Merge master into haskell-updates

doc/contributing/reviewing-contributions.chapter.md

@@ -302,6 +302,12 @@ Container system, boot system and library changes are some examples of the pull
 
 It is possible for community members that have enough knowledge and experience on a special topic to contribute by merging pull requests.
 
+In case the PR is stuck waiting for the original author to apply a trivial
+change (a typo, capitalisation change, etc.) and the author allowed the members
+to modify the PR, consider applying it yourself. (or commit the existing review
+suggestion) You should pay extra attention to make sure the addition doesn't go
+against the idea of the original PR and would not be opposed by the author.
+
 <!--
 The following paragraphs about how to deal with unactive contributors is just a proposition and should be modified to what the community agrees to be the right policy.
 

lib/default.nix

@@ -103,7 +103,7 @@ let
       getName getVersion
       nameFromURL enableFeature enableFeatureAs withFeature
       withFeatureAs fixedWidthString fixedWidthNumber isStorePath
-      toInt readPathsFromFile fileContents;
+      toInt toIntBase10 readPathsFromFile fileContents;
     inherit (self.stringsWithDeps) textClosureList textClosureMap
       noDepEntry fullDepEntry packEntry stringAfter;
     inherit (self.customisation) overrideDerivation makeOverridable

lib/strings.nix

@@ -193,7 +193,7 @@ rec {
        normalizePath "/a//b///c/"
        => "/a/b/c/"
   */
-  normalizePath = s: (builtins.foldl' (x: y: if y == "/" && hasSuffix "/" x then x else x+y) "" (splitString "" s));
+  normalizePath = s: (builtins.foldl' (x: y: if y == "/" && hasSuffix "/" x then x else x+y) "" (stringToCharacters s));
 
   /* Depending on the boolean `cond', return either the given string
      or the empty string. Useful to concatenate against a bigger string.
@@ -783,24 +783,105 @@ rec {
     else
       false;
 
-  /* Parse a string as an int.
+  /* Parse a string as an int. Does not support parsing of integers with preceding zero due to
+  ambiguity between zero-padded and octal numbers. See toIntBase10.
 
      Type: string -> int
 
      Example:
+
        toInt "1337"
        => 1337
+
        toInt "-4"
        => -4
+
+       toInt " 123 "
+       => 123
+
+       toInt "00024"
+       => error: Ambiguity in interpretation of 00024 between octal and zero padded integer.
+
        toInt "3.14"
        => error: floating point JSON numbers are not supported
   */
-  # Obviously, it is a bit hacky to use fromJSON this way.
   toInt = str:
-    let may_be_int = fromJSON str; in
-    if isInt may_be_int
-    then may_be_int
-    else throw "Could not convert ${str} to int.";
+    let
+      # RegEx: Match any leading whitespace, then any digits, and finally match any trailing
+      # whitespace.
+      strippedInput = match "[[:space:]]*([[:digit:]]+)[[:space:]]*" str;
+
+      # RegEx: Match a leading '0' then one or more digits.
+      isLeadingZero = match "0[[:digit:]]+" (head strippedInput) == [];
+
+      # Attempt to parse input
+      parsedInput = fromJSON (head strippedInput);
+
+      generalError = "toInt: Could not convert ${escapeNixString str} to int.";
+
+      octalAmbigError = "toInt: Ambiguity in interpretation of ${escapeNixString str}"
+      + " between octal and zero padded integer.";
+
+    in
+      # Error on presence of non digit characters.
+      if strippedInput == null
+      then throw generalError
+      # Error on presence of leading zero/octal ambiguity.
+      else if isLeadingZero
+      then throw octalAmbigError
+      # Error if parse function fails.
+      else if !isInt parsedInput
+      then throw generalError
+      # Return result.
+      else parsedInput;
+
+
+  /* Parse a string as a base 10 int. This supports parsing of zero-padded integers.
+
+     Type: string -> int
+
+     Example:
+       toIntBase10 "1337"
+       => 1337
+
+       toIntBase10 "-4"
+       => -4
+
+       toIntBase10 " 123 "
+       => 123
+
+       toIntBase10 "00024"
+       => 24
+
+       toIntBase10 "3.14"
+       => error: floating point JSON numbers are not supported
+  */
+  toIntBase10 = str:
+    let
+      # RegEx: Match any leading whitespace, then match any zero padding, capture any remaining
+      # digits after that, and finally match any trailing whitespace.
+      strippedInput = match "[[:space:]]*0*([[:digit:]]+)[[:space:]]*" str;
+
+      # RegEx: Match at least one '0'.
+      isZero = match "0+" (head strippedInput) == [];
+
+      # Attempt to parse input
+      parsedInput = fromJSON (head strippedInput);
+
+      generalError = "toIntBase10: Could not convert ${escapeNixString str} to int.";
+
+    in
+      # Error on presence of non digit characters.
+      if strippedInput == null
+      then throw generalError
+      # In the special case zero-padded zero (00000), return early.
+      else if isZero
+      then 0
+      # Error if parse function fails.
+      else if !isInt parsedInput
+      then throw generalError
+      # Return result.
+      else parsedInput;
 
   /* Read a list of paths from `file`, relative to the `rootPath`.
      Lines beginning with `#` are treated as comments and ignored.

lib/tests/misc.nix

@@ -327,6 +327,77 @@ runTests {
     expected = "Hello\\x20World";
   };
 
+  testToInt = testAllTrue [
+    # Naive
+    (123 == toInt "123")
+    (0 == toInt "0")
+    # Whitespace Padding
+    (123 == toInt " 123")
+    (123 == toInt "123 ")
+    (123 == toInt " 123 ")
+    (123 == toInt "   123   ")
+    (0 == toInt " 0")
+    (0 == toInt "0 ")
+    (0 == toInt " 0 ")
+  ];
+
+  testToIntFails = testAllTrue [
+    ( builtins.tryEval (toInt "") == { success = false; value = false; } )
+    ( builtins.tryEval (toInt "123 123") == { success = false; value = false; } )
+    ( builtins.tryEval (toInt "0 123") == { success = false; value = false; } )
+    ( builtins.tryEval (toInt " 0d ") == { success = false; value = false; } )
+    ( builtins.tryEval (toInt " 1d ") == { success = false; value = false; } )
+    ( builtins.tryEval (toInt " d0 ") == { success = false; value = false; } )
+    ( builtins.tryEval (toInt "00") == { success = false; value = false; } )
+    ( builtins.tryEval (toInt "01") == { success = false; value = false; } )
+    ( builtins.tryEval (toInt "002") == { success = false; value = false; } )
+    ( builtins.tryEval (toInt " 002 ") == { success = false; value = false; } )
+    ( builtins.tryEval (toInt " foo ") == { success = false; value = false; } )
+    ( builtins.tryEval (toInt " foo 123 ") == { success = false; value = false; } )
+    ( builtins.tryEval (toInt " foo123 ") == { success = false; value = false; } )
+  ];
+
+  testToIntBase10 = testAllTrue [
+    # Naive
+    (123 == toIntBase10 "123")
+    (0 == toIntBase10 "0")
+    # Whitespace Padding
+    (123 == toIntBase10 " 123")
+    (123 == toIntBase10 "123 ")
+    (123 == toIntBase10 " 123 ")
+    (123 == toIntBase10 "   123   ")
+    (0 == toIntBase10 " 0")
+    (0 == toIntBase10 "0 ")
+    (0 == toIntBase10 " 0 ")
+    # Zero Padding
+    (123 == toIntBase10 "0123")
+    (123 == toIntBase10 "0000123")
+    (0 == toIntBase10 "000000")
+    # Whitespace and Zero Padding
+    (123 == toIntBase10 " 0123")
+    (123 == toIntBase10 "0123 ")
+    (123 == toIntBase10 " 0123 ")
+    (123 == toIntBase10 " 0000123")
+    (123 == toIntBase10 "0000123 ")
+    (123 == toIntBase10 " 0000123 ")
+    (0 == toIntBase10 " 000000")
+    (0 == toIntBase10 "000000 ")
+    (0 == toIntBase10 " 000000 ")
+  ];
+
+  testToIntBase10Fails = testAllTrue [
+    ( builtins.tryEval (toIntBase10 "") == { success = false; value = false; } )
+    ( builtins.tryEval (toIntBase10 "123 123") == { success = false; value = false; } )
+    ( builtins.tryEval (toIntBase10 "0 123") == { success = false; value = false; } )
+    ( builtins.tryEval (toIntBase10 " 0d ") == { success = false; value = false; } )
+    ( builtins.tryEval (toIntBase10 " 1d ") == { success = false; value = false; } )
+    ( builtins.tryEval (toIntBase10 " d0 ") == { success = false; value = false; } )
+    ( builtins.tryEval (toIntBase10 " foo ") == { success = false; value = false; } )
+    ( builtins.tryEval (toIntBase10 " foo 123 ") == { success = false; value = false; } )
+    ( builtins.tryEval (toIntBase10 " foo 00123 ") == { success = false; value = false; } )
+    ( builtins.tryEval (toIntBase10 " foo00123 ") == { success = false; value = false; } )
+  ];
+
 # LISTS
 
   testFilter = {

lib/tests/modules.sh

@@ -162,7 +162,7 @@ checkConfigError 'A definition for option .* is not.*string or signed integer co
 # Check coerced value with unsound coercion
 checkConfigOutput '^12$' config.value ./declare-coerced-value-unsound.nix
 checkConfigError 'A definition for option .* is not of type .*. Definition values:\n\s*- In .*: "1000"' config.value ./declare-coerced-value-unsound.nix ./define-value-string-bigint.nix
-checkConfigError 'json.exception.parse_error' config.value ./declare-coerced-value-unsound.nix ./define-value-string-arbitrary.nix
+checkConfigError 'toInt: Could not convert .* to int' config.value ./declare-coerced-value-unsound.nix ./define-value-string-arbitrary.nix
 
 # Check mkAliasOptionModule.
 checkConfigOutput '^true$' config.enable ./alias-with-priority.nix

maintainers/maintainer-list.nix

@@ -8803,7 +8803,7 @@
     email = "megoettlinger@gmail.com";
     github = "mgttlinger";
     githubId = 5120487;
-    name = "Merlin Göttlinger";
+    name = "Merlin Humml";
   };
   mguentner = {
     email = "code@klandest.in";

maintainers/team-list.nix

@@ -182,6 +182,8 @@ with lib.maintainers; {
     members = [
       cole-h
       grahamc
+      hoverbear
+      lheckemann
     ];
     scope = "Group registration for packages maintained by Determinate Systems.";
     shortName = "Determinate Systems employees";

nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

@@ -38,24 +38,6 @@
           <literal>stdenv.buildPlatform.canExecute stdenv.hostPlatform</literal>.
         </para>
       </listitem>
-      <listitem>
-        <para>
-          The <literal>polymc</literal> package has been removed due to
-          a rogue maintainer. It has been replaced by
-          <literal>prismlauncher</literal>, a fork by the rest of the
-          maintainers. For more details, see
-          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/196624">the
-          pull request that made this change</link> and
-          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/196460">this
-          issue detailing the vulnerability</link>. Users with existing
-          installations should rename
-          <literal>~/.local/share/polymc</literal> to
-          <literal>~/.local/share/PrismLauncher</literal>. The main
-          config file’s path has also moved from
-          <literal>~/.local/share/polymc/polymc.cfg</literal> to
-          <literal>~/.local/share/PrismLauncher/prismlauncher.cfg</literal>.
-        </para>
-      </listitem>
       <listitem>
         <para>
           The <literal>nixpkgs.hostPlatform</literal> and
@@ -867,6 +849,24 @@
           the mtu on interfaces and tag its packets with an fwmark.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>polymc</literal> package has been removed due to
+          a rogue maintainer. It has been replaced by
+          <literal>prismlauncher</literal>, a fork by the rest of the
+          maintainers. For more details, see
+          <link xlink:href="https://github.com/NixOS/nixpkgs/pull/196624">the
+          pull request that made this change</link> and
+          <link xlink:href="https://github.com/NixOS/nixpkgs/issues/196460">this
+          issue detailing the vulnerability</link>. Users with existing
+          installations should rename
+          <literal>~/.local/share/polymc</literal> to
+          <literal>~/.local/share/PrismLauncher</literal>. The main
+          config file’s path has also moved from
+          <literal>~/.local/share/polymc/polymc.cfg</literal> to
+          <literal>~/.local/share/PrismLauncher/prismlauncher.cfg</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>services.matrix-synapse</literal> systemd unit

nixos/doc/manual/release-notes/rl-2211.section.md

@@ -20,16 +20,6 @@ In addition to numerous new and upgraded packages, this release has the followin
   built for `stdenv.hostPlatform` (i.e. produced by `stdenv.cc`) by evaluating
   `stdenv.buildPlatform.canExecute stdenv.hostPlatform`.
 
-- The `polymc` package has been removed due to a rogue maintainer. It has been
-  replaced by `prismlauncher`, a fork by the rest of the maintainers. For more
-  details, see [the pull request that made this
-  change](https://github.com/NixOS/nixpkgs/pull/196624) and [this issue
-  detailing the vulnerability](https://github.com/NixOS/nixpkgs/issues/196460).
-  Users with existing installations should rename `~/.local/share/polymc` to
-  `~/.local/share/PrismLauncher`. The main config file's path has also moved
-  from `~/.local/share/polymc/polymc.cfg` to
-  `~/.local/share/PrismLauncher/prismlauncher.cfg`.
-
 - The `nixpkgs.hostPlatform` and `nixpkgs.buildPlatform` options have been added.
   These cover and override the `nixpkgs.{system,localSystem,crossSystem}` options.
 
@@ -280,6 +270,16 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 
 - The `networking.wireguard` module now can set the mtu on interfaces and tag its packets with an fwmark.
 
+- The `polymc` package has been removed due to a rogue maintainer. It has been
+  replaced by `prismlauncher`, a fork by the rest of the maintainers. For more
+  details, see [the pull request that made this
+  change](https://github.com/NixOS/nixpkgs/pull/196624) and [this issue
+  detailing the vulnerability](https://github.com/NixOS/nixpkgs/issues/196460).
+  Users with existing installations should rename `~/.local/share/polymc` to
+  `~/.local/share/PrismLauncher`. The main config file's path has also moved
+  from `~/.local/share/polymc/polymc.cfg` to
+  `~/.local/share/PrismLauncher/prismlauncher.cfg`.
+
 - The `services.matrix-synapse` systemd unit has been hardened.
 
 - The `services.grafana` options were converted to a [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.

nixos/modules/profiles/minimal.nix

@@ -13,4 +13,9 @@ with lib;
   documentation.nixos.enable = mkDefault false;
 
   programs.command-not-found.enable = mkDefault false;
+
+  xdg.autostart.enable = mkDefault false;
+  xdg.icons.enable = mkDefault false;
+  xdg.mime.enable = mkDefault false;
+  xdg.sounds.enable = mkDefault false;
 }

nixos/modules/programs/zsh/zsh.nix

@@ -184,7 +184,7 @@ in
 
         # Tell zsh how to find installed completions.
         for p in ''${(z)NIX_PROFILES}; do
-            fpath+=($p/share/zsh/site-functions $p/share/zsh/$ZSH_VERSION/functions $p/share/zsh/vendor-completions)
+            fpath=($p/share/zsh/site-functions $p/share/zsh/$ZSH_VERSION/functions $p/share/zsh/vendor-completions $fpath)
         done
 
         # Setup custom shell init stuff.

nixos/modules/security/acme/default.nix

@@ -62,9 +62,9 @@ let
     SystemCallArchitectures = "native";
     SystemCallFilter = [
       # 1. allow a reasonable set of syscalls
-      "@system-service"
+      "@system-service @resources"
       # 2. and deny unreasonable ones
-      "~@privileged @resources"
+      "~@privileged"
       # 3. then allow the required subset within denied groups
       "@chown"
     ];

nixos/modules/services/audio/navidrome.nix

@@ -62,7 +62,7 @@ in {
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         SystemCallArchitectures = "native";
-        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
         RestrictRealtime = true;
         LockPersonality = true;
         MemoryDenyWriteExecute = true;

nixos/modules/services/backup/btrbk.nix

@@ -1,72 +1,74 @@
 { config, pkgs, lib, ... }:
 let
   inherit (lib)
+    concatLists
+    concatMap
     concatMapStringsSep
     concatStringsSep
     filterAttrs
-    flatten
     isAttrs
-    isString
     literalExpression
     mapAttrs'
     mapAttrsToList
     mkIf
     mkOption
     optionalString
-    partition
-    typeOf
+    sort
     types
     ;
 
+  # The priority of an option or section.
+  # The configurations format are order-sensitive. Pairs are added as children of
+  # the last sections if possible, otherwise, they start a new section.
+  # We sort them in topological order:
+  # 1. Leaf pairs.
+  # 2. Sections that may contain (1).
+  # 3. Sections that may contain (1) or (2).
+  # 4. Etc.
+  prioOf = { name, value }:
+    if !isAttrs value then 0 # Leaf options.
+    else {
+      target = 1; # Contains: options.
+      subvolume = 2; # Contains: options, target.
+      volume = 3; # Contains: options, target, subvolume.
+    }.${name} or (throw "Unknow section '${name}'");
+
+  genConfig' = set: concatStringsSep "\n" (genConfig set);
+  genConfig = set:
+    let
+      pairs = mapAttrsToList (name: value: { inherit name value; }) set;
+      sortedPairs = sort (a: b: prioOf a < prioOf b) pairs;
+    in
+      concatMap genPair sortedPairs;
+  genSection = sec: secName: value:
+    [ "${sec} ${secName}" ] ++ map (x: " " + x) (genConfig value);
+  genPair = { name, value }:
+    if !isAttrs value
+    then [ "${name} ${value}" ]
+    else concatLists (mapAttrsToList (genSection name) value);
+
+  addDefaults = settings: { backend = "btrfs-progs-sudo"; } // settings;
+
+  mkConfigFile = name: settings: pkgs.writeTextFile {
+    name = "btrbk-${name}.conf";
+    text = genConfig' (addDefaults settings);
+    checkPhase = ''
+      set +e
+      ${pkgs.btrbk}/bin/btrbk -c $out dryrun
+      # According to btrbk(1), exit status 2 means parse error
+      # for CLI options or the config file.
+      if [[ $? == 2 ]]; then
+        echo "Btrbk configuration is invalid:"
+        cat $out
+        exit 1
+      fi
+      set -e
+    '';
+  };
+
   cfg = config.services.btrbk;
   sshEnabled = cfg.sshAccess != [ ];
   serviceEnabled = cfg.instances != { };
-  attr2Lines = attr:
-    let
-      pairs = mapAttrsToList (name: value: { inherit name value; }) attr;
-      isSubsection = value:
-        if isAttrs value then true
-        else if isString value then false
-        else throw "invalid type in btrbk config ${typeOf value}";
-      sortedPairs = partition (x: isSubsection x.value) pairs;
-    in
-    flatten (
-      # non subsections go first
-      (
-        map (pair: [ "${pair.name} ${pair.value}" ]) sortedPairs.wrong
-      )
-      ++ # subsections go last
-      (
-        map
-          (
-            pair:
-            mapAttrsToList
-              (
-                childname: value:
-                  [ "${pair.name} ${childname}" ] ++ (map (x: " " + x) (attr2Lines value))
-              )
-              pair.value
-          )
-          sortedPairs.right
-      )
-    )
-  ;
-  addDefaults = settings: { backend = "btrfs-progs-sudo"; } // settings;
-  mkConfigFile = settings: concatStringsSep "\n" (attr2Lines (addDefaults settings));
-  mkTestedConfigFile = name: settings:
-    let
-      configFile = pkgs.writeText "btrbk-${name}.conf" (mkConfigFile settings);
-    in
-    pkgs.runCommand "btrbk-${name}-tested.conf" { } ''
-      mkdir foo
-      cp ${configFile} $out
-      if (set +o pipefail; ${pkgs.btrbk}/bin/btrbk -c $out ls foo 2>&1 | grep $out);
-      then
-      echo btrbk configuration is invalid
-      cat $out
-      exit 1
-      fi;
-    '';
 in
 {
   meta.maintainers = with lib.maintainers; [ oxalica ];
@@ -196,7 +198,7 @@ in
       (
         name: instance: {
           name = "btrbk/${name}.conf";
-          value.source = mkTestedConfigFile name instance.settings;
+          value.source = mkConfigFile name instance.settings;
         }
       )
       cfg.instances;

nixos/modules/services/misc/gitea.nix

@@ -592,7 +592,7 @@ in
         PrivateMounts = true;
         # System Call Filtering
         SystemCallArchitectures = "native";
-        SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @reboot @resources @setuid @swap";
+        SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @reboot @setuid @swap";
       };
 
       environment = {

nixos/modules/services/monitoring/grafana.nix

@@ -245,17 +245,17 @@ in {
     (mkRenamedOptionModule [ "services" "grafana" "users" "autoAssignOrg" ] [ "services" "grafana" "settings" "users" "auto_assign_org" ])
     (mkRenamedOptionModule [ "services" "grafana" "users" "autoAssignOrgRole" ] [ "services" "grafana" "settings" "users" "auto_assign_org_role" ])
     (mkRenamedOptionModule [ "services" "grafana" "auth" "disableLoginForm" ] [ "services" "grafana" "settings" "auth" "disable_login_form" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "enable" ] [ "services" "grafana" "settings" "auth" "anonymous" "enable" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "org_name" ] [ "services" "grafana" "settings" "auth" "anonymous" "org_name" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "org_role" ] [ "services" "grafana" "settings" "auth" "anonymous" "org_role" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "enable" ] [ "services" "grafana" "settings" "auth" "azuread" "enable" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowSignUp" ] [ "services" "grafana" "settings" "auth" "azuread" "allow_sign_up" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "clientId" ] [ "services" "grafana" "settings" "auth" "azuread" "client_id" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowedDomains" ] [ "services" "grafana" "settings" "auth" "azuread" "allowed_domains" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowedGroups" ] [ "services" "grafana" "settings" "auth" "azuread" "allowed_groups" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "enable" ] [ "services" "grafana" "settings" "auth" "google" "enable" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "allowSignUp" ] [ "services" "grafana" "settings" "auth" "google" "allow_sign_up" ])
-    (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "clientId" ] [ "services" "grafana" "settings" "auth" "google" "client_id" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "enable" ] [ "services" "grafana" "settings" "auth.anonymous" "enabled" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "org_name" ] [ "services" "grafana" "settings" "auth.anonymous" "org_name" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "org_role" ] [ "services" "grafana" "settings" "auth.anonymous" "org_role" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "enable" ] [ "services" "grafana" "settings" "auth.azuread" "enabled" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowSignUp" ] [ "services" "grafana" "settings" "auth.azuread" "allow_sign_up" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "clientId" ] [ "services" "grafana" "settings" "auth.azuread" "client_id" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowedDomains" ] [ "services" "grafana" "settings" "auth.azuread" "allowed_domains" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowedGroups" ] [ "services" "grafana" "settings" "auth.azuread" "allowed_groups" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "enable" ] [ "services" "grafana" "settings" "auth.google" "enabled" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "allowSignUp" ] [ "services" "grafana" "settings" "auth.google" "allow_sign_up" ])
+    (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "clientId" ] [ "services" "grafana" "settings" "auth.google" "client_id" ])
     (mkRenamedOptionModule [ "services" "grafana" "analytics" "reporting" "enable" ] [ "services" "grafana" "settings" "analytics" "reporting_enabled" ])
 
     (mkRemovedOptionModule [ "services" "grafana" "database" "passwordFile" ] ''
@@ -351,7 +351,7 @@ in {
             protocol = mkOption {
               description = lib.mdDoc "Which protocol to listen.";
               default = "http";
-              type = types.enum ["http" "https" "socket"];
+              type = types.enum ["http" "https" "h2" "socket"];
             };
 
             http_addr = mkOption {
@@ -1173,14 +1173,14 @@ in {
         any (x: x.secure_settings != null) cfg.provision.notifiers
       ) "Notifier secure settings will be stored as plaintext in the Nix store! Use file provider instead.")
       (optional (
-        builtins.isList cfg.provision.datasources
+        builtins.isList cfg.provision.datasources && cfg.provision.datasources != []
       ) ''
           Provisioning Grafana datasources with options has been deprecated.
           Use `services.grafana.provision.datasources.settings` or
           `services.grafana.provision.datasources.path` instead.
         '')
       (optional (
-        builtins.isList cfg.provision.dashboards
+        builtins.isList cfg.provision.datasources && cfg.provision.dashboards != []
       ) ''
           Provisioning Grafana dashboards with options has been deprecated.
           Use `services.grafana.provision.dashboards.settings` or
@@ -1253,8 +1253,8 @@ in {
         RuntimeDirectory = "grafana";
         RuntimeDirectoryMode = "0755";
         # Hardening
-        AmbientCapabilities = lib.mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
-        CapabilityBoundingSet = if (cfg.port < 1024) then [ "CAP_NET_BIND_SERVICE" ] else [ "" ];
+        AmbientCapabilities = lib.mkIf (cfg.settings.server.http_port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = if (cfg.settings.server.http_port < 1024) then [ "CAP_NET_BIND_SERVICE" ] else [ "" ];
         DeviceAllow = [ "" ];
         LockPersonality = true;
         NoNewPrivileges = true;

nixos/modules/services/networking/dnscrypt-proxy2.nix

@@ -111,7 +111,6 @@ in
           "~@aio"
           "~@keyring"
           "~@memlock"
-          "~@resources"
           "~@setuid"
           "~@timer"
         ];

nixos/modules/services/security/endlessh-go.nix

@@ -126,7 +126,7 @@ in
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
           SystemCallArchitectures = "native";
-          SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
+          SystemCallFilter = [ "@system-service" "~@privileged" ];
         };
     };
 

nixos/modules/services/web-apps/changedetection-io.nix

@@ -127,7 +127,7 @@ in
       defaultStateDir = cfg.datastorePath == "/var/lib/changedetection-io";
     in {
       services.changedetection-io = {
-        wantedBy = [ "mutli-user.target" ];
+        wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
         preStart = ''
           mkdir -p ${cfg.datastorePath}

nixos/modules/tasks/filesystems.nix

@@ -155,7 +155,7 @@ let
 
   makeFstabEntries =
     let
-      fsToSkipCheck = [ "none" "bindfs" "btrfs" "zfs" "tmpfs" "nfs" "vboxsf" "glusterfs" "apfs" "9p" "cifs" "prl_fs" "vmhgfs" ];
+      fsToSkipCheck = [ "none" "bindfs" "btrfs" "zfs" "tmpfs" "nfs" "nfs4" "vboxsf" "glusterfs" "apfs" "9p" "cifs" "prl_fs" "vmhgfs" ];
       isBindMount = fs: builtins.elem "bind" fs.options;
       skipCheck = fs: fs.noCheck || fs.device == "none" || builtins.elem fs.fsType fsToSkipCheck || isBindMount fs;
       # https://wiki.archlinux.org/index.php/fstab#Filepath_spaces

nixos/release-combined.nix

@@ -55,6 +55,7 @@ in rec {
         (onFullSupported "nixos.manual")
         (onSystems ["x86_64-linux"] "nixos.ova")
         (onSystems ["aarch64-linux"] "nixos.sd_image")
+        (onFullSupported "nixos.tests.acme")
         (onSystems ["x86_64-linux"] "nixos.tests.boot.biosCdrom")
         (onSystems ["x86_64-linux"] "nixos.tests.boot.biosUsb")
         (onFullSupported "nixos.tests.boot-stage1")

nixos/release-small.nix

@@ -31,6 +31,7 @@ in rec {
     inherit (nixos') channel manual options iso_minimal amazonImage dummy;
     tests = {
       inherit (nixos'.tests)
+        acme
         containers-imperative
         containers-ip
         firewall
@@ -110,6 +111,7 @@ in rec {
         "nixos.iso_minimal"
         "nixos.amazonImage"
         "nixos.manual"
+        "nixos.tests.acme"
         "nixos.tests.boot.uefiCdrom"
         "nixos.tests.containers-imperative"
         "nixos.tests.containers-ip"

nixos/tests/all-tests.nix

@@ -102,6 +102,7 @@ in {
   brscan5 = handleTest ./brscan5.nix {};
   btrbk = handleTest ./btrbk.nix {};
   btrbk-no-timer = handleTest ./btrbk-no-timer.nix {};
+  btrbk-section-order = handleTest ./btrbk-section-order.nix {};
   buildbot = handleTest ./buildbot.nix {};
   buildkite-agents = handleTest ./buildkite-agents.nix {};
   caddy = handleTest ./caddy.nix {};

nixos/tests/btrbk-section-order.nix

@@ -0,0 +1,51 @@
+# This tests validates the order of generated sections that may contain
+# other sections.
+# When a `volume` section has both `subvolume` and `target` children,
+# `target` must go before `subvolume`. Otherwise, `target` will become
+# a child of the last `subvolume` instead of `volume`, due to the
+# order-sensitive config format.
+#
+# Issue: https://github.com/NixOS/nixpkgs/issues/195660
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "btrbk-section-order";
+  meta.maintainers = with lib.maintainers; [ oxalica ];
+
+  nodes.machine = { ... }: {
+    services.btrbk.instances.local = {
+      onCalendar = null;
+      settings = {
+        timestamp_format = "long";
+        target."ssh://global-target/".ssh_user = "root";
+        volume."/btrfs" = {
+          snapshot_dir = "/volume-snapshots";
+          target."ssh://volume-target/".ssh_user = "root";
+          subvolume."@subvolume" = {
+            snapshot_dir = "/subvolume-snapshots";
+            target."ssh://subvolume-target/".ssh_user = "root";
+          };
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("basic.target")
+    got = machine.succeed("cat /etc/btrbk/local.conf")
+    expect = """
+    backend btrfs-progs-sudo
+    timestamp_format long
+    target ssh://global-target/
+     ssh_user root
+    volume /btrfs
+     snapshot_dir /volume-snapshots
+     target ssh://volume-target/
+      ssh_user root
+     subvolume @subvolume
+      snapshot_dir /subvolume-snapshots
+      target ssh://subvolume-target/
+       ssh_user root
+    """.strip()
+    print(got)
+    assert got == expect
+  '';
+})

nixos/tests/chromium.nix

@@ -39,7 +39,9 @@ mapAttrs (channel: chromiumPkg: makeTest {
   name = "chromium-${channel}";
   meta = {
     maintainers = with maintainers; [ aszlig primeos ];
+  } // optionalAttrs (chromiumPkg.meta ? timeout) {
     # https://github.com/NixOS/hydra/issues/591#issuecomment-435125621
+    # Note: optionalAttrs is used since meta.timeout is not set for Google Chrome
     inherit (chromiumPkg.meta) timeout;
   };
 
@@ -65,6 +67,9 @@ mapAttrs (channel: chromiumPkg: makeTest {
     from contextlib import contextmanager
 
 
+    major_version = "${versions.major (getVersion chromiumPkg.name)}"
+
+
     # Run as user alice
     def ru(cmd):
         return "su - ${user} -c " + shlex.quote(cmd)
@@ -84,7 +89,6 @@ mapAttrs (channel: chromiumPkg: makeTest {
             binary = pname
         # Add optional CLI options:
         options = []
-        major_version = "${versions.major (getVersion chromiumPkg.name)}"
         if major_version > "95" and not pname.startswith("google-chrome"):
             # Workaround to avoid a GPU crash:
             options.append("--use-gl=swiftshader")
@@ -242,9 +246,11 @@ mapAttrs (channel: chromiumPkg: makeTest {
         machine.screenshot("after_copy_from_chromium")
 
 
-    with test_new_win("gpu_info", "chrome://gpu", "chrome://gpu"):
-        # To check the text rendering (catches regressions like #131074):
-        machine.wait_for_text("Graphics Feature Status")
+    if major_version < "107":
+        # TODO: Fix the chrome://gpu test for M107+
+        with test_new_win("gpu_info", "chrome://gpu", "chrome://gpu"):
+            # To check the text rendering (catches regressions like #131074):
+            machine.wait_for_text("Graphics Feature Status")
 
 
     with test_new_win("version_info", "chrome://version", "About Version") as clipboard:

nixos/tests/grafana/basic.nix

@@ -6,12 +6,18 @@ let
   baseGrafanaConf = {
     services.grafana = {
       enable = true;
-      addr = "localhost";
-      analytics.reporting.enable = false;
-      domain = "localhost";
-      security = {
-        adminUser = "testadmin";
-        adminPassword = "snakeoilpwd";
+      settings = {
+        analytics.reporting_enabled = false;
+
+        server = {
+          http_addr = "localhost";
+          domain = "localhost";
+        };
+
+        security = {
+          admin_user = "testadmin";
+          admin_password = "snakeoilpwd";
+        };
       };
     };
   };
@@ -24,7 +30,7 @@ let
     };
 
     postgresql = {
-      services.grafana.database = {
+      services.grafana.settings.database = {
         host = "127.0.0.1:5432";
         user = "grafana";
       };
@@ -40,7 +46,7 @@ let
     };
 
     mysql = {
-      services.grafana.database.user = "grafana";
+      services.grafana.settings.database.user = "grafana";
       services.mysql = {
         enable = true;
         ensureDatabases = [ "grafana" ];

nixos/tests/grafana/provision/default.nix

@@ -6,14 +6,20 @@ let
   baseGrafanaConf = {
     services.grafana = {
       enable = true;
-      addr = "localhost";
-      analytics.reporting.enable = false;
-      domain = "localhost";
-      security = {
-        adminUser = "testadmin";
-        adminPassword = "snakeoilpwd";
-      };
       provision.enable = true;
+      settings = {
+        analytics.reporting_enabled = false;
+
+        server = {
+          http_addr = "localhost";
+          domain = "localhost";
+        };
+
+        security = {
+          admin_user = "testadmin";
+          admin_password = "snakeoilpwd";
+        };
+      };
     };
 
     systemd.tmpfiles.rules = [

pkgs/applications/audio/open-stage-control/default.nix

@@ -9,25 +9,34 @@ in
 
 nodeComposition.package.override rec {
   pname = "open-stage-control";
-  inherit (nodeComposition.args) version;
+  version = "1.18.3";
 
   src = fetchFromGitHub {
     owner = "jean-emmanuel";
     repo = "open-stage-control";
     rev = "v${version}";
-    hash = "sha256-q18pRtsHfme+OPmi3LhJDK1AdpfkwhoE9LA2rNenDtY=";
+    hash = "sha256-AXdPxTauy2rMRMdfUjkfTjbNDgOKmoiGUeeLak0wu84=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     copyDesktopItems
     makeBinaryWrapper
+    nodejs
+    python3
   ];
 
   buildInputs = [
     python3.pkgs.python-rtmidi
   ];
 
-  dontNpmInstall = true;
+  doInstallCheck = true;
+
+  preRebuild = ''
+    # remove electron to prevent building since nixpkgs electron is used instead
+    rm -r node_modules/electron
+  '';
 
   postInstall = ''
     # build assets
@@ -48,7 +57,6 @@ nodeComposition.package.override rec {
   installCheckPhase = ''
     XDG_CONFIG_HOME="$(mktemp -d)" $out/bin/open-stage-control --help
   '';
-  doInstallCheck = true;
 
   desktopItems = [
     (makeDesktopItem {
@@ -62,6 +70,8 @@ nodeComposition.package.override rec {
     })
   ];
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     description = "Libre and modular OSC / MIDI controller";
     homepage = "https://openstagecontrol.ammd.net/";

pkgs/applications/audio/open-stage-control/generate-dependencies.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p jq nodePackages.node2nix
-
-# Get latest release tag
-tag="$(curl -s https://api.github.com/repos/jean-emmanuel/open-stage-control/releases/latest | jq -r .tag_name)"
-
-# Download package.json from the latest release
-curl -s https://raw.githubusercontent.com/jean-emmanuel/open-stage-control/"$tag"/package.json | grep -v '"electron"\|"electron-installer-debian"\|"electron-packager"\|"electron-packager-plugin-non-proprietary-codecs-ffmpeg"' >package.json
-
-# Lock dependencies with node2nix
-node2nix \
-  --node-env ../../../development/node-packages/node-env.nix \
-  --nodejs-16 \
-  --input package.json \
-  --output node-packages.nix \
-  --composition node-composition.nix
-
-rm -f package.json

pkgs/applications/audio/open-stage-control/update.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p common-updater-scripts jq nodePackages.node2nix
+set -euo pipefail
+
+# Find nixpkgs repo
+nixpkgs="$(git rev-parse --show-toplevel || (printf 'Could not find root of nixpkgs repo\nAre we running from within the nixpkgs git repo?\n' >&2; exit 1))"
+
+# Get latest release tag
+tag="$(curl -s https://api.github.com/repos/jean-emmanuel/open-stage-control/releases/latest | jq -r .tag_name)"
+
+# Download package.json from the latest release
+curl -sSL https://raw.githubusercontent.com/jean-emmanuel/open-stage-control/"$tag"/package.json | grep -v '"electron"\|"electron-installer-debian"' >"$nixpkgs"/pkgs/applications/audio/open-stage-control/package.json
+
+# Lock dependencies with node2nix
+node2nix \
+  --node-env "$nixpkgs"/pkgs/development/node-packages/node-env.nix \
+  --nodejs-16 \
+  --input "$nixpkgs"/pkgs/applications/audio/open-stage-control/package.json \
+  --output "$nixpkgs"/pkgs/applications/audio/open-stage-control/node-packages.nix \
+  --composition "$nixpkgs"/pkgs/applications/audio/open-stage-control/node-composition.nix
+
+rm -f "$nixpkgs"/pkgs/applications/audio/open-stage-control/package.json
+
+# Update hash
+(cd "$nixpkgs" && update-source-version "${UPDATE_NIX_ATTR_PATH:-open-stage-control}" "${tag#v}")

pkgs/applications/audio/touchosc/default.nix

@@ -45,7 +45,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "touchosc";
-  version = "1.1.5.145";
+  version = "1.1.6.150";
 
   suffix = {
     aarch64-linux = "linux-arm64";
@@ -56,9 +56,9 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     url = "https://hexler.net/pub/${pname}/${pname}-${version}-${suffix}.deb";
     hash = {
-      aarch64-linux = "sha256-3qbr9dveeDqP9psZNyN520B2JuG/R9yvpYX9CdqR7TI=";
-      armv7l-linux  = "sha256-wns0hb+5s7cEbV+4crUWRJ1yU3pl1N0NJ0GWmM4Uvos=";
-      x86_64-linux  = "sha256-LsrR46Epc8x0KTc2lbVN1rbb5KZXYTG8oygJ1BmsCC8=";
+      aarch64-linux = "sha256-sYkAFyXnmzgSzo68OF0oiv8tUvY+g1WCcY783OZO+RM=";
+      armv7l-linux  = "sha256-GWpYW1262plxIzPVzBEh4Z3fQIhSmy0N9xAgwnjXrQE=";
+      x86_64-linux  = "sha256-LUWlLEsTUqVoWAkjXC/zOziPqO85H8iIlwJU7eqLRcY=";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
@@ -96,6 +96,8 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     homepage = "https://hexler.net/touchosc";
     description = "Next generation modular control surface";

pkgs/applications/audio/touchosc/update.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix curl libxml2 jq common-updater-scripts
+
+set -euo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel || (printf 'Could not find root of nixpkgs repo\nAre we running from within the nixpkgs git repo?\n' >&2; exit 1))"
+
+attr="${UPDATE_NIX_ATTR_PATH:-touchosc}"
+version="$(curl -sSL https://hexler.net/touchosc/appcast/linux | xmllint --xpath '/rss/channel/item/enclosure/@*[local-name()="version"]' - | cut -d= -f2- | tr -d '"' | head -n1)"
+
+findpath() {
+    path="$(nix --extra-experimental-features nix-command eval --json --impure -f "$nixpkgs" "$1.meta.position" | jq -r . | cut -d: -f1)"
+    outpath="$(nix --extra-experimental-features nix-command eval --json --impure --expr "builtins.fetchGit \"$nixpkgs\"")"
+
+    if [ -n "$outpath" ]; then
+        path="${path/$(echo "$outpath" | jq -r .)/$nixpkgs}"
+    fi
+
+    echo "$path"
+}
+
+pkgpath="$(findpath "$attr")"
+
+sed -i -e "/version\s*=/ s|\"$UPDATE_NIX_OLD_VERSION\"|\"$version\"|" "$pkgpath"
+
+for system in aarch64-linux armv7l-linux x86_64-linux; do
+    url="$(nix --extra-experimental-features nix-command eval --json --impure --argstr system "$system" -f "$nixpkgs" "$attr".src.url | jq -r .)"
+
+    curhash="$(nix --extra-experimental-features nix-command eval --json --impure --argstr system "$system" -f "$nixpkgs" "$attr".src.outputHash | jq -r .)"
+    newhash="$(nix --extra-experimental-features nix-command store prefetch-file --json "$url" | jq -r .hash)"
+
+    sed -i -e "s|\"$curhash\"|\"$newhash\"|" "$pkgpath"
+done

pkgs/applications/editors/vim/plugins/generated.nix

@@ -3873,6 +3873,18 @@ final: prev:
     meta.homepage = "https://github.com/rebelot/kanagawa.nvim/";
   };
 
+  keymap-layer-nvim = buildVimPluginFrom2Nix {
+    pname = "keymap-layer.nvim";
+    version = "2022-07-16";
+    src = fetchFromGitHub {
+      owner = "anuvyklack";
+      repo = "keymap-layer.nvim";
+      rev = "e46840f9f377766e856964a49d7f351de3188a38";
+      sha256 = "1bmvsr14b3hmbyzjx8wh4wyfqwh4vyy9zyvl04sz5kafw63j7wi1";
+    };
+    meta.homepage = "https://github.com/anuvyklack/keymap-layer.nvim/";
+  };
+
   kommentary = buildVimPluginFrom2Nix {
     pname = "kommentary";
     version = "2022-05-27";
@@ -4881,6 +4893,18 @@ final: prev:
     meta.homepage = "https://github.com/Shougo/neco-vim/";
   };
 
+  neo-tree-nvim = buildVimPluginFrom2Nix {
+    pname = "neo-tree.nvim";
+    version = "2022-10-22";
+    src = fetchFromGitHub {
+      owner = "nvim-neo-tree";
+      repo = "neo-tree.nvim";
+      rev = "ab8ca9fac52949d7a741b538c5d9c3898cd0f45a";
+      sha256 = "0ccrxj04md7lssfwy9lvw4sn99iwkpci9lddc577m6zs1nz00lw0";
+    };
+    meta.homepage = "https://github.com/nvim-neo-tree/neo-tree.nvim/";
+  };
+
   neocomplete-vim = buildVimPluginFrom2Nix {
     pname = "neocomplete.vim";
     version = "2021-02-18";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -624,6 +624,10 @@ self: super: {
     dependencies = with self; [ plenary-nvim ];
   });
 
+  neo-tree-nvim = super.neo-tree-nvim.overrideAttrs (old: {
+    dependencies = with self; [ plenary-nvim nui-nvim ];
+  });
+
   noice-nvim = super.noice-nvim.overrideAttrs(old: {
     dependencies = with self; [ nui-nvim nvim-notify ];
   });

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -324,6 +324,7 @@ https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
 https://github.com/JuliaEditorSupport/julia-vim/,,
 https://github.com/rebelot/kanagawa.nvim/,,
+https://github.com/anuvyklack/keymap-layer.nvim/,HEAD,
 https://github.com/b3nj5m1n/kommentary/,,
 https://github.com/udalov/kotlin-vim/,,
 https://github.com/qnighy/lalrpop.vim/,,
@@ -409,6 +410,7 @@ https://github.com/eagletmt/neco-ghc/,,
 https://github.com/ujihisa/neco-look/,,
 https://github.com/Shougo/neco-syntax/,,
 https://github.com/Shougo/neco-vim/,,
+https://github.com/nvim-neo-tree/neo-tree.nvim/,HEAD,
 https://github.com/Shougo/neocomplete.vim/,,
 https://github.com/KeitaNakamura/neodark.vim/,,
 https://github.com/folke/neodev.nvim/,HEAD,

pkgs/applications/graphics/photoflare/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "photoflare";
-  version = "1.6.10";
+  version = "1.6.11";
 
   src = fetchFromGitHub {
     owner = "PhotoFlare";
     repo = "photoflare";
     rev = "v${version}";
-    sha256 = "sha256-lQIzvI6rjcx8pHni9LN15LWyIkMALvyYx54G9WyqpOo=";
+    sha256 = "sha256-nXVTkkfRpbLZ+zUgnSzKNlVixI86eKoG5FO8GqgnrDY=";
   };
 
   nativeBuildInputs = [ qmake qttools ];

pkgs/applications/misc/caerbannog/default.nix

@@ -7,6 +7,7 @@
 , ninja
 , pkg-config
 , wrapGAppsHook
+, gtk3
 , atk
 , libhandy
 , libnotify
@@ -35,6 +36,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   buildInputs = [
+    gtk3
     atk
     gobject-introspection
     libhandy

pkgs/applications/misc/cpu-x/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpu-x";
-  version = "4.5.0";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "X0rg";
     repo = "CPU-X";
     rev = "v${version}";
-    sha256 = "sha256-pkyYfGpACF8kRCCUwEQtA5tMDSShsm+58KzUruc5pXE=";
+    sha256 = "sha256-rmRfKw2KMLsO3qfy2QznCIugvM2CLSxBUDgIzONYULk=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapGAppsHook nasm makeWrapper ];

pkgs/applications/misc/dmenu/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dmenu";
-  version = "5.1";
+  version = "5.2";
 
   src = fetchurl {
     url = "https://dl.suckless.org/tools/dmenu-${version}.tar.gz";
-    sha256 = "sha256-H01wnrujfrcybroOZl4PE75Pok7jXJWw15ww8Uo0j9U=";
+    sha256 = "sha256-1NTKd7WRQPJyJy21N+BbuRpZFPVoAmUtxX5hp3PUN5I=";
   };
 
   buildInputs = [ libX11 libXinerama zlib libXft ];

pkgs/applications/misc/mangal/default.nix

@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "mangal";
-  version = "3.12.0";
+  version = "3.14.0";
 
   src = fetchFromGitHub {
     owner = "metafates";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-1fWy7riInrbReQ0sQ1TF8GhqWQG0KXk1JzhmxlSuvmk=";
+    hash = "sha256-IQSRPjtMaxwJuiKGjOYQ7jp0mAPS/V6fA1/Ek/K5yqk=";
   };
 
   proxyVendor = true;
-  vendorSha256 = "sha256-+HDuGSZinotUtCqffrmFkjHegxdArSJMWwnUG/tnLRc=";
+  vendorSha256 = "sha256-XslNMrFCI+dGaSw7ro1vBMamFukbMA3m0I3hOl9QccM=";
 
   ldflags = [ "-s" "-w" ];
 

pkgs/applications/misc/nwg-wrapper/default.nix

@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "nwg-wrapper";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "114y55mv2rgnp75a3c7rk46v5v84d1zqb6wkha7x16ab6xa9phzl";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-GKDAdjO67aedCEFHKDukQ+oPMomTPwFE/CvJu112fus=";
   };
 
   nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
@@ -17,9 +17,6 @@ python3Packages.buildPythonPackage rec {
 
   propagatedBuildInputs = with python3Packages; [ i3ipc pygobject3 ];
 
-  # ValueError: Namespace GtkLayerShell not available
-  strictDeps = false;
-
   # No tests
   doCheck = false;
 

pkgs/applications/misc/vym/000-fix-zip-paths.diff

@@ -0,0 +1,21 @@
+diff -Naur source-old/src/main.cpp source-new/src/main.cpp
+--- source-old/src/main.cpp	1969-12-31 21:00:01.000000000 -0300
++++ source-new/src/main.cpp	2022-10-23 22:30:00.463905363 -0300
+@@ -286,13 +286,10 @@
+     // Platform specific settings
+     vymPlatform = QSysInfo::prettyProductName();
+ 
+-#if defined(Q_OS_WINDOWS)
+-    // Only Windows 10 has tar. Older windows versions not supported.
+-    zipToolPath = "tar";
+-#else
+-    zipToolPath = "/usr/bin/zip";
+-    unzipToolPath = "/usr/bin/unzip";
+-#endif
++    // Nixpkgs-specific hack
++    zipToolPath = "@zipPath@";
++    unzipToolPath = "@unzipPath@";
++
+     iconPath = vymBaseDir.path() + "/icons/";
+     flagsPath = vymBaseDir.path() + "/flags/";
+ 

pkgs/applications/misc/vym/default.nix

@@ -1,59 +1,69 @@
-{ lib, mkDerivation, fetchurl, pkg-config, qmake, qtscript, qtsvg }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, qmake
+, qtbase
+, qtscript
+, qtsvg
+, substituteAll
+, unzip
+, wrapQtAppsHook
+, zip
+}:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "vym";
-  version = "2.7.1";
+  version = "2.8.42";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/project/vym/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "0lyf0m4y5kn5s47z4sg10215f3jsn3k1bl389jfbh2f5v4srav4g";
+  src = fetchFromGitHub {
+    owner = "insilmaril";
+    repo = "vym";
+    rev = "89f50bcba953c410caf459b0a4bfbd09018010b7"; # not tagged yet (why??)
+    hash = "sha256-xMXvc8gt3nfKWbU+WoS24wCUTGDQRhG0Q9m7yDhY5/w=";
   };
 
-  # Hardcoded paths scattered about all have form share/vym
-  # which is encouraging, although we'll need to patch them (below).
-  qmakeFlags = [
-    "DATADIR=${placeholder "out"}/share"
-    "DOCDIR=${placeholder "out"}/share/doc/vym"
+  patches = [
+    (substituteAll {
+      src = ./000-fix-zip-paths.diff;
+      zipPath = "${zip}/bin/zip";
+      unzipPath = "${unzip}/bin/unzip";
+    })
   ];
 
-  postPatch = ''
-    for x in \
-      exportoofiledialog.cpp \
-      main.cpp \
-      mainwindow.cpp \
-      tex/*.{tex,lyx}; \
-    do
-      substituteInPlace $x \
-        --replace /usr/share/vym $out/share/vym \
-        --replace /usr/local/share/vym $out/share/vym \
-        --replace /usr/share/doc $out/share/doc/vym
-    done
-  '';
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapQtAppsHook
+  ];
 
-  hardeningDisable = [ "format" ];
+  buildInputs = [
+    qtbase
+    qtscript
+    qtsvg
+  ];
 
-  nativeBuildInputs = [ pkg-config qmake ];
-  buildInputs = [ qtscript qtsvg ];
-
-  postInstall = ''
-    install -Dm755 -t $out/share/man/man1 doc/*.1.gz
-  '';
+  qtWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [ unzip zip ]}"
+  ];
 
   meta = with lib; {
+    homepage = "http://www.insilmaril.de/vym/";
     description = "A mind-mapping software";
     longDescription = ''
-      VYM (View Your Mind) is a tool to generate and manipulate maps which show your thoughts.
-      Such maps can help you to improve your creativity and effectivity. You can use them
-      for time management, to organize tasks, to get an overview over complex contexts,
-      to sort your ideas etc.
+      VYM (View Your Mind) is a tool to generate and manipulate maps which show
+      your thoughts. Such maps can help you to improve your creativity and
+      effectivity. You can use them for time management, to organize tasks, to
+      get an overview over complex contexts, to sort your ideas etc.
 
-      Maps can be drawn by hand on paper or a flip chart and help to structure your thoughs.
-      While a tree like structure like shown on this page can be drawn by hand or any drawing software
-      vym offers much more features to work with such maps.
+      Maps can be drawn by hand on paper or a flip chart and help to structure
+      your thoughs. While a tree like structure like shown on this page can be
+      drawn by hand or any drawing software vym offers much more features to
+      work with such maps.
     '';
-    homepage = "http://www.insilmaril.de/vym/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = [ maintainers.AndersonTorres ];
     platforms = platforms.linux;
   };
-}
+})

pkgs/applications/misc/watchmate/default.nix

@@ -0,0 +1,54 @@
+{ lib
+, rustPlatform
+, fetchFromGitLab
+, pkg-config
+, gtk4
+, libadwaita
+, bluez
+, dbus
+, openssl
+, wrapGAppsHook4
+, glib
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "watchmate";
+  version = "0.3.0";
+
+  src = fetchFromGitLab {
+    owner = "azymohliad";
+    repo = "watchmate";
+    rev = "v${version}";
+    sha256 = "sha256-HyH+9KMbdiJSmjo2NsAvz8rN3JhYKz1nNqfuZufKjQA=";
+  };
+
+  cargoSha256 = "sha256-HvuxKPIVwVrcsTKgPwNosF/ar8QL9Jlldq7SBe2nh6o=";
+
+  nativeBuildInputs = [
+    pkg-config
+    wrapGAppsHook4
+    glib
+  ];
+  buildInputs = [
+    gtk4
+    libadwaita
+    bluez
+    dbus
+    openssl
+  ];
+
+  postInstall = ''
+    install -Dm444 assets/io.gitlab.azymohliad.WatchMate.desktop -t $out/share/applications/
+    install -Dm444 assets/io.gitlab.azymohliad.WatchMate.metainfo.xml -t $out/share/metainfo/
+    install -Dm444 assets/icons/io.gitlab.azymohliad.WatchMate.svg -t $out/share/icons/hicolor/scalable/apps/
+    install -Dm444 assets/icons/io.gitlab.azymohliad.WatchMate-symbolic.svg -t $out/share/icons/hicolor/scalable/apps/
+  '';
+
+  meta = with lib; {
+    description = "PineTime smart watch companion app for Linux phone and desktop";
+    homepage = "https://gitlab.com/azymohliad/watchmate";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ chuangzhu ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/networking/instant-messengers/discord/darwin.nix

@@ -1,4 +1,4 @@
-{ pname, version, src, openasar, meta, stdenv, binaryName, desktopName, lib, undmg, makeWrapper, withOpenASAR ? false }:
+{ pname, version, src, openasar, meta, stdenv, binaryName, desktopName, lib, undmg, makeWrapper, branch, withOpenASAR ? false }:
 
 stdenv.mkDerivation {
   inherit pname version src meta;

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -2,7 +2,7 @@
 let
   versions = if stdenv.isLinux then {
     stable = "0.0.21";
-    ptb = "0.0.29";
+    ptb = "0.0.34";
     canary = "0.0.140";
   } else {
     stable = "0.0.264";
@@ -18,7 +18,7 @@ let
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        sha256 = "d78NnQZ3MkLje8mHrI6noH2iD2oEvSJ3cDnsmzQsUYc=";
+        sha256 = "CD6dLoBnlvhpwEFfLI9OqjhviZPj3xNDyPK9qBJUqck=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
@@ -69,7 +69,7 @@ let
       (_: value:
         callPackage package (value
           // {
-          inherit src version openasar;
+          inherit src version openasar branch;
           meta = meta // { mainProgram = value.binaryName; };
         }))
       {

pkgs/applications/networking/instant-messengers/discord/linux.nix

@@ -5,6 +5,7 @@
 , libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext, libXfixes
 , libXi, libXrandr, libXrender, libXtst, libxcb, libxshmfence, mesa, nspr, nss
 , pango, systemd, libappindicator-gtk3, libdbusmenu, writeScript, python3, runCommand
+, branch
 , common-updater-scripts, withOpenASAR ? false }:
 
 let
@@ -141,7 +142,7 @@ stdenv.mkDerivation rec {
       }?platform=linux&format=tar.gz" | grep -oP 'location: \K\S+')
       version=''${url##https://dl*.discordapp.net/apps/linux/}
       version=''${version%%/*.tar.gz}
-      update-source-version ${pname} "$version" --file=./pkgs/applications/networking/instant-messengers/discord/default.nix
+      update-source-version ${pname} "$version" --file=./pkgs/applications/networking/instant-messengers/discord/default.nix --version-key=${branch}
     '';
   };
 }

pkgs/applications/networking/instant-messengers/zoom-us/default.nix

@@ -47,23 +47,23 @@ let
   # and often with different versions.  We write them on three lines
   # like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "5.12.0.11129";
-  versions.x86_64-darwin = "5.12.0.11129";
-  versions.x86_64-linux = "5.12.0.4682";
+  versions.aarch64-darwin = "5.12.3.11845";
+  versions.x86_64-darwin = "5.12.3.11845";
+  versions.x86_64-linux = "5.12.2.4816";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-0XhqJrls4X8wO9VNmmmUGexJkA9NDkwJkYRjmyV1kAU=";
+      hash = "sha256-iDLxqG7/cdo60V0mFE3tX/Msi0rRUjoM8X9yq2rlvf0=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-E7+zMrW4y1RfsR1LrxCJRRVlA+BuhzwMI/sfzqNHObo=";
+      hash = "sha256-+YOtdoh8S50+GHRLb6TPYCqDtry7SnnNqo7USzkDc7c=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-UNtxyR4SMCP9c1Dre/arfdSVZbAV8qoHyHlvj3ZbXIs=";
+      hash = "sha256-kgjooMqeZurzqIn3ADcgFjlqaC58dQNuIAHLx4M0S9I=";
     };
   };
 

pkgs/applications/office/libreoffice/default.nix

@@ -364,6 +364,11 @@ in
     ln -s $out/bin/soffice $out/bin/libreoffice
     ln -s $out/lib/libreoffice/share/xdg $out/share/applications
 
+    for f in $out/share/applications/*.desktop; do
+      substituteInPlace "$f" \
+        --replace "Exec=libreoffice${major}.${minor}" "Exec=libreoffice"
+    done
+
     cp -r sysui/desktop/icons  "$out/share"
     sed -re 's@Icon=libreoffice(dev)?[0-9.]*-?@Icon=@' -i "$out/share/applications/"*.desktop
 

pkgs/applications/office/trilium/default.nix

@@ -10,13 +10,13 @@ let
     maintainers = with maintainers; [ fliegendewurst ];
   };
 
-  version = "0.55.1";
+  version = "0.56.1";
 
   desktopSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-  desktopSource.sha256 = "0c12azw0hrax392ymn25nqszdhsy8p5cf970rfq9d98qp0i8ywf0";
+  desktopSource.sha256 = "1h6fwpk317mx341ib84gqxgacd0l65hxw79vqbm2fw25g68dphbb";
 
   serverSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-  serverSource.sha256 = "04yjkmz2ck6r0c2593w2ck4w66x9wjzma0vaddx29b9anh9vrln3";
+  serverSource.sha256 = "1c134gi6zaxg19kc1c46fnpk9kg42949xxmivba7w17lx7asc5if";
 
 in {
 

pkgs/applications/science/chemistry/openmolcas/default.nix

@@ -15,14 +15,14 @@ let
 
 in stdenv.mkDerivation {
   pname = "openmolcas";
-  version = "22.06";
+  version = "22.10";
 
   src = fetchFromGitLab {
     owner = "Molcas";
     repo = "OpenMolcas";
     # The tag keeps moving, fix a hash instead
-    rev = "17238da5c339c41ddf14ceb88f139d57143d7a14"; # 2022-06-17
-    sha256 = "0g17x5fp27b57f7j284xl3b3i9c4b909q504wpz0ipb0mrcvcpdp";
+    rev = "aedb15be52d6dee285dd3e10e9d05f44e4ca969a"; # 2022-10-22
+    sha256 = "sha256-7d2wBIEg/r5bPZXlngTIZxYdMN0UIop7TA+WFZmzCo8=";
   };
 
   patches = [

pkgs/applications/science/physics/dawn/default.nix

@@ -1,6 +1,8 @@
 { lib
 , stdenv
 , fetchurl
+, tk
+, makeWrapper
 }:
 
 stdenv.mkDerivation rec {
@@ -18,12 +20,19 @@ stdenv.mkDerivation rec {
       --replace 'INSTALL_DIR =' "INSTALL_DIR = $out/bin#"
   '';
 
+  nativeBuildInputs = [ makeWrapper ];
+
   dontConfigure = true;
 
   preInstall = ''
     mkdir -p "$out/bin"
   '';
 
+  postInstall = ''
+    wrapProgram "$out/bin/DAWN_GUI" \
+      --prefix PATH : ${lib.makeBinPath [ tk ]}
+  '';
+
   meta = with lib; {
     description = "A vectorized 3D PostScript processor with analytical hidden line/surface removal";
     license = licenses.unfree;

pkgs/applications/science/physics/dawncut/default.nix

@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dawncut";
+  version = "1.54a";
+
+  src = fetchurl {
+    name = "${pname}-${version}.tar.gz";
+    url = "https://geant4.kek.jp/~tanaka/src/dawncut_${builtins.replaceStrings ["."] ["_"] version}.taz";
+    hash = "sha256-Ux4fDi7TXePisYAxCMDvtzLYOgxnbxQIO9QacTRrT6k=";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile.architecture \
+      --replace 'CXX      := g++' ""
+  '';
+
+  dontConfigure = true;
+
+  NIX_CFLAGS_COMPILE="-std=c++98";
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm 500 dawncut "$out/bin/dawncut"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A tool to generate a 3D scene data clipped with an arbitrary plane";
+    license = licenses.unfree;
+    homepage = "https://geant4.kek.jp/~tanaka/DAWN/About_DAWNCUT.html";
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ veprbl ];
+  };
+}

pkgs/applications/window-managers/e16/default.nix

@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "e16";
-  version = "1.0.25";
+  version = "1.0.26";
 
   src = fetchurl {
     url = "mirror://sourceforge/enlightenment/e16-${version}.tar.xz";
-    hash = "sha256-rUtDaBa4vvC3gO7QSkFrphWuVOmbtkH+pRujQDaUOek=";
+    hash = "sha256-1FJFE4z8UT5VYv0Ef9pqi5sYq8iIbrDPKaqcUFf9dwE=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/arcan/arcan/default.nix

@@ -58,13 +58,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "arcan" + lib.optionalString useStaticOpenAL "-static-openal";
-  version = "0.6.2";
+  version = "0.6.2.1";
 
   src = fetchFromGitHub {
     owner = "letoram";
     repo = "arcan";
     rev = finalAttrs.version;
-    hash = "sha256-Qwyt927eLqaCqJ4Lo4J1lQX2A24ke+AH52rmSCTnpO0=";
+    hash = "sha256-7H3fVSsW5VANLqwhykY+Q53fPjz65utaGksh/OpZnJM=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/plasma-5/3rdparty/addons/bismuth/default.nix

@@ -12,13 +12,13 @@
 
 mkDerivation rec {
   pname = "bismuth";
-  version = "3.1.3";
+  version = "3.1.4";
 
   src = fetchFromGitHub {
     owner = "Bismuth-Forge";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-IWwFsYqoqW3924+pf8L+acIt31aU/mhqakXbT9Q4Bqw=";
+    sha256 = "sha256-c13OFEw6E/I8j/mqeLnuc9Chi6pc3+AgwAMPpCzh974=";
   };
 
   cmakeFlags = [

pkgs/development/compilers/ballerina/default.nix

@@ -1,6 +1,6 @@
 { ballerina, lib, writeText, runCommand, makeWrapper, fetchzip, stdenv, openjdk }:
 let
-  version = "2201.2.1";
+  version = "2201.2.2";
   codeName = "swan-lake";
 in stdenv.mkDerivation {
   pname = "ballerina";
@@ -8,7 +8,7 @@ in stdenv.mkDerivation {
 
   src = fetchzip {
     url = "https://dist.ballerina.io/downloads/${version}/ballerina-${version}-${codeName}.zip";
-    sha256 = "sha256-QNXaEivwlqBdbpxGCYnfIN/fQkWlVu8lqGWKfLlVB5s=";
+    sha256 = "sha256-xBr7lsZJKk4VXuUDt7IRQN/ZDH4WrxYjd1mBIoyb9qs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/development/compilers/cmucl/binary.nix

@@ -1,44 +1,62 @@
-{lib, stdenv, fetchurl}:
+{ lib
+, stdenv
+, fetchurl
+, installShellFiles
+}:
 
-let
-  inherit (stdenv.hostPlatform) system;
-  version = "21b";
-  downloadUrl = arch:
-    "http://common-lisp.net/project/cmucl/downloads/release/" +
-    "${version}/cmucl-${version}-${arch}.tar.bz2";
-  fetchDist = {arch, sha256}: fetchurl {
-    url = downloadUrl arch;
-    inherit sha256;
-  };
-  dist =
-    if system == "i686-linux" then fetchDist {
-        arch = "x86-linux";
-        sha256 = "13k3b5ygnbsq6n2i3r5i4ljw3r1qlskn2p5f4x9hrx6vfvbb3k7a";
-      }
-    else throw "Unsupported platform for cmucl.";
-in
-
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cmucl-binary";
-  inherit version;
+  version = "21d";
 
-  buildCommand = ''
-    mkdir -p $out
-    tar -C $out -xjf ${dist}
+  srcs = [
+    (fetchurl {
+      url = "http://common-lisp.net/project/cmucl/downloads/release/"
+            + finalAttrs.version + "/cmucl-${finalAttrs.version}-x86-linux.tar.bz2";
+      hash = "sha256-RdctcqPTtQh1Yb3BrpQ8jtRFQn85OcwOt1l90H6xDZs=";
+    })
+    (fetchurl {
+      url = "http://common-lisp.net/project/cmucl/downloads/release/"
+            + finalAttrs.version + "/cmucl-${finalAttrs.version}-x86-linux.extra.tar.bz2";
+      hash = "sha256-zEmiW3m5VPpFgPxV1WJNCqgYRlHMovtaMXcgXyNukls=";
+    })];
+
+  sourceRoot = ".";
+
+  outputs = [ "out" "doc" "man" ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -pv $out $doc/share $man
+    mv bin lib -t $out
+    mv -v doc -t $doc/share
+    installManPage man/man1/*
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
     patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       $out/bin/lisp
   '';
 
-  meta = {
+  meta = with lib; {
+    homepage = "http://www.cons.org/cmucl/";
     description = "The CMU implementation of Common Lisp";
     longDescription = ''
       CMUCL is a free implementation of the Common Lisp programming language
       which runs on most major Unix platforms.  It mainly conforms to the
       ANSI Common Lisp standard.
     '';
-    license = lib.licenses.free;		# public domain
-    homepage = "http://www.cons.org/cmucl/";
+    license = licenses.publicDomain;
     maintainers = [ ];
-    platforms = lib.platforms.linux;
+    platforms = [ "i686-linux" "x86_64-linux" ];
   };
-}
+})

pkgs/development/compilers/nim/default.nix

@@ -109,6 +109,9 @@ in {
     buildPhase = ''
       runHook preBuild
       local HOME=$TMPDIR
+    '' + lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
+      sed -i "s/aarch64/arm64/g" makefile
+    '' + ''
       make -j$NIX_BUILD_CORES
       ./bin/nim c --parallelBuild:$NIX_BUILD_CORES koch
       ./koch boot $kochArgs --parallelBuild:$NIX_BUILD_CORES

pkgs/development/interpreters/clojure/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "clojure";
-  version = "1.11.1.1165";
+  version = "1.11.1.1177";
 
   src = fetchurl {
     # https://clojure.org/releases/tools
     url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "sha256-UXukXP6Dt1Clj4JGvO5WmuFJ2HJGkPLbyP8xhxU/6dE=";
+    sha256 = "sha256-Axutyw+f7TPObxcw8llbu3r0zxYIKxFnBuUp+trR9eI=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/armadillo/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "11.4.1";
+  version = "11.4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "sha256-2ttf01vE3CUbNvXdgHKcPFiNZeLsvNTk41mtnLBFI/s=";
+    sha256 = "sha256-5oYBNPGsllbGoczHTHS3X4xZZqyGEoQfL78Mkc459Ok=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/boost/1.80.nix

@@ -0,0 +1,14 @@
+{ callPackage, fetchurl, fetchpatch, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  version = "1.80.0";
+
+  src = fetchurl {
+    urls = [
+      "mirror://sourceforge/boost/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
+      "https://boostorg.jfrog.io/artifactory/main/release/${version}/source/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
+    ];
+    # SHA256 from http://www.boost.org/users/history/version_1_80_0.html
+    sha256 = "1e19565d82e43bc59209a168f5ac899d3ba471d55c7610c677d4ccf2c9c500c0";
+  };
+})

pkgs/development/libraries/boost/default.nix

@@ -32,4 +32,5 @@ in {
   boost177 = makeBoost ./1.77.nix;
   boost178 = makeBoost ./1.78.nix;
   boost179 = makeBoost ./1.79.nix;
+  boost180 = makeBoost ./1.80.nix;
 }

pkgs/development/libraries/libowfat/default.nix

@@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "1hcqg7pvy093bxx8wk7i4gvbmgnxz2grxpyy7b4mphidjbcv7fgl";
   };
 
+  patches = [
+    (fetchurl {
+      name = "first_deferred.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-libs/libowfat/files/libowfat-0.32-gcc10.patch?id=129f4ab9f8571c651937c46ba7bd4c82d6d052a2";
+      sha256 = "zxWb9qq5dkDucOsiPfGG1Gb4BZ6HmhBjgSe3tBnydP4=";
+    })
+  ];
+
   # Fix for glibc 2.34 from Gentoo
   # https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=914a4aa87415dabfe77181a2365766417a5919a4
   postPatch = ''

pkgs/development/libraries/libvarlink/default.nix

@@ -4,17 +4,19 @@
 , meson
 , ninja
 , python3
+, nix-update-script
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libvarlink";
-  version = "22";
+  version = "23";
 
   src = fetchFromGitHub {
     owner = "varlink";
-    repo = pname;
-    rev = version;
-    sha256 = "1i15227vlc9k4276r833ndhxrcys9305pf6dga1j0alx2vj85yz2";
+    repo = finalAttrs.pname;
+    rev = finalAttrs.version;
+    sha256 = "sha256-oUy9HhybNMjRBWoqqal1Mw8cC5RddgN4izxAl0cgnKE=";
   };
 
   nativeBuildInputs = [ meson ninja ];
@@ -33,6 +35,18 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = finalAttrs.pname;
+    };
+    tests = {
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        command = "varlink --version";
+      };
+    };
+  };
+
   meta = with lib; {
     description = "C implementation of the Varlink protocol and command line tool";
     homepage = "https://github.com/varlink/libvarlink";
@@ -40,4 +54,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ artturin ];
     platforms = platforms.linux;
   };
-}
+})

pkgs/development/libraries/ncnn/cmakelists.patch

@@ -1,13 +1,26 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 98611276..989350bb 100644
+index c453d23e..66b4aa24 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -260,6 +260,8 @@ if(NCNN_VULKAN)
-                 include("${GLSLANG_TARGET_DIR}/HLSLTargets.cmake")
-             endif()
-             include("${GLSLANG_TARGET_DIR}/glslangTargets.cmake")
+@@ -478,6 +478,8 @@ if(NCNN_VULKAN)
+ 
+             find_package(Threads)
+ 
 +            include("${GLSLANG_TARGET_DIR}/SPIRV-Tools/SPIRV-ToolsTarget.cmake")
 +            include("${GLSLANG_TARGET_DIR}/SPIRV-Tools-opt/SPIRV-Tools-optTargets.cmake")
-             include("${GLSLANG_TARGET_DIR}/SPIRVTargets.cmake")
- 
-             if (NOT TARGET glslang OR NOT TARGET SPIRV)
+             include("${GLSLANG_TARGET_DIR}/OSDependentTargets.cmake")
+             include("${GLSLANG_TARGET_DIR}/OGLCompilerTargets.cmake")
+             if(EXISTS "${GLSLANG_TARGET_DIR}/HLSLTargets.cmake")
+diff --git a/src/ncnn.pc.in b/src/ncnn.pc.in
+index b580fcee..be2becd0 100644
+--- a/src/ncnn.pc.in
++++ b/src/ncnn.pc.in
+@@ -1,6 +1,6 @@
+ prefix=${pcfiledir}/../..
+-librarydir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
++librarydir=@CMAKE_INSTALL_FULL_LIBDIR@
++includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
+ 
+ Name: @CMAKE_PROJECT_NAME@
+ Description: high-performance neural network inference framework optimized for the mobile platform

pkgs/development/libraries/ncnn/default.nix

@@ -45,6 +45,5 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/Tencent/ncnn";
     license = licenses.bsd3;
     maintainers = with maintainers; [ tilcreator ];
-    broken = true; # at 2022-11-23
   };
 }

pkgs/development/ocaml-modules/arp/default.nix

@@ -25,6 +25,7 @@ buildDunePackage rec {
   propagatedBuildInputs = [
     cstruct
     duration
+    ethernet
     ipaddr
     logs
     lwt
@@ -37,7 +38,6 @@ buildDunePackage rec {
   doCheck = true;
   checkInputs = [
     alcotest
-    ethernet
     mirage-clock-unix
     mirage-profile
     mirage-random

pkgs/development/ocaml-modules/bls12-381-signature/default.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  fetchzip,
+  buildDunePackage,
+  bls12-381,
+  alcotest,
+  bisect_ppx,
+  integers_stubs_js,
+}:
+
+buildDunePackage rec {
+  pname = "bls12-381-signature";
+  version = "1.0.0";
+  src = fetchzip {
+    url = "https://gitlab.com/nomadic-labs/cryptography/ocaml-${pname}/-/archive/${version}/ocaml-bls12-381-signature-${version}.tar.bz2";
+    sha256 = "sha256-KaUpAT+BWxmUP5obi4loR9vVUeQmz3p3zG3CBolUuL4=";
+  };
+
+  minimalOCamlVersion = "4.08";
+
+  propagatedBuildInputs = [ bls12-381 ];
+
+  checkInputs = [alcotest bisect_ppx integers_stubs_js];
+
+  doCheck = true;
+
+  meta = {
+    description = "Implementation of BLS signatures for the pairing-friendly curve BLS12-381";
+    license = lib.licenses.mit;
+    homepage = "https://gitlab.com/nomadic-labs/cryptography/ocaml-bls12-381-signature";
+    maintainers = [lib.maintainers.ulrikstrid];
+  };
+}

pkgs/development/ocaml-modules/git/default.nix

@@ -8,13 +8,13 @@
 
 buildDunePackage rec {
   pname = "git";
-  version = "3.9.1";
+  version = "3.10.0";
 
   minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-git/releases/download/${version}/git-${version}.tbz";
-    sha256 = "sha256-OyeMW5gsq4fMEWRmhzPq2qardFZtMjoQk6mMKz5+Ds4=";
+    sha256 = "sha256-slUzAT4qwPzUNzHMbib/ArxaGzcMFl8tg0ynq1y5U1M=";
   };
 
   # remove changelog for the carton package

pkgs/development/ocaml-modules/paf/default.nix

@@ -25,11 +25,11 @@
 
 buildDunePackage rec {
   pname = "paf";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchurl {
     url = "https://github.com/dinosaure/paf-le-chien/releases/download/${version}/paf-${version}.tbz";
-    sha256 = "sha256-JIJjECEbajauowbXot19vtiDhTpGAQiSCBY0AHZOyZM=";
+    sha256 = "sha256-TzhRxFTPkLMAsLPl0ONC8DRhJRGstF58+QRKbGuJZVE=";
   };
 
   minimalOCamlVersion = "4.08";

pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/default.nix

@@ -4,6 +4,7 @@
   buildDunePackage,
   bls12-381,
   data-encoding,
+  bigstringaf,
   alcotest,
   alcotest-lwt,
   bisect_ppx,
@@ -12,16 +13,16 @@
 
 buildDunePackage rec {
   pname = "tezos-bls12-381-polynomial";
-  version = "0.1.2";
+  version = "0.1.3";
   duneVersion = "3";
   src = fetchFromGitLab {
     owner = "nomadic-labs/cryptography";
     repo = "privacy-team";
     rev = "v${version}";
-    sha256 = "sha256-HVeKZCPBRJWQXkcI2J7Fl4qGviYLD5x+4W4pAY/W4jA=";
+    sha256 = "sha256-H1Wog3GItTIVsawr9JkyyKq+uGqbTQPTR1dacpmxLbs=";
   };
 
-  propagatedBuildInputs = [bls12-381 data-encoding];
+  propagatedBuildInputs = [bls12-381 data-encoding bigstringaf];
 
   checkInputs = [alcotest alcotest-lwt bisect_ppx qcheck-alcotest];
 

pkgs/development/python-modules/aiobiketrax/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiobiketrax";
-  version = "0.3.0";
+  version = "0.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "basilfx";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-goS+BLIeFJ2fXQ2srbhKRfEjsMFX3+eA7iWzpBWMqZQ=";
+    hash = "sha256-P8BExzL22rRj1IFPpojKR8ITdVq0RF8e3qLgb+H1PzE=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/aiofile/default.nix

@@ -36,6 +36,23 @@ buildPythonPackage rec {
     "aiofile"
   ];
 
+  disabledTests = [
+    # Tests (SystemError) fails randomly during nix-review
+    "test_async_open_fp"
+    "test_async_open_iter_chunked"
+    "test_async_open_iter_chunked"
+    "test_async_open_line_iter"
+    "test_async_open_line_iter"
+    "test_async_open_readline"
+    "test_async_open_unicode"
+    "test_async_open"
+    "test_binary_io_wrapper"
+    "test_modes"
+    "test_text_io_wrapper"
+    "test_unicode_writer"
+    "test_write_read_nothing"
+  ];
+
   meta = with lib; {
     description = "File operations with asyncio support";
     homepage = "https://github.com/mosquito/aiofile";

pkgs/development/python-modules/denonavr/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "denonavr";
-  version = "0.10.11";
+  version = "0.10.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "scarface-4711";
     repo = pname;
-    rev = version;
-    hash = "sha256-RY1XRGuwSFL429foEjEN93fBucUyyYc6cmpzYmYRorc=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-QNiDoPjOuwwAgUqDzXHzn0BE9bwXQrQKAIFlHCywl88=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/localstack-client/default.nix

@@ -3,18 +3,21 @@
 , fetchFromGitHub
 , boto3
 , pytestCheckHook
+
+# downstream dependencies
+, localstack
 }:
 
 buildPythonPackage rec {
   pname = "localstack-client";
-  version = "1.36";
+  version = "1.39";
 
   src = fetchFromGitHub {
     owner = "localstack";
     repo = "localstack-python-client";
     # Request for proper tags: https://github.com/localstack/localstack-python-client/issues/38
-    rev = "92229c02c5b3cd0cef006e99c3d47db15aefcb4f";
-    sha256 = "sha256-pbDpe/5o4YU/2UIi8YbhzhIlXigOb/M2vjW9DKcIxoI=";
+    rev = "f1e538ad23700e5b1afe98720404f4801475e470";
+    sha256 = "sha256-MBXTiTzCwkduJPPRN7OKaWy2q9J8xCX/GGu09tyac3A=";
   };
 
   propagatedBuildInputs = [
@@ -25,6 +28,8 @@ buildPythonPackage rec {
     "localstack_client"
   ];
 
+  # All commands test `localstack` which is a downstream dependency
+  doCheck = false;
   checkInputs = [
     pytestCheckHook
   ];
@@ -37,6 +42,10 @@ buildPythonPackage rec {
   # For tests
   __darwinAllowLocalNetworking = true;
 
+  passthru.tests = {
+    inherit localstack;
+  };
+
   meta = with lib; {
     description = "A lightweight Python client for LocalStack";
     homepage = "https://github.com/localstack/localstack-python-client";

pkgs/development/python-modules/localstack-ext/default.nix

@@ -9,15 +9,18 @@
 , python-jose
 , requests
 , tabulate
+
+# Sensitive downstream dependencies
+, localstack
 }:
 
 buildPythonPackage rec {
   pname = "localstack-ext";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-EpFkam2xqRSiIhLkcBFSFKr9j0P5oRP4CIUVcjKT5gM=";
+    sha256 = "sha256-F+FQJwvB1WH7qcfOG6IGY+ZlfKwz39UE5rwoQKnxaac=";
   };
 
   postPatch = ''
@@ -50,6 +53,10 @@ buildPythonPackage rec {
   # No tests in repo
   doCheck = false;
 
+  passthru.tests = {
+    inherit localstack;
+  };
+
   meta = with lib; {
     description = "Extensions for LocalStack";
     homepage = "https://github.com/localstack/localstack";

pkgs/development/python-modules/localstack/default.nix

@@ -19,13 +19,13 @@
 
 buildPythonPackage rec {
   pname = "localstack";
-  version = "1.0.4";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "localstack";
     repo = "localstack";
     rev = "v${version}";
-    sha256 = "sha256-JDF3wM5AVhfkAFlxmy1f3aMxs4J5LWd0JOY8MzRAzT4=";
+    sha256 = "sha256-en/9kxhiW4aesc2SOpg/jRXiRa222iBQuq1O3cHeBJs=";
   };
 
   postPatch = ''

pkgs/development/python-modules/lxmf/default.nix

@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "lxmf";
-  version = "0.2.1";
+  version = "0.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "lxmf";
     rev = "refs/tags/${version}";
-    hash = "sha256-ULYo2eFzBoEc5OeuRW/o35P/9oeYob8lG4T++nDrnNg=";
+    hash = "sha256-DmJcxbAVaNUTe1ulVmYeI0Kdtm0Lz83akjH4ttZsgZg=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/mailmanclient/default.nix

@@ -1,22 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, six, httplib2, requests }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, requests
+, typing-extensions
+}:
 
 buildPythonPackage rec {
   pname = "mailmanclient";
-  version = "3.3.3";
-  disabled = !isPy3k;
+  version = "3.3.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "92fe624675e41f41f59de1208e0125dfaa8d062bbe6138bd7cd79e4dd0b6f85e";
+    hash = "sha256-0y31HXjvU/bwy0s0PcDOlrX1RdyTTnk41ceD4A0R4p4=";
   };
 
-  propagatedBuildInputs = [ six httplib2 requests ];
+  propagatedBuildInputs = [
+    requests
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
+  ];
+
+  # Tests require a running Mailman instance
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "mailmanclient"
+  ];
 
   meta = with lib; {
-    homepage = "https://www.gnu.org/software/mailman/";
     description = "REST client for driving Mailman 3";
-    license = licenses.lgpl3;
-    platforms = platforms.linux;
+    homepage = "https://www.gnu.org/software/mailman/";
+    license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ globin qyliss ];
+    platforms = platforms.linux;
   };
 }

pkgs/development/python-modules/onnx/default.nix

@@ -11,6 +11,8 @@
 , six
 , tabulate
 , typing-extensions
+, pythonRelaxDepsHook
+, pytest-runner
 }:
 
 buildPythonPackage rec {
@@ -27,8 +29,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cmake
+    pythonRelaxDepsHook
   ];
 
+  pythonRelaxDeps = [ "protobuf" ];
+
   propagatedBuildInputs = [
     protobuf
     numpy
@@ -39,6 +44,7 @@ buildPythonPackage rec {
   checkInputs = [
     nbval
     pytestCheckHook
+    pytest-runner
     tabulate
   ];
 
@@ -47,8 +53,6 @@ buildPythonPackage rec {
     patchShebangs tools/protoc-gen-mypy.py
     substituteInPlace tools/protoc-gen-mypy.sh.in \
       --replace "/bin/bash" "${bash}/bin/bash"
-
-    sed -i '/pytest-runner/d' setup.py
   '';
 
   preBuild = ''

pkgs/development/python-modules/ormar/default.nix

@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "ormar";
-  version = "0.11.3";
+  version = "0.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "collerek";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-4tGwhgHLZmvsbaDjmmQ3tXBwUBIxb5EpQrT8VIu/XwY=";
+    hash = "sha256-B6dC9+t/pe7vsPb7rkGAbJWLfCAF7lIElFvt1pUu5yA=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/peaqevcore/default.nix

@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "7.0.8";
+  version = "7.0.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-B6N9JLjbezYMO1119OR58cDhKY1ry7FKf+Q9wpHGiBE=";
+    hash = "sha256-97Evn/FT1SCQaiSNKBi0akajc7LkywqzJQEaqxm6s+U=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pex/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pex";
-  version = "2.1.111";
+  version = "2.1.112";
   format = "flit";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-C7ihItw9tRXzaaD3WBZT2HnifnZS///pAODmxmp/sVw=";
+    hash = "sha256-Mwns3l0cUylbMxC55wIZyYklVtqcPEQ02+5oxNd5SbQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/plugwise/default.nix

@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.25.3";
+  version = "0.25.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-vfdU0jzbfKJbIN343CWIwCK+tYt3ScgPhjq0+9NSiL8=";
+    sha256 = "sha256-avriroWSgBn80PzGEuvp/5yad9Q4onSxWLaLlpXDReo=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pyhumps/default.nix

@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , poetry-core
 , pytestCheckHook
 , pythonOlder
@@ -9,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyhumps";
-  version = "3.7.3";
+  version = "3.8.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,17 +17,9 @@ buildPythonPackage rec {
     owner = "nficano";
     repo = "humps";
     rev = "v${version}";
-    hash = "sha256-7jkwf4qGQ+AD4/hOrEe/oAPY+gnSySUVBWFf70rU7xc=";
+    hash = "sha256-ElL/LY2V2Z3efdV5FnDy9dSoBltULrzxsjaOx+7W9Oo=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://github.com/nficano/humps/pull/281
-      url = "https://github.com/nficano/humps/commit/e248c26195804fa04c43e88c5682528f367e27b3.patch";
-      hash = "sha256-+TCVfuMgfkDaS1tPu4q6PIOC3Kn1MBWyuoyAO6W0/h4=";
-    })
-  ];
-
   nativeBuildInputs = [
     poetry-core
   ];

pkgs/development/python-modules/pynobo/default.nix

@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "pynobo";
-  version = "1.5.0";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "echoromeo";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-msJClYHljib8sATooI8q4irz6cC8hEgvcxLmmgatvwU=";
+    hash = "sha256-YbQfdOLO1gs7+oiwe4rDmmD1o7MG+vma5xPlrtNZ00M=";
   };
 
   # Project has no tests

pkgs/development/python-modules/rns/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.3.16";
+  version = "0.3.17";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "Reticulum";
     rev = "refs/tags/${version}";
-    hash = "sha256-+TXIxyLLIWK0lLUyh4irTYHXZLAv8zFYUGKAbA7D9qA=";
+    hash = "sha256-2e1mUDIDxgjGY4PGfgtbGwkktQfH1LsAczXKVW4jCLA=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/skl2onnx/default.nix

@@ -10,6 +10,7 @@
 , onnxruntime
 , pandas
 , unittestCheckHook
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -30,6 +31,12 @@ buildPythonPackage rec {
     onnxconverter-common
   ];
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [ "scikit-learn" ];
+
   checkInputs = [
     onnxruntime
     pandas

pkgs/development/python-modules/types-python-dateutil/default.nix

@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-python-dateutil";
-  version = "2.8.19.1";
+  version = "2.8.19.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1kL3ryu5n+ePWndv0MpOMpMnIAR/QA4lrWK8KlsY3JQ=";
+    hash = "sha256-5uMs4Y83dlsIxGYiKHvI2BNtwMVi2a1bj9FYxZlj16c=";
   };
 
   # Modules doesn't have tests

pkgs/development/quickemu/default.nix

@@ -50,13 +50,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "quickemu";
-  version = "4.3";
+  version = "4.4";
 
   src = fetchFromGitHub {
     owner = "quickemu-project";
     repo = "quickemu";
     rev = version;
-    hash = "sha256-+ksv1DBNby3bJx2ylnDkqlQfsFIDRS/hZvsJn2+bcz8=";
+    hash = "sha256-82ojq1WTcgkVh+DQup2ymmqa6d6+LVR2p5cqEHA3hSM=";
   };
 
   postPatch = ''

pkgs/development/tools/codeowners/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "codeowners";
-  version = "0.4.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "hmarr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YhGBg7CP5usSyP3ksX3/54M9gCokK2No/fYANUTdJw0=";
+    hash = "sha256-4/e+EnRI2YfSx10mU7oOZ3JVE4TNEFwD2YJv+C0qBhI=";
   };
 
-  vendorSha256 = "sha256-no1x+g5MThhWw4eTfP33zoY8TyUtkt60FKsV2hTnYUU=";
+  vendorSha256 = "sha256-UMLM9grPSmx3nAh1/y7YhMWk12/JcT75/LQvjnLfCyE=";
 
   meta = with lib; {
     description = "A CLI and Go library for Github's CODEOWNERS file";

pkgs/development/tools/operator-sdk/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "operator-sdk";
-  version = "1.24.1";
+  version = "1.25.0";
 
   src = fetchFromGitHub {
     owner = "operator-framework";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6Al9EkAnaa7/wJzV4xy6FifPXa4MdA9INwJWpkWzCb8=";
+    sha256 = "sha256-Ej+Ai5bxqT3x/snFD0WaakcXlHCWJQh3vanyUJyJ/ks=";
   };
 
-  vendorSha256 = "sha256-eczTVlArpO+uLC6IsTkj4LBIi+fXq7CMBf1zJShDN58=";
+  vendorSha256 = "sha256-7I/Hcrp50Nyp2yjALoEX/+sr3B/XJ8JKmkAB1SgAuGg=";
 
   doCheck = false;
 

pkgs/development/tools/rust/cargo-cache/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-cache";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "matthiaskrgr";
     repo = pname;
     rev = version;
-    sha256 = "sha256-1/h9o8ldxI/Q1E6AurGfZ1xruf12g1OO5QlzMJLcEGo=";
+    sha256 = "sha256-q9tYKXK8RqiqbDZ/lTxUI1Dm/h28/yZR8rTQuq+roZs=";
   };
 
-  cargoSha256 = "sha256-yUa40j1yOrczCbp9IsL1e5FlHcSEeHPAmbrA8zpuTpI=";
+  cargoSha256 = "sha256-275QREIcncgBk4ah/CivSz5N2m6s/XPCfp6JGChpr38=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
 

pkgs/development/tools/rust/cargo-pgx/default.nix

@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-pgx";
-  version = "0.5.3";
+  version = "0.5.6";
 
   src = fetchCrate {
     inherit version pname;
-    sha256 = "sha256-Glc6MViZeQzfZ+pOcbcJzL5hHEXSoqfksGwVZxOJ6G0=";
+    sha256 = "sha256-CbQWgt/M/QVKpuOzY04OEZNX4DauYPMz2404WQlAvTw=";
   };
 
-  cargoSha256 = "sha256-Ag9lj3uR4Cijfcr+NFdCFb9K84b8QhGamLECzVpcN0U=";
+  cargoSha256 = "sha256-sqAOhSZXzqxOVkEbqpd+9MoXqEFlkFufQ8O1zAXPnLQ=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/development/tools/rust/cargo-show-asm/default.nix

@@ -1,43 +1,29 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
-, curl
 , installShellFiles
-, pkg-config
-, openssl
 , stdenv
-, darwin
 , nix-update-script
 , callPackage
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-asm";
-  version = "0.1.24";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "pacak";
     repo = "cargo-show-asm";
     rev = version;
-    hash = "sha256-ahkKUtg5M88qddzEwYxPecDtBofGfPVxKuYKgmsbWYc=";
+    hash = "sha256-qsr28zuvu+i7P/MpwhDKQFFXTyFFo+vWrjBrpD1V8PY=";
   };
 
-  cargoHash = "sha256-S7OpHNjiTfQg7aPmHEx6Q/OV5QA9pB29F3MTIeiLAXg=";
+  cargoHash = "sha256-IL+BB08uZr5fm05ITxpm66jTb+pYYlLKOwQ8uf5rKSs=";
 
   nativeBuildInputs = [
-    curl.dev
     installShellFiles
-    pkg-config
   ];
 
-  buildInputs = [
-    curl
-    openssl
-  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
-    CoreFoundation
-    SystemConfiguration
-  ]);
-
   postInstall = ''
     installShellCompletion --cmd cargo-asm \
       --bash <($out/bin/cargo-asm --bpaf-complete-style-bash) \

pkgs/misc/flashfocus/default.nix

@@ -1,12 +1,12 @@
-{ lib, python3, netcat-openbsd }:
+{ lib, python3, netcat-openbsd, nix-update-script }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flashfocus";
-  version = "2.2.3";
+  version = "2.3.1";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "0cn44hryvz2wl7xklaslxsb3l2i3f8jkgmml0n9v2ks22j5l4r4h";
+    sha256 = "sha256-XT3CKJWn1uKnPPsJC+MWlEAd8sWdVTEXz5b3n0UUedY=";
   };
 
   postPatch = ''
@@ -36,6 +36,10 @@ python3.pkgs.buildPythonApplication rec {
 
   pythonImportsCheck = [ "flashfocus" ];
 
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
   meta = with lib; {
     homepage = "https://github.com/fennerm/flashfocus";
     description = "Simple focus animations for tiling window managers";

pkgs/os-specific/linux/rdma-core/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rdma-core";
-  version = "42.0";
+  version = "43.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${version}";
-    sha256 = "sha256-MtvrKdo6Lkt064ol7+hlU7b1r+Dt5236bmE21wM5aDo=";
+    sha256 = "sha256-tqlanUZpDYT3wgvD0hA1D5RrMdzPzOqoELzuXGhjnz8=";
   };
 
   strictDeps = true;

pkgs/servers/minio/default.nix

@@ -15,16 +15,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2022-10-20T00-55-09Z";
+  version = "2022-10-21T22-37-48Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-O3+2FKAiprFucx05T9lYcA30yr9KSlDF9VEbAgH4B0E=";
+    sha256 = "sha256-kdf1V7qg/UwVASYYSAY2kfT8m+cmOnAb69FVzdzvZ5Y=";
   };
 
-  vendorSha256 = "sha256-dl+7K/Vd1ybCc1IHwITaHroeLymyk5kWqqIwmLgYYA8=";
+  vendorSha256 = "sha256-m2U2VfUBAmPMFOXhSCQCxtwWI1eFh5TLAp8Izqi8HLQ=";
 
   doCheck = false;