Merge staging-next into staging

2024-02-26 00:02:38 +00:00 · 2024-02-26 00:02:38 +00:00 · 08da949b49
commit 08da949b49
parent ebd604f240 6ef5b1bc23
37 changed files with 555 additions and 304 deletions
--- a/flake.nix
+++ b/flake.nix
@ -27,7 +27,19 @@
              # We set it to null, to remove the "legacy" entrypoint's
              # non-hermetic default.
              system = null;
-            } // args
+
+              modules = args.modules ++ [
+                # This module is injected here since it exposes the nixpkgs self-path in as
+                # constrained of contexts as possible to avoid more things depending on it and
+                # introducing unnecessary potential fragility to changes in flakes itself.
+                #
+                # See: failed attempt to make pkgs.path not copy when using flakes:
+                # https://github.com/NixOS/nixpkgs/pull/153594#issuecomment-1023287913
+                ({ config, pkgs, lib, ... }: {
+                  config.nixpkgs.flake.source = self.outPath;
+                })
+              ];
+            } // builtins.removeAttrs args [ "modules" ]
          );
      });

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1743,6 +1743,12 @@
    githubId = 113123021;
    name = "Ashvith Shetty";
  };
+  asininemonkey = {
+    email = "nixpkgs@asininemonkey.com";
+    github = "asininemonkey";
+    githubId = 65740649;
+    name = "Jose Cardoso";
+  };
  aske = {
    email = "aske@fmap.me";
    github = "aske";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -20,6 +20,14 @@ In addition to numerous new and upgraded packages, this release has the followin
   - This can be disabled through the `environment.stub-ld.enable` option.
   - If you use `programs.nix-ld.enable`, no changes are needed. The stub will be disabled automatically.

+- On flake-based NixOS configurations using `nixpkgs.lib.nixosSystem`, NixOS will automatically set `NIX_PATH` and the system-wide flake registry (`/etc/nix/registry.json`) to point `<nixpkgs>` and the unqualified flake path `nixpkgs` to the version of nixpkgs used to build the system.
+
+  This makes `nix run nixpkgs#hello` and `nix-build '<nixpkgs>' -A hello` work out of the box with no added configuration, reusing dependencies already on the system.
+
+  This may be undesirable if nix commands are not going to be run on the built system since it adds nixpkgs to the system closure. For such closure-size-constrained non-interactive systems, this setting should be disabled.
+
+  To disable this, set [nixpkgs.flake.setNixPath](#opt-nixpkgs.flake.setNixPath) and [nixpkgs.flake.setFlakeRegistry](#opt-nixpkgs.flake.setFlakeRegistry) to false.
+
 - Julia environments can now be built with arbitrary packages from the ecosystem using the `.withPackages` function. For example: `julia.withPackages ["Plots"]`.

 - A new option `systemd.sysusers.enable` was added. If enabled, users and
--- a/nixos/modules/hardware/printers.nix
+++ b/nixos/modules/hardware/printers.nix
@ -2,18 +2,23 @@
 with lib;
 let
  cfg = config.hardware.printers;
-  ppdOptionsString = options: optionalString (options != {})
-    (concatStringsSep " "
-      (mapAttrsToList (name: value: "-o '${name}'='${value}'") options)
-    );
-  ensurePrinter = p: ''
-    ${pkgs.cups}/bin/lpadmin -p '${p.name}' -E \
-      ${optionalString (p.location != null) "-L '${p.location}'"} \
-      ${optionalString (p.description != null) "-D '${p.description}'"} \
-      -v '${p.deviceUri}' \
-      -m '${p.model}' \
-      ${ppdOptionsString p.ppdOptions}
+
+  ensurePrinter = p: let
+    args = cli.toGNUCommandLineShell {} ({
+      p = p.name;
+      v = p.deviceUri;
+      m = p.model;
+    } // optionalAttrs (p.location != null) {
+      L = p.location;
+    } // optionalAttrs (p.description != null) {
+      D = p.description;
+    } // optionalAttrs (p.ppdOptions != {}) {
+      o = mapAttrsToList (name: value: "'${name}'='${value}'") p.ppdOptions;
+    });
+  in ''
+    ${pkgs.cups}/bin/lpadmin ${args} -E
  '';
+
  ensureDefaultPrinter = name: ''
    ${pkgs.cups}/bin/lpadmin -d '${name}'
  '';
--- a/nixos/modules/misc/nixpkgs-flake.nix
+++ b/nixos/modules/misc/nixpkgs-flake.nix
@ -0,0 +1,105 @@
+{ config, options, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.nixpkgs.flake;
+in
+{
+  options.nixpkgs.flake = {
+    source = mkOption {
+      # In newer Nix versions, particularly with lazy trees, outPath of
+      # flakes becomes a Nix-language path object. We deliberately allow this
+      # to gracefully come through the interface in discussion with @roberth.
+      #
+      # See: https://github.com/NixOS/nixpkgs/pull/278522#discussion_r1460292639
+      type = types.nullOr (types.either types.str types.path);
+
+      default = null;
+      defaultText = "if (using nixpkgsFlake.lib.nixosSystem) then self.outPath else null";
+
+      example = ''builtins.fetchTarball { name = "source"; sha256 = "${lib.fakeHash}"; url = "https://github.com/nixos/nixpkgs/archive/somecommit.tar.gz"; }'';
+
+      description = mdDoc ''
+        The path to the nixpkgs sources used to build the system. This is automatically set up to be
+        the store path of the nixpkgs flake used to build the system if using
+        `nixpkgs.lib.nixosSystem`, and is otherwise null by default.
+
+        This can also be optionally set if the NixOS system is not built with a flake but still uses
+        pinned sources: set this to the store path for the nixpkgs sources used to build the system,
+        as may be obtained by `builtins.fetchTarball`, for example.
+
+        Note: the name of the store path must be "source" due to
+        <https://github.com/NixOS/nix/issues/7075>.
+      '';
+    };
+
+    setNixPath = mkOption {
+      type = types.bool;
+
+      default = cfg.source != null;
+      defaultText = "config.nixpkgs.flake.source != null";
+
+      description = mdDoc ''
+        Whether to set {env}`NIX_PATH` to include `nixpkgs=flake:nixpkgs` such that `<nixpkgs>`
+        lookups receive the version of nixpkgs that the system was built with, in concert with
+        {option}`nixpkgs.flake.setFlakeRegistry`.
+
+        This is on by default for NixOS configurations built with flakes.
+
+        This makes {command}`nix-build '<nixpkgs>' -A hello` work out of the box on flake systems.
+
+        Note that this option makes the NixOS closure depend on the nixpkgs sources, which may add
+        undesired closure size if the system will not have any nix commands run on it.
+      '';
+    };
+
+    setFlakeRegistry = mkOption {
+      type = types.bool;
+
+      default = cfg.source != null;
+      defaultText = "config.nixpkgs.flake.source != null";
+
+      description = mdDoc ''
+        Whether to pin nixpkgs in the system-wide flake registry (`/etc/nix/registry.json`) to the
+        store path of the sources of nixpkgs used to build the NixOS system.
+
+        This is on by default for NixOS configurations built with flakes.
+
+        This option makes {command}`nix run nixpkgs#hello` reuse dependencies from the system, avoid
+        refetching nixpkgs, and have a consistent result every time.
+
+        Note that this option makes the NixOS closure depend on the nixpkgs sources, which may add
+        undesired closure size if the system will not have any nix commands run on it.
+      '';
+    };
+  };
+
+  config = mkIf (cfg.source != null) (mkMerge [
+    {
+      assertions = [
+        {
+          assertion = cfg.setNixPath -> cfg.setFlakeRegistry;
+          message = ''
+            Setting `nixpkgs.flake.setNixPath` requires that `nixpkgs.flake.setFlakeRegistry` also
+            be set, since it is implemented in terms of indirection through the flake registry.
+          '';
+        }
+      ];
+    }
+    (mkIf cfg.setFlakeRegistry {
+      nix.registry.nixpkgs.to = mkDefault {
+        type = "path";
+        path = cfg.source;
+      };
+    })
+    (mkIf cfg.setNixPath {
+      # N.B. This does not include nixos-config in NIX_PATH unlike modules/config/nix-channel.nix
+      # because we would need some kind of evil shim taking the *calling* flake's self path,
+      # perhaps, to ever make that work (in order to know where the Nix expr for the system came
+      # from and how to call it).
+      nix.nixPath = mkDefault ([ "nixpkgs=flake:nixpkgs" ]
+        ++ optional config.nix.channel.enable "/nix/var/nix/profiles/per-user/root/channels");
+    })
+  ]);
+}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -133,6 +133,7 @@
  ./misc/meta.nix
  ./misc/nixops-autoluks.nix
  ./misc/nixpkgs.nix
+  ./misc/nixpkgs-flake.nix
  ./misc/passthru.nix
  ./misc/version.nix
  ./misc/wordlist.nix
--- a/pkgs/applications/audio/snapcast/default.nix
+++ b/pkgs/applications/audio/snapcast/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, cmake, pkg-config
-, alsa-lib, asio, avahi, boost179, flac, libogg, libvorbis, soxr
+, alsa-lib, asio, avahi, boost179, flac, libogg, libvorbis, libopus, soxr
 , IOKit, AudioToolbox
 , aixlog, popl
 , pulseaudioSupport ? false, libpulseaudio
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
  # not needed
  buildInputs = [
    boost179
-    asio avahi flac libogg libvorbis
+    asio avahi flac libogg libvorbis libopus
    aixlog popl soxr
  ] ++ lib.optional pulseaudioSupport libpulseaudio
  ++ lib.optional stdenv.isLinux alsa-lib
--- a/pkgs/applications/blockchains/ton/default.nix
+++ b/pkgs/applications/blockchains/ton/default.nix
@ -6,21 +6,23 @@
 , pkg-config
 , gperf
 , libmicrohttpd
+, libsodium
 , openssl
 , readline
+, secp256k1
 , zlib
 , nix-update-script
 }:

 stdenv.mkDerivation rec {
  pname = "ton";
-  version = "2023.10";
+  version = "2024.01";

  src = fetchFromGitHub {
    owner = "ton-blockchain";
    repo = "ton";
    rev = "v${version}";
-    sha256 = "sha256-K1RhhW7EvwYV7/ng3NPjSGdHEQvJZ7K97YXd7s5wghc=";
+    hash = "sha256-nZ7yel+lTNO5zFzN711tLwAvqpf5qaYOxERwApnMVOs=";
    fetchSubmodules = true;
  };

@ -35,14 +37,19 @@ stdenv.mkDerivation rec {
  buildInputs = [
    gperf
    libmicrohttpd
+    libsodium
    openssl
    readline
+    secp256k1
    zlib
  ];

  passthru.updateScript = nix-update-script { };

  meta = with lib; {
+    # The build fails on darwin as:
+    #   error: aligned allocation function of type 'void *(std::size_t, std::align_val_t)' is only available on macOS 10.13 or newer
+    broken = stdenv.isDarwin;
    description = "A fully decentralized layer-1 blockchain designed by Telegram";
    homepage = "https://ton.org/";
    changelog = "https://github.com/ton-blockchain/ton/blob/v${version}/Changelog.md";
--- a/pkgs/applications/misc/yubioath-flutter/default.nix
+++ b/pkgs/applications/misc/yubioath-flutter/default.nix
@ -13,24 +13,27 @@

 flutter.buildFlutterApplication rec {
  pname = "yubioath-flutter";
-  version = "6.3.1";
+  version = "6.4.0";

  src = fetchFromGitHub {
    owner = "Yubico";
    repo = "yubioath-flutter";
    rev = version;
-    hash = "sha256-XgRIX2Iv5niJw2NSBPwM0K4uF5sPj9c+Xj4oHtAQSbU=";
+    hash = "sha256-aXUnmKEUCi0rsVr3HVhEk6xa1z9HMsH+0AIY531hqiU=";
  };

  passthru.helper = python3.pkgs.callPackage ./helper.nix { inherit src version meta; };

  pubspecLock = lib.importJSON ./pubspec.lock.json;
+  gitHashes = {
+    window_manager = "sha256-mLX51nbWFccsAfcqLQIYDjYz69y9wAz4U1RZ8TIYSj0=";
+  };

  postPatch = ''
    rm -f pubspec.lock

    substituteInPlace linux/CMakeLists.txt \
-      --replace "../build/linux/helper" "${passthru.helper}/libexec/helper"
+      --replace-fail "../build/linux/helper" "${passthru.helper}/libexec/helper"
  '';

  preInstall = ''
--- a/pkgs/applications/misc/yubioath-flutter/pubspec.lock.json
+++ b/pkgs/applications/misc/yubioath-flutter/pubspec.lock.json
@ -134,11 +134,11 @@
      "dependency": "transitive",
      "description": {
        "name": "build_runner_core",
-        "sha256": "c9e32d21dd6626b5c163d48b037ce906bbe428bc23ab77bcd77bb21e593b6185",
+        "sha256": "4ae8ffe5ac758da294ecf1802f2aff01558d8b1b00616aa7538ea9a8a5d50799",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "7.2.11"
+      "version": "7.3.0"
    },
    "built_collection": {
      "dependency": "transitive",
@ -154,11 +154,11 @@
      "dependency": "transitive",
      "description": {
        "name": "built_value",
-        "sha256": "c9aabae0718ec394e5bc3c7272e6bb0dc0b32201a08fe185ec1d8401d3e39309",
+        "sha256": "a3ec2e0f967bc47f69f95009bb93db936288d61d5343b9436e378b28a2f830c6",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "8.8.1"
+      "version": "8.9.0"
    },
    "characters": {
      "dependency": "transitive",
@ -264,31 +264,31 @@
      "dependency": "direct dev",
      "description": {
        "name": "custom_lint",
-        "sha256": "dfb893ff17c83cf08676c6b64df11d3e53d80590978d7c1fb242afff3ba6dedb",
+        "sha256": "f89ff83efdba7c8996e86bb3bad0b759d58f9b19ae4d0e277a386ddd8b481217",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.5.8"
+      "version": "0.6.0"
    },
    "custom_lint_builder": {
      "dependency": "direct dev",
      "description": {
        "name": "custom_lint_builder",
-        "sha256": "8df6634b38a36a6c6cb74a9c0eb02e9ba0b0ab89b29e38e6daa86e8ed2c6288d",
+        "sha256": "9cdd9987feaa6925ec5f98d64de4fbbb5d94248ff77bbf2489366efad6c4baef",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.5.8"
+      "version": "0.6.0"
    },
    "custom_lint_core": {
      "dependency": "transitive",
      "description": {
        "name": "custom_lint_core",
-        "sha256": "2b235be098d157e244f18ea905a15a18c16a205e30553888fac6544bbf52f03f",
+        "sha256": "9003a91409c9f1db6e2e50b4870d1d5e802e5923b25f7261bf3cb3e11ea9d4fb",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.5.8"
+      "version": "0.6.0"
    },
    "dart_style": {
      "dependency": "transitive",
@ -402,11 +402,11 @@
      "dependency": "direct main",
      "description": {
        "name": "flutter_riverpod",
-        "sha256": "da9591d1f8d5881628ccd5c25c40e74fc3eef50ba45e40c3905a06e1712412d5",
+        "sha256": "4bce556b7ecbfea26109638d5237684538d4abc509d253e6c5c4c5733b360098",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.9"
+      "version": "2.4.10"
    },
    "flutter_test": {
      "dependency": "direct dev",
@ -424,11 +424,11 @@
      "dependency": "direct dev",
      "description": {
        "name": "freezed",
-        "sha256": "6c5031daae12c7072b3a87eff98983076434b4889ef2a44384d0cae3f82372ba",
+        "sha256": "57247f692f35f068cae297549a46a9a097100685c6780fe67177503eea5ed4e5",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.6"
+      "version": "2.4.7"
    },
    "freezed_annotation": {
      "dependency": "direct main",
@ -645,11 +645,11 @@
      "dependency": "transitive",
      "description": {
        "name": "mime",
-        "sha256": "e4ff8e8564c03f255408decd16e7899da1733852a9110a58fe6d1b817684a63e",
+        "sha256": "2e123074287cc9fd6c09de8336dae606d1ddb88d9ac47358826db698c176a1f2",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.0.4"
+      "version": "1.0.5"
    },
    "package_config": {
      "dependency": "transitive",
@ -834,11 +834,11 @@
      "dependency": "transitive",
      "description": {
        "name": "riverpod",
-        "sha256": "942999ee48b899f8a46a860f1e13cee36f2f77609eb54c5b7a669bb20d550b11",
+        "sha256": "548e2192eb7aeb826eb89387f814edb76594f3363e2c0bb99dd733d795ba3589",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.9"
+      "version": "2.5.0"
    },
    "rxdart": {
      "dependency": "transitive",
@ -1119,11 +1119,11 @@
      "dependency": "direct main",
      "description": {
        "name": "url_launcher",
-        "sha256": "d25bb0ca00432a5e1ee40e69c36c85863addf7cc45e433769d61bed3fe81fd96",
+        "sha256": "c512655380d241a337521703af62d2c122bf7b77a46ff7dd750092aa9433499c",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.2.3"
+      "version": "6.2.4"
    },
    "url_launcher_android": {
      "dependency": "transitive",
@ -1308,12 +1308,13 @@
    "window_manager": {
      "dependency": "direct main",
      "description": {
-        "name": "window_manager",
-        "sha256": "dcc865277f26a7dad263a47d0e405d77e21f12cb71f30333a52710a408690bd7",
-        "url": "https://pub.dev"
+        "path": ".",
+        "ref": "2272d45bcf46d7e2b452a038906fbc85df3ce83d",
+        "resolved-ref": "2272d45bcf46d7e2b452a038906fbc85df3ce83d",
+        "url": "https://github.com/fdennis/window_manager.git"
      },
-      "source": "hosted",
-      "version": "0.3.7"
+      "source": "git",
+      "version": "0.3.8"
    },
    "xdg_directories": {
      "dependency": "transitive",
--- a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
@ -1,24 +1,24 @@
 { lib
 , stdenv
 , fetchurl
-, electron_26
+, electron_27
 , makeWrapper
 }:

 let

  pname = "mattermost-desktop";
-  version = "5.5.1";
+  version = "5.6.0";

  srcs = {
    "x86_64-linux" = {
      url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-x64.tar.gz";
-      hash = "sha256-bRiO5gYM7nrnkbHBP3B9zAK2YV5POkc3stEsbZJ48VA=";
+      hash = "sha256-KUF/zH18X+RS8AICBv53JTBpcaokzo92psyoQNmLF/Q=";
    };

    "aarch64-linux" = {
      url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-arm64.tar.gz";
-      hash = "sha256-Z4U6Jbwasra69QPHJ9/7WwMSxh0O9r4QIe/xC3WRf4w=";
+      hash = "sha256-Zl5PalAles39qSMtt1cytfu4Mheud4+8TTkt7Ohdf/o=";
    };
  };

@ -52,7 +52,7 @@ stdenv.mkDerivation {
    substituteInPlace $out/share/applications/Mattermost.desktop \
      --replace /share/mattermost-desktop/mattermost-desktop /bin/mattermost-desktop

-    makeWrapper ${electron_26}/bin/electron $out/bin/${pname} \
+    makeWrapper '${lib.getExe electron_27}' $out/bin/${pname} \
      --add-flags $out/share/${pname}/app.asar

    runHook postInstall
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@ -22,13 +22,13 @@
 }:

 let
-  version = "2.5.2";
+  version = "2.5.3";

  src = fetchFromGitHub {
    owner = "paperless-ngx";
    repo = "paperless-ngx";
    rev = "refs/tags/v${version}";
-    hash = "sha256-v6k9clKNBNb2MQp0BTrUL9zfY6SUKfzaaOycmV8RKyk=";
+    hash = "sha256-fZ5grVZjCVkCH6doeqBLHPh9mPvHkiz+QXi/OyoJhR4=";
  };

  python = python3;
@ -99,30 +99,12 @@ python.pkgs.buildPythonApplication rec {
  ];

  propagatedBuildInputs = with python.pkgs; [
-    amqp
-    anyio
-    asgiref
-    async-timeout
-    attrs
-    autobahn
-    automat
-    billiard
    bleach
-    celery
-    certifi
-    cffi
-    channels-redis
    channels
-    charset-normalizer
-    click
-    click-didyoumean
-    click-plugins
-    click-repl
-    coloredlogs
+    channels-redis
    concurrent-log-handler
-    constantly
-    cryptography
    dateparser
+    django
    django-allauth
    django-auditlog
    django-celery-results
@ -132,92 +114,41 @@ python.pkgs.buildPythonApplication rec {
    django-filter
    django-guardian
    django-multiselectfield
-    django
-    djangorestframework-guardian2
    djangorestframework
+    djangorestframework-guardian2
    drf-writable-nested
    filelock
    flower
    gotenberg-client
    gunicorn
-    h11
-    h2
-    hiredis
-    httptools
-    httpx
-    humanfriendly
-    humanize
-    hyperlink
-    idna
    imap-tools
-    img2pdf
-    incremental
-    inotify-simple
    inotifyrecursive
-    joblib
    langdetect
-    lxml
-    msgpack
    mysqlclient
    nltk
    ocrmypdf
-    packaging
    pathvalidate
    pdf2image
-    pikepdf
-    pillow
-    pluggy
-    portalocker
-    prompt-toolkit
    psycopg2
-    pyasn1-modules
-    pyasn1
-    pycparser
-    pyopenssl
    python-dateutil
    python-dotenv
+    python-gnupg
    python-ipware
    python-magic
-    python-gnupg
-    pytz
-    pyyaml
    pyzbar
    rapidfuzz
    redis
-    regex
-    reportlab
-    requests
    scikit-learn
-    scipy
    setproctitle
-    service-identity
-    sniffio
-    sqlparse
-    threadpoolctl
    tika-client
-    tornado
    tqdm
-    twisted
-    txaio
-    tzdata
-    tzlocal
-    urllib3
    uvicorn
-    uvloop
-    vine
    watchdog
-    watchfiles
-    wcwidth
-    webencodings
-    websockets
    whitenoise
    whoosh
-    zipp
-    zope-interface
    zxing-cpp
  ]
  ++ redis.optional-dependencies.hiredis
-  ++ twisted.optional-dependencies.tls
  ++ uvicorn.optional-dependencies.standard;

  postBuild = ''
@ -262,7 +193,6 @@ python.pkgs.buildPythonApplication rec {
    pytest-rerunfailures
    pytest-xdist
    pytestCheckHook
-    reportlab
  ];

  pytestFlagsArray = [
@ -280,7 +210,7 @@ python.pkgs.buildPythonApplication rec {

    # Disable unneeded code coverage test
    substituteInPlace src/setup.cfg \
-      --replace "--cov --cov-report=html --cov-report=xml" ""
+      --replace-fail "--cov --cov-report=html --cov-report=xml" ""
  '';

  disabledTests = [
--- a/pkgs/applications/video/kodi/addons/youtube/default.nix
+++ b/pkgs/applications/video/kodi/addons/youtube/default.nix
@ -3,13 +3,13 @@
 buildKodiAddon rec {
  pname = "youtube";
  namespace = "plugin.video.youtube";
-  version = "7.0.2.2";
+  version = "7.0.3";

  src = fetchFromGitHub {
    owner = "anxdpanic";
    repo = "plugin.video.youtube";
    rev = "v${version}";
-    hash = "sha256-BUeE/8oQYBiq4XgIp4nv0hjEQz3nnkDWCnAf4kpptwk=";
+    hash = "sha256-dD9jl/W8RDfYHv13TBniOeRyc4cocj8160BHWz3MKlE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/by-name/ar/arcticons-sans/package.nix
+++ b/pkgs/by-name/ar/arcticons-sans/package.nix
@ -0,0 +1,29 @@
+{ lib
+, stdenvNoCC
+, fetchzip
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "arcticons-sans";
+  version = "0.580";
+
+  src = fetchzip {
+    hash = "sha256-BRyYHOuz7zxD1zD4L4DmI9dFhGePmGFDqYmS0DIbvi8=";
+    url = "https://github.com/arcticons-team/arcticons-font/archive/refs/tags/${finalAttrs.version}.zip";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Arcticons Sans";
+    homepage = "https://github.com/arcticons-team/arcticons-font";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ asininemonkey ];
+  };
+})
--- a/pkgs/by-name/vi/vinegar/package.nix
+++ b/pkgs/by-name/vi/vinegar/package.nix
@ -8,37 +8,42 @@
 , xorg
 , wayland
 , vulkan-headers
-, wineWowPackages
+, wine64Packages
 , fetchpatch
 }:
 let
  # wine-staging doesn't support overrideAttrs for now
-  wine = wineWowPackages.stagingFull.overrideDerivation (oldAttrs: {
+  wine = wine64Packages.staging.overrideDerivation (oldAttrs: {
    patches =
-      (oldAttrs.patches or [ ])
+      (oldAttrs.patches or [])
      ++ [
        # upstream issue: https://bugs.winehq.org/show_bug.cgi?id=55604
        # Here are the currently applied patches for Roblox to run under WINE:
        (fetchpatch {
-          name = "vinegar-wine-segrevert.patch";
-          url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/8fc153c492542a522d6cc2dff7d1af0e030a529a/patches/wine/temp.patch";
-          hash = "sha256-AnEBBhB8leKP0xCSr6UsQK7CN0NDbwqhe326tJ9dDjc=";
+          name = "vinegar-wine-segregrevert.patch";
+          url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/e24cb9dfa996bcfeaa46504c0375660fe271148d/patches/wine/segregrevert.patch";
+          hash = "sha256-+3Nld81nG3GufI4jAF6yrWfkJmsSCOku39rx0Hov29c=";
+        })
+        (fetchpatch {
+          name = "vinegar-wine-mouselock.patch";
+          url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/e24cb9dfa996bcfeaa46504c0375660fe271148d/patches/wine/mouselock.patch";
+          hash = "sha256-0AGA4AQbxTL5BGVbm072moav7xVA3zpotYqM8pcEDa4=";
        })
      ];
  });
 in
 buildGoModule rec {
  pname = "vinegar";
-  version = "1.6.1";
+  version = "1.7.3";

  src = fetchFromGitHub {
    owner = "vinegarhq";
    repo = "vinegar";
    rev = "v${version}";
-    hash = "sha256-uRdWE5NwRVSuUZyU5B5u5DfJOxu/gUqwM682eORTDOs=";
+    hash = "sha256-aKL+4jw/uMbbvLRCBHstCTrcQ1PTYSCwMNgXTvSvMeY=";
  };

-  vendorHash = "sha256-Ex6PRd3rD2jbLXlY36koNvZF3P+gAZTE9hExIfOw9CE=";
+  vendorHash = "sha256-OaMfWecOPQh6quXjYkZLyBDHZ9TINSA7Ue/Y0sz5ZYY=";

  nativeBuildInputs = [ pkg-config makeBinaryWrapper ];
  buildInputs = [ libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wayland vulkan-headers wine ];
--- a/pkgs/development/compilers/chez/default.nix
+++ b/pkgs/development/compilers/chez/default.nix
@ -1,15 +1,15 @@
 { lib, stdenv, fetchurl
 , coreutils, cctools
-, ncurses, libiconv, libX11, libuuid
+, ncurses, libiconv, libX11, libuuid, testers
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "chez-scheme";
-  version = "9.6.4";
+  version = "10.0.0";

  src = fetchurl {
    url = "https://github.com/cisco/ChezScheme/releases/download/v${finalAttrs.version}/csv${finalAttrs.version}.tar.gz";
-    hash = "sha256-9YJ2gvolnEeXX/4Hh4X7Vh5KXFT3ZDMe9mwyEyhDaF0=";
+    hash = "sha256-03GZASte0ZhcQGnWqH/xjl4fWi3yfkApkfr0XcTyIyw=";
  };

  nativeBuildInputs = lib.optional stdenv.isDarwin cctools;
@ -28,18 +28,11 @@ stdenv.mkDerivation (finalAttrs: {
  ** NixOS or in any chroot build.
  */
  patchPhase = ''
-    substituteInPlace ./configure \
-      --replace "git submodule init && git submodule update || exit 1" "true"
-
-    substituteInPlace ./workarea \
-      --replace "/bin/ln" ln \
-      --replace "/bin/cp" cp
-
    substituteInPlace ./makefiles/installsh \
-      --replace "/usr/bin/true" "${coreutils}/bin/true"
+      --replace-warn "/usr/bin/true" "${coreutils}/bin/true"

    substituteInPlace zlib/configure \
-      --replace "/usr/bin/libtool" libtool
+      --replace-warn "/usr/bin/libtool" libtool
  '';

  /*
@ -52,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
  ** for.
  */
  configurePhase = ''
-    ./configure --threads --installprefix=$out --installman=$out/share/man
+    ./configure --as-is --threads --installprefix=$out --installman=$out/share/man
  '';

  /*
@ -64,12 +57,18 @@ stdenv.mkDerivation (finalAttrs: {

  setupHook = ./setup-hook.sh;

+  passthru.tests = {
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
  meta = {
    description  = "A powerful and incredibly fast R6RS Scheme compiler";
    homepage     = "https://cisco.github.io/ChezScheme/";
    license      = lib.licenses.asl20;
    maintainers  = with lib.maintainers; [ thoughtpolice ];
    platforms    = lib.platforms.unix;
-    badPlatforms = [ "aarch64-linux" "aarch64-darwin" ];
+    mainProgram  = "scheme";
  };
 })
--- a/pkgs/development/compilers/sbcl/bootstrap.nix
+++ b/pkgs/development/compilers/sbcl/bootstrap.nix
@ -26,4 +26,6 @@ stdenv.mkDerivation rec {
  postFixup = lib.optionalString (!stdenv.isAarch32 && stdenv.isLinux) ''
    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $out/share/sbcl/sbcl
  '';
+
+  meta.sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
 }
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@ -2,14 +2,14 @@
 , stdenv
 , fetchurl
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , unzip
 , zlib
-, pcre
+, pcre2
 , hdf5
 , boost
+, glib
 , gflags
 , protobuf_21
 , config
@ -35,6 +35,8 @@
 , eigen
 , enableBlas ? true
 , blas
+, enableVA ? !stdenv.isDarwin
+, libva
 , enableContrib ? true

 , enableCuda ? config.cudaSupport
@ -58,7 +60,11 @@
 , enableFfmpeg ? true
 , ffmpeg
 , enableGStreamer ? true
+, elfutils
 , gst_all_1
+, orc
+, libunwind
+, zstd
 , enableTesseract ? false
 , tesseract
 , leptonica
@ -85,7 +91,7 @@
 }@inputs:

 let
-  version = "4.7.0";
+  version = "4.9.0";

  # It's necessary to consistently use backendStdenv when building with CUDA
  # support, otherwise we get libstdc++ errors downstream
@ -96,21 +102,21 @@ let
    owner = "opencv";
    repo = "opencv";
    rev = version;
-    sha256 = "sha256-jUeGsu8+jzzCnIFbVMCW8DcUeGv/t1yCY/WXyW+uGDI=";
+    hash = "sha256-3qqu4xlRyMbPKHHTIT+iRRGtpFlcv0NU8GNZpgjdi6k=";
  };

  contribSrc = fetchFromGitHub {
    owner = "opencv";
    repo = "opencv_contrib";
    rev = version;
-    sha256 = "sha256-meya0J3RdOIeMM46e/6IOVwrKn3t/c0rhwP2WQaybkE=";
+    hash = "sha256-K74Ghk4uDqj4OWEzDxT2R3ERi+jkAWZszzezRenfuZ8=";
  };

  testDataSrc = fetchFromGitHub {
    owner = "opencv";
    repo = "opencv_extra";
    rev = version;
-    sha256 = "sha256-6hAdJdaUgtRGQanQKuY/q6fcXWXFZ3K/oLbGxvksry0=";
+    hash = "sha256-pActKi7aN5EOZq2Fpf5mALnZq71c037/R3Q6wJ4uCfQ=";
  };

  # Contrib must be built in order to enable Tesseract support:
@ -121,16 +127,16 @@ let
    src = fetchFromGitHub {
      owner = "opencv";
      repo = "opencv_3rdparty";
-      rev = "a56b6ac6f030c312b2dce17430eef13aed9af274";
-      sha256 = "1msbkc3zixx61rcg6a04i1bcfhw1phgsrh93glq1n80hgsk3nbjq";
+      rev = "0cc4aa06bf2bef4b05d237c69a5a96b9cd0cb85a";
+      hash = "sha256-/kHivOgCkY9YdcRRaVgytXal3ChE9xFfGAB0CfFO5ec=";
    } + "/ippicv";
-    files = let name = platform: "ippicv_2019_${platform}_general_20180723.tgz"; in
+    files = let name = platform: "ippicv_2021.10.0_${platform}_20230919_general.tgz"; in
      if effectiveStdenv.hostPlatform.system == "x86_64-linux" then
-        { ${name "lnx_intel64"} = "c0bd78adb4156bbf552c1dfe90599607"; }
+        { ${name "lnx_intel64"} = "606a19b207ebedfe42d59fd916cc4850"; }
      else if effectiveStdenv.hostPlatform.system == "i686-linux" then
-        { ${name "lnx_ia32"} = "4f38432c30bfd6423164b7a24bbc98a0"; }
+        { ${name "lnx_ia32"} = "ea08487b810baad2f68aca87b74a2db9"; }
      else if effectiveStdenv.hostPlatform.system == "x86_64-darwin" then
-        { ${name "mac_intel64"} = "fe6b2bb75ae0e3f19ad3ae1a31dfa4a2"; }
+        { ${name "mac_intel64"} = "14f01c5a4780bfae9dde9b0aaf5e56fc"; }
      else
        throw "ICV is not available for this platform (or not yet supported by this package)";
    dst = ".cache/ippicv";
@ -142,7 +148,7 @@ let
      owner = "opencv";
      repo = "opencv_3rdparty";
      rev = "fccf7cd6a4b12079f73bbfb21745f9babcd4eb1d";
-      sha256 = "0r9fam8dplyqqsd3qgpnnfgf9l7lj44di19rxwbm8mxiw0rlcdvy";
+      hash = "sha256-fjdGM+CxV1QX7zmF2AiR9NDknrP2PjyaxtjT21BVLmU=";
    };
    files = {
      "vgg_generated_48.i" = "e8d0dcd54d1bcfdc29203d011a797179";
@ -179,7 +185,7 @@ let
      owner = "opencv";
      repo = "opencv_3rdparty";
      rev = "8afa57abc8229d611c4937165d20e2a2d9fc5a12";
-      sha256 = "061lsvqdidq9xa2hwrcvwi9ixflr2c2lfpc8drr159g68zi8bp4v";
+      hash = "sha256-m9yF4kfmpRJybohdRwUTmboeU+SbZQ6F6gm32PDWNBg=";
    };
    files = {
      "face_landmark_model.dat" = "7505c44ca4eb54b4ab1e4777cb96ac05";
@ -191,10 +197,10 @@ let
  ade = rec {
    src = fetchurl {
      url = "https://github.com/opencv/ade/archive/${name}";
-      sha256 = "sha256-TjLRbFbC7MDY9PxIy560ryviBI58cbQwqgc7A7uOHkg=";
+      hash = "sha256-WG/GudVpkO10kOJhoKXFMj672kggvyRYCIpezal3wcE=";
    };
-    name = "v0.1.2a.zip";
-    md5 = "fa4b3e25167319cb0fa9432ef8281945";
+    name = "v0.1.2d.zip";
+    md5 = "dbb095a8bf3008e91edbbf45d8d34885";
    dst = ".cache/ade";
  };

@ -204,7 +210,7 @@ let
      owner = "opencv";
      repo = "opencv_3rdparty";
      rev = "a8b69ccc738421293254aec5ddb38bd523503252";
-      sha256 = "sha256-/n6zHwf0Rdc4v9o4rmETzow/HTv+81DnHP+nL56XiTY=";
+      hash = "sha256-/n6zHwf0Rdc4v9o4rmETzow/HTv+81DnHP+nL56XiTY=";
    };
    files = {
      "detect.caffemodel" = "238e2b2d6f3c18d6c3a30de0c31e23cf";
@ -260,20 +266,6 @@ effectiveStdenv.mkDerivation {
  patches = [
    ./cmake-don-t-use-OpenCVFindOpenEXR.patch
  ] ++ lib.optionals enableContrib [
-    (fetchpatch {
-      name = "CVE-2023-2617.patch";
-      url = "https://github.com/opencv/opencv_contrib/commit/ccc277247ac1a7aef0a90353edcdec35fbc5903c.patch";
-      stripLen = 2;
-      extraPrefix = [ "opencv_contrib/" ];
-      sha256 = "sha256-drZ+DVn+Pk4zAZJ+LgX5u3Tz7MU0AEI/73EVvxDP3AU=";
-    })
-    (fetchpatch {
-      name = "CVE-2023-2618.patch";
-      url = "https://github.com/opencv/opencv_contrib/commit/ec406fa4748fb4b0630c1b986469e7918d5e8953.patch";
-      stripLen = 2;
-      extraPrefix = [ "opencv_contrib/" ];
-      sha256 = "sha256-cB5Tsh2fDOsc0BNtSzd6U/QoCjkd9yMW1QutUU69JJ0=";
-    })
  ] ++ lib.optional enableCuda ./cuda_opt_flow.patch;

  # This prevents cmake from using libraries in impure paths (which
@ -300,60 +292,104 @@ effectiveStdenv.mkDerivation {
    echo '"(build info elided)"' > modules/core/version_string.inc
  '';

-  buildInputs = [ zlib pcre boost gflags protobuf_21 ]
-    ++ lib.optional enablePython pythonPackages.python
-    ++ lib.optional (effectiveStdenv.buildPlatform == effectiveStdenv.hostPlatform) hdf5
-    ++ lib.optional enableGtk2 gtk2
-    ++ lib.optional enableGtk3 gtk3
-    ++ lib.optional enableVtk vtk
-    ++ lib.optional enableJPEG libjpeg
-    ++ lib.optional enablePNG libpng
-    ++ lib.optional enableTIFF libtiff
-    ++ lib.optional enableWebP libwebp
-    ++ lib.optionals enableEXR [ openexr ilmbase ]
-    ++ lib.optional enableJPEG2000 openjpeg
-    ++ lib.optional enableFfmpeg ffmpeg
-    ++ lib.optionals (enableFfmpeg && effectiveStdenv.isDarwin)
-      [ VideoDecodeAcceleration bzip2 ]
-    ++ lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good ])
-    ++ lib.optional enableOvis ogre
-    ++ lib.optional enableGPhoto2 libgphoto2
-    ++ lib.optional enableDC1394 libdc1394
-    ++ lib.optional enableEigen eigen
-    ++ lib.optional enableBlas blas.provider
+  buildInputs = [
+    boost
+    gflags
+    glib
+    pcre2
+    protobuf_21
+    zlib
+  ] ++ lib.optionals enablePython [
+    pythonPackages.python
+  ] ++ lib.optionals (effectiveStdenv.buildPlatform == effectiveStdenv.hostPlatform) [
+    hdf5
+  ] ++ lib.optionals enableGtk2 [
+    gtk2
+  ] ++ lib.optionals enableGtk3 [
+    gtk3
+  ] ++ lib.optionals enableVtk [
+    vtk
+  ] ++ lib.optionals enableJPEG [
+    libjpeg
+  ] ++ lib.optionals enablePNG [
+    libpng
+  ] ++ lib.optionals enableTIFF [
+    libtiff
+  ] ++ lib.optionals enableWebP [
+    libwebp
+  ] ++ lib.optionals enableEXR [
+    openexr
+    ilmbase
+  ] ++ lib.optionals enableJPEG2000 [
+    openjpeg
+  ] ++ lib.optionals enableFfmpeg [
+    ffmpeg
+  ] ++ lib.optionals (enableFfmpeg && effectiveStdenv.isDarwin) [
+    bzip2
+    VideoDecodeAcceleration
+  ] ++ lib.optionals (enableGStreamer && effectiveStdenv.isLinux) (with gst_all_1; [
+    elfutils
+    gst-plugins-base
+    gst-plugins-good
+    gstreamer
+    libunwind
+    orc
+    zstd
+  ]) ++ lib.optionals enableOvis [
+    ogre
+  ] ++ lib.optionals enableGPhoto2 [
+    libgphoto2
+  ] ++ lib.optionals enableDC1394 [
+    libdc1394
+  ] ++ lib.optionals enableEigen [
+    eigen
+  ] ++ lib.optionals enableVA [
+    libva
+  ] ++ lib.optionals enableBlas [
+    blas.provider
+  ] ++ lib.optionals enableTesseract [
    # There is seemingly no compile-time flag for Tesseract.  It's
    # simply enabled automatically if contrib is built, and it detects
    # tesseract & leptonica.
-    ++ lib.optionals enableTesseract [ tesseract leptonica ]
-    ++ lib.optional enableTbb tbb
-    ++ lib.optionals effectiveStdenv.isDarwin [
-      bzip2 AVFoundation Cocoa VideoDecodeAcceleration CoreMedia MediaToolbox Accelerate
-    ]
-    ++ lib.optionals enableDocs [ doxygen graphviz-nox ]
-    ++ lib.optionals enableCuda (with cudaPackages; [
-      cuda_cudart.lib
-      cuda_cudart.dev
-      cuda_cccl.dev # <thrust/*>
-      libnpp.dev # npp.h
-      libnpp.lib
-      libnpp.static
-      nvidia-optical-flow-sdk
-    ] ++ lib.optionals enableCublas [
-      # May start using the default $out instead once
-      # https://github.com/NixOS/nixpkgs/issues/271792
-      # has been addressed
-      libcublas.static
-      libcublas.lib
-      libcublas.dev # cublas_v2.h
-    ] ++ lib.optionals enableCudnn [
-      cudnn.dev # cudnn.h
-      cudnn.lib
-      cudnn.static
-    ] ++ lib.optionals enableCufft [
-      libcufft.dev # cufft.h
-      libcufft.lib
-      libcufft.static
-    ]);
+    tesseract
+    leptonica
+  ] ++ lib.optionals enableTbb [
+    tbb
+  ] ++ lib.optionals effectiveStdenv.isDarwin [
+    bzip2
+    AVFoundation
+    Cocoa
+    VideoDecodeAcceleration
+    CoreMedia
+    MediaToolbox
+    Accelerate
+  ] ++ lib.optionals enableDocs [
+    doxygen
+    graphviz-nox
+  ] ++ lib.optionals enableCuda (with cudaPackages; [
+    cuda_cudart.lib
+    cuda_cudart.dev
+    cuda_cccl.dev # <thrust/*>
+    libnpp.dev # npp.h
+    libnpp.lib
+    libnpp.static
+    nvidia-optical-flow-sdk
+  ] ++ lib.optionals enableCublas [
+    # May start using the default $out instead once
+    # https://github.com/NixOS/nixpkgs/issues/271792
+    # has been addressed
+    libcublas.static
+    libcublas.lib
+    libcublas.dev # cublas_v2.h
+  ] ++ lib.optionals enableCudnn [
+    cudnn.dev # cudnn.h
+    cudnn.lib
+    cudnn.static
+  ] ++ lib.optionals enableCufft [
+    libcufft.dev # cufft.h
+    libcufft.lib
+    libcufft.static
+  ]);

  propagatedBuildInputs = lib.optionals enablePython [ pythonPackages.numpy ];

--- a/pkgs/development/python-modules/dask-awkward/default.nix
+++ b/pkgs/development/python-modules/dask-awkward/default.nix
@ -2,13 +2,19 @@
 , awkward
 , buildPythonPackage
 , dask
+, dask-histogram
+, distributed
 , fetchFromGitHub
 , hatch-vcs
 , hatchling
+, hist
+, pandas
 , pyarrow
 , pytestCheckHook
 , pythonOlder
 , pythonRelaxDepsHook
+, typing-extensions
+, uproot
 }:

 buildPythonPackage rec {
@ -38,12 +44,23 @@ buildPythonPackage rec {
  propagatedBuildInputs = [
    awkward
    dask
+    typing-extensions
  ];

+  passthru.optional-dependencies = {
+    io = [
+      pyarrow
+    ];
+  };
+
  checkInputs = [
+    dask-histogram
+    distributed
+    hist
+    pandas
    pytestCheckHook
-    pyarrow
-  ];
+    uproot
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);

  pythonImportsCheck = [
    "dask_awkward"
@ -54,6 +71,8 @@ buildPythonPackage rec {
    "test_remote_double"
    "test_remote_single"
    "test_from_text"
+    # ValueError: not a ROOT file: first four bytes...
+    "test_basic_root_works"
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/http-message-signatures/default.nix
+++ b/pkgs/development/python-modules/http-message-signatures/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "http-message-signatures";
-  version = "0.4.4";
+  version = "0.5.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "pyauth";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-acTziJM5H5Td+eG/LNrlNwgpVvFDyl/tf6//YuE1XZk=";
+    hash = "sha256-Jsivw4lNA/2oqsOGGx8D4gUPftzuys877A9RXyapnSQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/orbax-checkpoint/default.nix
+++ b/pkgs/development/python-modules/orbax-checkpoint/default.nix
@ -0,0 +1,78 @@
+{ lib
+, absl-py
+, buildPythonPackage
+, cached-property
+, etils
+, fetchPypi
+, flit-core
+, importlib-resources
+, jax
+, jaxlib
+, msgpack
+, nest-asyncio
+, numpy
+, protobuf
+, pytest-xdist
+, pytestCheckHook
+, pythonOlder
+, pyyaml
+, tensorstore
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "orbax-checkpoint";
+  version = "0.5.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchPypi {
+    pname = "orbax_checkpoint";
+    inherit version;
+    hash = "sha256-FXKQTLv+hROSfg2A+AtzDg7y9oAzLTwoENhENTKTi0U=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    absl-py
+    cached-property
+    etils
+    importlib-resources
+    jax
+    jaxlib
+    msgpack
+    nest-asyncio
+    numpy
+    protobuf
+    pyyaml
+    tensorstore
+    typing-extensions
+  ];
+
+  nativeCheckInputs = [
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "orbax"
+  ];
+
+  disabledTestPaths = [
+    # Circular dependency flax
+    "orbax/checkpoint/transform_utils_test.py"
+    "orbax/checkpoint/utils_test.py"
+  ];
+
+  meta = with lib; {
+    description = "Orbax provides common utility libraries for JAX users";
+    homepage = "https://github.com/google/orbax/tree/main/checkpoint";
+    changelog = "https://github.com/google/orbax/blob/${version}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [fab ];
+  };
+}
--- a/pkgs/development/python-modules/pillow-heif/default.nix
+++ b/pkgs/development/python-modules/pillow-heif/default.nix
@ -57,6 +57,9 @@ buildPythonPackage rec {
    x265
  ];

+  # clang-16: error: argument unused during compilation: '-fno-strict-overflow' [-Werror,-Wunused-command-line-argument]
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
+
  propagatedBuildInputs = [
    pillow
  ];
--- a/pkgs/development/python-modules/pyunifiprotect/default.nix
+++ b/pkgs/development/python-modules/pyunifiprotect/default.nix
@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "pyunifiprotect";
-  version = "4.23.3";
+  version = "4.23.4";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "briis";
    repo = "pyunifiprotect";
    rev = "refs/tags/v${version}";
-    hash = "sha256-QWIiBuKDhSNYVyEm45QV4a2UxADDrBdiCBeJI+a6v7c=";
+    hash = "sha256-sBdu4XJkEtHf6dlHgJKFQvONp1x89NiS2EgxMiJFX7A=";
  };

  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/structlog/default.nix
+++ b/pkgs/development/python-modules/structlog/default.nix
@ -11,13 +11,12 @@
 , pythonOlder
 , simplejson
 , twisted
-, typing-extensions
 }:

 buildPythonPackage rec {
  pname = "structlog";
-  version = "23.2.0";
-  format = "pyproject";
+  version = "24.1.0";
+  pyproject = true;

  disabled = pythonOlder "3.8";

@ -25,7 +24,7 @@ buildPythonPackage rec {
    owner = "hynek";
    repo = "structlog";
    rev = "refs/tags/${version}";
-    hash = "sha256-KSHKgkv+kObKCdWZDg5o6QYe0AMND9VLdEuseY/GyDY=";
+    hash = "sha256-0Yc28UEeozK2+IqILFTqHoTiM5L2SA4t6jld4qTBSzQ=";
  };

  nativeBuildInputs = [
@ -34,10 +33,6 @@ buildPythonPackage rec {
    hatchling
  ];

-  propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
-    typing-extensions
-  ];
-
  nativeCheckInputs = [
    freezegun
    pretend
@ -47,11 +42,6 @@ buildPythonPackage rec {
    twisted
  ];

-  disabledTests = [
-    # _pickle.PicklingError: Only BytesLoggers to sys.stdout and sys.stderr can be pickled.
-    "test_pickle"
-  ];
-
  pythonImportsCheck = [
    "structlog"
  ];
@ -61,6 +51,6 @@ buildPythonPackage rec {
    homepage = "https://github.com/hynek/structlog";
    changelog = "https://github.com/hynek/structlog/blob/${version}/CHANGELOG.md";
    license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
  };
 }
--- a/pkgs/development/tools/aws-sam-cli/default.nix
+++ b/pkgs/development/tools/aws-sam-cli/default.nix
@ -10,8 +10,8 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "aws-sam-cli";
-  version = "1.108.0";
-  format = "pyproject";
+  version = "1.110.0";
+  pyproject = true;

  disabled = python3.pythonOlder "3.8";

@ -19,7 +19,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "aws";
    repo = "aws-sam-cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-k6SXCFkISyfr5/0vhe/Dfzs4qsVfu14lFx/bl53QxR4=";
+    hash = "sha256-FJHHEsdi2uGP9/GxrANsVEuxZiS4M4BPBGoARQBQpkA=";
  };

  nativeBuildInputs = with python3.pkgs; [
@ -28,16 +28,18 @@ python3.pkgs.buildPythonApplication rec {
  ];

  pythonRelaxDeps = [
+    "aws-lambda-builders"
    "aws-sam-translator"
    "boto3-stubs"
    "cfn-lint"
-    "tzlocal"
    "cookiecutter"
    "docker"
-    "aws-lambda-builders"
-    "tomlkit"
-    "rich"
    "jsonschema"
+    "pyopenssl"
+    "rich"
+    "ruamel-yaml"
+    "tomlkit"
+    "tzlocal"
  ];

  propagatedBuildInputs = with python3.pkgs; [
@ -86,8 +88,6 @@ python3.pkgs.buildPythonApplication rec {
      --prefix PATH : $out/bin:${lib.makeBinPath [ git ]}
  '';

-  doCheck = true;
-
  nativeCheckInputs = with python3.pkgs; [
    filelock
    flaky
@ -105,22 +105,27 @@ python3.pkgs.buildPythonApplication rec {

  pytestFlagsArray = [
    "tests"
-
-    # Disable tests that requires networking or complex setup
-    "--ignore=tests/end_to_end"
-    "--ignore=tests/integration"
-    "--ignore=tests/regression"
-    "--ignore=tests/smoke"
-    "--ignore=tests/unit/lib/telemetry"
-
-    # Disable flaky tests
-    "--ignore=tests/unit/lib/samconfig/test_samconfig.py"
-    "--deselect=tests/unit/lib/sync/flows/test_rest_api_sync_flow.py::TestRestApiSyncFlow::test_update_stage"
-    "--deselect=tests/unit/lib/sync/flows/test_rest_api_sync_flow.py::TestRestApiSyncFlow::test_delete_deployment"
-    "--deselect=tests/unit/local/lambda_service/test_local_lambda_invoke_service.py::TestValidateRequestHandling::test_request_with_no_data"
-
    # Disable warnings
-    "-W ignore::DeprecationWarning"
+    "-W"
+    "ignore::DeprecationWarning"
+  ];
+
+  disabledTestPaths = [
+    # Disable tests that requires networking or complex setup
+    "tests/end_to_end"
+    "tests/integration"
+    "tests/regression"
+    "tests/smoke"
+    "tests/unit/lib/telemetry"
+    # Disable flaky tests
+    "tests/unit/lib/samconfig/test_samconfig.py"
+  ];
+
+  disabledTests = [
+    # Disable flaky tests
+    "test_update_stage"
+    "test_delete_deployment"
+    "test_request_with_no_data"
  ];

  pythonImportsCheck = [
--- a/pkgs/development/tools/continuous-integration/drone-runner-docker/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone-runner-docker/default.nix
@ -14,7 +14,7 @@ buildGoModule rec {
  vendorHash = "sha256-KcNp3VdJ201oxzF0bLXY4xWHqHNz54ZrVSI96cfhU+k=";

  meta = with lib; {
-    maintainers = with maintainers; [ endocrimes emilylange ];
+    maintainers = with maintainers; [ endocrimes ];
    license = licenses.unfreeRedistributable;
    homepage = "https://github.com/drone-runners/drone-runner-docker";
    description = "Drone pipeline runner that executes builds inside Docker containers";
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@ -12,7 +12,7 @@
 , mesa
 , libxkbcommon
 , libxshmfence
-, libglvnd
+, libGL
 , alsa-lib
 , cairo
 , cups
@ -102,7 +102,7 @@ let
    ++ lib.optionals (lib.versionOlder version "10.0.0") [ libXScrnSaver ]
    ++ lib.optionals (lib.versionAtLeast version "11.0.0") [ libxkbcommon ]
    ++ lib.optionals (lib.versionAtLeast version "12.0.0") [ libxshmfence ]
-    ++ lib.optionals (lib.versionAtLeast version "17.0.0") [ libglvnd ]
+    ++ lib.optionals (lib.versionAtLeast version "17.0.0") [ libGL ]
  );

  linux = {
@ -130,6 +130,11 @@ let
        --set-rpath "${electronLibPath}:$out/libexec/electron" \
        $out/libexec/electron/.electron-wrapped \
        ${lib.optionalString (lib.versionAtLeast version "15.0.0") "$out/libexec/electron/.chrome_crashpad_handler-wrapped" }
+
+      # patch libANGLE
+      patchelf \
+        --set-rpath "${lib.makeLibraryPath [ libGL pciutils ]}" \
+        $out/libexec/electron/lib*GL*
    '';
  };

--- a/pkgs/development/tools/rojo/default.nix
+++ b/pkgs/development/tools/rojo/default.nix
@ -12,17 +12,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "rojo";
-  version = "7.4.0";
+  version = "7.4.1";

  src = fetchFromGitHub {
    owner = "rojo-rbx";
    repo = "rojo";
    rev = "v${version}";
-    sha256 = "sha256-Eh1G0jX9KXVlMZLl8whxULywadblWml232qvcq4JLJ4=";
+    hash = "sha256-7fnzNYAbsZW/48C4dwpMXXQy2ZgxbYFSs85wNKGcu/4=";
    fetchSubmodules = true;
  };

-  cargoSha256 = "sha256-aKfgylY9aspL1JpdYa6hOy/6lQoqO54OhZWqSlMPZ8o=";
+  cargoHash = "sha256-9kmSNWsZY0OcqaYOCblMwkXTdGXhj7f/2pUDx/L/o2o=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/misc/cups/drivers/foomatic-db/default.nix
+++ b/pkgs/misc/cups/drivers/foomatic-db/default.nix
@ -13,15 +13,15 @@

 stdenv.mkDerivation rec {
  pname = "foomatic-db";
-  version = "unstable-2023-09-02";
+  version = "unstable-2024-02-09";

  src = fetchFromGitHub {
    # there is also a daily snapshot at the `downloadPage`,
    # but it gets deleted quickly and would provoke 404 errors
    owner = "OpenPrinting";
    repo = "foomatic-db";
-    rev = "4e6ab90da63afddee33d80115acb44149d2d292b";
-    hash = "sha256-wtDGJUyViiCenCY4zvr0Ia4ecZpoDsDSWwlYYs3YMT8=";
+    rev = "f8b43644771612f854fecda969440511de784bf0";
+    hash = "sha256-8Pui83Z7g5aHBJk46AYeKil/0++I6zcc5S/BWRuy1WM=";
  };

  buildInputs = [ cups cups-filters ghostscript gnused perl ];
--- a/pkgs/servers/monitoring/zabbix/agent.nix
+++ b/pkgs/servers/monitoring/zabbix/agent.nix
@ -1,13 +1,13 @@
 { lib, stdenv, fetchurl, pkg-config, libiconv, openssl, pcre }:

-import ./versions.nix ({ version, sha256, ... }:
+import ./versions.nix ({ version, hash, ... }:
  stdenv.mkDerivation {
    pname = "zabbix-agent";
    inherit version;

    src = fetchurl {
      url = "https://cdn.zabbix.com/zabbix/sources/stable/${lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
-      inherit sha256;
+      inherit hash;
    };

    nativeBuildInputs = [ pkg-config ];
--- a/pkgs/servers/monitoring/zabbix/agent2.nix
+++ b/pkgs/servers/monitoring/zabbix/agent2.nix
@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchurl, autoreconfHook, pkg-config, libiconv, openssl, pcre, zlib }:

-import ./versions.nix ({ version, sha256, vendorHash ? throw "unsupported version ${version} for zabbix-agent2", ... }:
+import ./versions.nix ({ version, hash, vendorHash ? throw "unsupported version ${version} for zabbix-agent2", ... }:
  buildGoModule {
    pname = "zabbix-agent2";
    inherit version;

    src = fetchurl {
      url = "https://cdn.zabbix.com/zabbix/sources/stable/${lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
-      inherit sha256;
+      inherit hash;
    };

    modRoot = "src/go";
--- a/pkgs/servers/monitoring/zabbix/proxy.nix
+++ b/pkgs/servers/monitoring/zabbix/proxy.nix
@ -15,14 +15,14 @@ assert sqliteSupport -> !mysqlSupport && !postgresqlSupport;
 let
  inherit (lib) optional optionalString;
 in
-  import ./versions.nix ({ version, sha256, ... }:
+  import ./versions.nix ({ version, hash, ... }:
    stdenv.mkDerivation {
      pname = "zabbix-proxy";
      inherit version;

      src = fetchurl {
        url = "https://cdn.zabbix.com/zabbix/sources/stable/${lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
-        inherit sha256;
+        inherit hash;
      };

      nativeBuildInputs = [ pkg-config ];
--- a/pkgs/servers/monitoring/zabbix/server.nix
+++ b/pkgs/servers/monitoring/zabbix/server.nix
@ -16,14 +16,14 @@ assert postgresqlSupport -> !mysqlSupport;
 let
  inherit (lib) optional optionalString;
 in
-  import ./versions.nix ({ version, sha256, ... }:
+  import ./versions.nix ({ version, hash, ... }:
    stdenv.mkDerivation {
      pname = "zabbix-server";
      inherit version;

      src = fetchurl {
        url = "https://cdn.zabbix.com/zabbix/sources/stable/${lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
-        inherit sha256;
+        inherit hash;
      };

      nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/servers/monitoring/zabbix/versions.nix
+++ b/pkgs/servers/monitoring/zabbix/versions.nix
@ -1,13 +1,13 @@
 generic: {
  v60 = generic {
-    version = "6.0.21";
-    sha256 = "sha256-hdKPI5UEQvF/URH2eLWW32az3LMEse3UXIELOsfvwzk=";
+    version = "6.0.26";
+    hash = "sha256-MIOKe5hqfDecB1oWZKzbFmJCsQLuAGtp21l2WxxVG+g=";
    vendorHash = null;
  };

  v50 = generic {
-    version = "5.0.37";
-    sha256 = "sha256-+C5fI+eMJKsynVnVJIYj27x1iFQwaG9Fnho0BXgENQI=";
-    vendorHash = "sha256-oSZBzIUL1yHXk7PnkSAlhI0i89aGMFrFHmbMN9rDAJ0=";
+    version = "5.0.41";
+    hash = "sha256-pPvw0lPoK1IpsXc5c8Qu9zFhx2oHJz2bwiX80vrYa58=";
+    vendorHash = "sha256-qLDoNnEFiSrWXbLtYlmQaqY8Rv6JaG8WbMYBlry5Evc=";
  };
 }
--- a/pkgs/servers/monitoring/zabbix/web.nix
+++ b/pkgs/servers/monitoring/zabbix/web.nix
@ -1,13 +1,13 @@
 { lib, stdenv, fetchurl, writeText }:

-import ./versions.nix ({ version, sha256, ... }:
+import ./versions.nix ({ version, hash, ... }:
  stdenv.mkDerivation rec {
    pname = "zabbix-web";
    inherit version;

    src = fetchurl {
      url = "https://cdn.zabbix.com/zabbix/sources/stable/${lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
-      inherit sha256;
+      inherit hash;
    };

    phpConfig = writeText "zabbix.conf.php" ''
--- a/pkgs/servers/tang/default.nix
+++ b/pkgs/servers/tang/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "tang";
-  version = "14";
+  version = "15";

  src = fetchFromGitHub {
    owner = "latchset";
    repo = "tang";
    rev = "refs/tags/v${version}";
-    hash = "sha256-QKURKb2g71pZvuZlJk3Rc26H3oU0WSkjgQtJQLrYGbw=";
+    hash = "sha256-nlC2hdNzQZrfirjS2gX4oFp2OD1OdxmLsN03hfxD3ug=";
  };

  nativeBuildInputs = [
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -8952,6 +8952,8 @@ self: super: with self; {

  oras = callPackage ../development/python-modules/oras { };

+  orbax-checkpoint = callPackage ../development/python-modules/orbax-checkpoint { };
+
  orderedmultidict = callPackage ../development/python-modules/orderedmultidict { };

  ordered-set = callPackage ../development/python-modules/ordered-set { };