Merge master into haskell-updates

2024-11-23 15:33:13 +00:00 · 2022-09-20 00:20:33 +00:00 · 2022-09-20 00:20:33 +00:00 · eb735a451f
commit eb735a451f
parent ee0290c232 2166fbfa59
151 changed files with 7105 additions and 7057 deletions
--- a/.github/ISSUE_TEMPLATE/missing_documentation.md
+++ b/.github/ISSUE_TEMPLATE/missing_documentation.md
@ -1,6 +1,6 @@
 ---
 name: Missing or incorrect documentation
-about:
+about: Help us improve the Nixpkgs and NixOS reference manuals
 title: ''
 labels: '9.needs: documentation'
 assignees: ''
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -13420,6 +13420,12 @@
    githubId = 1292007;
    name = "Sébastien Maccagnoni";
  };
+  tirex = {
+    email = "szymon@kliniewski.pl";
+    name = "Szymon Kliniewski";
+    github = "NoneTirex";
+    githubId = 26038207;
+  };
  titanous = {
    email = "jonathan@titanous.com";
    github = "titanous";
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -484,6 +484,14 @@
          <literal>services.datadog-agent</literal> module.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          lemmy module option
+          <literal>services.lemmy.settings.database.createLocally</literal>
+          moved to
+          <literal>services.lemmy.database.createLocally</literal>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          virtlyst package and <literal>services.virtlyst</literal>
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -166,6 +166,9 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).

 - dd-agent package removed along with the `services.dd-agent` module, due to the project being deprecated in favor of `datadog-agent`,  which is available via the `services.datadog-agent` module.

+- lemmy module option `services.lemmy.settings.database.createLocally`
+  moved to `services.lemmy.database.createLocally`.
+
 - virtlyst package and `services.virtlyst` module removed, due to lack of maintainers.

 - The `services.graphite.api` and `services.graphite.beacon` NixOS options, and
--- a/nixos/modules/services/web-apps/lemmy.nix
+++ b/nixos/modules/services/web-apps/lemmy.nix
@ -28,6 +28,8 @@ in

    caddy.enable = mkEnableOption (lib.mdDoc "exposing lemmy with the caddy reverse proxy");

+    database.createLocally = mkEnableOption (lib.mdDoc "creation of database on the instance");
+
    settings = mkOption {
      default = { };
      description = lib.mdDoc "Lemmy configuration";
@ -63,9 +65,6 @@ in
            description = lib.mdDoc "The difficultly of the captcha to solve.";
          };
        };
-
-        options.database.createLocally = mkEnableOption (lib.mdDoc "creation of database on the instance");
-
      };
    };

@ -142,7 +141,7 @@ in
      };

      assertions = [{
-        assertion = cfg.settings.database.createLocally -> localPostgres;
+        assertion = cfg.database.createLocally -> localPostgres;
        message = "if you want to create the database locally, you need to use a local database";
      }];

@ -163,9 +162,9 @@ in

        wantedBy = [ "multi-user.target" ];

-        after = [ "pict-rs.service" ] ++ lib.optionals cfg.settings.database.createLocally [ "lemmy-postgresql.service" ];
+        after = [ "pict-rs.service" ] ++ lib.optionals cfg.database.createLocally [ "lemmy-postgresql.service" ];

-        requires = lib.optionals cfg.settings.database.createLocally [ "lemmy-postgresql.service" ];
+        requires = lib.optionals cfg.database.createLocally [ "lemmy-postgresql.service" ];

        serviceConfig = {
          DynamicUser = true;
@ -203,7 +202,7 @@ in
        };
      };

-      systemd.services.lemmy-postgresql = mkIf cfg.settings.database.createLocally {
+      systemd.services.lemmy-postgresql = mkIf cfg.database.createLocally {
        description = "Lemmy postgresql db";
        after = [ "postgresql.service" ];
        partOf = [ "lemmy.service" ];
--- a/nixos/tests/lemmy.nix
+++ b/nixos/tests/lemmy.nix
@ -15,10 +15,10 @@ in
      services.lemmy = {
        enable = true;
        ui.port = uiPort;
+        database.createLocally = true;
        settings = {
          hostname = "http://${lemmyNodeName}";
          port = backendPort;
-          database.createLocally = true;
          # Without setup, the /feeds/* and /nodeinfo/* API endpoints won't return 200
          setup = {
            admin_username = "mightyiam";
--- a/pkgs/applications/audio/plexamp/default.nix
+++ b/pkgs/applications/audio/plexamp/default.nix
@ -2,12 +2,12 @@

 let
  pname = "plexamp";
-  version = "4.3.0";
+  version = "4.4.0";

  src = fetchurl {
    url = "https://plexamp.plex.tv/plexamp.plex.tv/desktop/Plexamp-${version}.AppImage";
    name="${pname}-${version}.AppImage";
-    sha512 = "c9d2rp7tibb73tZdoFONW7eoy+u+GaUZ0RPhYWCBk5MYwtY81xrsdka64x60xzxOopWZ6JkmGs9AWI1XifqBTQ==";
+    sha512 = "VYdeZUgVWDce9XGyf5AnwPV/Ja6p2i3IRAcnSj7J7KqTUdgoNsPl4gqs4HcdrSCEX8PfloimJihoBuEKtgXcNA==";
  };

  appimageContents = appimageTools.extractType2 {
@ -33,7 +33,7 @@ in appimageTools.wrapType2 {
  meta = with lib; {
    description = "A beautiful Plex music player for audiophiles, curators, and hipsters";
    homepage = "https://plexamp.com/";
-    changelog = "https://forums.plex.tv/t/plexamp-release-notes/221280/45";
+    changelog = "https://forums.plex.tv/t/plexamp-release-notes/221280/46";
    license = licenses.unfree;
    maintainers = with maintainers; [ killercup synthetica ];
    platforms = [ "x86_64-linux" ];
--- a/pkgs/applications/audio/scream/default.nix
+++ b/pkgs/applications/audio/scream/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "scream";
-  version = "3.9";
+  version = "4.0";

  src = fetchFromGitHub {
    owner = "duncanthrax";
    repo = pname;
    rev = version;
-    sha256 = "sha256-JxDR7UhS4/+oGQ9Fwm4f+yBM9OyX0Srvr9n/vaZVvxQ=";
+    sha256 = "sha256-lP5mdNhZjkEVjgQUEsisPy+KXUqsE6xj6dFWcgD+VGM=";
  };

  buildInputs = lib.optional pulseSupport libpulseaudio
--- a/pkgs/applications/blockchains/erigon.nix
+++ b/pkgs/applications/blockchains/erigon.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "erigon";
-  version = "2022.09.01";
+  version = "2022.09.02";

  src = fetchFromGitHub {
    owner = "ledgerwatch";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-vcppzHJ6yLIqp/5Gl9JIgkTVR1mKKAj1vhWY/bCvbPQ=";
+    sha256 = "sha256-ZLR6xdl3ckady+drYtN/kKK9xSRZ6jcWIxEQwN87MeU=";
    fetchSubmodules = true;
  };

-  vendorSha256 = "sha256-mY8m5bXm09pmq1imCo8uiBBnzPzrVuka8XtZyxL9LWo=";
+  vendorSha256 = "sha256-yUvz5ZrCegA69H0NDZfU9Yi97ljk4swnzPHJZ5Dl4Qs=";
  proxyVendor = true;

  # Build errors in mdbx when format hardening is enabled:
@ -30,6 +30,6 @@ buildGoModule rec {
    homepage = "https://github.com/ledgerwatch/erigon/";
    description = "Ethereum node implementation focused on scalability and modularity";
    license = with licenses; [ lgpl3Plus gpl3Plus ];
-    maintainers = with maintainers; [ d-xo ];
+    maintainers = with maintainers; [ d-xo happysalada ];
  };
 }
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -8,6 +8,7 @@
 , python3Packages
 , jdk
 , llvmPackages_8
+, llvmPackages_14
 , nixpkgs-fmt
 , protobuf
 , jq
@ -2551,7 +2552,7 @@ let
        };
      };

-      vadimcn.vscode-lldb = callPackage ./vscode-lldb { };
+      vadimcn.vscode-lldb = callPackage ./vscode-lldb { llvmPackages = llvmPackages_14; };

      valentjn.vscode-ltex = vscode-utils.buildVscodeMarketplaceExtension rec {
        mktplcRef = {
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/default.nix
@ -0,0 +1,17 @@
+# This file has been generated by node2nix 1.11.1. Do not edit!
+
+{pkgs ? import <nixpkgs> {
+    inherit system;
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-14_x"}:
+
+let
+  nodeEnv = import ./node-env.nix {
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript;
+    inherit pkgs nodejs;
+    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
+  };
+in
+import ./node-packages.nix {
+  inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit;
+  inherit nodeEnv;
+}
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/node-env.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/node-env.nix
@ -0,0 +1,598 @@
+# This file originates from node2nix
+
+{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript}:
+
+let
+  # Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master
+  utillinux = if pkgs ? utillinux then pkgs.utillinux else pkgs.util-linux;
+
+  python = if nodejs ? python then nodejs.python else python2;
+
+  # Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
+  tarWrapper = runCommand "tarWrapper" {} ''
+    mkdir -p $out/bin
+
+    cat > $out/bin/tar <<EOF
+    #! ${stdenv.shell} -e
+    $(type -p tar) "\$@" --warning=no-unknown-keyword --delay-directory-restore
+    EOF
+
+    chmod +x $out/bin/tar
+  '';
+
+  # Function that generates a TGZ file from a NPM project
+  buildNodeSourceDist =
+    { name, version, src, ... }:
+
+    stdenv.mkDerivation {
+      name = "node-tarball-${name}-${version}";
+      inherit src;
+      buildInputs = [ nodejs ];
+      buildPhase = ''
+        export HOME=$TMPDIR
+        tgzFile=$(npm pack | tail -n 1) # Hooks to the pack command will add output (https://docs.npmjs.com/misc/scripts)
+      '';
+      installPhase = ''
+        mkdir -p $out/tarballs
+        mv $tgzFile $out/tarballs
+        mkdir -p $out/nix-support
+        echo "file source-dist $out/tarballs/$tgzFile" >> $out/nix-support/hydra-build-products
+      '';
+    };
+
+  # Common shell logic
+  installPackage = writeShellScript "install-package" ''
+    installPackage() {
+      local packageName=$1 src=$2
+
+      local strippedName
+
+      local DIR=$PWD
+      cd $TMPDIR
+
+      unpackFile $src
+
+      # Make the base dir in which the target dependency resides first
+      mkdir -p "$(dirname "$DIR/$packageName")"
+
+      if [ -f "$src" ]
+      then
+          # Figure out what directory has been unpacked
+          packageDir="$(find . -maxdepth 1 -type d | tail -1)"
+
+          # Restore write permissions to make building work
+          find "$packageDir" -type d -exec chmod u+x {} \;
+          chmod -R u+w "$packageDir"
+
+          # Move the extracted tarball into the output folder
+          mv "$packageDir" "$DIR/$packageName"
+      elif [ -d "$src" ]
+      then
+          # Get a stripped name (without hash) of the source directory.
+          # On old nixpkgs it's already set internally.
+          if [ -z "$strippedName" ]
+          then
+              strippedName="$(stripHash $src)"
+          fi
+
+          # Restore write permissions to make building work
+          chmod -R u+w "$strippedName"
+
+          # Move the extracted directory into the output folder
+          mv "$strippedName" "$DIR/$packageName"
+      fi
+
+      # Change to the package directory to install dependencies
+      cd "$DIR/$packageName"
+    }
+  '';
+
+  # Bundle the dependencies of the package
+  #
+  # Only include dependencies if they don't exist. They may also be bundled in the package.
+  includeDependencies = {dependencies}:
+    lib.optionalString (dependencies != []) (
+      ''
+        mkdir -p node_modules
+        cd node_modules
+      ''
+      + (lib.concatMapStrings (dependency:
+        ''
+          if [ ! -e "${dependency.packageName}" ]; then
+              ${composePackage dependency}
+          fi
+        ''
+      ) dependencies)
+      + ''
+        cd ..
+      ''
+    );
+
+  # Recursively composes the dependencies of a package
+  composePackage = { name, packageName, src, dependencies ? [], ... }@args:
+    builtins.addErrorContext "while evaluating node package '${packageName}'" ''
+      installPackage "${packageName}" "${src}"
+      ${includeDependencies { inherit dependencies; }}
+      cd ..
+      ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+    '';
+
+  pinpointDependencies = {dependencies, production}:
+    let
+      pinpointDependenciesFromPackageJSON = writeTextFile {
+        name = "pinpointDependencies.js";
+        text = ''
+          var fs = require('fs');
+          var path = require('path');
+
+          function resolveDependencyVersion(location, name) {
+              if(location == process.env['NIX_STORE']) {
+                  return null;
+              } else {
+                  var dependencyPackageJSON = path.join(location, "node_modules", name, "package.json");
+
+                  if(fs.existsSync(dependencyPackageJSON)) {
+                      var dependencyPackageObj = JSON.parse(fs.readFileSync(dependencyPackageJSON));
+
+                      if(dependencyPackageObj.name == name) {
+                          return dependencyPackageObj.version;
+                      }
+                  } else {
+                      return resolveDependencyVersion(path.resolve(location, ".."), name);
+                  }
+              }
+          }
+
+          function replaceDependencies(dependencies) {
+              if(typeof dependencies == "object" && dependencies !== null) {
+                  for(var dependency in dependencies) {
+                      var resolvedVersion = resolveDependencyVersion(process.cwd(), dependency);
+
+                      if(resolvedVersion === null) {
+                          process.stderr.write("WARNING: cannot pinpoint dependency: "+dependency+", context: "+process.cwd()+"\n");
+                      } else {
+                          dependencies[dependency] = resolvedVersion;
+                      }
+                  }
+              }
+          }
+
+          /* Read the package.json configuration */
+          var packageObj = JSON.parse(fs.readFileSync('./package.json'));
+
+          /* Pinpoint all dependencies */
+          replaceDependencies(packageObj.dependencies);
+          if(process.argv[2] == "development") {
+              replaceDependencies(packageObj.devDependencies);
+          }
+          replaceDependencies(packageObj.optionalDependencies);
+
+          /* Write the fixed package.json file */
+          fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2));
+        '';
+      };
+    in
+    ''
+      node ${pinpointDependenciesFromPackageJSON} ${if production then "production" else "development"}
+
+      ${lib.optionalString (dependencies != [])
+        ''
+          if [ -d node_modules ]
+          then
+              cd node_modules
+              ${lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies}
+              cd ..
+          fi
+        ''}
+    '';
+
+  # Recursively traverses all dependencies of a package and pinpoints all
+  # dependencies in the package.json file to the versions that are actually
+  # being used.
+
+  pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
+    ''
+      if [ -d "${packageName}" ]
+      then
+          cd "${packageName}"
+          ${pinpointDependencies { inherit dependencies production; }}
+          cd ..
+          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+      fi
+    '';
+
+  # Extract the Node.js source code which is used to compile packages with
+  # native bindings
+  nodeSources = runCommand "node-sources" {} ''
+    tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
+    mv node-* $out
+  '';
+
+  # Script that adds _integrity fields to all package.json files to prevent NPM from consulting the cache (that is empty)
+  addIntegrityFieldsScript = writeTextFile {
+    name = "addintegrityfields.js";
+    text = ''
+      var fs = require('fs');
+      var path = require('path');
+
+      function augmentDependencies(baseDir, dependencies) {
+          for(var dependencyName in dependencies) {
+              var dependency = dependencies[dependencyName];
+
+              // Open package.json and augment metadata fields
+              var packageJSONDir = path.join(baseDir, "node_modules", dependencyName);
+              var packageJSONPath = path.join(packageJSONDir, "package.json");
+
+              if(fs.existsSync(packageJSONPath)) { // Only augment packages that exist. Sometimes we may have production installs in which development dependencies can be ignored
+                  console.log("Adding metadata fields to: "+packageJSONPath);
+                  var packageObj = JSON.parse(fs.readFileSync(packageJSONPath));
+
+                  if(dependency.integrity) {
+                      packageObj["_integrity"] = dependency.integrity;
+                  } else {
+                      packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads.
+                  }
+
+                  if(dependency.resolved) {
+                      packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided
+                  } else {
+                      packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories.
+                  }
+
+                  if(dependency.from !== undefined) { // Adopt from property if one has been provided
+                      packageObj["_from"] = dependency.from;
+                  }
+
+                  fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2));
+              }
+
+              // Augment transitive dependencies
+              if(dependency.dependencies !== undefined) {
+                  augmentDependencies(packageJSONDir, dependency.dependencies);
+              }
+          }
+      }
+
+      if(fs.existsSync("./package-lock.json")) {
+          var packageLock = JSON.parse(fs.readFileSync("./package-lock.json"));
+
+          if(![1, 2].includes(packageLock.lockfileVersion)) {
+            process.stderr.write("Sorry, I only understand lock file versions 1 and 2!\n");
+            process.exit(1);
+          }
+
+          if(packageLock.dependencies !== undefined) {
+              augmentDependencies(".", packageLock.dependencies);
+          }
+      }
+    '';
+  };
+
+  # Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes
+  reconstructPackageLock = writeTextFile {
+    name = "addintegrityfields.js";
+    text = ''
+      var fs = require('fs');
+      var path = require('path');
+
+      var packageObj = JSON.parse(fs.readFileSync("package.json"));
+
+      var lockObj = {
+          name: packageObj.name,
+          version: packageObj.version,
+          lockfileVersion: 1,
+          requires: true,
+          dependencies: {}
+      };
+
+      function augmentPackageJSON(filePath, dependencies) {
+          var packageJSON = path.join(filePath, "package.json");
+          if(fs.existsSync(packageJSON)) {
+              var packageObj = JSON.parse(fs.readFileSync(packageJSON));
+              dependencies[packageObj.name] = {
+                  version: packageObj.version,
+                  integrity: "sha1-000000000000000000000000000=",
+                  dependencies: {}
+              };
+              processDependencies(path.join(filePath, "node_modules"), dependencies[packageObj.name].dependencies);
+          }
+      }
+
+      function processDependencies(dir, dependencies) {
+          if(fs.existsSync(dir)) {
+              var files = fs.readdirSync(dir);
+
+              files.forEach(function(entry) {
+                  var filePath = path.join(dir, entry);
+                  var stats = fs.statSync(filePath);
+
+                  if(stats.isDirectory()) {
+                      if(entry.substr(0, 1) == "@") {
+                          // When we encounter a namespace folder, augment all packages belonging to the scope
+                          var pkgFiles = fs.readdirSync(filePath);
+
+                          pkgFiles.forEach(function(entry) {
+                              if(stats.isDirectory()) {
+                                  var pkgFilePath = path.join(filePath, entry);
+                                  augmentPackageJSON(pkgFilePath, dependencies);
+                              }
+                          });
+                      } else {
+                          augmentPackageJSON(filePath, dependencies);
+                      }
+                  }
+              });
+          }
+      }
+
+      processDependencies("node_modules", lockObj.dependencies);
+
+      fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2));
+    '';
+  };
+
+  prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
+    let
+      forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
+    in
+    ''
+        # Pinpoint the versions of all dependencies to the ones that are actually being used
+        echo "pinpointing versions of dependencies..."
+        source $pinpointDependenciesScriptPath
+
+        # Patch the shebangs of the bundled modules to prevent them from
+        # calling executables outside the Nix store as much as possible
+        patchShebangs .
+
+        # Deploy the Node.js package by running npm install. Since the
+        # dependencies have been provided already by ourselves, it should not
+        # attempt to install them again, which is good, because we want to make
+        # it Nix's responsibility. If it needs to install any dependencies
+        # anyway (e.g. because the dependency parameters are
+        # incomplete/incorrect), it fails.
+        #
+        # The other responsibilities of NPM are kept -- version checks, build
+        # steps, postprocessing etc.
+
+        export HOME=$TMPDIR
+        cd "${packageName}"
+        runHook preRebuild
+
+        ${lib.optionalString bypassCache ''
+          ${lib.optionalString reconstructLock ''
+            if [ -f package-lock.json ]
+            then
+                echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
+                echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
+                rm package-lock.json
+            else
+                echo "No package-lock.json file found, reconstructing..."
+            fi
+
+            node ${reconstructPackageLock}
+          ''}
+
+          node ${addIntegrityFieldsScript}
+        ''}
+
+        npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} rebuild
+
+        if [ "''${dontNpmInstall-}" != "1" ]
+        then
+            # NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
+            rm -f npm-shrinkwrap.json
+
+            npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} install
+        fi
+    '';
+
+  # Builds and composes an NPM package including all its dependencies
+  buildNodePackage =
+    { name
+    , packageName
+    , version ? null
+    , dependencies ? []
+    , buildInputs ? []
+    , production ? true
+    , npmFlags ? ""
+    , dontNpmInstall ? false
+    , bypassCache ? false
+    , reconstructLock ? false
+    , preRebuild ? ""
+    , dontStrip ? true
+    , unpackPhase ? "true"
+    , buildPhase ? "true"
+    , meta ? {}
+    , ... }@args:
+
+    let
+      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ];
+    in
+    stdenv.mkDerivation ({
+      name = "${name}${if version == null then "" else "-${version}"}";
+      buildInputs = [ tarWrapper python nodejs ]
+        ++ lib.optional (stdenv.isLinux) utillinux
+        ++ lib.optional (stdenv.isDarwin) libtool
+        ++ buildInputs;
+
+      inherit nodejs;
+
+      inherit dontStrip; # Stripping may fail a build for some package deployments
+      inherit dontNpmInstall preRebuild unpackPhase buildPhase;
+
+      compositionScript = composePackage args;
+      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+
+      passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
+
+      installPhase = ''
+        source ${installPackage}
+
+        # Create and enter a root node_modules/ folder
+        mkdir -p $out/lib/node_modules
+        cd $out/lib/node_modules
+
+        # Compose the package and all its dependencies
+        source $compositionScriptPath
+
+        ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
+
+        # Create symlink to the deployed executable folder, if applicable
+        if [ -d "$out/lib/node_modules/.bin" ]
+        then
+            ln -s $out/lib/node_modules/.bin $out/bin
+
+            # Patch the shebang lines of all the executables
+            ls $out/bin/* | while read i
+            do
+                file="$(readlink -f "$i")"
+                chmod u+rwx "$file"
+                patchShebangs "$file"
+            done
+        fi
+
+        # Create symlinks to the deployed manual page folders, if applicable
+        if [ -d "$out/lib/node_modules/${packageName}/man" ]
+        then
+            mkdir -p $out/share
+            for dir in "$out/lib/node_modules/${packageName}/man/"*
+            do
+                mkdir -p $out/share/man/$(basename "$dir")
+                for page in "$dir"/*
+                do
+                    ln -s $page $out/share/man/$(basename "$dir")
+                done
+            done
+        fi
+
+        # Run post install hook, if provided
+        runHook postInstall
+      '';
+
+      meta = {
+        # default to Node.js' platforms
+        platforms = nodejs.meta.platforms;
+      } // meta;
+    } // extraArgs);
+
+  # Builds a node environment (a node_modules folder and a set of binaries)
+  buildNodeDependencies =
+    { name
+    , packageName
+    , version ? null
+    , src
+    , dependencies ? []
+    , buildInputs ? []
+    , production ? true
+    , npmFlags ? ""
+    , dontNpmInstall ? false
+    , bypassCache ? false
+    , reconstructLock ? false
+    , dontStrip ? true
+    , unpackPhase ? "true"
+    , buildPhase ? "true"
+    , ... }@args:
+
+    let
+      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
+    in
+      stdenv.mkDerivation ({
+        name = "node-dependencies-${name}${if version == null then "" else "-${version}"}";
+
+        buildInputs = [ tarWrapper python nodejs ]
+          ++ lib.optional (stdenv.isLinux) utillinux
+          ++ lib.optional (stdenv.isDarwin) libtool
+          ++ buildInputs;
+
+        inherit dontStrip; # Stripping may fail a build for some package deployments
+        inherit dontNpmInstall unpackPhase buildPhase;
+
+        includeScript = includeDependencies { inherit dependencies; };
+        pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+
+        passAsFile = [ "includeScript" "pinpointDependenciesScript" ];
+
+        installPhase = ''
+          source ${installPackage}
+
+          mkdir -p $out/${packageName}
+          cd $out/${packageName}
+
+          source $includeScriptPath
+
+          # Create fake package.json to make the npm commands work properly
+          cp ${src}/package.json .
+          chmod 644 package.json
+          ${lib.optionalString bypassCache ''
+            if [ -f ${src}/package-lock.json ]
+            then
+                cp ${src}/package-lock.json .
+                chmod 644 package-lock.json
+            fi
+          ''}
+
+          # Go to the parent folder to make sure that all packages are pinpointed
+          cd ..
+          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+
+          ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
+
+          # Expose the executables that were installed
+          cd ..
+          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+
+          mv ${packageName} lib
+          ln -s $out/lib/node_modules/.bin $out/bin
+        '';
+      } // extraArgs);
+
+  # Builds a development shell
+  buildNodeShell =
+    { name
+    , packageName
+    , version ? null
+    , src
+    , dependencies ? []
+    , buildInputs ? []
+    , production ? true
+    , npmFlags ? ""
+    , dontNpmInstall ? false
+    , bypassCache ? false
+    , reconstructLock ? false
+    , dontStrip ? true
+    , unpackPhase ? "true"
+    , buildPhase ? "true"
+    , ... }@args:
+
+    let
+      nodeDependencies = buildNodeDependencies args;
+      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "unpackPhase" "buildPhase" ];
+    in
+    stdenv.mkDerivation ({
+      name = "node-shell-${name}${if version == null then "" else "-${version}"}";
+
+      buildInputs = [ python nodejs ] ++ lib.optional (stdenv.isLinux) utillinux ++ buildInputs;
+      buildCommand = ''
+        mkdir -p $out/bin
+        cat > $out/bin/shell <<EOF
+        #! ${stdenv.shell} -e
+        $shellHook
+        exec ${stdenv.shell}
+        EOF
+        chmod +x $out/bin/shell
+      '';
+
+      # Provide the dependencies in a development shell through the NODE_PATH environment variable
+      inherit nodeDependencies;
+      shellHook = lib.optionalString (dependencies != []) ''
+        export NODE_PATH=${nodeDependencies}/lib/node_modules
+        export PATH="${nodeDependencies}/bin:$PATH"
+      '';
+    } // extraArgs);
+in
+{
+  buildNodeSourceDist = lib.makeOverridable buildNodeSourceDist;
+  buildNodePackage = lib.makeOverridable buildNodePackage;
+  buildNodeDependencies = lib.makeOverridable buildNodeDependencies;
+  buildNodeShell = lib.makeOverridable buildNodeShell;
+}
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/node-packages.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/node-packages.nix
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/package.json
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/build-deps/package.json
@ -1,23 +0,0 @@
-{
-  "name": "vscode-lldb",
-  "version": "1.6.8",
-  "dependencies": {
-    "string-argv": "^0.3.1",
-    "yaml": "^1.10.0",
-    "yauzl": "^2.10.0",
-    "@types/vscode": "^1.31.0",
-    "@types/node": "^8.10.50",
-    "@types/mocha": "^7.0.1",
-    "@types/yauzl": "^2.9.0",
-    "typescript": "^4.2.4",
-    "mocha": "^8.4.0",
-    "source-map-support": "^0.5.12",
-    "memory-streams": "^0.1.3",
-    "vscode-debugprotocol": "^1.47.0",
-    "vscode-debugadapter-testsupport": "^1.47.0",
-    "vsce": "=1.88.0",
-    "webpack": "^5.37.1",
-    "webpack-cli": "^4.7.0",
-    "ts-loader": "^8.0.0"
-  }
-}
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/cmake-build-extension-only.patch
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/cmake-build-extension-only.patch
@ -1,5 +1,5 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 37745b5..cad11a0 100644
+index 6ae4dfb..519f544 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
@@ -16,13 +16,6 @@ endif()
@ -13,10 +13,10 @@ index 37745b5..cad11a0 100644
 -    message(FATAL_ERROR "LLDB_PACKAGE not set." )
 -endif()
 -
- set(TEST_TIMEOUT 5000 CACHE STRING "Test timeout [ms]")
- 
- # General OS-specific definitions
-@@ -87,16 +80,6 @@ configure_file(package.json ${CMAKE_CURRENT_BINARY_DIR}/package.json @ONLY)
+ if (CMAKE_SYSROOT)
+     set(CMAKE_C_FLAGS "--sysroot=${CMAKE_SYSROOT} ${CMAKE_C_FLAGS}")
+     set(CMAKE_CXX_FLAGS "--sysroot=${CMAKE_SYSROOT} ${CMAKE_CXX_FLAGS}")
+@@ -93,16 +86,6 @@ configure_file(package.json ${CMAKE_CURRENT_BINARY_DIR}/package.json @ONLY)
 configure_file(webpack.config.js ${CMAKE_CURRENT_BINARY_DIR}/webpack.config.js @ONLY)
 file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/package-lock.json DESTINATION ${CMAKE_CURRENT_BINARY_DIR})
 
@ -33,4 +33,20 @@ index 37745b5..cad11a0 100644
 # Copy it back, so we can commit the lock file.
 file(COPY ${CMAKE_CURRENT_BINARY_DIR}/package-lock.json DESTINATION ${CMAKE_CURRENT_SOURCE_DIR})
 
+@@ -154,6 +137,7 @@ add_custom_target(tests
+ 
+ add_copy_file(PackageFiles ${CMAKE_CURRENT_SOURCE_DIR}/README.md ${CMAKE_CURRENT_BINARY_DIR}/README.md)
+ add_copy_file(PackageFiles ${CMAKE_CURRENT_SOURCE_DIR}/CHANGELOG.md ${CMAKE_CURRENT_BINARY_DIR}/CHANGELOG.md)
+add_copy_file(PackageFiles ${CMAKE_CURRENT_SOURCE_DIR}/LICENSE ${CMAKE_CURRENT_BINARY_DIR}/LICENSE)
+ add_copy_file(PackageFiles ${CMAKE_CURRENT_SOURCE_DIR}/images/lldb.png ${CMAKE_CURRENT_BINARY_DIR}/images/lldb.png)
+ add_copy_file(PackageFiles ${CMAKE_CURRENT_SOURCE_DIR}/images/user.svg ${CMAKE_CURRENT_BINARY_DIR}/images/user.svg)
+ add_copy_file(PackageFiles ${CMAKE_CURRENT_SOURCE_DIR}/images/users.svg ${CMAKE_CURRENT_BINARY_DIR}/images/users.svg)
+@@ -170,6 +154,7 @@ add_custom_target(dev_debugging
+ set(PackagedFilesBootstrap
+     README.md
+     CHANGELOG.md
+    LICENSE
+     extension.js
+     images/*
+     syntaxes/*

--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
@ -1,11 +1,11 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, makeWrapper, callPackage
-, nodePackages, cmake, nodejs, unzip, python3
+{ pkgs, lib, stdenv, fetchFromGitHub, runCommand, rustPlatform, makeWrapper, llvmPackages
+, nodePackages, cmake, nodejs, unzip, python3, pkg-config, libsecret
 }:
 assert lib.versionAtLeast python3.version "3.5";
 let
  publisher = "vadimcn";
  pname = "vscode-lldb";
-  version = "1.6.10";
+  version = "1.7.4";

  vscodeExtUniqueId = "${publisher}.${pname}";

@ -13,19 +13,17 @@ let
    owner = "vadimcn";
    repo = "vscode-lldb";
    rev = "v${version}";
-    sha256 = "sha256-4PM/818UFHRZekfbdhS/Rz0Pu6HOjJEldi4YuBWECnI=";
+    sha256 = "sha256-yAB0qxeC2sWCQ1EcKG/7LsuUrxV/kbxkcOzRfAotxFc=";
  };

-  lldb = callPackage ./lldb.nix {};
+  # need to build a custom version of lldb and llvm for enhanced rust support
+  lldb = (import ./lldb.nix { inherit fetchFromGitHub runCommand llvmPackages; });

  adapter = rustPlatform.buildRustPackage {
    pname = "${pname}-adapter";
    inherit version src;

-    # It will pollute the build environment of `buildRustPackage`.
-    cargoPatches = [ ./reset-cargo-config.patch ];
-
-    cargoSha256 = "sha256-Ch1X2vN+p7oCqSs/GIu5IzG+pcSKmQ+VwP2T8ycRhos=";
+    cargoSha256 = "sha256-Ly7yIGB6kLy0c9RzWt8BFuX90dxu2QASocNTEdQA3yo=";

    nativeBuildInputs = [ makeWrapper ];

@ -42,7 +40,14 @@ let
    doCheck = false;
  };

-  nodeDeps = nodePackages."vscode-lldb-build-deps-../../applications/editors/vscode/extensions/vscode-lldb/build-deps";
+  nodeDeps = ((import ./build-deps/default.nix {
+    inherit pkgs nodejs;
+    inherit (stdenv.hostPlatform) system;
+  }).nodeDependencies.override (old: {
+    inherit src version;
+    buildInputs = [pkg-config libsecret];
+    dontNpmInstall = true;
+  }));

 in stdenv.mkDerivation {
  pname = "vscode-extension-${publisher}-${pname}";
@ -55,7 +60,7 @@ in stdenv.mkDerivation {
  patches = [ ./cmake-build-extension-only.patch ];

  postConfigure = ''
-    cp -r ${nodeDeps}/lib/node_modules/vscode-lldb/{node_modules,package-lock.json} .
+    cp -r ${nodeDeps}/lib/{node_modules,package-lock.json} .
  '';

  cmakeFlags = [
@ -92,6 +97,7 @@ in stdenv.mkDerivation {

  passthru = {
    inherit lldb adapter;
+    updateScript = ./update.sh;
  };

  meta = with lib; {
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/fix-python-installation.patch
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/fix-python-installation.patch
@ -0,0 +1,13 @@
+diff --git a/bindings/python/CMakeLists.txt b/bindings/python/CMakeLists.txt
+index 82a52da89a7e..5127dc1d8f41 100644
+--- a/bindings/python/CMakeLists.txt
+++ b/bindings/python/CMakeLists.txt
+@@ -160,7 +160,7 @@ function(finish_swig_python swig_target lldb_python_bindings_dir lldb_python_tar
+   if(LLDB_BUILD_FRAMEWORK)
+     set(LLDB_PYTHON_INSTALL_PATH ${LLDB_FRAMEWORK_INSTALL_DIR}/LLDB.framework/Versions/${LLDB_FRAMEWORK_VERSION}/Resources/Python)
+   else()
+-    set(LLDB_PYTHON_INSTALL_PATH ${LLDB_PYTHON_RELATIVE_PATH})
+    set(LLDB_PYTHON_INSTALL_PATH ${CMAKE_INSTALL_LIBDIR}/../${LLDB_PYTHON_RELATIVE_PATH})
+   endif()
+   if (NOT CMAKE_CFG_INTDIR STREQUAL  ".")
+     string(REPLACE ${CMAKE_CFG_INTDIR} "\$\{CMAKE_INSTALL_CONFIG_NAME\}" LLDB_PYTHON_INSTALL_PATH ${LLDB_PYTHON_INSTALL_PATH})
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/lldb.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/lldb.nix
@ -1,23 +1,35 @@
 # Patched lldb for Rust language support.
-{ lldb_12, fetchFromGitHub }:
+{ fetchFromGitHub, runCommand, llvmPackages }:
 let
  llvmSrc = fetchFromGitHub {
    owner = "vadimcn";
    repo = "llvm-project";
-    rev = "f2e9ff34256cd8c6feaf14359f88ad3f538ed687";
-    sha256 = "sha256-5UsCBu3rtt+l2HZiCswoQJPPh8T6y471TBF4AypdF9I=";
+    # codelldb/14.x branch
+    rev = "4c267c83cbb55fedf2e0b89644dc1db320fdfde7";
+    sha256 = "sha256-jM//ej6AxnRYj+8BAn4QrxHPT6HiDzK5RqHPSg3dCcw=";
  };
-in lldb_12.overrideAttrs (oldAttrs: {
-  src = "${llvmSrc}/lldb";
-
+in (llvmPackages.lldb.overrideAttrs (oldAttrs: rec {
  passthru = (oldAttrs.passthru or {}) // {
    inherit llvmSrc;
  };

+  patches = oldAttrs.patches ++ [
+    # backport of https://github.com/NixOS/nixpkgs/commit/0d3002334850a819d1a5c8283c39f114af907cd4
+    # remove when https://github.com/NixOS/nixpkgs/issues/166604 fixed
+    ./fix-python-installation.patch
+  ];
+
  doInstallCheck = true;
-  postInstallCheck = (oldAttrs.postInstallCheck or "") + ''
+
+  # installCheck for lldb_14 currently broken
+  # https://github.com/NixOS/nixpkgs/issues/166604#issuecomment-1086103692
+  # ignore the oldAttrs installCheck
+  installCheckPhase = ''
    versionOutput="$($out/bin/lldb --version)"
    echo "'lldb --version' returns: $versionOutput"
    echo "$versionOutput" | grep -q 'rust-enabled'
  '';
+})).override({
+  monorepoSrc = llvmSrc;
+  libllvm = llvmPackages.libllvm.override({ monorepoSrc = llvmSrc; });
 })
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/reset-cargo-config.patch
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/reset-cargo-config.patch
@ -1,19 +0,0 @@
-diff --git a/.cargo/config b/.cargo/config
-index c3c75e4..e69de29 100644
--- a/.cargo/config
-+++ b/.cargo/config
-@@ -1,14 +0,0 @@
-[build]
-target-dir = "build/target"
-
-[target.armv7-unknown-linux-gnueabihf]
-rustflags = [
-    "-C", "link-arg=-fuse-ld=lld",
-    "-C", "link-arg=--target=armv7-unknown-linux-gnueabihf",
-]
-
-[target.aarch64-unknown-linux-gnu]
-rustflags = [
-    "-C", "link-arg=-fuse-ld=lld",
-    "-C", "link-arg=--target=aarch64-unknown-linux-gnu",
-]
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/update.sh
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/update.sh
@ -3,10 +3,6 @@

 set -eo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
-if [[ $# -ne 1 ]]; then
-    echo "Usage: ./update.sh <version>"
-    exit 1
-fi

 echo "
 FIXME: This script doesn't update patched lldb. Please manually check branches
@ -19,28 +15,31 @@ nixFile=./default.nix
 owner=vadimcn
 repo=vscode-lldb
 version="$1"
+if [[ $# -ne 1 ]]; then
+    # no version specified, find the newest one
+    version=$(
+        curl -s "https://api.github.com/repos/$owner/$repo/releases" |
+        jq 'map(select(.prerelease | not)) | .[0].tag_name' --raw-output |
+        sed 's/[\"v]//'
+    )
+fi
+old_version=$(sed -nE 's/.*\bversion = "(.*)".*/\1/p' ./default.nix)
+if grep -q 'cargoSha256 = ""' ./default.nix; then
+    old_version='broken'
+fi
+if [[ "$version" == "$old_version" ]]; then
+    echo "Up to date: $version"
+    exit
+fi
+echo "$old_version -> $version"

+# update hashes
 sed -E 's/\bversion = ".*?"/version = "'$version'"/' --in-place "$nixFile"
 srcHash=$(nix-prefetch fetchFromGitHub --owner vadimcn --repo vscode-lldb --rev "v$version")
 sed -E 's#\bsha256 = ".*?"#sha256 = "'$srcHash'"#' --in-place "$nixFile"
 cargoHash=$(nix-prefetch "{ sha256 }: (import $nixpkgs {}).vscode-extensions.vadimcn.vscode-lldb.adapter.cargoDeps.overrideAttrs (_: { outputHash = sha256; })")
 sed -E 's#\bcargoSha256 = ".*?"#cargoSha256 = "'$cargoHash'"#' --in-place "$nixFile"

+# update node dependencies
 src="$(nix-build $nixpkgs -A vscode-extensions.vadimcn.vscode-lldb.src --no-out-link)"
-oldDeps="$(jq '.dependencies' build-deps/package.json)"
-newDeps="$(jq '.dependencies + .devDependencies' "$src/package.json")"
-jq '{ name, version: $version, dependencies: (.dependencies + .devDependencies) }' \
-    --arg version "$version" \
-    "$src/package.json" \
-    > build-deps/package.json
-
-if [[ "$oldDeps" == "$newDeps" ]]; then
-    echo "Dependencies not changed"
-    sed '/"vscode-lldb-build-deps-/,+3 s/version = ".*"/version = "'"$version"'"/' \
-        --in-place "$nixpkgs/pkgs/development/node-packages/node-packages.nix"
-else
-    echo "Dependencies changed"
-    # Regenerate nodePackages.
-    cd "$nixpkgs/pkgs/development/node-packages"
-    exec ./generate.sh
-fi
+nix-shell -p node2nix -I nixpkgs=$nixpkgs --run "cd build-deps && ls -R && node2nix -14 -d -i \"$src/package.json\" -l \"$src/package-lock.json\""
--- a/pkgs/development/libraries/spatialite-tools/default.nix
+++ b/pkgs/development/libraries/spatialite-tools/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , pkg-config
+, freexl
 , geos
 , expat
 , librttopo
@ -11,6 +12,8 @@
 , proj
 , readosm
 , sqlite
+, testers
+, spatialite_tools
 }:

 stdenv.mkDerivation rec {
@ -18,14 +21,15 @@ stdenv.mkDerivation rec {
  version = "5.0.1";

  src = fetchurl {
-    url = "https://www.gaia-gis.it/gaia-sins/spatialite-tools-sources/${pname}-${version}.tar.gz";
-    sha256 = "sha256-lgTCBeh/A3eJvFIwLGbM0TccPpjHTo7E4psHUt41Fxw=";
+    url = "https://www.gaia-gis.it/gaia-sins/spatialite-tools-${version}.tar.gz";
+    hash = "sha256-lgTCBeh/A3eJvFIwLGbM0TccPpjHTo7E4psHUt41Fxw=";
  };

  nativeBuildInputs = [ pkg-config ];

  buildInputs = [
    expat
+    freexl
    geos
    librttopo
    libspatialite
@ -36,17 +40,20 @@ stdenv.mkDerivation rec {
    sqlite
  ];

-  configureFlags = [ "--disable-freexl" ];
-
  enableParallelBuilding = true;

-  NIX_LDFLAGS = "-lsqlite3";
+  passthru.tests.version = testers.testVersion {
+    package = spatialite_tools;
+    command = "! spatialite_tool --version";
+    version = "${libspatialite.version}";
+  };

  meta = with lib; {
    description = "A complete sqlite3-compatible CLI front-end for libspatialite";
    homepage = "https://www.gaia-gis.it/fossil/spatialite-tools";
    license = with licenses; [ mpl11 gpl2Plus lgpl21Plus ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = with maintainers; [ dotlambda ];
+    mainProgram = "spatialite_tool";
  };
 }
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@ -32,7 +32,7 @@
    sha256 = "sha256-T2S5qoOqjqJGf7M4h+IFO+bBER3aNcbxC7CY1fJFqpg=";
  };

-  mvnSha256 = "KVE+AYYEWN9bjAWop4mpiPq8yU3GdSGqOTmLG4pdflQ=";
+  mvnSha256 = "HdIhENml6W4U+gM7ODxXinbex5o1X4YhWGTct5rpL5c=";
  mvnParameters = "-P desktop,all-platforms";

  nativeBuildInputs = [
--- a/pkgs/applications/misc/pdfarranger/default.nix
+++ b/pkgs/applications/misc/pdfarranger/default.nix
@ -5,13 +5,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "pdfarranger";
-  version = "1.8.2";
+  version = "1.9.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
-    rev = version;
-    sha256 = "18bpnnwjx72d5ps06dr89mkixiwzc9hf5gr75k8qcnrkshl038v2";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-T7Uo4WZSmSwMHzi8jWX/fw9ZsNKF+SZFy8O2NeD6R7o=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@ -35,19 +35,7 @@ let
        checkInputs = old.checkInputs ++ (with self; [
          requests
        ]);
-        disabledTests = old.disabledTests ++ [
-          # ResourceWarning: unclosed file
-          "test_basic"
-          "test_date_to_unix"
-          "test_easteregg"
-          "test_file_rfc2231_filename_continuations"
-          "test_find_terminator"
-          "test_save_to_pathlib_dst"
-        ];
-        disabledTestPaths = old.disabledTestPaths ++ [
-          # ResourceWarning: unclosed file
-          "tests/test_http.py"
-        ];
+        doCheck = false;
      });
      # Required by flask-1.1
      jinja2 = super.jinja2.overridePythonAttrs (old: rec {
@ -89,18 +77,25 @@ let
          sha256 = "d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a";
        };
      });
+      # Now requires `lingua` as check input that requires a newer `click`,
+      # however `click-7` is needed by the older flask we need here. Since it's just
+      # for the test-suite apparently, let's skip it for now.
+      Mako = super.Mako.overridePythonAttrs (lib.const {
+        checkInputs = [];
+        doCheck = false;
+      });
    };
  };
 in
 python3'.pkgs.buildPythonPackage rec {
  pname = "privacyIDEA";
-  version = "3.7.2";
+  version = "3.7.3";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-bjMw69nKecv87nwsLfb4+h677WjZlkVcIpVe53AI9WU=";
+    sha256 = "sha256-odwYUGfgoRrGbLpOh8SuQzYby8Ya6hKSn0rdHp+RS/U=";
    fetchSubmodules = true;
  };

@ -115,23 +110,29 @@ python3'.pkgs.buildPythonPackage rec {
  passthru.tests = { inherit (nixosTests) privacyidea; };

  checkInputs = with python3'.pkgs; [ openssl mock pytestCheckHook responses testfixtures ];
+  preCheck = "export HOME=$(mktemp -d)";
+  postCheck = "unset HOME";
  disabledTests = [
-    "AESHardwareSecurityModuleTestCase"
-    "test_01_cert_request"
+    # expects `/home/` to exist, fails with `FileNotFoundError: [Errno 2] No such file or directory: '/home/'`.
    "test_01_loading_scripts"
+
+    # Tries to connect to `fcm.googleapis.com`.
    "test_02_api_push_poll"
-    "test_02_cert_enrolled"
-    "test_02_enroll_rights"
-    "test_02_get_resolvers"
-    "test_02_success"
-    "test_03_get_identifiers"
-    "test_04_remote_user_auth"
+
+    # Timezone info not available in build sandbox
    "test_14_convert_timestamp_to_utc"
+
+    # Fails because of different logger configurations
+    "test_01_create_default_app"
+    "test_03_logging_config_file"
+    "test_04_logging_config_yaml"
+    "test_05_logging_config_broken_yaml"
  ];

  pythonImportsCheck = [ "privacyidea" ];

  postPatch = ''
+    patchShebangs tests/testdata/scripts
    substituteInPlace privacyidea/lib/resolvers/LDAPIdResolver.py --replace \
      "/etc/privacyidea/ldap-ca.crt" \
      "${cacert}/etc/ssl/certs/ca-bundle.crt"
--- a/pkgs/applications/misc/surface-control/default.nix
+++ b/pkgs/applications/misc/surface-control/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "surface-control";
-  version = "0.4.2-1";
+  version = "0.4.3-1";

  src = fetchFromGitHub {
    owner = "linux-surface";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-tFGYIIlcJ4qF1t4Ej6WanjHtm8dSWtH38856uSTc7rU=";
+    sha256 = "sha256-bqrp/XS4OJIRW2ChHnf9gMh/TgCPUEb9fP2soeT1Qe4=";
  };

-  cargoSha256 = "sha256-WwTM1DMTi5DKnkMERkW8H8T2OXlg+Tk6BupmwnOAK5I=";
+  cargoSha256 = "sha256-TWXK36cN8WuqfrMX7ybO2lnNiGnSKmfK6QGWMBM1y0o=";

  nativeBuildInputs = [ pkg-config installShellFiles ];
  buildInputs = [ udev ];
--- a/pkgs/applications/misc/zine/Cargo.lock.patch
+++ b/pkgs/applications/misc/zine/Cargo.lock.patch
--- a/pkgs/applications/misc/zine/default.nix
+++ b/pkgs/applications/misc/zine/default.nix
@ -1,26 +1,23 @@
 { lib
-, stdenv
-, fetchFromGitHub
 , rustPlatform
+, fetchCrate
 , pkg-config
+, stdenv
 , openssl
 , CoreServices
 , Security
 }:
+
 rustPlatform.buildRustPackage rec {
  pname = "zine";
  version = "0.6.0";

-  src = fetchFromGitHub {
-    owner = "zineland";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-Pd/UAg6O9bOvrdvbY46Vf8cxFzjonEwcwPaaW59vH6E=";
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-savwRdIO48gCwqW2Wz/nWZuI1TxW/F0OR9jhNzHF+us=";
  };

-  cargoPatches = [ ./Cargo.lock.patch ]; # Repo does not provide Cargo.lock
-
-  cargoSha256 = "sha256-qpzBDyNSZblmdimnnL4T/wS+6EXpduJ1U2+bfxM7piM=";
+  cargoSha256 = "sha256-U+pzT3V4rHiU+Hrax1EUXGQgdjrdfd3G07luaDSam3g=";

  nativeBuildInputs = [
    pkg-config
@ -33,6 +30,6 @@ rustPlatform.buildRustPackage rec {
    description = "A simple and opinionated tool to build your own magazine";
    homepage = "https://github.com/zineland/zine";
    license = licenses.asl20;
-    maintainers = with maintainers; [ dit7ya ];
+    maintainers = with maintainers; [ dit7ya figsoda ];
  };
 }
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.173";
+  version = "1.2.174";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    hash = "sha256-jbV2pQSFq/E++eOyQwB0ssG2R9mm3sprlm5mFfHJsBA=";
+    hash = "sha256-8TuAreXWKCXThyiWwiSi5kDVHJKeMB8lpltWbVqGY34=";
  };

  vendorHash = "sha256-NHRPl38/R7yS8Hht118mBc+OBPwfYiHOaGIwryNK8Mo=";
--- a/pkgs/applications/networking/gmailctl/default.nix
+++ b/pkgs/applications/networking/gmailctl/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "gmailctl";
-  version = "0.10.4";
+  version = "0.10.5";

  src = fetchFromGitHub {
    owner = "mbrt";
    repo = "gmailctl";
    rev = "v${version}";
-    sha256 = "sha256-tAYFuxB8LSyFHraAQxCj8Q09mS/9RYcinVm5whpRh04=";
+    sha256 = "sha256-H1Nuu/T55e5zWUmofKoyVSA4TaJBdK+JeZtw+G/sC54=";
  };

-  vendorSha256 = "sha256-IFxKczPrqCM9NOoOJayfbrsJIMf3eoI9zXSFns0/i8o=";
+  vendorSha256 = "sha256-ivkTtcvoH+i58iQM9T0xio0YUeMhNzDcmrCSuGFljEI=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@ -44,11 +44,11 @@ in

 stdenv.mkDerivation rec {
  pname = "bluejeans";
-  version = "2.30.0.89";
+  version = "2.30.1.18";

  src = fetchurl {
    url = "https://swdl.bluejeans.com/desktop-app/linux/${getFirst 3 version}/BlueJeans_${version}.rpm";
-    sha256 = "sha256-ALydB6bTxaYsBk0BrTKG8Yan4n/jvxT8T7fSMFel+CQ=";
+    sha256 = "sha256-V/3nmindkuTmUsuAuc0UxldAQe7jfeXWSZWPTXTyLq8=";
  };

  nativeBuildInputs = [ rpmextract makeWrapper ];
--- a/pkgs/applications/networking/instant-messengers/cinny/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny/default.nix
@ -4,11 +4,11 @@ let
  configOverrides = writeText "cinny-config-overrides.json" (builtins.toJSON conf);
 in stdenv.mkDerivation rec {
  pname = "cinny";
-  version = "2.1.3";
+  version = "2.2.0";

  src = fetchurl {
    url = "https://github.com/ajbura/cinny/releases/download/v${version}/cinny-v${version}.tar.gz";
-    sha256 = "sha256-Tn8pT0tppBEQtLdwQf0edUBe3dkK7fedunnNYIld/SQ=";
+    sha256 = "sha256-wwMNb3WBW/I72MXfeYdUZzE/z9YgPFdRbq/F0AdKf9Q=";
  };

  installPhase = ''
--- a/pkgs/applications/networking/n8n/node-packages.nix
+++ b/pkgs/applications/networking/n8n/node-packages.nix
--- a/pkgs/applications/networking/soju/default.nix
+++ b/pkgs/applications/networking/soju/default.nix
@ -1,38 +1,65 @@
-{ lib, buildGoModule, fetchFromSourcehut, installShellFiles, scdoc }:
+{ lib
+, buildGoModule
+, fetchFromSourcehut
+, installShellFiles
+, scdoc
+}:

 buildGoModule rec {
  pname = "soju";
-  version = "0.4.0";
+  version = "0.5.2";

  src = fetchFromSourcehut {
    owner = "~emersion";
    repo = "soju";
    rev = "v${version}";
-    sha256 = "sha256-4ixPEnSa1m52Hu1dzxMG8c0bkqGN04vRlIzvdZ/ES4A=";
+    hash = "sha256-lpLWqaSFx/RJg73n5XNN/qUXHfZsBkbABoYcgxpK3rU=";
  };

-  vendorSha256 = "sha256-UVFi/QK2zwzhBkPXEJLYc5WSu3OOvWTVVGkMhrrufyc=";
+  vendorHash = "sha256-n1wwi7I2hDLOe08RkJOiopDUGI6uhipNpBdeOLARIoU=";

  subPackages = [
    "cmd/soju"
    "cmd/sojuctl"
-    "contrib/znc-import.go"
+    "contrib/migrate-db"
+    "contrib/znc-import"
  ];

  nativeBuildInputs = [
-    scdoc
    installShellFiles
+    scdoc
  ];

+  ldflags = [ "-s" "-w" ];
+
+  postBuild = ''
+    make doc/soju.1
+  '';
+
  postInstall = ''
-    scdoc < doc/soju.1.scd > doc/soju.1
    installManPage doc/soju.1
  '';

+  preCheck = ''
+    # Test all targets.
+    unset subPackages
+
+    # Disable a test that requires an additional service.
+    rm database/postgres_test.go
+  '';
+
  meta = with lib; {
    description = "A user-friendly IRC bouncer";
+    longDescription = ''
+      soju is a user-friendly IRC bouncer. soju connects to upstream IRC servers
+      on behalf of the user to provide extra functionality. soju supports many
+      features such as multiple users, numerous IRCv3 extensions, chat history
+      playback and detached channels. It is well-suited for both small and large
+      deployments.
+    '';
    homepage = "https://soju.im";
+    changelog = "https://git.sr.ht/~emersion/soju/refs/${src.rev}";
    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ malvo ];
+    maintainers = with maintainers; [ azahi malvo ];
  };
 }
--- a/pkgs/applications/science/misc/sasview/default.nix
+++ b/pkgs/applications/science/misc/sasview/default.nix
@ -1,6 +1,7 @@
 { lib
 , python3
 , fetchFromGitHub
+, fetchpatch
 , wrapQtAppsHook
 }:

@ -15,6 +16,15 @@ python3.pkgs.buildPythonApplication rec {
    hash = "sha256-TjcchqA6GCvkr59ZgDuGglan2RxLp+aMjJk28XhvoiY=";
  };

+  patches = [
+    # Fix `asscalar` numpy API removal.
+    # See https://github.com/SasView/sasview/pull/2178
+    (fetchpatch {
+      url = "https://github.com/SasView/sasview/commit/b1ab08c2a4e8fdade7f3e4cfecf3dfec38b8f3c5.patch";
+      hash = "sha256-IH8g4XPziVAnkmBdzLH1ii8vN6kyCmOgrQlH2HEbm5o=";
+    })
+  ];
+
  nativeBuildInputs = [
    python3.pkgs.pyqt5
    wrapQtAppsHook
--- a/pkgs/data/fonts/unifont/default.nix
+++ b/pkgs/data/fonts/unifont/default.nix
@ -4,16 +4,16 @@

 stdenv.mkDerivation rec {
  pname = "unifont";
-  version = "14.0.04";
+  version = "15.0.01";

  ttf = fetchurl {
    url = "mirror://gnu/unifont/${pname}-${version}/${pname}-${version}.ttf";
-    hash = "sha256-IR0d3dxWZRHbJUx0bYPfd7ShubJUnN/+Cj6QHkbu/qg=";
+    hash = "sha256-KZRZvDTpFbHBjdOGd3OfQdCyptebk/SAzRV+8k2mdas=";
  };

  pcf = fetchurl {
    url = "mirror://gnu/unifont/${pname}-${version}/${pname}-${version}.pcf.gz";
-    hash = "sha256-Q5lR7hX4+P+Q9fVDjw9GtLGqUIslsKOWnn8je85fH+0=";
+    hash = "sha256-77rkcU0YajAVugWHnGscaFvcFTgWm+1WPLknQZvTjN0=";
  };

  nativeBuildInputs = [ libfaketime fonttosfnt mkfontscale ];
--- a/pkgs/data/fonts/unifont_upper/default.nix
+++ b/pkgs/data/fonts/unifont_upper/default.nix
@ -1,7 +1,7 @@
 { lib, fetchurl }:

 let
-  version = "14.0.04";
+  version = "15.0.01";
 in fetchurl rec {
  name = "unifont_upper-${version}";

@ -13,7 +13,7 @@ in fetchurl rec {

  postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/unifont_upper.ttf";

-  hash = "sha256-cNw+3Y/6h2TD6ZSaGO32NNyiTwCUSJsA3Q5W5/m+eLE=";
+  hash = "sha256-cGX9umTGRfrQT3gwPgNqxPHB7Un3ZT3b7hPy4IP45Fk=";

  meta = with lib; {
    description = "Unicode font for glyphs above the Unicode Basic Multilingual Plane";
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "numix-icon-theme-circle";
-  version = "22.09.12";
+  version = "22.09.18";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = pname;
    rev = version;
-    sha256 = "sha256-W8hk6UniK4HDJPtMaRQzhfvmE2uZhz4J0QMIbSrtJFo=";
+    sha256 = "sha256-O81tOldb7QAKtMOeL5/Bb7+FWQhiIID3AJWybJah+kY=";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/data/icons/numix-icon-theme-square/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-square/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "numix-icon-theme-square";
-  version = "22.09.12";
+  version = "22.09.18";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = pname;
    rev = version;
-    sha256 = "sha256-cwdP7vY7sXYhBbMpSvfDuuNZBalddmP5XEYMYmpYeoc=";
+    sha256 = "sha256-cJexDI4egOGLggL0kGTu/nplQQg1lPjvnoVk9VCS5gA=";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/data/misc/unicode-character-database/default.nix
+++ b/pkgs/data/misc/unicode-character-database/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "unicode-character-database";
-  version = "14.0.0";
+  version = "15.0.0";

  src = fetchurl {
    url = "https://www.unicode.org/Public/zipped/${version}/UCD.zip";
-    sha256 = "sha256-AzpSdrXXr4hEWJ+ONILzl3qDhecdEH03UFVGUXjCNgA=";
+    sha256 = "sha256-X73kAPPmh9JcybCo0w12GedssvTD6Fup347BMSy2cYw=";
  };

  nativeBuildInputs = [
--- a/pkgs/data/misc/unicode-emoji/default.nix
+++ b/pkgs/data/misc/unicode-emoji/default.nix
@ -4,7 +4,7 @@
 }:

 let
-  version = "14.0";
+  version = "15.0";

  fetchData = { file, sha256 }: fetchurl {
    url = "https://www.unicode.org/Public/emoji/${version}/${file}";
@ -21,15 +21,15 @@ let
  srcs = {
    emoji-sequences = fetchData {
      file = "emoji-sequences.txt";
-      sha256 = "sha256-4helD/0oe+UmNIuVxPx/P0R9V10EY/RccewdeemeGxE=";
+      sha256 = "sha256-vRpXHAcdY3arTnFwBH3WUW3DOh8B3L9+sRcecLHZ2lg=";
    };
    emoji-test = fetchData {
      file = "emoji-test.txt";
-      sha256 = "sha256-DDOVhnFzfvowINzBZ7dGYMZnL4khyRWVzrLL95djsUg=";
+      sha256 = "sha256-3Rega6+ZJ5jXRhLFL/i/12V5IypEo5FaGG6Wf9Bj0UU=";
    };
    emoji-zwj-sequences = fetchData {
      file = "emoji-zwj-sequences.txt";
-      sha256 = "sha256-owlGLICFkyEsIHz/DUZucxjBmgVO40A69BCJPbIYDA0=";
+      sha256 = "sha256-9AqrpyUCiBcR/fafa4VaH0pT5o1YzEZDVySsX4ja1u8=";
    };
  };
 in
--- a/pkgs/data/misc/unihan-database/default.nix
+++ b/pkgs/data/misc/unihan-database/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "unihan-database";
-  version = "14.0.0";
+  version = "15.0.0";

  src = fetchurl {
    url = "https://www.unicode.org/Public/zipped/${version}/Unihan.zip";
-    hash = "sha256-KuRRmyuCzU0VN5wX5Xv7EsM8D1TaSXfeA7KwS88RhS0=";
+    hash = "sha256-JLFUaR/JfLRCZ7kl1iBkKXCGs/iWtXqBgce21CcCoCY=";
  };

  nativeBuildInputs = [
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "v2ray-geoip";
-  version = "202209150105";
+  version = "202209170841";

  src = fetchFromGitHub {
    owner = "v2fly";
    repo = "geoip";
-    rev = "6666b85fc48179414d59613cdfd6f83354f778bc";
-    sha256 = "sha256-iBQvfVvfTG8zQdoTGOFxME0tr/YWCVxjXFQhP/zmRVU=";
+    rev = "9487b31412243e602ee3332ff3cce63a15906733";
+    sha256 = "sha256-gKzrPBiifC2Lg050tFJynFd6DZ4vzSoPB6wbR4OzMFQ=";
  };

  installPhase = ''
--- a/pkgs/desktops/gnome/core/gucharmap/default.nix
+++ b/pkgs/desktops/gnome/core/gucharmap/default.nix
@ -45,7 +45,7 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "gucharmap";
-  version = "14.0.3";
+  version = "15.0.0";

  outputs = [ "out" "lib" "dev" "devdoc" ];

@ -54,7 +54,7 @@ in stdenv.mkDerivation rec {
    owner = "GNOME";
    repo = pname;
    rev = version;
-    sha256 = "sha256-xO34CR+SWxtHuP6G8m0jla0rivVp3ddrsODNo50MhHw=";
+    sha256 = "sha256-ymEtiOKdmQ1XWrGk40csX5O5BiwxH3aCPboVekcUukQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/lingua-franca/default.nix
+++ b/pkgs/development/compilers/lingua-franca/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  postPatch = ''
    substituteInPlace bin/lfc \
      --replace 'base=`dirname $(dirname ''${abs_path})`' "base='$out'" \
-      --replace "run_lfc_with_args" "${jdk17_headless}/bin/java -jar $out/lib/jars/org.lflang.lfc-${version}-SNAPSHOT-all.jar"
+      --replace "run_lfc_with_args" "${jdk17_headless}/bin/java -jar $out/lib/jars/org.lflang.lfc-${version}-all.jar"
  '';

  installPhase = ''
--- a/pkgs/development/coq-modules/corn/default.nix
+++ b/pkgs/development/coq-modules/corn/default.nix
@ -3,14 +3,16 @@
 with lib; mkCoqDerivation rec {
  pname = "corn";
  inherit version;
-  defaultVersion = switch coq.coq-version [
+  defaultVersion = with versions; switch coq.coq-version [
    { case = "8.6"; out = "8.8.1"; }
-    { case = (versions.range "8.7" "8.15"); out = "8.13.0"; }
+    { case = (range "8.11" "8.16"); out = "8.16.0"; }
+    { case = (range "8.7"  "8.15"); out = "8.13.0"; }
  ] null;
  release = {
    "8.8.1".sha256 = "0gh32j0f18vv5lmf6nb87nr5450w6ai06rhrnvlx2wwi79gv10wp";
    "8.12.0".sha256 = "0b92vhyzn1j6cs84z2182fn82hxxj0bqq7hk6cs4awwb3vc7dkhi";
    "8.13.0".sha256 = "1wzr7mdsnf1rq7q0dvmv55vxzysy85b00ahwbs868bl7m8fk8x5b";
+    "8.16.0".sha256 = "sha256-ZE/EEIndxHfo/9Me5NX4ZfcH0ZAQ4sRfZY7LRZfLXBQ=";
  };

  preConfigure = "patchShebangs ./configure.sh";
--- a/pkgs/development/embedded/arduino/arduino-cli/default.nix
+++ b/pkgs/development/embedded/arduino/arduino-cli/default.nix
@ -4,18 +4,18 @@ let

  pkg = buildGoModule rec {
    pname = "arduino-cli";
-    version = "0.25.1";
+    version = "0.27.1";

    src = fetchFromGitHub {
      owner = "arduino";
      repo = pname;
      rev = version;
-      sha256 = "sha256-NuYPqJ/Fvt1P6KFXTIQaAvXYJgTwWrMspPags0Q06cE=";
+      sha256 = "sha256-lwLzMUMHwheZHrjPttdk6TFsjt8SymHkBMtXTbr/nYE=";
    };

    subPackages = [ "." ];

-    vendorSha256 = "sha256-u5YCwnciXlWgqQd9CXfXNipLLlNE3p8+bL6WaTvOkVA=";
+    vendorSha256 = "sha256-kEM6eCWTI+XKs58cVhNfjJsIwC3r1ATy1sFbjtorgGY=";

    doCheck = false;

--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "clojure";
-  version = "1.11.1.1161";
+  version = "1.11.1.1165";

  src = fetchurl {
    # https://clojure.org/releases/tools
    url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "sha256-B+NSIS1lHLqtLImY2gRYwYTrilJrbmDUvqd2H8UunA4=";
+    sha256 = "sha256-UXukXP6Dt1Clj4JGvO5WmuFJ2HJGkPLbyP8xhxU/6dE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/interpreters/janet/darwin-remove-net-test.patch
+++ b/pkgs/development/interpreters/janet/darwin-remove-net-test.patch
@ -1,20 +0,0 @@
-diff --git a/test/suite0009.janet b/test/suite0009.janet
-index 6095bc60..25360d60 100644
--- a/test/suite0009.janet
-+++ b/test/suite0009.janet
-@@ -174,15 +174,6 @@
-   (defer (:close stream)
-     (check-matching-names stream)))
- 
-# Test localname and peername
-(repeat 20
-  (with [s (net/server "127.0.0.1" "8000" names-handler)]
-    (defn test-names []
-      (with [conn (net/connect "127.0.0.1" "8000")]
-        (check-matching-names conn)))
-    (repeat 20 (test-names)))
-  (gccollect))
-
- # Create pipe
- 
- (var pipe-counter 0)
--- a/pkgs/development/interpreters/janet/default.nix
+++ b/pkgs/development/interpreters/janet/default.nix
@ -11,10 +11,6 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-uGbaoWJAWbSQ7QkocU7gFZUiWb0GD8mtuO7V0sUXTv0=";
  };

-  # This release fails the test suite on darwin, remove when debugged.
-  # See https://github.com/NixOS/nixpkgs/pull/150618 for discussion.
-  patches = lib.optionals stdenv.isDarwin ./darwin-remove-net-test.patch;
-
  postPatch = ''
    substituteInPlace janet.1 \
      --replace /usr/local/ $out/
@ -29,7 +25,7 @@ stdenv.mkDerivation rec {
  doInstallCheck = true;

  installCheckPhase = ''
-    $out/bin/janet --help
+    $out/bin/janet -e '(+ 1 2 3)'
  '';

  meta = with lib; {
@ -38,7 +34,5 @@ stdenv.mkDerivation rec {
    license = licenses.mit;
    maintainers = with maintainers; [ andrewchambers peterhoeg ];
    platforms = platforms.all;
-    # Marked as broken when patch is applied, see comment above patch.
-    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/development/libraries/cmark-gfm/default.nix
+++ b/pkgs/development/libraries/cmark-gfm/default.nix
@ -1,18 +1,18 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
  pname = "cmark-gfm";
-  version = "0.29.0.gfm.5";
+  version = "0.29.0.gfm.6";

  src = fetchFromGitHub {
    owner = "github";
    repo = "cmark-gfm";
    rev = version;
-    sha256 = "sha256-HNFxp62xBNo2GbWiiYXco2NMgoOXsnZNdbXgTK1i1JU=";
+    sha256 = "sha256-ekHY5EGSrJrQwlXNjKpyj7k0Bzq1dYPacRsfNZ8K+lk=";
  };

  nativeBuildInputs = [ cmake ];
-  # tests load the library dynamically which for unknown reason failed
-  doCheck = false;
+
+  doCheck = true;

  # remove when https://github.com/github/cmark-gfm/pull/248 merged and released
  postInstall = ''
--- a/pkgs/development/libraries/freexl/default.nix
+++ b/pkgs/development/libraries/freexl/default.nix
@ -0,0 +1,28 @@
+{ lib, stdenv, fetchurl, validatePkgConfig, libiconv }:
+
+stdenv.mkDerivation rec {
+  pname = "freexl";
+  version = "1.0.6";
+
+  src = fetchurl {
+    url = "https://www.gaia-gis.it/gaia-sins/freexl-${version}.tar.gz";
+    hash = "sha256-Pei1ej0TDLKIHqUtOqnOH+7bG1e32qTrN/dRQE+Q/CI=";
+  };
+
+  nativeBuildInputs = [ validatePkgConfig ];
+
+  buildInputs = lib.optional stdenv.isDarwin libiconv;
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "A library to extract valid data from within an Excel (.xls) spreadsheet";
+    homepage = "https://www.gaia-gis.it/fossil/freexl";
+    # They allow any of these
+    license = with licenses; [ gpl2Plus lgpl21Plus mpl11 ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ sikmir ];
+  };
+}
--- a/pkgs/development/libraries/libheif/default.nix
+++ b/pkgs/development/libraries/libheif/default.nix
@ -3,7 +3,7 @@

 stdenv.mkDerivation rec {
  pname = "libheif";
-  version = "1.12.0";
+  version = "1.13.0";

  outputs = [ "bin" "out" "dev" "man" ];

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    owner = "strukturag";
    repo = "libheif";
    rev = "v${version}";
-    sha256 = "sha256-RjGLaDSBO8T7ijRb5a16aUlkCy5vdFPs4O9caIJo4jI=";
+    sha256 = "sha256-/w/I6dgyiAscUqVpPjw2z6LbZJ6IBTeE5lawLg0awTM=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/development/libraries/librttopo/default.nix
+++ b/pkgs/development/libraries/librttopo/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitea
 , autoreconfHook
+, validatePkgConfig
 , geos
 }:

@ -19,14 +20,21 @@ stdenv.mkDerivation rec {
    sha256 = "0h7lzlkn9g4xky6h81ndy0aa6dxz8wb6rnl8v3987jy1i6pr072p";
  };

-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [
+    autoreconfHook
+    validatePkgConfig
+    geos # for geos-config
+  ];

  buildInputs = [ geos ];

+  enableParallelBuilding = true;
+
  meta = with lib; {
    description = "RT Topology Library";
    homepage = "https://git.osgeo.org/gitea/rttopo/librttopo";
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ dotlambda ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/libspatialite/default.nix
+++ b/pkgs/development/libraries/libspatialite/default.nix
@ -2,6 +2,8 @@
 , stdenv
 , fetchurl
 , pkg-config
+, validatePkgConfig
+, freexl
 , geos
 , librttopo
 , libxml2
@ -18,13 +20,18 @@ stdenv.mkDerivation rec {
  outputs = [ "out" "dev" ];

  src = fetchurl {
-    url = "https://www.gaia-gis.it/gaia-sins/libspatialite-sources/${pname}-${version}.tar.gz";
-    sha256 = "sha256-7svJQxHHgBLQWevA+uhupe9u7LEzA+boKzdTwbNAnpg=";
+    url = "https://www.gaia-gis.it/gaia-sins/libspatialite-${version}.tar.gz";
+    hash = "sha256-7svJQxHHgBLQWevA+uhupe9u7LEzA+boKzdTwbNAnpg=";
  };

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+    validatePkgConfig
+    geos # for geos-config
+  ];

  buildInputs = [
+    freexl
    geos
    librttopo
    libxml2
@ -35,14 +42,22 @@ stdenv.mkDerivation rec {
    libiconv
  ];

-  configureFlags = [ "--disable-freexl" ];
-
  enableParallelBuilding = true;

  postInstall = lib.optionalString stdenv.isDarwin ''
    ln -s $out/lib/mod_spatialite.{so,dylib}
  '';

+  # Failed tests (linux & darwin):
+  # - check_virtualtable6
+  # - check_drop_rename
+  doCheck = false;
+
+  preCheck = ''
+    export LD_LIBRARY_PATH=$(pwd)/src/.libs
+    export DYLD_LIBRARY_PATH=$(pwd)/src/.libs
+  '';
+
  meta = with lib; {
    description = "Extensible spatial index library in C++";
    homepage = "https://www.gaia-gis.it/fossil/libspatialite";
--- a/pkgs/development/libraries/liquid-dsp/default.nix
+++ b/pkgs/development/libraries/liquid-dsp/default.nix
@ -1,4 +1,9 @@
-{lib, stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, cctools
+}:

 stdenv.mkDerivation rec {
  pname = "liquid-dsp";
@ -11,10 +16,10 @@ stdenv.mkDerivation rec {
    sha256 = "0mr86z37yycrqwbrmsiayi1vqrgpjq0pn1c3p1qrngipkw45jnn0";
  };

-  nativeBuildInputs = [ autoreconfHook ];
+  configureFlags = lib.optionals stdenv.isDarwin [ "LIBTOOL=${cctools}/bin/libtool" ];
+  nativeBuildInputs = [ autoreconfHook ] ++ lib.optionals stdenv.isDarwin [ cctools ];

  meta = {
-    broken = stdenv.isDarwin;
    homepage = "https://liquidsdr.org/";
    description = "Digital signal processing library for software-defined radios";
    license = lib.licenses.mit;
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@ -5,6 +5,6 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert

 import ./generic.nix {
-  version = "3.82";
-  hash = "sha256-Mr9nO3LC+ZU+07THAzq/WmytMChUokrliMV1plZ8FXM=";
+  version = "3.83";
+  hash = "sha256-qyPqZ/lkCQuLc8gKZ0CCVxw25fTrqSBXrGSMnB3vASg=";
 }
--- a/pkgs/development/libraries/physics/geant4/default.nix
+++ b/pkgs/development/libraries/physics/geant4/default.nix
@ -47,12 +47,12 @@ in
 lib.warnIf (enableQT != false) "geant4: enableQT is deprecated, please use enableQt"

 stdenv.mkDerivation rec {
-  version = "11.0.2";
+  version = "11.0.3";
  pname = "geant4";

  src = fetchurl{
    url = "https://cern.ch/geant4-data/releases/geant4-v${version}.tar.gz";
-    hash = "sha256-/AONuDcxL3Tj+O/RC108qHqZnUg9TYlZxguKdJIh7GE=";
+    hash = "sha256-cvi2h1EtbmMNxsZMXEG6cRIgRoVAEymZ0A5PzhkIrkg=";
  };

  cmakeFlags = [
--- a/pkgs/development/libraries/readosm/default.nix
+++ b/pkgs/development/libraries/readosm/default.nix
@ -1,24 +1,26 @@
-{ lib, stdenv, fetchurl, expat, zlib, geos, libspatialite }:
+{ lib, stdenv, fetchurl, expat, zlib, validatePkgConfig }:

 stdenv.mkDerivation rec {
  pname = "readosm";
  version = "1.1.0a";

  src = fetchurl {
-    url = "https://www.gaia-gis.it/gaia-sins/readosm-sources/${pname}-${version}.tar.gz";
-    sha256 = "0igif2bxf4dr82glxz9gyx5mmni0r2dsnx9p9k6pxv3c4lfhaz6v";
+    url = "https://www.gaia-gis.it/gaia-sins/readosm-${version}.tar.gz";
+    hash = "sha256-23wFHSVs7H7NTDd1q5vIINpaS/cv/U6fQLkR15dw8UU=";
  };

-  buildInputs = [ expat zlib geos libspatialite ];
+  nativeBuildInputs = [ validatePkgConfig ];

-  configureFlags = [ "--disable-freexl" ];
+  buildInputs = [ expat zlib ];

  enableParallelBuilding = true;

-  meta = {
+  doCheck = true;
+
+  meta = with lib; {
    description = "An open source library to extract valid data from within an Open Street Map input file";
    homepage = "https://www.gaia-gis.it/fossil/readosm";
-    license = with lib.licenses; [ mpl11 gpl2Plus lgpl21Plus ];
-    platforms = lib.platforms.linux;
+    license = with licenses; [ mpl11 gpl2Plus lgpl21Plus ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/sqlitecpp/default.nix
+++ b/pkgs/development/libraries/sqlitecpp/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "sqlitecpp";
-  version = "3.1.1";
+  version = "3.2.0";

  src = fetchFromGitHub {
    owner = "SRombauts";
    repo = pname;
    rev = version;
-    sha256 = "1c2yyipiqswi5sf9xmpsgw6l1illzmcpkjm56agk6kl2hay23lgr";
+    sha256 = "sha256-Z1c2lQZ0UltcIf9dTnumZPhke4uEmsjg/Ygppvx3kxY=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/vapoursynth/default.nix
+++ b/pkgs/development/libraries/vapoursynth/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "vapoursynth";
-  version = "59";
+  version = "60";

  src = fetchFromGitHub {
    owner  = "vapoursynth";
    repo   = "vapoursynth";
    rev    = "R${version}";
-    sha256 = "sha256-6w7GSC5ZNIhLpulni4sKq0OvuxHlTJRilBFGH5PQW8U=";
+    sha256 = "sha256-E1uHNcGxBrwg00tNnY3qH6BpvXtBEGkX7QFy0aMLSnA=";
  };

  patches = [
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@ -7,19 +7,22 @@

 stdenv.mkDerivation rec {
  pname = "wolfssl";
-  version = "5.4.0";
+  version = "5.5.0";

  src = fetchFromGitHub {
    owner = "wolfSSL";
    repo = "wolfssl";
    rev = "v${version}-stable";
-    sha256 = "sha256-5a83Mi+S+mASdZ6O2+0I+qulsF6yNUe80a3qZvWmXHw=";
+    sha256 = "sha256-PqxwWPK5eBcS5d6e0CL4uZHybDye1K8pxniKU99YSAE=";
  };

  postPatch = ''
    patchShebangs ./scripts
    # ocsp tests require network access
    sed -i -e '/ocsp\.test/d' -e '/ocsp-stapling\.test/d' scripts/include.am
+    # ensure test detects musl-based systems too
+    substituteInPlace scripts/ocsp-stapling2.test \
+      --replace '"linux-gnu"' '"linux-"'
  '';

  # Almost same as Debian but for now using --enable-all --enable-reproducible-build instead of --enable-distro to ensure options.h gets installed
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@ -9,6 +9,7 @@
  coffee-script = "coffee";
  typescript = "tsc";
  vue-cli = "vue";
+  "@withgraphite/graphite-cli" = "gt";

  # Packages that provide a single executable whose name differs from the package's `name`.
  "@angular/cli" = "ng";
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -378,7 +378,6 @@
 , "vscode-json-languageserver"
 , "vscode-json-languageserver-bin"
 , "vscode-langservers-extracted"
-, { "vscode-lldb-build-deps": "../../applications/editors/vscode/extensions/vscode-lldb/build-deps" }
 , "vue-cli"
 , "vue-language-server"
 , "wavedrom-cli"
@ -388,6 +387,7 @@
 , "webpack-dev-server"
 , "copy-webpack-plugin"
 , "webtorrent-cli"
+, "@withgraphite/graphite-cli"
 , "wrangler"
 , "wring"
 , "write-good"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@ -167,6 +167,10 @@ final: prev: {
    meta = oldAttrs.meta // { broken = since "10"; };
  });

+  graphite-cli = prev."@withgraphite/graphite-cli".override {
+    name = "graphite-cli";
+  };
+
  graphql-language-service-cli = prev.graphql-language-service-cli.override {
    nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
    postInstall = ''
--- a/pkgs/development/ocaml-modules/checkseum/default.nix
+++ b/pkgs/development/ocaml-modules/checkseum/default.nix
@ -1,27 +1,24 @@
 { lib, fetchurl, buildDunePackage, ocaml, dune-configurator, pkg-config
-, bigarray-compat, optint
+, optint
 , fmt, rresult, bos, fpath, astring, alcotest
 , withFreestanding ? false
 , ocaml-freestanding
 }:

 buildDunePackage rec {
-  version = "0.3.2";
+  version = "0.3.4";
  pname = "checkseum";

-  useDune2 = true;
-
-  minimumOCamlVersion = "4.07";
+  minimalOCamlVersion = "4.07";

  src = fetchurl {
-    url = "https://github.com/mirage/checkseum/releases/download/v${version}/checkseum-v${version}.tbz";
-    sha256 = "9cdd282ea1cfc424095d7284e39e4d0ad091de3c3f2580539d03f6966d45ccd5";
+    url = "https://github.com/mirage/checkseum/releases/download/v${version}/checkseum-${version}.tbz";
+    sha256 = "sha256-BL4BOwxXORrkOOba4QjRSetm8bF9JmlKHSFPq24+1zg=";
  };

  buildInputs = [ dune-configurator ];
  nativeBuildInputs = [ pkg-config ];
  propagatedBuildInputs = [
-    bigarray-compat
    optint
  ] ++ lib.optionals withFreestanding [
    ocaml-freestanding
--- a/pkgs/development/ocaml-modules/h2/default.nix
+++ b/pkgs/development/ocaml-modules/h2/default.nix
@ -28,10 +28,9 @@ buildDunePackage rec {
  inherit (hpack)
    version
    src
-    useDune2
    ;

-  minimumOCamlVersion = "4.06";
+  minimalOCamlVersion = "4.06";

  propagatedBuildInputs = [
    angstrom
@ -42,7 +41,7 @@ buildDunePackage rec {
    httpaf
  ];

-  # Tests fail with 4.06
+  # Tests fail with ≤ 4.07
  doCheck = lib.versionAtLeast ocaml.version "4.08";
  preCheck = ''
    ln -s "${http2-frame-test-case}" lib_test/http2-frame-test-case
--- a/pkgs/development/ocaml-modules/happy-eyeballs/lwt.nix
+++ b/pkgs/development/ocaml-modules/happy-eyeballs/lwt.nix
@ -0,0 +1,26 @@
+{ buildDunePackage
+, happy-eyeballs
+, cmdliner
+, dns-client
+, logs
+, lwt
+}:
+
+buildDunePackage {
+  pname = "happy-eyeballs-lwt";
+  inherit (happy-eyeballs) src version;
+
+  buildInputs = [ cmdliner ];
+
+  propagatedBuildInputs = [
+    dns-client
+    happy-eyeballs
+    logs
+    lwt
+  ];
+
+  meta = happy-eyeballs.meta // {
+    description = "Connecting to a remote host via IP version 4 or 6 using Lwt_unix";
+  };
+
+}
--- a/pkgs/development/ocaml-modules/happy-eyeballs/mirage.nix
+++ b/pkgs/development/ocaml-modules/happy-eyeballs/mirage.nix
@ -0,0 +1,25 @@
+{ buildDunePackage
+, happy-eyeballs
+, dns-client
+, logs
+, lwt
+, tcpip
+}:
+
+buildDunePackage {
+  pname = "happy-eyeballs-mirage";
+  inherit (happy-eyeballs) src version;
+
+  propagatedBuildInputs = [
+    dns-client
+    happy-eyeballs
+    logs
+    lwt
+    tcpip
+  ];
+
+  meta = happy-eyeballs.meta // {
+    description = "Connecting to a remote host via IP version 4 or 6 using Mirage";
+  };
+
+}
--- a/pkgs/development/ocaml-modules/hpack/default.nix
+++ b/pkgs/development/ocaml-modules/hpack/default.nix
@ -7,15 +7,14 @@

 buildDunePackage rec {
  pname = "hpack";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchurl {
    url = "https://github.com/anmonteiro/ocaml-h2/releases/download/${version}/h2-${version}.tbz";
-    sha256 = "0qcn3yvyz0h419fjg9nb20csfmwmh3ihz0zb0jfzdycf5w4mlry6";
+    sha256 = "sha256-7gjRhJs2mufQbImAXiKFT9mZ1kHGSHHwjCVZM5f0C14=";
  };

-  useDune2 = true;
-  minimumOCamlVersion = "4.04";
+  minimalOCamlVersion = "4.04";

  propagatedBuildInputs = [
    angstrom
--- a/pkgs/development/ocaml-modules/ogg/default.nix
+++ b/pkgs/development/ocaml-modules/ogg/default.nix
@ -2,17 +2,17 @@

 buildDunePackage rec {
  pname = "ogg";
-  version = "0.7.2";
-
-  useDune2 = true;
+  version = "0.7.3";

  src = fetchFromGitHub {
    owner = "savonet";
    repo = "ocaml-ogg";
    rev = "v${version}";
-    sha256 = "sha256-EY1iVtB5M8//KJPT9FMDYVeBrE/lT30fCqTjjKKnWZU=";
+    sha256 = "sha256-D6tLKBSGfWBoMfQrWmamd8jo2AOphJV9xeSm+l06L5c=";
  };

+  minimalOCamlVersion = "4.08";
+
  buildInputs = [ dune-configurator ];
  propagatedBuildInputs = [ libogg ];

--- a/pkgs/development/ocaml-modules/paf/cohttp.nix
+++ b/pkgs/development/ocaml-modules/paf/cohttp.nix
@ -22,8 +22,6 @@ buildDunePackage {
  inherit (paf)
    version
    src
-    useDune2
-    minimumOCamlVersion
  ;

  propagatedBuildInputs = [
@ -34,7 +32,7 @@ buildDunePackage {
    ipaddr
  ];

-  doCheck = false;  # tests fail
+  doCheck = true;
  checkInputs = [
    alcotest-lwt
    fmt
--- a/pkgs/development/ocaml-modules/paf/default.nix
+++ b/pkgs/development/ocaml-modules/paf/default.nix
@ -25,15 +25,14 @@

 buildDunePackage rec {
  pname = "paf";
-  version = "0.0.8";
+  version = "0.1.0";

  src = fetchurl {
    url = "https://github.com/dinosaure/paf-le-chien/releases/download/${version}/paf-${version}.tbz";
-    sha256 = "CyIIV11G7oUPPHuhov52LP4Ih4pY6bcUApD23/9q39k=";
+    sha256 = "sha256-JIJjECEbajauowbXot19vtiDhTpGAQiSCBY0AHZOyZM=";
  };

-  useDune2 = true;
-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.08";

  propagatedBuildInputs = [
    mirage-stack
@ -49,7 +48,7 @@ buildDunePackage rec {
    tcpip
  ];

-  doCheck = false;
+  doCheck = true;
  checkInputs = [
    lwt
    logs
--- a/pkgs/development/ocaml-modules/paf/le.nix
+++ b/pkgs/development/ocaml-modules/paf/le.nix
@ -17,8 +17,6 @@ buildDunePackage {
  inherit (paf)
    version
    src
-    useDune2
-    minimumOCamlVersion
  ;

  propagatedBuildInputs = [
--- a/pkgs/development/ocaml-modules/sedlex/default.nix
+++ b/pkgs/development/ocaml-modules/sedlex/default.nix
@ -9,20 +9,20 @@
 }:

 let
-  unicodeVersion = "14.0.0";
+  unicodeVersion = "15.0.0";
  baseUrl = "https://www.unicode.org/Public/${unicodeVersion}";

  DerivedCoreProperties = fetchurl {
    url = "${baseUrl}/ucd/DerivedCoreProperties.txt";
-    sha256 = "sha256:1g77s8g9443dd92f82pbkim7rk51s7xdwa3mxpzb1lcw8ryxvvg3";
+    sha256 = "sha256-02cpC8CGfmtITGg3BTC90aCLazJARgG4x6zK+D4FYo0=";
  };
  DerivedGeneralCategory = fetchurl {
    url = "${baseUrl}/ucd/extracted/DerivedGeneralCategory.txt";
-    sha256 = "sha256:080l3bwwppm7gnyga1hzhd07b55viklimxpdsx0fsxhr8v47krnd";
+    sha256 = "sha256-/imkXAiCUA5ZEUCqpcT1Bn5qXXRoBhSK80QAxIucBvk=";
  };
  PropList = fetchurl {
    url = "${baseUrl}/ucd/PropList.txt";
-    sha256 = "sha256:08k75jzl7ws9l3sm1ywsj24qa4qvzn895wggdpp5nyj1a2wgvpbb";
+    sha256 = "sha256-4FwKKBHRE9rkq9gyiEGZo+qNGH7huHLYJAp4ipZUC/0=";
  };
 in
 buildDunePackage rec {
--- a/pkgs/development/ocaml-modules/tcpip/default.nix
+++ b/pkgs/development/ocaml-modules/tcpip/default.nix
@ -13,13 +13,13 @@

 buildDunePackage rec {
  pname = "tcpip";
-  version = "7.1.0";
+  version = "7.1.2";

  useDune2 = true;

  src = fetchurl {
    url = "https://github.com/mirage/mirage-${pname}/releases/download/v${version}/${pname}-${version}.tbz";
-    sha256 = "sha256-4nd2OVZa4w22I4bgglnS8lrNfjTk40PL5n6Oh6n+osw=";
+    sha256 = "sha256-lraur6NfFD9yddG+y21jlHKt82gLgYBBbedltlgcRm0=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/ocaml-modules/uucd/default.nix
+++ b/pkgs/development/ocaml-modules/uucd/default.nix
@ -6,11 +6,11 @@ let
 in
 stdenv.mkDerivation rec {
  name = "ocaml-${pname}-${version}";
-  version = "14.0.0";
+  version = "15.0.0";

  src = fetchurl {
    url = "${webpage}/releases/${pname}-${version}.tbz";
-    sha256 = "sha256:0fc737v5gj3339jx4x9xr096lxrpwvp6vaiylhavcvsglcwbgm30";
+    sha256 = "sha256-DksDi6Dfe/fNGBmeubwxv9dScTHPJRuaPrlX7M8QRrw=";
  };

  nativeBuildInputs = [ ocaml findlib ocamlbuild topkg ];
--- a/pkgs/development/ocaml-modules/uucp/default.nix
+++ b/pkgs/development/ocaml-modules/uucp/default.nix
@ -2,7 +2,7 @@

 let
  pname = "uucp";
-  version = "14.0.0";
+  version = "15.0.0";
  webpage = "https://erratique.ch/software/${pname}";
  minimumOCamlVersion = "4.03";
  doCheck = true;
@ -18,7 +18,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "${webpage}/releases/${pname}-${version}.tbz";
-    sha256 = "sha256:1yx9nih3d9prb9zizq8fzmmqylf24a6yifhf81h33znrj5xn1mpj";
+    sha256 = "sha256-rEeU9AWpCzuAtAOe7hJHBmJjP97BZsQsPFQQ8uZLUzA=";
  };

  nativeBuildInputs = [ ocaml findlib ocamlbuild topkg ];
--- a/pkgs/development/ocaml-modules/uuseg/default.nix
+++ b/pkgs/development/ocaml-modules/uuseg/default.nix
@ -1,4 +1,6 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, uucp, uutf, cmdliner }:
+{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, uucp, uutf, cmdliner
+, cmdlinerSupport ? lib.versionAtLeast cmdliner.version "1.1"
+}:

 let
  pname = "uuseg";
@ -8,20 +10,29 @@ in
 stdenv.mkDerivation rec {

  name = "ocaml${ocaml.version}-${pname}-${version}";
-  version = "14.0.0";
+  version = "15.0.0";

  src = fetchurl {
    url = "${webpage}/releases/${pname}-${version}.tbz";
-    sha256 = "sha256:1g9zyzjkhqxgbb9mh3cgaawscwdazv6y8kdqvmy6yhnimmfqv25p";
+    sha256 = "sha256-q8x3bia1QaKpzrWFxUmLWIraKqby7TuPNGvbSjkY4eM=";
  };

  nativeBuildInputs = [ ocaml findlib ocamlbuild topkg ];
-  buildInputs = [  topkg cmdliner  uutf ];
+  buildInputs = [  topkg uutf ]
+  ++ lib.optional cmdlinerSupport cmdliner;
  propagatedBuildInputs = [ uucp ];

  strictDeps = true;

-  inherit (topkg) buildPhase installPhase;
+  buildPhase = ''
+    runHook preBuild
+    ${topkg.run} build \
+      --with-uutf true \
+      --with-cmdliner ${lib.boolToString cmdlinerSupport}
+    runHook postBuild
+  '';
+
+  inherit (topkg) installPhase;

  meta = with lib; {
    description = "An OCaml library for segmenting Unicode text";
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.15";
+  version = "9.2.18";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-CXJ9UVTrJzXumDJ6wghDbxVfZo9ZC67qBpz8B5D0DLo=";
+    hash = "sha256-9l1TlJwwmc51z+Dwl8uDNlUSOhGaI1bIMoqokaT/IFE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aioitertools/default.nix
+++ b/pkgs/development/python-modules/aioitertools/default.nix
@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchpatch
 , fetchPypi
-, pythonAtLeast
 , pythonOlder

 # native
@ -17,14 +16,14 @@

 buildPythonPackage rec {
  pname = "aioitertools";
-  version = "0.10.0";
+  version = "0.11.0";
  format = "pyproject";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-fR0dSgPUYsWghAeH098JjxJYR+DTi4M7MPj4y8RaFCA=";
+    hash = "sha256-QsaLjdOmnCv38iM7999LtYtVe8pSUqwC7VGHu8Z9aDE=";
  };

  nativeBuildInputs = [
@ -45,8 +44,8 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Implementation of itertools, builtins, and more for AsyncIO and mixed-type iterables";
+    homepage = "https://aioitertools.omnilib.dev/";
    license = licenses.mit;
-    homepage = "https://pypi.org/project/aioitertools/";
    maintainers = with maintainers; [ teh ];
  };
 }
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -46,7 +46,7 @@ in

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.15";
+  version = "9.2.18";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -55,7 +55,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-9KWk4uB7VlYsnQbDCRgnVkis0UAZfiI2xH9cAD1Dd7M=";
+    hash = "sha256-wy+0VojvgRjIkiPxnJN+r3R4dkIqhHCP/jZqurf+1CY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/angrop/default.nix
+++ b/pkgs/development/python-modules/angrop/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "angrop";
-  version = "9.2.6";
+  version = "9.2.7";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-qaDAicmYZxLPTl17il61ij01prRv2H4xxe07Xg4KWhI=";
+    hash = "sha256-wIPk7Cz7FSPviPFBSLrBjLr9M0o3pyoJM7wiAhHrg9Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/ansible-doctor/default.nix
+++ b/pkgs/development/python-modules/ansible-doctor/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "ansible-doctor";
-  version = "1.4.1";
+  version = "1.4.4";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "thegeeklab";
    repo = "ansible-doctor";
    rev = "refs/tags/v${version}";
-    hash = "sha256-kfBEV3PXU+C7FD9xiBMvdamb3b2KXp+Qi23/xUnoXHM=";
+    hash = "sha256-blCBlSCp7W6tlCa5381ex7yq37iY9v6u7ITHmJEUxl0=";
  };

  nativeBuildInputs = [
@ -52,13 +52,9 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace 'version = "0.0.0"' 'version = "${version}"' \
-      --replace 'Jinja2 = "3.1.2"' 'Jinja2 = "*"' \
-      --replace 'anyconfig = "0.13.0"' 'anyconfig = "*"' \
-      --replace 'environs = "9.5.0"' 'environs = "*"' \
-      --replace 'jsonschema = "4.6.0"' 'jsonschema = "*"' \
-      --replace '"ruamel.yaml" = "0.17.21"' '"ruamel.yaml" = "*"' \
-      --replace 'python-json-logger = "2.0.2"' 'python-json-logger = "*"'
+      --replace 'jsonschema = "4.15.0"' 'jsonschema = "*"' \
+      --replace 'nested-lookup = "0.2.25"' 'nested-lookup = "*"' \
+      --replace 'pathspec = "0.10.1"' 'pathspec = "*"'
  '';

  # Module has no tests
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.15";
+  version = "9.2.18";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-K9EAyCvwgWhiZ+rkPKPGBr3lWYIIRCf0FAzPjIjrcU8=";
+    hash = "sha256-atLc02FoW2cmlvA/jzRsOeXEY9cyrSeLSl3+pO5nNKA=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/beartype/default.nix
+++ b/pkgs/development/python-modules/beartype/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "beartype";
-  version = "0.10.4";
+  version = "0.11.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-JOxp9qf05ul69APQjeJw3vMkhRgGAycJXSOxxN9kvyo=";
+    hash = "sha256-OFS1Dqqpi7iUkL5X5zxpx3eg8wRXTnBDrH2pisanNaY=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "boschshcpy";
-  version = "0.2.32";
+  version = "0.2.34";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "tschamm";
    repo = pname;
    rev = version;
-    sha256 = "sha256-tJlgmxa6HppLLTs4ZggnJ5H6NOH3v+C9pUfLBmxr4XY=";
+    sha256 = "sha256-GVJw0ugvzP7gGOhaV03JxWGUlStnedbRVV1+S7BDU/w=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.15";
+  version = "9.2.18";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-3v5te+j3I4yzxoBO8kY8VGLCrWfb1iOz9GHzun1DT0I=";
+    hash = "sha256-LhLRuEHhNdr7WSnsbfv0ol+/MbEq+rAdw5UjxY/i9b8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -15,7 +15,7 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.15";
+  version = "9.2.18";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
@ -37,7 +37,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-vGIthytW0gZy0X2OXuFwdBnPuvcWkV47FeaXZY8FCVc=";
+    hash = "sha256-hg6G07rSPRFGBaJdJduDqb7BVGt/sZtCA4I0Hhl4wfw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/cocotb/default.nix
+++ b/pkgs/development/python-modules/cocotb/default.nix
@ -1,7 +1,7 @@
 { lib
 , stdenv
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , setuptools
 , setuptools-scm
 , cocotb-bus
@ -12,15 +12,14 @@

 buildPythonPackage rec {
  pname = "cocotb";
-  version = "1.6.2";
+  version = "1.7.1";

-  # - we need to use the tarball from PyPi
-  #   or the full git checkout (with .git)
-  # - using fetchFromGitHub will cause a build failure,
-  #   because it does not include required metadata
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-SY+1727DbWMg6CnmHw8k/VP0dwBRYszn+YyyvZXgvUs=";
+  # pypi source doesn't include tests
+  src = fetchFromGitHub {
+    owner = "cocotb";
+    repo = "cocotb";
+    rev = "v${version}";
+    sha256 = "sha256-wACgT5r0YmSYvLhTsuFhTcJqeCtGGLifOmr7/Lz2Vug=";
  };

  nativeBuildInputs = [ setuptools-scm ];
@ -52,11 +51,13 @@ buildPythonPackage rec {
  ];

  checkInputs = [ cocotb-bus pytestCheckHook swig verilog ];
-
-  checkPhase = ''
+  preCheck = ''
    export PATH=$out/bin:$PATH
+    mv cocotb cocotb.hidden
  '';

+  pythonImportsCheck = [ "cocotb" ];
+
  meta = with lib; {
    description = "Coroutine based cosimulation library for writing VHDL and Verilog testbenches in Python";
    homepage = "https://github.com/cocotb/cocotb";
--- a/pkgs/development/python-modules/dask-image/default.nix
+++ b/pkgs/development/python-modules/dask-image/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "dask-image";
-  version = "2021.12.0";
+  version = "2022.9.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Nb5JYmvQHD44khKBJqJ9XuMmahmKjjx+MNWervcS/Pk=";
+    hash = "sha256-8SPf0Wp9FcdmYqasFHeFCe1e7ZtJT0Mi5ZRemxWSNUc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/forecast-solar/default.nix
+++ b/pkgs/development/python-modules/forecast-solar/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "forecast-solar";
-  version = "2.2.0";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "home-assistant-libs";
    repo = "forecast_solar";
-    rev = version;
-    sha256 = "sha256-2gex50QEN55uUa8SfAQA7iDZ3SVnpOTXfD3Sxq7KvNw=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-1xRbTOeBHzLmf0FJwsrg/4+Z2Fs7uwbQwS2Tm41mNRk=";
  };

  PACKAGE_VERSION = version;
--- a/pkgs/development/python-modules/google-cloud-asset/default.nix
+++ b/pkgs/development/python-modules/google-cloud-asset/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-asset";
-  version = "3.13.0";
+  version = "3.13.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-UWy6dC1a9712pxT43JNP2CAbtXUFi2olvEm1eLw+z0g=";
+    hash = "sha256-FEgsqN1rgkryreNNotwzfErYAdwAjiJ9M7TfVJtQXUc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
+++ b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-securitycenter";
-  version = "1.15.0";
+  version = "1.16.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-rWV7lY0CHrVJFOA/Yix/o3OE++wKSK5EEXOV6o5lwIo=";
+    hash = "sha256-LuC8zMJP4SF/pOUSmA0TV/U/12bo9Wg+UYxdpHaGFfM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@ -14,11 +14,11 @@

 buildPythonPackage rec {
  pname = "google-cloud-spanner";
-  version = "3.19.0";
+  version = "3.20.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-QGigxsIrIF/ey1hL5wTdo1Z6VqRQQX4vpgen1HgzaiQ=";
+    sha256 = "sha256-3KnpesMoqjjXgHjHihLN8cnYjtO07sbjHL1G4ZyInZ8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-vision/default.nix
+++ b/pkgs/development/python-modules/google-cloud-vision/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-vision";
-  version = "3.1.1";
+  version = "3.1.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-X8YR2tTEgcYeN6j4VfXa4AaU+uRbxabWQydc0UYXFbI=";
+    hash = "sha256-ZPuKE2GNUWD26nR+dlKAVDpQViCTCFyx+8W/448MgX4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "holidays";
-  version = "0.15";
+  version = "0.16";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-vfRsiuLvGO9bOoDgoY+OLVxDw0dW6siTDGKNxI1R3g4=";
+    hash = "sha256-HX9P1rGYApj7uzMWsNV/pvFbUxMHTNrMEqOrk788pc0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/hvac/default.nix
+++ b/pkgs/development/python-modules/hvac/default.nix
@ -8,11 +8,11 @@

 buildPythonPackage rec {
  pname = "hvac";
-  version = "0.11.2";
+  version = "1.0.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "f905c59d32d88d3f67571fe5a8a78de4659e04798ad809de439f667247d13626";
+    sha256 = "sha256-5AKMXA7Me3/PalTSkPmSQOWrzbn/5ELRwU8GExDUxhw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/mechanicalsoup/default.nix
+++ b/pkgs/development/python-modules/mechanicalsoup/default.nix
@ -1,27 +1,28 @@
 { lib
 , beautifulsoup4
 , buildPythonPackage
-, pythonAtLeast
 , fetchFromGitHub
 , lxml
 , pytest-httpbin
 , pytest-mock
 , pytestCheckHook
+, pythonOlder
 , requests
 , requests-mock
 }:

 buildPythonPackage rec {
  pname = "mechanicalsoup";
-  version = "1.1.0";
+  version = "1.2.0";
+  format = "setuptools";

-  disabled = ! pythonAtLeast "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "MechanicalSoup";
    repo = "MechanicalSoup";
    rev = "v${version}";
-    sha256 = "1mly0ivai3rx64frk7a7ra6abhdxm9x3l6s6x7sgrl9qx1z8zsp3";
+    hash = "sha256-Q5oDAgAZYYUYqjDByXNXFNVKmRyjzIGVE4LN9j8vk4c=";
  };

  propagatedBuildInputs = [
@ -45,7 +46,9 @@ buildPythonPackage rec {
      --replace " --cov --cov-config .coveragerc --flake8" ""
  '';

-  pythonImportsCheck = [ "mechanicalsoup" ];
+  pythonImportsCheck = [
+    "mechanicalsoup"
+  ];

  meta = with lib; {
    description = "Python library for automating interaction with websites";
--- a/pkgs/development/python-modules/miniupnpc/default.nix
+++ b/pkgs/development/python-modules/miniupnpc/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi }:
+{ stdenv, lib, buildPythonPackage, fetchPypi, cctools, which }:

 buildPythonPackage rec {
  pname = "miniupnpc";
@ -9,8 +9,9 @@ buildPythonPackage rec {
    sha256 = "0ca94zz7sr2x57j218aypxqcwkr23n8js30f3yrvvqbg929nr93y";
  };

+  nativeBuildInputs = lib.optionals stdenv.isDarwin [ cctools which ];
+
  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "miniUPnP client";
    homepage = "http://miniupnp.free.fr/";
    license = licenses.mit;
--- a/Show More
+++ b/Show More