Merge master into haskell-updates

2024-11-27 17:33:09 +00:00 · 2023-10-08 00:13:15 +00:00 · 2023-10-08 00:13:15 +00:00 · d108dd86fe
commit d108dd86fe
parent 11f1fcf47c 20cd4548b2
148 changed files with 1481 additions and 597 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -8584,6 +8584,12 @@
    githubId = 1918771;
    name = "Joe Doyle";
  };
+  jpentland = {
+    email = "joe.pentland@gmail.com";
+    github = "jpentland";
+    githubId = 1135582;
+    name = "Joe Pentland";
+  };
  jperras = {
    email = "joel@nerderati.com";
    github = "jperras";
--- a/nixos/lib/testing/nodes.nix
+++ b/nixos/lib/testing/nodes.nix
@ -30,13 +30,15 @@ let
            })
          ({ options, ... }: {
            key = "nodes.nix-pkgs";
-            config = mkIf (!options.nixpkgs.pkgs.isDefined) {
-              # Ensure we do not use aliases. Ideally this is only set
-              # when the test framework is used by Nixpkgs NixOS tests.
-              nixpkgs.config.allowAliases = false;
-              # TODO: switch to nixpkgs.hostPlatform and make sure containers-imperative test still evaluates.
-              nixpkgs.system = hostPkgs.stdenv.hostPlatform.system;
-            };
+            config = optionalAttrs (!config.node.pkgsReadOnly) (
+              mkIf (!options.nixpkgs.pkgs.isDefined) {
+                # Ensure we do not use aliases. Ideally this is only set
+                # when the test framework is used by Nixpkgs NixOS tests.
+                nixpkgs.config.allowAliases = false;
+                # TODO: switch to nixpkgs.hostPlatform and make sure containers-imperative test still evaluates.
+                nixpkgs.system = hostPkgs.stdenv.hostPlatform.system;
+              }
+            );
          })
          testModuleArgs.config.extraBaseModules
        ];
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@ -84,8 +84,8 @@ let
      backupScript = mkBackupScript backupJobName cfg;
    in nameValuePair backupJobName {
      description = "BorgBackup job ${name}";
-      path = with pkgs; [
-        borgbackup openssh
+      path =  [
+        config.services.borgbackup.package pkgs.openssh
      ];
      script = "exec " + optionalString cfg.inhibitsSleep ''\
        ${pkgs.systemd}/bin/systemd-inhibit \
@ -137,7 +137,7 @@ let
    '');

  mkBorgWrapper = name: cfg: mkWrapperDrv {
-    original = "${pkgs.borgbackup}/bin/borg";
+    original = getExe config.services.borgbackup.package;
    name = "borg-job-${name}";
    set = { BORG_REPO = cfg.repo; } // (mkPassEnv cfg) // cfg.environment;
  };
@ -231,6 +231,8 @@ in {

  ###### interface

+  options.services.borgbackup.package = mkPackageOptionMD pkgs "borgbackup" { };
+
  options.services.borgbackup.jobs = mkOption {
    description = lib.mdDoc ''
      Deduplicating backups using BorgBackup.
@ -769,6 +771,7 @@ in {

      users = mkMerge (mapAttrsToList mkUsersConfig repos);

-      environment.systemPackages = with pkgs; [ borgbackup ] ++ (mapAttrsToList mkBorgWrapper jobs);
+      environment.systemPackages =
+        [ config.services.borgbackup.package ] ++ (mapAttrsToList mkBorgWrapper jobs);
    });
 }
--- a/nixos/modules/services/hardware/keyd.nix
+++ b/nixos/modules/services/hardware/keyd.nix
@ -2,7 +2,6 @@
 with lib;
 let
  cfg = config.services.keyd;
-  settingsFormat = pkgs.formats.ini { };

  keyboardOptions = { ... }: {
    options = {
@ -16,7 +15,7 @@ let
      };

      settings = mkOption {
-        type = settingsFormat.type;
+        type = (pkgs.formats.ini { }).type;
        default = { };
        example = {
          main = {
@ -37,6 +36,20 @@ let
          See <https://github.com/rvaiya/keyd> how to configure.
        '';
      };
+
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        example = ''
+          [control+shift]
+          h = left
+        '';
+        description = lib.mdDoc ''
+          Extra configuration that is appended to the end of the file.
+          **Do not** write `ids` section here, use a separate option for it.
+          You can use this option to define compound layers that must always be defined after the layer they are comprised.
+        '';
+      };
    };
  };
 in
@ -85,15 +98,12 @@ in
    environment.etc = mapAttrs'
      (name: options:
        nameValuePair "keyd/${name}.conf" {
-          source = pkgs.runCommand "${name}.conf"
-            {
-              ids = ''
-                [ids]
-                ${concatStringsSep "\n" options.ids}
-              '';
-              passAsFile = [ "ids" ];
-            } ''
-            cat $idsPath <(echo) ${settingsFormat.generate "keyd-${name}.conf" options.settings} >$out
+          text = ''
+            [ids]
+            ${concatStringsSep "\n" options.ids}
+
+            ${generators.toINI {} options.settings}
+            ${options.extraConfig}
          '';
        })
      cfg.keyboards;
--- a/nixos/modules/services/misc/gollum.nix
+++ b/nixos/modules/services/misc/gollum.nix
@ -154,5 +154,5 @@ in
    };
  };

-  meta.maintainers = with lib.maintainers; [ erictapen bbenno joscha ];
+  meta.maintainers = with lib.maintainers; [ erictapen bbenno ];
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -58,6 +58,7 @@ let
    "nut"
    "openldap"
    "openvpn"
+    "pgbouncer"
    "php-fpm"
    "pihole"
    "postfix"
@ -312,6 +313,25 @@ in
        Please specify either 'services.prometheus.exporters.nextcloud.passwordFile' or
          'services.prometheus.exporters.nextcloud.tokenFile'
      '';
+    } {
+      assertion =  cfg.pgbouncer.enable -> (
+        (cfg.pgbouncer.connectionStringFile != null || cfg.pgbouncer.connectionString != "")
+      );
+        message = ''
+          PgBouncer exporter needs either connectionStringFile or connectionString configured"
+        '';
+    } {
+      assertion = cfg.pgbouncer.enable -> (
+        config.services.pgbouncer.ignoreStartupParameters != null && builtins.match ".*extra_float_digits.*" config.services.pgbouncer.ignoreStartupParameters != null
+        );
+        message = ''
+          Prometheus PgBouncer exporter requires including `extra_float_digits` in services.pgbouncer.ignoreStartupParameters
+
+          Example:
+          services.pgbouncer.ignoreStartupParameters = extra_float_digits;
+
+          See https://github.com/prometheus-community/pgbouncer_exporter#pgbouncer-configuration
+        '';
    } {
      assertion = cfg.sql.enable -> (
        (cfg.sql.configFile == null) != (cfg.sql.configuration == null)
@ -350,12 +370,24 @@ in
        `openFirewall' is set to `true'!
      '';
    })) ++ config.services.prometheus.exporters.assertions;
-    warnings = [(mkIf (config.services.prometheus.exporters.idrac.enable && config.services.prometheus.exporters.idrac.configurationPath != null) ''
-        Configuration file in `services.prometheus.exporters.idrac.configurationPath` may override
-        `services.prometheus.exporters.idrac.listenAddress` and/or `services.prometheus.exporters.idrac.port`.
-        Consider using `services.prometheus.exporters.idrac.configuration` instead.
-      ''
-    )] ++ config.services.prometheus.exporters.warnings;
+    warnings = [
+      (mkIf (config.services.prometheus.exporters.idrac.enable && config.services.prometheus.exporters.idrac.configurationPath != null) ''
+          Configuration file in `services.prometheus.exporters.idrac.configurationPath` may override
+          `services.prometheus.exporters.idrac.listenAddress` and/or `services.prometheus.exporters.idrac.port`.
+          Consider using `services.prometheus.exporters.idrac.configuration` instead.
+        ''
+      )
+      (mkIf
+        (cfg.pgbouncer.enable && cfg.pgbouncer.connectionString != "") ''
+          config.services.prometheus.exporters.pgbouncer.connectionString is insecure. Use connectionStringFile instead.
+        ''
+      )
+      (mkIf
+        (cfg.pgbouncer.enable && config.services.pgbouncer.authType != "any") ''
+          Admin user (with password or passwordless) MUST exist in the services.pgbouncer.authFile if authType other than any is used.
+        ''
+      )
+    ] ++ config.services.prometheus.exporters.warnings;
  }] ++ [(mkIf config.services.minio.enable {
    services.prometheus.exporters.minio.minioAddress  = mkDefault "http://localhost:9000";
    services.prometheus.exporters.minio.minioAccessKey = mkDefault config.services.minio.accessKey;
--- a/nixos/modules/services/monitoring/prometheus/exporters/pgbouncer.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/pgbouncer.nix
@ -0,0 +1,145 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.pgbouncer;
+in
+{
+  port = 9127;
+  extraOpts = {
+
+    telemetryPath = mkOption {
+      type = types.str;
+      default = "/metrics";
+      description = lib.mdDoc ''
+        Path under which to expose metrics.
+      '';
+    };
+
+    connectionString = mkOption {
+      type = types.str;
+      default = "";
+      example = "postgres://admin:@localhost:6432/pgbouncer?sslmode=require";
+      description = lib.mdDoc ''
+        Connection string for accessing pgBouncer.
+
+        NOTE: You MUST keep pgbouncer as database name (special internal db)!!!
+
+        NOTE: Admin user (with password or passwordless) MUST exist
+        in the services.pgbouncer.authFile if authType other than any is used.
+
+        WARNING: this secret is stored in the world-readable Nix store!
+        Use {option}`connectionStringFile` instead.
+      '';
+    };
+
+    connectionStringFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/keys/pgBouncer-connection-string";
+      description = lib.mdDoc ''
+        File that contains pgBouncer connection string in format:
+        postgres://admin:@localhost:6432/pgbouncer?sslmode=require
+
+        NOTE: You MUST keep pgbouncer as database name (special internal db)!!!
+
+        NOTE: Admin user (with password or passwordless) MUST exist
+        in the services.pgbouncer.authFile if authType other than any is used.
+
+        {option}`connectionStringFile` takes precedence over {option}`connectionString`
+      '';
+    };
+
+    pidFile = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = lib.mdDoc ''
+        Path to PgBouncer pid file.
+
+        If provided, the standard process metrics get exported for the PgBouncer
+        process, prefixed with 'pgbouncer_process_...'. The pgbouncer_process exporter
+        needs to have read access to files owned by the PgBouncer process. Depends on
+        the availability of /proc.
+
+        https://prometheus.io/docs/instrumenting/writing_clientlibs/#process-metrics.
+
+      '';
+    };
+
+    webSystemdSocket = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Use systemd socket activation listeners instead of port listeners (Linux only).
+      '';
+    };
+
+    logLevel = mkOption {
+      type = types.enum ["debug" "info" "warn" "error" ];
+      default = "info";
+      description = lib.mdDoc ''
+        Only log messages with the given severity or above.
+      '';
+    };
+
+    logFormat = mkOption {
+      type = types.enum ["logfmt" "json"];
+      default = "logfmt";
+      description = lib.mdDoc ''
+        Output format of log messages. One of: [logfmt, json]
+      '';
+    };
+
+    webConfigFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = lib.mdDoc ''
+        Path to configuration file that can enable TLS or authentication.
+      '';
+    };
+
+    extraFlags = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = lib.mdDoc ''
+        Extra commandline options when launching Prometheus.
+      '';
+    };
+
+  };
+
+  serviceOpts = {
+    after = [ "pgbouncer.service" ];
+      serviceConfig = let
+      startScript = pkgs.writeShellScriptBin "pgbouncer-start" "${concatStringsSep " " ([
+            "${pkgs.prometheus-pgbouncer-exporter}/bin/pgbouncer_exporter"
+            "--web.listen-address ${cfg.listenAddress}:${toString cfg.port}"
+            "--pgBouncer.connectionString ${if cfg.connectionStringFile != null then
+            "$(head -n1 ${cfg.connectionStringFile})" else "${escapeShellArg cfg.connectionString}"}"
+          ]
+            ++ optionals (cfg.telemetryPath != null) [
+            "--web.telemetry-path ${escapeShellArg cfg.telemetryPath}"
+          ]
+            ++ optionals (cfg.pidFile != null) [
+            "--pgBouncer.pid-file= ${escapeShellArg cfg.pidFile}"
+          ]
+            ++ optionals (cfg.logLevel != null) [
+            "--log.level ${escapeShellArg cfg.logLevel}"
+          ]
+            ++ optionals (cfg.logFormat != null) [
+            "--log.format ${escapeShellArg cfg.logFormat}"
+          ]
+            ++ optionals (cfg.webSystemdSocket != false) [
+            "--web.systemd-socket ${escapeShellArg cfg.webSystemdSocket}"
+          ]
+            ++ optionals (cfg.webConfigFile != null) [
+            "--web.config.file ${escapeShellArg cfg.webConfigFile}"
+          ]
+            ++ cfg.extraFlags)}";
+      in
+      {
+        ExecStart = "${startScript}/bin/pgbouncer-start";
+      };
+  };
+}
--- a/nixos/modules/services/network-filesystems/orangefs/server.nix
+++ b/nixos/modules/services/network-filesystems/orangefs/server.nix
@ -192,7 +192,7 @@ in {
    # orangefs daemon will run as user
    users.users.orangefs = {
      isSystemUser = true;
-      group = "orangfs";
+      group = "orangefs";
    };
    users.groups.orangefs = {};

--- a/nixos/modules/services/networking/dnsmasq.nix
+++ b/nixos/modules/services/networking/dnsmasq.nix
@ -4,7 +4,7 @@ with lib;

 let
  cfg = config.services.dnsmasq;
-  dnsmasq = pkgs.dnsmasq;
+  dnsmasq = cfg.package;
  stateDir = "/var/lib/dnsmasq";

  # True values are just put as `name` instead of `name=true`, and false values
@ -53,6 +53,8 @@ in
        '';
      };

+      package = mkPackageOptionMD pkgs "dnsmasq" {};
+
      resolveLocalQueries = mkOption {
        type = types.bool;
        default = true;
--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome.nix
@ -229,7 +229,7 @@ in
        panelModulePackages = mkOption {
          default = [ pkgs.gnome.gnome-applets ];
          defaultText = literalExpression "[ pkgs.gnome.gnome-applets ]";
-          type = types.listOf types.path;
+          type = types.listOf types.package;
          description = lib.mdDoc ''
            Packages containing modules that should be made available to `gnome-panel` (usually for applets).

@ -294,8 +294,7 @@ in
          map
            (wm:
              pkgs.gnome.gnome-flashback.mkSessionForWm {
-                inherit (wm) wmName wmLabel wmCommand enableGnomePanel;
-                inherit (cfg.flashback) panelModulePackages;
+                inherit (wm) wmName wmLabel wmCommand;
              }
            ) flashbackWms;

@ -309,7 +308,14 @@ in

      environment.systemPackages = with pkgs.gnome; [
        gnome-flashback
-      ];
+        (gnome-panel-with-modules.override {
+          panelModulePackages = cfg.flashback.panelModulePackages;
+        })
+      ]
+      # For /share/applications/${wmName}.desktop
+      ++ (map (wm: gnome-flashback.mkWmApplication { inherit (wm) wmName wmLabel wmCommand; }) flashbackWms)
+      # For /share/gnome-session/sessions/gnome-flashback-${wmName}.session
+      ++ (map (wm: gnome-flashback.mkGnomeSession { inherit (wm) wmName wmLabel enableGnomePanel; }) flashbackWms);
    })

    (mkIf serviceCfg.core-os-services.enable {
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@ -28,7 +28,6 @@ let
    # TODO: warn the user that any address configured on those interfaces will be useless
    ++ concatMap (i: attrNames (filterAttrs (_: config: config.type != "internal") i.interfaces)) (attrValues cfg.vswitches);

-  domains = cfg.search ++ (optional (cfg.domain != null) cfg.domain);
  genericNetwork = override:
    let gateway = optional (cfg.defaultGateway != null && (cfg.defaultGateway.address or "") != "") cfg.defaultGateway.address
      ++ optional (cfg.defaultGateway6 != null && (cfg.defaultGateway6.address or "") != "") cfg.defaultGateway6.address;
@ -40,8 +39,6 @@ let
        };
    in optionalAttrs (gateway != [ ]) {
      routes = override (map makeGateway gateway);
-    } // optionalAttrs (domains != [ ]) {
-      domains = override domains;
    };

  genericDhcpNetworks = initrd: mkIf cfg.useDHCP {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -331,7 +331,6 @@ in {
  graylog = handleTest ./graylog.nix {};
  grocy = handleTest ./grocy.nix {};
  grub = handleTest ./grub.nix {};
-  guacamole-client = handleTest ./guacamole-client.nix {};
  guacamole-server = handleTest ./guacamole-server.nix {};
  gvisor = handleTest ./gvisor.nix {};
  hadoop = import ./hadoop { inherit handleTestOn; package=pkgs.hadoop; };
--- a/nixos/tests/dconf.nix
+++ b/nixos/tests/dconf.nix
@ -14,8 +14,8 @@ import ./make-test-python.nix
        profiles.user.databases = [
          {
            settings = {
-              "test/not/locked" = mkInt32 1;
-              "test/is/locked" = "locked";
+              "test/not".locked = mkInt32 1;
+              "test/is".locked = "locked";
            };
            locks = [
              "/test/is/locked"
--- a/nixos/tests/gnome-flashback.nix
+++ b/nixos/tests/gnome-flashback.nix
@ -32,14 +32,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
    xauthority = "/run/user/${uid}/gdm/Xauthority";
  in ''
      with subtest("Login to GNOME Flashback with GDM"):
-          # wait_for_x() checks graphical-session.target, which is expected to be
-          # inactive on gnome-flashback before #228946 (i.e. systemd managed
-          # gnome-session) is done.
-          # https://github.com/NixOS/nixpkgs/pull/208060
-          #
-          # Previously this was unconditionally touched by xsessionWrapper but was
-          # changed in #233981 (we have GNOME-Flashback:GNOME in XDG_CURRENT_DESKTOP).
-          # machine.wait_for_x()
+          machine.wait_for_x()
          machine.wait_until_succeeds('journalctl -t gnome-session-binary --grep "Entering running state"')
          # Wait for alice to be logged in"
          machine.wait_for_unit("default.target", "${user.name}")
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@ -28,7 +28,7 @@ import ./make-test-python.nix ({ pkgs, ... } : {
        };
      };
      boot.extraModulePackages =
-        optional (versionOlder config.boot.kernelPackages.kernel.version "5.6")
+        pkgs.lib.optional (pkgs.lib.versionOlder config.boot.kernelPackages.kernel.version "5.6")
          config.boot.kernelPackages.wireguard;
      boot.kernelModules = [ "wireguard" ];
    };
--- a/nixos/tests/keyd.nix
+++ b/nixos/tests/keyd.nix
@ -26,13 +26,13 @@ let
  '';


-  mkKeyboardTest = name: { settings, test }: with pkgs.lib; makeTest {
+  mkKeyboardTest = name: { default, test }: with pkgs.lib; makeTest {
    inherit name;

    nodes.machine = {
      services.keyd = {
        enable = true;
-        keyboards.default = { inherit settings; };
+        keyboards = { inherit default; };
      };
    };

@ -70,13 +70,20 @@ let
 in
 pkgs.lib.mapAttrs mkKeyboardTest {
  swap-ab_and_ctrl-as-shift = {
-    test.press = [ "a" "ctrl-b" "c" ];
-    test.expect = [ "b" "A" "c" ];
+    test.press = [ "a" "ctrl-b" "c" "alt_r-h" ];
+    test.expect = [ "b" "A" "c" "q" ];

-    settings.main = {
-      "a" = "b";
-      "b" = "a";
-      "control" = "oneshot(shift)";
+    default = {
+      settings.main = {
+        "a" = "b";
+        "b" = "a";
+        "control" = "oneshot(shift)";
+        "rightalt" = "layer(rightalt)";
+      };
+      extraConfig = ''
+        [rightalt:G]
+        h = q
+      '';
    };
  };
 }
--- a/nixos/tests/legit.nix
+++ b/nixos/tests/legit.nix
@ -8,7 +8,7 @@ in
  meta.maintainers = [ lib.maintainers.ratsclub ];

  nodes = {
-    server = { config, pkgs }: {
+    server = { config, pkgs, ... }: {
      services.legit = {
        enable = true;
        settings = {
--- a/nixos/tests/litestream.nix
+++ b/nixos/tests/litestream.nix
@ -44,14 +44,22 @@ import ./make-test-python.nix ({ pkgs, ...} : {
      };
      services.grafana = {
        enable = true;
-        security = {
-          adminUser = "admin";
-          adminPassword = "admin";
-        };
-        addr = "localhost";
-        port = 3000;
-        extraOptions = {
-          DATABASE_URL = "sqlite3:///var/lib/grafana/data/grafana.db?cache=private&mode=rwc&_journal_mode=WAL";
+        settings = {
+          security = {
+            admin_user = "admin";
+            admin_password = "admin";
+          };
+
+          server = {
+            http_addr = "localhost";
+            http_port = 3000;
+          };
+
+          database = {
+            type = "sqlite3";
+            path = "/var/lib/grafana/data/grafana.db";
+            wal = true;
+          };
        };
      };
      users.users.foo = {
--- a/nixos/tests/lxd-image-server.nix
+++ b/nixos/tests/lxd-image-server.nix
@ -8,8 +8,8 @@ let
    };
  };

-  lxd-image-metadata = lxd-image.lxdMeta.${pkgs.stdenv.hostPlatform.system};
-  lxd-image-rootfs = lxd-image.lxdImage.${pkgs.stdenv.hostPlatform.system};
+  lxd-image-metadata = lxd-image.lxdContainerMeta.${pkgs.stdenv.hostPlatform.system};
+  lxd-image-rootfs = lxd-image.lxdContainerImage.${pkgs.stdenv.hostPlatform.system};

 in {
  name = "lxd-image-server";
--- a/nixos/tests/mongodb.nix
+++ b/nixos/tests/mongodb.nix
@ -27,7 +27,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
  in {
    name = "mongodb";
    meta = with pkgs.lib.maintainers; {
-      maintainers = [ bluescreen303 offline cstrahan rvl phile314 ];
+      maintainers = [ bluescreen303 offline rvl phile314 ];
    };

    nodes = {
--- a/nixos/tests/osquery.nix
+++ b/nixos/tests/osquery.nix
@ -36,7 +36,7 @@ in
      machine.succeed("echo 'SELECT address FROM etc_hosts LIMIT 1;' | osqueryi | tee /dev/console | grep -q '127.0.0.1'")

      # osquery binaries respect configuration from the Nix config option.
-      machine.succeed("echo 'SELECT value FROM osquery_flags WHERE name = \"utc\";' | osqueryi | tee /dev/console | grep -q ${boolToString utc}")
+      machine.succeed("echo 'SELECT value FROM osquery_flags WHERE name = \"utc\";' | osqueryi | tee /dev/console | grep -q ${lib.boolToString utc}")

      # osquery binaries respect configuration from the Nix flags option.
      machine.succeed("echo 'SELECT value FROM osquery_flags WHERE name = \"config_refresh\";' | osqueryi | tee /dev/console | grep -q ${config_refresh}")
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -966,6 +966,36 @@ let
      '';
    };

+    pgbouncer = {
+      exporterConfig = {
+        enable = true;
+        connectionString = "postgres://admin:@localhost:6432/pgbouncer?sslmode=disable";
+      };
+
+      metricProvider = {
+        services.postgresql.enable = true;
+        services.pgbouncer = {
+          # https://github.com/prometheus-community/pgbouncer_exporter#pgbouncer-configuration
+          ignoreStartupParameters = "extra_float_digits";
+          enable = true;
+          listenAddress = "*";
+          databases = { postgres = "host=/run/postgresql/ port=5432 auth_user=postgres dbname=postgres"; };
+          authType = "any";
+          maxClientConn = 99;
+        };
+      };
+      exporterTest = ''
+        wait_for_unit("postgresql.service")
+        wait_for_unit("pgbouncer.service")
+        wait_for_unit("prometheus-pgbouncer-exporter.service")
+        wait_for_open_port(9127)
+        succeed("curl -sSf http://localhost:9127/metrics | grep 'pgbouncer_up 1'")
+        succeed(
+            "curl -sSf http://localhost:9127/metrics | grep 'pgbouncer_config_max_client_connections 99'"
+        )
+      '';
+    };
+
    php-fpm = {
      nodeName = "php_fpm";
      exporterConfig = {
--- a/nixos/tests/sftpgo.nix
+++ b/nixos/tests/sftpgo.nix
@ -17,7 +17,7 @@ let

  # Returns an attributeset of users who are not system users.
  normalUsers = config:
-    filterAttrs (name: user: user.isNormalUser) config.users.users;
+    lib.filterAttrs (name: user: user.isNormalUser) config.users.users;

  # Returns true if a user is a member of the given group
  isMemberOf =
@ -26,7 +26,7 @@ let
    groupName:
    # users.users attrset
    user:
-      any (x: x == user.name) config.users.groups.${groupName}.members;
+      lib.any (x: x == user.name) config.users.groups.${groupName}.members;

  # Generates a valid SFTPGo user configuration for a given user
  # Will be converted to JSON and loaded on application startup.
@ -52,7 +52,7 @@ let
      # inside the dataprovider they will be automatically created.
      # You have to create the folder on the filesystem yourself
      virtual_folders =
-        lib.optional (lib.isMemberOf config sharedFolderName user) {
+        lib.optional (isMemberOf config sharedFolderName user) {
          name = sharedFolderName;
          mapped_path = "${config.services.sftpgo.dataDir}/${sharedFolderName}";
          virtual_path = "/${sharedFolderName}";
@ -63,7 +63,7 @@ let
        lib.recursiveUpdate {
          "/" = [ "list" ];     # read-only top level directory
          "/private" = [ "*" ]; # private subdirectory, not shared with others
-        } (lib.optionalAttrs (lib.isMemberOf config "shared" user) {
+        } (lib.optionalAttrs (isMemberOf config "shared" user) {
          "/shared" = [ "*" ];
        });

@ -89,7 +89,7 @@ let
  # of users and folders to import to SFTPGo.
  loadDataJson = config: pkgs.writeText "users-and-folders.json" (builtins.toJSON {
    users =
-      lib.mapAttrsToList (name: user: lib.generateUserAttrSet config user) (normalUsers config);
+      lib.mapAttrsToList (name: user: generateUserAttrSet config user) (normalUsers config);

    folders = [
      {
@ -144,7 +144,7 @@ in
 {
  name = "sftpgo";

-  meta.maintainers = with maintainers; [ yayayayaka ];
+  meta.maintainers = with lib.maintainers; [ yayayayaka ];

  nodes = {
    server = { nodes, ... }: {
@ -228,7 +228,7 @@ in
          # Created shared folder directories
          "d ${statePath}/${sharedFolderName} 2770 ${sftpgoUser} ${sharedFolderName}   -"
        ]
-        ++ mapAttrsToList (name: user:
+        ++ lib.mapAttrsToList (name: user:
          # Create private user directories
          ''
            d ${statePath}/users/${user.name} 0700 ${sftpgoUser} ${sftpgoGroup} -
@ -273,12 +273,12 @@ in
          networking.firewall.allowedTCPPorts = [ 22 80 ];
          services.sftpgo = {
            settings = {
-              sftpd.bindings = mkForce [{
+              sftpd.bindings = lib.mkForce [{
                address = "";
                port = 22;
              }];

-              httpd.bindings = mkForce [{
+              httpd.bindings = lib.mkForce [{
                address = "";
                port = 80;
              }];
--- a/nixos/tests/tracee.nix
+++ b/nixos/tests/tracee.nix
@ -43,6 +43,10 @@ import ./make-test-python.nix ({ pkgs, ... }: {
            mv $GOPATH/tracee-integration $out/bin/
          '';
          doInstallCheck = false;
+
+          meta = oa.meta // {
+            outputsToInstall = [];
+          };
        }))
      ];
    };
--- a/pkgs/applications/audio/renoise/default.nix
+++ b/pkgs/applications/audio/renoise/default.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
        }
        else
          releasePath
-    else throw "Platform is not supported. Use instalation native to your platform https://www.renoise.com/";
+    else throw "Platform is not supported. Use installation native to your platform https://www.renoise.com/";

  buildInputs = [ alsa-lib libjack2 libX11 libXcursor libXext libXrandr ];

--- a/pkgs/applications/blockchains/lnd/default.nix
+++ b/pkgs/applications/blockchains/lnd/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "lnd";
-  version = "0.16.3-beta";
+  version = "0.17.0-beta";

  src = fetchFromGitHub {
    owner = "lightningnetwork";
    repo = "lnd";
    rev = "v${version}";
-    hash = "sha256-/seSpWnlQmeU4vQtlHMOSedPXP9HJp1GyxcB1LqHayA=";
+    hash = "sha256-HndO7vp/sia352hs23xAgrpyJ/CfbRxYAAhLZ4q94Pc=";
  };

-  vendorHash = "sha256-obrSVMqTwHe7231wa0OuoT6ANBqkQbkHIy93J2f68Zk=";
+  vendorHash = "sha256-4n81AZLKCTEV4+p4kRhZbzYsdRGIztzh6EKPin8W1Z0=";

  subPackages = [ "cmd/lncli" "cmd/lnd" ];

--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@ -69,9 +69,9 @@ in rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the hash for staging as well.
-    version = "8.14";
+    version = "8.17";
    url = "https://dl.winehq.org/wine/source/8.x/wine-${version}.tar.xz";
-    hash = "sha256-4YNu9msYJfqdoEKDDASVsqw5SBVENkNGaXnuif3X+vQ=";
+    hash = "sha256-8BeFvTFix05l3rE6oK3XEeN8SERUcZvt0OjCsaNGm34=";
    inherit (stable) patches;

    ## see http://wiki.winehq.org/Gecko
@ -117,7 +117,7 @@ in rec {
  staging = fetchFromGitHub rec {
    # https://github.com/wine-staging/wine-staging/releases
    inherit (unstable) version;
-    hash = "sha256-ct/RGXt9B6F3PHbirX8K03AZ0Kunitd2HmI0N5k6VHI=";
+    hash = "sha256-8uxXyt3zu+LuFJbTQD+bv+Zmnzb18Dhlo3ign1lFT2s=";
    owner = "wine-staging";
    repo = "wine-staging";
    rev = "v${version}";
--- a/pkgs/applications/emulators/yuzu/sources.nix
+++ b/pkgs/applications/emulators/yuzu/sources.nix
@ -1,19 +1,19 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2023-09-27
+# Last updated: 2023-10-07
 {
  compatList = {
-    rev = "0e93552d7d65a8eb5149d69488281e4abeeba396";
+    rev = "156a0a80efc47069ba3360f8a1b268a1c6f2f505";
    hash = "sha256:1hdsza3wf9a0yvj6h55gsl7xqvhafvbz1i8paz9kg7l49b0gnlh1";
  };

  mainline = {
-    version = "1569";
-    hash = "sha256:17qs5fn75zqxz0c325zyj46z79pvm2j536afyg96glq6av2kql2b";
+    version = "1579";
+    hash = "sha256:0689w42as1di8xbh8kq2p0cws8gdwq64zdj3i8wq612nkw0q5s60";
  };

  ea = {
-    version = "3897";
-    distHash = "sha256:1kxn7hcrn7kkdjgkxpxjw2pdrg73jhlbv3gvhc6z8358bav7xcbs";
-    fullHash = "sha256:1zc1k90f4jzbm8l8fjfsnd77hljh4nqa78l7cczcc3yv2jwrgrz6";
+    version = "3911";
+    distHash = "sha256:0xj642kjhj0gp9l15b3ysj3gmyy47rcvzw9amghsfl13bg5ffnwh";
+    fullHash = "sha256:13rd6kwnhpvjzp67k6pqgl9fsqzwy5d8043hv6kd93gg8jbxkp38";
  };
 }
--- a/pkgs/applications/file-managers/doublecmd/default.nix
+++ b/pkgs/applications/file-managers/doublecmd/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "doublecmd";
-  version = "1.1.1";
+  version = "1.1.2";

  src = fetchFromGitHub {
    owner = "doublecmd";
    repo = "doublecmd";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-IccM7AwPiOtGHjAzvjQ99mrLFh8iZu8G7Rf71LJHB/g=";
+    hash = "sha256-hRBF0Xl1SSoW+vbp9c1iCuFBVIzLtueNJaqoFMF8lJ4=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/fig2dev/default.nix
+++ b/pkgs/applications/graphics/fig2dev/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "fig2dev";
-  version = "3.2.8b";
+  version = "3.2.9";

  src = fetchurl {
    url = "mirror://sourceforge/mcj/fig2dev-${version}.tar.xz";
-    sha256 = "1jv8rg71dsy00lpg434r5zqs5qrg8mxqvv2gpcjjvmzsm551d2j1";
+    hash = "sha256-FeJGyNE8xy3iXggxQDitUM59Le+pzxr8Fy/X9ZMgkLE=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/graphics/meme-image-generator/default.nix
+++ b/pkgs/applications/graphics/meme-image-generator/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "meme-image-generator";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "nomad-software";
    repo = "meme";
    rev = "v${version}";
-    hash = "sha256-MzSPJCszVEZkBvSbRzXR7AaDQOOjDQ2stKKJr8oGOSE=";
+    hash = "sha256-L+JpNg9X3RSNXTozv2H1n2JiQx75i9gFGaQmDFaMIf0=";
  };

  vendorHash = null;
--- a/pkgs/applications/graphics/xfig/default.nix
+++ b/pkgs/applications/graphics/xfig/default.nix
@ -9,16 +9,17 @@
 , libXp
 , Xaw3d
 , libXaw
+, libXft
 , fig2dev
 }:

 stdenv.mkDerivation rec {
  pname = "xfig";
-  version = "3.2.8b";
+  version = "3.2.9";

  src = fetchurl {
    url = "mirror://sourceforge/mcj/xfig-${version}.tar.xz";
-    sha256 = "0fndgbm1mkqb1sn2v2kj3nx9mxj70jbp31y2bjvzcmmkry0q3k5j";
+    hash = "sha256-E+2dBNG7wt7AnafvSc7sJ4OC0pD2zZJkdMLy0Bb+wvc=";
  };

  nativeBuildInputs = [ imagemagick makeWrapper ];
@ -30,6 +31,7 @@ stdenv.mkDerivation rec {
    libXp
    Xaw3d
    libXaw
+    libXft
  ];

  postPatch = ''
@ -57,6 +59,7 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  meta = with lib; {
+    changelog = "https://sourceforge.net/p/mcj/xfig/ci/${version}/tree/CHANGES";
    description = "An interactive drawing tool for X11";
    longDescription = ''
      Note that you need to have the <literal>netpbm</literal> tools
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "albert";
-  version = "0.22.9";
+  version = "0.22.13";

  src = fetchFromGitHub {
    owner = "albertlauncher";
    repo = "albert";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-MhZHklb//VH2GkAzK46P7EwCIa50l5y+2VssrgpTlWA=";
+    sha256 = "sha256-IZpIgU/cf25XxH8J0xQJLASu0YmTmcHY5RxUcbKrtvA=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/snapmaker-luban/default.nix
+++ b/pkgs/applications/misc/snapmaker-luban/default.nix
@ -2,17 +2,17 @@
 , alsa-lib, at-spi2-atk, at-spi2-core, atk, cairo, cups
 , gtk3, nss, glib, dbus, nspr, gdk-pixbuf, libdrm, mesa
 , libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
-, libXfixes, libXi, libXrandr, libXrender, libXtst, libxcb, pango
+, libXfixes, libXi, libXrandr, libXrender, libXtst, libxcb, libxshmfence, pango
 , gcc-unwrapped, udev
 }:

 stdenv.mkDerivation rec {
  pname = "snapmaker-luban";
-  version = "4.8.0";
+  version = "4.9.1";

  src = fetchurl {
    url = "https://github.com/Snapmaker/Luban/releases/download/v${version}/snapmaker-luban-${version}-linux-x64.tar.gz";
-    sha256 = "sha256-uY8MlLIZrbds5/QdYZFTLSSis0BwRU19XfLiBX+2VCY=";
+    sha256 = "sha256-qLeF1trBrp53xkiAhybPTHUKuXYHQYfZ3tsmPPJlvUM=";
  };

  nativeBuildInputs = [
@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
    libXScrnSaver
    libXtst
    libxcb
+    libxshmfence
    mesa # Required for libgbm
    nspr
    nss
@ -42,7 +43,7 @@ stdenv.mkDerivation rec {

  libPath = lib.makeLibraryPath [
    stdenv.cc.cc alsa-lib atk at-spi2-atk at-spi2-core cairo cups
-    gdk-pixbuf glib gtk3 libX11 libXcomposite
+    gdk-pixbuf glib gtk3 libX11 libXcomposite libxshmfence
    libXcursor libXdamage libXext libXfixes libXi libXrandr libXrender
    libXtst nspr nss libxcb pango libXScrnSaver udev
  ];
@ -93,5 +94,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3;
    maintainers = [ maintainers.simonkampe ];
    platforms = [ "x86_64-linux" ];
+    knownVulnerabilities = [ "CVE-2023-5217" ];
  };
 }
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -92,11 +92,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.58.135";
+  version = "1.58.137";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-tJfpBIZvBr0diympUmImXYELPERJIzCSuOB0aovhodI=";
+    sha256 = "sha256-6vsdQU9NbEKFp/1A0bNQvutF4I+vI0zfrx70QvU1KV4=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -27,11 +27,11 @@
  };
  stable = {
    chromedriver = {
-      sha256_darwin = "138mw5p6r0n0531fs6322yxsjgj9hia5plw4mj0b3mclykzy5l37";
+      sha256_darwin = "06yhmapflj5m40952zcrq97qlj3crbbffaspiz87w0syxnw9avq1";
      sha256_darwin_aarch64 =
-        "1cym94av2gw2zwj3rdqbjcqkigpzf0zk2bam2hw9n2hiabb4rm0p";
-      sha256_linux = "1q1vyhmcx6b5criz5bn1c3x3z2dzqdgsmwcvlb0rzqlzpla9q26m";
-      version = "117.0.5938.92";
+        "07dkpaqildzsrwbgjgxw5imbbz2pjvyq3n1wiw94lfjqbd9jrkbz";
+      sha256_linux = "0lqng6g722apxa9k596f42f6bw323q4b29vrkcs1lh86skgikdgj";
+      version = "117.0.5938.149";
    };
    deps = {
      gn = {
@ -41,9 +41,9 @@
        version = "2023-08-01";
      };
    };
-    sha256 = "1bdfvcywj6ggrn6fz6g7hqhikg0cjdj8llgcm4wji52i7897gw18";
-    sha256bin64 = "05a2sggxm76kc6m5wcpb4gibnxa07j291m7292zdvyg32kffqxjr";
-    version = "117.0.5938.132";
+    sha256 = "1pyrqxzxxibz0yp218kw6z186x8y6kd5a1l0mcbhj70rpm9cimyx";
+    sha256bin64 = "1zly8dpxmhyqdsqd381r0yzjrf8nkfigfjhabm3dbf1ih7qma40z";
+    version = "117.0.5938.149";
  };
  ungoogled-chromium = {
    deps = {
@ -54,12 +54,12 @@
        version = "2023-08-01";
      };
      ungoogled-patches = {
-        rev = "117.0.5938.132-1";
-        sha256 = "11bg7j5838nhkwpv7blvpijjhqrisvx032bjmkng1cpy2d0kmfcx";
+        rev = "117.0.5938.149-1";
+        sha256 = "0kzbnymbp7snxmg3adpl16anyhs2rxk0iqy5dda8dx5rv9s8i0x0";
      };
    };
-    sha256 = "1bdfvcywj6ggrn6fz6g7hqhikg0cjdj8llgcm4wji52i7897gw18";
-    sha256bin64 = "05a2sggxm76kc6m5wcpb4gibnxa07j291m7292zdvyg32kffqxjr";
-    version = "117.0.5938.132";
+    sha256 = "1pyrqxzxxibz0yp218kw6z186x8y6kd5a1l0mcbhj70rpm9cimyx";
+    sha256bin64 = "1zly8dpxmhyqdsqd381r0yzjrf8nkfigfjhabm3dbf1ih7qma40z";
+    version = "117.0.5938.149";
  };
 }
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -84,7 +84,7 @@ let
            ++ lib.optional sndioSupport sndio
            ++ lib.optional jackSupport libjack2
            ++ lib.optional smartcardSupport opensc
-            ++ lib.optional (cfg.speechSynthesisSupport or false) speechd
+            ++ lib.optional (cfg.speechSynthesisSupport or true) speechd
            ++ pkcs11Modules
            ++ gtk_modules;
      gtk_modules = [ libcanberra-gtk3 ];
--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@ -14,12 +14,11 @@
 , makeDesktopItem
 , wrapGAppsHook
 , testers
-, palemoon-bin
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "palemoon-bin";
-  version = "32.4.0.1";
+  version = "32.4.1";

  src = fetchzip {
    urls = [
@ -27,9 +26,9 @@ stdenv.mkDerivation (finalAttrs: {
      "https://rm-us.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
    ];
    hash = if withGTK3 then
-      "sha256-kGt3pIgCjVeSD6UXRvj5w9opWrMx3q3B/Y0S55kKS08="
+      "sha256-c/rfnMpiLWqlNZppqPRNWXsgAQ1FofAdel5EFnK+mrY="
    else
-      "sha256-kNvUC/ir7TKjvKXYFoEDOPAY75CEgeixmEV1tuB/WIM=";
+      "sha256-27njFdqq2DUctlz/UOtH5tlOduQNpoapuCYS+48K9dk=";
  };

  preferLocalBuild = true;
@ -155,7 +154,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  passthru.tests.version = testers.testVersion {
-    package = palemoon-bin;
+    package = finalAttrs.finalPackage;
  };

  meta = with lib; {
--- a/pkgs/applications/networking/cluster/kubelogin/default.nix
+++ b/pkgs/applications/networking/cluster/kubelogin/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubelogin";
-  version = "0.0.31";
+  version = "0.0.32";

  src = fetchFromGitHub {
    owner = "Azure";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-yIRiIZKq+Q10Uo/9qEToeMHMipA5rApkxIRr/IJ0yfY=";
+    sha256 = "sha256-pMen6ZL1S0xr5+h7gVBMG4XjlZUifIiqHvjKgg8AY5c=";
  };

-  vendorHash = "sha256-XHSVLATWKklg1jWL4Lnaey7hCkYHAk/cNyUgQZ6WIq0=";
+  vendorHash = "sha256-pNOCagxOcxhELSWO1GfbxGmopYXIgKD00XdZdVgawrc=";

  ldflags = [
    "-X main.version=${version}"
--- a/pkgs/applications/networking/cluster/opentofu/default.nix
+++ b/pkgs/applications/networking/cluster/opentofu/default.nix
@ -14,15 +14,15 @@
 let
  package =  buildGoModule rec {
    pname = "opentofu";
-    version = "1.6.0-alpha1";
+    version = "1.6.0-alpha2";

    src = fetchFromGitHub {
      owner = "opentofu";
      repo = "opentofu";
      rev = "v${version}";
-      hash = "sha256-0FO55H1nOyhAd+ex1zA0XycH6x/HKkLlxzuIJNoaI9g=";
+      hash = "sha256-29vF5vWCPxJJHsQ1dkLcIaqEQVYxp2YjZ4LK5r4/dlo=";
    };
-    vendorHash = "sha256-3jQfIIZOgOmNHQ06rXz+3QTZ37WcuCc7A7/MhC7udrg=";
+    vendorHash = "sha256-qhnQ47K9N7HoTMUXhX2RlUuQaCgeAB/Sshh56A5rhpk=";
    ldflags = [ "-s" "-w" ];

    postConfigure = ''
@ -65,6 +65,14 @@ let

  opentofu_plugins_test = let
    mainTf = writeText "main.tf" ''
+      terraform {
+        required_providers {
+          random = {
+            source  = "registry.terraform.io/hashicorp/random"
+          }
+        }
+      }
+
      resource "random_id" "test" {}
    '';
    opentofu = package.withPlugins (p: [ p.random ]);
--- a/pkgs/applications/networking/cluster/tf-summarize/default.nix
+++ b/pkgs/applications/networking/cluster/tf-summarize/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "tf-summarize";
-  version = "0.3.2";
+  version = "0.3.3";

  src = fetchFromGitHub {
    owner = "dineshba";
    repo = "tf-summarize";
    rev = "v${version}";
-    hash = "sha256-d8DIVPQkuEvDCO0wKl+aK1jSu6MJCpTxQrgKYcFnzjA=";
+    hash = "sha256-1sYWOvSWxoS0R6M1HxJ6yyBSa/LY3b9G8mF3NMofFhM=";
  };

-  vendorHash = "sha256-cnybdZth7qlP2BHK8uvLCoqJtggMIkvaL2+YugiUZRE=";
+  vendorHash = "sha256-YdfZt8SHBJHk5VUC8Em97EzX79EV4hxvo0B05npBA2U=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/timoni/default.nix
+++ b/pkgs/applications/networking/cluster/timoni/default.nix
@ -6,16 +6,16 @@

 buildGo121Module rec {
  pname = "timoni";
-  version = "0.14.0";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "stefanprodan";
    repo = "timoni";
    rev = "v${version}";
-    hash = "sha256-UYHb469x4VnFffjO9CfSyn0ZzLLaAee2WpWGFAQjBpA=";
+    hash = "sha256-DzJNNikvODP3v1jgQLbFcXEhcFfTeIYR6qHhUzEP/Ns=";
  };

-  vendorHash = "sha256-JDaQL+ferkYI74OUqgfopny8uFEg0J84JX1VtO5URpE=";
+  vendorHash = "sha256-lRZFRnft8vEntVxiLOBcR00FP8AXexLyo3h2LCNWN00=";

  subPackages = [ "cmd/timoni" ];
  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/networking/cluster/weave-gitops/default.nix
+++ b/pkgs/applications/networking/cluster/weave-gitops/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "weave-gitops";
-  version = "0.31.2";
+  version = "0.33.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-bzYvyqLMdVdgp8C71mnykzB9HEIPDXQ+SpBOScKybJ8=";
+    sha256 = "sha256-MJX9OrfvzGwrJria1Ki6QHprvoDLxBRPCnKRqPdnbUw=";
  };

  ldflags = [ "-s" "-w" "-X github.com/weaveworks/weave-gitops/cmd/gitops/version.Version=${version}" ];
--- a/pkgs/applications/networking/instant-messengers/quaternion/default.nix
+++ b/pkgs/applications/networking/instant-messengers/quaternion/default.nix
@ -52,7 +52,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Cross-platform desktop IM client for the Matrix protocol";
-    homepage = "https://matrix.org/docs/projects/client/quaternion.html";
+    homepage = "https://matrix.org/ecosystem/clients/quaternion/";
    license = licenses.gpl3;
    maintainers = with maintainers; [ peterhoeg ];
    inherit (qtquickcontrols2.meta) platforms;
--- a/pkgs/applications/networking/instant-messengers/tensor/default.nix
+++ b/pkgs/applications/networking/instant-messengers/tensor/default.nix
@ -60,7 +60,7 @@ mkDerivation rec {
  '';

  meta = with lib; {
-    homepage = "https://matrix.org/docs/projects/client/tensor.html";
+    homepage = "https://github.com/davidar/tensor";
    description = "Cross-platform Qt5/QML-based Matrix client";
    license = licenses.gpl3;
    maintainers = with maintainers; [ peterhoeg ];
--- a/pkgs/applications/networking/instant-messengers/webcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/webcord/default.nix
@ -13,16 +13,16 @@

 buildNpmPackage rec {
  pname = "webcord";
-  version = "4.4.1";
+  version = "4.4.2";

  src = fetchFromGitHub {
    owner = "SpacingBat3";
    repo = "WebCord";
    rev = "v${version}";
-    hash = "sha256-g9UJANYs5IlKAeRc27oNOfdD3uD3nrG5Ecp+AbbsXLE=";
+    hash = "sha256-23YmyRU+xBXpC7bZtBY3RZeVpLFQ3I/Ag5Tvi3m9cIs=";
  };

-  npmDepsHash = "sha256-SSlSLZs97LDtL7OyfCtEGZjDVfsn5KKUgRNyL8J5M5g=";
+  npmDepsHash = "sha256-gHX5ZdcC46BwMu22G05Q8UhvZ6CtQ1HSf6KLLlN2iX0=";

  nativeBuildInputs = [
    copyDesktopItems
@ -79,7 +79,7 @@ buildNpmPackage rec {
  passthru.updateScript = nix-update-script { };

  meta = with lib; {
-    description = "A Discord and Fosscord electron-based client implemented without Discord API";
+    description = "A Discord and SpaceBar electron-based client implemented without Discord API";
    homepage = "https://github.com/SpacingBat3/WebCord";
    downloadPage = "https://github.com/SpacingBat3/WebCord/releases";
    changelog = "https://github.com/SpacingBat3/WebCord/releases/tag/v${version}";
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@ -21,7 +21,7 @@
 , dht
 , libnatpmp
 , libiconv
-, darwin
+, Foundation
  # Build options
 , enableGTK3 ? false
 , gtkmm3
@ -37,14 +37,14 @@
 , apparmorRulesFromClosure
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "transmission";
  version = "4.0.4";

  src = fetchFromGitHub {
    owner = "transmission";
    repo = "transmission";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-Sz3+5VvfOgET1aiormEnBOrF+yN79tiSQvjLAoGqTLw=";
    fetchSubmodules = true;
  };
@ -113,7 +113,7 @@ stdenv.mkDerivation rec {
  ++ lib.optionals enableGTK3 [ gtkmm3 xorg.libpthreadstubs ]
  ++ lib.optionals enableSystemd [ systemd ]
  ++ lib.optionals stdenv.isLinux [ inotify-tools ]
-  ++ lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Foundation ];
+  ++ lib.optionals stdenv.isDarwin [ libiconv Foundation ];

  postInstall = ''
    mkdir $apparmor
@ -164,7 +164,5 @@ stdenv.mkDerivation rec {
    license = with lib.licenses; [ gpl2Plus mit ];
    maintainers = with lib.maintainers; [ astsmtl ];
    platforms = lib.platforms.unix;
-    # Needs macOS >= 10.14.6
-    broken = stdenv.isDarwin && stdenv.isx86_64;
  };
-}
+})
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@ -32,17 +32,14 @@
 , apparmorRulesFromClosure
 }:

-let
-  version = "3.00";
-
-in stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "transmission";
-  inherit version;
+  version = "3.00";

  src = fetchFromGitHub {
    owner = "transmission";
    repo = "transmission";
-    rev = version;
+    rev = finalAttrs.version;
    sha256 = "0ccg0km54f700x9p0jsnncnwvfnxfnxf7kcm7pcx1cj0vw78924z";
    fetchSubmodules = true;
  };
@ -147,4 +144,4 @@ in stdenv.mkDerivation {
    platforms = lib.platforms.unix;
  };

-}
+})
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "PortfolioPerformance";
-  version = "0.65.3";
+  version = "0.65.4";

  src = fetchurl {
    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-xAbfyjQ0MPNDC6UJthCLtu8nfI/AdtludvejA32/dIQ=";
+    hash = "sha256-2+1lwaO2+kq/EjJoA4EvGCMLH6iErR9KtWINLoO17+w=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@ -41,12 +41,12 @@

 stdenv.mkDerivation rec {
  pname = "zotero";
-  version = "6.0.26";
+  version = "6.0.27";

  src = fetchurl {
    url =
      "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    hash = "sha256-Btrzv9trUFjCrQ+OEc7MUOzq7x3XW7jtgUJMitmPK0A=";
+    hash = "sha256-+nCPLVVBkEu0g2Kxt/XYAt6sYxYm05nPcmPNS2OejRs=";
  };

  nativeBuildInputs = [ wrapGAppsHook ];
--- a/pkgs/applications/science/logic/abc/default.nix
+++ b/pkgs/applications/science/logic/abc/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname   = "abc-verifier";
-  version = "unstable-2023-06-28";
+  version = "unstable-2023-09-13";

  src = fetchFromGitHub {
    owner = "yosyshq";
    repo  = "abc";
-    rev   = "bb64142b07794ee685494564471e67365a093710";
-    hash  = "sha256-Qkk61Lh84ervtehWskSB9GKh+JPB7mI1IuG32OSZMdg=";
+    rev   = "daad9ede0137dc58487a0abc126253e671a85b14";
+    hash  = "sha256-5XeFYvdqT08xduFUDC5yK1jEOV1fYzyQD7N9ZmG3mpQ=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/terminal-emulators/iterm2/default.nix
+++ b/pkgs/applications/terminal-emulators/iterm2/default.nix
@ -11,11 +11,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "iterm2";
-  version = "3.4.20";
+  version = "3.4.21";

  src = fetchzip {
    url = "https://iterm2.com/downloads/stable/iTerm2-${lib.replaceStrings ["."] ["_"] version}.zip";
-    hash = "sha256-RXBv3RXd2Kq8k7rbOE3HPEf6vI64VZCo1IX03gDy7l0=";
+    hash = "sha256-hx2d08U4AeRCLtSV3QBcnRu1QS0RblLx/LUH6HHdQvw=";
  };

  dontFixup = true;
--- a/pkgs/applications/video/anilibria-winmaclinux/0001-fix-installation-paths.patch
+++ b/pkgs/applications/video/anilibria-winmaclinux/0001-fix-installation-paths.patch
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@ -28,7 +28,7 @@ mkDerivation rec {
  qmakeFlags = [ "PREFIX=${placeholder "out"}" ];

  patches = [
-    ./0001-fix-instalation-paths.patch
+    ./0001-fix-installation-paths.patch
    ./0002-disable-version-check.patch
  ];

--- a/pkgs/applications/window-managers/lesbar/default.nix
+++ b/pkgs/applications/window-managers/lesbar/default.nix
@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, fetchFromSourcehut
+, pkg-config
+, scdoc
+, libX11
+, cairo
+, pango
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lesbar";
+  version = "1.1.0";
+
+  src = fetchFromSourcehut {
+    owner = "~salmiak";
+    repo = "lesbar";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-uggIoO6rgotkLi6lSJTR4d3NtidXsAC1Kjay9YsT9ps=";
+  };
+
+  nativeBuildInputs = [ pkg-config scdoc ];
+
+  buildInputs = [ libX11 cairo pango ];
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    description = "A programming language agnostic view layer for creating desktop widgets and status bars";
+    homepage = "https://git.sr.ht/~salmiak/lesbar";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jpentland ];
+    platforms = platforms.linux;
+  };
+})
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@ -417,7 +417,7 @@ fi
 tmpHomePath="$(mktemp -d "${TMPDIR:-/tmp}/nix-prefetch-git-tmp-home-XXXXXXXXXX")"
 exit_handlers+=(remove_tmpHomePath)
 HOME="$tmpHomePath"
-ln -s /build/.netrc "$HOME/"
+ln -s "$NIX_BUILD_TOP/.netrc" "$HOME/"
 unset XDG_CONFIG_HOME
 export GIT_CONFIG_NOSYSTEM=1

--- a/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
@ -34,7 +34,16 @@ npmInstallHook() {

    if [ ! -d "$nodeModulesPath" ]; then
        if [ -z "${dontNpmPrune-}" ]; then
-            npm prune --omit=dev --no-save ${npmWorkspace+--workspace=$npmWorkspace} $npmPruneFlags "${npmPruneFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"
+            if ! npm prune --omit=dev --no-save ${npmWorkspace+--workspace=$npmWorkspace} $npmPruneFlags "${npmPruneFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"; then
+              echo
+              echo
+              echo "ERROR: npm prune step failed"
+              echo
+              echo 'If npm tried to download additional dependencies above, try setting `dontNpmPrune = true`.'
+              echo
+
+              exit 1
+            fi
        fi

        find node_modules -maxdepth 1 -type d -empty -delete
--- a/pkgs/tools/misc/a4term/default.nix
+++ b/pkgs/tools/misc/a4term/default.nix
@ -5,14 +5,14 @@
 , libvterm-neovim
 }:

-stdenv.mkDerivation rec {
-  pname = "a4term";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "a4";
  version = "0.2.3";

  src = fetchFromGitHub {
    owner = "rpmohn";
    repo = "a4";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-AX5psz9+bLdFFeDR55TIrAWDAkhDygw6289OgIfOJTg=";
  };

@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
    libvterm-neovim
  ];

-  makeFlags = [ "PREFIX=$(out)" ];
+  installFlags = [ "PREFIX=${placeholder "out"}" ];

  meta = {
    description = "A dynamic terminal window manager";
@ -31,4 +31,4 @@ stdenv.mkDerivation rec {
    platforms = lib.platforms.linux;
    mainProgram = "a4";
  };
-}
+})
--- a/pkgs/applications/editors/imhex/default.nix
+++ b/pkgs/applications/editors/imhex/default.nix
@ -22,12 +22,15 @@
 }:

 let
-  version = "1.30.1";
+  # FIXME: unstable, stable needs #252945 (details in #258964)
+  # Next version bump should be stabilized
+  version = "unstable-2023-10-01";
+  patterns_version = "1.31.0";

  patterns_src = fetchFromGitHub {
    owner = "WerWolv";
    repo = "ImHex-Patterns";
-    rev = "ImHex-v${version}";
+    rev = "ImHex-v${patterns_version}";
    hash = "sha256-lTTXu9RxoD582lXWI789gNcWvJmxmBIlBRIiyY3DseM=";
  };

@ -40,8 +43,8 @@ stdenv.mkDerivation rec {
    fetchSubmodules = true;
    owner = "WerWolv";
    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-3s9Dgdhl+k2KjMoSHNl59YOoCEwqK+37DOzKdGP88/4=";
+    rev = "a62ede784018f9d5aaf40587f71a1271429ab50b";
+    hash = "sha256-L3ncmM7Ro60DvOF/Y0fjo2Smlw2LL8cPa8H6yVGdGAk=";
  };

  nativeBuildInputs = [ cmake llvm python3 perl pkg-config rsync ];
@ -81,7 +84,7 @@ stdenv.mkDerivation rec {
    description = "Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM";
    homepage = "https://github.com/WerWolv/ImHex";
    license = with licenses; [ gpl2Only ];
-    maintainers = with maintainers; [ luis kashw2 ];
+    maintainers = with maintainers; [ luis kashw2 cafkafk ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/by-name/im/impression/package.nix
+++ b/pkgs/by-name/im/impression/package.nix
@ -0,0 +1,69 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, blueprint-compiler
+, cargo
+, desktop-file-utils
+, meson
+, ninja
+, pkg-config
+, rustPlatform
+, rustc
+, wrapGAppsHook4
+, cairo
+, dbus
+, gdk-pixbuf
+, glib
+, gtk4
+, libadwaita
+, pango
+}:
+
+stdenv.mkDerivation rec {
+  pname = "impression";
+  version = "2.1";
+
+  src = fetchFromGitLab {
+    owner = "adhami3310";
+    repo = "Impression";
+    rev = "v${version}";
+    hash = "sha256-Pq1Pz/uNBsk4UdtCwA5gmZoS+kiDrCbpum4ABW7oocA=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-eIfDuz4ewTzmLDKShro3VkoXAZEUOKu133eD/z75jjY=";
+  };
+
+  nativeBuildInputs = [
+    blueprint-compiler
+    cargo
+    desktop-file-utils
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustc
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    cairo
+    dbus
+    gdk-pixbuf
+    glib
+    gtk4
+    libadwaita
+    pango
+  ];
+
+  meta = {
+    description = "Straight-forward and modern application to create bootable drives";
+    homepage = "https://gitlab.com/adhami3310/Impression";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "impression";
+    maintainers = with lib.maintainers; [ dotlambda ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/le/lexmark-aex/package.nix
+++ b/pkgs/by-name/le/lexmark-aex/package.nix
@ -0,0 +1,78 @@
+{ lib
+, stdenv
+, cups
+, fetchurl
+, patchPpdFilesHook
+, autoPatchelfHook
+, dpkg
+, perl
+, avahi
+}:
+
+stdenv.mkDerivation {
+  pname = "lexmark-aex";
+  version = "1.0";
+
+  dontPatchELF = true;
+  dontStrip = true;
+
+  src = fetchurl {
+    url = "https://downloads.lexmark.com/downloads/drivers/Lexmark-AEX-PPD-Files-1.0-01242019.amd64.deb";
+    hash = "sha256-igrJEeFLArGbncOwk/WttnWfPjOokD0/IzpJ4VSOtHk=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    patchPpdFilesHook
+    dpkg
+  ];
+
+  buildInputs = [
+    # Needed for autoPatchelfHook.
+    avahi
+    cups
+    # Needed for patchShebangs.
+    perl
+  ];
+
+  # Needed for autoPatchelfHook.
+  runtimeDependencies = [ (lib.getLib cups) ];
+
+  ppdFileCommands = [ "CommandFileFilterG2" "rerouteprintoption" ];
+
+  installPhase = let
+    libdir =
+      if stdenv.system == "x86_64-linux"    then "lib64"
+      else if stdenv.system == "i686_linux" then "lib"
+      else throw "other platforms than i686_linux and x86_64-linux are not yet supported";
+  in ''
+    runHook preInstall
+
+    prefix=usr/local/Lexmark/ppd/Lexmark-AEX-PPD-Files/GlobalPPD_1.4
+
+    # Install raster image filter.
+    install -Dm755 "$prefix/rerouteprintoption" "$out/lib/cups/filter/rerouteprintoption"
+    patchShebangs "$out/lib/cups/filter/rerouteprintoption"
+
+    # Install additional binary filters.
+    for i in CommandFileFilterG2 LexHBPFilter; do
+      install -Dm755 "$prefix/${libdir}/$i" "$out/lib/cups/filter/$i"
+    done
+
+    # Install PPD.
+    install -Dm 0644 -t "$out/share/cups/model/Lexmark" "$prefix"/*.ppd
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "CUPS drivers for Lexmark B2200 and MB2200 Series printers";
+    homepage = "https://support.lexmark.com/en_xm/drivers-downloads.html";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
+    maintainers = [ maintainers.tobim ];
+    platforms = [ "x86_64-linux" "i686-linux" ];
+  };
+}
--- a/pkgs/by-name/ui/uiua/package.nix
+++ b/pkgs/by-name/ui/uiua/package.nix
@ -1,25 +1,25 @@
-{
-  lib,
-  stdenv,
-  rustPlatform,
-  fetchFromGitHub,
-  audioSupport ? true,
-  darwin,
-  alsa-lib,
-  pkg-config
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, audioSupport ? true
+, darwin
+, alsa-lib
 }:
-rustPlatform.buildRustPackage {
+
+rustPlatform.buildRustPackage rec {
  pname = "uiua";
-  version = "unstable-2023-09-28";
+  version = "0.0.16";

  src = fetchFromGitHub {
    owner = "uiua-lang";
    repo = "uiua";
-    rev = "9b8c65332396f521f170b0ed3ce104b7a8bcf7c0";
-    hash = "sha256-+pleCEEwgRj+p+k9oKIvbsGUWC49qByV/juv76ZdBcc=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-CMuCl4idoO5qIpXdkXBbglsZQBWVT8w9azbn2rRxviA=";
  };

-  cargoHash = "sha256-L8TCMe6eHS3QRy6HuTc1WvMfzsDhKx9YYupAkNeBwpk=";
+  cargoHash = "sha256-BLP9OGTnksM9NscfhtVWxE0/CqZgkqqlIMgRclCzEzs=";

  nativeBuildInputs = lib.optionals stdenv.isDarwin [
    rustPlatform.bindgenHook
@ -37,8 +37,6 @@ rustPlatform.buildRustPackage {

  buildFeatures = lib.optional audioSupport "audio";

-  doCheck = true;
-
  meta = with lib; {
    description = "A stack-oriented array programming language with a focus on simplicity, beauty, and tacit code";
    longDescription = ''
@ -49,6 +47,6 @@ rustPlatform.buildRustPackage {
    homepage = "https://www.uiua.org/";
    license = licenses.mit;
    mainProgram = "uiua";
-    maintainers = with maintainers; [ cafkafk ];
+    maintainers = with maintainers; [ cafkafk tomasajt ];
  };
 }
--- a/pkgs/data/fonts/source-han/default.nix
+++ b/pkgs/data/fonts/source-han/default.nix
@ -5,7 +5,7 @@
 }:

 let
-  makePackage =
+  makeSuperOTC =
    { family
    , description
    , rev
@ -13,9 +13,10 @@ let
    , zip ? ""
    , prefix ? ""
    }:
-    let Family =
-      lib.toUpper (lib.substring 0 1 family) +
-      lib.substring 1 (lib.stringLength family) family;
+    let
+      Family =
+        lib.toUpper (lib.substring 0 1 family) +
+        lib.substring 1 (lib.stringLength family) family;
    in
    stdenvNoCC.mkDerivation rec {
      pname = "source-han-${family}";
@ -49,9 +50,36 @@ let
        maintainers = with lib.maintainers; [ taku0 emily ];
      };
    };
+
+  makeVariable =
+    { family
+    , version
+    , hash
+    , format
+    }:
+    let
+      Family =
+        lib.toUpper (lib.substring 0 1 family) +
+        lib.substring 1 (lib.stringLength family) family;
+    in
+    fetchurl {
+      pname = "source-han-${family}-vf-${format}";
+      inherit version hash;
+      url = "https://raw.githubusercontent.com/adobe-fonts/source-han-${family}/${version}R/Variable/OTC/SourceHan${Family}-VF.${format}.ttc";
+      recursiveHash = true;
+      downloadToTemp = true;
+      postFetch = "install -Dm444 $downloadedFile $out/share/fonts/variable/SourceHan${Family}-VF.${format}.ttc";
+
+      meta = {
+        description = "An open source Pan-CJK ${Family} typeface";
+        homepage = "https://github.com/adobe-fonts/source-han-${family}";
+        license = lib.licenses.ofl;
+        maintainers = with lib.maintainers; [ taku0 emily ];
+      };
+    };
 in
 {
-  sans = makePackage {
+  sans = makeSuperOTC {
    family = "sans";
    description = "sans-serif";
    rev = "2.004R";
@ -59,7 +87,7 @@ in
    zip = ".zip";
  };

-  serif = makePackage {
+  serif = makeSuperOTC {
    family = "serif";
    description = "serif";
    rev = "2.001R";
@ -68,10 +96,38 @@ in
    prefix = "01_";
  };

-  mono = makePackage {
+  mono = makeSuperOTC {
    family = "mono";
    description = "monospaced";
    rev = "1.002";
    hash = "sha256-DBkkSN6QhI8R64M2h2iDqaNtxluJZeSJYAz8x6ZzWME=";
  };
+
+  sans-vf-otf = makeVariable {
+    family = "sans";
+    version = "2.004";
+    hash = "sha256-V7PE09c7h4RDS8Ij4PSI36Gy+LM+PVDi73Rcs+4DfHo=";
+    format = "otf";
+  };
+
+  sans-vf-ttf = makeVariable {
+    family = "sans";
+    version = "2.004";
+    hash = "sha256-mXTG/d30gUxzxkJpaH4vOawRXMSxxTXlHCvHEsfGqbc=";
+    format = "ttf";
+  };
+
+  serif-vf-otf = makeVariable {
+    family = "serif";
+    version = "2.002";
+    hash = "sha256-8sD4bU6w7HBm4vBuPAjcjpxN2rtEJugAw+X0bAOcmjA=";
+    format = "otf";
+  };
+
+  serif-vf-ttf = makeVariable {
+    family = "serif";
+    version = "2.002";
+    hash = "sha256-dmTZFRsD55WCOg2+sqd8bkmTSnSNn5xUYf0PgzIvzww=";
+    format = "ttf";
+  };
 }
--- a/pkgs/desktops/gnome/default.nix
+++ b/pkgs/desktops/gnome/default.nix
@ -238,9 +238,9 @@ lib.makeScope pkgs.newScope (self: with self; {

  gnome-flashback = callPackage ./misc/gnome-flashback { };

-  gnome-panel = callPackage ./misc/gnome-panel {
-    autoreconfHook = pkgs.autoreconfHook269;
-  };
+  gnome-panel = callPackage ./misc/gnome-panel { };
+
+  gnome-panel-with-modules = callPackage ./misc/gnome-panel/wrapper.nix { };

  gnome-tweaks = callPackage ./misc/gnome-tweaks { };

--- a/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
@ -127,72 +127,36 @@ let
        versionPolicy = "odd-unstable";
      };

-      mkSessionForWm = { wmName, wmLabel, wmCommand, enableGnomePanel, panelModulePackages }:
-        let
-          wmApplication = writeTextFile {
-            name = "gnome-flashback-${wmName}-wm";
-            destination = "/share/applications/${wmName}.desktop";
-            text = ''
-              [Desktop Entry]
-              Type=Application
-              Encoding=UTF-8
-              Name=${wmLabel}
-              Exec=${wmCommand}
-              NoDisplay=true
-              X-GNOME-WMName=${wmLabel}
-              X-GNOME-Autostart-Phase=WindowManager
-              X-GNOME-Provides=windowmanager
-              X-GNOME-Autostart-Notify=false
-            '';
-          };
+      mkWmApplication = { wmName, wmLabel, wmCommand }:
+        writeTextFile {
+          name = "gnome-flashback-${wmName}-wm";
+          destination = "/share/applications/${wmName}.desktop";
+          text = ''
+            [Desktop Entry]
+            Type=Application
+            Encoding=UTF-8
+            Name=${wmLabel}
+            Exec=${wmCommand}
+            NoDisplay=true
+            X-GNOME-WMName=${wmLabel}
+            X-GNOME-Autostart-Phase=WindowManager
+            X-GNOME-Provides=windowmanager
+            X-GNOME-Autostart-Notify=false
+          '';
+        };

-          gnomeSession = writeTextFile {
-            name = "gnome-flashback-${wmName}-gnome-session";
-            destination = "/share/gnome-session/sessions/gnome-flashback-${wmName}.session";
-            text = ''
-              [GNOME Session]
-              Name=GNOME Flashback (${wmLabel})
-              ${requiredComponents wmName enableGnomePanel}
-            '';
-          };
+      mkGnomeSession = { wmName, wmLabel, enableGnomePanel }:
+        writeTextFile {
+          name = "gnome-flashback-${wmName}-gnome-session";
+          destination = "/share/gnome-session/sessions/gnome-flashback-${wmName}.session";
+          text = ''
+            [GNOME Session]
+            Name=GNOME Flashback (${wmLabel})
+            ${requiredComponents wmName enableGnomePanel}
+          '';
+        };

-          # gnome-panel will only look for applets in a single directory so symlink them into here.
-          panelModulesEnv = buildEnv {
-            name = "gnome-panel-modules-env";
-            # We always want to find the built-in panel applets.
-            paths = [ gnome-panel gnome-flashback ] ++ panelModulePackages;
-            pathsToLink = [ "/lib/gnome-panel/modules" ];
-          };
-
-          executable = stdenv.mkDerivation {
-            name = "gnome-flashback-${wmName}";
-            nativeBuildInputs = [ glib wrapGAppsHook ];
-            buildInputs = [ gnome-flashback ] ++ lib.optionals enableGnomePanel ([ gnome-panel ] ++ panelModulePackages);
-
-            # We want to use the wrapGAppsHook mechanism to wrap gnome-session
-            # with the environment that gnome-flashback and gnome-panel need to
-            # run, including the configured applet packages. This is only possible
-            # in the fixup phase, so turn everything else off.
-            dontUnpack = true;
-            dontConfigure = true;
-            dontBuild = true;
-            dontInstall = true;
-            dontWrapGApps = true; # We want to do the wrapping ourselves.
-
-            # gnome-flashback and gnome-panel need to be added to XDG_DATA_DIRS so that their .desktop files can be found by gnome-session.
-            # We need to pass the --builtin flag so that gnome-session invokes gnome-session-binary instead of systemd.
-            # If systemd is used, it doesn't use the environment we set up here and so it can't find the .desktop files.
-            preFixup = ''
-              makeWrapper ${gnome-session}/bin/gnome-session $out \
-                --add-flags "--session=gnome-flashback-${wmName} --builtin" \
-                --set-default XDG_CURRENT_DESKTOP 'GNOME-Flashback:GNOME' \
-                --prefix XDG_DATA_DIRS : '${lib.makeSearchPath "share" ([ wmApplication gnomeSession gnome-flashback ] ++ lib.optional enableGnomePanel gnome-panel)}' \
-                "''${gappsWrapperArgs[@]}" \
-                ${lib.optionalString enableGnomePanel "--set NIX_GNOME_PANEL_MODULESDIR '${panelModulesEnv}/lib/gnome-panel/modules'"}
-            '';
-          };
-
-        in
+      mkSessionForWm = { wmName, wmLabel, wmCommand }:
        writeTextFile
          {
            name = "gnome-flashback-${wmName}-xsession";
@ -201,7 +165,7 @@ let
              [Desktop Entry]
              Name=GNOME Flashback (${wmLabel})
              Comment=This session logs you into GNOME Flashback with ${wmLabel}
-              Exec=${executable}
+              Exec=${gnome-session}/bin/gnome-session --session=gnome-flashback-${wmName}
              TryExec=${wmCommand}
              Type=Application
              DesktopNames=GNOME-Flashback;GNOME;
@ -211,7 +175,7 @@ let
        };

      mkSystemdTargetForWm = { wmName, wmLabel, wmCommand, enableGnomePanel }:
-        runCommand "gnome-flashback-${wmName}.target" {} ''
+        runCommand "gnome-flashback-${wmName}.target" { } ''
          mkdir -p $out/lib/systemd/user
          cp -r "${gnome-flashback}/lib/systemd/user/gnome-session@gnome-flashback-metacity.target.d" \
            "$out/lib/systemd/user/gnome-session@gnome-flashback-${wmName}.target.d"
--- a/pkgs/desktops/gnome/misc/gnome-panel/wrapper.nix
+++ b/pkgs/desktops/gnome/misc/gnome-panel/wrapper.nix
@ -0,0 +1,66 @@
+{ stdenv
+, lib
+, buildEnv
+, gnome-panel
+, gnome-flashback
+, xorg
+, glib
+, wrapGAppsHook
+, panelModulePackages ? [ ]
+}:
+
+let
+  # We always want to find the built-in panel applets.
+  selectedPanelModulePackages = [ gnome-panel gnome-flashback ] ++ panelModulePackages;
+
+  panelModulesEnv = buildEnv {
+    name = "gnome-panel-modules-env";
+    paths = selectedPanelModulePackages;
+    pathsToLink = [ "/lib/gnome-panel/modules" ];
+  };
+in
+stdenv.mkDerivation {
+  pname = "${gnome-panel.pname}-with-modules";
+  inherit (gnome-panel) version;
+
+  nativeBuildInputs = [
+    glib
+    wrapGAppsHook
+  ];
+
+  buildInputs = selectedPanelModulePackages ++
+    lib.forEach selectedPanelModulePackages (x: x.buildInputs or [ ]);
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  preferLocalBuild = true;
+  allowSubstitutes = false;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    ${xorg.lndir}/bin/lndir -silent ${gnome-panel} $out
+
+    rm -r $out/lib/gnome-panel/modules
+    ${xorg.lndir}/bin/lndir -silent ${panelModulesEnv} $out
+
+    rm $out/share/applications/gnome-panel.desktop
+
+    substitute ${gnome-panel}/share/applications/gnome-panel.desktop \
+      $out/share/applications/gnome-panel.desktop --replace \
+      "Exec=${gnome-panel}/bin/gnome-panel" "Exec=$out/bin/gnome-panel"
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --set NIX_GNOME_PANEL_MODULESDIR "$out/lib/gnome-panel/modules"
+    )
+  '';
+
+  meta = gnome-panel.meta // { outputsToInstall = [ "out" ]; };
+}
--- a/pkgs/development/compilers/cmdstan/default.nix
+++ b/pkgs/development/compilers/cmdstan/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "cmdstan";
-  version = "2.32.2";
+  version = "2.33.1";

  src = fetchFromGitHub {
    owner = "stan-dev";
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-obV+R1ZjBgunXndCNry+MEne1nQawo81IV2DWwYbbIQ=";
+    hash = "sha256-c+L/6PjW7YgmXHuKhKjiRofBRAhKYCzFCZ6BOX5AmC4=";
  };

  nativeBuildInputs = [ stanc ];
--- a/pkgs/development/compilers/gcc/common/pre-configure.nix
+++ b/pkgs/development/compilers/gcc/common/pre-configure.nix
@ -122,7 +122,7 @@ in lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
 + lib.optionalString (targetPlatform != hostPlatform &&
                      withoutTargetLibc &&
                      targetPlatform.config == hostPlatform.config &&
-                      (stdenv.cc.isClang || stdenv.targetPlatform.useLLVM)) ''
+                      (stdenv.cc.isClang || stdenv.targetPlatform.useLLVM or false)) ''
  export inhibit_libc=true
 ''

--- a/pkgs/development/compilers/stanc/default.nix
+++ b/pkgs/development/compilers/stanc/default.nix
@ -5,7 +5,7 @@

 ocamlPackages.buildDunePackage rec {
  pname = "stanc";
-  version = "2.32.2";
+  version = "2.33.1";

  minimalOCamlVersion = "4.12";
  duneVersion = "3";
@ -14,7 +14,7 @@ ocamlPackages.buildDunePackage rec {
    owner = "stan-dev";
    repo = "stanc3";
    rev = "v${version}";
-    hash = "sha256-dngmZXVb59uV7EugYIZAqE1gk66em7iuzllbbPWK2xk=";
+    hash = "sha256-DeQOiYJ5OHIMXcYHTYlObJnxM2Rqf6pSN4T7sAGw+wg=";
  };

  # Error: This expression has type [ `Use_Sys_unix ]
--- a/pkgs/development/compilers/yosys/default.nix
+++ b/pkgs/development/compilers/yosys/default.nix
@ -71,13 +71,13 @@ let

 in stdenv.mkDerivation rec {
  pname   = "yosys";
-  version = "0.33";
+  version = "0.34";

  src = fetchFromGitHub {
    owner = "YosysHQ";
    repo  = "yosys";
-    rev   = "${pname}-${version}";
-    hash  = "sha256-3MsWF161pqqeAbmeTlkQY6UpU4pq1WT0XXK9yciwt0M=";
+    rev   = "refs/tags/${pname}-${version}";
+    hash  = "sha256-GHDsMBj7DRb9ffESgzd1HzDAA6Cyft5PomidvIMzn9g=";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/SDL_compat/default.nix
+++ b/pkgs/development/libraries/SDL_compat/default.nix
@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "SDL_compat";
-  version = "1.2.64";
+  version = "1.2.68";

  src = fetchFromGitHub {
    owner = "libsdl-org";
    repo = "sdl12-compat";
    rev = "release-" + version;
-    hash = "sha256-Ctl7RElRWaB4IpBZD5Sm0rYOcv5zaIag78VTKoFlbVs=";
+    hash = "sha256-f2dl3L7/qoYNl4sjik1npcW/W09zsEumiV9jHuKnUmM=";
  };

  nativeBuildInputs = [ cmake pkg-config ]
--- a/pkgs/development/libraries/amdvlk/default.nix
+++ b/pkgs/development/libraries/amdvlk/default.nix
@ -25,13 +25,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "amdvlk";
-  version = "2023.Q3.2";
+  version = "2023.Q3.3";

  src = fetchRepoProject {
    name = "${pname}-src";
    manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
    rev = "refs/tags/v-${version}";
-    sha256 = "/1D2BbT1gnMLvIHfpkxLkeo1pjbG9LkTx9Zl5+gGU/M=";
+    sha256 = "HHnMiU6mzhUSicXev53PP8y9ealtDMavJLp2F/JAWhI=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/exiv2/default.nix
+++ b/pkgs/development/libraries/exiv2/default.nix
@ -1,30 +1,33 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, zlib
-, expat
 , cmake
-, which
-, libxml2
-, python3
-, gettext
 , doxygen
+, gettext
 , graphviz
 , libxslt
-, libiconv
 , removeReferencesTo
+, libiconv
+, brotli
+, expat
+, inih
+, zlib
+, libxml2
+, python3
+, which
 }:

 stdenv.mkDerivation rec {
  pname = "exiv2";
-  version = "0.27.7";
+  version = "0.28.0";

-  outputs = [ "out" "lib" "dev" "doc" "man" "static" ];
+  outputs = [ "out" "lib" "dev" "doc" "man" ];

  src = fetchFromGitHub {
    owner = "exiv2";
-    repo  = "exiv2";
+    repo = "exiv2";
    rev = "v${version}";
-    sha256 = "sha256-xytVGrLDS22n2/yydFTT6CsDESmhO9mFbPGX4yk+b6g=";
+    hash = "sha256-nEoLJWxSJmAonCbW/iZKjLrKMj09mwEaSUXUcUu8GxU=";
  };

  nativeBuildInputs = [
@ -36,10 +39,14 @@ stdenv.mkDerivation rec {
    removeReferencesTo
  ];

-  buildInputs = lib.optional stdenv.isDarwin libiconv;
+  buildInputs = lib.optionals stdenv.isDarwin [
+    libiconv
+  ];

  propagatedBuildInputs = [
+    brotli
    expat
+    inih
    zlib
  ];

@ -60,68 +67,34 @@ stdenv.mkDerivation rec {
    "doc"
  ];

-  doCheck = true;
+  # https://github.com/Exiv2/exiv2/issues/2762
+  doCheck = lib.versionOlder brotli.version "1.1.0";

  preCheck = ''
    patchShebangs ../test/
    mkdir ../test/tmp
-
-    ${lib.optionalString stdenv.hostPlatform.isAarch ''
-      # Fix tests on arm
-      # https://github.com/Exiv2/exiv2/issues/933
-      rm -f ../tests/bugfixes/github/test_CVE_2018_12265.py
-    ''}
-
-    ${lib.optionalString stdenv.isDarwin ''
-      export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD/lib
-      # Removing tests depending on charset conversion
-      substituteInPlace ../test/Makefile --replace "conversions.sh" ""
-      rm -f ../tests/bugfixes/redmine/test_issue_460.py
-      rm -f ../tests/bugfixes/redmine/test_issue_662.py
-      rm -f ../tests/bugfixes/github/test_issue_1046.py
-
-      rm ../tests/bugfixes/redmine/test_issue_683.py
-
-      # disable tests that requires loopback networking
-      substituteInPlace  ../tests/bash_tests/testcases.py \
-        --replace "def io_test(self):" "def io_disabled(self):"
-     ''}
-  '' + lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
+  '' + lib.optionalString stdenv.hostPlatform.isAarch32 ''
+    # Fix tests on arm
+    # https://github.com/Exiv2/exiv2/issues/933
+    rm -f ../tests/bugfixes/github/test_CVE_2018_12265.py
+  '' + lib.optionalString stdenv.isDarwin ''
+    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD/lib
    export LC_ALL=C
-  '' + lib.optionalString stdenv.isAarch32 ''
-    # these tests are fixed in 0.28, remove when updating to 0.28
-    rm -f ../tests/bugfixes/github/test_issue_1503.py
-    rm -f ../tests/bugfixes/github/test_pr1475_AVIF.py
-    rm -f ../tests/bugfixes/github/test_pr1475_HEIC.py
-    rm -f ../tests/bugfixes/github/test_pr1475_HIF.py
+
+    # disable tests that requires loopback networking
+    substituteInPlace  ../tests/bash_tests/testcases.py \
+      --replace "def io_test(self):" "def io_disabled(self):"
  '';

-  # With CMake we have to enable samples or there won't be
-  # a tests target. This removes them.
-  postInstall = ''
-    ( cd "$out/bin"
-      mv exiv2 .exiv2
-      rm *
-      mv .exiv2 exiv2
-    )
-
-    mkdir -p $static/lib
-    mv $lib/lib/*.a $static/lib/
-
+  preFixup = ''
    remove-references-to -t ${stdenv.cc.cc} $lib/lib/*.so.*.*.* $out/bin/exiv2 $static/lib/*.a
  '';

-  postFixup = ''
-    substituteInPlace "$dev"/lib/cmake/exiv2/exiv2Config.cmake --replace \
-      "set(_IMPORT_PREFIX \"$out\")" \
-      "set(_IMPORT_PREFIX \"$static\")"
-    substituteInPlace "$dev"/lib/cmake/exiv2/exiv2Config-*.cmake --replace \
-      "$lib/lib/libexiv2-xmp.a" \
-      "$static/lib/libexiv2-xmp.a"
-  '';
-
  disallowedReferences = [ stdenv.cc.cc ];

+  # causes redefinition of _FORTIFY_SOURCE
+  hardeningDisable = [ "fortify3" ];
+
  meta = with lib; {
    homepage = "https://exiv2.org";
    description = "A library and command-line utility to manage image metadata";
--- a/pkgs/development/libraries/graphene-hardened-malloc/default.nix
+++ b/pkgs/development/libraries/graphene-hardened-malloc/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "graphene-hardened-malloc";
-  version = "11";
+  version = "12";

  src = fetchFromGitHub {
    owner = "GrapheneOS";
    repo = "hardened_malloc";
    rev = finalAttrs.version;
-    sha256 = "sha256-BbjL0W12QXFmGCzFrFYY6CZZeFbUt0elCGhM+mbL/IU=";
+    sha256 = "sha256-ujwzr4njNsf/VTyEq7zKHWxoivU3feavSTx+MLIj1ZM=";
  };

  doCheck = true;
--- a/pkgs/development/libraries/libmediainfo/default.nix
+++ b/pkgs/development/libraries/libmediainfo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libmediainfo";
-  version = "23.07";
+  version = "23.09";

  src = fetchurl {
    url = "https://mediaarea.net/download/source/libmediainfo/${version}/libmediainfo_${version}.tar.xz";
-    hash = "sha256-YEVsiyq4dppggdlv176G20/jJSDkoCI5fLIsrPR86CA=";
+    hash = "sha256-HDJvFmVyrGwsHIim1Tr35FE4iEDH7r7scdWrv9G7LtM=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/development/libraries/libnbd/default.nix
+++ b/pkgs/development/libraries/libnbd/default.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  pname = "libnbd";
-  version = "1.16.0";
+  version = "1.18.0";

  src = fetchurl {
    url = "https://download.libguestfs.org/libnbd/${lib.versions.majorMinor version}-stable/${pname}-${version}.tar.gz";
-    hash = "sha256-Tkd46NxLvGe+RpCSFdCsYrFWc3PAtXI1aCq8177jla0=";
+    hash = "sha256-srJyd32eCIthoncvM9JQEKCWEOZxxc3YntaV4Ay8kZ8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/science/math/amd-blis/default.nix
+++ b/pkgs/development/libraries/science/math/amd-blis/default.nix
@ -6,10 +6,10 @@
 # Enable BLAS interface with 64-bit integer width.
 , blas64 ? false

-# Target architecture. "amd64" compiles kernels for all Zen
+# Target architecture. "amdzen" compiles kernels for all Zen
 # generations. To build kernels for specific Zen generations,
-# use "zen", "zen2", or "zen3".
-, withArchitecture ? "amd64"
+# use "zen", "zen2", "zen3", or "zen4".
+, withArchitecture ? "amdzen"

 # Enable OpenMP-based threading.
 , withOpenMP ? true
@ -18,15 +18,16 @@
 let
  threadingSuffix = lib.optionalString withOpenMP "-mt";
  blasIntSize = if blas64 then "64" else "32";
+
 in stdenv.mkDerivation rec {
  pname = "amd-blis";
-  version = "3.0";
+  version = "4.1";

  src = fetchFromGitHub {
    owner = "amd";
    repo = "blis";
    rev = version;
-    hash = "sha256-bbbeo1yOKse9pzbsB6lQ7pULKdzu3G7zJzTUgPXiMZY=";
+    hash = "sha256-1vd4uBg/+Vufqsr+MnAWSUW/THkribHNSMeq1/is8K4=";
  };

  inherit blas64;
@ -54,8 +55,9 @@ in stdenv.mkDerivation rec {
  '';

  postInstall = ''
-    ln -s $out/lib/libblis${threadingSuffix}.so.3 $out/lib/libblas.so.3
-    ln -s $out/lib/libblis${threadingSuffix}.so.3 $out/lib/libcblas.so.3
+    ls $out/lib
+    ln -s $out/lib/libblis${threadingSuffix}.so $out/lib/libblas.so.3
+    ln -s $out/lib/libblis${threadingSuffix}.so $out/lib/libcblas.so.3
    ln -s $out/lib/libblas.so.3 $out/lib/libblas.so
    ln -s $out/lib/libcblas.so.3 $out/lib/libcblas.so
  '';
--- a/pkgs/development/libraries/simpleitk/default.nix
+++ b/pkgs/development/libraries/simpleitk/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "simpleitk";
-  version = "2.2.1";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "SimpleITK";
    repo = "SimpleITK";
    rev = "refs/tags/v${version}";
-    hash = "sha256-0YxmixUTXpjegZQv7DDCNTWFTH8QEWqQQszee7aQ5EI=";
+    hash = "sha256-SJSFJEFu1qKowX5/98MslN7GFDS8aF5+EKkQ2983Azg=";
  };

  nativeBuildInputs = [ cmake swig4 ];
--- a/pkgs/development/python-modules/anthemav/default.nix
+++ b/pkgs/development/python-modules/anthemav/default.nix
@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "anthemav";
+  version = "1.4.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "nugget";
+    repo = "python-anthemav";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ZjAt4oODx09Qij0PwBvLCplSjwdBx2fReiwjmKhdPa0=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "anthemav"
+  ];
+
+  meta = with lib; {
+    description = "Python asyncio module to interface with Anthem AVM and MRX receivers";
+    homepage = "https://github.com/nugget/python-anthemav";
+    changelog = "https://github.com/nugget/python-anthemav/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/argh/default.nix
+++ b/pkgs/development/python-modules/argh/default.nix
@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "argh";
-  version = "0.29.3";
+  version = "0.29.4";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-WOQ4zpFpqqLm3hR+POs0zqz+JlVqIwb1Di1G9Sd5rLE=";
+    hash = "sha256-aVwK5FNCcMriaXhBtKVvQ0qZBpSgAmTqEOu7zcAsE/c=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/atom/default.nix
+++ b/pkgs/development/python-modules/atom/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "atom";
-  version = "0.10.0";
+  version = "0.10.3";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "nucleic";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-l+4/bk3V5gMa7CXSHSo8aWmipur0xheL2FopHuiLcpQ=";
+    hash = "sha256-NXjvRVYcWU9p7b8y2ICOzYe6TeMh1S70Edy/JvTG7a4=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/cmdstanpy/default.nix
+++ b/pkgs/development/python-modules/cmdstanpy/default.nix
@ -8,6 +8,7 @@
 , pandas
 , numpy
 , tqdm
+, stanio
 , xarray

 , pytestCheckHook
@ -15,14 +16,14 @@

 buildPythonPackage rec {
  pname = "cmdstanpy";
-  version = "1.1.0";
+  version = "1.2.0";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "stan-dev";
    repo = "cmdstanpy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-9kAd3rbSctWEhAzB6RiQlbg5/uVxGIghYLus8hWzBFQ=";
+    hash = "sha256-1/X5JDvCx21qLNamNQXpg+w3d3DdSRlB+liIv2fThs4=";
  };

  patches = [
@ -41,6 +42,7 @@ buildPythonPackage rec {
    pandas
    numpy
    tqdm
+    stanio
  ];

  passthru.optional-dependencies = {
--- a/pkgs/development/python-modules/django-auth-ldap/default.nix
+++ b/pkgs/development/python-modules/django-auth-ldap/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "django-auth-ldap";
-  version = "4.5.0";
+  version = "4.6.0";
  format = "pyproject";

  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-B6L+NbQCUIluErjWLROW0eQ3AEYwNwN2BJPOzXkfqI8=";
+    hash = "sha256-muK/h/m2Nnts/ZSgRRiWy8co5UAO2By/vVjOdDwJCaI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/django-redis/default.nix
+++ b/pkgs/development/python-modules/django-redis/default.nix
@ -20,7 +20,7 @@

 let
  pname = "django-redis";
-  version = "5.3.0";
+  version = "5.4.0";
 in
 buildPythonPackage {
  inherit pname version;
@ -31,7 +31,7 @@ buildPythonPackage {
    owner = "jazzband";
    repo = "django-redis";
    rev = version;
-    hash = "sha256-eX9rUUvpkRrkZ82YalWn8s9DTw6nsbGzi1A6ibRoQGw=";
+    hash = "sha256-m7z3c7My24vrSSnyfDQ/LlWhy7pV4U0L8LATMvkfczc=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/einops/default.nix
+++ b/pkgs/development/python-modules/einops/default.nix
@ -3,12 +3,7 @@
 , chainer
 , fetchFromGitHub
 , hatchling
-, jupyter
-, keras
-  #, mxnet
 , nbconvert
-, nbformat
-, nose
 , numpy
 , parameterized
 , pytestCheckHook
@ -33,12 +28,7 @@ buildPythonPackage rec {

  nativeCheckInputs = [
    chainer
-    jupyter
-    keras
-    # mxnet (has issues with some CPUs, segfault)
    nbconvert
-    nbformat
-    nose
    numpy
    parameterized
    pytestCheckHook
--- a/pkgs/development/python-modules/flask-jwt-extended/default.nix
+++ b/pkgs/development/python-modules/flask-jwt-extended/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "flask-jwt-extended";
-  version = "4.5.2";
+  version = "4.5.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "Flask-JWT-Extended";
    inherit version;
-    hash = "sha256-ulYkW6Q7cciuk2eEuGdiXc6LmVb67t7ClTIi5XlC+ws=";
+    hash = "sha256-Bh7z0l7VdDur5JZKs4822HDm0v2KEmurXXfd74oBkys=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/flask-mysqldb/default.nix
+++ b/pkgs/development/python-modules/flask-mysqldb/default.nix
@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, setuptools
+, flask
+, mysqlclient
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "flask-mysqldb";
+  version = "2.0.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "alexferl";
+    repo = "flask-mysqldb";
+    rev = "v${version}";
+    hash = "sha256-RHAB9WGRzojH6eAOG61QguwF+4LssO9EcFjbWxoOtF4=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    flask
+    mysqlclient
+  ];
+
+  pythonImportsCheck = [
+    "flask_mysqldb"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "MySQL connection support for Flask";
+    homepage = "https://github.com/alexferl/flask-mysqldb";
+    changelog = "https://github.com/alexferl/flask-mysqldb/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ netali ];
+  };
+}
--- a/pkgs/development/python-modules/fschat/default.nix
+++ b/pkgs/development/python-modules/fschat/default.nix
@ -29,7 +29,7 @@
 , protobuf
 }:
 let
-  version = "0.2.28";
+  version = "0.2.30";
 in
 buildPythonPackage {
  pname = "fschat";
@ -39,8 +39,8 @@ buildPythonPackage {
  src = fetchFromGitHub {
    owner = "lm-sys";
    repo = "FastChat";
-    rev = "v${version}";
-    hash = "sha256-nTP4zY6mJykzKb6LBWosg77mwE33vq9eiYSpAlZU5NI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-SkrdRpmbxnt/Xn8TTmozxhr3fPeAFPP7X0cM9vJC9Sc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-logging/default.nix
@ -21,14 +21,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-logging";
-  version = "3.7.0";
+  version = "3.8.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-0uroUD8Pb5SEhG34sIepU5zY0yo19n9QBTz9sCuYlh4=";
+    hash = "sha256-/dkW5ZqEqowC6BSNf907O2I8V7DB/3H0MpfOjlD8Hqs=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/imap-tools/default.nix
+++ b/pkgs/development/python-modules/imap-tools/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "imap-tools";
-  version = "1.2.0";
+  version = "1.3.0";

  disabled = pythonOlder "3.5";

@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "ikvk";
    repo = "imap_tools";
    rev = "refs/tags/v${version}";
-    hash = "sha256-FC4uvBqQ9Lqpvj94ByM7LYiqqjAQQljYduBxwum49lI=";
+    hash = "sha256-dlCPJQDkHW4zNIHwhyKkgk+rI2t+Xn+Fbf3xJPRtaiY=";
  };

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/influxdb-client/default.nix
+++ b/pkgs/development/python-modules/influxdb-client/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "influxdb-client";
-  version = "1.37.0";
+  version = "1.38.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "influxdata";
    repo = "influxdb-client-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-paS+/miraJ9vRL1ZEAWJRSVd1hGvrYJe+0YD/F4sGDs=";
+    hash = "sha256-oE0RPryuUJcy6HN3V2XIxipGYU41xrYMC7b0sGRfay8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/loqedapi/default.nix
+++ b/pkgs/development/python-modules/loqedapi/default.nix
@ -0,0 +1,49 @@
+{ lib
+, aiohttp
+, async-timeout
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, setuptools
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "loqedapi";
+  version = "2.1.8";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "cpolhout";
+    repo = "loqedAPI";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-9ekZ98GazH1tna4JT5SEUETKR227UYRIBBghdj+TFB4=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    async-timeout
+  ];
+
+  # Tests require network access
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "loqedAPI"
+  ];
+
+  meta = with lib; {
+    description = "Module to interact with the Loqed Smart Door Lock API";
+    homepage = "https://github.com/cpolhout/loqedAPI";
+    changelog = "https://github.com/cpolhout/loqedAPI/releases/tag/v${version}";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/marisa-trie/default.nix
+++ b/pkgs/development/python-modules/marisa-trie/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "marisa-trie";
-  version = "1.0.0";
+  version = "1.1.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-2KaDAfAjpyTrN5qqGxD4ip4aRYzIpBtSfGJQeFm0pNI=";
+    hash = "sha256-W/Q+0M82r0V4/nsDTPlfUyQ5dmUWaA5L1gNyNhHr1Ws=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/nsz/default.nix
+++ b/pkgs/development/python-modules/nsz/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "nsz";
-  version = "4.4.0";
+  version = "4.5.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "nicoboss";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-glK4CK7D33FfLqHLxVr4kkb887/A9tqxPwWpcXYZu/0=";
+    hash = "sha256-/46qOQEuzSBmnFG0XW4z71HAHpuyqhia29KQkUlDsgg=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/oci/default.nix
+++ b/pkgs/development/python-modules/oci/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "oci";
-  version = "2.112.2";
+  version = "2.112.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "oracle";
    repo = "oci-python-sdk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Khh1/lpgBtUb1pfV7wNkHA6dWiBpAS899zB4Elp1ULY=";
+    hash = "sha256-MeqMaui3gBtEdYGZ5w557hfIOiPKRUdScEUBN9QQWwg=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/pyecoforest/default.nix
+++ b/pkgs/development/python-modules/pyecoforest/default.nix
@ -0,0 +1,56 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, httpx
+, poetry-core
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+, respx
+}:
+
+buildPythonPackage rec {
+  pname = "pyecoforest";
+  version = "0.3.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "pjanuario";
+    repo = "pyecoforest";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-GBt7uHppWLq5nIIVwYsOWmLjWjcwdvJwDE/Gu2KnSIA=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "--cov=pyecoforest --cov-report=term-missing:skip-covered" ""
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    httpx
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+    respx
+  ];
+
+  pythonImportsCheck = [
+    "pyecoforest"
+  ];
+
+  meta = with lib; {
+    description = "Module for interacting with Ecoforest devices";
+    homepage = "https://github.com/pjanuario/pyecoforest";
+    changelog = "https://github.com/pjanuario/pyecoforest/blob/${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/pyfronius/default.nix
+++ b/pkgs/development/python-modules/pyfronius/default.nix
@ -2,32 +2,24 @@
 , aiohttp
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pythonOlder
 , pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "pyfronius";
-  version = "0.7.1";
+  version = "0.7.2";
+  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "nielstron";
    repo = pname;
    rev = "release-${version}";
-    sha256 = "1xwx0c1dp2374bwigzwhvcj4577vrxyhn6i5zv73k9ydc7w1xgyz";
+    hash = "sha256-eWe4nXKW9oP9lqehy6BK7ABaIqP3dgRX6ymW1Okfd9g=";
  };

-  patches = [
-    (fetchpatch {
-      # Python3.10 compatibility; https://github.com/nielstron/pyfronius/pull/7
-      url = "https://github.com/nielstron/pyfronius/commit/9deb209d4246ff575cd3c4c5373037bf11df6719.patch";
-      hash = "sha256-srXYCvp86kGYUYZIXMcu68hEbkTspD945J+hc/AhqSw=";
-    })
-  ];
-
  propagatedBuildInputs = [
    aiohttp
  ];
@ -36,11 +28,14 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [ "pyfronius" ];
+  pythonImportsCheck = [
+    "pyfronius"
+  ];

  meta = with lib; {
    description = "Python module to communicate with Fronius Symo";
    homepage = "https://github.com/nielstron/pyfronius";
+    changelog = "https://github.com/nielstron/pyfronius/releases/tag/release-${version}";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/pypykatz/default.nix
+++ b/pkgs/development/python-modules/pypykatz/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "pypykatz";
-  version = "0.6.8";
+  version = "0.6.9";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-uOOPDVlx8EKgkCJmZOQxIlI0UBMNzuh/ESoIoa2TmNM=";
+    hash = "sha256-Xni2cYI+ByTFSDvuWHDU97KljwMe3aT7P+VIir6ktks=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/python_docs_theme/default.nix
+++ b/pkgs/development/python-modules/python_docs_theme/default.nix
@ -2,14 +2,14 @@

 buildPythonPackage rec {
  pname = "python_docs_theme";
-  version = "2023.7";
+  version = "2023.9";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "python";
    repo = "python-docs-theme";
    rev = "refs/tags/${version}";
-    sha256 = "sha256-43/TlgYm7Q4ZtY25MiLU9fd1atDmiDUeUK6AYfDfmag=";
+    sha256 = "sha256-XVwMEfprTNdNnaW38HMCAu4CswdVjBXYtNWBgqXfbno=";
  };

  nativeBuildInputs = [ flit-core ];
--- a/pkgs/development/python-modules/pywayland/default.nix
+++ b/pkgs/development/python-modules/pywayland/default.nix
@ -10,11 +10,11 @@

 buildPythonPackage rec {
  pname = "pywayland";
-  version = "0.4.16";
+  version = "0.4.17";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-qqcMhwsKs2UhX45xUF9zaDxO0VsfNjhDOx3HNE/ltd0=";
+    hash = "sha256-9/0ZAmOML3oVrAfzGj72iV08FgyiYBSByoKyxhojxlc=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/Show More
+++ b/Show More