Merge master into haskell-updates

2024-11-28 09:53:10 +00:00 · 2023-08-20 00:12:01 +00:00 · 2023-08-20 00:12:01 +00:00 · b8a3b5d228
commit b8a3b5d228
parent dba9d4e33a 174bd27ec8
186 changed files with 4736 additions and 3301 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -5177,6 +5177,11 @@
    githubId = 1583484;
    name = "Andrey Golovizin";
  };
+  errnoh = {
+    github = "errnoh";
+    githubId = 373946;
+    name = "Erno Hopearuoho";
+  };
  ersin = {
    email = "me@ersinakinci.com";
    github = "ersinakinci";
@ -11102,6 +11107,12 @@
    github = "michaelCTS";
    githubId = 132582212;
  };
+  michaeldonovan = {
+    email = "michael@mdonovan.dev";
+    name = "Michael Donovan";
+    github = "michaeldonovan";
+    githubId = 14077230;
+  };
  michaelgrahamevans = {
    email = "michaelgrahamevans@gmail.com";
    name = "Michael Evans";
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -30,6 +30,8 @@

 - [sitespeed-io](https://sitespeed.io), a tool that can generate metrics (timings, diagnostics) for websites. Available as [services.sitespeed-io](#opt-services.sitespeed-io.enable).

+- [Jool](https://nicmx.github.io/Jool/en/index.html), an Open Source implementation of IPv4/IPv6 translation on Linux. Available as [networking.jool.enable](#opt-networking.jool.enable).
+
 - [Apache Guacamole](https://guacamole.apache.org/), a cross-platform, clientless remote desktop gateway. Available as [services.guacamole-server](#opt-services.guacamole-server.enable) and [services.guacamole-client](#opt-services.guacamole-client.enable) services.

 - [pgBouncer](https://www.pgbouncer.org), a PostgreSQL connection pooler. Available as [services.pgbouncer](#opt-services.pgbouncer.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -319,6 +319,7 @@
  ./services/audio/botamusique.nix
  ./services/audio/gmediarender.nix
  ./services/audio/gonic.nix
+  ./services/audio/goxlr-utility.nix
  ./services/audio/hqplayerd.nix
  ./services/audio/icecast.nix
  ./services/audio/jack.nix
@ -928,6 +929,7 @@
  ./services/networking/jibri/default.nix
  ./services/networking/jicofo.nix
  ./services/networking/jitsi-videobridge.nix
+  ./services/networking/jool.nix
  ./services/networking/kea.nix
  ./services/networking/keepalived/default.nix
  ./services/networking/keybase.nix
--- a/nixos/modules/programs/htop.nix
+++ b/nixos/modules/programs/htop.nix
@ -9,7 +9,8 @@ let
  fmt = value:
    if isList value then concatStringsSep " " (map fmt value) else
    if isString value then value else
-    if isBool value || isInt value then toString value else
+    if isBool value then if value then "1" else "0" else
+    if isInt value then toString value else
    throw "Unrecognized type ${typeOf value} in htop settings";

 in
--- a/nixos/modules/services/audio/goxlr-utility.nix
+++ b/nixos/modules/services/audio/goxlr-utility.nix
@ -0,0 +1,48 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.goxlr-utility;
+in
+
+with lib;
+{
+
+  options = {
+    services.goxlr-utility = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = lib.mdDoc ''
+          Whether to enable goxlr-utility for controlling your TC-Helicon GoXLR or GoXLR Mini
+        '';
+      };
+      package = mkPackageOptionMD pkgs "goxlr-utility" { };
+      autoStart.xdg = mkOption {
+        default = true;
+        type = with types; bool;
+        description = lib.mdDoc ''
+          Start the daemon automatically using XDG autostart.
+          Sets `xdg.autostart.enable = true` if not already enabled.
+        '';
+      };
+    };
+  };
+
+  config = mkIf config.services.goxlr-utility.enable
+    {
+      services.udev.packages = [ cfg.package ];
+
+      xdg.autostart.enable = mkIf cfg.autoStart.xdg true;
+      environment.systemPackages = mkIf cfg.autoStart.xdg
+        [
+          cfg.package
+          (pkgs.makeAutostartItem
+            {
+              name = "goxlr-utility";
+              package = cfg.package;
+            })
+        ];
+    };
+
+  meta.maintainers = with maintainers; [ errnoh ];
+}
--- a/nixos/modules/services/games/openarena.nix
+++ b/nixos/modules/services/games/openarena.nix
@ -1,14 +1,14 @@
 { config, lib, pkgs, ... }:

-with lib;
-
 let
+  inherit (lib) concatStringsSep mkEnableOption mkIf mkOption types;
  cfg = config.services.openarena;
 in
 {
  options = {
    services.openarena = {
      enable = mkEnableOption (lib.mdDoc "OpenArena");
+      package = lib.mkPackageOptionMD pkgs "openarena" { };

      openPorts = mkOption {
        type = types.bool;
@ -43,7 +43,7 @@ in
      serviceConfig = {
        DynamicUser = true;
        StateDirectory = "openarena";
-        ExecStart = "${pkgs.openarena}/bin/oa_ded +set fs_basepath ${pkgs.openarena}/openarena-0.8.8 +set fs_homepath /var/lib/openarena ${concatStringsSep " " cfg.extraFlags}";
+        ExecStart = "${cfg.package}/bin/oa_ded +set fs_basepath ${cfg.package}/share/openarena +set fs_homepath /var/lib/openarena ${concatStringsSep " " cfg.extraFlags}";
        Restart = "on-failure";

        # Hardening
--- a/nixos/modules/services/games/quake3-server.nix
+++ b/nixos/modules/services/games/quake3-server.nix
@ -1,13 +1,15 @@
 { config, pkgs, lib, ... }:
-with lib;

 let
+  inherit (lib) literalMD mkEnableOption mkIf mkOption types;
  cfg = config.services.quake3-server;
+
  configFile = pkgs.writeText "q3ds-extra.cfg" ''
    set net_port ${builtins.toString cfg.port}

    ${cfg.extraConfig}
  '';
+
  defaultBaseq3 = pkgs.requireFile rec {
    name = "baseq3";
    hashMode = "recursive";
@ -25,6 +27,7 @@ let
      $services.quake3-server.baseq3/.q3a/
    '';
  };
+
  home = pkgs.runCommand "quake3-home" {} ''
      mkdir -p $out/.q3a/baseq3

@ -38,6 +41,7 @@ in {
  options = {
    services.quake3-server = {
      enable = mkEnableOption (lib.mdDoc "Quake 3 dedicated server");
+      package = lib.mkPackageOptionMD pkgs "ioquake3" { };

      port = mkOption {
        type = types.port;
@ -103,10 +107,10 @@ in {
        ReadOnlyPaths = if baseq3InStore then home else cfg.baseq3;
        ExecStartPre = optionalString (!baseq3InStore) "+${pkgs.coreutils}/bin/cp ${configFile} ${cfg.baseq3}/.q3a/baseq3/nix.cfg";

-        ExecStart = "${pkgs.ioquake3}/ioq3ded.x86_64 +exec nix.cfg";
+        ExecStart = "${cfg.package}/bin/ioq3ded +exec nix.cfg";
      };
    };
  };

-  meta.maintainers = with maintainers; [ f4814n ];
+  meta.maintainers = with lib.maintainers; [ f4814n ];
 }
--- a/nixos/modules/services/logging/graylog.nix
+++ b/nixos/modules/services/logging/graylog.nix
@ -37,8 +37,8 @@ in

      package = mkOption {
        type = types.package;
-        default = if versionOlder config.system.stateVersion "23.05" then pkgs.graylog-3_3 else pkgs.graylog-5_0;
-        defaultText = literalExpression (if versionOlder config.system.stateVersion "23.05" then "pkgs.graylog-3_3" else "pkgs.graylog-5_0");
+        default = if versionOlder config.system.stateVersion "23.05" then pkgs.graylog-3_3 else pkgs.graylog-5_1;
+        defaultText = literalExpression (if versionOlder config.system.stateVersion "23.05" then "pkgs.graylog-3_3" else "pkgs.graylog-5_1");
        description = lib.mdDoc "Graylog package to use.";
      };

--- a/nixos/modules/services/networking/jool.nix
+++ b/nixos/modules/services/networking/jool.nix
@ -0,0 +1,222 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.networking.jool;
+
+  jool = config.boot.kernelPackages.jool;
+  jool-cli = pkgs.jool-cli;
+
+  hardening = {
+    # Run as unprivileged user
+    User = "jool";
+    Group = "jool";
+    DynamicUser = true;
+
+    # Restrict filesystem to only read the jool module
+    TemporaryFileSystem = [ "/" ];
+    BindReadOnlyPaths = [
+      builtins.storeDir
+      "/run/current-system/kernel-modules"
+    ];
+
+    # Give capabilities to load the module and configure it
+    AmbientCapabilities = [ "CAP_SYS_MODULE" "CAP_NET_ADMIN" ];
+    RestrictAddressFamilies = [ "AF_NETLINK" ];
+
+    # Other restrictions
+    RestrictNamespaces = [ "net" ];
+    SystemCallFilter = [ "@system-service" "@module" ];
+    CapabilityBoundingSet = [ "CAP_SYS_MODULE" "CAP_NET_ADMIN" ];
+  };
+
+  configFormat = pkgs.formats.json {};
+
+  mkDefaultAttrs = lib.mapAttrs (n: v: lib.mkDefault v);
+
+  defaultNat64 = {
+    instance = "default";
+    framework = "netfilter";
+    global.pool6 = "64:ff9b::/96";
+  };
+  defaultSiit = {
+    instance = "default";
+    framework = "netfilter";
+  };
+
+  nat64Conf = configFormat.generate "jool-nat64.conf" cfg.nat64.config;
+  siitConf  = configFormat.generate "jool-siit.conf" cfg.siit.config;
+
+in
+
+{
+  ###### interface
+
+  options = {
+    networking.jool.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      relatedPackages = [ "linuxPackages.jool" "jool-cli" ];
+      description = lib.mdDoc ''
+        Whether to enable Jool, an Open Source implementation of IPv4/IPv6
+        translation on Linux.
+
+        Jool can perform stateless IP/ICMP translation (SIIT) or stateful
+        NAT64, analogous to the IPv4 NAPT. Refer to the upstream
+        [documentation](https://nicmx.github.io/Jool/en/intro-xlat.html) for
+        the supported modes of translation and how to configure them.
+      '';
+    };
+
+    networking.jool.nat64.enable = lib.mkEnableOption (lib.mdDoc "a NAT64 instance of Jool.");
+    networking.jool.nat64.config = lib.mkOption {
+      type = configFormat.type;
+      default = defaultNat64;
+      example = lib.literalExpression ''
+        {
+          # custom NAT64 prefix
+          global.pool6 = "2001:db8:64::/96";
+
+          # Port forwarding
+          bib = [
+            { # SSH 192.0.2.16 → 2001:db8:a::1
+              "protocol"     = "TCP";
+              "ipv4 address" = "192.0.2.16#22";
+              "ipv6 address" = "2001:db8:a::1#22";
+            }
+            { # DNS (TCP) 192.0.2.16 → 2001:db8:a::2
+              "protocol"     = "TCP";
+              "ipv4 address" = "192.0.2.16#53";
+              "ipv6 address" = "2001:db8:a::2#53";
+            }
+            { # DNS (UDP) 192.0.2.16 → 2001:db8:a::2
+              "protocol" = "UDP";
+              "ipv4 address" = "192.0.2.16#53";
+              "ipv6 address" = "2001:db8:a::2#53";
+            }
+          ];
+
+          pool4 = [
+            # Ports for dynamic translation
+            { protocol =  "TCP";  prefix = "192.0.2.16/32"; "port range" = "40001-65535"; }
+            { protocol =  "UDP";  prefix = "192.0.2.16/32"; "port range" = "40001-65535"; }
+            { protocol = "ICMP";  prefix = "192.0.2.16/32"; "port range" = "40001-65535"; }
+
+            # Ports for static BIB entries
+            { protocol =  "TCP";  prefix = "192.0.2.16/32"; "port range" = "22"; }
+            { protocol =  "UDP";  prefix = "192.0.2.16/32"; "port range" = "53"; }
+          ];
+        }
+      '';
+      description = lib.mdDoc ''
+        The configuration of a stateful NAT64 instance of Jool managed through
+        NixOS. See https://nicmx.github.io/Jool/en/config-atomic.html for the
+        available options.
+
+        ::: {.note}
+        Existing or more instances created manually will not interfere with the
+        NixOS instance, provided the respective `pool4` addresses and port
+        ranges are not overlapping.
+        :::
+
+        ::: {.warning}
+        Changes to the NixOS instance performed via `jool instance nixos-nat64`
+        are applied correctly but will be lost after restarting
+        `jool-nat64.service`.
+        :::
+      '';
+    };
+
+    networking.jool.siit.enable = lib.mkEnableOption (lib.mdDoc "a SIIT instance of Jool.");
+    networking.jool.siit.config = lib.mkOption {
+      type = configFormat.type;
+      default = defaultSiit;
+      example = lib.literalExpression ''
+        {
+          # Maps any IPv4 address x.y.z.t to 2001:db8::x.y.z.t and v.v.
+          pool6 = "2001:db8::/96";
+
+          # Explicit address mappings
+          eamt = [
+            # 2001:db8:1:: ←→ 192.0.2.0
+            { "ipv6 prefix": "2001:db8:1::/128", "ipv4 prefix": "192.0.2.0" }
+            # 2001:db8:1::x ←→ 198.51.100.x
+            { "ipv6 prefix": "2001:db8:2::/120", "ipv4 prefix": "198.51.100.0/24" }
+          ]
+        }
+      '';
+      description = lib.mdDoc ''
+        The configuration of a SIIT instance of Jool managed through
+        NixOS. See https://nicmx.github.io/Jool/en/config-atomic.html for the
+        available options.
+
+        ::: {.note}
+        Existing or more instances created manually will not interfere with the
+        NixOS instance, provided the respective `EAMT` address mappings are not
+        overlapping.
+        :::
+
+        ::: {.warning}
+        Changes to the NixOS instance performed via `jool instance nixos-siit`
+        are applied correctly but will be lost after restarting
+        `jool-siit.service`.
+        :::
+      '';
+    };
+
+  };
+
+  ###### implementation
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ jool-cli ];
+    boot.extraModulePackages = [ jool ];
+
+    systemd.services.jool-nat64 = lib.mkIf cfg.nat64.enable {
+      description = "Jool, NAT64 setup";
+      documentation = [ "https://nicmx.github.io/Jool/en/documentation.html" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      reloadIfChanged = true;
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStartPre = "${pkgs.kmod}/bin/modprobe jool";
+        ExecStart    = "${jool-cli}/bin/jool file handle ${nat64Conf}";
+        ExecStop     = "${jool-cli}/bin/jool -f ${nat64Conf} instance remove";
+      } // hardening;
+    };
+
+    systemd.services.jool-siit = lib.mkIf cfg.siit.enable {
+      description = "Jool, SIIT setup";
+      documentation = [ "https://nicmx.github.io/Jool/en/documentation.html" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      reloadIfChanged = true;
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStartPre = "${pkgs.kmod}/bin/modprobe jool_siit";
+        ExecStart    = "${jool-cli}/bin/jool_siit file handle ${siitConf}";
+        ExecStop     = "${jool-cli}/bin/jool_siit -f ${siitConf} instance remove";
+      } // hardening;
+    };
+
+    system.checks = lib.singleton (pkgs.runCommand "jool-validated" {
+      nativeBuildInputs = [ pkgs.buildPackages.jool-cli ];
+      preferLocalBuild = true;
+    } ''
+      printf 'Validating Jool configuration... '
+      ${lib.optionalString cfg.siit.enable "jool_siit file check ${siitConf}"}
+      ${lib.optionalString cfg.nat64.enable "jool file check ${nat64Conf}"}
+      printf 'ok\n'
+      touch "$out"
+    '');
+
+    networking.jool.nat64.config = mkDefaultAttrs defaultNat64;
+    networking.jool.siit.config  = mkDefaultAttrs defaultSiit;
+
+  };
+
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
+}
--- a/nixos/modules/services/web-apps/grocy.nix
+++ b/nixos/modules/services/web-apps/grocy.nix
@ -115,10 +115,8 @@ in {
      user = "grocy";
      group = "nginx";

-      # PHP 8.0 is the only version which is supported/tested by upstream:
-      # https://github.com/grocy/grocy/blob/v3.3.0/README.md#how-to-install
-      # Compatibility with PHP 8.1 is available on their development branch:
-      # https://github.com/grocy/grocy/commit/38a4ad8ec480c29a1bff057b3482fd103b036848
+      # PHP 8.1 is the only version which is supported/tested by upstream:
+      # https://github.com/grocy/grocy/blob/v4.0.0/README.md#platform-support
      phpPackage = pkgs.php81;

      inherit (cfg.phpfpm) settings;
@ -168,7 +166,7 @@ in {
  };

  meta = {
-    maintainers = with maintainers; [ ma27 ];
+    maintainers = with maintainers; [ n0emis ];
    doc = ./grocy.md;
  };
 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -391,6 +391,7 @@ in {
  jibri = handleTest ./jibri.nix {};
  jirafeau = handleTest ./jirafeau.nix {};
  jitsi-meet = handleTest ./jitsi-meet.nix {};
+  jool = handleTest ./jool.nix {};
  k3s = handleTest ./k3s {};
  kafka = handleTest ./kafka.nix {};
  kanidm = handleTest ./kanidm.nix {};
--- a/nixos/tests/jool.nix
+++ b/nixos/tests/jool.nix
@ -0,0 +1,250 @@
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+
+let
+  inherit (pkgs) lib;
+
+  ipv6Only = {
+    networking.useDHCP = false;
+    networking.interfaces.eth1.ipv4.addresses = lib.mkVMOverride [ ];
+  };
+
+  ipv4Only = {
+    networking.useDHCP = false;
+    networking.interfaces.eth1.ipv6.addresses = lib.mkVMOverride [ ];
+  };
+
+  webserver = ip: msg: {
+    systemd.services.webserver = {
+      description = "Mock webserver";
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig.Restart = "always";
+      script = ''
+        while true; do
+        {
+          printf 'HTTP/1.0 200 OK\n'
+          printf 'Content-Length: ${toString (1 + builtins.stringLength msg)}\n'
+          printf '\n${msg}\n\n'
+        } | ${pkgs.libressl.nc}/bin/nc -${toString ip}nvl 80
+        done
+      '';
+    };
+    networking.firewall.allowedTCPPorts = [ 80 ];
+  };
+
+in
+
+{
+  siit = makeTest {
+    # This test simulates the setup described in [1] with two IPv6 and
+    # IPv4-only devices on different subnets communicating through a border
+    # relay running Jool in SIIT mode.
+    # [1]: https://nicmx.github.io/Jool/en/run-vanilla.html
+    name = "jool-siit";
+    meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
+    # Border relay
+    nodes.relay = { ... }: {
+      imports = [ ../modules/profiles/minimal.nix ];
+      virtualisation.vlans = [ 1 2 ];
+
+      # Enable packet routing
+      boot.kernel.sysctl = {
+        "net.ipv6.conf.all.forwarding" = 1;
+        "net.ipv4.conf.all.forwarding" = 1;
+      };
+
+      networking.useDHCP = false;
+      networking.interfaces = lib.mkVMOverride {
+        eth1.ipv6.addresses = [ { address = "fd::198.51.100.1"; prefixLength = 120; } ];
+        eth2.ipv4.addresses = [ { address = "192.0.2.1";  prefixLength = 24; } ];
+      };
+
+      networking.jool = {
+        enable = true;
+        siit.enable = true;
+        siit.config.global.pool6 = "fd::/96";
+      };
+    };
+
+    # IPv6 only node
+    nodes.alice = { ... }: {
+      imports = [
+        ../modules/profiles/minimal.nix
+        ipv6Only
+        (webserver 6 "Hello, Bob!")
+      ];
+
+      virtualisation.vlans = [ 1 ];
+      networking.interfaces.eth1.ipv6 = {
+        addresses = [ { address = "fd::198.51.100.8"; prefixLength = 120; } ];
+        routes    = [ { address = "fd::192.0.2.0"; prefixLength = 120;
+                        via = "fd::198.51.100.1"; } ];
+      };
+    };
+
+    # IPv4 only node
+    nodes.bob = { ... }: {
+      imports = [
+        ../modules/profiles/minimal.nix
+        ipv4Only
+        (webserver 4 "Hello, Alice!")
+      ];
+
+      virtualisation.vlans = [ 2 ];
+      networking.interfaces.eth1.ipv4 = {
+        addresses = [ { address = "192.0.2.16"; prefixLength = 24; } ];
+        routes    = [ { address = "198.51.100.0"; prefixLength = 24;
+                        via = "192.0.2.1"; } ];
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      relay.wait_for_unit("jool-siit.service")
+      alice.wait_for_unit("network-addresses-eth1.service")
+      bob.wait_for_unit("network-addresses-eth1.service")
+
+      with subtest("Alice and Bob can't ping each other"):
+        relay.systemctl("stop jool-siit.service")
+        alice.fail("ping -c1 fd::192.0.2.16")
+        bob.fail("ping -c1 198.51.100.8")
+
+      with subtest("Alice and Bob can ping using the relay"):
+        relay.systemctl("start jool-siit.service")
+        alice.wait_until_succeeds("ping -c1 fd::192.0.2.16")
+        bob.wait_until_succeeds("ping -c1 198.51.100.8")
+
+      with subtest("Alice can connect to Bob's webserver"):
+        bob.wait_for_open_port(80)
+        alice.succeed("curl -vvv http://[fd::192.0.2.16] >&2")
+        alice.succeed("curl --fail -s http://[fd::192.0.2.16] | grep -q Alice")
+
+      with subtest("Bob can connect to Alices's webserver"):
+        alice.wait_for_open_port(80)
+        bob.succeed("curl --fail -s http://198.51.100.8 | grep -q Bob")
+    '';
+  };
+
+  nat64 = makeTest {
+    # This test simulates the setup described in [1] with two IPv6-only nodes
+    # (a client and a homeserver) on the LAN subnet and an IPv4 node on the WAN.
+    # The router runs Jool in stateful NAT64 mode, masquarading the LAN and
+    # forwarding ports using static BIB entries.
+    # [1]: https://nicmx.github.io/Jool/en/run-nat64.html
+    name = "jool-nat64";
+    meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
+    # Router
+    nodes.router = { ... }: {
+      imports = [ ../modules/profiles/minimal.nix ];
+      virtualisation.vlans = [ 1 2 ];
+
+      # Enable packet routing
+      boot.kernel.sysctl = {
+        "net.ipv6.conf.all.forwarding" = 1;
+        "net.ipv4.conf.all.forwarding" = 1;
+      };
+
+      networking.useDHCP = false;
+      networking.interfaces = lib.mkVMOverride {
+        eth1.ipv6.addresses = [ { address = "2001:db8::1"; prefixLength = 96; } ];
+        eth2.ipv4.addresses = [ { address = "203.0.113.1"; prefixLength = 24; } ];
+      };
+
+      networking.jool = {
+        enable = true;
+        nat64.enable = true;
+        nat64.config = {
+          bib = [
+            { # forward HTTP 203.0.113.1 (router) → 2001:db8::9 (homeserver)
+              "protocol"     = "TCP";
+              "ipv4 address" = "203.0.113.1#80";
+              "ipv6 address" = "2001:db8::9#80";
+            }
+          ];
+          pool4 = [
+            # Ports for dynamic translation
+            { protocol =  "TCP";  prefix = "203.0.113.1/32"; "port range" = "40001-65535"; }
+            { protocol =  "UDP";  prefix = "203.0.113.1/32"; "port range" = "40001-65535"; }
+            { protocol = "ICMP";  prefix = "203.0.113.1/32"; "port range" = "40001-65535"; }
+            # Ports for static BIB entries
+            { protocol =  "TCP";  prefix = "203.0.113.1/32"; "port range" = "80"; }
+          ];
+        };
+      };
+    };
+
+    # LAN client (IPv6 only)
+    nodes.client = { ... }: {
+      imports = [ ../modules/profiles/minimal.nix ipv6Only ];
+      virtualisation.vlans = [ 1 ];
+
+      networking.interfaces.eth1.ipv6 = {
+        addresses = [ { address = "2001:db8::8"; prefixLength = 96; } ];
+        routes    = [ { address = "64:ff9b::";   prefixLength = 96;
+                        via = "2001:db8::1"; } ];
+      };
+    };
+
+    # LAN server (IPv6 only)
+    nodes.homeserver = { ... }: {
+      imports = [
+        ../modules/profiles/minimal.nix
+        ipv6Only
+        (webserver 6 "Hello from IPv6!")
+      ];
+
+      virtualisation.vlans = [ 1 ];
+      networking.interfaces.eth1.ipv6 = {
+        addresses = [ { address = "2001:db8::9"; prefixLength = 96; } ];
+        routes    = [ { address = "64:ff9b::";   prefixLength = 96;
+                        via = "2001:db8::1"; } ];
+      };
+    };
+
+    # WAN server (IPv4 only)
+    nodes.server = { ... }: {
+      imports = [
+        ../modules/profiles/minimal.nix
+        ipv4Only
+        (webserver 4 "Hello from IPv4!")
+      ];
+
+      virtualisation.vlans = [ 2 ];
+      networking.interfaces.eth1.ipv4.addresses =
+        [ { address = "203.0.113.16"; prefixLength = 24; } ];
+    };
+
+    testScript = ''
+      start_all()
+
+      for node in [client, homeserver, server]:
+        node.wait_for_unit("network-addresses-eth1.service")
+
+      with subtest("Client can ping the WAN server"):
+        router.wait_for_unit("jool-nat64.service")
+        client.succeed("ping -c1 64:ff9b::203.0.113.16")
+
+      with subtest("Client can connect to the WAN webserver"):
+        server.wait_for_open_port(80)
+        client.succeed("curl --fail -s http://[64:ff9b::203.0.113.16] | grep -q IPv4!")
+
+      with subtest("Router BIB entries are correctly populated"):
+        router.succeed("jool bib display | grep -q 'Dynamic TCP.*2001:db8::8'")
+        router.succeed("jool bib display | grep -q 'Static TCP.*2001:db8::9'")
+
+      with subtest("WAN server can reach the LAN server"):
+        homeserver.wait_for_open_port(80)
+        server.succeed("curl --fail -s http://203.0.113.1 | grep -q IPv6!")
+    '';
+
+  };
+
+}
--- a/pkgs/applications/audio/butt/default.nix
+++ b/pkgs/applications/audio/butt/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "butt";
-  version = "0.1.37";
+  version = "0.1.38";

  src = fetchurl {
    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-FI8xRCaGSMC6KEf5v87Q4syO3kVPWXYXgnL24+myRKo=";
+    hash = "sha256-6c4BknAh+XPaKrEfCz0oHm7lWOLV+9jiJbQx9vvtI4I=";
  };

  postPatch = ''
--- a/pkgs/applications/audio/g4music/default.nix
+++ b/pkgs/applications/audio/g4music/default.nix
@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
    gtk4
    libadwaita
  ] ++ (with gst_all_1; [
+    gst-plugins-bad
    gst-plugins-base
    gst-plugins-good
    gstreamer
--- a/pkgs/applications/backup/areca/default.nix
+++ b/pkgs/applications/backup/areca/default.nix
@ -1,57 +0,0 @@
-{ lib, stdenv, fetchurl, ant, jre, jdk, swt, acl, attr }:
-
-stdenv.mkDerivation rec {
-  pname = "areca";
-  version = "7.5";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/project/areca/areca-stable/areca-${version}/areca-${version}-src.tar.gz";
-    sha256 = "1q4ha9s96c1syplxm04bh1v1gvjq16l4pa8w25w95d2ywwvyq1xb";
-  };
-
-  sourceRoot = ".";
-
-  buildInputs = [ jdk ant acl attr ];
-
-  patches = [ ./fix-javah-bug.diff ];
-
-  postPatch = ''
-    substituteInPlace build.xml --replace "/usr/lib/java/swt.jar" "${swt}/jars/swt.jar"
-    substituteInPlace build.xml --replace "gcc" "${stdenv.cc}/bin/gcc"
-    substituteInPlace areca.sh --replace "bin/" ""
-    substituteInPlace bin/areca_run.sh --replace "/usr/java" "${jre}/lib/openjdk"
-    substituteInPlace bin/areca_run.sh --replace "/usr/lib/java/swt.jar" "${swt}/jars/swt.jar"
-
-    # Fix for NixOS/nixpkgs/issues/53716
-    sed -i -e 's;^;#include <attr/attributes.h>;' jni/com_myJava_file_metadata_posix_jni_wrapper_FileAccessWrapper.c
-    substituteInPlace jni/com_myJava_file_metadata_posix_jni_wrapper_FileAccessWrapper.c --replace attr/xattr.h sys/xattr.h
-
-    sed -i "s#^PROGRAM_DIR.*#PROGRAM_DIR=$out#g" bin/areca_run.sh
-    sed -i "s#^LIBRARY_PATH.*#LIBRARY_PATH=$out/lib:${lib.makeLibraryPath [ swt acl ]}#g" bin/areca_run.sh
-
-    # https://sourceforge.net/p/areca/bugs/563/
-    substituteInPlace bin/areca_run.sh --replace '[ "$JAVA_IMPL" = "java" ]' \
-      '[[ "$JAVA_IMPL" = "java" || "$JAVA_IMPL" = "openjdk" ]]'
-  '';
-
-  buildPhase = "ant";
-
-  installPhase = ''
-    mkdir -p $out/bin $out/lib $out/translations
-    cp areca.sh $out/bin/areca
-    cp -r bin $out
-    cp -r lib $out
-    cp -r translations $out
-    cp COPYING $out
-  '';
-
-  meta = with lib; {
-    homepage = "http://www.areca-backup.org/";
-    description = "An Open Source personal backup solution";
-    # Builds fine but fails to launch.
-    broken = true;
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ pSub ];
-    platforms = with platforms; linux;
-  };
-}
--- a/pkgs/applications/editors/jucipp/default.nix
+++ b/pkgs/applications/editors/jucipp/default.nix
@ -1,73 +0,0 @@
-{ lib, stdenv, fetchgit, dconf, gtksourceview3, at-spi2-core, gtksourceviewmm,
-  boost, libepoxy, cmake, aspell, llvmPackages, libgit2, pkg-config, pcre,
-  libXdmcp, libxkbcommon, libpthreadstubs, wrapGAppsHook, aspellDicts, gtkmm3,
-  coreutils, glibc, dbus, openssl, libxml2, gnumake, ctags }:
-
-stdenv.mkDerivation rec {
-  pname = "juicipp";
-  version = "1.2.3";
-
-  meta = with lib; {
-    homepage = "https://github.com/cppit/jucipp";
-    description = "A lightweight, platform independent C++-IDE with support for C++11, C++14, and experimental C++17 features depending on libclang version";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ xnwdd ];
-    # error: token ""1.1"" is not valid in preprocessor expression
-    # TODO: fix pname being different from the attribute name
-    broken = true;
-  };
-
-  src = fetchgit {
-    url = "https://github.com/cppit/jucipp.git";
-    rev = "refs/tags/v${version}";
-    deepClone = true;
-    sha256 = "0xp6ijnrggskjrvscp204bmdpz48l5a8nxr9abp17wni6akb5wiq";
-  };
-
-  nativeBuildInputs = [ pkg-config wrapGAppsHook cmake ];
-  buildInputs = [
-    dbus
-    openssl
-    libxml2
-    gtksourceview3
-    at-spi2-core
-    pcre
-    libepoxy
-    boost
-    libXdmcp
-    aspell
-    libgit2
-    libxkbcommon
-    gtkmm3
-    libpthreadstubs
-    gtksourceviewmm
-    llvmPackages.clang.cc
-    llvmPackages.lldb
-    dconf
-  ];
-
-
-  lintIncludes = let
-    p = "arguments.emplace_back(\"-I";
-    e = "\");";
-    v = lib.getVersion llvmPackages.clang;
-  in
-    p+llvmPackages.libcxx.dev+"/include/c++/v1"+e
-    +p+llvmPackages.clang-unwrapped.lib+"/lib/clang/"+v+"/include/"+e
-    +p+glibc.dev+"/include"+e;
-
-  preConfigure = ''
-    sed -i 's|liblldb LIBLLDB_LIBRARIES|liblldb LIBNOTHING|g' CMakeLists.txt
-    sed -i 's|> arguments;|> arguments; ${lintIncludes}|g' src/source_clang.cc
-  '';
-  cmakeFlags = [ "-DLIBLLDB_LIBRARIES=${lib.makeLibraryPath [ llvmPackages.lldb ]}/liblldb.so" ];
-  postInstall = ''
-    mv $out/bin/juci $out/bin/.juci
-    makeWrapper "$out/bin/.juci" "$out/bin/juci" \
-      --set PATH "${lib.makeBinPath [ ctags coreutils llvmPackages.clang.cc cmake gnumake llvmPackages.clang.bintools llvmPackages.clang ]}" \
-      --set NO_AT_BRIDGE 1 \
-      --set ASPELL_CONF "dict-dir ${aspellDicts.en}/lib/aspell"
-  '';
-
-}
--- a/pkgs/applications/editors/vim/plugins/deprecated.json
+++ b/pkgs/applications/editors/vim/plugins/deprecated.json
@ -19,6 +19,10 @@
        "date": "2022-10-20",
        "new": "neodev-nvim"
    },
+    "nvchad-extensions": {
+      "date": "2023-08-19",
+      "new": "nvchad-ui"
+    },
    "nvim-bufferline-lua": {
        "date": "2021-08-22",
        "new": "bufferline-nvim"
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -27,12 +27,12 @@
  };
  arduino = buildGrammar {
    language = "arduino";
-    version = "0.0.0+rev=d988e6a";
+    version = "0.0.0+rev=a2aa2b3";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-arduino";
-      rev = "d988e6a803203cc2bbfd2a8a84edffc73d2922b4";
-      hash = "sha256-Q8LmoBIKqU/DCf387ew/LgvYbyT8KsxvmD+WFMXOMGI=";
+      rev = "a2aa2b38301960822c5384cd10a07c2026e9d44e";
+      hash = "sha256-VtY+SaWIkLHv48jewmU0k1AtPwqpthWbNkpTHtCS98Y=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-arduino";
  };
@ -60,12 +60,12 @@
  };
  bash = buildGrammar {
    language = "bash";
-    version = "0.0.0+rev=1b0321e";
+    version = "0.0.0+rev=8077be4";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-bash";
-      rev = "1b0321ee85701d5036c334a6f04761cdc672e64c";
-      hash = "sha256-ueZjazaqjbxqCM7mO8h9m0fJ6RUCaX4MuJx7StnPqyc=";
+      rev = "8077be4c5504f2618f1280295bc4ae20a75988c1";
+      hash = "sha256-i31QbosmsI1CUGAHOqeNGVeqoct13+i24CUtaGwdT7o=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-bash";
  };
@ -113,6 +113,17 @@
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-bicep";
  };
+  bitbake = buildGrammar {
+    language = "bitbake";
+    version = "0.0.0+rev=ed92abd";
+    src = fetchFromGitHub {
+      owner = "amaanq";
+      repo = "tree-sitter-bitbake";
+      rev = "ed92abd7b67ab66a6fa3a747a0157f01d2e467d8";
+      hash = "sha256-HfWUDYiBCmtlu5fFX287BSDHyCiD7gqIVFDTxH5APAE=";
+    };
+    meta.homepage = "https://github.com/amaanq/tree-sitter-bitbake";
+  };
  blueprint = buildGrammar {
    language = "blueprint";
    version = "0.0.0+rev=7f1a5df";
@ -126,12 +137,12 @@
  };
  c = buildGrammar {
    language = "c";
-    version = "0.0.0+rev=93ef178";
+    version = "0.0.0+rev=a2b7bac";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-c";
-      rev = "93ef1785bbf854cf964e6e53d6e1e6885a4d8ebc";
-      hash = "sha256-5n9ZnslpUWyusWTo+AqJiPGB64NB0rTbc2rtfByPUC8=";
+      rev = "a2b7bac3b313efbaa683d9a276ff63cdc544d960";
+      hash = "sha256-39i06oXMQemfq3Y4TTXai6HFXvURVOif1v2i9LP4sAI=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-c";
  };
@ -192,12 +203,12 @@
  };
  cmake = buildGrammar {
    language = "cmake";
-    version = "0.0.0+rev=3dfc596";
+    version = "0.0.0+rev=73ab4b8";
    src = fetchFromGitHub {
      owner = "uyha";
      repo = "tree-sitter-cmake";
-      rev = "3dfc596025431b21e839d392c171f6f97c2a4258";
-      hash = "sha256-SrNsKtZ/BYa6wWkuseHuwwvcC37IKFuGtS5oNefWG0U=";
+      rev = "73ab4b8e9522f014a67f87f585e820d36fa47408";
+      hash = "sha256-5X4ho6tqPZFQWqoQ6WBsfuA+RbxTX5XzX7xzyFSTifw=";
    };
    meta.homepage = "https://github.com/uyha/tree-sitter-cmake";
  };
@ -258,12 +269,12 @@
  };
  cpp = buildGrammar {
    language = "cpp";
-    version = "0.0.0+rev=77cecd8";
+    version = "0.0.0+rev=a90f170";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-cpp";
-      rev = "77cecd88d28032bf4f54fd4ee68efb53a6c8c9a5";
-      hash = "sha256-/w77s0qcJcLH6MX3BVuM37UQ1Xm/6t2oJ2KTq+hnIJI=";
+      rev = "a90f170f92d5d70e7c2d4183c146e61ba5f3a457";
+      hash = "sha256-e9Mz84lssaPR80hlogyjXx+jA8gD8YVp4T06qC6gRVI=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-cpp";
  };
@ -278,14 +289,26 @@
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-css";
  };
+  csv = buildGrammar {
+    language = "csv";
+    version = "0.0.0+rev=f1d35df";
+    src = fetchFromGitHub {
+      owner = "amaanq";
+      repo = "tree-sitter-csv";
+      rev = "f1d35df780976721d3cd38f0b16538dd31f87a23";
+      hash = "sha256-t4uzc1VwJzS4qj0D1wolUvUNuc5OzC4L4RnLpYh+TXo=";
+    };
+    location = "csv";
+    meta.homepage = "https://github.com/amaanq/tree-sitter-csv";
+  };
  cuda = buildGrammar {
    language = "cuda";
-    version = "0.0.0+rev=d4285d0";
+    version = "0.0.0+rev=f00c914";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-cuda";
-      rev = "d4285d0396a409c91bcd5a7fd362cf13cc6f8600";
-      hash = "sha256-M4jx6pEj6kb0XIaWq7dzEvd+p6qadlowEyMYzJoeiRU=";
+      rev = "f00c91430124797e798cbf28e09075d7d192938a";
+      hash = "sha256-9Jx6O4yfIrbCLTEPgpoZZ+3yxhi2r0MwrbiHCUexa60=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-cuda";
  };
@ -378,6 +401,18 @@
    };
    meta.homepage = "https://github.com/rydesun/tree-sitter-dot";
  };
+  dtd = buildGrammar {
+    language = "dtd";
+    version = "0.0.0+rev=9deacbf";
+    src = fetchFromGitHub {
+      owner = "ObserverOfTime";
+      repo = "tree-sitter-xml";
+      rev = "9deacbfb79cb3527a0396255beb17e1bba3f2052";
+      hash = "sha256-3ryZXRgsBaNKBBHUhJ8ANHYunOUMzthMI7gw+6lnooQ=";
+    };
+    location = "tree-sitter-dtd";
+    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-xml";
+  };
  ebnf = buildGrammar {
    language = "ebnf";
    version = "0.0.0+rev=8e635b0";
@ -645,12 +680,12 @@
  };
  glsl = buildGrammar {
    language = "glsl";
-    version = "0.0.0+rev=00ffe20";
+    version = "0.0.0+rev=4780c2b";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-glsl";
-      rev = "00ffe2099374613d2f313ace4a9dda44370b458b";
-      hash = "sha256-K0JSRytbV5qMP6X3rT/cmEjxdTPgT63hQpahFrUjTOU=";
+      rev = "4780c2b689a5a5bd0ccfd78403510e9cf4a0f2fc";
+      hash = "sha256-lbdQSqLtjM1AtdmlAebCH0CewYPENIQHb7oyXNuUM6U=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-glsl";
  };
@ -709,6 +744,17 @@
    };
    meta.homepage = "https://github.com/omertuc/tree-sitter-go-work";
  };
+  gpg = buildGrammar {
+    language = "gpg";
+    version = "0.0.0+rev=c44ce76";
+    src = fetchFromGitHub {
+      owner = "ObserverOfTime";
+      repo = "tree-sitter-gpg-config";
+      rev = "c44ce76960114352dd00728b835ceef02e0506b8";
+      hash = "sha256-EDkmwHzRwf3x5LMsnOnhj+AbYLKF3dy/t4sGxuIWnYg=";
+    };
+    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-gpg-config";
+  };
  graphql = buildGrammar {
    language = "graphql";
    version = "0.0.0+rev=5e66e96";
@ -810,12 +856,12 @@
  };
  hlsl = buildGrammar {
    language = "hlsl";
-    version = "0.0.0+rev=95361dd";
+    version = "0.0.0+rev=45e60a6";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-hlsl";
-      rev = "95361dde7ad4025fbec5dc4e5cdde0ea8ed64172";
-      hash = "sha256-zOWkB0ii0awy/P2nHd3vGEoiLpo/fswhHVvYJOwfgzg=";
+      rev = "45e60a69b4dac922d81474b5d6fa88b4e5387b21";
+      hash = "sha256-qQqgiFJAX3hT1ecvKJ6fssWvtkT8i3IdRVBt6L0coI4=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
  };
@ -898,12 +944,12 @@
  };
  ispc = buildGrammar {
    language = "ispc";
-    version = "0.0.0+rev=cc57a93";
+    version = "0.0.0+rev=9b2f9ae";
    src = fetchFromGitHub {
      owner = "fab4100";
      repo = "tree-sitter-ispc";
-      rev = "cc57a931eb782474324910e19ca253aa0d5fe38a";
-      hash = "sha256-fWBKSLzegpf5duDEqIbz5hvEFlOZFjQdLpVxLhimSAY=";
+      rev = "9b2f9aec2106b94b4e099fe75e73ebd8ae707c04";
+      hash = "sha256-vxe+g7o0gXgB4GjhjkxqLqcLL2+8wqMB3tm1xQFSitI=";
    };
    meta.homepage = "https://github.com/fab4100/tree-sitter-ispc";
  };
@ -920,23 +966,23 @@
  };
  java = buildGrammar {
    language = "java";
-    version = "0.0.0+rev=e8d1bc4";
+    version = "0.0.0+rev=0b3f9cf";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-java";
-      rev = "e8d1bc4043c1d2326f7ce3aa7b8833c7b18d0560";
-      hash = "sha256-UXTEUb5OyGYRDae52fuSBOiu/6LXIk3s8mt0vl7z2Bw=";
+      rev = "0b3f9cfe10a973df0530533313fdbef6c2c92bfa";
+      hash = "sha256-dSRXjHfJOCrwm6HXlEz+prlKH7k+5B99S8vWyH49KzQ=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-java";
  };
  javascript = buildGrammar {
    language = "javascript";
-    version = "0.0.0+rev=f772967";
+    version = "0.0.0+rev=c69aaba";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-javascript";
-      rev = "f772967f7b7bc7c28f845be2420a38472b16a8ee";
-      hash = "sha256-rfOAn5S8E2RunlRyY1aTs7j0r6UGKH+732xdpk/5524=";
+      rev = "c69aabab53609d00e8e198ab902e4fde4b8e449f";
+      hash = "sha256-6cyKT4yASueb+nNj8EqZbF7LZYZasMOYvq5ki2a0zQk=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-javascript";
  };
@ -997,12 +1043,12 @@
  };
  jsonnet = buildGrammar {
    language = "jsonnet";
-    version = "0.0.0+rev=26d9699";
+    version = "0.0.0+rev=d34615f";
    src = fetchFromGitHub {
      owner = "sourcegraph";
      repo = "tree-sitter-jsonnet";
-      rev = "26d9699842a429731844c93cbcb485519bb2c526";
-      hash = "sha256-e5K2k1DNPU/NuWN2uGwk+k3c5plNk5RN0Or6ahxD/lQ=";
+      rev = "d34615fa12cc1d1cfc1f1f1a80acc9db80ee4596";
+      hash = "sha256-jjDjntNm0YAsG6Ec2n0eB8BjpgEQEAjV8LAZ3GGYhG8=";
    };
    meta.homepage = "https://github.com/sourcegraph/tree-sitter-jsonnet";
  };
@ -1085,12 +1131,12 @@
  };
  lua = buildGrammar {
    language = "lua";
-    version = "0.0.0+rev=7268c1c";
+    version = "0.0.0+rev=88e4464";
    src = fetchFromGitHub {
      owner = "MunifTanjim";
      repo = "tree-sitter-lua";
-      rev = "7268c1cea5df56ac0c779cd37d6631d4e6f41d4f";
-      hash = "sha256-GrRHbNVKijYNeICeopVW6OtHquqKhKtDDa7dK5sEMNQ=";
+      rev = "88e446476a1e97a8724dff7a23e2d709855077f2";
+      hash = "sha256-w+WVQHPiS/xyRz0obdJoUHZ7QzIDAvgtSzmE98yDORY=";
    };
    meta.homepage = "https://github.com/MunifTanjim/tree-sitter-lua";
  };
@ -1275,12 +1321,12 @@
  };
  objc = buildGrammar {
    language = "objc";
-    version = "0.0.0+rev=97e022e";
+    version = "0.0.0+rev=62e61b6";
    src = fetchFromGitHub {
      owner = "amaanq";
      repo = "tree-sitter-objc";
-      rev = "97e022ec4a908108283bad23d42eee39ad204db6";
-      hash = "sha256-3sp93zxliIrjp6Z1SUlFdp2rkcsFLba4SEIVdaQ4H+4=";
+      rev = "62e61b6f5c0289c376d61a8c91faf6435cde9012";
+      hash = "sha256-Q1qAUgoYfpxmhn5XpnCwLBdu2BL2YF2We9bjumR8dNk=";
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-objc";
  };
@ -1388,12 +1434,12 @@
  };
  php = buildGrammar {
    language = "php";
-    version = "0.0.0+rev=d76de26";
+    version = "0.0.0+rev=ce2c73a";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-php";
-      rev = "d76de26b8218df208949f46b31e0c422020eda3a";
-      hash = "sha256-s5oms776eOTkT/tD61ElHCY+pIg7LhnJ3VIyhdHoZWs=";
+      rev = "ce2c73a8d84b5648e8792698dc9fd955e5f6a906";
+      hash = "sha256-HZOIz9KiZ13aqeQtCeQln56RRRPUSgT7ulPJs54fzJc=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
  };
@ -1465,12 +1511,12 @@
  };
  promql = buildGrammar {
    language = "promql";
-    version = "0.0.0+rev=ed9a12f";
+    version = "0.0.0+rev=77625d7";
    src = fetchFromGitHub {
      owner = "MichaHoffmann";
      repo = "tree-sitter-promql";
-      rev = "ed9a12f6ae4e75d4622adef8fb1b1e4d0ac0a759";
-      hash = "sha256-pE0cPBB6zuQ2MdjT+kPOqhbTvcOBk5M+JK3leaT7ITE=";
+      rev = "77625d78eebc3ffc44d114a07b2f348dff3061b0";
+      hash = "sha256-IJbnC03pDfcSAF//Ux+LqqfjtagGSD5Nu46yUo0vT5Q=";
    };
    meta.homepage = "https://github.com/MichaHoffmann/tree-sitter-promql";
  };
@ -1496,6 +1542,18 @@
    };
    meta.homepage = "https://github.com/PRQL/tree-sitter-prql";
  };
+  psv = buildGrammar {
+    language = "psv";
+    version = "0.0.0+rev=f1d35df";
+    src = fetchFromGitHub {
+      owner = "amaanq";
+      repo = "tree-sitter-csv";
+      rev = "f1d35df780976721d3cd38f0b16538dd31f87a23";
+      hash = "sha256-t4uzc1VwJzS4qj0D1wolUvUNuc5OzC4L4RnLpYh+TXo=";
+    };
+    location = "psv";
+    meta.homepage = "https://github.com/amaanq/tree-sitter-csv";
+  };
  pug = buildGrammar {
    language = "pug";
    version = "0.0.0+rev=a7ff31a";
@ -1518,14 +1576,25 @@
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-puppet";
  };
+  pymanifest = buildGrammar {
+    language = "pymanifest";
+    version = "0.0.0+rev=8953f91";
+    src = fetchFromGitHub {
+      owner = "ObserverOfTime";
+      repo = "tree-sitter-pymanifest";
+      rev = "8953f91d733dd92c1ac43b3d58a7a2f43fa62dae";
+      hash = "sha256-1kG09tYE9FAxsE4MqLadi4dtqtJOFOZGOOVgnqvWc44=";
+    };
+    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-pymanifest";
+  };
  python = buildGrammar {
    language = "python";
-    version = "0.0.0+rev=5af00f6";
+    version = "0.0.0+rev=c01fb4e";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-python";
-      rev = "5af00f64af6bbf822f208243cce5cf75396fb6f5";
-      hash = "sha256-2btd/NRE6NuGNlx4cq535OrwtWXihiP3VMCJjPCiDOk=";
+      rev = "c01fb4e38587e959b9058b8cd34b9e6a3068c827";
+      hash = "sha256-cV/QwvEQkIQcgo0Pm+3pUH2LhpYOPsuWMgjXMa8dv+s=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-python";
  };
@ -1652,12 +1721,12 @@
  };
  robot = buildGrammar {
    language = "robot";
-    version = "0.0.0+rev=5e50f25";
+    version = "0.0.0+rev=322e4cc";
    src = fetchFromGitHub {
      owner = "Hubro";
      repo = "tree-sitter-robot";
-      rev = "5e50f2517580290cd1b9689664815e3b09d986b8";
-      hash = "sha256-5mWRCd9JcTGTuODltbuz7htW/fYjlBTS9HzxrFRj12w=";
+      rev = "322e4cc65754d2b3fdef4f2f8a71e0762e3d13af";
+      hash = "sha256-VxWZWFPYkD3odM3TpEgLKsFnN8wB6xoIiXUYqBbpDqw=";
    };
    meta.homepage = "https://github.com/Hubro/tree-sitter-robot";
  };
@ -1707,12 +1776,12 @@
  };
  scala = buildGrammar {
    language = "scala";
-    version = "0.0.0+rev=f14629b";
+    version = "0.0.0+rev=3a67773";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-scala";
-      rev = "f14629b4d53f72356ce8f6d4ac8c54d21b4e74dd";
-      hash = "sha256-SRj4iF1qS2jEFaIkRfXzAmzG7jKeSzKv5/GdXKbKRjU=";
+      rev = "3a67773e205eb43c993cc5d43f633ddb79eb1653";
+      hash = "sha256-S5vXtvdpQMh8Beacpm07zRaHoJCa+ZiH2j5IB6idOng=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-scala";
  };
@ -1829,12 +1898,12 @@
  };
  starlark = buildGrammar {
    language = "starlark";
-    version = "0.0.0+rev=504ddd7";
+    version = "0.0.0+rev=c45ce2b";
    src = fetchFromGitHub {
      owner = "amaanq";
      repo = "tree-sitter-starlark";
-      rev = "504ddd75ecc78fbbce22aa6facd70375d3f8854a";
-      hash = "sha256-ourTH45q4X0CxDAVGhwK5XgeWNhS4SRtc4qyUF+H+RQ=";
+      rev = "c45ce2b39062bbd12ea1c210bd200db250efb24a";
+      hash = "sha256-rEOvGrXRguIXQNvXdm+s80xRQ+8iCCdafA2Wl+dsHJo=";
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-starlark";
  };
@ -2006,6 +2075,18 @@
    };
    meta.homepage = "https://github.com/ikatyang/tree-sitter-toml";
  };
+  tsv = buildGrammar {
+    language = "tsv";
+    version = "0.0.0+rev=f1d35df";
+    src = fetchFromGitHub {
+      owner = "amaanq";
+      repo = "tree-sitter-csv";
+      rev = "f1d35df780976721d3cd38f0b16538dd31f87a23";
+      hash = "sha256-t4uzc1VwJzS4qj0D1wolUvUNuc5OzC4L4RnLpYh+TXo=";
+    };
+    location = "tsv";
+    meta.homepage = "https://github.com/amaanq/tree-sitter-csv";
+  };
  tsx = buildGrammar {
    language = "tsx";
    version = "0.0.0+rev=b1bf482";
@ -2187,17 +2268,29 @@
  };
  wing = buildGrammar {
    language = "wing";
-    version = "0.0.0+rev=9399564";
+    version = "0.0.0+rev=f30b02c";
    src = fetchFromGitHub {
      owner = "winglang";
      repo = "wing";
-      rev = "9399564d1e32864c6af2d49c0dcd1f76d54443f2";
-      hash = "sha256-Me+AhVl0a38w54vWa4yvxOPHMwVnJw1wewrn0bBC9AM=";
+      rev = "f30b02c4bf363b797de39ae63375a4f357718ae9";
+      hash = "sha256-562MgzH/hGvCBctNj34jXrsmwHXJt4Hxb2lsZ/IeN74=";
    };
    location = "libs/tree-sitter-wing";
    generate = true;
    meta.homepage = "https://github.com/winglang/wing";
  };
+  xml = buildGrammar {
+    language = "xml";
+    version = "0.0.0+rev=9deacbf";
+    src = fetchFromGitHub {
+      owner = "ObserverOfTime";
+      repo = "tree-sitter-xml";
+      rev = "9deacbfb79cb3527a0396255beb17e1bba3f2052";
+      hash = "sha256-3ryZXRgsBaNKBBHUhJ8ANHYunOUMzthMI7gw+6lnooQ=";
+    };
+    location = "tree-sitter-xml";
+    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-xml";
+  };
  yaml = buildGrammar {
    language = "yaml";
    version = "0.0.0+rev=0e36bed";
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -966,7 +966,7 @@ self: super: {
        pname = "sg-nvim-rust";
        inherit (old) version src;

-        cargoHash = "sha256-cMMNur6QKp87Q28JyCH2IMLE3xDVd7Irg9HvJ2AsnZc=";
+        cargoHash = "sha256-f14cGAGZFs4DG8FBKYDz1NY38TOuENW9Co2fywGc74E=";

        nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -257,6 +257,7 @@ https://github.com/edgedb/edgedb-vim/,,
 https://github.com/folke/edgy.nvim/,HEAD,
 https://github.com/editorconfig/editorconfig-vim/,,
 https://github.com/gpanders/editorconfig.nvim/,,
+https://github.com/creativenull/efmls-configs-nvim/,,
 https://github.com/elixir-tools/elixir-tools.nvim/,HEAD,
 https://github.com/elmcast/elm-vim/,,
 https://github.com/dmix/elvish.vim/,,
@ -265,7 +266,6 @@ https://github.com/vim-scripts/emodeline/,,
 https://github.com/vim-scripts/errormarker.vim/,,
 https://github.com/sainnhe/everforest/,,
 https://github.com/google/executor.nvim/,HEAD,
-https://github.com/nvchad/extensions/,HEAD,nvchad-extensions
 https://github.com/jinh0/eyeliner.nvim/,HEAD,
 https://github.com/fenetikm/falcon/,,
 https://github.com/brooth/far.vim/,,
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@ -111,9 +111,6 @@ let
      # The credentials should be stored in a secure keychain already, so the benefit of this is questionable
      # in the first place.
      rm -rf $out/lib/vscode/resources/app/node_modules/vscode-encrypt
-
-      # Unbundle libglvnd as VSCode doesn't include libGLESv2.so.2 which is necessary for GPU acceleration
-      rm -rf $out/lib/vscode/libGLESv2.so
    '') + ''
      runHook postInstall
    '';
@ -122,7 +119,6 @@ let
      gappsWrapperArgs+=(
        # Add gio to PATH so that moving files to the trash works when not using a desktop environment
        --prefix PATH : ${glib.bin}/bin
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libglvnd ]}
        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
        --add-flags ${lib.escapeShellArg commandLineArgs}
      )
@ -157,6 +153,10 @@ let
      chmod +x ${vscodeRipgrep}
    '');

+    postFixup = lib.optionalString stdenv.isLinux ''
+      patchelf --add-needed ${libglvnd}/lib/libGLESv2.so.2 $out/lib/vscode/${executableName}
+    '';
+
    inherit meta;
  };

--- a/pkgs/applications/editors/your-editor/default.nix
+++ b/pkgs/applications/editors/your-editor/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "your-editor";
-  version = "1505";
+  version = "1506";

  src = fetchFromGitHub {
    owner = "your-editor";
    repo = "yed";
    rev = version;
-    sha256 = "sha256-4HPrBr1M8J484qu1cXpZyVdLu3+/IYoNnNV9vSd4SlY=";
+    sha256 = "sha256-QmUquXoDGhoan+Y1kdkTirdkIvYPBkeAEkMLkaE9QKk=";
  };

  installPhase = ''
--- a/pkgs/applications/graphics/vengi-tools/default.nix
+++ b/pkgs/applications/graphics/vengi-tools/default.nix
@ -29,13 +29,13 @@

 stdenv.mkDerivation rec {
  pname = "vengi-tools";
-  version = "0.0.25";
+  version = "0.0.26";

  src = fetchFromGitHub {
    owner = "mgerhardy";
    repo = "vengi";
    rev = "v${version}";
-    hash = "sha256-ZY0HG1BpRQV7+RzdXUhKV6JRa/1RIYmCuhnYCZapG8w=";
+    hash = "sha256-p+ZL3oxzwKhh+j1bxakgyStH+1GAu2aEwNmsqo6fNFo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@ -2,13 +2,13 @@

 let
  pname = "anytype";
-  version = "0.33.3";
+  version = "0.34.3";
  name = "Anytype-${version}";
  nameExecutable = pname;
  src = fetchurl {
    url = "https://anytype-release.fra1.cdn.digitaloceanspaces.com/Anytype-${version}.AppImage";
    name = "Anytype-${version}.AppImage";
-    sha256 = "sha256-3qBd1WgHn/sfEyNRPTX5viMX3lVZPfsG6x7GfNwkL3E=";
+    sha256 = "sha256-YJMpCEQ6eJYISGeYgvS6TcQwU2eD6fjgHrHRKA6CQJU=";
  };
  appimageContents = appimageTools.extractType2 { inherit name src; };
 in
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -28,11 +28,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "blender";
-  version = "3.6.0";
+  version = "3.6.2";

  src = fetchurl {
    url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    hash = "sha256-SzdWyzdGhsaesv1VX5ZUfUnLHvRvW8buJTlOVxz6yOk=";
+    hash = "sha256-olEmcOM3VKo/IWOhQp/qOkdJvwzM7bCkf8i8Bzh07Eg=";
  };

  patches = [
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -32,11 +32,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "calibre";
-  version = "6.24.0";
+  version = "6.25.0";

  src = fetchurl {
    url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-SG6st8RRN2hGFQa1XB93fbklTNta5uJXGSeY+F7CSPY=";
+    hash = "sha256-4ghB2RUImh8AsMGsBCsVeKXgyV+llCLNy24/2LNJwv0=";
  };

  # https://sources.debian.org/patches/calibre/${finalAttrs.version}+dfsg-1
--- a/pkgs/applications/misc/ideamaker/default.nix
+++ b/pkgs/applications/misc/ideamaker/default.nix
@ -1,79 +0,0 @@
-{ stdenv
-, autoPatchelfHook
-, curl
-, dpkg
-, fetchurl
-, gcc
-, lib
-, libGLU
-, libcork
-, makeDesktopItem
-, qt5
-, quazip
-, zlib
-}:
-stdenv.mkDerivation rec {
-  pname = "ideamaker";
-  version = "4.0.1";
-
-  src = fetchurl {
-    # N.B. Unfortunately ideamaker adds a number after the patch number in
-    # their release scheme which is not referenced anywhere other than in
-    # the download URL. Because of this, I have chosen to not use ${version}
-    # and just handwrite the correct values in the following URL, hopefully
-    # avoiding surprises for the next person that comes to update this
-    # package.
-    url = "https://download.raise3d.com/ideamaker/release/4.0.1/ideaMaker_4.0.1.4802-ubuntu_amd64.deb";
-    sha256 = "0a1jcakdglcr4kz0kyq692dbjk6aq2yqcp3i6gzni91k791h49hp";
-  };
-
-  nativeBuildInputs = [ autoPatchelfHook dpkg qt5.wrapQtAppsHook ];
-  buildInputs = [
-    curl
-    gcc.cc.lib
-    libGLU
-    libcork
-    qt5.qtbase
-    qt5.qtserialport
-    quazip
-    zlib
-  ];
-
-  unpackPhase = ''
-    runHook preUnpack
-    dpkg-deb -x $src .
-    runHook postUnpack
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{bin,share/pixmaps}
-
-    cp usr/lib/x86_64-linux-gnu/ideamaker/ideamaker $out/bin
-    ln -s "${desktopItem}/share/applications" $out/share/
-    cp usr/share/ideamaker/icons/ideamaker-icon.png $out/share/pixmaps/${pname}.png
-
-    runHook postInstall
-  '';
-
-  desktopItem = makeDesktopItem {
-    name = pname;
-    exec = pname;
-    icon = pname;
-    desktopName = "Ideamaker";
-    genericName = meta.description;
-    categories = [ "Utility" "Viewer" "Engineering" ];
-    mimeTypes = [ "application/sla" ];
-  };
-
-  meta = with lib; {
-    homepage = "https://www.raise3d.com/ideamaker/";
-    description = "Raise3D's 3D slicer software";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ lovesegfault ];
-    broken = true;  # Segfaults on startup.
-  };
-}
--- a/pkgs/applications/misc/nwg-dock/default.nix
+++ b/pkgs/applications/misc/nwg-dock/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "nwg-dock";
-  version = "0.3.5";
+  version = "0.3.6";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-kLvVP+hwv8Xgvp1YqrXZ2xpEcU92yvNMT5YCcDcg7xQ=";
+    sha256 = "sha256-Nh6VAgQIGxNxkWnNieRope5Hj3RL0uSFuOLqg+/oucw=";
  };

-  vendorHash = "sha256-WDygnKdldZda4GadfStHWsDel1KLdzjVjw0RxmnFPRE=";
+  vendorHash = "sha256-k/2JD25ZmVI3G9GqJnI9vz5WtRc2vo4nfAiGUt6IPyU=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/applications/misc/osmscout-server/default.nix
+++ b/pkgs/applications/misc/osmscout-server/default.nix
@ -1,7 +1,23 @@
-{ lib, mkDerivation, fetchFromGitHub, pkg-config
-, qmake, qttools, kirigami2, qtquickcontrols2, qtlocation
-, libosmscout, valhalla, libpostal, osrm-backend, protobuf
-, libmicrohttpd, sqlite, marisa, kyotocabinet, boost
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, fetchpatch
+, pkg-config
+, qmake
+, qttools
+, boost
+, kirigami2
+, kyotocabinet
+, libmicrohttpd
+, libosmscout
+, libpostal
+, marisa
+, osrm-backend
+, protobuf
+, qtquickcontrols2
+, qtlocation
+, sqlite
+, valhalla
 }:

 let
@ -31,6 +47,19 @@ mkDerivation rec {
    libpostal sqlite marisa kyotocabinet boost protobuf date
  ];

+  patches = [
+    # Valhalla 3.2.1 support. Only required for next patch to apply cleanly
+    (fetchpatch {
+      url = "https://github.com/rinigus/osmscout-server/commit/1df9d383e61dd14cbe9e5b52412a2e951cee2ee4.patch";
+      hash = "sha256-h+YTyHr4RYgwH5bfVgyujSekbL2LfV8vJgVkjXT0I10=";
+    })
+    # Valhalla 3.4.0 support
+    (fetchpatch {
+      url = "https://github.com/rinigus/osmscout-server/commit/fe6562a4c3ba5da2735232ea8fdc7f71d7e7e714.patch";
+      hash = "sha256-wibLTFk3cFS5mcC71TgMA9ZAAHS3mbjboFHqax6nCxs=";
+    })
+  ];
+
  qmakeFlags = [
    "SCOUT_FLAVOR=kirigami" # Choose to build the kirigami UI variant
    "CONFIG+=disable_mapnik" # Disable the optional mapnik backend
--- a/pkgs/applications/misc/remontoire/default.nix
+++ b/pkgs/applications/misc/remontoire/default.nix
@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, wrapGAppsHook
+, desktop-file-utils
+, glib
+, gtk3
+, json-glib
+, libgee
+, librsvg
+, meson
+, ninja
+, pkg-config
+, python3
+, vala
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "remontoire";
+  version = "unstable-2022-06-19";
+
+  src = fetchFromGitHub {
+    owner = "regolith-linux";
+    repo = "remontoire";
+    rev = "68d562c78d6e0094ca744bd7161c308f583e93e";
+    hash = "sha256-Cb6tzTGZdQA9oA04DO/xLBw5F+FRj5BM2Aa62YWGmZA=";
+  };
+
+  nativeBuildInputs = [
+    glib
+    meson
+    ninja
+    pkg-config
+    python3
+    vala
+    wrapGAppsHook
+    desktop-file-utils
+  ];
+
+  buildInputs = [
+    gtk3
+    json-glib
+    libgee
+  ];
+
+  postPatch = ''
+    chmod +x build-aux/meson/postinstall.py
+    patchShebangs build-aux/meson/postinstall.py
+  '';
+
+  meta = with lib; {
+    description = "A small GTK app for presenting keybinding hints";
+    homepage = "https://github.com/regolith-linux/remontoire";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ aacebedo ];
+  };
+})
--- a/pkgs/applications/misc/rofi-rbw/default.nix
+++ b/pkgs/applications/misc/rofi-rbw/default.nix
@ -1,15 +1,30 @@
-{ lib, buildPythonApplication, fetchFromGitHub, configargparse, setuptools, poetry-core, rbw }:
+{ lib
+, buildPythonApplication
+, fetchFromGitHub
+, configargparse
+, setuptools
+, poetry-core
+, rbw
+
+, waylandSupport ? false
+, wl-clipboard
+, wtype
+
+, x11Support ? false
+, xclip
+, xdotool
+}:

 buildPythonApplication rec {
  pname = "rofi-rbw";
-  version = "1.1.0";
+  version = "1.2.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "fdw";
    repo = "rofi-rbw";
    rev = "refs/tags/${version}";
-    hash = "sha256-5K6tofC1bIxxNOQ0jk6NbVoaGGyQImYiUZAaAmkwiTA=";
+    hash = "sha256-6ZM+qJvVny/h5W/+7JqD/CCf9eayExvZfC/z9rHssVU=";
  };

  nativeBuildInputs = [
@ -17,12 +32,36 @@ buildPythonApplication rec {
    poetry-core
  ];

+  buildInputs = [
+    rbw
+  ] ++ lib.optionals waylandSupport [
+    wl-clipboard
+    wtype
+  ] ++ lib.optionals x11Support [
+    xclip
+    xdotool
+  ];
+
  propagatedBuildInputs = [ configargparse ];

  pythonImportsCheck = [ "rofi_rbw" ];

+  wrapper_paths = [
+    rbw
+  ] ++ lib.optionals waylandSupport [
+    wl-clipboard
+    wtype
+  ] ++ lib.optionals x11Support [
+    xclip
+    xdotool
+  ];
+
+  wrapper_flags =
+    lib.optionalString waylandSupport "--typer wtype --clipboarder wl-copy"
+    + lib.optionalString x11Support "--typer xdotool --clipboarder xclip";
+
  preFixup = ''
-    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ rbw ]})
+    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath wrapper_paths} --add-flags "${wrapper_flags}")
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@ -1,69 +1,92 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, meson
-, pkg-config
-, ninja
-, wrapGAppsHook
-, wayland
-, wlroots
-, gtkmm3
-, libsigcxx
-, jsoncpp
-, scdoc
-, spdlog
+, SDL2
+, alsa-lib
+, catch2_3
+, fftw
+, glib
+, gobject-introspection
 , gtk-layer-shell
+, gtkmm3
 , howard-hinnant-date
+, hyprland
+, iniparser
+, jsoncpp
+, libdbusmenu-gtk3
+, libevdev
 , libinotify-kqueue
+, libinput
+, libjack2
+, libmpdclient
+, libnl
+, libpulseaudio
+, libsigcxx
 , libxkbcommon
-, cavaSupport     ? true,  alsa-lib, fftw, iniparser, ncurses, pipewire, portaudio, SDL2
-, evdevSupport    ? true,  libevdev
-, hyprlandSupport ? false, hyprland
-, inputSupport    ? true,  libinput
-, jackSupport     ? true,  libjack2
-, mpdSupport      ? true,  libmpdclient
-, mprisSupport    ? stdenv.isLinux, playerctl ? false
-, nlSupport       ? true,  libnl
-, pulseSupport    ? true,  libpulseaudio
-, rfkillSupport   ? true
-, runTests        ? true,  catch2_3
-, sndioSupport    ? true,  sndio
-, swaySupport     ? true,  sway
-, traySupport     ? true,  libdbusmenu-gtk3
-, udevSupport     ? true,  udev
-, upowerSupport   ? true,  upower
-, wireplumberSupport ? true, wireplumber
-, withMediaPlayer ? mprisSupport && false, glib, gobject-introspection, python3
+, meson
+, ncurses
+, ninja
+, pipewire
+, pkg-config
+, playerctl
+, portaudio
+, python3
+, scdoc
+, sndio
+, spdlog
+, sway
+, udev
+, upower
+, wayland
+, wireplumber
+, wlroots
+, wrapGAppsHook
+
+, cavaSupport ? true
+, evdevSupport ? true
+, hyprlandSupport ? false
+, inputSupport ? true
+, jackSupport ? true
+, mpdSupport ? true
+, mprisSupport ? stdenv.isLinux
+, nlSupport ? true
+, pulseSupport ? true
+, rfkillSupport ? true
+, runTests ? true
+, sndioSupport ? true
+, swaySupport ? true
+, traySupport ? true
+, udevSupport ? true
+, upowerSupport ? true
+, wireplumberSupport ? true
+, withMediaPlayer ? mprisSupport && false
 }:
+
 let
  # Derived from subprojects/cava.wrap
-  libcava = rec {
-    version = "0.8.5";
-    src = fetchFromGitHub {
-      owner = "LukashonakV";
-      repo = "cava";
-      rev = version;
-      hash = "sha256-b/XfqLh8PnW018sGVKRRlFvBpo2Ru1R2lUeTR7pugBo=";
-    };
+  libcava.src = fetchFromGitHub {
+    owner = "LukashonakV";
+    repo = "cava";
+    rev = "0.8.5";
+    hash = "sha256-b/XfqLh8PnW018sGVKRRlFvBpo2Ru1R2lUeTR7pugBo=";
  };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "waybar";
  version = "0.9.22";

  src = fetchFromGitHub {
    owner = "Alexays";
    repo = "Waybar";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-9LJDA+zrHF9Mn8+W9iUw50LvO+xdT7/l80KdltPrnDo=";
  };

  postUnpack = lib.optional cavaSupport ''
-    (
-      cd "$sourceRoot"
-      cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-0.8.5
-      patchShebangs .
-    )
+    pushd "$sourceRoot"
+    cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-0.8.5
+    patchShebangs .
+    popd
  '';

  # Patch for workspaces support in wlr/workspaces
@ -71,7 +94,11 @@ stdenv.mkDerivation rec {
  patches = lib.optional hyprlandSupport [ ./hyprland.diff ];

  nativeBuildInputs = [
-    meson ninja pkg-config scdoc wrapGAppsHook
+    meson
+    ninja
+    pkg-config
+    scdoc
+    wrapGAppsHook
  ] ++ lib.optional withMediaPlayer gobject-introspection;

  propagatedBuildInputs = lib.optionals withMediaPlayer [
@ -82,72 +109,87 @@ stdenv.mkDerivation rec {

  strictDeps = false;

-  buildInputs = with lib;
-    [ wayland wlroots gtkmm3 libsigcxx jsoncpp spdlog gtk-layer-shell howard-hinnant-date libxkbcommon ]
-    ++ optional  (!stdenv.isLinux) libinotify-kqueue
-    ++ optional  cavaSupport   alsa-lib
-    ++ optional  cavaSupport   iniparser
-    ++ optional  cavaSupport   fftw
-    ++ optional  cavaSupport   ncurses
-    ++ optional  cavaSupport   pipewire
-    ++ optional  cavaSupport   portaudio
-    ++ optional  cavaSupport   SDL2
-    ++ optional  evdevSupport  libevdev
-    ++ optional  hyprlandSupport hyprland
-    ++ optional  inputSupport  libinput
-    ++ optional  jackSupport   libjack2
-    ++ optional  mpdSupport    libmpdclient
-    ++ optional  mprisSupport  playerctl
-    ++ optional  nlSupport     libnl
-    ++ optional  pulseSupport  libpulseaudio
-    ++ optional  sndioSupport  sndio
-    ++ optional  swaySupport   sway
-    ++ optional  traySupport   libdbusmenu-gtk3
-    ++ optional  udevSupport   udev
-    ++ optional  upowerSupport upower
-    ++ optional  wireplumberSupport wireplumber;
+  buildInputs = [
+    gtk-layer-shell
+    gtkmm3
+    howard-hinnant-date
+    jsoncpp
+    libsigcxx
+    libxkbcommon
+    spdlog
+    wayland
+    wlroots
+  ]
+  ++ lib.optionals cavaSupport  [
+    SDL2
+    alsa-lib
+    fftw
+    iniparser
+    ncurses
+    pipewire
+    portaudio
+  ]
+  ++ lib.optional evdevSupport libevdev
+  ++ lib.optional hyprlandSupport hyprland
+  ++ lib.optional inputSupport libinput
+  ++ lib.optional jackSupport libjack2
+  ++ lib.optional mpdSupport libmpdclient
+  ++ lib.optional mprisSupport playerctl
+  ++ lib.optional nlSupport libnl
+  ++ lib.optional pulseSupport libpulseaudio
+  ++ lib.optional sndioSupport sndio
+  ++ lib.optional swaySupport sway
+  ++ lib.optional traySupport libdbusmenu-gtk3
+  ++ lib.optional udevSupport udev
+  ++ lib.optional upowerSupport upower
+  ++ lib.optional wireplumberSupport wireplumber
+  ++ lib.optional (!stdenv.isLinux) libinotify-kqueue;

  nativeCheckInputs = [ catch2_3 ];
  doCheck = runTests;

-  mesonFlags = (lib.mapAttrsToList
-    (option: enable: "-D${option}=${if enable then "enabled" else "disabled"}")
-    {
-      cava = cavaSupport;
-      dbusmenu-gtk = traySupport;
-      jack = jackSupport;
-      libinput = inputSupport;
-      libnl = nlSupport;
-      libudev = udevSupport;
-      mpd = mpdSupport;
-      mpris = mprisSupport;
-      pulseaudio = pulseSupport;
-      rfkill = rfkillSupport;
-      sndio = sndioSupport;
-      tests = runTests;
-      upower_glib = upowerSupport;
-      wireplumber = wireplumberSupport;
-    }
-  ) ++ [
-    "-Dsystemd=disabled"
-    "-Dgtk-layer-shell=enabled"
-    "-Dman-pages=enabled"
-  ] ++ lib.optional hyprlandSupport "-Dexperimental=true";
+  mesonFlags = (lib.mapAttrsToList lib.mesonEnable {
+    "cava" = cavaSupport;
+    "dbusmenu-gtk" = traySupport;
+    "gtk-layer-shell" = true;
+    "jack" = jackSupport;
+    "libinput" = inputSupport;
+    "libnl" = nlSupport;
+    "libudev" = udevSupport;
+    "man-pages" = true;
+    "mpd" = mpdSupport;
+    "mpris" = mprisSupport;
+    "pulseaudio" = pulseSupport;
+    "rfkill" = rfkillSupport;
+    "sndio" = sndioSupport;
+    "systemd" = false;
+    "tests" = runTests;
+    "upower_glib" = upowerSupport;
+    "wireplumber" = wireplumberSupport;
+  })
+  ++ lib.optional hyprlandSupport (lib.mesonBool "experimental" true);

  preFixup = lib.optionalString withMediaPlayer ''
-      cp $src/resources/custom_modules/mediaplayer.py $out/bin/waybar-mediaplayer.py
+    cp $src/resources/custom_modules/mediaplayer.py $out/bin/waybar-mediaplayer.py

-      wrapProgram $out/bin/waybar-mediaplayer.py \
-        --prefix PYTHONPATH : "$PYTHONPATH:$out/${python3.sitePackages}"
-    '';
+    wrapProgram $out/bin/waybar-mediaplayer.py \
+      --prefix PYTHONPATH : "$PYTHONPATH:$out/${python3.sitePackages}"
+  '';

-  meta = with lib; {
-    changelog = "https://github.com/alexays/waybar/releases/tag/${version}";
-    description = "Highly customizable Wayland bar for Sway and Wlroots based compositors";
-    license = licenses.mit;
-    maintainers = with maintainers; [ FlorianFranzen minijackson synthetica lovesegfault rodrgz jtbx ];
-    platforms = platforms.unix;
+  meta = {
    homepage = "https://github.com/alexays/waybar";
+    description = "Highly customizable Wayland bar for Sway and Wlroots based compositors";
+    changelog = "https://github.com/alexays/waybar/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
    mainProgram = "waybar";
+    maintainers = with lib.maintainers; [
+      FlorianFranzen
+      jtbx
+      lovesegfault
+      minijackson
+      rodrgz
+      synthetica
+    ];
+    inherit (wlroots.meta) platforms;
  };
-}
+})
--- a/pkgs/applications/misc/wpm/default.nix
+++ b/pkgs/applications/misc/wpm/default.nix
@ -0,0 +1,28 @@
+{ lib
+, python3
+, fetchPypi
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "wpm";
+  version = "1.51.5";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-swT9E5Tto4yWnm0voowcJXtY3cIY3MNqAdfrTnuGbdg=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
+  pythonImportsCheck = [ "wpm" ];
+
+  meta = with lib; {
+    description = "Console app for measuring typing speed in words per minute (WPM)";
+    homepage = "https://pypi.org/project/wpm";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ alejandrosame ];
+  };
+}
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -91,11 +91,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.56.20";
+  version = "1.57.47";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-ub44AI0Fu3V8SRhiBrQueJZaSdl4/cI6DQ3QYJfGseo=";
+    sha256 = "sha256-u2xC+Q6tcg989S0zM2flRRiCu7kLSv1/y3N2EvFxiwM=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -30,11 +30,11 @@

  firefox-beta = buildMozillaMach rec {
    pname = "firefox-beta";
-    version = "117.0b5";
+    version = "117.0b9";
    applicationName = "Mozilla Firefox Beta";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "8cb7a96a996b5d3b4e119b4b6317eb7015f9e3d96a3c6a301effe4e5cdaf1c8295a68e57cd919b42a1bef8717ae6764edcbedd4399ca89e14e5f212b144125c1";
+      sha512 = "95e215f4280e177c3f763c6a8ab7ff56d6e0ca4aca2ac5eec8a3be7a461257e3aba236f3d122200e031d8e75ae2486779fb89d398defeefdb52589cb98a131b4";
    };

    meta = {
@ -58,12 +58,12 @@

  firefox-devedition = (buildMozillaMach rec {
    pname = "firefox-devedition";
-    version = "117.0b5";
+    version = "117.0b9";
    applicationName = "Mozilla Firefox Developer Edition";
    branding = "browser/branding/aurora";
    src = fetchurl {
      url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "16f2fc0ac5d3cd76659b33b319a39367d5e37d7c2f5246f2f76a57b1455ab16af83872ec4fb74a30e127b744a06d8dc5c99a531d3bf2ff4c6465d1d5e2fcd126";
+      sha512 = "ab034e31467a7c9a57f5c32d486fb69a250d4293513babeeea8ff2042b0eac858be2c46c69469c700a7271f46a0c297ecdaa5ff651434adc8f9c157f80a97e43";
    };

    meta = {
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@ -19,11 +19,11 @@

  python3Packages = python3.pkgs;
  pdfjs = let
-    version = "2.14.305";
+    version = "3.9.179";
  in
  fetchzip {
    url = "https://github.com/mozilla/pdf.js/releases/download/v${version}/pdfjs-${version}-dist.zip";
-    hash = "sha256-E7t+0AUndrgi4zfJth0w28RmWLqLyXMUCnueNf/gNi4=";
+    hash = "sha256-QoJFb7MlZN6lDe2Yalsd10sseukL6+tNRi6JzLPVBYw=";
    stripRoot = false;
  };

--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "helmfile";
-  version = "0.155.1";
+  version = "0.156.0";

  src = fetchFromGitHub {
    owner = "helmfile";
    repo = "helmfile";
    rev = "v${version}";
-    sha256 = "sha256-6y+7Jrs/sIpxJjO9Zzv2ht1RprrqcBjwyOsCnqDHxUY=";
+    sha256 = "sha256-MrDhOsjXo4aaeWSo/WNheUqom7kF2MzyaqeZXVAAzz4=";
  };

-  vendorHash = "sha256-MCx+6K3CqVfFEYgkxT1sFvy0vshpKwW07AUngEG2muk=";
+  vendorHash = "sha256-hMoBwA9KmQSBJkEu3UAxM1wi6RRHZdUhYqri5JGwEmw=";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/k0sctl/default.nix
+++ b/pkgs/applications/networking/cluster/k0sctl/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "k0sctl";
-  version = "0.15.4";
+  version = "0.15.5";

  src = fetchFromGitHub {
    owner = "k0sproject";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-sMMYuE/KIWScZTCuzW9WQpCDHI+Og1zRxGlZzOuHgNo=";
+    sha256 = "sha256-ntjrk2OEIkAmNpf9Ag6HkSIOSA3NtO9hSJOBgvne4b0=";
  };

-  vendorSha256 = "sha256-6UWRh0NHFr7adJJSmrfTjzXH75Dmjed/+KxH6Kz//jk=";
+  vendorSha256 = "sha256-JlaXQqDO/b1xe9NA2JtuB1DZZlphWu3Mo/Mf4lhmKNo=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -110,13 +110,13 @@
    "vendorHash": null
  },
  "aws": {
-    "hash": "sha256-eUvN+b7rj1l20/RHo+zFz2rxpZM4QlXBlag/Nfnt7ps=",
+    "hash": "sha256-25CTfFwj/RxsFE6gpUxS1X3TbsuRhTZP89WqhsaRp8w=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
    "owner": "hashicorp",
    "repo": "terraform-provider-aws",
-    "rev": "v5.13.0",
+    "rev": "v5.13.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-w+p37Ayw/wsv6k5Bk6SWwiVdyJtH1z6mx6hM301Dnyw="
+    "vendorHash": "sha256-Oir+zn8UNbO3vbl3+QUIlis4K2watmWokaYdD7xGYzI="
  },
  "azuread": {
    "hash": "sha256-aLckXkWxMsDS1ddPucAmjFS6+mkwHeAO1+BlPNaF6cI=",
@ -836,13 +836,13 @@
    "vendorHash": null
  },
  "okta": {
-    "hash": "sha256-yoO8LDSB80GfEjPR3sf8JcciX+3gM1qtFBv/rFAzb6g=",
+    "hash": "sha256-Y3sLtuN55vgO35aWM6c2zIChkF5Q+8zlvH5NOJF/tRU=",
    "homepage": "https://registry.terraform.io/providers/okta/okta",
    "owner": "okta",
    "repo": "terraform-provider-okta",
-    "rev": "v4.2.0",
+    "rev": "v4.3.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tXVV8lcB8A66WtsWb2wDcJEERjzbHm/eqHyzIOrVk7E="
+    "vendorHash": "sha256-2w/cdB8ySt+nimU4KXSpWjWMkeX7rEmhYHBJWQPJ5PI="
  },
  "oktaasa": {
    "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@ -1061,13 +1061,13 @@
    "vendorHash": "sha256-NO1r/EWLgH1Gogru+qPeZ4sW7FuDENxzNnpLSKstnE8="
  },
  "spotinst": {
-    "hash": "sha256-g0qkUzLcMZZQrYtRbpyNWkpYLzJskP7Be+tGs3SGyVo=",
+    "hash": "sha256-PzIQ8hYCoZOdNoFvHGBGG/3ROIBl6micozonoMojG0Q=",
    "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
    "owner": "spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.133.0",
+    "rev": "v1.134.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-5F8A8v8YQXrYAgWGYjO5G+sY3SY+O2oiYo3zVLZ9LUc="
+    "vendorHash": "sha256-ptMO8xtL5STVapeZbie+6UHR4AcLbHkzXTz7sPfbsV4="
  },
  "stackpath": {
    "hash": "sha256-7KQUddq+M35WYyAIAL8sxBjAaXFcsczBRO1R5HURUZg=",
@ -1115,11 +1115,11 @@
    "vendorHash": "sha256-0HRhwUGDE4y7UFlXyD0w8zl4NV5436L4SRhrb8vQGyc="
  },
  "tencentcloud": {
-    "hash": "sha256-T98RZ775nXIjqanqWhZfz+IKJIXvDEkVnqHhznilYe0=",
+    "hash": "sha256-9nm4x3pBHvUDyMWUZpxqbSOc4uxGZ50lKBwf8PV9UAQ=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.81.20",
+    "rev": "v1.81.21",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1188,13 +1188,13 @@
    "vendorHash": null
  },
  "utils": {
-    "hash": "sha256-UqAWByIArvTz2ArR/dgIDw98grqj9BEyRJzNODteKao=",
+    "hash": "sha256-+11qnWZPtCyAjON5XZye9069332lKEpJdy504dYhOLw=",
    "homepage": "https://registry.terraform.io/providers/cloudposse/utils",
    "owner": "cloudposse",
    "repo": "terraform-provider-utils",
-    "rev": "1.10.0",
+    "rev": "1.11.0",
    "spdx": "Apache-2.0",
-    "vendorHash": "sha256-n70qtdz4x8bdzCmVYyVTvvndx0w0AV/Yv8thGvitT6U="
+    "vendorHash": "sha256-D7geLjmJoelbHolyS5IhnGNNl6kD8ZGtCRWcy+j2dxA="
  },
  "vault": {
    "hash": "sha256-lnM52d7J36wu9MYh13IFSR15rMfJpXP4tw47LzRy4o4=",
--- a/pkgs/applications/networking/cluster/zarf/default.nix
+++ b/pkgs/applications/networking/cluster/zarf/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "zarf";
-  version = "0.28.4";
+  version = "0.29.0";

  src = fetchFromGitHub {
    owner = "defenseunicorns";
    repo = "zarf";
    rev = "v${version}";
-    hash = "sha256-UloVE3CRiXYzIAm0Yyt0WyYEY7ykCyIiPH5JNa/acAo=";
+    hash = "sha256-MpjxyVOouivB1FT8ejKhq3lPSfCaXwxMXpyxoaNxVEk=";
  };

-  vendorHash = "sha256-+i4pHHCo7sSESerHEVQ1r8MoEzhKdfhRGRjvyiyPG5E=";
+  vendorHash = "sha256-h/N50x64ROW3KJ5965vauSpkIoeq8Zn26eCEmJqU0Zg=";
  proxyVendor = true;

  preBuild = ''
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -6,7 +6,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.8.7";
+  version = "3.9.1";
  format = "pyproject";

  # Fetch from GitHub in order to use `requirements.in`
@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "Flexget";
    repo = "Flexget";
    rev = "refs/tags/v${version}";
-    hash = "sha256-WfOLDTwmHPfg4UkrPC7gvDNJtAorrateQ4W59NmhdHc=";
+    hash = "sha256-XXmqDZJ5rjoBarhIYlzC2O9jf97SWJiILWLsHDgM78Q=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/ferdium/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ferdium/default.nix
@ -3,17 +3,17 @@
 mkFranzDerivation rec {
  pname = "ferdium";
  name = "Ferdium";
-  version = "6.4.0";
+  version = "6.4.1";
  src = fetchurl {
    url = "https://github.com/ferdium/ferdium-app/releases/download/v${version}/Ferdium-linux-${version}-amd64.deb";
-    sha256 = "sha256-zIGtGmCtQn26rxDsZfPKUZAFnBaWYRhfVJdazPyZ/g0=";
+    hash = "sha256-Oai5z6/CE/R2rH9LBVhY7eaKpF8eIIYI+3vjJPbq+rw=";
  };

  extraBuildInputs = [ xorg.libxshmfence ];

  passthru = {
    updateScript = nix-update-script {
-      extraArgs = [ "--override-filename" ./default.nix  ];
+      extraArgs = [ "--override-filename" ./default.nix ];
    };
  };

--- a/pkgs/applications/networking/iroh/default.nix
+++ b/pkgs/applications/networking/iroh/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "iroh";
-  version = "0.4.1";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "n0-computer";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "bNuTEsbOx7ERH/TigLKVOV6eUF+5C2w3PDH9KkfajBo=";
+    rev = "${pname}-v${version}";
+    hash = "sha256-p1OvXso5szo8ZCnCTKgDzCEMJgiePXQMhVYOkWVZrbE=";
  };

-  cargoSha256 = "WgpX8hz19mnmDmqErSuNDUiFUpr7/K46g4ylhvDIqVw=";
+  cargoHash = "sha256-QqMBEYaIQ6PqO7w7Yd1jVr0zHARsVaJtZzWytmDksZQ=";

  buildInputs = lib.optionals stdenv.isDarwin (
    with darwin.apple_sdk.frameworks; [
--- a/pkgs/applications/science/biology/bamtools/default.nix
+++ b/pkgs/applications/science/biology/bamtools/default.nix
@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, jsoncpp
+, pkg-config
+, zlib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bamtools";
+  version = "2.5.2";
+
+  src = fetchFromGitHub {
+    owner = "pezmaster31";
+    repo = "bamtools";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-l2DmA4P1kPneTCL9YVACE6LcQHT0F+mufPyM69VkksE=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    jsoncpp
+    zlib
+  ];
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "C++ API & command-line toolkit for working with BAM data";
+    homepage = "https://github.com/pezmaster31/bamtools";
+    changelog = "https://github.com/pezmaster31/bamtools/releases/tag/${finalAttrs.src.rev}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ natsukium ];
+    platforms = platforms.unix;
+  };
+})
--- a/pkgs/applications/science/math/calc/default.nix
+++ b/pkgs/applications/science/math/calc/default.nix
@ -10,14 +10,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "calc";
-  version = "2.14.1.6";
+  version = "2.14.3.5";

  src = fetchurl {
    urls = [
      "https://github.com/lcn2/calc/releases/download/v${finalAttrs.version}/calc-${finalAttrs.version}.tar.bz2"
      "http://www.isthe.com/chongo/src/calc/calc-${finalAttrs.version}.tar.bz2"
    ];
-    hash = "sha256-zlmzCCltGB3ipgWBF9vu2szmAZguPDiR2K3xdTnWf0A=";
+    hash = "sha256-4eXs6NDfsJO5Vr9Mo2jC16hTRAyt++1s+Z/JrWDKwUk=";
  };

  postPatch = ''
--- a/pkgs/applications/virtualization/aqemu/default.nix
+++ b/pkgs/applications/virtualization/aqemu/default.nix
@ -1,27 +0,0 @@
-{ mkDerivation, cmake, fetchFromGitHub, libvncserver, qemu, qtbase, lib
-}:
-
-mkDerivation rec {
-  pname = "aqemu";
-  version = "0.9.2";
-
-  src = fetchFromGitHub {
-    owner = "tobimensch";
-    repo = "aqemu";
-    rev = "v${version}";
-    sha256 = "1h1mcw8x0jir5p39bs8ka0lcisiyi4jq61fsccgb9hsvl1i8fvk5";
-  };
-
-  nativeBuildInputs = [ cmake ];
-
-  buildInputs = [ libvncserver qtbase qemu ];
-
-  meta = with lib; {
-    description = "A virtual machine manager GUI for qemu";
-    homepage = "https://github.com/tobimensch/aqemu";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ hrdinka ];
-    platforms = with platforms; linux;
-    broken = true;
-  };
-}
--- a/pkgs/applications/virtualization/ddev/default.nix
+++ b/pkgs/applications/virtualization/ddev/default.nix
@ -0,0 +1,43 @@
+{ lib, buildGoModule, fetchFromGitHub, testers, ddev }:
+
+buildGoModule rec {
+  pname = "ddev";
+  version = "1.22.1";
+
+  src = fetchFromGitHub {
+    owner = "ddev";
+    repo = "ddev";
+    rev = "v${version}";
+    hash = "sha256-3uDdp827noiY6P7VSBXM34MTe9+MCEkNtuRQ3eFoBnk=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [
+    "-extldflags -static"
+    "-X github.com/ddev/ddev/pkg/versionconstants.DdevVersion=${version}"
+    "-X github.com/ddev/ddev/pkg/versionconstants.SegmentKey=${version}"
+  ];
+
+  # Tests need docker.
+  doCheck = false;
+
+  passthru.tests.version = testers.testVersion {
+    package = ddev;
+    command = ''
+      # DDEV will try to create $HOME/.ddev, so we set $HOME to a temporary
+      # directory.
+      export HOME=$(mktemp -d)
+      ddev --version
+    '';
+  };
+
+  meta = with lib; {
+    description = "Docker-based local PHP+Node.js web development environments";
+    homepage = "https://ddev.com/";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    mainProgram = "ddev";
+    maintainers = with maintainers; [ star-szr ];
+  };
+}
--- a/pkgs/applications/window-managers/gamescope/default.nix
+++ b/pkgs/applications/window-managers/gamescope/default.nix
@ -33,7 +33,7 @@
 }:
 let
  pname = "gamescope";
-  version = "3.12.0-beta10";
+  version = "3.12.3";

  vkroots = fetchFromGitHub {
    owner = "Joshua-Ashton";
@ -49,7 +49,7 @@ stdenv.mkDerivation {
    owner = "ValveSoftware";
    repo = "gamescope";
    rev = "refs/tags/${version}";
-    hash = "sha256-31zGo22Z0+zQ81LmzI+Xif9eREzRpS0S9+nK1i/cBCY=";
+    hash = "sha256-eo3c+s+sB20wrzbe2H/pMAYdvKeYOpWwEqmuuLY6ZJA=";
  };

  patches = [
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -189,7 +189,7 @@ stdenv.mkDerivation {
    # Binutils, and Apple's "cctools"; "bintools" as an attempt to find an
    # unused middle-ground name that evokes both.
    inherit bintools;
-    inherit cc libc nativeTools nativeLibc nativePrefix isGNU isClang;
+    inherit cc libc libcxx nativeTools nativeLibc nativePrefix isGNU isClang;

    emacsBufferSetup = pkgs: ''
      ; We should handle propagation here too
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -5,7 +5,7 @@
 , closureInfo
 , coreutils
 , e2fsprogs
-, fakechroot
+, proot
 , fakeNss
 , fakeroot
 , go
@ -777,7 +777,7 @@ rec {
      fi
    done
    # Copy all layers from input images to output image directory
-    cp -R --no-clobber inputs/*/* image/
+    cp -R --update=none inputs/*/* image/
    # Merge repositories objects and manifests
    jq -s add "''${repos[@]}" > repositories
    jq -s add "''${manifests[@]}" > manifest.json
@ -887,6 +887,13 @@ rec {
        });

        contentsList = if builtins.isList contents then contents else [ contents ];
+        bind-paths = builtins.toString (builtins.map (path: "--bind=${path}:${path}!") [
+          "/dev/"
+          "/proc/"
+          "/sys/"
+          "${builtins.storeDir}/"
+          "$out/layer.tar"
+        ]);

        # We store the customisation layer as a tarball, to make sure that
        # things like permissions set on 'extraCommands' are not overridden
@ -898,21 +905,14 @@ rec {
          nativeBuildInputs = [
            fakeroot
          ] ++ optionals enableFakechroot [
-            fakechroot
-            # for chroot
-            coreutils
-            # fakechroot needs getopt, which is provided by util-linux
-            util-linux
+            proot
          ];
          postBuild = ''
            mv $out old_out
            (cd old_out; eval "$extraCommands" )

            mkdir $out
-            ${optionalString enableFakechroot ''
-              export FAKECHROOT_EXCLUDE_PATH=/dev:/proc:/sys:${builtins.storeDir}:$out/layer.tar
-            ''}
-            ${optionalString enableFakechroot ''fakechroot chroot $PWD/old_out ''}fakeroot bash -c '
+            ${optionalString enableFakechroot ''proot -r $PWD/old_out ${bind-paths} --pwd=/ ''}fakeroot bash -c '
              source $stdenv/setup
              ${optionalString (!enableFakechroot) ''cd old_out''}
              eval "$fakeRootCommands"
--- a/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
@ -24,6 +24,13 @@ npmInstallHook() {
        elif $typ == "object" then .bin | to_entries | map(.key + " " + .value) | join("\n")
        else "invalid type " + $typ | halt_error end' "${npmWorkspace-.}/package.json")

+    while IFS= read -r man; do
+        mkdir -p "$out/share/man"
+        ln -s "$packageOut/$man" "$out/share/man"
+    done < <(@jq@ --raw-output '(.man | type) as $typ | if $typ == "string" then .man
+        elif $typ == "list" then .man | join("\n")
+        else "invalid type " + $typ | halt_error end' "${npmWorkspace-.}/package.json")
+
    local -r nodeModulesPath="$packageOut/node_modules"

    if [ ! -d "$nodeModulesPath" ]; then
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "26.0.2";
+  version = "26.1.0";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1mlicv98ih9kjd0rnr7kzxzyy96d2vgajlgk4gh3hyn390wkcz78";
-  iosevka-aile = "0qy84wiqkazja6bs9r763zk3xp12183ijz9gqf0v0xj74qymrwax";
-  iosevka-curly = "1lrh0666vr10n7n924w36qa5bh0w7rqrf3irx0fmwzgsk24zn8d1";
-  iosevka-curly-slab = "15zz7czs5rf5y6c5mr7i5ds69f9kqdwyzsivy5i3qi4iz1jakf29";
-  iosevka-etoile = "16kpki6xvdhjlz7v2gdfyjvv4apby68b66913igd5d8zjd85k47n";
-  iosevka-slab = "0gcv3198802h1kzy2m90hb3kj3p4y50bld7j1gprif3d8mp6an9r";
-  iosevka-ss01 = "09if5d5g4kwlfn5s9hyyrpd1g9fjm2wxj6kbq1s9x28wq7n6xgz8";
-  iosevka-ss02 = "1a4978p6j1fp68qfh0baykg47gssz68bcjkhwn1sb2i99fr37qng";
-  iosevka-ss03 = "0gfg97jf1s2zkc0grlg15bzzxn1z9l8g0x7pg58igr1i2d4x2gvb";
-  iosevka-ss04 = "0clhiydpqs146zv8flqa185b0rgfrj2ifls5fzlvpnba2q223wz3";
-  iosevka-ss05 = "0gxvb19awcj6f41196r1q3ghgm87y0y9j9sfi533f5ny7088mliz";
-  iosevka-ss06 = "14v4962qqbxy5r5kyzq372ckqhzx6l0kmc3xpqxf9fpvfjk89a2y";
-  iosevka-ss07 = "0n2ykrjrfixyildpmi4i1hpj9bsckskgkk3zd3acm2fmpxljvc9n";
-  iosevka-ss08 = "0p9wm3ydvqi0hvayg3mh7841k8rjl2j59qf5m3q4vz8bpbyn80g4";
-  iosevka-ss09 = "1z43l6dlxhh0qrnwd1l93dm5xdvw2jfdsp7fi754r9jc1c3pyamz";
-  iosevka-ss10 = "19nrvx6j9kxxvql6c88rnq6vnnacd0k6lgxg70306zdd7j6g2g1f";
-  iosevka-ss11 = "0jp65j6wqinwmkb412bzjxpb4py6z0kvmm68psgdcl0962w1j806";
-  iosevka-ss12 = "01azishdfz1k202ss1vdz1vl88qn0vsfh9kx53mzin83nqfnqym0";
-  iosevka-ss13 = "1w7syx42y6i6xkxhylc4ybr95ffs9dqhllziyv7dv8p9k1sq9b5v";
-  iosevka-ss14 = "1mplavdlqqclsyjbsh91c8bmbhm0cli6y10f3p6rxjjy16536y24";
-  iosevka-ss15 = "1j6f566l0ppynqvfiq68rb5facmapwj1wbp37xpnswhbh5jilc2h";
-  iosevka-ss16 = "1xxg98mx7m9slm4a1zyrl8lp6n12gbgz79vwd21lanq6bw3l0ki3";
-  iosevka-ss17 = "05bvcw7zpisfpagy54fy2985kscp4466q1fvxn28wb1sw0m6gnvy";
-  iosevka-ss18 = "19lg2xlz3pjcprmni8mc57z9kh28qxap4d94102qzpqb4krfhj07";
-  sgr-iosevka = "0gj6cq0adj0ph85ml205n8wqjimkaqm4yqxgfg02ddk2h3ss97g3";
-  sgr-iosevka-aile = "1vsxdqrxy5qgqry3zskbqpimb3l9950j9yws9zb0jga3v77blwy1";
-  sgr-iosevka-curly = "0dwl6s0pnr4xhl3pgphh3jddz80b9gwcais8fn56hc7x0dkni585";
-  sgr-iosevka-curly-slab = "1fxr7d7rhpm07db5r3qc5bmks05dr9pa2yzk4h3i4zvkpw7gzwd7";
-  sgr-iosevka-etoile = "0dwjywirg5b4ia93kg6cdbyjhk5n171yjb0x2sq6npfq0ywzn8fk";
-  sgr-iosevka-fixed = "0fa9s91p64w3z2pkypy7p5a7srha75c0vi4n4cy8qm2lbx7pgvkh";
-  sgr-iosevka-fixed-curly = "0sdxnsbhsr7kl6f8sb701hcadg1dlq2adkmd9ljg9x8kf8qyjbk4";
-  sgr-iosevka-fixed-curly-slab = "0xc7qxbcxdwnr0nl48mxxmjm7i66rksp7pka522i764yagv2gaf7";
-  sgr-iosevka-fixed-slab = "1fxv28gi3bdihckznsqna5r5d3yzkfqgnidcngb4v9wmvvzxdbjv";
-  sgr-iosevka-fixed-ss01 = "0gynmpnrsj757r9kcznx41lsfpji30xc0c8y3gd8i2zbjps0akrz";
-  sgr-iosevka-fixed-ss02 = "10kplc1xwg5r11j526ax2vjkyqfabxhfa2azzj1hy4cmqqzjxqzg";
-  sgr-iosevka-fixed-ss03 = "0hg1wcnaxcf6xd21xsf6bhm6w0ksj7fl3k6q7nj3j348pfzxw4xj";
-  sgr-iosevka-fixed-ss04 = "0j7lcrda9n865r1vyrx9qc89wnxc6lf3xly28bk856cjf6z84q5d";
-  sgr-iosevka-fixed-ss05 = "0w0cfl8bqcbgw8q6rf0vwngcx7x6z2shk4cysk70nkkmhc584r4r";
-  sgr-iosevka-fixed-ss06 = "0kkhc8w52dgp0skb4sbr5z3i9s0rdhmmx88qs27j3wdlwryk8m08";
-  sgr-iosevka-fixed-ss07 = "1pf70s6cg4ppah985sn0rl7ri5y0xs9y1svcf5a57bp84wc0h8dl";
-  sgr-iosevka-fixed-ss08 = "13iannimij20igm71725l22wqfaq5w6c1m2vjz5hmcxrh7nmfsn5";
-  sgr-iosevka-fixed-ss09 = "1nb8xgn95x07jxxxfy39rwlkpb8w20qxnaz15l4kzxfjlwwwgcwl";
-  sgr-iosevka-fixed-ss10 = "0dbbchg8lmkpjqw8yn052qpmk00vb1bwcar7nwlhr93vy4z8y72h";
-  sgr-iosevka-fixed-ss11 = "1ljkr3ld4zv7f33xy5xx5wzrypzxzkpwv01cmc5w349dwbza9fpc";
-  sgr-iosevka-fixed-ss12 = "11wvz3g45l589nnljawp9avz80jbv64df6i0mhgb3ln8n7mx7y7g";
-  sgr-iosevka-fixed-ss13 = "1qb9xspdcadsmvb5ghi555bkj1x8iv0dw00yvxs4mzw7rgq47rrb";
-  sgr-iosevka-fixed-ss14 = "17xig4lm02xg8r19pfn5lc45qbc7j4h1q79lcp5w4ym83wmfcsq6";
-  sgr-iosevka-fixed-ss15 = "0ivy6d8xmm3yl0n2zy58z9jbkbwv5wagdnk70vszp1ln9vsgbnfn";
-  sgr-iosevka-fixed-ss16 = "1jbr1cf0wmqg164z0i16rgn0qjpll9qyw5ch5p225a25pfkk4sbv";
-  sgr-iosevka-fixed-ss17 = "1zz3drhw9k3ckn2x460v4m033j7shjy082d3hhwkadfwgpy7cbny";
-  sgr-iosevka-fixed-ss18 = "0qvm24y2c248rwhcyy7fv1930dnsbs1sa23q5w94g7xw94pigq4z";
-  sgr-iosevka-slab = "1ln6kx0cn2f9lz0jiz2qq3bb3vkxzpcw2jn52wxpq3pa55fmh9xw";
-  sgr-iosevka-ss01 = "1vimfq19c0hf3vysi6agyplnshzbkg3hprslrlrcqv6pafhc0j4m";
-  sgr-iosevka-ss02 = "1l4wfi2s47pxsdhlif7h9rgdqmj8dxswbpmrwghad1vpi09s9q33";
-  sgr-iosevka-ss03 = "078vckd5hsmvnpyh54yzab7pbxlsqrr0h4phyhnpzsmqgg483kwm";
-  sgr-iosevka-ss04 = "01z2f6qddl6d5k8k9v6xpry6wihr9w8b7chy1n8zvli52p5mbww7";
-  sgr-iosevka-ss05 = "0bvjr0nh1j8wb2xs91z32vxxzwhkjwbpkpz8l8mwf1a0hlaqpbar";
-  sgr-iosevka-ss06 = "1lpnvjdw6qzs5l473fwx4vk2xxwxkbfw4rfkvml3i60rs655nmy6";
-  sgr-iosevka-ss07 = "01jbma445cyr6acic4qafjkxfl9q7bbn0ngvx7s5bxmc6xv3hnaf";
-  sgr-iosevka-ss08 = "1vxlc5m4pwydy9zcam47494vx52c7h0nfp6f7z4iqpfshv0nnyp6";
-  sgr-iosevka-ss09 = "0w5qfwpxagls74s0b98grd9in4m947fmrw6nn215zhp0zj2mfwi6";
-  sgr-iosevka-ss10 = "1fwbyis93kdjc62vp701rr6vpfw2an1xznpnm0aifafnz6rl5zfg";
-  sgr-iosevka-ss11 = "081gj3b1b669vc38l6gpwagk7afd7338d04jqprx5savz9a9nfs7";
-  sgr-iosevka-ss12 = "09hc5vnvkymlrirjy3rszxb64n55c7a359vs5lfgcsmrf08z35xw";
-  sgr-iosevka-ss13 = "0qzzs4rgny8habxxrjqqnfigh6pcx15hcgi9z29crs5sskmcsp2s";
-  sgr-iosevka-ss14 = "004rcv0g0916c7vrkb796zck9sywhsdrd5z1kx1v8v9gyxlgv46z";
-  sgr-iosevka-ss15 = "1yn6alx6ppgrgfzhmgsiwmw7rrvj7ad7yss5yqwbas6k9n70j5ki";
-  sgr-iosevka-ss16 = "06h59vvl0vcrb5r24y22cwhdmcpi0wn92daz3ak739x52qnc9dll";
-  sgr-iosevka-ss17 = "0c8s66lb7mp0zya12mcxdfy05jhwwi78fwm35lnk1xkarbzrdwq8";
-  sgr-iosevka-ss18 = "00k036viav27far3jbmh7zpawccnmg9qh93v5d6wz6b7l2h7mwam";
-  sgr-iosevka-term = "16bwjvamhaq7bcl2dkvv79asn68bdzqkii7q1h5sc3jvzhd0v6sz";
-  sgr-iosevka-term-curly = "0scrz4yfs7v26vyjcd35p2jgbqj4phasr6yswc0xlc7l19x9z91v";
-  sgr-iosevka-term-curly-slab = "0551npqdascnn4crd9drkfx8mw4gfjqrvn2112diqn5q4rlpgyrn";
-  sgr-iosevka-term-slab = "0gjr5lw1aj4vskv5kkbgahfhn7aqh4qdlnv9560c2laaxfs62zdh";
-  sgr-iosevka-term-ss01 = "08gh7rsyj1pl444g5crfm2rjnxk9kqqd6svvzqalaq5j3pgdk7mb";
-  sgr-iosevka-term-ss02 = "1x4swlfrjazkxbryb1rswjg9wiqjypdyzwvab1875g0ian6zl293";
-  sgr-iosevka-term-ss03 = "1cp2z0spb0q9n7xi370hvz2lw7rrwly6cicww0k8x6mzd67n7jyr";
-  sgr-iosevka-term-ss04 = "1z7njiz4j98liqg9d4mp6f9zlw7r1kqwl41lhh1r9vb8nx8b64xi";
-  sgr-iosevka-term-ss05 = "0nwfhrm22wl402j3nzff7zb9v7w9fgg5njivhm3r23lllh368ga9";
-  sgr-iosevka-term-ss06 = "1j56gpp7680f2kq0d28nz9nfcz6hq08vq613f0d3c8vln6pmk082";
-  sgr-iosevka-term-ss07 = "1wsi14f6lkkvvvf4cwzdc6six821r2izdgwa7yd96fdk4l3jc357";
-  sgr-iosevka-term-ss08 = "0w4hb53dyr9mwrxghr62gc36s8sqbrfhw4088zar9jz5w8clsrr6";
-  sgr-iosevka-term-ss09 = "0ym37rrfi23rbshnv8hi9acx7gf4zs70m6pr2gy556w8bb95dw66";
-  sgr-iosevka-term-ss10 = "093ca1i94dk16zvbxnw41g80krfmi946gwvzbfw8a9nmx5krcvx6";
-  sgr-iosevka-term-ss11 = "03s2wiwlx6k676jqidgc78rpxm1c4dc194k2lk5704jxvysv5i3x";
-  sgr-iosevka-term-ss12 = "1wq4i66zxwgc7n2zqwc2x05fmxpg6yqm9f0ll9balih1al0qvwb6";
-  sgr-iosevka-term-ss13 = "169fwn82lippqs9rnil0mibn25mzkmxm6rgnhs61lp4z7srqd5h9";
-  sgr-iosevka-term-ss14 = "05mw5hav1xin4xycbfdjpw4j62ixckkd6bw0nl5dnq3ji33v0skg";
-  sgr-iosevka-term-ss15 = "1mpmkvsk8y1a8i4c2dwqglxm46rgkqmd2y68wyik0asa8vrfflv6";
-  sgr-iosevka-term-ss16 = "051hxw063d29m59971zbcsfj26ch0sk1cxv503xm86ilblmj54dj";
-  sgr-iosevka-term-ss17 = "0mlp1kbn298w0mwfyfbmzkfwbf7cibchb3f0l8mk833lvxjxxiaz";
-  sgr-iosevka-term-ss18 = "0v5j17y5hpg56h2kdz1469k56358k7g0wqxl4nd1ib3j0y7jndsc";
+  iosevka = "0698fzf03nss7wkaa0i3kp8f5f1gjbsknz18px616g7c3bgss582";
+  iosevka-aile = "1vaiznxyil5a4gc2hy1k1164fn15rk3814lwf5av830323rc7and";
+  iosevka-curly = "1rnyxbz62v34hbnaj3r74pl1ahk539b7bh0x175lv9j0fwrm73is";
+  iosevka-curly-slab = "1gcmzsh35ayb3bmrkcdpxii3l8r7qg0yvxjy37y2hp544f2drnkp";
+  iosevka-etoile = "0v3y8cr0w2q1xa4nmwmrh5rcxcfjj38rq6gwqsbvs2rlxls50yi4";
+  iosevka-slab = "179fydcaf72z01i9d54m7biq6i472rl84nsxghbmgrzghyblxck6";
+  iosevka-ss01 = "18b9cd95q2rnbm762mcfqqcqkffmw895khmsxqsd1dmkb9gj509w";
+  iosevka-ss02 = "1gg06d76yl2lv6lpcd9vszqf2yb3rz2w032ih9rjid1wcxccnn62";
+  iosevka-ss03 = "0hqwrqzvikb2xkgmn4zff8jw1czvm6zawf37hz2hnwnx0ffgzhz0";
+  iosevka-ss04 = "1gq79pfhwrag686r8symivn54pwcnnp5rxwyfswfyq72x6xxq0ri";
+  iosevka-ss05 = "1di9v2ka7v8l7gglv29zfrp3p7aznqnkwkzdn6pqz91p7y0kd1ck";
+  iosevka-ss06 = "0m7gazz4cq544qyv37mg08j0b1jv7vf1af17snxypzg6gi3l9l79";
+  iosevka-ss07 = "1nlxbraigk6wz46jr47zs3drsv87f4rviscfi6pa2x70fqfvxcvd";
+  iosevka-ss08 = "1ch3c27nzhnnn87jsl5rpl8cpnqdn8zsh2hfch0nkh8y8s6hc6jk";
+  iosevka-ss09 = "0gk0lm2212whr73ydjj0wdmjrvzp5mcawg7c035cyzfj4r35mh7l";
+  iosevka-ss10 = "0d7988z1zsqavd5j2vphkcyy98cfc7bam2bbh62qr99k7321y9dh";
+  iosevka-ss11 = "0a89wmn5f1a97rvl2fa7slqw95mx1a95i5jjrbdslwifycrbv0j8";
+  iosevka-ss12 = "065l9bnhjcracyz73y57mv9bxhxlakvgy2xjwmrayg9a8mnqdl40";
+  iosevka-ss13 = "15miz16fsrl21y2c63gvkngbm7v99s5w9wzcb6x2pl3whfwdm5hh";
+  iosevka-ss14 = "1sbm3m61m4k1wz588axm1w94869fxh0y06gldwivnz460cads42j";
+  iosevka-ss15 = "0w8xm6vv8k95rw5q81d2nw34hllbjlixfqwvrjyj0gpxxw8kkcgy";
+  iosevka-ss16 = "1y64daxpbjwjsakkya9j1x9inn7kq1dpy0y1mldig2dd7i5f49rd";
+  iosevka-ss17 = "1pads0rraq6dxgbra6ss5ilxil988ypcwgfiild9pzb8y5ljgvqr";
+  iosevka-ss18 = "0vf7nvawm9yaip2nvsxc56br1v5q7dqk39i9c813ff5bakwkskiw";
+  sgr-iosevka = "08wrm2ynkw95n7762ay2iak15bj15j0v60pw6p29s5q2fli3cdlj";
+  sgr-iosevka-aile = "117fz5a2p9q1mw6221b04xq4x16lnp6p54vm53jz01pd5s0yg7zn";
+  sgr-iosevka-curly = "1lmp69ppzc7vzi11zlk2y2wg74m19w0jwq482ax024bgm939fxvr";
+  sgr-iosevka-curly-slab = "00gi8i7rq14s1yaz37x2vnxrg78rj1mxfxcii1q1bdmzpnxzvlsh";
+  sgr-iosevka-etoile = "1hw7xfhb666k5n3ay17b33lg09cvsq9wibbgy2x1mmxv1dwxswi8";
+  sgr-iosevka-fixed = "069j0q2g8qdg7akycxsclgxknifg26xd392wcfvm9hwj4j3yscw0";
+  sgr-iosevka-fixed-curly = "1f3gfvkpng044s40pvhw8xmrbdayphav7jnbif3y87ipb2vkah02";
+  sgr-iosevka-fixed-curly-slab = "1zpwqmhck2ym4nh2d4rixqyg7n1jq7xnrqndnjs24nkzk41kg793";
+  sgr-iosevka-fixed-slab = "0bvnp6szadwwyn2l8hms6wfv2pvncb67y4gw9xnwz3xzfwin53bn";
+  sgr-iosevka-fixed-ss01 = "1v8xnyfvq9gjk7xxk465iam2mjb13rj1yibiacp26cn7pz29rdqi";
+  sgr-iosevka-fixed-ss02 = "0ygy6124896cacpqgnpckxw5h9qj8z61drmkcrwk55qjs2gnzgky";
+  sgr-iosevka-fixed-ss03 = "07z7wqg9hgf47aqlb2rqbww9nvr8yhvsaibjmab4xp0c9spibgc9";
+  sgr-iosevka-fixed-ss04 = "1chfswa79zbw1p47dqlh176aq7vrvyziflzm4w30ribk86p6z17d";
+  sgr-iosevka-fixed-ss05 = "0nqqffadk65six8xa6gy3as7ir84lb2gs3bii75iwzy84xiw4ky3";
+  sgr-iosevka-fixed-ss06 = "1996bmsvjs4x35wx98qb7qp998gj1w718kp7rpalls7460796lb8";
+  sgr-iosevka-fixed-ss07 = "0bmrfw0kwdar7ah7pwdf5i7lzgrxfqjwzw8962n801znngccy90d";
+  sgr-iosevka-fixed-ss08 = "03l0gzrivsy8jrdyvyhl5cv6ndk85p9lxfpzkjbhf29dxbd2wg5q";
+  sgr-iosevka-fixed-ss09 = "0dmg5nr23kx3b8cqiha8a8hhq7dysk4s8zwg8c2xwymm39sh77bg";
+  sgr-iosevka-fixed-ss10 = "0kg4bbn9r500fwirr9glwyd26hwyzlplhxmjbzbkqwa39zwl6h1a";
+  sgr-iosevka-fixed-ss11 = "1my2kf7hvara3xv1x5qq8vvr6ywq7w17b0phy63mbn6qc4k179xl";
+  sgr-iosevka-fixed-ss12 = "0g9xkp0l2wadxni5ax0ir2qh7cp4924xa57k33lk25i8pgc4bban";
+  sgr-iosevka-fixed-ss13 = "0jhvfffh6i8g817z594dg7igawxfbwn3dv11xhh2rac9njxyiz3m";
+  sgr-iosevka-fixed-ss14 = "1c1sxyzdipr025zkabxsy5m2aplnpj1sv62bp54w86xaddj3386i";
+  sgr-iosevka-fixed-ss15 = "14a89q4gys44bng51nbnl6z5dhzddx8pnwl4l3l2qkjlqja1f4jr";
+  sgr-iosevka-fixed-ss16 = "04r4aljb9ikd3i4pxniyrlybx29l6v52q80kcg59ymaa20gaqadr";
+  sgr-iosevka-fixed-ss17 = "1ia45a47n5gxrfin48xyfgz0r7nkj66hz27vl4lkzvscv75igqmp";
+  sgr-iosevka-fixed-ss18 = "0mbz6d8w9ija55nh7vdp24hi6i5fs0d5bfm3580yx1a2iphrkwbr";
+  sgr-iosevka-slab = "1xnz4jhxap7lmvxqrngsvsmafdi026v3rzrmya28f3iwq37d6kf8";
+  sgr-iosevka-ss01 = "1vwm199q642d90l52k3jvaz9acqq7i6wk8bpnfq94xl1d8z2jl4g";
+  sgr-iosevka-ss02 = "0l6igwh9g0y9x8lwyvdn6x6qakv8gvlswi3148ghwp0d8hxwy79v";
+  sgr-iosevka-ss03 = "1a8vfdzcq2dikv48ccl3smn0kw2w88ddgwi3hr68x8jp84rpjg6c";
+  sgr-iosevka-ss04 = "19gj3wpqzhhnnmrmyz4jpnz0db397bx433agy0hmyjnk50vdbw5w";
+  sgr-iosevka-ss05 = "0wg2fr10bwmmm1bhjrwadfrvzvbwcayjfg49791x9gzkdvxmc1y9";
+  sgr-iosevka-ss06 = "1jkcl6ngkdkr9v2x6lsslxfqbn9kn9zmw504ihfl4dii84rk8l83";
+  sgr-iosevka-ss07 = "093bhgh1lvabf3xmh8flsy1daabmq1hq4j1czhbqcairzjlk30i2";
+  sgr-iosevka-ss08 = "1a9l4jlndsf6bdy7cy0c1x23cdms3aw0gq43k9nv2k19fn5mklmc";
+  sgr-iosevka-ss09 = "0bcr8mrb958470ilbla9xpmlgf03g0x4rfzz72lr2aln8rja5sdi";
+  sgr-iosevka-ss10 = "0lnj2v6hng13wmbf55kar8yzj6c11adkh2x1j6s3nfz18gbaa4yg";
+  sgr-iosevka-ss11 = "111nbmwrvxd4yzjnbv0vp7hlgbif4zycbiw4ll8zqnibqf3zynb6";
+  sgr-iosevka-ss12 = "1n8jy9haqd9xg14szl0k2fbxxydkkb2z5lighsh569qjcjh17vyw";
+  sgr-iosevka-ss13 = "1kdq1xwwvcf8gi3122sg211dgijk0q72zxbpxk1cj3f2cimbi87h";
+  sgr-iosevka-ss14 = "1i4f6k7gpzzxkia81qfkhx9rwzpg29n9k3i3lbqf0y9fj01kwgax";
+  sgr-iosevka-ss15 = "0agzapx40qv0pixxijfa5m94w5p90adjyfh0qp4kx37hvidzcplq";
+  sgr-iosevka-ss16 = "0lc4bs89g2840m0mkcxagc694mx5ydh2zvcrvh1316snz6gqmqbv";
+  sgr-iosevka-ss17 = "0wsd2jck9pgrivr93d64krkdkqdwm21mgz52pijwr51bwci41xy3";
+  sgr-iosevka-ss18 = "00ml8w11n9dc5ykraz3hcacwvhsjx1z100risi3aw81vfwq0z1xg";
+  sgr-iosevka-term = "0zvpj73ddk36g9ggw2bngmhzpdixpnnjhvzzyw7ff4xbgaxlkrrs";
+  sgr-iosevka-term-curly = "0b0a2ipjwj1mf2042658z6rsnn5jiva32aw9wrq7rs56p7drf33c";
+  sgr-iosevka-term-curly-slab = "0dvh9kykb80p6g689wxcfsxya9n959j3l7a9q9bz92nddyny45wp";
+  sgr-iosevka-term-slab = "06mbfcjcghd5dc3k2y1bf39xhdni7dvsasm3rgj0cjzylg7c9rkv";
+  sgr-iosevka-term-ss01 = "0bpqbnp2njn8q1vqpy3iaqxzwm4zb50spyk1drdnk5v4j8rnxr86";
+  sgr-iosevka-term-ss02 = "0g3kdwlaii8vja3p5y91pmawzj7hn59y35gixvgkqpnrkpp3y6bm";
+  sgr-iosevka-term-ss03 = "139psybgajsyszpz811kxvgfi08ia54dk011dx359kk6gj72wmnz";
+  sgr-iosevka-term-ss04 = "0aix3x98id9zc86qmbmbqh60a9s6928y26lcz1sms88p2nnnliqp";
+  sgr-iosevka-term-ss05 = "10gbkay5fff1k91r1jhibh3gialif6m7fyqlw5sphjxn75qpkxm4";
+  sgr-iosevka-term-ss06 = "0bxachp1qsnzgavap30nsbqpa75hd5pzk2gfj8l1b6q3cpmvnlyf";
+  sgr-iosevka-term-ss07 = "028fkmz1yb1g30idszz0bdjhsn1iq845pxkf0iwq409y2qs8xh8s";
+  sgr-iosevka-term-ss08 = "11yvq67lql3q249k1b9gdc3g1q48q6sihj62kgk7l9qh4cv3wmnh";
+  sgr-iosevka-term-ss09 = "1r87wznw3nbry0ddl20k7gqxbmiz0pnmf5qb01jfdnhsnq9fdr4a";
+  sgr-iosevka-term-ss10 = "0xivpfm736jp4326bwbcnc7gq2sik3f3r46sqka1r33vvlwmcq0m";
+  sgr-iosevka-term-ss11 = "1j03vhbqgff59qi4sw11y49gkmzamv94vlwicg8idbnqbkxkhr8r";
+  sgr-iosevka-term-ss12 = "0mcixkpb5680f9jrbk4hrzvf7nlh2hppb8ar1w8a1lvx7qyr3wxc";
+  sgr-iosevka-term-ss13 = "19nzxs9r2br3n3ibi15b7acarlgd2mriyzi318dmis0dxfdqd27l";
+  sgr-iosevka-term-ss14 = "18gqq1ysjw8fx9insy06wi7wbfzsha5vcq72j89iac67jlr3qdp0";
+  sgr-iosevka-term-ss15 = "0l5hhq3kcrg7jhzlpsakx150gsn9l9018vydv5ln84lxfg16hc0m";
+  sgr-iosevka-term-ss16 = "0lhq56r8anw2dqny3wgmw0jb8fcsk4idsb7li09m87rkikfd2igr";
+  sgr-iosevka-term-ss17 = "0ylgk2bzxb65cb9rma0a17bz8n1w0r9pk16nlm01bglp79cin9a0";
+  sgr-iosevka-term-ss18 = "0ld3f3a06r4kjbdppx5yml855af3cz2kia124jjzx6x5j5ybn87y";
 }
--- a/pkgs/data/misc/clash-geoip/default.nix
+++ b/pkgs/data/misc/clash-geoip/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "clash-geoip";
-  version = "20230712";
+  version = "20230812";

  src = fetchurl {
    url = "https://github.com/Dreamacro/maxmind-geoip/releases/download/${version}/Country.mmdb";
-    sha256 = "sha256-QXxY/WruYY09LL+OEKhd/EUb+GOI49KFnG75mbwMWoU=";
+    sha256 = "sha256-yO8zSQjNYGxaSXcOhFOIE4HsiMnCm3ZVYfVZg5xO96s=";
  };

  dontUnpack = true;
--- a/pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , meson
 , ninja
@ -11,37 +10,19 @@
 , dbus
 , polkit
 , accountsservice
-, python3
 }:

 stdenv.mkDerivation rec {
  pname = "elementary-default-settings";
-  version = "7.0.2";
+  version = "7.1.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "default-settings";
    rev = version;
-    sha256 = "sha256-YFI1UM7CxjYkoIhSg9Fn81Ze6DX7D7p89xibk7ik8bI=";
+    sha256 = "sha256-j4K8qYwfu6/s4qnTSzwv6KRsk9f+Qr/l1bhLywKMHMU=";
  };

-  patches = [
-    # Don't set picture-uri-dark. elementary-gsettings-schemas won't
-    # aware of our custom remove-backgrounds.gschema.override so it
-    # will be a confusing invalid value otherwise (though gala actually
-    # can handle it well).
-    # https://github.com/elementary/default-settings/pull/282
-    (fetchpatch {
-      url = "https://github.com/elementary/default-settings/commit/881f84b8316e549ab627b7ac9acf352e0346a1a4.patch";
-      sha256 = "sha256-zf2Anr+ljLjHbn5ZmRj3nCRVJ52rwe4EkwdIfSOGeLQ=";
-    })
-    # https://github.com/elementary/default-settings/pull/283
-    (fetchpatch {
-      url = "https://github.com/elementary/default-settings/commit/37ef6062a8651875dd9d927c5730155c8b26e953.patch";
-      sha256 = "sha256-u7rrwuHgMPn1eIyIuwJcBgy8SshaXgrgFTSNm8IHbaY=";
-    })
-  ];
-
  nativeBuildInputs = [
    accountsservice
    dbus
@ -50,7 +31,6 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    polkit
-    python3
  ];

  mesonFlags = [
@ -59,11 +39,6 @@ stdenv.mkDerivation rec {
    "-Dplank-dockitems=false"
  ];

-  postPatch = ''
-    chmod +x meson/post_install.py
-    patchShebangs meson/post_install.py
-  '';
-
  preInstall = ''
    # Install our override for plank dockitems as the desktop file path is different.
    schema_dir=$out/share/glib-2.0/schemas
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@ -142,14 +142,7 @@ in lib.makeScope pkgs.newScope (self: with self; {

  elm-test-rs = callPackage ./packages/elm-test-rs.nix { };

-  elm-test = nodePkgs.elm-test // {
-    meta = with lib; nodePkgs.elm-test.meta // {
-      description = "Runs elm-test suites from Node.js";
-      homepage = "https://github.com/rtfeldman/node-test-runner";
-      license = licenses.bsd3;
-      maintainers = [ maintainers.turbomack ];
-    };
-  };
+  elm-test = callPackage ./packages/elm-test.nix { };
 } // (hs810Pkgs self).elmPkgs // (hs92Pkgs self).elmPkgs // (with elmLib; with (hs810Pkgs self).elmPkgs; {
  elm-verify-examples = let
    patched = patchBinwrap [elmi-to-json] nodePkgs.elm-verify-examples // {
--- a/pkgs/development/compilers/elm/packages/elm-test.nix
+++ b/pkgs/development/compilers/elm/packages/elm-test.nix
@ -0,0 +1,32 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "elm-test";
+  version = "0.19.1-revision12";
+
+  src = fetchFromGitHub {
+    owner = "rtfeldman";
+    repo = "node-test-runner";
+    rev = version;
+    hash = "sha256-cnxAOFcPTJjtHi4VYCO9oltb5iOeDnLvRgnuJnNzjsY=";
+  };
+
+  npmDepsHash = "sha256-QljHVrmF6uBem9sW67CYduCro3BqF34EPGn1BtKqom0=";
+
+  postPatch = ''
+    sed -i '/elm-tooling install/d' package.json
+  '';
+
+  dontNpmBuild = true;
+
+  meta = {
+    changelog = "https://github.com/rtfeldman/node-test-runner/blob/${src.rev}/CHANGELOG.md";
+    description = "Runs elm-test suites from Node.js";
+    homepage = "https://github.com/rtfeldman/node-test-runner";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ turbomack ];
+  };
+}
--- a/pkgs/development/compilers/fstar/default.nix
+++ b/pkgs/development/compilers/fstar/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "fstar";
-  version = "2023.02.01";
+  version = "2023.04.25";

  src = fetchFromGitHub {
    owner = "FStarLang";
    repo = "FStar";
    rev = "v${version}";
-    hash = "sha256-sLhbIGF7j1tH8zKsPq1qOSwHvYDrVCyfln9UbE3IYv0=";
+    hash = "sha256-LF8eXi/es337QJ2fs5u9pLqegJkh1kDLjK8p4CcSGGc=";
  };

  strictDeps = true;
@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
    removeReferencesTo
  ] ++ (with ocamlPackages; [
    ocaml
+    dune_3
    findlib
    ocamlbuild
    menhir
@ -45,8 +46,7 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  postPatch = ''
-    patchShebangs ulib/gen_mllib.sh
-    substituteInPlace src/ocaml-output/Makefile --replace '$(COMMIT)' 'v${version}'
+    patchShebangs ulib/install-ulib.sh
  '';

  preInstall = ''
--- a/pkgs/development/embedded/teensy-cmake-macros/default.nix
+++ b/pkgs/development/embedded/teensy-cmake-macros/default.nix
@ -0,0 +1,35 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, pkg-config
+, callPackage
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "teensy-cmake-macros";
+  version = "unstable-2023-04-15";
+
+  src = fetchFromGitHub {
+    owner = "newdigate";
+    repo = "teensy-cmake-macros";
+    rev = "dc401ed23e6e13a9db3cd2a65f611a4738df3b0e";
+    hash = "sha256-E+BOlsCJtOScr3B5GSv1WM6rFv6cFYvm/iJ893fsmXM=";
+  };
+
+  propagatedBuildInputs = [ cmake pkg-config ];
+
+  passthru = {
+    hook = callPackage ./hook.nix {
+      teensy-cmake-macros = finalAttrs.finalPackage;
+    };
+  };
+
+  meta = with lib; {
+    description = "CMake macros for building teensy projects";
+    platforms = platforms.all;
+    homepage = "https://github.com/newdigate/teensy-cmake-macros";
+    license = licenses.mit;
+    maintainers = [ maintainers.michaeldonovan ];
+  };
+})
--- a/pkgs/development/embedded/teensy-cmake-macros/hook.nix
+++ b/pkgs/development/embedded/teensy-cmake-macros/hook.nix
@ -0,0 +1,17 @@
+{ lib
+, makeSetupHook
+, teensy-cmake-macros
+}:
+
+makeSetupHook {
+  name = "teensy-cmake-macros-hook";
+
+  propagatedBuildInputs = [ teensy-cmake-macros ];
+
+  passthru = { inherit teensy-cmake-macros; };
+
+  meta = {
+    description = "A setup hook for teensy-cmake-macros";
+    inherit (teensy-cmake-macros.meta) maintainers platforms broken;
+  };
+} ./setup-hook.sh
--- a/pkgs/development/embedded/teensy-cmake-macros/setup-hook.sh
+++ b/pkgs/development/embedded/teensy-cmake-macros/setup-hook.sh
@ -0,0 +1,5 @@
+teensyCMakeMacrosEnvHook() {
+  cmakeFlagsArray+=(-DCMAKE_MODULE_PATH=@out@/lib/cmake)
+}
+
+addEnvHooks "$targetOffset" teensyCMakeMacrosEnvHook
--- a/pkgs/development/interpreters/cling/default.nix
+++ b/pkgs/development/interpreters/cling/default.nix
@ -1,20 +1,39 @@
-{ lib
-, stdenv
-, python3
-, libffi
-, git
-, cmake
-, zlib
-, fetchgit
+{ cmake
 , fetchFromGitHub
-, makeWrapper
-, runCommand
+, fetchgit
+, git
+, lib
+, libffi
 , llvmPackages_9
-, glibc
+, makeWrapper
 , ncurses
+, python3
+, runCommand
+, zlib
+
+# *NOT* from LLVM 9!
+# The compiler used to compile Cling may affect the runtime include and lib
+# directories it expects to be run with. Cling builds against (a fork of) Clang,
+# so we prefer to use Clang as the compiler as well for consistency.
+# It would be cleanest to use LLVM 9's clang, but it errors. So, we use a later
+# version of Clang to compile, but we check out the Cling fork of Clang 9 to
+# build Cling against.
+, clangStdenv
+
+# For runtime C++ standard library
+, gcc-unwrapped
+
+# Build with debug symbols
+, debug ? false
+
+# Build with libc++ (LLVM) rather than stdlibc++ (GCC).
+# This is experimental and not all features work.
+, useLLVMLibcxx ? false
 }:

 let
+  stdenv = clangStdenv;
+
  # The LLVM 9 headers have a couple bugs we need to patch
  fixedLlvmDev = runCommand "llvm-dev-${llvmPackages_9.llvm.version}" { buildInputs = [git]; } ''
    mkdir $out
@ -58,7 +77,7 @@ let
    ];

    nativeBuildInputs = [ python3 git cmake ];
-    buildInputs = [ libffi zlib ncurses ];
+    buildInputs = [ libffi ncurses zlib ];

    strictDeps = true;

@ -69,6 +88,7 @@ let
      "-DLLVM_MAIN_INCLUDE_DIR=${fixedLlvmDev}/include"
      "-DLLVM_TABLEGEN_EXE=${llvmPackages_9.llvm.out}/bin/llvm-tblgen"
      "-DLLVM_TOOLS_BINARY_DIR=${llvmPackages_9.llvm.out}/bin"
+      "-DLLVM_BUILD_TOOLS=Off"
      "-DLLVM_TOOL_CLING_BUILD=ON"

      "-DLLVM_TARGETS_TO_BUILD=host;NVPTX"
@ -78,14 +98,22 @@ let
      # see cling/tools/CMakeLists.txt
      "-DCLING_INCLUDE_TESTS=ON"
      "-DCLANG-TOOLS=OFF"
-      # "--trace-expand"
+    ] ++ lib.optionals debug [
+      "-DCMAKE_BUILD_TYPE=Debug"
+    ] ++ lib.optionals useLLVMLibcxx [
+      "-DLLVM_ENABLE_LIBCXX=ON"
+      "-DLLVM_ENABLE_LIBCXXABI=ON"
    ];

+    CPPFLAGS = if useLLVMLibcxx then [ "-stdlib=libc++" ] else [];
+
    postInstall = lib.optionalString (!stdenv.isDarwin) ''
      mkdir -p $out/share/Jupyter
      cp -r /build/clang/tools/cling/tools/Jupyter/kernel $out/share/Jupyter
    '';

+    dontStrip = debug;
+
    meta = with lib; {
      description = "The Interactive C++ Interpreter";
      homepage = "https://root.cern/cling/";
@ -95,44 +123,49 @@ let
    };
  };

+  # Runtime flags for the C++ standard library
+  cxxFlags = if useLLVMLibcxx then [
+    "-I" "${lib.getDev llvmPackages_9.libcxx}/include/c++/v1"
+    "-L" "${llvmPackages_9.libcxx}/lib"
+    "-l" "${llvmPackages_9.libcxx}/lib/libc++.so"
+  ] else [
+    "-I" "${gcc-unwrapped}/include/c++/${gcc-unwrapped.version}"
+    "-I" "${gcc-unwrapped}/include/c++/${gcc-unwrapped.version}/x86_64-unknown-linux-gnu"
+  ];
+
  # The flags passed to the wrapped cling should
  # a) prevent it from searching for system include files and libs, and
-  # b) provide it with the include files and libs it needs (C and C++ standard library)
+  # b) provide it with the include files and libs it needs (C and C++ standard library plus
+  # its own stuff)

-  # These are also exposed as cling.flags/cling.compilerIncludeFlags because it's handy to be
-  # able to pass them to tools that wrap Cling, particularly Jupyter kernels such as xeus-cling
-  # and the built-in jupyter-cling-kernel. Both of these use Cling as a library by linking against
-  # libclingJupyter.so, so the makeWrapper approach to wrapping the binary doesn't work.
+  # These are also exposed as cling.flags because it's handy to be able to pass them to tools
+  # that wrap Cling, particularly Jupyter kernels such as xeus-cling and the built-in
+  # jupyter-cling-kernel, which use Cling as a library.
  # Thus, if you're packaging a Jupyter kernel, you either need to pass these flags as extra
  # args to xcpp (for xeus-cling) or put them in the environment variable CLING_OPTS
-  # (for jupyter-cling-kernel)
+  # (for jupyter-cling-kernel).
  flags = [
    "-nostdinc"
    "-nostdinc++"
-    "-isystem" "${lib.getDev stdenv.cc.libc}/include"
-    "-I" "${lib.getDev unwrapped}/include"
-    "-I" "${lib.getLib unwrapped}/lib/clang/9.0.1/include"
-  ];

-  # Autodetect the include paths for the compiler used to build Cling, in the same way Cling does at
-  # https://github.com/root-project/cling/blob/v0.7/lib/Interpreter/CIFactory.cpp#L107:L111
-  # Note: it would be nice to just put the compiler in Cling's PATH and let it do this by itself, but
-  # unfortunately passing -nostdinc/-nostdinc++ disables Cling's autodetection logic.
-  compilerIncludeFlags = runCommand "compiler-include-flags.txt" {} ''
-    export LC_ALL=C
-    ${stdenv.cc}/bin/c++ -xc++ -E -v /dev/null 2>&1 | sed -n -e '/^.include/,''${' -e '/^ \/.*++/p' -e '}' > tmp
-    sed -e 's/^/-isystem /' -i tmp
-    tr '\n' ' ' < tmp > $out
-  '';
+    "-isystem" "${lib.getLib unwrapped}/lib/clang/9.0.1/include"
+  ]
+  ++ cxxFlags
+  ++ [
+    # System libc
+    "-isystem" "${lib.getDev stdenv.cc.libc}/include"
+
+    # cling includes
+    "-isystem" "${lib.getDev unwrapped}/include"
+  ];

 in

 runCommand "cling-${unwrapped.version}" {
  nativeBuildInputs = [ makeWrapper ];
-  inherit unwrapped flags compilerIncludeFlags;
+  inherit unwrapped flags;
  inherit (unwrapped) meta;
 } ''
  makeWrapper $unwrapped/bin/cling $out/bin/cling \
-    --add-flags "$(cat "$compilerIncludeFlags")" \
    --add-flags "$flags"
 ''
--- a/pkgs/development/interpreters/luau/default.nix
+++ b/pkgs/development/interpreters/luau/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "luau";
-  version = "0.590";
+  version = "0.591";

  src = fetchFromGitHub {
    owner = "Roblox";
    repo = "luau";
    rev = version;
-    hash = "sha256-ZVe4SCx6/IC039CL+ngNIQShNi9V6XQh62gpbcoK/tM=";
+    hash = "sha256-eCYB+B5bglUcF+xAAHBWwwgDrvY9NatmcwL/GUnIhOk=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/interpreters/python/tests.nix
+++ b/pkgs/development/interpreters/python/tests.nix
@ -114,6 +114,10 @@ let
      nix-pythonprefix-mypy = callPackage ./tests/test_nix_pythonprefix {
        interpreter = python;
      };
+      # Make sure tkinter is importable. See https://github.com/NixOS/nixpkgs/issues/238990
+      tkinter = callPackage ./tests/test_tkinter {
+        interpreter = python;
+      };
    }
  );

--- a/pkgs/development/interpreters/python/tests/test_tkinter/default.nix
+++ b/pkgs/development/interpreters/python/tests/test_tkinter/default.nix
@ -0,0 +1,17 @@
+{ interpreter, writeText, runCommand }:
+
+let
+
+  pythonEnv = interpreter.withPackages(ps: [
+    ps.tkinter
+  ]);
+
+  pythonScript = writeText "myscript.py" ''
+    import tkinter
+    print(tkinter)
+  '';
+
+in runCommand "${interpreter.name}-tkinter-test" {} ''
+  ${pythonEnv}/bin/python ${pythonScript}
+  touch $out
+''
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@ -50,7 +50,7 @@ in

 stdenv.mkDerivation rec {
  pname = "racket";
-  version = "8.9"; # always change at once with ./minimal.nix
+  version = "8.10"; # always change at once with ./minimal.nix

  src = (lib.makeOverridable ({ name, sha256 }:
    fetchurl {
@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
    }
  )) {
    name = "${pname}-${version}";
-    sha256 = "sha256-OuIl6E4Rn0zRpH8bFhM1aPx9NcKQxQVJVWbZ3M78UiQ=";
+    sha256 = "sha256-Dklj2iwX5/bVdCi9odz2Ttp0N+Lya7bMSLR/QXo9k6M=";
  };

  FONTCONFIG_FILE = fontsConf;
@ -149,6 +149,7 @@ stdenv.mkDerivation rec {
      GUIs and charts.
    '';
    homepage = "https://racket-lang.org/";
+    changelog = "https://github.com/racket/racket/releases/tag/v${version}";
    license = with licenses; [ asl20 /* or */ mit ];
    maintainers = with maintainers; [ henrytill vrthra ];
    platforms = [ "x86_64-darwin" "x86_64-linux" "aarch64-linux" "aarch64-darwin" ];
--- a/pkgs/development/interpreters/racket/minimal.nix
+++ b/pkgs/development/interpreters/racket/minimal.nix
@ -6,7 +6,7 @@ racket.overrideAttrs (oldAttrs: rec {
  version = oldAttrs.version;
  src = oldAttrs.src.override {
    name = "${pname}-${version}";
-    sha256 = "sha256-mAvwer///Oz2w/Sf4tIo+DyS6wib8P85G+q9waDri3Q=";
+    sha256 = "sha256-k1NzmkiYgPkP42U+08Ljjb3FEU7OM3lEaXsLH29hveA=";
  };

  meta = oldAttrs.meta // {
--- a/pkgs/development/libraries/nvidia-video-sdk/default.nix
+++ b/pkgs/development/libraries/nvidia-video-sdk/default.nix
@ -1,28 +0,0 @@
-{ lib, stdenv, fetchurl, unzip }:
-
-stdenv.mkDerivation rec {
-  pname = "nvidia-video-sdk";
-  version = "6.0.1";
-
-  src = fetchurl {
-    url = "https://developer.nvidia.com/video-sdk-601";
-    name = "nvidia_video_sdk_${version}.zip";
-    sha256 = "08h1vnqsv22js9v3pyim5yb80z87baxb7s2g5gsvvjax07j7w8h5";
-  };
-
-  nativeBuildInputs = [ unzip ];
-
-  # We only need the header files. The library files are
-  # in the nvidia_x11 driver.
-  installPhase = ''
-    mkdir -p $out/include
-    cp -R Samples/common/inc/* $out/include
-  '';
-
-  meta = with lib; {
-    description = "The NVIDIA Video Codec SDK";
-    homepage = "https://developer.nvidia.com/nvidia-video-codec-sdk";
-    license = licenses.unfree;
-  };
-}
-
--- a/pkgs/development/libraries/talloc/default.nix
+++ b/pkgs/development/libraries/talloc/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "talloc";
-  version = "2.4.0";
+  version = "2.4.1";

  src = fetchurl {
    url = "mirror://samba/talloc/${pname}-${version}.tar.gz";
-    sha256 = "sha256-bfNoYsQkZu+I82BERROHDvRpNPkBbIQ4PMQAin0MRro=";
+    sha256 = "sha256-QQpUfwhVcAe+DogZTyGIaDWO3Aq5jJi6jBZ5MNs9M/k=";
  };

  nativeBuildInputs = [
@ -71,5 +71,6 @@ stdenv.mkDerivation rec {
    homepage = "https://tdb.samba.org/";
    license = licenses.gpl3;
    platforms = platforms.all;
+    maintainers = [ maintainers.matthiasbeyer ];
  };
 }
--- a/pkgs/development/libraries/valhalla/default.nix
+++ b/pkgs/development/libraries/valhalla/default.nix
@ -1,32 +1,42 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
-, zlib, curl, protobuf, prime-server, boost, sqlite, libspatialite
-, luajit, geos39, python3, zeromq }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, boost
+, curl
+, geos
+, libspatialite
+, luajit
+, prime-server
+, protobuf
+, python3
+, sqlite
+, zeromq
+, zlib
+, testers
+}:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "valhalla";
-  version = "3.1.0";
+  version = "3.4.0";

  src = fetchFromGitHub {
    owner = "valhalla";
    repo = "valhalla";
-    rev = version;
-    sha256 = "04vxvzy6hnhdvb9lh1p5vqzzi2drv0g4l2gnbdp44glipbzgd4dr";
+    rev = finalAttrs.version;
+    hash = "sha256-1X9vsWsgnzmXn7bCMhN2PNwtfV0RRdzRFZIrQN2PLfA=";
    fetchSubmodules = true;
  };

-  # https://github.com/valhalla/valhalla/issues/2119
  postPatch = ''
-    for f in valhalla/mjolnir/transitpbf.h \
-             src/mjolnir/valhalla_query_transit.cc; do
-      substituteInPlace $f --replace 'SetTotalBytesLimit(limit, limit)' \
-                                     'SetTotalBytesLimit(limit)'
-    done
+    substituteInPlace src/bindings/python/CMakeLists.txt \
+      --replace "\''${Python_SITEARCH}" "${placeholder "out"}/${python3.sitePackages}"
  '';

-  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [
-    zlib curl protobuf prime-server boost sqlite libspatialite
-    luajit geos39 python3 zeromq
+  nativeBuildInputs = [
+    cmake
+    pkg-config
  ];

  cmakeFlags = [
@ -34,17 +44,36 @@ stdenv.mkDerivation rec {
    "-DENABLE_BENCHMARKS=OFF"
  ];

+  buildInputs = [
+    boost
+    curl
+    geos
+    libspatialite
+    luajit
+    prime-server
+    protobuf
+    python3
+    sqlite
+    zeromq
+    zlib
+  ];
+
  postFixup = ''
    substituteInPlace "$out"/lib/pkgconfig/libvalhalla.pc \
      --replace '=''${prefix}//' '=/' \
      --replace '=''${exec_prefix}//' '=/'
  '';

+  passthru.tests = {
+    pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
  meta = with lib; {
+    changelog = "https://github.com/valhalla/valhalla/blob/${finalAttrs.src.rev}/CHANGELOG.md";
    description = "Open Source Routing Engine for OpenStreetMap";
    homepage = "https://valhalla.readthedocs.io/";
    license = licenses.mit;
    maintainers = [ maintainers.Thra11 ];
    platforms = platforms.linux;
  };
-}
+})
--- a/pkgs/development/libraries/yyjson/default.nix
+++ b/pkgs/development/libraries/yyjson/default.nix
@ -0,0 +1,29 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "yyjson";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "ibireme";
+    repo = "yyjson";
+    rev = finalAttrs.version;
+    hash = "sha256-Cz8K+cWuDpoMY6d+ecuOvXIMc4wtx15LLvxpFibkNyw=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  meta = with lib; {
+    description = "The fastest JSON library in C";
+    homepage = "https://github.com/ibireme/yyjson";
+    changelog = "https://github.com/ibireme/yyjson/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ federicoschonborn ];
+  };
+})
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@ -269,15 +269,15 @@ let

  njson = build-asdf-system {
    pname = "njson";
-    version = "1.0.0";
+    version = "1.1.0";
    src = pkgs.fetchFromGitHub {
      owner = "atlas-engineer";
      repo = "njson";
-      rev = "1.0.0";
-      sha256 = "sha256-zeOxkoi5cPl1sw1oEOaMsKhhs3Pb8EzzKTjvuDNj/Ko=";
+      rev = "1.1.0";
+      sha256 = "sha256-hVo5++QCns7Mv3zATpAP3EVz1pbj+jbQmzSLqs6hqQo=";
    };
-    lispLibs = [ self.nasdf super.cl-json ];
-    systems = [ "njson" "njson/cl-json" ];
+    lispLibs = [ self.nasdf super.cl-json super.com_dot_inuoe_dot_jzon];
+    systems = [ "njson" "njson/cl-json" "njson/jzon"];
  };

  nsymbols = build-asdf-system {
@ -370,7 +370,7 @@ let

  nyxt-gtk = build-asdf-system {
    pname = "nyxt";
-    version = "3.5.0";
+    version = "3.6.0";

    lispLibs = (with super; [
      alexandria
@ -420,6 +420,7 @@ let
      cl-cffi-gtk
      cl-gobject-introspection
      quri
+      sqlite
    ]) ++ (with self; [
      history-tree
      nhooks
@ -439,8 +440,8 @@ let
    src = pkgs.fetchFromGitHub {
      owner = "atlas-engineer";
      repo = "nyxt";
-      rev = "3.5.0";
-      sha256 = "sha256-/x3S4qAvvHxUxDcs6MAuZvAtqLTQdwlH7r4zFlKIjY4=";
+      rev = "3.6.0";
+      sha256 = "sha256-DaPEKdYf5R+RS7VQzbdLSqZvEQfxjeGEdX8rwmHRLrY=";
    };

    nativeBuildInputs = [ pkgs.makeWrapper ];
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@ -51,6 +51,7 @@ mapAliases {
  bitwarden-cli = pkgs.bitwarden-cli; # added 2023-07-25
  castnow = pkgs.castnow; # added 2023-07-30
  eask = pkgs.eask; # added 2023-08-17
+  inherit (pkgs.elmPackages) elm-test;
  eslint_d = pkgs.eslint_d; # Added 2023-05-26
  flood = pkgs.flood; # Added 2023-07-25
  gtop = pkgs.gtop; # added 2023-07-31
@ -60,9 +61,11 @@ mapAliases {
  markdownlint-cli = pkgs.markdownlint-cli; # added 2023-07-29
  readability-cli = pkgs.readability-cli; # Added 2023-06-12
  reveal-md = pkgs.reveal-md; # added 2023-07-31
+  s3http = throw "s3http was removed because it was abandoned upstream"; # added 2023-08-18
  thelounge = pkgs.thelounge; # Added 2023-05-22
  triton = pkgs.triton; # Added 2023-05-06
  typescript = pkgs.typescript; # Added 2023-06-21
  vscode-langservers-extracted = pkgs.vscode-langservers-extracted; # Added 2023-05-27
+  vue-cli = self."@vue/cli"; # added 2023-08-18
  zx = pkgs.zx; # added 2023-08-01
 }
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@ -7,7 +7,6 @@
  "@squoosh/cli" = "squoosh-cli";
  "@webassemblyjs/cli-1.11.1" = "wasm2wast";
  coffee-script = "coffee";
-  vue-cli = "vue";
  "@withgraphite/graphite-cli" = "gt";

  # Packages that provide a single executable.
@ -68,7 +67,6 @@
  react-native-cli = "react-native";
  react-tools = "jsx";
  remod-cli = "remod";
-  s3http = "s3http.js";
  svelte-language-server = "svelteserver";
  teck-programmer = "teck-firmware-upgrade";
  typescript-language-server = "typescript-language-server";
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -122,7 +122,6 @@
 , "@electron-forge/cli"
 , "eas-cli"
 , "elm-oracle"
-, "elm-test"
 , "emoj"
 , "emojione"
 , "escape-string-regexp"
@ -267,7 +266,6 @@
 , "rollup"
 , {"rust-analyzer-build-deps": "../../applications/editors/vscode/extensions/rust-lang.rust-analyzer/build-deps"}
 , "rtlcss"
-, "s3http"
 , "sass"
 , "semver"
 , "serve"
@ -366,7 +364,6 @@
 , "vscode-html-languageserver-bin"
 , "vscode-json-languageserver"
 , "vscode-json-languageserver-bin"
-, "vue-cli"
 , "vue-language-server"
 , "wavedrom-cli"
 , "web-ext"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@ -98676,68 +98676,6 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-  elm-test = nodeEnv.buildNodePackage {
-    name = "elm-test";
-    packageName = "elm-test";
-    version = "0.19.1-revision12";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/elm-test/-/elm-test-0.19.1-revision12.tgz";
-      sha512 = "5GV3WkJ8R/faOP1hwElQdNuCt8tKx2+1lsMrdeIYWSFz01Kp9gJl/R6zGtp4QUyrUtO8KnHsxjHrQNUf2CHkrg==";
-    };
-    dependencies = [
-      sources."ansi-styles-4.3.0"
-      sources."anymatch-3.1.3"
-      sources."balanced-match-1.0.2"
-      sources."binary-extensions-2.2.0"
-      sources."brace-expansion-2.0.1"
-      sources."braces-3.0.2"
-      sources."chalk-4.1.2"
-      sources."chokidar-3.5.3"
-      sources."color-convert-2.0.1"
-      sources."color-name-1.1.4"
-      sources."commander-9.5.0"
-      sources."cross-spawn-7.0.3"
-      sources."elm-solve-deps-wasm-1.0.2"
-      sources."fill-range-7.0.1"
-      sources."fs.realpath-1.0.0"
-      sources."fsevents-2.3.2"
-      sources."glob-8.1.0"
-      sources."glob-parent-5.1.2"
-      sources."graceful-fs-4.2.11"
-      sources."has-flag-4.0.0"
-      sources."inflight-1.0.6"
-      sources."inherits-2.0.4"
-      sources."is-binary-path-2.1.0"
-      sources."is-extglob-2.1.1"
-      sources."is-glob-4.0.3"
-      sources."is-number-7.0.0"
-      sources."isexe-2.0.0"
-      sources."minimatch-5.1.6"
-      sources."normalize-path-3.0.0"
-      sources."once-1.4.0"
-      sources."path-key-3.1.1"
-      sources."picomatch-2.3.1"
-      sources."readdirp-3.6.0"
-      sources."shebang-command-2.0.0"
-      sources."shebang-regex-3.0.0"
-      sources."split-1.0.1"
-      sources."supports-color-7.2.0"
-      sources."through-2.3.8"
-      sources."to-regex-range-5.0.1"
-      sources."which-2.0.2"
-      sources."wrappy-1.0.2"
-      sources."xmlbuilder-15.1.1"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "Run elm-test suites.";
-      homepage = "https://github.com/rtfeldman/node-test-runner#readme";
-      license = "BSD-3-Clause";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
  emoj = nodeEnv.buildNodePackage {
    name = "emoj";
    packageName = "emoj";
@ -127965,103 +127903,6 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-  s3http = nodeEnv.buildNodePackage {
-    name = "s3http";
-    packageName = "s3http";
-    version = "0.0.5";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/s3http/-/s3http-0.0.5.tgz";
-      sha512 = "AvzoPrG52y/LXjDmKiRoLrZbTJHXdfGYqzHlVLTrdK/+aeCI+RyGB/F1gd9qs6qwP4c1Ntdgvx9W5FziivG4+Q==";
-    };
-    dependencies = [
-      sources."aws-sdk-1.18.0"
-      sources."axios-0.21.4"
-      sources."buffer-crc32-0.2.1"
-      sources."bytes-0.2.1"
-      sources."call-bind-1.0.2"
-      sources."coffee-script-1.6.3"
-      sources."commander-2.0.0"
-      (sources."connect-2.11.0" // {
-        dependencies = [
-          sources."methods-0.0.1"
-        ];
-      })
-      sources."cookie-0.1.0"
-      sources."cookie-signature-1.0.1"
-      sources."core-util-is-1.0.3"
-      sources."crc-0.2.0"
-      sources."crypto-0.0.3"
-      sources."debug-4.3.4"
-      sources."events.node-0.4.9"
-      (sources."everyauth-0.4.5" // {
-        dependencies = [
-          sources."bytes-0.1.0"
-          sources."connect-2.3.9"
-          sources."cookie-0.0.4"
-          sources."debug-0.5.0"
-          sources."fresh-0.1.0"
-          sources."mime-1.2.6"
-          sources."qs-0.4.2"
-          sources."send-0.0.3"
-        ];
-      })
-      (sources."express-3.4.4" // {
-        dependencies = [
-          sources."commander-1.3.2"
-        ];
-      })
-      sources."follow-redirects-1.15.2"
-      sources."formidable-1.0.11"
-      sources."fresh-0.2.0"
-      sources."function-bind-1.1.1"
-      sources."get-intrinsic-1.2.1"
-      sources."has-1.0.3"
-      sources."has-proto-1.0.1"
-      sources."has-symbols-1.0.3"
-      sources."http-auth-2.0.7"
-      sources."inherits-2.0.4"
-      sources."isarray-0.0.1"
-      sources."keypress-0.1.0"
-      sources."methods-0.1.0"
-      sources."mime-1.2.11"
-      sources."mkdirp-0.3.5"
-      sources."ms-2.1.2"
-      sources."multiparty-2.2.0"
-      sources."negotiator-0.3.0"
-      sources."node-swt-0.1.1"
-      sources."node-uuid-1.4.1"
-      sources."node-wsfederation-0.1.1"
-      sources."oauth-https://github.com/ciaranj/node-oauth/tarball/master"
-      sources."object-inspect-1.12.3"
-      (sources."openid-2.0.10" // {
-        dependencies = [
-          sources."qs-6.11.2"
-        ];
-      })
-      sources."pause-0.0.1"
-      sources."qs-0.6.5"
-      sources."range-parser-0.0.4"
-      sources."raw-body-0.0.3"
-      sources."readable-stream-1.1.14"
-      sources."request-2.9.203"
-      sources."sax-1.2.4"
-      sources."send-0.1.4"
-      sources."side-channel-1.0.4"
-      sources."stream-counter-0.2.0"
-      sources."string-1.6.1"
-      sources."string_decoder-0.10.31"
-      sources."uid2-0.0.3"
-      sources."util-0.4.9"
-      sources."xml2js-0.2.4"
-      sources."xmlbuilder-0.4.2"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
  sass = nodeEnv.buildNodePackage {
    name = "sass";
    packageName = "sass";
@ -139329,289 +139170,6 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-  vue-cli = nodeEnv.buildNodePackage {
-    name = "vue-cli";
-    packageName = "vue-cli";
-    version = "2.9.6";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/vue-cli/-/vue-cli-2.9.6.tgz";
-      sha512 = "swQ0bfyJSWfFr42IXr8A774yA1n+YudhzsaHBKhWSkczSqjvgZvSvM8NEnx6QKnfOHBXbdNR5vhahjNUMlftQQ==";
-    };
-    dependencies = [
-      sources."ajv-6.12.6"
-      sources."ansi-escapes-3.2.0"
-      sources."ansi-regex-3.0.1"
-      sources."ansi-styles-3.2.1"
-      sources."anymatch-3.1.3"
-      sources."argparse-1.0.10"
-      sources."array-differ-1.0.0"
-      sources."array-union-1.0.2"
-      sources."array-uniq-1.0.3"
-      sources."arrify-1.0.1"
-      sources."asn1-0.2.6"
-      sources."assert-plus-1.0.0"
-      sources."async-2.6.4"
-      sources."asynckit-0.4.0"
-      sources."aws-sign2-0.7.0"
-      sources."aws4-1.12.0"
-      sources."balanced-match-1.0.2"
-      sources."base64-js-1.5.1"
-      sources."bcrypt-pbkdf-1.0.2"
-      sources."binary-extensions-2.2.0"
-      sources."bl-1.2.3"
-      sources."bluebird-3.7.2"
-      sources."brace-expansion-1.1.11"
-      sources."braces-3.0.2"
-      sources."buffer-5.7.1"
-      sources."buffer-alloc-1.2.0"
-      sources."buffer-alloc-unsafe-1.1.0"
-      sources."buffer-crc32-0.2.13"
-      sources."buffer-fill-1.0.0"
-      sources."builtins-1.0.3"
-      sources."capture-stack-trace-1.0.2"
-      sources."caseless-0.12.0"
-      sources."caw-2.0.1"
-      sources."chalk-2.4.2"
-      sources."chardet-0.7.0"
-      sources."chokidar-3.5.3"
-      sources."cli-cursor-2.1.0"
-      sources."cli-spinners-1.3.1"
-      sources."cli-width-2.2.1"
-      sources."co-3.1.0"
-      sources."coffee-script-1.12.7"
-      sources."color-convert-1.9.3"
-      sources."color-name-1.1.3"
-      sources."combined-stream-1.0.8"
-      sources."commander-2.20.3"
-      sources."concat-map-0.0.1"
-      sources."config-chain-1.1.13"
-      sources."consolidate-0.14.5"
-      sources."core-util-is-1.0.3"
-      sources."create-error-class-3.0.2"
-      sources."dashdash-1.14.1"
-      sources."debug-4.3.4"
-      sources."decompress-4.2.1"
-      sources."decompress-tar-4.1.1"
-      (sources."decompress-tarbz2-4.1.1" // {
-        dependencies = [
-          sources."file-type-6.2.0"
-        ];
-      })
-      sources."decompress-targz-4.1.1"
-      (sources."decompress-unzip-4.0.1" // {
-        dependencies = [
-          sources."file-type-3.9.0"
-          sources."get-stream-2.3.1"
-        ];
-      })
-      sources."delayed-stream-1.0.0"
-      sources."download-5.0.3"
-      sources."download-git-repo-1.1.0"
-      sources."duplexer3-0.1.5"
-      sources."ecc-jsbn-0.1.2"
-      sources."end-of-stream-1.4.4"
-      sources."escape-string-regexp-1.0.5"
-      sources."esprima-4.0.1"
-      sources."extend-3.0.2"
-      sources."extend-shallow-2.0.1"
-      sources."external-editor-3.1.0"
-      sources."extsprintf-1.3.0"
-      sources."fast-deep-equal-3.1.3"
-      sources."fast-json-stable-stringify-2.1.0"
-      sources."fd-slicer-1.1.0"
-      sources."figures-2.0.0"
-      sources."file-type-5.2.0"
-      sources."filename-reserved-regex-2.0.0"
-      sources."filenamify-2.1.0"
-      sources."fill-range-7.0.1"
-      sources."forever-agent-0.6.1"
-      sources."form-data-2.3.3"
-      sources."fs-constants-1.0.0"
-      sources."fs.realpath-1.0.0"
-      sources."fsevents-2.3.2"
-      sources."get-proxy-2.1.0"
-      sources."get-stream-3.0.0"
-      sources."getpass-0.1.7"
-      sources."git-clone-0.1.0"
-      sources."glob-7.2.3"
-      sources."glob-parent-5.1.2"
-      sources."got-6.7.1"
-      sources."graceful-fs-4.2.11"
-      sources."gray-matter-4.0.3"
-      sources."handlebars-4.7.8"
-      sources."har-schema-2.0.0"
-      sources."har-validator-5.1.5"
-      sources."has-flag-3.0.0"
-      sources."has-symbol-support-x-1.4.2"
-      sources."has-to-string-tag-x-1.4.1"
-      sources."http-signature-1.2.0"
-      sources."iconv-lite-0.4.24"
-      sources."ieee754-1.2.1"
-      sources."inflight-1.0.6"
-      sources."inherits-2.0.4"
-      sources."ini-1.3.8"
-      sources."inquirer-6.5.2"
-      sources."is-binary-path-2.1.0"
-      sources."is-extendable-0.1.1"
-      sources."is-extglob-2.1.1"
-      sources."is-fullwidth-code-point-2.0.0"
-      sources."is-glob-4.0.3"
-      sources."is-natural-number-4.0.1"
-      sources."is-number-7.0.0"
-      sources."is-object-1.0.2"
-      sources."is-redirect-1.0.0"
-      sources."is-retry-allowed-1.2.0"
-      sources."is-stream-1.1.0"
-      sources."is-typedarray-1.0.0"
-      sources."is-utf8-0.2.1"
-      sources."isarray-1.0.0"
-      sources."isstream-0.1.2"
-      sources."isurl-1.0.0"
-      sources."js-yaml-3.14.1"
-      sources."jsbn-0.1.1"
-      sources."json-schema-0.4.0"
-      sources."json-schema-traverse-0.4.1"
-      sources."json-stringify-safe-5.0.1"
-      sources."jsprim-1.4.2"
-      sources."kind-of-6.0.3"
-      sources."lodash-4.17.21"
-      sources."lodash.clonedeepwith-4.5.0"
-      sources."log-symbols-2.2.0"
-      sources."lowercase-keys-1.0.1"
-      (sources."make-dir-1.3.0" // {
-        dependencies = [
-          sources."pify-3.0.0"
-        ];
-      })
-      (sources."metalsmith-2.6.1" // {
-        dependencies = [
-          sources."commander-10.0.1"
-        ];
-      })
-      sources."micromatch-4.0.5"
-      sources."mime-db-1.52.0"
-      sources."mime-types-2.1.35"
-      sources."mimic-fn-1.2.0"
-      sources."minimatch-3.1.2"
-      sources."minimist-1.2.8"
-      sources."mkdirp-0.5.6"
-      sources."ms-2.1.2"
-      sources."multimatch-2.1.0"
-      sources."mute-stream-0.0.7"
-      sources."neo-async-2.6.2"
-      sources."normalize-path-3.0.0"
-      (sources."npm-conf-1.1.3" // {
-        dependencies = [
-          sources."pify-3.0.0"
-        ];
-      })
-      sources."oauth-sign-0.9.0"
-      sources."object-assign-4.1.1"
-      sources."once-1.4.0"
-      sources."onetime-2.0.1"
-      sources."ora-1.4.0"
-      sources."os-homedir-1.0.2"
-      sources."os-tmpdir-1.0.2"
-      sources."path-is-absolute-1.0.1"
-      sources."pend-1.2.0"
-      sources."performance-now-2.1.0"
-      sources."picomatch-2.3.1"
-      sources."pify-2.3.0"
-      sources."pinkie-2.0.4"
-      sources."pinkie-promise-2.0.1"
-      sources."prepend-http-1.0.4"
-      sources."process-nextick-args-2.0.1"
-      sources."proto-list-1.2.4"
-      sources."psl-1.9.0"
-      sources."punycode-2.3.0"
-      sources."qs-6.5.3"
-      sources."read-metadata-1.0.0"
-      (sources."readable-stream-2.3.8" // {
-        dependencies = [
-          sources."safe-buffer-5.1.2"
-        ];
-      })
-      sources."readdirp-3.6.0"
-      sources."request-2.88.2"
-      sources."restore-cursor-2.0.0"
-      sources."rimraf-2.7.1"
-      sources."run-async-2.4.1"
-      sources."rxjs-6.6.7"
-      sources."safe-buffer-5.2.1"
-      sources."safer-buffer-2.1.2"
-      sources."section-matter-1.0.0"
-      sources."seek-bzip-1.0.6"
-      sources."semver-5.7.2"
-      sources."signal-exit-3.0.7"
-      sources."source-map-0.6.1"
-      sources."sprintf-js-1.0.3"
-      sources."sshpk-1.17.0"
-      sources."stat-mode-1.0.0"
-      (sources."string-width-2.1.1" // {
-        dependencies = [
-          sources."strip-ansi-4.0.0"
-        ];
-      })
-      (sources."string_decoder-1.1.1" // {
-        dependencies = [
-          sources."safe-buffer-5.1.2"
-        ];
-      })
-      (sources."strip-ansi-5.2.0" // {
-        dependencies = [
-          sources."ansi-regex-4.1.1"
-        ];
-      })
-      sources."strip-bom-string-1.0.0"
-      sources."strip-dirs-2.1.0"
-      sources."strip-outer-1.0.1"
-      sources."supports-color-5.5.0"
-      sources."tar-stream-1.6.2"
-      sources."through-2.3.8"
-      sources."tildify-1.2.0"
-      sources."timed-out-4.0.1"
-      sources."tmp-0.0.33"
-      sources."to-buffer-1.1.1"
-      sources."to-regex-range-5.0.1"
-      sources."tough-cookie-2.5.0"
-      sources."trim-repeated-1.0.0"
-      sources."tslib-1.14.1"
-      sources."tunnel-agent-0.6.0"
-      sources."tweetnacl-0.14.5"
-      sources."uglify-js-3.17.4"
-      sources."uid-0.0.2"
-      sources."unbzip2-stream-1.4.3"
-      sources."unzip-response-2.0.1"
-      sources."uri-js-4.4.1"
-      sources."url-parse-lax-1.0.0"
-      sources."url-to-options-1.0.1"
-      sources."user-home-2.0.0"
-      sources."util-deprecate-1.0.2"
-      sources."uuid-3.4.0"
-      sources."validate-npm-package-name-3.0.0"
-      (sources."verror-1.10.0" // {
-        dependencies = [
-          sources."core-util-is-1.0.2"
-        ];
-      })
-      sources."ware-1.3.0"
-      sources."wordwrap-1.0.0"
-      sources."wrap-fn-0.1.5"
-      sources."wrappy-1.0.2"
-      sources."xtend-4.0.2"
-      sources."yaml-js-0.0.8"
-      sources."yauzl-2.10.0"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "A simple CLI for scaffolding Vue.js projects.";
-      homepage = "https://github.com/vuejs/vue-cli#readme";
-      license = "MIT";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
  vue-language-server = nodeEnv.buildNodePackage {
    name = "vue-language-server";
    packageName = "vue-language-server";
--- a/pkgs/development/python-modules/aiomysql/default.nix
+++ b/pkgs/development/python-modules/aiomysql/default.nix
@ -1,10 +1,11 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pymysql
 , pythonOlder
 , setuptools-scm
-, setuptools-scm-git-archive
+, wheel
 }:

 buildPythonPackage rec {
@ -21,9 +22,19 @@ buildPythonPackage rec {
    hash = "sha256-m/EgoBU3e+s3soXyYtACMDSjJfMLBOk/00qPtgawwQ8=";
  };

+  patches = [
+    # https://github.com/aio-libs/aiomysql/pull/955
+    (fetchpatch {
+      name = "remove-setuptools-scm-git-archive-dependency.patch";
+      url = "https://github.com/aio-libs/aiomysql/commit/fee997d2e848b634a84ce0c4e9025e3b3e761640.patch";
+      hash = "sha256-qKcOfdDaA9DLS2fdHOEUW37aCCdtZjN0zsFV9dK/umQ=";
+      includes = [ "pyproject.toml" ];
+    })
+  ];
+
  nativeBuildInputs = [
    setuptools-scm
-    setuptools-scm-git-archive
+    wheel
  ];

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/batchgenerators/default.nix
+++ b/pkgs/development/python-modules/batchgenerators/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "batchgenerators";
-  version = "0.24";
+  version = "0.25";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "MIC-DKFZ";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-47jAeHMJPBk7GpUvXtQuJchgiSy6M50anftsuXWk2ag=";
+    hash = "sha256-L2mWH2t8PN9o1M67KDdl1Tj2ZZ02MY4icsJY2VNrj3A=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/blosc2/default.nix
+++ b/pkgs/development/python-modules/blosc2/default.nix
@ -3,11 +3,13 @@
 , fetchFromGitHub

 # build-system
-, setuptools
-, scikit-build
-, cython
 , cmake
+, cython
 , ninja
+, oldest-supported-numpy
+, scikit-build
+, setuptools
+, wheel

 # propagates
 , msgpack
@ -44,9 +46,10 @@ buildPythonPackage rec {
    cmake
    cython
    ninja
-    numpy
+    oldest-supported-numpy
    scikit-build
    setuptools
+    wheel
  ];

  dontUseCmakeConfigure = true;
--- a/pkgs/development/python-modules/caio/default.nix
+++ b/pkgs/development/python-modules/caio/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "caio";
-  version = "0.9.12";
+  version = "0.9.13";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "mosquito";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-uMq/3yWP9OwaVxixGAFCLMsDPoJhmIuG0I7hO7AnIOk=";
+    hash = "sha256-Q87NuL6yZ5uKImQqqdKTMWNyfUOb4NaZDEvNdqZbHDk=";
  };

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/cffsubr/default.nix
+++ b/pkgs/development/python-modules/cffsubr/default.nix
@ -1,25 +1,36 @@
 { stdenv
 , lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , fonttools
 , pytestCheckHook
 , setuptools-scm
+, wheel
 }:

 buildPythonPackage rec {
  pname = "cffsubr";
  version = "0.2.9.post1";
-
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "azFBLc9JyPqEZkvahn4u3cVbb+b6aW/yU8TxOp/y/Fw=";
+    hash = "sha256-azFBLc9JyPqEZkvahn4u3cVbb+b6aW/yU8TxOp/y/Fw=";
  };

+  patches = [
+    # https://github.com/adobe-type-tools/cffsubr/pull/23
+    (fetchpatch {
+      name = "remove-setuptools-git-ls-files.patch";
+      url = "https://github.com/adobe-type-tools/cffsubr/commit/887a6a03b1e944b82fcb99b797fbc2f3a64298f0.patch";
+      hash = "sha256-LuyqBtDrKWwCeckr+YafZ5nfVw1XnELwFI6X8bGomhs=";
+    })
+  ];
+
  nativeBuildInputs = [
    setuptools-scm
+    wheel
  ];

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/coinmetrics-api-client/default.nix
+++ b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "coinmetrics-api-client";
-  version = "2023.8.2.13";
+  version = "2023.8.10.19";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -27,7 +27,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit version;
    pname = "coinmetrics_api_client";
-    hash = "sha256-R7EbzH8ftHqoCbe8plXPOmTL01mow7t+zgVfL4+bZXQ=";
+    hash = "sha256-sXWcnl6E2Aw78Y4JPpTQlRmhRP6egl6eo81N2PIhi34=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/compreffor/default.nix
+++ b/pkgs/development/python-modules/compreffor/default.nix
@ -1,15 +1,17 @@
 { lib
 , buildPythonPackage
+, cython
+, fetchpatch
 , fetchPypi
 , setuptools-scm
 , fonttools
 , pytestCheckHook
+, wheel
 }:

 buildPythonPackage rec {
  pname = "compreffor";
  version = "0.5.4";
-
  format = "pyproject";

  src = fetchPypi {
@ -17,8 +19,19 @@ buildPythonPackage rec {
    hash = "sha256-MGulQEUGPrQ30T3VYzwRRlvzvWkFqNzqsNzAjtjX9xU=";
  };

+  patches = [
+    # https://github.com/googlefonts/compreffor/pull/153
+    (fetchpatch {
+      name = "remove-setuptools-git-ls-files.patch";
+      url = "https://github.com/googlefonts/compreffor/commit/10f563564390568febb3ed1d0f293371cbd86953.patch";
+      hash = "sha256-wNQMJFJXTFILGzAgzUXzz/rnK67/RU+exYP6MhEQAkA=";
+    })
+  ];
+
  nativeBuildInputs = [
+    cython
    setuptools-scm
+    wheel
  ];

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@ -3,9 +3,9 @@
 , buildPythonPackage
 , fetchFromGitHub

-# build-syste
+# build-system
 , setuptools
-, versioneer
+, wheel

 # dependencies
 , click
@ -52,7 +52,7 @@ buildPythonPackage rec {

  nativeBuildInputs = [
    setuptools
-    versioneer
+    wheel
  ];

  propagatedBuildInputs = [
@ -109,10 +109,12 @@ buildPythonPackage rec {
    echo "def get_versions(): return {'dirty': False, 'error': None, 'full-revisionid': None, 'version': '${version}'}" > dask/_version.py

    substituteInPlace setup.py \
+      --replace "import versioneer" "" \
      --replace "version=versioneer.get_version()," "version='${version}'," \
      --replace "cmdclass=versioneer.get_cmdclass()," ""

    substituteInPlace pyproject.toml \
+      --replace ', "versioneer[toml]==0.28"' "" \
      --replace " --durations=10" "" \
      --replace " --cov-config=pyproject.toml" "" \
      --replace "\"-v" "\" "
--- a/pkgs/development/python-modules/devito/default.nix
+++ b/pkgs/development/python-modules/devito/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenv
 , anytree
 , buildPythonPackage
 , cached-property
@ -18,8 +19,8 @@
 , pytest-xdist
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , scipy
-, stdenv
 , sympy
 }:

@ -37,20 +38,18 @@ buildPythonPackage rec {
    hash = "sha256-LzqY//205XEOd3/f8k1g4OYndRHMTVplBogGJf5Forw=";
  };

-  postPatch = ''
-    # Removing unecessary dependencies
-    sed -e "s/flake8.*//g" \
-        -e "s/codecov.*//g" \
-        -e "s/pytest.*//g" \
-        -e "s/pytest-runner.*//g" \
-        -e "s/pytest-cov.*//g" \
-        -i requirements.txt
+  pythonRemoveDeps = [
+    "codecov"
+    "flake8"
+    "pytest-runner"
+    "pytest-cov"
+  ];

-    # Relaxing dependencies requirements
-    sed -e "s/>.*//g" \
-        -e "s/<.*//g" \
-        -i requirements.txt
-  '';
+  pythonRelaxDeps = true;
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];

  propagatedBuildInputs = [
    anytree
@ -71,31 +70,35 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
-    pytestCheckHook
-    pytest-xdist
-    matplotlib
    gcc
+    matplotlib
+    pytest-xdist
+    pytestCheckHook
  ];

+  pytestFlagsArray = [ "-x" ];
+
  # I've had to disable the following tests since they fail while using nix-build, but they do pass
  # outside the build. They mostly related to the usage of MPI in a sandboxed environment.
  disabledTests = [
    "test_assign_parallel"
-    "test_gs_parallel"
-    "test_if_parallel"
-    "test_if_halo_mpi"
    "test_cache_blocking_structure_distributed"
-    "test_mpi"
    "test_codegen_quality0"
-    "test_new_distributor"
-    "test_subdomainset_mpi"
-    "test_init_omp_env_w_mpi"
-    "test_mpi_nocomms"
-    "test_shortcuts"
-    "est_docstrings"
-    "test_docstrings[finite_differences.coefficients]"
    "test_coefficients_w_xreplace"
+    "test_docstrings"
+    "test_docstrings[finite_differences.coefficients]"
+    "test_gs_parallel"
+    "test_if_halo_mpi"
+    "test_if_parallel"
+    "test_init_omp_env_w_mpi"
    "test_loop_bounds_forward"
+    "test_mpi_nocomms"
+    "test_mpi"
+    "test_index_derivative"
+    "test_new_distributor"
+    "test_setupWOverQ"
+    "test_shortcuts"
+    "test_subdomainset_mpi"
  ];

  disabledTestPaths = [
--- a/pkgs/development/python-modules/immutables/default.nix
+++ b/pkgs/development/python-modules/immutables/default.nix
@ -3,31 +3,26 @@
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
-, typing-extensions
 }:

 buildPythonPackage rec {
  pname = "immutables";
-  version = "0.19";
+  version = "0.20";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "MagicStack";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-yW+pmAryBp6bvjolN91ACDkk5zxvKfu4nRLQSy71kqs=";
+    hash = "sha256-fEECtP6WQVzwSzBYX+CbhQtzkB/1WC3OYKXk2XY//xA=";
  };

  postPatch = ''
    rm tests/conftest.py
  '';

-  propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
-    typing-extensions
-  ];
-
  nativeCheckInputs = [
    pytestCheckHook
  ];
@ -49,6 +44,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "An immutable mapping type";
    homepage = "https://github.com/MagicStack/immutables";
+    changelog = "https://github.com/MagicStack/immutables/releases/tag/v${version}";
    license = with licenses; [ asl20 ];
    maintainers = with maintainers; [ catern ];
  };
--- a/pkgs/development/python-modules/insteon-frontend-home-assistant/default.nix
+++ b/pkgs/development/python-modules/insteon-frontend-home-assistant/default.nix
@ -1,8 +1,10 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , pythonOlder
 , setuptools
+, wheel
 }:

 buildPythonPackage rec {
@ -17,8 +19,18 @@ buildPythonPackage rec {
    hash = "sha256-R+P4pgKbLvf0mwpSDoujCvlJe/yS+nvSJ7ewLVOOg/0=";
  };

+  patches = [
+    # https://github.com/pyinsteon/insteon-panel/pull/33
+    (fetchpatch {
+      name = "unpin-setuptools.patch";
+      url = "https://github.com/pyinsteon/insteon-panel/commit/2297eb05668907edd03633f244e5876990e340c7.patch";
+      hash = "sha256-kTu1+IwDrcdqelyK/vfhxw8MQBis5I1jag7YTytKQhs=";
+    })
+  ];
+
  nativeBuildInputs = [
    setuptools
+    wheel
  ];

  # upstream has no tests
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@ -260,10 +260,10 @@ let
      ];

      sha256 = (if cudaSupport then {
-        x86_64-linux = "sha256-8QaXoZq6oITRsYn4RdLUXcKQv3PJ4Q3ItX9PkBwxGBI=";
+        x86_64-linux = "sha256-L+d4umcN8eZQJS7NtbyMhFbbGUVd0a73GOYbZx3bW9Q=";
      } else {
-        x86_64-linux = "sha256-M/h5EZmyiV4QvzgKRjdz7V1LHENUJlc/ig1QAItnWVQ=";
-        aarch64-linux = "sha256-edkYcdlvOLNGRSanch1fGCZwq8SFn3TzcUNt1LhzG/E=";
+        x86_64-linux = "sha256-V1giQbu70RYjbNsqudibiCgvtFNRIJ8XG75QtIzjM4g=";
+        aarch64-linux = "sha256-DRU4aT7kQffhsOllgHtSlIsYOeLF4Sy5o5RR1CaTle0=";
      }).${stdenv.system} or (throw "jaxlib: unsupported system: ${stdenv.system}");
    };

--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@ -85,7 +85,7 @@

 buildPythonPackage rec {
  pname = "langchain";
-  version = "0.0.263";
+  version = "0.0.268";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -94,7 +94,7 @@ buildPythonPackage rec {
    owner = "hwchase17";
    repo = "langchain";
    rev = "refs/tags/v${version}";
-    hash = "sha256-/ReuUVSVO/JqfXFmGU/Yk5GAzmSuJvnr8zOTw3qLZvQ=";
+    hash = "sha256-x5cYtOY91JpW3vV7Q6JNNRoTFKGMu93TqBAhnhQ6pHE=";
  };

  sourceRoot = "${src.name}/libs/langchain";
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@ -3,23 +3,24 @@
 , fetchFromGitHub
 , poetry-core
 , pydantic
-, requests
-, pytestCheckHook
 , pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+, requests
 }:

 buildPythonPackage rec {
  pname = "langsmith";
-  version = "0.0.14";
+  version = "0.0.24";
  format = "pyproject";

+  disabled = pythonOlder "3.8";
+
  src = fetchFromGitHub {
    owner = "langchain-ai";
-    repo = "langchainplus-sdk";
-    # there are no correct tags
-    # https://github.com/langchain-ai/langchainplus-sdk/issues/105
-    rev = "092f67222e4beabca0f51ba03f1ee028f916da63";
-    hash = "sha256-U8fs16Uq80EB7Ey5YuQhUKKI9DOXJWlabM5JdoDnWP0=";
+    repo = "langsmith-sdk";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Uv6zzSWs+Fvb0ztwgkbkZcaNJOFpt8pWh88HZHsTris=";
  };

  sourceRoot = "${src.name}/python";
@ -39,15 +40,18 @@ buildPythonPackage rec {
  ];

  disabledTests = [
-    # these tests require network access
+    # These tests require network access
    "integration_tests"
  ];

-  pythonImportsCheck = [ "langsmith" ];
+  pythonImportsCheck = [
+    "langsmith"
+  ];

  meta = with lib; {
    description = "Client library to connect to the LangSmith LLM Tracing and Evaluation Platform";
-    homepage = "https://github.com/langchain-ai/langchainplus-sdk";
+    homepage = "https://github.com/langchain-ai/langsmith-sdk";
+    changelog = "https://github.com/langchain-ai/langsmith-sdk/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ natsukium ];
  };
--- a/pkgs/development/python-modules/m2crypto/default.nix
+++ b/pkgs/development/python-modules/m2crypto/default.nix
@ -1,52 +1,48 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
-, swig2
 , openssl
-, typing
 , parameterized
+, pytestCheckHook
+, pythonOlder
+, swig2
 }:

-
 buildPythonPackage rec {
-  version = "0.38.0";
-  pname = "M2Crypto";
+  pname = "m2crypto";
+  version = "0.39.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-mfImCjCQHJSajcbV+CzVMS/7iryS52YzuvIxu7yy3ss=";
+    pname = "M2Crypto";
+    inherit version;
+    hash = "sha256-JMD0cTWLixmtTIqp2hLoaAMLZcH9syedAG32DJUBM4o=";
  };

-  patches = [
-    # Use OpenSSL_version_num() instead of unrealiable parsing of .h file.
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/m2crypto/raw/42951285c800f72e0f0511cec39a7f49e970a05c/f/m2crypto-MR271-opensslversion.patch";
-      hash = "sha256-e1/NHgWza+kum76MUFSofq9Ko3pML67PUfqWjcwIl+A=";
-    })
-    # Changed required to pass tests on OpenSSL 3.0
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/m2crypto/raw/42951285c800f72e0f0511cec39a7f49e970a05c/f/m2crypto-0.38-ossl3-tests.patch";
-      hash = "sha256-B6JKoPh76+CIna6zmrvFj50DIp3pzg8aKyzz+Q5hqQ0=";
-    })
-    # Allow EVP tests fail on non-FIPS algorithms
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/m2crypto/raw/42951285c800f72e0f0511cec39a7f49e970a05c/f/m2crypto-0.38-ossl3-tests-evp.patch";
-      hash = "sha256-jMUAphVBQMFaOJSeYUCQMV3WSe9VDQqG6GY5fDQXZnA=";
-    })
-    # Fix the readline test https://gitlab.com/m2crypto/m2crypto/-/issues/286
-    (fetchpatch {
-      url = "https://gitlab.com/m2crypto/m2crypto/-/commit/b8addc7ad9990d1ba3786830ebd74aa8c939849d.patch";
-      hash = "sha256-M5mrmJVCT0fASvERLKa/MR+EY2hzRGIkyUfguVBPKNk=";
-    })
+  nativeBuildInputs = [
+    swig2
+    openssl
  ];

-  nativeBuildInputs = [ swig2 openssl ];
-  buildInputs = [ openssl parameterized ];
+  buildInputs = [
+    openssl
+    parameterized
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "M2Crypto"
+  ];

  meta = with lib; {
    description = "A Python crypto and SSL toolkit";
    homepage = "https://gitlab.com/m2crypto/m2crypto";
+    changelog = "https://gitlab.com/m2crypto/m2crypto/-/blob/${version}/CHANGES";
    license = licenses.mit;
    maintainers = with maintainers; [ andrew-d ];
  };
--- a/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
+++ b/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "mkdocs-mermaid2-plugin";
-  version = "1.0.1";
+  version = "1.0.8";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "fralau";
    repo = "mkdocs-mermaid2-plugin";
    rev = "refs/tags/v${version}";
-    hash = "sha256-8/5lltOT78VSMxunIfCeGSBQ7VIRVnk3cHIzd7S+c00=";
+    hash = "sha256-0h/EMfp6D14ZJcQe3U2r/RQ/VNejOK9bLP6AMNiB0Rc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/oauthenticator/default.nix
+++ b/pkgs/development/python-modules/oauthenticator/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "oauthenticator";
-  version = "16.0.5";
+  version = "16.0.6";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ddCqr6qIIyU3EQ6p2i+U6F359j3hcZ7E2X8qbeUz2e8=";
+    hash = "sha256-82I+ZmWRUUV+kxveHNDXTsbOeZcT0QJo/SJP3paxRcY=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/oci/default.nix
+++ b/pkgs/development/python-modules/oci/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "oci";
-  version = "2.110.0";
+  version = "2.110.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "oracle";
    repo = "oci-python-sdk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-aZo/Xv5+AzAEgEGN1GNtqEtUtuhDnOYneG/0f+hByc0=";
+    hash = "sha256-v2h/K1gat+nHGjn6a9r1BDMDAoJ/OtNctxHzV41gRkg=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/pyprusalink/default.nix
+++ b/pkgs/development/python-modules/pyprusalink/default.nix
@ -2,8 +2,10 @@
 , aiohttp
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pythonOlder
 , setuptools
+, wheel
 }:

 buildPythonPackage rec {
@ -20,8 +22,18 @@ buildPythonPackage rec {
    hash = "sha256-XRtbb7kceiqi8pioTWStRo0drCtQfy1t62jCMihlIec=";
  };

+  patches = [
+    # https://github.com/home-assistant-libs/pyprusalink/pull/55
+    (fetchpatch {
+      name = "unpin-setuptools-dependency.patch";
+      url = "https://github.com/home-assistant-libs/pyprusalink/commit/8efc3229c491a1763456f0f4017251d5789c6d0a.patch";
+      hash = "sha256-kTu1+IwDrcdqelyK/vfhxw8MQBis5I1jag7YTytKQhs=";
+    })
+  ];
+
  nativeBuildInputs = [
    setuptools
+    wheel
  ];

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "pysigma-backend-insightidr";
-  version = "0.2.1";
+  version = "0.2.2";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "SigmaHQ";
    repo = "pySigma-backend-insightidr";
    rev = "refs/tags/v${version}";
-    hash = "sha256-0VBnbThEkGhpxkGNBop0rPYn0NujyrK+ei/2+2f3Wno=";
+    hash = "sha256-B42MADteF0+GC/CPJPLaTGdGcQjC8KEsK9u3tBmtObg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "pyswitchbot";
-  version = "0.38.0";
+  version = "0.39.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "Danielhiversen";
    repo = "pySwitchbot";
    rev = "refs/tags/${version}";
-    hash = "sha256-0BlrrrOvMHBH+w7r1lzvXg2Lq84XZFfSRheBaDmCpc4=";
+    hash = "sha256-CswgfEmKaQvhDXizpcu6d8JMYtJSgNQ3L4+63ee58eE=";
  };

  propagatedBuildInputs = [
--- a/Show More
+++ b/Show More