Merge master into staging-next

2025-02-05 11:44:02 +00:00 · 2023-02-13 18:01:22 +00:00 · 2023-02-13 18:01:22 +00:00 · e84df07fe1
commit e84df07fe1
parent a6767ed934 be5517c731
65 changed files with 758 additions and 925 deletions
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -312,6 +312,19 @@ with lib.maintainers; {
    enableFeatureFreezePing = true;
  };

+  graalvm-ce = {
+    members = [
+      bandresen
+      hlolli
+      glittershark
+      babariviere
+      ericdallo
+      thiagokokada
+    ];
+    scope = "Maintain GraalVM Community Edition packages.";
+    shortName = "GraalVM-CE";
+  };
+
  haskell = {
    members = [
      cdepillabout
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -99,6 +99,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - Calling `makeSetupHook` without passing a `name` argument is deprecated.

+- The `cosmoc` package has been removed. The upstream scripts in `cosmocc` should be used instead.
+
 - Qt 5.12 and 5.14 have been removed, as the corresponding branches have been EOL upstream for a long time. This affected under 10 packages in nixpkgs, largely unmaintained upstream as well, however, out-of-tree package expressions may need to be updated manually.

 - The [services.wordpress.sites.&lt;name&gt;.plugins](#opt-services.wordpress.sites._name_.plugins) and [services.wordpress.sites.&lt;name&gt;.themes](#opt-services.wordpress.sites._name_.themes) options have been converted from sets to attribute sets to allow for consumers to specify explicit install paths via attribute name.
--- a/pkgs/applications/audio/helvum/default.nix
+++ b/pkgs/applications/audio/helvum/default.nix
@ -16,20 +16,20 @@

 stdenv.mkDerivation rec {
  pname = "helvum";
-  version = "0.3.4";
+  version = "0.4.0";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "pipewire";
    repo = pname;
    rev = version;
-    sha256 = "0nhv6zw2zzxz2bg2zj32w1brywnm5lv6j3cvmmvwshc389z2k5x1";
+    hash = "sha256-TvjO7fGobGmAltVHeXWyMtMLANdVWVGvBYq20JD3mMI=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-EIHO9qVPIXgezfFOaarlTU0an762nFmX1ELbQuAZ7rY";
+    hash = "sha256-W5Imlut30cjV4A6TCjBFLbViB0CDUucNsvIUiCXqu7I=";
  };

  nativeBuildInputs = [
@ -50,9 +50,6 @@ stdenv.mkDerivation rec {
    pipewire
  ];

-  # FIXME: workaround for Pipewire 0.3.64 deprecated API change, remove when fixed upstream
-  NIX_CFLAGS_COMPILE = [ "-DPW_ENABLE_DEPRECATED" ];
-
  meta = with lib; {
    description = "A GTK patchbay for pipewire";
    homepage = "https://gitlab.freedesktop.org/pipewire/helvum";
--- a/pkgs/applications/blockchains/torq/default.nix
+++ b/pkgs/applications/blockchains/torq/default.nix
@ -6,20 +6,20 @@

 let
  pname = "torq";
-  version = "0.17.3";
+  version = "0.18.17";

  src = fetchFromGitHub {
    owner = "lncapital";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-fqHJZi1NQCrZqsa+N+FVYZ8s9o0D555Sqn5qNlJ1MmI=";
+    hash = "sha256-xiA66yGo8b1+zZ7jQ7SFOtNPmqbdna7fUCT21uibrIM=";
  };

  web = buildNpmPackage {
    pname = "${pname}-frontend";
    inherit version;
    src = "${src}/web";
-    npmDepsHash = "sha256-8mUfTFzPjQlQvhC3zZf+WruDBkYnmGt3yckNi0CPWs0=";
+    npmDepsHash = "sha256-/7x5RWYIB5BChYMnMuFVVaZd0pVkew4i4QrF7hSFnCM=";

    # copied from upstream Dockerfile
    npmInstallFlags = [ "--legacy-peer-deps" ];
@ -29,14 +29,14 @@ let
    # override npmInstallHook, we only care about the build/ directory
    installPhase = ''
      mkdir $out
-      cp -r build $out/
+      cp -r build/* $out/
    '';
  };
 in
 buildGoModule rec {
  inherit pname version src;

-  vendorHash = "sha256-HETN2IMnpxnTyg6bQDpoD0saJu+gKocdEf0VzEi12Gs=";
+  vendorHash = "sha256-bvisI589Gq9IdyJEqI+uzs3iDPOTUkq95P3n/KoFhF0=";

  subPackages = [ "cmd/torq" ];

@ -47,7 +47,8 @@ buildGoModule rec {
  ];

  postInstall = ''
-    ln -s ${web} $out/web
+    mkdir -p $out/web/build
+    cp -r ${web}/* $out/web/build/
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/darkman/default.nix
+++ b/pkgs/applications/misc/darkman/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "darkman";
-  version = "1.4.0";
+  version = "1.5.4";

  src = fetchFromGitLab {
    owner = "WhyNotHugo";
    repo = "darkman";
    rev = "v${version}";
-    sha256 = "sha256-Q/pjQmlyREl32C0LiwypEz1qBw2AeBOZbUIwNP392Sc=";
+    sha256 = "sha256-6SNXVe6EfVwcXH9O6BxNw+v4/uhKhCtVS3XE2GTc2Sc=";
  };

-  vendorSha256 = "09rjqw6v1jaf0mhmycw9mcay9q0y1fya2azj8216gdgkl48ics08";
+  vendorSha256 = "sha256-xEPmNnaDwFU4l2G4cMvtNeQ9KneF5g9ViQSFrDkrafY=";

  nativeBuildInputs = [ scdoc ];

--- a/pkgs/applications/misc/regextester/default.nix
+++ b/pkgs/applications/misc/regextester/default.nix
@ -11,18 +11,19 @@
 , ninja
 , gobject-introspection
 , gsettings-desktop-schemas
+, desktop-file-utils
 , pantheon
 , wrapGAppsHook }:

 stdenv.mkDerivation rec {
  pname = "regextester";
-  version = "1.0.1";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "artemanufrij";
    repo = "regextester";
    rev = version;
-    sha256 = "1xwwv1hccni1mrbl58f7ly4qfq6738vn24bcbl2q346633cd7kx3";
+    hash = "sha256-5+gU8DeB99w2h/4vMal2eHkR0305dmRYiY6fsLZzlnc=";
  };

  nativeBuildInputs = [
@ -34,6 +35,7 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    wrapGAppsHook
+    desktop-file-utils
  ];

  buildInputs = [
--- a/pkgs/applications/science/physics/nnpdf/default.nix
+++ b/pkgs/applications/science/physics/nnpdf/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , apfel
@ -16,22 +15,15 @@

 stdenv.mkDerivation rec {
  pname = "nnpdf";
-  version = "4.0.4";
+  version = "4.0.6";

  src = fetchFromGitHub {
    owner = "NNPDF";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Alx4W0TkPzJBsnRXcKBrlEU6jWTnOjrji/IPk+dNCw0=";
+    hash = "sha256-mwOMNlYFhHZq/wakO1/HGwcxvKGKh5OyFa2D9d3Y3IA=";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/NNPDF/nnpdf/commit/7943b62a91d3a41fd4f6366b18881d50695f4b45.diff";
-      hash = "sha256-UXhTO7vZgJiY8h3bgjg7SQC0gMUQsYQ/V/PgtCEQ7VU=";
-    })
-  ];
-
  postPatch = ''
    for file in CMakeLists.txt buildmaster/CMakeLists.txt; do
      substituteInPlace $file \
--- a/pkgs/applications/version-management/git-trim/default.nix
+++ b/pkgs/applications/version-management/git-trim/default.nix
@ -1,4 +1,14 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, pkg-config, openssl, libiconv, Security }:
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, libgit2
+, IOKit
+, CoreFoundation
+, fetchpatch
+}:

 rustPlatform.buildRustPackage rec {
  pname = "git-trim";
@ -11,11 +21,22 @@ rustPlatform.buildRustPackage rec {
    sha256 = "sha256-XAO3Qg5I2lYZVNx4+Z5jKHRIFdNwBJsUQwJXFb4CbvM=";
  };

-  cargoHash = "sha256-KCLMb8NXxjscrmKXkP/RbV+LsJqOG7zaClJGFiQ4o9k=";
+  cargoHash = "sha256-mS8kNkZs8jX99ryG4XkU+U/iWIIcmET2vOfG1YNNZFU=";
+
+  cargoPatches = [
+    # Update git2 https://github.com/foriequal0/git-trim/pull/202
+    (fetchpatch {
+      url = "https://github.com/foriequal0/git-trim/commit/4355cd1d6f605455087c4d7ad16bfb92ffee941f.patch";
+      sha256 = "sha256-C1pX4oe9ZCgvqYTBJeSjMdr0KFyjv2PNVMJDlwCAngY=";
+    })
+  ];
+
+  OPENSSL_NO_VENDOR = 1;

  nativeBuildInputs = [ pkg-config ];

-  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ libiconv Security ];
+  buildInputs = [ openssl libgit2 ]
+    ++ lib.optionals stdenv.isDarwin [ IOKit CoreFoundation ];

  postInstall = ''
    install -Dm644 -t $out/share/man/man1/ docs/git-trim.1
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@ -26,13 +26,13 @@

 mkDerivation rec {
  pname = "haruna";
-  version = "0.10.2";
+  version = "0.10.3";

  src = fetchFromGitLab {
    owner = "multimedia";
    repo = "haruna";
    rev = "v${version}";
-    hash = "sha256-hhHWxmr2EzW9QqfV1bpJCiWOWsmGJmvxvtQcuXlMTc4=";
+    hash = "sha256-kXafPUcWWvadGbcN4PAtXlFmfll/mSpwu2Sbh6Gxx4w=";
    domain = "invent.kde.org";
  };

--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, python3, zlib, pkg-config, glib, buildPackages
+{ lib, stdenv, fetchurl, fetchpatch, python3Packages, zlib, pkg-config, glib, buildPackages
 , perl, pixman, vde2, alsa-lib, texinfo, flex
 , bison, lzo, snappy, libaio, libtasn1, gnutls, nettle, curl, ninja, meson, sigtool
 , makeWrapper, runtimeShell, removeReferencesTo
@ -51,7 +51,13 @@ stdenv.mkDerivation rec {

  depsBuildBuild = [ buildPackages.stdenv.cc ];

-  nativeBuildInputs = [ makeWrapper removeReferencesTo pkg-config flex bison meson ninja perl python3 python3.pkgs.sphinx python3.pkgs.sphinx-rtd-theme ]
+  nativeBuildInputs = [
+    makeWrapper removeReferencesTo
+    pkg-config flex bison meson ninja perl
+
+    # Don't change this to python3 and python3.pkgs.*, breaks cross-compilation
+    python3Packages.python python3Packages.sphinx python3Packages.sphinx-rtd-theme
+  ]
    ++ lib.optionals gtkSupport [ wrapGAppsHook ]
    ++ lib.optionals stdenv.isDarwin [ sigtool ];

@ -143,7 +149,6 @@ stdenv.mkDerivation rec {
    # have our patches and will be subtly broken because of that.
    "--meson=meson"
    "--cross-prefix=${stdenv.cc.targetPrefix}"
-    "--cpu=${stdenv.hostPlatform.uname.processor}"
    (lib.enableFeature guestAgentSupport "guest-agent")
  ] ++ lib.optional numaSupport "--enable-numa"
    ++ lib.optional seccompSupport "--enable-seccomp"
--- a/pkgs/build-support/build-graalvm-native-image/default.nix
+++ b/pkgs/build-support/build-graalvm-native-image/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, graalvm, glibcLocales }:
+{ lib, stdenv, graalvm-ce, glibcLocales }:

 { name ? "${args.pname}-${args.version}"
  # Final executable name
@ -19,7 +19,7 @@
  # XMX size of GraalVM during build
 , graalvmXmx ? "-J-Xmx6g"
  # The GraalVM derivation to use
-, graalvmDrv ? graalvm
+, graalvmDrv ? graalvm-ce
  # Locale to be used by GraalVM compiler
 , LC_ALL ? "en_US.UTF-8"
 , meta ? { }
@ -51,12 +51,14 @@ stdenv.mkDerivation (args // {

  disallowedReferences = [ graalvmDrv ];

+  passthru = { inherit graalvmDrv; };
+
  meta = {
    # default to graalvm's platforms
    platforms = graalvmDrv.meta.platforms;
    # default to executable name
    mainProgram = executable;
    # need to have native-image-installable-svm available
-    broken = !(builtins.elem "native-image-installable-svm" graalvmDrv.products);
+    broken = !(builtins.any (p: (p.product or "") == "native-image-installable-svm") graalvmDrv.products);
  } // meta;
 })
--- a/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
@ -0,0 +1,148 @@
+{ lib
+, stdenv
+, alsa-lib
+, autoPatchelfHook
+, cairo
+, cups
+, fontconfig
+, Foundation
+, glib
+, gtk3
+, gtkSupport ? stdenv.isLinux
+, makeWrapper
+, setJavaClassPath
+, unzip
+, xorg
+, zlib
+}:
+{ javaVersion
+, meta ? { }
+, products ? [ ]
+, ... } @ args:
+
+let
+  runtimeLibraryPath = lib.makeLibraryPath
+    ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
+  mapProducts = key: default: (map (p: p.${key} or default) products);
+  concatProducts = key: lib.concatStringsSep "\n" (mapProducts key "");
+
+  graalvmXXX-ce = stdenv.mkDerivation (args // {
+    pname = "graalvm${javaVersion}-ce";
+
+    unpackPhase = ''
+      runHook preUnpack
+
+      mkdir -p "$out"
+
+      # The tarball on Linux has the following directory structure:
+      #
+      #   graalvm-ce-java11-20.3.0/*
+      #
+      # while on Darwin it looks like this:
+      #
+      #   graalvm-ce-java11-20.3.0/Contents/Home/*
+      #
+      # We therefor use --strip-components=1 vs 3 depending on the platform.
+      tar xf "$src" -C "$out" --strip-components=${
+        if stdenv.isLinux then "1" else "3"
+      }
+
+      # Sanity check
+      if [ ! -d "$out/bin" ]; then
+          echo "The `bin` is directory missing after extracting the graalvm"
+          echo "tarball, please compare the directory structure of the"
+          echo "tarball with what happens in the unpackPhase (in particular"
+          echo "with regards to the `--strip-components` flag)."
+          exit 1
+      fi
+
+      runHook postUnpack
+    '';
+
+    postUnpack = ''
+      for product in ${toString products}; do
+        cp -Rv $product/* $out
+      done
+    '';
+
+    dontStrip = true;
+
+    nativeBuildInputs = [ unzip makeWrapper ]
+      ++ lib.optional stdenv.isLinux autoPatchelfHook;
+
+    propagatedBuildInputs = [ setJavaClassPath zlib ]
+      ++ lib.optional stdenv.isDarwin Foundation;
+
+    buildInputs = lib.optionals stdenv.isLinux [
+      alsa-lib # libasound.so wanted by lib/libjsound.so
+      fontconfig
+      stdenv.cc.cc.lib # libstdc++.so.6
+      xorg.libX11
+      xorg.libXext
+      xorg.libXi
+      xorg.libXrender
+      xorg.libXtst
+    ];
+
+    preInstall = concatProducts "preInstall";
+    postInstall = ''
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -sf $out/include/linux/*_md.h $out/include/
+
+      # copy-paste openjdk's preFixup
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat > $out/nix-support/setup-hook << EOF
+        if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+      EOF
+    '' + concatProducts "postInstall";
+
+    preFixup = lib.optionalString (stdenv.isLinux) ''
+      # Find all executables in any directory that contains '/bin/'
+      for bin in $(find "$out" -executable -type f -wholename '*/bin/*'); do
+        wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+      done
+    '' + concatProducts "preFixup";
+    postFixup = concatProducts "postFixup";
+
+    doInstallCheck = true;
+    installCheckPhase = ''
+      runHook preInstallCheck
+
+      echo ${
+        lib.escapeShellArg ''
+          public class HelloWorld {
+            public static void main(String[] args) {
+              System.out.println("Hello World");
+            }
+          }
+        ''
+      } > HelloWorld.java
+      $out/bin/javac HelloWorld.java
+
+      # run on JVM with Graal Compiler
+      echo "Testing GraalVM"
+      $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
+
+      ${concatProducts "installCheckPhase"}
+
+      runHook postInstallCheck
+    '';
+
+    passthru = {
+      inherit products;
+      home = graalvmXXX-ce;
+      updateScript = ./update.sh;
+    };
+
+    meta = with lib; ({
+      inherit platforms;
+      homepage = "https://www.graalvm.org/";
+      description = "High-Performance Polyglot VM";
+      license = with licenses; [ upl gpl2Classpath bsd3 ];
+      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+      mainProgram = "java";
+      maintainers = with maintainers; teams.graalvm-ce.members ++ [ ];
+    } // meta);
+  });
+in graalvmXXX-ce
--- a/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
@ -0,0 +1,73 @@
+{ lib
+, stdenv
+, autoPatchelfHook
+, makeWrapper
+, perl
+, unzip
+, zlib
+}:
+{ product
+, javaVersion
+, extraNativeBuildInputs ? [ ]
+, extraBuildInputs ? [ ]
+, meta ? { }
+, passthru ? { }
+, ... } @ args:
+
+stdenv.mkDerivation (args // {
+  pname = "${product}-java${javaVersion}";
+
+  nativeBuildInputs = [ perl unzip makeWrapper ]
+    ++ lib.optional stdenv.isLinux autoPatchelfHook
+    ++ extraNativeBuildInputs;
+
+  buildInputs = [
+    stdenv.cc.cc.lib # libstdc++.so.6
+    zlib
+  ] ++ extraBuildInputs;
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    unpack_jar() {
+      local jar="$1"
+      unzip -q -o "$jar" -d "$out"
+      perl -ne 'use File::Path qw(make_path);
+                use File::Basename qw(dirname);
+                if (/^(.+) = (.+)$/) {
+                  make_path dirname("$ENV{out}/$1");
+                  symlink $2, "$ENV{out}/$1";
+                }' "$out/META-INF/symlinks"
+      perl -ne 'if (/^(.+) = ([r-])([w-])([x-])([r-])([w-])([x-])([r-])([w-])([x-])$/) {
+                  my $mode = ($2 eq 'r' ? 0400 : 0) + ($3 eq 'w' ? 0200 : 0) + ($4  eq 'x' ? 0100 : 0) +
+                              ($5 eq 'r' ? 0040 : 0) + ($6 eq 'w' ? 0020 : 0) + ($7  eq 'x' ? 0010 : 0) +
+                              ($8 eq 'r' ? 0004 : 0) + ($9 eq 'w' ? 0002 : 0) + ($10 eq 'x' ? 0001 : 0);
+                  chmod $mode, "$ENV{out}/$1";
+                }' "$out/META-INF/permissions"
+      rm -rf "$out/META-INF"
+    }
+
+    unpack_jar "$src"
+
+    runHook postUnpack
+  '';
+
+  dontInstall = true;
+  dontBuild = true;
+  dontStrip = true;
+  # installCheckPhase is going to run in GraalVM main derivation (see buildGraalvm.nix)
+  # to make sure that it has everything it needs to run correctly.
+  # Other hooks like fixupPhase/installPhase are also going to run there for the
+  # same reason.
+  doInstallCheck = false;
+
+  passthru = { inherit product; } // passthru;
+
+  meta = with lib; ({
+    homepage = "https://www.graalvm.org/";
+    description = "High-Performance Polyglot VM (Product: ${product})";
+    license = with licenses; [ upl gpl2Classpath bsd3 ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; teams.graalvm-ce.members ++ [ ];
+  } // meta);
+})
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@ -1,75 +1,52 @@
-{ callPackage, Foundation }:
-/*
-  Add new graal versions and products here and then see update.nix on how to
-  generate the sources.
-*/
+{ lib
+, stdenv
+, callPackage
+, fetchurl
+, Foundation
+}:

 let
-  mkGraal = opts: callPackage (import ./mkGraal.nix opts) {
-    inherit Foundation;
+  buildGraalvm = callPackage ./buildGraalvm.nix { inherit Foundation; };
+  buildGraalvmProduct = callPackage ./buildGraalvmProduct.nix { };
+  javaPlatform = {
+    "aarch64-linux" = "linux-aarch64";
+    "x86_64-linux" = "linux-amd64";
+    "aarch64-darwin" = "darwin-aarch64";
+    "x86_64-darwin" = "darwin-amd64";
  };
-
-  /*
-    Looks a bit ugly but makes version update in the update script using sed
-    much easier
-
-    Don't change these values! They will be updated by the update script, see ./update.nix.
-  */
-  graalvm11-ce-release-version = "22.3.0";
-  graalvm17-ce-release-version = "22.3.0";
-
-  products = [
-    "graalvm-ce"
-    "native-image-installable-svm"
-  ];
+  javaPlatformVersion = javaVersion:
+    "${javaVersion}-${javaPlatform.${stdenv.system} or (throw "Unsupported platform: ${stdenv.system}")}";
+  source = product: javaVersion: (import ./hashes.nix).${product}.${javaPlatformVersion javaVersion};

 in
-{
-  inherit mkGraal;
+rec {
+  inherit buildGraalvm buildGraalvmProduct;

-  graalvm11-ce = mkGraal rec {
-    config = {
-      x86_64-darwin = {
-        inherit products;
-        arch = "darwin-amd64";
-      };
-      x86_64-linux = {
-        inherit products;
-        arch = "linux-amd64";
-      };
-      aarch64-darwin = {
-        inherit products;
-        arch = "darwin-aarch64";
-      };
-      aarch64-linux = {
-        inherit products;
-        arch = "linux-aarch64";
-      };
-    };
-    defaultVersion = graalvm11-ce-release-version;
+  graalvm11-ce = buildGraalvm rec {
+    version = "22.3.1";
    javaVersion = "11";
+    src = fetchurl (source "graalvm-ce" javaVersion);
+    meta.platforms = builtins.attrNames javaPlatform;
+    products = [ native-image-installable-svm-java11 ];
  };

-  graalvm17-ce = mkGraal rec {
-    config = {
-      x86_64-darwin = {
-        inherit products;
-        arch = "darwin-amd64";
-      };
-      x86_64-linux = {
-        inherit products;
-        arch = "linux-amd64";
-      };
-      aarch64-darwin = {
-        inherit products;
-        arch = "darwin-aarch64";
-      };
-      aarch64-linux = {
-        inherit products;
-        arch = "linux-aarch64";
-      };
-    };
-    defaultVersion = graalvm17-ce-release-version;
+  native-image-installable-svm-java11 = callPackage ./native-image-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "native-image-installable-svm" javaVersion);
+  };
+
+  graalvm17-ce = buildGraalvm rec {
+    version = "22.3.1";
    javaVersion = "17";
+    src = fetchurl (source "graalvm-ce" javaVersion);
+    meta.platforms = builtins.attrNames javaPlatform;
+    products = [ native-image-installable-svm-java17 ];
+  };
+
+  native-image-installable-svm-java17 = callPackage ./native-image-installable-svm.nix rec {
+    javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "native-image-installable-svm" javaVersion);
  };
 }
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
@ -1,42 +0,0 @@
-{
-  "darwin-aarch64": {
-    "graalvm-ce|java11|22.3.0": {
-      "sha256": "c9657e902c2ba674931c3cf233a38c4de3d5186ae5d70452f9df75ac0c4cacff",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java11-darwin-aarch64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java11|22.3.0": {
-      "sha256": "dd9f91a970c7270b3f7fe8e711ba1ae081d34ed433c75f2bb0459aaf19e0fbe7",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java11-darwin-aarch64-22.3.0.jar"
-    }
-  },
-  "darwin-amd64": {
-    "graalvm-ce|java11|22.3.0": {
-      "sha256": "b8b39d6a3e3a9ed6348c2776ff071fc64ca90f98999ee846e6ca7e5fdc746a8b",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java11-darwin-amd64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java11|22.3.0": {
-      "sha256": "00fe13c42813f581955eb35370bb8409ba17c7fdc83971d000baf695be2a0cb5",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java11-darwin-amd64-22.3.0.jar"
-    }
-  },
-  "linux-aarch64": {
-    "graalvm-ce|java11|22.3.0": {
-      "sha256": "c6646149dad486a0b02c5fc10649786240f275efda65aa14a25d01d2f5bafe15",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java11-linux-aarch64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java11|22.3.0": {
-      "sha256": "0886e214f03f8a44962ecab459a94afb5c6a0f20910cb128d9ff775f4a9e4162",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java11-linux-aarch64-22.3.0.jar"
-    }
-  },
-  "linux-amd64": {
-    "graalvm-ce|java11|22.3.0": {
-      "sha256": "d4200bcc43e5ad4e6949c1b1edc1e59f63066e3a2280d5bd82d0c9b1d67c3f2c",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java11-linux-amd64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java11|22.3.0": {
-      "sha256": "17843f92dc9de74b161a63c52cc2a4597e5472cf3f6f6d71930fb655b35f9208",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java11-linux-amd64-22.3.0.jar"
-    }
-  }
-}
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
@ -1,42 +0,0 @@
-{
-  "darwin-aarch64": {
-    "graalvm-ce|java17|22.3.0": {
-      "sha256": "dfc0c8998b8d00fcca87ef1c866c6e4985fd20b0beba3021f9677f9b166dfaf8",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java17-darwin-aarch64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.3.0": {
-      "sha256": "b6e44cb03f560bb43db1fd0aa862af36ba1df6717765920d91c18519712adfe9",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java17-darwin-aarch64-22.3.0.jar"
-    }
-  },
-  "darwin-amd64": {
-    "graalvm-ce|java17|22.3.0": {
-      "sha256": "422cd6abecfb8b40238460c09c42c5a018cb92fab4165de9691be2e3c3d0e8d1",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java17-darwin-amd64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.3.0": {
-      "sha256": "9ce13874e62877d3bbe3faa4a57fbbffc766fdc8191971e7b25de0226fe86598",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java17-darwin-amd64-22.3.0.jar"
-    }
-  },
-  "linux-aarch64": {
-    "graalvm-ce|java17|22.3.0": {
-      "sha256": "e27249d9eef4504deb005cf14c6a028aad1adfa37209e12e9d7407710c08ed90",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java17-linux-aarch64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.3.0": {
-      "sha256": "d5b833c44d37fbe4df75906f73144e2db01e683bca3386fe185f4abbc8fbc798",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java17-linux-aarch64-22.3.0.jar"
-    }
-  },
-  "linux-amd64": {
-    "graalvm-ce|java17|22.3.0": {
-      "sha256": "3473d8b3b1bc682e95adfb3ac1d9a59b51b0f43e2b752f2a5b550e4ebfa2fd17",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/graalvm-ce-java17-linux-amd64-22.3.0.tar.gz"
-    },
-    "native-image-installable-svm|java17|22.3.0": {
-      "sha256": "d1f5c58b65c57ad8a0c7da0c4569ce815ebf1ae503b0741ba1facf27b816d398",
-      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.0/native-image-installable-svm-java17-linux-amd64-22.3.0.jar"
-    }
-  }
-}
--- a/pkgs/development/compilers/graalvm/community-edition/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
@ -0,0 +1,71 @@
+# Generated by pkgs/development/compilers/graalvm/community-edition/update.sh script
+{
+  "native-image-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "0z9rbmci6yz7f7mqd3xzsxc5ih4hq72lyzqfchan7fr6mh38d6gw";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "03v20fc9famlnbrznpasnd5gdl5k9nl4dlj3pp6bad4y6l7rqnx5";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "1yb7kpbs7hrzlysvrqjzgfz678p1hbg6237jzb35zmwdaczav51n";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "00fbyqsj4xj9ay8bki1190lf59bgrzvla8lzzq51p53a1bdrhhmv";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "1kaqvkbhj3iifq6asyrpy225a89y7klzbh7an1ycnvc2hvqkv4nz";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java11-darwin-aarch64-22.3.1.jar";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "09l7x4x8yanq55v6y6wpfx94mvsq1bpbnihknjc6dnq3vcrci77n";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java17-darwin-aarch64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "036w9dmdcs46kmjqr3086mg389fgr3h1zysavfq8cbh199x0ibia";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "1hvjfvcn878bzvi944v3x23sby72hbfvg5s3zzspyc37l5cdpqi3";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/native-image-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
+  "graalvm-ce" = {
+    "11-linux-aarch64" = {
+      sha256 = "1g4a3z9993pq52j3jf25pbcq9rvl8jz1yar8c859jw5chaf3ysml";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java11-linux-aarch64-22.3.1.tar.gz";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "06288dwbql943nii74i9mngzb38h2nzrxzzgs346mgk2965gwm59";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-linux-aarch64-22.3.1.tar.gz";
+    };
+    "11-linux-amd64" = {
+      sha256 = "1f6xkdnxn6xsm24sqw24rsca72wm7v6q96m23l5fng5ym0jpfm2m";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java11-linux-amd64-22.3.1.tar.gz";
+    };
+    "17-linux-amd64" = {
+      sha256 = "0aci9i28rq5nk2qya9dcg5hxr3sgsbv7f5x8679hrjrqmrclmkrs";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-linux-amd64-22.3.1.tar.gz";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "0cbcm9d211m4b6g1bkpfksma917lzqkl4kx38vm1nrwjkll357y5";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java11-darwin-aarch64-22.3.1.tar.gz";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "1qbw3hlmqcrmd70xk56463scdxr50n66z2n3c24h68qlwwlpqc73";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-darwin-aarch64-22.3.1.tar.gz";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "0a12rzf99x5l29f6bwm6myk18dgnrx2c9rwmii2pm864y7azlnij";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java11-darwin-amd64-22.3.1.tar.gz";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "02lclv2j3v850izh84wdvksi3d3xmgpfl7x85vzifhgsvagm6sz4";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-darwin-amd64-22.3.1.tar.gz";
+    };
+  };
+}
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@ -1,346 +0,0 @@
-{
-  # An attrset describing each platform configuration. All values are extract
-  # from the GraalVM releases available on
-  # https://github.com/graalvm/graalvm-ce-builds/releases
-  # Example:
-  # config = {
-  #   x86_64-linux = {
-  #     # List of products that will be included in the GraalVM derivation
-  #     # See `with{NativeImage,Ruby,Python,WASM,*}Svm` variables for the
-  #     # available values
-  #     products = [ "graalvm-ce" "native-image-installable-svm" ];
-  #     # GraalVM arch, not to be confused with the nix platform
-  #     arch = "linux-amd64";
-  #     # GraalVM version
-  #     version = "22.0.0.2";
-  #   };
-  # }
-  config
-  # GraalVM version that will be used unless overridden by `config.<platform>.version`
-, defaultVersion
-  # Java version used by GraalVM
-, javaVersion
-  # Platforms were GraalVM will be allowed to build (i.e. `meta.platforms`)
-, platforms ? builtins.attrNames config
-  # If set to true, update script will (re-)generate the sources file even if
-  # there are no updates available
-, forceUpdate ? false
-  # Path for the sources file that will be used
-  # See `update.nix` file for a description on how this file works
-, sourcesPath ? ./. + "/graalvm${javaVersion}-ce-sources.json"
-}:
-
-{ stdenv
-, lib
-, autoPatchelfHook
-, fetchurl
-, makeWrapper
-, setJavaClassPath
-, writeShellScriptBin
-  # minimum dependencies
-, alsa-lib
-, fontconfig
-, Foundation
-, freetype
-, glibc
-, openssl
-, perl
-, unzip
-, xorg
-, zlib
-  # runtime dependencies
-, binutils
-, cups
-, gcc
-, musl
-  # runtime dependencies for GTK+ Look and Feel
-, gtkSupport ? stdenv.isLinux
-, cairo
-, glib
-  # updateScript deps
-, gnused
-, gtk3
-, jq
-, writeShellScript
-  # Use musl instead of glibc to allow true static builds in GraalVM's
-  # Native Image (i.e.: `--static --libc=musl`). This will cause glibc static
-  # builds to fail, so it should be used with care
-, useMusl ? false
-  # Extra libraries to be included in native-image using '-H:CLibraryPath' flag
-, extraCLibs ? [ ]
-}:
-
-assert useMusl -> stdenv.isLinux;
-
-let
-  platform = config.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  version = platform.version or defaultVersion;
-  name = "graalvm${javaVersion}-ce";
-  sources = builtins.fromJSON (builtins.readFile sourcesPath);
-
-  cLibs = [ glibc zlib.static ]
-    ++ lib.optionals (!useMusl) [ glibc.static ]
-    ++ lib.optionals useMusl [ musl ]
-    ++ extraCLibs;
-
-  runtimeLibraryPath = lib.makeLibraryPath
-    ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
-
-  runtimeDependencies = lib.makeBinPath ([
-    binutils
-    stdenv.cc
-  ] ++ lib.optionals useMusl [
-    (lib.getDev musl)
-    # GraalVM 21.3.0+ expects musl-gcc as <system>-musl-gcc
-    (writeShellScriptBin "${stdenv.hostPlatform.system}-musl-gcc" ''${lib.getDev musl}/bin/musl-gcc "$@"'')
-  ]);
-
-  withNativeImageSvm = builtins.elem "native-image-installable-svm" platform.products;
-  withRubySvm = builtins.elem "ruby-installable-svm" platform.products;
-  withPythonSvm = builtins.elem "python-installable-svm" platform.products;
-  withWasmSvm = builtins.elem "wasm-installable-svm" platform.products;
-
-  graalvmXXX-ce = stdenv.mkDerivation rec {
-    inherit version;
-    pname = name;
-
-    srcs = map fetchurl (builtins.attrValues sources.${platform.arch});
-
-    buildInputs = lib.optionals stdenv.isLinux [
-      alsa-lib # libasound.so wanted by lib/libjsound.so
-      fontconfig
-      freetype
-      stdenv.cc.cc.lib # libstdc++.so.6
-      xorg.libX11
-      xorg.libXext
-      xorg.libXi
-      xorg.libXrender
-      xorg.libXtst
-      zlib
-    ] ++ lib.optionals withRubySvm [
-      openssl # libssl.so wanted by languages/ruby/lib/mri/openssl.so
-    ];
-
-    nativeBuildInputs = [ unzip perl makeWrapper ]
-      ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
-
-    unpackPhase = ''
-      runHook preUnpack
-
-      unpack_jar() {
-        jar=$1
-        unzip -q -o $jar -d $out
-        perl -ne 'use File::Path qw(make_path);
-                  use File::Basename qw(dirname);
-                  if (/^(.+) = (.+)$/) {
-                    make_path dirname("$ENV{out}/$1");
-                    system "ln -s $2 $ENV{out}/$1";
-                  }' $out/META-INF/symlinks
-        perl -ne 'if (/^(.+) = ([r-])([w-])([x-])([r-])([w-])([x-])([r-])([w-])([x-])$/) {
-                    my $mode = ($2 eq 'r' ? 0400 : 0) + ($3 eq 'w' ? 0200 : 0) + ($4  eq 'x' ? 0100 : 0) +
-                               ($5 eq 'r' ? 0040 : 0) + ($6 eq 'w' ? 0020 : 0) + ($7  eq 'x' ? 0010 : 0) +
-                               ($8 eq 'r' ? 0004 : 0) + ($9 eq 'w' ? 0002 : 0) + ($10 eq 'x' ? 0001 : 0);
-                    chmod $mode, "$ENV{out}/$1";
-                  }' $out/META-INF/permissions
-        rm -rf $out/META-INF
-      }
-
-      mkdir -p $out
-      arr=($srcs)
-
-      # The tarball on Linux has the following directory structure:
-      #
-      #   graalvm-ce-java11-20.3.0/*
-      #
-      # while on Darwin it looks like this:
-      #
-      #   graalvm-ce-java11-20.3.0/Contents/Home/*
-      #
-      # We therefor use --strip-components=1 vs 3 depending on the platform.
-      tar xf ''${arr[0]} -C $out --strip-components=${
-        if stdenv.isLinux then "1" else "3"
-      }
-
-      # Sanity check
-      if [ ! -d $out/bin ]; then
-         echo "The `bin` is directory missing after extracting the graalvm"
-         echo "tarball, please compare the directory structure of the"
-         echo "tarball with what happens in the unpackPhase (in particular"
-         echo "with regards to the `--strip-components` flag)."
-         exit 1
-      fi
-
-      for jar in "''${arr[@]:1}"; do
-        unpack_jar "$jar"
-      done
-
-      runHook postUnpack
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      # jni.h expects jni_md.h to be in the header search path.
-      ln -s $out/include/linux/*_md.h $out/include/
-
-      # copy-paste openjdk's preFixup
-      # Set JAVA_HOME automatically.
-      mkdir -p $out/nix-support
-      cat > $out/nix-support/setup-hook << EOF
-        if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
-      ${
-        # Wrap native-image binary to pass -H:CLibraryPath flag and find glibc
-        lib.optionalString (withNativeImageSvm && stdenv.isLinux) ''
-          wrapProgram $out/bin/native-image \
-            ${lib.concatStringsSep " "
-              (map (l: "--add-flags '-H:CLibraryPath=${l}/lib'") cLibs)}
-        ''
-      }
-
-      runHook postInstall
-    '';
-
-    dontStrip = true;
-
-    # Workaround for libssl.so.10 wanted by TruffleRuby
-    # Resulting TruffleRuby cannot use `openssl` library.
-    autoPatchelfIgnoreMissingDeps = withRubySvm && stdenv.isDarwin;
-
-    preFixup = lib.optionalString (stdenv.isLinux) ''
-      # Find all executables in any directory that contains '/bin/'
-      for bin in $(find "$out" -executable -type f -wholename '*/bin/*'); do
-        wrapProgram "$bin" \
-          --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}" \
-          --prefix PATH : "${runtimeDependencies}"
-      done
-
-      find "$out" -name libfontmanager.so -exec \
-        patchelf --add-needed libfontconfig.so {} \;
-
-      ${
-        lib.optionalString withRubySvm ''
-          # Workaround for libssl.so.10/libcrypto.so.10 wanted by TruffleRuby
-          patchelf $out/languages/ruby/lib/mri/openssl.so \
-            --replace-needed libssl.so.10 libssl.so \
-            --replace-needed libcrypto.so.10 libcrypto.so
-        ''
-      }
-    '';
-
-    # $out/bin/native-image needs zlib to build native executables.
-    propagatedBuildInputs = [ setJavaClassPath zlib ] ++
-      # On Darwin native-image calls clang and it
-      # tries to include <Foundation/Foundation.h>,
-      # and Interactive Ruby (irb) requires OpenSSL
-      # headers.
-      lib.optionals stdenv.hostPlatform.isDarwin [ Foundation openssl ];
-
-    doInstallCheck = true;
-    installCheckPhase = ''
-      runHook preInstallCheck
-
-      echo ${
-        lib.escapeShellArg ''
-          public class HelloWorld {
-            public static void main(String[] args) {
-              System.out.println("Hello World");
-            }
-          }
-        ''
-      } > HelloWorld.java
-      $out/bin/javac HelloWorld.java
-
-      # run on JVM with Graal Compiler
-      echo "Testing GraalVM"
-      $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
-
-      ${
-        lib.optionalString withNativeImageSvm ''
-          echo "Ahead-Of-Time compilation"
-          $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces HelloWorld
-          ./helloworld | fgrep 'Hello World'
-        ''
-      }
-
-      ${# --static flag doesn't work for darwin
-        lib.optionalString (withNativeImageSvm && stdenv.isLinux && !useMusl) ''
-          echo "Ahead-Of-Time compilation with -H:+StaticExecutableWithDynamicLibC"
-          $out/bin/native-image -H:+StaticExecutableWithDynamicLibC HelloWorld
-          ./helloworld | fgrep 'Hello World'
-
-          echo "Ahead-Of-Time compilation with --static"
-          $out/bin/native-image --static HelloWorld
-          ./helloworld | fgrep 'Hello World'
-        ''
-      }
-
-      ${# --static flag doesn't work for darwin
-        lib.optionalString (withNativeImageSvm && stdenv.isLinux && useMusl) ''
-          echo "Ahead-Of-Time compilation with --static and --libc=musl"
-          $out/bin/native-image --libc=musl --static HelloWorld
-          ./helloworld | fgrep 'Hello World'
-        ''
-      }
-
-      ${
-        lib.optionalString withWasmSvm ''
-          echo "Testing Jshell"
-          echo '1 + 1' | $out/bin/jshell
-        ''
-      }
-
-      ${
-        lib.optionalString withPythonSvm ''
-          echo "Testing GraalPython"
-          $out/bin/graalpython -c 'print(1 + 1)'
-          echo '1 + 1' | $out/bin/graalpython
-        ''
-      }
-
-      ${
-        lib.optionalString withRubySvm ''
-          echo "Testing TruffleRuby"
-          # Hide warnings about wrong locale
-          export LANG=C
-          export LC_ALL=C
-          $out/bin/ruby -e 'puts(1 + 1)'
-        ''
-        # FIXME: irb is broken in all platforms
-        + lib.optionalString false ''
-          echo '1 + 1' | $out/bin/irb
-        ''
-      }
-
-      runHook postInstallCheck
-    '';
-
-    passthru = {
-      inherit (platform) products;
-      home = graalvmXXX-ce;
-      updateScript = import ./update.nix {
-        inherit config defaultVersion forceUpdate gnused jq lib name sourcesPath writeShellScript;
-        graalVersion = version;
-        javaVersion = "java${javaVersion}";
-      };
-    };
-
-    meta = with lib; {
-      inherit platforms;
-      homepage = "https://www.graalvm.org/";
-      description = "High-Performance Polyglot VM";
-      license = with licenses; [ upl gpl2Classpath bsd3 ];
-      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-      mainProgram = "java";
-      maintainers = with maintainers; [
-        bandresen
-        hlolli
-        glittershark
-        babariviere
-        ericdallo
-        thiagokokada
-      ];
-    };
-  };
-in
-graalvmXXX-ce
--- a/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix
@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, graalvmCEPackages
+, gcc
+, glibc
+, javaVersion
+, musl
+, src
+, version
+, writeShellScriptBin
+, zlib
+, useMusl ? false
+, extraCLibs ? [ ]
+}:
+
+assert useMusl -> stdenv.isLinux;
+let
+  cLibs = [ glibc zlib.static ]
+    ++ lib.optionals (!useMusl) [ glibc.static ]
+    ++ lib.optionals useMusl [ musl ]
+    ++ extraCLibs;
+  # GraalVM 21.3.0+ expects musl-gcc as <system>-musl-gcc
+  musl-gcc = (writeShellScriptBin "${stdenv.hostPlatform.system}-musl-gcc" ''${lib.getDev musl}/bin/musl-gcc "$@"'');
+  binPath = lib.makeBinPath ([ gcc ] ++ lib.optionals useMusl [ musl-gcc ]);
+in
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "native-image-installable-svm";
+
+  postInstall = lib.optionalString stdenv.isLinux ''
+    wrapProgram $out/bin/native-image \
+      --prefix PATH : ${binPath} \
+      ${lib.concatStringsSep " "
+        (map (l: "--add-flags '-H:CLibraryPath=${l}/lib'") cLibs)}
+  '';
+
+  installCheckPhase = ''
+    echo "Ahead-Of-Time compilation"
+    $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces HelloWorld
+    ./helloworld | fgrep 'Hello World'
+
+    ${lib.optionalString (stdenv.isLinux && !useMusl) ''
+      echo "Ahead-Of-Time compilation with -H:+StaticExecutableWithDynamicLibC"
+      $out/bin/native-image -H:+StaticExecutableWithDynamicLibC HelloWorld
+      ./helloworld | fgrep 'Hello World'
+
+      echo "Ahead-Of-Time compilation with --static"
+      $out/bin/native-image --static HelloWorld
+      ./helloworld | fgrep 'Hello World'
+    ''}
+
+    ${lib.optionalString (stdenv.isLinux && useMusl) ''
+      echo "Ahead-Of-Time compilation with --static and --libc=musl"
+      $out/bin/native-image --static HelloWorld --libc=musl
+      ./helloworld | fgrep 'Hello World'
+    ''}
+  '';
+}
--- a/pkgs/development/compilers/graalvm/community-edition/update.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/update.nix
@ -1,227 +0,0 @@
-{ config
-, defaultVersion
-, forceUpdate
-, gnused
-, graalVersion
-, javaVersion
-, jq
-, lib
-, name
-, sourcesPath
-, writeShellScript
-}:
-
-/*
-  How to  use:
-  run `nix-shell maintainers/scripts/update.nix --argstr package graalvmXX-ce`
-  to update the graalvmXX-ce-sources.json file.
-  E.g: nix-shell maintainers/scripts/update.nix --argstr package graalvm17-ce
-
-  Basic idea:
-  If we know the platform, product, javaVersion and graalVersion
-  we can create the url. This leads to the following json structure:
-  {
-  "platform/arch1": {
-  "product1|javaVersion|graalVersion": { "sha256": "...", "url": "..."},
-  "product2|javaVersion|graalVersion": { "sha256": "...", "url": "..."},
-  ...
-  },
-  "platform/arch2": {
-  ...
-  }
-  }
-*/
-
-let
-  separator = "|";
-
-  # isDev :: String -> Boolean
-  isDev = version:
-    lib.hasInfix "dev" version;
-
-  # getLatestVersion :: String -> String
-  getLatestVersion = currentVersion:
-    let
-      dev = if isDev currentVersion then "dev-" else "";
-      url = "https://api.github.com/repos/graalvm/graalvm-ce-${dev}builds/releases/latest";
-      file = builtins.fetchurl url;
-      json = builtins.fromJSON (builtins.readFile file);
-    in
-    lib.removePrefix "vm-" json.tag_name;
-
-  # getArchString :: String -> String
-  getArchString = nixArchString:
-    {
-      "aarch64-linux" = "linux-aarch64";
-      "aarch64-darwin" = "darwin-aarch64";
-      "x86_64-linux" = "linux-amd64";
-      "x86_64-darwin" = "darwin-amd64";
-    }.${nixArchString};
-
-
-  # getProductSuffix :: String -> String
-  getProductSuffix = productName:
-    {
-      "graalvm-ce" = ".tar.gz";
-      "native-image-installable-svm" = ".jar";
-      "ruby-installable-svm" = ".jar";
-      "wasm-installable-svm" = ".jar";
-      "python-installable-svm" = ".jar";
-      "js-installable-svm" = ".jar";
-    }.${productName};
-
-  # getProductSuffix :: String -> String
-  getProductBaseUrl = productName:
-    {
-      "graalvm-ce" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
-      "native-image-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
-      "ruby-installable-svm" = "https://github.com/oracle/truffleruby/releases/download";
-      "wasm-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
-      "python-installable-svm" = "https://github.com/graalvm/graalpython/releases/download";
-      "js-installable-svm" = "https://github.com/oracle/graaljs/releases/download";
-    }.${productName};
-
-  # getDevUrl :: String
-  getDevUrl = { arch, graalVersion, product, javaVersion }:
-    let
-      baseUrl = https://github.com/graalvm/graalvm-ce-dev-builds/releases/download;
-    in
-    "${baseUrl}/${graalVersion}/${product}-${javaVersion}-${arch}-dev${getProductSuffix product}";
-
-  # getReleaseUrl :: AttrSet -> String
-  getReleaseUrl = { arch, graalVersion, product, javaVersion }:
-    let baseUrl = getProductBaseUrl product;
-    in
-    "${baseUrl}/vm-${graalVersion}/${product}-${javaVersion}-${arch}-${graalVersion}${getProductSuffix product}";
-
-  # getUrl :: AttrSet -> String
-  getUrl = args@{ arch, graalVersion, product, javaVersion }:
-    if isDev graalVersion
-    then getDevUrl args
-    else getReleaseUrl args;
-
-  # computeSha256 :: String -> String
-  computeSha256 = url:
-    builtins.hashFile "sha256" (builtins.fetchurl url);
-
-  # downloadSha256 :: String -> String
-  downloadSha256 = url:
-    let sha256Url = url + ".sha256";
-    in
-    builtins.readFile (builtins.fetchurl sha256Url);
-
-  # getSha256 :: String -> String -> String
-  getSha256 = graalVersion: url:
-    if isDev graalVersion
-    then computeSha256 url
-    else downloadSha256 url;
-
-  # cartesianZipListsWith :: (a -> b -> c) -> [a] -> [b] -> [c]
-  cartesianZipListsWith = f: fst: snd:
-    let
-      cartesianProduct = lib.cartesianProductOfSets { a = fst; b = snd; };
-      fst' = builtins.catAttrs "a" cartesianProduct;
-      snd' = builtins.catAttrs "b" cartesianProduct;
-    in
-    lib.zipListsWith f fst' snd';
-
-  # zipListsToAttrs :: [a] -> [b] -> AttrSet
-  zipListsToAttrs = names: values:
-    lib.listToAttrs (
-      lib.zipListsWith (name: value: { inherit name value; }) names values
-    );
-
-  # genProductJavaVersionGraalVersionAttrSet :: String -> AttrSet
-  genProductJavaVersionGraalVersionAttrSet = product_javaVersion_graalVersion:
-    let
-      attrNames = [ "product" "javaVersion" "graalVersion" ];
-      attrValues = lib.splitString separator product_javaVersion_graalVersion;
-    in
-    zipListsToAttrs attrNames attrValues;
-
-  # genUrlAndSha256 :: String -> String -> AttrSet
-  genUrlAndSha256 = arch: product_javaVersion_graalVersion:
-    let
-      productJavaVersionGraalVersion =
-        (genProductJavaVersionGraalVersionAttrSet product_javaVersion_graalVersion)
-        // { inherit arch; };
-      url = getUrl productJavaVersionGraalVersion;
-      sha256 = getSha256 productJavaVersionGraalVersion.graalVersion url;
-    in
-    {
-      ${arch} = {
-        ${product_javaVersion_graalVersion} = {
-          inherit sha256 url;
-        };
-      };
-    };
-
-  # genArchProductVersionPairs :: String -> -> String -> AttrSet -> [AttrSet]
-  genArchProductVersionList = javaVersion: graalVersion: archProducts:
-    let
-      arch = archProducts.arch;
-      products = archProducts.products;
-      javaGraalVersion = javaVersion + separator + (getLatestVersion (archProducts.version or graalVersion));
-      productJavaGraalVersionList =
-        cartesianZipListsWith (a: b: a + separator + b)
-          products [ javaGraalVersion ];
-    in
-    cartesianZipListsWith (genUrlAndSha256) [ arch ] productJavaGraalVersionList;
-
-
-  # genSources :: String -> String -> AttrSet -> Path String
-  genSources = javaVersion: defaultVersion: config:
-    let
-      archProducts = builtins.attrValues config;
-      sourcesList = builtins.concatMap (genArchProductVersionList javaVersion defaultVersion) archProducts;
-      sourcesAttr = builtins.foldl' (lib.recursiveUpdate) { } sourcesList;
-    in
-    builtins.toFile "sources.json" (builtins.toJSON sourcesAttr);
-
-  # isNew :: String -> String -> Boolean
-  isNew = newVersion: currentVersion:
-    {
-      "-1" = false;
-      "0" = false;
-      "1" = true;
-    }.${builtins.toString (builtins.compareVersions newVersion currentVersion)};
-
-  newVersion = getLatestVersion graalVersion;
-  sourcesJson = genSources javaVersion defaultVersion config;
-  sourcesJsonPath = lib.strings.escapeShellArg sourcesPath;
-
-  # versionKeyInDefaultNix String -> String
-  versionKeyInDefaultNix = graalVersion:
-    if isDev graalVersion
-    then "${name}-dev-version"
-    else "${name}-release-version";
-
-  /*
-    updateScriptText :: String -> String -> String
-    Writes the json file and updates the version in default.nix using sed
-    because update-source-version does not work srcs.
-  */
-  updateScriptText = newVersion: currentVersion:
-
-    if (forceUpdate || (isNew newVersion currentVersion))
-    then
-      let
-        versionKey = versionKeyInDefaultNix currentVersion;
-      in
-      ''
-        echo "New version found. Updating ${currentVersion} -> ${newVersion}".
-        export PATH="${lib.makeBinPath [ jq gnused ]}:$PATH"
-        jq . ${sourcesJson} > ${sourcesJsonPath}
-        sed -i 's|${versionKey} = "${currentVersion}";|${versionKey} = "${newVersion}";|' \
-          ${lib.strings.escapeShellArg ./default.nix}
-      ''
-    else ''echo "No new version found. Skip updating."'';
-
-in
-writeShellScript "update-graal.sh" ''
-  set -o errexit
-  set -o nounset
-  set -o pipefail
-
-  ${updateScriptText newVersion graalVersion}
-''
--- a/pkgs/development/compilers/graalvm/community-edition/update.sh
+++ b/pkgs/development/compilers/graalvm/community-edition/update.sh
@ -0,0 +1,86 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p coreutils curl.out nix jq gnused -i bash
+
+set -eou pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+tmpfile="$(mktemp --suffix=.nix)"
+
+info() { echo "[INFO] $*"; }
+
+echo_file() { echo "$@" >> "$tmpfile"; }
+
+verlte() {
+    [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
+}
+
+readonly nixpkgs=../../../../..
+
+readonly current_version="$(nix-instantiate "$nixpkgs" --eval --strict -A graalvm-ce.version | tr -d \")"
+
+if [[ -z "${1:-}" ]]; then
+  readonly gh_version="$(curl \
+      ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+      -s https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest | \
+      jq --raw-output .tag_name)"
+  readonly new_version="${gh_version//vm-/}"
+else
+  readonly new_version="$1"
+fi
+
+info "Current version: $current_version"
+info "New version: $new_version"
+if verlte "$new_version" "$current_version"; then
+  info "graalvm-ce $current_version is up-to-date."
+  [[ -z "${FORCE:-}" ]]  && exit 0
+else
+  info "graalvm-ce $current_version is out-of-date. Updating..."
+fi
+
+declare -r -A products_urls=(
+  [graalvm-ce]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/graalvm-ce-java@platform@-${new_version}.tar.gz"
+  [native-image-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/native-image-installable-svm-java@platform@-${new_version}.jar"
+  # [ruby-installable-svm]="https://github.com/oracle/truffleruby/releases/download/vm-${new_version}/ruby-installable-svm-java@platform@-${new_version}.jar"
+  # [wasm-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/wasm-installable-svm-java@platform@-${new_version}.jar"
+  # [python-installable-svm]="https://github.com/graalvm/graalpython/releases/download/vm-${new_version}/python-installable-svm-java@platform@-${new_version}.jar"
+)
+
+readonly platforms=(
+  "11-linux-aarch64"
+  "17-linux-aarch64"
+  "11-linux-amd64"
+  "17-linux-amd64"
+  "11-darwin-aarch64"
+  "17-darwin-aarch64"
+  "11-darwin-amd64"
+  "17-darwin-amd64"
+)
+
+info "Generating hashes.nix file for 'graalvm-ce' $new_version. This will take a while..."
+
+# Indentation of `echo_file` function is on purpose to make it easier to visualize the output
+echo_file "# Generated by $0 script"
+echo_file "{"
+for product in "${!products_urls[@]}"; do
+  url="${products_urls["${product}"]}"
+echo_file "  \"$product\" = {"
+  for platform in "${platforms[@]}"; do
+    if hash="$(nix-prefetch-url "${url//@platform@/$platform}")"; then
+echo_file "    \"$platform\" = {"
+echo_file "      sha256 = \"$hash\";"
+echo_file "      url = \"${url//@platform@/${platform}}\";"
+echo_file "    };"
+    fi
+  done
+echo_file "  };"
+done
+echo_file "}"
+
+info "Updating graalvm-ce version..."
+# update-source-version does not work here since it expects src attribute
+sed "s|$current_version|$new_version|" -i default.nix
+
+info "Moving the temporary file to hashes.nix"
+mv "$tmpfile" hashes.nix
+
+info "Done!"
--- a/pkgs/development/libraries/rocm-device-libs/default.nix
+++ b/pkgs/development/libraries/rocm-device-libs/default.nix
@ -14,7 +14,7 @@ let
    else throw "Unsupported ROCm LLVM platform";
 in stdenv.mkDerivation (finalAttrs: {
  pname = "rocm-device-libs";
-  version = "5.4.2";
+  version = "5.4.3";

  src = fetchFromGitHub {
    owner = "RadeonOpenCompute";
--- a/pkgs/development/libraries/wxwidgets/wxGTK32.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK32.nix
@ -53,13 +53,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "wxwidgets";
-  version = "3.2.1";
+  version = "3.2.2.1";

  src = fetchFromGitHub {
    owner = "wxWidgets";
    repo = "wxWidgets";
    rev = "v${version}";
-    hash = "sha256-k6td/8pF7ad7+gVm7L0jX79fHKwR7/qrOBpSFggyaI0=";
+    hash = "sha256-u+INjo9EkW433OYoCDZpw5pcW1DyF/t/J5ntLZX+6aA=";
  };

  # Workaround for pkgsMusl.wxGTK32 failing as:
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "aioesphomeapi";
-  version = "13.2.0";
+  version = "13.3.1";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "esphome";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-ACO5vp5ZMxzfY4RBvZ+vbk+fsj43Q896bar0+HNYHwE=";
+    hash = "sha256-Pca+SMuUL3XyQpLAL6SOYPnztc95WF2o0v4+5Nc5Nxg=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/certomancer/default.nix
+++ b/pkgs/development/python-modules/certomancer/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "certomancer";
-  version = "0.8.2";
+  version = "0.9.1";
  format = "setuptools";
  disabled = pythonOlder "3.7";

@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "MatthiasValvekens";
    repo = "certomancer";
    rev = version;
-    sha256 = "sha256-H43NlFNTwZtedHsB7c62MocwQVOi5JjVJxRcZY+Wn7Y=";
+    sha256 = "4v2e46ZrzhKXpMULj0vmDRoLOypi030eaADAYjLMg5M=";
  };

  propagatedBuildInputs = [
@ -43,9 +43,7 @@ buildPythonPackage rec {
  ];

  postPatch = ''
-    substituteInPlace setup.py \
-      --replace ", 'pytest-runner'" "" \
-      --replace "pyhanko-certvalidator==0.19.2" "pyhanko-certvalidator==0.19.5"
+    substituteInPlace setup.py --replace ", 'pytest-runner'" ""
  '';

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/chart-studio/default.nix
+++ b/pkgs/development/python-modules/chart-studio/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "chart-studio";
-  version = "5.11.0";
+  version = "5.13.0";

  # chart-studio was split from plotly
  src = fetchFromGitHub {
    owner = "plotly";
    repo = "plotly.py";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-Reti8tvBpBxpfNjnZs8wWuS76oEWIKPCxzSdTEO+ykA=";
+    sha256 = "sha256-j4n5goW2Iu5Z1+Gta1Ar34WXaF8ryUKs5P+6Onhmyh0=";
  };

  sourceRoot = "source/packages/python/chart-studio";
--- a/pkgs/development/python-modules/clustershell/default.nix
+++ b/pkgs/development/python-modules/clustershell/default.nix
@ -12,11 +12,11 @@

 buildPythonPackage rec {
  pname = "ClusterShell";
-  version = "1.9";
+  version = "1.9.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-A0arNKF9jPRj3GnnOBHG8xDD2YEPpMrPRbZEaKg8FHQ=";
+    sha256 = "sha256-bwqzyhQbUI2gPOGb1S8eXo0pdz/DBi1782RQqCIH7Bs=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/coconut/default.nix
+++ b/pkgs/development/python-modules/coconut/default.nix
@ -14,13 +14,13 @@

 buildPythonPackage rec {
  pname = "coconut";
-  version = "2.1.1";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "evhub";
    repo = "coconut";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-zDMcQPAYlxid3fcMT8kRzE+LN1dxUVWjkg8pdVtmwZg=";
+    sha256 = "sha256-+OrVNtre7kAfU5L7/6DadZxFNWVt5raF6HLGXHHpOvE=";
  };

  propagatedBuildInputs = [ cpyparsing ipykernel mypy pygments prompt-toolkit watchdog ];
--- a/pkgs/development/python-modules/collections-extended/default.nix
+++ b/pkgs/development/python-modules/collections-extended/default.nix
@ -5,6 +5,7 @@
 , poetry-core
 , pytestCheckHook
 , pythonOlder
+, pythonAtLeast
 }:

 buildPythonPackage rec {
@ -12,7 +13,8 @@ buildPythonPackage rec {
  version = "2.0.2";
  format = "pyproject";

-  disabled = pythonOlder "3.6";
+  # https://github.com/mlenzen/collections-extended/issues/198
+  disabled = pythonOlder "3.6" || pythonAtLeast "3.11";

  src = fetchFromGitHub {
    owner = "mlenzen";
--- a/pkgs/development/python-modules/drf-yasg/default.nix
+++ b/pkgs/development/python-modules/drf-yasg/default.nix
@ -14,11 +14,11 @@

 buildPythonPackage rec {
  pname = "drf-yasg";
-  version = "1.21.4";
+  version = "1.21.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-iHyfeeZPRqpIl0I05hApsb6msS6mKKj8ijaXWJrdHT4=";
+    sha256 = "sha256-zu8MO13EOJeBr9eG5tw2l68qL+DYck7h9jfCPXW7xbI=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/holoviews/default.nix
+++ b/pkgs/development/python-modules/holoviews/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "holoviews";
-  version = "1.15.3";
+  version = "1.15.4";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-pFiRzSuPzUCHQs//81HJKPv0zx730fBEQsfYeG7o6ZQ=";
+    hash = "sha256-StwTN1DmDnNiZ+3iF2NW5qMDFDiwkTZ8tPKzhN6ZrgM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/iminuit/default.nix
+++ b/pkgs/development/python-modules/iminuit/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "iminuit";
-  version = "2.18.0";
+  version = "2.19.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-fuLGoLzaxYGzj66NDzQ/3uVfkfH2psyWQ/z7zGwtw+Y=";
+    hash = "sha256-9NHLrM8RXNxIZpaPZJ8qN3lKXA3gGN6BVqp0VWNQpUw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/inquirer/default.nix
+++ b/pkgs/development/python-modules/inquirer/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder

 # native
 , poetry-core
@ -18,14 +19,16 @@

 buildPythonPackage rec {
  pname = "inquirer";
-  version = "3.1.1";
+  version = "3.1.2";
  format = "pyproject";

+  disabled = pythonOlder "3.7";
+
  src = fetchFromGitHub rec {
    owner = "magmax";
    repo = "python-inquirer";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-gDJqD0IHshyGw9MmMtYjkkpvYklRLgPd6EtLVqi2I/o=";
+    hash = "sha256-7kq0sZzPeCX7TA5Cl2rg6Uw+9jLz335a+tOrO0+Cyas=";
  };

  nativeBuildInputs = [
@ -44,10 +47,16 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+
+  pythonImportsCheck = [
+    "inquirer"
+  ];
+
  meta = with lib; {
-    homepage = "https://github.com/magmax/python-inquirer";
    description = "A collection of common interactive command line user interfaces, based on Inquirer.js";
+    homepage = "https://github.com/magmax/python-inquirer";
+    changelog = "https://github.com/magmax/python-inquirer/releases/tag/v${version}";
    license = licenses.mit;
-    maintainers = [ maintainers.mmahut ];
+    maintainers = with maintainers; [ mmahut ];
  };
 }
--- a/pkgs/development/python-modules/lightning/default.nix
+++ b/pkgs/development/python-modules/lightning/default.nix
@ -1,30 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pytest
-, jinja2
-, matplotlib
-, numpy
-, requests
-, six
-}:
-
-buildPythonPackage rec {
-  version = "1.2.1";
-  pname = "lightning-python";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "3987d7d4a634bdb6db9bcf212cf4d2f72bab5bc039f4f6cbc02c9d01c4ade792";
-  };
-
-  buildInputs = [ pytest ];
-  propagatedBuildInputs = [ jinja2 matplotlib numpy requests six ];
-
-  meta = with lib; {
-    description = "A Python client library for the Lightning data visualization server";
-    homepage = "http://lightning-viz.org";
-    license = licenses.mit;
-  };
-
-}
--- a/pkgs/development/python-modules/limnoria/default.nix
+++ b/pkgs/development/python-modules/limnoria/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "limnoria";
-  version = "2023.1.12";
+  version = "2023.1.28";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-V3DkIsnVv/HekWuOnIKnMHhccDGWun7mF7AcBSEsy6o=";
+    hash = "sha256-yIKJAW5hb7EOUiS7G+Q4QAESfG4dbfqHScaQBKLMkeM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/n3fit/default.nix
+++ b/pkgs/development/python-modules/n3fit/default.nix
@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, hyperopt
+, keras
+, nnpdf
+, psutil
+, tensorflow
+, validphys2
+}:
+
+buildPythonPackage rec {
+  pname = "n3fit";
+  version = "4.0";
+  format = "setuptools";
+
+  inherit (nnpdf) src;
+
+  prePatch = ''
+    cd n3fit
+  '';
+
+  postPatch = ''
+    substituteInPlace src/n3fit/version.py \
+      --replace '= __give_git()' '= "'$version'"'
+  '';
+
+  propagatedBuildInputs = [
+    hyperopt
+    keras
+    psutil
+    tensorflow
+    validphys2
+  ];
+
+  postInstall = ''
+    for prog in "$out"/bin/*; do
+      wrapProgram "$prog" --set PYTHONPATH "$PYTHONPATH:$(toPythonPath "$out")"
+    done
+  '';
+
+  doCheck = false; # no tests
+  pythonImportsCheck = [ "n3fit" ];
+
+  meta = with lib; {
+    description = "NNPDF fitting framework";
+    homepage = "https://docs.nnpdf.science";
+    inherit (nnpdf.meta) license;
+    maintainers = with maintainers; [ veprbl ];
+  };
+}
--- a/pkgs/development/python-modules/oralb-ble/default.nix
+++ b/pkgs/development/python-modules/oralb-ble/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "oralb-ble";
-  version = "0.17.4";
+  version = "0.17.5";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-KvvcyeYXBtV/sUKMv+1xoXH9ALUX46EWS/STFZkCnUQ=";
+    hash = "sha256-Lwrr5XzU2pbx3cYkvYtHgXFhGnz3cMBnNFWCpuY3ltg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/oslo-log/default.nix
+++ b/pkgs/development/python-modules/oslo-log/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "oslo-log";
-  version = "5.0.2";
+  version = "5.1.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -25,7 +25,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "oslo.log";
    inherit version;
-    hash = "sha256-5F5zEqpxUooWc2zkUVK+PxrxI/XvYqqB2gRoBVhPzKM=";
+    hash = "sha256-9qw3r5WRjgXXod19CwVSuosisuQwhi6zNt5ZLSXITyk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/primer3/default.nix
+++ b/pkgs/development/python-modules/primer3/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "primer3";
-  version = "0.6.1";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "libnano";
    repo = "primer3-py";
-    rev = version;
-    sha256 = "1glybwp9w2m1ydvaphr41gj31d8fvlh40s35galfbjqa563si72g";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-o9B8TN3mOchOO7dz34mI3NDtIhHSlA9+lMNsYcxhTE0=";
  };

  nativeBuildInputs = [ cython ]
--- a/pkgs/development/python-modules/quantiphy/default.nix
+++ b/pkgs/development/python-modules/quantiphy/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "quantiphy";
-  version = "2.18";
+  version = "2.19";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "KenKundert";
    repo = "quantiphy";
    rev = "v${version}";
-    hash = "sha256-KXZQTal5EQDrMNV9QKeuLeYYDaMfAJlEDEagq2XG9/Q=";
+    hash = "sha256-oSWq/D1EX6mxUDElfujyOSEtql0csAm72u2B5RuQddE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/raincloudy/default.nix
+++ b/pkgs/development/python-modules/raincloudy/default.nix
@ -1,12 +1,18 @@
 { lib
+, aiohttp
+, aioresponses
 , beautifulsoup4
 , buildPythonPackage
 , fetchFromGitHub
 , html5lib
+, pytest-asyncio
+, pytest-aiohttp
 , pytestCheckHook
 , pythonOlder
 , requests
 , requests-mock
+, setuptools
+, setuptools-scm
 , urllib3
 }:

@ -24,7 +30,25 @@ buildPythonPackage rec {
    hash = "sha256-qCkBVirM09iA1sXiOB9FJns8bHjQq7rRk8XbRWrtBDI=";
  };

+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  postPatch = ''
+    # https://github.com/vanstinator/raincloudy/pull/60
+    substituteInPlace setup.py \
+      --replace "bs4" "beautifulsoup4" \
+
+    # fix raincloudy.aio package discovery, by relying on
+    # autodiscovery instead.
+    sed -i '/packages=/d' setup.py
+  '';
+
  propagatedBuildInputs = [
+    aiohttp
    requests
    beautifulsoup4
    urllib3
@ -32,19 +56,16 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    aioresponses
+    pytest-asyncio
+    pytest-aiohttp
    pytestCheckHook
    requests-mock
  ];

-  postPatch = ''
-    # https://github.com/vanstinator/raincloudy/pull/60
-    substituteInPlace setup.py \
-      --replace "bs4" "beautifulsoup4" \
-      --replace "html5lib==1.0.1" "html5lib"
-  '';
-
  pythonImportsCheck = [
    "raincloudy"
+    "raincloudy.aio"
  ];

  disabledTests = [
--- a/pkgs/development/python-modules/types-protobuf/default.nix
+++ b/pkgs/development/python-modules/types-protobuf/default.nix
@ -6,12 +6,12 @@

 buildPythonPackage rec {
  pname = "types-protobuf";
-  version = "4.21.0.2";
+  version = "4.21.0.5";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-ffSD00rT/LH6f/8Qc1YNWWyawfQZz6hRsiDJqTOGyZg=";
+    sha256 = "sha256-gZp8Z+aUduOcPwyYcbu57oIxNkXTF7ba62CslaMJ29M=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/validobj/default.nix
+++ b/pkgs/development/python-modules/validobj/default.nix
@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, pythonAtLeast
 , fetchPypi
 , flit
 , hypothesis
@ -11,6 +12,9 @@ buildPythonPackage rec {
  version = "0.6";
  format = "pyproject";

+  # https://github.com/Zaharid/validobj/issues/8
+  disabled = pythonAtLeast "3.11";
+
  src = fetchPypi {
    inherit pname version;
    sha256 = "sha256-BvnHn0Erk87Ce3tYwYf0tBwRJMrG19Af/Y568VJ02uo=";
--- a/pkgs/development/python-modules/validphys2/default.nix
+++ b/pkgs/development/python-modules/validphys2/default.nix
@ -22,7 +22,7 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace src/validphys/version.py \
-      --replace '= __give_git()' '= "${version}"'
+      --replace '= __give_git()' '= "'$version'"'
  '';

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/vowpalwabbit/default.nix
+++ b/pkgs/development/python-modules/vowpalwabbit/default.nix
@ -18,11 +18,11 @@

 buildPythonPackage rec {
  pname = "vowpalwabbit";
-  version = "9.6.0";
+  version = "9.7.0";

  src = fetchPypi{
    inherit pname version;
-    sha256 = "sha256-LHs98lccPjub5GDPB3dxtkOYCDxri04CVpSSsypa4xI=";
+    sha256 = "sha256-O3WnG3JQ7CEHMPYTmE9pgnS8YZs717P6wBKBnXIvvFI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "xiaomi-ble";
-  version = "0.16.1";
+  version = "0.16.3";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-JsrOt6LmmhJZ4MBwLVKKt3IMbvAnxJx70AZROhb9gbc=";
+    hash = "sha256-yk3rEOcHIEZLz3qKxeGzHuVUWWxG3GhSt9vc0pXcanQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "yalexs-ble";
-  version = "1.12.8";
+  version = "1.12.12";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "bdraco";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-04Xl2TBs9RL+KWmJgUY+PDoYN4AAvrcWP7TJBEu5lNU=";
+    hash = "sha256-CO+plbsZzQkxtvz8N3QP71P2V1wPdyp1oeW/424mZks=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/bbin/default.nix
+++ b/pkgs/development/tools/bbin/default.nix
@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation rec {
    mkdir -p $out/share
    cp -r docs $out/share/docs
    wrapProgram $out/bin/bbin \
-      --prefix PATH : "${lib.makeBinPath [ babashka graalvm17-ce ]}"
+      --prefix PATH : "${lib.makeBinPath [ babashka babashka.graalvmDrv ]}"

    runHook postInstall
  '';
--- a/pkgs/development/tools/cosmoc/default.nix
+++ b/pkgs/development/tools/cosmoc/default.nix
@ -1,41 +0,0 @@
-{ stdenv, lib, cosmopolitan }:
-
-stdenv.mkDerivation {
-  pname = "cosmoc";
-  inherit (cosmopolitan) version;
-
-  doInstallCheck = true;
-  dontUnpack = true;
-  dontBuild = true;
-
-  # compiler arguments based on upstream README.md
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    cat <<EOF >$out/bin/cosmoc
-    #!${stdenv.shell}
-    exec ${stdenv.cc}/bin/${stdenv.cc.targetPrefix}gcc \
-      -Os -static -nostdlib -nostdinc -fno-pie -no-pie -mno-red-zone \
-      -fno-omit-frame-pointer -pg -mnop-mcount -mno-tls-direct-seg-refs \
-      "\$@" \
-      -fuse-ld=bfd -Wl,-T,${cosmopolitan}/lib/ape.lds -Wl,--gc-sections \
-      -include ${cosmopolitan}/include/cosmopolitan.h \
-      ${cosmopolitan}/lib/{crt.o,ape-no-modify-self.o,cosmopolitan.a}
-    EOF
-    chmod +x $out/bin/cosmoc
-    runHook postInstall
-  '';
-
-  installCheckPhase = ''
-    printf 'main() { printf("hello world\\n"); }\n' >hello.c
-    $out/bin/cosmoc hello.c
-    ./a.out
-  '';
-
-  meta = with lib; {
-    homepage = "https://justine.lol/cosmopolitan/";
-    description = "compiler for Cosmopolitan C programs";
-    license = licenses.mit;
-    maintainers = teams.cosmopolitan.members;
-  };
-}
--- a/pkgs/development/tools/cosmocc/default.nix
+++ b/pkgs/development/tools/cosmocc/default.nix
@ -0,0 +1,35 @@
+{ runCommand, lib, cosmopolitan }:
+
+let
+  cosmocc =
+    runCommand "cosmocc"
+      {
+        pname = "cosmocc";
+        inherit (cosmopolitan) version;
+
+        meta = with lib; {
+          homepage = "https://justine.lol/cosmopolitan/";
+          description = "compilers for Cosmopolitan C/C++ programs";
+          license = licenses.mit;
+          maintainers = teams.cosmopolitan.members;
+        };
+        passthru.tests = {
+          cc = runCommand "c-test" { } ''
+            cat > hello.c << END
+            #include <stdio.h>
+            int main() {
+              printf("Hello world!\n");
+              return 0;
+            }
+            END
+            ${cosmocc}/bin/cosmocc hello.c
+            ./a.out > $out
+          '';
+        };
+      } ''
+      mkdir -p $out/bin
+      install ${cosmopolitan.dist}/tool/scripts/{cosmocc,cosmoc++} $out/bin
+      sed 's|/opt/cosmo\([ /]\)|${cosmopolitan.dist}\1|g' -i $out/bin/*
+    '';
+in
+cosmocc
--- a/pkgs/development/tools/jbang/default.nix
+++ b/pkgs/development/tools/jbang/default.nix
@ -1,12 +1,12 @@
 { stdenv, lib, fetchzip, jdk, makeWrapper, coreutils, curl }:

 stdenv.mkDerivation rec {
-  version = "0.102.0";
+  version = "0.103.0";
  pname = "jbang";

  src = fetchzip {
    url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-5T0MQ1b1kA7MVm2drNbUdK6CitTjT76ORPN/BJmsmsM=";
+    sha256 = "sha256-81Le1xVftyQkt5Jm2JXRxID/ySNS1Tcl+BRIsDYeg1k=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/tools/ocaml/ocaml-top/default.nix
+++ b/pkgs/development/tools/ocaml/ocaml-top/default.nix
@ -2,13 +2,13 @@

 with ocamlPackages; buildDunePackage rec {
  pname = "ocaml-top";
-  version = "1.2.0-rc";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "OCamlPro";
    repo = "ocaml-top";
    rev = version;
-    sha256 = "sha256-ZXnPnPvJmHshkTwYWeBojrgJYAF/R6vUo0XkvVMFSeQ=";
+    hash = "sha256-xmPGGB/zUpfeAxUIhR1PhfoESAJq7sTpqHuf++EH3Lw=";
  };

  nativeBuildInputs = [ ocp-build ];
@ -19,11 +19,6 @@ with ocamlPackages; buildDunePackage rec {
    ocp-build -init
  '';

-  postPatch = ''
-    substituteInPlace src/completion.ml \
-      --replace 'LibIndex.load ' 'LibIndex.load ~qualify:false '
-  '';
-
  meta = {
    homepage = "https://www.typerex.org/ocaml-top.html";
    license = lib.licenses.gpl3;
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@ -60,7 +60,7 @@ let
        buildGrammar {
          language = grammar.language or name;
          inherit version;
-          src = grammar.src or fetchGrammar grammar;
+          src = grammar.src or (fetchGrammar grammar);
          location = grammar.location or null;
        };
      grammars' = import ./grammars { inherit lib; } // extraGrammars;
--- a/pkgs/os-specific/linux/ipset/default.nix
+++ b/pkgs/os-specific/linux/ipset/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ipset";
-  version = "7.15";
+  version = "7.17";

  src = fetchurl {
    url = "https://ipset.netfilter.org/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ClVFqq22QBQsH4iNNmp43fhyR5mWf6IGhqcAU71iF1E=";
+    sha256 = "sha256-vknJ/0id1mEMrWVB50PDOE6slunyRwfaezkp2PKsZNg=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2023.2.3";
+  version = "2023.2.4";
  components = {
    "3_day_blinds" = ps: with ps; [
    ];
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -270,7 +270,7 @@ let
  extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);

  # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.2.3";
+  hassVersion = "2023.2.4";

 in python.pkgs.buildPythonApplication rec {
  pname = "homeassistant";
@ -288,7 +288,7 @@ in python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    rev = "refs/tags/${version}";
-    hash = "sha256-cRdxlmlgkKTnrtqGQPbSpBLHf+vfI9T6sdETcGshN9M=";
+    hash = "sha256-Lt/t4S6To0MvdvmdKir7VytrNXPGhC7sMfjQmgox5XY=";
  };

  nativeBuildInputs = with python3.pkgs; [
--- a/pkgs/servers/libreddit/default.nix
+++ b/pkgs/servers/libreddit/default.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "libreddit";
-  version = "0.29.1";
+  version = "0.29.2";

  src = fetchFromGitHub {
    owner = "libreddit";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-W/vUOioZpA2UYPyJOVTGC1mek574m48NKQXG2o7emjU=";
+    hash = "sha256-YCjH0K84sPgQ9MtA5IUHoGCxrAzRSu4KIuk2qPyhaM4=";
  };

-  cargoHash = "sha256-WrkUW9fV69RswS3qBMqBGxNBq6W4eJmJaTrEDp9byrM=";
+  cargoHash = "sha256-VsQckZm8ySmbpn1uSgxWqZ+cc+NnUDNBmSsj4MHdQtk=";

  buildInputs = lib.optionals stdenv.isDarwin [
    Security
--- a/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
@ -6,14 +6,14 @@

 buildGoModule rec {
  pname = "artifactory_exporter";
-  version = "1.11.0";
+  version = "1.12.0";
  rev = "v${version}";

  src = fetchFromGitHub {
    owner = "peimanja";
    repo = pname;
    rev = rev;
-    hash = "sha256-dUAIPS2o+uvCGX32AgknynT0Mzzbq/7SeNmKN0Xc69o=";
+    hash = "sha256-EFjWDoWPePbPX9j4vuI41TAlGcFRlUyPpSvJriZdR0U=";
  };

  vendorHash = "sha256-5yzBKgjJCv4tgdBS6XmZUq1ebbka0LOuv6BARWO7kQg=";
--- a/pkgs/servers/nosql/ferretdb/default.nix
+++ b/pkgs/servers/nosql/ferretdb/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "ferretdb";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "FerretDB";
    repo = "FerretDB";
    rev = "v${version}";
-    sha256 = "sha256-+tmClWkW3uhBXuQzuSMJnzeA1rrkpLV0QLCzcKhbThw=";
+    sha256 = "sha256-iqoz7axU5U6MdRl8I2vS3Nh37XZZPI4bRb3oFxpQs6M=";
  };

  postPatch = ''
@ -19,7 +19,7 @@ buildGoModule rec {
    echo nixpkgs     > build/version/package.txt
  '';

-  vendorSha256 = "sha256-43FxDRcif8FDHyXdNL/FJEt5ZnCQ8r7d5Red3l9442Q=";
+  vendorSha256 = "sha256-qtxR1vk/EZZmCRP1Z+EFObfMbQXKiRaSiI1Dsv268b8=";

  CGO_ENABLED = 0;

--- a/pkgs/shells/hilbish/default.nix
+++ b/pkgs/shells/hilbish/default.nix
@ -2,19 +2,19 @@

 buildGoModule rec {
  pname = "hilbish";
-  version = "2.0.1";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "Rosettea";
    repo = "Hilbish";
    rev = "v${version}";
-    sha256 = "sha256-5GPJVusF3/WbEE5VH45Wyxq40wbNxgjO8QI2cLMpdN0=";
+    sha256 = "sha256-iXDBo3bcmjsDy+iUREpg+sDTFN2LeF7jA+mg62LKeIs=";
    fetchSubmodules = true;
  };

  subPackages = [ "." ];

-  vendorSha256 = "sha256-Kiy1JR3X++naY2XNLpnGujrNQt7qlL0zxv8E96cHmHo=";
+  vendorHash = "sha256-Kiy1JR3X++naY2XNLpnGujrNQt7qlL0zxv8E96cHmHo=";

  ldflags = [
    "-s"
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@ -25,14 +25,14 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
  pname = "awscli2";
-  version = "2.9.21"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.9.23"; # N.B: if you change this, check if overrides are still up-to-date
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cli";
    rev = version;
-    hash = "sha256-/CMV6eCNm2gF9HhdoTo2TUUy7I4NF9Fb+6l2biGIbkE=";
+    hash = "sha256-OaZ8Eax8XE4xGs5yHh+1P8mwEfHkFNEtY6ZGLQc8Thk=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/networking/xray/default.nix
+++ b/pkgs/tools/networking/xray/default.nix
@ -20,16 +20,16 @@ let
 in
 buildGoModule rec {
  pname = "xray";
-  version = "1.7.2";
+  version = "1.7.5";

  src = fetchFromGitHub {
    owner = "XTLS";
    repo = "Xray-core";
    rev = "v${version}";
-    sha256 = "sha256-jwCvo6+YXC471VqGWzcrnrLWOSJW2tBKa5SoynQg0Lo=";
+    sha256 = "sha256-WCku/7eczcsGiIuTy0sSQKUKXlH14TpdVg2/ZPdaiHQ=";
  };

-  vendorSha256 = "sha256-P2g0MqlBScm6yTnpvL5T6l9ntsb4tK9k3Civ7rTevrE=";
+  vendorSha256 = "sha256-2P7fI7fUnShsAl95mPiJgtr/eobt+DMmaoxZcox0eu8=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/tools/package-management/repro-get/default.nix
+++ b/pkgs/tools/package-management/repro-get/default.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "repro-get";
-  version = "0.2.1";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "reproducible-containers";
    repo = "repro-get";
    rev = "v${version}";
-    sha256 = "sha256-3cvKHwAyPYwR5VlhpPJH+3BK9Kw7dTGOPN1q2RnwsG0=";
+    sha256 = "sha256-2B4jNP58t+cfeHi5pICtB9+NwujRzkhl1d/cPkWlNrk=";
  };

-  vendorSha256 = "sha256-ebvtPc0QiP7fNiWYjd7iLG/4iH4DqWV/eaDHvmV/H3Y=";
+  vendorHash = "sha256-GM8sKIZb2G9dBj2RoRO80hQrv8D+hHYo0O9FbBuK780=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1911,7 +1911,7 @@ with pkgs;
  git-town = callPackage ../applications/version-management/git-town { };

  git-trim = callPackage ../applications/version-management/git-trim {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk_11_0.frameworks) IOKit CoreFoundation;
  };

  git-up = callPackage ../applications/version-management/git-up {
@ -15015,11 +15015,10 @@ with pkgs;
    recurseIntoAttrs (callPackage ../development/compilers/graalvm/community-edition {
      inherit (darwin.apple_sdk.frameworks) Foundation;
    });
+  graalvm-ce = graalvm11-ce;
  graalvm11-ce = graalvmCEPackages.graalvm11-ce;
  graalvm17-ce = graalvmCEPackages.graalvm17-ce;
-  buildGraalvmNativeImage = callPackage ../build-support/build-graalvm-native-image {
-    graalvm = graalvm11-ce;
-  };
+  buildGraalvmNativeImage = callPackage ../build-support/build-graalvm-native-image { };

  openshot-qt = libsForQt5.callPackage ../applications/video/openshot-qt { };

@ -19292,7 +19291,7 @@ with pkgs;

  cog = callPackage ../development/web/cog { };

-  cosmoc = callPackage ../development/tools/cosmoc { };
+  cosmocc = callPackage ../development/tools/cosmocc { };

  cosmopolitan = callPackage ../development/libraries/cosmopolitan { };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -5464,8 +5464,6 @@ self: super: with self; {

  lightgbm = callPackage ../development/python-modules/lightgbm { };

-  lightning = callPackage ../development/python-modules/lightning { };
-
  lightning-utilities  = callPackage ../development/python-modules/lightning-utilities { };

  lightparam = callPackage ../development/python-modules/lightparam { };
@ -6198,6 +6196,8 @@ self: super: with self; {

  myst-parser = callPackage ../development/python-modules/myst-parser { };

+  n3fit = callPackage ../development/python-modules/n3fit { };
+
  nad-receiver = callPackage ../development/python-modules/nad-receiver { };

  nagiosplugin = callPackage ../development/python-modules/nagiosplugin { };