.packages.linux_6_1;
+  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_1;

  # this package should point to a version / git revision compatible with the latest kernel release
  # IMPORTANT: Always use a tagged release candidate or commits from the
--- a/pkgs/servers/ldap/389/default.nix
+++ b/pkgs/servers/ldap/389/default.nix
@ -37,20 +37,20 @@

 stdenv.mkDerivation rec {
  pname = "389-ds-base";
-  version = "2.3.1";
+  version = "2.4.1";

  src = fetchFromGitHub {
    owner = "389ds";
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "sha256-14zl0zGVb8ykgtjao8QGakFyr+b5Cve0NbiZeZig/Ac=";
+    hash = "sha256-LoM2iztWC/HEq0jBKzzi+T6euXcNIDqsEzAeWfQSr90=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    sourceRoot = "source/src";
    name = "${pname}-${version}";
-    hash = "sha256-C7HFv6tTBXoi0a1yEQeGjcKjruvBrm/kiu5zgUUTse0=";
+    hash = "sha256-+eJgWeLVoJ8j8J2QNM91EY3DBy4zicTwKAU1rcLr8R4=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/admin/pgadmin/default.nix
+++ b/pkgs/tools/admin/pgadmin/default.nix
@ -14,13 +14,14 @@

 let
  pname = "pgadmin";
-  version = "7.0";
+  version = "7.1";
+  yarnSha256 = "sha256-9iuD0cy0PEtx9Jc626LtE0sAOtP451TGlFKGtC8Tjs4=";

  src = fetchFromGitHub {
    owner = "pgadmin-org";
    repo = "pgadmin4";
    rev = "REL-${lib.versions.major version}_${lib.versions.minor version}";
-    hash = "sha256-m2mO37qNjrznpdKeFHq6yE8cZx4sHBvPB2RHUtS1Uis=";
+    hash = "sha256-oqOjWfmBJNqCCSyKzbdJkdNql7Him2HgAcRovWtjfbE=";
  };

  # keep the scope, as it is used throughout the derivation and tests
@ -28,8 +29,8 @@ let
  pythonPackages = python3.pkgs.overrideScope (final: prev: rec { });

  offlineCache = fetchYarnDeps {
-    yarnLock = src + "/web/yarn.lock";
-    hash = "sha256-cnn7CJcnT+TUeeZoeJVX3bO85vuJmVrO7CPR/CYTCS0=";
+    yarnLock = ./yarn.lock;
+    hash = yarnSha256;
  };

 in
@ -101,6 +102,10 @@ pythonPackages.buildPythonApplication rec {
    cd web
    export HOME="$TMPDIR"
    yarn config --offline set yarn-offline-mirror "${offlineCache}"
+    # replace with converted yarn.lock file
+    rm yarn.lock
+    cp ${./yarn.lock} yarn.lock
+    chmod +w yarn.lock
    fixup_yarn_lock yarn.lock
    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
    patchShebangs node_modules/
--- a/pkgs/tools/admin/pgadmin/update.sh
+++ b/pkgs/tools/admin/pgadmin/update.sh
@ -0,0 +1,109 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl wget jq yq common-updater-scripts prefetch-yarn-deps yarn-lock-converter
+
+set -eu -o pipefail
+
+TMPDIR=/tmp/pgadmin-update-script
+
+################################################################
+#         This script will update pgadmin4 in nixpkgs          #
+# Due to recent changes upstream, we will need to convert the  #
+#             `yarn.lock` file back to version 1.              #
+#   This isn't trivially done and relies on 3rd party tools    #
+#       and a hand-written converter (in this script).         #
+# Also, the converter cannot check for `github` repos in the   #
+#   `yarn.lock` file, which this script will add automatically #
+################################################################
+
+cleanup() {
+  if [ -e $TMPDIR/.done ]
+  then
+    rm -rf "$TMPDIR"
+  else
+    echo
+    read -p "Script exited prematurely. Do you want to delete the temporary directory $TMPDIR ? " -n 1 -r
+    echo
+    if [[ $REPLY =~ ^[Yy]$ ]]
+    then
+      rm -rf "$TMPDIR"
+    fi
+  fi
+}
+
+trap cleanup EXIT
+
+scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
+nixpkgs=$(realpath "$scriptDir"/../../../..)
+
+newest_version="$(curl -s https://www.pgadmin.org/versions.json | jq -r .pgadmin4.version)"
+old_version=$(nix-instantiate --eval -E "(import \"$nixpkgs\" { config = {}; overlays = []; }).pgadmin4.version" | tr -d '"')
+url="https://ftp.postgresql.org/pub/pgadmin/pgadmin4/v${newest_version}/source/pgadmin4-${newest_version}.tar.gz"
+
+if [[ $newest_version == $old_version ]]; then
+  printf "Already at latest version $newest_version\n"
+  exit 0
+fi
+printf "New version: $newest_version \n"
+
+# don't use mktemp, so if a network error happens, we can resume from there
+mkdir -p $TMPDIR
+pushd $TMPDIR
+wget -c $url
+tar -xzf "pgadmin4-$newest_version.tar.gz"
+cd "pgadmin4-$newest_version/web"
+
+printf "Will now convert the v2 lockfile. This will download the npm packages to get the metadata.\n"
+printf "Please note: This will take some time! For details, see the logfile ${TMPDIR}/update.log\n"
+yarn-lock-converter -i yarn.lock -o yarn_v1.lock --cache .cache > $TMPDIR/update.log
+printf "Conversion done\n"
+
+printf "Will now do some regex substitution post-processing\n"
+sed -i -E "s|(.), |\1\", \"|g" yarn_v1.lock
+printf "Substituion done\n"
+
+printf "Will now add missing github packages back to the v1 yarn.lock file\n"
+# remove header
+tail +8 yarn.lock > yarn_mod.lock
+LENGTH=$(yq '. | with_entries(select(.value.resolution | contains("github"))) | keys | length' yarn_mod.lock)
+for i in $(seq 0 $(($LENGTH-1)));
+do
+  ENTRY=$(yq ". | with_entries(select(.value.resolution | contains(\"github\"))) | keys | .[$i]" yarn_mod.lock)
+  URL=$(echo $ENTRY | cut -d "@" -f 2)
+  VERSION=$(yq ".$ENTRY.version" yarn_mod.lock)
+  LENGTH_DEP=$(yq ".$ENTRY.dependencies | keys | length" yarn_mod.lock)
+  echo "$ENTRY:" >> adendum.lock
+  echo "  version $VERSION" >> adendum.lock
+  echo "  resolved \"$URL" >> adendum.lock
+  echo "  dependencies:" >> adendum.lock
+
+  for j in $(seq 0 $(($LENGTH_DEP-1)));
+  do
+    DEPENDENCY_KEY=$(yq ".$ENTRY.dependencies | keys | .[$j]" yarn_mod.lock)
+    DEPENDENCY_VALUE=$(yq ".$ENTRY.dependencies.$DEPENDENCY_KEY" yarn_mod.lock)
+    # remove '"'
+    DEPENDENCY_KEY=${DEPENDENCY_KEY//\"}
+    echo "    \"$DEPENDENCY_KEY\" $DEPENDENCY_VALUE" >> adendum.lock
+  done
+done
+
+echo "" >> yarn_v1.lock
+cat adendum.lock >> yarn_v1.lock
+printf "Done\n"
+
+rm yarn.lock
+mv yarn_v1.lock yarn.lock
+
+printf "Will now generate the hash. This will download the packages to the nix store and also take some time\n"
+YARN_HASH=$(prefetch-yarn-deps yarn.lock)
+YARN_HASH=$(nix hash to-sri --type sha256 "$YARN_HASH")
+printf "Done\n"
+
+printf "Copy files to nixpkgs\n"
+cp yarn.lock "$nixpkgs/pkgs/tools/admin/pgadmin/"
+printf "Done\n"
+popd
+
+sed -i -E -e "s#yarnSha256 = \".*\"#yarnSha256 = \"$YARN_HASH\"#" ${scriptDir}/default.nix
+
+update-source-version pgadmin4 "$newest_version" --print-changes
+touch $TMPDIR/.done
--- a/pkgs/tools/admin/pgadmin/yarn.lock
+++ b/pkgs/tools/admin/pgadmin/yarn.lock
--- a/pkgs/tools/graphics/ueberzugpp/default.nix
+++ b/pkgs/tools/graphics/ueberzugpp/default.nix
@ -15,27 +15,47 @@
 , nlohmann_json
 , libsixel
 , microsoft-gsl
+, chafa
+, libuuid
+, libossp_uuid
+, enableOpencv ? stdenv.isLinux
 , opencv
+, enableSway ? stdenv.isLinux
+, extra-cmake-modules
+, wayland
+, wayland-protocols
+, enableX11 ? stdenv.isLinux
 , xorg
-, withOpencv ? stdenv.isLinux
-, withX11 ? stdenv.isLinux
+, withoutStdRanges ? stdenv.isDarwin
+, range-v3
 }:

 stdenv.mkDerivation rec {
  pname = "ueberzugpp";
-  version = "2.8.3";
+  version = "2.8.5";

  src = fetchFromGitHub {
    owner = "jstkdng";
    repo = "ueberzugpp";
    rev = "v${version}";
-    hash = "sha256-U6jw1VQmc/E/vXBCVvjBsmLjhVf0MFuK+FK8jnEEl1M=";
+    hash = "sha256-WnrKwbh7m84xlKMuixkB8LLw8Pzb8+mZV9cHWiI6cBY=";
  };

+  # error: no member named 'ranges' in namespace 'std'
+  postPatch = lib.optionalString withoutStdRanges ''
+    for f in src/canvas/chafa.cpp src/canvas/iterm2/iterm2.cpp; do
+      sed -i "1i #include <range/v3/algorithm/for_each.hpp>" $f
+      substituteInPlace $f \
+        --replace "#include <ranges>" "" \
+        --replace "std::ranges" "ranges"
+    done
+  '';
+
+  strictDeps = true;
+
  nativeBuildInputs = [
    cmake
    pkg-config
-    cli11
  ];

  buildInputs = [
@ -50,16 +70,27 @@ stdenv.mkDerivation rec {
    nlohmann_json
    libsixel
    microsoft-gsl
-  ] ++ lib.optionals withOpencv [
+    chafa
+    cli11
+    (if stdenv.isLinux then libuuid else libossp_uuid)
+  ] ++ lib.optionals enableOpencv [
    opencv
-  ] ++ lib.optionals withX11 [
+  ] ++ lib.optionals enableSway [
+    extra-cmake-modules
+    wayland
+    wayland-protocols
+  ] ++ lib.optionals enableX11 [
    xorg.libX11
    xorg.xcbutilimage
+  ] ++ lib.optionals withoutStdRanges [
+    range-v3
  ];

-  cmakeFlags = lib.optionals (!withOpencv) [
+  cmakeFlags = lib.optionals (!enableOpencv) [
    "-DENABLE_OPENCV=OFF"
-  ] ++ lib.optionals (!withX11) [
+  ] ++ lib.optionals enableSway [
+    "-DENABLE_SWAY=ON"
+  ] ++ lib.optionals (!enableX11) [
    "-DENABLE_X11=OFF"
  ];

@ -68,11 +99,14 @@ stdenv.mkDerivation rec {
    export MACOSX_DEPLOYMENT_TARGET=10.14
  '';

+  postInstall = ''
+    ln -s $out/bin/ueberzug $out/bin/ueberzugpp
+  '';
+
  meta = with lib; {
    description = "Drop in replacement for ueberzug written in C++";
    homepage = "https://github.com/jstkdng/ueberzugpp";
    license = licenses.gpl3Plus;
-    mainProgram = "ueberzug";
    maintainers = with maintainers; [ aleksana wegank ];
    platforms = platforms.unix;
  };
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@ -3,7 +3,8 @@
 , e2fsprogs, enjarify, file, findutils, fontforge-fonttools, ffmpeg, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg, gnutar
 , gzip, html2text, hdf5, imagemagick, jdk, libarchive, libcaca, llvm, lz4, mono, ocaml, oggvideotools, openssh, openssl, pdftk, pgpdump, poppler_utils, procyon, qemu, R
 , radare2, sng, sqlite, squashfsTools, tcpdump, ubootTools, odt2txt, unzip, wabt, xmlbeans, xxd, xz, zip, zstd
-, enableBloat ? false
+, enableBloat ? true
+, enableUnfree ? false
 # updater only
 , writeScript
 }:
@ -43,21 +44,32 @@ python3Packages.buildPythonApplication rec {
  # To help figuring out what's missing from the list, run: ./pkgs/tools/misc/diffoscope/list-missing-tools.sh
  #
  # Still missing these tools: docx2txt lipo otool r2pipe
-  pythonPath = [
+  # We filter automatically all packages for the host platform (some dependencies are not supported on Darwin, aarch64, etc.).
+  pythonPath = lib.filter (lib.meta.availableOn stdenv.hostPlatform) ([
      binutils-unwrapped-all-targets bzip2 colordiff coreutils cpio db diffutils
      e2fsprogs file findutils fontforge-fonttools gettext gnutar gzip
      html2text libarchive lz4 openssl pgpdump sng sqlite squashfsTools unzip xxd
-      xz zip zstd
+      xz zip zstd cdrkit dtc
    ]
    ++ (with python3Packages; [
      argcomplete debian defusedxml jsondiff jsbeautifier libarchive-c
-      python-magic progressbar33 pypdf2 tlsh
+      python-magic progressbar33 pypdf2 tlsh pyxattr rpm
    ])
-    ++ lib.optionals stdenv.isLinux [ python3Packages.pyxattr python3Packages.rpm acl cdrkit dtc ]
-    ++ lib.optionals enableBloat ([
-      abootimg apksigcopier apksigner apktool cbfstool colord enjarify ffmpeg fpc ghc ghostscriptX giflib gnupg gnumeric
-      hdf5 imagemagick libcaca llvm jdk mono ocaml odt2txt oggvideotools openssh pdftk poppler_utils procyon qemu R tcpdump ubootTools wabt radare2 xmlbeans
-    ] ++ (with python3Packages; [ androguard binwalk guestfs h5py pdfminer-six ]));
+    ++ lib.optionals enableBloat (
+      [
+        apksigcopier apksigner enjarify ffmpeg fpc ghc ghostscriptX giflib gnupg pdftk
+        hdf5 imagemagick libcaca llvm jdk mono ocaml odt2txt openssh
+        poppler_utils procyon qemu R tcpdump wabt radare2 xmlbeans
+        abootimg cbfstool colord ubootTools
+      ]
+      ++ (with python3Packages; [ androguard binwalk h5py pdfminer-six guestfs ])
+      # oggvideotools is broken on Darwin, please put it back when it will be fixed?
+      ++ lib.optionals stdenv.isLinux [ oggvideotools ]
+      # This doesn't work on aarch64-darwin
+      ++ lib.optionals (stdenv.hostPlatform != "aarch64-darwin") [ gnumeric ]
+      # `apktool` depend on `build-tools` which requires Android SDK acceptance, therefore, the whole thing is unfree.
+      ++ lib.optionals enableUnfree [ apktool ]
+    ));

  nativeCheckInputs = with python3Packages; [ pytestCheckHook ] ++ pythonPath;

@ -121,7 +133,7 @@ python3Packages.buildPythonApplication rec {
    '';
    homepage = "https://diffoscope.org/";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ dezgeg danielfullmer ];
+    maintainers = with maintainers; [ dezgeg danielfullmer raitobezarius ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/tools/misc/lighthouse-steamvr/Cargo.lock
+++ b/pkgs/tools/misc/lighthouse-steamvr/Cargo.lock
--- a/pkgs/tools/misc/lighthouse-steamvr/default.nix
+++ b/pkgs/tools/misc/lighthouse-steamvr/default.nix
@ -2,16 +2,25 @@

 rustPlatform.buildRustPackage rec {
  pname = "Lighthouse";
-  version = "unstable-2021-03-28";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "ShayBox";
-    repo = "Lighthouse";
-    rev = "a090889077557fe92610ca503979b5cfc0724d61";
-    sha256 = "0vfl4y61cdrah98x6xcnb3cyi8rwhlws8ps6vfdlmr3dv30mbnbb";
+    repo = pname;
+    rev = version;
+    sha256 = "0628v6fq9dcv1w4spgnypgyxf1qw5x03yhasink5s9nqpcip0w4h";
  };

-  cargoSha256 = "0aqd9ixszwq6qmj751gxx453gwbhwqi16m72bkbkj9s6nfyqihql";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "clap-verbosity-flag-2.0.0" = "125b8ki3dqj2kilimmvpi9wslwky8xacydi75c2bdrxpi926nya6";
+    };
+  };
+
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
+  '';

  nativeBuildInputs = [ pkg-config ];

@ -22,7 +31,6 @@ rustPlatform.buildRustPackage rec {
    description = "VR Lighthouse power state management";
    homepage = "https://github.com/ShayBox/Lighthouse";
    license = licenses.mit;
-    maintainers = with maintainers; [ expipiplus1 ];
+    maintainers = with maintainers; [ expipiplus1 bddvlpr ];
  };
 }
-
--- a/pkgs/tools/misc/oggvideotools/default.nix
+++ b/pkgs/tools/misc/oggvideotools/default.nix
@ -43,5 +43,9 @@ stdenv.mkDerivation rec {
    homepage = "http://www.streamnik.de/oggvideotools.html";
    license = licenses.gpl2Only;
    maintainers = with maintainers; [ SuperSandro2000 ];
+    # Compilation error on Darwin:
+    # error: invalid argument '--std=c++0x' not allowed with 'C'
+    # make[2]: *** [src/libresample/CMakeFiles/resample.dir/build.make:76: src/libresample/CMakeFiles/resample.dir/filterkit.c.o] Error 1
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/tools/security/gotrue/supabase.nix
+++ b/pkgs/tools/security/gotrue/supabase.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "gotrue";
-  version = "2.67.1";
+  version = "2.69.1";

  src = fetchFromGitHub {
    owner = "supabase";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-aJQCd4azeEvZiC1MUEPz1siy7ljSqvSYbEvQQHY14KM=";
+    hash = "sha256-OMAicqkwx/9OjM3Q42LOrv2gIkUNV7I9+UGuxNfL39U=";
  };

-  vendorHash = "sha256-67IGkVQja1tBNBBV9KCSrQqkF6glvS0GAGZPINiTZu8=";
+  vendorHash = "sha256-gv6ZzteQmx8AwYv6+EbZMSVKttf2T0okQyvfrvKpozM=";

  ldflags = [
    "-s"
--- a/pkgs/tools/security/sget/default.nix
+++ b/pkgs/tools/security/sget/default.nix
@ -1,33 +0,0 @@
-{ stdenv, lib, buildGoModule, fetchFromGitHub, installShellFiles }:
-
-buildGoModule rec {
-  pname = "sget";
-  version = "unstable-2022-10-04";
-
-  src = fetchFromGitHub {
-    owner = "sigstore";
-    repo = pname;
-    rev = "d7d1e53b21ca906000e74474729854cb5ac48dbc";
-    sha256 = "sha256-BgxTlLmtKqtDq3HgLoH+j0vBrpRujmL9Wr8F4d+jPi0=";
-  };
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  vendorSha256 = "sha256-KPQHS7Hfco1ljOJgStIXMaol7j4dglcr0w+6Boj7GK8=";
-
-  ldflags = [ "-s" "-w" ];
-
-  postInstall = ''
-    installShellCompletion --cmd sget \
-      --bash <($out/bin/sget completion bash) \
-      --fish <($out/bin/sget completion fish) \
-      --zsh <($out/bin/sget completion zsh)
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/sigstore/sget";
-    description = "Command for safer, automatic verification of signatures and integration with Sigstore's binary transparency log, Rekor";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ lesuisse ];
-  };
-}
--- a/pkgs/tools/security/yubikey-touch-detector/default.nix
+++ b/pkgs/tools/security/yubikey-touch-detector/default.nix
@ -1,4 +1,4 @@
-{ lib, libnotify, buildGoModule, fetchFromGitHub, pkg-config }:
+{ lib, libnotify, buildGoModule, fetchFromGitHub, fetchurl, pkg-config, iconColor ? "#84bd00" }:

 buildGoModule rec {
  pname = "yubikey-touch-detector";
@ -12,13 +12,31 @@ buildGoModule rec {
  };
  vendorHash = "sha256-OitI9Yp4/mRMrNH4yrWSL785+3mykPkvzarrc6ipOeg=";

+  iconSrc = fetchurl {
+    url = "https://github.com/Yubico/yubioath-flutter/raw/yubioath-desktop-5.0.0/images/touch.svg";
+    hash = "sha256-+jC9RKjl1uMBaNqLX5WXN+E4CuOcIEx5IGXWxgxzA/k=";
+  };
+
  nativeBuildInputs = [ pkg-config ];

  buildInputs = [ libnotify ];

+  postPatch = ''
+    cp $iconSrc yubikey-touch-detector.svg
+    substituteInPlace yubikey-touch-detector.svg \
+      --replace '#284c61' ${lib.escapeShellArg iconColor}
+
+    substituteInPlace notifier/libnotify.go \
+      --replace \
+        'AppIcon: "yubikey-touch-detector"' \
+        "AppIcon: \"$out/share/icons/yubikey-touch-detector.svg\""
+  '';
+
  postInstall = ''
    install -Dm444 -t $out/share/doc/${pname} *.md

+    install -Dm444 -t $out/share/icons yubikey-touch-detector.svg
+
    install -Dm444 -t $out/lib/systemd/user *.{service,socket}

    substituteInPlace $out/lib/systemd/user/*.service \
@ -29,7 +47,7 @@ buildGoModule rec {
    description = "A tool to detect when your YubiKey is waiting for a touch (to send notification or display a visual indicator on the screen).";
    homepage = "https://github.com/maximbaz/yubikey-touch-detector";
    maintainers = with maintainers; [ sumnerevans ];
-    license = licenses.isc;
+    license = with licenses; [ bsd2 isc ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/tools/text/angle-grinder/default.nix
+++ b/pkgs/tools/text/angle-grinder/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "angle-grinder";
-  version = "0.19.0";
+  version = "0.19.2";

  src = fetchFromGitHub {
    owner = "rcoh";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-CAfbV5WKDMjKv2TSdnxpDEqdAwGWME/9PXLcU/TtM2U=";
+    sha256 = "sha256-/OYIG4s0hH/bkAPxt/x5qHopDIoMN9AJLQ8Sx8USgsM=";
  };

-  cargoHash = "sha256-EDU+8sbCz4eyBwByHJwQc1Z0ftTZakGcYePbpl8sp08=";
+  cargoHash = "sha256-pOW2jFQxaf2zQWL5+URvHVeCAvSI0u8iALPO5fCoqmI=";

  meta = with lib; {
    description = "Slice and dice logs on the command line";
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1507,6 +1507,7 @@ mapAliases ({
  seeks = throw "seeks has been removed from nixpkgs, as it was unmaintained"; # Added 2020-06-21
  sepolgen = throw "sepolgen was merged into selinux-python"; # Added 2021-11-11
  session-desktop-appimage = session-desktop;
+  sget = throw "sget has been removed from nixpkgs, as it is not supported upstream anymore see https://github.com/sigstore/sget/issues/145"; # Added 2023-05-26
  shared_mime_info = throw "'shared_mime_info' has been renamed to/replaced by 'shared-mime-info'"; # Converted to throw 2022-02-22
  inherit (libsForQt5.mauiPackages) shelf; # added 2022-05-17
  shellinabox = throw "shellinabox has been removed from nixpkgs, as it was unmaintained upstream"; # Added 2021-12-15
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -6852,12 +6852,12 @@ with pkgs;

  diction = callPackage ../tools/text/diction { };

-  diffoscopeMinimal = callPackage ../tools/misc/diffoscope {
+  diffoscope = callPackage ../tools/misc/diffoscope {
    jdk = jdk8;
  };

-  diffoscope = diffoscopeMinimal.override {
-    enableBloat = !stdenv.isDarwin;
+  diffoscopeMinimal = diffoscope.override {
+    enableBloat = false;
  };

  diffr = callPackage ../tools/text/diffr {
@ -12248,8 +12248,6 @@ with pkgs;

  sg3_utils = callPackage ../tools/system/sg3_utils { };

-  sget = callPackage ../tools/security/sget { };
-
  sha1collisiondetection = callPackage ../tools/security/sha1collisiondetection { };

  shadowsocks-libev = callPackage ../tools/networking/shadowsocks-libev { };
@ -22957,6 +22955,8 @@ with pkgs;

  dbcsr = callPackage ../development/libraries/science/math/dbcsr { };

+  taco = callPackage ../development/libraries/taco { };
+
  ## libGL/libGLU/Mesa stuff

  # Default libGL implementation, should provide headers and
@ -34791,7 +34791,7 @@ with pkgs;

  ueberzug = with python3Packages; toPythonApplication ueberzug;

-  ueberzugpp = callPackage ../tools/graphics/ueberzugpp { };
+  ueberzugpp = darwin.apple_sdk_11_0.callPackage ../tools/graphics/ueberzugpp { };

  uefi-run = callPackage ../tools/virtualization/uefi-run { };

--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@ -183,15 +183,6 @@ in {
      ];
    };

-    linux_6_2 = callPackage ../os-specific/linux/kernel/linux-6.2.nix {
-      kernelPatches = [
-        kernelPatches.bridge_stp_helper
-        kernelPatches.request_key_helper
-        kernelPatches.make-maple-state-reusable-after-mas_empty_area
-        kernelPatches.fix-em-ice-bonding
-      ];
-    };
-
    linux_6_3 = callPackage ../os-specific/linux/kernel/linux-6.3.nix {
      kernelPatches = [
        kernelPatches.bridge_stp_helper
@ -282,6 +273,7 @@ in {
    linux_5_18 = throw "linux 5.18 was removed because it has reached its end of life upstream";
    linux_5_19 = throw "linux 5.19 was removed because it has reached its end of life upstream";
    linux_6_0 = throw "linux 6.0 was removed because it has reached its end of life upstream";
+    linux_6_2 = throw "linux 6.2 was removed because it has reached its end of life upstream";

    linux_xanmod_tt = throw "linux_xanmod_tt was removed because upstream no longer offers this option";

@ -581,13 +573,13 @@ in {
    linux_5_10 = recurseIntoAttrs (packagesFor kernels.linux_5_10);
    linux_5_15 = recurseIntoAttrs (packagesFor kernels.linux_5_15);
    linux_6_1 = recurseIntoAttrs (packagesFor kernels.linux_6_1);
-    linux_6_2 = recurseIntoAttrs (packagesFor kernels.linux_6_2);
    linux_6_3 = recurseIntoAttrs (packagesFor kernels.linux_6_3);
  } // lib.optionalAttrs config.allowAliases {
    linux_4_9 = throw "linux 4.9 was removed because it will reach its end of life within 22.11"; # Added 2022-11-08
    linux_5_18 = throw "linux 5.18 was removed because it reached its end of life upstream"; # Added 2022-09-17
    linux_5_19 = throw "linux 5.19 was removed because it reached its end of life upstream"; # Added 2022-11-01
    linux_6_0 = throw "linux 6.0 was removed because it reached its end of life upstream"; # Added 2023-01-20
+    linux_6_2 = throw "linux 6.2 was removed because it reached its end of life upstream"; # Added 2023-05-26
  };

  rtPackages = {
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -11799,6 +11799,11 @@ self: super: with self; {

  tabview = callPackage ../development/python-modules/tabview { };

+  taco = toPythonModule (pkgs.taco.override {
+    inherit (self) python;
+    enablePython = true;
+  });
+
  tadasets = callPackage ../development/python-modules/tadasets { };

  tag-expressions = callPackage ../development/python-modules/tag-expressions { };