Merge master into haskell-updates

2025-04-16 07:58:20 +00:00 · 2023-09-27 00:12:00 +00:00 · 2023-09-27 00:12:00 +00:00 · 9290456dd6
commit 9290456dd6
parent a1486d7898 647a8a5b57
203 changed files with 6713 additions and 10452 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -759,6 +759,12 @@
    github = "Alexnortung";
    githubId = 1552267;
  };
+  alexoundos = {
+    email = "alexoundos@gmail.com";
+    github = "AleXoundOS";
+    githubId = 464913;
+    name = "Alexander Tomokhov";
+  };
  alexshpilkin = {
    email = "ashpilkin@gmail.com";
    github = "alexshpilkin";
@ -11409,6 +11415,12 @@
    githubId = 43088426;
    name = "Mihnea Stoian";
  };
+  mikaelfangel = {
+    email = "nixpkgs.bottle597@passfwd.com";
+    github = "MikaelFangel";
+    githubId = 34864484;
+    name = "Mikael Fangel";
+  };
  mikefaille = {
    email = "michael@faille.io";
    github = "mikefaille";
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -41,6 +41,8 @@

 - [GoToSocial](https://gotosocial.org/), an ActivityPub social network server, written in Golang. Available as [services.gotosocial](#opt-services.gotosocial.enable).

+- [Castopod](https://castopod.org/), an open-source hosting platform made for podcasters who want to engage and interact with their audience. Available as [services.castopod](#opt-services.castopod.enable).
+
 - [Typesense](https://github.com/typesense/typesense), a fast, typo-tolerant search engine for building delightful search experiences. Available as [services.typesense](#opt-services.typesense.enable).

 * [NS-USBLoader](https://github.com/developersu/ns-usbloader/), an all-in-one tool for managing Nintendo Switch homebrew. Available as [programs.ns-usbloader](#opt-programs.ns-usbloader.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -324,6 +324,7 @@
  ./services/amqp/rabbitmq.nix
  ./services/audio/alsa.nix
  ./services/audio/botamusique.nix
+  ./services/audio/castopod.nix
  ./services/audio/gmediarender.nix
  ./services/audio/gonic.nix
  ./services/audio/goxlr-utility.nix
--- a/nixos/modules/services/audio/castopod.md
+++ b/nixos/modules/services/audio/castopod.md
@ -0,0 +1,22 @@
+# Castopod {#module-services-castopod}
+
+Castopod is an open-source hosting platform made for podcasters who want to engage and interact with their audience.
+
+## Quickstart {#module-services-castopod-quickstart}
+
+Use the following configuration to start a public instance of Castopod on `castopod.example.com` domain:
+
+```nix
+networking.firewall.allowedTCPPorts = [ 80 443 ];
+services.castopod = {
+  enable = true;
+  database.createLocally = true;
+  nginx.virtualHost = {
+    serverName = "castopod.example.com";
+    enableACME = true;
+    forceSSL = true;
+  };
+};
+```
+
+Go to `https://castopod.example.com/cp-install` to create superadmin account after applying the above configuration.
--- a/nixos/modules/services/audio/castopod.nix
+++ b/nixos/modules/services/audio/castopod.nix
@ -0,0 +1,287 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.castopod;
+  fpm = config.services.phpfpm.pools.castopod;
+
+  user = "castopod";
+  stateDirectory = "/var/lib/castopod";
+
+  # https://docs.castopod.org/getting-started/install.html#requirements
+  phpPackage = pkgs.php.withExtensions ({ enabled, all }: with all; [
+    intl
+    curl
+    mbstring
+    gd
+    exif
+    mysqlnd
+  ] ++ enabled);
+in
+{
+  meta.doc = ./castopod.md;
+  meta.maintainers = with lib.maintainers; [ alexoundos misuzu ];
+
+  options.services = {
+    castopod = {
+      enable = lib.mkEnableOption (lib.mdDoc "Castopod");
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.castopod;
+        defaultText = lib.literalMD "pkgs.castopod";
+        description = lib.mdDoc "Which Castopod package to use.";
+      };
+      database = {
+        createLocally = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = lib.mdDoc ''
+            Create the database and database user locally.
+          '';
+        };
+        hostname = lib.mkOption {
+          type = lib.types.str;
+          default = "localhost";
+          description = lib.mdDoc "Database hostname.";
+        };
+        name = lib.mkOption {
+          type = lib.types.str;
+          default = "castopod";
+          description = lib.mdDoc "Database name.";
+        };
+        user = lib.mkOption {
+          type = lib.types.str;
+          default = user;
+          description = lib.mdDoc "Database user.";
+        };
+        passwordFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          example = "/run/keys/castopod-dbpassword";
+          description = lib.mdDoc ''
+            A file containing the password corresponding to
+            [](#opt-services.castopod.database.user).
+          '';
+        };
+      };
+      settings = lib.mkOption {
+        type = with lib.types; attrsOf (oneOf [ str int bool ]);
+        default = { };
+        example = {
+          "email.protocol" = "smtp";
+          "email.SMTPHost" = "localhost";
+          "email.SMTPUser" = "myuser";
+          "email.fromEmail" = "castopod@example.com";
+        };
+        description = lib.mdDoc ''
+          Environment variables used for Castopod.
+          See [](https://code.castopod.org/adaures/castopod/-/blob/main/.env.example)
+          for available environment variables.
+        '';
+      };
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        example = "/run/keys/castopod-env";
+        description = lib.mdDoc ''
+          Environment file to inject e.g. secrets into the configuration.
+          See [](https://code.castopod.org/adaures/castopod/-/blob/main/.env.example)
+          for available environment variables.
+        '';
+      };
+      configureNginx = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = lib.mdDoc "Configure nginx as a reverse proxy for CastoPod.";
+      };
+      localDomain = lib.mkOption {
+        type = lib.types.str;
+        example = "castopod.example.org";
+        description = lib.mdDoc "The domain serving your CastoPod instance.";
+      };
+      poolSettings = lib.mkOption {
+        type = with lib.types; attrsOf (oneOf [ str int bool ]);
+        default = {
+          "pm" = "dynamic";
+          "pm.max_children" = "32";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "2";
+          "pm.max_spare_servers" = "4";
+          "pm.max_requests" = "500";
+        };
+        description = lib.mdDoc ''
+          Options for Castopod's PHP pool. See the documentation on `php-fpm.conf` for details on configuration directives.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.castopod.settings =
+      let
+        sslEnabled = with config.services.nginx.virtualHosts.${cfg.localDomain}; addSSL || forceSSL || onlySSL || enableACME || useACMEHost != null;
+        baseURL = "http${lib.optionalString sslEnabled "s"}://${cfg.localDomain}";
+      in
+      lib.mapAttrs (name: lib.mkDefault) {
+        "app.forceGlobalSecureRequests" = sslEnabled;
+        "app.baseURL" = baseURL;
+
+        "media.baseURL" = "/";
+        "media.root" = "media";
+        "media.storage" = stateDirectory;
+
+        "admin.gateway" = "admin";
+        "auth.gateway" = "auth";
+
+        "database.default.hostname" = cfg.database.hostname;
+        "database.default.database" = cfg.database.name;
+        "database.default.username" = cfg.database.user;
+        "database.default.DBPrefix" = "cp_";
+
+        "cache.handler" = "file";
+      };
+
+    services.phpfpm.pools.castopod = {
+      inherit user;
+      group = config.services.nginx.group;
+      phpPackage = phpPackage;
+      phpOptions = ''
+        # https://code.castopod.org/adaures/castopod/-/blob/main/docker/production/app/uploads.ini
+        file_uploads = On
+        memory_limit = 512M
+        upload_max_filesize = 500M
+        post_max_size = 512M
+        max_execution_time = 300
+        max_input_time = 300
+      '';
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+      } // cfg.poolSettings;
+    };
+
+    systemd.services.castopod-setup = {
+      after = lib.optional config.services.mysql.enable "mysql.service";
+      requires = lib.optional config.services.mysql.enable "mysql.service";
+      wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.openssl phpPackage ];
+      script =
+        let
+          envFile = "${stateDirectory}/.env";
+          media = "${cfg.settings."media.storage"}/${cfg.settings."media.root"}";
+        in
+        ''
+          mkdir -p ${stateDirectory}/writable/{cache,logs,session,temp,uploads}
+
+          if [ ! -d ${lib.escapeShellArg media} ]; then
+            cp --no-preserve=mode,ownership -r ${cfg.package}/share/castopod/public/media ${lib.escapeShellArg media}
+          fi
+
+          if [ ! -f ${stateDirectory}/salt ]; then
+            openssl rand -base64 33 > ${stateDirectory}/salt
+          fi
+
+          cat <<'EOF' > ${envFile}
+          ${lib.generators.toKeyValue { } cfg.settings}
+          EOF
+
+          echo "analytics.salt=$(cat ${stateDirectory}/salt)" >> ${envFile}
+
+          ${if (cfg.database.passwordFile != null) then ''
+            echo "database.default.password=$(cat ${lib.escapeShellArg cfg.database.passwordFile})" >> ${envFile}
+          '' else ''
+            echo "database.default.password=" >> ${envFile}
+          ''}
+
+          ${lib.optionalString (cfg.environmentFile != null) ''
+            cat ${lib.escapeShellArg cfg.environmentFile}) >> ${envFile}
+          ''}
+
+          php spark castopod:database-update
+        '';
+      serviceConfig = {
+        StateDirectory = "castopod";
+        WorkingDirectory = "${cfg.package}/share/castopod";
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = user;
+        Group = config.services.nginx.group;
+      };
+    };
+
+    systemd.services.castopod-scheduled = {
+      after = [ "castopod-setup.service" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ phpPackage ];
+      script = ''
+        php public/index.php scheduled-activities
+        php public/index.php scheduled-websub-publish
+        php public/index.php scheduled-video-clips
+      '';
+      serviceConfig = {
+        StateDirectory = "castopod";
+        WorkingDirectory = "${cfg.package}/share/castopod";
+        Type = "oneshot";
+        User = user;
+        Group = config.services.nginx.group;
+      };
+    };
+
+    systemd.timers.castopod-scheduled = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "*-*-* *:*:00";
+        Unit = "castopod-scheduled.service";
+      };
+    };
+
+    services.mysql = lib.mkIf cfg.database.createLocally {
+      enable = true;
+      package = lib.mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [{
+        name = cfg.database.user;
+        ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+      }];
+    };
+
+    services.nginx = lib.mkIf cfg.configureNginx {
+      enable = true;
+      virtualHosts."${cfg.localDomain}" = {
+        root = lib.mkForce "${cfg.package}/share/castopod/public";
+
+        extraConfig = ''
+          try_files $uri $uri/ /index.php?$args;
+          index index.php index.html;
+        '';
+
+        locations."^~ /${cfg.settings."media.root"}/" = {
+          root = cfg.settings."media.storage";
+          extraConfig = ''
+            add_header Access-Control-Allow-Origin "*";
+            expires max;
+            access_log off;
+          '';
+        };
+
+        locations."~ \.php$" = {
+          fastcgiParams = {
+            SERVER_NAME = "$host";
+          };
+          extraConfig = ''
+            fastcgi_intercept_errors on;
+            fastcgi_index index.php;
+            fastcgi_pass unix:${fpm.socket};
+            try_files $uri =404;
+            fastcgi_read_timeout 3600;
+            fastcgi_send_timeout 3600;
+          '';
+        };
+      };
+    };
+
+    users.users.${user} = lib.mapAttrs (name: lib.mkDefault) {
+      description = "Castopod user";
+      isSystemUser = true;
+      group = config.services.nginx.group;
+    };
+  };
+}
--- a/nixos/modules/services/hardware/kanata.nix
+++ b/nixos/modules/services/hardware/kanata.nix
@ -9,8 +9,14 @@ let
    options = {
      devices = mkOption {
        type = types.listOf types.str;
+        default = [ ];
        example = [ "/dev/input/by-id/usb-0000_0000-event-kbd" ];
-        description = mdDoc "Paths to keyboard devices.";
+        description = mdDoc ''
+          Paths to keyboard devices.
+
+          An empty list, the default value, lets kanata detect which
+          input devices are keyboards and intercept them all.
+        '';
      };
      config = mkOption {
        type = types.lines;
@ -162,6 +168,14 @@ in
  };

  config = mkIf cfg.enable {
+    warnings =
+      let
+        keyboardsWithEmptyDevices = filterAttrs (name: keyboard: keyboard.devices == [ ]) cfg.keyboards;
+        existEmptyDevices = length (attrNames keyboardsWithEmptyDevices) > 0;
+        moreThanOneKeyboard = length (attrNames cfg.keyboards) > 1;
+      in
+      optional (existEmptyDevices && moreThanOneKeyboard) "One device can only be intercepted by one kanata instance.  Setting services.kanata.keyboards.${head (attrNames keyboardsWithEmptyDevices)}.devices = [ ] and using more than one services.kanata.keyboards may cause a race condition.";
+
    hardware.uinput.enable = true;

    systemd.services = mapAttrs' mkService cfg.keyboards;
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@ -164,6 +164,15 @@ let
          of the wireguard network has to be adjusted as well.
        '';
      };
+
+      metric = mkOption {
+        default = null;
+        type = with types; nullOr int;
+        example = 700;
+        description = lib.mdDoc ''
+          Set the metric of routes related to this Wireguard interface.
+        '';
+      };
    };

  };
@ -395,7 +404,7 @@ let
            optionalString interfaceCfg.allowedIPsAsRoutes
              (concatMapStringsSep "\n"
                (allowedIP:
-                  ''${ip} route replace "${allowedIP}" dev "${interfaceName}" table "${interfaceCfg.table}"''
+                  ''${ip} route replace "${allowedIP}" dev "${interfaceName}" table "${interfaceCfg.table}" ${optionalString (interfaceCfg.metric != null) "metric ${toString interfaceCfg.metric}"}''
                ) peer.allowedIPs);
        in ''
          ${wg_setup}
--- a/nixos/modules/services/web-apps/peering-manager.nix
+++ b/nixos/modules/services/web-apps/peering-manager.nix
@ -2,40 +2,15 @@

 let
  cfg = config.services.peering-manager;
-  configFile = pkgs.writeTextFile {
-    name = "configuration.py";
-    text = ''
-      ALLOWED_HOSTS = ['*']
-      DATABASE = {
-        'NAME': 'peering-manager',
-        'USER': 'peering-manager',
-        'HOST': '/run/postgresql',
-      }

-      # Redis database settings. Redis is used for caching and for queuing background tasks such as webhook events. A separate
-      # configuration exists for each. Full connection details are required in both sections, and it is strongly recommended
-      # to use two separate database IDs.
-      REDIS = {
-        'tasks': {
-          'UNIX_SOCKET_PATH': '${config.services.redis.servers.peering-manager.unixSocket}',
-          'DATABASE': 0,
-        },
-        'caching': {
-          'UNIX_SOCKET_PATH': '${config.services.redis.servers.peering-manager.unixSocket}',
-          'DATABASE': 1,
-        }
-      }
-
-      with open("${cfg.secretKeyFile}", "r") as file:
-        SECRET_KEY = file.readline()
-    '' + lib.optionalString (cfg.peeringdbApiKeyFile != null) ''
-      with open("${cfg.peeringdbApiKeyFile}", "r") as file:
-        PEERINGDB_API_KEY = file.readline()
-    '' + ''
-
-      ${cfg.extraConfig}
-    '';
+  pythonFmt = pkgs.formats.pythonVars {};
+  settingsFile = pythonFmt.generate "peering-manager-settings.py" cfg.settings;
+  extraConfigFile = pkgs.writeTextFile {
+    name = "peering-manager-extraConfig.py";
+    text = cfg.extraConfig;
  };
+  configFile = pkgs.concatText "configuration.py" [ settingsFile extraConfigFile ];
+
  pkg = (pkgs.peering-manager.overrideAttrs (old: {
    postInstall = ''
      ln -s ${configFile} $out/opt/peering-manager/peering_manager/configuration.py
@ -106,6 +81,30 @@ in {
      '';
    };

+    settings = lib.mkOption {
+      description = lib.mdDoc ''
+        Configuration options to set in `configuration.py`.
+        See the [documentation](https://peering-manager.readthedocs.io/en/stable/configuration/optional-settings/) for more possible options.
+      '';
+
+      default = { };
+
+      type = lib.types.submodule {
+        freeformType = pythonFmt.type;
+
+        options = {
+          ALLOWED_HOSTS = lib.mkOption {
+            type = with lib.types; listOf str;
+            default = ["*"];
+            description = lib.mdDoc ''
+              A list of valid fully-qualified domain names (FQDNs) and/or IP
+              addresses that can be used to reach the peering manager service.
+            '';
+          };
+        };
+      };
+    };
+
    extraConfig = mkOption {
      type = types.lines;
      default = "";
@ -135,7 +134,39 @@ in {
  };

  config = lib.mkIf cfg.enable {
-    services.peering-manager.plugins = lib.mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+    services.peering-manager = {
+      settings = {
+        DATABASE = {
+          NAME = "peering-manager";
+          USER = "peering-manager";
+          HOST = "/run/postgresql";
+        };
+
+        # Redis database settings. Redis is used for caching and for queuing background tasks such as webhook events. A separate
+        # configuration exists for each. Full connection details are required in both sections, and it is strongly recommended
+        # to use two separate database IDs.
+        REDIS = {
+          tasks = {
+            UNIX_SOCKET_PATH = config.services.redis.servers.peering-manager.unixSocket;
+            DATABASE = 0;
+          };
+          caching = {
+            UNIX_SOCKET_PATH = config.services.redis.servers.peering-manager.unixSocket;
+            DATABASE = 1;
+          };
+        };
+      };
+
+      extraConfig = ''
+        with open("${cfg.secretKeyFile}", "r") as file:
+          SECRET_KEY = file.readline()
+      '' + lib.optionalString (cfg.peeringdbApiKeyFile != null) ''
+        with open("${cfg.peeringdbApiKeyFile}", "r") as file:
+          PEERINGDB_API_KEY = file.readline()
+      '';
+
+      plugins = lib.mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+    };

    system.build.peeringManagerPkg = pkg;

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -158,6 +158,7 @@ in {
  cagebreak = handleTest ./cagebreak.nix {};
  calibre-web = handleTest ./calibre-web.nix {};
  calibre-server = handleTest ./calibre-server.nix {};
+  castopod = handleTest ./castopod.nix {};
  cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; };
  cassandra_3_11 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_11; };
  cassandra_4 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_4; };
--- a/nixos/tests/castopod.nix
+++ b/nixos/tests/castopod.nix
@ -0,0 +1,87 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+{
+  name = "castopod";
+  meta = with lib.maintainers; {
+    maintainers = [ alexoundos misuzu ];
+  };
+  nodes.castopod = { nodes, ... }: {
+    networking.firewall.allowedTCPPorts = [ 80 ];
+    networking.extraHosts = ''
+      127.0.0.1 castopod.example.com
+    '';
+    services.castopod = {
+      enable = true;
+      database.createLocally = true;
+      localDomain = "castopod.example.com";
+    };
+    environment.systemPackages =
+      let
+        username = "admin";
+        email = "admin@castood.example.com";
+        password = "v82HmEp5";
+        testRunner = pkgs.writers.writePython3Bin "test-runner"
+          {
+            libraries = [ pkgs.python3Packages.selenium ];
+            flakeIgnore = [
+              "E501"
+            ];
+          } ''
+          from selenium.webdriver.common.by import By
+          from selenium.webdriver import Firefox
+          from selenium.webdriver.firefox.options import Options
+          from selenium.webdriver.support.ui import WebDriverWait
+          from selenium.webdriver.support import expected_conditions as EC
+
+          options = Options()
+          options.add_argument('--headless')
+          driver = Firefox(options=options)
+          try:
+              driver.implicitly_wait(20)
+              driver.get('http://castopod.example.com/cp-install')
+
+              wait = WebDriverWait(driver, 10)
+
+              wait.until(EC.title_contains("installer"))
+
+              driver.find_element(By.CSS_SELECTOR, '#username').send_keys(
+                  '${username}'
+              )
+              driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
+                  '${email}'
+              )
+              driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
+                  '${password}'
+              )
+              driver.find_element(By.XPATH, "//button[contains(., 'Finish install')]").click()
+
+              wait.until(EC.title_contains("Auth"))
+
+              driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
+                  '${email}'
+              )
+              driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
+                  '${password}'
+              )
+              driver.find_element(By.XPATH, "//button[contains(., 'Login')]").click()
+
+              wait.until(EC.title_contains("Admin dashboard"))
+          finally:
+              driver.close()
+              driver.quit()
+        '';
+      in
+      [ pkgs.firefox-unwrapped pkgs.geckodriver testRunner ];
+  };
+  testScript = ''
+    start_all()
+    castopod.wait_for_unit("castopod-setup.service")
+    castopod.wait_for_file("/run/phpfpm/castopod.sock")
+    castopod.wait_for_unit("nginx.service")
+    castopod.wait_for_open_port(80)
+    castopod.wait_until_succeeds("curl -sS -f http://castopod.example.com")
+    castopod.succeed("curl -s http://localhost/cp-install | grep 'Create your Super Admin account' > /dev/null")
+
+    with subtest("Create superadmin and log in"):
+        castopod.succeed("PYTHONUNBUFFERED=1 test-runner | systemd-cat -t test-runner")
+  '';
+})
--- a/pkgs/applications/audio/castopod/default.nix
+++ b/pkgs/applications/audio/castopod/default.nix
@ -0,0 +1,53 @@
+{ stdenv
+, fetchurl
+, ffmpeg-headless
+, lib
+, nixosTests
+, stateDirectory ? "/var/lib/castopod"
+}:
+stdenv.mkDerivation {
+  pname = "castopod";
+  version = "1.6.4";
+
+  src = fetchurl {
+    url = "https://code.castopod.org/adaures/castopod/uploads/ce56d4f149242f12bedd20f9a2b0916d/castopod-1.6.4.tar.gz";
+    sha256 = "080jj91yxbn3xsbs0sywzwa2f5in9bp9qi2zwqcfqpaxlq9ga62v";
+  };
+
+  dontBuild = true;
+  dontFixup = true;
+
+  postPatch = ''
+    # not configurable at runtime unfortunately:
+    substituteInPlace app/Config/Paths.php \
+      --replace "__DIR__ . '/../../writable'" "'${stateDirectory}/writable'"
+
+    # configuration file must be writable, place it to ${stateDirectory}
+    substituteInPlace modules/Install/Controllers/InstallController.php \
+      --replace "ROOTPATH" "'${stateDirectory}/'"
+    substituteInPlace public/index.php spark \
+      --replace "DotEnv(ROOTPATH)" "DotEnv('${stateDirectory}')"
+
+    # ffmpeg is required for Video Clips feature
+    substituteInPlace modules/MediaClipper/VideoClipper.php \
+      --replace "ffmpeg" "${ffmpeg-headless}/bin/ffmpeg"
+    substituteInPlace modules/Admin/Controllers/VideoClipsController.php \
+      --replace "which ffmpeg" "echo ${ffmpeg-headless}/bin/ffmpeg"
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/castopod
+    cp -r . $out/share/castopod
+  '';
+
+  passthru.tests.castopod = nixosTests.castopod;
+  passthru.updateScript = ./update.sh;
+
+  meta = with lib; {
+    description = "An open-source hosting platform made for podcasters who want to engage and interact with their audience";
+    homepage = "https://castopod.org";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ alexoundos misuzu ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/audio/castopod/update.sh
+++ b/pkgs/applications/audio/castopod/update.sh
@ -0,0 +1,89 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p curl jq
+set -euo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+castopod_nix="$nixpkgs/pkgs/applications/audio/castopod/default.nix"
+
+# https://www.meetup.com/api/guide/#p02-querying-section
+query='
+query allReleases($fullPath: ID!, $first: Int, $last: Int, $before: String, $after: String, $sort: ReleaseSort) {
+  project(fullPath: $fullPath) {
+    id
+    releases(
+      first: $first
+      last: $last
+      before: $before
+      after: $after
+      sort: $sort
+    ) {
+      nodes {
+        ...Release
+        __typename
+      }
+      __typename
+    }
+    __typename
+  }
+}
+
+fragment Release on Release {
+  id
+  name
+  tagName
+  releasedAt
+  createdAt
+  upcomingRelease
+  historicalRelease
+  assets {
+    links {
+      nodes {
+        id
+        name
+        url
+        directAssetUrl
+        linkType
+        __typename
+      }
+      __typename
+    }
+    __typename
+  }
+  __typename
+}
+'
+variables='{
+  "fullPath": "adaures/castopod",
+  "first": 1,
+  "sort": "RELEASED_AT_DESC"
+}'
+
+post=$(cat <<EOF
+{"query": "$(echo $query)", "variables": $(echo $variables)}
+EOF
+)
+
+json="$(curl -s -X POST https://code.castopod.org/api/graphql \
+  -H 'Content-Type: application/json' \
+  -d "$post")"
+
+echo "$json"
+TAG=$(echo $json | jq -r '.data.project.releases.nodes[].tagName')
+ASSET_URL=$(echo $json | jq -r '.data.project.releases.nodes[].assets.links.nodes[].url' | grep .tar.gz$)
+
+CURRENT_VERSION=$(nix eval -f "$nixpkgs" --raw castopod.version)
+VERSION=${TAG:1}
+
+if [[ "$CURRENT_VERSION" == "$VERSION" ]]; then
+  echo "castopod is up-to-date: ${CURRENT_VERSION}"
+  exit 0
+fi
+
+SHA256=$(nix-prefetch-url "$ASSET_URL")
+
+URL=$(echo $ASSET_URL | sed -e 's/[\/&]/\\&/g')
+
+sed -e "s/version =.*;/version = \"$VERSION\";/g" \
+    -e "s/url =.*;/url = \"$URL\";/g" \
+    -e "s/sha256 =.*;/sha256 = \"$SHA256\";/g" \
+    -i "$castopod_nix"
--- a/pkgs/applications/audio/open-stage-control/default.nix
+++ b/pkgs/applications/audio/open-stage-control/default.nix
@ -2,13 +2,13 @@

 buildNpmPackage rec {
  pname = "open-stage-control";
-  version = "1.25.3";
+  version = "1.25.5";

  src = fetchFromGitHub {
    owner = "jean-emmanuel";
    repo = "open-stage-control";
    rev = "v${version}";
-    hash = "sha256-drv+QNBmUjvlRul8PlFK4ZBIDw6BV4kJXVw287H6WT4=";
+    hash = "sha256-N0bL/kgw5tIVcD4fGYrahdola/w9ouct0+AUqw+dUOg=";
  };

  # Remove some Electron stuff from package.json
@ -16,7 +16,7 @@ buildNpmPackage rec {
    sed -i -e '/"electron"\|"electron-installer-debian"/d' package.json
  '';

-  npmDepsHash = "sha256-M+6+zrxy8VpJQS0dG/xORMbflKEq8wO2DEOjGrA6OUw=";
+  npmDepsHash = "sha256-unjoBWVwmUqxAU3mDC37sXzoh7aEOdny4Asa70+sZnk=";

  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/applications/blockchains/go-ethereum/default.nix
+++ b/pkgs/applications/blockchains/go-ethereum/default.nix
@ -9,16 +9,16 @@ let

 in buildGoModule rec {
  pname = "go-ethereum";
-  version = "1.12.2";
+  version = "1.13.0";

  src = fetchFromGitHub {
    owner = "ethereum";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-iCLOrf6/f0f7sD0YjmBtlcOcZRDIp9IZkBadTKj1Qjw=";
+    sha256 = "sha256-tomzF0jM1tcxnnBHLfNWcR1XGECxU8Q/SQAWQBRAFW8=";
  };

-  vendorHash = "sha256-ChmQjhz4dQdwcY/269Hi5XAn8/+0z/AF7Kd9PJ8WqHg=";
+  vendorHash = "sha256-VX2S7yjdcconPd8wisV+Cl6FVuEUGU7smIBKfTxpUVY=";

  doCheck = false;

--- a/pkgs/applications/editors/glow/default.nix
+++ b/pkgs/applications/editors/glow/default.nix
@ -1,6 +1,8 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, installShellFiles
+, stdenv
 }:
 buildGoModule rec {
  pname = "glow";
@ -19,6 +21,14 @@ buildGoModule rec {

  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];

+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd glow \
+      --bash <($out/bin/glow completion bash) \
+      --fish <($out/bin/glow completion fish) \
+      --zsh <($out/bin/glow completion zsh)
+  '';
+
  meta = with lib; {
    description = "Render markdown on the CLI, with pizzazz!";
    homepage = "https://github.com/charmbracelet/glow";
--- a/pkgs/applications/editors/ldtk/default.nix
+++ b/pkgs/applications/editors/ldtk/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ldtk";
-  version = "1.3.4";
+  version = "1.4.0";

  src = fetchurl {
    url = "https://github.com/deepnight/ldtk/releases/download/v${finalAttrs.version}/ubuntu-distribution.zip";
-    hash = "sha256-/EFmuzj8hYhQJegZpZhZb4fuSeMF9wdG1Be4duEvW54=";
+    hash = "sha256-WuKzhE9r/yMqlV2bf/0AuNVKfxq/SlecmN3rHt6RjXo=";
  };

  nativeBuildInputs = [ unzip makeWrapper copyDesktopItems appimage-run ];
--- a/pkgs/applications/editors/orbiton/default.nix
+++ b/pkgs/applications/editors/orbiton/default.nix
@ -4,13 +4,13 @@

 buildGoModule rec {
  pname = "orbiton";
-  version = "2.64.3";
+  version = "2.65.0";

  src = fetchFromGitHub {
    owner = "xyproto";
    repo = "orbiton";
    rev = "v${version}";
-    hash = "sha256-mx6k6OXr3iTCD1FTC7J1fnz7Gs/GyggHXnVywuPo5BY=";
+    hash = "sha256-ul5E5xOtH5qh5tNE+S/VhUOr079wHwgtXF7ZIAwGzgU=";
  };

  vendorHash = null;
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -30,6 +30,7 @@
 , Foundation
 , testers
 , imagemagick
+, perlPackages
 , python3
 }:

@ -47,13 +48,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "imagemagick";
-  version = "7.1.1-15";
+  version = "7.1.1-18";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    rev = finalAttrs.version;
-    hash = "sha256-/fI/RrwcgvKX5loIrDAur60VF5O4FgyPYN7BbcPP/bU=";
+    hash = "sha256-DnmX4dxpOqDGHOFSnq7ms2fLGdB1nKdZbpd0Q9t+X6A=";
  };

  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
@ -125,12 +126,14 @@ stdenv.mkDerivation (finalAttrs: {

  passthru.tests = {
    version = testers.testVersion { package = finalAttrs.finalPackage; };
+    inherit (perlPackages) ImageMagick;
    inherit (python3.pkgs) img2pdf;
    pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
  };

  meta = with lib; {
    homepage = "http://www.imagemagick.org/";
+    changelog = "https://github.com/ImageMagick/Website/blob/main/ChangeLog.md";
    description = "A software suite to create, edit, compose, or convert bitmap images";
    pkgConfigModules = [ "ImageMagick" "MagickWand" ];
    platforms = platforms.linux ++ platforms.darwin;
--- a/pkgs/applications/graphics/upscayl/default.nix
+++ b/pkgs/applications/graphics/upscayl/default.nix
@ -4,11 +4,11 @@
  lib,
 }: let
  pname = "upscayl";
-  version = "2.8.1";
+  version = "2.8.6";

  src = fetchurl {
    url = "https://github.com/upscayl/upscayl/releases/download/v${version}/upscayl-${version}-linux.AppImage";
-    hash = "sha256-gmFT6onuoaw9WDCUDImZM/AxuZECqPC73ZyNnp6WSGA=";
+    hash = "sha256-w5rjLqdlPOZWgdc2t0Y3tl24qZqpjBV6I9gruLaI+qc=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@ -18,14 +18,14 @@

 mkDerivation rec {
  pname = "qcad";
-  version = "3.28.1.3";
+  version = "3.28.2.2";

  src = fetchFromGitHub {
    name = "qcad-${version}-src";
    owner = "qcad";
    repo = "qcad";
    rev = "v${version}";
-    sha256 = "sha256-4Kr/zKE2VqAblNvxT9dg1325V0OCMca3MPEiG3fTxT4=";
+    sha256 = "sha256-0iH+fuh7jurk7FmEdTig+Tfm7ts3b2Azqv6T5kUNpg4=";
  };

  patches = [
--- a/pkgs/applications/misc/timewarrior/default.nix
+++ b/pkgs/applications/misc/timewarrior/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "timewarrior";
-  version = "1.5.0";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "GothenburgBitFactory";
    repo = "timewarrior";
    rev = "v${version}";
-    sha256 = "sha256-qD49NExR0OZ6hgt5ejGiltxF9xkmseJjhJNzEGofnhw=";
+    sha256 = "sha256-0obIMnPBvMO30o+qXqwtINNRobBR6cFO65B/xjVt+2w=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/zola/default.nix
+++ b/pkgs/applications/misc/zola/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , rustPlatform
 , cmake
 , pkg-config
@ -26,6 +27,14 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-AAub8UwAvX3zNX+SM/T9biyNxFTgfqUQG/MUGfwWuno=";

+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-40274.patch";
+      url = "https://github.com/getzola/zola/commit/fe1967fb0fe063b1cee1ad48820870ab2ecc0e5b.patch";
+      hash = "sha256-B/SVGhVX5hAbvMhBYO+mU5+xdZXU2JyS4uKmOj+aZuI=";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -91,11 +91,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.58.124";
+  version = "1.58.129";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-Q/bdauGZR68ueeKxOKI8X7OAc7UmNgixxEJncDsYhH0=";
+    sha256 = "sha256-AJ287Ph6iGnodw3Xt2XMlryBlBLNnvEI8rwpuo5ubKc=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/librewolf/librewolf.nix
+++ b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
@ -29,9 +29,9 @@ rec {
    sed -i '/MOZ_NORMANDY/ s/True/False/' browser/moz.configure
  '';

-  extraPrefsFiles = [ "${source}/submodules/settings/librewolf.cfg" ];
+  extraPrefsFiles = [ "${src.settings}/librewolf.cfg" ];

-  extraPoliciesFiles = [ "${source}/submodules/settings/distribution/policies.json" ];
+  extraPoliciesFiles = [ "${src.settings}/distribution/policies.json" ];

  extraPassthru = {
    librewolf = { inherit src extraPatches; };
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@ -1,11 +1,15 @@
 {
-  "packageVersion": "116.0.3-1",
+  "packageVersion": "117.0.1-1",
  "source": {
-    "rev": "116.0.3-1",
-    "sha256": "19l5nny96p89xm8c9f5m1435sglshn7izmjnj338c8qh217zxiyq"
+    "rev": "117.0.1-1",
+    "sha256": "06j85b6v54vxj99hgrlibpsg6f8w8cqj912vz7gwyfa17pawax9z"
+  },
+  "settings": {
+    "rev": "9c862f06f970d69e00c1035e0d4774fb44fd84a6",
+    "sha256": "0ay58wrhfn0b56748phpn0ahz11ls9y8d2fd1z4zrj6dv398vlmb"
  },
  "firefox": {
-    "version": "116.0.3",
-    "sha512": "194c50e9ba5a918c37fbef8cd72ffb98e5e9f51955d8172b6666a758b5f20777ca0a7f79dff0328305fb6dafefb102ab002e326f47d0965a4dc6d3e9287c42b9"
+    "version": "117.0.1",
+    "sha512": "1583b0ad3b3b17c59bfbfb3e416074766327d0b926ef4f6c6b1e3b2d7cf6a18dec592b7d17fab9493ba1506f3540a02277096d28616dd29b6e7b9e93905f2071"
  }
 }
--- a/pkgs/applications/networking/browsers/librewolf/src.nix
+++ b/pkgs/applications/networking/browsers/librewolf/src.nix
@ -1,4 +1,4 @@
-{ lib, fetchurl, fetchFromGitLab }:
+{ lib, fetchurl, fetchFromGitLab, fetchFromGitea }:
 let src = lib.importJSON ./src.json;
 in
 {
@ -9,6 +9,12 @@ in
    fetchSubmodules = true;
    inherit (src.source) rev sha256;
  };
+  settings = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "librewolf";
+    repo = "settings";
+    inherit (src.settings) rev sha256;
+  };
  firefox = fetchurl {
    url =
      "mirror://mozilla/firefox/releases/${src.firefox.version}/source/firefox-${src.firefox.version}.source.tar.xz";
--- a/pkgs/applications/networking/browsers/librewolf/update.nix
+++ b/pkgs/applications/networking/browsers/librewolf/update.nix
@ -57,9 +57,18 @@ writeScript "update-librewolf" ''
  ffHash=$(grep '\.source\.tar\.xz$' "$HOME"/shasums | grep '^[^ ]*' -o)
  echo "ffHash=$ffHash"

+  # upstream does not specify settings rev, so just get the latest. see https://github.com/NixOS/nixpkgs/issues/252276
+  settingsRev=$(curl 'https://codeberg.org/api/v1/repos/librewolf/settings/commits?sha=master&limit=1' | jq -r .[0].sha)
+  echo "settingsRev=$settingsRev"
+  repoUrl=https://codeberg.org/librewolf/settings
+  nix-prefetch-git $repoUrl --quiet --rev $settingsRev > $prefetchOut
+  settingsSha256=$(jq -r .sha256 < $prefetchOut)
+
  jq ".source.rev = \"$latestTag\"" $srcJson | sponge $srcJson
  jq ".source.sha256 = \"$srcHash\"" $srcJson | sponge $srcJson
  jq ".firefox.version = \"$ffVersion\"" $srcJson | sponge $srcJson
  jq ".firefox.sha512 = \"$ffHash\"" $srcJson | sponge $srcJson
  jq ".packageVersion = \"$lwVersion\"" $srcJson | sponge $srcJson
+  jq ".settings.rev = \"$settingsRev\"" $srcJson | sponge $srcJson
+  jq ".settings.sha256 = \"$settingsSha256\"" $srcJson | sponge $srcJson
 ''
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "helm-secrets";
-  version = "4.4.2";
+  version = "4.5.0";

  src = fetchFromGitHub {
    owner = "jkroepke";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-GpPgjRqzH4fcnaHs9SWfdaCZimwBleXnxQLjqy8SArs=";
+    hash = "sha256-zytorArHhdwF7F9c2QkaX3KxLNlWySKieK2K1b5omFI=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/networking/cluster/rancher/default.nix
+++ b/pkgs/applications/networking/cluster/rancher/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "rancher";
-  version = "2.7.0";
+  version = "2.7.7";

  src = fetchFromGitHub {
    owner  = "rancher";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "sha256-co4LVd5A0bJ4CIuCfv6WyV8XCMbPCFAAcV12WekYrw4=";
+    hash   = "sha256-HgLV4iuZXkL6BOKtUul1pFuIWv09VnUSPbdrtFd6Khk=";
  };

  ldflags = [
@ -19,7 +19,7 @@ buildGoModule rec {
    "-static"
  ];

-  vendorHash = "sha256-oclMnt6uJa8SG2fNM0fi+HCVMMi4rkykx8VpK/tXilQ=";
+  vendorHash = "sha256-mXLZMnGJ1m5gFroJcSoE4SbVvsyuS73hfXFeWBRtUdI=";

  postInstall = ''
    mv $out/bin/cli $out/bin/rancher
--- a/pkgs/applications/networking/instant-messengers/caprine-bin/build-from-appimage.nix
+++ b/pkgs/applications/networking/instant-messengers/caprine-bin/build-from-appimage.nix
@ -43,6 +43,5 @@ in

  meta = metaCommon // {
    platforms = [ "x86_64-linux" ];
-    mainProgram = "caprine";
  };
 })
--- a/pkgs/applications/networking/instant-messengers/caprine-bin/build-from-dmg.nix
+++ b/pkgs/applications/networking/instant-messengers/caprine-bin/build-from-dmg.nix
@ -30,6 +30,5 @@ stdenvNoCC.mkDerivation {

  meta = metaCommon // {
    platforms = with lib.platforms; darwin;
-    mainProgram = "caprine";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/caprine-bin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/caprine-bin/default.nix
@ -1,7 +1,7 @@
 { lib, callPackage, stdenvNoCC }:
 let
  pname = "caprine";
-  version = "2.58.0";
+  version = "2.58.3";
  metaCommon = with lib; {
    description = "An elegant Facebook Messenger desktop app";
    homepage = "https://sindresorhus.com/caprine";
@ -10,11 +10,11 @@ let
  };
  x86_64-appimage = callPackage ./build-from-appimage.nix {
    inherit pname version metaCommon;
-    sha256 = "7iK2RyA63okJLH2Xm97fFilJHzqFuP96xkUr2+ADbC4=";
+    sha256 = "sha256-w0nBQhHYzFLsNu0MxWhoju6fh4JpAKC7MWWVxwDkRYk=";
  };
  x86_64-dmg = callPackage ./build-from-dmg.nix {
    inherit pname version metaCommon;
-    sha256 = "RqK+fJJAt9W+m7zg6ZYI6PEAOa3V1UxsptEpG1qjibg=";
+    sha256 = "sha256-6Mx2ZkT2hdnaSVt2hKMMV9xc7rYPFFbxcj6vb84ojYU=";
  };
 in
 (if stdenvNoCC.isDarwin then x86_64-dmg else x86_64-appimage).overrideAttrs (oldAttrs: {
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 (if stdenv.isDarwin then darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv).mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20230925";
+  version = "20230926";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-j1iAFNG6A/u/2OY07At0kobXtlSqoy3jM2rBf96qhHQ=";
+    hash = "sha256-OU5jKalS8vbQPMT+/FgXbRjWrgL96oIp2I/eHsRa7Q8=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "teams-for-linux";
-  version = "1.3.8";
+  version = "1.3.11";

  src = fetchFromGitHub {
    owner = "IsmaelMartinez";
    repo = "teams-for-linux";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-G0UBzSXoZPLHBsM0nslPLNBZs0sUAQYJ403nPV+3Qu4=";
+    hash = "sha256-xSNjAao8pv3jGRK68bkwGy0vo3nm8KRZjTtCEge4kHs=";
  };

  offlineCache = fetchYarnDeps {
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
@ -30,11 +30,11 @@ in
 stdenv.mkDerivation rec {
  pname = "teamspeak-client";

-  version = "3.6.1";
+  version = "3.6.2";

  src = fetchurl {
    url = "https://files.teamspeak-services.com/releases/client/${version}/TeamSpeak3-Client-linux_${arch}-${version}.run";
-    hash = "sha256-j4sgZ+tJpV6ST0yLmbLTLgBxQTcK1LZoEEfMe3TUAC4=";
+    hash = "sha256-WfEQQ4lxoj+QSnAOfdCoEc+Z1Oa5dbo6pFli1DsAZCI=";
  };

  # grab the plugin sdk for the desktop icon
--- a/pkgs/applications/networking/p2p/pyrosimple/default.nix
+++ b/pkgs/applications/networking/p2p/pyrosimple/default.nix
@ -10,14 +10,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "pyrosimple";
-  version = "2.10.2";
+  version = "2.11.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "kannibalox";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-3ZsRJNGbcKGU6v2uYUintMpKY8Z/DyTIDDxTsDEV6lw=";
+    hash = "sha256-J3eRuQK53Tsh1vhIgEUYBv08c6v3fSMzgK2PIhA13Qw=";
  };

  pythonRelaxDeps = [
--- a/pkgs/applications/networking/soju/default.nix
+++ b/pkgs/applications/networking/soju/default.nix
@ -18,13 +18,6 @@ buildGoModule rec {

  vendorHash = "sha256-iT/QMm6RM6kvw69Az+aLTtBuaCX7ELAiYlj5wXAtBd4=";

-  subPackages = [
-    "cmd/soju"
-    "cmd/sojuctl"
-    "contrib/migrate-db"
-    "contrib/znc-import"
-  ];
-
  nativeBuildInputs = [
    installShellFiles
    scdoc
@ -33,17 +26,14 @@ buildGoModule rec {
  ldflags = [ "-s" "-w" ];

  postBuild = ''
-    make doc/soju.1
+    make doc/soju.1 doc/sojuctl.1
  '';

  postInstall = ''
-    installManPage doc/soju.1
+    installManPage doc/soju.1 doc/sojuctl.1
  '';

  preCheck = ''
-    # Test all targets.
-    unset subPackages
-
    # Disable a test that requires an additional service.
    rm database/postgres_test.go
  '';
--- a/pkgs/applications/office/appflowy/default.nix
+++ b/pkgs/applications/office/appflowy/default.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  pname = "appflowy";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchzip {
    url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${version}/AppFlowy_x86_64-unknown-linux-gnu_ubuntu-20.04.tar.gz";
-    hash = "sha256-jIekGA+MG9tvjEyHAI3dcD7lI1JL/qPqRpVO9gRhcTw=";
+    hash = "sha256-UmBXAfRIr9zOScqibKPHeKzr+UTx3gbGEm0tl7qn+oE=";
    stripRoot = false;
  };

--- a/pkgs/applications/office/super-productivity/default.nix
+++ b/pkgs/applications/office/super-productivity/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "super-productivity";
-  version = "7.13.2";
+  version = "7.14.3";

  src = fetchurl {
    url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "sha256-HwRJUrNaoAnNuIcDWgXOYA+PxLjOE6NXRJqINIbVxOw=";
+    sha256 = "sha256-wW72T1+RfejaI9LxSxa/g0lvIRmAeFa2ZaEa8K9mRcw=";
    name = "${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@ -22,13 +22,13 @@

 stdenv.mkDerivation rec {
  pname = "stellarium";
-  version = "23.2";
+  version = "23.3";

  src = fetchFromGitHub {
    owner = "Stellarium";
    repo = "stellarium";
    rev = "v${version}";
-    hash = "sha256-8Iheb/9wjf0u10ZQRkLMLNN2s7P++Fqcr26iatiKcTo=";
+    hash = "sha256-bYvGmYu9jMHk2IUICz2kCVh56Ymz8JHqurdWV+xEdJY=";
  };

  patches = [
@ -92,6 +92,6 @@ stdenv.mkDerivation rec {
    homepage = "https://stellarium.org/";
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ kilianar ];
  };
 }
--- a/pkgs/applications/science/logic/beluga/default.nix
+++ b/pkgs/applications/science/logic/beluga/default.nix
@ -2,13 +2,13 @@

 ocamlPackages.buildDunePackage rec {
  pname = "beluga";
-  version = "1.1";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "Beluga-lang";
    repo = "Beluga";
    rev = "refs/tags/v${version}";
-    hash = "sha256-0E7rmiLmQPfOAQ1qKiqxeLdqviVl+Thkl6KfOWkGZRc=";
+    hash = "sha256-l/C77czLtlLnpadVx4d9ve9jv/e11jsOgzrbXt+Zo5s=";
  };

  duneVersion = "3";
--- a/pkgs/applications/science/logic/uhdm/default.nix
+++ b/pkgs/applications/science/logic/uhdm/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "UHDM";
-  version = "1.73";
+  version = "1.74";

  src = fetchFromGitHub {
    owner = "chipsalliance";
    repo = finalAttrs.pname;
    rev = "v${finalAttrs.version}";
-    hash = "sha256-VmRn51UrJTGEG4n2fi5kRv8khXakfGbqMtYPejsZCBI=";
+    hash = "sha256-DiwLo/3RcXY+wG2+7aDx4p6UuQm/eNX/kG35TJzIbe0=";
    fetchSubmodules = false;  # we use all dependencies from nix
  };

--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@ -10,7 +10,7 @@
 }:

 let
-  version = "5.12.147";
+  version = "5.12.149";
 in
 rustPlatform.buildRustPackage {
  pname = "git-mit";
@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
    owner = "PurpleBooth";
    repo = "git-mit";
    rev = "v${version}";
-    hash = "sha256-TaYuxyezegPZPWlkYcZk+YhmHqQ/P1nO5D5JC3LN8bo=";
+    hash = "sha256-8e7tuNXgYT4wkTbxEz+Sqp0zVody0QC+yK8gcjR3Pww=";
  };

-  cargoHash = "sha256-9oqw2rIAhdo5G2GsW7rwHMymgFASKE7OrVqO2ewfG2g=";
+  cargoHash = "sha256-V5c/UsNFWogCgyHSDwsOm2Nfsl/vBUClKQGmwzYqNz0=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/version-management/gql/default.nix
+++ b/pkgs/applications/version-management/gql/default.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gql";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "AmrDeveloper";
    repo = "GQL";
    rev = version;
-    hash = "sha256-iM5a0uy+egPBMSDBo6ks8QNfRoKku2GmFpzoanSDm9M=";
+    hash = "sha256-qNLVbhVXITbMRI2x/0q5enJgjL3EAcXBwqWeH6MPfZs=";
  };

-  cargoHash = "sha256-bpPrnguDSj1K22vmf/hEimd4tVS6ANmTiVtdsUuN1BM=";
+  cargoHash = "sha256-UrzJGEASGaDqKUrPiNcjldevCqCPaNXJXNYecbHodOc=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@ -14,13 +14,13 @@

 mkDerivation rec {
  pname = "anilibria-winmaclinux";
-  version = "1.2.9";
+  version = "1.2.10";

  src = fetchFromGitHub {
    owner = "anilibria";
    repo = "anilibria-winmaclinux";
    rev = version;
-    sha256 = "sha256-Fdj7i4jpKIDwaIBAch7SjIV/WnqMDnCfNYSiZLsamx8=";
+    sha256 = "sha256-mCDw8V/Uzewm32rj+mkkm5atS5nJAFJ3ry1boTn+gqI=";
  };

  sourceRoot = "source/src";
--- a/pkgs/applications/video/hypnotix/default.nix
+++ b/pkgs/applications/video/hypnotix/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "hypnotix";
-  version = "3.6";
+  version = "3.7";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "hypnotix";
    rev = version;
-    hash = "sha256-hi3ppYDzFEp4FGZHlGgwEFqyOqzX+d0JK674EyibB/c=";
+    hash = "sha256-H8+KJ9+HLAorGIeljw8H3N8W3E2yYhAno1xy+jI54zM=";
  };

  patches = [
--- a/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
+++ b/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
@ -1,8 +1,9 @@
 { lib
 , fetchFromGitHub
-, makeRustPlatform
 , hostPlatform
 , targetPlatform
+, cargo
+, rustc
 , lld
 }:

@ -24,7 +25,12 @@ let
    };
  };

-  inherit (cross) rustPlatform;
+  # inherit (cross) rustPlatform;
+  # ^ breaks because we are doing a no_std embedded build with a custom sysroot,
+  # but the fast_cross rustc wrapper already passes a sysroot argument
+  rustPlatform = cross.makeRustPlatform {
+    inherit rustc cargo;
+  };

 in

--- a/pkgs/applications/window-managers/notion/default.nix
+++ b/pkgs/applications/window-managers/notion/default.nix
@ -1,44 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config
-, lua, gettext, which, groff, xmessage, xterm
-, readline, fontconfig, libX11, libXext, libSM
-, libXinerama, libXrandr, libXft
-, makeWrapper
-}:
-
-stdenv.mkDerivation rec {
-  pname = "notion";
-  version = "4.0.2";
-
-  src = fetchFromGitHub {
-    owner = "raboof";
-    repo = pname;
-    rev = version;
-    sha256 = "14swd0yqci8lxn259fkd9w92bgyf4rmjwgvgyqp78wlfix6ai4mv";
-  };
-
-  # error: 'PATH_MAX' undeclared
-  postPatch = ''
-    sed 1i'#include <linux/limits.h>' -i mod_notionflux/notionflux/notionflux.c
-  '';
-
-  nativeBuildInputs = [ pkg-config makeWrapper groff ];
-  buildInputs = [ lua gettext which readline fontconfig libX11 libXext libSM
-                  libXinerama libXrandr libXft ];
-
-  buildFlags = [ "LUA_DIR=${lua}" "X11_PREFIX=/no-such-path" ];
-
-  makeFlags = [ "NOTION_RELEASE=${version}" "PREFIX=\${out}" ];
-
-  postInstall = ''
-    wrapProgram $out/bin/notion \
-      --prefix PATH ":" "${xmessage}/bin:${xterm}/bin" \
-  '';
-
-  meta = with lib; {
-    description = "Tiling tabbed window manager";
-    homepage = "https://notionwm.net";
-    license   = licenses.lgpl21;
-    maintainers = with maintainers; [ jfb AndersonTorres raboof ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/window-managers/smallwm/default.nix
+++ b/pkgs/applications/window-managers/smallwm/default.nix
@ -1,38 +0,0 @@
-{ lib, stdenv, fetchFromGitHub
-, doxygen, graphviz, libX11, libXrandr }:
-
-stdenv.mkDerivation rec {
-
-  pname = "smallwm";
-  version = "2020-02-28";
-
-  src = fetchFromGitHub {
-    owner = "adamnew123456";
-    repo = "SmallWM";
-    rev = "c2dc72afa87241bcf7e646630f4aae216ce78613";
-    sha256 = "0cqhy81ymdcdyvgi55a401rr96h2akskcxi9ddzjbln4a71yjlz8";
-  };
-
-  nativeBuildInputs = [ doxygen graphviz ];
-  buildInputs = [ libX11 libXrandr ];
-
-  dontConfigure = true;
-
-  makeFlags = [ "CC=${stdenv.cc}/bin/cc" "CXX=${stdenv.cc}/bin/c++" ];
-
-  buildFlags = [ "all" "doc" ];
-
-  installPhase = ''
-    install -dm755 $out/bin $out/share/doc/${pname}-${version}
-    install -m755 bin/smallwm -t $out/bin
-    cp -r README.markdown doc/html doc/latex $out/share/doc/${pname}-${version}
-  '';
-
-  meta = with lib;{
-    description = "A small X window manager, extended from tinywm";
-    homepage = "https://github.com/adamnew123456/SmallWM";
-    license = licenses.bsd2;
-    maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/build-support/php/hooks/default.nix
+++ b/pkgs/build-support/php/hooks/default.nix
@ -3,20 +3,21 @@
 , moreutils
 , makeBinaryWrapper
 , php
+, cacert
 }:

 {
  composerRepositoryHook = makeSetupHook
    {
      name = "composer-repository-hook.sh";
-      propagatedBuildInputs = [ jq moreutils php ];
+      propagatedBuildInputs = [ jq moreutils php cacert ];
      substitutions = { };
    } ./composer-repository-hook.sh;

  composerInstallHook = makeSetupHook
    {
      name = "composer-install-hook.sh";
-      propagatedBuildInputs = [ jq makeBinaryWrapper moreutils php ];
+      propagatedBuildInputs = [ jq makeBinaryWrapper moreutils php cacert ];
      substitutions = { };
    } ./composer-install-hook.sh;
 }
--- a/pkgs/applications/window-managers/afterstep/default.nix
+++ b/pkgs/applications/window-managers/afterstep/default.nix
@ -1,26 +1,31 @@
-{ lib, stdenv, fetchurl, pkg-config
-, libtiff
-, fltk, gtk
-, libICE, libSM
-, dbus
+{ lib
+, stdenv
+, fetchFromGitHub
 , fetchpatch
+, dbus
+, fltk13
+, gtk2
+, libICE
+, libSM
+, libtiff
+, pkg-config
 }:

-stdenv.mkDerivation rec {
-
+stdenv.mkDerivation (finalAttrs: {
  pname = "afterstep";
  version = "2.2.12";
-  sourceName = "AfterStep-${version}";

-  src = fetchurl {
-    urls = [ "ftp://ftp.afterstep.org/stable/${sourceName}.tar.bz2" ];
-    sha256 = "1j7vkx1ig4kzwffdxnkqv3kld9qi3sam4w2nhq18waqjsi8xl5gz";
+  src = fetchFromGitHub {
+    owner = "afterstep";
+    repo = "afterstep";
+    rev = finalAttrs.version;
+    hash = "sha256-j1ADTRZ3Mxv9VNZWhWCFMnM/CJfkphdrgbw9Ca3bBw0=";
  };

  patches = [
    (fetchpatch {
      url = "https://salsa.debian.org/debian/afterstep/raw/master/debian/patches/44-Fix-build-with-gcc-5.patch";
-      sha256 = "1vipy2lzzd2gqrsqk85pwgcdhargy815fxlbn57hsm45zglc3lj4";
+      hash = "sha256-RNLB6PuFVA1PsYt2VwLyLyvY2OO3oIl1xk+0/6nwN+4=";
    })

    # Fix pending upstream inclusion for binutils-2.36 support:
@ -28,7 +33,7 @@ stdenv.mkDerivation rec {
    (fetchpatch {
      name = "binutils-2.36.patch";
      url = "https://github.com/afterstep/afterstep/commit/5e9e897cf8c455390dd6f5b27fec49707f6b9088.patch";
-      sha256 = "1kk97max05r2p1a71pvpaza79ff0klz32rggik342p7ki3516qv8";
+      hash = "sha256-aGMTyojzXEHGjO9lMT6dwLl01Fd333BUuCIX0FU9ac4=";
    })
  ];

@ -40,8 +45,22 @@ stdenv.mkDerivation rec {
    done
  '';

-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libtiff fltk gtk libICE libSM dbus ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    dbus
+    fltk13
+    gtk2
+    libICE
+    libSM
+    libtiff
+  ];
+
+  outputs = [ "out" "man" ];
+
+  strictDeps = true;

  # A strange type of bug: dbus is not immediately found by pkg-config
  preConfigure = ''
@ -66,20 +85,19 @@ stdenv.mkDerivation rec {
  #   https://github.com/afterstep/afterstep/issues/8
  enableParallelBuilding = false;

-  meta = with lib; {
+  meta = {
+    homepage = "http://www.afterstep.org/";
    description = "A NEXTStep-inspired window manager";
    longDescription = ''
-      AfterStep is a window manager for the Unix X Window
-      System. Originally based on the look and feel of the NeXTStep
-      interface, it provides end users with a consistent, clean, and
-      elegant desktop. The goal of AfterStep development is to provide
-      for flexibility of desktop configuration, improving aestetics,
-      and efficient use of system resources.
+      AfterStep is a window manager for the Unix X Window System. Originally
+      based on the look and feel of the NeXTStep interface, it provides end
+      users with a consistent, clean, and elegant desktop. The goal of AfterStep
+      development is to provide for flexibility of desktop configuration,
+      improving aestetics, and efficient use of system resources.
    '';
-    homepage = "http://www.afterstep.org/";
-    license = licenses.gpl2;
-    maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    mainProgram = "afterstep";
+    platforms = lib.platforms.linux;
  };
-
-}
+})
--- a/pkgs/applications/window-managers/berry/default.nix
+++ b/pkgs/applications/window-managers/berry/default.nix
@ -13,14 +13,14 @@
 , which
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "berry";
  version = "0.1.12";

  src = fetchFromGitHub {
    owner = "JLErvin";
-    repo = pname;
-    rev = version;
+    repo = "berry";
+    rev = finalAttrs.version;
    hash = "sha256-xMJRiLNtwVRQf9HiCF3ClLKEmdDNxcY35IYxe+L7+Hk=";
  };

@ -39,8 +39,12 @@ stdenv.mkDerivation rec {
    freetype
  ];

+  outputs = [ "out" "man" ];
+
+  strictDeps = true;
+
  postPatch = ''
-    sed -i --regexp-extended 's/(pkg_verstr=").*(")/\1${version}\2/' configure
+    sed -i --regexp-extended 's/(pkg_verstr=").*(")/\1${finalAttrs.version}\2/' configure
  '';

  preConfigure = ''
@ -49,16 +53,16 @@ stdenv.mkDerivation rec {

  desktopItems = [
    (makeDesktopItem {
-      name = pname;
+      name = "berry";
      exec = "berry";
-      comment = meta.description;
+      comment = "A healthy, bite-sized window manager";
      desktopName = "Berry Window Manager";
      genericName = "Berry Window Manager";
      categories = [ "Utility" ];
    })
  ];

-  meta = with lib; {
+  meta = {
    homepage = "https://berrywm.org/";
    description = "A healthy, bite-sized window manager";
    longDescription = ''
@ -74,8 +78,9 @@ stdenv.mkDerivation rec {
      - Intuitively place new windows in unoccupied spaces.
      - Virtual desktops.
    '';
-    license = licenses.mit;
-    maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    mainProgram = "berry";
+    maintainers = [ lib.maintainers.AndersonTorres ];
+    inherit (libX11.meta) platforms;
  };
-}
+})
--- a/pkgs/by-name/ca/cargo-bump/package.nix
+++ b/pkgs/by-name/ca/cargo-bump/package.nix
@ -0,0 +1,36 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-bump";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "rustadopt";
+    repo = "cargo-bump";
+    rev = "v${version}";
+    hash = "sha256-PhA7uC2gJcBnUQPWgZC51p/KTSxSGld3m+dd6BhW6q8=";
+  };
+
+  cargoHash = "sha256-mp2y5q0GYfSlB5aPC6MY9Go8a2JAiPKtVYL9SewfloI=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  meta = with lib; {
+    description = "Increments the version number of the current project.";
+    homepage = "https://github.com/wraithan/cargo-bump";
+    license = with licenses; [ isc ];
+    maintainers = with maintainers; [ cafkafk ];
+  };
+}
--- a/pkgs/by-name/no/notion/package.nix
+++ b/pkgs/by-name/no/notion/package.nix
@ -0,0 +1,86 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fontconfig
+, gettext
+, groff
+, libSM
+, libX11
+, libXext
+, libXft
+, libXinerama
+, libXrandr
+, lua
+, makeWrapper
+, pkg-config
+, readline
+, which
+, xmessage
+, xterm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "notion";
+  version = "4.0.2";
+
+  src = fetchFromGitHub {
+    owner = "raboof";
+    repo = "notion";
+    rev = finalAttrs.version;
+    hash = "sha256-u5KoTI+OcnQu9m8/Lmsmzr8lEk9tulSE7RRFhj1oXJM=";
+  };
+
+  # error: 'PATH_MAX' undeclared
+  postPatch = ''
+    sed 1i'#include <linux/limits.h>' -i mod_notionflux/notionflux/notionflux.c
+  '';
+
+  nativeBuildInputs = [
+    gettext
+    groff
+    lua
+    makeWrapper
+    pkg-config
+    which
+  ];
+
+  buildInputs = [
+    fontconfig
+    libSM
+    libX11
+    libXext
+    libXft
+    libXinerama
+    libXrandr
+    lua
+    readline
+  ];
+
+  outputs = [ "out" "man" ];
+
+  strictDeps = true;
+
+  buildFlags = [
+    "LUA_DIR=${lua}"
+    "X11_PREFIX=/no-such-path"
+  ];
+
+  makeFlags = [
+    "NOTION_RELEASE=${finalAttrs.version}"
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/notion \
+      --prefix PATH ":" "${lib.makeBinPath [ xmessage xterm ]}" \
+  '';
+
+  meta = {
+    description = "Tiling tabbed window manager";
+    homepage = "https://notionwm.net";
+    license = lib.licenses.lgpl21;
+    mainProgram = "notion";
+    maintainers = with lib.maintainers; [ jfb AndersonTorres raboof ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/applications/window-managers/pekwm/default.nix
+++ b/pkgs/applications/window-managers/pekwm/default.nix
@ -2,10 +2,8 @@
 , stdenv
 , fetchFromGitHub
 , awk
-, grep
-, sed
-, runtimeShell
 , cmake
+, grep
 , libXext
 , libXft
 , libXinerama
@ -14,6 +12,8 @@
 , libjpeg
 , libpng
 , pkg-config
+, runtimeShell
+, sed
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -32,13 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
  ];

-  cmakeFlags = [
-    "-DAWK=${awk}/bin/awk"
-    "-DGREP=${grep}/bin/grep"
-    "-DSED=${sed}/bin/sed"
-    "-DSH=${runtimeShell}"
-  ];
-
  buildInputs = [
    libXext
    libXft
@ -49,6 +42,17 @@ stdenv.mkDerivation (finalAttrs: {
    libpng
  ];

+  outputs = [ "out" "man" ];
+
+  strictDeps = true;
+
+  cmakeFlags = [
+    "-DAWK=${lib.getBin awk}/bin/awk"
+    "-DGREP=${lib.getBin grep}/bin/grep"
+    "-DSED=${lib.getBin sed}/bin/sed"
+    "-DSH=${runtimeShell}"
+  ];
+
  meta = {
    homepage = "https://www.pekwm.se/";
    description = "A lightweight window manager";
@ -67,6 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    changelog = "https://raw.githubusercontent.com/pekwm/pekwm/release-${finalAttrs.version}/NEWS.md";
    license = lib.licenses.gpl2Plus;
+    mainProgram = "pekwm";
    maintainers = [ lib.maintainers.AndersonTorres ];
    platforms = lib.platforms.linux;
  };
--- a/pkgs/by-name/pe/pesign/package.nix
+++ b/pkgs/by-name/pe/pesign/package.nix
@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, nss
+, efivar
+, util-linux
+, popt
+, nspr
+, mandoc
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pesign";
+  version = "116";
+
+  src = fetchFromGitHub {
+    owner = "rhboot";
+    repo = "pesign";
+    rev = version;
+    hash = "sha256-cuOSD/ZHkilgguDFJviIZCG8kceRWw2JgssQuWN02Do=";
+  };
+
+  # nss-util is missing because it is already contained in nss
+  # Red Hat seems to be shipping a separate nss-util:
+  # https://centos.pkgs.org/7/centos-x86_64/nss-util-devel-3.44.0-4.el7_7.x86_64.rpm.html
+  # containing things we already have in `nss`.
+  # We can ignore all the errors pertaining to a missing
+  # nss-util.pc I suppose.
+  buildInputs = [ efivar util-linux nss popt nspr mandoc ];
+  nativeBuildInputs = [ pkg-config ];
+
+  makeFlags = [ "INSTALLROOT=$(out)" ];
+
+  postInstall = ''
+    mv $out/usr/bin $out/bin
+    mv $out/usr/share $out/share
+
+    rm -rf $out/usr
+    rm -rf $out/etc
+    rm -rf $out/run
+  '';
+
+  meta = with lib; {
+    description = "Signing tools for PE-COFF binaries. Compliant with the PE and Authenticode specifications.";
+    homepage = "https://github.com/rhboot/pesign";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ raitobezarius ];
+    # efivar is currently Linux-only.
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/po/poethepoet/package.nix
+++ b/pkgs/by-name/po/poethepoet/package.nix
@ -0,0 +1,43 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "poethepoet";
+  version = "0.23.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "nat-n";
+    repo = "poethepoet";
+    rev = "v${version}";
+    hash = "sha256-bT+lRPqR7mxfZSlOyhqCkpBE0etiLh0wkg62nyK751Q=";
+  };
+
+  nativeBuildInputs = [
+    python3.pkgs.poetry-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pastel
+    tomli
+  ];
+
+  passthru.optional-dependencies = with python3.pkgs; {
+    poetry_plugin = [
+      poetry
+    ];
+  };
+
+  pythonImportsCheck = [ "poethepoet" ];
+
+  meta = with lib; {
+    description = "A task runner that works well with poetry";
+    homepage = "https://github.com/nat-n/poethepoet";
+    changelog = "https://github.com/nat-n/poethepoet/releases/tag/${src.rev}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "poe";
+  };
+}
--- a/pkgs/applications/window-managers/ratpoison/default.nix
+++ b/pkgs/applications/window-managers/ratpoison/default.nix
@ -1,42 +1,71 @@
-{ lib, stdenv, fetchurl, pkg-config, perl, autoconf, automake
-, libX11, xorgproto, libXt, libXpm, libXft, libXtst, libXi
-, libXrandr, fontconfig, freetype, readline
+{ lib
+, stdenv
+, fetchurl
+, autoreconfHook
+, fontconfig
+, freetype
+, libX11
+, libXft
+, libXi
+, libXpm
+, libXrandr
+, libXt
+, libXtst
+, perl
+, pkg-config
+, readline
+, texinfo
+, xorgproto
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "ratpoison";
  version = "1.4.9";

  src = fetchurl {
-    url = "mirror://savannah/ratpoison/${pname}-${version}.tar.xz";
-    sha256 = "1wfir1gvh5h7izgvx2kd1pr2k7wlncd33zq7qi9s9k2y0aza93yr";
+    url = "mirror://savannah/ratpoison/ratpoison-${finalAttrs.version}.tar.xz";
+    hash = "sha256-2Y+kvgJezKRTxAf/MRqzlJ8p8g1tir7fjwcWuF/I0fE=";
  };

+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    texinfo
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+    libX11
+    libXft
+    libXi
+    libXpm
+    libXrandr
+    libXt
+    libXtst
+    perl
+    readline
+    xorgproto
+  ];
+
  outputs = [ "out" "contrib" "man" "doc" "info" ];

+  strictDeps = true;
+
  configureFlags = [
    # >=1.4.9 requires this even with readline in inputs
    "--enable-history"
  ];

-  nativeBuildInputs = [ pkg-config autoconf automake ];
-
-  buildInputs =
-    [ perl
-      libX11 xorgproto libXt libXpm libXft libXtst libXi libXrandr
-      fontconfig freetype readline ];
-
  postInstall = ''
    mkdir -p $contrib/{bin,share}
    mv $out/bin/rpws $contrib/bin
    mv $out/share/ratpoison $contrib/share
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://www.nongnu.org/ratpoison/";
    description = "Simple mouse-free tiling window manager";
-    license = licenses.gpl2Plus;
-
    longDescription = ''
       Ratpoison is a simple window manager with no fat library
       dependencies, no fancy graphics, no window decorations, and no
@ -51,8 +80,9 @@ stdenv.mkDerivation rec {
       Ratpoison has a prefix map to minimize the key clobbering that
       cripples Emacs and other quality pieces of software.
    '';
-
-    platforms = platforms.unix;
-    maintainers = [ maintainers.AndersonTorres ];
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "ratpoison";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (libX11.meta) platforms;
  };
-}
+})
--- a/pkgs/by-name/si/simplex-chat-desktop/package.nix
+++ b/pkgs/by-name/si/simplex-chat-desktop/package.nix
@ -0,0 +1,46 @@
+{ lib
+, appimageTools
+, fetchurl
+}:
+
+let
+  pname = "simplex-chat-desktop";
+  version = "5.3.1";
+
+  src = fetchurl {
+    url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-x86_64.AppImage";
+    hash = "sha256-vykdi7SXKKsjYE/yixGrKQoWuUIOAjofLUn/fsdmLMc=";
+  };
+
+  appimageContents = appimageTools.extract {
+    inherit pname version src;
+  };
+in appimageTools.wrapType2 {
+    inherit pname version src;
+
+    extraPkgs = pkgs: with pkgs; [
+      makeWrapper
+    ];
+
+    extraBwrapArgs = [
+      "--setenv _JAVA_AWT_WM_NONREPARENTING 1"
+    ];
+
+    extraInstallCommands = ''
+      mv $out/bin/${pname}-${version} $out/bin/${pname}
+
+      install --mode=444 -D ${appimageContents}/chat.simplex.app.desktop --target-directory=$out/share/applications
+      substituteInPlace $out/share/applications/chat.simplex.app.desktop \
+        --replace 'Exec=simplex' 'Exec=${pname}'
+      cp -r ${appimageContents}/usr/share/icons $out/share
+    '';
+
+  meta = with lib; {
+    description = "Desktop application for SimpleX Chat";
+    homepage = "https://simplex.chat";
+    changelog = "https://github.com/simplex-chat/simplex-chat/releases/tag/v${version}";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ yuu ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/by-name/sl/slurm-nm/package.nix
+++ b/pkgs/by-name/sl/slurm-nm/package.nix
@ -0,0 +1,32 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, pkg-config
+, meson
+, ncurses
+, ninja
+}:
+
+stdenv.mkDerivation rec {
+  pname = "slurm";
+  version = "0.4.4";
+
+  src = fetchFromGitHub {
+    owner = "mattthias";
+    repo = "slurm";
+    rev = "upstream/${version}";
+    hash = "sha256-w77SIXFctMwwNw9cQm0HQaEaMs/5NXQjn1LpvkpCCB8=";
+  };
+
+  nativeBuildInputs = [ pkg-config meson ninja ];
+  buildInputs = [ ncurses ];
+
+  meta = with lib; {
+    description = "A generic network load monitor";
+    homepage = "https://github.com/mattthias/slurm";
+    license = licenses.gpl2Plus;
+    platforms = with platforms; [ "x86_64-linux" ];
+    maintainers = with maintainers; [ mikaelfangel ];
+    mainProgram = "slurm";
+  };
+}
--- a/pkgs/by-name/sm/smallwm/package.nix
+++ b/pkgs/by-name/sm/smallwm/package.nix
@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, doxygen
+, graphviz
+, libX11
+, libXrandr
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "smallwm";
+  version = "unstable-2020-02-28";
+
+  src = fetchFromGitHub {
+    owner = "adamnew123456";
+    repo = "SmallWM";
+    rev = "c2dc72afa87241bcf7e646630f4aae216ce78613";
+    hash = "sha256-6FPpw1HE0iV/ayl2NvVUApqUcwBElRLf9o216gPyEDM=";
+  };
+
+  nativeBuildInputs = [
+    doxygen
+    graphviz
+  ];
+
+  buildInputs = [
+    libX11
+    libXrandr
+  ];
+
+  strictDeps = true;
+
+  dontConfigure = true;
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "CXX=${stdenv.cc.targetPrefix}c++"
+  ];
+
+  buildFlags = [ "all" "doc" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -dm755 $out/bin $out/share/doc/smallwm-${finalAttrs.version}
+    install -m755 bin/smallwm -t $out/bin
+    cp -r README.markdown doc/html doc/latex $out/share/doc/smallwm-${finalAttrs.version}
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A small X window manager, extended from tinywm";
+    homepage = "https://github.com/adamnew123456/SmallWM";
+    license = lib.licenses.bsd2;
+    mainProgram = "smallwm";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (libX11.meta) platforms;
+  };
+})
--- a/pkgs/applications/window-managers/tinywm/default.nix
+++ b/pkgs/applications/window-managers/tinywm/default.nix
@ -1,36 +1,49 @@
-{ lib, stdenv, fetchFromGitHub
-, libX11 }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, libX11
+}:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "tinywm";
-  version = "2014-04-22";
+  version = "1.1-unstable-2014-04-22";

  src = fetchFromGitHub {
    owner = "mackstann";
-    repo = pname;
+    repo = "tinywm";
    rev = "9d05612f41fdb8bc359f1fd9cc930bf16315abb1";
-    sha256 = "1s7r4f2d3lk1i8h089v2vyrr02hh0y9i3ihl9kqgk9s87hqw8q5b";
+    hash = "sha256-q2DEMTxIp/nwTBTGEZMHEAqQs99iJwQgimHS0YQj+eg=";
  };

  buildInputs = [ libX11 ];

+  strictDeps = true;
+
  dontConfigure = true;

  buildPhase = ''
+    runHook preBuild
+
    $CC -Wall -pedantic -I${libX11}/include tinywm.c -L${libX11}/lib -lX11 -o tinywm
+
+    runHook postBuild
  '';

  installPhase = ''
-    install -dm755 $out/bin $out/share/doc/${pname}-${version}
+    runHook preInstall
+
+    install -dm755 $out/bin $out/share/doc/tinywm-${finalAttrs.version}
    install -m755 tinywm -t $out/bin/
    # The annotated source code is a piece of documentation
-    install -m644 annotated.c README -t $out/share/doc/${pname}-${version}
+    install -m644 annotated.c README -t $out/share/doc/tinywm-${finalAttrs.version}
+
+    runHook postInstall
  '';

-  meta = with lib;{
+  meta = {
+    homepage = "http://incise.org/tinywm.html";
    description = "A tiny window manager for X11";
    longDescription = ''
-
      TinyWM is a tiny window manager that I created as an exercise in
      minimalism. It is also maybe helpful in learning some of the very basics
      of creating a window manager. It is only around 50 lines of C. There is
@ -44,9 +57,9 @@ stdenv.mkDerivation rec {
        keybinding in there somewhere)
      - Focus windows with the mouse pointer (X does this on its own)
    '';
-    homepage = "http://incise.org/tinywm.html";
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = libX11.meta.platforms;
-    license = licenses.publicDomain;
+    license = lib.licenses.publicDomain;
+    mainProgram = "tinywm";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (libX11.meta) platforms;
  };
-}
+})
--- a/pkgs/applications/window-managers/waybox/default.nix
+++ b/pkgs/applications/window-managers/waybox/default.nix
@ -1,62 +1,65 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, pkg-config
-, meson
 , cmake
-, ninja
-, libxkbcommon
-, wayland
-, wayland-scanner
-, wayland-protocols
-, wlroots
-, pixman
-, udev
 , libGL
+, libxkbcommon
 , libxml2
 , mesa
+, meson
+, ninja
+, pixman
+, pkg-config
+, udev
+, wayland
+, wayland-protocols
+, wayland-scanner
+, wlroots
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "waybox";
  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "wizbright";
-    repo = pname;
-    rev = version;
+    repo = "waybox";
+    rev = finalAttrs.version;
    hash = "sha256-G8dRa4hgev3x58uqp5To5OzF3zcPSuT3NL9MPnWf2M8=";
  };

  nativeBuildInputs = [
-    pkg-config
-    meson
    cmake
+    meson
    ninja
+    pkg-config
    wayland-scanner
  ];

-  dontUseCmakeConfigure = true;
-
  buildInputs = [
+    libGL
    libxkbcommon
    libxml2
+    mesa # for libEGL
+    pixman
+    udev
    wayland
    wayland-protocols
    wlroots
-    pixman
-    udev
-    libGL
-    mesa # for libEGL
  ];

+  strictDeps = true;
+
+  dontUseCmakeConfigure = true;
+
  passthru.providedSessions = [ "waybox" ];

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/wizbright/waybox";
    description = "An openbox clone on Wayland";
-    license = licenses.mit;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    mainProgram = "waybox";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (wayland.meta) platforms;
  };
-}
+})
--- a/pkgs/applications/window-managers/yeahwm/default.nix
+++ b/pkgs/applications/window-managers/yeahwm/default.nix
@ -1,40 +1,63 @@
-{ lib, stdenv, fetchurl
+{ lib
+, stdenv
+, fetchurl
+, installShellFiles
 , lesstif
-, libX11, libXext, libXmu, libXinerama }:
-
-stdenv.mkDerivation rec {
+, libX11
+, libXext
+, libXinerama
+, libXmu
+}:

+stdenv.mkDerivation (finalAttrs: {
  pname = "yeahwm";
  version = "0.3.5";

  src = fetchurl {
-    url = "http://phrat.de/${pname}_${version}.tar.gz";
-    sha256 = "01gfzjvb40n16m2ja4238nk08k4l203y6a61cydqvf68924fjb69";
+    url = "http://phrat.de/yeahwm_${finalAttrs.version}.tar.gz";
+    hash = "sha256-ySzpiEjIuI2bZ8Eo4wcQlEwEpkVDECVFNcECsrb87gU=";
  };

-  buildInputs = [ lesstif libX11 libXext libXinerama libXmu ];
+  nativeBuildInputs = [
+    installShellFiles
+  ];

-  dontConfigure = true;
+  buildInputs = [
+    lesstif
+    libX11
+    libXext
+    libXinerama
+    libXmu
+  ];

-  preBuild = ''
+  strictDeps = true;
+
+  preBuild = let
+    includes = builtins.concatStringsSep " "
+      (builtins.map (l: "-I${lib.getDev l}/include")
+        finalAttrs.buildInputs);
+    ldpath = builtins.concatStringsSep " "
+      (builtins.map (l: "-L${lib.getLib l}/lib")
+        finalAttrs.buildInputs);
+  in ''
    makeFlagsArray+=( CC="${stdenv.cc}/bin/cc" \
                      XROOT="${libX11}" \
-                      INCLUDES="-I${libX11.dev}/include -I${libXext.dev}/include -I${libXinerama.dev}/include -I${libXmu.dev}/include" \
-                      LDPATH="-L${libX11}/lib -L${libXext}/lib -L${libXinerama}/lib -L${libXmu}/lib" \
+                      INCLUDES="${includes}" \
+                      LDPATH="${ldpath}" \
                      prefix="${placeholder "out"}" )
  '';

-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
+  # Workaround build failure on -fno-common toolchains like upstream gcc-10.
+  # Otherwise build fails as:
  #   ld: screen.o:(.bss+0x40): multiple definition of `fg'; client.o:(.bss+0x40): first defined here
  env.NIX_CFLAGS_COMPILE = "-fcommon";

  postInstall = ''
-    gzip -9 --stdout yeahwm.1 > yeahwm.1.gz
-    install -m644 yeahwm.1.gz ${placeholder "out"}/share/man/man1/
+    installManPage yeahwm.1
  '';

-  meta = with lib;{
+  meta = {
+    homepage = "http://phrat.de/index.html";
    description = "An X window manager based on evilwm and aewm";
    longDescription = ''
      YeahWM is a h* window manager for X based on evilwm and aewm.
@ -55,9 +78,10 @@ stdenv.mkDerivation rec {
      - Little resource usage.
      - It's slick.
    '';
-    homepage = "http://phrat.de/index.html";
-    license = licenses.isc;
-    maintainers = [ maintainers.AndersonTorres ];
-    platforms = libX11.meta.platforms;
+    changelog = "http://phrat.de/README";
+    license = lib.licenses.isc;
+    mainProgram = "yeahwm";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (libX11.meta) platforms;
  };
-}
+})
--- a/pkgs/development/coq-modules/serapi/default.nix
+++ b/pkgs/development/coq-modules/serapi/default.nix
@ -89,7 +89,7 @@ in
    then [
      ./janestreet-0.15.patch
    ]
-    else if version == "8.17.0+0.17.0"
+    else if version == "8.16.0+0.16.3" || version == "8.17.0+0.17.0"
    then [
      ./janestreet-0.16.patch
    ]
--- a/pkgs/development/interpreters/cel-go/default.nix
+++ b/pkgs/development/interpreters/cel-go/default.nix
@ -5,18 +5,18 @@

 buildGoModule rec {
  pname = "cel-go";
-  version = "0.18.0";
+  version = "0.18.1";

  src = fetchFromGitHub {
    owner = "google";
    repo = "cel-go";
    rev = "v${version}";
-    hash = "sha256-+YGRcTlPKTdecMicW4UjupSnuuq5msfGKTP/bwOf7dw=";
+    hash = "sha256-eXltZkg5QjdCrL9sk2ngVtirSnjBBqk+OdNLY4QtVx4=";
  };

  modRoot = "repl";

-  vendorHash = "sha256-RSCZOR++WBoGffCQp114Sa1Dbms2tBa0xceVQ3skwR4=";
+  vendorHash = "sha256-kalTHpyMYrKZHayxNKLc8vtogiDKyyQLExOQhqp1MUY=";

  patches = [
    # repl/go.mod and repl/go.sum are outdated
--- a/pkgs/development/interpreters/clisp/bits_ipctypes_to_sys_ipc.patch
+++ b/pkgs/development/interpreters/clisp/bits_ipctypes_to_sys_ipc.patch
@ -1,12 +0,0 @@
-diff -ru a/modules/bindings/glibc/linux.lisp b/modules/bindings/glibc/linux.lisp
--- a/modules/bindings/glibc/linux.lisp	2008-10-10 16:15:49.000000000 +0300
-+++ b/modules/bindings/glibc/linux.lisp	2012-12-04 01:01:35.000000000 +0200
-@@ -86,7 +86,7 @@
- 
- (def-c-type __key_t)            ; int
- 
-(c-lines "#include <bits/ipctypes.h>~%")
-+(c-lines "#include <sys/ipc.h>~%")
- (def-c-type __ipc_pid_t)        ; ushort
- 
- ; --------------------------- <sys/types.h> -----------------------------------
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@ -3,10 +3,26 @@
 # - base (default): contains readline and i18n, regexp and syscalls modules
 #   by default
 # - full: contains base plus modules in withModules
-{ lib, stdenv, fetchurl, libsigsegv, gettext, ncurses, readline, libX11
-, libXau, libXt, pcre, zlib, libXpm, xorgproto, libXext
+{ lib
+, stdenv
+, fetchFromGitLab
+, autoconf269
+, automake
+, libtool
+, libsigsegv
+, gettext
+, ncurses
+, pcre
+, zlib
+, readline
 , libffi
 , libffcall
+, libX11
+, libXau
+, libXt
+, libXpm
+, libXext
+, xorgproto
 , coreutils
 # build options
 , threadSupport ? stdenv.hostPlatform.isx86
@ -16,26 +32,30 @@
    "pcre"
    "rawsock"
  ]
-  ++ lib.optionals stdenv.isLinux [ "bindings/glibc" "zlib" "wildcard" ]
+  ++ lib.optionals stdenv.isLinux [ "bindings/glibc" "zlib" ]
  ++ lib.optional x11Support "clx/new-clx"
 }:

 assert x11Support -> (libX11 != null && libXau != null && libXt != null
  && libXpm != null && xorgproto != null && libXext != null);

-stdenv.mkDerivation rec {
-  version = "2.49";
+let
+  ffcallAvailable = stdenv.isLinux && (libffcall != null);
+in
+
+stdenv.mkDerivation {
+  version = "2.50pre20230112";
  pname = "clisp";

-  src = fetchurl {
-    url = "mirror://gnu/clisp/release/${version}/clisp-${version}.tar.bz2";
-    sha256 = "8132ff353afaa70e6b19367a25ae3d5a43627279c25647c220641fed00f8e890";
+  src = fetchFromGitLab {
+    owner = "gnu-clisp";
+    repo = "clisp";
+    rev = "bf72805c4dace982a6d3399ff4e7f7d5e77ab99a";
+    hash = "sha256-sQoN2FUg9BPaCgvCF91lFsU/zLja1NrgWsEIr2cPiqo=";
  };

-  inherit libsigsegv gettext coreutils;
-
-  ffcallAvailable = stdenv.isLinux && (libffcall != null);
-
+  strictDeps = true;
+  nativeBuildInputs = lib.optionals stdenv.isDarwin [ autoconf269 automake libtool ];
  buildInputs = [libsigsegv]
  ++ lib.optional (gettext != null) gettext
  ++ lib.optional (ncurses != null) ncurses
@ -49,24 +69,28 @@ stdenv.mkDerivation rec {
  ];

  patches = [
-    ./bits_ipctypes_to_sys_ipc.patch # from Gentoo
-    # The cfree alias no longer exists since glibc 2.26
-    ./remove-cfree-binding.patch
+    ./gnulib_aarch64.patch
  ];

  # First, replace port 9090 (rather low, can be used)
  # with 64237 (much higher, IANA private area, not
  # anything rememberable).
-  # Also remove reference to a type that disappeared from recent glibc
-  # (seems the correct thing to do, found no reference to any solution)
  postPatch = ''
    sed -e 's@9090@64237@g' -i tests/socket.tst
    sed -i 's@/bin/pwd@${coreutils}&@' src/clisp-link.in
    find . -type f | xargs sed -e 's/-lICE/-lXau &/' -i
-
-    substituteInPlace modules/bindings/glibc/linux.lisp --replace "(def-c-type __swblk_t)" ""
  '';

+  preConfigure = lib.optionalString stdenv.isDarwin (''
+    cd src
+    autoreconf -f -i -I m4 -I glm4
+    cd -
+  '' + lib.concatMapStrings (x: ''
+    cd modules/${x}
+    autoreconf -f -i -I ../../src -I ../../src/m4 -I ../../src/glm4
+    cd -
+  '') withModules);
+
  configureFlags = [ "builddir" ]
  ++ lib.optional (!dllSupport) "--without-dynamic-modules"
  ++ lib.optional (readline != null) "--with-readline"
@ -74,35 +98,27 @@ stdenv.mkDerivation rec {
  ++ lib.optional (ffcallAvailable && (libffi != null)) "--with-dynamic-ffi"
  ++ lib.optional ffcallAvailable "--with-ffcall"
  ++ lib.optional (!ffcallAvailable) "--without-ffcall"
-  ++ builtins.map (x: "--with-module=" + x) withModules
+  ++ builtins.map (x: " --with-module=" + x) withModules
  ++ lib.optional threadSupport "--with-threads=POSIX_THREADS";

  preBuild = ''
    sed -e '/avcall.h/a\#include "config.h"' -i src/foreign.d
+    sed -i -re '/ cfree /d' -i modules/bindings/glibc/linux.lisp
    cd builddir
  '';

-  # Fails to build in parallel due to missing gnulib header dependency used in charstrg.d:
-  #   ../src/charstrg.d:319:10: fatal error: uniwidth.h: No such file or directory
-  enableParallelBuilding = false;
-
  postInstall =
    lib.optionalString (withModules != [])
      (''./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full''
      + lib.concatMapStrings (x: " " + x) withModules);

-  env.NIX_CFLAGS_COMPILE = "-O0 ${lib.optionalString (!stdenv.is64bit) "-falign-functions=4"}";
-
-  # TODO : make mod-check fails
-  doCheck = false;
+  env.NIX_CFLAGS_COMPILE = "-O0 -falign-functions=${if stdenv.is64bit then "8" else "4"}";

  meta = {
    description = "ANSI Common Lisp Implementation";
-    homepage = "http://clisp.cons.org";
+    homepage = "http://clisp.org";
    maintainers = lib.teams.lisp.members;
-    platforms = lib.platforms.unix;
-    # problems on Darwin: https://github.com/NixOS/nixpkgs/issues/20062
-    broken = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAarch64;
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Plus;
+    platforms = with lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/development/interpreters/clisp/gnulib_aarch64.patch
+++ b/pkgs/development/interpreters/clisp/gnulib_aarch64.patch
@ -0,0 +1,13 @@
+diff --git a/src/gllib/vma-iter.c b/src/gllib/vma-iter.c
+index 6045f21d7..d50a3a398 100644
+--- a/src/gllib/vma-iter.c
+++ b/src/gllib/vma-iter.c
+@@ -1327,7 +1327,7 @@ vma_iterate (vma_iterate_callback_fn callback, void *data)
+          In 64-bit processes, we could use vm_region_64 or mach_vm_region.
+          I choose vm_region_64 because it uses the same types as vm_region,
+          resulting in less conditional code.  */
+-# if defined __ppc64__ || defined __x86_64__
+# if defined __aarch64__ || defined __ppc64__ || defined __x86_64__
+       struct vm_region_basic_info_64 info;
+       mach_msg_type_number_t info_count = VM_REGION_BASIC_INFO_COUNT_64;
+ 
--- a/pkgs/development/interpreters/clisp/hg.nix
+++ b/pkgs/development/interpreters/clisp/hg.nix
@ -1,98 +0,0 @@
-# there are the following linking sets:
-# - boot (not installed): without modules, only used when building clisp
-# - base (default): contains readline and i18n, regexp and syscalls modules
-#   by default
-# - full: contains base plus modules in withModules
-{ lib, stdenv, fetchhg, libsigsegv, gettext, ncurses, readline, libX11
-, libXau, libXt, pcre, zlib, libXpm, xorgproto, libXext
-, libffi, libffcall, automake
-, coreutils
-# build options
-, threadSupport ? stdenv.hostPlatform.isx86
-, x11Support ? stdenv.hostPlatform.isx86
-, dllSupport ? true
-, withModules ? [
-    "pcre"
-    "rawsock"
-  ]
-  ++ lib.optionals stdenv.isLinux [ "bindings/glibc" "zlib" ]
-  ++ lib.optional x11Support "clx/new-clx"
-}:
-
-assert x11Support -> (libX11 != null && libXau != null && libXt != null
-  && libXpm != null && xorgproto != null && libXext != null);
-
-stdenv.mkDerivation rec {
-  version = "2.50pre20171114";
-  pname = "clisp";
-
-  src = fetchhg {
-    url = "http://hg.code.sf.net/p/clisp/clisp";
-    rev = "36df6dc59b8f";
-    sha256 = "1pidiv1m55lvc4ln8vx0ylnnhlj95y6hrfdq96nrj14f4v8fkvmr";
-  };
-
-  inherit libsigsegv gettext coreutils;
-
-  ffcallAvailable = stdenv.isLinux && (libffcall != null);
-
-  nativeBuildInputs = [ automake ]; # sometimes fails otherwise
-  buildInputs = [libsigsegv]
-  ++ lib.optional (gettext != null) gettext
-  ++ lib.optional (ncurses != null) ncurses
-  ++ lib.optional (pcre != null) pcre
-  ++ lib.optional (zlib != null) zlib
-  ++ lib.optional (readline != null) readline
-  ++ lib.optional (ffcallAvailable && (libffi != null)) libffi
-  ++ lib.optional ffcallAvailable libffcall
-  ++ lib.optionals x11Support [
-    libX11 libXau libXt libXpm xorgproto libXext
-  ];
-
-  # First, replace port 9090 (rather low, can be used)
-  # with 64237 (much higher, IANA private area, not
-  # anything rememberable).
-  # Also remove reference to a type that disappeared from recent glibc
-  # (seems the correct thing to do, found no reference to any solution)
-  postPatch = ''
-    sed -e 's@9090@64237@g' -i tests/socket.tst
-    sed -i 's@/bin/pwd@${coreutils}&@' src/clisp-link.in
-    find . -type f | xargs sed -e 's/-lICE/-lXau &/' -i
-
-    substituteInPlace modules/bindings/glibc/linux.lisp --replace "(def-c-type __swblk_t)" ""
-  '';
-
-  configureFlags = [ "builddir" ]
-  ++ lib.optional (!dllSupport) "--without-dynamic-modules"
-  ++ lib.optional (readline != null) "--with-readline"
-  # --with-dynamic-ffi can only exist with --with-ffcall - foreign.d does not compile otherwise
-  ++ lib.optional (ffcallAvailable && (libffi != null)) "--with-dynamic-ffi"
-  ++ lib.optional ffcallAvailable "--with-ffcall"
-  ++ lib.optional (!ffcallAvailable) "--without-ffcall"
-  ++ builtins.map (x: " --with-module=" + x) withModules
-  ++ lib.optional threadSupport "--with-threads=POSIX_THREADS";
-
-  preBuild = ''
-    sed -e '/avcall.h/a\#include "config.h"' -i src/foreign.d
-    sed -i -re '/ cfree /d' -i modules/bindings/glibc/linux.lisp
-    cd builddir
-  '';
-
-  postInstall =
-    lib.optionalString (withModules != [])
-      (''./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full''
-      + lib.concatMapStrings (x: " " + x) withModules);
-
-  env.NIX_CFLAGS_COMPILE = "-O0 ${lib.optionalString (!stdenv.is64bit) "-falign-functions=4"}";
-
-  # TODO : make mod-check fails
-  doCheck = false;
-
-  meta = {
-    description = "ANSI Common Lisp Implementation";
-    homepage = "http://clisp.cons.org";
-    maintainers = lib.teams.lisp.members;
-    # problems on Darwin: https://github.com/NixOS/nixpkgs/issues/20062
-    platforms = lib.platforms.linux;
-  };
-}
--- a/pkgs/development/interpreters/clisp/remove-cfree-binding.patch
+++ b/pkgs/development/interpreters/clisp/remove-cfree-binding.patch
@ -1,12 +0,0 @@
-diff --git a/modules/bindings/glibc/linux.lisp b/modules/bindings/glibc/linux.lisp
-index c40b4f8..1c8edca 100644
--- a/modules/bindings/glibc/linux.lisp
-+++ b/modules/bindings/glibc/linux.lisp
-@@ -648,7 +648,6 @@
- (def-call-out calloc (:arguments (nmemb size_t) (size size_t))
-   (:return-type c-pointer))
- (def-call-out free (:arguments (ptr c-pointer)) (:return-type nil))
-(def-call-out cfree (:arguments (ptr c-pointer)) (:return-type nil))
- (def-call-out valloc (:arguments (size size_t)) (:return-type c-pointer))
- 
- (def-call-out abort (:arguments) (:return-type nil))
--- a/pkgs/development/interpreters/micropython/default.nix
+++ b/pkgs/development/interpreters/micropython/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "micropython";
-  version = "1.19.1";
+  version = "1.20.0";

  src = fetchFromGitHub {
    owner = "micropython";
    repo = "micropython";
    rev = "v${version}";
-    sha256 = "sha256-BoX3Z3Zr/AQqkgRrq+UVgdoDqNESDTNsY9AtrElpzfA=";
+    sha256 = "sha256-XTkw0M2an13xlRlDusyHYqwNeHqhq4mryRC5/pk+5Ko=";
    fetchSubmodules = true;
  };

@ -33,7 +33,6 @@ stdenv.mkDerivation rec {
  doCheck = true;

  skippedTests = ""
-    + lib.optionalString (stdenv.isDarwin) " -e uasyncio_basic -e uasyncio_heaplock -e uasyncio_wait_task"
    + lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) " -e ffi_callback"
    + lib.optionalString (stdenv.isLinux && stdenv.isAarch64) " -e float_parse"
  ;
@ -49,7 +48,7 @@ stdenv.mkDerivation rec {
  installPhase = ''
    runHook preInstall
    mkdir -p $out/bin
-    install -Dm755 ports/unix/micropython -t $out/bin
+    install -Dm755 ports/unix/build-standard/micropython -t $out/bin
    runHook postInstall
  '';

--- a/pkgs/development/libraries/cyclonedds/default.nix
+++ b/pkgs/development/libraries/cyclonedds/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "cyclonedds";
-  version = "0.10.3";
+  version = "0.10.4";

  src = fetchFromGitHub {
    owner = "eclipse-cyclonedds";
    repo = "cyclonedds";
    rev = version;
-    sha256 = "sha256-Ie2l2TwEXqhMZWL3CmQD+c8LdQlclP6egsP7jnsOAlM=";
+    sha256 = "sha256-LSCfQPyd/QOsrnLNbKb0OlCvmHi/2aDDhi8VeXpYb1w=";
  };

  patches = [
--- a/pkgs/development/libraries/gtkmm/3.x.nix
+++ b/pkgs/development/libraries/gtkmm/3.x.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "gtkmm";
-  version = "3.24.7";
+  version = "3.24.8";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "HXo1r5xc7MrLJE7jwt65skVyDYUQrFx+b0tvmUfmeJw=";
+    sha256 = "0pQMZJIuW5WFVLI9TEHRg56p5D4NLls4Gc+0aCSgmMQ=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/libfyaml/default.nix
+++ b/pkgs/development/libraries/libfyaml/default.nix
@ -1,31 +1,39 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook, testers }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libfyaml";
-  version = "0.8";
+  version = "0.9";

  src = fetchFromGitHub {
    owner = "pantoniou";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-b/jRKe23NIVSydoczI+Ax2VjBJLfAEwF8SW61vIDTwA=";
+    repo = "libfyaml";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Id5pdFzjA9q67okfESO3LZH8jIz93mVgIEEuBbPjuGI=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];

  outputs = [ "bin" "dev" "out" "man" ];

+  configureFlags = [ "--disable-network" ];
+
  doCheck = true;

  preCheck = ''
    patchShebangs test
  '';

+  passthru.tests.pkg-config = testers.hasPkgConfigModules {
+    package = finalAttrs.finalPackage;
+  };
+
  meta = with lib; {
-    homepage = "https://github.com/pantoniou/libfyaml";
    description = "Fully feature complete YAML parser and emitter, supporting the latest YAML spec and passing the full YAML testsuite";
+    homepage = "https://github.com/pantoniou/libfyaml";
+    changelog = "https://github.com/pantoniou/libfyaml/releases/tag/v${finalAttrs.version}";
    license = licenses.mit;
    maintainers = [ maintainers.marsam ];
+    pkgConfigModules = [ "libfyaml" ];
    platforms = platforms.all;
  };
-}
+})
--- a/pkgs/development/libraries/libite/default.nix
+++ b/pkgs/development/libraries/libite/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libite";
-  version = "2.5.3";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "troglobit";
    repo = "libite";
    rev = "v${version}";
-    sha256 = "sha256-orxmd6yItB6XLj650RQb0CP/EnN9563v+P9xz9LEJkY=";
+    sha256 = "sha256-hdV8g/BFTI/QfEgVsf942SR0G5xdqP/+h+vnydt4kf0=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@ -13,7 +13,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "liblouis";
-  version = "3.26.0";
+  version = "3.27.0";

  outputs = [ "out" "dev" "info" "doc" ]
    # configure: WARNING: cannot generate manual pages while cross compiling
@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "liblouis";
    repo = "liblouis";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Kko9qBWdNiZ61Wbb7lUYoSNU1hhRUexPcU3pADv0UHo=";
+    hash = "sha256-5umpIscs4Y8MSaoY7yKtBFmlIa8QDQtjBxoysZ+GTm8=";
  };

  strictDeps = true;
--- a/pkgs/development/libraries/libsolv/default.nix
+++ b/pkgs/development/libraries/libsolv/default.nix
@ -16,14 +16,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "0.7.24";
+  version = "0.7.25";
  pname = "libsolv";

  src = fetchFromGitHub {
    owner = "openSUSE";
    repo = "libsolv";
    rev = version;
-    sha256 = "sha256-UTVnGJO/9mQF9RwK75hh6IkoP1MwAlFaLCtdYU8uS34=";
+    sha256 = "sha256-OSYfv8dTyoa2f1T/zCEruKczickP5jS05xjYLQQiFaY=";
  };

  cmakeFlags = [
--- a/pkgs/development/libraries/nghttp3/default.nix
+++ b/pkgs/development/libraries/nghttp3/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "nghttp3";
-  version = "0.14.0";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "ngtcp2";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-DqqT8rgGlbV0upe0E37AR8bk3SIsoyCXt8xJzIkz9xc=";
+    hash = "sha256-ZnfwPgjBAI2elHrx7uzc3JX2MdeX/hsrFKj4TfMK2tI=";
  };

  outputs = [ "out" "dev" "doc" ];
--- a/pkgs/development/libraries/opensubdiv/default.nix
+++ b/pkgs/development/libraries/opensubdiv/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "opensubdiv";
-  version = "3.5.0";
+  version = "3.5.1";

  src = fetchFromGitHub {
    owner = "PixarAnimationStudios";
    repo = "OpenSubdiv";
    rev = "v${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "sha256-pYD2HxAszE9Ux1xsSJ7s2R13U8ct5tDo3ZP7H0+F9Rc=";
+    sha256 = "sha256-uDKCT0Uoa5WQekMUFm2iZmzm+oWAZ6IWMwfpchkUZY0=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/pe-parse/default.nix
+++ b/pkgs/development/libraries/pe-parse/default.nix
@ -1,23 +1,16 @@
-{ stdenv, lib, fetchFromGitHub, cmake, fetchpatch }:
+{ lib, stdenv, fetchFromGitHub, cmake }:

 stdenv.mkDerivation rec {
  pname = "pe-parse";
-  version = "2.0.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "trailofbits";
    repo = "pe-parse";
    rev = "v${version}";
-    hash = "sha256-HwWlMRhpB/sa/JRyAZF7LZzkXCCyuxB+gtDAfHt7e6k=";
+    hash = "sha256-XegSZWRoQg6NEWuTSFI1RMvN3GbpLDrZrloPU2XdK2M=";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/trailofbits/pe-parse/commit/eecdb3d36eb44e306398a2e66e85490f9bdcc74c.patch";
-      hash = "sha256-pd6D/JMctiQqJxnJU9Nm/GDVf4/CaIGeXx1UfdcCupo=";
-    })
-  ];
-
  nativeBuildInputs = [ cmake ];

  doInstallCheck = true;
@ -28,6 +21,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "A principled, lightweight parser for Windows portable executable files";
    homepage = "https://github.com/trailofbits/pe-parse";
+    changelog = "https://github.com/trailofbits/pe-parse/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ arturcygan ];
    mainProgram = "dump-pe";
--- a/pkgs/development/libraries/science/astronomy/stellarsolver/default.nix
+++ b/pkgs/development/libraries/science/astronomy/stellarsolver/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "stellarsolver";
-  version = "2.4";
+  version = "2.5";

  src = fetchFromGitHub {
    owner = "rlancaste";
    repo = pname;
    rev = version;
-    sha256 = "sha256-HYNkpgkiRtA1ZsiFkmYk3MT3fKgs2d2neSExVXBbsPc=";
+    sha256 = "sha256-0bFGHlkZnAZlnxlj8tY3s9yTWgkNtSsPFfudB3uvyOA=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@ -103,6 +103,7 @@ mapAliases {
  parcel-bundler = parcel; # added 2023-09-04
  prettier_d_slim = pkgs.prettier-d-slim; # added 2023-09-14
  inherit (pkgs) quicktype; # added 2023-09-09
+  react-native-cli = throw "react-native-cli was removed because it was deprecated"; # added 2023-09-25
  inherit (pkgs) react-static; # added 2023-08-21
  readability-cli = pkgs.readability-cli; # Added 2023-06-12
  inherit (pkgs) redoc-cli; # added 2023-09-12
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@ -52,7 +52,6 @@
  prettier = "prettier";
  purescript-psa = "psa";
  purs-tidy = "purs-tidy";
-  react-native-cli = "react-native";
  react-tools = "jsx";
  remod-cli = "remod";
  svelte-language-server = "svelteserver";
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -191,6 +191,7 @@
 , "patch-package"
 , "peerflix"
 , "peerflix-server"
+, {"pgrok-build-deps": "../../tools/networking/pgrok/build-deps"}
 , "pkg"
 , "pm2"
 , "pnpm"
@ -210,7 +211,6 @@
 , "purty"
 , "pxder"
 , "pyright"
-, "react-native-cli"
 , "react-tools"
 , "remod-cli"
 , "reveal.js"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/ocaml-modules/qcheck/core.nix
+++ b/pkgs/development/ocaml-modules/qcheck/core.nix
@ -2,16 +2,15 @@

 buildDunePackage rec {
  pname = "qcheck-core";
-  version = "0.20";
+  version = "0.21.2";

  minimalOCamlVersion = "4.08";
-  duneVersion = "3";

  src = fetchFromGitHub {
    owner = "c-cube";
    repo = "qcheck";
    rev = "v${version}";
-    sha256 = "sha256-d3gleiaPEDJTbHtieL4oAq1NlA/0NtzdW9SA1sItFeQ=";
+    hash = "sha256-a+sjpvpQZbXjQgyx69hhVAmRCfDMMhFlg965dK5UN6Q=";
  };

  patches = [ ./bytes.patch ];
--- a/pkgs/development/php-packages/phalcon/default.nix
+++ b/pkgs/development/php-packages/phalcon/default.nix
@ -2,13 +2,13 @@

 buildPecl rec {
  pname = "phalcon";
-  version = "5.3.0";
+  version = "5.3.1";

  src = fetchFromGitHub {
    owner = "phalcon";
    repo = "cphalcon";
    rev = "v${version}";
-    hash = "sha256-82DJ+Qx0OYhw9Nv6FkAoyBec8WWfAiqNfBU9Ll/8RfA=";
+    hash = "sha256-FxGibpGlbNLqWDplCv4T4yUPg5US020niLfC7tHfkCU=";
  };

  internalDeps = [ php.extensions.session php.extensions.pdo ];
--- a/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "aliyun-python-sdk-iot";
-  version = "8.56.0";
+  version = "8.57.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-8d77P522c6gV8LhKErixzE2DvGmjr9bms+2eHYirgwg=";
+    hash = "sha256-Ea0IUn2mlu0c7QYJZkUrBUrtjUuTHoTeuvZHw/il+4A=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/app-model/default.nix
+++ b/pkgs/development/python-modules/app-model/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "app-model";
-  version = "0.2.1";
+  version = "0.2.2";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "pyapp-kit";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-1LldqihVCCgFdnsod751zWAAqkaaIH2qMpfsPYjWzgs=";
+    hash = "sha256-vo10BHUzvYlldAqTw/1LxgvSXgTM3LAls9jQIeB5LcU=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/async-tkinter-loop/default.nix
+++ b/pkgs/development/python-modules/async-tkinter-loop/default.nix
@ -10,13 +10,13 @@

 buildPythonPackage rec {
  pname = "async-tkinter-loop";
-  version = "0.8.1";
+  version = "0.9.1";
  format = "pyproject";

  src = fetchPypi {
    inherit version;
    pname = "async_tkinter_loop";
-    hash = "sha256-+9AvnYIZMWCbpCEKdbIadyU8zgyUlW/fRYYyDOxAzeg=";
+    hash = "sha256-Phxx9RovjU5JOonMt7Zhum0/BGRS5OLRAkLTl4L/BW4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aws-encryption-sdk/default.nix
+++ b/pkgs/development/python-modules/aws-encryption-sdk/default.nix
@ -48,7 +48,7 @@ buildPythonPackage rec {
    homepage = "https://aws-encryption-sdk-python.readthedocs.io/";
    changelog = "https://github.com/aws/aws-encryption-sdk-python/blob/v${version}/CHANGELOG.rst";
    description = "Fully compliant, native Python implementation of the AWS Encryption SDK.";
-    license = licenses.apsl20;
+    license = licenses.asl20;
    maintainers = with maintainers; [ anthonyroussel ];
  };
 }
--- a/pkgs/development/python-modules/base64io/default.nix
+++ b/pkgs/development/python-modules/base64io/default.nix
@ -23,7 +23,7 @@ buildPythonPackage rec {
    homepage = "https://base64io-python.readthedocs.io/";
    changelog = "https://github.com/aws/base64io-python/blob/${version}/CHANGELOG.rst";
    description = "Python stream implementation for base64 encoding/decoding";
-    license = licenses.apsl20;
+    license = licenses.asl20;
    maintainers = with maintainers; [ anthonyroussel ];
  };
 }
--- a/pkgs/development/python-modules/bluetooth-data-tools/default.nix
+++ b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "bluetooth-data-tools";
-  version = "1.11.0";
+  version = "1.12.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-iyfk0OOJezNCNyqRCbR2cTTTdgdYQM6hExTngd/3CtA=";
+    hash = "sha256-zdMqjZ7CEwDnvVvIe1breQ+/4ZwzdLk2CtI+GCY+3uk=";
  };

  # The project can build both an optimized cython version and an unoptimized
--- a/pkgs/development/python-modules/clarifai-grpc/default.nix
+++ b/pkgs/development/python-modules/clarifai-grpc/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "clarifai-grpc";
-  version = "9.8.0";
+  version = "9.8.4";
  format = "setuptools";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-hUx+dUx0Lkz6sEZizHqH8ONk2r19D9MIVuefhBmjEiQ=";
+    hash = "sha256-j+dtcNInkTcgcLt6IOjqVeI/qSczRNs9PhS9iPoUF+c=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "dbus-fast";
-  version = "2.9.0";
+  version = "2.10.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-0+uWnm0gygDL4sc2b+3dekgZfgAQZKfmJRMSDgyeMjk=";
+    hash = "sha256-GWRtk3MF6QdSOWmKWcdhTitutLkRoMsU+l+LGEefBEo=";
  };

  # The project can build both an optimized cython version and an unoptimized
--- a/pkgs/development/python-modules/django-postgresql-netfields/default.nix
+++ b/pkgs/development/python-modules/django-postgresql-netfields/default.nix
@ -1,18 +1,23 @@
-{ lib
+{ stdenv
+, lib
 , buildPythonPackage
 , django
 , netaddr
 , six
 , fetchFromGitHub
 , pythonOlder
+, djangorestframework
 # required for tests
-#, djangorestframework
-#, psycopg2
+, postgresql
+, postgresqlTestHook
+, psycopg2
+, pytestCheckHook
+, pytest-django
 }:

 buildPythonPackage rec {
  pname = "django-postgresql-netfields";
-  version = "1.3.0";
+  version = "1.3.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -21,7 +26,7 @@ buildPythonPackage rec {
    owner = "jimfunk";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-I+X4yfadtiiZlW7QhfwVbK1qyWn/khH9fWXszCo9uro=";
+    hash = "sha256-76vGvxxfNZQBCCsTkkSgQZ8PpFspWxJQDj/xq9iOSTU=";
  };

  propagatedBuildInputs = [
@ -30,23 +35,19 @@ buildPythonPackage rec {
    six
  ];

-  # tests need a postgres database
-  doCheck = false;
+  doCheck = !stdenv.isDarwin; # could not create shared memory segment: Operation not permitted

-  # keeping the dependencies below as comment for reference
-  # checkPhase = ''
-    # python manage.py test
-  # '';
+  nativeCheckInputs = [
+    djangorestframework
+    postgresql
+    postgresqlTestHook
+    psycopg2
+    pytestCheckHook
+    pytest-django
+  ];

-  # buildInputs = [
-    # djangorestframework
-    # psycopg2
-  # ];
-
-  # Requires psycopg2
-  # pythonImportsCheck = [
-  #   "netfields"
-  # ];
+  postgresqlTestUserOptions = "LOGIN SUPERUSER";
+  env.DJANGO_SETTINGS_MODULE = "testsettings";

  meta = with lib; {
    description = "Django PostgreSQL netfields implementation";
--- a/pkgs/development/python-modules/django-treebeard/default.nix
+++ b/pkgs/development/python-modules/django-treebeard/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "django-treebeard";
-  version = "4.6.1";
+  version = "4.7";
  format = "setuptools";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-hKs1BAJ31STrd5OeI1VoychWy1I8yWVXk7Zv6aPvRos=";
+    hash = "sha256-x1Gj+SQVjCiP6omvwlpxUZefrwG/Ef3HvjuFgJnfpW0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/drf-spectacular-sidecar/default.nix
+++ b/pkgs/development/python-modules/drf-spectacular-sidecar/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "drf-spectacular-sidecar";
-  version = "2023.3.1";
+  version = "2023.9.1";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "tfranzel";
    repo = "drf-spectacular-sidecar";
    rev = version;
-    hash = "sha256-UTH6t/znN4nYnqDhtFFxXoBXX8Zo19pJE9iDsvw7bGE=";
+    hash = "sha256-EoQKbxzXEuKC50/W1/tBB2wASJZmNNwg9r1qhIB4Ws8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/garth/default.nix
+++ b/pkgs/development/python-modules/garth/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "garth";
-  version = "0.4.26";
+  version = "0.4.27";
  format = "pyproject";

  disabled = pythonOlder "3.9";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Ezq9lZE6HTtuW396sKZ32mDvNjrkz6UHQGvLhXUjfnI=";
+    hash = "sha256-GOpYR1fudDKHbnxwAMCXrk95xYe0Pdi7pYebHua+IjM=";
  };

  nativeBuildInputs = [
--- a/Show More
+++ b/Show More