Merge master into haskell-updates

2024-11-23 23:43:30 +00:00 · 2023-10-14 00:11:41 +00:00 · 2023-10-14 00:11:41 +00:00 · 921f9317ff
commit 921f9317ff
parent 55a0671553 959de2cf8b
240 changed files with 3417 additions and 6728 deletions
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@ -69,8 +69,8 @@ rec {
     "<pkg>.overrideDerivation" to learn about `overrideDerivation` and caveats
     related to its use.
  */
-  makeOverridable = f: origArgs:
-    let
+  makeOverridable = f: lib.setFunctionArgs
+    (origArgs: let
      result = f origArgs;

      # Creates a functor with the same arguments as f
@ -95,7 +95,8 @@ rec {
        lib.setFunctionArgs result (lib.functionArgs result) // {
          override = overrideArgs;
        }
-      else result;
+      else result)
+    (lib.functionArgs f);


  /* Call the package function in the file `fn` with the required
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -43,6 +43,18 @@ in

 runTests {

+# CUSTOMIZATION
+
+  testFunctionArgsMakeOverridable = {
+    expr = functionArgs (makeOverridable ({ a, b, c ? null}: {}));
+    expected = { a = false; b = false; c = true; };
+  };
+
+  testFunctionArgsMakeOverridableOverride = {
+    expr = functionArgs (makeOverridable ({ a, b, c ? null }: {}) { a = 1; b = 2; }).override;
+    expected = { a = false; b = false; c = true; };
+  };
+
 # TRIVIAL

  testId = {
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -12851,6 +12851,12 @@
    githubId = 9939720;
    name = "Philippe Nguyen";
  };
+  npulidomateo = {
+    matrix = "@npulidomateo:matrix.org";
+    github = "npulidomateo";
+    githubId = 13149442;
+    name = "Nico Pulido-Mateo";
+  };
  nrdxp = {
    email = "tim.deh@pm.me";
    matrix = "@timdeh:matrix.org";
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -72,6 +72,7 @@ lualogging,,,,,,
 luaossl,,,,,5.1,
 luaposix,,,,34.1.1-1,,vyp lblasc
 luarepl,,,,,,
+luarocks-build-rust-mlua,,,,,,mrcjkb
 luasec,,,,,,flosse
 luasocket,,,,,,
 luasql-sqlite3,,,,,,vyp
@ -92,6 +93,7 @@ mediator_lua,,,,,,
 middleclass,,,,,,
 mpack,,,,,,
 moonscript,https://github.com/leafo/moonscript.git,dev-1,,,,arobyn
+nui-nvim,,,,,,mrcjkb
 nvim-client,https://github.com/neovim/lua-client.git,,,,,
 nvim-cmp,https://github.com/hrsh7th/nvim-cmp,,,,,
 penlight,https://github.com/lunarmodules/Penlight.git,,,,,alerque
@ -109,5 +111,7 @@ teal-language-server,,,http://luarocks.org/dev,,,
 telescope.nvim,,,,,5.1,
 telescope-manix,,,,,,
 tl,,,,,,mephistophiles
+toml,,,,,,mrcjkb
+toml-edit,,,,,5.1,mrcjkb
 vstruct,https://github.com/ToxicFrog/vstruct.git,,,,,
 vusted,,,,,,figsoda
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -130,7 +130,7 @@ In addition to numerous new and upgraded packages, this release includes the fol
  don't lose access to their files.

  In any other case, it's safe to use OpenSSL 3 for PHP's OpenSSL extension. This can be done by setting
-  [](#opt-services.nextcloud.enableBrokenCiphersForSSE) to `false`.
+  `services.nextcloud.enableBrokenCiphersForSSE` to `false`.

 - The `coq` package and versioned variants starting at `coq_8_14` no
  longer include CoqIDE, which is now available through
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -217,6 +217,8 @@

 - `fileSystems.<name>.autoResize` now uses `systemd-growfs` to resize the file system online in stage 2. This means that `f2fs` and `ext2` can no longer be auto resized, while `xfs` and `btrfs` now can be.

+- `nixos-rebuild {switch,boot,test,dry-activate}` now runs the system activation inside `systemd-run`, creating an ephemeral systemd service and protecting the system switch against issues like network disconnections during remote (e.g. SSH) sessions. This has the side effect of running the switch in an isolated environment, that could possible break post-switch scripts that depends on things like environment variables being set. If you want to opt-out from this behavior for now, you may set the `NIXOS_SWITCH_USE_DIRTY_ENV` environment variable before running `nixos-rebuild`. However, keep in mind that this option will be removed in the future.
+
 - The `services.vaultwarden.config` option default value was changed to make Vaultwarden only listen on localhost, following the [secure defaults for most NixOS services](https://github.com/NixOS/nixpkgs/issues/100192).

 - `services.lemmy.settings.federation` was removed in 0.17.0 and no longer has any effect. To enable federation, the hostname must be set in the configuration file and then federation must be enabled in the admin web UI. See the [release notes](https://github.com/LemmyNet/lemmy/blob/c32585b03429f0f76d1e4ff738786321a0a9df98/RELEASES.md#upgrade-instructions) for more details.
@ -322,6 +324,8 @@

 - The `fonts.fonts` and `fonts.enableDefaultFonts` options have been renamed to `fonts.packages` and `fonts.enableDefaultPackages` respectively.

+- `pkgs.openvpn3` now optionally supports systemd-resolved. `programs.openvpn3` will automatically enable systemd-resolved support if `config.services.resolved.enable` is enabled.
+
 - `services.fail2ban.jails` can now be configured with attribute sets defining settings and filters instead of lines. The stringed options `daemonConfig` and `extraSettings` have respectively been replaced by `daemonSettings` and `jails.DEFAULT.settings` which use attribute sets.

 - The application firewall `opensnitch` now uses the process monitor method eBPF as default as recommended by upstream. The method can be changed with the setting [services.opensnitch.settings.ProcMonitorMethod](#opt-services.opensnitch.settings.ProcMonitorMethod).
@ -437,6 +441,8 @@ The module update takes care of the new config syntax and the data itself (user

 - `python3.pkgs.flitBuildHook` has been removed. Use `flit-core` and `format = "pyproject"` instead.

+- The `extend` function of `llvmPackages` has been removed due it coming from the `tools` attrset thus only extending the `tool` attrset. A possible replacement is to construct the set from `libraries` and `tools`, or patch nixpkgs.
+
 - The `qemu-vm.nix` module now supports disabling overriding `fileSystems` with
  `virtualisation.fileSystems`. This enables the user to boot VMs from
  "external" disk images not created by the qemu-vm module. You can stop the
--- a/nixos/modules/programs/openvpn3.nix
+++ b/nixos/modules/programs/openvpn3.nix
@ -8,11 +8,23 @@ in
 {
  options.programs.openvpn3 = {
    enable = mkEnableOption (lib.mdDoc "the openvpn3 client");
+    package = mkOption {
+      type = types.package;
+      default = pkgs.openvpn3.override {
+        enableSystemdResolved = config.services.resolved.enable;
+      };
+      defaultText = literalExpression ''pkgs.openvpn3.override {
+        enableSystemdResolved = config.services.resolved.enable;
+      }'';
+      description = lib.mdDoc ''
+        Which package to use for `openvpn3`.
+      '';
+    };
  };

  config = mkIf cfg.enable {
-    services.dbus.packages = with pkgs; [
-      openvpn3
+    services.dbus.packages = [
+      cfg.package
    ];

    users.users.openvpn = {
@ -25,8 +37,8 @@ in
      gid = config.ids.gids.openvpn;
    };

-    environment.systemPackages = with pkgs; [
-      openvpn3
+    environment.systemPackages = [
+      cfg.package
    ];
  };

--- a/nixos/modules/programs/projecteur.nix
+++ b/nixos/modules/programs/projecteur.nix
@ -0,0 +1,20 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.programs.projecteur;
+in
+{
+  options.programs.projecteur = {
+    enable = lib.mkEnableOption (lib.mdDoc "projecteur");
+    package = lib.mkPackageOptionMD pkgs "projecteur" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    services.udev.packages = [ cfg.package ];
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ benneti drupol ];
+  };
+}
--- a/nixos/modules/services/web-apps/nextcloud.md
+++ b/nixos/modules/services/web-apps/nextcloud.md
@ -119,13 +119,7 @@ Auto updates for Nextcloud apps can be enabled using
  - **Server-side encryption.**
    Nextcloud supports [server-side encryption (SSE)](https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_configuration.html).
    This is not an end-to-end encryption, but can be used to encrypt files that will be persisted
-    to external storage such as S3. Please note that this won't work anymore when using OpenSSL 3
-    for PHP's openssl extension and **Nextcloud 25 or older** because this is implemented using the
-    legacy cipher RC4. For Nextcloud26 this isn't relevant anymore, because Nextcloud has an RC4 implementation
-    written in native PHP and thus doesn't need `ext-openssl` for that anymore.
-    If [](#opt-system.stateVersion) is *above* `22.05`,
-    this is disabled by default. To turn it on again and for further information please refer to
-    [](#opt-services.nextcloud.enableBrokenCiphersForSSE).
+    to external storage such as S3.

 ## Using an alternative webserver as reverse-proxy (e.g. `httpd`) {#module-services-nextcloud-httpd}

--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -27,13 +27,7 @@ let

  phpPackage = cfg.phpPackage.buildEnv {
    extensions = { enabled, all }:
-      (with all;
-        # disable default openssl extension
-        (lib.filter (e: e.pname != "php-openssl") enabled)
-        # use OpenSSL 1.1 for RC4 Nextcloud encryption if user
-        # has acknowledged the brokenness of the ciphers (RC4).
-        # TODO: remove when https://github.com/nextcloud/server/issues/32003 is fixed.
-        ++ (if cfg.enableBrokenCiphersForSSE then [ cfg.phpPackage.extensions.openssl-legacy ] else [ cfg.phpPackage.extensions.openssl ])
+      (with all; enabled
        ++ optional cfg.enableImagemagick imagick
        # Optionally enabled depending on caching settings
        ++ optional cfg.caching.apcu apcu
@ -66,6 +60,9 @@ let
  mysqlLocal = cfg.database.createLocally && cfg.config.dbtype == "mysql";
  pgsqlLocal = cfg.database.createLocally && cfg.config.dbtype == "pgsql";

+  # https://github.com/nextcloud/documentation/pull/11179
+  ocmProviderIsNotAStaticDirAnymore = versionAtLeast cfg.package.version "27.1.2";
+
 in {

  imports = [
@ -87,6 +84,10 @@ in {
      Further details about this can be found in the `Nextcloud`-section of the NixOS-manual
      (which can be opened e.g. by running `nixos-help`).
    '')
+    (mkRemovedOptionModule [ "services" "nextcloud" "enableBrokenCiphersForSSE" ] ''
+      This option has no effect since there's no supported Nextcloud version packaged here
+      using OpenSSL for RC4 SSE.
+    '')
    (mkRemovedOptionModule [ "services" "nextcloud" "disableImagemagick" ] ''
      Use services.nextcloud.enableImagemagick instead.
    '')
@ -95,39 +96,6 @@ in {
  options.services.nextcloud = {
    enable = mkEnableOption (lib.mdDoc "nextcloud");

-    enableBrokenCiphersForSSE = mkOption {
-      type = types.bool;
-      default = versionOlder stateVersion "22.11";
-      defaultText = literalExpression "versionOlder system.stateVersion \"22.11\"";
-      description = lib.mdDoc ''
-        This option enables using the OpenSSL PHP extension linked against OpenSSL 1.1
-        rather than latest OpenSSL (≥ 3), this is not recommended unless you need
-        it for server-side encryption (SSE). SSE uses the legacy RC4 cipher which is
-        considered broken for several years now. See also [RFC7465](https://datatracker.ietf.org/doc/html/rfc7465).
-
-        This cipher has been disabled in OpenSSL ≥ 3 and requires
-        a specific legacy profile to re-enable it.
-
-        If you deploy Nextcloud using OpenSSL ≥ 3 for PHP and have
-        server-side encryption configured, you will not be able to access
-        your files anymore. Enabling this option can restore access to your files.
-        Upon testing we didn't encounter any data corruption when turning
-        this on and off again, but this cannot be guaranteed for
-        each Nextcloud installation.
-
-        It is `true` by default for systems with a [](#opt-system.stateVersion) below
-        `22.11` to make sure that existing installations won't break on update. On newer
-        NixOS systems you have to explicitly enable it on your own.
-
-        Please note that this only provides additional value when using
-        external storage such as S3 since it's not an end-to-end encryption.
-        If this is not the case,
-        it is advised to [disable server-side encryption](https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_configuration.html#disabling-encryption) and set this to `false`.
-
-        In the future, Nextcloud may move to AES-256-GCM, by then,
-        this option will be removed.
-      '';
-    };
    hostName = mkOption {
      type = types.str;
      description = lib.mdDoc "FQDN for the nextcloud instance.";
@ -225,7 +193,7 @@ in {
    package = mkOption {
      type = types.package;
      description = lib.mdDoc "Which package to use for the Nextcloud instance.";
-      relatedPackages = [ "nextcloud25" "nextcloud26" "nextcloud27" ];
+      relatedPackages = [ "nextcloud26" "nextcloud27" ];
    };
    phpPackage = mkOption {
      type = types.package;
@ -740,28 +708,7 @@ in {
        '')
        ++ (optional (versionOlder cfg.package.version "25") (upgradeWarning 24 "22.11"))
        ++ (optional (versionOlder cfg.package.version "26") (upgradeWarning 25 "23.05"))
-        ++ (optional (versionOlder cfg.package.version "27") (upgradeWarning 26 "23.11"))
-        ++ (optional cfg.enableBrokenCiphersForSSE ''
-          You're using PHP's openssl extension built against OpenSSL 1.1 for Nextcloud.
-          This is only necessary if you're using Nextcloud's server-side encryption.
-          Please keep in mind that it's using the broken RC4 cipher.
-
-          If you don't use that feature, you can switch to OpenSSL 3 and get
-          rid of this warning by declaring
-
-            services.nextcloud.enableBrokenCiphersForSSE = false;
-
-          If you need to use server-side encryption you can ignore this warning.
-          Otherwise you'd have to disable server-side encryption first in order
-          to be able to safely disable this option and get rid of this warning.
-          See <https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_configuration.html#disabling-encryption> on how to achieve this.
-
-          For more context, here is the implementing pull request: https://github.com/NixOS/nixpkgs/pull/198470
-        '')
-        ++ (optional (cfg.enableBrokenCiphersForSSE && versionAtLeast cfg.package.version "26") ''
-          Nextcloud26 supports RC4 without requiring legacy OpenSSL, so
-          `services.nextcloud.enableBrokenCiphersForSSE` can be set to `false`.
-        '');
+        ++ (optional (versionOlder cfg.package.version "27") (upgradeWarning 26 "23.11"));

      services.nextcloud.package = with pkgs;
        mkDefault (
@ -1136,10 +1083,6 @@ in {
              }
            '';
          };
-          "/" = {
-            priority = 900;
-            extraConfig = "rewrite ^ /index.php;";
-          };
          "~ ^/store-apps" = {
            priority = 201;
            extraConfig = "root ${cfg.home};";
@ -1164,15 +1107,23 @@ in {
              try_files $uri $uri/ =404;
            '';
          };
-          "~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)".extraConfig = ''
-            return 404;
-          '';
-          "~ ^/(?:\\.(?!well-known)|autotest|occ|issue|indie|db_|console)".extraConfig = ''
-            return 404;
-          '';
-          "~ ^\\/(?:index|remote|public|cron|core\\/ajax\\/update|status|ocs\\/v[12]|updater\\/.+|oc[ms]-provider\\/.+|.+\\/richdocumentscode\\/proxy)\\.php(?:$|\\/)" = {
+          "~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)" = {
+            priority = 450;
+            extraConfig = ''
+              return 404;
+            '';
+          };
+          "~ ^/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
+            priority = 450;
+            extraConfig = ''
+              return 404;
+            '';
+          };
+          "~ \\.php(?:$|/)" = {
            priority = 500;
            extraConfig = ''
+              # legacy support (i.e. static files and directories in cfg.package)
+              rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[s${optionalString (!ocmProviderIsNotAStaticDirAnymore) "m"}]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
              include ${config.services.nginx.package}/conf/fastcgi.conf;
              fastcgi_split_path_info ^(.+?\.php)(\\/.*)$;
              set $path_info $fastcgi_path_info;
@ -1188,19 +1139,30 @@ in {
              fastcgi_read_timeout ${builtins.toString cfg.fastcgiTimeout}s;
            '';
          };
-          "~ \\.(?:css|js|woff2?|svg|gif|map)$".extraConfig = ''
+          "~ \\.(?:css|js|mjs|svg|gif|png|jpg|jpeg|ico|wasm|tflite|map|html|ttf|bcmap|mp4|webm)$".extraConfig = ''
            try_files $uri /index.php$request_uri;
            expires 6M;
            access_log off;
+            location ~ \.wasm$ {
+              default_type application/wasm;
+            }
          '';
-          "~ ^\\/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
+          "~ ^\\/(?:updater|ocs-provider${optionalString (!ocmProviderIsNotAStaticDirAnymore) "|ocm-provider"})(?:$|\\/)".extraConfig = ''
            try_files $uri/ =404;
            index index.php;
          '';
-          "~ \\.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$".extraConfig = ''
-            try_files $uri /index.php$request_uri;
-            access_log off;
-          '';
+          "/remote" = {
+            priority = 1500;
+            extraConfig = ''
+              return 301 /remote.php$request_uri;
+            '';
+          };
+          "/" = {
+            priority = 1600;
+            extraConfig = ''
+              try_files $uri $uri/ /index.php$request_uri;
+            '';
+          };
        };
        extraConfig = ''
          index index.php index.html /index.php$request_uri;
--- a/nixos/modules/virtualisation/lxc-container.nix
+++ b/nixos/modules/virtualisation/lxc-container.nix
@ -9,15 +9,16 @@ in {

  options = {
    virtualisation.lxc = {
-      privilegedContainer = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Whether this LXC container will be running as a privileged container or not. If set to `true` then
-          additional configuration will be applied to the `systemd` instance running within the container as
-          recommended by [distrobuilder](https://linuxcontainers.org/distrobuilder/introduction/).
-        '';
-      };
+      nestedContainer = lib.mkEnableOption (lib.mdDoc ''
+        Whether this container is configured as a nested container. On LXD containers this is recommended
+        for all containers and is enabled with `security.nesting = true`.
+      '');
+
+      privilegedContainer = lib.mkEnableOption (lib.mdDoc ''
+        Whether this LXC container will be running as a privileged container or not. If set to `true` then
+        additional configuration will be applied to the `systemd` instance running within the container as
+        recommended by [distrobuilder](https://linuxcontainers.org/distrobuilder/introduction/).
+      '');
    };
  };

@ -68,6 +69,8 @@ in {
      ln -fs "$1/init" /sbin/init
    '';

+    systemd.additionalUpstreamSystemUnits = lib.mkIf cfg.nestedContainer ["systemd-udev-trigger.service"];
+
    # Add the overrides from lxd distrobuilder
    # https://github.com/lxc/distrobuilder/blob/05978d0d5a72718154f1525c7d043e090ba7c3e0/distrobuilder/main.go#L630
    systemd.packages = [
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -424,7 +424,7 @@ in {
  ksm = handleTest ./ksm.nix {};
  kthxbye = handleTest ./kthxbye.nix {};
  kubernetes = handleTestOn ["x86_64-linux"] ./kubernetes {};
-  kubo = runTest ./kubo.nix;
+  kubo = import ./kubo { inherit recurseIntoAttrs runTest; };
  ladybird = handleTest ./ladybird.nix {};
  languagetool = handleTest ./languagetool.nix {};
  latestKernel.login = handleTest ./login.nix { latestKernel = true; };
--- a/nixos/tests/kubo/default.nix
+++ b/nixos/tests/kubo/default.nix
@ -0,0 +1,5 @@
+{ recurseIntoAttrs, runTest }:
+recurseIntoAttrs {
+  kubo = runTest ./kubo.nix;
+  kubo-fuse = runTest ./kubo-fuse.nix;
+}
--- a/nixos/tests/kubo/kubo-fuse.nix
+++ b/nixos/tests/kubo/kubo-fuse.nix
@ -0,0 +1,42 @@
+{ lib, ...} : {
+  name = "kubo-fuse";
+  meta = with lib.maintainers; {
+    maintainers = [ mguentner Luflosi ];
+  };
+
+  nodes.machine = { config, ... }: {
+    services.kubo = {
+      enable = true;
+      autoMount = true;
+    };
+    users.users.alice = {
+      isNormalUser = true;
+      extraGroups = [ config.services.kubo.group ];
+    };
+    users.users.bob = {
+      isNormalUser = true;
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    with subtest("FUSE mountpoint"):
+        machine.fail("echo a | su bob -l -c 'ipfs add --quieter'")
+        # The FUSE mount functionality is broken as of v0.13.0 and v0.17.0.
+        # See https://github.com/ipfs/kubo/issues/9044.
+        # Workaround: using CID Version 1 avoids that.
+        ipfs_hash = machine.succeed(
+            "echo fnord3 | su alice -l -c 'ipfs add --quieter --cid-version=1'"
+        ).strip()
+
+        machine.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+
+    with subtest("Unmounting of /ipns and /ipfs"):
+        # Force Kubo to crash and wait for it to restart
+        machine.systemctl("kill --signal=SIGKILL ipfs.service")
+        machine.wait_for_unit("ipfs.service", timeout = 30)
+
+        machine.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+  '';
+}
--- a/nixos/tests/kubo/kubo.nix
+++ b/nixos/tests/kubo/kubo.nix
@ -18,20 +18,6 @@
    };
  };

-  nodes.fuse = { config, ... }: {
-    services.kubo = {
-      enable = true;
-      autoMount = true;
-    };
-    users.users.alice = {
-      isNormalUser = true;
-      extraGroups = [ config.services.kubo.group ];
-    };
-    users.users.bob = {
-      isNormalUser = true;
-    };
-  };
-
  testScript = ''
    start_all()

@ -63,23 +49,5 @@
    with subtest("Setting dataDir works properly with the hardened systemd unit"):
        machine.succeed("test -e /mnt/ipfs/config")
        machine.succeed("test ! -e /var/lib/ipfs/")
-
-    with subtest("FUSE mountpoint"):
-        fuse.fail("echo a | su bob -l -c 'ipfs add --quieter'")
-        # The FUSE mount functionality is broken as of v0.13.0 and v0.17.0.
-        # See https://github.com/ipfs/kubo/issues/9044.
-        # Workaround: using CID Version 1 avoids that.
-        ipfs_hash = fuse.succeed(
-            "echo fnord3 | su alice -l -c 'ipfs add --quieter --cid-version=1'"
-        ).strip()
-
-        fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
-
-    with subtest("Unmounting of /ipns and /ipfs"):
-        # Force Kubo to crash and wait for it to restart
-        fuse.systemctl("kill --signal=SIGKILL ipfs.service")
-        fuse.wait_for_unit("ipfs.service", timeout = 30)
-
-        fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
  '';
 }
--- a/nixos/tests/nextcloud/default.nix
+++ b/nixos/tests/nextcloud/default.nix
@ -8,10 +8,6 @@ with pkgs.lib;
 foldl
  (matrix: ver: matrix // {
    "basic${toString ver}" = import ./basic.nix { inherit system pkgs; nextcloudVersion = ver; };
-    "openssl-sse${toString ver}" = import ./openssl-sse.nix {
-      inherit system pkgs;
-      nextcloudVersion = ver;
-    };
    "with-postgresql-and-redis${toString ver}" = import ./with-postgresql-and-redis.nix {
      inherit system pkgs;
      nextcloudVersion = ver;
@ -26,4 +22,4 @@ foldl
    };
  })
 { }
-  [ 25 26 27 ]
+  [ 26 27 ]
--- a/nixos/tests/nextcloud/openssl-sse.nix
+++ b/nixos/tests/nextcloud/openssl-sse.nix
@ -1,109 +0,0 @@
-args@{ pkgs, nextcloudVersion ? 25, ... }:
-
-(import ../make-test-python.nix ({ pkgs, ...}: let
-  adminuser = "root";
-  adminpass = "notproduction";
-  nextcloudBase = {
-    networking.firewall.allowedTCPPorts = [ 80 ];
-    system.stateVersion = "22.05"; # stateVersions <22.11 use openssl 1.1 by default
-    services.nextcloud = {
-      enable = true;
-      config.adminpassFile = "${pkgs.writeText "adminpass" adminpass}";
-      database.createLocally = true;
-      package = pkgs.${"nextcloud" + (toString nextcloudVersion)};
-    };
-  };
-in {
-  name = "nextcloud-openssl";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ ma27 ];
-  };
-  nodes.nextcloudwithopenssl1 = {
-    imports = [ nextcloudBase ];
-    services.nextcloud.hostName = "nextcloudwithopenssl1";
-  };
-  nodes.nextcloudwithopenssl3 = {
-    imports = [ nextcloudBase ];
-    services.nextcloud = {
-      hostName = "nextcloudwithopenssl3";
-      enableBrokenCiphersForSSE = false;
-    };
-  };
-  testScript = { nodes, ... }: let
-    withRcloneEnv = host: pkgs.writeScript "with-rclone-env" ''
-      #!${pkgs.runtimeShell}
-      export RCLONE_CONFIG_NEXTCLOUD_TYPE=webdav
-      export RCLONE_CONFIG_NEXTCLOUD_URL="http://${host}/remote.php/dav/files/${adminuser}"
-      export RCLONE_CONFIG_NEXTCLOUD_VENDOR="nextcloud"
-      export RCLONE_CONFIG_NEXTCLOUD_USER="${adminuser}"
-      export RCLONE_CONFIG_NEXTCLOUD_PASS="$(${pkgs.rclone}/bin/rclone obscure ${adminpass})"
-      "''${@}"
-    '';
-    withRcloneEnv1 = withRcloneEnv "nextcloudwithopenssl1";
-    withRcloneEnv3 = withRcloneEnv "nextcloudwithopenssl3";
-    copySharedFile1 = pkgs.writeScript "copy-shared-file" ''
-      #!${pkgs.runtimeShell}
-      echo 'hi' | ${withRcloneEnv1} ${pkgs.rclone}/bin/rclone rcat nextcloud:test-shared-file
-    '';
-    copySharedFile3 = pkgs.writeScript "copy-shared-file" ''
-      #!${pkgs.runtimeShell}
-      echo 'bye' | ${withRcloneEnv3} ${pkgs.rclone}/bin/rclone rcat nextcloud:test-shared-file2
-    '';
-    openssl1-node = nodes.nextcloudwithopenssl1.system.build.toplevel;
-    openssl3-node = nodes.nextcloudwithopenssl3.system.build.toplevel;
-  in ''
-    nextcloudwithopenssl1.start()
-    nextcloudwithopenssl1.wait_for_unit("multi-user.target")
-    nextcloudwithopenssl1.succeed("nextcloud-occ status")
-    nextcloudwithopenssl1.succeed("curl -sSf http://nextcloudwithopenssl1/login")
-    nextcloud_version = ${toString nextcloudVersion}
-
-    with subtest("With OpenSSL 1 SSE can be enabled and used"):
-        nextcloudwithopenssl1.succeed("nextcloud-occ app:enable encryption")
-        nextcloudwithopenssl1.succeed("nextcloud-occ encryption:enable")
-
-    with subtest("Upload file and ensure it's encrypted"):
-        nextcloudwithopenssl1.succeed("${copySharedFile1}")
-        nextcloudwithopenssl1.succeed("grep -E '^HBEGIN:oc_encryption_module' /var/lib/nextcloud/data/root/files/test-shared-file")
-        nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file | grep hi")
-
-    with subtest("Switch to OpenSSL 3"):
-        nextcloudwithopenssl1.succeed("${openssl3-node}/bin/switch-to-configuration test")
-        nextcloudwithopenssl1.wait_for_open_port(80)
-        nextcloudwithopenssl1.succeed("nextcloud-occ status")
-
-    with subtest("Existing encrypted files cannot be read, but new files can be added"):
-        # This will succeed starting NC26 because of their custom implementation of openssl_seal
-        read_existing_file_test = nextcloudwithopenssl1.fail if nextcloud_version < 26 else nextcloudwithopenssl1.succeed
-        read_existing_file_test("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file >&2")
-        nextcloudwithopenssl1.succeed("nextcloud-occ encryption:disable")
-        nextcloudwithopenssl1.succeed("${copySharedFile3}")
-        nextcloudwithopenssl1.succeed("grep bye /var/lib/nextcloud/data/root/files/test-shared-file2")
-        nextcloudwithopenssl1.succeed("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file2 | grep bye")
-
-    with subtest("Switch back to OpenSSL 1.1 and ensure that encrypted files are readable again"):
-        nextcloudwithopenssl1.succeed("${openssl1-node}/bin/switch-to-configuration test")
-        nextcloudwithopenssl1.wait_for_open_port(80)
-        nextcloudwithopenssl1.succeed("nextcloud-occ status")
-        nextcloudwithopenssl1.succeed("nextcloud-occ encryption:enable")
-        nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file2 | grep bye")
-        nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file | grep hi")
-        nextcloudwithopenssl1.succeed("grep -E '^HBEGIN:oc_encryption_module' /var/lib/nextcloud/data/root/files/test-shared-file")
-        nextcloudwithopenssl1.succeed("grep bye /var/lib/nextcloud/data/root/files/test-shared-file2")
-
-    with subtest("Ensure that everything can be decrypted"):
-        nextcloudwithopenssl1.succeed("echo y | nextcloud-occ encryption:decrypt-all >&2")
-        nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file2 | grep bye")
-        nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file | grep hi")
-        nextcloudwithopenssl1.succeed("grep -vE '^HBEGIN:oc_encryption_module' /var/lib/nextcloud/data/root/files/test-shared-file")
-
-    with subtest("Switch to OpenSSL 3 ensure that all files are usable now"):
-        nextcloudwithopenssl1.succeed("${openssl3-node}/bin/switch-to-configuration test")
-        nextcloudwithopenssl1.wait_for_open_port(80)
-        nextcloudwithopenssl1.succeed("nextcloud-occ status")
-        nextcloudwithopenssl1.succeed("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file2 | grep bye")
-        nextcloudwithopenssl1.succeed("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file | grep hi")
-
-    nextcloudwithopenssl1.shutdown()
-  '';
-})) args
--- a/nixos/tests/xfce.nix
+++ b/nixos/tests/xfce.nix
@ -20,26 +20,53 @@ import ./make-test-python.nix ({ pkgs, ...} : {
      };

      services.xserver.desktopManager.xfce.enable = true;
+      environment.systemPackages = [ pkgs.xfce.xfce4-whiskermenu-plugin ];

      hardware.pulseaudio.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then

    };

+  enableOCR = true;
+
  testScript = { nodes, ... }: let
    user = nodes.machine.users.users.alice;
+    bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus";
  in ''
-      machine.wait_for_x()
-      machine.wait_for_file("${user.home}/.Xauthority")
-      machine.succeed("xauth merge ${user.home}/.Xauthority")
-      machine.wait_for_window("xfce4-panel")
-      machine.sleep(10)
+      with subtest("Wait for login"):
+        machine.wait_for_x()
+        machine.wait_for_file("${user.home}/.Xauthority")
+        machine.succeed("xauth merge ${user.home}/.Xauthority")

-      # Check that logging in has given the user ownership of devices.
-      machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+      with subtest("Check that logging in has given the user ownership of devices"):
+        machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")

-      machine.succeed("su - ${user.name} -c 'DISPLAY=:0.0 xfce4-terminal >&2 &'")
-      machine.wait_for_window("Terminal")
-      machine.sleep(10)
-      machine.screenshot("screen")
+      with subtest("Check if Xfce components actually start"):
+        machine.wait_for_window("xfce4-panel")
+        machine.wait_for_window("Desktop")
+        for i in ["xfwm4", "xfsettingsd", "xfdesktop", "xfce4-screensaver", "xfce4-notifyd", "xfconfd"]:
+          machine.wait_until_succeeds(f"pgrep -f {i}")
+
+      with subtest("Open whiskermenu"):
+        machine.succeed("su - ${user.name} -c 'DISPLAY=:0 ${bus} xfconf-query -c xfce4-panel -p /plugins/plugin-1 -t string -s whiskermenu -n >&2 &'")
+        machine.succeed("su - ${user.name} -c 'DISPLAY=:0 ${bus} xfconf-query -c xfce4-panel -p /plugins/plugin-1/stay-on-focus-out -t bool -s true -n >&2 &'")
+        machine.succeed("su - ${user.name} -c 'DISPLAY=:0 ${bus} xfce4-panel -r >&2 &'")
+        machine.wait_until_succeeds("journalctl -b --grep 'xfce4-panel: Restarting' -t xsession")
+        machine.sleep(5)
+        machine.wait_until_succeeds("pgrep -f libwhiskermenu")
+        machine.succeed("su - ${user.name} -c 'DISPLAY=:0 ${bus} xfce4-popup-whiskermenu >&2 &'")
+        machine.wait_for_text('Mail Reader')
+        # Close the menu.
+        machine.succeed("su - ${user.name} -c 'DISPLAY=:0 ${bus} xfce4-popup-whiskermenu >&2 &'")
+
+      with subtest("Open Xfce terminal"):
+        machine.succeed("su - ${user.name} -c 'DISPLAY=:0 xfce4-terminal >&2 &'")
+        machine.wait_for_window("Terminal")
+
+      with subtest("Open Thunar"):
+        machine.succeed("su - ${user.name} -c 'DISPLAY=:0 thunar >&2 &'")
+        machine.wait_for_window("Thunar")
+        machine.wait_for_text('(Pictures|Public|Templates|Videos)')
+        machine.sleep(10)
+        machine.screenshot("screen")
    '';
 })
--- a/pkgs/applications/accessibility/wvkbd/default.nix
+++ b/pkgs/applications/accessibility/wvkbd/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "wvkbd";
-  version = "0.12";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "jjsullivan5196";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-5m4aeuCqSJNgerQKyP9M6Qf7P4ijCtCY4Efew6E09Bc=";
+    sha256 = "sha256-a1VOSLpvSKiEkR73V/Q3Es9irueDihMKcQvO9alPCqo=";
  };

  postPatch = ''
--- a/pkgs/applications/audio/picard/default.nix
+++ b/pkgs/applications/audio/picard/default.nix
@ -16,19 +16,18 @@ let
    if enablePlayback then
      pythonPackages.pyqt5_with_qtmultimedia
    else
-      pythonPackages.pyqt5
-  ;
+      pythonPackages.pyqt5;
 in
 pythonPackages.buildPythonApplication rec {
  pname = "picard";
-  version = "2.9.2";
+  version = "2.10";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "metabrainz";
    repo = "picard";
    rev = "refs/tags/release-${version}";
-    hash = "sha256-Sk4QlwJqqgCWAgguhIVscJfpf/5imoHYN9yVWv5qYG8=";
+    hash = "sha256-wgIJ813mOSpFzFJESDwNvRSZcX42MTtOyFgSeeRR28g=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "praat";
-  version = "6.3.16";
+  version = "6.3.17";

  src = fetchFromGitHub {
    owner = "praat";
    repo = "praat";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-0g16EblefuUU99RgcwtGrPWniGGlOt6GjVjyNdzN3GY=";
+    hash = "sha256-HArWXUYoIjJmvh0GOcdGyBHfqC5r4ZEuvXyQ1x5iOt0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -7,7 +7,6 @@
 , gdb
 , zlib
 , python3
-, icu
 , lldb
 , dotnet-sdk_7
 , maven
@ -17,6 +16,7 @@
 , openssl
 , expat
 , libxcrypt-legacy
+, fontconfig
 , vmopts ? null
 }:

@ -252,8 +252,6 @@ let
    (mkJetBrainsProduct {
      inherit pname version src wmClass jdk buildNumber;
      product = "Rider";
-      # icu is required by Rider.Backend
-      extraLdPath = [ icu ];
      meta = with lib; {
        homepage = "https://www.jetbrains.com/rider/";
        inherit description license platforms;
@ -268,15 +266,28 @@ let
        maintainers = with maintainers; [ raphaelr ];
      };
    }).overrideAttrs (attrs: {
-      postPatch = lib.optionalString (!stdenv.isDarwin) (attrs.postPatch + ''
-        interp="$(cat $NIX_CC/nix-support/dynamic-linker)"
-        patchelf --set-interpreter $interp \
-          lib/ReSharperHost/linux-x64/Rider.Backend \
-          plugins/dotCommon/DotFiles/linux-x64/JetBrains.Profiler.PdbServer
+      nativeBuildInputs = (attrs.nativeBuildInputs or [ ]) ++ lib.optionals (stdenv.isLinux) [
+        autoPatchelfHook
+      ];
+      buildInputs = (attrs.buildInputs or [ ]) ++ lib.optionals (stdenv.isLinux) [
+        stdenv.cc.cc
+        zlib
+        fontconfig  # plugins/dotTrace/DotFiles/linux-x64/libSkiaSharp.so
+      ];
+      dontAutoPatchelf = true;
+      postFixup = (attrs.postFixup or "") + lib.optionalString (stdenv.isLinux) ''
+        (
+          cd $out/rider

-        rm -rf lib/ReSharperHost/linux-x64/dotnet
-        ln -s ${dotnet-sdk_7} lib/ReSharperHost/linux-x64/dotnet
-      '');
+          # Remove dotnet copy first so it's not considered by autoPatchElf
+          rm -rf lib/ReSharperHost/linux-x64/dotnet
+          autoPatchelf \
+            lib/ReSharperHost/linux-x64/ \
+            plugins/dotCommon/DotFiles/linux-x64/ \
+            plugins/dotTrace/DotFiles/linux-x64/
+          ln -s ${dotnet-sdk_7} lib/ReSharperHost/linux-x64/dotnet
+        )
+      '';
    });

  buildRubyMine = { pname, version, src, license, description, wmClass, buildNumber, ... }:
--- a/pkgs/applications/editors/jetbrains/linux.nix
+++ b/pkgs/applications/editors/jetbrains/linux.nix
@ -89,6 +89,21 @@ with stdenv; lib.makeOverridable mkDerivation (rec {
    if [ -d "plugins/remote-dev-server" ]; then
      patch -p1 < ${./JetbrainsRemoteDev.patch}
    fi
+
+    vmopts_file=bin/linux/${vmoptsName}
+    if [[ ! -f $vmopts_file ]]; then
+      vmopts_file=bin/${vmoptsName}
+      if [[ ! -f $vmopts_file ]]; then
+        echo "ERROR: $vmopts_file not found"
+        exit 1
+      fi
+    fi
+    echo -Djna.library.path=${lib.makeLibraryPath ([
+      libsecret e2fsprogs libnotify
+      # Required for Help -> Collect Logs
+      # in at least rider and goland
+      udev
+    ])} >> $vmopts_file
  '';

  installPhase = ''
@ -106,14 +121,7 @@ with stdenv; lib.makeOverridable mkDerivation (rec {

    wrapProgram  "$out/$pname/bin/${loName}.sh" \
      --prefix PATH : "$out/libexec/${pname}:${lib.makeBinPath [ jdk coreutils gnugrep which git python3 ]}" \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath ([
-        # Some internals want libstdc++.so.6
-        stdenv.cc.cc.lib libsecret e2fsprogs
-        libnotify
-        # Required for Help -> Collect Logs
-        # in at least rider and goland
-        udev
-      ] ++ extraLdPath)}" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath extraLdPath}" \
      ${lib.concatStringsSep " " extraWrapperArgs} \
      --set-default JDK_HOME "$jdk" \
      --set-default ANDROID_JAVA_HOME "$jdk" \
--- a/pkgs/applications/editors/jetbrains/update_ides.py
+++ b/pkgs/applications/editors/jetbrains/update_ides.py
@ -31,6 +31,7 @@ def download_channels():
    return {
        channel["@name"]: channel
        for product in products
+        if "channel" in product
        for channel in one_or_more(product["channel"])
    }

--- a/pkgs/applications/editors/jetbrains/versions.json
+++ b/pkgs/applications/editors/jetbrains/versions.json
@ -108,10 +108,10 @@
    "rust-rover": {
      "update-channel": "RustRover EAP",
      "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.tar.gz",
-      "version": "2023.2 EAP",
-      "sha256": "1f67e1a82f5cbb7c84382c7f251ae06b1e2699fa7d2fa4129e23ec2e43251687",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.62.tar.gz",
-      "build_number": "232.9921.62"
+      "version": "2023.3 EAP",
+      "sha256": "3dd8e99b066164efc11e86e3289e444c5238dfce8e9142fe2d3a8c340eeeb175",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-233.8264.22.tar.gz",
+      "build_number": "233.8264.22"
    },
    "webstorm": {
      "update-channel": "WebStorm RELEASE",
@ -231,10 +231,10 @@
    "rust-rover": {
      "update-channel": "RustRover EAP",
      "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.dmg",
-      "version": "2023.2 EAP",
-      "sha256": "dfde444bff011783cb4a5aa2aafae8ea989874c19535b01da8214df5eb3174fb",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.62.dmg",
-      "build_number": "232.9921.62"
+      "version": "2023.3 EAP",
+      "sha256": "889ed748efbd44b76da03186efac063baf36c2208d919550dd97cf2dae8f40e3",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-233.8264.22.dmg",
+      "build_number": "233.8264.22"
    },
    "webstorm": {
      "update-channel": "WebStorm RELEASE",
@ -354,10 +354,10 @@
    "rust-rover": {
      "update-channel": "RustRover EAP",
      "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.dmg",
-      "version": "2023.2 EAP",
-      "sha256": "35d44a4f72c027283843aaa6409de701d14274cdc5a614c3fdc53121383f9389",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.62-aarch64.dmg",
-      "build_number": "232.9921.62"
+      "version": "2023.3 EAP",
+      "sha256": "9c4f26089697f6cb394e971dac8ef4fe974b5ecffd63311fcf0be66d4b4aec59",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-233.8264.22-aarch64.dmg",
+      "build_number": "233.8264.22"
    },
    "webstorm": {
      "update-channel": "WebStorm RELEASE",
--- a/pkgs/applications/editors/orbiton/default.nix
+++ b/pkgs/applications/editors/orbiton/default.nix
@ -4,13 +4,13 @@

 buildGoModule rec {
  pname = "orbiton";
-  version = "2.65.1";
+  version = "2.65.2";

  src = fetchFromGitHub {
    owner = "xyproto";
    repo = "orbiton";
    rev = "v${version}";
-    hash = "sha256-ebtzhir6nBnIawkJJq+BgXv/5CbXtbhujXkMBzQEsNY=";
+    hash = "sha256-wuRbn3zQlyqba21tKLVCRfs8QgreWQ+FBFDw6myoYbk=";
  };

  vendorHash = null;
--- a/pkgs/applications/editors/quartus-prime/default.nix
+++ b/pkgs/applications/editors/quartus-prime/default.nix
@ -1,4 +1,5 @@
-{ stdenv, lib, buildFHSEnvChroot, callPackage, makeDesktopItem, writeScript
+{ lib, buildFHSEnv, callPackage, makeDesktopItem, writeScript, runtimeShell
+, runCommand, quartus-prime-lite
 , supportedDevices ? [ "Arria II" "Cyclone V" "Cyclone IV" "Cyclone 10 LP" "MAX II/V" "MAX 10 FPGA" ]
 , unwrapped ? callPackage ./quartus.nix { inherit supportedDevices; }
 }:
@ -13,10 +14,15 @@ let
    categories = [ "Development" ];
  };
 # I think modelsim_ase/linux/vlm checksums itself, so use FHSUserEnv instead of `patchelf`
-in buildFHSEnvChroot rec {
+in buildFHSEnv rec {
  name = "quartus-prime-lite"; # wrapped

  targetPkgs = pkgs: with pkgs; [
+    (runCommand "ld-lsb-compat" {} ''
+      mkdir -p "$out/lib"
+      ln -sr "${glibc}/lib/ld-linux-x86-64.so.2" "$out/lib/ld-lsb-x86-64.so.3"
+      ln -sr "${pkgsi686Linux.glibc}/lib/ld-linux.so.2" "$out/lib/ld-lsb.so.3"
+    '')
    # quartus requirements
    glib
    xorg.libICE
@ -26,6 +32,10 @@ in buildFHSEnvChroot rec {
    xorg.libXtst
    xorg.libXi
  ];
+
+  # Also support 32-bit executables.
+  multiArch = true;
+
  multiPkgs = pkgs: with pkgs; let
    # This seems ugly - can we override `libpng = libpng12` for all `pkgs`?
    freetype = pkgs.freetype.override { libpng = libpng12; };
@ -47,46 +57,67 @@ in buildFHSEnvChroot rec {
    libxcrypt-legacy
  ];

-  passthru = { inherit unwrapped; };
-
-  extraInstallCommands = let
-    quartusExecutables = (map (c: "quartus/bin/quartus_${c}") [
-      "asm" "cdb" "cpf" "drc" "eda" "fit" "jbcc" "jli" "map" "pgm" "pow"
-      "sh" "si" "sim" "sta" "stp" "tan"
-    ]) ++ [ "quartus/bin/quartus" ];
-
-    qsysExecutables = map (c: "quartus/sopc_builder/bin/qsys-${c}") [
-      "generate" "edit" "script"
-    ];
-    # Should we install all executables ?
-    modelsimExecutables = map (c: "modelsim_ase/bin/${c}") [
-      "vsim" "vlog" "vlib"
-    ];
-  in ''
+  extraInstallCommands = ''
    mkdir -p $out/share/applications $out/share/icons/128x128
    ln -s ${desktopItem}/share/applications/* $out/share/applications
    ln -s ${unwrapped}/licenses/images/dc_quartus_panel_logo.png $out/share/icons/128x128/quartus.png

-    mkdir -p $out/quartus/bin $out/quartus/sopc_builder/bin $out/modelsim_ase/bin
-    WRAPPER=$out/bin/${name}
-    EXECUTABLES="${lib.concatStringsSep " " (quartusExecutables ++ qsysExecutables ++ modelsimExecutables)}"
-    for executable in $EXECUTABLES; do
-        echo "#!${stdenv.shell}" >> $out/$executable
-        echo "$WRAPPER ${unwrapped}/$executable \"\$@\"" >> $out/$executable
+    progs_to_wrap=(
+      "${unwrapped}"/quartus/bin/*
+      "${unwrapped}"/quartus/sopc_builder/bin/qsys-{generate,edit,script}
+      # Should we install all executables?
+      "${unwrapped}"/modelsim_ase/bin/{vsim,vlog,vlib,vcom,vdel,vmap}
+      "${unwrapped}"/modelsim_ase/linuxaloem/lmutil
+    )
+
+    wrapper=$out/bin/${name}
+    progs_wrapped=()
+    for prog in ''${progs_to_wrap[@]}; do
+        relname="''${prog#"${unwrapped}/"}"
+        wrapped="$out/$relname"
+        progs_wrapped+=("$wrapped")
+        mkdir -p "$(dirname "$wrapped")"
+        echo "#!${runtimeShell}" >> "$wrapped"
+        case "$relname" in
+            modelsim_ase/*)
+                echo "export NIXPKGS_IS_MODELSIM_WRAPPER=1" >> "$wrapped"
+                ;;
+        esac
+        echo "$wrapper $prog \"\$@\"" >> "$wrapped"
    done

    cd $out
-    chmod +x $EXECUTABLES
+    chmod +x ''${progs_wrapped[@]}
    # link into $out/bin so executables become available on $PATH
-    ln --symbolic --relative --target-directory ./bin $EXECUTABLES
+    ln --symbolic --relative --target-directory ./bin ''${progs_wrapped[@]}
  '';

-  # LD_PRELOAD fixes issues in the licensing system that cause memory corruption and crashes when
-  # starting most operations in many containerized environments, including WSL2, Docker, and LXC
-  # (a similiar fix involving LD_PRELOADing tcmalloc did not solve the issue in my situation)
-  # we use the name so that quartus can load the 64 bit verson and modelsim can load the 32 bit version
-  # https://community.intel.com/t5/Intel-FPGA-Software-Installation/Running-Quartus-Prime-Standard-on-WSL-crashes-in-libudev-so/m-p/1189032
-  runScript = writeScript "${name}-wrapper" ''
-    exec env LD_PRELOAD=libudev.so.0 "$@"
+  profile = ''
+    # LD_PRELOAD fixes issues in the licensing system that cause memory corruption and crashes when
+    # starting most operations in many containerized environments, including WSL2, Docker, and LXC
+    # (a similiar fix involving LD_PRELOADing tcmalloc did not solve the issue in my situation)
+    # we use the name so that quartus can load the 64 bit verson and modelsim can load the 32 bit version
+    # https://community.intel.com/t5/Intel-FPGA-Software-Installation/Running-Quartus-Prime-Standard-on-WSL-crashes-in-libudev-so/m-p/1189032
+    #
+    # But, as can be seen in the above resource, LD_PRELOADing libudev breaks
+    # compiling encrypted device libraries in ModelSim (with error
+    # `(vlog-2163) Macro `<protected> is undefined.`), so only use LD_PRELOAD
+    # for non-ModelSim wrappers.
+    if [ "$NIXPKGS_IS_MODELSIM_WRAPPER" != 1 ]; then
+        export LD_PRELOAD=''${LD_PRELOAD:+$LD_PRELOAD:}libudev.so.0
+    fi
  '';
+
+  # Run the wrappers directly, instead of going via bash.
+  runScript = "";
+
+  passthru = {
+    inherit unwrapped;
+    tests = {
+      modelsimEncryptedModel = runCommand "quartus-prime-lite-test-modelsim-encrypted-model" {} ''
+        "${quartus-prime-lite}/bin/vlog" "${quartus-prime-lite.unwrapped}/modelsim_ase/altera/verilog/src/arriav_atoms_ncrypt.v"
+        touch "$out"
+      '';
+    };
+  };
 }
--- a/pkgs/applications/editors/typora/default.nix
+++ b/pkgs/applications/editors/typora/default.nix
@ -0,0 +1,104 @@
+{ stdenv
+, fetchurl
+, dpkg
+, lib
+, glib
+, nss
+, nspr
+, at-spi2-atk
+, cups
+, dbus
+, libdrm
+, gtk3
+, pango
+, cairo
+, xorg
+, libxkbcommon
+, mesa
+, expat
+, alsa-lib
+, buildFHSEnv
+}:
+
+let
+  pname = "typora";
+  version = "1.7.5";
+  src = fetchurl {
+    url = "https://download.typora.io/linux/typora_${version}_amd64.deb";
+    hash = "sha256-4Q+fx1kNu98+nxnI/7hLhE6zOdNsaAiAnW6xVd+hZOI=";
+  };
+
+  typoraBase = stdenv.mkDerivation {
+    inherit pname version src;
+
+    nativeBuildInputs = [ dpkg ];
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/bin $out/share
+      mv usr/share $out
+      ln -s $out/share/typora/Typora $out/bin/Typora
+      runHook postInstall
+    '';
+  };
+
+  typoraFHS = buildFHSEnv {
+    name = "typora-fhs";
+    targetPkgs = pkgs: (with pkgs; [
+      typoraBase
+      udev
+      alsa-lib
+      glib
+      nss
+      nspr
+      atk
+      cups
+      dbus
+      gtk3
+      libdrm
+      pango
+      cairo
+      mesa
+      expat
+      libxkbcommon
+    ]) ++ (with pkgs.xorg; [
+      libX11
+      libXcursor
+      libXrandr
+      libXcomposite
+      libXdamage
+      libXext
+      libXfixes
+      libxcb
+    ]);
+    runScript = ''
+      Typora $*
+    '';
+  };
+
+in stdenv.mkDerivation {
+  inherit pname version;
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    ln -s ${typoraFHS}/bin/typora-fhs $out/bin/typora
+    ln -s ${typoraBase}/share/ $out
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A markdown editor, a markdown reader";
+    homepage = "https://typora.io/";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ npulidomateo ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -6574,6 +6574,18 @@ final: prev:
    meta.homepage = "https://github.com/folke/noice.nvim/";
  };

+  none-ls-nvim = buildVimPlugin {
+    pname = "none-ls.nvim";
+    version = "2023-10-01";
+    src = fetchFromGitHub {
+      owner = "nvimtools";
+      repo = "none-ls.nvim";
+      rev = "f39f627bbdfb33cc4ae4a95b4708e7dba7b9aafc";
+      sha256 = "1qh9bdxhs0c5mxyyv3dkmiyr03qi8g4rsbjcgzkprk4v5pz04g1v";
+    };
+    meta.homepage = "https://github.com/nvimtools/none-ls.nvim/";
+  };
+
  nord-nvim = buildVimPlugin {
    pname = "nord.nvim";
    version = "2023-08-30";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -551,6 +551,7 @@ https://github.com/tjdevries/nlua.nvim/,,
 https://github.com/mcchrish/nnn.vim/,,
 https://github.com/shortcuts/no-neck-pain.nvim/,HEAD,
 https://github.com/folke/noice.nvim/,HEAD,
+https://github.com/nvimtools/none-ls.nvim/,HEAD,
 https://github.com/shaunsingh/nord.nvim/,,
 https://github.com/andersevenrud/nordic.nvim/,,
 https://github.com/vigoux/notifier.nvim/,HEAD,
--- a/pkgs/applications/emulators/ryujinx/default.nix
+++ b/pkgs/applications/emulators/ryujinx/default.nix
@ -28,13 +28,13 @@

 buildDotnetModule rec {
  pname = "ryujinx";
-  version = "1.1.1012"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.1044"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml

  src = fetchFromGitHub {
    owner = "Ryujinx";
    repo = "Ryujinx";
-    rev = "e6700b314f1384f015666767baf9ea1d8411e330";
-    sha256 = "1szgmvwril7zwfbvqz850xavrk70i56i1yyqfh9mxpxlc3n9xxzr";
+    rev = "7afae8c69947f7a5fa9a55cee36381aef372dfba";
+    sha256 = "1kf95sbb4p50b6bah75sd95660kk2a7cbjwgvqv4c4cal6c126g7";
  };

  dotnet-sdk = dotnetCorePackages.sdk_7_0;
--- a/pkgs/applications/emulators/ryujinx/deps.nix
+++ b/pkgs/applications/emulators/ryujinx/deps.nix
@ -2,35 +2,33 @@
 # Please dont edit it manually, your changes might get overwritten!

 { fetchNuGet }: [
-  (fetchNuGet { pname = "Avalonia"; version = "11.0.3"; sha256 = "1ig635386glxgfv9l894dqp98l93ymsylml649xm42lc9a9f1khc"; })
+  (fetchNuGet { pname = "Avalonia"; version = "11.0.4"; sha256 = "0jid0x90dc8m609wqwbq87014yzih2iimz74wm6zi1j02k080jk0"; })
  (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2023020321"; sha256 = "1az4s1g22ipak9a3xfh55z2h3rm6lpqh7svbpw6ag4ysrgsjjsjd"; })
  (fetchNuGet { pname = "Avalonia.BuildServices"; version = "0.0.29"; sha256 = "05mm7f0jssih3gbzqfgjnfq5cnqa85ihsg0z1897ciihv8qd3waq"; })
-  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.0"; sha256 = "06wgzhxkivlaxkn8p61wainsprml2g1q4jmvy9fpn64qnfywjdn7"; })
-  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.3"; sha256 = "0xcxwc588lc2ify2d3m53pmwjgf7p9lwz5q11hn8p5c9zh01iai9"; })
-  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "11.0.3"; sha256 = "1kls0v2rjimcv7k0dvqd3l694xdg9nf8wdzcz1cadi4qvj0bx7l4"; })
-  (fetchNuGet { pname = "Avalonia.Controls.ItemsRepeater"; version = "11.0.0"; sha256 = "1qxw096av0n4ks0jixh7xxrzgsn9fshp1ypy3vvij7r0a1sk7y1q"; })
+  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.4"; sha256 = "1sqdcaknqazq4mw2x1jb6pfmfnyhpkd4xh6fl4ld85qikzzj7796"; })
+  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "11.0.4"; sha256 = "10kc1pfyi0jq29xavq059vfjm51igi45yikz7i1ys061zbjs0n62"; })
  (fetchNuGet { pname = "Avalonia.Controls.ItemsRepeater"; version = "11.0.0-rc2.1"; sha256 = "0pmc0fi2abn9qaqwx9lvqnd1a5a8lzp8zin72d3k3xjsh1w1g0n8"; })
-  (fetchNuGet { pname = "Avalonia.Desktop"; version = "11.0.3"; sha256 = "0g8hzvkf2rrfnpmm56m2miwpdw14l04rr0q8xz03j220fy9xk5fm"; })
-  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "11.0.3"; sha256 = "1rificg9ikf8m2550ylrqavkkvihf8xb22agmdrbz07v7s93v731"; })
-  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "11.0.3"; sha256 = "0w8qc45phfz4mnnx1mfxi042qmq31shmjmz5inb4maw9xha0yr3c"; })
-  (fetchNuGet { pname = "Avalonia.Markup.Xaml.Loader"; version = "11.0.3"; sha256 = "09g4flx6sg2b2mkwbqrwl51q87xzy0d43j2xjxvnwc8vwhr1h8gs"; })
-  (fetchNuGet { pname = "Avalonia.Native"; version = "11.0.3"; sha256 = "1gi3y2cdfcjkwjldavahyx09a1n91jpvx8szwrfgr3kk4ycc5lyn"; })
-  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.0"; sha256 = "1b5031k8slwiz7bncih67fjl6ny234yd4skqxk611l9zp5snjic2"; })
-  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.3"; sha256 = "0syh20a6892pip4qz32kgc5w77ig40yjgwbcknivhjr8arc3126r"; })
+  (fetchNuGet { pname = "Avalonia.Controls.ItemsRepeater"; version = "11.0.4"; sha256 = "1p7mz33a6dn6ghvwajxdghq15mn5f6isvvqzxcjbnhh3m5c1zhrz"; })
+  (fetchNuGet { pname = "Avalonia.Desktop"; version = "11.0.4"; sha256 = "101jlqx24d19nk0nd7x19pvbjjybckzgqh9h78c85vb98xbwh3ky"; })
+  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "11.0.4"; sha256 = "1dxylsvaffzravz64rwq2wjjlr3392i5153nmkqk89ldaq70wjja"; })
+  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "11.0.4"; sha256 = "1sbgs6d1b751h0ipq249w7z3aclpfb42sw3f7g31vin9w8wxwa6q"; })
+  (fetchNuGet { pname = "Avalonia.Markup.Xaml.Loader"; version = "11.0.4"; sha256 = "1yxand1h0ybwbykn12ixdanbp74rd5spcz8xifmzjmvisjzglvsi"; })
+  (fetchNuGet { pname = "Avalonia.Native"; version = "11.0.4"; sha256 = "10fyr63sqb4xyr7rlk94rzjbnb9mbln95mb9papip5kb3sm8jx60"; })
+  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.4"; sha256 = "096436hhg45v02pp4f43mf00xn6blx7x66sb8fq5j4jn7479fynp"; })
  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.0"; sha256 = "1ra1kd0kkblppr5zy7rzdbwllggrzvp9lkxblf9mg3y8rnp6fk83"; })
-  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.3"; sha256 = "0089z8ml8pblq6hispj1nf7lvf6zplrrlix22jcd87pm13232pg2"; })
-  (fetchNuGet { pname = "Avalonia.Svg"; version = "11.0.0"; sha256 = "1xmgaj2wnjdl16x4y6rmfp3q9faca5na90zlb8j62rxcwf1v3lkr"; })
-  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "11.0.0"; sha256 = "0cd8w9pm7lpifdzjmsnmjlzdqgq3qw653mcj3adczb5ycqqbd8p3"; })
-  (fetchNuGet { pname = "Avalonia.Themes.Simple"; version = "11.0.3"; sha256 = "0zkm0asxcbsybswxs0p6ybsiq6j1l1j02h0xfxzsmhcimm3y92kk"; })
-  (fetchNuGet { pname = "Avalonia.Win32"; version = "11.0.3"; sha256 = "14pj98057fmfgafq0pni7pw79ls0lsf3jaydfjmdjyw5x2b2x51q"; })
-  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.3"; sha256 = "0pb41fpiwndcf34r53apxf92qgqxavc4zfl1xy847pz3kj1vsclp"; })
+  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.4"; sha256 = "1ysmq4f8bxabpq3nhcrrvgwvxb9z7gx9565bvdyksdhsq16wyxym"; })
+  (fetchNuGet { pname = "Avalonia.Svg"; version = "11.0.0.2"; sha256 = "0b07rszfp87lj08bsni6vjynqcpfdwr8cqxpwy68620qki8w953l"; })
+  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "11.0.0.2"; sha256 = "12bqmm0sdc5a1xxz1hffvpgpjc5m64cn7w45bd67wnapz2w943rv"; })
+  (fetchNuGet { pname = "Avalonia.Themes.Simple"; version = "11.0.4"; sha256 = "1rncb8ifqarjc5gfh6ld0ldahvxy57a2hzi7vs826an4zl3r0yrx"; })
+  (fetchNuGet { pname = "Avalonia.Win32"; version = "11.0.4"; sha256 = "07ijkpbhz59gvsxsik8mib8rhpm5yrpnjz66sjnxl8m0ghqnkf02"; })
+  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.4"; sha256 = "0xq6xqd3cwwdcqsipvrs4rpf82nqhr45ispwjj4dxlyn4i1n8ryd"; })
  (fetchNuGet { pname = "CommandLineParser"; version = "2.9.1"; sha256 = "1sldkj8lakggn4hnyabjj1fppqh50fkdrr1k99d4gswpbk5kv582"; })
  (fetchNuGet { pname = "Concentus"; version = "1.1.7"; sha256 = "0y5z444wrbhlmsqpy2sxmajl1fbf74843lvgj3y6vz260dn2q0l0"; })
  (fetchNuGet { pname = "DiscordRichPresence"; version = "1.2.1.24"; sha256 = "0maw0yd6xgwy0cgk593z3zva0r5j267zpdmmpq8avj3zbna6n4x1"; })
  (fetchNuGet { pname = "DynamicData"; version = "7.14.2"; sha256 = "07k79w4702masq71rk865mi3h1kaxamyp7dgl08ny4n22gg8482k"; })
  (fetchNuGet { pname = "ExCSS"; version = "4.1.4"; sha256 = "1y50xp6rihkydbf5l73mr3qq2rm6rdfjrzdw9h1dw9my230q5lpd"; })
  (fetchNuGet { pname = "Fizzler"; version = "1.2.1"; sha256 = "1w5jb1d0figbv68dydbnlcsfmqlc3sv9z1zxp7d79dg2dkarc4qm"; })
-  (fetchNuGet { pname = "FluentAvaloniaUI"; version = "2.0.1"; sha256 = "12w6rk3qgn6i2zk06appf98pgdf89pw10865qcwn5xpjwm7487k2"; })
+  (fetchNuGet { pname = "FluentAvaloniaUI"; version = "2.0.4"; sha256 = "1xizjlk34xi4z837j6lbv4mc5vfb8gimkxicxcz0012wkzlmmzb1"; })
  (fetchNuGet { pname = "FSharp.Core"; version = "7.0.200"; sha256 = "1ji816r8idwjmxk8bzyq1z32ybz7xdg3nb0a7pnvqr8vys11bkgb"; })
  (fetchNuGet { pname = "GtkSharp.Dependencies"; version = "1.1.1"; sha256 = "0ffywnc3ca1lwhxdnk99l238vsprsrsh678bgm238lb7ja7m52pw"; })
  (fetchNuGet { pname = "HarfBuzzSharp"; version = "2.8.2.3"; sha256 = "115aybicqs9ijjlcv6k6r5v0agkjm1bm1nkd0rj3jglv8s0xvmp2"; })
@ -45,31 +43,30 @@
  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.0.0"; sha256 = "0bbl0jpqywqmzz2gagld1p2gvdfldjfjmm25hil9wj2nq1zc4di8"; })
  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.3.4"; sha256 = "0wd6v57p53ahz5z9zg4iyzmy3src7rlsncyqpcag02jjj1yx6g58"; })
  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "3.8.0"; sha256 = "12n7rvr39bzkf2maw7zplw8rwpxpxss4ich3bb2pw770rx4nyvyw"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "4.6.0"; sha256 = "0qvkwkbqz4dhkxsisanax1lwm3nzyyb4kgb40qczxbl8g251cjp2"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "4.7.0"; sha256 = "1zj4wwsad2j7y1byigm3c386rv56xr05mwxjlgqh0h0n5w5yjc4w"; })
  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "3.8.0"; sha256 = "1kmry65csvfn72zzc16vj1nfbfwam28wcmlrk3m5rzb8ydbzgylb"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "4.6.0"; sha256 = "1yfvwygx795c9lswpiv8q19zydifarzljdmvv67vjmi559cm8b1q"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "4.7.0"; sha256 = "1lz3ha3pp58hd4y031z64slcf9rh7g1cgkrlrbhi4vpa67xhynnh"; })
  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp.Scripting"; version = "3.8.0"; sha256 = "0w0yx0lpg54iw5jazqk46h48gx43ij32gwac8iywdj6kxfxm03vw"; })
  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Scripting.Common"; version = "3.8.0"; sha256 = "0hjgxcsj5zy27lqk0986m59n5dbplx2vjjla2lsvg4bwg8qa7bpk"; })
-  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.6.3"; sha256 = "1xxzd2yxlbq2h4k6flp7lvffmmwrjlyha2z1yvrxxymiyyggk2zg"; })
+  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.7.2"; sha256 = "09mf5kpxn1a1m8ciwklhh6ascx0yqpcs5r2hvmfj80j44n3qrwhm"; })
  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.3.0"; sha256 = "0gw297dgkh0al1zxvgvncqs0j15lsna9l1wpqas4rflmys440xvb"; })
-  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.5.0"; sha256 = "01i28nvzccxbqmiz217fxs6hnjwmd5fafs37rd49a6qp53y6623l"; })
  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.7.0"; sha256 = "0gd67zlw554j098kabg887b5a6pq9kzavpa3jjy5w53ccjzjfy8j"; })
  (fetchNuGet { pname = "Microsoft.DotNet.PlatformAbstractions"; version = "3.1.6"; sha256 = "0b9myd7gqbpaw9pkd2bx45jhik9mwj0f1ss57sk2cxmag2lkdws5"; })
  (fetchNuGet { pname = "Microsoft.Extensions.DependencyModel"; version = "6.0.0"; sha256 = "08c4fh1n8vsish1vh7h73mva34g0as4ph29s4lvps7kmjb4z64nl"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "6.31.0"; sha256 = "0l1y4q5syl6kcnk6yrjphdj3clfjnmlnxrkvmfjffvfnl9slsh9m"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "6.31.0"; sha256 = "0vfrrrvz6axfg41pcnwlhqh7gkxl1vrm8hbxjkzkw5a5ijh0i4pc"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "6.31.0"; sha256 = "0dbvi7ifsl6gdsa1hc4bvma9qyr63gvgamwndy0k7wyvvh492rhm"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "6.31.0"; sha256 = "0yrsysxgjfwrh1n2mplpm4jwm0ws4p49pdd3zcsql7kjjhs525lv"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.0.0"; sha256 = "0sc96z969qfybq5njsqm8hwhqv8jj6gysyjq7n9r9km1nqnhazmi"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.0.0"; sha256 = "12xa4yx19j5q7nbisl57jla8x6pby964cr9xkv0qm4834x4zdd3h"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.0.0"; sha256 = "0hv1qb51v6frvhybwcn6m3haq768jgdx59p17jn217fbjiprq14s"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.0.0"; sha256 = "0cjdbi3ximvfz2nyp2vlxqskmscxw8drjighvy7dna3mi749isrh"; })
  (fetchNuGet { pname = "Microsoft.IO.RecyclableMemoryStream"; version = "2.3.2"; sha256 = "115bm7dljchr7c02hiv1r3l21r22wpml1j26fyn2amaflaihpq4l"; })
-  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.6.3"; sha256 = "1f2b9ljc3l6lk2qq3ps6pzb5r4dvqvs9j1xav8kj2yy52i2dbz7r"; })
+  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.7.2"; sha256 = "08g9dpp766racnh90s1sy3ncl291majgq6v2604hfw1f6zkmbjqh"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.0.0"; sha256 = "1fk2fk2639i7nzy58m9dvpdnzql4vb8yl8vr19r2fp8lmj9w2jr0"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.1.2"; sha256 = "1507hnpr9my3z4w1r6xk5n0s1j3y6a2c2cnynj76za7cphxi1141"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.6.3"; sha256 = "0czzs36ybgipn9bga2swkdd653vh0wvs5hsi2lgykhblimdmb947"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.6.3"; sha256 = "0yi0n8jxf4l6v8bscgi8ws9zf5i84213pf1qj5d7nwx4jb05m23l"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.7.2"; sha256 = "0xdjkdnrvnaxqgg38y5w1l3jbppigg68cc8q9jn0p21vn48bgrxq"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.7.2"; sha256 = "1szsg1iy77f0caxzkk0ihpp4ifbfnbdbn8k0wbbhbdprxj8pr356"; })
  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.0.1"; sha256 = "1n8ap0cmljbqskxpf8fjzn7kh1vvlndsa75k01qig26mbw97k2q7"; })
  (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "4.5.0"; sha256 = "1zapbz161ji8h82xiajgriq6zgzmb1f3ar517p2h63plhsq5gh2q"; })
  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "7.0.0"; sha256 = "1bh77misznh19m1swqm3dsbji499b8xh9gk6w74sgbkarf6ni8lb"; })
@ -141,7 +138,7 @@
  (fetchNuGet { pname = "Ryujinx.SDL2-CS"; version = "2.28.1-build28"; sha256 = "0kn7f6cgvb2rsybiif6g7xkw1srmfr306zpv029lvi264dv6aj6l"; })
  (fetchNuGet { pname = "shaderc.net"; version = "0.1.0"; sha256 = "0f35s9h0vj9f1rx9bssj66hibc3j9bzrb4wgb5q2jwkf5xncxbpq"; })
  (fetchNuGet { pname = "SharpZipLib"; version = "1.4.2"; sha256 = "0ijrzz2szxjmv2cipk7rpmg14dfaigdkg7xabjvb38ih56m9a27y"; })
-  (fetchNuGet { pname = "ShimSkiaSharp"; version = "1.0.0"; sha256 = "0gdsrzh8q8mxlm7sxvai7zshaz93a3dm1ha4cgs4845lfhpn8nhc"; })
+  (fetchNuGet { pname = "ShimSkiaSharp"; version = "1.0.0.2"; sha256 = "0l28whcj3r8gmdg7vyb4sxbjdr12w5q9lqibclfrwrwhlx3rxhb0"; })
  (fetchNuGet { pname = "Silk.NET.Core"; version = "2.16.0"; sha256 = "1mkqc2aicvknmpyfry2v7jjxh3apaxa6dmk1vfbwxnkysl417x0k"; })
  (fetchNuGet { pname = "Silk.NET.Vulkan"; version = "2.16.0"; sha256 = "0sg5mxv7ga5pq6wc0lz52j07fxrcfmb0an30r4cxsxk66298z2wy"; })
  (fetchNuGet { pname = "Silk.NET.Vulkan.Extensions.EXT"; version = "2.16.0"; sha256 = "05918f6fl8byla2m7qjp7dvxww2rbpj2sqd4xq26rl885fmddfvf"; })
@ -156,9 +153,9 @@
  (fetchNuGet { pname = "SkiaSharp.NativeAssets.WebAssembly"; version = "2.88.3"; sha256 = "1w5njksq3amrrp7fqxw89nv6ar2kgc5yx092i4rxv7hrjbd1aagx"; })
  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.3"; sha256 = "03wwfbarsxjnk70qhqyd1dw65098dncqk2m0vksx92j70i7lry6q"; })
  (fetchNuGet { pname = "SPB"; version = "0.0.4-build28"; sha256 = "1ran6qwzlkv6xpvnp7n0nkva0zfrzwlcxj7zfzz9v8mpicqs297x"; })
-  (fetchNuGet { pname = "Svg.Custom"; version = "1.0.0"; sha256 = "0bmvgaqy4iaxw9x88ifx3a2zz0vw3p9w6pj4bk3xfnf5p9vjx1mr"; })
-  (fetchNuGet { pname = "Svg.Model"; version = "1.0.0"; sha256 = "0yrjcqcrlgqpdm3bi59nc3fppcqgrfc7jddjwxjj2q423gimip97"; })
-  (fetchNuGet { pname = "Svg.Skia"; version = "1.0.0"; sha256 = "1bs2l9fjiqpip4qh0aw7x8f8m0ja0xlcj5vwd329knkww2jx1d3c"; })
+  (fetchNuGet { pname = "Svg.Custom"; version = "1.0.0.2"; sha256 = "0xkv2h80s4nz2yypiax30s1ws0yd6zdijf5rq1lqjcxaiggf6a7q"; })
+  (fetchNuGet { pname = "Svg.Model"; version = "1.0.0.2"; sha256 = "0zdj69w5dxzwj4fqcsjfjjbc67x931f7qb32i1jsn2k91v904gsd"; })
+  (fetchNuGet { pname = "Svg.Skia"; version = "1.0.0.2"; sha256 = "1877z97c8qbsr1adbc0hvfls03icgmzh4j3pjp8cfnxflxrxql6a"; })
  (fetchNuGet { pname = "System.AppContext"; version = "4.1.0"; sha256 = "0fv3cma1jp4vgj7a8hqc9n7hr1f1kjp541s6z0q1r6nazb4iz9mz"; })
  (fetchNuGet { pname = "System.Buffers"; version = "4.0.0"; sha256 = "13s659bcmg9nwb6z78971z1lr6bmh2wghxi1ayqyzl4jijd351gr"; })
  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
@ -183,7 +180,7 @@
  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.0.1"; sha256 = "0bv0alrm2ck2zk3rz25lfyk9h42f3ywq77mx1syl6vvyncnpg4qh"; })
  (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.0.1"; sha256 = "0hjhdb5ri8z9l93bw04s7ynwrjrhx2n0p34sf33a9hl9phz69fyc"; })
-  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "6.31.0"; sha256 = "03bwmmznb4axcvlx8ql5cgigpbldjc1zrxnf5kj25r4drq8yp1cm"; })
+  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "7.0.0"; sha256 = "15c717z4kspqxiwnia7dk1mj5gv7hg584q4x1xc7z1g0rnz28pwd"; })
  (fetchNuGet { pname = "System.IO"; version = "4.1.0"; sha256 = "1g0yb8p11vfd0kbkyzlfsbsp5z44lwsvyc0h3dpw6vqnbi035ajp"; })
  (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
  (fetchNuGet { pname = "System.IO.Compression"; version = "4.1.0"; sha256 = "0iym7s3jkl8n0vzm3jd6xqg9zjjjqni05x45dwxyjr2dy88hlgji"; })
@ -247,7 +244,6 @@
  (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; sha256 = "0jvfn7j22l3mm28qjy3rcw287y9h65ha4m940waaxah07jnbzrhn"; })
  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.2.0"; sha256 = "148s9g5dgm33ri7dnh19s4lgnlxbpwvrw2jnzllq2kijj4i4vs85"; })
  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.2.0"; sha256 = "118jijz446kix20blxip0f0q8mhsh9bz118mwc2ch1p6g7facpzc"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.5.0"; sha256 = "1pm4ykbcz48f1hdmwpia432ha6qbb9kbrxrrp7cg3m8q8xn52ngn"; })
  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.0.0"; sha256 = "1cwv8lqj8r15q81d2pz2jwzzbaji0l28xfrpw29kdpsaypm92z2q"; })
  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.0.0"; sha256 = "0a8y1a5wkmpawc787gfmnrnbzdgxmx1a14ax43jf3rj9gxmy3vk4"; })
  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.0.0"; sha256 = "16sx3cig3d0ilvzl8xxgffmxbiqx87zdi8fc73i3i7zjih1a7f4q"; })
@ -261,9 +257,7 @@
  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.1"; sha256 = "1z21qyfs6sg76rp68qdx0c9iy57naan89pg7p6i3qpj8kyzn921w"; })
  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "7.0.0"; sha256 = "0sn6hxdjm7bw3xgsmg041ccchsa4sp02aa27cislw3x61dbr68kq"; })
  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11"; sha256 = "08nsfrpiwsg9x5ml4xyl3zyvjfdi4mvbqf93kjdh11j4fwkznizs"; })
-  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "4.7.2"; sha256 = "0ap286ykazrl42if59bxhzv81safdfrrmfqr3112siwyajx4wih9"; })
  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "6.0.0"; sha256 = "06n9ql3fmhpjl32g3492sj181zjml5dlcc5l76xq2h38c4f87sai"; })
-  (fetchNuGet { pname = "System.Text.Json"; version = "4.7.2"; sha256 = "10xj1pw2dgd42anikvj9qm23ccssrcp7dpznpj4j7xjp1ikhy3y4"; })
  (fetchNuGet { pname = "System.Text.Json"; version = "6.0.0"; sha256 = "1si2my1g0q0qv1hiqnji4xh9wd05qavxnzj9dwgs23iqvgjky0gl"; })
  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.1.0"; sha256 = "1mw7vfkkyd04yn2fbhm38msk7dz2xwvib14ygjsb8dq2lcvr18y7"; })
  (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; sha256 = "19x946h926bzvbsgj28csn46gak2crv2skpwsx80hbgazmkgb1ls"; })
--- a/pkgs/applications/gis/tunnelx/default.nix
+++ b/pkgs/applications/gis/tunnelx/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tunnelx";
-  version = "2023-07-nix";
+  version = "2023-09-29";

  src = fetchFromGitHub {
    owner = "CaveSurveying";
    repo = "tunnelx";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-H6lHqc9on/pv/KihNcaHPwbWf4JXRkeRqNoYq6yVKqM=";
+    hash = "sha256-4vTtmhVNDXUD7pCiugt+Yl/M3MFsUnzJfpcU9AxnGvA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/tev/default.nix
+++ b/pkgs/applications/graphics/tev/default.nix
@ -5,14 +5,14 @@

 stdenv.mkDerivation rec {
  pname = "tev";
-  version = "1.23";
+  version = "1.26";

  src = fetchFromGitHub {
    owner = "Tom94";
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-NtnnZV/+8aUm8BkUz8Xm3aeSbOI2gNUPNfvYlwUl01Y=";
+    sha256 = "sha256-6acFt0fyL0yStUwreGggJ+7Zi+0Fqburj/ytmf+Oi4w=";
  };

  nativeBuildInputs = [ cmake wrapGAppsHook ];
--- a/pkgs/applications/kde/angelfish.nix
+++ b/pkgs/applications/kde/angelfish.nix
@ -24,7 +24,7 @@
 , srcs

 # provided as callPackage input to enable easier overrides through overlays
-, cargoSha256 ? "sha256-ggYQ2cUwTnqFdoBlTar5zCWtUQGsWAAtWCcebtovF/k="
+, cargoSha256 ? "sha256-po/CzUnUFh1saJuw8CVk4zeWsVAgw2iPdfq81t0zwU8="
 }:

 mkDerivation rec {
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/release-service/23.08.1/src -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/release-service/23.08.2/src -A '*.tar.xz' )
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
--- a/pkgs/applications/misc/copyq/default.nix
+++ b/pkgs/applications/misc/copyq/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch2
 , cmake
 , ninja
 , extra-cmake-modules
@ -26,6 +27,15 @@ stdenv.mkDerivation rec {
    hash = "sha256-aAmpFKIIFZLPWUaOcf4V1d/wVQ7xRcnXFsqFjROsabg=";
  };

+  patches = [
+    # itemfakevim: fix build with qt 6.6.0
+    # https://github.com/hluk/CopyQ/pull/2508
+    (fetchpatch2 {
+      url = "https://github.com/hluk/CopyQ/commit/a20bfff0d78296b334ff8cabb047ab5d842b7311.patch";
+      hash = "sha256-F/6cQ8+O1Ttd4EFFxQas5ES6U+qxWdmYqUWRQLsVMa4=";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    ninja
--- a/pkgs/applications/misc/firefly-desktop/default.nix
+++ b/pkgs/applications/misc/firefly-desktop/default.nix
@ -2,10 +2,10 @@

 let
  pname = "firefly-desktop";
-  version = "2.1.5";
+  version = "2.1.8";
  src = fetchurl {
    url = "https://github.com/iotaledger/firefly/releases/download/desktop-${version}/${pname}-${version}.AppImage";
-    sha256 = "sha256-33LQedZTfps7uAB5LGGXM/YB7SySTJLp70+yS5pMvIk=";
+    sha256 = "sha256-MATMl5eEIauDQpz8/wqIzD7IugPVZ2HJAWCbDM4n+hA=";
  };
  appimageContents = appimageTools.extractType2 { inherit pname version src; };

--- a/pkgs/applications/misc/mediainfo/default.nix
+++ b/pkgs/applications/misc/mediainfo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mediainfo";
-  version = "23.07";
+  version = "23.10";

  src = fetchurl {
    url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    hash = "sha256-ttfanimZX9NKIhAIJbhD50wyx7xnrbARZrG+7epJ9dA=";
+    hash = "sha256-t0OuJSHZ2Oi5pYUNfCop3jC6d321JzjQ37oXzARnduc=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/applications/misc/obinskit/default.nix
+++ b/pkgs/applications/misc/obinskit/default.nix
@ -25,7 +25,8 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://s3.hexcore.xyz/occ/linux/tar/ObinsKit_${version}_x64.tar.gz";
-    sha256 = "1kcn41wmwcx6q70spa9a1qh7wfrj1sk4v4i58lbnf9kc6vasw41a";
+    curlOptsList = [ "--header" "Referer: https://www.hexcore.xyz/" ];
+    hash = "sha256-KhCu1TZsJmcXRSWSTaYOMjt+IA4qqavBwaYzXnkgls0=";
  };

  unpackPhase = "tar -xzf $src";
--- a/pkgs/applications/misc/oranda/default.nix
+++ b/pkgs/applications/misc/oranda/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "oranda";
-  version = "0.4.1";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "axodotdev";
    repo = "oranda";
    rev = "v${version}";
-    hash = "sha256-k4xrgRanQmkjmXGvfeaGU61+GP8asYPq4RQrao3rd4Q=";
+    hash = "sha256-CB3ALd8N+bZ6kD34rKTxdIXrSqZtaQTINmI2yf/m38w=";
  };

-  cargoHash = "sha256-CLMhzPM11LnQdCVD66xC4Fk+8LnfRfFzk3FwQeXboes=";
+  cargoHash = "sha256-GLnczSTDMDjvLw+8js6LUVtW8QLlS3G12pSabYkYsHI=";

  nativeBuildInputs = [
    pkg-config
@ -30,6 +30,7 @@ rustPlatform.buildRustPackage rec {
    oniguruma
  ] ++ lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.SystemConfiguration
  ];

  # requires internet access
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -27,39 +27,39 @@
  };
  stable = {
    chromedriver = {
-      sha256_darwin = "06yhmapflj5m40952zcrq97qlj3crbbffaspiz87w0syxnw9avq1";
+      sha256_darwin = "0y973bs4dbdrl152bfiq5avsp6h27j3v1kwgcgxk1d0g293322xs";
      sha256_darwin_aarch64 =
-        "07dkpaqildzsrwbgjgxw5imbbz2pjvyq3n1wiw94lfjqbd9jrkbz";
-      sha256_linux = "0lqng6g722apxa9k596f42f6bw323q4b29vrkcs1lh86skgikdgj";
-      version = "117.0.5938.149";
+        "04qrhr52qc9rhmslgsh2yymsix9cv32g39xbpf8576scihfdngv8";
+      sha256_linux = "1hy3s6j20h03ria033kfxd3rq259davvpjny4gpvznzklns71vi1";
+      version = "118.0.5993.70";
    };
    deps = {
      gn = {
-        rev = "811d332bd90551342c5cbd39e133aa276022d7f8";
-        sha256 = "0jlg3d31p346na6a3yk0x29pm6b7q03ck423n5n6mi8nv4ybwajq";
+        rev = "cc56a0f98bb34accd5323316e0292575ff17a5d4";
+        sha256 = "1ly7z48v147bfdb1kqkbc98myxpgqq3g6vgr8bjx1ikrk17l82ab";
        url = "https://gn.googlesource.com/gn";
-        version = "2023-08-01";
+        version = "2023-08-10";
      };
    };
-    sha256 = "1pyrqxzxxibz0yp218kw6z186x8y6kd5a1l0mcbhj70rpm9cimyx";
-    sha256bin64 = "1zly8dpxmhyqdsqd381r0yzjrf8nkfigfjhabm3dbf1ih7qma40z";
-    version = "117.0.5938.149";
+    sha256 = "0gcrnvm3ar7x0fv38kjvdzgb8lflx1sckcqy89yawgfy6jkh1vj9";
+    sha256bin64 = "1bq170l0g9yq17x6xlg6fjar6gv3hdi0zijwmx4s02pmw6727484";
+    version = "118.0.5993.70";
  };
  ungoogled-chromium = {
    deps = {
      gn = {
-        rev = "811d332bd90551342c5cbd39e133aa276022d7f8";
-        sha256 = "0jlg3d31p346na6a3yk0x29pm6b7q03ck423n5n6mi8nv4ybwajq";
+        rev = "cc56a0f98bb34accd5323316e0292575ff17a5d4";
+        sha256 = "1ly7z48v147bfdb1kqkbc98myxpgqq3g6vgr8bjx1ikrk17l82ab";
        url = "https://gn.googlesource.com/gn";
-        version = "2023-08-01";
+        version = "2023-08-10";
      };
      ungoogled-patches = {
-        rev = "117.0.5938.149-1";
-        sha256 = "0kzbnymbp7snxmg3adpl16anyhs2rxk0iqy5dda8dx5rv9s8i0x0";
+        rev = "118.0.5993.70-1";
+        sha256 = "0k6684cy1ks6yba2bdz17g244f05qy9769cvis4h2jzhgbf5rysh";
      };
    };
-    sha256 = "1pyrqxzxxibz0yp218kw6z186x8y6kd5a1l0mcbhj70rpm9cimyx";
-    sha256bin64 = "1zly8dpxmhyqdsqd381r0yzjrf8nkfigfjhabm3dbf1ih7qma40z";
-    version = "117.0.5938.149";
+    sha256 = "0gcrnvm3ar7x0fv38kjvdzgb8lflx1sckcqy89yawgfy6jkh1vj9";
+    sha256bin64 = "1bq170l0g9yq17x6xlg6fjar6gv3hdi0zijwmx4s02pmw6727484";
+    version = "118.0.5993.70";
  };
 }
--- a/pkgs/applications/networking/cluster/click/default.nix
+++ b/pkgs/applications/networking/cluster/click/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "click";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "databricks";
    repo = "click";
    rev = "v${version}";
-    hash = "sha256-rwS08miRpc+Q9DRuspr21NMYpEYmmscvzarDnjyVe5c=";
+    hash = "sha256-tYSbyDipZg6Qj/CWk1QVUT5AG8ncTt+5V1+ekpmsKXA=";
  };

-  cargoHash = "sha256-WNITVYTS7JWrBBwxlQuVTmLddWLbDJACizEsRiustGg=";
+  cargoHash = "sha256-fcJTxZX9mdF4oFl/Cn1egczRy+yhWt2zLKsdLKz6Q+s=";

  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];

--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "kubernetes-helm";
-  version = "3.13.0";
+  version = "3.13.1";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-/czguDCjnQPO4bcWa9Idl9U3yzFDxL7D4P/Ia7ZzMXE=";
+    sha256 = "sha256-HzamUAqO21RuWLLEfGfrpnlSJslyh4zAppCich5ZzD4=";
  };
-  vendorHash = "sha256-ba5ZUpV8QHn8T1mXxY5WB0pA1OGUzmNixtwwTQFrqb4=";
+  vendorHash = "sha256-U4adeMBruUje97rr1hHfiCxMWSXlqv+aAlsHZZ4n5zs=";

  subPackages = [ "cmd/helm" ];
  ldflags = [
--- a/pkgs/applications/networking/cluster/k8sgpt/default.nix
+++ b/pkgs/applications/networking/cluster/k8sgpt/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "k8sgpt";
-  version = "0.3.15";
+  version = "0.3.17";

  src = fetchFromGitHub {
    owner = "k8sgpt-ai";
    repo = "k8sgpt";
    rev = "v${version}";
-    hash = "sha256-mWdSyP1Gcs1FC0HUX2p84PK0n1Xnd2LrD48luN4+OVs=";
+    hash = "sha256-vSytBicpYWs7MqVts+3d6qVZ19nrM1oi00YRPmCQb/I=";
  };

-  vendorHash = "sha256-y+oF9sqYVEQSukLkfz0JXFpKtUKP/1DzHIivkL2wBwk=";
+  vendorHash = "sha256-UFXESGdipfM/TI/9ZSVwoUPsd3LVeEmTFB6sVqkkzQo=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@ -2,7 +2,7 @@

 (callPackage ./generic.nix { }) {
  channel = "edge";
-  version = "23.9.4";
-  sha256 = "1hjhbkwn44i1gsc7llxc9mrdjf5xc1nl4dxqgnxgks3hzkch6qqc";
-  vendorHash = "sha256-OzHl9QhNLaTCBCWpCmqzPkdWMwygKXSkYTczQD5KVh8=";
+  version = "23.10.1";
+  sha256 = "1m4inwim5iyahwza3i4zwz4iaja9p93vfacq324r9w8gciyvc26s";
+  vendorHash = "sha256-wjICOdn/YqRmWHZQYB/WS0fxJ+OQsnas6BphUC2C9go=";
 }
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "pluto";
-  version = "5.18.4";
+  version = "5.18.5";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "pluto";
    rev = "v${version}";
-    hash = "sha256-/8ZJXy5FErLnnXpED0UL+xqOo4QZtmR1hpcSpVsE8mw=";
+    hash = "sha256-zdfzGmEL1ZsU3g3jmkgOfxcIGyffkC9UeiU18jPOr7Y=";
  };

-  vendorHash = "sha256-ysMRE/OwMf4rBnlkpkW9K8ZHEEbHpQ02RXNwLLSr0nY=";
+  vendorHash = "sha256-8ZOYp/vM16PugmE+3QK7ZRDwIwRCMEwD0NRyiOBlh14=";

  ldflags = [
    "-w" "-s"
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@ -2,14 +2,14 @@

 buildGoModule rec {
  pname = "velero";
-  version = "1.11.1";
+  version = "1.12.0";


  src = fetchFromGitHub {
    owner = "vmware-tanzu";
    repo = "velero";
    rev = "v${version}";
-    sha256 = "sha256-G1+zdzHj8fDKVEVQpBEH3o/em+gxCyQmrpSXj8bE/P4=";
+    sha256 = "sha256-NrOdnsdKxobJkMUGxdWQyzqB+2fDCjvTjnIt5S9fL0U=";
  };

  ldflags = [
@ -20,7 +20,7 @@ buildGoModule rec {
    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
  ];

-  vendorHash = "sha256-WkJk+46+9U4TegDnGtQ+EoqqV/D7githz2pJvxCbV4c=";
+  vendorHash = "sha256-mPRBmCqyQWCbWArORXL9sF8B4AlXHtA7Zs9NZD0TqoE=";

  excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];

--- a/pkgs/applications/networking/coreth/default.nix
+++ b/pkgs/applications/networking/coreth/default.nix
@ -6,19 +6,19 @@

 buildGoModule rec {
  pname = "coreth";
-  version = "0.12.4";
+  version = "0.12.5";

  src = fetchFromGitHub {
    owner = "ava-labs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-AcU/1/TBS0nT7bXYguM8KI4mBUQzvSTVwuQkzq3t3EY=";
+    hash = "sha256-jHJubqNmU0OkKmWNCkucmv+IM19x3nfyDkfBpRihh7Y=";
  };

  # go mod vendor has a bug, see: golang/go#57529
  proxyVendor = true;

-  vendorHash = "sha256-GVSI3yv7YzW2QPC26gA2C3TqjBnTxyiPzmW+hsGGdaQ=";
+  vendorHash = "sha256-GKAGBEHP09NJ/GLq349K9VwFGt8rCvoHu8BB8TzN4CU=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/instant-messengers/qq/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/default.nix
@ -23,23 +23,23 @@
 }:

 let
-  version = "3.2.1-17153";
-  _hash = "b69de82d";
+  sources = import ./sources.nix;
  srcs = {
    x86_64-linux = fetchurl {
-      url = "https://dldir1.qq.com/qqfile/qq/QQNT/${_hash}/linuxqq_${version}_amd64.deb";
-      hash = "sha256-+GjTjv0K2vnlkb46KhMvRRFWuIEBz23Lg3QhiA7QzkA=";
+      url = "https://dldir1.qq.com/qqfile/qq/QQNT/${sources.urlhash}/linuxqq_${sources.version}_amd64.deb";
+      hash = sources.amd64_hash;
    };
    aarch64-linux = fetchurl {
-      url = "https://dldir1.qq.com/qqfile/qq/QQNT/${_hash}/linuxqq_${version}_arm64.deb";
-      hash = "sha256-BtmmVpKZF15aU7RRmXl9g5leg2jz5sT4vYXluq9aIYk=";
+      url = "https://dldir1.qq.com/qqfile/qq/QQNT/${sources.urlhash}/linuxqq_${sources.version}_arm64.deb";
+      hash = sources.arm64_hash;
    };
  };
  src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 in
 stdenv.mkDerivation {
  pname = "qq";
-  inherit version src;
+  version = sources.version;
+  inherit src;

  nativeBuildInputs = [
    autoPatchelfHook
@ -98,6 +98,8 @@ stdenv.mkDerivation {
    )
  '';

+  passthru.updateScript = ./update.sh;
+
  meta = with lib; {
    homepage = "https://im.qq.com/linuxqq/";
    description = "Messaging app";
--- a/pkgs/applications/networking/instant-messengers/qq/sources.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/sources.nix
@ -0,0 +1,8 @@
+# Generated by ./update.sh - do not update manually!
+# Last updated: 2023-09-26
+{
+  version = "3.2.1-17153";
+  urlhash = "b69de82d";
+  arm64_hash = "sha256-BtmmVpKZF15aU7RRmXl9g5leg2jz5sT4vYXluq9aIYk=";
+  amd64_hash = "sha256-+GjTjv0K2vnlkb46KhMvRRFWuIEBz23Lg3QhiA7QzkA=";
+}
--- a/pkgs/applications/networking/instant-messengers/qq/update.sh
+++ b/pkgs/applications/networking/instant-messengers/qq/update.sh
@ -0,0 +1,31 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash --pure --keep GITHUB_TOKEN -p nix git curl cacert nix-prefetch-git jq
+
+set -euo pipefail
+
+cd $(readlink -e $(dirname "${BASH_SOURCE[0]}"))
+
+payload=$(curl https://im.qq.com/rainbow/linuxQQDownload | grep -oP "var params= \K\{.*\}(?=;)")
+amd64_url=$(jq -r .x64DownloadUrl.deb <<< "$payload")
+arm64_url=$(jq -r .armDownloadUrl.deb <<< "$payload")
+
+urlhash=$(grep -oP "(?<=QQNT/)[a-e0-9]+(?=/linuxqq)" <<< "$amd64_url")
+version=$(grep -oP "(?<=/linuxqq_).*(?=_amd64.deb)" <<< "$amd64_url")
+
+amd64_hash=$(nix-prefetch-url $amd64_url)
+arm64_hash=$(nix-prefetch-url $arm64_url)
+
+# use friendlier hashes
+amd64_hash=$(nix hash to-sri --type sha256 "$amd64_hash")
+arm64_hash=$(nix hash to-sri --type sha256 "$arm64_hash")
+
+cat >sources.nix <<EOF
+# Generated by ./update.sh - do not update manually!
+# Last updated: $(date +%F)
+{
+  version = "$version";
+  urlhash = "$urlhash";
+  arm64_hash = "$arm64_hash";
+  amd64_hash = "$amd64_hash";
+}
+EOF
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 (if stdenv.isDarwin then darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv).mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20231003";
+  version = "20231011-1";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-fMVLmuhdccYzsOgVvViaICmbXgU0o3Fu0K85hbao4YI=";
+    hash = "sha256-AwlhKF7Tsx20v6t4P6j7E4XPlg9Nq+BSYOFVY+3byos=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@ -94,6 +94,13 @@ stdenv.mkDerivation rec {
      url = "https://salsa.debian.org/debian/telegram-desktop/-/raw/09b363ed5a4fcd8ecc3282b9bfede5fbb83f97ef/debian/patches/Disable-register-custom-scheme.patch";
      hash = "sha256-B8X5lnSpwwdp1HlvyXJWQPybEN+plOwimdV5gW6aY2Y=";
    })
+    # lib_base: Add missing include for Qt 6.6
+    (fetchpatch {
+      url = "https://github.com/desktop-app/lib_base/commit/5ca91dbb811c84591780236abc31431e313faf39.patch";
+      stripLen = 1;
+      extraPrefix = "Telegram/lib_base/";
+      hash = "sha256-eZkyMnPaAmUFYXiCmPhLRTw2Xdx0lylY+UVOckCsiaA=";
+    })
  ];

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/twitch-tui/default.nix
+++ b/pkgs/applications/networking/instant-messengers/twitch-tui/default.nix
@ -4,6 +4,7 @@
 , rustPlatform
 , pkg-config
 , openssl
+, CoreServices
 , Security
 }:

@ -27,6 +28,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [
    openssl
  ] ++ lib.optionals stdenv.isDarwin [
+    CoreServices
    Security
  ];

--- a/pkgs/applications/networking/ipfs-cluster/default.nix
+++ b/pkgs/applications/networking/ipfs-cluster/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "ipfs-cluster";
-  version = "1.0.6";
+  version = "1.0.7";

-  vendorHash = "sha256-IRR10wC05dv4d170Iweuxdy/JEnYjvdW0h5nS1ht9cg=";
+  vendorHash = "sha256-/Kjm/hM+lKsZ6fzStDyOitp7Vtt7Vb8ak7E/W0lbW20=";

  src = fetchFromGitHub {
    owner = "ipfs-cluster";
    repo = "ipfs-cluster";
    rev = "v${version}";
-    hash = "sha256-2En7morOodWvtNZGAZhl1EZJCCHdrYSUA1WBYGkjnYI=";
+    hash = "sha256-eBbbD77nnjcumhrsixAlI09B1ZAxK5IOHoBeJGgj+TY=";
  };

  meta = with lib; {
--- a/pkgs/applications/networking/kubo/default.nix
+++ b/pkgs/applications/networking/kubo/default.nix
@ -2,6 +2,7 @@
 , buildGoModule
 , fetchurl
 , nixosTests
+, callPackage
 }:

 buildGoModule rec {
@ -29,7 +30,10 @@ buildGoModule rec {

  subPackages = [ "cmd/ipfs" ];

-  passthru.tests.kubo = nixosTests.kubo;
+  passthru.tests = {
+    inherit (nixosTests) kubo;
+    repoVersion = callPackage ./test-repoVersion.nix {};
+  };

  vendorHash = null;

--- a/pkgs/applications/networking/kubo/test-repoVersion.nix
+++ b/pkgs/applications/networking/kubo/test-repoVersion.nix
@ -0,0 +1,13 @@
+{ runCommand, kubo }:
+
+runCommand "kubo-test-repoVersion" { } ''
+  export IPFS_PATH="$TMPDIR"
+  "${kubo}/bin/ipfs" init --empty-repo
+  declared_repo_version='${kubo.repoVersion}'
+  actual_repo_version="$(cat "$IPFS_PATH/version")"
+  if [ "$declared_repo_version" != "$actual_repo_version" ]; then
+    echo "kubo.repoVersion is not set correctly. It should be $actual_repo_version but is $declared_repo_version."
+    exit 1
+  fi
+  touch "$out"
+''
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "protonmail-bridge";
-  version = "3.4.2";
+  version = "3.5.1";

  src = fetchFromGitHub {
    owner = "ProtonMail";
    repo = "proton-bridge";
    rev = "v${version}";
-    hash = "sha256-i+RD0f3WxdW0PgMNynsIXnOfEdh3vS3NufJyXpw0EU0=";
+    hash = "sha256-nYr9M9jRtKDZdtCWirpLAKA/tgz07N6/EI6JV4NzjXM=";
  };

-  vendorHash = "sha256-lrK4L7oTR5qP34Df0UJnTJATmKUmHVZeGrD9kD+sZFw=";
+  vendorHash = "sha256-I7vDmSLccJSov5RlTtzrQTc+uCprMxwOrHkroL9oZXE=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/video/obs-studio/plugins/obs-tuna/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-tuna/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch2
 , obs-studio
 , cmake
 , zlib
@ -27,6 +28,16 @@ stdenv.mkDerivation (finalAttrs: {
    fetchSubmodules = true;
  };

+  patches = [
+    # fix build with qt 6.6.0
+    # treewide: replace deprecated qAsConst with std::as_const()
+    # https://github.com/univrsal/tuna/pull/176
+    (fetchpatch2 {
+      url = "https://github.com/univrsal/tuna/commit/0d570e771f8d8e6ae7c85bd2b86bbf59c264789e.patch";
+      hash = "sha256-A5idhMiM9funqhTm5XMIBqwy+FO1SaNPtgZjo+Vws6k=";
+    })
+  ];
+
  postInstall = ''
    mkdir $out/lib $out/share
    mv $out/obs-plugins/64bit $out/lib/obs-plugins
--- a/pkgs/applications/window-managers/phosh/default.nix
+++ b/pkgs/applications/window-managers/phosh/default.nix
@ -36,7 +36,7 @@

 stdenv.mkDerivation rec {
  pname = "phosh";
-  version = "0.31.1";
+  version = "0.32.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true; # including gvc and libcall-ui which are designated as subprojects
-    sha256 = "sha256-ZdZKymmOzhlJtsFl+ix5kERnfgjCggDpvDhL4vzS4mc=";
+    sha256 = "sha256-4LsB/7zKRkoxNQQVxwrSSIqGP7KQ0WHBnSVY+ClWTxo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/window-managers/picom/picom-allusive.nix
+++ b/pkgs/applications/window-managers/picom/picom-allusive.nix
@ -2,13 +2,13 @@

 picom.overrideAttrs (oldAttrs: rec {
  pname = "picom-allusive";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "allusive-dev";
    repo = "picom-allusive";
    rev = version;
-    hash = "sha256-lk4Ll0mi9h3BAqwgOzFQw4WYKnSW9XTl3PjoK2E4WKg=";
+    hash = "sha256-1zWntz2QKp/O9ZuOUZy9NkCNXFsBqRRvcd0SAr+7G/o=";
  };

  postInstall = ''
--- a/pkgs/by-name/fo/fortune-kind/package.nix
+++ b/pkgs/by-name/fo/fortune-kind/package.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "fortune-kind";
-  version = "0.1.3";
+  version = "0.1.4";

  src = fetchFromGitHub {
    owner = "cafkafk";
    repo = "fortune-kind";
    rev = "v${version}";
-    hash = "sha256-q4r1Qdyh2L1vTi+CKln+a9lKGgyRAhvg1aJRd0CIEJs=";
+    hash = "sha256-xIibKXca3RXQpRJyQ62GL7l24ovX4KXhdk2zK1gB98M=";
  };

-  cargoHash = "sha256-ArVOGWaKbge8nxxGpAT8TttFZYJpuFF5u/tHYC9Qkeo=";
+  cargoHash = "sha256-7JBT3EhwrcNITR5ocQkLoQw4/R7xAoplZ9I1cTs9DW8=";

  nativeBuildInputs = [ makeBinaryWrapper installShellFiles ];
  buildInputs = lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
--- a/pkgs/applications/emulators/ppsspp/default.nix
+++ b/pkgs/applications/emulators/ppsspp/default.nix
@ -34,14 +34,14 @@ stdenv.mkDerivation (finalAttrs: {
          + lib.optionalString enableQt "-qt"
          + lib.optionalString (!enableQt) "-sdl"
          + lib.optionalString forceWayland "-wayland";
-  version = "1.16.5";
+  version = "1.16.6";

  src = fetchFromGitHub {
    owner = "hrydgard";
    repo = "ppsspp";
    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    sha256 = "sha256-R4XJ/Rn1e7tWjYMztE/YQFlTEVGmt2izaLvLdycVCXQ=";
+    hash = "sha256-FCdYvYKcV+0TpQUSWiooNlTXKYtqbfnAWwjk7M8iF1Q=";
  };

  postPatch = ''
--- a/pkgs/by-name/up/uplosi/package.nix
+++ b/pkgs/by-name/up/uplosi/package.nix
@ -0,0 +1,31 @@
+{ lib
+, fetchFromGitHub
+, buildGo121Module
+}:
+buildGo121Module rec {
+  pname = "uplosi";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "edgelesssys";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-YhB0kx/rbHMHSPC2zWcBY7bD677btSCyPEgWY7yuxC4=";
+  };
+
+  vendorHash = "sha256-3WLDmw2rhmjrKJ8QXtARS9p8qFx17iwUnljwoUep2uc=";
+
+  CGO_ENABLED = "0";
+  ldflags = [ "-s" "-w" "-buildid=" "-X main.version=${version}" ];
+  flags = [ "-trimpath" ];
+
+  meta = with lib; {
+    description = "Upload OS images to cloud provider";
+    homepage = "https://github.com/edgelesssys/uplosi";
+    changelog = "https://github.com/edgelesssys/uplosi/releases/tag/v${version}";
+    license = licenses.asl20;
+    mainProgram = "uplosi";
+    maintainers = with maintainers; [ katexochen malt3 ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/by-name/wa/wayidle/package.nix
+++ b/pkgs/by-name/wa/wayidle/package.nix
@ -0,0 +1,27 @@
+{ lib
+, rustPlatform
+, fetchFromSourcehut
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "wayidle";
+  version = "0.1.1";
+
+  src = fetchFromSourcehut {
+    owner = "~whynothugo";
+    repo = "wayidle";
+    rev = "v${version}";
+    hash = "sha256-6wULrwGnXLdrX/THanJThbykKjNKpGukw9dj0jX0/dM=";
+  };
+
+  cargoHash = "sha256-zF2s3XSXnN7jVtv/0axzHiIJd/cb6wMYAOQILXp1U5U=";
+
+  meta = with lib; {
+    description = "Execute a program when a Wayland compositor reports being N seconds idle";
+    homepage = "https://git.sr.ht/~whynothugo/wayidle";
+    license = licenses.isc;
+    maintainers = with maintainers; [ tomfitzhenry ];
+    mainProgram = "wayidle";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/data/documentation/zeal/default.nix
+++ b/pkgs/data/documentation/zeal/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch2
 , cmake
 , extra-cmake-modules
 , pkg-config
@ -30,6 +31,16 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-s1FaazHVtWE697BO0hIOgZVowdkq68R9x327ZnJRnlo=";
  };

+  patches = [
+    # fix build with qt 6.6.0
+    # treewide: replace deprecated qAsConst with std::as_const()
+    # https://github.com/zealdocs/zeal/pull/1565
+    (fetchpatch2 {
+      url = "https://github.com/zealdocs/zeal/commit/d50a0115d58df2b222ede4c3a76b9686f4716465.patch";
+      hash = "sha256-Ub6RCZGpLSOjvK17Jrm+meZuZGXcC4kI3QYl5HbsLWU=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace CMakeLists.txt \
      --replace 'ZEAL_VERSION_SUFFIX "-dev"' 'ZEAL_VERSION_SUFFIX ""'
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@ -67,13 +67,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gnome-shell";
-  version = "44.4";
+  version = "44.5";

  outputs = [ "out" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-shell/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "HdUebujZL7y5XObd8Ruf7OiNImIsAQFf+pNgFpzUGGY=";
+    sha256 = "wWr84Dgd1ZNCfXCER6nR+sdInrApRe+zfpBMp0qSSjU=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@ -66,13 +66,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mutter";
-  version = "44.4";
+  version = "44.5";

  outputs = [ "out" "dev" "man" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
-    sha256 = "M3IKWGywqacyr1oH7RPj89MqGml4EjURQKVLygBrlAw=";
+    sha256 = "8kfg7WXrYvKwd1RtUoPtbUf0Ar2mpDFkE1AdjK7Slnk=";
  };

  mesonFlags = [
--- a/pkgs/development/compilers/jetbrains-jdk/default.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/default.nix
@ -27,6 +27,13 @@
 , udev
 }:

+let
+  arch = {
+    "aarch64-linux" = "aarch64";
+    "x86_64-linux" = "x64";
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  cpu = stdenv.hostPlatform.parsed.cpu.name;
+in
 openjdk17.overrideAttrs (oldAttrs: rec {
  pname = "jetbrains-jdk-jcef";
  javaVersion = "17.0.7";
@ -57,22 +64,22 @@ openjdk17.overrideAttrs (oldAttrs: rec {
  buildPhase = ''
    runHook preBuild

-    mkdir -p jcef_linux_x64/jmods
-    cp ${jetbrains.jcef}/* jcef_linux_x64/jmods
+    mkdir -p jcef_linux_${arch}/jmods
+    cp ${jetbrains.jcef}/* jcef_linux_${arch}/jmods

    sed \
        -e "s/OPENJDK_TAG=.*/OPENJDK_TAG=${openjdkTag}/" \
        -e "s/SOURCE_DATE_EPOCH=.*//" \
        -e "s/export SOURCE_DATE_EPOCH//" \
        -i jb/project/tools/common/scripts/common.sh
-    sed -i "s/STATIC_CONF_ARGS/STATIC_CONF_ARGS \$configureFlags/" jb/project/tools/linux/scripts/mkimages_x64.sh
+    sed -i "s/STATIC_CONF_ARGS/STATIC_CONF_ARGS \$configureFlags/" jb/project/tools/linux/scripts/mkimages_${arch}.sh
    sed \
        -e "s/create_image_bundle \"jb/#/" \
        -e "s/echo Creating /exit 0 #/" \
-        -i jb/project/tools/linux/scripts/mkimages_x64.sh
+        -i jb/project/tools/linux/scripts/mkimages_${arch}.sh

    patchShebangs .
-    ./jb/project/tools/linux/scripts/mkimages_x64.sh ${build} ${if debugBuild then "fd" else "jcef"}
+    ./jb/project/tools/linux/scripts/mkimages_${arch}.sh ${build} ${if debugBuild then "fd" else "jcef"}

    runHook postBuild
  '';
@ -84,9 +91,9 @@ openjdk17.overrideAttrs (oldAttrs: rec {
  in ''
    runHook preInstall

-    mv build/linux-x86_64-server-${buildType}/images/jdk/man build/linux-x86_64-server-${buildType}/images/jbrsdk${jcefSuffix}-${javaVersion}-linux-x64${debugSuffix}-b${build}
-    rm -rf build/linux-x86_64-server-${buildType}/images/jdk
-    mv build/linux-x86_64-server-${buildType}/images/jbrsdk${jcefSuffix}-${javaVersion}-linux-x64${debugSuffix}-b${build} build/linux-x86_64-server-${buildType}/images/jdk
+    mv build/linux-${cpu}-server-${buildType}/images/jdk/man build/linux-${cpu}-server-${buildType}/images/jbrsdk${jcefSuffix}-${javaVersion}-linux-${arch}${debugSuffix}-b${build}
+    rm -rf build/linux-${cpu}-server-${buildType}/images/jdk
+    mv build/linux-${cpu}-server-${buildType}/images/jbrsdk${jcefSuffix}-${javaVersion}-linux-${arch}${debugSuffix}-b${build} build/linux-${cpu}-server-${buildType}/images/jdk
  '' + oldAttrs.installPhase + "runHook postInstall";

  postInstall = ''
--- a/pkgs/development/compilers/jetbrains-jdk/jcef.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/jcef.nix
@ -73,6 +73,23 @@ let rpath = lib.makeLibraryPath [
 ];

 buildType = if debugBuild then "Debug" else "Release";
+platform = {
+  "aarch64-linux" = "linuxarm64";
+  "x86_64-linux" = "linux64";
+}.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+arches = {
+  "linuxarm64" = {
+    depsArch = "arm64";
+    projectArch = "arm64";
+    targetArch = "arm64";
+  };
+  "linux64" = {
+    depsArch = "amd64";
+    projectArch = "x86_64";
+    targetArch = "x86_64";
+  };
+}.${platform};
+inherit (arches) depsArch projectArch targetArch;

 in stdenv.mkDerivation rec {
  pname = "jcef-jetbrains";
@ -92,12 +109,15 @@ in stdenv.mkDerivation rec {
    hash = "sha256-3HuW8upR/bZoK8euVti2KpCZh9xxfqgyHmgoG1NjxOI=";
  };
  cef-bin = let
-    fileName = "cef_binary_111.2.1+g870da30+chromium-111.0.5563.64_linux64_minimal";
-    urlName = builtins.replaceStrings ["+"] ["%2B"] fileName;
-  in fetchzip rec {
-    name = fileName;
+    name = "cef_binary_111.2.1+g870da30+chromium-111.0.5563.64_${platform}_minimal";
+    hash = {
+      "linuxarm64" = "sha256-gCDIfWsysXE8lHn7H+YM3Jag+mdbWwTQpJf0GKdXEVs=";
+      "linux64" = "sha256-r+zXTmDN5s/bYLvbCnHufYdXIqQmCDlbWgs5pdOpLTw=";
+    }.${platform};
+    urlName = builtins.replaceStrings ["+"] ["%2B"] name;
+  in fetchzip {
    url = "https://cef-builds.spotifycdn.com/${urlName}.tar.bz2";
-    hash = "sha256-r+zXTmDN5s/bYLvbCnHufYdXIqQmCDlbWgs5pdOpLTw=";
+    inherit name hash;
  };
  clang-fmt = fetchurl {
    url = "https://storage.googleapis.com/chromium-clang-format/dd736afb28430c9782750fc0fd5f0ed497399263";
@ -128,7 +148,7 @@ in stdenv.mkDerivation rec {
    mkdir jcef_build
    cd jcef_build

-    cmake -G "Ninja" -DPROJECT_ARCH="x86_64" -DCMAKE_BUILD_TYPE=${buildType} ..
+    cmake -G "Ninja" -DPROJECT_ARCH="${projectArch}" -DCMAKE_BUILD_TYPE=${buildType} ..

    runHook postConfigure
  '';
@ -137,7 +157,7 @@ in stdenv.mkDerivation rec {

  postBuild = ''
    export JCEF_ROOT_DIR=$(realpath ..)
-    ../tools/compile.sh linux64 Release
+    ../tools/compile.sh ${platform} Release
  '';

  # Mostly taken from jb/tools/common/create_modules.sh
@ -148,8 +168,8 @@ in stdenv.mkDerivation rec {
    export OUT_NATIVE_DIR=$JCEF_ROOT_DIR/jcef_build/native/${buildType}
    export JB_TOOLS_DIR=$(realpath ../jb/tools)
    export JB_TOOLS_OS_DIR=$JB_TOOLS_DIR/linux
-    export OUT_CLS_DIR=$(realpath ../out/linux64)
-    export TARGET_ARCH=x86_64 DEPS_ARCH=amd64
+    export OUT_CLS_DIR=$(realpath ../out/${platform})
+    export TARGET_ARCH=${targetArch} DEPS_ARCH=${depsArch}
    export OS=linux
    export JOGAMP_DIR="$JCEF_ROOT_DIR"/third_party/jogamp/jar

@ -183,7 +203,11 @@ in stdenv.mkDerivation rec {
    jar uf gluegen-rt.jar module-info.class
    rm module-info.class module-info.java
    mkdir lib
+  ''
+  # see https://github.com/JetBrains/jcef/commit/f3b787e3326c1915d663abded7f055c0866f32ec
+  + lib.optionalString (platform != "linuxarm64") ''
    extract_jar "$JOGAMP_DIR"/gluegen-rt-natives-"$OS"-"$DEPS_ARCH".jar lib natives/"$OS"-"$DEPS_ARCH"
+  '' + ''

    cd ../jogl
    cp "$JOGAMP_DIR"/gluegen-rt.jar .
@ -193,7 +217,11 @@ in stdenv.mkDerivation rec {
    jar uf jogl-all.jar module-info.class
    rm module-info.class module-info.java
    mkdir lib
+  ''
+  # see https://github.com/JetBrains/jcef/commit/f3b787e3326c1915d663abded7f055c0866f32ec
+  + lib.optionalString (platform != "linuxarm64") ''
    extract_jar "$JOGAMP_DIR"/jogl-all-natives-"$OS"-"$DEPS_ARCH".jar lib natives/"$OS"-"$DEPS_ARCH"
+  '' + ''

    cd ../jcef
    cp "$OUT_CLS_DIR"/jcef.jar .
--- a/pkgs/development/compilers/purescript/purescript/default.nix
+++ b/pkgs/development/compilers/purescript/purescript/default.nix
@ -15,7 +15,7 @@ let

 in stdenv.mkDerivation rec {
  pname = "purescript";
-  version = "0.15.11";
+  version = "0.15.12";

  # These hashes can be updated automatically by running the ./update.sh script.
  src =
@ -25,17 +25,17 @@ in stdenv.mkDerivation rec {
      then
      fetchurl {
        url = "https://github.com/${pname}/${pname}/releases/download/v${version}/macos-arm64.tar.gz";
-        sha256 = "1ffhcwzb4cazxviqdl9zwg0jnbhsisg2pbxkqbk63zj2grjcpg86";
+        sha256 = "0s8j9svgxir0rb0wxkshwal60962g5z0pysdyrjgcr9r77y5gffk";
      }
      else
      fetchurl {
        url = "https://github.com/${pname}/${pname}/releases/download/v${version}/macos.tar.gz";
-        sha256 = "0h923269zb9hwlifcv8skz17zlggh8hsxhrgf33h2inl1midvgq5";
+        sha256 = "13d2mmphxy9f9yy242qsm58hipr612jymwy7lhf0is4y4m2lvrk2";
      })
    else
    fetchurl {
      url = "https://github.com/${pname}/${pname}/releases/download/v${version}/linux64.tar.gz";
-      sha256 = "0vrbgmgmmwbyxl969k59zkfrq5dxshspnzskx8zmhcy4flamz8av";
+      sha256 = "05xwplibkv86iiwpv29vg3zxp5yw7waw86zh08q3p0qx355wjy73";
    };


--- a/pkgs/development/compilers/tinygo/0002-Add-clang-header-path.patch
+++ b/pkgs/development/compilers/tinygo/0002-Add-clang-header-path.patch
@ -1,46 +1,25 @@
-diff --git a/builder/builtins.go b/builder/builtins.go
-index a1066b67..f4f8ca79 100644
--- a/builder/builtins.go
-+++ b/builder/builtins.go
-@@ -179,7 +179,7 @@ var avrBuiltins = []string{
- var CompilerRT = Library{
- 	name: "compiler-rt",
- 	cflags: func(target, headerPath string) []string {
-		return []string{"-Werror", "-Wall", "-std=c11", "-nostdlibinc"}
-+		return []string{"-Werror", "-Wall", "-std=c11", "-isystem", "@clang_include@"}
- 	},
- 	sourceDir: func() string {
- 		llvmDir := filepath.Join(goenv.Get("TINYGOROOT"), "llvm-project/compiler-rt/lib/builtins")
-diff --git a/builder/picolibc.go b/builder/picolibc.go
-index 1b7c748b..8a6b9ddd 100644
--- a/builder/picolibc.go
-+++ b/builder/picolibc.go
-@@ -32,7 +32,7 @@ var Picolibc = Library{
- 			"-D__OBSOLETE_MATH_FLOAT=1", // use old math code that doesn't expect a FPU
- 			"-D__OBSOLETE_MATH_DOUBLE=0",
- 			"-D_WANT_IO_C99_FORMATS",
-			"-nostdlibinc",
-+			"-isystem", "@clang_include@",
- 			"-isystem", newlibDir + "/libc/include",
- 			"-I" + newlibDir + "/libc/tinystdio",
- 			"-I" + newlibDir + "/libm/common",
+diff --git a/builder/library.go b/builder/library.go
+index 6517355b..b8de1894 100644
+--- a/builder/library.go
+++ b/builder/library.go
+@@ -142,7 +142,7 @@ func (l *Library) load(config *compileopts.Config, tmpdir string) (job *compileJ
+ 	// Note: -fdebug-prefix-map is necessary to make the output archive
+ 	// reproducible. Otherwise the temporary directory is stored in the archive
+ 	// itself, which varies each run.
+-	args := append(l.cflags(target, headerPath), "-c", "-Oz", "-gdwarf-4", "-ffunction-sections", "-fdata-sections", "-Wno-macro-redefined", "--target="+target, "-fdebug-prefix-map="+dir+"="+remapDir)
+	args := append(l.cflags(target, headerPath), "-c", "-Oz", "-gdwarf-4", "-ffunction-sections", "-fdata-sections", "-Wno-macro-redefined", "--target="+target, "-fdebug-prefix-map="+dir+"="+remapDir, "-isystem", "@clang_include@")
+ 	cpu := config.CPU()
+ 	if cpu != "" {
+ 		// X86 has deprecated the -mcpu flag, so we need to use -march instead.
 diff --git a/compileopts/config.go b/compileopts/config.go
-index 9a4bc310..424421ae 100644
+index 39fc4f2a..8711b5a8 100644
 --- a/compileopts/config.go
 +++ b/compileopts/config.go
-@@ -276,6 +276,7 @@ func (c *Config) CFlags() []string {
- 		path, _ := c.LibcPath("picolibc")
- 		cflags = append(cflags,
- 			"--sysroot="+path,
-+			"-isystem", "@clang_include@",
- 			"-isystem", filepath.Join(path, "include"), // necessary for Xtensa
- 			"-isystem", filepath.Join(picolibcDir, "include"),
- 			"-isystem", filepath.Join(picolibcDir, "tinystdio"),
-@@ -285,7 +286,6 @@ func (c *Config) CFlags() []string {
- 		path, _ := c.LibcPath("musl")
- 		arch := MuslArchitecture(c.Triple())
- 		cflags = append(cflags,
-			"-nostdlibinc",
- 			"-isystem", filepath.Join(path, "include"),
- 			"-isystem", filepath.Join(root, "lib", "musl", "arch", arch),
- 			"-isystem", filepath.Join(root, "lib", "musl", "include"),
+@@ -264,6 +264,7 @@ func (c *Config) CFlags() []string {
+ 	for _, flag := range c.Target.CFlags {
+ 		cflags = append(cflags, strings.ReplaceAll(flag, "{root}", goenv.Get("TINYGOROOT")))
+ 	}
+	cflags = append([]string{"-isystem", "@clang_include@"}, cflags...)
+ 	switch c.Target.Libc {
+ 	case "darwin-libSystem":
+ 		root := goenv.Get("TINYGOROOT")
--- a/pkgs/development/compilers/tinygo/default.nix
+++ b/pkgs/development/compilers/tinygo/default.nix
@ -54,6 +54,15 @@ buildGoModule rec {
  patches = [
    ./0001-Makefile.patch

+    # clang.cc does not have any paths in the include path.
+    # For TinyGo, we want to have no include paths, _except_ for the built-in
+    # Clang header files (things like stdint.h). That's why we use -nostdlibinc.
+    # So to make Clang work like we want, we will have to manually add this one
+    # include path.
+    # We can't use a regular clang command (something like
+    # llvmPackages.clangUseLLVM) because there are various bugs, see:
+    # https://github.com/NixOS/nixpkgs/issues/259397
+    # https://github.com/NixOS/nixpkgs/issues/259386
    (substituteAll {
      src = ./0002-Add-clang-header-path.patch;
      clang_include = "${clang.cc.lib}/lib/clang/${llvmMajor}/include";
@ -108,10 +117,9 @@ buildGoModule rec {
    substituteInPlace builder/buildid.go \
      --replace "OUT_PATH" "$out"

-    # TODO: Fix mingw and darwin
-    # Disable windows and darwin cross-compile tests
+    # TODO: Fix mingw
+    # Disable windows cross-compile tests
    sed -i "/GOOS=windows/d" Makefile
-    sed -i "/GOOS=darwin/d" Makefile
  '' + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
    substituteInPlace Makefile \
      --replace "./build/tinygo" "${buildPackages.tinygo}/bin/tinygo"
--- a/pkgs/development/coq-modules/iris/default.nix
+++ b/pkgs/development/coq-modules/iris/default.nix
@ -6,11 +6,13 @@ mkCoqDerivation rec {
  owner = "iris";
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.16" "8.18"; out = "4.1.0"; }
    { case = range "8.13" "8.17"; out = "4.0.0"; }
    { case = range "8.12" "8.14"; out = "3.5.0"; }
    { case = range "8.11" "8.13"; out = "3.4.0"; }
    { case = range "8.9"  "8.10"; out = "3.3.0"; }
  ] null;
+  release."4.1.0".sha256 = "sha256-nTZUeZOXiH7HsfGbMKDE7vGrNVCkbMaWxdMWUcTUNlo=";
  release."4.0.0".sha256 = "sha256-Jc9TmgGvkiDaz9IOoExyeryU1E+Q37GN24NIM397/Gg=";
  release."3.6.0".sha256 = "sha256:02vbq597fjxd5znzxdb54wfp36412wz2d4yash4q8yddgl1kakmj";
  release."3.5.0".sha256 = "0hh14m0anfcv65rxm982ps2vp95vk9fwrpv4br8bxd9vz0091d70";
@ -29,6 +31,6 @@ mkCoqDerivation rec {
  meta = with lib; {
    description = "The Coq development of the Iris Project";
    license = licenses.bsd3;
-    maintainers = [ maintainers.vbgl ];
+    maintainers = [ maintainers.vbgl maintainers.ineol ];
  };
 }
--- a/pkgs/development/coq-modules/stdpp/default.nix
+++ b/pkgs/development/coq-modules/stdpp/default.nix
@ -6,11 +6,13 @@ mkCoqDerivation rec {
  domain = "gitlab.mpi-sws.org";
  owner = "iris";
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.16" "8.18"; out = "1.9.0"; }
    { case = range "8.13" "8.17"; out = "1.8.0"; }
    { case = range "8.12" "8.14"; out = "1.6.0"; }
    { case = range "8.11" "8.13"; out = "1.5.0"; }
    { case = range "8.8" "8.10";  out = "1.4.0"; }
  ] null;
+  release."1.9.0".sha256 = "sha256-OXeB+XhdyzWMp5Karsz8obp0rTeMKrtG7fu/tmc9aeI=";
  release."1.8.0".sha256 = "sha256-VkIGBPHevHeHCo/Q759Q7y9WyhSF/4SMht4cOPuAXHU=";
  release."1.7.0".sha256 = "sha256:0447wbzm23f9rl8byqf6vglasfn6c1wy6cxrrwagqjwsh3i5lx8y";
  release."1.6.0".sha256 = "1l1w6srzydjg0h3f4krrfgvz455h56shyy2lbcnwdbzjkahibl7v";
@ -27,6 +29,6 @@ mkCoqDerivation rec {
  meta = with lib; {
    description = "An extended “Standard Library” for Coq";
    license = licenses.bsd3;
-    maintainers = [ maintainers.vbgl ];
+    maintainers = [ maintainers.vbgl maintainers.ineol ];
  };
 }
--- a/pkgs/development/libraries/alkimia/default.nix
+++ b/pkgs/development/libraries/alkimia/default.nix
@ -5,18 +5,18 @@

 mkDerivation rec {
  pname = "alkimia";
-  version = "8.1.1";
+  version = "8.1.2";

  src = fetchurl {
    url = "mirror://kde/stable/alkimia/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-lXrcY8C+VN1DPjJoo3MjvlRW5auE7OJ/c6FhapLbhtU=";
+    sha256 = "sha256-z4Ru6HucxjD1jgvdIzNCloELo7zBdR/i9HIhYYl+4zo=";
  };

  nativeBuildInputs = [ extra-cmake-modules doxygen graphviz ];

  # qtwebengine is not a mandatory dependency, but it adds some features
  # we might need for alkimia's dependents. See:
-  # https://github.com/KDE/alkimia/blob/v8.1.1/CMakeLists.txt#L124
+  # https://github.com/KDE/alkimia/blob/v8.1.2/CMakeLists.txt#L124
  buildInputs = [ qtbase qtwebengine kdelibs4support plasma-framework knewstuff kpackage ];
  propagatedBuildInputs = [ mpir ];

--- a/pkgs/development/libraries/at-spi2-core/default.nix
+++ b/pkgs/development/libraries/at-spi2-core/default.nix
@ -7,7 +7,7 @@
 , pkg-config
 , gobject-introspection
 , buildPackages
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , gsettings-desktop-schemas
 , makeWrapper
 , dbus
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@ -19,7 +19,7 @@
 , lib
 , testers
 , buildPackages
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , gobject-introspection
 }:

--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@ -158,6 +158,7 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = teams.gnome.members ++ (with maintainers; [ lovek323 artturin ]);
    pkgConfigModules = [ "gobject-introspection-1.0" ];
    platforms = platforms.unix;
+    badPlatforms = [ lib.systems.inspect.platformPatterns.isStatic ];
    license = with licenses; [ gpl2 lgpl2 ];

    longDescription = ''
--- a/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
+++ b/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
@ -4,7 +4,7 @@
 , glib
 , gobject-introspection
 , buildPackages
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , meson
 , ninja
  # just for passthru
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@ -23,7 +23,7 @@
 , at-spi2-atk
 , gobject-introspection
 , buildPackages
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , compileSchemas ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , fribidi
 , xorg
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@ -11,7 +11,7 @@
 , ninja
 , gobject-introspection
 , buildPackages
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , icu
 , graphite2
 , harfbuzz # The icu variant uses and propagates the non-icu one.
--- a/pkgs/development/libraries/igraph/default.nix
+++ b/pkgs/development/libraries/igraph/default.nix
@ -37,6 +37,10 @@ stdenv.mkDerivation (finalAttrs: {

  postPatch = ''
    echo "${finalAttrs.version}" > IGRAPH_VERSION
+  ''
+  # https://github.com/igraph/igraph/issues/2340
+  + lib.optionalString stdenv.isDarwin ''
+    sed -i "/safelocale/d" tests/CMakeLists.txt
  '';

  outputs = [ "out" "dev" "doc" ];
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@ -7,7 +7,7 @@
 , nixosTests
 , pkg-config
 , gettext
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , buildPackages
 , gobject-introspection
 , gi-docgen
--- a/pkgs/development/libraries/libcouchbase/default.nix
+++ b/pkgs/development/libraries/libcouchbase/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libcouchbase";
-  version = "3.3.8";
+  version = "3.3.9";

  src = fetchFromGitHub {
    owner = "couchbase";
    repo = "libcouchbase";
    rev = version;
-    sha256 = "sha256-4484PH2+4uvCSSPw9vecoCeGda8ELxoOW6mtIfuUC+U=";
+    sha256 = "sha256-dvXRbAdgb1WmKLijYkx6+js60ZxK1Tl2aTFSF7EpN74=";
  };

  cmakeFlags = [ "-DLCB_NO_MOCK=ON" ];
--- a/pkgs/development/libraries/libgpiod/default.nix
+++ b/pkgs/development/libraries/libgpiod/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "libgpiod";
-  version = "2.0.1";
+  version = "2.0.2";

  src = fetchurl {
    url = "https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/snapshot/libgpiod-${version}.tar.gz";
-    hash = "sha256-tu2lU1YWCo5zkG49SOlZ74EpZ4fXZJdbEPJX6WYGaOk=";
+    hash = "sha256-NTLh26/9wsWWWnYaB1DyaR7kmq0nPdu9k6z2pyextlw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libmanette/default.nix
+++ b/pkgs/development/libraries/libmanette/default.nix
@ -7,7 +7,7 @@
 , vala
 , gobject-introspection
 , buildPackages
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , gtk-doc
 , docbook-xsl-nons
 , docbook_xml_dtd_43
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@ -12,7 +12,7 @@
 , bash-completion
 , bash
 , buildPackages
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , withDocs ? stdenv.hostPlatform == stdenv.buildPlatform
 , gobject-introspection
 }:
--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@ -9,7 +9,7 @@
 , gdk-pixbuf
 , gnome
 , buildPackages
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , gobject-introspection
 }:

--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@ -17,7 +17,7 @@
 , libmbim
 , libqrtr-glib
 , buildPackages
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , withMan ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
 }:

--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@ -22,7 +22,7 @@
 , gnome
 , vala
 , writeScript
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , buildPackages
 , gobject-introspection
 , _experimental-update-script-combinators
--- a/pkgs/development/libraries/libsecret/default.nix
+++ b/pkgs/development/libraries/libsecret/default.nix
@ -13,7 +13,7 @@
 , libgcrypt
 , gobject-introspection
 , buildPackages
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , vala
 , gi-docgen
 , gnome
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@ -11,7 +11,7 @@
 , glib-networking
 , buildPackages
 , gobject-introspection
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , vala
 , libpsl
 , python3
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@ -16,7 +16,7 @@
 , sqlite
 , glib-networking
 , buildPackages
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 }:

 stdenv.mkDerivation rec {
--- a/pkgs/development/libraries/libvirt-glib/default.nix
+++ b/pkgs/development/libraries/libvirt-glib/default.nix
@ -11,7 +11,7 @@
 , libvirt
 , libxml2
 , buildPackages
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , gobject-introspection
 , withDocs ? stdenv.hostPlatform == stdenv.buildPlatform
 , gtk-doc
--- a/pkgs/development/libraries/nco/default.nix
+++ b/pkgs/development/libraries/nco/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nco";
-  version = "5.1.7";
+  version = "5.1.8";

  src = fetchFromGitHub {
    owner = "nco";
    repo = "nco";
    rev = finalAttrs.version;
-    hash = "sha256-CdIZ0ql8QBM7UcEyTmt4P9gZyO8jrkLipAOsJUkpG8g=";
+    hash = "sha256-ASZyvcP9XVFPf7nTsBx5E+D/7fWzUslPZrmhhNY5DzQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/numcpp/default.nix
+++ b/pkgs/development/libraries/numcpp/default.nix
@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "numcpp";
-  version = "2.11.0";
+  version = "2.12.0";

  src = fetchFromGitHub {
    owner = "dpilger26";
    repo = "NumCpp";
    rev = "Version_${finalAttrs.version}";
-    hash = "sha256-IAku1bcaMkawZxpQbvxcS6VX07ogw4UGo1DX2Wa8xwU=";
+    hash = "sha256-HeT2zZbULXZhmgquQTl3qHL0T50IIUf3oAZaEDIcAys=";
  };

  nativeCheckInputs = [gtest python3];
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@ -17,7 +17,7 @@
 , glib
 , python3
 , x11Support? !stdenv.isDarwin, libXft
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , buildPackages, gobject-introspection
 }:

--- a/Show More
+++ b/Show More