Merge master into haskell-updates

2025-02-01 17:53:14 +00:00 · 2022-09-05 00:17:51 +00:00 · 2022-09-05 00:17:51 +00:00 · 9bb9ff3be1
commit 9bb9ff3be1
parent 30f0a9c291 eb3d3b2e90
168 changed files with 2678 additions and 1136 deletions
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@ -458,7 +458,7 @@ you of the correct hash.
  `maturinBuildFlags`.
 * `cargoCheckHook`: run tests using Cargo. The build type for checks
  can be set using `cargoCheckType`. Features can be specified with
-  `cargoCheckNoDefaultFeaatures` and `cargoCheckFeatures`. Additional
+  `cargoCheckNoDefaultFeatures` and `cargoCheckFeatures`. Additional
  flags can be passed to the tests using `checkFlags` and
  `checkFlagsArray`. By default, tests are run in parallel. This can
  be disabled by setting `dontUseCargoParallelTests`.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2046,6 +2046,12 @@
    githubId = 1516457;
    name = "Christian Albrecht";
  };
+  CactiChameleon9 = {
+    email = "h19xjkkp@duck.com";
+    github = "CactiChameleon9";
+    githubId = 51231053;
+    name = "Daniel";
+  };
  callahad = {
    email = "dan.callahan@gmail.com";
    github = "callahad";
@ -4340,6 +4346,12 @@
    githubId = 415760;
    name = "Jonas Höglund";
  };
+  firefly-cpp = {
+    email = "iztok@iztok-jr-fister.eu";
+    github = "firefly-cpp";
+    githubId = 1633361;
+    name = "Iztok Fister Jr.";
+  };
  fishi0x01 = {
    email = "fishi0x01@gmail.com";
    github = "fishi0x01";
@ -6490,6 +6502,12 @@
    githubId = 752510;
    name = "Martin Potier";
  };
+  jqqqqqqqqqq = {
+    email = "jqqqqqqqqqq@gmail.com";
+    github = "jqqqqqqqqqq";
+    githubId = 12872927;
+    name = "Curtis Jiang";
+  };
  jqueiroz = {
    email = "nixos@johnjq.com";
    github = "jqueiroz";
@ -9686,6 +9704,12 @@
    github = "numkem";
    githubId = 332423;
  };
+  nviets = {
+    email = "nathan.g.viets@gmail.com";
+    github = "nviets";
+    githubId = 16027994;
+    name = "Nathan Viets";
+  };
  nyanloutre = {
    email = "paul@nyanlout.re";
    github = "nyanloutre";
@ -11570,6 +11594,12 @@
      fingerprint = "AE8C 0836 FDF6 3FFC 9580  C588 B156 8953 B193 9F1C";
    }];
  };
+  samlukeyes123 = {
+    email = "samlukeyes123@gmail.com";
+    github = "SamLukeYes";
+    githubId = 12882091;
+    name = "Sam L. Yes";
+  };
  samrose = {
    email = "samuel.rose@gmail.com";
    github = "samrose";
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -243,6 +243,14 @@
          <link linkend="opt-services.schleuder.enable">services.schleuder</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://www.dolibarr.org/">Dolibarr</link>,
+          an enterprise resource planning and customer relationship
+          manager. Enable using
+          <link linkend="opt-services.dolibarr.enable">services.dolibarr</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://www.expressvpn.com">expressvpn</link>,
@ -437,6 +445,13 @@
          <literal>&quot;wine64&quot;</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>paperless</literal> module now defaults
+          <literal>PAPERLESS_TIME_ZONE</literal> to your configured
+          system timezone.
+        </para>
+      </listitem>
      <listitem>
        <para>
          (Neo)Vim can not be configured with
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -88,6 +88,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [schleuder](https://schleuder.org/), a mailing list manager with PGP support. Enable using [services.schleuder](#opt-services.schleuder.enable).

+- [Dolibarr](https://www.dolibarr.org/), an enterprise resource planning and customer relationship manager. Enable using [services.dolibarr](#opt-services.dolibarr.enable).
+
 - [expressvpn](https://www.expressvpn.com), the CLI client for ExpressVPN. Available as [services.expressvpn](#opt-services.expressvpn.enable).

 - [Grafana Tempo](https://www.grafana.com/oss/tempo/), a distributed tracing store. Available as [services.tempo](#opt-services.tempo.enable).
@ -153,6 +155,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).

 - The `meta.mainProgram` attribute of packages in `wineWowPackages` now defaults to `"wine64"`.

+- The `paperless` module now defaults `PAPERLESS_TIME_ZONE` to your configured system timezone.
+
 - (Neo)Vim can not be configured with `configure.pathogen` anymore to reduce maintainance burden.
 Use `configure.packages` instead.

--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@ -73,8 +73,8 @@ in
    };

    colors = mkOption {
-      type = types.listOf types.str;
-      default = [];
+      type = with types; listOf (strMatching "[[:xdigit:]]{6}");
+      default = [ ];
      example = [
        "002b36" "dc322f" "859900" "b58900"
        "268bd2" "d33682" "2aa198" "eee8d5"
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@ -27,9 +27,13 @@ with lib;
    fonts.fontconfig.enable = false;

    nixpkgs.overlays = singleton (const (super: {
+      beam = super.beam_nox;
      cairo = super.cairo.override { x11Support = false; };
      dbus = super.dbus.override { x11Support = false; };
-      beam = super.beam_nox;
+      ffmpeg_4 = super.ffmpeg_4.override { sdlSupport = false; vdpauSupport = false; };
+      ffmpeg_5 = super.ffmpeg_5.override { sdlSupport = false; vdpauSupport = false; };
+      gobject-introspection = super.gobject-introspection.override { x11Support = false; };
+      libva = super.libva-minimal;
      networkmanager-fortisslvpn = super.networkmanager-fortisslvpn.override { withGnome = false; };
      networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
      networkmanager-l2tp = super.networkmanager-l2tp.override { withGnome = false; };
@ -37,7 +41,6 @@ with lib;
      networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
      networkmanager-sstp = super.networkmanager-vpnc.override { withGnome = false; };
      networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
-      gobject-introspection = super.gobject-introspection.override { x11Support = false; };
      qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
    }));
  };
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1065,6 +1065,7 @@
  ./services/web-apps/discourse.nix
  ./services/web-apps/documize.nix
  ./services/web-apps/dokuwiki.nix
+  ./services/web-apps/dolibarr.nix
  ./services/web-apps/engelsystem.nix
  ./services/web-apps/ethercalc.nix
  ./services/web-apps/fluidd.nix
--- a/nixos/modules/programs/gnupg.nix
+++ b/nixos/modules/programs/gnupg.nix
@ -135,7 +135,7 @@ in
      # The SSH agent protocol doesn't have support for changing TTYs; however we
      # can simulate this with the `exec` feature of openssh (see ssh_config(5))
      # that hooks a command to the shell currently running the ssh program.
-      Match host * exec "${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye > /dev/null"
+      Match host * exec "${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye >/dev/null 2>&1"
    '';

    environment.extraInit = mkIf cfg.agent.enableSSHSupport ''
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@ -17,9 +17,11 @@ let
    GUNICORN_CMD_ARGS = "--bind=${cfg.address}:${toString cfg.port}";
  } // (
    lib.mapAttrs (_: toString) cfg.extraConfig
-  ) // (optionalAttrs enableRedis {
+  ) // optionalAttrs (config.time.timeZone != null) {
+    PAPERLESS_TIME_ZONE = lib.mkDefault config.time.timeZone;
+  } // optionalAttrs enableRedis {
    PAPERLESS_REDIS = "unix://${redisServer.unixSocket}";
-  });
+  };

  manage = let
    setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
@ -174,11 +176,10 @@ in
        See [the documentation](https://paperless-ngx.readthedocs.io/en/latest/configuration.html)
        for available options.
      '';
-      example = literalExpression ''
-        {
-          PAPERLESS_OCR_LANGUAGE = "deu+eng";
-        }
-      '';
+      example = {
+        PAPERLESS_OCR_LANGUAGE = "deu+eng";
+        PAPERLESS_DBHOST = "/run/postgresql";
+      };
    };

    user = mkOption {
@ -285,12 +286,13 @@ in
        '';
        Restart = "on-failure";

-        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
-        CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
-        # gunicorn needs setuid
-        SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "@setuid" ];
+        # gunicorn needs setuid, liblapack needs mbind
+        SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "@setuid mbind" ];
        # Needs to serve web page
        PrivateNetwork = false;
+      } // lib.optionalAttrs (cfg.port < 1024) {
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
      };
      environment = env // {
        PATH = mkForce cfg.package.path;
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -72,6 +72,7 @@ let
    "unbound"
    "unifi"
    "unifi-poller"
+    "v2ray"
    "varnish"
    "wireguard"
    "flow"
--- a/nixos/modules/services/monitoring/prometheus/exporters/v2ray.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/v2ray.nix
@ -0,0 +1,29 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.v2ray;
+in
+{
+  port = 9299;
+  extraOpts = {
+    v2rayEndpoint = mkOption {
+      type = types.str;
+      default = "127.0.0.1:54321";
+      description = ''
+        v2ray grpc api endpoint
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-v2ray-exporter}/bin/v2ray-exporter \
+          --v2ray-endpoint ${cfg.v2rayEndpoint} \
+          --listen ${cfg.listenAddress}:${toString cfg.port} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/networking/minidlna.nix
+++ b/nixos/modules/services/networking/minidlna.nix
@ -1,6 +1,5 @@
 # Module for MiniDLNA, a simple DLNA server.
 { config, lib, pkgs, ... }:
-
 with lib;

 let
@ -34,8 +33,7 @@ in
    default = {};
    description = lib.mdDoc ''
      The contents of MiniDLNA's configuration file.
-      When the service is activated, a basic template is generated
-      from the current options opened here.
+      When the service is activated, a basic template is generated from the current options opened here.
    '';
    type = types.submodule {
      freeformType = settingsFormat.type;
@ -46,10 +44,8 @@ in
        example = [ "/data/media" "V,/home/alice/video" ];
        description = lib.mdDoc ''
          Directories to be scanned for media files.
-          The prefixes `A,`,`V,` and
-          `P,` restrict a directory to audio, video
-          or image files. The directories must be accessible to the
-          `minidlna` user account.
+          The `A,` `V,` `P,` prefixes restrict a directory to audio, video or image files.
+          The directories must be accessible to the `minidlna` user account.
        '';
      };
      options.notify_interval = mkOption {
@ -57,18 +53,11 @@ in
        default = 90000;
        description = lib.mdDoc ''
          The interval between announces (in seconds).
-          Instead of waiting on announces, one can open port UDP 1900 or
-          set `openFirewall` option to use SSDP discovery.
-          Furthermore announce interval has now been set as 90000 in order
-          to prevent disconnects with certain clients and to rely solely
-          on the SSDP method.
-
-          Lower values (e.g. 60 seconds) should be used if one does not
-          want to utilize SSDP. By default miniDLNA will announce its
-          presence on the network approximately every 15 minutes. Many
-          people prefer shorter announce intervals on their home networks,
-          especially when DLNA clients are started on demand.
+          Instead of waiting for announces, you should set `openFirewall` option to use SSDP discovery.
+          Furthermore, this option has been set to 90000 in order to prevent disconnects with certain
+          clients and relies solely on the discovery.

+          Lower values (e.g. 30 seconds) should be used if you can't use the discovery.
          Some relevant information can be found here:
          https://sourceforge.net/p/minidlna/discussion/879957/thread/1389d197/
        '';
@ -86,7 +75,7 @@ in
      };
      options.friendly_name = mkOption {
        type = types.str;
-        default = "${config.networking.hostName} MiniDLNA";
+        default = config.networking.hostName;
        defaultText = literalExpression "config.networking.hostName";
        example = "rpi3";
        description = lib.mdDoc "Name that the DLNA server presents to clients.";
@ -116,7 +105,7 @@ in
      options.wide_links = mkOption {
        type = types.enum [ "yes" "no" ];
        default = "no";
-        description = lib.mdDoc "Set this to yes to allow symlinks that point outside user-defined media_dirs.";
+        description = lib.mdDoc "Set this to yes to allow symlinks that point outside user-defined `media_dir`.";
      };
    };
  };
--- a/nixos/modules/services/web-apps/dokuwiki.nix
+++ b/nixos/modules/services/web-apps/dokuwiki.nix
@ -329,6 +329,7 @@ in
      "d ${stateDir hostName}/cache 0750 ${user} ${webserver.group} - -"
      "d ${stateDir hostName}/index 0750 ${user} ${webserver.group} - -"
      "d ${stateDir hostName}/locks 0750 ${user} ${webserver.group} - -"
+      "d ${stateDir hostName}/log 0750 ${user} ${webserver.group} - -"
      "d ${stateDir hostName}/media 0750 ${user} ${webserver.group} - -"
      "d ${stateDir hostName}/media_attic 0750 ${user} ${webserver.group} - -"
      "d ${stateDir hostName}/media_meta 0750 ${user} ${webserver.group} - -"
--- a/nixos/modules/services/web-apps/dolibarr.nix
+++ b/nixos/modules/services/web-apps/dolibarr.nix
@ -0,0 +1,320 @@
+{ config, pkgs, lib, ... }:
+let
+  inherit (lib) any boolToString concatStringsSep isBool isString literalExpression mapAttrsToList mkDefault mkEnableOption mkIf mkOption optionalAttrs types;
+
+  package = pkgs.dolibarr.override { inherit (cfg) stateDir; };
+
+  cfg = config.services.dolibarr;
+  vhostCfg = config.services.nginx.virtualHosts."${cfg.domain}";
+
+  mkConfigFile = filename: settings:
+    let
+      # hack in special logic for secrets so we read them from a separate file avoiding the nix store
+      secretKeys = [ "force_install_databasepass" "dolibarr_main_db_pass" "dolibarr_main_instance_unique_id" ];
+
+      toStr = k: v:
+        if (any (str: k == str) secretKeys) then v
+        else if isString v then "'${v}'"
+        else if isBool v then boolToString v
+        else if isNull v then "null"
+        else toString v
+      ;
+    in
+      pkgs.writeText filename ''
+        <?php
+        ${concatStringsSep "\n" (mapAttrsToList (k: v: "\$${k} = ${toStr k v};") settings)}
+      '';
+
+  # see https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/install/install.forced.sample.php for all possible values
+  install = {
+    force_install_noedit = 2;
+    force_install_main_data_root = "${cfg.stateDir}/documents";
+    force_install_nophpinfo = true;
+    force_install_lockinstall = "444";
+    force_install_distrib = "nixos";
+    force_install_type = "mysqli";
+    force_install_dbserver = cfg.database.host;
+    force_install_port = toString cfg.database.port;
+    force_install_database = cfg.database.name;
+    force_install_databaselogin = cfg.database.user;
+
+    force_install_mainforcehttps = vhostCfg.forceSSL;
+    force_install_createuser = false;
+    force_install_dolibarrlogin = null;
+  } // optionalAttrs (cfg.database.passwordFile != null) {
+    force_install_databasepass = ''file_get_contents("${cfg.database.passwordFile}")'';
+  };
+in
+{
+  # interface
+  options.services.dolibarr = {
+    enable = mkEnableOption "dolibarr";
+
+    domain = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = ''
+        Domain name of your server.
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "dolibarr";
+      description = ''
+        User account under which dolibarr runs.
+
+        <note><para>
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the dolibarr application starts.
+        </para></note>
+      '';
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "dolibarr";
+      description = ''
+        Group account under which dolibarr runs.
+
+        <note><para>
+          If left as the default value this group will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the group exists before the dolibarr application starts.
+        </para></note>
+      '';
+    };
+
+    stateDir = mkOption {
+      type = types.str;
+      default = "/var/lib/dolibarr";
+      description = ''
+        State and configuration directory dolibarr will use.
+      '';
+    };
+
+    database = {
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = "Database host address.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 3306;
+        description = "Database host port.";
+      };
+      name = mkOption {
+        type = types.str;
+        default = "dolibarr";
+        description = "Database name.";
+      };
+      user = mkOption {
+        type = types.str;
+        default = "dolibarr";
+        description = "Database username.";
+      };
+      passwordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/run/keys/dolibarr-dbpassword";
+        description = "Database password file.";
+      };
+      createLocally = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Create the database and database user locally.";
+      };
+    };
+
+    settings = mkOption {
+      type = with types; (attrsOf (oneOf [ bool int str ]));
+      default = { };
+      description = lib.mdDoc "Dolibarr settings, see <https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/conf/conf.php.example> for details.";
+    };
+
+    nginx = mkOption {
+      type = types.nullOr (types.submodule (
+        lib.recursiveUpdate
+          (import ../web-servers/nginx/vhost-options.nix { inherit config lib; })
+          {
+            # enable encryption by default,
+            # as sensitive login and Dolibarr (ERP) data should not be transmitted in clear text.
+            options.forceSSL.default = true;
+            options.enableACME.default = true;
+          }
+      ));
+      default = null;
+      example = lib.literalExpression ''
+        {
+          serverAliases = [
+            "dolibarr.''${config.networking.domain}"
+            "erp.''${config.networking.domain}"
+          ];
+          enableACME = false;
+        }
+      '';
+      description = lib.mdDoc ''
+          With this option, you can customize an nginx virtual host which already has sensible defaults for Dolibarr.
+          Set to {} if you do not need any customization to the virtual host.
+          If enabled, then by default, the {option}`serverName` is
+          `''${domain}`,
+          SSL is active, and certificates are acquired via ACME.
+          If this is set to null (the default), no nginx virtualHost will be configured.
+      '';
+    };
+
+    poolConfig = mkOption {
+      type = with types; attrsOf (oneOf [ str int bool ]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+      };
+      description = lib.mdDoc ''
+        Options for the Dolibarr PHP pool. See the documentation on [`php-fpm.conf`](https://www.php.net/manual/en/install.fpm.configuration.php)
+        for details on configuration directives.
+      '';
+    };
+  };
+
+  # implementation
+  config = mkIf cfg.enable {
+
+    assertions = [
+      { assertion = cfg.database.createLocally -> cfg.database.user == cfg.user;
+        message = "services.dolibarr.database.user must match services.dolibarr.user if the database is to be automatically provisioned";
+      }
+    ];
+
+    services.dolibarr.settings = {
+      dolibarr_main_url_root = "https://${cfg.domain}";
+      dolibarr_main_document_root = "${package}/htdocs";
+      dolibarr_main_url_root_alt = "/custom";
+      dolibarr_main_data_root = "${cfg.stateDir}/documents";
+
+      dolibarr_main_db_host = cfg.database.host;
+      dolibarr_main_db_port = toString cfg.database.port;
+      dolibarr_main_db_name = cfg.database.name;
+      dolibarr_main_db_prefix = "llx_";
+      dolibarr_main_db_user = cfg.database.user;
+      dolibarr_main_db_pass = mkIf (cfg.database.passwordFile != null) ''
+        file_get_contents("${cfg.database.passwordFile}")
+      '';
+      dolibarr_main_db_type = "mysqli";
+      dolibarr_main_db_character_set = mkDefault "utf8";
+      dolibarr_main_db_collation = mkDefault "utf8_unicode_ci";
+
+      # Authentication settings
+      dolibarr_main_authentication = mkDefault "dolibarr";
+
+      # Security settings
+      dolibarr_main_prod = true;
+      dolibarr_main_force_https = vhostCfg.forceSSL;
+      dolibarr_main_restrict_os_commands = "${pkgs.mariadb}/bin/mysqldump, ${pkgs.mariadb}/bin/mysql";
+      dolibarr_nocsrfcheck = false;
+      dolibarr_main_instance_unique_id = ''
+        file_get_contents("${cfg.stateDir}/dolibarr_main_instance_unique_id")
+      '';
+      dolibarr_mailing_limit_sendbyweb = false;
+    };
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group}"
+      "d '${cfg.stateDir}/documents' 0750 ${cfg.user} ${cfg.group}"
+      "f '${cfg.stateDir}/conf.php' 0660 ${cfg.user} ${cfg.group}"
+      "L '${cfg.stateDir}/install.forced.php' - ${cfg.user} ${cfg.group} - ${mkConfigFile "install.forced.php" install}"
+    ];
+
+    services.mysql = mkIf cfg.database.createLocally {
+      enable = mkDefault true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        { name = cfg.database.user;
+          ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+        }
+      ];
+    };
+
+    services.nginx.enable = mkIf (cfg.nginx != null) true;
+    services.nginx.virtualHosts."${cfg.domain}" = mkIf (cfg.nginx != null) (lib.mkMerge [
+      cfg.nginx
+      ({
+        root = lib.mkForce "${package}/htdocs";
+        locations."/".index = "index.php";
+        locations."~ [^/]\\.php(/|$)" = {
+          extraConfig = ''
+            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+            fastcgi_pass unix:${config.services.phpfpm.pools.dolibarr.socket};
+          '';
+        };
+      })
+    ]);
+
+    systemd.services."phpfpm-dolibarr".after = mkIf cfg.database.createLocally [ "mysql.service" ];
+    services.phpfpm.pools.dolibarr = {
+      inherit (cfg) user group;
+      phpPackage = pkgs.php.buildEnv {
+        extensions = { enabled, all }: enabled ++ [ all.calendar ];
+        # recommended by dolibarr web application
+        extraConfig = ''
+          session.use_strict_mode = 1
+          session.cookie_samesite = "Lax"
+          ; open_basedir = "${package}/htdocs, ${cfg.stateDir}"
+          allow_url_fopen = 0
+          disable_functions = "pcntl_alarm, pcntl_fork, pcntl_waitpid, pcntl_wait, pcntl_wifexited, pcntl_wifstopped, pcntl_wifsignaled, pcntl_wifcontinued, pcntl_wexitstatus, pcntl_wtermsig, pcntl_wstopsig, pcntl_signal, pcntl_signal_get_handler, pcntl_signal_dispatch, pcntl_get_last_error, pcntl_strerror, pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_exec, pcntl_getpriority, pcntl_setpriority, pcntl_async_signals"
+        '';
+      };
+
+      settings = {
+        "listen.mode" = "0660";
+        "listen.owner" = cfg.user;
+        "listen.group" = cfg.group;
+      } // cfg.poolConfig;
+    };
+
+    # there are several challenges with dolibarr and NixOS which we can address here
+    # - the dolibarr installer cannot be entirely automated, though it can partially be by including a file called install.forced.php
+    # - the dolibarr installer requires write access to its config file during installation, though not afterwards
+    # - the dolibarr config file generally holds secrets generated by the installer, though the config file is a php file so we can read and write these secrets from an external file
+    systemd.services.dolibarr-config = {
+      description = "dolibarr configuration file management via NixOS";
+      wantedBy = [ "multi-user.target" ];
+
+      script = ''
+        # extract the 'main instance unique id' secret that the dolibarr installer generated for us, store it in a file for use by our own NixOS generated configuration file
+        ${pkgs.php}/bin/php -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
+
+        # replace configuration file generated by installer with the NixOS generated configuration file
+        install -m 644 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
+      '';
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = cfg.user;
+        Group = cfg.group;
+        RemainAfterExit = "yes";
+      };
+
+      unitConfig = {
+        ConditionFileNotEmpty = "${cfg.stateDir}/conf.php";
+      };
+    };
+
+    users.users.dolibarr = mkIf (cfg.user == "dolibarr" ) {
+      isSystemUser = true;
+      group = cfg.group;
+    };
+
+    users.groups = optionalAttrs (cfg.group == "dolibarr") {
+      dolibarr = { };
+    };
+
+    users.users."${config.services.nginx.group}".extraGroups = [ cfg.group ];
+  };
+}
--- a/nixos/tests/dolibarr.nix
+++ b/nixos/tests/dolibarr.nix
@ -0,0 +1,59 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "dolibarr";
+  meta.maintainers = [ lib.maintainers.raitobezarius ];
+
+  nodes.machine =
+    { ... }:
+    {
+      services.dolibarr = {
+        enable = true;
+        domain = "localhost";
+        nginx = {
+          forceSSL = false;
+          enableACME = false;
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ 80 ];
+    };
+
+  testScript = ''
+    from html.parser import HTMLParser
+    start_all()
+
+    csrf_token = None
+    class TokenParser(HTMLParser):
+      def handle_starttag(self, tag, attrs):
+        attrs = dict(attrs) # attrs is an assoc list originally
+        if tag == 'input' and attrs.get('name') == 'token':
+            csrf_token = attrs.get('value')
+            print(f'[+] Caught CSRF token: {csrf_token}')
+      def handle_endtag(self, tag): pass
+      def handle_data(self, data): pass
+
+    machine.wait_for_unit("phpfpm-dolibarr.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_open_port(80)
+    # Sanity checks on URLs.
+    # machine.succeed("curl -fL http://localhost/index.php")
+    # machine.succeed("curl -fL http://localhost/")
+    # Perform installation.
+    machine.succeed('curl -fL -X POST http://localhost/install/check.php -F selectlang=auto')
+    machine.succeed('curl -fL -X POST http://localhost/install/fileconf.php -F selectlang=auto')
+    # First time is to write the configuration file correctly.
+    machine.succeed('curl -fL -X POST http://localhost/install/step1.php -F "testpost=ok" -F "action=set" -F "selectlang=auto"')
+    # Now, we have a proper conf.php in $stateDir.
+    assert 'nixos' in machine.succeed("cat /var/lib/dolibarr/conf.php")
+    machine.succeed('curl -fL -X POST http://localhost/install/step2.php --data "testpost=ok&action=set&dolibarr_main_db_character_set=utf8&dolibarr_main_db_collation=utf8_unicode_ci&selectlang=auto"')
+    machine.succeed('curl -fL -X POST http://localhost/install/step4.php --data "testpost=ok&action=set&selectlang=auto"')
+    machine.succeed('curl -fL -X POST http://localhost/install/step5.php --data "testpost=ok&action=set&login=root&pass=hunter2&pass_verif=hunter2&selectlang=auto"')
+    # Now, we have installed the machine, let's verify we still have the right configuration.
+    assert 'nixos' in machine.succeed("cat /var/lib/dolibarr/conf.php")
+    # We do not want any redirect now as we have installed the machine.
+    machine.succeed('curl -f -X POST http://localhost')
+    # Test authentication to the webservice.
+    parser = TokenParser()
+    parser.feed(machine.succeed('curl -f -X GET http://localhost/index.php?mainmenu=login&username=root'))
+    machine.succeed(f'curl -f -X POST http://localhost/index.php?mainmenu=login&token={csrf_token}&username=root&password=hunter2')
+  '';
+})
--- a/nixos/tests/minidlna.nix
+++ b/nixos/tests/minidlna.nix
@ -6,25 +6,24 @@ import ./make-test-python.nix ({ pkgs, ... }: {
      { ... }:
      {
        imports = [ ../modules/profiles/minimal.nix ];
-        networking.firewall.allowedTCPPorts = [ 8200 ];
-        services.minidlna = {
-          enable = true;
-          loglevel = "error";
-          mediaDirs = [
-           "PV,/tmp/stuff"
+        services.minidlna.enable = true;
+        services.minidlna.openFirewall = true;
+        services.minidlna.settings = {
+          log_level = "error";
+          media_dir = [
+            "PV,/tmp/stuff"
+          ];
+          friendly_name = "rpi3";
+          root_container = "B";
+          notify_interval = 60;
+          album_art_names = [
+            "Cover.jpg/cover.jpg/AlbumArtSmall.jpg/albumartsmall.jpg"
+            "AlbumArt.jpg/albumart.jpg/Album.jpg/album.jpg"
+            "Folder.jpg/folder.jpg/Thumb.jpg/thumb.jpg"
          ];
-          friendlyName = "rpi3";
-          rootContainer = "B";
-          extraConfig =
-          ''
-            album_art_names=Cover.jpg/cover.jpg/AlbumArtSmall.jpg/albumartsmall.jpg
-            album_art_names=AlbumArt.jpg/albumart.jpg/Album.jpg/album.jpg
-            album_art_names=Folder.jpg/folder.jpg/Thumb.jpg/thumb.jpg
-            notify_interval=60
-          '';
        };
      };
-      client = { ... }: { };
+    client = { ... }: { };
  };

  testScript =
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -1256,6 +1256,67 @@ let
      '';
    };

+    v2ray = {
+      exporterConfig = {
+        enable = true;
+      };
+
+      metricProvider = {
+        systemd.services.prometheus-nginx-exporter.after = [ "v2ray.service" ];
+        services.v2ray = {
+          enable = true;
+          config = {
+            stats = {};
+            api = {
+              tag = "api";
+              services = [ "StatsService" ];
+            };
+            inbounds = [
+              {
+                port = 1080;
+                listen = "127.0.0.1";
+                protocol = "http";
+              }
+              {
+                listen = "127.0.0.1";
+                port = 54321;
+                protocol = "dokodemo-door";
+                settings = { address = "127.0.0.1"; };
+                tag = "api";
+              }
+            ];
+            outbounds = [
+              {
+                protocol = "freedom";
+              }
+              {
+                protocol = "freedom";
+                settings = {};
+                tag = "api";
+              }
+            ];
+            routing = {
+              strategy = "rules";
+              settings = {
+                rules = [
+                  {
+                    inboundTag = [ "api" ];
+                    outboundTag = "api";
+                    type = "field";
+                  }
+                ];
+              };
+            };
+          };
+        };
+      };
+      exporterTest = ''
+        wait_for_unit("prometheus-v2ray-exporter.service")
+        wait_for_open_port(9299)
+        succeed("curl -sSf localhost:9299/scrape | grep 'v2ray_up 1'")
+      '';
+    };
+
    varnish = {
      exporterConfig = {
        enable = true;
--- a/pkgs/applications/audio/muse/default.nix
+++ b/pkgs/applications/audio/muse/default.nix
@ -16,10 +16,6 @@ stdenv.mkDerivation rec {

  sourceRoot = "source/muse3";

-  prePatch = ''
-    chmod u+w $NIX_BUILD_TOP
-  '';
-
  patches = [ ./fix-parallel-building.patch ];

  nativeBuildInputs = [ cmake pkg-config qttools wrapQtAppsHook ];
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "praat";
-  version = "6.2.17";
+  version = "6.2.22";

  src = fetchFromGitHub {
    owner = "praat";
    repo = "praat";
    rev = "v${version}";
-    sha256 = "sha256-368Dq4UU1+NTlskQQ5t/nEmyjLvSfdW3rhqzwKoKjzE=";
+    sha256 = "sha256-RE4QDK5x9xG1RsAWB6dgviu3V1ay/+r0vyHCPCu/qCU=";
  };

  configurePhase = ''
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ergo";
-  version = "4.0.38";
+  version = "4.0.42";

  src = fetchurl {
    url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-FdgF2xxqk9n1la6Lu4g6n+3O5pgIUKSYC3KzH0yM2Ok=";
+    sha256 = "sha256-ZcNV6qgD736KlKz4h6xHAl3ByYzca77YXoETonRaWP8=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/editors/manuskript/default.nix
+++ b/pkgs/applications/editors/manuskript/default.nix
@ -2,15 +2,15 @@

 python3Packages.buildPythonApplication rec {
  pname = "manuskript";
-  version = "0.13.1";
+  version = "0.14.0";

  format = "other";

  src = fetchFromGitHub {
    repo = pname;
    owner = "olivierkes";
-    rev = version;
-    hash = "sha256-TEmAamNdqBK7bu62tLtJl05wBI6hga84PQSrWiMPROY=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-mWLkah4eO1i5sp79xGLCIkr26TpbXxuVxIJ6gudKGWI=";
  };

  nativeBuildInputs = [ wrapQtAppsHook ];
--- a/pkgs/applications/editors/netbeans/default.nix
+++ b/pkgs/applications/editors/netbeans/default.nix
@ -3,7 +3,7 @@
 }:

 let
-  version = "14";
+  version = "15";
  desktopItem = makeDesktopItem {
    name = "netbeans";
    exec = "netbeans";
@ -19,7 +19,7 @@ stdenv.mkDerivation {
  inherit version;
  src = fetchurl {
    url = "mirror://apache/netbeans/netbeans/${version}/netbeans-${version}-bin.zip";
-    hash = "sha512-AEuUOiVCvZh4SjghQR2j8LBIubEBzEaZqWsb93icZU9K1sc6ddUanLD0NsQhzjK6oK1EDv5GG9PmqOXo6Sf1xg==";
+    hash = "sha512-WxqAQiPKdMfQCw9Hxaa7K2VIGTJj+Hu9WO2ehG4yQUkHBd+l0f0siLKk/i2xqLE1ZA522rxKud6iwXDuAsjjDg==";
  };

  buildCommand = ''
--- a/pkgs/applications/editors/vim/plugins/deprecated.json
+++ b/pkgs/applications/editors/vim/plugins/deprecated.json
@ -1,6 +1,6 @@
 {
    "TrueZen-nvim": {
-        "date": "2022-08-31",
+        "date": "2022-09-02",
        "new": "true-zen-nvim"
    },
    "compe-tmux": {
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -161,12 +161,12 @@ final: prev:

  LeaderF = buildVimPluginFrom2Nix {
    pname = "LeaderF";
-    version = "2022-07-20";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "Yggdroot";
      repo = "LeaderF";
-      rev = "aef58eaa7f328d6f5713a04198c80590bbc4ecba";
-      sha256 = "08xacx5n5di51929yiqz51z57ph8scvk4z9pa02r69iq4wa9grzr";
+      rev = "1137327cf3b3e357c308ee7a459599f7ccfcb4eb";
+      sha256 = "16w4069zwpws9a2fvl9nzlfzxn6sp1cays2r9d3xlk5b0q4v21qd";
    };
    meta.homepage = "https://github.com/Yggdroot/LeaderF/";
  };
@ -281,12 +281,12 @@ final: prev:

  SchemaStore-nvim = buildVimPluginFrom2Nix {
    pname = "SchemaStore.nvim";
-    version = "2022-08-30";
+    version = "2022-08-31";
    src = fetchFromGitHub {
      owner = "b0o";
      repo = "SchemaStore.nvim";
-      rev = "ccc3bab1507427648a0eb99eb8f3e5948027e9ef";
-      sha256 = "0svnq4vvb5s4yq20ilpsfki25g8d47zc57h3ddiqibkc1lsyzhmn";
+      rev = "18f46aca5cb6265e1468353cf782c1fda28fb9ea";
+      sha256 = "0w5xj8qzs9m057ms6q70h8r44lbdvag9q6ldr8xy0a8fnpd5ickl";
    };
    meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
  };
@ -442,7 +442,7 @@ final: prev:
      owner = "ycm-core";
      repo = "YouCompleteMe";
      rev = "d4343e8384ffb25d70a9ebc966bbf1277735567c";
-      sha256 = "12pgal13zxdmdb6vqbnllxjdk68p9p1c9wvwhqrrwa1jriwijap0";
+      sha256 = "0gmc9mnbi4g0vzw911ybkw5q2ph2jhv8hs4a126q1jk2swbc5wkk";
      fetchSubmodules = true;
    };
    meta.homepage = "https://github.com/ycm-core/YouCompleteMe/";
@ -570,12 +570,12 @@ final: prev:

  aniseed = buildVimPluginFrom2Nix {
    pname = "aniseed";
-    version = "2022-07-23";
+    version = "2022-08-24";
    src = fetchFromGitHub {
      owner = "Olical";
      repo = "aniseed";
-      rev = "411d81776d996f3d6afee07469ebe58248fe9e36";
-      sha256 = "0a1a241c2ldkrxyil8d3x67v6f3vqqjnihh6qx8mswg6qdyv60jl";
+      rev = "9892a40d4cf970a2916a984544b7f984fc12f55c";
+      sha256 = "1dbhvbaiabc8f9p3vfch3pkail2zx234g048mywl005s90d339kz";
    };
    meta.homepage = "https://github.com/Olical/aniseed/";
  };
@ -702,12 +702,12 @@ final: prev:

  aurora = buildVimPluginFrom2Nix {
    pname = "aurora";
-    version = "2022-08-24";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "ray-x";
      repo = "aurora";
-      rev = "5ffd920e9f377f69d956cb8e4e22c90093872e19";
-      sha256 = "1a600an1mi31jx9q83lrr0l09q9dl9a8cibwm75kw84svlvirra2";
+      rev = "9595471ec75ac26c575e46b3d93e1812df393ee9";
+      sha256 = "09nizsrc1wakwxaxwhjbg1qz7wxps2d111v0ldr3m05nkb8h8nrm";
    };
    meta.homepage = "https://github.com/ray-x/aurora/";
  };
@ -786,12 +786,12 @@ final: prev:

  barbar-nvim = buildVimPluginFrom2Nix {
    pname = "barbar.nvim";
-    version = "2022-08-10";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "romgrk";
      repo = "barbar.nvim";
-      rev = "8c6a2e6e472ff9b7dc0a53d9a3bd88f1fbc7da6d";
-      sha256 = "1nc45lp9lszxqjknrhqhjmyialfv6nqb60087snx212wm9igy661";
+      rev = "c41ad6e3f68c2c9f6aa268c6232cdef885107303";
+      sha256 = "0mdimwsiclpjn2df75lc92ryyjyql4m1x0bvpl629z33hvhlcvs0";
    };
    meta.homepage = "https://github.com/romgrk/barbar.nvim/";
  };
@ -918,12 +918,12 @@ final: prev:

  bufferline-nvim = buildVimPluginFrom2Nix {
    pname = "bufferline.nvim";
-    version = "2022-08-25";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "akinsho";
      repo = "bufferline.nvim";
-      rev = "fb7b17362eb6eedc57c37bdfd364f8e7d8149e31";
-      sha256 = "1q0g99099qvl9s9k4vrrb99hg8qpps7k1pzgba5m6ibiqmzny70f";
+      rev = "938908fc8db120d907bda23f6744202f534f63e4";
+      sha256 = "1wvd7k7xn3lb7fzqhag0mgyjjg50v31qfcdlmbn54dwbf684ra98";
    };
    meta.homepage = "https://github.com/akinsho/bufferline.nvim/";
  };
@ -1026,12 +1026,12 @@ final: prev:

  clang_complete = buildVimPluginFrom2Nix {
    pname = "clang_complete";
-    version = "2022-07-08";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "xavierd";
      repo = "clang_complete";
-      rev = "813aa270bd390bf64f03dc34f98834fb726a707d";
-      sha256 = "1kjr2qb431xqr8bzmb5bzd98mym4s4azr0h2qlgm7cqqpmh19i0m";
+      rev = "e25b6a54e5cf648eb36d5be5b82c1bbb22260fde";
+      sha256 = "0ik55akiyivq70a0jds35f8jqvs78mzxq3b302vhyq07w44mk7vx";
    };
    meta.homepage = "https://github.com/xavierd/clang_complete/";
  };
@ -1230,12 +1230,12 @@ final: prev:

  cmp-fish = buildVimPluginFrom2Nix {
    pname = "cmp-fish";
-    version = "2022-06-23";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "mtoohey31";
      repo = "cmp-fish";
-      rev = "8ce7517d74c11a55bf2d0e52e4649e49cea6c7a1";
-      sha256 = "0nlcx39hycl15bw1vn35lcw0lmgckn396m2pwfk22lyijdqdgnlk";
+      rev = "8ae7bfb1b3251d433c4adf4e64396ef929fbd91f";
+      sha256 = "02yvzj7n8j20x6hxbgj7jy2ddhfqbccg6bg9hfl2yg67prqmz7p5";
    };
    meta.homepage = "https://github.com/mtoohey31/cmp-fish/";
  };
@ -1494,12 +1494,12 @@ final: prev:

  cmp-tabnine = buildVimPluginFrom2Nix {
    pname = "cmp-tabnine";
-    version = "2022-08-21";
+    version = "2022-08-30";
    src = fetchFromGitHub {
      owner = "tzachar";
      repo = "cmp-tabnine";
-      rev = "14e287b5b1434cef322de9cc1ec6fda13b913f45";
-      sha256 = "1mvydmhwx240wpbvfmm8lrb2iny08sxz18zx9z8g9bvmhi4mp1ww";
+      rev = "f2ea9c0824d389d588966c64c146d324138a443c";
+      sha256 = "0d80lyjpsxn3cny66l280q20pkljh9h92wpa3iyyhj8g49zcihmw";
    };
    meta.homepage = "https://github.com/tzachar/cmp-tabnine/";
  };
@ -1698,12 +1698,12 @@ final: prev:

  coc-nvim = buildVimPluginFrom2Nix {
    pname = "coc.nvim";
-    version = "2022-08-30";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "neoclide";
      repo = "coc.nvim";
-      rev = "16973b9cc6e4e29a713f8556f8603585730d58db";
-      sha256 = "1v4061g51s67rd1kw5nvglkyy6jgpv578kqf5s1nxlrrm49fa4f5";
+      rev = "19c0fbd07ec559fd7bfacb7b6d99aa04b984e4da";
+      sha256 = "0kicvgz75178mcy5922ggrfrfdkyyjpwzcx6k5mlvw38fvccazf0";
    };
    meta.homepage = "https://github.com/neoclide/coc.nvim/";
  };
@ -1770,12 +1770,12 @@ final: prev:

  command-t = buildVimPluginFrom2Nix {
    pname = "command-t";
-    version = "2022-08-30";
+    version = "2022-08-31";
    src = fetchFromGitHub {
      owner = "wincent";
      repo = "command-t";
-      rev = "f862693a674fec84617b3bc86e8b71d4df1c05e2";
-      sha256 = "0xz5gzq7vxs80pgxx63bnpcs0b24xs9zg001dxphb219lqad8cii";
+      rev = "a61574dabc9076bac869b56c1819fa47e4d64cf0";
+      sha256 = "0lsimnn8ppaxq0w0sypzj20jrsfxb984q2mdxycclczp8p0hsawc";
    };
    meta.homepage = "https://github.com/wincent/command-t/";
  };
@ -1926,12 +1926,12 @@ final: prev:

  conjure = buildVimPluginFrom2Nix {
    pname = "conjure";
-    version = "2022-08-07";
+    version = "2022-08-31";
    src = fetchFromGitHub {
      owner = "Olical";
      repo = "conjure";
-      rev = "08236a13164a948fe403f34fe1f593ead0a3c6fe";
-      sha256 = "13iqzsj4x5fyzd40119jcng5vlz35y3ylrndiqwl62qj4pk4xqjb";
+      rev = "a8686aa6f8760bd3cd4f219a8a4101af037c9d9b";
+      sha256 = "0w74571l9hnds4f57fbs0p0snfbdavy052304yazjfxlmyppfrwf";
    };
    meta.homepage = "https://github.com/Olical/conjure/";
  };
@ -1974,24 +1974,24 @@ final: prev:

  coq-artifacts = buildVimPluginFrom2Nix {
    pname = "coq.artifacts";
-    version = "2022-08-31";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "ms-jpq";
      repo = "coq.artifacts";
-      rev = "828d8bfe5b95814de538fb36db9765c5a83fa1b2";
-      sha256 = "0bjpbd4larz41jxy3bwww58vvf2fqvw8siph8kw2nd06mlkb96qn";
+      rev = "446f10b15a3df79d0dd2e03af9aa51efa5202db1";
+      sha256 = "03wcdjar3g8ajf0bsp24fg6qnqpxqw87djg9bjc6q811kk2y9rqi";
    };
    meta.homepage = "https://github.com/ms-jpq/coq.artifacts/";
  };

  coq-thirdparty = buildVimPluginFrom2Nix {
    pname = "coq.thirdparty";
-    version = "2022-08-31";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "ms-jpq";
      repo = "coq.thirdparty";
-      rev = "a6694b983faa626075e0fa9588d85b147c1e4071";
-      sha256 = "09armjhxqyhwhgl63r2dqqwm1xl05820da2wrwrafwr211dgjqr4";
+      rev = "6e91fceca1addcbda590eaefe79b40dae3390f60";
+      sha256 = "1yaxnnyywm0770sj6vm3ffbqyyqq9lfmfkwnn37ldjrnd1a4nb0z";
    };
    meta.homepage = "https://github.com/ms-jpq/coq.thirdparty/";
  };
@ -2010,12 +2010,12 @@ final: prev:

  coq_nvim = buildVimPluginFrom2Nix {
    pname = "coq_nvim";
-    version = "2022-08-31";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "ms-jpq";
      repo = "coq_nvim";
-      rev = "699619de6b964700b89967d20b539ffe4f4abeec";
-      sha256 = "0ap4npxkmrx9r87qrkf10xpmmha8bw4p1chdx3wq273rmigccp1n";
+      rev = "ba5e0b14fa29e1eadcd527638d68231f25cd0c6a";
+      sha256 = "0lg6a0h4k94ipy3da5h1pfckdsw99fmc5fdddzg1wxvbbs6vfsvz";
    };
    meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
  };
@ -2504,12 +2504,12 @@ final: prev:

  diaglist-nvim = buildVimPluginFrom2Nix {
    pname = "diaglist.nvim";
-    version = "2022-01-11";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "onsails";
      repo = "diaglist.nvim";
-      rev = "6c43beac1ff07f6ef00f063090b5a6c9ed11b800";
-      sha256 = "1a10hmz38g3lpf1xxsk3b62vr16iaz5z5yqvk21m9bpai871fv1r";
+      rev = "afc124a0976d56db43cc840e62757193ccab7856";
+      sha256 = "04virm388yi2lrq8bi6331m7q7lj46wrlh8pd8js6q7ylkvz6qfq";
    };
    meta.homepage = "https://github.com/onsails/diaglist.nvim/";
  };
@ -2528,12 +2528,12 @@ final: prev:

  diffview-nvim = buildVimPluginFrom2Nix {
    pname = "diffview.nvim";
-    version = "2022-08-29";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "sindrets";
      repo = "diffview.nvim";
-      rev = "f4931669d2cfe16c2bff6443fd7b12c9aa8687a5";
-      sha256 = "1h9ld41kf1l8j5wwics19ym1h2aivdmdawi81arfam7s6qg1n154";
+      rev = "adc3250d65a5a12c3ebf8f85ff483a4cb8609c41";
+      sha256 = "10lsi4ms24zhhx9dfxfihz656fkjjkrxj77h9nnhggsxsjpqp9nb";
    };
    meta.homepage = "https://github.com/sindrets/diffview.nvim/";
  };
@ -2564,12 +2564,12 @@ final: prev:

  dressing-nvim = buildVimPluginFrom2Nix {
    pname = "dressing.nvim";
-    version = "2022-08-28";
+    version = "2022-08-31";
    src = fetchFromGitHub {
      owner = "stevearc";
      repo = "dressing.nvim";
-      rev = "f38eb335729162905687becdd4e200a294772ff5";
-      sha256 = "0bnr7m807knl0b7wx3cyvxlv7hk1pws7d1rbhfdvr8kjs5vd6p32";
+      rev = "9cdb3e0f0973447b940b35d3175dc780301de427";
+      sha256 = "159kh9g6hm51blqi5g23w463jz2hnnskppm352s8ic9h239dm3ak";
    };
    meta.homepage = "https://github.com/stevearc/dressing.nvim/";
  };
@ -2605,7 +2605,7 @@ final: prev:
      owner = "editorconfig";
      repo = "editorconfig-vim";
      rev = "d354117b72b3b43b75a29b8e816c0f91af10efe9";
-      sha256 = "12qvximadgb9z2i0hgvj4p4nxaqk0aqbnaqpafpma73xyb23hx5v";
+      sha256 = "1kgxz82lkssxflylylk9z10aq6qps45z27k24i8kf29wzpf5b3lr";
      fetchSubmodules = true;
    };
    meta.homepage = "https://github.com/editorconfig/editorconfig-vim/";
@ -2674,12 +2674,12 @@ final: prev:

  everforest = buildVimPluginFrom2Nix {
    pname = "everforest";
-    version = "2022-08-30";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "sainnhe";
      repo = "everforest";
-      rev = "902196bf48b085ca8036f4d3009dfd4944f9d56e";
-      sha256 = "1p4zlnyzi1dyynjh63173xh7sfqyzvz9hra8ysfjs7j0s1fx8499";
+      rev = "c60a594cc4adbfb863d3186f730765b0e1cb85eb";
+      sha256 = "1b2jhm9yksmkri894sfzrqhsms06vhg3acr98qaqs9y30mabcb88";
    };
    meta.homepage = "https://github.com/sainnhe/everforest/";
  };
@ -2811,7 +2811,7 @@ final: prev:
      owner = "andviro";
      repo = "flake8-vim";
      rev = "5bc93f7f26ceb18ccbe116830eaf8ff2baa63994";
-      sha256 = "142pgasl0b64a0zxmspdsi636axrgvdx6rh3hwjrb1zlsck19y1a";
+      sha256 = "1s7rb2ygky1jjjqpwhzp5lsf7js1g0yhnbf6x5lfwygz6646xpy3";
      fetchSubmodules = true;
    };
    meta.homepage = "https://github.com/andviro/flake8-vim/";
@ -3059,12 +3059,12 @@ final: prev:

  ghcid = buildVimPluginFrom2Nix {
    pname = "ghcid";
-    version = "2022-03-26";
+    version = "2022-08-31";
    src = fetchFromGitHub {
      owner = "ndmitchell";
      repo = "ghcid";
-      rev = "f48626bf5b64067a84b644bcc56afac686046966";
-      sha256 = "0v2m05980r5zq77b11nghjgz0yr70a88gd7jv0d0iy2z6ah63sxv";
+      rev = "2ee828d864ea81900b38c375d4bc4cd3657fe6fd";
+      sha256 = "1sgskxl6yf6c4bls6wf3hlqww48h53m3a9wyypy6mx303k2qcl2c";
    };
    meta.homepage = "https://github.com/ndmitchell/ghcid/";
  };
@ -3155,12 +3155,12 @@ final: prev:

  gitsigns-nvim = buildNeovimPluginFrom2Nix {
    pname = "gitsigns.nvim";
-    version = "2022-08-22";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "lewis6991";
      repo = "gitsigns.nvim";
-      rev = "1e107c91c0c5e3ae72c37df8ffdd50f87fb3ebfa";
-      sha256 = "0qg2y796mkkisyab6br4p0d6blx8ispglpphpdlmf14hp9si56bp";
+      rev = "d7e0bcbe45bd9d5d106a7b2e11dc15917d272c7a";
+      sha256 = "1h4gxyamynwygxpqfib2a7sd1xbi6sh8ixg85j6qiaqqpahr0a4k";
    };
    meta.homepage = "https://github.com/lewis6991/gitsigns.nvim/";
  };
@ -3743,12 +3743,12 @@ final: prev:

  kanagawa-nvim = buildVimPluginFrom2Nix {
    pname = "kanagawa.nvim";
-    version = "2022-08-24";
+    version = "2022-08-31";
    src = fetchFromGitHub {
      owner = "rebelot";
      repo = "kanagawa.nvim";
-      rev = "ec3b133414388b0bfea3f33ca0bff10538aef8ac";
-      sha256 = "0d04vkias6vlxjjvlf16f8znviwgym83b2bp2rrfhdp3i7q4gmyx";
+      rev = "5f1203f4606e3208f6dd156c03f498d9fadcf1a8";
+      sha256 = "07jl5vf9mbz2bi1w6xm4kvxd18g3diq5ay2yrcc1m5nfki82r3si";
    };
    meta.homepage = "https://github.com/rebelot/kanagawa.nvim/";
  };
@ -4222,12 +4222,12 @@ final: prev:

  lua-dev-nvim = buildVimPluginFrom2Nix {
    pname = "lua-dev.nvim";
-    version = "2022-05-12";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "folke";
      repo = "lua-dev.nvim";
-      rev = "f5c31936fe06fcbeb59b98f69f74f9c2f91abaec";
-      sha256 = "0vwpi3cg0gv17w3bm2vlzspsms1rn2yjrzkq2zvf2f4slqq3rfpw";
+      rev = "d8b800ee7376c9299f14544325a1e76f220fce3d";
+      sha256 = "05m6zr4v6xr6pbwigcb7lfxx1167d7nailf8w04sscjr8w2mpv8l";
    };
    meta.homepage = "https://github.com/folke/lua-dev.nvim/";
  };
@ -4727,12 +4727,12 @@ final: prev:

  neoformat = buildVimPluginFrom2Nix {
    pname = "neoformat";
-    version = "2022-08-23";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "sbdchd";
      repo = "neoformat";
-      rev = "b3976412a63b44a171824ac9e1b4595354d99d98";
-      sha256 = "006h02bvlffb6z5m7b2nxlb3rbqd32xjdkckkgzfrbyvsjviflq1";
+      rev = "0ae951121da29a157d80db70c32679b428afffdc";
+      sha256 = "1nslf2wfj0z4qq7zgqcx62gb31px6sqqb8rk1a10j3ply5bc7r67";
    };
    meta.homepage = "https://github.com/sbdchd/neoformat/";
  };
@ -4799,12 +4799,12 @@ final: prev:

  neorg = buildVimPluginFrom2Nix {
    pname = "neorg";
-    version = "2022-08-30";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "nvim-neorg";
      repo = "neorg";
-      rev = "4b8c20d083e49a4464424e6363dba9349c44b7d3";
-      sha256 = "1w8fcvg2ig1ajaz9x4mmi92jgzc33rnqxscahcccl4h67870xsgj";
+      rev = "d4e771d574af2633a59496440161c0196e1c71d7";
+      sha256 = "0d3jki67bybyccmpb73f0m660wav69g9xzaxqzskaycmg7x4jrbn";
    };
    meta.homepage = "https://github.com/nvim-neorg/neorg/";
  };
@ -5699,12 +5699,12 @@ final: prev:

  nvim-treesitter = buildVimPluginFrom2Nix {
    pname = "nvim-treesitter";
-    version = "2022-08-31";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "nvim-treesitter";
      repo = "nvim-treesitter";
-      rev = "501db1459a7a46cb0766b3c56e9a6904bbcbcc97";
-      sha256 = "1m46jmk3wflsfqpdkiczlfplyfvmxnvrak59rmf0cmkqsq16ysrh";
+      rev = "7845f31839b844653736eed6dd284c862156d679";
+      sha256 = "11biavpv32xh3ziw5wifav7imibq2m149fsrmhgg4l3ymspkyl0q";
    };
    meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
  };
@ -5747,12 +5747,12 @@ final: prev:

  nvim-treesitter-textobjects = buildVimPluginFrom2Nix {
    pname = "nvim-treesitter-textobjects";
-    version = "2022-08-30";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "nvim-treesitter";
      repo = "nvim-treesitter-textobjects";
-      rev = "6dcd228384be6fa95199db57cccf27dbd4c743a5";
-      sha256 = "0l2l7r4kl2j9mvjiij419hdpghv410d5jqfqrp52l74vw703j294";
+      rev = "b2ba68ee777fc1926fc66d533f61071ddba05ee2";
+      sha256 = "15bgqk8nqdb69jvccmnlhdyqzhzv46zg2y267qx55as0mcf8pxgn";
    };
    meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter-textobjects/";
  };
@ -5843,12 +5843,12 @@ final: prev:

  nvimdev-nvim = buildVimPluginFrom2Nix {
    pname = "nvimdev.nvim";
-    version = "2022-08-25";
+    version = "2022-08-31";
    src = fetchFromGitHub {
      owner = "neovim";
      repo = "nvimdev.nvim";
-      rev = "51982c916aae738b50321e23c286235f9c9fe9b9";
-      sha256 = "15g3823igm1k8wpkkn4mkk4xic4vrw74wpm8smm36gmy0pd04wlw";
+      rev = "23bfd686ccc71c0b0082c06be90e4513c21f6488";
+      sha256 = "1fffdyy9ypfipy7n9mab8bc7ndal145m02a664smi853zkxwh2k7";
    };
    meta.homepage = "https://github.com/neovim/nvimdev.nvim/";
  };
@ -6023,12 +6023,12 @@ final: prev:

  packer-nvim = buildVimPluginFrom2Nix {
    pname = "packer.nvim";
-    version = "2022-08-31";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "wbthomason";
      repo = "packer.nvim";
-      rev = "b32b982d52664a0a6c5a43a5f9934f001d722d4e";
-      sha256 = "122rpg6611k2yi8gycxnn3ylqblqkmbi5w3jnkgin4vnspn8hd0a";
+      rev = "b356e3836cfaf27e19874f1b5b81eb227ef161f4";
+      sha256 = "0fkx8gc2h9fh172if4x7cq0baizr098g1yzyygf462wfr5ds2anf";
    };
    meta.homepage = "https://github.com/wbthomason/packer.nvim/";
  };
@ -6269,7 +6269,7 @@ final: prev:
      owner = "python-mode";
      repo = "python-mode";
      rev = "85d2cd1a196ac1def79d4599b5be69395ed5b603";
-      sha256 = "0jk8pssliyar4qs42x9m1jgri446cr4yc7iv8l9wc9xn6r3qnm29";
+      sha256 = "0gr4ag5qymdpx0mlfvx743y4s8bjd7v4a0yzd02jvmz3dyylvavw";
      fetchSubmodules = true;
    };
    meta.homepage = "https://github.com/python-mode/python-mode/";
@ -6589,12 +6589,12 @@ final: prev:

  satellite-nvim = buildVimPluginFrom2Nix {
    pname = "satellite.nvim";
-    version = "2022-06-26";
+    version = "2022-08-31";
    src = fetchFromGitHub {
      owner = "lewis6991";
      repo = "satellite.nvim";
-      rev = "320e3c54b507486e3ed0c9dacc656fdf54b40057";
-      sha256 = "1qkx0mcrmqgvpx9gmncblkm7km4ap3hvkcp65dqc9nn2h4w63hvy";
+      rev = "25d0c59edab4892363c3cec47fc5f34769e5a242";
+      sha256 = "1frnkh6ny4dxia793jkmv95wvvivmyp5296sg68vbf043hwny4a3";
    };
    meta.homepage = "https://github.com/lewis6991/satellite.nvim/";
  };
@ -7149,7 +7149,7 @@ final: prev:
      owner = "codota";
      repo = "tabnine-vim";
      rev = "e27face391a4d9a3e43ff251010f77deddf0c88d";
-      sha256 = "1y5haygvixnav9cck49yvvm14afyy5gyq8rwiybqvkd6vfxlv99f";
+      sha256 = "1204ibnsdksihyvnql22sarn2xgqajwvr0d975bnp35n593chymq";
      fetchSubmodules = true;
    };
    meta.homepage = "https://github.com/codota/tabnine-vim/";
@ -7675,24 +7675,24 @@ final: prev:

  toggleterm-nvim = buildVimPluginFrom2Nix {
    pname = "toggleterm.nvim";
-    version = "2022-08-30";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "akinsho";
      repo = "toggleterm.nvim";
-      rev = "cd3b4d67112fbc8bee01ea44ba5ad1eea3894714";
-      sha256 = "015f8qy7s0lkhcqh4jy14m2vhxhcz9vnn7h76lbqhzrq37l2lkya";
+      rev = "b402342665ee06e127c304e245f03143357a58c4";
+      sha256 = "1q9pw0sp5qg596571yfcbq4mfrylrsrr968s35yvbgnsw4fw1d2w";
    };
    meta.homepage = "https://github.com/akinsho/toggleterm.nvim/";
  };

  tokyonight-nvim = buildVimPluginFrom2Nix {
    pname = "tokyonight.nvim";
-    version = "2021-12-31";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "folke";
      repo = "tokyonight.nvim";
-      rev = "8223c970677e4d88c9b6b6d81bda23daf11062bb";
-      sha256 = "1rzg0h0ab3jsfrimdawh8vlxa6y3j3rmk57zyapnmzpzllcswj0i";
+      rev = "791c2a219a9425a5817fafc2dd2dcf65c4a0abde";
+      sha256 = "0hp95fsh0ld6icw5dmj45w1a9f1j39z64bzshw3vqj7w2d86q87m";
    };
    meta.homepage = "https://github.com/folke/tokyonight.nvim/";
  };
@ -10630,12 +10630,12 @@ final: prev:

  vim-nixhash = buildVimPluginFrom2Nix {
    pname = "vim-nixhash";
-    version = "2022-02-06";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "symphorien";
      repo = "vim-nixhash";
-      rev = "d6e3c5161ef2e3fbc4a4b68a785d958d97e25b7e";
-      sha256 = "1mrprl6mqapjzcya643nzvwaf01r38knjg9xnfbpvlidfq38d3cw";
+      rev = "e03af8d0c1bae3c015ffdb45ce79556c0561e59d";
+      sha256 = "1kdg84666gf1d3qiwwqmk7nwshspr2kpb8hjyh2m0nx0zmjji2ij";
    };
    meta.homepage = "https://github.com/symphorien/vim-nixhash/";
  };
@ -10798,12 +10798,12 @@ final: prev:

  vim-oscyank = buildVimPluginFrom2Nix {
    pname = "vim-oscyank";
-    version = "2022-06-20";
+    version = "2022-08-31";
    src = fetchFromGitHub {
      owner = "ojroques";
      repo = "vim-oscyank";
-      rev = "360ccdc01b18cd434588c34e15e5ea382b436de8";
-      sha256 = "14phavx432h16bdm7m99a21xz2gb1s47fd5g8v2b5ig12l4yss92";
+      rev = "849c67adf24a86935b8be62860ad9acb00cf4572";
+      sha256 = "1f23accmz82835kxvfsksjp77w9khkbcp4064c646p90ck194lji";
    };
    meta.homepage = "https://github.com/ojroques/vim-oscyank/";
  };
@ -11602,12 +11602,12 @@ final: prev:

  vim-snippets = buildVimPluginFrom2Nix {
    pname = "vim-snippets";
-    version = "2022-08-30";
+    version = "2022-08-31";
    src = fetchFromGitHub {
      owner = "honza";
      repo = "vim-snippets";
-      rev = "569c72257910b5b6f5e915b46d0978f73dbfa90a";
-      sha256 = "0scarxqsbi91qvfi5vzn0wgbxpx4i50mq63byly4jn74pgdsha00";
+      rev = "a6d2976f05cf31da5f4ebceb4b6f9fe2e0ec7c34";
+      sha256 = "0rnqm7l264h6x6jf9644jk168bphnhpb3dbfymgpz8613psh7fza";
    };
    meta.homepage = "https://github.com/honza/vim-snippets/";
  };
@ -11843,12 +11843,12 @@ final: prev:

  vim-test = buildVimPluginFrom2Nix {
    pname = "vim-test";
-    version = "2022-08-25";
+    version = "2022-08-31";
    src = fetchFromGitHub {
      owner = "vim-test";
      repo = "vim-test";
-      rev = "2da8d59fdc46d1af7b7105a578d1ace3924d1a7b";
-      sha256 = "06csh1a6kq7744gaigkahdqvlwqjga7w672cm0aw6yylwpwz27nn";
+      rev = "7401804603e074ae65f19d16daf312369b153028";
+      sha256 = "0kf67vayak8xqy0fykqxx9zkavf54vf4y7bsm42zf9ad1havhacy";
    };
    meta.homepage = "https://github.com/vim-test/vim-test/";
  };
@ -12528,12 +12528,12 @@ final: prev:

  vimtex = buildVimPluginFrom2Nix {
    pname = "vimtex";
-    version = "2022-08-28";
+    version = "2022-08-31";
    src = fetchFromGitHub {
      owner = "lervag";
      repo = "vimtex";
-      rev = "d8f507b83d65ef1686233da18e91f16819e84beb";
-      sha256 = "123l773jrqy28mi03m8k1kvqf0y2yhdhs22dl7iwcr14s71qq234";
+      rev = "aa52fa6b2711347a8d3b364d2e64f608207d8710";
+      sha256 = "00gih8v5f2mjmzmsns0prw00b4izx0pl08h47hln7ljjfq5v8npn";
    };
    meta.homepage = "https://github.com/lervag/vimtex/";
  };
@ -12853,12 +12853,12 @@ final: prev:

  catppuccin-nvim = buildVimPluginFrom2Nix {
    pname = "catppuccin-nvim";
-    version = "2022-08-28";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "catppuccin";
      repo = "nvim";
-      rev = "d4aa577d07197c4ca32f3bafb0aebb5b4b7dec9f";
-      sha256 = "1kvm7xgi3jdgn0xqcd1ynjysmbzdg2xmfzqmkpn87f7lyi4ihb9s";
+      rev = "ddae70a80590dc3ee1c2605010abd82c615c1172";
+      sha256 = "1jh9h18bgxy68wd2fw3q9vxjgnlh8653528qbwzdwrjlvwsz0qdf";
    };
    meta.homepage = "https://github.com/catppuccin/nvim/";
  };
@ -12877,12 +12877,12 @@ final: prev:

  chad = buildVimPluginFrom2Nix {
    pname = "chad";
-    version = "2022-08-31";
+    version = "2022-09-01";
    src = fetchFromGitHub {
      owner = "ms-jpq";
      repo = "chadtree";
-      rev = "27e5f9708c1347a3e9e6abb20eff0354f008544b";
-      sha256 = "1cn8swfhmp8pw0pwpwlf7hwji3f5nwzl0wv2mr0yn9bnpc1857b8";
+      rev = "75d9335bd79bf9de6fdde974083ae7edb16d8190";
+      sha256 = "1d92vj2vmnz881gqn10za5jbs47rlslkpfvbz6a5nmyjphz8fx06";
    };
    meta.homepage = "https://github.com/ms-jpq/chadtree/";
  };
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -538,6 +538,21 @@ let
        };
      };

+      catppuccin.catppuccin-vsc = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "catppuccin-vsc";
+          publisher = "catppuccin";
+          version = "2.1.0";
+          sha256 = "sha256-1pX9NQxW2Rm9p912Pn7QmLmXPI7EmiXTnCLWsIQNFhY=";
+        };
+        meta = with lib; {
+          description = "Soothing pastel theme for VSCode";
+          license = licenses.mit;
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=Catppuccin.catppuccin-vsc";
+          maintainers = with maintainers; [ nullx76 ];
+        };
+      };
+
      chenglou92.rescript-vscode = callPackage ./rescript { };

      christian-kohler.path-intellisense = buildVscodeMarketplaceExtension {
--- a/pkgs/applications/emulators/flycast/default.nix
+++ b/pkgs/applications/emulators/flycast/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "flycast";
-  version = "1.3";
+  version = "2.0";

  src = fetchFromGitHub {
    owner = "flyinghead";
    repo = "flycast";
    rev = "v${version}";
-    sha256 = "sha256-FAHm8Fu/yv2rJvWCY+g50TYH4zOT6rO7F+jTL2T6EOU=";
+    sha256 = "sha256-vSyLg2lAJBV7crKVbGRbi1PUuCwHF9GB/8pjMTlaigA=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/graphics/mangareader/default.nix
+++ b/pkgs/applications/graphics/mangareader/default.nix
@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, wrapQtAppsHook
+, extra-cmake-modules
+, cmake
+, kio
+, ki18n
+, kxmlgui
+, kconfig
+, karchive
+, kcoreaddons
+, kconfigwidgets
+, nix-update-script
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mangareader";
+  version = "2.0.4";
+
+  src = fetchFromGitHub {
+    owner = "g-fb";
+    repo = pname;
+    rev = version;
+    hash = "sha256-j5b2O5OgDRaaxNssknTTgVscudk1+mFlGQN5KE6CwcU=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    kio
+    ki18n
+    kxmlgui
+    kconfig
+    karchive
+    kcoreaddons
+    kconfigwidgets
+  ];
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
+  meta = with lib; {
+    description = "Qt manga reader for local files";
+    homepage = "https://github.com/g-fb/mangareader";
+    changelog = "https://github.com/g-fb/mangareader/releases/tag/${src.rev}";
+    platforms = platforms.linux;
+    license = with licenses; [ gpl3Plus cc-by-nc-sa-40 ];
+    maintainers = with maintainers; [ zendo ];
+  };
+}
--- a/pkgs/applications/graphics/pineapple-pictures/default.nix
+++ b/pkgs/applications/graphics/pineapple-pictures/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "pineapple-pictures";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "BLumia";
    repo = "pineapple-pictures";
    rev = version;
-    sha256 = "sha256-1fsEHyepmoZfNOFEnW6RQJyccOlQr5LTp8TjRqyXkcw";
+    sha256 = "sha256-9Nlrei3TxZr3tv0BtlfsKAvDJhQHgd21FzLnzitYF3U=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/binance/default.nix
+++ b/pkgs/applications/misc/binance/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "binance";
-  version = "1.36.0";
+  version = "1.39.0";

  src = fetchurl {
    url = "https://github.com/binance/desktop/releases/download/v${version}/${pname}-${version}-amd64-linux.deb";
-    sha256 = "sha256-Q1cvEQ/yxytzrPfiyeTZSCPecnmSdhy+ds/gtie4vwo=";
+    sha256 = "sha256-6VQerIzX2u8QGUsa8kvu6Qud3OEn9lrZkQddfkZ1X0g=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "cherrytree";
-  version = "0.99.47";
+  version = "0.99.48";

  src = fetchFromGitHub {
    owner = "giuspen";
    repo = "cherrytree";
    rev = version;
-    sha256 = "sha256-qKBf/7DBIpK1o/xlDlWeVXkSSV5a3y9hoWsAzeTIsf4=";
+    sha256 = "sha256-mNWep+ZMQzb2PBHgzUKRpfMhP0ok1RZiuIoyH3P7+TI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/pwsafe/default.nix
+++ b/pkgs/applications/misc/pwsafe/default.nix
@ -2,19 +2,18 @@
 , cmake, pkg-config, zip, gettext, perl
 , wxGTK30, libXext, libXi, libXt, libXtst, xercesc
 , qrencode, libuuid, libyubikey, yubikey-personalization
-, curl, openssl, file
+, curl, openssl, file, gitUpdater
 }:

 stdenv.mkDerivation rec {
  pname = "pwsafe";
-  version = "1.14.0"; # do NOT update to 3.x Windows releases
-  # nixpkgs-update: no auto update
+  version = "1.15.0"; # do NOT update to 3.x Windows releases

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    hash = "sha256-s3IXe4gTwUOzQslNfWrcN/srrG9Jv02zfkGgiZN3C1s=";
+    hash = "sha256-EyyQHp2MlGgUnikClgvP7I313Bh6H3yVPXel8Z/U6gQ=";
  };

  nativeBuildInputs = [
@ -53,6 +52,12 @@ stdenv.mkDerivation rec {

  installFlags = [ "PREFIX=${placeholder "out"}" ];

+  passthru.updateScript = gitUpdater {
+    inherit pname version;
+    ignoredVersions = "^([^1]|1[^.])"; # ignore anything other than 1.x
+    url = src.gitRepoUrl;
+  };
+
  meta = with lib; {
    description = "A password database utility";
    longDescription = ''
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -1,18 +1,23 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, testers, spicetify-cli }:

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.11.1";
+  version = "2.13.0";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-NX3qbnnbV2mLxBQCjfl7xNicyir6usi2uYGw6Yij/ho=";
+    sha256 = "sha256-XsYZoJDSaAp+oMTy5YWM9aM+TCNkqF5WXBhU/axcEVk=";
  };

  vendorSha256 = "sha256-zYIbtcDM9iYSRHagvI9D284Y7w0ZxG4Ba1p4jqmQyng=";

+  ldflags = [
+    "-s -w"
+    "-X 'main.version=${version}'"
+  ];
+
  # used at runtime, but not installed by default
  postInstall = ''
    cp -r ${src}/jsHelper $out/bin/jsHelper
@ -23,6 +28,11 @@ buildGoModule rec {
    $out/bin/spicetify-cli --help > /dev/null
  '';

+  passthru.tests.version = testers.testVersion {
+    package = spicetify-cli;
+    command = "spicetify-cli -v";
+  };
+
  meta = with lib; {
    description = "Command-line tool to customize Spotify client";
    homepage = "https://github.com/spicetify/spicetify-cli/";
--- a/pkgs/applications/misc/wofi-emoji/default.nix
+++ b/pkgs/applications/misc/wofi-emoji/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {

  postPatch = ''
    substituteInPlace build.sh \
-      --replace 'curl ${emojiJSON.url}' 'cat emoji-en-US.json'
+      --replace 'curl ${emojiJSON.url}' 'cat ${emojiJSON}'
  '';

  buildPhase = ''
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@ -7,20 +7,20 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.8.38";
+  version = "0.8.39";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    sha256 = "sha256-8C7aQCQ6kqHCGSktYS3djTlEuPyRnzb9LrXkqgfzDyY=";
+    sha256 = "sha256-ucM4Dl4ZeeZ6pCQ3qdf3Z88CWJIoreZWeo6ehKqXxI8=";
  };

  CGO_ENABLED = 0;

  nativeBuildInputs = [ installShellFiles ];

-  vendorSha256 = "sha256-ok8NuqVFZtzjSLpgxQI03ISojfKdHPHWyikqwtceMlo=";
+  vendorSha256 = "sha256-TUaCqHbPEwhB2xS8RSoF7RCSkKFJzQKbuV1PbxApyMQ=";

  # Exclude pkg/get: tests downloading of binaries which fail when sandbox=true
  subPackages = [
--- a/pkgs/applications/networking/cluster/kubeone/default.nix
+++ b/pkgs/applications/networking/cluster/kubeone/default.nix
@ -2,6 +2,8 @@
 , buildGoModule
 , fetchFromGitHub
 , installShellFiles
+, kubeone
+, testers
 }:

 buildGoModule rec {
@ -17,6 +19,12 @@ buildGoModule rec {

  vendorSha256 = "sha256-w/uLR7wi28Ub7Nouxxg39NlD1OzyIE2oEP4D88Xbwu0=";

+  ldflags = [
+    "-s -w"
+    "-X k8c.io/kubeone/pkg/cmd.version=${version}"
+    "-X k8c.io/kubeone/pkg/cmd.date=unknown"
+  ];
+
  nativeBuildInputs = [
    installShellFiles
  ];
@ -27,6 +35,11 @@ buildGoModule rec {
      --zsh <($out/bin/kubeone completion zsh)
  '';

+  passthru.tests.version = testers.testVersion {
+    package = kubeone;
+    command = "kubeone version";
+  };
+
  meta = {
    description = "Automate cluster operations on all your cloud, on-prem, edge, and IoT environments.";
    homepage = "https://kubeone.io/";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -32,10 +32,10 @@
    "owner": "aiven",
    "provider-source-address": "registry.terraform.io/aiven/aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v3.5.1",
-    "sha256": "sha256-EJPf8jDANrjg+XPhFn6L7GPUya2WbrSUX8/hQldQmnQ=",
+    "rev": "v3.6.0",
+    "sha256": "sha256-FjCcUC06iDeKaHSlQPNuKdqEhA8ft4MQ+sY3YPlNY6E=",
    "vendorSha256": "sha256-X9AJM4OsJ2/zl2Mm6gaz5wA6hk9AfOlUFYYN9Ojirrc=",
-    "version": "3.5.1"
+    "version": "3.6.0"
  },
  "akamai": {
    "owner": "akamai",
@ -51,10 +51,10 @@
    "owner": "aliyun",
    "provider-source-address": "registry.terraform.io/aliyun/alicloud",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.182.0",
-    "sha256": "sha256-syxmCEvNRUsVl4B9OuClKztlr9hqKIHTpeppcNPUJog=",
+    "rev": "v1.183.0",
+    "sha256": "sha256-+bjDSRsQ407um35Qz/xfCtEd4jAjzjROh4T4iYsapmM=",
    "vendorSha256": "sha256-kjr93pVmMZgeJgeG8hG86CDWr95gCIAhf93OQ4tJ9kw=",
-    "version": "1.182.0"
+    "version": "1.183.0"
  },
  "ansible": {
    "owner": "nbering",
@ -78,10 +78,10 @@
    "owner": "auth0",
    "provider-source-address": "registry.terraform.io/auth0/auth0",
    "repo": "terraform-provider-auth0",
-    "rev": "v0.36.0",
-    "sha256": "sha256-nKF5K+62Fc6MIrF7GagzLyp15aBpMKox6ZTS5csBfAU=",
-    "vendorSha256": "sha256-HNHW6ePs1qbwPiU0Xc2AwWmsSqr7mWI7xtMvL9GW7L8=",
-    "version": "0.36.0"
+    "rev": "v0.37.0",
+    "sha256": "sha256-2C5OHkRzYjhOH/snZ3CDWILaxusvG/7GYRtjpGUJljM=",
+    "vendorSha256": "sha256-yV6gO0Hv7zYs+0Lxy4mAMRkHoVDSMG+D5d2ZWH6TqW8=",
+    "version": "0.37.0"
  },
  "avi": {
    "owner": "vmware",
@ -105,28 +105,28 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/aws",
    "repo": "terraform-provider-aws",
-    "rev": "v4.28.0",
-    "sha256": "sha256-35z4a2pOoL78wGgfiKBjUXa4NORQNgPNgirHLX0N4gY=",
-    "vendorSha256": "sha256-XlTrAj7LRFWse80KgMRGUnGNi0ri6XwAi1cuEqKqrBg=",
-    "version": "4.28.0"
+    "rev": "v4.29.0",
+    "sha256": "sha256-hFvDQHiSr+UTSy2ikWM1BzRy139YZ5ulrbv738WQFrs=",
+    "vendorSha256": "sha256-PiOBkvIQ3X921HDPjUcfy1hcePh8mVVc3np17BnjdhI=",
+    "version": "4.29.0"
  },
  "azuread": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azuread",
    "repo": "terraform-provider-azuread",
-    "rev": "v2.28.0",
-    "sha256": "sha256-4GEoJJoMi1gCdhrqb5IsPb2haht4vH1hyJx7Z4rin00=",
+    "rev": "v2.28.1",
+    "sha256": "sha256-r7trdPrlvZ5rW75L7AEkG1baQaLMXnZ48Axi552nPIM=",
    "vendorSha256": null,
-    "version": "2.28.0"
+    "version": "2.28.1"
  },
  "azurerm": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
    "repo": "terraform-provider-azurerm",
-    "rev": "v3.20.0",
-    "sha256": "sha256-CaiEFJrtcro3taVXpsHoe5vvXjUaLn+7d72V+5UmNtg=",
+    "rev": "v3.21.1",
+    "sha256": "sha256-Rsj1DGN3v6rwjSBVRa4bvXP67ZYkJMDoz5ANyYCgf/4=",
    "vendorSha256": null,
-    "version": "3.20.0"
+    "version": "3.21.1"
  },
  "azurestack": {
    "owner": "hashicorp",
@ -142,10 +142,10 @@
    "owner": "baidubce",
    "provider-source-address": "registry.terraform.io/baidubce/baiducloud",
    "repo": "terraform-provider-baiducloud",
-    "rev": "v1.15.0",
-    "sha256": "sha256-U5EvN13fKzpeWHSEwgxiESrXCQ0KS9R2HZ7XTrj10pc=",
+    "rev": "v1.15.2",
+    "sha256": "sha256-RQTb1bIDpD5jvAJTOWG+aEVpMrSnJAqG6ZRQ/dOLZ4I=",
    "vendorSha256": "sha256-dgcYdfManE48sYaRRMfYMxQ4qX4uqas0yx+bn60kPWU=",
-    "version": "1.15.0"
+    "version": "1.15.2"
  },
  "bigip": {
    "owner": "F5Networks",
@ -307,10 +307,10 @@
    "owner": "digitalocean",
    "provider-source-address": "registry.terraform.io/digitalocean/digitalocean",
    "repo": "terraform-provider-digitalocean",
-    "rev": "v2.22.1",
-    "sha256": "sha256-Sc2altZo/8Y1UYpZjT8beq3VUljJAdzyXexB9Yi5WQI=",
+    "rev": "v2.22.2",
+    "sha256": "sha256-aIfx/dtVgNoLCFz8rXJBQTsmZ6SPA1hm6uMbeQmWkKM=",
    "vendorSha256": null,
-    "version": "2.22.1"
+    "version": "2.22.2"
  },
  "dme": {
    "owner": "DNSMadeEasy",
@ -343,10 +343,10 @@
    "owner": "kreuzwerker",
    "provider-source-address": "registry.terraform.io/kreuzwerker/docker",
    "repo": "terraform-provider-docker",
-    "rev": "v2.20.2",
-    "sha256": "sha256-5xQRUHga83sIIyBiWhXLWkjsBuk/1n4cZg/Y+zYz7+o=",
-    "vendorSha256": "sha256-aPt1y7UEL+Y4aRm0rfHr/yJ393NP2oAqgz7+fo/msQo=",
-    "version": "2.20.2"
+    "rev": "v2.20.3",
+    "sha256": "sha256-9zYqZ1bKOz2B4INrJqSklztNAl2ol3NGYW2IjPJfFkM=",
+    "vendorSha256": "sha256-G8gnEd7hT6XAC7cLOw711KsSFKjKvdd1BX/iaYV8a+U=",
+    "version": "2.20.3"
  },
  "elasticsearch": {
    "owner": "phillbaker",
@ -370,10 +370,10 @@
    "owner": "exoscale",
    "provider-source-address": "registry.terraform.io/exoscale/exoscale",
    "repo": "terraform-provider-exoscale",
-    "rev": "v0.40.0",
-    "sha256": "sha256-CQd/wYY4XRmWPV77uwTQgqZOGqWVdtAgsG8sUNB7y4A=",
+    "rev": "v0.40.1",
+    "sha256": "sha256-K5Rj3DoT4TAXF6MGOXgLw30qZmHyUYSMf1Cn4TTmxQk=",
    "vendorSha256": null,
-    "version": "0.40.0"
+    "version": "0.40.1"
  },
  "external": {
    "owner": "hashicorp",
@ -426,10 +426,10 @@
    "owner": "integrations",
    "provider-source-address": "registry.terraform.io/integrations/github",
    "repo": "terraform-provider-github",
-    "rev": "v4.30.0",
-    "sha256": "sha256-yLEh0RLDStle7K4hXYgsKIEYuZ5nwrY5dR574yRjRLw=",
+    "rev": "v4.31.0",
+    "sha256": "sha256-BKLY+ROxB35EQ37hlYGaNDdsAEggpGuRP7Uxoo7wFRc=",
    "vendorSha256": null,
-    "version": "4.30.0"
+    "version": "4.31.0"
  },
  "gitlab": {
    "owner": "gitlabhq",
@ -445,20 +445,20 @@
    "provider-source-address": "registry.terraform.io/hashicorp/google",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.33.0",
-    "sha256": "sha256-6mWSlTIVvbz7lid2+2T//vQf45ZNAEvD30qYG2Wd9yg=",
-    "vendorSha256": "sha256-LvWKVuHWOsMwucCQtrRMQ3wRnbGMid7jBG47wvBCvmY=",
-    "version": "4.33.0"
+    "rev": "v4.34.0",
+    "sha256": "sha256-pyp12UM42+dubwbPx7L4qIOYW0OulZ1D5OSgbdOUJQU=",
+    "vendorSha256": "sha256-ItetuU8tAzuMcShpS0C5BNmav4+cOrWxbyFvWS2zM9o=",
+    "version": "4.34.0"
  },
  "google-beta": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.33.0",
-    "sha256": "sha256-PoNacRcv+w7ydIPkuvfOhSjvdgYAahdKOI5yBoD9tu0=",
-    "vendorSha256": "sha256-LvWKVuHWOsMwucCQtrRMQ3wRnbGMid7jBG47wvBCvmY=",
-    "version": "4.33.0"
+    "rev": "v4.34.0",
+    "sha256": "sha256-1Ia2seissoXc98pGj4uvJcMP41eme1K/Tmnmtp8owLA=",
+    "vendorSha256": "sha256-ItetuU8tAzuMcShpS0C5BNmav4+cOrWxbyFvWS2zM9o=",
+    "version": "4.34.0"
  },
  "googleworkspace": {
    "owner": "hashicorp",
@ -473,10 +473,10 @@
    "owner": "grafana",
    "provider-source-address": "registry.terraform.io/grafana/grafana",
    "repo": "terraform-provider-grafana",
-    "rev": "v1.27.0",
-    "sha256": "sha256-ED97aYj71Zw89QCn19u4XP5pvfElKrQhFl3ESCYcafg=",
-    "vendorSha256": "sha256-UFtjicPL8Dg5dxi5vjCmvD1egZnODmsXSUCx0q5TyZw=",
-    "version": "1.27.0"
+    "rev": "v1.28.0",
+    "sha256": "sha256-j5kLmzPqEQkbn8ikjWs28gt8AXBW5/DAbnMZag0aP+Q=",
+    "vendorSha256": "sha256-NkGMblM6JB0JLTQJkNQqV90LXI8bEbULcgwwytwCwW4=",
+    "version": "1.28.0"
  },
  "gridscale": {
    "owner": "gridscale",
@ -536,19 +536,19 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/http",
    "repo": "terraform-provider-http",
-    "rev": "v3.0.1",
-    "sha256": "sha256-oeHWuXiLQF4cnC2QKWmqfNS5abItAxpYCV9BAId1Ld0=",
-    "vendorSha256": "sha256-fROMSbnav8BiUWD6qdwKi/fGEn4a2lmOuAXsnFTT3fQ=",
-    "version": "3.0.1"
+    "rev": "v3.1.0",
+    "sha256": "sha256-ZIV4OrfwUtWuQyp9Uw/sA7tW7JlG2+bAUu8TamyTPbs=",
+    "vendorSha256": "sha256-LPd5TQbuauXKMXraHsJd5uIdn357CveRyaLmavtMHSA=",
+    "version": "3.1.0"
  },
  "huaweicloud": {
    "owner": "huaweicloud",
    "provider-source-address": "registry.terraform.io/huaweicloud/huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.40.0",
-    "sha256": "sha256-2wwwEWChYJNbeonxBg/M6fSVcoHKup3z/sQ93iZd2hc=",
+    "rev": "v1.40.1",
+    "sha256": "sha256-ejzyyliMyOjwQAQCx07ysEO0FMlE9jZDcuS2Bcz8Dvs=",
    "vendorSha256": null,
-    "version": "1.40.0"
+    "version": "1.40.1"
  },
  "huaweicloudstack": {
    "owner": "huaweicloud",
@ -644,19 +644,19 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/kubernetes",
    "repo": "terraform-provider-kubernetes",
-    "rev": "v2.13.0",
-    "sha256": "sha256-QBuYxfuH4Fd/B3CBa6Rp7TujwgyfVaausctAYlEnJ1U=",
+    "rev": "v2.13.1",
+    "sha256": "sha256-2/7sSgLt/t5e9YWi9D5hOfirHDrfHnuK3w684KjKIWI=",
    "vendorSha256": null,
-    "version": "2.13.0"
+    "version": "2.13.1"
  },
  "launchdarkly": {
    "owner": "launchdarkly",
    "provider-source-address": "registry.terraform.io/launchdarkly/launchdarkly",
    "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.9.1",
-    "sha256": "sha256-y6rikCql7zt/Dwo6FLHR/MdnhdA/ZDEVdsYRza4+daE=",
+    "rev": "v2.9.2",
+    "sha256": "sha256-XseHo/PVNGV+TKR+DBOmNlwYozFPWDolQR6/mE/XwVQ=",
    "vendorSha256": "sha256-Ef07RvkqXR/7qf8gHayxczBJ/ChHDmxR6+/wzaokkzk=",
-    "version": "2.9.1"
+    "version": "2.9.2"
  },
  "libvirt": {
    "owner": "dmacvicar",
@ -753,10 +753,10 @@
    "provider-source-address": "registry.terraform.io/mongodb/mongodbatlas",
    "proxyVendor": true,
    "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.4.4",
-    "sha256": "sha256-QFiaFxCg4pYgMkC2+HAxlyWv2DL1Riqk3nRZqI6ie1k=",
-    "vendorSha256": "sha256-nBBr6Uqa2VHSaEWfvFVotlF9DvTApgztS/wAgbj9OL0=",
-    "version": "1.4.4"
+    "rev": "v1.4.5",
+    "sha256": "sha256-uDpbsHJY6BXd1N/maHWfEpZy4tl81P0oI4F2rcJxvH8=",
+    "vendorSha256": "sha256-2ChyCuFJQASobUZBOlbsw7nI4APYE+mdcfIvkr2EEN0=",
+    "version": "1.4.5"
  },
  "namecheap": {
    "owner": "namecheap",
@ -780,19 +780,19 @@
    "owner": "newrelic",
    "provider-source-address": "registry.terraform.io/newrelic/newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v3.0.0",
-    "sha256": "sha256-u2wOmdk9QH1husFTW1Fb3VW2+gFrjerqBL7sOwFUKkw=",
+    "rev": "v3.1.0",
+    "sha256": "sha256-pcY4SsElHVKHw8rh/ZYMsSqPOZ4XDlzLgwxgF9ivZmw=",
    "vendorSha256": "sha256-PxMw2qjQP+dW1TAb8NxbtmHk/9yXAfM8aMIm4Qw5M1c=",
-    "version": "3.0.0"
+    "version": "3.1.0"
  },
  "nomad": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/nomad",
    "repo": "terraform-provider-nomad",
-    "rev": "v1.4.17",
-    "sha256": "sha256-xP0E2rJbsthLIzN0zxDo1eGMb8xBetT+uuCcegVvJUU=",
-    "vendorSha256": "sha256-p+SCagP8Niuc4h1s8l1c7Dao78wnHPRz9vNbFH10BaA=",
-    "version": "1.4.17"
+    "rev": "v1.4.18",
+    "sha256": "sha256-HhocWB3ZCFdeYgmA64hv1CYwqIf4EB/Q+vNrFKVB31I=",
+    "vendorSha256": "sha256-jS0soOe8kVnsC8Aum1zuiqHColOZmKEpu7jP74AnXmM=",
+    "version": "1.4.18"
  },
  "ns1": {
    "owner": "ns1-terraform",
@ -826,19 +826,19 @@
    "owner": "nutanix",
    "provider-source-address": "registry.terraform.io/nutanix/nutanix",
    "repo": "terraform-provider-nutanix",
-    "rev": "v1.7.0",
-    "sha256": "sha256-UWK5QGc/7IETQ+IBQA9uaCV1IBpgwSO24UKFflUw3CU=",
+    "rev": "v1.7.1",
+    "sha256": "sha256-UOny3UfrSrw/h9U9r1qlro4we03lOnUcZBL/bPwDESE=",
    "vendorSha256": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI=",
-    "version": "1.7.0"
+    "version": "1.7.1"
  },
  "oci": {
    "owner": "oracle",
    "provider-source-address": "registry.terraform.io/oracle/oci",
    "repo": "terraform-provider-oci",
-    "rev": "v4.90.0",
-    "sha256": "sha256-IbYldkApgE+wuSEpDnF7YeRfonjWQfBNskd++bPvPeA=",
+    "rev": "v4.91.0",
+    "sha256": "sha256-WLmY/vL0r2fQD4OPcWc9Pqs6hV2Fc2dbuTg7ssvwyu0=",
    "vendorSha256": null,
-    "version": "4.90.0"
+    "version": "4.91.0"
  },
  "okta": {
    "owner": "okta",
@ -880,10 +880,10 @@
    "owner": "opentelekomcloud",
    "provider-source-address": "registry.terraform.io/opentelekomcloud/opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.31.1",
-    "sha256": "sha256-88xh0cXAhne8ruVy+Ak7HmMEOjRQ2H/RXNyyEkEGb40=",
-    "vendorSha256": "sha256-mLroGI3X9nLufz4LT4KCbVoPUZimtMaQ3rI108SKURE=",
-    "version": "1.31.1"
+    "rev": "v1.31.2",
+    "sha256": "sha256-wACJpaCQ/FeKFUVvzZGxe5BGogGSZFBI5CGWN456CdY=",
+    "vendorSha256": "sha256-loqQELA5zeLs2860ui4klSkxPzquIQbybQ+MHEUAWAY=",
+    "version": "1.31.2"
  },
  "opsgenie": {
    "owner": "opsgenie",
@ -970,10 +970,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/random",
    "repo": "terraform-provider-random",
-    "rev": "v3.3.2",
-    "sha256": "sha256-izTx/uxe/SAsWSlN5husEWK64c9ugdg8BS7lScnWSX4=",
-    "vendorSha256": "sha256-ofU1zZb/C2LFaRCt0NULi+9dQY02lKBlz3jV1/ZhfWU=",
-    "version": "3.3.2"
+    "rev": "v3.4.2",
+    "sha256": "sha256-wLppAWv/pgsBUe4tEcP6CB4vHvYYAuugeF0Z+eKyEw8=",
+    "vendorSha256": "sha256-FBjwsOMtpKk0UhvWam9+7vQB6pIRwEOPD0A9fdiuDN4=",
+    "version": "3.4.2"
  },
  "remote": {
    "owner": "tenstad",
@ -997,10 +997,10 @@
    "owner": "scaleway",
    "provider-source-address": "registry.terraform.io/scaleway/scaleway",
    "repo": "terraform-provider-scaleway",
-    "rev": "v2.2.8",
-    "sha256": "sha256-UzgXZhVlPel6CQpMAQP2ca7/ur+y8ADkcF2q7pN+sfM=",
+    "rev": "v2.2.9",
+    "sha256": "sha256-bYy3bTn5mFbu0Y7hy7KY2ZkU2xMC0HgBRRh7cxT/A9s=",
    "vendorSha256": "sha256-Jg1FalV+WsKYOZpszeNYydP4Qtf2cdaZt7xz4O699wc=",
-    "version": "2.2.8"
+    "version": "2.2.9"
  },
  "secret": {
    "owner": "numtide",
@ -1060,10 +1060,10 @@
    "owner": "Snowflake-Labs",
    "provider-source-address": "registry.terraform.io/Snowflake-Labs/snowflake",
    "repo": "terraform-provider-snowflake",
-    "rev": "v0.42.1",
-    "sha256": "sha256-/qQSMSF4Uxs5ZJj3S1LATs1Uima/FmXVMf41x8K2bQ8=",
+    "rev": "v0.43.0",
+    "sha256": "sha256-OTJRcFdudwO15GmciAtlz6/Z7JqOpfjbaANJXvP6Jxw=",
    "vendorSha256": "sha256-43q1SrV7tEt0x7iRUAgBFg1oh8+B9i1i59nlR8kbLIY=",
-    "version": "0.42.1"
+    "version": "0.43.0"
  },
  "sops": {
    "owner": "carlpett",
@ -1105,19 +1105,19 @@
    "owner": "SumoLogic",
    "provider-source-address": "registry.terraform.io/SumoLogic/sumologic",
    "repo": "terraform-provider-sumologic",
-    "rev": "v2.18.0",
-    "sha256": "sha256-Ahj+twdryRx9EovytxEbm9e/s67/0YXBHdRkD8q3jnY=",
+    "rev": "v2.18.2",
+    "sha256": "sha256-d0g0iSPyQrMlll7DW09+9krTi7lkeszxE786vKtr6aQ=",
    "vendorSha256": "sha256-W+dV6rmyOqCeQboYvpxYoNZixv2+uBd2+sc9BvTE+Ag=",
-    "version": "2.18.0"
+    "version": "2.18.2"
  },
  "tencentcloud": {
    "owner": "tencentcloudstack",
    "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.77.4",
-    "sha256": "sha256-RkrWJ16fouiINR8+6wW0BBV7lpGu/s32UYPSOUgVLl4=",
+    "rev": "v1.77.6",
+    "sha256": "sha256-1mdgrYbWy/PRIQ+o3UmTnSWhnP5p8k1D61Wz4U4N32A=",
    "vendorSha256": null,
-    "version": "1.77.4"
+    "version": "1.77.6"
  },
  "tfe": {
    "owner": "hashicorp",
@ -1150,10 +1150,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/tls",
    "repo": "terraform-provider-tls",
-    "rev": "v4.0.1",
-    "sha256": "sha256-/yfSai1huhk+1OYN6DKspWBdfSDql53lxHWjALD5AV4=",
-    "vendorSha256": "sha256-Uk20wDu2qIs9Ez/H6NyHMS7i34Il0ReuDzC3MnKdHSk=",
-    "version": "4.0.1"
+    "rev": "v4.0.2",
+    "sha256": "sha256-PerRBYTEY6ITLZ5cWifEQ+FAUvsqC6wUzslI/fa96Hc=",
+    "vendorSha256": "sha256-7io1fQRX8+QABY0VRKex6W7fP5kDbij0qXrhzPbr/CY=",
+    "version": "4.0.2"
  },
  "triton": {
    "deleteVendor": true,
@ -1268,18 +1268,18 @@
    "owner": "vmware",
    "provider-source-address": "registry.terraform.io/vmware/wavefront",
    "repo": "terraform-provider-wavefront",
-    "rev": "v3.1.0",
-    "sha256": "sha256-Q9ikBBlqprdu4BheItrWBoWqODgMXLgbtSg9RHtejBE=",
-    "vendorSha256": "sha256-sUzlDapp1smQ4lbgvsz22y3/fGkfJdHBlK7HNfihYpI=",
-    "version": "3.1.0"
+    "rev": "v3.2.0",
+    "sha256": "sha256-6hqVAg3YwkEDBpkgPQZQyrjHfKfRc8+iTZqMg2vBwJI=",
+    "vendorSha256": "sha256-0N2YWVnbGvD4YLdEtfdvAjhLY4zkj07GoXtFFPSD5Zk=",
+    "version": "3.2.0"
  },
  "yandex": {
    "owner": "yandex-cloud",
    "provider-source-address": "registry.terraform.io/yandex-cloud/yandex",
    "repo": "terraform-provider-yandex",
-    "rev": "v0.77.0",
-    "sha256": "sha256-jkFWEUHqsR//IqgFIyFyJBm5EoclD5ri23QrZ3tRG/w=",
-    "vendorSha256": "sha256-08/Av6lrFdhTI0cH5cFbcHKOcDPrchC5wSWW83xHrfU=",
-    "version": "0.77.0"
+    "rev": "v0.78.0",
+    "sha256": "sha256-Llp0o/+CtyoWhymgWxVMPncl4C+XT2/5mhXAN4hYDLY=",
+    "vendorSha256": "sha256-QcFmk/kmhdhvO2HqpnLGDRIkOYu23A1g/mYKjzapIvc=",
+    "version": "0.78.0"
  }
 }
--- a/pkgs/applications/networking/feedreaders/tuifeed/default.nix
+++ b/pkgs/applications/networking/feedreaders/tuifeed/default.nix
@ -7,14 +7,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "tuifeed";
-  version = "0.2.1";
+  version = "0.3.2";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-QMjMJVr+OI/5QQTwNVpUQdnYSWpWmZMuEcg5UgPpcAk=";
+    sha256 = "sha256-JG/l6NfN5RqBpz9NVcVY3mP/iE31TXvw+Vjq8N8rNIY=";
  };

-  cargoHash = "sha256-NPrROFV2Yx4p4CocVMY2dPAlgcdZrZQfa779beLAbcI=";
+  cargoHash = "sha256-QKSNbpVRtSKp2q1jVPYTS8XCMtQAyg3AWvD/6+OjI7Y=";

  buildInputs = lib.optionals stdenv.isDarwin [ Security ];

--- a/pkgs/applications/networking/instant-messengers/baresip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/baresip/default.nix
@ -24,13 +24,13 @@
 , libvpx
 }:
 stdenv.mkDerivation rec {
-  version = "2.6.0";
+  version = "2.7.0";
  pname = "baresip";
  src = fetchFromGitHub {
    owner = "baresip";
    repo = "baresip";
    rev = "v${version}";
-    sha256 = "sha256-YcXLRhW7PyvK0R1+7DOjmtxg+Ajq9u7fvZFQO7DJapQ=";
+    sha256 = "sha256-ouevompKkWn5CXuDcPuKiTE9GrIXBs/NFsNu6GHgReE=";
  };
  postPatch = ''
    patchShebangs modules/ctrl_dbus/gen.sh
@ -116,5 +116,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/baresip/baresip";
    maintainers = with lib.maintainers; [ elohmeier raskin ];
    license = lib.licenses.bsd3;
+    platforms = lib.platforms.unix;
  };
 }
--- a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@ -44,11 +44,11 @@ in

 stdenv.mkDerivation rec {
  pname = "bluejeans";
-  version = "2.29.1.3";
+  version = "2.30.0.89";

  src = fetchurl {
    url = "https://swdl.bluejeans.com/desktop-app/linux/${getFirst 3 version}/BlueJeans_${version}.rpm";
-    sha256 = "sha256-vWViSJXRPZ4B40LNnoKRZNbxB1YKnaW2ay6GCjnFLGY=";
+    sha256 = "sha256-ALydB6bTxaYsBk0BrTKG8Yan4n/jvxT8T7fSMFel+CQ=";
  };

  nativeBuildInputs = [ rpmextract makeWrapper ];
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@ -98,14 +98,14 @@ let
  } source;

  source = rec {
-    version = "unstable-1.4.231";
+    version = "1.4.274";

    # Needs submodules
    src = fetchFromGitHub {
      owner = "mumble-voip";
      repo = "mumble";
-      rev = "9e0e274d6a9d8a9919267e747d05d0500d150560";
-      sha256 = "0whvb4nlf7gjf2v7wsaq0ir18mshhw5wi8c9q9qz43wnh42nn2qi";
+      rev = "cc73c7679b08158f91b02272efbb0e3e5dd9c9e4";
+      sha256 = "sha256-QXczSLDhWLE4CDvBJ7NtqfL52bZJDisFo04AMHnMuN8=";
      fetchSubmodules = true;
    };
  };
--- a/pkgs/applications/networking/termius/default.nix
+++ b/pkgs/applications/networking/termius/default.nix
@ -13,7 +13,7 @@

 stdenv.mkDerivation rec {
  pname = "termius";
-  version = "7.42.1";
+  version = "7.45.3";

  src = fetchurl {
    # find the latest version with
@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
    # curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_url' -r
    # and the sha512 with
    # curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_sha512' -r
-    url = "https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_117.snap";
-    sha512 = "1e9a6e14a7046a8297c9f067211257cfbbe4dc121ddf4123271ddb96eccbfa504b6e0d05de2077326127ae1d0b2e571c232125e51bfaa1ef82d6cbf9355f13e6";
+    url = "https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_123.snap";
+    sha512 = "1a43ece6ccb0f5a7b29a3ff0c41f27b0d82bd90214cc3d0b88dbd57ecaf2f59c092906e7ed377e3d04f2fc418027f7a0cb7f2e4458ef619663b84b080581c375";
  };

  desktopItem = makeDesktopItem {
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@ -16,7 +16,7 @@

 let
  # Use specific package versions required by paperless-ngx
-  py = python3.override {
+  python = python3.override {
    packageOverrides = self: super: {
      django = super.django_4;

@ -51,7 +51,7 @@ let

  path = lib.makeBinPath [ ghostscript imagemagick jbig2enc optipng pngquant qpdf tesseract4 unpaper ];
 in
-py.pkgs.pythonPackages.buildPythonApplication rec {
+python.pkgs.pythonPackages.buildPythonApplication rec {
  pname = "paperless-ngx";
  version = "1.8.0";

@ -63,7 +63,7 @@ py.pkgs.pythonPackages.buildPythonApplication rec {

  format = "other";

-  propagatedBuildInputs = with py.pkgs.pythonPackages; [
+  propagatedBuildInputs = with python.pkgs.pythonPackages; [
    aioredis
    arrow
    asgiref
@ -169,7 +169,7 @@ py.pkgs.pythonPackages.buildPythonApplication rec {
  # Compile manually because `pythonRecompileBytecodeHook` only works for
  # files in `python.sitePackages`
  postBuild = ''
-    ${py.interpreter} -OO -m compileall src
+    ${python.interpreter} -OO -m compileall src
  '';

  installPhase = ''
@ -181,7 +181,7 @@ py.pkgs.pythonPackages.buildPythonApplication rec {
      --prefix PATH : "${path}"
  '';

-  checkInputs = with py.pkgs.pythonPackages; [
+  checkInputs = with python.pkgs.pythonPackages; [
    pytest-django
    pytest-env
    pytest-sugar
@ -207,6 +207,7 @@ py.pkgs.pythonPackages.buildPythonApplication rec {
  '';

  passthru = {
+    inherit python;
    # PYTHONPATH of all dependencies used by the package
    pythonPath = python3.pkgs.makePythonPath propagatedBuildInputs;
    inherit path;
--- a/pkgs/applications/office/super-productivity/default.nix
+++ b/pkgs/applications/office/super-productivity/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "super-productivity";
-  version = "7.11.6";
+  version = "7.12.0";

  src = fetchurl {
    url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "sha256-BXRnc6c/PpFdF4gPemU6IzVQvr+Tl5Fbxz7mY6Z5u7o=";
+    sha256 = "sha256-Ms7wt79iZz0xnrp+yrFs/FzVqINe6BSOEmYG9Oiz5JU=";
    name = "${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/office/tagainijisho/default.nix
+++ b/pkgs/applications/office/tagainijisho/default.nix
@ -1,11 +1,11 @@
 { lib, mkDerivation, fetchzip, qtbase, qttools, cmake, sqlite }:
 mkDerivation rec {
  pname = "tagainijisho";
-  version = "1.2.0";
+  version = "1.2.1";

  src = fetchzip {
    url = "https://github.com/Gnurou/tagainijisho/releases/download/${version}/tagainijisho-${version}.tar.gz";
-    hash = "sha256-fLq4Wfpa7Wr62KvHztgLiXE8eopCq+wipgabFm2bq6w=";
+    hash = "sha256-NYmvkjGl+lgFh4PPWGxitupYJ2DOyCBAYlITGb3FMj8=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/science/biology/iqtree/default.nix
+++ b/pkgs/applications/science/biology/iqtree/default.nix
@ -0,0 +1,32 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, boost
+, eigen
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "iqtree";
+  version = "2.2.0.4";
+
+  src = fetchFromGitHub {
+    owner = "iqtree";
+    repo = "iqtree2";
+    rev = "v${version}";
+    sha256 = "sha256:0ickw1ldpvv2m66yzbvqfhn8k07qdkhbjrlqjs6vcf3s42j5c6pq";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ boost eigen zlib ];
+
+  meta = with lib; {
+    homepage = "http://www.iqtree.org/";
+    description = "Efficient and versatile phylogenomic software by maximum likelihood";
+    license = licenses.lgpl2;
+    maintainers = with maintainers; [ bzizou ];
+  };
+}
--- a/pkgs/applications/science/biology/last/default.nix
+++ b/pkgs/applications/science/biology/last/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "last";
-  version = "1406";
+  version = "1409";

  src = fetchFromGitLab {
    owner = "mcfrith";
    repo = "last";
    rev = version;
-    sha256 = "sha256-N1B9W++4SiMRMUjDi8ZexOWF/HQpN8BBPuDKYh4bCS8=";
+    sha256 = "sha256-AFK0va1HonSWJdzJLdLraiu4LhUCJFgq6qajbbPmHuY=";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/science/electronics/dataexplorer/default.nix
+++ b/pkgs/applications/science/electronics/dataexplorer/default.nix
@ -0,0 +1,67 @@
+{ lib
+, stdenv
+, fetchurl
+, jdk
+, jre
+, ant
+, makeWrapper
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dataexplorer";
+  version = "3.6.2";
+
+  src = fetchurl {
+    url = "mirror://savannah/dataexplorer/dataexplorer-${version}-src.tar.gz";
+    sha256 = "sha256-2e8qeoJh7z/RIowMtAd8PGcMPck5H8iHqel6bW7EQ0E=";
+  };
+
+  nativeBuildInputs = [ ant makeWrapper ];
+
+  buildInputs = [ jdk ];
+
+  buildPhase = ''
+    ant -f build/build.xml dist
+  '';
+
+  doCheck = false;
+  # Missing dependencies (e.g. junit). Does not work.
+  #checkPhase = ''
+  #  ant -f build/build.xml check
+  #'';
+
+  installPhase = ''
+    ant -Dprefix=$out/share/ -f build/build.xml install
+
+    # The sources contain a wrapper script in $out/share/DataExplorer/DataExplorer
+    # but it hardcodes bash shebang and does not pin the java path.
+    # So we create our own wrapper, using similar cmdline args as upstream.
+    mkdir -p $out/bin
+    makeWrapper ${jre}/bin/java $out/bin/DataExplorer \
+      --add-flags "-Dfile.encoding=UTF-8 -Xms64m -Xmx3092m -jar $out/share/DataExplorer/DataExplorer.jar" \
+      --set SWT_GTK3 0
+
+    makeWrapper ${jre}/bin/java $out/bin/DevicePropertiesEditor \
+      --add-flags "-Dfile.encoding=UTF-8 -Xms32m -Xmx512m -classpath $out/share/DataExplorer/DataExplorer.jar gde.ui.dialog.edit.DevicePropertiesEditor" \
+      --set SWT_GTK3 0 \
+      --set LIBOVERLAY_SCROLLBAR 0
+
+    install -Dvm644 build/misc/GNU_LINUX_JUNSI_ICHARER_DUO_UDEV_RULE/50-Junsi-iCharger-DUO.rules \
+      $out/etc/udev/rules.d/50-Junsi-iCharger-DUO.rules
+    install -Dvm644 build/misc/GNU_LINUX_SKYRC_UDEV_RULE/50-SkyRC-Charger.rules \
+      $out/etc/udev/rules.d/50-SkyRC-Charger.rules
+  '';
+
+  meta = with lib; {
+    description = "Graphical tool to analyze data, gathered from various hardware devices";
+    homepage = "https://www.nongnu.org/dataexplorer/index.html";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ panicgh ];
+    platforms = jdk.meta.platforms;
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryNativeCode  # contains RXTXcomm (JNI library with *.so files)
+      binaryBytecode    # contains thirdparty jar files, e.g. javax.json, org.glassfish.json
+    ];
+  };
+}
--- a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
+++ b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
@ -1,9 +1,39 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, ninja, pkg-config, python3Packages
-, boost, rapidjson, qtbase, qtsvg, igraph, spdlog, wrapQtAppsHook
-, graphviz, llvmPackages, z3
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, ninja
+, pkg-config
+, python3Packages
+, boost
+, rapidjson
+, qtbase
+, qtsvg
+, igraph
+, spdlog
+, wrapQtAppsHook
+, graphviz
+, llvmPackages
+, z3
+, fmt_8
 }:

-stdenv.mkDerivation rec {
+let
+  # no stable hal release yet with recent spdlog/fmt support, remove
+  # once 4.0.0 is released - see https://github.com/emsec/hal/issues/452
+  spdlog' = spdlog.override {
+    fmt_8 = fmt_8.overrideAttrs (_: rec {
+      version = "8.0.1";
+      src = fetchFromGitHub {
+        owner = "fmtlib";
+        repo = "fmt";
+        rev = version;
+        sha256 = "1mnvxqsan034d2jiqnw2yvkljl7lwvhakmj5bscwp1fpkn655bbw";
+      };
+    });
+  };
+in stdenv.mkDerivation rec {
  version = "3.3.0";
  pname = "hal-hardware-analyzer";

@ -34,7 +64,7 @@ stdenv.mkDerivation rec {
  '';

  nativeBuildInputs = [ cmake ninja pkg-config ];
-  buildInputs = [ qtbase qtsvg boost rapidjson igraph spdlog graphviz wrapQtAppsHook z3 ]
+  buildInputs = [ qtbase qtsvg boost rapidjson igraph spdlog' graphviz wrapQtAppsHook z3 ]
    ++ (with python3Packages; [ python pybind11 ])
    ++ lib.optional stdenv.cc.isClang llvmPackages.openmp;

--- a/pkgs/applications/science/logic/cadical/default.nix
+++ b/pkgs/applications/science/logic/cadical/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "cadical";
-  version = "1.4.1";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "arminbiere";
    repo = "cadical";
    rev = "rel-${version}";
-    sha256 = "0y44z3np4gssgdh4aj5qila7pshrbphycdxn2083i8ayyyjbxshp";
+    sha256 = "sha256-Po+pGoUwk1gtBqz4Sc/QQ52rRGbA2pATebX+KPYII5o=";
  };

  outputs = [ "out" "dev" "lib" ];
--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "cbmc";
-  version = "5.64.0";
+  version = "5.65.0";

  src = fetchFromGitHub {
    owner = "diffblue";
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "sha256-FQoUNJV5eq/qGc6fdNlMHQADGipx9dxkb4EFRNX7h6w=";
+    sha256 = "sha256-A2xMbRblDXyhUXGDVxNBxFbs9npQJpMUBCPAloF33M8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/machine-learning/uarmsolver/default.nix
+++ b/pkgs/applications/science/machine-learning/uarmsolver/default.nix
@ -0,0 +1,31 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "uarmsolver";
+  version = "0.2.4";
+
+  src = fetchFromGitHub {
+   owner = "firefly-cpp";
+   repo = "uARMSolver";
+   rev = version;
+   sha256 = "17px69z0kw0z6cip41c45i6srbw56b0md92i9vbqyzinx8b75mzw";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  installPhase = ''
+    install -D -t $out/bin uARMSolver
+  '';
+
+  meta = with lib; {
+    description = "universal Association Rule Mining Solver";
+    homepage    = "https://github.com/firefly-cpp/uARMSolver";
+    license     = licenses.mit;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ firefly-cpp ];
+  };
+}
--- a/pkgs/applications/science/math/perseus/default.nix
+++ b/pkgs/applications/science/math/perseus/default.nix
@ -8,12 +8,12 @@ stdenv.mkDerivation {
  hardeningDisable = [ "stackprotector" ];

  src = fetchurl {
-    url = "http://www.sas.upenn.edu/~vnanda/source/perseus_4_beta.zip";
-    sha256 = "09brijnqabhgfjlj5wny0bqm5dwqcfkp1x5wif6yzdmqh080jybj";
+    url = "http://people.maths.ox.ac.uk/nanda/source/perseus_4_beta.zip";
+    sha256 = "sha256-cnkJEIC4tu+Ni7z0cKdjmLdS8QLe8iKpdA8uha2MeSU=";
  };

  sourceRoot = ".";
-
+  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
  buildPhase = ''
    g++ Pers.cpp -O3 -fpermissive -o perseus
  '';
@ -32,7 +32,7 @@ stdenv.mkDerivation {
      around datasets arising from point samples, images, distance
      matrices and so forth.
    '';
-    homepage = "http://www.sas.upenn.edu/~vnanda/perseus/index.html";
+    homepage = "http://people.maths.ox.ac.uk/nanda/perseus/index.html";
    license = lib.licenses.gpl3;
    maintainers = with lib.maintainers; [ erikryb ];
    platforms = lib.platforms.linux;
--- a/pkgs/applications/version-management/git-and-tools/git-sync/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-sync/default.nix
@ -21,13 +21,12 @@ stdenv.mkDerivation rec {
    cp -a contrib/git-* $out/bin/
  '';

-  wrapperPath = with lib; makeBinPath [
-    inotify-tools
+  wrapperPath = with lib; makeBinPath ([
    coreutils
    git
    gnugrep
    gnused
-  ];
+  ] ++ lib.optionals stdenv.isLinux [ inotify-tools ]);

  postFixup = ''
    wrap_path="${wrapperPath}":$out/bin
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@ -21,11 +21,11 @@ let

  self = python3Packages.buildPythonApplication rec {
    pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.2.1";
+    version = "6.2.2";

    src = fetchurl {
      url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-isXXog0cKtVNTCY9E0FkZG3DSo46a+1pz76rr404gto=";
+      sha256 = "sha256-nvqdpfSXqHUKycSPpDHEq3IgnxNgGAxdSSDRMRsEIN8=";
    };

    format = "other";
@ -35,7 +35,7 @@ let
    cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
      inherit src;
      name = "mercurial-${version}";
-      sha256 = "sha256-shmeTQSCpQLrRUbL5bu9nAiPideZUe31YNCrClLM1eI=";
+      sha256 = "sha256-hvjp45Iv+fjs8R5Q+k96chY5j0S2Vs6+VrXzMuc2Cwg=";
      sourceRoot = "mercurial-${version}/rust";
    } else null;
    cargoRoot = if rustSupport then "rust" else null;
@ -148,6 +148,17 @@ let

    # doesn't like the extra setlocale warnings emitted by our bash wrappers
    test-locale.t
+
+    # Python 3.10 error message change https://bz.mercurial-scm.org/show_bug.cgi?id=6643
+    test-http-bad-server.t
+
+    # Python 3.10-3.12 deprecation warning: distutils
+    # https://bz.mercurial-scm.org/show_bug.cgi?id=6729
+    test-hghave.t
+
+    # Python 3.10-3.12 deprecation warning: asyncore
+    # https://bz.mercurial-scm.org/show_bug.cgi?id=6727
+    test-patchbomb-tls.t
    EOF

    export HGTEST_REAL_HG="${mercurial}/bin/hg"
--- a/pkgs/applications/video/obs-studio/plugins/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/default.nix
@ -14,4 +14,5 @@
    obs-vkcapture32 = pkgsi686Linux.obs-studio-plugins.obs-vkcapture;
  };
  obs-backgroundremoval = callPackage ./obs-backgroundremoval.nix {};
+  obs-hyperion = callPackage ./obs-hyperion/default.nix {};
 }
--- a/pkgs/applications/video/obs-studio/plugins/obs-hyperion/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-hyperion/default.nix
@ -0,0 +1,24 @@
+{ stdenv, lib, fetchFromGitLab, meson, ninja, pkg-config, obs-studio, libGL
+, qtbase }:
+
+stdenv.mkDerivation rec {
+  pname = "obs-hyperion";
+  version = "1.0.1";
+
+  src = fetchFromGitLab {
+    owner = "hyperion-project";
+    repo = "hyperion-obs-plugin";
+    rev = "v${version}";
+    sha256 = "sha256-Si+TGYWpNPtUUFT+M571lCYslPyeYX92MdYV2EGgcyQ=";
+  };
+
+  nativeBuildInputs = [ meson pkg-config ninja ];
+  buildInputs = [ obs-studio libGL qtbase ];
+
+  meta = with lib; {
+    description = "OBS Studio plugin to connect to a Hyperion.ng server";
+    license = licenses.mit;
+    maintainers = with maintainers; [ algram ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@ -3,7 +3,10 @@
 , libcap, libdrm, libepoxy, minijail, virglrenderer, wayland, wayland-protocols
 }:

-let
+rustPlatform.buildRustPackage rec {
+  pname = "crosvm";
+  version = "104.0";
+
  src = fetchgit {
    url = "https://chromium.googlesource.com/crosvm/crosvm";
    rev = "265aab613b1eb31598ea0826f04810d9f010a2c6";
@ -11,18 +14,6 @@ let
    fetchSubmodules = true;
  };

-  # use vendored virglrenderer
-  virglrenderer' = virglrenderer.overrideAttrs (oa: {
-    src = "${src}/third_party/virglrenderer";
-  });
-in
-
-rustPlatform.buildRustPackage rec {
-  pname = "crosvm";
-  version = "104.0";
-
-  inherit src;
-
  separateDebugInfo = true;

  patches = [
@ -34,7 +25,7 @@ rustPlatform.buildRustPackage rec {
  nativeBuildInputs = [ minijail-tools pkg-config protobuf wayland-scanner ];

  buildInputs = [
-    libcap libdrm libepoxy minijail virglrenderer' wayland wayland-protocols
+    libcap libdrm libepoxy minijail virglrenderer wayland wayland-protocols
  ];

  arch = stdenv.hostPlatform.parsed.cpu.name;
--- a/pkgs/applications/virtualization/docker/buildx.nix
+++ b/pkgs/applications/virtualization/docker/buildx.nix
@ -20,11 +20,17 @@ buildGoModule rec {
  ];

  installPhase = ''
+    runHook preInstall
    install -D $GOPATH/bin/buildx $out/libexec/docker/cli-plugins/docker-buildx
+
+    mkdir -p $out/bin
+    ln -s $out/libexec/docker/cli-plugins/docker-buildx $out/bin/docker-buildx
+    runHook postInstall
  '';

  meta = with lib; {
    description = "Docker CLI plugin for extended build capabilities with BuildKit";
+    homepage = "https://github.com/docker/buildx";
    license = licenses.asl20;
    maintainers = [ maintainers.ivan-babrou ];
  };
--- a/pkgs/applications/window-managers/sway/lock-effects.nix
+++ b/pkgs/applications/window-managers/sway/lock-effects.nix
@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
    longDescription = ''
      Swaylock, with fancy effects
    '';
+    mainProgram = "swaylock";
    inherit (src.meta) homepage;
    license = licenses.mit;
    platforms = platforms.linux;
--- a/pkgs/applications/window-managers/sway/swayest-workstyle/default.nix
+++ b/pkgs/applications/window-managers/sway/swayest-workstyle/default.nix
@ -0,0 +1,29 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "swayest-workstyle";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "Lyr-7D1h";
+    repo = "swayest_workstyle";
+    rev = version;
+    sha256 = "sha256-LciTrYbmJV0y0H6QH88vTBXbDdDSx6FQtO4J/CFLjtY=";
+  };
+
+  cargoSha256 = "sha256-34Ij3Hd1JI6d1vhv1XomFc9SFoB/6pbS39upLk+NeQM=";
+
+  doCheck = false; # No tests
+
+  meta = with lib; {
+    description = "Map sway workspace names to icons defined depending on the windows inside of the workspace";
+    homepage = "https://github.com/Lyr-7D1h/swayest_workstyle";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ miangraham ];
+    mainProgram = "sworkstyle";
+  };
+}
--- a/pkgs/common-updater/unstable-updater.nix
+++ b/pkgs/common-updater/unstable-updater.nix
@ -8,7 +8,7 @@

 # This is an updater for unstable packages that should always use the latest
 # commit.
-{ url ? null # The git url, if empty it will be set to src.url
+{ url ? null # The git url, if empty it will be set to src.gitRepoUrl
 , branch ? null
 , stableVersion ? false # Use version format according to RFC 107 (i.e. LAST_TAG+date=YYYY-MM-DD)
 , tagPrefix ? "" # strip this prefix from a tag name when using stable version
@ -46,7 +46,7 @@ let
        esac
    done

-    # By default we set url to src.url
+    # By default we set url to src.gitRepoUrl
    if [[ -z "$url" ]]; then
        url="$(${nix}/bin/nix-instantiate $systemArg --eval -E \
                   "with import ./. {}; $UPDATE_NIX_ATTR_PATH.src.gitRepoUrl" \
--- a/pkgs/data/themes/catppuccin-gtk/default.nix
+++ b/pkgs/data/themes/catppuccin-gtk/default.nix
@ -5,7 +5,6 @@
 , gnome-themes-extra
 , gtk-engine-murrine
 , sassc
-, which
 , tweaks ? [ ]
 , size ? "standard"
 }:
@ -14,9 +13,9 @@ let
  validTweaks = [ "nord" "dracula" "black" "rimless" "normal" ];

  unknownTweaks = lib.subtractLists validTweaks tweaks;
-  illegalMix = !(lib.elem "nord" tweaks) && !(lib.elem "dracula" tweaks);
+  illegalMix = (lib.elem "nord" tweaks) && (lib.elem "dracula" tweaks);

-  assertIllegal = lib.assertMsg illegalMix ''
+  assertIllegal = lib.assertMsg (!illegalMix) ''
    Tweaks "nord" and "dracula" cannot be mixed. Tweaks: ${toString tweaks}
  '';

@ -37,16 +36,16 @@ assert assertUnknown;

 stdenvNoCC.mkDerivation rec {
  pname = "catppuccin-gtk";
-  version = "unstable-2022-08-01";
+  version = "0.2.7";

  src = fetchFromGitHub {
    repo = "gtk";
    owner = "catppuccin";
-    rev = "87a79fd2bf07accc694455df30a32a82b1b31f4f";
-    sha256 = "sha256-dKHTQva0BYkO6VPNfY/pzRn/V1ghX+tYqbnM9hTAMeE=";
+    rev = "v-${version}";
+    sha256 = "sha256-oTAfURHMWqlKHk4CNz5cn6vO/7GmQJM2rXXGDz2e+0w=";
  };

-  nativeBuildInputs = [ gtk3 sassc which ];
+  nativeBuildInputs = [ gtk3 sassc ];

  buildInputs = [ gnome-themes-extra ];

@ -61,7 +60,6 @@ stdenvNoCC.mkDerivation rec {

    export HOME=$(mktemp -d)

-    mkdir -p $out/share/themes
    bash install.sh -d $out/share/themes -t all \
      ${lib.optionalString (size != "") "-s ${size}"} \
      ${lib.optionalString (tweaks != []) "--tweaks " + builtins.toString tweaks}
--- a/pkgs/development/embedded/orbuculum/default.nix
+++ b/pkgs/development/embedded/orbuculum/default.nix
@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, czmq
+, libusb1
+, ncurses
+}:
+
+stdenv.mkDerivation rec {
+  pname = "orbuculum";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "orbcode";
+    repo = pname;
+    rev = "V${version}";
+    sha256 = "sha256-aMMXfrBQQ9oOx17MUKmqe5vdTpxhBGM5mVfAel0y0a0=";
+  };
+
+  buildInputs = [
+    czmq
+    libusb1
+    ncurses
+  ];
+
+  installFlags = [
+    "INSTALL_ROOT=$(out)/"
+  ];
+
+  postInstall = ''
+    mkdir -p $out/etc/udev/rules.d/
+    cp $src/Support/60-orbcode.rules $out/etc/udev/rules.d/
+  '';
+
+  meta = with lib; {
+    description = "Cortex M SWO SWV Demux and Postprocess for the ORBTrace";
+    homepage = "https://orbcode.org";
+    changelog = "https://github.com/orbcode/orbuculum/blob/V${version}/CHANGES.md";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ newam ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , aws-c-cal
 , aws-c-common
@ -7,18 +8,19 @@
 , aws-c-io
 , aws-c-sdkutils
 , cmake
+, nix
 , s2n-tls
 }:

 stdenv.mkDerivation rec {
  pname = "aws-c-auth";
-  version = "0.6.14";
+  version = "0.6.16";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "aws-c-auth";
    rev = "v${version}";
-    sha256 = "sha256-Wi1vW0EYgtOltPI5FMhY5je2ZMF9R5ch4nIjENva+FU=";
+    sha256 = "sha256-JUCnrnJnXDCsdw9UcmujoxZ+cE9PDmqQNHYyvjSVBpw=";
  };

  nativeBuildInputs = [
@ -42,6 +44,10 @@ stdenv.mkDerivation rec {
    "-DBUILD_SHARED_LIBS=ON"
  ];

+  passthru.tests = {
+    inherit nix;
+  };
+
  meta = with lib; {
    description = "C99 library implementation of AWS client-side authentication";
    homepage = "https://github.com/awslabs/aws-c-auth";
--- a/pkgs/development/libraries/aws-c-cal/default.nix
+++ b/pkgs/development/libraries/aws-c-cal/default.nix
@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, cmake, aws-c-common, openssl, Security }:
+{ lib, stdenv, fetchFromGitHub, cmake, aws-c-common, nix, openssl, Security }:

 stdenv.mkDerivation rec {
  pname = "aws-c-cal";
-  version = "0.5.18";
+  version = "0.5.19";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-sT5ahf8MuIhqDV6RrRU+RgsLdwVUDEFWRZJpzQJOPGA=";
+    sha256 = "sha256-VEjefo+y8bizCxvJmzx+dZ1BE9eT1cR3Tkfn1eVQI/0=";
  };

  nativeBuildInputs = [ cmake ];
@ -21,6 +21,10 @@ stdenv.mkDerivation rec {
    "-DBUILD_SHARED_LIBS=ON"
  ];

+  passthru.tests = {
+    inherit nix;
+  };
+
  meta = with lib; {
    description = "AWS Crypto Abstraction Layer ";
    homepage = "https://github.com/awslabs/aws-c-cal";
--- a/pkgs/development/libraries/aws-c-event-stream/default.nix
+++ b/pkgs/development/libraries/aws-c-event-stream/default.nix
@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, cmake, aws-c-cal, aws-c-common, aws-c-io, aws-checksums, s2n-tls, libexecinfo }:
+{ lib, stdenv, fetchFromGitHub, cmake, aws-c-cal, aws-c-common, aws-c-io, aws-checksums, nix, s2n-tls, libexecinfo }:

 stdenv.mkDerivation rec {
  pname = "aws-c-event-stream";
-  version = "0.2.12";
+  version = "0.2.14";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-I4DqsPmHsZsReoqAH0WMU5/XlM4LiaxpJrVVYdXnMZY=";
+    sha256 = "sha256-QUrDIeQjsmf8TKu4UoSZi0eNw7Yg/2HIvXo7Y0FLY6w=";
  };

  nativeBuildInputs = [ cmake ];
@ -20,6 +20,10 @@ stdenv.mkDerivation rec {
    "-DBUILD_SHARED_LIBS:BOOL=ON"
  ];

+  passthru.tests = {
+    inherit nix;
+  };
+
  meta = with lib; {
    description = "C99 implementation of the vnd.amazon.eventstream content-type";
    homepage = "https://github.com/awslabs/aws-c-event-stream";
--- a/pkgs/development/libraries/aws-c-http/default.nix
+++ b/pkgs/development/libraries/aws-c-http/default.nix
@ -5,18 +5,19 @@
 , aws-c-compression
 , aws-c-io
 , cmake
+, nix
 , s2n-tls
 }:

 stdenv.mkDerivation rec {
  pname = "aws-c-http";
-  version = "0.6.19";
+  version = "0.6.20";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "aws-c-http";
    rev = "v${version}";
-    sha256 = "sha256-ErwsRYz0D5ktlDaXIDvTXkxO7MM0N4RAA5IBqPbNfAc=";
+    sha256 = "sha256-eHsk/ME/kVGm8gxkR9NcJUkfbvI+4u5S4y4Tw29hEnY=";
  };

  nativeBuildInputs = [
@ -35,6 +36,10 @@ stdenv.mkDerivation rec {
    "-DBUILD_SHARED_LIBS=ON"
  ];

+  passthru.tests = {
+    inherit nix;
+  };
+
  meta = with lib; {
    description = "C99 implementation of the HTTP/1.1 and HTTP/2 specifications";
    homepage = "https://github.com/awslabs/aws-c-http";
--- a/pkgs/development/libraries/aws-c-io/default.nix
+++ b/pkgs/development/libraries/aws-c-io/default.nix
@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, cmake, aws-c-cal, aws-c-common, s2n-tls, Security }:
+{ lib, stdenv, fetchFromGitHub, cmake, aws-c-cal, aws-c-common, nix, s2n-tls, Security }:

 stdenv.mkDerivation rec {
  pname = "aws-c-io";
-  version = "0.11.2";
+  version = "0.13.3";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-HMsCFvwWgWwU3YBuZsmOSsMnEvzAVV9jEZyEEBwRcYg=";
+    sha256 = "sha256-lrSAWw5T4RAbk0JaNi5Vmh7qcjxOS8a1jdFMpaItrhI=";
  };

  nativeBuildInputs = [ cmake ];
@ -20,6 +20,10 @@ stdenv.mkDerivation rec {
    "-DBUILD_SHARED_LIBS=ON"
  ];

+  passthru.tests = {
+    inherit nix;
+  };
+
  meta = with lib; {
    description = "AWS SDK for C module for IO and TLS";
    homepage = "https://github.com/awslabs/aws-c-io";
--- a/pkgs/development/libraries/aws-c-mqtt/default.nix
+++ b/pkgs/development/libraries/aws-c-mqtt/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , aws-c-cal
 , aws-c-common
@ -6,18 +7,19 @@
 , aws-c-http
 , aws-c-io
 , cmake
+, nix
 , s2n-tls
 }:

 stdenv.mkDerivation rec {
  pname = "aws-c-mqtt";
-  version = "0.7.11";
+  version = "0.7.12";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "aws-c-mqtt";
    rev = "v${version}";
-    sha256 = "sha256-+vxn9Fq8eZ53cRR31hnLf1cxZ2zY03lt2RuEop+ciu0=";
+    sha256 = "sha256-0u3t0m5GQ7wxxLI8rY7j9AMliPzrAR9J/c/7DcT43WU=";
  };

  nativeBuildInputs = [
@ -37,6 +39,10 @@ stdenv.mkDerivation rec {
    "-DBUILD_SHARED_LIBS=ON"
  ];

+  passthru.tests = {
+    inherit nix;
+  };
+
  meta = with lib; {
    description = "C99 implementation of the MQTT 3.1.1 specification";
    homepage = "https://github.com/awslabs/aws-c-mqtt";
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@ -8,18 +8,19 @@
 , aws-c-io
 , aws-checksums
 , cmake
+, nix
 , s2n-tls
 }:

 stdenv.mkDerivation rec {
  pname = "aws-c-s3";
-  version = "0.1.43";
+  version = "0.1.46";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "aws-c-s3";
    rev = "v${version}";
-    sha256 = "sha256-I4pPNjaRNHPzVZVgY0qm8S+Tdvtklx/N3EKu0SAm5c8=";
+    sha256 = "sha256-OUrMdIWWnk+yAJTVJ/UlUNFABLlTkmYac5g125Zq+fQ=";
  };

  nativeBuildInputs = [
@ -41,6 +42,10 @@ stdenv.mkDerivation rec {
    "-DBUILD_SHARED_LIBS=ON"
  ];

+  passthru.tests = {
+    inherit nix;
+  };
+
  meta = with lib; {
    description = "C99 library implementation for communicating with the S3 service";
    homepage = "https://github.com/awslabs/aws-c-s3";
--- a/pkgs/development/libraries/belr/default.nix
+++ b/pkgs/development/libraries/belr/default.nix
@ -7,7 +7,7 @@

 stdenv.mkDerivation rec {
  pname = "belr";
-  version = "5.1.12";
+  version = "5.1.55";

  src = fetchFromGitLab {
    domain = "gitlab.linphone.org";
--- a/pkgs/development/libraries/cimg/default.nix
+++ b/pkgs/development/libraries/cimg/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "cimg";
-  version = "3.1.4";
+  version = "3.1.6";

  src = fetchFromGitHub {
    owner = "dtschump";
    repo = "CImg";
    rev = "v.${version}";
-    hash = "sha256-nHYRs8X8I0B76SlgqWez3qubrsG7iBfa0I/G78v7H8g=";
+    hash = "sha256-NZwivsTYgirZXuS25buGHL3uk75shRGMH4c3YdS7Mgg=";
  };

  outputs = [ "out" "doc" ];
--- a/pkgs/development/libraries/kpmcore/default.nix
+++ b/pkgs/development/libraries/kpmcore/default.nix
@ -6,11 +6,11 @@
 stdenv.mkDerivation rec {
  pname = "kpmcore";
  # NOTE: When changing this version, also change the version of `partition-manager`.
-  version = "22.04.3";
+  version = "22.08.0";

  src = fetchurl {
    url = "mirror://kde/stable/release-service/${version}/src/${pname}-${version}.tar.xz";
-    hash = "sha256-LmKglUgXhLOBLSpzfXvK/UXFqY3L+p/EoHbZTSKlGhM=";
+    hash = "sha256-Ws20hKX2iDdke5yBBKXukVUD4OnLf1OmwlhW+jUXL24=";
  };

  nativeBuildInputs = [ extra-cmake-modules ];
--- a/pkgs/development/libraries/libharu/default.nix
+++ b/pkgs/development/libraries/libharu/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libharu";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "libharu";
    repo = pname;
-    rev = "RELEASE_${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "15s9hswnl3qqi7yh29jyrg0hma2n99haxznvcywmsp8kjqlyg75q";
+    rev = "v${version}";
+    hash = "sha256-85o9pb2zJVYbM0SHxCNgJuDkcsHuFuwFe6B6xivoUUg=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/libjaylink/default.nix
+++ b/pkgs/development/libraries/libjaylink/default.nix
@ -5,14 +5,14 @@

 stdenv.mkDerivation rec {
  pname = "libjaylink";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitLab {
    domain = "gitlab.zapb.de";
    owner = "libjaylink";
    repo = "libjaylink";
    rev = version;
-    sha256 = "sha256-90obLaSE3oxrocyJWZ4+j4U4GuPIZEiiIQqenu4vsJg=";
+    sha256 = "sha256-odJDE1A0WZ9vBXPxaUdthjTgmbmbdHjbyY1PkaM4+vI=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/development/libraries/libspatialindex/default.nix
+++ b/pkgs/development/libraries/libspatialindex/default.nix
@ -1,20 +1,37 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libspatialindex";
-  version = "1.8.5";
+  version = "1.9.3";

-  src = fetchurl {
-    url = "https://download.osgeo.org/libspatialindex/spatialindex-src-${version}.tar.gz";
-    sha256 = "1vxzm7kczwnb6qdmc0hb00z8ykx11zk3sb68gc7rch4vrfi4dakw";
+  src = fetchFromGitHub {
+    owner = "libspatialindex";
+    repo = "libspatialindex";
+    rev = finalAttrs.version;
+    hash = "sha256-zsvS0IkCXyuNLCQpccKdAsFKoq0l+y66ifXlTHLNTkc=";
  };

-  enableParallelBuilding = true;
+  patches = [
+    # Allow building static libs
+    (fetchpatch {
+      name = "fix-static-lib-build.patch";
+      url = "https://github.com/libspatialindex/libspatialindex/commit/caee28d84685071da3ff3a4ea57ff0b6ae64fc87.patch";
+      hash = "sha256-nvTW/t9tw1ZLeycJY8nj7rQgZogxQb765Ca2b9NDvRo=";
+    })
+  ];

-  meta = {
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [
+    "-DSIDX_BUILD_TESTS=${if finalAttrs.doCheck then "ON" else "OFF"}"
+  ];
+
+  doCheck = true;
+
+  meta = with lib; {
    description = "Extensible spatial index library in C++";
-    homepage = "http://libspatialindex.github.io/";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.unix;
+    homepage = "https://libspatialindex.org";
+    license = licenses.mit;
+    platforms = platforms.unix;
  };
-}
+})
--- a/pkgs/development/libraries/nng/default.nix
+++ b/pkgs/development/libraries/nng/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, ninja }:
+{ lib, stdenv, fetchFromGitHub, cmake, ninja, mbedtlsSupport ? true, mbedtls }:

 stdenv.mkDerivation rec {
  pname = "nng";
@ -11,9 +11,13 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-qbjMLpPk5FxH710Mf8AIraY0mERbaxVVhTT94W0EV+k=";
  };

-  nativeBuildInputs = [ cmake ninja ];
+  nativeBuildInputs = [ cmake ninja ]
+    ++ lib.optionals mbedtlsSupport [ mbedtls ];

-  cmakeFlags = [ "-G Ninja" ];
+  buildInputs = lib.optional mbedtlsSupport [ mbedtls ];
+
+  cmakeFlags = [ "-G Ninja" "-DNNG_ENABLE_TLS=ON" ]
+    ++ lib.optionals mbedtlsSupport [ "-DMBEDTLS_ROOT_DIR=${mbedtls}" ];

  meta = with lib; {
    homepage = "https://nng.nanomsg.org/";
@ -21,5 +25,6 @@ stdenv.mkDerivation rec {
    license = licenses.mit;
    mainProgram = "nngcat";
    platforms = platforms.unix;
+    maintainers = with maintainers; [ nviets ];
  };
 }
--- a/pkgs/development/libraries/precice/default.nix
+++ b/pkgs/development/libraries/precice/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "precice";
-  version = "2.4.0";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "precice";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0qmwdxpbmy4dvjxav3dls18qns734j0yfvxvjrh1nnkk36qhfp3q";
+    sha256 = "sha256-n/UuiVHw1zwlhwR/HDaKgoMnPy6fm9HWZ5FmAr7F/GE=";
  };

  cmakeFlags = [
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@ -50,9 +50,6 @@ stdenv.mkDerivation rec {
  '' + lib.optionalString stdenv.cc.isClang ''
    substituteInPlace src/3rdparty/webkit/Source/WebCore/html/HTMLImageElement.cpp \
      --replace 'optionalHeight > 0' 'optionalHeight != NULL'
-
-    substituteInPlace ./tools/linguist/linguist/messagemodel.cpp \
-      --replace 'm->comment()) >= 0' 'm->comment()) != NULL'
  '';

  patches =
@ -237,6 +234,6 @@ stdenv.mkDerivation rec {
    license     = lib.licenses.lgpl21Plus; # or gpl3
    maintainers = with lib.maintainers; [ orivej lovek323 sander ];
    platforms   = lib.platforms.unix;
-    badPlatforms = [ "x86_64-darwin" ];
+    badPlatforms = [ "x86_64-darwin" "aarch64-darwin" ];
  };
 }
--- a/pkgs/development/libraries/raylib/default.nix
+++ b/pkgs/development/libraries/raylib/default.nix
@ -1,21 +1,21 @@
-{ stdenv, lib, fetchFromGitHub, cmake,
-  mesa, libGLU, glfw,
-  libX11, libXi, libXcursor, libXrandr, libXinerama,
-  alsaSupport ? stdenv.hostPlatform.isLinux, alsa-lib,
-  pulseSupport ? stdenv.hostPlatform.isLinux, libpulseaudio,
-  sharedLib ? true,
-  includeEverything ? true
+{ stdenv, lib, fetchFromGitHub, cmake, fetchpatch
+, mesa, libGLU, glfw
+, libX11, libXi, libXcursor, libXrandr, libXinerama
+, alsaSupport ? stdenv.hostPlatform.isLinux, alsa-lib
+, pulseSupport ? stdenv.hostPlatform.isLinux, libpulseaudio
+, sharedLib ? true
+, includeEverything ? true
 }:

 stdenv.mkDerivation rec {
  pname = "raylib";
-  version = "4.0.0";
+  version = "4.2.0";

  src = fetchFromGitHub {
    owner = "raysan5";
    repo = pname;
    rev = version;
-    sha256 = "1mszf5v7qy38cv1fisq6xd9smb765hylhkv1ms9y7shmdl2ni6b7";
+    sha256 = "sha256-aMIjywcQxki0cKlNznPAMfvrtGj3qcR95D4/BDuPZZM=";
  };

  nativeBuildInputs = [ cmake ];
@ -24,10 +24,21 @@ stdenv.mkDerivation rec {
  ] ++ lib.optional alsaSupport alsa-lib
    ++ lib.optional pulseSupport libpulseaudio;

+  patches = [
+    # fixes glfw compile error;
+    # remove with next raylib version > 4.2.0 or when glfw 3.4.0 is released.
+    (fetchpatch {
+      url = "https://github.com/raysan5/raylib/commit/2ad7967db80644a25ca123536cf2f6efcb869684.patch";
+      sha256 = "sha256-/xgzox1ITeoZ91QWdwnJJ+jJ5nJsMHcEgbIEdNYh4NY=";
+      name = "raylib-glfw-fix.patch";
+    })
+  ];
+
  # https://github.com/raysan5/raylib/wiki/CMake-Build-Options
  cmakeFlags = [
    "-DUSE_EXTERNAL_GLFW=ON"
    "-DBUILD_EXAMPLES=OFF"
+    "-DCUSTOMIZE_BUILD=1"
  ] ++ lib.optional includeEverything "-DINCLUDE_EVERYTHING=ON"
    ++ lib.optional sharedLib "-DBUILD_SHARED_LIBS=ON";

--- a/pkgs/development/libraries/science/math/arpack/default.nix
+++ b/pkgs/development/libraries/science/math/arpack/default.nix
@ -45,10 +45,6 @@ stdenv.mkDerivation rec {
    install_name_tool -change libblas.dylib ${blas}/lib/libblas.dylib $out/lib/libarpack.dylib
  '';

-  # disable stackprotector on aarch64-darwin for now
-  # https://github.com/NixOS/nixpkgs/issues/127608
-  hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
-
  meta = {
    homepage = "https://github.com/opencollab/arpack-ng";
    description = ''
--- a/pkgs/development/libraries/speechd/default.nix
+++ b/pkgs/development/libraries/speechd/default.nix
@ -27,11 +27,11 @@ let
  inherit (python3Packages) python pyxdg wrapPython;
 in stdenv.mkDerivation rec {
  pname = "speech-dispatcher";
-  version = "0.11.1";
+  version = "0.11.2";

  src = fetchurl {
    url = "https://github.com/brailcom/speechd/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-0doS7T2shPE3mbai7Dm6LTyiGoST9E3BhVvQupbC3cY=";
+    sha256 = "sha256-i0ZJkl5oy+GntMCge7BBznc4s1yQamAr+CmG2xqg82Q=";
  };

  patches = [
--- a/pkgs/development/libraries/sundials/default.nix
+++ b/pkgs/development/libraries/sundials/default.nix
@ -61,21 +61,6 @@ stdenv.mkDerivation rec {
  )]
  ;

-  # disable stackprotector on aarch64-darwin for now
-  # https://github.com/NixOS/nixpkgs/issues/127608
-  #
-  # build error:
-  #
-  # /private/tmp/nix-build-sundials-6.3.0.drv-0/ccD2dUtR.s:21:15: error: index must be an integer in range [-256, 255].
-  #         ldr     x0, [x0, ___stack_chk_guard];momd
-  #                          ^
-  # /private/tmp/nix-build-sundials-6.3.0.drv-0/ccD2dUtR.s:46:15: error: index must be an integer in range [-256, 255].
-  #         ldr     x0, [x0, ___stack_chk_guard];momd
-  #
-  # See also a proposed solution: https://github.com/NixOS/nixpkgs/pull/151983
-
-  hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
-
  doCheck = true;
  checkTarget = "test";

--- a/pkgs/development/libraries/vapoursynth/default.nix
+++ b/pkgs/development/libraries/vapoursynth/default.nix
@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    broken = stdenv.isDarwin;
+    broken = stdenv.isDarwin; # see https://github.com/NixOS/nixpkgs/pull/189446 for partial fix
    description = "A video processing framework with the future in mind";
    homepage    = "http://www.vapoursynth.com/";
    license     = licenses.lgpl21;
--- a/pkgs/development/libraries/virglrenderer/default.nix
+++ b/pkgs/development/libraries/virglrenderer/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  pname = "virglrenderer";
-  version = "0.9.1";
+  version = "0.10.0";

  src = fetchurl {
    url = "https://gitlab.freedesktop.org/virgl/virglrenderer/-/archive/virglrenderer-${version}/virglrenderer-virglrenderer-${version}.tar.bz2";
-    sha256 = "1h76a1ylhh4niq33sa5knx033sr4k2816vibh4m58j54y7qc6346";
+    sha256 = "tMLD6lu1NnKeoQQIzwhMypKdrW5alULod2cdb8+76iM=";
  };

  buildInputs = [ libGLU libepoxy libX11 libdrm mesa ];
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@ -0,0 +1,38 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "brev-cli";
+  version = "0.6.95";
+
+  src = fetchFromGitHub {
+    owner = "brevdev";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "09qhc38ycqs6vdyy1rxaxbihq0q59g2ffkmmlk6ipdlv2b3ywz0f";
+  };
+
+  vendorSha256 = "sha256-5P9oodntXn7RMpjKLoCXlnEZeW4/W0hfYPt7I3hjvGw=";
+
+  CGO_ENABLED = 0;
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/brevdev/brev-cli/pkg/cmd/version.Version=${src.rev}"
+  ];
+
+  postInstall = ''
+    mv $out/bin/brev-cli $out/bin/brev
+  '';
+
+  meta = with lib; {
+    description = "Connect your laptop to cloud computers";
+    homepage = "https://github.com/brevdev/brev-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
--- a/pkgs/development/misc/cppreference-doc/default.nix
+++ b/pkgs/development/misc/cppreference-doc/default.nix
@ -0,0 +1,31 @@
+{ lib, fetchzip }:
+
+let
+  pname = "cppreference-doc";
+  version = "2022.07.30";
+  ver = builtins.replaceStrings ["."] [""] version;
+
+in fetchzip {
+  name = pname + "-" + version;
+
+  url = "https://github.com/PeterFeicht/${pname}/releases/download/v${ver}/html-book-${ver}.tar.xz";
+  sha256 = "sha256-gsYNpdxbWnmwcC9IJV1g+e0/s4Hoo5ig1MGoYPIHspw=";
+
+  stripRoot = false;
+
+  postFetch = ''
+    rm $out/cppreference-doxygen-local.tag.xml $out/cppreference-doxygen-web.tag.xml
+    mkdir -p $out/share/cppreference/doc
+    mv $out/reference $out/share/cppreference/doc/html
+  '';
+
+  passthru = { inherit pname version; };
+
+  meta = with lib; {
+    description = "C++ standard library reference";
+    homepage = "https://en.cppreference.com";
+    license = licenses.cc-by-sa-30;
+    maintainers = with maintainers; [ panicgh ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/ocaml-modules/index/default.nix
+++ b/pkgs/development/ocaml-modules/index/default.nix
@ -6,15 +6,14 @@

 buildDunePackage rec {
  pname = "index";
-  version = "1.6.0";
+  version = "1.6.1";

  src = fetchurl {
    url = "https://github.com/mirage/index/releases/download/${version}/index-${version}.tbz";
-    sha256 = "sha256:150mcsh8vj2hapfnxbjmacanjy4avrv8yk1lyaxmqj3fpmn1y32y";
+    sha256 = "sha256-rPwNzqkWqDak2mDTDIBqIvachY1vfOIzFmwaXjZea+4=";
  };

  minimalOCamlVersion = "4.08";
-  useDune2 = true;

  buildInputs = [
    stdlib-shims
--- a/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "aliyun-python-sdk-cdn";
-  version = "3.7.1";
+  version = "3.7.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-GAY4o9lr+1m8g1T7EhL5jLjEdfMWC/1vJ3UC4PQzvjI=";
+    hash = "sha256-wbVkoNu9ffMpuivUGg+PAya099xMbU0Ehvl0++ud+WE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/bids-validator/default.nix
+++ b/pkgs/development/python-modules/bids-validator/default.nix
@ -4,12 +4,12 @@
 }:

 buildPythonPackage rec {
-  version = "1.9.7";
+  version = "1.9.8";
  pname = "bids-validator";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-q8dnOSoN9Gu9yl/UJNRXeTBBKTnfJhHwqN6+QVTlexI=";
+    sha256 = "sha256-/zl5m7IF+S1vLDIvC47/DRwCiPQpGgsY/OYa+k39fz4=";
  };

  # needs packages which are not available in nixpkgs
--- a/pkgs/development/python-modules/bincopy/default.nix
+++ b/pkgs/development/python-modules/bincopy/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "bincopy";
-  version = "17.10.2";
+  version = "17.10.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-d1l+kqyGkBvctfKRHxCpve/8mLa7nTfDwXzxgJznce4=";
+    sha256 = "sha256-HDSqwrCXf2U0uzfa4Vb9Euu9ZSm6eFD9bcMf6eieicY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/cryptg/default.nix
+++ b/pkgs/development/python-modules/cryptg/default.nix
@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, rustPlatform
+, setuptools-rust
+}:
+
+buildPythonPackage rec {
+  pname = "cryptg";
+  version = "0.3.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "cher-nov";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-IhzwQrWu8k308ZZhWz4Z3FHAkSLTXiCydyiy0MPN8NI=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    hash = "sha256-M2ySVqfgpgHktLh4t5Sh1UTBCzajlQiDku4O9azHJwk=";
+  };
+
+  nativeBuildInputs = with rustPlatform;[
+    setuptools-rust
+    cargoSetupHook
+    rust.rustc
+    rust.cargo
+  ];
+
+  # has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "cryptg" ];
+
+  meta = with lib; {
+    description = "Official Telethon extension to provide much faster cryptography for Telegram API requests";
+    homepage = "https://github.com/cher-nov/cryptg";
+    license = licenses.cc0;
+    maintainers = with maintainers; [ nickcao ];
+  };
+}
--- a/pkgs/development/python-modules/django-configurations/default.nix
+++ b/pkgs/development/python-modules/django-configurations/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "django-configurations";
-  version = "2.3.2";
+  version = "2.4";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "bd1a77a60735839b7d105912cc3977735fa005ea06544c632fbd322d1e021677";
+    sha256 = "sha256-IrmWTmtlfa/Ho1QQoRXSDxRRFJqCc3rcbDMew2WIgZY=";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/domeneshop/default.nix
+++ b/pkgs/development/python-modules/domeneshop/default.nix
@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, urllib3
+, pyopenssl
+, cryptography
+, idna
+, certifi
+}:
+
+buildPythonPackage rec {
+  pname = "domeneshop";
+  version = "0.4.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "tr3wsrscIU66kTz3nlvDHj2EXoEHCH3grD0yD7BU3Fc=";
+  };
+
+  propagatedBuildInputs = [
+    certifi
+    urllib3
+  ] ++ urllib3.optional-dependencies.secure;
+
+  # There are none
+  doCheck = false;
+
+  pythonImportsCheck = [ "domeneshop" ];
+
+  meta = with lib; {
+    description = "Python library for working with the Domeneshop API";
+    homepage = "https://api.domeneshop.no/docs/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
--- a/pkgs/development/python-modules/galois/default.nix
+++ b/pkgs/development/python-modules/galois/default.nix
@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, setuptools-scm
 , pythonOlder
 , fetchFromGitHub
 , pytestCheckHook
@ -11,8 +12,8 @@

 buildPythonPackage rec {
  pname = "galois";
-  version = "0.0.32";
-  format = "setuptools";
+  version = "0.1.1";
+  format = "pyproject";

  disabled = pythonOlder "3.7";

@ -20,9 +21,15 @@ buildPythonPackage rec {
    owner = "mhostetter";
    repo = "galois";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-+cxRLrfqk3N9pWKCVsTxruZwMYZ5dQyKJRnrb8y+ECM=";
+    sha256 = "sha256-ekbebwsdGkINdOFI+LLdwTRBN6d8mlNmftkj5SNRKNI=";
  };

+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
  propagatedBuildInputs = [
    numpy
    numba
@ -35,8 +42,9 @@ buildPythonPackage rec {
  ];

  postPatch = ''
-     substituteInPlace setup.cfg \
-       --replace "numpy >= 1.18.4, < 1.23" "numpy >= 1.18.4"
+     substituteInPlace pyproject.toml \
+       --replace "numpy >= 1.18.4, < 1.24" "numpy >= 1.18.4" \
+       --replace "numba >= 0.53, < 0.57" "numba >= 0.53" \
    '';

  pythonImportsCheck = [ "galois" ];
--- a/pkgs/development/python-modules/geventhttpclient/default.nix
+++ b/pkgs/development/python-modules/geventhttpclient/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "geventhttpclient";
-  version = "2.0";
+  version = "2.0.2";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-SegzLaon80HeCNk4h4KJs7dzaVzblvIpZRjC1uPr7JI=";
+    hash = "sha256-gTWoUgCxcN73KT0B3RVXkx/NG+wax4xSrXzt0iNoubo=";
  };

  propagatedBuildInputs = [
@ -36,6 +36,8 @@ buildPythonPackage rec {
    urllib3
  ];

+  __darwinAllowLocalNetworking = true;
+
  disabledTests = [
    # socket.gaierror: [Errno -3] Temporary failure in name resolution
    "test_client_simple"
--- a/pkgs/development/python-modules/google-cloud-compute/default.nix
+++ b/pkgs/development/python-modules/google-cloud-compute/default.nix
@ -12,12 +12,12 @@

 buildPythonPackage rec {
  pname = "google-cloud-compute";
-  version = "1.4.0";
+  version = "1.5.1";
  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0sgp0xa9cfmgyb1dwdy1f4q9dfr3lgsgm7vbiks9xmiaf0fr221m";
+    sha256 = "sha256-1crkhcf56U6DAx9xVG2e9hCxQ04OjQq2QgLs434cCv0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/gspread/default.nix
+++ b/pkgs/development/python-modules/gspread/default.nix
@ -4,26 +4,38 @@
 , requests
 , google-auth
 , google-auth-oauthlib
+, pythonOlder
 }:

 buildPythonPackage rec {
-  version = "5.4.0";
  pname = "gspread";
+  version = "5.5.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-thcrYvqJnj5BmdLQ6hAItkMFVUugjT06lukSOCT97Eg=";
+    hash = "sha256-hiDph+U0AxXyuNjSbPl+RzaoSzMloXx9m8/3BSXcMAM=";
  };

-  propagatedBuildInputs = [ requests google-auth google-auth-oauthlib ];
+  propagatedBuildInputs = [
+    requests
+    google-auth
+    google-auth-oauthlib
+  ];
+
+  # No tests included
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "gspread"
+  ];

  meta = with lib; {
    description = "Google Spreadsheets client library";
    homepage = "https://github.com/burnash/gspread";
    license = licenses.mit;
+    maintainers = with maintainers; [ ];
  };
-
-  # No tests included
-  doCheck = false;
-
 }
--- a/pkgs/development/python-modules/keyrings-google-artifactregistry-auth/default.nix
+++ b/pkgs/development/python-modules/keyrings-google-artifactregistry-auth/default.nix
@ -11,11 +11,11 @@

 buildPythonPackage rec {
  pname = "keyrings.google-artifactregistry-auth";
-  version = "1.0.0";
+  version = "1.1.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-gvoX5SP0A39Ke0VRlplETJF8gIP+QzK6xNReRxM8UnA=";
+    sha256 = "sha256-vrA3+/awws4R2BAxn9wYDKuIZdqioWsQnDr3MYL/5E0=";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@ -4,11 +4,11 @@

 buildPythonPackage rec {
  pname = "mautrix";
-  version = "0.17.3";
+  version = "0.17.8";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-j49NrZJMDw8m5ZGP4DXxk7uzF+0BxDjs4coEkMDUP+0=";
+    sha256 = "sha256-DFajAD5mnXLQmJGRv4j2mWhtIj77nZNSQhbesX4qMys=";
  };

  propagatedBuildInputs = [
--- a/Show More
+++ b/Show More