Merge remote-tracking branch 'origin/master' into staging-next

2025-04-16 20:28:21 +00:00 · 2023-09-20 15:08:16 -06:00 · 2023-09-20 15:08:16 -06:00 · b2f85dbf28
commit b2f85dbf28
parent 8d8feb905e e8dd05c4c4
130 changed files with 1270 additions and 12658 deletions
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@ -217,6 +217,10 @@ $ prefetch-npm-deps package-lock.json
 sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 ```

+### corepack {#javascript-corepack}
+
+This package puts the corepack wrappers for pnpm and yarn in your PATH, and they will honor the `packageManager` setting in the `package.json`.
+
 ### node2nix {#javascript-node2nix}

 #### Preparation {#javascript-node2nix-preparation}
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3136,6 +3136,11 @@
      fingerprint = "9C56 1D64 30B2 8D6B DCBC 9CEB 73D5 E7FD EE3D E49A";
    }];
  };
+  chrpinedo = {
+    github = "chrpinedo";
+    githubId = 2324630;
+    name = "Christian Pinedo";
+  };
  chuahou = {
    email = "human+github@chuahou.dev";
    github = "chuahou";
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -16,6 +16,15 @@
      into a satisfying solution regarding this problem.
    - Updating with `nixos-rebuild boot` and rebooting is recommended, since in some rare cases the `nixos-rebuild switch` into the new generation on a live system might fail due to missing mount units.

+- [`sudo-rs`], a reimplementation of `sudo` in Rust, is now supported.
+  Switching to it (via `security.sudo.package = pkgs.sudo-rs;`) introduces
+  slight changes in default behaviour, due to `sudo-rs`' current limitations:
+  - terminfo-related environment variables aren't preserved for `root` and `wheel`;
+  - `root` and `wheel` are not given the ability to set (or preserve)
+    arbitrary environment variables.
+
+[`sudo-rs`]: https://github.com/memorysafety/sudo-rs/
+
 ## New Services {#sec-release-23.11-new-services}

 - [MCHPRS](https://github.com/MCHPR/MCHPRS), a multithreaded Minecraft server built for redstone. Available as [services.mchprs](#opt-services.mchprs.enable).
@ -208,6 +217,12 @@

 - Package `pash` was removed due to being archived upstream. Use `powershell` as an alternative.

+- `security.sudo.extraRules` now includes `root`'s default rule, with ordering
+  priority 400. This is functionally identical for users not specifying rule
+  order, or relying on `mkBefore` and `mkAfter`, but may impact users calling
+  `mkOrder n` with n ≤ 400.
+
+
 ## Other Notable Changes {#sec-release-23.11-notable-changes}

 - The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration.
@ -292,6 +307,13 @@ The module update takes care of the new config syntax and the data itself (user

 - New `boot.bcache.enable` (default enabled) allows completely removing `bcache` mount support.

+- `security.sudo` now provides two extra options, that do not change the
+  module's default behaviour:
+  - `defaultOptions` controls the options used for the default rules;
+  - `keepTerminfo` controls whether `TERMINFO` and `TERMINFO_DIRS` are preserved
+    for `root` and the `wheel` group.
+
+
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}

 - The use of `sourceRoot = "source";`, `sourceRoot = "source/subdir";`, and similar lines in package derivations using the default `unpackPhase` is deprecated as it requires `unpackPhase` to always produce a directory named "source". Use `sourceRoot = src.name`, `sourceRoot = "${src.name}/subdir";`, or `setSourceRoot = "sourceRoot=$(echo */subdir)";` or similar instead.
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@ -582,9 +582,7 @@ class Machine:

        # While sh is bash on NixOS, this is not the case for every distro.
        # We explicitly call bash here to allow for the driver to boot other distros as well.
-        out_command = (
-            f"{timeout_str} bash -c {shlex.quote(command)} | (base64 -w 0; echo)\n"
-        )
+        out_command = f"{timeout_str} bash -c {shlex.quote(command)} 2>/dev/null | (base64 -w 0; echo)\n"

        assert self.shell
        self.shell.send(out_command.encode())
--- a/nixos/modules/config/terminfo.nix
+++ b/nixos/modules/config/terminfo.nix
@ -6,12 +6,26 @@ with lib;

 {

-  options.environment.enableAllTerminfo = with lib; mkOption {
-    default = false;
-    type = types.bool;
-    description = lib.mdDoc ''
-      Whether to install all terminfo outputs
-    '';
+  options = with lib; {
+    environment.enableAllTerminfo = mkOption {
+      default = false;
+      type = types.bool;
+      description = lib.mdDoc ''
+        Whether to install all terminfo outputs
+      '';
+    };
+
+    security.sudo.keepTerminfo = mkOption {
+      default = config.security.sudo.package.pname != "sudo-rs";
+      defaultText = literalMD ''
+        `true` unless using `sudo-rs`
+      '';
+      type = types.bool;
+      description = lib.mdDoc ''
+        Whether to preserve the `TERMINFO` and `TERMINFO_DIRS`
+        environment variables, for `root` and the `wheel` group.
+      '';
+    };
  };

  config = {
@ -54,7 +68,7 @@ with lib;
      export TERM=$TERM
    '';

-    security.sudo.extraConfig = ''
+    security.sudo.extraConfig = mkIf config.security.sudo.keepTerminfo ''

      # Keep terminfo database for root and %wheel.
      Defaults:root,%wheel env_keep+=TERMINFO_DIRS
--- a/nixos/modules/security/sudo.nix
+++ b/nixos/modules/security/sudo.nix
@ -4,9 +4,16 @@ with lib;

 let

+  inherit (pkgs) sudo sudo-rs;
+
  cfg = config.security.sudo;

-  inherit (pkgs) sudo;
+  enableSSHAgentAuth =
+    with config.security;
+    pam.enableSSHAgentAuth && pam.sudo.sshAgentAuth;
+
+  usingMillersSudo = cfg.package.pname == sudo.pname;
+  usingSudoRs = cfg.package.pname == sudo-rs.pname;

  toUserString = user: if (isInt user) then "#${toString user}" else "${user}";
  toGroupString = group: if (isInt group) then "%#${toString group}" else "%${group}";
@ -30,41 +37,51 @@ in

  ###### interface

-  options = {
+  options.security.sudo = {

-    security.sudo.enable = mkOption {
-      type = types.bool;
-      default = true;
-      description =
-        lib.mdDoc ''
-          Whether to enable the {command}`sudo` command, which
-          allows non-root users to execute commands as root.
-        '';
+    defaultOptions = mkOption {
+      type = with types; listOf str;
+      default = optional usingMillersSudo "SETENV";
+      defaultText = literalMD ''
+        `[ "SETENV" ]` if using the default `sudo` implementation
+      '';
+      description = mdDoc ''
+        Options used for the default rules, granting `root` and the
+        `wheel` group permission to run any command as any user.
+      '';
    };

-    security.sudo.package = mkOption {
+    enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = mdDoc ''
+        Whether to enable the {command}`sudo` command, which
+        allows non-root users to execute commands as root.
+      '';
+    };
+
+    package = mkOption {
      type = types.package;
      default = pkgs.sudo;
      defaultText = literalExpression "pkgs.sudo";
-      description = lib.mdDoc ''
+      description = mdDoc ''
        Which package to use for `sudo`.
      '';
    };

-    security.sudo.wheelNeedsPassword = mkOption {
+    wheelNeedsPassword = mkOption {
      type = types.bool;
      default = true;
-      description =
-        lib.mdDoc ''
-          Whether users of the `wheel` group must
-          provide a password to run commands as super user via {command}`sudo`.
-        '';
+      description = mdDoc ''
+        Whether users of the `wheel` group must
+        provide a password to run commands as super user via {command}`sudo`.
+      '';
      };

-    security.sudo.execWheelOnly = mkOption {
+    execWheelOnly = mkOption {
      type = types.bool;
      default = false;
-      description = lib.mdDoc ''
+      description = mdDoc ''
        Only allow members of the `wheel` group to execute sudo by
        setting the executable's permissions accordingly.
        This prevents users that are not members of `wheel` from
@ -72,19 +89,18 @@ in
      '';
    };

-    security.sudo.configFile = mkOption {
+    configFile = mkOption {
      type = types.lines;
      # Note: if syntax errors are detected in this file, the NixOS
      # configuration will fail to build.
-      description =
-        lib.mdDoc ''
-          This string contains the contents of the
-          {file}`sudoers` file.
-        '';
+      description = mdDoc ''
+        This string contains the contents of the
+        {file}`sudoers` file.
+      '';
    };

-    security.sudo.extraRules = mkOption {
-      description = lib.mdDoc ''
+    extraRules = mkOption {
+      description = mdDoc ''
        Define specific rules to be in the {file}`sudoers` file.
        More specific rules should come after more general ones in order to
        yield the expected behavior. You can use mkBefore/mkAfter to ensure
@ -114,7 +130,7 @@ in
        options = {
          users = mkOption {
            type = with types; listOf (either str int);
-            description = lib.mdDoc ''
+            description = mdDoc ''
              The usernames / UIDs this rule should apply for.
            '';
            default = [];
@ -122,7 +138,7 @@ in

          groups = mkOption {
            type = with types; listOf (either str int);
-            description = lib.mdDoc ''
+            description = mdDoc ''
              The groups / GIDs this rule should apply for.
            '';
            default = [];
@ -131,7 +147,7 @@ in
          host = mkOption {
            type = types.str;
            default = "ALL";
-            description = lib.mdDoc ''
+            description = mdDoc ''
              For what host this rule should apply.
            '';
          };
@ -139,7 +155,7 @@ in
          runAs = mkOption {
            type = with types; str;
            default = "ALL:ALL";
-            description = lib.mdDoc ''
+            description = mdDoc ''
              Under which user/group the specified command is allowed to run.

              A user can be specified using just the username: `"foo"`.
@ -149,7 +165,7 @@ in
          };

          commands = mkOption {
-            description = lib.mdDoc ''
+            description = mdDoc ''
              The commands for which the rule should apply.
            '';
            type = with types; listOf (either str (submodule {
@ -157,7 +173,7 @@ in
              options = {
                command = mkOption {
                  type = with types; str;
-                  description = lib.mdDoc ''
+                  description = mdDoc ''
                    A command being either just a path to a binary to allow any arguments,
                    the full command with arguments pre-set or with `""` used as the argument,
                    not allowing arguments to the command at all.
@ -166,7 +182,7 @@ in

                options = mkOption {
                  type = with types; listOf (enum [ "NOPASSWD" "PASSWD" "NOEXEC" "EXEC" "SETENV" "NOSETENV" "LOG_INPUT" "NOLOG_INPUT" "LOG_OUTPUT" "NOLOG_OUTPUT" ]);
-                  description = lib.mdDoc ''
+                  description = mdDoc ''
                    Options for running the command. Refer to the [sudo manual](https://www.sudo.ws/man/1.7.10/sudoers.man.html).
                  '';
                  default = [];
@ -179,10 +195,10 @@ in
      });
    };

-    security.sudo.extraConfig = mkOption {
+    extraConfig = mkOption {
      type = types.lines;
      default = "";
-      description = lib.mdDoc ''
+      description = mdDoc ''
        Extra configuration text appended to {file}`sudoers`.
      '';
    };
@ -192,44 +208,52 @@ in
  ###### implementation

  config = mkIf cfg.enable {
-    assertions = [
-      { assertion = cfg.package.pname != "sudo-rs";
-        message = "The NixOS `sudo` module does not work with `sudo-rs` yet."; }
-    ];
+    security.sudo.extraRules =
+      let
+        defaultRule = { users ? [], groups ? [], opts ? [] }: [ {
+          inherit users groups;
+          commands = [ {
+            command = "ALL";
+            options = opts ++ cfg.defaultOptions;
+          } ];
+        } ];
+      in mkMerge [
+        # This is ordered before users' `mkBefore` rules,
+        # so as not to introduce unexpected changes.
+        (mkOrder 400 (defaultRule { users = [ "root" ]; }))

-    # We `mkOrder 600` so that the default rule shows up first, but there is
-    # still enough room for a user to `mkBefore` it.
-    security.sudo.extraRules = mkOrder 600 [
-      { groups = [ "wheel" ];
-        commands = [ { command = "ALL"; options = (if cfg.wheelNeedsPassword then [ "SETENV" ] else [ "NOPASSWD" "SETENV" ]); } ];
-      }
-    ];
+        # This is ordered to show before (most) other rules, but
+        # late-enough for a user to `mkBefore` it.
+        (mkOrder 600 (defaultRule {
+          groups = [ "wheel" ];
+          opts = (optional (!cfg.wheelNeedsPassword) "NOPASSWD");
+        }))
+      ];

-    security.sudo.configFile =
+    security.sudo.configFile = concatStringsSep "\n" (filter (s: s != "") [
      ''
        # Don't edit this file. Set the NixOS options ‘security.sudo.configFile’
        # or ‘security.sudo.extraRules’ instead.
-
+      ''
+      (optionalString enableSSHAgentAuth ''
        # Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.
        Defaults env_keep+=SSH_AUTH_SOCK
-
-        # "root" is allowed to do anything.
-        root        ALL=(ALL:ALL) SETENV: ALL
-
-        # extraRules
-        ${concatStringsSep "\n" (
-          lists.flatten (
-            map (
-              rule: optionals (length rule.commands != 0) [
-                (map (user: "${toUserString user}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.users)
-                (map (group: "${toGroupString group}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.groups)
-              ]
-            ) cfg.extraRules
-          )
-        )}
-
+      '')
+      (concatStringsSep "\n" (
+        lists.flatten (
+          map (
+            rule: optionals (length rule.commands != 0) [
+              (map (user: "${toUserString user}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.users)
+              (map (group: "${toGroupString group}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.groups)
+            ]
+          ) cfg.extraRules
+        )
+      ) + "\n")
+      (optionalString (cfg.extraConfig != "") ''
+        # extraConfig
        ${cfg.extraConfig}
-      '';
+      '')
+    ]);

    security.wrappers = let
      owner = "root";
@ -241,7 +265,8 @@ in
        source = "${cfg.package.out}/bin/sudo";
        inherit owner group setuid permissions;
      };
-      sudoedit = {
+      # sudo-rs does not yet ship a sudoedit (as of v0.2.0)
+      sudoedit = mkIf usingMillersSudo {
        source = "${cfg.package.out}/bin/sudoedit";
        inherit owner group setuid permissions;
      };
@ -250,6 +275,8 @@ in
    environment.systemPackages = [ sudo ];

    security.pam.services.sudo = { sshAgentAuth = true; usshAuth = true; };
+    security.pam.services.sudo-i = mkIf usingSudoRs
+      { sshAgentAuth = true; usshAuth = true; };

    environment.etc.sudoers =
      { source =
@ -258,12 +285,12 @@ in
            src = pkgs.writeText "sudoers-in" cfg.configFile;
            preferLocalBuild = true;
          }
-          # Make sure that the sudoers file is syntactically valid.
-          # (currently disabled - NIXOS-66)
-          "${pkgs.buildPackages.sudo}/sbin/visudo -f $src -c && cp $src $out";
+          "${cfg.package}/bin/visudo -f $src -c && cp $src $out";
        mode = "0440";
      };

  };

+  meta.maintainers = [ lib.maintainers.nicoo ];
+
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -303,6 +303,14 @@ in
        The exporter is configured to run as 'services.mysql.user', but
          'services.mysql.enable' is set to false.
      '';
+    } {
+      assertion = cfg.nextcloud.enable -> (
+        (cfg.nextcloud.passwordFile == null) != (cfg.nextcloud.tokenFile == null)
+      );
+      message = ''
+        Please specify either 'services.prometheus.exporters.nextcloud.passwordFile' or
+          'services.prometheus.exporters.nextcloud.tokenFile'
+      '';
    } {
      assertion = cfg.sql.enable -> (
        (cfg.sql.configFile == null) != (cfg.sql.configuration == null)
--- a/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix
@ -23,10 +23,12 @@ in
      description = lib.mdDoc ''
        Username for connecting to Nextcloud.
        Note that this account needs to have admin privileges in Nextcloud.
+        Unused when using token authentication.
      '';
    };
    passwordFile = mkOption {
-      type = types.path;
+      type = types.nullOr types.path;
+      default = null;
      example = "/path/to/password-file";
      description = lib.mdDoc ''
        File containing the password for connecting to Nextcloud.
@ -34,9 +36,9 @@ in
      '';
    };
    tokenFile = mkOption {
-      type = types.path;
+      type = types.nullOr types.path;
+      default = null;
      example = "/path/to/token-file";
-      default = "";
      description = lib.mdDoc ''
        File containing the token for connecting to Nextcloud.
        Make sure that this file is readable by the exporter user.
@ -58,12 +60,13 @@ in
          --addr ${cfg.listenAddress}:${toString cfg.port} \
          --timeout ${cfg.timeout} \
          --server ${cfg.url} \
-          ${if cfg.tokenFile == "" then ''
+          ${if cfg.passwordFile != null then ''
            --username ${cfg.username} \
            --password ${escapeShellArg "@${cfg.passwordFile}"} \
-         '' else ''
+          '' else ''
            --auth-token ${escapeShellArg "@${cfg.tokenFile}"} \
-         ''} ${concatStringsSep " \\\n  " cfg.extraFlags}'';
+          ''} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}'';
    };
  };
 }
--- a/nixos/modules/services/networking/frp.nix
+++ b/nixos/modules/services/networking/frp.nix
@ -31,8 +31,8 @@ in
        default = { };
        description = mdDoc ''
          Frp configuration, for configuration options
-          see the example of [client](https://github.com/fatedier/frp/blob/dev/conf/frpc_full.ini)
-          or [server](https://github.com/fatedier/frp/blob/dev/conf/frps_full.ini) on github.
+          see the example of [client](https://github.com/fatedier/frp/blob/dev/conf/frpc_legacy_full.ini)
+          or [server](https://github.com/fatedier/frp/blob/dev/conf/frps_legacy_full.ini) on github.
        '';
        example = literalExpression ''
          {
--- a/nixos/modules/services/web-apps/calibre-web.nix
+++ b/nixos/modules/services/web-apps/calibre-web.nix
@ -10,6 +10,8 @@ in
    services.calibre-web = {
      enable = mkEnableOption (lib.mdDoc "Calibre-Web");

+      package = lib.mkPackageOption pkgs "calibre-web" { };
+
      listen = {
        ip = mkOption {
          type = types.str;
@ -73,6 +75,8 @@ in
          '';
        };

+        enableKepubify = mkEnableOption (lib.mdDoc "kebup conversion support");
+
        enableBookUploading = mkOption {
          type = types.bool;
          default = false;
@ -106,7 +110,7 @@ in
    systemd.services.calibre-web = let
      appDb = "/var/lib/${cfg.dataDir}/app.db";
      gdriveDb = "/var/lib/${cfg.dataDir}/gdrive.db";
-      calibreWebCmd = "${pkgs.calibre-web}/bin/calibre-web -p ${appDb} -g ${gdriveDb}";
+      calibreWebCmd = "${cfg.package}/bin/calibre-web -p ${appDb} -g ${gdriveDb}";

      settings = concatStringsSep ", " (
        [
@ -117,6 +121,7 @@ in
        ]
        ++ optional (cfg.options.calibreLibrary != null) "config_calibre_dir = '${cfg.options.calibreLibrary}'"
        ++ optional cfg.options.enableBookConversion "config_converterpath = '${pkgs.calibre}/bin/ebook-convert'"
+        ++ optional cfg.options.enableKepubify "config_kepubifypath = '${pkgs.kepubify}/bin/kepubify'"
      );
    in
      {
--- a/nixos/modules/services/web-apps/plausible.nix
+++ b/nixos/modules/services/web-apps/plausible.nix
@ -248,11 +248,10 @@ in {
            # setup
            ${cfg.package}/createdb.sh
            ${cfg.package}/migrate.sh
+            export IP_GEOLOCATION_DB=${pkgs.dbip-country-lite}/share/dbip/dbip-country-lite.mmdb
            ${cfg.package}/bin/plausible eval "(Plausible.Release.prepare() ; Plausible.Auth.create_user(\"$ADMIN_USER_NAME\", \"$ADMIN_USER_EMAIL\", \"$ADMIN_USER_PWD\"))"
            ${optionalString cfg.adminUser.activate ''
-              if ! ${cfg.package}/init-admin.sh | grep 'already exists'; then
-                psql -d plausible <<< "UPDATE users SET email_verified=true;"
-              fi
+              psql -d plausible <<< "UPDATE users SET email_verified=true where email = '$ADMIN_USER_EMAIL';"
            ''}

            exec plausible start
--- a/nixos/modules/services/web-apps/vikunja.nix
+++ b/nixos/modules/services/web-apps/vikunja.nix
@ -147,5 +147,9 @@ in {
    };

    environment.etc."vikunja/config.yaml".source = configFile;
+
+    environment.systemPackages = [
+      cfg.package-api # for admin `vikunja` CLI
+    ];
  };
 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -673,9 +673,11 @@ in {
  qboot = handleTestOn ["x86_64-linux" "i686-linux"] ./qboot.nix {};
  qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix {};
  qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix;
-  quorum = handleTest ./quorum.nix {};
-  quake3 = handleTest ./quake3.nix {};
+  qgis = handleTest ./qgis.nix { qgisPackage = pkgs.qgis; };
+  qgis-ltr = handleTest ./qgis.nix { qgisPackage = pkgs.qgis-ltr; };
  qownnotes = handleTest ./qownnotes.nix {};
+  quake3 = handleTest ./quake3.nix {};
+  quorum = handleTest ./quorum.nix {};
  rabbitmq = handleTest ./rabbitmq.nix {};
  radarr = handleTest ./radarr.nix {};
  radicale = handleTest ./radicale.nix {};
@ -741,6 +743,7 @@ in {
  strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
  stunnel = handleTest ./stunnel.nix {};
  sudo = handleTest ./sudo.nix {};
+  sudo-rs = handleTest ./sudo-rs.nix {};
  swap-file-btrfs = handleTest ./swap-file-btrfs.nix {};
  swap-partition = handleTest ./swap-partition.nix {};
  swap-random-encryption = handleTest ./swap-random-encryption.nix {};
--- a/nixos/tests/plausible.nix
+++ b/nixos/tests/plausible.nix
@ -30,6 +30,8 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {

    machine.succeed("curl -f localhost:8000 >&2")

+    machine.succeed("curl -f localhost:8000/js/script.js >&2")
+
    csrf_token = machine.succeed(
        "curl -c /tmp/cookies localhost:8000/login | grep '_csrf_token' | sed -E 's,.*value=\"(.*)\".*,\\1,g'"
    )
--- a/nixos/tests/qgis.nix
+++ b/nixos/tests/qgis.nix
@ -0,0 +1,30 @@
+import ./make-test-python.nix ({ pkgs, lib, qgisPackage, ... }:
+  let
+    testScript = pkgs.writeTextFile {
+      name = "qgis-test.py";
+      text = (builtins.readFile ../../pkgs/applications/gis/qgis/test.py);
+    };
+  in
+  {
+    name = "qgis";
+    meta = {
+      maintainers = with lib; [ teams.geospatial.members ];
+    };
+
+    nodes = {
+      machine = { pkgs, ... }: {
+        virtualisation.diskSize = 2 * 1024;
+
+        imports = [ ./common/x11.nix ];
+        environment.systemPackages = [ qgisPackage ];
+
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      machine.succeed("${qgisPackage}/bin/qgis --version | grep 'QGIS ${qgisPackage.version}'")
+      machine.succeed("${qgisPackage}/bin/qgis --code ${testScript}")
+    '';
+  })
--- a/nixos/tests/sudo-rs.nix
+++ b/nixos/tests/sudo-rs.nix
@ -0,0 +1,97 @@
+# Some tests to ensure sudo is working properly.
+{ pkgs, ... }:
+let
+  inherit (pkgs.lib) mkIf optionalString;
+  password = "helloworld";
+in
+  import ./make-test-python.nix ({ lib, pkgs, ...} : {
+    name = "sudo";
+    meta.maintainers = pkgs.sudo-rs.meta.maintainers;
+
+    nodes.machine =
+      { lib, ... }:
+      {
+        environment.systemPackages = [ pkgs.faketty ];
+        users.groups = { foobar = {}; barfoo = {}; baz = { gid = 1337; }; };
+        users.users = {
+          test0 = { isNormalUser = true; extraGroups = [ "wheel" ]; };
+          test1 = { isNormalUser = true; password = password; };
+          test2 = { isNormalUser = true; extraGroups = [ "foobar" ]; password = password; };
+          test3 = { isNormalUser = true; extraGroups = [ "barfoo" ]; };
+          test4 = { isNormalUser = true; extraGroups = [ "baz" ]; };
+          test5 = { isNormalUser = true; };
+        };
+
+        security.sudo = {
+          enable = true;
+          package = pkgs.sudo-rs;
+          wheelNeedsPassword = false;
+
+          extraRules = [
+            # SUDOERS SYNTAX CHECK (Test whether the module produces a valid output;
+            # errors being detected by the visudo checks.
+
+            # These should not create any entries
+            { users = [ "notest1" ]; commands = [ ]; }
+            { commands = [ { command = "ALL"; options = [ ]; } ]; }
+
+            # Test defining commands with the options syntax, though not setting any options
+            { users = [ "notest2" ]; commands = [ { command = "ALL"; options = [ ]; } ]; }
+
+
+            # CONFIGURATION FOR TEST CASES
+            { users = [ "test1" ]; groups = [ "foobar" ]; commands = [ "ALL" ]; }
+            { groups = [ "barfoo" 1337 ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ]; }
+            { users = [ "test5" ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ]; runAs = "test1:barfoo"; }
+          ];
+        };
+      };
+
+    nodes.strict = { ... }: {
+      environment.systemPackages = [ pkgs.faketty ];
+      users.users = {
+        admin = { isNormalUser = true; extraGroups = [ "wheel" ]; };
+        noadmin = { isNormalUser = true; };
+      };
+
+      security.sudo = {
+        package = pkgs.sudo-rs;
+        enable = true;
+        wheelNeedsPassword = false;
+        execWheelOnly = true;
+      };
+    };
+
+    testScript =
+      ''
+        with subtest("users in wheel group should have passwordless sudo"):
+            machine.succeed('faketty -- su - test0 -c "sudo -u root true"')
+
+        with subtest("test1 user should have sudo with password"):
+            machine.succeed('faketty -- su - test1 -c "echo ${password} | sudo -S -u root true"')
+
+        with subtest("test1 user should not be able to use sudo without password"):
+            machine.fail('faketty -- su - test1 -c "sudo -n -u root true"')
+
+        with subtest("users in group 'foobar' should be able to use sudo with password"):
+            machine.succeed('faketty -- su - test2 -c "echo ${password} | sudo -S -u root true"')
+
+        with subtest("users in group 'barfoo' should be able to use sudo without password"):
+            machine.succeed("sudo -u test3 sudo -n -u root true")
+
+        with subtest("users in group 'baz' (GID 1337)"):
+            machine.succeed("sudo -u test4 sudo -n -u root echo true")
+
+        with subtest("test5 user should be able to run commands under test1"):
+            machine.succeed("sudo -u test5 sudo -n -u test1 true")
+
+        with subtest("test5 user should not be able to run commands under root"):
+            machine.fail("sudo -u test5 sudo -n -u root true")
+
+        with subtest("users in wheel should be able to run sudo despite execWheelOnly"):
+            strict.succeed('faketty -- su - admin -c "sudo -u root true"')
+
+        with subtest("non-wheel users should be unable to run sudo thanks to execWheelOnly"):
+            strict.fail('faketty -- su - noadmin -c "sudo --help"')
+      '';
+  })
--- a/pkgs/applications/audio/jamulus/default.nix
+++ b/pkgs/applications/audio/jamulus/default.nix
@ -1,18 +1,33 @@
-{ mkDerivation, lib, fetchFromGitHub, pkg-config, qtscript, qmake, libjack2
+{ mkDerivation
+, lib
+, fetchFromGitHub
+, pkg-config
+, qtscript
+, qmake
+, qtbase
+, qtmultimedia
+, qtdeclarative
+, libjack2
 }:

 mkDerivation rec {
  pname = "jamulus";
-  version = "3.8.2";
+  version = "3.10.0";
  src = fetchFromGitHub {
    owner = "jamulussoftware";
    repo = "jamulus";
    rev = "r${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-K2HznkntDhp+I8DHJk5Cuh5cR8yjwfzX+pGGzS8yVLQ=";
+    hash = "sha256-uqBre1Hcdmmifm/gii3MlP9LiAovQVsAaPZTmVm1nnM=";
  };

  nativeBuildInputs = [ pkg-config qmake ];
-  buildInputs = [ qtscript libjack2 ];
+  buildInputs = [
+    qtscript
+    qtbase
+    qtmultimedia
+    qtdeclarative
+    libjack2
+  ];

  qmakeFlags = [ "CONFIG+=noupcasename" ];

@ -22,6 +37,7 @@ mkDerivation rec {
    homepage = "https://github.com/corrados/jamulus/wiki";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux;
+    mainProgram = "jamulus";
    maintainers = [ lib.maintainers.seb314 ];
  };
 }
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@ -14,15 +14,15 @@
 , jq
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mympd";
-  version = "11.0.5";
+  version = "12.0.1";

  src = fetchFromGitHub {
    owner = "jcorporation";
    repo = "myMPD";
-    rev = "v${version}";
-    sha256 = "sha256-m+EO3+vVqX7/SNvbQrJVjhG53Q20f6cEJ2HNUdWeeiw=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-tkkaBIWoQS28FsCSN5CKw2ZQ3cbYa34PVZCUGaaqaQo=";
  };

  nativeBuildInputs = [
@ -64,4 +64,4 @@ stdenv.mkDerivation rec {
    platforms = lib.platforms.linux;
    license = lib.licenses.gpl2Plus;
  };
-}
+})
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "pt2-clone";
-  version = "1.62.2";
+  version = "1.64";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${version}";
-    sha256 = "sha256-k2rX5ysV3jgCWn0ffe5xSYo9oO6RLakTapE/SnvOPVI=";
+    sha256 = "sha256-b/1YksgXKXi6Tyntd03yWKZAAjvmG4HxsVYLVXoiMaA=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "reaper";
-  version = "6.81";
+  version = "6.82";

  src = fetchurl {
    url = url_for_platform version stdenv.hostPlatform.qemuArch;
    hash = {
-      x86_64-linux = "sha256-Zzt/g96yAztE0NjVa4uaWXBckSvnGxP0K87Hmq82Mi0=";
-      aarch64-linux = "sha256-PNUUm7xNpPRyQaZm9YDXysJ1yo/IzxUz+kqI6/Z6fpo=";
+      x86_64-linux = "sha256-2vtkOodMj0JGLQQn4a+XHxodHQqpnSW1ea7v6aC9sHo=";
+      aarch64-linux = "sha256-FBNfXTnxqq22CnFrE2zvf6kDy/p/+SXOzqz7JS3IdG8=";
    }.${stdenv.hostPlatform.system};
  };

--- a/pkgs/applications/file-managers/lf/default.nix
+++ b/pkgs/applications/file-managers/lf/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "lf";
-  version = "30";
+  version = "31";

  src = fetchFromGitHub {
    owner = "gokcehan";
    repo = "lf";
    rev = "r${version}";
-    hash = "sha256-hlhmnkPm1x7uJMwUM/B02rXLffsXFbkxXYITKD3BERY=";
+    hash = "sha256-Tuk/4R/gGtSY+4M/+OhQCbhXftZGoxZ0SeLIwYjTLA4=";
  };

-  vendorHash = "sha256-DYReTxH4SHnJERbiE6rOp5XqzN3NRbICt5iNeX8Jgt8=";
+  vendorHash = "sha256-PVvHrXfMN6ZSWqd5GJ08VaeKaHrFsz6FKdDoe0tk2BE=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/gis/qgis/default.nix
+++ b/pkgs/applications/gis/qgis/default.nix
@ -1,5 +1,6 @@
 { lib
 , makeWrapper
+, nixosTests
 , symlinkJoin

 , extraPythonPackages ? (ps: [ ])
@ -33,7 +34,10 @@ in symlinkJoin rec {
      --set PYTHONPATH $program_PYTHONPATH
  '';

-  passthru.unwrapped = qgis-unwrapped;
+  passthru = {
+    unwrapped = qgis-unwrapped;
+    tests.qgis = nixosTests.qgis;
+  };

  meta = qgis-unwrapped.meta;
 }
--- a/pkgs/applications/gis/qgis/ltr.nix
+++ b/pkgs/applications/gis/qgis/ltr.nix
@ -1,5 +1,6 @@
 { lib
 , makeWrapper
+, nixosTests
 , symlinkJoin

 , extraPythonPackages ? (ps: [ ])
@ -33,7 +34,10 @@ in symlinkJoin rec {
      --set PYTHONPATH $program_PYTHONPATH
  '';

-  passthru.unwrapped = qgis-ltr-unwrapped;
+  passthru = {
+    unwrapped = qgis-ltr-unwrapped;
+    tests.qgis-ltr = nixosTests.qgis-ltr;
+  };

  inherit (qgis-ltr-unwrapped) meta;
 }
--- a/pkgs/applications/gis/qgis/test.py
+++ b/pkgs/applications/gis/qgis/test.py
@ -0,0 +1,64 @@
+# QGIS test script.
+# This script will create vector memory layer containing Nix snowflake.
+
+# Set QGIS_TEST_INTERACTIVE=True to run this script in interactive mode (and see
+# Nix snowflake).
+
+# Run script as following:
+# QGIS_TEST_INTERACTIVE=True ./result/bin/qgis --code pkgs/applications/gis/qgis/test.py
+
+import os
+
+test_interactive = eval(os.getenv("QGIS_TEST_INTERACTIVE", "False"))
+
+def test(test_interactive=False):
+
+    import osgeo  # just to check if geo python modules are available
+    from qgis.core import QgsVectorLayer, QgsFeature, QgsGeometry, QgsProject
+
+    # Nix snowflake as WKT
+    WKT = """
+     MULTIPOLYGON (
+         ((37.10819200000000251 45.01934500000000128, 41.42360200000000248 45.0228350000000006, 43.98593199999999825 46.39836900000000242, 51.11554000000000286 46.39135900000000134, 52.20562400000000025 46.98079299999999847, 51.13812500000000227 47.55708200000000119, 46.12925599999999804 47.56117799999999818, 48.65136199999999889 48.91279899999999969, 46.46644299999999816 50.06610299999999825, 37.10819200000000251 45.01934500000000128)),
+         ((36.37806400000000195 49.06532800000000094, 34.21064499999999953 50.22733199999999698, 29.10392099999999971 50.23055699999999746, 25.55861099999999908 52.15672200000000203, 23.37426999999999921 52.15597100000000097, 22.30527299999999968 51.57995100000000122, 24.79831000000000074 50.22714599999999763, 19.77820099999999925 50.23147999999999769, 17.66315000000000168 49.06561399999999651, 36.37806400000000195 49.06532800000000094)),
+         ((25.51021400000000128 46.84120599999999968, 23.36222199999999916 45.67570500000000067, 25.90661599999999964 44.29694800000000043, 22.32231799999999922 42.37779100000000199, 23.41657500000000169 41.78910799999999881, 25.55307200000000023 41.78884599999999949, 28.06890399999999985 43.13755299999999693, 30.56690599999999947 41.78159999999999741, 34.86687599999999776 41.79416100000000256, 25.51021400000000128 46.84120599999999968)),
+         ((29.60533099999999962 44.88583400000000267, 31.77274900000000102 43.72382000000000346, 36.87947299999999728 43.7205939999999984, 40.42478299999999791 41.79442999999999842, 42.60912400000000133 41.7951929999999976, 43.67812200000000189 42.37121299999999735, 41.18508400000000336 43.72401599999999888, 46.20519399999999877 43.71968400000000088, 48.32024400000000242 44.885548, 29.60533099999999962 44.88583400000000267)),
+         ((28.88739899999999849 48.92013800000000145, 24.57198899999999853 48.9166450000000026, 22.0096589999999992 47.54111400000000032, 14.88005199999999917 47.54812199999999933, 13.78996700000000075 46.95868999999999716, 14.85746600000000051 46.38240100000000155, 19.86633600000000044 46.37830199999999792, 17.34422899999999856 45.02668100000000351, 19.52914900000000031 43.87337800000000243, 28.88739899999999849 48.92013800000000145)),
+         ((25.52133699999999905 46.84445300000000145, 23.37334500000000048 45.67894900000000291, 25.91773900000000097 44.30019200000000268, 22.33344200000000157 42.38103699999999918, 23.4276990000000005 41.79235400000000311, 25.56419500000000156 41.79209199999999669, 28.08002700000000118 43.14079900000000123, 30.57802999999999827 41.78484600000000171, 34.87800000000000011 41.79740699999999975, 25.52133699999999905 46.84445300000000145)),
+         ((25.52133699999999905 46.84445300000000145, 23.37334500000000048 45.67895099999999786, 25.91773900000000097 44.30019200000000268, 22.33344200000000157 42.38103699999999918, 23.4276990000000005 41.79235400000000311, 25.56419500000000156 41.79209199999999669, 28.08002700000000118 43.14079900000000123, 30.57802999999999827 41.78484600000000171, 34.87800000000000011 41.79740699999999975, 25.52133699999999905 46.84445300000000145)),
+         ((25.51021400000000128 46.84120599999999968, 23.36222199999999916 45.67570500000000067, 25.90661599999999964 44.29694800000000043, 22.32231799999999922 42.37779100000000199, 23.41657500000000169 41.78910799999999881, 25.55307200000000023 41.78884599999999949, 28.06890399999999985 43.13755299999999693, 30.56690599999999947 41.78159999999999741, 34.86687599999999776 41.79416100000000256, 25.51021400000000128 46.84120599999999968)),
+         ((40.49807200000000051 47.09720099999999832, 42.64606299999999806 48.26270199999999733, 40.10166999999999859 49.64145899999999756, 43.685966999999998 51.56061600000000311, 42.59170999999999907 52.14929899999999918, 40.45521399999999801 52.1495609999999985, 37.93938099999999736 50.80085400000000107, 35.44137899999999775 52.15680700000000058, 31.14140899999999945 52.14424700000000001, 40.49807200000000051 47.09720099999999832)),
+     )
+    """
+
+    layer = QgsVectorLayer('Polygon?crs=epsg:3857', 'QGIS-on-Nix', 'memory')
+    provider = layer.dataProvider()
+
+    polygon = QgsFeature()
+    geom = QgsGeometry.fromWkt(WKT)
+    polygon.setGeometry(geom)
+    provider.addFeatures([polygon])
+
+    layer.updateExtents()
+    QgsProject.instance().addMapLayers([layer])
+
+    # Make sure our test layer contains exactly one feature
+    assert layer.featureCount() == 1
+
+    if not test_interactive:
+        QgsProject.instance().removeMapLayer(layer)
+        QgsProject.instance().clear()
+
+try:
+    test(test_interactive=test_interactive)
+
+    if not test_interactive:
+        print("QGIS test script was successfully executed.")
+        os._exit(0)  # iface.actionExit().trigger() doesn't work
+
+except Exception as e:
+    if not test_interactive:
+        print("QGIS test script has failed.")
+        print("Error message: {}".format(e))
+        os._exit(1)
+
--- a/pkgs/applications/graphics/normcap/default.nix
+++ b/pkgs/applications/graphics/normcap/default.nix
@ -0,0 +1,52 @@
+# From NUR https://github.com/nix-community/nur-combined/blob/6bddae47680482383b5769dd3aa7d82b88e6cbc8/repos/renesat/pkgs/normcap/default.nix
+
+{
+  lib,
+  stdenv,
+  python3,
+  fetchFromGitHub,
+  tesseract4,
+  leptonica,
+  wl-clipboard
+}:
+python3.pkgs.buildPythonApplication rec {
+  pname = "normcap";
+  version = "0.4.4";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "dynobo";
+    repo = "normcap";
+    rev = "v${version}";
+    hash = "sha256-dShtmoqS9TC3PHuwq24OEOhYfBHGhDCma8Du8QCkFuI=";
+  };
+
+  buildInputs = [
+    wl-clipboard
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    tesseract4
+    leptonica
+    pyside6
+
+    # Test
+    toml
+    pytest-qt
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace 'PySide6-Essentials = "6.5.1"' ""
+  '';
+
+  meta = with lib; {
+    description = "OCR powered screen-capture tool to capture information instead of images";
+    homepage = "https://dynobo.github.io/normcap/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ cafkafk ];
+  };
+}
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "albert";
-  version = "0.22.0";
+  version = "0.22.4";

  src = fetchFromGitHub {
    owner = "albertlauncher";
    repo = "albert";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-x5H7z0rwunfMwtihXEerc47Sdkl6IvSHfavXzXMLse0=";
+    sha256 = "sha256-M5wMi/yH5c08Y7tpHpOulcz0utnnduGsR5z3EHeBecM=";
    fetchSubmodules = true;
  };

@ -71,6 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/albertlauncher/albert/blob/${finalAttrs.src.rev}/CHANGELOG.md";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ ericsagnes synthetica ];
+    mainProgram = "albert";
    platforms = platforms.linux;
  };
 })
--- a/pkgs/applications/misc/kiwix/lib.nix
+++ b/pkgs/applications/misc/kiwix/lib.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "libkiwix";
-  version = "12.0.0";
+  version = "12.1.1";

  src = fetchFromGitHub {
    owner = "kiwix";
    repo = pname;
    rev = version;
-    sha256 = "sha256-4FxLxJxVhqbeNqX4vorHkROUuRURvE6AXlteIZCEBtc=";
+    sha256 = "sha256-hcwLxfn1fiUAiwsnIddv4HukvVrFePtx7sDQUD1lGUA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/sunwait/default.nix
+++ b/pkgs/applications/misc/sunwait/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "sunwait";
-  version = "2020-10-26";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "risacher";
    repo = "sunwait";
-    rev = "102cb417ecbb7a3757ba9ee4b94d6db3225124c4";
-    sha256 = "0cs8rdcnzsl10zia2k49a6c2z6gvp5rnf31sgn3hn5c7kgy7l3ax";
+    rev = finalAttrs.version;
+    hash = "sha256-v2cNjecJ4SstOsvDe/Lu0oOyBd8I8LMHZIH+f9ZC7Fc=";
  };

  makeFlags = [ "C=${stdenv.cc.targetPrefix}c++" ];
@ -17,11 +17,12 @@ stdenv.mkDerivation {
    install -Dm755 sunwait -t $out/bin
  '';

-  meta = with lib; {
+  meta = {
    description = "Calculates sunrise or sunset times with civil, nautical, astronomical and custom twilights";
    homepage = "https://github.com/risacher/sunwait";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ ];
-    platforms = platforms.all;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ eclairevoyant ];
+    mainProgram = "sunwait";
+    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
+++ b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "argocd-autopilot";
-  version = "0.4.15";
+  version = "0.4.16";

  src = fetchFromGitHub {
    owner = "argoproj-labs";
    repo = "argocd-autopilot";
    rev = "v${version}";
-    sha256 = "sha256-E0Y2GBklUiQBSdrKerFO0B8AAPYnDuxbdRk7uU7cQBI=";
+    sha256 = "sha256-KxEH6FpCaOVOjdNKn7dYbFlT/W4gA8276Zt3sIs3Tg8=";
  };

-  vendorHash = "sha256-5YGe9OnZhjswLMlXohPGzpebocuJFfBd94cc1y88irs=";
+  vendorHash = "sha256-3f5eEge5tGko/B7MtPcifoQOkkVr0jjFX5nF6g1kow4=";

  proxyVendor = true;

--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubeseal";
-  version = "0.23.1";
+  version = "0.24.0";

  src = fetchFromGitHub {
    owner = "bitnami-labs";
    repo = "sealed-secrets";
    rev = "v${version}";
-    sha256 = "sha256-FhkeovWuDQZ7KwyIk6YY/iWfRQxTUT0fcAJcCiTZ9Cg=";
+    sha256 = "sha256-7v0r5xwxlTUASkhVRbUUD+/wjvyurylqaRPmspLY/IM=";
  };

-  vendorHash = "sha256-mtWh5nJrdy7PIk4+S+66Xgqpllg6lAyc73lW/bjV5AE=";
+  vendorHash = "sha256-77KUQlOCIRxuyL/vkxK+F+WEyzDFAYaBNq+JuAmkQvY=";

  subPackages = [ "cmd/kubeseal" ];

--- a/pkgs/applications/networking/cluster/ocm/default.nix
+++ b/pkgs/applications/networking/cluster/ocm/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "ocm";
-  version = "0.1.67";
+  version = "0.1.68";

  src = fetchFromGitHub {
    owner = "openshift-online";
    repo = "ocm-cli";
    rev = "v${version}";
-    sha256 = "sha256-MNagqeT6Uw9fLl6gJ+2FYTRZ2rO2qTYi8SBDoOR9EUM=";
+    sha256 = "sha256-pJ/QWdKLVKFQuaGO9sNf6lhMMgqk9VZS9NLtUz+2+t8=";
  };

-  vendorHash = "sha256-4d8IGe/gTt4HAqyg05pYtAFfHp6NCmUBtfxRA64rEmM=";
+  vendorHash = "sha256-3HLTuWf4mK3r92s2mPE2yl/rrPxgcsB9EmrxkiJsMaE=";

  # Strip the final binary.
  ldflags = [ "-s" "-w" ];
--- a/pkgs/applications/networking/cluster/pachyderm/default.nix
+++ b/pkgs/applications/networking/cluster/pachyderm/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "pachyderm";
-  version = "2.7.0";
+  version = "2.7.2";

  src = fetchFromGitHub {
    owner = "pachyderm";
    repo = "pachyderm";
    rev = "v${version}";
-    hash = "sha256-OA6NY8hI/Aw6vdtDfN1cRXdsLLfxW5ECg5tobPZB66Y=";
+    hash = "sha256-+DqkYzRS1H6PGthljAqsmLAnGtKkX4g0drZiRh8b1v4=";
  };

  vendorHash = "sha256-q8Cx+J5BjMvO5wuvH5Tc5Oa9rjW7vXvS4DhSVv/E3E4=";
--- a/pkgs/applications/networking/instant-messengers/session-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/session-desktop/default.nix
@ -8,12 +8,12 @@
 }:

 let
-  version = "1.11.0";
+  version = "1.11.3";
  pname = "session-desktop";

  src = fetchurl {
    url = "https://github.com/oxen-io/session-desktop/releases/download/v${version}/session-desktop-linux-x86_64-${version}.AppImage";
-    sha256 = "sha256-QartWtp5/OtJqQq5GXRoIQ/ytK9/YCW1ixXTUrnGwqw=";
+    hash = "sha256-HdgW7Ls0h75BXKXGzzf37K9w4bgkfA9eAUEmBrSDT+U=";
  };
  appimage = appimageTools.wrapType2 {
    inherit version pname src;
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@ -25,14 +25,14 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  version = "16.1.35";
+  version = "16.1.39";
  pname = "jmol";

  src = let
    baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
  in fetchurl {
    url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    hash = "sha256-r1ydAwAdXl5RRj64W0j8L7XbgnC7VOYjFNE019BcbpY=";
+    hash = "sha256-8M24VXMi7zHkTPNM5zd8nV4J0mXb3/MNIqqxfmlRt9M=";
  };

  patchPhase = ''
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, python3Packages, libunistring
 , harfbuzz, fontconfig, pkg-config, ncurses, imagemagick
 , libstartup_notification, libGL, libX11, libXrandr, libXinerama, libXcursor
-, libxkbcommon, libXi, libXext, wayland-protocols, wayland
+, libxkbcommon, libXi, libXext, wayland-protocols, wayland, xxHash
 , lcms2
 , librsync
 , openssl
@ -29,20 +29,20 @@
 with python3Packages;
 buildPythonApplication rec {
  pname = "kitty";
-  version = "0.29.2";
+  version = "0.30.0";
  format = "other";

  src = fetchFromGitHub {
    owner = "kovidgoyal";
    repo = "kitty";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ureJHG6Jh4bsXqQZnGwY5Hlq7sXxYX3iTajb8ZkpZw8=";
+    hash = "sha256-M6qFkeUp2rBudO2PiLN2VSrmut68c9mjjUr07WEX9VY=";
  };

  goModules = (buildGoModule {
    pname = "kitty-go-modules";
    inherit src version;
-    vendorHash = "sha256-jk2EcYVuhV/UQfHAIfpnn8ZIZnwjA/o8YRXmpoC85Vc=";
+    vendorHash = "sha256-53Y2S/P2fWT9STZFTdlkESxHNpoAggifZJ0+WXCzbkU=";
  }).goModules;

  buildInputs = [
@ -51,6 +51,7 @@ buildPythonApplication rec {
    lcms2
    librsync
    openssl.dev
+    xxHash
  ] ++ lib.optionals stdenv.isDarwin [
    Cocoa
    Kernel
@ -155,7 +156,8 @@ buildPythonApplication rec {
  preCheck = lib.optionalString stdenv.isDarwin ''
    substituteInPlace kitty_tests/file_transmission.py \
      --replace test_file_get dont_test_file_get \
-      --replace test_path_mapping_receive dont_test_path_mapping_receive
+      --replace test_path_mapping_receive dont_test_path_mapping_receive \
+      --replace test_transfer_send dont_test_transfer_send
    substituteInPlace kitty_tests/shell_integration.py \
      --replace test_fish_integration dont_test_fish_integration
    substituteInPlace kitty_tests/shell_integration.py \
@ -237,6 +239,6 @@ buildPythonApplication rec {
    changelog = "https://sw.kovidgoyal.net/kitty/changelog/";
    platforms = platforms.darwin ++ platforms.linux;
    mainProgram = "kitty";
-    maintainers = with maintainers; [ tex rvolosatovs Luflosi adamcstephens ];
+    maintainers = with maintainers; [ tex rvolosatovs Luflosi adamcstephens kashw2 ];
  };
 }
--- a/pkgs/applications/virtualization/ecs-agent/default.nix
+++ b/pkgs/applications/virtualization/ecs-agent/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "amazon-ecs-agent";
-  version = "1.75.0";
+  version = "1.75.3";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "aws";
    repo = pname;
-    hash = "sha256-pjBAu7QyDZdZbGK2pmvF75C6M3liS0KixupUx+iCEjA=";
+    hash = "sha256-30KDmbT46K5/jE2aSFkX2TZZvWDtzudazTyqFiyLTds=";
  };

  vendorHash = null;
--- a/pkgs/build-support/testers/testMetaPkgConfig/tester.nix
+++ b/pkgs/build-support/testers/testMetaPkgConfig/tester.nix
@ -6,9 +6,7 @@ runCommand "check-meta-pkg-config-modules-for-${package.name}" {
  meta = {
    description = "Test whether ${package.name} exposes all pkg-config modules ${toString package.meta.pkgConfigModules}";
  };
-  dependsOn = map
-    (moduleName: testers.hasPkgConfigModule { inherit package moduleName; })
-    package.meta.pkgConfigModules;
+  dependsOn = testers.hasPkgConfigModules { inherit package; };
 } ''
  echo "found all of ${toString package.meta.pkgConfigModules}" > "$out"
 ''
--- a/pkgs/by-name/na/nawk/package.nix
+++ b/pkgs/by-name/na/nawk/package.nix
@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  meta = {
-    homepage = "https://github.com/onetrueawk/awk";
+    homepage = "https://awk.dev";
    description = "The one, true implementation of AWK";
    longDescription = ''
      This is the version of awk described in "The AWK Programming Language",
--- a/pkgs/by-name/ni/nixos-anywhere/package.nix
+++ b/pkgs/by-name/ni/nixos-anywhere/package.nix
@ -26,13 +26,13 @@ let
    gnused # needed by ssh-copy-id
  ];
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "nixos-anywhere";
  version = "1.0.0";
  src = fetchFromGitHub {
    owner = "numtide";
    repo = "nixos-anywhere";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-zM+N7+XDR34DuTrVLJd7Ggq1JPlURddsqNOjXY/rcQM=";
  };
  nativeBuildInputs = [ makeWrapper ];
@ -48,8 +48,9 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Install nixos everywhere via ssh";
    homepage = "https://github.com/numtide/nixos-anywhere";
+    mainProgram = "nixos-anywhere";
    license = licenses.mit;
    platforms = platforms.all;
    maintainers = [ maintainers.mic92 maintainers.lassulus maintainers.phaer ];
  };
-}
+})
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "26.3.2";
+  version = "27.0.1";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1x0jvkr00k7g1cyvdr2c6bq93zzs9jkjfp553sq729gswvf40kzr";
-  iosevka-aile = "033zsjqkzp1sdvl5acx2blypzfnmf4j2nhk6h05hr4w0xwia9srv";
-  iosevka-curly = "15yyagvl6pxqvizjazn9j0m7s7nv4wyid0wqs91wg7w9nakrhnfs";
-  iosevka-curly-slab = "05m1mjd1kgfpmx7yfkiccd5r765w9xc50sqvxrr599mycd8ddh56";
-  iosevka-etoile = "0z2j66fzvxngqjywmvcgz307c77clz8pasm8dclcwl942l87i395";
-  iosevka-slab = "1s7i4x6v1nf8jx4p7s3mpldjrbkzciak8znnpyzhwkq6ncqvdv6y";
-  iosevka-ss01 = "0liwcnjv64p6c20y0lpppsdnpgfrkdrk0njmcvyd6sqil8lxy2rz";
-  iosevka-ss02 = "0n6w0l6b2wqjqpxl7jcnk40fmjwf06zr6ca6cnhvzaklribs1ika";
-  iosevka-ss03 = "04sv1wljvh0prmdm3svldlyqkvd90zwfy1qbw4518119lvg9h86p";
-  iosevka-ss04 = "1ahqhy14igk48q5abslbb1f5g3py69sb6fdzs1gphh0k8vzbawi6";
-  iosevka-ss05 = "0gx907wziwm6h4vkc2f2d3ja9657i4vfpsia3dhl0amvc5pmvpsc";
-  iosevka-ss06 = "0ybl1lgva3warfxqccip9ygfvwa9pw904qvsa4ar160lc767fc19";
-  iosevka-ss07 = "0ldmdshb9d60db52zrknpm0lxmvvik8rxvy9zy2n2lpv7d9dnfgf";
-  iosevka-ss08 = "0kp0zqbjkj9szxn5l7688pnnbwwvjfxy55spwp4ba3rfcsl6mp5y";
-  iosevka-ss09 = "00k73f7xrfhv6mif70dykv12krg1bnnj4brx8bnd4lcxmg6b34ks";
-  iosevka-ss10 = "0r3h2hpkgh3fncrhlm1g23qkbrpqgjxb7sdmi78wznxn4g9hviwv";
-  iosevka-ss11 = "03q7ny5hk6llid2278k139dwaq1afg0r0fa9gjwhdb960r2rya24";
-  iosevka-ss12 = "0jp5jszwhd4idxqw97n7za88bm7ch9nfxvxk7s9kx4mxznj2bacz";
-  iosevka-ss13 = "1rg7kpqcvf22scdmlbi61h0zw58c46m00ihf2rzvzjfllfzmcqhh";
-  iosevka-ss14 = "09zqsycwjz3g0vj9rqripc9kii67zdj7bkb9j0i5zkbqi2xgab0k";
-  iosevka-ss15 = "0rfhvrxyc24skizhy5fplfvgimvjdd95h1bjjbgrz8sqqld92qal";
-  iosevka-ss16 = "091jnvc9jdzf2hnv1ciczmhrngrlhj3gfsjl7ahbimxagxzf31a5";
-  iosevka-ss17 = "0brcyhg806vs38d8vanq19fffk05lcksairykiapkxhblwv0sy67";
-  iosevka-ss18 = "03h37wi1y85jxjjkk3gjlsphyd2wwsba0lwawi4k8hr0d1l9kglx";
-  sgr-iosevka = "0db82n6w5x0ajs9pr4glpd9b8han32addkfbbb84b3nxx6snn1bc";
-  sgr-iosevka-aile = "097gv8i3dpl41wz4ahd4wz5jfiycm44gpxfnicn5d2zw0p84cjzv";
-  sgr-iosevka-curly = "0lly5hs0jpin33i2h796cr37mdhn3v1x9j5dbcrsdi6wm4ql9kk9";
-  sgr-iosevka-curly-slab = "088jxb727gaf6k4b3cvj9sjhnv4d3yhg96l8iibf930q5c0nflm8";
-  sgr-iosevka-etoile = "11vhpd8j351sgpbg0gxjbgl3ycd1x4xvvv3x9zflxb80l6ch7dym";
-  sgr-iosevka-fixed = "1z0gwcdd1i40swmjxlpf1q4y0123layr3b2yz8pbm8bcpwdyds62";
-  sgr-iosevka-fixed-curly = "194r71zczwf4xjy9x6rjarm2vwaxazirvv04yvi08wcny17ln1d5";
-  sgr-iosevka-fixed-curly-slab = "0j0yqr2icbxdgpwpdbsg6rpi54w3vjxz8xi2cgc8warsydp9p167";
-  sgr-iosevka-fixed-slab = "11s9s1bb982p1p7g5hv2gm8rvhnfls49hrz78gx07nm7ybz4g4i9";
-  sgr-iosevka-fixed-ss01 = "0isa4q30nacz5avw9cr67v8h3p3w0nn9nwlfk1pb35lsm2sxjgqr";
-  sgr-iosevka-fixed-ss02 = "104lqk88w3lv1rchgzh1d9pg2hcgfnwiyvn0p5jii1q7c96dl9xw";
-  sgr-iosevka-fixed-ss03 = "07mkd430yhnnmk3kpmrlagz8kfl0wr44y6bg6w07b1cb5x7bs53q";
-  sgr-iosevka-fixed-ss04 = "1g812caqnzs78cmn1f2297bnnsdyhvswmv3bx9kqg2sx76kkrdym";
-  sgr-iosevka-fixed-ss05 = "0yhmg63vck9108ncg2dnm9vbf6zj5vsjjp0gna1mqn0cn2wvah9i";
-  sgr-iosevka-fixed-ss06 = "0pd73ra3dyc3qawkg7w4w602nqckrbx4sjvbirlmf55krqhkaqgr";
-  sgr-iosevka-fixed-ss07 = "12rxwqks5ka7h0sxsbdmncfx5ln11isa5df7i3cnwxvqdxh2smyf";
-  sgr-iosevka-fixed-ss08 = "1v3h11x5bal8m7glfqqzgv3cx2frgsz7gz2lsnqwsbkn5x9cd66f";
-  sgr-iosevka-fixed-ss09 = "0l03bk1h495r4k275is4i98f4rdhicn6ff14prarl3n68fb68gx0";
-  sgr-iosevka-fixed-ss10 = "0r5bixx333fbv1gddm8hzflki80zwk54lv373x0aw6iji33ybb97";
-  sgr-iosevka-fixed-ss11 = "1v01q658fa4dqxh7wrl8s950cmcqprdnghhrqyas17wrpy3b7jin";
-  sgr-iosevka-fixed-ss12 = "11yhc63rn08znfram3ycz5qfwgh4jjpwn0hagjz78d6i6sandzf1";
-  sgr-iosevka-fixed-ss13 = "1hgli7vkkwxgp03c48y76ldajdiaayd0blgdm49gjd2jhl0hkkbz";
-  sgr-iosevka-fixed-ss14 = "1qgv0zd6kxvbdjznmzzs3vgyk1fgg58pvfd04h9zr22n4h08a7lw";
-  sgr-iosevka-fixed-ss15 = "1a4wcwgh8mnrd0p10ybw5g1v0dyc6pi8vlf561miv7xxxhwsnxn6";
-  sgr-iosevka-fixed-ss16 = "112p61cqiwzfilddwqq0i9b896vb25mbkkl51ac9xabp28izl0m3";
-  sgr-iosevka-fixed-ss17 = "16k69hv04mcnsyb6cnrbd9cgfv8ifkazwnfs5scfijcz9rbs4zm6";
-  sgr-iosevka-fixed-ss18 = "1gm3azw6hsz42fmiiangg8rba4dh6r6a3mqh9nphkd6x0ipmvmkn";
-  sgr-iosevka-slab = "0vn49nms0n3vm76g0lblfhnxkhjkx2kf3xwjqds34c24gzbyhhiz";
-  sgr-iosevka-ss01 = "07nki2ip4kjnli32gw47pdznvyj50a4k72b53x3nxgb1ag3z9gmw";
-  sgr-iosevka-ss02 = "0pq0g8xq9yrrwihq07bylrwj0cvj06xwiqi6njc08lci31xnf5gm";
-  sgr-iosevka-ss03 = "1lbapf246fmdlck4fddy53758nci8g3ph7mhrc3hr1ndx99whrnb";
-  sgr-iosevka-ss04 = "1g32mj1k1al50zcxnbfarb6qvvr5rfq9bmzkq9j2nfr4qjcgwr63";
-  sgr-iosevka-ss05 = "0pynimqhc2bz1sd249cjlpbndy0wp17w59r1s87lhdikqqymb2ck";
-  sgr-iosevka-ss06 = "1nsiwjw2f1w2n5n5iqgscgg25zk821b2ps3mb6h6knnsdgw9snpq";
-  sgr-iosevka-ss07 = "1vm5jmiw6x1b8zlv5ipjqzwx9bwaj9mlcpj9xnayafdx5giwsm81";
-  sgr-iosevka-ss08 = "1fhcn9qn6fq1q6f2xnszy5yzpn88rh1hbax8pb1cdrg304ksjqsx";
-  sgr-iosevka-ss09 = "1837k4r634pr3dkz5mk9sbmpafgnpw0dgj9n4k19396n47llbzc1";
-  sgr-iosevka-ss10 = "0agdxcgysrapg038grv3i753k4l1dqqs56g45aj6b0sp3ygjpkpa";
-  sgr-iosevka-ss11 = "00367dmgva7mhwnnxrjmcag39k0sizr443sv06pscglmgrl7f2y6";
-  sgr-iosevka-ss12 = "0h9m42a6jybwjlv2pq1agdprppcvsgyvyif0l8yv9kji2i2gj2ln";
-  sgr-iosevka-ss13 = "1m2xmmfq7qrff3av6wnw1zs2zh6hsic0in8rx2m01q71j8k7galk";
-  sgr-iosevka-ss14 = "19zk3kqm1870hri7q2cpryy274klk8ddf2vrlqipndxai26k6pxh";
-  sgr-iosevka-ss15 = "0ssbdq3cgidyw5dhgdnfh5vz648d10z6fsp46kkir4xir3j5xj3k";
-  sgr-iosevka-ss16 = "1kr7c4aw9nslizfv9nsxd9rj1kqd0klw375n4vy3r434rdrhgdhp";
-  sgr-iosevka-ss17 = "1k5vzkf5nhfspq22cmm4l1547wpkc521p1lsz1xz1pwgxgxfqgb6";
-  sgr-iosevka-ss18 = "1niykrhiwnzzk6sm95fjrh6dlpzswbqvpcgx4accq4zxlm8llpgf";
-  sgr-iosevka-term = "0sfxz35zcn7xnak57l6nmsicl13y9wh20pqh2cq7gv820vqfhsyj";
-  sgr-iosevka-term-curly = "0p42d65yk8ywfsjkw8vd6jy11qpwf9yczvs23265wlql7xdi5vgj";
-  sgr-iosevka-term-curly-slab = "0blh2r7166bbm981g1vhg4ri2injawb3kzf4d2y8jlnhlvi7hvjp";
-  sgr-iosevka-term-slab = "13b470id7xksp60k6agf9vg64shd0p5079059nvd6h87lr7wya80";
-  sgr-iosevka-term-ss01 = "195f5yrfvwvhb1blk2lrkzwc2vpbbg8y4l0hrmackmxy0ana4kfb";
-  sgr-iosevka-term-ss02 = "1r5qxk98x2zb50rggk216ghbwncdqhjax54r0157d68g8xknrrqd";
-  sgr-iosevka-term-ss03 = "01j6dnn995x4knvvifywb9cmqixrn2c9y9lvq31pdv5v241i9w28";
-  sgr-iosevka-term-ss04 = "01y0hacz8n4wfwqhsiswzy1czy3z1ndb881cvry19d2cg7ch328q";
-  sgr-iosevka-term-ss05 = "1hy8caysjd08aqkgjabs6jdp57fcg835brplfbcjqqfr22k5d5z8";
-  sgr-iosevka-term-ss06 = "12qqr9wk7qxpyxz8cj6zplx54g63gdy9jbsiaj29cagnkjwl1rjj";
-  sgr-iosevka-term-ss07 = "06wg3zyddcpac0gw8r37gdij3ls220f9issxn1mrrczl5wdhv8k0";
-  sgr-iosevka-term-ss08 = "0q5sxz53hqv9d8g6qv7sgcz13cxg76pwln3y72frrw1jjwvfgvdk";
-  sgr-iosevka-term-ss09 = "187mip309cfdwpw5gzjb9jwygvnfhc2bvzi0vybhhz5a70hfdbfv";
-  sgr-iosevka-term-ss10 = "1c258790xqp2bkva7md5cpi9wc6581r5j21n17srhk3dgav77q91";
-  sgr-iosevka-term-ss11 = "0qxbhg1acr6wd8ys0a5ga1pcpfqz3wwvpah9qym7pxdgmqbjq8p8";
-  sgr-iosevka-term-ss12 = "01bayvin0z6nbak2i23539aciw3g1rgqr2av38n1l0l8dpibrwbb";
-  sgr-iosevka-term-ss13 = "1qfw019paggnn6iq72zlpn132xg821awrhbyigkywj169v0nappf";
-  sgr-iosevka-term-ss14 = "0xkwj83lb6hyvz95g0rqcb7apg9njxal9sn5cgkc4abgvnvh3id9";
-  sgr-iosevka-term-ss15 = "0wnqf1bhz4jrm2g7gb3av63d3wnnb9341nlvjgb9yis03akawch3";
-  sgr-iosevka-term-ss16 = "17jwakhnl1sp6v6f8d4p47m1xpklv3r5kyvv97zyw4v7calrkabq";
-  sgr-iosevka-term-ss17 = "15kk0zl9ypz2wyyc80qla51m6bcganrima28w2rcgr1h2amwcdhm";
-  sgr-iosevka-term-ss18 = "1dkfxanxmix3afbqrdbagkpwy9ql37s4iami63l5axcq51g3fzkv";
+  iosevka = "131bxglkns15zan0xzk8k781458ig34jijzp0k27wdpw8dgblykh";
+  iosevka-aile = "0xyxjj3kr0sb8s40kl1lyzmkd18w2m4qnarfbrssxcbafgs6hd3f";
+  iosevka-curly = "0vgmynf2d2b0vxvksgsiss02was60zb7bavrffddh3fklrarkil8";
+  iosevka-curly-slab = "1gg95wccw82v7xdgibajmf312lw1c8bdpk3jl1vvp4xmig06gnfs";
+  iosevka-etoile = "1k928f9mj1fyjwxmn5iddb0p067mji408va96hcm7wy396gmh40j";
+  iosevka-slab = "06kl8y0jpbirdpx7ga09icdsjp9x3hm1552h5sq4wgy8m2prlvja";
+  iosevka-ss01 = "18dywa48mhfzaf3y4vq8509fk9sff1w7ddda6ldglvba15qj56q8";
+  iosevka-ss02 = "0f1iqbvdrdvlk6z0mykm1f095jljni9xkbkc5pnxz5ahv6lxmx6g";
+  iosevka-ss03 = "0bd50by3zlbph859g2fw5ly4lv8ywv4x1qmf1ja5ay02g5b41ail";
+  iosevka-ss04 = "0gxfma9fl6q49i6ymk84a7pz4r4wnik0ixccx478i2pdbbmyvads";
+  iosevka-ss05 = "0ms52v7y5sj579hghj8gc9rl736lpymslpbs3lfkx5p26kxwk3ny";
+  iosevka-ss06 = "0qky2yplvfln3nhclbfzdl6hn0pyjra43by8pwqzx43ai87sz4rl";
+  iosevka-ss07 = "17d0m773plnd3v8sj5j9sb5mb9qnqjnii43r0md8f0iwa3icp406";
+  iosevka-ss08 = "1rx7jv8hhy55gajx4y2741zbrl212qgx7lslgd8y924gxspkfaxq";
+  iosevka-ss09 = "1mz4sc7qn3nmq7l7cm3lh0i1pysqzns8pmqa9a7l6c8llzk8n9xa";
+  iosevka-ss10 = "1z5wa5ja205z3zyw1jdw9l59fzvfw1bifvqn9qxlnbjrkrn5kdsf";
+  iosevka-ss11 = "1lhw4ynk3wxp7bl4w2hg4vydj4y64nhi5cxn8mvamv9j7qqjyfdm";
+  iosevka-ss12 = "1gya74qfzql3y2j820yihy5hhm9hqf7ip7qnv9mhdymwzpc5swb2";
+  iosevka-ss13 = "0rr3nwwwvwh9q6fpkzxlxxw21gp8zsd611kx9m5igb6yx6wmm9z7";
+  iosevka-ss14 = "0p7wha20va30834z2y55s89g00z19587bbv7z6id64lvdwyki3fk";
+  iosevka-ss15 = "1bq707bkp5zyhjwdzadv9aaf8xnnxlzrqircgm56xbdc6j1y3zj2";
+  iosevka-ss16 = "03pb7hr5ncvlsmg48xasycsmcqwwy831xq7f747pzn0pvfbpzbcm";
+  iosevka-ss17 = "1scbnvd6wj9cm6ahxw5qa4cnq6ld118kmlzmd73fqram3l9m3w06";
+  iosevka-ss18 = "0xq9cypwdpg13s7swvhhiazkw8fpsf85c8salbg4wp8j1lq6lcrm";
+  sgr-iosevka = "1ha7n2liqkxlwiaz5r1zxv5ivchiyqrlahwd7w90w1z5sqwzmy3p";
+  sgr-iosevka-aile = "0cp9nj3z9kc3fax1z0zrv3x725pl2m5w7sfz0idpfaiwa0593n10";
+  sgr-iosevka-curly = "1lygvbjrg8lzbrqx7yznpc89r37farkk00dxnwjvc2v8r9796lv5";
+  sgr-iosevka-curly-slab = "0cz3wsldvsqyq3lxm579zimch118pr5cbvgyq6x4437nykk0jm9c";
+  sgr-iosevka-etoile = "0zxnpk0i8qkk8cq49sb2c6lr08j1y3pdj2560qcs7l64q4fzzr1v";
+  sgr-iosevka-fixed = "08ha4khxz8pskj051hjv3rvzlg6ry3gxwlc2q1ajf2j4viyw8245";
+  sgr-iosevka-fixed-curly = "1v4isscbgc6qya41znfnglply9rj7q6rmvn260r4rbj2hx99j5wy";
+  sgr-iosevka-fixed-curly-slab = "0smw0anc9rljarr4c4szvyjbd0ajj7pl001pi69cjpx0xb8zrcsz";
+  sgr-iosevka-fixed-slab = "0iffpdk35dkvczarn4y778k23rdicl0yr613w3z3alx1sajg02q4";
+  sgr-iosevka-fixed-ss01 = "056xmr3688lhpvbn2sqii1p8py6smkpar6jl5bls529cmd8zcfwi";
+  sgr-iosevka-fixed-ss02 = "0qrirgskr8xmcrbi3xvskb29xlq4sxhr67grin5m957nckqi257f";
+  sgr-iosevka-fixed-ss03 = "12hxqax5b02iswpwmfv1kp08gdcxjijsl3a6fwl2gm2ciwvhc4mj";
+  sgr-iosevka-fixed-ss04 = "0xlgxsrirkrwy0rrgiib5ahsqv9kcnfckcb02gkdn4w3bhlkydbr";
+  sgr-iosevka-fixed-ss05 = "1v2a97kw5zpw8q46v59jsmm7y4s4b1ksfk3kjnm92c8vbysmkm1z";
+  sgr-iosevka-fixed-ss06 = "1z3xb2jvgjg58kjipsvjkcc5pfsqs4pd86hvkjfbng2jjl0lvcjl";
+  sgr-iosevka-fixed-ss07 = "1g2fzzylj0g4bz9zrf9mj42h0wrwg27zdq0njgj78wp4fspmllrl";
+  sgr-iosevka-fixed-ss08 = "0qb8x8rxyq13yrv62hw7vx8bvl4nwdzdharxf6c34njsg0nafnw0";
+  sgr-iosevka-fixed-ss09 = "07dhlnh3ismw8ixdnw73xam0jji6kha5h10cqjl3jbqxlghdm873";
+  sgr-iosevka-fixed-ss10 = "0gas1ms88cd5fqajqa89vn87pnqlpy2kry418arwy9c3h5fpdw70";
+  sgr-iosevka-fixed-ss11 = "15zpzv45m5fc7vb2apz6jywc0ip0ykxzb16qdj8qf8j4rq0ajyw0";
+  sgr-iosevka-fixed-ss12 = "00pj11pkhkv72223mv0bhdj0qqv13ywc0gmdkfnmd9cbl0ml1yk8";
+  sgr-iosevka-fixed-ss13 = "1c6qffagjn3qy87gszh0cfm2xz3bnyz8gf4aqbpxyjg55abd1jx0";
+  sgr-iosevka-fixed-ss14 = "1pixg3sjaqc7m1nxcs5alczkk3axhscbgl3x599d5by02z7m1pxq";
+  sgr-iosevka-fixed-ss15 = "0x0k5i3pd4dhbkpb427lmayrvj6bbbr3gp262asckhcsq093wh7c";
+  sgr-iosevka-fixed-ss16 = "0rgv1cl5261bfhx50bkhz8276jbshzf8sz421nmz4qpmxzdalk1p";
+  sgr-iosevka-fixed-ss17 = "1g1w7zirrl9gjky8nbgbh9qjdq03r6sdh9hxcli1wz5qv09zwmh0";
+  sgr-iosevka-fixed-ss18 = "1igfnc9gl5wa06qaw3pisq4ppvd5nwzlh2f34r3xrzmiak9ljwlc";
+  sgr-iosevka-slab = "17mpfvcf4wa2kql8024pdmdf23qm17ch9cr6s1a2pgwf0hn2b3nh";
+  sgr-iosevka-ss01 = "14chhyysy66z01jq9j3d40765sz4d0v3ivzf319clv82q80gkm92";
+  sgr-iosevka-ss02 = "1c8wdcz0f8c9jdc0nyia60m785pblvcd62ag4d329dli8fp0c4kg";
+  sgr-iosevka-ss03 = "1jhl0pcwmvwkify2fdv5ml6l26106xnphxrqn11wsvg4dln3afjl";
+  sgr-iosevka-ss04 = "1wj5nbdnb3n5vfc3y41cwbqqxnhd7p2b55qd05ij85b5a9cgsflj";
+  sgr-iosevka-ss05 = "0zw7ryr7mf7c1njfin66yycg4lalrdvhdd4ycf031qj07v5py5cn";
+  sgr-iosevka-ss06 = "1ka2l4mk0ahn4alnlhyspifg2qnm7cb3ydmndy3q249aidp58bzs";
+  sgr-iosevka-ss07 = "085ghsjwysvzqpksj95x91yz0fyzc5pfj9lhpa8li0x2wjba2jsh";
+  sgr-iosevka-ss08 = "0054z74wk3wbaj3nqnkp7h6fj0zqggnhi21wwfpq52knk8ffc00s";
+  sgr-iosevka-ss09 = "0rbmhq7qix0v4ff8x9j6cgxnjfp80ck2gfww8a7k3nld9z4dn6v8";
+  sgr-iosevka-ss10 = "1ckaiqw677fi195ah496zhhs678bc4xzh31hhwsmvp92y7mfy5na";
+  sgr-iosevka-ss11 = "0zqv2qmvp07j430vbym6552zqky04dx2bnn66r40ndjsz96g8081";
+  sgr-iosevka-ss12 = "10srsjb10qwhm9hgzm56aq58wgy3r9nrcyrvj7jq1q32s5r7jv16";
+  sgr-iosevka-ss13 = "1aaikjri6xkhg6585r6079c41iqhdr94nlismk0zcdygy3ln6vbx";
+  sgr-iosevka-ss14 = "01p421bprrsrddc0f8yxgfg0db8gxs7zgass4p8smainq3zym7v7";
+  sgr-iosevka-ss15 = "0fping8ssj32rsacj7b8a13l0jcmmhznx0phv28x76hkcwagh674";
+  sgr-iosevka-ss16 = "1nzk6hf689v7s81qi1nb7vdg2xvd7v2gv2id9xgdjbfmf3bld10j";
+  sgr-iosevka-ss17 = "01cr9bw4cfyw7i4fim1xdcj5qn2l1dzccnakbqndycmnx4k1134v";
+  sgr-iosevka-ss18 = "10i5qv9ans24mjymq9jh7i3ygdkjvr38y0xc44sn7fb5l72miz1l";
+  sgr-iosevka-term = "02qaa9g0q1d66ha5391xm2vh24hr1vjqw6h6j05a9z2a0y712j71";
+  sgr-iosevka-term-curly = "1xjv9n7dimrsn0dcz9jz6p810bdx7bhcrwnh6m5mvxcf7bpj8341";
+  sgr-iosevka-term-curly-slab = "0sbj3s6ig6410092lsls7mq7h98cipmnabd1fcqxn6dszvhqq6q9";
+  sgr-iosevka-term-slab = "101m8cgjr6s8c42xas2dqyzbl44ab0y1s4cx1rqr8bgr5zxp3jsc";
+  sgr-iosevka-term-ss01 = "0b0i2gs1cv45b5ki8lgiclrly1sg2kh3r82gqbsh4scijv3md9m1";
+  sgr-iosevka-term-ss02 = "0vsldgiscl74jmj55mzqg5zz5pbg6f2fqksfyfyjdps5f584dqq7";
+  sgr-iosevka-term-ss03 = "10czljsmga2nvjix9lca84p271hx2i612984b2hbcz8cip4v2my6";
+  sgr-iosevka-term-ss04 = "06fwjgkqmhngnsljklxz2ab9dpr4sqhn8pxrkhhqka4r5srpn454";
+  sgr-iosevka-term-ss05 = "0lk1k89kjr7ld3bh8pcc8gagjgxv90bwgsgjmn7gqq7nj0kknh4j";
+  sgr-iosevka-term-ss06 = "1apfrkfxq8xbc8hry7x5l8bx87zv13asyw03hirrvzvqrl6q76lw";
+  sgr-iosevka-term-ss07 = "05rvnm17f7qgy4zq3chp12dqvdxwvfv7rld7axccyikqh3b63kn8";
+  sgr-iosevka-term-ss08 = "1y0n2dl6vknvpxhn5d2zsnjj2vgpd9saqs0kmvlbd7lpjsz8d7i0";
+  sgr-iosevka-term-ss09 = "0qkn7syk2wrk14nhwnkbbavsi518pi7qzppiq56y5z1l119dwhrg";
+  sgr-iosevka-term-ss10 = "04b78kk5mggb5xdpigkbkgvcl9q5v41mpx466isqwgxa3p6bp2b4";
+  sgr-iosevka-term-ss11 = "01wsf0qbybnw3bg7iy6yigamg31dhvl6k1gb8jsg4ylllpy7aip3";
+  sgr-iosevka-term-ss12 = "079sbibpsa3xvp8v0pdcacfpck4s01xkczbrbzpnrwiha4b5dqj4";
+  sgr-iosevka-term-ss13 = "1py76ly8wppb0q05mhv91q2x7slidwbbycm86q225yx8hgl0wjdi";
+  sgr-iosevka-term-ss14 = "0sq49yvl03w56dzxpzvfr18bah964g93fg42n31q5bbybmgykd8j";
+  sgr-iosevka-term-ss15 = "0x8kksl8k7zj0hh0fjlqmc5g2jwzdl8ylx6ljzdhfs6y9kdgf04r";
+  sgr-iosevka-term-ss16 = "1kh0m87j4nghgpixh213zs8b626yy5vbmjd4ng17jvvdj98faxzn";
+  sgr-iosevka-term-ss17 = "14rwlw0y8fv7ykyvxhpdhzycmi3j0zx3zrsvph61mnsk33p05vb9";
+  sgr-iosevka-term-ss18 = "19m3f6sgn8ivdhy7nagym6c0nwfd9yyqjdn6q6lxd8hp751jzlf9";
 }
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@ -3,12 +3,12 @@
 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-domain-list-community";
-    version = "20230905081311";
+    version = "20230913074035";
    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "domain-list-community";
      rev = version;
-      hash = "sha256-lSiEfLfXnxou0pt9k6SFRnCm/CeUh2TBhLzi6BwJs7w=";
+      hash = "sha256-A1401KSNkGoVEbiX2MyepesnyF0qVWZ7tuKLtoKUA/k=";
    };
    vendorHash = "sha256-dYaGR5ZBORANKAYuPAi9i+KQn2OAGDGTZxdyVjkcVi8=";
    meta = with lib; {
--- a/pkgs/desktops/mate/libmatemixer/default.nix
+++ b/pkgs/desktops/mate/libmatemixer/default.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "libmatemixer";
-  version = "1.26.0";
+  version = "1.26.1";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1wcz4ppg696m31f5x7rkyvxxdriik2vprsr83b4wbs97bdhcr6ws";
+    sha256 = "SWD1mmufr4KgHUpLjMJgtIaN2ZHv1Kmxe10KFaHToa4=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-user-guide/default.nix
+++ b/pkgs/desktops/mate/mate-user-guide/default.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-user-guide";
-  version = "1.26.1";
+  version = "1.26.2";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "XQTJdLd/L/OQQkQ4mY6F7ErdjiJnJA51WnqODvd/wi8=";
+    sha256 = "TTK241ZKyPTqqysVSC33+XaXUN+IEavtg30KLn7jgIs=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/ldc/default.nix
+++ b/pkgs/development/compilers/ldc/default.nix
@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "1.31.0";
-  sha256 = "sha256-8cjs6eHjWAbDRBvyT75mbN3Y7vN1WSwZzY/uRwHNVFg=";
+  version = "1.34.0";
+  sha256 = "sha256-MAXG6ceSWFOMg5eXZnZ6WePXTzy5CsLLDc5ddXO+txk=";
 }
--- a/pkgs/development/compilers/ldc/generic.nix
+++ b/pkgs/development/compilers/ldc/generic.nix
@ -130,7 +130,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/ldc-developers/ldc";
    # from https://github.com/ldc-developers/ldc/blob/master/LICENSE
    license = with licenses; [ bsd3 boost mit ncsa gpl2Plus ];
-    maintainers = with maintainers; [ ThomasMader lionello ];
+    maintainers = with maintainers; [ ThomasMader lionello jtbx ];
    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
  };
 }
--- a/pkgs/development/interpreters/expr/default.nix
+++ b/pkgs/development/interpreters/expr/default.nix
@ -5,18 +5,18 @@

 buildGoModule rec {
  pname = "expr";
-  version = "1.15.2";
+  version = "1.15.3";

  src = fetchFromGitHub {
    owner = "antonmedv";
    repo = "expr";
    rev = "v${version}";
-    hash = "sha256-cPgVpoixZKFVquT2XehVn+j288HWuWKeGeAaTKfoQs4=";
+    hash = "sha256-r+XlcDvCQarzh8wO3NL87PJThnioeVC73OZdJ8kW4RM=";
  };

  sourceRoot = "${src.name}/repl";

-  vendorHash = "sha256-bmWaSemyihr/zTQ1BE/dzCrCYdOWGzs3W3+kwrV5N0U=";
+  vendorHash = "sha256-WxYqP8L64U5MAYG7XTpKrRW1aaqGB4hJr+e/RKdb1lU=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -96,9 +96,9 @@ in {
      major = "3";
      minor = "12";
      patch = "0";
-      suffix = "rc2";
+      suffix = "rc3";
    };
-    hash = "sha256-EesQN25rr3vqUwAfUYHq7heXeIxNtug6Bh5CI1eSdnQ=";
+    hash = "sha256-ljl+iR6YgCsdOZ3uPOrrm88KolZsinsczk0BlsJ3UGo=";
    inherit (darwin) configd;
    inherit passthruFun;
  };
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@ -94,8 +94,13 @@ stdenv.mkDerivation rec {
    export LD_LIBRARY_PATH=$(pwd)''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
  '';

-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=unknown-warning-option"
-    + lib.optionalString stdenv.isAarch64 "-Wno-error=format-security";
+  env.NIX_CFLAGS_COMPILE = lib.concatStringsSep " " (
+    lib.optionals stdenv.cc.isClang [
+      "-Wno-error=unknown-warning-option"
+    ] ++ lib.optionals stdenv.isAarch64 [
+      "-Wno-error=format-security"
+    ]
+  );

  enableParallelBuilds = true;

--- a/pkgs/development/php-packages/phan/default.nix
+++ b/pkgs/development/php-packages/phan/default.nix
@ -9,11 +9,11 @@ let
 in
 mkDerivation rec {
  pname = "phan";
-  version = "5.4.1";
+  version = "5.4.2";

  src = fetchurl {
    url = "https://github.com/phan/phan/releases/download/${version}/phan.phar";
-    hash = "sha256-DJr1BWAfNI3hYvmBui5Dp+n7ec+f+gkOso21KEd6m8I=";
+    hash = "sha256-9fpmsv2ia5ad+QtaicdZ0XpOZw7T5LWhfd2miYfSpWM=";
  };

  dontUnpack = true;
--- a/pkgs/development/python-modules/aiovodafone/default.nix
+++ b/pkgs/development/python-modules/aiovodafone/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "aiovodafone";
-  version = "0.2.0";
+  version = "0.2.1";
  format = "pyproject";

  disabled = pythonOlder "3.10";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "chemelli74";
    repo = "aiovodafone";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KIYVGPJSOWEWXuYQXmRgtXwL3kI371jvx7vbfTni2jI=";
+    hash = "sha256-fBGVXYHyC7Ek75KgmH9LCCgETGvHnS9WF1QJMbDtfVc=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/azure-data-tables/default.nix
+++ b/pkgs/development/python-modules/azure-data-tables/default.nix
@ -1,33 +1,43 @@
 { lib
+, azure-core
 , buildPythonPackage
 , fetchPypi
-, azure-core
-, msrest
+, isodate
+, pythonOlder
+, typing-extensions
+, yarl
 }:

 buildPythonPackage rec {
  pname = "azure-data-tables";
-  version = "12.4.3";
+  version = "12.4.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    extension = "zip";
-    hash = "sha256-qLA0vNRyIu36xKwB55BD/TCTOv+nmyOtk3+Y4P+SalI=";
+    hash = "sha256-HWjIQBWYmU43pSxKLcwx45EExn10jeEkyY9Hpbyn0vw=";
  };

  propagatedBuildInputs = [
    azure-core
-    msrest
+    isodate
+    typing-extensions
+    yarl
  ];

-  # has no tests
+  # Module has no tests
  doCheck = false;

-  pythonImportsCheck = [ "azure.data.tables" ];
+  pythonImportsCheck = [
+    "azure.data.tables"
+  ];

  meta = with lib; {
    description = "NoSQL data storage service that can be accessed from anywhere";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-data-tables_${version}/sdk/tables/azure-data-tables/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ jonringer ];
  };
--- a/pkgs/development/python-modules/azure-eventgrid/default.nix
+++ b/pkgs/development/python-modules/azure-eventgrid/default.nix
@ -1,34 +1,34 @@
 { lib
-, buildPythonPackage
-, fetchPypi
-, msrest
 , azure-common
 , azure-core
-, msrestazure
+, buildPythonPackage
+, fetchPypi
+, isodate
 , pythonOlder
+, typing-extensions
 }:

 buildPythonPackage rec {
  pname = "azure-eventgrid";
-  version = "4.13.0";
+  version = "4.14.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    extension = "zip";
-    hash = "sha256-Za/cyt/tCvzLTfIgS5Ifjbb9jPtdCojNzzI5WeBiO6I=";
+    hash = "sha256-Nati9XRCNJgt/cmhj2t1l+oijsR6SC1UVZ35VANd0l8=";
  };

  propagatedBuildInputs = [
    azure-common
    azure-core
-    msrest
-    msrestazure
+    isodate
+  ]  ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
  ];

-  # has no tests
+  # Module has no tests
  doCheck = false;

  pythonImportsCheck = [
@ -38,6 +38,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "A fully-managed intelligent event routing service that allows for uniform event consumption using a publish-subscribe model";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-eventgrid_${version}/sdk/eventgrid/azure-eventgrid/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ maxwilson ];
  };
--- a/pkgs/development/python-modules/azure-mgmt-compute/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-compute/default.nix
@ -1,36 +1,38 @@
 { lib
-, buildPythonPackage
-, fetchPypi
 , azure-mgmt-common
 , azure-mgmt-core
+, buildPythonPackage
+, fetchPypi
 , isodate
 , pythonOlder
+, typing-extensions
 }:

 buildPythonPackage rec {
  pname = "azure-mgmt-compute";
-  version = "30.1.0";
+  version = "30.2.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    extension = "zip";
-    hash = "sha256-pWN525DU4kwHi8h0XQ5fdzIp+e8GfNcSwQ+qmIYVp1s=";
+    hash = "sha256-pd1tAbhn1ot2sAM+x8yKGgEpCtlp7vVyCAcAzMZhyYE=";
  };

  propagatedBuildInputs = [
    azure-mgmt-common
    azure-mgmt-core
    isodate
+  ]  ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
  ];

  pythonNamespaces = [
    "azure.mgmt"
  ];

-  # has no tests
+  # Module has no tests
  doCheck = false;

  pythonImportsCheck = [
@ -40,6 +42,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "This is the Microsoft Azure Compute Management Client Library";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-mgmt-compute_${version}/sdk/compute/azure-mgmt-compute/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ olcai maxwilson ];
  };
--- a/pkgs/development/python-modules/azure-mgmt-iothub/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-iothub/default.nix
@ -1,40 +1,44 @@
 { lib
-, buildPythonPackage
-, fetchPypi
-, msrest
-, msrestazure
 , azure-common
 , azure-mgmt-core
-, azure-mgmt-nspkg
+, buildPythonPackage
+, fetchPypi
+, isodate
 , pythonOlder
+, typing-extensions
 }:

 buildPythonPackage rec {
  pname = "azure-mgmt-iothub";
-  version = "2.4.0";
+  version = "3.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    extension = "zip";
-    hash = "sha256-enpNE5kVyGK+ctrGt1gt6633rNvT9FM76kSQ7prb1Wo=";
+    hash = "sha256-2vIfyYxoo1PsYWMYwOYr4EyNaJmWC+jCy/mRZzrItyI=";
  };

  propagatedBuildInputs = [
    azure-common
    azure-mgmt-core
-    msrest
-    msrestazure
+    isodate
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
  ];

-  # has no tests
+  # Module has no tests
  doCheck = false;

+  pythonImportsCheck = [
+    "azure.mgmt.iothub"
+  ];
+
  meta = with lib; {
    description = "This is the Microsoft Azure IoTHub Management Client Library";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-mgmt-iothub_${version}/sdk/iothub/azure-mgmt-iothub/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ maxwilson ];
  };
--- a/pkgs/development/python-modules/azure-mgmt-network/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-network/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-network";
-  version = "25.0.0";
+  version = "25.1.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-rZPbkUQJFIeNSSPWHTK79INWeRX5+GJ7o7mEMLhyJ9E=";
+    hash = "sha256-+Tn3W/E54D0sRXpPB6XrrbWv/dcKpUvpoK9EuOUhMvw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/azure-mgmt-recoveryservices/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-recoveryservices/default.nix
@ -1,32 +1,29 @@
 { lib
-, buildPythonPackage
-, fetchPypi
-, msrest
-, msrestazure
 , azure-common
 , azure-mgmt-core
+, buildPythonPackage
+, fetchPypi
+, isodate
 , pythonOlder
 , typing-extensions
 }:

 buildPythonPackage rec {
  pname = "azure-mgmt-recoveryservices";
-  version = "2.4.0";
+  version = "2.5.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    extension = "zip";
-    hash = "sha256-2JeOvtNxx6Z3AY4GI9fBRKbMcYVHsbrhk8C+5t5eelk=";
+    hash = "sha256-XxowjEhYx5uD/4vY5hGSCSvcarmdbdc5Y2GLHciEurU=";
  };

  propagatedBuildInputs = [
    azure-common
    azure-mgmt-core
-    msrest
-    msrestazure
+    isodate
  ] ++ lib.optionals (pythonOlder "3.8") [
    typing-extensions
  ];
@ -41,6 +38,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "This is the Microsoft Azure Recovery Services Client Library";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-mgmt-recoveryservices_${version}/sdk/recoveryservices/azure-mgmt-recoveryservices/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ maxwilson ];
  };
--- a/pkgs/development/python-modules/azure-mgmt-redis/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-redis/default.nix
@ -1,39 +1,44 @@
 { lib
-, buildPythonPackage
-, fetchPypi
-, msrest
-, msrestazure
 , azure-common
 , azure-mgmt-core
-, azure-mgmt-nspkg
-, isPy3k
+, buildPythonPackage
+, fetchPypi
+, isodate
+, pythonOlder
+, typing-extensions
 }:

 buildPythonPackage rec {
  pname = "azure-mgmt-redis";
-  version = "14.2.0";
+  version = "14.3.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    extension = "zip";
-    hash = "sha256-u6PG1mx3iiiLssoLzOj5kxI2L3uvQMnWrEQY6MBJOtA=";
+    hash = "sha256-eoMbY4oNzYXkn3uFUhxecJQD+BxYkGTbWhAWSgAoLyA=";
  };

  propagatedBuildInputs = [
-    msrest
-    msrestazure
+    isodate
    azure-common
    azure-mgmt-core
-  ] ++ lib.optionals (!isPy3k) [
-    azure-mgmt-nspkg
+   ] ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
  ];

-  # has no tests
+  # Module has no tests
  doCheck = false;

+  pythonImportsCheck = [
+    "azure.mgmt.redis"
+  ];
+
  meta = with lib; {
    description = "This is the Microsoft Azure Redis Cache Management Client Library";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-mgmt-redis_${version}/sdk/redis/azure-mgmt-redis/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ maxwilson ];
  };
--- a/pkgs/development/python-modules/azure-servicebus/default.nix
+++ b/pkgs/development/python-modules/azure-servicebus/default.nix
@ -4,32 +4,29 @@
 , buildPythonPackage
 , fetchPypi
 , isodate
-, msrestazure
+, msrest
 , pythonOlder
-, six
 , typing-extensions
 , uamqp
 }:

 buildPythonPackage rec {
  pname = "azure-servicebus";
-  version = "7.11.1";
+  version = "7.11.2";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    extension = "zip";
-    hash = "sha256-iWbHtpFSiQTcpSQ6S8lrUWAi9kjesh1ZvKPVvNquxYU=";
+    hash = "sha256-0iKPBVxP6tP+vnU37QD8vDHeMsfULO02pxt6hg/RIw8=";
  };

  propagatedBuildInputs = [
    azure-common
    azure-core
    isodate
-    msrestazure
-    six
+    msrest
    typing-extensions
    uamqp
  ];
@ -44,6 +41,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Microsoft Azure Service Bus Client Library";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-servicebus_${version}/sdk/servicebus/azure-servicebus/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ maxwilson ];
  };
--- a/pkgs/development/python-modules/azure-storage-file-share/default.nix
+++ b/pkgs/development/python-modules/azure-storage-file-share/default.nix
@ -1,36 +1,34 @@
 { lib
-, buildPythonPackage
-, fetchPypi
-, pythonOlder
 , azure-core
+, buildPythonPackage
 , cryptography
+, fetchPypi
 , isodate
 , msrest
+, pythonOlder
 , typing-extensions
 }:

 buildPythonPackage rec {
  pname = "azure-storage-file-share";
-  version = "12.13.0";
+  version = "12.14.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    extension = "zip";
-    hash = "sha256-ozqVIWPvAl0doaqK77P+VBhx9q+6Ljk/q7WrAP2ZPm8=";
+    hash = "sha256-f1vV13c/NEUYWZ0Tgha+CwpHZJ5AZWdbhFPrTmf5hGA=";
  };

  propagatedBuildInputs = [
    azure-core
    cryptography
    isodate
-    msrest
    typing-extensions
  ];

-  # requires checkout from monorepo
+  # Tests require checkout from monorepo
  doCheck = false;

  pythonImportsCheck = [
@ -41,6 +39,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Microsoft Azure File Share Storage Client Library for Python";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-storage-file-share_${version}/sdk/storage/azure-storage-file-share/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ kamadorueda ];
  };
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.31.40";
+  version = "1.31.50";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-IAGiU9r0ri4XHmE3uZgqAKf7/HpTRJoWhW3ASefNUhQ=";
+    hash = "sha256-sLqNn6YnyOBse3bFyRzQseUpBCgF2rhsprR2dBYiUds=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/coffea/default.nix
+++ b/pkgs/development/python-modules/coffea/default.nix
@ -31,14 +31,14 @@

 buildPythonPackage rec {
  pname = "coffea";
-  version = "2023.6.0.rc1";
-  format = "pyproject";
+  version = "2023.7.0.rc0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "CoffeaTeam";
-    repo = pname;
+    repo = "coffea";
    rev = "refs/tags/v${version}";
-    hash = "sha256-TEtQ2KnwcylQbprlRtgHv7HIFg7roDWD4TihrQE4icU=";
+    hash = "sha256-WIJw5NLVN6TrG/0mySqtlqvoNVinmpcWZchSqiNjQ9Q=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/curlify/default.nix
+++ b/pkgs/development/python-modules/curlify/default.nix
@ -0,0 +1,25 @@
+{ lib, buildPythonPackage, fetchFromGitHub, requests }:
+
+buildPythonPackage {
+  pname = "curlify";
+  version = "2.2.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "ofw";
+    repo = "curlify";
+    rev = "b914625b12f9b05c39f305b47ebd0d1f061af24d";
+    hash = "sha256-yDHmH35TtQDJB0na1V98RtBuVHX5TmKC72hzzs1DQK8=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  meta = with lib; {
+    description = "Convert python requests request object to cURL command";
+    homepage = "https://github.com/ofw/curlify";
+    license = licenses.mit;
+    maintainers = with maintainers; [ chrpinedo ];
+  };
+}
--- a/pkgs/development/python-modules/django-reversion/default.nix
+++ b/pkgs/development/python-modules/django-reversion/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "django-reversion";
-  version = "5.0.4";
+  version = "5.0.5";
  format = "setuptools";

  disabled = pythonOlder "3.7";

 src = fetchPypi {
    inherit pname version;
-    hash = "sha256-wSurRS0x3TwkRFbPHfODrPFLoUfPmUBMXkRBJZbeQvw=";
+    hash = "sha256-JTxpGwpOC+He7Atiw4yfu3W25aj9gdO1iib0YTWXAQY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/dvc/default.nix
+++ b/pkgs/development/python-modules/dvc/default.nix
@ -55,14 +55,14 @@

 buildPythonPackage rec {
  pname = "dvc";
-  version = "3.21.1";
+  version = "3.22.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-FCVxSkVWWtk6dTOtO+l28bDvXnxjX8wwy1uE/5Go4Mw=";
+    hash = "sha256-8L8ilGOPSfc6mW4JmmLM7VimwlFBQ6h5WIxaRnvWcm0=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/edk2-pytool-library/default.nix
+++ b/pkgs/development/python-modules/edk2-pytool-library/default.nix
@ -7,22 +7,21 @@
 , pyasn1
 , pyasn1-modules
 , cryptography
-, tinydb
 , joblib
-, tinyrecord
+, gitpython
 , pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "edk2-pytool-library";
-  version = "0.17.0";
+  version = "0.18.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "tianocore";
    repo = "edk2-pytool-library";
    rev = "v${version}";
-    hash = "sha256-US9m7weW11+VxX6ZsKP5tYKp+bQoiI+TZ3YWE97D/f0=";
+    hash = "sha256-O7K439nAIHHTWSoR8mZWEu9sXcrhYfZto3RTgHZcOuA=";
  };

  nativeBuildInputs = [
@ -40,15 +39,19 @@ buildPythonPackage rec {
    pyasn1
    pyasn1-modules
    cryptography
-    tinydb
    joblib
-    tinyrecord
+    gitpython
  ];

  nativeCheckInputs = [
    pytestCheckHook
  ];

+  disabledTests = [
+    # requires network access
+    "test_basic_parse"
+  ];
+
  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;

  pythonImportsCheck = [ "edk2toollib" ];
--- a/pkgs/development/python-modules/garminconnect/default.nix
+++ b/pkgs/development/python-modules/garminconnect/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "garminconnect";
-  version = "0.2.4";
+  version = "0.2.6";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "cyberjunky";
    repo = "python-garminconnect";
    rev = "refs/tags/${version}";
-    hash = "sha256-C+LldV7TyyubaH8HVdFl7NnaPSLf4bzM03+r72vkOk8=";
+    hash = "sha256-e/6fq9PkrfX2dz+QfgyKft6difkXfoj40WWiyK6h0n4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/garth/default.nix
+++ b/pkgs/development/python-modules/garth/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "garth";
-  version = "0.4.25";
+  version = "0.4.26";
  format = "pyproject";

  disabled = pythonOlder "3.9";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-n+vy9MCSBvxFOcD/jk2oPSa/bzf550mk+dZYSVa0rm0=";
+    hash = "sha256-Ezq9lZE6HTtuW396sKZ32mDvNjrkz6UHQGvLhXUjfnI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
+++ b/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "google-ai-generativelanguage";
-  version = "0.3.1";
+  version = "0.3.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-DbtXyNBCew90y4RfJgHiolD9SIjZfX18wvo76xGA66k=";
+    hash = "sha256-PkQpWHUzvTnv7Ky+cRSHzaXTwh2rDvD0qq53tbxPBME=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-bigquery-logging";
-  version = "1.2.2";
+  version = "1.3.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-e6ZCsdEstzxMjaJdubslQ4Lchr3FmBCdtTZ0xVsCl14=";
+    hash = "sha256-7hj42cr9BKwSBEX09kZPngAUPFPrQ/VS5hBzbAaQhH4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-iam-logging";
-  version = "1.2.1";
+  version = "1.2.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-R35MCPWM5wiJzlFHJuHOD5P6IthPtDjGtw5OhFlfhNc=";
+    hash = "sha256-6IBjA2WwP11d/vQJSIY3WhbqYvAgFRtZFFSffUqKM38=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
+++ b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-securitycenter";
-  version = "1.23.2";
+  version = "1.23.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-3QdHomKKN8bSUtyFCZJliw/FxNixVj9pdkzMwJWT880=";
+    hash = "sha256-8yBC/+jxKsyQ5pz+VBSgnwqB/XxXCChpjGLAjMDoQow=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/hyperpyyaml/default.nix
+++ b/pkgs/development/python-modules/hyperpyyaml/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pyyaml
 , ruamel-yaml
 , pytestCheckHook
@ -18,6 +19,15 @@ buildPythonPackage rec {
    hash = "sha256-tC4kLJAY9MVgjWwU2Qu0rPCVDw7CjKVIciRZgYhnR9I=";
  };

+  patches = [
+    # This patch is needed to comply with the newer versions of ruamel.yaml.
+    # PR to upstream this change: https://github.com/speechbrain/HyperPyYAML/pull/23
+    (fetchpatch {
+      url = "https://github.com/speechbrain/HyperPyYAML/commit/95c6133686c42764770a77429eab55f6dfe5581c.patch";
+      hash = "sha256-WrHDo17f5pYNXSSqI8t1tlAloYms9oLFup7D2qCKwWw=";
+    })
+  ];
+
  propagatedBuildInputs = [
    pyyaml
    ruamel-yaml
@ -35,7 +45,5 @@ buildPythonPackage rec {
    changelog = "https://github.com/speechbrain/HyperPyYAML/releases/tag/v${version}";
    license = licenses.asl20;
    maintainers = with maintainers; [ GaetanLepage ];
-    # hyperpyyaml is not compatible with the too new version of `ruaml-yaml`
-    broken = true;
  };
 }
--- a/pkgs/development/python-modules/intake/default.nix
+++ b/pkgs/development/python-modules/intake/default.nix
@ -11,7 +11,6 @@
 , jinja2
 , msgpack
 , msgpack-numpy
-, numpy
 , pandas
 , panel
 , pyarrow
@ -26,16 +25,16 @@

 buildPythonPackage rec {
  pname = "intake";
-  version = "unstable-2023-08-24";
+  version = "0.7.0";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "81b1567a2030adfb22b856b4f63cefe35de68983";
-    hash = "sha256-PygLrZz8ssHUrzGt2A7HxidvA2IVY94edVLjSp4jLI4=";
+    owner = "intake";
+    repo = "intake";
+    rev = "refs/tags/${version}";
+    hash = "sha256-LK4abwPViEFJZ10bbRofF2aw2Mj0dliKwX6dFy93RVQ=";
  };

  propagatedBuildInputs = [
@ -89,12 +88,14 @@ buildPythonPackage rec {
  disabledTests = [
    # Disable tests which touch network
    "http"
+    "test_address_flag"
    "test_dir"
    "test_discover"
    "test_filtered_compressed_cache"
    "test_flatten_flag"
    "test_get_dir"
    "test_pagination"
+    "test_port_flag"
    "test_read_part_compressed"
    "test_read_partition"
    "test_read_pattern"
--- a/pkgs/development/python-modules/ml-dtypes/default.nix
+++ b/pkgs/development/python-modules/ml-dtypes/default.nix
@ -11,16 +11,16 @@

 buildPythonPackage rec {
  pname = "ml-dtypes";
-  version = "0.2.0";
+  version = "0.3.0";
  format = "pyproject";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "jax-ml";
    repo = "ml_dtypes";
    rev = "refs/tags/v${version}";
-    hash = "sha256-eqajWUwylIYsS8gzEaCZLLr+1+34LXWhfKBjuwsEhhI=";
+    hash = "sha256-crBTPQeRjgykkIpWx95ypyDeA/RRjWIasg9MR2r2yIU=";
    # Since this upstream patch (https://github.com/jax-ml/ml_dtypes/commit/1bfd097e794413b0d465fa34f2eff0f3828ff521),
    # the attempts to use the nixpkgs packaged eigen dependency have failed.
    # Hence, we rely on the bundled eigen library.
@ -31,8 +31,9 @@ buildPythonPackage rec {
    substituteInPlace pyproject.toml \
      --replace "numpy~=1.21.2" "numpy" \
      --replace "numpy~=1.23.3" "numpy" \
-      --replace "pybind11~=2.10.0" "pybind11" \
-      --replace "setuptools~=67.6.0" "setuptools"
+      --replace "numpy~=1.26.0" "numpy" \
+      --replace "pybind11~=2.11.1" "pybind11" \
+      --replace "setuptools~=68.1.0" "setuptools"
  '';

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/plaid-python/default.nix
+++ b/pkgs/development/python-modules/plaid-python/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "plaid-python";
-  version = "15.5.0";
+  version = "16.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-zI3fOd1IcnXS5moM3mHl/1qzrAHnxoVrFg1GBCqiA10=";
+    hash = "sha256-FoZTfTPKidY0VPHYui25ArFm/MBIC7Ynwo9TyMT7st4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "0.10.0.20230828";
+  version = "0.10.0.20230920";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-eVPcj1gMY9a8Znhon2lEs9EKWgc55euyvzxnrkDH05o=";
+    hash = "sha256-4Sp8uyJAJ+Sg0wv6TjNkMOCKlL/c/2ToWP1byG2BZtE=";
  };

  passthru.optional-dependencies = {
--- a/pkgs/development/python-modules/pyngrok/default.nix
+++ b/pkgs/development/python-modules/pyngrok/default.nix
@ -1,16 +1,20 @@
 { lib
 , buildPythonPackage
+, pythonOlder
 , fetchPypi
 , pyyaml
 }:

 buildPythonPackage rec {
  pname = "pyngrok";
-  version = "6.0.0";
+  version = "6.1.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-3YqHlEuOKFcuPRJr+yyBopSFlFdfUjfu/TZRrgtIcVU=";
+    hash = "sha256-9fT2fnntBQ7y+c52tuqHM7iVAqoLgwAs6izmuZRUNiI=";
  };

  propagatedBuildInputs = [
@ -20,8 +24,9 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "pyngrok" ];

  meta = with lib; {
-    homepage = "https://github.com/alexdlaird/pyngrok";
    description = "A Python wrapper for ngrok";
+    homepage = "https://github.com/alexdlaird/pyngrok";
+    changelog = "https://github.com/alexdlaird/pyngrok/blob/${version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ wegank ];
  };
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "pyoverkiz";
-  version = "1.10.1";
+  version = "1.11.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "iMicknl";
    repo = "python-overkiz-api";
    rev = "refs/tags/v${version}";
-    hash = "sha256-tb0xU1H1VrWTuObCg1+mFkzawAzrknO3fER7cN2St7U=";
+    hash = "sha256-ZwDqctkbF3PUu4F9s7amdBoOYQ15jJk64HK4I7rJX/A=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pyschlage/default.nix
+++ b/pkgs/development/python-modules/pyschlage/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pyschlage";
-  version = "2023.9.0";
+  version = "2023.9.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "dknowles2";
    repo = "pyschlage";
    rev = "refs/tags/${version}";
-    hash = "sha256-4uYUEx6OcUMG8nS/PqZK5hHFQd/7pTGIix2it8pleuY=";
+    hash = "sha256-HFgQXMUmjWW5syBwtCunQ/TeulPwtF48Nesy9iZ3hlU=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/python-rtmidi/default.nix
+++ b/pkgs/development/python-modules/python-rtmidi/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "python-rtmidi";
-  version = "1.5.5";
+  version = "1.5.6";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -29,7 +29,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "python_rtmidi";
    inherit version;
-    hash = "sha256-Pz6bD6SX6BPMC91zsorgeXfJGAPk1VULx8ejShUBy94=";
+    hash = "sha256-sqCjmbtKXhpWR3eYr9QdAioYtelU9tD/krRbuZvuNxA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyvista/default.nix
+++ b/pkgs/development/python-modules/pyvista/default.nix
@ -6,20 +6,23 @@
 , numpy
 , pillow
 , pooch
+, pythonOlder
 , scooby
 , vtk
 }:

 buildPythonPackage rec {
  pname = "pyvista";
-  version = "0.42.1";
+  version = "0.42.2";
  format = "setuptools";

+  disabled = pythonOlder "3.8";
+
  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Bk2bw6WCLzMb3nLMCS9rRugNocA9eYju/aoE68TYu5c=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-i+09vjp6m9CSEbWcvj2TCnOb408xw5Gli1en6FTYZH4=";
  };

  propagatedBuildInputs = [
@ -40,8 +43,9 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
-    homepage = "https://pyvista.org";
    description = "Easier Pythonic interface to VTK";
+    homepage = "https://pyvista.org";
+    changelog = "https://github.com/pyvista/pyvista/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ wegank ];
  };
--- a/pkgs/development/python-modules/svgelements/default.nix
+++ b/pkgs/development/python-modules/svgelements/default.nix
@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, wheel
+, anyio
+, numpy
+, pillow
+, pytest-forked
+, pytest-xdist
+, pytestCheckHook
+, scipy
+}:
+
+buildPythonPackage rec {
+  pname = "svgelements";
+  version = "1.9.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "meerk40t";
+    repo = "svgelements";
+    rev = "refs/tags/${version}";
+    hash = "sha256-nx2sGXeeh8S17TfRDFifQbdSxc4YGsDNnrPSSbxv7S4=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  pythonImportsCheck = [ "svgelements" ];
+
+  nativeCheckInputs =  [
+    anyio
+    numpy
+    pillow
+    pytest-forked
+    pytest-xdist
+    pytestCheckHook
+    scipy
+  ];
+
+  meta = with lib; {
+    description = "SVG Parsing for Elements, Paths, and other SVG Objects";
+    homepage = "https://github.com/meerk40t/svgelements";
+    license = licenses.mit;
+    maintainers = with maintainers; [ GaetanLepage ];
+  };
+}
--- a/pkgs/development/python-modules/tempita/default.nix
+++ b/pkgs/development/python-modules/tempita/default.nix
@ -5,7 +5,7 @@ buildPythonPackage {
  pname = "tempita";

  src = fetchFromGitHub {
-    owner = "gjhiggins";
+    owner = "agramfort";
    repo = "tempita";
    rev = "47414a7c6e46a9a9afe78f0bce2ea299fa84d10";
    sha256 = "0f33jjjs5rvp7ar2j6ggyfykcrsrn04jaqcq71qfvycf6b7nw3rn";
@ -14,7 +14,7 @@ buildPythonPackage {
  buildInputs = [ nose ];

  meta = {
-    homepage = "https://github.com/gjhiggins/tempita";
+    homepage = "https://github.com/agramfort/tempita";
    description = "A very small text templating language";
    license = lib.licenses.mit;
  };
--- a/pkgs/development/python-modules/tplink-omada-client/default.nix
+++ b/pkgs/development/python-modules/tplink-omada-client/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "tplink-omada-client";
-  version = "1.3.3";
+  version = "1.3.4";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "tplink_omada_client";
    inherit version;
-    hash = "sha256-Jo0p/28Hzokeq0SAdyWfkKzoscVkQj9kP3VnRlWjR8o=";
+    hash = "sha256-ckb5pKAT4HfozKtgu7MpNGUdJuOLzkUjTfA/6h6imO4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/type-infer/default.nix
+++ b/pkgs/development/python-modules/type-infer/default.nix
@ -0,0 +1,71 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, poetry-core
+, colorlog
+, dataclasses-json
+, langid
+, nltk
+, numpy
+, pandas
+, psutil
+, python-dateutil
+, scipy
+, toml
+, nltk-data
+, symlinkJoin
+}:
+let
+  testNltkData = symlinkJoin {
+    name = "nltk-test-data";
+    paths = [ nltk-data.punkt nltk-data.stopwords ];
+  };
+in
+buildPythonPackage rec {
+  pname = "type-infer";
+  version = "0.0.15";
+  format = "pyproject";
+
+  disable = pythonOlder "3.8";
+
+  # using PyPI because the repo does not have tags or release branches
+  src = fetchPypi {
+    pname = "type_infer";
+    inherit version;
+    hash = "sha256-AnThYE6hHc3Pwu8fl0VBiQJfGVjeEKo4RrCsOl2pfCA=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    colorlog
+    dataclasses-json
+    langid
+    nltk
+    numpy
+    pandas
+    psutil
+    python-dateutil
+    scipy
+    toml
+  ];
+
+  # PyPI package does not include tests
+  doCheck = false;
+
+  # Package import requires NLTK data to be downloaded
+  # It is the only way to set NLTK_DATA environment variable,
+  # so that it is available in pythonImportsCheck
+  env.NLTK_DATA = testNltkData;
+  pythonImportsCheck = [ "type_infer" ];
+
+  meta = with lib; {
+    description = "Automated type inference for Machine Learning pipelines";
+    homepage = "https://pypi.org/project/type-infer/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ mbalatsko ];
+  };
+}
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@ -1,19 +1,20 @@
-{ docbook_xml_dtd_45
-, docbook_xsl
+{ lib
+, stdenv
 , fetchFromGitHub
+
+, docbook_xml_dtd_45
+, docbook_xsl
 , installShellFiles
-, lib
 , libxslt
 , pcre
 , pkg-config
 , python3
-, stdenv
 , which
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "cppcheck";
-  version = "2.12.0";
+  version = "2.12.1";

  outputs = [ "out" "man" ];

@ -21,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "danmar";
    repo = "cppcheck";
    rev = finalAttrs.version;
-    hash = "sha256-Rfm63ERmTsmmH8W6aiBMx+NiQjzGuoWHqHRRqWishhw=";
+    hash = "sha256-I1z4OZaWUD1sqPf7Z0ISoRl5mrGTFq0l5u2ct29fOmQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/analysis/rizin/cutter.nix
+++ b/pkgs/development/tools/analysis/rizin/cutter.nix
@ -14,13 +14,13 @@

 let cutter = mkDerivation rec {
  pname = "cutter";
-  version = "2.3.1";
+  version = "2.3.2";

  src = fetchFromGitHub {
    owner = "rizinorg";
    repo = "cutter";
    rev = "v${version}";
-    hash = "sha256-OxF6lKH4nnBU8pLzaCGVl8DUIxsbWD4RMevyGRirkPM=";
+    hash = "sha256-88yIqFYIv7o6aC2YSJwWJ46fZJBnOmifv+SirsfS4tw=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/tools/analysis/rizin/default.nix
+++ b/pkgs/development/tools/analysis/rizin/default.nix
@ -25,11 +25,11 @@

 let rizin = stdenv.mkDerivation rec {
  pname = "rizin";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchurl {
    url = "https://github.com/rizinorg/rizin/releases/download/v${version}/rizin-src-v${version}.tar.xz";
-    hash = "sha256-dgZHyvinimOKDgQL97icPtBk+r3+rE/kT/FdYrqsbJE=";
+    hash = "sha256-4poAo+IgBL3RAUbShrHM4OBhltQarkcpqvydeDIf+Gs=";
  };

  mesonFlags = [
--- a/pkgs/development/tools/build-managers/apache-maven/build-package.nix
+++ b/pkgs/development/tools/build-managers/apache-maven/build-package.nix
@ -5,11 +5,14 @@

 { src
 , sourceRoot ? null
+, buildOffline ? false
 , patches ? [ ]
 , pname
 , version
 , mvnHash ? ""
 , mvnFetchExtraArgs ? { }
+, mvnDepsParameters ? ""
+, manualMvnArtifacts ? [ ]
 , mvnParameters ? ""
 , ...
 } @args:
@ -28,9 +31,17 @@ let

    buildPhase = ''
      runHook preBuild
+    '' + lib.optionalString buildOffline ''
+      mvn dependency:go-offline -Dmaven.repo.local=$out/.m2 ${mvnDepsParameters}

+      for artifactId in ${builtins.toString manualMvnArtifacts}
+      do
+        echo "downloading manual $artifactId"
+        mvn dependency:get -Dartifact="$artifactId" -Dmaven.repo.local=$out/.m2
+      done
+    '' + lib.optionalString (!buildOffline) ''
      mvn package -Dmaven.repo.local=$out/.m2 ${mvnParameters}
-
+    '' + ''
      runHook postBuild
    '';

@ -65,7 +76,7 @@ stdenv.mkDerivation (builtins.removeAttrs args [ "mvnFetchExtraArgs" ] // {
    runHook preBuild

    mvnDeps=$(cp -dpR ${fetchedMavenDeps}/.m2 ./ && chmod +w -R .m2 && pwd)
-    mvn package --offline "-Dmaven.repo.local=$mvnDeps/.m2" ${mvnParameters}
+    mvn package -o -nsu "-Dmaven.repo.local=$mvnDeps/.m2" ${mvnParameters}

    runHook postBuild
  '';
--- a/pkgs/development/tools/build-managers/moon/default.nix
+++ b/pkgs/development/tools/build-managers/moon/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "moon";
-  version = "1.13.3";
+  version = "1.13.4";

  src = fetchFromGitHub {
    owner = "moonrepo";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-br3MRV2QTDHkRUdmv9s09aiPNfQtpwGBpS4Uk5tNbg8=";
+    hash = "sha256-K7uCgdTg/RTd3X8ve7xTsxDn3H9p6WS93ijCRnJPsJs=";
  };

-  cargoHash = "sha256-2YsAVgBL3QUKCa5BN9KOWgBwITigDmifI+GhLj5j2W4=";
+  cargoHash = "sha256-JPbqBifhLx+FK2J9+pZysuFIiumBma3YVW/Y8KdNq+M=";

  env = {
    RUSTFLAGS = "-C strip=symbols";
--- a/pkgs/development/tools/fx/default.nix
+++ b/pkgs/development/tools/fx/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "fx";
-  version = "30.0.0";
+  version = "30.0.3";

  src = fetchFromGitHub {
    owner = "antonmedv";
    repo = pname;
    rev = version;
-    hash = "sha256-MRWDitL9nATi6+oaOJ/A+iaNLztWBZ+Mrs7Hkt0lhL8=";
+    hash = "sha256-bTXxzGf7mXQ0VfAQhaKAOYtOVAEVC71R3eRJej0zfJs=";
  };

-  vendorHash = "sha256-cIyh/FC1lcUgPeUZKrh+kCZmSKGE7Bo411eI0dZeMx4=";
+  vendorHash = "sha256-FyV3oaI4MKl0LKJf23XIeUmvFsa1DvQw2pq5Heza3Ws=";

  meta = with lib; {
    description = "Terminal JSON viewer";
--- a/pkgs/development/tools/misc/patchelf/unstable.nix
+++ b/pkgs/development/tools/misc/patchelf/unstable.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "patchelf";
-  version = "unstable-2023-07-20";
+  version = "unstable-2023-09-19";

  src = fetchFromGitHub {
    owner = "NixOS";
    repo = "patchelf";
-    rev = "c40128936fc804b74abddaa0bc1d8ef6e5dba48e";
-    sha256 = "sha256-qX0pGkHeX+KssiATwwohzUlGIZQqpIjKsLv32U2nyWA=";
+    rev = "afd3cc94450dc6845e923f9221fa38818538219e";
+    sha256 = "sha256-ZTy3Dw2HkKokBUXz3ftoGCYncVQ/K3lons9mIt+HVvQ=";
  };

  # Drop test that fails on musl (?)
--- a/pkgs/development/tools/misc/spruce/default.nix
+++ b/pkgs/development/tools/misc/spruce/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spruce";
-  version = "1.30.2";
+  version = "1.31.0";

  src = fetchFromGitHub {
    owner = "geofffranks";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-flY81xiUfOyfdavhF0AyIwrB2G8N6BWltdGMT2uf9Co=";
+    hash = "sha256-7BZl3GPEuXdZptbkChlmdUkxfIkA3B3IdPFO46zejQ4=";
  };

  vendorHash = null;
--- a/pkgs/development/tools/pscale/default.nix
+++ b/pkgs/development/tools/pscale/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "pscale";
-  version = "0.154.0";
+  version = "0.155.0";

  src = fetchFromGitHub {
    owner = "planetscale";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-TExrsxG+7K0QLuMmmIuNcmkFuU9jxbZsQSPxm1q+F0Q=";
+    sha256 = "sha256-ZQ4DpGCkxvF9VJJNr6Xye717MrVW2aRYAlq4oib3nV8=";
  };

-  vendorHash = "sha256-hj+uzb1mpFrbbZXozCP9166i0C5pwIKhEtJOxovBCZE=";
+  vendorHash = "sha256-OeXX16PsDPjQP+piMYhbnANfdBoYamA21yoMM1pWiCA=";

  ldflags = [
    "-s" "-w"
--- a/pkgs/development/tools/viceroy/default.nix
+++ b/pkgs/development/tools/viceroy/default.nix
@ -2,18 +2,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "viceroy";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "fastly";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-ojwhRsJzcQBZ8rBhs1VtsDmc2KYlAr8MR3oShxxyDtY=";
+    hash = "sha256-DeKqLbgHmk6034ItyBzWRXLSeOj3+h49bzf9IX3Aa00=";
  };

  buildInputs = lib.optional stdenv.isDarwin Security;

-  cargoHash = "sha256-zRZ0hFBzU3NLgwRVkcSIZAaaa6CKT8fJj0IIRxiMGGg=";
+  cargoHash = "sha256-g6XdHl/Jxa+kpIjvnaP/RtoByo5O4IDC+s8M4DfGU/8=";

  cargoTestFlags = [
    "--package viceroy-lib"
--- a/pkgs/development/tools/wasmedge/default.nix
+++ b/pkgs/development/tools/wasmedge/default.nix
@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "wasmedge";
-  version = "0.13.3";
+  version = "0.13.4";

  src = fetchFromGitHub {
    owner = "WasmEdge";
    repo = "WasmEdge";
    rev = finalAttrs.version;
-    sha256 = "sha256-IZMYeuneKtcuvbEVgkF2C3gbxJe7GlXRNEYwpFxtiKA=";
+    sha256 = "sha256-2EKUnRvd1w1TxO7OFKYpTzSXC3fdIU7Jk0MIPPTY96U=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@ -80,6 +80,7 @@ rustPlatform.buildRustPackage rec {
      bash or python.
    '';
    license = licenses.mit;
+    mainProgram = "deno";
    maintainers = with maintainers; [ jk ];
    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
  };
--- a/pkgs/development/web/nodejs/corepack.nix
+++ b/pkgs/development/web/nodejs/corepack.nix
@ -0,0 +1,26 @@
+{ lib, stdenv, nodejs }:
+
+stdenv.mkDerivation {
+  pname = "corepack-nodejs";
+  inherit (nodejs) version;
+
+  nativeBuildInputs = [ nodejs ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    corepack enable --install-directory $out/bin
+    # Enabling npm caused some crashes - leaving out for now
+    # corepack enable --install-directory $out/bin npm
+  '';
+
+  meta = {
+    description = "Wrappers for npm, pnpm and Yarn via Node.js Corepack";
+    homepage = "https://nodejs.org/api/corepack.html";
+    changelog = "https://github.com/nodejs/node/releases/tag/v${nodejs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ wmertens ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+}
--- a/pkgs/games/heroic/fhsenv.nix
+++ b/pkgs/games/heroic/fhsenv.nix
@ -53,6 +53,14 @@ buildFHSEnv {
      libXv
      libXxf86vm
    ];
+    gstreamerDeps = pkgs: with pkgs.gst_all_1; [
+      gstreamer
+      gst-plugins-base
+      gst-plugins-good
+      gst-plugins-ugly
+      gst-plugins-bad
+      gst-libav
+    ];
  in pkgs: with pkgs; [
    alsa-lib
    alsa-plugins
@ -68,7 +76,6 @@ buildFHSEnv {
    giflib
    glib
    gnutls
-    gst_all_1.gst-plugins-base
    gtk3
    lcms2
    libevdev
@ -119,6 +126,7 @@ buildFHSEnv {
    wayland
    zlib
  ] ++ xorgDeps pkgs
+    ++ gstreamerDeps pkgs
    ++ extraLibraries pkgs;

  extraInstallCommands = ''
--- a/Show More
+++ b/Show More