Merge staging-next into staging

2023-02-13 06:02:02 +00:00 · 2023-02-13 06:02:02 +00:00 · 29cdca7736
commit 29cdca7736
parent de9e9c8ce7 0d7cb3a2aa
107 changed files with 1171 additions and 1125 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3855,6 +3855,12 @@
    githubId = 39825;
    name = "Dominik Honnef";
  };
+  doriath = {
+    email = "tomasz.zurkowski@gmail.com";
+    github = "doriath";
+    githubId = 150959;
+    name = "Tomasz Zurkowski";
+  };
  doronbehar = {
    email = "me@doronbehar.com";
    github = "doronbehar";
--- a/nixos/modules/services/matrix/appservice-discord.nix
+++ b/nixos/modules/services/matrix/appservice-discord.nix
@ -5,7 +5,6 @@ with lib;
 let
  dataDir = "/var/lib/matrix-appservice-discord";
  registrationFile = "${dataDir}/discord-registration.yaml";
-  appDir = "${pkgs.matrix-appservice-discord}/${pkgs.matrix-appservice-discord.passthru.nodeAppDir}";
  cfg = config.services.matrix-appservice-discord;
  opt = options.services.matrix-appservice-discord;
  # TODO: switch to configGen.json once RFC42 is implemented
@ -16,6 +15,15 @@ in {
    services.matrix-appservice-discord = {
      enable = mkEnableOption (lib.mdDoc "a bridge between Matrix and Discord");

+      package = mkOption {
+        type = types.package;
+        default = pkgs.matrix-appservice-discord;
+        defaultText = literalExpression "pkgs.matrix-appservice-discord";
+        description = lib.mdDoc ''
+          Which package of matrix-appservice-discord to use.
+        '';
+      };
+
      settings = mkOption rec {
        # TODO: switch to types.config.json as prescribed by RFC42 once it's implemented
        type = types.attrs;
@ -114,7 +122,7 @@ in {

      preStart = ''
        if [ ! -f '${registrationFile}' ]; then
-          ${pkgs.matrix-appservice-discord}/bin/matrix-appservice-discord \
+          ${cfg.package}/bin/matrix-appservice-discord \
            --generate-registration \
            --url=${escapeShellArg cfg.url} \
            ${optionalString (cfg.localpart != null) "--localpart=${escapeShellArg cfg.localpart}"} \
@ -135,13 +143,13 @@ in {

        DynamicUser = true;
        PrivateTmp = true;
-        WorkingDirectory = appDir;
+        WorkingDirectory = "${cfg.package}/${cfg.package.passthru.nodeAppDir}";
        StateDirectory = baseNameOf dataDir;
        UMask = "0027";
        EnvironmentFile = cfg.environmentFile;

        ExecStart = ''
-          ${pkgs.matrix-appservice-discord}/bin/matrix-appservice-discord \
+          ${cfg.package}/bin/matrix-appservice-discord \
            --file='${registrationFile}' \
            --config='${settingsFile}' \
            --port='${toString cfg.port}'
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@ -1,126 +1,190 @@
-{ stdenv
-, lib
-, fetchpatch
-, pkg-config
-, cmake
-, bluez
-, ffmpeg
-, libao
-, gtk3
-, glib
-, libGLU
-, libGL
-, gettext
-, libpthreadstubs
-, libXrandr
-, libXext
-, readline
-, openal
-, libXdmcp
-, portaudio
+{ lib
+, stdenv
 , fetchFromGitHub
-, libusb1
-, libevdev
-, wxGTK30
-, soundtouch
-, miniupnpc
-, mbedtls_2
+, cmake
+, pkg-config
+, wrapQtAppsHook
+, alsa-lib
+, bluez
+, bzip2
+, cubeb
 , curl
-, lzo
+, enet
+, ffmpeg
+, fmt_8
+, hidapi
+, libevdev
+, libGL
+, libiconv
+, libpulseaudio
+, libspng
+, libusb1
+, libXdmcp
+, libXext
+, libXrandr
+, mbedtls_2
+, mgba
+, miniupnpc
+, minizip-ng
+, openal
+, pugixml
+, qtbase
 , sfml
-, libpulseaudio ? null
+, soundtouch
+, udev
+, vulkan-loader
+, xxHash
+, xz
+
+  # Used in passthru
+, common-updater-scripts
+, dolphin-emu
+, jq
+, testers
+, writeShellScript
+
+  # Darwin-only dependencies
+, CoreBluetooth
+, ForceFeedback
+, IOKit
+, moltenvk
+, OpenGL
+, VideoToolbox
 }:

 stdenv.mkDerivation rec {
  pname = "dolphin-emu";
-  version = "5.0";
+  version = "5.0-18498";

  src = fetchFromGitHub {
    owner = "dolphin-emu";
    repo = "dolphin";
-    rev = version;
-    sha256 = "07mlfnh0hwvk6xarcg315x7z2j0qbg9g7cm040df9c8psiahc3g6";
+    rev = "46b99671d9158e0ca840c1d8ef249db0f321ced7";
+    sha256 = "sha256-K+OF8o8I1XDLQQcsWC8p8jUuWeb+RoHlBG3cEZ1aWIU=";
+    fetchSubmodules = true;
  };

-  patches = [
-    # Fix FTBFS with glibc 2.26
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/02_glibc-2.26.patch";
-      name = "02_glibc-2.26.patch";
-      sha256 = "sha256-LBXT3rf5klwmX9YQXt4/iv06GghsWZprNhLGYlKiDqk=";
-    })
-    # Fix FTBFS with GCC 8
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/03_gcc8.patch";
-      name = "03_gcc8.patch";
-      sha256 = "sha256-uWP6zMjoHYbX6K+oPSQdBn2xWQpvNyhZabMkhtYrSbU=";
-    })
-    # Fix FTBFS with SoundTouch 2.1.2
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/05_soundtouch-2.1.2.patch";
-      name = "05_soundtouch-2.1.2.patch";
-      sha256 = "sha256-Y7CNM6GQC9GRhlOBLZlxkIpj1CFhIwA5L8lGXur/bwY=";
-    })
-    # Use GTK+3 wxWidgets backend
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/06_gtk3.patch";
-      name = "06_gtk3.patch";
-      sha256 = "sha256-pu5Q0+8kNwmpf2DoXCXHFqxF0EGTnFXJipkBz1Vh2cs=";
-    })
-  ];
-
-  cmakeFlags = [
-    "-DENABLE_LTO=True"
-  ];
-
  nativeBuildInputs = [
-    pkg-config
    cmake
+    pkg-config
+    wrapQtAppsHook
  ];

  buildInputs = [
-    bluez
-    ffmpeg
-    libao
-    libGLU
-    libGL
-    gtk3
-    glib
-    gettext
-    libpthreadstubs
-    libXrandr
-    libXext
-    readline
-    openal
-    libevdev
-    libXdmcp
-    portaudio
-    libpulseaudio
-    libevdev
-    libXdmcp
-    portaudio
-    libusb1
-    libpulseaudio
-    wxGTK30
-    soundtouch
-    miniupnpc
-    mbedtls_2
+    bzip2
+    cubeb
    curl
-    lzo
+    enet
+    ffmpeg
+    fmt_8
+    hidapi
+    libGL
+    libiconv
+    libpulseaudio
+    libspng
+    libusb1
+    libXdmcp
+    mbedtls_2
+    miniupnpc
+    minizip-ng
+    openal
+    pugixml
+    qtbase
    sfml
+    soundtouch
+    xxHash
+    xz
+  ] ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    bluez
+    libevdev
+    libXext
+    libXrandr
+    mgba # Derivation doesn't support Darwin
+    udev
+    vulkan-loader
+  ] ++ lib.optionals stdenv.isDarwin [
+    CoreBluetooth
+    ForceFeedback
+    IOKit
+    moltenvk
+    OpenGL
+    VideoToolbox
  ];

+  cmakeFlags = [
+    "-DDISTRIBUTOR=NixOS"
+    "-DUSE_SHARED_ENET=ON"
+    "-DDOLPHIN_WC_REVISION=${src.rev}"
+    "-DDOLPHIN_WC_DESCRIBE=${version}"
+    "-DDOLPHIN_WC_BRANCH=master"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DOSX_USE_DEFAULT_SEARCH_PATH=True"
+    "-DUSE_BUNDLED_MOLTENVK=OFF"
+    # Bundles the application folder into a standalone executable, so we cannot devendor libraries
+    "-DSKIP_POSTPROCESS_BUNDLE=ON"
+    # Needs xcode so compilation fails with it enabled. We would want the version to be fixed anyways.
+    # Note: The updater isn't available on linux, so we dont need to disable it there.
+    "-DENABLE_AUTOUPDATE=OFF"
+  ];
+
+  qtWrapperArgs = lib.optionals stdenv.isLinux [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
+    # https://bugs.dolphin-emu.org/issues/11807
+    # The .desktop file should already set this, but Dolphin may be launched in other ways
+    "--set QT_QPA_PLATFORM xcb"
+  ];
+
+  # https://github.com/NixOS/nixpkgs/issues/201254
+  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
+
+  # Use nix-provided libraries instead of submodules
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace CMakeLists.txt \
+      --replace "if(NOT APPLE)" "if(true)" \
+      --replace "if(LIBUSB_FOUND AND NOT APPLE)" "if(LIBUSB_FOUND)"
+  '';
+
  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
    install -D $src/Data/51-usb-device.rules $out/etc/udev/rules.d/51-usb-device.rules
+  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Only gets installed automatically if the standalone executable is used
+    mkdir -p $out/Applications
+    cp -r ./Binaries/Dolphin.app $out/Applications
+    ln -s $out/Applications/Dolphin.app/Contents/MacOS/Dolphin $out/bin
  '';

+  passthru = {
+    tests.version = testers.testVersion {
+      package = dolphin-emu;
+      command = "dolphin-emu-nogui --version";
+    };
+
+    updateScript = writeShellScript "dolphin-update-script" ''
+      set -eou pipefail
+      export PATH=${lib.makeBinPath [ curl jq common-updater-scripts ]}
+
+      json="$(curl -s https://dolphin-emu.org/update/latest/beta)"
+      version="$(jq -r '.shortrev' <<< "$json")"
+      rev="$(jq -r '.hash' <<< "$json")"
+      update-source-version dolphin-emu "$version" --rev="$rev"
+    '';
+  };
+
  meta = with lib; {
-    homepage = "https://dolphin-emu.org/";
+    homepage = "https://dolphin-emu.org";
    description = "Gamecube/Wii/Triforce emulator for x86_64 and ARMv8";
+    mainProgram = if stdenv.hostPlatform.isDarwin then "Dolphin" else "dolphin-emu";
+    branch = "master";
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ MP2E ashkitten ];
-    # x86_32 is an unsupported platform.
-    # Enable generic build if you really want a JIT-less binary.
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [
+      MP2E
+      ashkitten
+      xfix
+      ivar
+    ];
+    # Requires both LLVM and SDK bump
+    broken = stdenv.isDarwin && stdenv.isx86_64;
  };
 }
--- a/pkgs/applications/emulators/dolphin-emu/master.nix
+++ b/pkgs/applications/emulators/dolphin-emu/master.nix
@ -1,196 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, pkg-config
-, cmake
-, wrapQtAppsHook
-, qtbase
-, bluez
-, ffmpeg
-, libGL
-, libXrandr
-, libusb1
-, libXdmcp
-, libXext
-, openal
-, udev
-, libevdev
-, cubeb
-, curl
-, alsa-lib
-, miniupnpc
-, enet
-, mbedtls_2
-, soundtouch
-, sfml
-, minizip-ng
-, xz
-, hidapi
-, fmt_8
-, vulkan-loader
-, libpulseaudio
-, bzip2
-, libiconv
-, pugixml
-, xxHash
-
-  # Used in passthru
-, testers
-, dolphin-emu-beta
-, writeShellScript
-, common-updater-scripts
-, jq
-
-  # Darwin-only dependencies
-, CoreBluetooth
-, ForceFeedback
-, IOKit
-, VideoToolbox
-, OpenGL
-, libpng
-, moltenvk
-}:
-
-stdenv.mkDerivation rec {
-  pname = "dolphin-emu";
-  version = "5.0-17995";
-
-  src = fetchFromGitHub {
-    owner = "dolphin-emu";
-    repo = "dolphin";
-    rev = "8bad821019721b9b72701b495da95656ace5fea5";
-    sha256 = "sha256-uxHzn+tXRBr11OPpZ4ELBw7DTJH4mnqUBOeyPlXNAh8=";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # On x86_64-darwin CMake reportedly does not work without this in some cases.
-    # See https://github.com/NixOS/nixpkgs/pull/190373#issuecomment-1241310765
-    ./minizip-external-missing-include.patch
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    cubeb
-    curl
-    ffmpeg
-    pugixml
-    xxHash
-    libGL
-    libpulseaudio
-    openal
-    libusb1
-    libiconv
-    libpng
-    libXdmcp
-    hidapi
-    miniupnpc
-    enet
-    mbedtls_2
-    soundtouch
-    sfml
-    minizip-ng
-    xz
-    qtbase
-    fmt_8
-    bzip2
-  ] ++ lib.optionals stdenv.isLinux [
-    libXrandr
-    libXext
-    bluez
-    udev
-    libevdev
-    alsa-lib
-    vulkan-loader
-  ] ++ lib.optionals stdenv.isDarwin [
-    CoreBluetooth
-    OpenGL
-    ForceFeedback
-    IOKit
-    VideoToolbox
-    moltenvk
-  ];
-
-  cmakeFlags = [
-    "-DDISTRIBUTOR=NixOS"
-    "-DUSE_SHARED_ENET=ON"
-    "-DDOLPHIN_WC_REVISION=${src.rev}"
-    "-DDOLPHIN_WC_DESCRIBE=${version}"
-    "-DDOLPHIN_WC_BRANCH=master"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-DOSX_USE_DEFAULT_SEARCH_PATH=True"
-    "-DUSE_BUNDLED_MOLTENVK=OFF"
-    # Bundles the application folder into a standalone executable, so we cannot devendor libraries
-    "-DSKIP_POSTPROCESS_BUNDLE=ON"
-    # Needs xcode so compilation fails with it enabled. We would want the version to be fixed anyways.
-    # Note: The updater isn't available on linux, so we dont need to disable it there.
-    "-DENABLE_AUTOUPDATE=OFF"
-  ];
-
-  qtWrapperArgs = lib.optionals stdenv.isLinux [
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
-    # https://bugs.dolphin-emu.org/issues/11807
-    # The .desktop file should already set this, but Dolphin may be launched in other ways
-    "--set QT_QPA_PLATFORM xcb"
-    # https://bugs.dolphin-emu.org/issues/12913
-    "--set QT_XCB_NO_XI2 1"
-  ];
-
-  # https://github.com/NixOS/nixpkgs/issues/201254
-  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
-
-  # Use nix-provided libraries instead of submodules
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace CMakeLists.txt \
-      --replace "if(NOT APPLE)" "if(true)" \
-      --replace "if(LIBUSB_FOUND AND NOT APPLE)" "if(LIBUSB_FOUND)"
-  '';
-
-  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
-    install -D $src/Data/51-usb-device.rules $out/etc/udev/rules.d/51-usb-device.rules
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Only gets installed automatically if the standalone executable is used
-    mkdir -p $out/Applications
-    cp -r ./Binaries/Dolphin.app $out/Applications
-    ln -s $out/Applications/Dolphin.app/Contents/MacOS/Dolphin $out/bin
-  '';
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = dolphin-emu-beta;
-      command = "dolphin-emu-nogui --version";
-    };
-
-    updateScript = writeShellScript "dolphin-update-script" ''
-      set -eou pipefail
-      export PATH=${lib.makeBinPath [ curl jq common-updater-scripts ]}
-
-      json="$(curl -s https://dolphin-emu.org/update/latest/beta)"
-      version="$(jq -r '.shortrev' <<< "$json")"
-      rev="$(jq -r '.hash' <<< "$json")"
-      update-source-version dolphin-emu-beta "$version" --rev="$rev"
-    '';
-  };
-
-  meta = with lib; {
-    homepage = "https://dolphin-emu.org";
-    description = "Gamecube/Wii/Triforce emulator for x86_64 and ARMv8";
-    mainProgram = if stdenv.hostPlatform.isDarwin then "Dolphin" else "dolphin-emu";
-    branch = "master";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
-      MP2E
-      ashkitten
-      xfix
-      ivar
-    ];
-    # Requires both LLVM and SDK bump
-    broken = stdenv.isDarwin && stdenv.isx86_64;
-  };
-}
--- a/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch
+++ b/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch
@ -1,18 +0,0 @@
-commit 5e0cb8066fb1653399c54e93e42375295c2562bd
-Author: Ivar Scholten <ivar.scholten@protonmail.com>
-Date:   Fri Sep 9 14:27:55 2022 +0200
-
-    Externals/minizip: add missing include to CheckFunctionExists
-
-diff --git a/Externals/minizip/CMakeLists.txt b/Externals/minizip/CMakeLists.txt
-index c3d7c5512e..f59f8b295c 100644
--- a/Externals/minizip/CMakeLists.txt
-+++ b/Externals/minizip/CMakeLists.txt
-@@ -60,6 +60,7 @@ if (HAVE_INTTYPES_H)
-   target_compile_definitions(minizip PRIVATE HAVE_INTTYPES_H)
- endif()
-
-+include(CheckFunctionExists)
- check_function_exists(fseeko HAVE_FSEEKO)
- if (NOT HAVE_FSEEKO)
-   target_compile_definitions(minizip PRIVATE NO_FSEEKO)
--- a/pkgs/applications/emulators/dosbox-staging/default.nix
+++ b/pkgs/applications/emulators/dosbox-staging/default.nix
@ -1,10 +1,15 @@
-{ alsa-lib
-, copyDesktopItems
+{ lib
+, stdenv
 , fetchFromGitHub
+, SDL2
+, SDL2_image
+, SDL2_net
+, alsa-lib
+, copyDesktopItems
 , fluidsynth
 , glib
 , gtest
-, lib
+, irr1
 , libGL
 , libGLU
 , libjack2
@ -20,22 +25,17 @@
 , ninja
 , opusfile
 , pkg-config
-, irr1
-, SDL2
-, SDL2_image
-, SDL2_net
 , speexdsp
-, stdenv
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (self: {
  pname = "dosbox-staging";
  version = "0.80.1";

  src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "v${version}";
+    owner = "dosbox-staging";
+    repo = "dosbox-staging";
+    rev = "v${self.version}";
    hash = "sha256-I90poBeLSq1c8PXyjrx7/UcbfqFNnnNiXfJdWhLPGMc=";
  };

@ -49,6 +49,9 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
+    SDL2
+    SDL2_image
+    SDL2_net
    alsa-lib
    fluidsynth
    glib
@ -63,9 +66,6 @@ stdenv.mkDerivation rec {
    libslirp
    libsndfile
    opusfile
-    SDL2
-    SDL2_image
-    SDL2_net
    speexdsp
  ];

@ -91,17 +91,17 @@ stdenv.mkDerivation rec {
    # original dosbox. Doing it this way allows us to work with frontends and
    # launchers that expect the binary to be named dosbox, but get out of the
    # way of vanilla dosbox if the user desires to install that as well.
-    mv $out/bin/dosbox $out/bin/${pname}
+    mv $out/bin/dosbox $out/bin/${self.pname}
    makeWrapper $out/bin/dosbox-staging $out/bin/dosbox

    # Create a symlink to dosbox manual instead of merely copying it
    pushd $out/share/man/man1/
-    mv dosbox.1.gz ${pname}.1.gz
-    ln -s ${pname}.1.gz dosbox.1.gz
+    mv dosbox.1.gz ${self.pname}.1.gz
+    ln -s ${self.pname}.1.gz dosbox.1.gz
    popd
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://dosbox-staging.github.io/";
    description = "A modernized DOS emulator";
    longDescription = ''
@ -110,10 +110,14 @@ stdenv.mkDerivation rec {
      existing DOSBox codebase while leveraging modern development tools and
      practices.
    '';
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ joshuafern AndersonTorres ];
-    platforms = platforms.unix;
+    changelog = "https://github.com/dosbox-staging/dosbox-staging/releases/tag/v${self.version}";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [
+      lib.maintainers.joshuafern
+      lib.maintainers.AndersonTorres
+    ];
+    platforms = lib.platforms.unix;
    priority = 101;
  };
-}
-# TODO: report upstream about not finding SDL2_net
+})
+# TODO: report upstream about not finding extra SDL2 libraries
--- a/pkgs/applications/graphics/eyedropper/default.nix
+++ b/pkgs/applications/graphics/eyedropper/default.nix
@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
  ];

  meta = with lib; {
-    description = "An easy-to-use color picker and editor";
+    description = "A powerful color picker and formatter";
    homepage = "https://github.com/FineFindus/eyedropper";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
--- a/pkgs/applications/graphics/jpegoptim/default.nix
+++ b/pkgs/applications/graphics/jpegoptim/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, libjpeg }:

 stdenv.mkDerivation rec {
-  version = "1.5.1";
+  version = "1.5.2";
  pname = "jpegoptim";

  src = fetchFromGitHub {
    owner = "tjko";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-QPipwBk+BS/u3YxB8ACeFXQSuoW1aynEyG3tEMrhcaE=";
+    sha256 = "sha256-PROQvOqsis8we58OOZ/kuY+L/CoV7XfnY9wvrpsTJu8=";
  };

  # There are no checks, it seems.
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@ -6,7 +6,7 @@
 }:

 let
-  version = "5.10.0";
+  version = "5.11.0";

  docFiles = [
    (fetchurl {
@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
    owner = "paraview";
    repo = "paraview";
    rev = "v${version}";
-    sha256 = "0ipx6zq44hpic7gvv0s2jvjncak6vlmrz5sp9ypc15b15bna0gs2";
+    sha256 = "sha256-WvkKGl5lG+apX6m4ULVZZVtDsSUjEVXe/seh95b+LmI=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/graphics/tesseract/tesseract3.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract3.nix
@ -3,15 +3,23 @@

 stdenv.mkDerivation rec {
  pname = "tesseract";
-  version = "3.05.00";
+  version = "3.05.02";

  src = fetchFromGitHub {
    owner = "tesseract-ocr";
    repo = "tesseract";
    rev = version;
-    hash = "sha256-YHj00gG/3SW0ILTiQwphiCxuP9OCDya27hyFQB27mYc=";
+    hash = "sha256-28osuZnVwkJpNTYkU+5D5PI8xtViFzGCMScHzkS2H20=";
  };

+  # leptonica 1.83 made internal structures private. using internal headers isn't
+  # great, but tesseract3's days are numbered anyway
+  postPatch = ''
+    for f in textord/devanagari_processing.cpp cube/cube_line_object.h cube/cube_line_segmenter.h cube/cube_utils.h ; do
+      sed -i '/allheaders.h/a#include "pix_internal.h"' "$f"
+    done
+  '';
+
  enableParallelBuilding = true;

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/tesseract/tesseract4.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract4.nix
@ -3,26 +3,20 @@

 stdenv.mkDerivation rec {
  pname = "tesseract";
-  version = "4.1.1";
+  version = "4.1.3";

  src = fetchFromGitHub {
    owner = "tesseract-ocr";
    repo = "tesseract";
    rev = version;
-    hash = "sha256-lu/Y5mlCI8AajhiWaID0fGo5PghEQZdgt2X0K9c/QrE=";
+    hash = "sha256-sV3w53ky13ESc0dGPutMGQ4TcmOeWJkvUwBPIyzSTc8=";
  };

-  patches = [
-    # https://github.com/tesseract-ocr/tesseract/issues/3447
-    (fetchpatch {
-      url = "https://github.com/tesseract-ocr/tesseract/commit/dbc79b09d195490dfa3f7d338eadac07ad6683f7.patch";
-      sha256 = "sha256-lGlg0etuU4RXfdq1QH2bYObdeGrFHKf9O8zMUAbfNIQ=";
-    })
-    (fetchpatch {
-      url = "https://github.com/tesseract-ocr/tesseract/commit/6dc4b184b1ebf2e68461f6b63f63a033bc7245f7.patch";
-      sha256 = "sha256-DwIX3r5NmeajI6WgIVHDbkhLH/ygJIjPO5XrbzWQhSw=";
-    })
-  ];
+  # leptonica 1.83 made internal structures private. using internal headers isn't
+  # great, but tesseract4's days are numbered anyway
+  postPatch = ''
+    sed -i '/allheaders.h/a#include "pix_internal.h"' src/textord/devanagari_processing.cpp
+  '';

  enableParallelBuilding = true;

--- a/pkgs/applications/misc/qt-box-editor/default.nix
+++ b/pkgs/applications/misc/qt-box-editor/default.nix
@ -10,23 +10,25 @@

 mkDerivation {
  pname = "qt-box-editor";
-  version = "unstable-2019-07-12";
+  version = "unstable-2019-07-14";

  src = fetchFromGitHub {
    owner = "zdenop";
    repo = "qt-box-editor";
-    rev = "75a68b466868ba41ba2886caa796057403fe1901";
-    sha256 = "0zwsyy7cnbhy5aazwlkhd9y8bnzlgy1gffqa46abajn4809b95k3";
+    rev = "cba2929dabc6c715acd1a282ba161fee914c87f6";
+    hash = "sha256-3dWnAu0CLO3atjbC1zJEnL3vzsIEecDDDhW3INMfCv4=";
  };

  buildInputs = [ qtbase qtsvg leptonica tesseract ];

  nativeBuildInputs = [ qmake ];

-  # remove with next release
-  # https://github.com/zdenop/qt-box-editor/pull/78
+  # https://github.com/zdenop/qt-box-editor/issues/87
  postPatch = ''
-    printf "INSTALLS += target\ntarget.path = $out/bin" >>  qt-box-editor.pro
+    sed -i '/allheaders.h/a#include <leptonica/pix_internal.h>' src/TessTools.h
+
+    substituteInPlace qt-box-editor.pro \
+      --replace '-llept' '-lleptonica'
  '';

  meta = with lib; {
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@ -2,7 +2,7 @@

 (callPackage ./generic.nix { }) {
  channel = "edge";
-  version = "23.1.2";
-  sha256 = "1c8l5zzy5pjilp1a84084g3dgdm0rxkx7hj7lqcn0iihfvhxc1xq";
-  vendorSha256 = "sha256-6dOX3SsKjpwC/dEUO2SnVna99lpav7kIEKrMUy4YfhA=";
+  version = "23.2.1";
+  sha256 = "0qjl6qxfg6bj22fwm2y01if5dqp2w79y45ibrg46r33pf6gbwjxj";
+  vendorSha256 = "sha256-YxWBjbE3aBFfCbQeSTfQv5QzP5n4IRHHqNrFwrJPQ7g=";
 }
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "pluto";
-  version = "5.12.0";
+  version = "5.13.3";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "pluto";
    rev = "v${version}";
-    sha256 = "sha256-WE/XWNBy5p8PEQ11s8nmW+HoVEkQB9cKoj5ZS8Suvs8=";
+    sha256 = "sha256-6kbfsqhALf7LFl0GS4VAMTVDFKP+CaEr6IPfpTZ33Fo=";
  };

-  vendorHash = "sha256-F5Vh9wPd53bifLStk6wEwidPZvOjN87jn4RxJbSuW4o=";
+  vendorHash = "sha256-lXW1yHrGLwZdhfkMLeu7zm0w2HxXk1DW+QEY+rfGZpE=";

  ldflags = [
    "-w" "-s"
--- a/pkgs/applications/networking/go-graft/default.nix
+++ b/pkgs/applications/networking/go-graft/default.nix
@ -2,19 +2,19 @@

 buildGoModule rec {
  pname = "go-graft";
-  version = "0.2.16";
+  version = "0.2.17";

  src = fetchFromGitHub {
    owner = "mzz2017";
    repo = "gg";
    rev = "v${version}";
-    sha256 = "sha256-zdOcQ/+WXS7pDfnvYdb/FDjMT3yJdwnS8DoH2MIDcDs=";
+    sha256 = "sha256-UhRsgUz9au7e47cS6yrIJXc/8ZxVDpMHWBjoAcw+oCM=";
  };

  CGO_ENABLED = 0;

  ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" "-buildid=" ];
-  vendorHash = "sha256-kx94B1XIXWJOY9Y69lNb/sHWVjsuFuOXrdtJFJrUuAs=";
+  vendorHash = "sha256-EiBt2SxUQY05Wr7KJbK+fs3U3iSmqECJ0glS8B2Ox9Q=";
  subPackages = [ "." ];

  meta = with lib; {
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -3,7 +3,7 @@ let
  versions = if stdenv.isLinux then {
    stable = "0.0.24";
    ptb = "0.0.38";
-    canary = "0.0.146";
+    canary = "0.0.148";
  } else {
    stable = "0.0.264";
    ptb = "0.0.59";
@ -22,7 +22,7 @@ let
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        sha256 = "sha256-5GiG+RGqwHUdIeSVWpbaIw3sTuZbvIQeetXSEvSqTls=";
+        sha256 = "sha256-2ZrSDyPj3AHriCWZ/bb303H3J97TTun//WjmInNEmwk=";
      };
    };
    x86_64-darwin = {
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -4,13 +4,13 @@ let
  common = { stname, target, postInstall ? "" }:
    buildGoModule rec {
      pname = stname;
-      version = "1.23.0";
+      version = "1.23.1";

      src = fetchFromGitHub {
        owner = "syncthing";
        repo = "syncthing";
        rev = "v${version}";
-        hash = "sha256-Z4YVU45na4BgIbN/IlORpTCuf2EuSuOyppDRzswn3EI=";
+        hash = "sha256-Jbg56Nn+5ZjIv1KZrThkqWY+P13MglLE78E6jc0rbY0=";
      };

      vendorHash = "sha256-q63iaRxJRvPY0Np20O6JmdMEjSg/kxRneBfs8fRTwXk=";
--- a/pkgs/applications/office/paperwork/paperwork-shell.nix
+++ b/pkgs/applications/office/paperwork/paperwork-shell.nix
@ -11,6 +11,7 @@
 , fabulous
 , getkey
 , psutil
+, shared-mime-info

 , pkgs
 }:
@ -39,6 +40,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    shared-mime-info
    openpaperwork-gtk
  ];

--- a/pkgs/applications/office/paperwork/src.nix
+++ b/pkgs/applications/office/paperwork/src.nix
@ -1,13 +1,13 @@
 {fetchFromGitLab}:
 rec {
-  version = "2.1.1";
+  version = "2.1.2";
  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    repo = "paperwork";
    group = "World";
    owner = "OpenPaperwork";
    rev = version;
-    sha256 = "2M2eMP54F3RRDMBuAZ1gBiBoMmTRJaHTUwtTjj4ZU+4=";
+    sha256 = "/5k+zUtTE+Dr879xbHDCAYrqlEJLsbkcRSG3GbA/PCg=";
  };
  sample_documents = fetchFromGitLab {
    domain = "gitlab.gnome.org";
--- a/pkgs/applications/science/biology/last/default.nix
+++ b/pkgs/applications/science/biology/last/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "last";
-  version = "1445";
+  version = "1447";

  src = fetchFromGitLab {
    owner = "mcfrith";
    repo = "last";
    rev = "refs/tags/${version}";
-    hash = "sha256-E3D9KmCIVcwXblwJ0wePk0wKoXwKA2UsSGqfMmRsw2A=";
+    hash = "sha256-zts1F2tFeBP7CQifpc2M4i6duK8FA7hQXTOizv8/kWM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/math/gap/default.nix
+++ b/pkgs/applications/science/math/gap/default.nix
@ -134,8 +134,6 @@ stdenv.mkDerivation rec {
    # https://github.com/NixOS/nixpkgs/pull/192548#discussion_r992824942
    rm -r "$out/share/gap/pkg"
    cp -ar pkg tst "$out/share/gap"
-
-    makeWrapper "$out/lib/gap/gap" "$out/bin/gap" --add-flags "-l $out/share/gap"
  '';

  preFixup = ''
--- a/pkgs/applications/science/math/pari/default.nix
+++ b/pkgs/applications/science/math/pari/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , gmp
 , libX11
 , libpthreadstubs
@ -25,6 +26,15 @@ stdenv.mkDerivation rec {
    hash = "sha256-sEYoER7iKHZRmksc2vsy/rqjTq+iT56B9Y+NBX++4N0=";
  };

+  patches = [
+    # https://pari.math.u-bordeaux.fr/cgi-bin/bugreport.cgi?bug=2441
+    (fetchpatch {
+      name = "fix-find_isogenous_from_Atkin.patch";
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/pari/patches/bug2441.patch?id=9.8.rc0";
+      hash = "sha256-DvOUFlFDnopN+MJY6GYRPNabuoHPFch/nNn+49ygznc=";
+    })
+  ];
+
  buildInputs = [
    gmp
    libX11
--- a/pkgs/applications/science/math/sage/README.md
+++ b/pkgs/applications/science/math/sage/README.md
@ -10,7 +10,7 @@ First you should find out which change to nixpkgs is at fault (if you don't alre

 If the build broke as a result of a package update, try those solutions in order:

- search the [sage trac](https://trac.sagemath.org/) for keywords like "Upgrade <package>". Maybe somebody has already proposed a patch that fixes the issue. You can then add a `fetchpatch` to `sage-src.nix`.
+- search the [sage GitHub repo](https://github.com/sagemath/sage) for keywords like "Upgrade <package>". Maybe somebody has already proposed a patch that fixes the issue. You can then add a `fetchpatch` to `sage-src.nix`.

 - check if [gentoo](https://github.com/cschwan/sage-on-gentoo/tree/master/sci-mathematics/sage), [debian](https://salsa.debian.org/science-team/sagemath/tree/master/debian) or [arch linux](https://git.archlinux.org/svntogit/community.git/tree/trunk?h=packages/sagemath) already solved the problem. You can then again add a `fetchpatch` to `sage-src.nix`. If applicable you should also [propose the patch upstream](#proposing-a-sage-patch).

@ -19,7 +19,7 @@ If the build broke as a result of a package update, try those solutions in order
 ```
 [user@localhost ~]$ git clone https://github.com/sagemath/sage.git
 [user@localhost ~]$ cd sage
-[user@localhost sage]$ git checkout 8.2 # substitute the relevant version here
+[user@localhost sage]$ git checkout 9.8 # substitute the relevant version here
 ```

 Then make the needed changes and generate a patch with `git diff`:
@ -29,42 +29,10 @@ Then make the needed changes and generate a patch with `git diff`:
 [user@localhost ~]$ git diff -u > /path/to/nixpkgs/pkgs/applications/science/math/sage/patches/name-of-patch.patch
 ```

-Now just add the patch to `sage-src.nix` and test your changes. If they fix the problem, [propose them upstream](#proposing-a-sage-patch) and add a link to the trac ticket.
+Now just add the patch to `sage-src.nix` and test your changes. If they fix the problem, submit a PR upstream (refer to sages [Developer's Guide](http://doc.sagemath.org/html/en/developer/index.html) for further details).

 - pin the package version in `default.nix` and add a note that explains why that is necessary.

-
-## Proposing a sage patch
-
-You can [login the sage trac using GitHub](https://trac.sagemath.org/login). Your username will then be `gh-<your-github-name>`. The only other way is to request a trac account via email. After that refer to [git the hard way](http://doc.sagemath.org/html/en/developer/manual_git.html#chapter-manual-git) in the sage documentation. The "easy way" requires a non-GitHub account (requested via email) and a special tool. The "hard way" is really not all that hard if you're a bit familiar with git.
-
-Here's the gist, assuming you want to use ssh key authentication. First, [add your public ssh key](https://trac.sagemath.org/prefs/sshkeys). Then:
-
-```
-[user@localhost ~]$ git clone https://github.com/sagemath/sage.git
-[user@localhost ~]$ cd sage
-[user@localhost sage]$ git remote add trac git@trac.sagemath.org:sage.git -t master
-[user@localhost sage]$ git checkout -b u/gh-<your-github-username>/<your-branch-name> develop
-[user@localhost sage]$ <make changes>
-[user@localhost sage]$ git add .
-[user@localhost sage]$ git commit
-[user@localhost sage]$ git show # review your changes
-[user@localhost sage]$ git push --set-upstream trac u/gh-<your-github-username>/<your-branch-name>
-```
-
-You now created a branch on the trac server (you *must* follow the naming scheme as you only have push access to branches with the `u/gh-<your-github-username>/` prefix).
-Now you can [create a new trac ticket](https://trac.sagemath.org/newticket).
- Write a description of the change
- set the type and component as appropriate
- write your real name in the "Authors" field
- write `u/gh-<your-github-username>/<your-branch-name>` in the "Branch" field
- click "Create ticket"
- click "Modify" on the top right of your ticket (for some reason you can only change the ticket status after you have created it)
- set the ticket status from `new` to `needs_review`
- click "Save changes"
-
-Refer to sages [Developer's Guide](http://doc.sagemath.org/html/en/developer/index.html) for further details.
-
 ## I want to update sage

 You'll need to change the `version` field in `sage-src.nix`. Afterwards just try to build and let nix tell you which patches no longer apply (hopefully because they were adopted upstream). Remove those.
@ -74,5 +42,5 @@ If the problem is not obvious, you can try to first update sage to an intermedia

 ## Well, that didn't help!

-If you couldn't fix the problem, create a GitHub issue on the nixpkgs repo and ping @timokau (or whoever is listed in the `maintainers` list of the sage package).
+If you couldn't fix the problem, create a GitHub issue on the nixpkgs repo and ping the sage maintainers (as listed in the sage package).
 Describe what you did and why it didn't work. Afterwards it would be great if you help the next guy out and improve this documentation!
--- a/pkgs/applications/science/math/sage/env-locations.nix
+++ b/pkgs/applications/science/math/sage/env-locations.nix
@ -35,7 +35,8 @@ writeTextFile rec {
    export GRAPHS_DATA_DIR='${graphs}/share/graphs'
    export ELLCURVE_DATA_DIR='${elliptic_curves}/share/ellcurves'
    export POLYTOPE_DATA_DIR='${polytopes_db}/share/reflexive_polytopes'
-    export GAP_ROOT_DIR='${gap}/share/gap'
+    export GAP_LIB_DIR='${gap}/lib/gap'
+    export GAP_SHARE_DIR='${gap}/share/gap'
    export ECLDIR='${maxima.lisp-compiler}/lib/${maxima.lisp-compiler.pname}-${maxima.lisp-compiler.version}/'
    export COMBINATORIAL_DESIGN_DATA_DIR="${combinatorial_designs}/share/combinatorial_designs"
    export CREMONA_MINI_DATA_DIR="${elliptic_curves}/share/cremona"
--- a/pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch
+++ b/pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch
@ -1,26 +0,0 @@
-diff --git a/src/sage/geometry/polyhedron/backend_normaliz.py b/src/sage/geometry/polyhedron/backend_normaliz.py
-index 86b89632a5..ca8a43b248 100644
--- a/src/sage/geometry/polyhedron/backend_normaliz.py
-+++ b/src/sage/geometry/polyhedron/backend_normaliz.py
-@@ -53,7 +53,7 @@ def _number_field_elements_from_algebraics_list_of_lists_of_lists(listss, **kwds
-         1.732050807568878?
-         sage: from sage.geometry.polyhedron.backend_normaliz import _number_field_elements_from_algebraics_list_of_lists_of_lists
-         sage: K, results, hom = _number_field_elements_from_algebraics_list_of_lists_of_lists([[[rt2], [1]], [[rt3]], [[1], []]]); results  # optional - sage.rings.number_field
-        [[[-a^3 + 3*a], [1]], [[-a^2 + 2]], [[1], []]]
-+        [[[-a^3 + 3*a], [1]], [[a^2 - 2]], [[1], []]]
-     """
-     from sage.rings.qqbar import number_field_elements_from_algebraics
-     numbers = []
-diff --git a/src/sage/lfunctions/pari.py b/src/sage/lfunctions/pari.py
-index d2b20f1891..6c31efe239 100644
--- a/src/sage/lfunctions/pari.py
-+++ b/src/sage/lfunctions/pari.py
-@@ -339,7 +339,7 @@ def lfun_eta_quotient(scalings, exponents):
-         0.0374412812685155
- 
-         sage: lfun_eta_quotient([6],[4])
-        [[Vecsmall([7]), [Vecsmall([6]), Vecsmall([4])]], 0, [0, 1], 2, 36, 1]
-+        [[Vecsmall([7]), [Vecsmall([6]), Vecsmall([4]), 0]], 0, [0, 1], 2, 36, 1]
- 
-         sage: lfun_eta_quotient([2,1,4], [5,-2,-2])
-         Traceback (most recent call last):
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -57,14 +57,14 @@ let
  );
 in
 stdenv.mkDerivation rec {
-  version = "9.7";
+  version = "9.8";
  pname = "sage-src";

  src = fetchFromGitHub {
    owner = "sagemath";
    repo = "sage";
    rev = version;
-    sha256 = "sha256-MYpCp18wqKwCa+tcJ7He14p1FXDlVm1vubQqQS9g3LY=";
+    sha256 = "sha256-dDbrzJXsOBARYfJz0r7n3LbaoXHnx7Acz6HBa95NV9o=";
  };

  # Patches needed because of particularities of nix or the way this is packaged.
@ -89,14 +89,6 @@ stdenv.mkDerivation rec {
    # To help debug the transient error in
    # https://trac.sagemath.org/ticket/23087 when it next occurs.
    ./patches/configurationpy-error-verbose.patch
-
-    # https://trac.sagemath.org/ticket/33907
-    (fetchSageDiff {
-      name = "interfaces-expectpy-intermittent.patch";
-      base = "9.8.beta6";
-      rev = "6f5c1c2fc8bcfb5e6555716d05ce70511795ffa1";
-      sha256 = "sha256-z8FQxtrk62MHzPjrUTad+fMAE6XV8GTsLWKgGOM3zBg=";
-    })
  ];

  # Patches needed because of package updates. We could just pin the versions of
@ -119,28 +111,12 @@ stdenv.mkDerivation rec {
    # adapted from https://trac.sagemath.org/ticket/23712#comment:22
    ./patches/tachyon-renamed-focallength.patch

-    # https://trac.sagemath.org/ticket/34118
-    (fetchSageDiff {
-      name = "sympy-1.11-upgrade.patch";
-      base = "9.7";
-      rev = "52815744bde2b682245b6f985a112f7cb8666056";
-      sha256 = "sha256-gv6z6JkQ6S6oCJQNkVgcPVvzlplyvR1nC7pWmcUiSc0=";
-    })
-
-    # https://trac.sagemath.org/ticket/34460
-    (fetchSageDiff {
-      name = "ipywidgets-8-upgrade.patch";
-      base = "9.7";
-      rev = "2816dbacb342398a23bb3099e20c92c8020ab0fa";
-      sha256 = "sha256-tCOsMxXwPkRg3FJGVvTqDzlWdra78UfDY6nci0Nr9GI=";
-    })
-
    # https://trac.sagemath.org/ticket/34391
    (fetchSageDiff {
      name = "gap-4.12-upgrade.patch";
-      base = "9.8.beta2";
-      rev = "eb8cd42feb58963adba67599bf6e311e03424328";
-      sha256 = "sha256-0dKewOZe2n3PqSdxCJt18FkqwTdrD0VA5MXAMiTW8Tw=";
+      base = "9.8.beta7";
+      rev = "dd4a17281adcda74e11f998ef519b6bd0dafb043";
+      sha256 = "sha256-UQT9DO9xd5hh5RucvUkIm+rggPKu8bc1YaSI6LVYH98=";
    })

    # https://trac.sagemath.org/ticket/34701
@ -151,46 +127,6 @@ stdenv.mkDerivation rec {
      sha256 = "sha256-9BhQLFB3wUhiXRQsK9L+I62lSjvTfrqMNi7QUIQvH4U=";
    })

-    # https://trac.sagemath.org/ticket/34537
-    (fetchSageDiff {
-      name = "pari-2.15.1-upgrade.patch";
-      squashed = true;
-      base = "54cd6fe6de52aee5a433e0569e8c370618cb2047"; # 9.8.beta1
-      rev = "1e86aa26790d84bf066eca67f98a60a8aa3d4d3a";
-      sha256 = "sha256-LUgcMqrKXWb72Kxl0n6MV5unLXlQSeG8ncN41F7TRSc=";
-      excludes = ["build/*"
-                  "src/sage/geometry/polyhedron/base_number_field.py"
-                  "src/sage/geometry/polyhedron/backend_normaliz.py"
-                  "src/sage/lfunctions/pari.py"];
-    })
-    # Some files were excluded from the above patch due to
-    # conflicts. The patch below contains rebased versions.
-    ./patches/pari-2.15.1-upgrade-rebased.patch
-
-    # https://trac.sagemath.org/ticket/34668
-    (fetchSageDiff {
-      name = "matplotlib-3.6-upgrade.patch";
-      base = "9.8.beta2";
-      rev = "5501e0de0dca1cff0355326dd42bd8c7e5749568";
-      sha256 = "sha256-ceJkVaecIsZewN8v/3gPQXFbFjv5Akz6zEFg/ToXdek=";
-    })
-
-    # https://trac.sagemath.org/ticket/34693
-    (fetchSageDiff {
-      name = "matplotlib-3.6-docbuilding.patch";
-      base = "9.8.beta4";
-      rev = "64589686c261d33e6b5aff2589bcae8af004bcc6";
-      sha256 = "sha256-j5AMY1TmhP+HBBBYaFZSkABJ5vtwe6iP2LRfGEgSm8Q=";
-    })
-
-    # https://trac.sagemath.org/ticket/34615
-    (fetchSageDiff {
-      name = "sphinx-5.2-upgrade.patch";
-      base = "9.8.beta1";
-      rev = "8f8af65e54d3a9962cfab40f15dc23f4e955b43f";
-      sha256 = "sha256-yhDdyxnXSSkqLcuOPBWSEBc26rk1Od3gLcWW8S2p8bY=";
-    })
-
    # temporarily paper over https://github.com/jupyter-widgets/ipywidgets/issues/3669
    ./patches/ipywidgets-on_submit-deprecationwarning.patch

--- a/pkgs/applications/terminal-emulators/foot/default.nix
+++ b/pkgs/applications/terminal-emulators/foot/default.nix
@ -18,7 +18,7 @@
 , wayland-scanner
 , pkg-config
 , utf8proc
-, allowPgo ? true
+, allowPgo ? !stdenv.hostPlatform.isMusl
 , python3  # for PGO
 # for clang stdenv check
 , foot
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@ -26,13 +26,13 @@

 buildPythonApplication rec {
  pname = "commitizen";
-  version = "2.41.0";
+  version = "2.42.0";

  src = fetchFromGitHub {
    owner = "commitizen-tools";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-dzAIRfUdyHSefDRDuPMsr8l2Dsiall2ZUDB6GufTbXE=";
+    hash = "sha256-13WEbF6in+zYZXWYqlYA98qJkKxjmcpQY9GuGS+DDtk=";
  };

  format = "pyproject";
--- a/pkgs/applications/version-management/sapling/default.nix
+++ b/pkgs/applications/version-management/sapling/default.nix
@ -88,111 +88,93 @@ let
      runHook postInstall
    '';
  };
-
-  # Builds the main `sl` binary and its Python extensions
-  sapling = python3Packages.buildPythonPackage {
-    pname = "sapling-main";
-    inherit src version;
-
-    sourceRoot = "source/eden/scm";
-
-    # Upstream does not commit Cargo.lock
-    cargoDeps = rustPlatform.importCargoLock {
-      lockFile = ./Cargo.lock;
-      outputHashes = {
-        "cloned-0.1.0" = "sha256-DYQTK722wgeDUJtOVXHLt42G6gpe6A62rET+JH+bPKU=";
-        "deltae-0.3.0" = "sha256-a9Skaqs+tVTw8x83jga+INBr+TdaMmo35Bf2wbfR6zs=";
-        "fb303_core-0.0.0" = "sha256-YEFNTYvtgp8nc/1O7AbdyxCD3Xx2xCjbS17fTTEsUL0=";
-        "fbthrift-0.0.1+unstable" = "sha256-mDoYhXOzQIDqP7XdmiBbmq5VmAKAgggTNH/kW2kHv4k=";
-        "reqwest-0.11.11" = "sha256-uhc8XhkGW22XDNo0qreWdXeFF2cslOOZHfTRQ30IBcE=";
-        "serde_bser-0.3.1" = "sha256-/zn1NfXWytXvnalkgPsg9BdujVV97PGkXwmPtQGVeCc=";
-      };
-    };
-    postPatch = ''
-      cp ${./Cargo.lock} Cargo.lock
-    '';
-
-    # Since the derivation builder doesn't have network access to remain pure,
-    # fetch the artifacts manually and link them. Then replace the hardcoded URLs
-    # with filesystem paths for the curl calls.
-    postUnpack = ''
-      mkdir $sourceRoot/hack_pydeps
-      ${lib.concatStrings (map (li: "ln -s ${fetchurl li} $sourceRoot/hack_pydeps/${baseNameOf li.url}\n") links)}
-      sed -i "s|https://files.pythonhosted.org/packages/[[:alnum:]]*/[[:alnum:]]*/[[:alnum:]]*/|file://$NIX_BUILD_TOP/$sourceRoot/hack_pydeps/|g" $sourceRoot/setup.py
-    '';
-
-    # Now, copy the "sl web" (aka edenscm-isl) results into the output of this
-    # package, so that the command can actually work. NOTES:
-    #
-    # 1) This applies on all systems (so no conditional a la postFixup)
-    # 2) This doesn't require any kind of fixup itself, so we leave it out
-    #    of postFixup for that reason, too
-    # 3) If asked, we optionally patch in a hardcoded path to the 'nodejs' package,
-    #    so that 'sl web' always works
-    # 4) 'sl web' will still work if 'nodejs' is in $PATH, just not OOTB
-    preFixup = ''
-      sitepackages=$out/lib/${python3Packages.python.libPrefix}/site-packages
-      chmod +w $sitepackages
-      cp -r ${isl} $sitepackages/edenscm-isl
-    '' + lib.optionalString (!enableMinimal) ''
-      chmod +w $sitepackages/edenscm-isl/run-isl
-      substituteInPlace $sitepackages/edenscm-isl/run-isl \
-        --replace 'NODE=node' 'NODE=${nodejs}/bin/node'
-    '';
-
-    postFixup = lib.optionalString stdenv.isLinux ''
-      wrapProgram $out/bin/sl \
-        --set LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive"
-    '';
-
-    nativeBuildInputs = [
-      curl
-      pkg-config
-    ] ++ (with rustPlatform; [
-      myCargoSetupHook
-      rust.cargo
-      rust.rustc
-    ]);
-
-    buildInputs = [
-      openssl
-    ] ++ lib.optionals stdenv.isDarwin [
-      curl
-      libiconv
-      CoreFoundation
-      CoreServices
-      Security
-    ];
-
-    doCheck = false;
-
-    HGNAME = "sl";
-    SAPLING_OSS_BUILD = "true";
-    SAPLING_VERSION = version;
-    SAPLING_VERSION_HASH = versionHash;
-  };
 in
-stdenv.mkDerivation {
+# Builds the main `sl` binary and its Python extensions
+python3Packages.buildPythonApplication {
  pname = "sapling";
-  inherit version;
+  inherit src version;

-  dontUnpack = true;
+  sourceRoot = "source/eden/scm";

-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-    cp -r ${sapling}/* $out
-
-    runHook postInstall
+  # Upstream does not commit Cargo.lock
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "cloned-0.1.0" = "sha256-DYQTK722wgeDUJtOVXHLt42G6gpe6A62rET+JH+bPKU=";
+      "deltae-0.3.0" = "sha256-a9Skaqs+tVTw8x83jga+INBr+TdaMmo35Bf2wbfR6zs=";
+      "fb303_core-0.0.0" = "sha256-YEFNTYvtgp8nc/1O7AbdyxCD3Xx2xCjbS17fTTEsUL0=";
+      "fbthrift-0.0.1+unstable" = "sha256-mDoYhXOzQIDqP7XdmiBbmq5VmAKAgggTNH/kW2kHv4k=";
+      "reqwest-0.11.11" = "sha256-uhc8XhkGW22XDNo0qreWdXeFF2cslOOZHfTRQ30IBcE=";
+      "serde_bser-0.3.1" = "sha256-/zn1NfXWytXvnalkgPsg9BdujVV97PGkXwmPtQGVeCc=";
+    };
+  };
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
  '';

+  # Since the derivation builder doesn't have network access to remain pure,
+  # fetch the artifacts manually and link them. Then replace the hardcoded URLs
+  # with filesystem paths for the curl calls.
+  postUnpack = ''
+    mkdir $sourceRoot/hack_pydeps
+    ${lib.concatStrings (map (li: "ln -s ${fetchurl li} $sourceRoot/hack_pydeps/${baseNameOf li.url}\n") links)}
+    sed -i "s|https://files.pythonhosted.org/packages/[[:alnum:]]*/[[:alnum:]]*/[[:alnum:]]*/|file://$NIX_BUILD_TOP/$sourceRoot/hack_pydeps/|g" $sourceRoot/setup.py
+  '';
+
+  # Now, copy the "sl web" (aka edenscm-isl) results into the output of this
+  # package, so that the command can actually work. NOTES:
+  #
+  # 1) This applies on all systems (so no conditional a la postFixup)
+  # 2) This doesn't require any kind of fixup itself, so we leave it out
+  #    of postFixup for that reason, too
+  # 3) If asked, we optionally patch in a hardcoded path to the 'nodejs' package,
+  #    so that 'sl web' always works
+  # 4) 'sl web' will still work if 'nodejs' is in $PATH, just not OOTB
+  preFixup = ''
+    sitepackages=$out/lib/${python3Packages.python.libPrefix}/site-packages
+    chmod +w $sitepackages
+    cp -r ${isl} $sitepackages/edenscm-isl
+  '' + lib.optionalString (!enableMinimal) ''
+    chmod +w $sitepackages/edenscm-isl/run-isl
+    substituteInPlace $sitepackages/edenscm-isl/run-isl \
+      --replace 'NODE=node' 'NODE=${nodejs}/bin/node'
+  '';
+
+  postFixup = lib.optionalString stdenv.isLinux ''
+    wrapProgram $out/bin/sl \
+      --set LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive"
+  '';
+
+  nativeBuildInputs = [
+    curl
+    pkg-config
+  ] ++ (with rustPlatform; [
+    myCargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    curl
+    libiconv
+    CoreFoundation
+    CoreServices
+    Security
+  ];
+
+  HGNAME = "sl";
+  SAPLING_OSS_BUILD = "true";
+  SAPLING_VERSION = version;
+  SAPLING_VERSION_HASH = versionHash;
+
  # just a simple check phase, until we have a running test suite. this should
  # help catch issues like lack of a LOCALE_ARCHIVE setting (see GH PR #202760)
  doCheck = true;
-  checkPhase = ''
+  installCheckPhase = ''
    echo -n "testing sapling version; should be \"${version}\"... "
-    ${sapling}/bin/sl version | grep -qw "${version}"
+    $out/bin/sl version | grep -qw "${version}"
    echo "OK!"
  '';

--- a/pkgs/applications/video/ccextractor/default.nix
+++ b/pkgs/applications/video/ccextractor/default.nix
@ -23,7 +23,10 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-usVAKBkdd8uz9cD5eLd0hnwGonOJLscRdc+iWDlNXVc=";
  };

-  postPatch = lib.optionalString stdenv.isDarwin ''
+  postPatch = ''
+    # https://github.com/CCExtractor/ccextractor/issues/1467
+    sed -i '/allheaders.h/a#include <leptonica/pix_internal.h>' src/lib_ccx/ocr.c
+  '' + lib.optionalString stdenv.isDarwin ''
    substituteInPlace src/CMakeLists.txt \
    --replace 'add_definitions(-DGPAC_CONFIG_LINUX)' 'add_definitions(-DGPAC_CONFIG_DARWIN)'
  '';
--- a/pkgs/applications/video/mirakurun/default.nix
+++ b/pkgs/applications/video/mirakurun/default.nix
@ -39,6 +39,9 @@ stdenvNoCC.mkDerivation rec {
    yarnLock = ./yarn.lock;
    packageJSON = ./package.json;

+    # workaround for https://github.com/webpack/webpack/issues/14532
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
    patches = [
      # NOTE: fixes for hardcoded paths and assumptions about filesystem
      # permissions
--- a/pkgs/applications/video/openshot-qt/default.nix
+++ b/pkgs/applications/video/openshot-qt/default.nix
@ -7,6 +7,7 @@
 , gtk3
 , libopenshot
 , python3
+, qtbase
 , qtsvg
 , wrapGAppsHook
 }:
@ -55,7 +56,7 @@ mkDerivationWith python3.pkgs.buildPythonApplication rec {
  ''
  # Fix toolbar icons on Darwin
  + lib.optionalString stdenv.isDarwin ''
-    --suffix QT_PLUGIN_PATH : "${lib.getBin qtsvg}/lib/qt-5.12.7/plugins" \
+    --suffix QT_PLUGIN_PATH : "${lib.getBin qtsvg}/${qtbase.qtPluginPrefix}" \
  '' + ''
    "''${gappsWrapperArgs[@]}" \
    "''${qtWrapperArgs[@]}"
--- a/pkgs/applications/video/openshot-qt/libopenshot.nix
+++ b/pkgs/applications/video/openshot-qt/libopenshot.nix
@ -31,8 +31,6 @@ stdenv.mkDerivation rec {

  postPatch = ''
    sed -i 's/{UNITTEST++_INCLUDE_DIR}/ENV{UNITTEST++_INCLUDE_DIR}/g' tests/CMakeLists.txt
-    sed -i 's/{_REL_PYTHON_MODULE_PATH}/ENV{_REL_PYTHON_MODULE_PATH}/g' bindings/python/CMakeLists.txt
-    export _REL_PYTHON_MODULE_PATH=$(toPythonPath $out)
  '';

  nativeBuildInputs = lib.optionals stdenv.isLinux [
@ -62,7 +60,10 @@ stdenv.mkDerivation rec {

  doCheck = false;

-  cmakeFlags = [ "-DENABLE_RUBY=OFF" ];
+  cmakeFlags = [
+    "-DENABLE_RUBY=OFF"
+    "-DPYTHON_MODULE_PATH=${python3.sitePackages}"
+  ];

  meta = with lib; {
    homepage = "http://openshot.org/";
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@ -7,16 +7,14 @@ let
  apptainer = callPackage
    (import ./generic.nix rec {
      pname = "apptainer";
-      # TODO: Upgrade to 1.1.4 only after https://github.com/apptainer/apptainer/pull/967 get merge
-      # and https://github.com/apptainer/apptainer/issues/958 get fixed
-      version = "1.1.3";
+      version = "1.1.5";
      projectName = "apptainer";

      src = fetchFromGitHub {
        owner = "apptainer";
        repo = "apptainer";
        rev = "v${version}";
-        hash = "sha256-QFg6RC77OE/a6Qlzn6Zi5I7Iaq/U3/m0eI9yLArzuNc=";
+        hash = "sha256-onJkpHJNsO0cQO2m+TmdMuMkuvH178mDhOeX41bYFic=";
      };

      # Update by running
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "18.0.0";
+  version = "19.0.0";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "03f2rabj2w2l7jwqyl2awj42jhh0l3picqgyfcv3q067i34abfyn";
-  iosevka-aile = "0p1r5sysy6djfd1sx0pfxf42bv7ayqgk1nvil33jr925w96i2dp6";
-  iosevka-curly = "0r33wcgvh315avgkkic27qpf3bavrqwbig1kj4wm5rdr957ldk40";
-  iosevka-curly-slab = "0yd7grhnx7z27xmd3wr8x2xx2002hmfi1y3ndmqq1sc9gab5gcb7";
-  iosevka-etoile = "0jhd49vxxxaqi1rxfkmpc3v1q96ak1b5wyggchngqi3739pjgqy3";
-  iosevka-slab = "00wk15kj9b1nr3b0bmarx6gqx3jg8z1pm9qqf9x09s72b3ng8adm";
-  iosevka-ss01 = "1kp6zv8zyx50la7zrfz4fis68s41kplibagny61w5v3w36xpm3cs";
-  iosevka-ss02 = "1c0dl28a3wwa5g4793jyb4n4c8p5vjlyh1b8j2i5da31dqrqm9gj";
-  iosevka-ss03 = "0vs8x6l8gwqi47g1c5ainsk5fb2i6j4wv7mgdyw5j5l3blnba5yh";
-  iosevka-ss04 = "1caf4xqd1dywzbq06ip042rw88833yk9ws7y3vjvsp93g7a2r675";
-  iosevka-ss05 = "008aphj4w6ri3fgnydrxavvpm3bfywv4cym10fqi9xgd84jhm9m1";
-  iosevka-ss06 = "00dkagqiwzwzvv75zss82yx0gdcbmh9xvr8swhi5zk0y0bc3xk2y";
-  iosevka-ss07 = "1acnva081awp76xyspksq9jkvlyswh3q1jy9gnsc6kh4vyn17vjs";
-  iosevka-ss08 = "0lmkglcjlppvfd7k2pz57r476fa4c0q5l4gqzfy1mlklh0mc5hqb";
-  iosevka-ss09 = "04r2k2z54iszwfnif872p5br0dm4fvc5341cpbxv4almpzxjyqnr";
-  iosevka-ss10 = "1c6gs9g8dhywpd2ha7kx2l7g7bwj7i5a78645ipx8126f749y0y9";
-  iosevka-ss11 = "0286k56r12a2yjylxynvzd0idrcv4ykrmpkn3b5xv9f74qq6irmf";
-  iosevka-ss12 = "0ab4x5lh8spbg0djb092vcq1cnvjhazwkia8byq1q47iwiyh756l";
-  iosevka-ss13 = "0kva71mfkl9xzz8khjzgrj47zg2505rg0hv5hxflawxsqwi4iwvl";
-  iosevka-ss14 = "1gk7m3xh4v3jm6s5g2prd27w4p0r1blbxsxdy3b020bdwikxcaga";
-  iosevka-ss15 = "0frxjc3hhay8izsx4ywff4j39qxp9ljz6hvw0rjcya3vny515jq5";
-  iosevka-ss16 = "1g299yhn0kfc7vn8vbgwq4798w5lcl72j6hj91k90i1yq11lg13i";
-  iosevka-ss17 = "02z83x73bhpgf44kq0gw46bdnpqzr4vm37h78bh19vydzqaj8hg0";
-  iosevka-ss18 = "1b7vhhbspi98xzmk4hpiw08jmscm7f7nibqxhkfmppl6y0ymbm9d";
-  sgr-iosevka = "1n60dgprl2p22wwfhxpwy9v9xf6vyv3qwm2jdc0m9m0q9jwjashr";
-  sgr-iosevka-aile = "1k195vqv2wajhmyma43xgda3s2z86kl2gksgdrm95s9sx7ijns2s";
-  sgr-iosevka-curly = "15yq1fs7knp9gxgqjxslpmlx85c6kvpm31sf81llpf4k5f9dmlcp";
-  sgr-iosevka-curly-slab = "0fa68lm6iwlf2s5k8388dwgk015c55zg1wkhhhjmixwn7p8gifxz";
-  sgr-iosevka-etoile = "1ry1zc7cdx6g927d1752ipz39v4wsnfrnn8n9cfwamz8v458wld1";
-  sgr-iosevka-fixed = "173v09dx5pwsbh9jac5qxi7nk95dqyryg747hl58bchby6kmnc3k";
-  sgr-iosevka-fixed-curly = "11y8bj9vmdq48n370f1r4zsk72ci3cq7c9ff6y40hn5w40s8k379";
-  sgr-iosevka-fixed-curly-slab = "1a4gmz6sl67l23awkfl8f3xdr8hbb2mi1lsc0ain1wvvyx1bi56m";
-  sgr-iosevka-fixed-slab = "11xv18ykrfg2fdvbrlcx7k3qvp5yqbm278ks3gm0gbck1awvfckg";
-  sgr-iosevka-fixed-ss01 = "1yb96x53wjks537vs0gd7rss6piszs139k1kgb1swrpq7519awaz";
-  sgr-iosevka-fixed-ss02 = "10yy0yg2i9nm00lzpmrfbdh7jjcll37wql3fcsaxha57gcxf9nf0";
-  sgr-iosevka-fixed-ss03 = "1fpjfqlqq6lz3gya1q24nzy2xls6nxn567lhglj0ykjnh3prkll8";
-  sgr-iosevka-fixed-ss04 = "1kwa5mwd6ihsyj2y70hrrvgy41cs19i0f7nvl4khs3i69a1l58ag";
-  sgr-iosevka-fixed-ss05 = "08v8in8s8p2nayazq60w1kc1jpq48nwdwh6wbxv7ij7lfwii8xws";
-  sgr-iosevka-fixed-ss06 = "03jzylw99xa3b6hpy6bpwhyii6d9fggy9synfl54sn7smwqk08wr";
-  sgr-iosevka-fixed-ss07 = "13yzd6r51gka03fcl3bvx6d97b4m4px2cnsd724maqkqrcxkbxgb";
-  sgr-iosevka-fixed-ss08 = "1xghlj7drx9328jr1cb051nkwv47r5ykkyy6ydff1c4amc1xabsq";
-  sgr-iosevka-fixed-ss09 = "12l6lbz4m1lwyqqmv583777r9ymssy9x34rz72y3dch0mqhmjjzg";
-  sgr-iosevka-fixed-ss10 = "1flrh6a7m0dw7na30nhbxjld54517z77ff3s9fjrpmgyb9wz7i2j";
-  sgr-iosevka-fixed-ss11 = "1j4v4h6k505gkxyswcjf61kj9cfgkalxjg1arms9zb351p8rrkda";
-  sgr-iosevka-fixed-ss12 = "00qwnsxc08bm5cq3ljz2pjqsiw019ah4z0crqcwaysijicxmbckc";
-  sgr-iosevka-fixed-ss13 = "0jrw0amhfi28mc4i7a74qvgjamvymijlf3akskaw9qrmzvks8wn1";
-  sgr-iosevka-fixed-ss14 = "0rvh842zkxdrna9nh2ylsjs3q90sq39658l0mafi85b8z5asdwai";
-  sgr-iosevka-fixed-ss15 = "0j5yrr1biqfhgj6qg6359xg9rfv6qzqiqdqjgfjwbhijs6xfn8f1";
-  sgr-iosevka-fixed-ss16 = "06jrfhb257nmldnxxyc5rh869r5y62v2y034c0r9j7354s7gcq7a";
-  sgr-iosevka-fixed-ss17 = "0cgmsh0478963k1dgpkhy6j1b383gx2q09z3shr6j87knjjwqgp0";
-  sgr-iosevka-fixed-ss18 = "0r4nyd459aqgna7dyzvxnznclqihxdb888g949kdzhxykfchq53s";
-  sgr-iosevka-slab = "1bv8asz66hn80xvjxa7b0vgywha1bpmhd8q95cssc3085dprz1r6";
-  sgr-iosevka-ss01 = "0sv19w0adnddzarf8dlz0n73jzqnp0xfb2lgh4xcpjkhm66j3fhh";
-  sgr-iosevka-ss02 = "1ih10a666r77pvj57crdgyn7ll15giwxj0nis501r1fkp1bzkscn";
-  sgr-iosevka-ss03 = "180hkjzzgasf9a58vi0n0cishnbyjgbjmkh60awcpxwvh85qd4hf";
-  sgr-iosevka-ss04 = "1i4rpg9j967xaxg8h9dmachd3896f4jgwxa0mfjlizls2hfvnbsi";
-  sgr-iosevka-ss05 = "1ca2z4dincjk7jl16pa6d7dnnzq3w3il7fr2lphvrjvdrxbci615";
-  sgr-iosevka-ss06 = "08dj9dcq58grnp6lh16yvvzjqhzlm765v4ci1rys0wbjnp72xxda";
-  sgr-iosevka-ss07 = "13k6plhdgxhp5gjs8z98wb480hh5wy6p2zmc4xvhp88y93fy8kk7";
-  sgr-iosevka-ss08 = "1zfxamanq6a06fazn1jkaswh5g6iw22qnycg5dnxn4flk8nas1db";
-  sgr-iosevka-ss09 = "0qaxp4fsvl26il16h78y2l8013m49cbk2nzxcs1k9g5if11a49d3";
-  sgr-iosevka-ss10 = "1qvvm6rvhrbp83qjfb3dfsbam20f6aw52kg1i5ggfrqj35niv0hd";
-  sgr-iosevka-ss11 = "1v2b456qj8kyacm7308gsim5p25wnyg8qabyrfvdj00h81s31akl";
-  sgr-iosevka-ss12 = "1rsi6ir5vccar0n3ychisc40axiyhqj5yvcx450ppd33f3sd5rc7";
-  sgr-iosevka-ss13 = "12x4q5l1pdxi065zs913dqd7zb8qpi4bbgd43h3k5azsrwxwvixr";
-  sgr-iosevka-ss14 = "1snzdv23jqmbz25k9i2zl7px7yysk5hn74q1x251s07ghdx3nfdj";
-  sgr-iosevka-ss15 = "0hbmj6wij6cv9yh76npp4xrl7fdm8jjx03398anfcsa02gkvg8zz";
-  sgr-iosevka-ss16 = "0v6vhg0vp5ig6ngs96q5mxa2snfp08nk68a9772sm1ny61q3chrq";
-  sgr-iosevka-ss17 = "0268b85yhdfsbjyhi0vlxwrpwxa8h919np53s060z94094h6jd9x";
-  sgr-iosevka-ss18 = "13vnhh8181h36y6iz2p2x6rjgjv5w3d0gqbcdkwhgmvx7s03k122";
-  sgr-iosevka-term = "05c2sxb4aris90mhjxyfkw1b0ga0hplfas669076h7yjsimw647l";
-  sgr-iosevka-term-curly = "1j0b4fhcivkdgka9zyqf732hcxj8rchqxkwv2bwxib1a17fmwn6c";
-  sgr-iosevka-term-curly-slab = "0dvv2n3plfxm8z2xi1ihzn4rncyk1kz8xbgyprnb0lvqiyf18igy";
-  sgr-iosevka-term-slab = "0i7wrvq6c96q8v6zw9iym42b6sbm0vc04ysljghpblnnfymq5yv9";
-  sgr-iosevka-term-ss01 = "1n23qp50pr466blpn2h9dhjbn0wnbbxyzb0sz751bk8db41lpyqb";
-  sgr-iosevka-term-ss02 = "0ghvfhkdsfsjb8yjwvwlwhn66lmy8dx34126ccnvj0g77ww2nwa9";
-  sgr-iosevka-term-ss03 = "03hnmy9wijqwsc36cg5b3pxj7mb1cbyacii00pcvrpcns2w1ssbw";
-  sgr-iosevka-term-ss04 = "0fv9xhhii0h5ii4yxsdnywn45254494mgq1n5aajasq494cgxhp4";
-  sgr-iosevka-term-ss05 = "0qa4l77sjpxd9l4nb555bhgzm0f1c74w6014md2rpljjvyy2mzwg";
-  sgr-iosevka-term-ss06 = "05y7rmghvhmzw3spn7b3v6hmpcqg5p32flm437a1aljdr46sbxli";
-  sgr-iosevka-term-ss07 = "1lzqgpr1vchi4ricqp1v49nv62rl3anbdvzpvddby81wr5jcyd1y";
-  sgr-iosevka-term-ss08 = "1sxicv2gspc39fyja370dpiq12xd1bgndiw5r6cqfkkd8x8dgpdv";
-  sgr-iosevka-term-ss09 = "0ax9pgm3d171kksrqd2z8xpr68kdxkqg9h344an55gjk01q7dzay";
-  sgr-iosevka-term-ss10 = "1rgvadmvdldcaqa0r76kzmrck814qwksdqficaxcd7wk8bx64n81";
-  sgr-iosevka-term-ss11 = "02if14ff5kax4p1aa2wkbidhwlzgyxi7lxir2ildahwfkvkp971y";
-  sgr-iosevka-term-ss12 = "0sj8n12is4094nbj67wkk88953jp9235kvvr4230abql1g6s263r";
-  sgr-iosevka-term-ss13 = "006sdcj8qw247b63d647ykm8razyb0apsfd0cjmlikj9hdmyzrr2";
-  sgr-iosevka-term-ss14 = "0i7d3ldp9rj1f4kwdk8hkxq0s38df6i25qfx6hwfjj1c5bl3a843";
-  sgr-iosevka-term-ss15 = "15gjqz7zc6wwy1l61pgpnz7wwyyaij43dcrwcwyi6h10jhm8b3ia";
-  sgr-iosevka-term-ss16 = "1c1i1iyqzgh3pz4fzjp26d71lphmcgqbjp2s91yyqg3nfhwbzvyc";
-  sgr-iosevka-term-ss17 = "0kr58576vlx81nb2ia5z9226m6h0ybd5vzfj5li9b721l4q0rpky";
-  sgr-iosevka-term-ss18 = "1zjs40i4dmw2l45k8wydngl4g3a88nhbmmjwd5lsz8a40pq4bw15";
+  iosevka = "0m8z67daj1gwb3yiw8qw3n1nxp96xb11fvb5183bh02r7ncym0da";
+  iosevka-aile = "02jhyzk3bpsjng3b1jfffwvr2inhhjsm4jdahzj05j381fp717c4";
+  iosevka-curly = "1si2kzv7qhlpyaaa954vnjmfk1c5rjxjimvckinpkjz30cnvg1bl";
+  iosevka-curly-slab = "1ngk3r6kdqngksga3s3m615jkqrxdcplj8srvlb6642vcc38w6vh";
+  iosevka-etoile = "1yg38x8dk5nyyjyy71v5j4x2x701hmp8gjwvphf5scf6vn52lvxz";
+  iosevka-slab = "1bw6lyy8lg4vpalnrsrnkrm9dlyl6vm6faigy2y9bfvh7nxrd8qa";
+  iosevka-ss01 = "1p02d8mdqx6mbnycs9d2r0qwqsxjrlgbl7skf8y66dsmjn6xxd0y";
+  iosevka-ss02 = "0ds8ad38h7h8250hdm89v2imya6jdzgk1h5jgsf983ls1gqjikhc";
+  iosevka-ss03 = "1s6rc4qhlfgvr7g8ywmlmsl58hfrqx0w24ivx5zz4jr5zqj70j7l";
+  iosevka-ss04 = "1lc8kx0p8m8nm4ql6ylcw9g4iq0j65hv6x48273cclqqcmqdn4qj";
+  iosevka-ss05 = "1wx02ysbj0rpr623jp1jy64ywrj8rm3n2fqzq05f4qv996bij11k";
+  iosevka-ss06 = "1bf0qnpvbq94d42gvbzikfkk20d788cicsyk8kz1vsf5xbg37kla";
+  iosevka-ss07 = "1ybl5gfyz4dnarimamshf002p9k6148wbbrbarpswb85kab502hd";
+  iosevka-ss08 = "1llp8iryr5dixdarwls9iw8mmnhzhlr7q8fzq969p64ygk76rkn4";
+  iosevka-ss09 = "14b49k0zv49xybdwrbf0p1krrga3jjviwzy0alxrwn0zf7vlbnbi";
+  iosevka-ss10 = "1xs1dkq62pml17dii2lhsianhzr22059i17sw2b334wbszc00j7y";
+  iosevka-ss11 = "0mrjzmk74vlq69ih4gm2iza4qdzyznn42bk3jwlvpd67z5vq36ag";
+  iosevka-ss12 = "0z16a8wrydi0ch9zj0lcz6cxbvawkr0ck03bzdbb81waggk4fxin";
+  iosevka-ss13 = "1rv8n3vbhwqv7bks6v86v4w13fr4a015xpvprzfz76xp98hb9dmc";
+  iosevka-ss14 = "0m7kpvy8bknmrfsql9b24w7n15hybnkisjxzzmrxkf8a60jrydni";
+  iosevka-ss15 = "006jkgww0hdb0c1wgby0y5535xapjpk1w8vm51d3yyrp04pwr1r1";
+  iosevka-ss16 = "1mmc7cyyk64lcavb2gib64b64zcr7qcn0m3cmlwnr1zgm6nb3w64";
+  iosevka-ss17 = "0wanv1h8qg5jyx7w380h7jkbc22slg9566pzw7dv7dg1nw0h2v3k";
+  iosevka-ss18 = "1y1daxghw3jbfn785935906j76l0230yixdmwlrzyra2svyaql3w";
+  sgr-iosevka = "182nzxxrxfz8xc3w8g9bsr0can71671w4xplyvyi7b1v9f62g9f5";
+  sgr-iosevka-aile = "1arjiwx5qf8j6pzb8mpd1g46z0kn80341wvcmsnx42d97b2m64jx";
+  sgr-iosevka-curly = "1lyh0rh2pswbaxsqyxicyknhla4gm2h0jb2rg0wx9vib9h53lazn";
+  sgr-iosevka-curly-slab = "0h2j7dwcyd5v1acpwjsz9li5g4r1ssx715x5pj4gdvskq4calff4";
+  sgr-iosevka-etoile = "15ag0w6sv24rc91mxh4c89gq6jwnq37bxml6a41rvn54fy0h1jnd";
+  sgr-iosevka-fixed = "0935zbk5x0mk06al11nig74b2rv1x8zc3waxs8hvbri0ryzykzk4";
+  sgr-iosevka-fixed-curly = "1i8cqfwcdsaxdlh87kaya8bp33fwlyz984r757122qnqbywcfm30";
+  sgr-iosevka-fixed-curly-slab = "0ba77jxn8n5dssjpwj4iyvwxw3mxqizrvsz5jyv9a4f3gfvwi18k";
+  sgr-iosevka-fixed-slab = "0qfhc7pg30ashpx504lln4h2w36icrbgij7fga07z2a715qxmfq9";
+  sgr-iosevka-fixed-ss01 = "1597hn4vzh0r8j22k7866blj3kw2bhp70z7msfr2hbszpscwxwqg";
+  sgr-iosevka-fixed-ss02 = "1ygrsvamgp6f26zg5qysk6dn4fa1im02dzsrlpgpv3sl4gh0cv44";
+  sgr-iosevka-fixed-ss03 = "0936ggnzaavqn4d7fsmmf54bwp0v31sz0n1w15ky7c5bsqp9h8ja";
+  sgr-iosevka-fixed-ss04 = "1xjslygh3f5nv0k8fiby0cgg22wr0a9jh79fbzallx3zh4d60a2a";
+  sgr-iosevka-fixed-ss05 = "0vnm398zdvkzymhw41gljpf9jq52wq3vawiyw5xsdr75d4n63fpb";
+  sgr-iosevka-fixed-ss06 = "1pnk8ijb193h85sk702ar0m0wk03xz1xcnvx8iq4k52q3a3vdd40";
+  sgr-iosevka-fixed-ss07 = "0qfcf6r2gzc5zwjfrcq1hjp9c5s13fc34lwwmxkj8224d42543jn";
+  sgr-iosevka-fixed-ss08 = "1ram9wm14k2sncfqpak23vss3pyqbwd1ndhm1i4ib7bpq8skd3wi";
+  sgr-iosevka-fixed-ss09 = "0r8zy1fwih42clxm2rsjqks5rxgy1qxirz396r25gvwxng2503y4";
+  sgr-iosevka-fixed-ss10 = "1v44s7n1gwz7mcybjsi1amv6xc8z47k20miycngjcy1cccrds2da";
+  sgr-iosevka-fixed-ss11 = "1fdclqvzq45shpj97awc7636ymgrnfd69iaizwxy49y2krpa7dx9";
+  sgr-iosevka-fixed-ss12 = "07f7i0qh9z6hlgy0ak3myxmiy4rbrixcap52lhk8wwapbnf21r7l";
+  sgr-iosevka-fixed-ss13 = "07z3hfi5vynwl15dqfsldwjj5i9fldmm6i1nypm28cxbya3izj60";
+  sgr-iosevka-fixed-ss14 = "1r001yna7ydf24bkgygld2kh47pvsz1yr9s57ssvdql37q24wzf1";
+  sgr-iosevka-fixed-ss15 = "1757lzbp9payykcdywdbfilhgm1yij8gsnazc7bywpc4sv806vhz";
+  sgr-iosevka-fixed-ss16 = "18mr7wvz5q60kgz0h2k05ahd0krz3ng7wgg1amd3292cji61vxvw";
+  sgr-iosevka-fixed-ss17 = "1bykqwspssv1vbx2nns8dfckijqmd633g57glmlhjmxlavv5gxnw";
+  sgr-iosevka-fixed-ss18 = "034w2yv2ihybkz03zalcsixrmjs7as62v8jhk8xkyckqc3bk0kc7";
+  sgr-iosevka-slab = "04b1w9ij6dgy5gyvi7d47g9xadpb230mlgbdrk36fyhvfyw048y1";
+  sgr-iosevka-ss01 = "077d4dan7f41ydi64xv0z0784j5vcj98vmqagmy1c1xyr0p68dac";
+  sgr-iosevka-ss02 = "1hmy2cwnsb3f60yp66lznas78432518xkj2jmpqy8ad05d2zmmc8";
+  sgr-iosevka-ss03 = "1bs1hb6magmbc2zh4fzx7h6j6bdllbvv85fv5krs3b888w3fzjw1";
+  sgr-iosevka-ss04 = "1c3wb8nz0xz57crwn151b5sgzm320jkirsajyjf0srdaid1gkjkx";
+  sgr-iosevka-ss05 = "1dx33y8rk3nzgdfikz262javq4v3n76hvv5b7rx7kxlkxycpy8ya";
+  sgr-iosevka-ss06 = "1s54xx4w3zvbz2w7f5sl5vlqazwsm033jsq8ljrdh4c2l88mpcq3";
+  sgr-iosevka-ss07 = "03zfq3jib2df6dhj1pbmw8hq57i0fx98gkawxzk13sfgrzz1zv47";
+  sgr-iosevka-ss08 = "09k220gha919lv18bs6y2zlcjqa5j7jsq8mfqx8xddcwq1v9v094";
+  sgr-iosevka-ss09 = "0plvxhqwkr52sich4kwzqs3xq5s5x61hq7n423ar2zaskx007sjv";
+  sgr-iosevka-ss10 = "0c42h417sir120cp6fbnbhv3s1ys8pxky56v6f44h50w7p6qhlx1";
+  sgr-iosevka-ss11 = "03sp7z0s5sb9bnhxb9liainpiqmq1r0lpmigscl6wr1rpaxq2l7i";
+  sgr-iosevka-ss12 = "0y2xs0qv3b1k4s4my9c69j94ql2kwmqmm3f626vjj8rar8r0wab0";
+  sgr-iosevka-ss13 = "1pyv3i1972n5gxr16fl68gydjsxndh7kbba3d15bmkankahgll6c";
+  sgr-iosevka-ss14 = "1c7y8h8jv937wnlxkgdswb0ixa5v747z598pd0yhvwid3ksxb1px";
+  sgr-iosevka-ss15 = "08wzzkr0l0xz4l7qk9kbhvybr4favl0qz0cjr7raw0hibqkw17sp";
+  sgr-iosevka-ss16 = "0q63x71mq19gqqiaqbqsp0lvf3knhckx5d17caq6ipv5gs3xxmzr";
+  sgr-iosevka-ss17 = "04054qbvyfvp1aqs3likyh85kqyckkg2ac83s65lvkj3f46r50sg";
+  sgr-iosevka-ss18 = "1ckrfx3f4mncm1hbc2bcsbk97kkzsi524wfgvhz10jw1yk5yyd60";
+  sgr-iosevka-term = "1ygfsc86fihkxpwm2q3j2y3ibpb7lkrjwrld7dg9ymb83hah29xm";
+  sgr-iosevka-term-curly = "1qz8x2z23m5yvdpf0055a7xb5z77dabwbf3hkmh4r77rp1h6idv4";
+  sgr-iosevka-term-curly-slab = "011n7qpcx2abvp5i9z6picy5bcjvvfx7pjqy8m7sf02fdm14s2jl";
+  sgr-iosevka-term-slab = "1iwgcqnxbjf25k6bbx3iwcqy2ghwnnxvfinjp5slwr7bhjjjbl9y";
+  sgr-iosevka-term-ss01 = "09s813a8ywqpncmq0iqkjjnh1sb5zn267fzp2dz92cmw5929627s";
+  sgr-iosevka-term-ss02 = "1yyvnxdwi6caq6b6pgviad5l7b7znx4xkxdg1np23a7imr94vb1c";
+  sgr-iosevka-term-ss03 = "1hrdipmf54z2hrl7g8m8z17aq3lp5v66xy24f58qsm4c1pfab3i7";
+  sgr-iosevka-term-ss04 = "1h54glwrzblg61y4f1sxm78mci47wjry4h4gdrbpx96snf31ynbb";
+  sgr-iosevka-term-ss05 = "1xzzj36817nsw15s3a1f740d89gc4634dnczjjj6vrddli8ilann";
+  sgr-iosevka-term-ss06 = "0c07i831bmfz6y7jqaip6il4cvqzc51d0w17s2dnjrnj4x3ndgmx";
+  sgr-iosevka-term-ss07 = "0x9wzf0w4pzjmzzbmzj56nkhhz5834chvxqn9519fbq1md4pfl3b";
+  sgr-iosevka-term-ss08 = "1gf1l17d8hrf1aq4pq9ai05kan8m86z8s2d7masjkvg1zaw2lb4s";
+  sgr-iosevka-term-ss09 = "1nnhciib413ll2h7ps3vyghiayz9iwniwr7byyn9pdimm0j5vq07";
+  sgr-iosevka-term-ss10 = "0qvficwhpya5sy5myxsjjfmrn9z2d9lpzyi88l8dhz3dfvyr1yzs";
+  sgr-iosevka-term-ss11 = "0ml6swvyddhz2nvq14skfh1d9d98c3d6ir0qgf97pc0qxyqbcfp2";
+  sgr-iosevka-term-ss12 = "01nxs1m2iif6lswx22h58i45zxab0nbqpf0rzlp6v3wnb8ylpbi5";
+  sgr-iosevka-term-ss13 = "0zadj9fakpqmibnxz883hwbcgqfssjvsi6kcvzik5cnamlk2jz8c";
+  sgr-iosevka-term-ss14 = "1dwfm8lcbgf8rfw11i2alrv98f9332cqyk9zvzfrjrdp9camr7j0";
+  sgr-iosevka-term-ss15 = "0z7ad7vy2faq33kpbl1x2w6i3s4af8v8fzj05rdyadws35ra3idd";
+  sgr-iosevka-term-ss16 = "1fzzkmk7ppcbmg7s50nknc7nwavfpqsja12af8qidzba9z535w2g";
+  sgr-iosevka-term-ss17 = "1rcpfgf5blg3nbf6prw9h2ylc2ji8vl6cxqlck482kncz8ph9swk";
+  sgr-iosevka-term-ss18 = "1nksii5xyi97lsrf1hxl06m0pdlk8rnsbg1s81amkzz8fxlyhzlc";
 }
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@ -2,12 +2,12 @@

 stdenvNoCC.mkDerivation rec {
  pname = "JuliaMono-ttf";
-  version = "0.047";
+  version = "0.048";

  src = fetchzip {
    url = "https://github.com/cormullion/juliamono/releases/download/v${version}/${pname}.tar.gz";
    stripRoot = false;
-    hash = "sha256-tCZo48SBGdhcsP1wgaWkfWr3L3Yz+p/iqesLmarSWbk=";
+    hash = "sha256-KSyJMlQclEj2CR+5uSYLmPtseWiDIUuahaPDx7Tn/bw=";
  };

  installPhase = ''
--- a/pkgs/data/misc/papirus-folders/default.nix
+++ b/pkgs/data/misc/papirus-folders/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "papirus-folders";
-  version = "1.12.0";
+  version = "1.12.1";

  src = fetchFromGitHub {
    owner = "PapirusDevelopmentTeam";
    repo = "papirus-folders";
    rev = "v${version}";
-    sha256 = "sha256-ZZMEZCWO+qW76eqa+TgxWGVz69VkSCPcttLoCrH7ppY=";
+    sha256 = "sha256-Dus9f2m5Wj46Url7N3UYEvBAankppzGzdJHGPH3CT3g=";
  };

  buildInputs = [
--- a/pkgs/desktops/gnome/core/gnome-contacts/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
@ -26,11 +26,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-contacts";
-  version = "43.0";
+  version = "43.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-contacts/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "VbYd9+k/Cr4f+kZeGOPF3k9JqQ8mjqnRHtyGrwbQceE=";
+    sha256 = "Ug3IjJAce4/n4SoBOhQlz+2R8vhAhIWitJ+SxnWZACA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/gnu-cim/default.nix
+++ b/pkgs/development/compilers/gnu-cim/default.nix
@ -0,0 +1,45 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gnu-cim";
+  version = "5.1";
+
+  outputs = ["out" "lib" "man" "info"];
+
+  src = fetchurl {
+    url = "mirror://gnu/cim/cim-${version}.tar.gz";
+    hash = "sha256-uQcXtm7EAFA73WnlN+i38+ip0QbDupoIoErlc2mgaak=";
+  };
+
+  postPatch = ''
+    for fname in lib/{simulation,simset}.c; do
+      substituteInPlace "$fname" \
+        --replace \
+          '#include "../../lib/cim.h"' \
+          '#include "../lib/cim.h"'
+    done
+  '';
+
+  CFLAGS = lib.optionalString stdenv.cc.isClang "-Wno-return-type";
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "A GNU compiler for the programming language Simula";
+    longDescription = ''
+      GNU Cim is a compiler for the programming language Simula.
+      It offers a class concept, separate compilation with full type checking,
+      interface to external C routines, an application package for process
+      simulation and a coroutine concept. Commonly used with the Demos for
+      discrete event modelling.
+    '';
+    homepage = "https://www.gnu.org/software/cim/";
+    license = licenses.gpl2;
+    platforms = platforms.all;
+    badPlatforms = [ "aarch64-darwin" ];
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
--- a/pkgs/development/compilers/zig/0.10.nix
+++ b/pkgs/development/compilers/zig/0.10.nix
@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
  cmakeFlags = [
    # file RPATH_CHANGE could not write new RPATH
    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+    "-DZIG_TARGET_MCPU=baseline"
  ];

  doCheck = true;
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@ -43,7 +43,7 @@
  # non-existent in older versions
  # see https://github.com/boostorg/process/issues/55
 , enableS3 ? (!stdenv.isDarwin) || (lib.versionOlder boost.version "1.69" || lib.versionAtLeast boost.version "1.70")
-, enableGcs ? !stdenv.isDarwin # google-cloud-cpp is not supported on darwin
+, enableGcs ? (!stdenv.isDarwin) && (lib.versionAtLeast grpc.cxxStandard "17") # google-cloud-cpp is not supported on darwin, needs to support C++17
 }:

 assert lib.asserts.assertMsg
@ -52,17 +52,19 @@ assert lib.asserts.assertMsg

 let
  arrow-testing = fetchFromGitHub {
+    name = "arrow-testing";
    owner = "apache";
    repo = "arrow-testing";
-    rev = "5bab2f264a23f5af68f69ea93d24ef1e8e77fc88";
-    hash = "sha256-Pxx8ohUpXb5u1995IvXmxQMqWiDJ+7LAll/AjQP7ph8=";
+    rev = "ecab1162cbec872e17d949ecc86181670aee045c";
+    hash = "sha256-w6rEuxfLTEO8DyXV44G6JOMeTfYtskFCOj9rHXNmj2Y=";
  };

  parquet-testing = fetchFromGitHub {
+    name = "parquet-testing";
    owner = "apache";
    repo = "parquet-testing";
-    rev = "aafd3fc9df431c2625a514fb46626e5614f1d199";
-    hash = "sha256-cO5t/mgsbBhbSefx8EMGTyxmgTjhZ8mFujkFQ3p/JS0=";
+    rev = "5b82793ef7196f7b3583e85669ced211cd8b5ff2";
+    hash = "sha256-gcOvk7qFHZgJWE9CpucC8zwayYw47VbC3lmSRu4JQFg=";
  };

  aws-sdk-cpp-arrow = aws-sdk-cpp.override {
@ -79,11 +81,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "arrow-cpp";
-  version = "9.0.0";
+  version = "11.0.0";

  src = fetchurl {
    url = "mirror://apache/arrow/arrow-${version}/apache-arrow-${version}.tar.gz";
-    hash = "sha256-qaAz8KNJAomZj0WGgNGVec8HkRcXumWv3my4AHD3qbU=";
+    hash = "sha256-Ldjw6ghIpYeFYo7jpXZ1VI1QnhchOi9dcrDZALQ/VDA=";
  };
  sourceRoot = "apache-arrow-${version}/cpp";

@ -108,15 +110,15 @@ stdenv.mkDerivation rec {
  ARROW_XSIMD_URL = fetchFromGitHub {
    owner = "xtensor-stack";
    repo = "xsimd";
-    rev = "8.1.0";
-    hash = "sha256-Aqs6XJkGjAjGAp0PprabSM4m+32M/UXpSHppCHdzaZk=";
+    rev = "9.0.1";
+    hash = "sha256-onALN6agtrHWigtFlCeefD9CiRZI4Y690XTzy2UDnrk=";
  };

  ARROW_SUBSTRAIT_URL = fetchFromGitHub {
    owner = "substrait-io";
    repo = "substrait";
-    rev = "v0.6.0";
-    hash = "sha256-hxCBomL4Qg9cHLRg9ZiO9k+JVOZXn6f4ikPtK+V9tno=";
+    rev = "v0.20.0";
+    hash = "sha256-71hAwJ0cGvpwK/ibeeQt82e9uqxcu9sM1rPtPENMPfs=";
  };

  patches = [
@ -148,18 +150,17 @@ stdenv.mkDerivation rec {
    utf8proc
    zlib
    zstd
-  ] ++ lib.optionals enableShared [
-    python3.pkgs.python
-    python3.pkgs.numpy
  ] ++ lib.optionals enableFlight [
    grpc
    openssl
    protobuf
+    sqlite
  ] ++ lib.optionals enableS3 [ aws-sdk-cpp-arrow openssl ]
  ++ lib.optionals enableGcs [
    crc32c
    curl
-    google-cloud-cpp grpc
+    google-cloud-cpp
+    grpc
    nlohmann_json
  ];

@ -183,16 +184,12 @@ stdenv.mkDerivation rec {
    "-DARROW_COMPUTE=ON"
    "-DARROW_CSV=ON"
    "-DARROW_DATASET=ON"
-    "-DARROW_ENGINE=ON"
    "-DARROW_FILESYSTEM=ON"
    "-DARROW_FLIGHT_SQL=${if enableFlight then "ON" else "OFF"}"
    "-DARROW_HDFS=ON"
    "-DARROW_IPC=ON"
    "-DARROW_JEMALLOC=${if enableJemalloc then "ON" else "OFF"}"
    "-DARROW_JSON=ON"
-    "-DARROW_PLASMA=ON"
-    # Disable Python for static mode because openblas is currently broken there.
-    "-DARROW_PYTHON=${if enableShared then "ON" else "OFF"}"
    "-DARROW_USE_GLOG=ON"
    "-DARROW_WITH_BACKTRACE=ON"
    "-DARROW_WITH_BROTLI=ON"
@ -203,21 +200,21 @@ stdenv.mkDerivation rec {
    "-DARROW_WITH_ZLIB=ON"
    "-DARROW_WITH_ZSTD=ON"
    "-DARROW_MIMALLOC=ON"
-    # Parquet options:
-    "-DARROW_PARQUET=ON"
    "-DARROW_SUBSTRAIT=ON"
-    "-DPARQUET_BUILD_EXECUTABLES=ON"
    "-DARROW_FLIGHT=${if enableFlight then "ON" else "OFF"}"
    "-DARROW_FLIGHT_TESTING=${if enableFlight then "ON" else "OFF"}"
    "-DARROW_S3=${if enableS3 then "ON" else "OFF"}"
    "-DARROW_GCS=${if enableGcs then "ON" else "OFF"}"
+    # Parquet options:
+    "-DARROW_PARQUET=ON"
+    "-DPARQUET_BUILD_EXECUTABLES=ON"
+    "-DPARQUET_REQUIRE_ENCRYPTION=ON"
  ] ++ lib.optionals (!enableShared) [
    "-DARROW_TEST_LINKAGE=static"
  ] ++ lib.optionals stdenv.isDarwin [
    "-DCMAKE_INSTALL_RPATH=@loader_path/../lib" # needed for tools executables
-  ] ++ lib.optional (!stdenv.isx86_64) "-DARROW_USE_SIMD=OFF"
-  ++ lib.optional enableS3 "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h"
-  ++ lib.optionals enableGcs [ "-DCMAKE_CXX_STANDARD=${grpc.cxxStandard}" ];
+  ] ++ lib.optionals (!stdenv.isx86_64) [ "-DARROW_USE_SIMD=OFF" ]
+  ++ lib.optionals enableS3 [ "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h" ];

  doInstallCheck = true;
  ARROW_TEST_DATA = lib.optionalString doInstallCheck "${arrow-testing}/data";
@ -239,31 +236,33 @@ stdenv.mkDerivation rec {
        "TestS3FSGeneric.*"
      ];
    in
-    lib.optionalString doInstallCheck "-${builtins.concatStringsSep ":" filteredTests}";
+    lib.optionalString doInstallCheck "-${lib.concatStringsSep ":" filteredTests}";
+
  __darwinAllowLocalNetworking = true;
-  nativeInstallCheckInputs = [ perl which sqlite ] ++ lib.optional enableS3 minio;
-  installCheckPhase =
-    let
-      excludedTests = lib.optionals stdenv.isDarwin [
-        # Some plasma tests need to be patched to use a shorter AF_UNIX socket
-        # path on Darwin. See https://github.com/NixOS/nix/pull/1085
-        "plasma-external-store-tests"
-        "plasma-client-tests"
-      ] ++ [ "arrow-gcsfs-test" ];
-    in
-    ''
-      runHook preInstallCheck

-      ctest -L unittest \
-        --exclude-regex '^(${builtins.concatStringsSep "|" excludedTests})$'
+  nativeInstallCheckInputs = [ perl which sqlite ]
+    ++ lib.optionals enableS3 [ minio ]
+    ++ lib.optionals enableFlight [ python3 ];

-      runHook postInstallCheck
-    '';
+  disabledTests = [
+    # requires networking
+    "arrow-gcsfs-test"
+    "arrow-flight-integration-test"
+  ];
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    ctest -L unittest --exclude-regex '^(${lib.concatStringsSep "|" disabledTests})$'
+
+    runHook postInstallCheck
+  '';

  meta = with lib; {
    description = "A cross-language development platform for in-memory data";
    homepage = "https://arrow.apache.org/docs/cpp/";
    license = licenses.asl20;
+    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin; # waiting on gtest changes in staging
    platforms = platforms.unix;
    maintainers = with maintainers; [ tobim veprbl cpcloud ];
  };
--- a/pkgs/development/libraries/cosmopolitan/default.nix
+++ b/pkgs/development/libraries/cosmopolitan/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "cosmopolitan";
-  version = "2.1.1";
+  version = "2.2";

  src = fetchFromGitHub {
    owner = "jart";
    repo = pname;
    rev = version;
-    sha256 = "sha256-2Q4lutSIQ6tBwTy01lPSMepNAww9Kb7BwNyEcsSdWZ0=";
+    sha256 = "sha256-DTL1dXH+LhaxWpiCrsNjV74Bw5+kPbhEAA2Z1NKiPDk=";
  };

  patches = [
@ -34,6 +34,9 @@ stdenv.mkDerivation rec {
    rm test/libc/calls/sched_setscheduler_test.c
    rm test/libc/thread/pthread_create_test.c
    rm test/libc/calls/getgroups_test.c
+
+    # fails
+    rm test/libc/stdio/posix_spawn_test.c
  '';

  installPhase = ''
--- a/pkgs/development/libraries/example-robot-data/default.nix
+++ b/pkgs/development/libraries/example-robot-data/default.nix
@ -8,14 +8,14 @@

 stdenv.mkDerivation rec {
  pname = "example-robot-data";
-  version = "4.0.3";
+  version = "4.0.4";

  src = fetchFromGitHub {
    owner = "Gepetto";
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-rxVyka8tcF/CmGTVNyh3FPR1LVa6JOAN+9zjElgqCak=";
+    sha256 = "sha256-5FqMRChv/YGeoZq/jLSEJI5iQazQIDwslT78fbERVfs=";
  };

  strictDeps = true;
--- a/pkgs/development/libraries/fizz/default.nix
+++ b/pkgs/development/libraries/fizz/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "fizz";
-  version = "2023.01.30.00";
+  version = "2023.02.06.00";

  src = fetchFromGitHub {
    owner = "facebookincubator";
    repo = "fizz";
    rev = "v${version}";
-    sha256 = "sha256-WyqDVoByBP91qGohNadr3iGpKEwZrURjr9mEaAdbfvs=";
+    sha256 = "sha256-JwRoIiSumT1jw5/VX/TkxpTJbrmLLke27xH8UHtrs2c=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/irr1/default.nix
+++ b/pkgs/development/libraries/irr1/default.nix
@ -4,25 +4,25 @@
 , cmake
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (self: {
  pname = "irr1";
  version = "1.9.4";

  src = fetchFromGitHub {
    owner = "berndporr";
    repo = "iir1";
-    rev = version;
+    rev = self.version;
    hash = "sha256-T8gl51IkZIGq+6D5ge4Kb3wm5aw7Rhphmnf6TTGwHbs=";
  };

  nativeBuildInputs = [ cmake ];

  meta = {
-    description = "A DSP IIR realtime filter library written in C++";
-    downloadPage = "https://github.com/berndporr/iir1";
    homepage = "http://berndporr.github.io/iir1/";
+    description = "A DSP IIR realtime filter library written in C++";
+    changelog = "https://github.com/berndporr/iir1/releases/tag/${self.version}";
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.AndersonTorres ];
    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/development/libraries/jbig2enc/default.nix
+++ b/pkgs/development/libraries/jbig2enc/default.nix
@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, leptonica
+, zlib
+, libwebp
+, giflib
+, libjpeg
+, libpng
+, libtiff
+, autoreconfHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "jbig2enc";
+  version = "0.29";
+
+  src = fetchFromGitHub {
+    owner = "agl";
+    repo = "jbig2enc";
+    rev = version;
+    hash = "sha256-IAL4egXgaGmCilzcryjuvOoHhahyrfGWY68GBfXXgAM=";
+  };
+
+  buildInputs = [ autoreconfHook ];
+  propagatedBuildInputs = [
+    leptonica
+    zlib
+    libwebp
+    giflib
+    libjpeg
+    libpng
+    libtiff
+  ];
+
+  patches = [
+    (fetchpatch {
+      name = "fix-build-leptonica-1.83.patch";
+      url = "https://github.com/agl/jbig2enc/commit/ea050190466f5336c69c6a11baa1cb686677fcab.patch";
+      hash = "sha256-+kScjFgDEU9F7VOUNAhm2XBjGm49fzAH8hYhmTm8xv8=";
+    })
+  ];
+
+  # This is necessary, because the resulting library has
+  # /tmp/nix-build-jbig2enc/src/.libs before /nix/store/jbig2enc/lib
+  # in its rpath, which means that patchelf --shrink-rpath removes
+  # the /nix/store one.  By cleaning up before fixup, we ensure that
+  # the /tmp/nix-build-jbig2enc/src/.libs directory is gone.
+  preFixup = ''
+    make clean
+  '';
+
+  meta = {
+    description = "Encoder for the JBIG2 image compression format";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    homepage = "https://github.com/agl/jbig2enc";
+  };
+}
--- a/pkgs/development/libraries/leptonica/default.nix
+++ b/pkgs/development/libraries/leptonica/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  pname = "leptonica";
-  version = "1.82.0";
+  version = "1.83.0";

  src = fetchurl {
    url = "http://www.leptonica.org/source/${pname}-${version}.tar.gz";
-    sha256 = "sha256-FVMC7pFGaMJ7b+PKn/LaY7JF9tYvMGHI8nVjd0uK4tY=";
+    sha256 = "sha256-IGWR3VjPhO84CDba0TO1jJ0a+SSR9amCXDRqFiBEvP4=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/development/libraries/physics/clhep/default.nix
+++ b/pkgs/development/libraries/physics/clhep/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "clhep";
-  version = "2.4.6.3";
+  version = "2.4.6.4";

  src = fetchurl {
    url = "https://proj-clhep.web.cern.ch/proj-clhep/dist1/clhep-${version}.tgz";
-    hash = "sha256-/NAH8RsQukryjQJyIrYxSNDrRP96CC7uNTvfkh+caEo=";
+    hash = "sha256-SciTMPGQPvcH08XXnBanxabyyQ/CkOIDTuODSAlInlc=";
  };

  prePatch = ''
--- a/pkgs/development/libraries/pico-sdk/default.nix
+++ b/pkgs/development/libraries/pico-sdk/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "pico-sdk";
-  version = "1.4.0";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "raspberrypi";
    repo = pname;
    rev = version;
-    sha256 = "sha256-i3IAaNcd0EfKNvU104a776O1poDAChlx1m+nP8iFn8E=";
+    sha256 = "sha256-p69go8KXQR21szPb+R1xuonyFj+ZJDunNeoU7M3zIsE=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "s2n-tls";
-  version = "1.3.34";
+  version = "1.3.36";

  src = fetchFromGitHub {
    owner = "aws";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-CaVo2OxfB7ImMOgPuyvKQFbTeEm3PqD8CV96jUEZ8U0=";
+    sha256 = "sha256-IL7+f+7Igvm7KeBpDwnIoIB8IUqg3JDEtLFQslBIENE=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/science/math/sympow/default.nix
+++ b/pkgs/development/libraries/science/math/sympow/default.nix
@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitLab
+, fetchpatch
 , makeWrapper
 , which
 , autoconf
@ -20,7 +21,14 @@ stdenv.mkDerivation rec {
    sha256 = "132l0xv00ld1svvv9wh99wfra4zzjv2885h2sq0dsl98wiyvi5zl";
  };

-  patches = [ ./clean-extra-logfile-output-from-pari.patch ];
+  patches = [
+    ./clean-extra-logfile-output-from-pari.patch
+    (fetchpatch {
+      name = "null-terminate-dupdirname.patch";
+      url = "https://gitlab.com/rezozer/forks/sympow/-/merge_requests/5.diff";
+      sha256 = "sha256-yKjio+qN9teL8L+mb7WOBN/iv545vRIxW20FJU37oO4=";
+    })
+  ];

  postUnpack = ''
    patchShebangs .
--- a/pkgs/development/libraries/stfl/default.nix
+++ b/pkgs/development/libraries/stfl/default.nix
@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
    sha256 = "1460d5lc780p3q38l3wc9jfr2a7zlyrcra0li65aynj738cam9yl";
  };

+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
  buildInputs = [ ncurses libiconv ];

  preBuild = ''
@ -16,12 +18,22 @@ stdenv.mkDerivation rec {
    sed -i s%ncursesw/ncurses.h%ncurses.h% stfl_internals.h
  '' + lib.optionalString stdenv.isDarwin ''
    sed -i s/-soname/-install_name/ Makefile
-  '';
+  ''
+  # upstream builds shared library unconditionally. Also, it has no
+  # support for cross-compilation.
+  + lib.optionalString stdenv.hostPlatform.isStatic ''
+    sed -i 's/all:.*/all: libstfl.a stfl.pc/' Makefile
+    sed -i 's/\tar /\t${stdenv.cc.targetPrefix}ar /' Makefile
+    sed -i 's/\tranlib /\t${stdenv.cc.targetPrefix}ranlib /' Makefile
+    sed -i '/install -m 644 libstfl.so./d' Makefile
+    sed -i '/ln -fs libstfl.so./d' Makefile
+  '' ;

  installPhase = ''
    DESTDIR=$out prefix=\"\" make install
-
-    # some programs rely on libstfl.so.0 to be present, so link it
+  ''
+  # some programs rely on libstfl.so.0 to be present, so link it
+  + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
    ln -s $out/lib/libstfl.so.0.24 $out/lib/libstfl.so.0
  '';

--- a/pkgs/development/libraries/thrift/default.nix
+++ b/pkgs/development/libraries/thrift/default.nix
@ -36,11 +36,14 @@ stdenv.mkDerivation rec {

  buildInputs = [
    boost
+  ] ++ lib.optionals (!static) [
+    (python3.withPackages (ps: [ps.twisted]))
+  ];
+
+  propagatedBuildInputs = [
    libevent
    openssl
    zlib
-  ] ++ lib.optionals (!static) [
-    (python3.withPackages (ps: [ps.twisted]))
  ];

  postPatch = ''
@ -66,6 +69,11 @@ stdenv.mkDerivation rec {
      url = "https://github.com/apache/thrift/commit/c41ad9d5119e9bdae1746167e77e224f390f2c42.diff";
      hash = "sha256-FkErrg/6vXTomS4AsCsld7t+Iccc55ZiDaNjJ3W1km0=";
    })
+    (fetchpatch {
+      name = "thrift-install-FindLibevent.patch"; # https://github.com/apache/thrift/pull/2726
+      url = "https://github.com/apache/thrift/commit/2ab850824f75d448f2ba14a468fb77d2594998df.diff";
+      hash = "sha256-ejMKFG/cJgoPlAFzVDPI4vIIL7URqaG06/IWdQ2NkhY=";
+    })
  ];

  cmakeFlags = [
--- a/pkgs/development/python-modules/asf-search/default.nix
+++ b/pkgs/development/python-modules/asf-search/default.nix
@ -1,17 +1,19 @@
 { lib
 , buildPythonPackage
-, dateparser
 , fetchFromGitHub
+, pythonOlder
+, requests
+, shapely
+, python-dateutil
+, pytz
 , importlib-metadata
 , numpy
+, dateparser
+, jinja2
+, remotezip
 , pytestCheckHook
-, python-dateutil
-, pythonOlder
-, pytz
-, requests
 , requests-mock
-, shapely
-, wktutils
+, defusedxml
 }:

 buildPythonPackage rec {
@ -29,25 +31,25 @@ buildPythonPackage rec {
  };

  propagatedBuildInputs = [
-    dateparser
-    importlib-metadata
-    numpy
-    python-dateutil
-    pytz
    requests
    shapely
-    wktutils
+    python-dateutil
+    pytz
+    importlib-metadata
+    numpy
+    dateparser
+    jinja2
+    remotezip
  ];

  nativeCheckInputs = [
    pytestCheckHook
-    requests-mock
  ];

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "WKTUtils==" "WKTUtils>="
-  '';
+  checkInputs = [
+    requests-mock
+    defusedxml
+  ];

  pythonImportsCheck = [
    "asf_search"
--- a/pkgs/development/python-modules/awswrangler/default.nix
+++ b/pkgs/development/python-modules/awswrangler/default.nix
@ -0,0 +1,88 @@
+{ backoff
+, sparqlwrapper
+, boto3
+, buildPythonPackage
+, fetchFromGitHub
+, gremlinpython
+, jsonpath-ng
+, lib
+, moto
+, openpyxl
+, opensearch-py
+, pandas
+, pg8000
+, poetry-core
+, progressbar2
+, pyarrow
+, pymysql
+, pyodbc
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+, redshift-connector
+, requests-aws4auth
+}:
+
+buildPythonPackage rec {
+  pname = "awswrangler";
+  version = "2.19.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7.1";
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "aws-sdk-pandas";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xUEytEgr/djfnoOowLxAZmbPkMS+vU0fuPY7JxZXEe0=";
+  };
+
+  nativeBuildInputs = [ poetry-core pythonRelaxDepsHook ];
+
+  propagatedBuildInputs = [
+    backoff
+    boto3
+    gremlinpython
+    jsonpath-ng
+    openpyxl
+    opensearch-py
+    pandas
+    pg8000
+    progressbar2
+    pyarrow
+    pymysql
+    redshift-connector
+    requests-aws4auth
+  ];
+
+  pythonRelaxDeps = [
+    "gremlinpython"
+    "numpy"
+    "pandas"
+    "pg8000"
+  ];
+
+  nativeCheckInputs = [ moto pytestCheckHook ];
+
+  pytestFlagsArray = [
+    # Subset of tests that run in upstream CI (many others require credentials)
+    # https://github.com/aws/aws-sdk-pandas/blob/2b7c62ac0762b1303149bb3c03979791479ba4f9/.github/workflows/minimal-tests.yml
+    "tests/test_metadata.py"
+    "tests/test_session.py"
+    "tests/test_utils.py"
+    "tests/test_moto.py"
+  ];
+
+  passthru.optional-dependencies = {
+    sqlserver = [ pyodbc ];
+    sparql = [ sparqlwrapper ];
+  };
+
+  meta = {
+    description = "Pandas on AWS";
+    homepage = "https://github.com/aws/aws-sdk-pandas";
+    changelog = "https://github.com/aws/aws-sdk-pandas/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mcwitt ];
+  };
+}
--- a/pkgs/development/python-modules/bundlewrap/default.nix
+++ b/pkgs/development/python-modules/bundlewrap/default.nix
@ -31,7 +31,7 @@ buildPythonPackage rec {

  nativeBuildInputs = [ setuptools ];
  propagatedBuildInputs = [
-    cryptography jinja2 Mako passlib pyyaml requests tomlkit librouteros
+    setuptools cryptography jinja2 Mako passlib pyyaml requests tomlkit librouteros
  ] ++ lib.optionals (pythonOlder "3.11") [ rtoml ];

  pythonImportsCheck = [ "bundlewrap" ];
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@ -1,5 +1,6 @@
 { lib
 , stdenv
+, arrow-cpp
 , bokeh
 , buildPythonPackage
 , click
@ -70,13 +71,14 @@ buildPythonPackage rec {
  };

  nativeCheckInputs = [
-    fastparquet
-    pyarrow
    pytestCheckHook
    pytest-rerunfailures
    pytest-xdist
    scipy
    zarr
+  ] ++ lib.optionals (!arrow-cpp.meta.broken) [ # support is sparse on aarch64
+    fastparquet
+    pyarrow
  ];

  dontUseSetuptoolsCheck = true;
--- a/pkgs/development/python-modules/effect/default.nix
+++ b/pkgs/development/python-modules/effect/default.nix
@ -1,40 +1,52 @@
-{ buildPythonPackage
-, fetchPypi
-, lib
-, isPy3k
-, six
+{ lib
 , attrs
-, pytest
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+, pythonOlder
+, six
 , testtools
 }:

 buildPythonPackage rec {
-  version = "1.1.0";
  pname = "effect";
-  disabled = (!isPy3k);
+  version = "1.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "7affb603707c648b07b11781ebb793a4b9aee8acf1ac5764c3ed2112adf0c9ea";
+    hash = "sha256-ev+2A3B8ZIsHsReB67eTpLmu6KzxrFdkw+0hEq3wyeo=";
  };

+  postPatch = ''
+    substituteInPlace effect/test_do.py \
+      --replace "py.test" "pytest"
+  '';
+
+  propagatedBuildInputs = [
+    attrs
+    six
+  ];
+
  nativeCheckInputs = [
-    pytest
+    pytestCheckHook
+  ];
+
+  checkInputs = [
    testtools
  ];

-  propagatedBuildInputs = [
-    six
-    attrs
+  pythonImportsCheck = [
+    "effect"
  ];

-  checkPhase = ''
-    pytest
-  '';
-
  meta = with lib; {
    description = "Pure effects for Python";
-    homepage = "https://github.com/python-effect/effect";
+    homepage = "https://effect.readthedocs.io/";
+    changelog = "https://github.com/python-effect/effect/releases/tag/${version}";
    license = licenses.mit;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@ -1,29 +1,46 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, pythonOlder, cython
-, attrs, click, cligj, click-plugins, six, munch, enum34
-, pytestCheckHook, boto3, mock, giflib, pytz
-, gdal, certifi
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, cython
+, gdal
+, setuptools
+, attrs
+, certifi
+, click
+, click-plugins
+, cligj
+, munch
+, shapely
+, boto3
+, pytestCheckHook
+, pytz
 }:

 buildPythonPackage rec {
  pname = "fiona";
-  version = "1.9.0";
+  version = "1.9.1";

-  src = fetchPypi {
-    pname = "Fiona";
-    inherit version;
-    hash = "sha256-bkh8v7pahJ+98G5FFp/X4fFmL0Tz1xerS5RgRrJFfq4=";
+  disabled = pythonOlder "3.7";
+
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "Toblerity";
+    repo = "Fiona";
+    rev = "refs/tags/${version}";
+    hash = "sha256-2CGLkgnpCAh9G+ILol5tmRj9S6/XeKk8eLzGEODiyP8=";
  };

-  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
-
  nativeBuildInputs = [
    cython
    gdal # for gdal-config
+    setuptools
  ];

  buildInputs = [
    gdal
-  ] ++ lib.optionals stdenv.cc.isClang [ giflib ];
+  ];

  propagatedBuildInputs = [
    attrs
@ -31,32 +48,33 @@ buildPythonPackage rec {
    click
    cligj
    click-plugins
-    six
    munch
-    pytz
-  ] ++ lib.optional (!isPy3k) enum34;
+    setuptools
+  ];
+
+  passthru.optional-dependencies = {
+    calc = [ shapely ];
+    s3 = [ boto3 ];
+  };

  nativeCheckInputs = [
    pytestCheckHook
-    boto3
-  ] ++ lib.optional (pythonOlder "3.4") mock;
+    pytz
+  ] ++ passthru.optional-dependencies.s3;

  preCheck = ''
    rm -r fiona # prevent importing local fiona
-    # disable gdal deprecation warnings
-    export GDAL_ENABLE_DEPRECATED_DRIVER_GTM=YES
  '';

  disabledTests = [
    # Some tests access network, others test packaging
    "http" "https" "wheel"
-    # https://github.com/Toblerity/Fiona/issues/1164
-    "test_no_append_driver_cannot_append"
  ];

  pythonImportsCheck = [ "fiona" ];

  meta = with lib; {
+    changelog = "https://github.com/Toblerity/Fiona/blob/${src.rev}/CHANGES.txt";
    description = "OGR's neat, nimble, no-nonsense API for Python";
    homepage = "https://fiona.readthedocs.io/";
    license = licenses.bsd3;
--- a/pkgs/development/python-modules/fpylll/default.nix
+++ b/pkgs/development/python-modules/fpylll/default.nix
@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , buildPythonPackage
 , pkgconfig
 , gmp
@ -16,23 +15,15 @@

 buildPythonPackage rec {
  pname = "fpylll";
-  version = "0.5.7";
+  version = "0.5.9";

  src = fetchFromGitHub {
    owner = "fplll";
    repo = "fpylll";
    rev = version;
-    sha256 = "sha256-iUPreJ8BSB8LDisbJis0xn8ld6+Nf9Z4AP8SWJlCfZg=";
+    sha256 = "sha256-T6l6hKzRDevlLyLu5H+bnEdl0OhsPer1coCDiftbPAk=";
  };

-  patches = [
-   (fetchpatch {
-     name = "remove-strategies-doctest.patch";
-     url = "https://github.com/fplll/fpylll/commit/3edffcd189e9d827a322d83b0f84d32e5f067442.patch";
-     sha256 = "sha256-U7qOIbVzUNwYmjOPryjnE3J+MX/vMwm3T0UyOZ5ylLc=";
-   })
-  ];
-
  buildInputs = [
    gmp
    pari
--- a/pkgs/development/python-modules/mediapy/default.nix
+++ b/pkgs/development/python-modules/mediapy/default.nix
@ -21,6 +21,8 @@ buildPythonPackage rec {

  propagatedBuildInputs = [ ipython matplotlib numpy pillow ];

+  format = "flit";
+
  pythonImportsCheck = [ "mediapy" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@ -18,18 +18,15 @@
 , pkg-config
 , scipy
 , setuptools-scm
-, six
 }:

 let
  zero_or_one = cond: if cond then 1 else 0;
-
-  _arrow-cpp = arrow-cpp.override { python3 = python; };
 in

 buildPythonPackage rec {
  pname = "pyarrow";
-  inherit (_arrow-cpp) version src;
+  inherit (arrow-cpp) version src;

  disabled = pythonOlder "3.7";

@ -42,13 +39,14 @@ buildPythonPackage rec {
    setuptools-scm
  ];

+  buildInputs = [ arrow-cpp ];
+
  propagatedBuildInputs = [
    cffi
    cloudpickle
    fsspec
    numpy
    scipy
-    six
  ];

  nativeCheckInputs = [
@ -61,20 +59,24 @@ buildPythonPackage rec {
  PYARROW_BUILD_TYPE = "release";

  PYARROW_WITH_DATASET = zero_or_one true;
-  PYARROW_WITH_FLIGHT = zero_or_one _arrow-cpp.enableFlight;
+  PYARROW_WITH_FLIGHT = zero_or_one arrow-cpp.enableFlight;
  PYARROW_WITH_HDFS = zero_or_one true;
  PYARROW_WITH_PARQUET = zero_or_one true;
-  PYARROW_WITH_PLASMA = zero_or_one (!stdenv.isDarwin);
-  PYARROW_WITH_S3 = zero_or_one _arrow-cpp.enableS3;
+  PYARROW_WITH_PARQUET_ENCRYPTION = zero_or_one true;
+  # Plasma is deprecated since arrow 10.0.0
+  PYARROW_WITH_PLASMA = zero_or_one false;
+  PYARROW_WITH_S3 = zero_or_one arrow-cpp.enableS3;
+  PYARROW_WITH_GCS = zero_or_one arrow-cpp.enableGcs;
+  PYARROW_BUNDLE_ARROW_CPP_HEADERS = zero_or_one false;

  PYARROW_CMAKE_OPTIONS = [
    "-DCMAKE_INSTALL_RPATH=${ARROW_HOME}/lib"
  ];

-  ARROW_HOME = _arrow-cpp;
-  PARQUET_HOME = _arrow-cpp;
+  ARROW_HOME = arrow-cpp;
+  PARQUET_HOME = arrow-cpp;

-  ARROW_TEST_DATA = lib.optionalString doCheck _arrow-cpp.ARROW_TEST_DATA;
+  ARROW_TEST_DATA = lib.optionalString doCheck arrow-cpp.ARROW_TEST_DATA;

  doCheck = true;

@ -86,6 +88,13 @@ buildPythonPackage rec {
    export PYARROW_PARALLEL=$NIX_BUILD_CORES
  '';

+  postInstall = ''
+    # copy the pyarrow C++ header files to the appropriate location
+    pyarrow_include="$out/${python.sitePackages}/pyarrow/include"
+    mkdir -p "$pyarrow_include/arrow/python"
+    find "$PWD/pyarrow/src/arrow" -type f -name '*.h' -exec cp {} "$pyarrow_include/arrow/python" \;
+  '';
+
  pytestFlagsArray = [
    # Deselect a single test because pyarrow prints a 2-line error message where
    # only a single line is expected. The additional line of output comes from
@ -103,6 +112,8 @@ buildPythonPackage rec {
    "--deselect=pyarrow/tests/test_pandas.py::test_threaded_pandas_import"
    # Flaky test, works locally but not on Hydra
    "--deselect=pyarrow/tests/test_csv.py::TestThreadedCSVTableRead::test_cancellation"
+    # expects arrow-cpp headers to be bundled
+    "--deselect=pyarrow/tests/test_cpp_internals.py::test_pyarrow_include"
  ] ++ lib.optionals stdenv.isDarwin [
    # Requires loopback networking
    "--deselect=pyarrow/tests/test_ipc.py::test_socket_"
@ -110,11 +121,18 @@ buildPythonPackage rec {
    "--deselect=pyarrow/tests/test_flight.py::test_large_descriptor"
    "--deselect=pyarrow/tests/test_flight.py::test_large_metadata_client"
    "--deselect=pyarrow/tests/test_flight.py::test_none_action_side_effect"
+    # fails to compile
+    "--deselect=pyarrow/tests/test_cython.py::test_cython_api"
  ] ++ lib.optionals (pythonAtLeast "3.11") [
    # Repr output is printing number instead of enum name so these tests fail
    "--deselect=pyarrow/tests/test_fs.py::test_get_file_info"
+  ] ++ lib.optionals stdenv.isLinux [
+    # this test requires local networking
+    "--deselect=pyarrow/tests/test_fs.py::test_filesystem_from_uri_gcs"
  ];

+  disabledTests = [ "GcsFileSystem" ];
+
  dontUseSetuptoolsCheck = true;

  preCheck = ''
@ -129,7 +147,7 @@ buildPythonPackage rec {

  pythonImportsCheck = [
    "pyarrow"
-  ] ++ map (module: "pyarrow.${module}") ([
+  ] ++ map (module: "pyarrow.${module}") [
    "compute"
    "csv"
    "dataset"
@ -139,9 +157,7 @@ buildPythonPackage rec {
    "hdfs"
    "json"
    "parquet"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
-    "plasma"
-  ]);
+  ];

  meta = with lib; {
    description = "A cross-language development platform for in-memory data";
--- a/pkgs/development/python-modules/pyipma/default.nix
+++ b/pkgs/development/python-modules/pyipma/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "pyipma";
-  version = "3.0.5";
+  version = "3.0.6";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "dgomes";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-KyXHNkP/XJlTdVFdP91x3udMquQju8G2VUHLPvZymtk=";
+    hash = "sha256-BwW8gUFeinZ9Z/v1orJKRTqt2WxVMD+hQj+A3gU1LDI=";
  };

  propagatedBuildInputs = [
@ -52,6 +52,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Library to retrieve information from Instituto Português do Mar e Atmosfera";
    homepage = "https://github.com/dgomes/pyipma";
+    changelog = "https://github.com/dgomes/pyipma/releases/tag/${version}";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/pyoutbreaksnearme/default.nix
+++ b/pkgs/development/python-modules/pyoutbreaksnearme/default.nix
@ -1,7 +1,6 @@
 { lib
 , aiohttp
 , aresponses
-, aiocache
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
@ -9,39 +8,29 @@
 , pytest-aiohttp
 , pytestCheckHook
 , pythonOlder
-, pythonRelaxDepsHook
-, msgpack
 , ujson
 }:

 buildPythonPackage rec {
-  pname = "pyflunearyou";
-  version = "2021.10.0";
+  pname = "pyoutbreaksnearme";
+  version = "2022.10.0";
  format = "pyproject";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "bachya";
    repo = pname;
-    rev = version;
-    sha256 = "sha256-Q65OSE4qckpvaIvZULBR434i7hwuVM97eSq1Blb1oIU=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-D7oXkKDSg+yF+j1WyG/VVY12hLU6oyhEtxLrF6IkMSA=";
  };

-  pythonRelaxDeps = [
-    "aiocache"
-    "ujson"
-  ];
-
  nativeBuildInputs = [
    poetry-core
-    pythonRelaxDepsHook
  ];

  propagatedBuildInputs = [
    aiohttp
-    aiocache
-    msgpack
    ujson
  ];

@ -58,12 +47,13 @@ buildPythonPackage rec {
  ];

  pythonImportsCheck = [
-    "pyflunearyou"
+    "pyoutbreaksnearme"
  ];

  meta = with lib; {
-    description = "Python library for retrieving UV-related information from Flu Near You";
-    homepage = "https://github.com/bachya/pyflunearyou";
+    description = "Library for retrieving data from for Outbreaks Near Me";
+    homepage = "https://github.com/bachya/pyoutbreaksnearme";
+    changelog = "https://github.com/bachya/pyoutbreaksnearme/releases/tag/${version}";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/pyweatherflowrest/default.nix
+++ b/pkgs/development/python-modules/pyweatherflowrest/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "pyweatherflowrest";
-  version = "1.0.8";
+  version = "1.0.9";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -16,8 +16,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "briis";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "1swyqdnvhwaigqhjn5a22gi8if4bl8alfrigln4qa0jl9z03kg09";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LFA1GJCYFIWl7/YblRrYgAB4lbELpzhCJyjB8aCkJ/E=";
  };

  nativeBuildInputs = [
@ -44,6 +44,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python module to get data from WeatherFlow Weather Stations";
    homepage = "https://github.com/briis/pyweatherflowrest";
+    changelog = "https://github.com/briis/pyweatherflowrest/blob/v${version}/CHANGELOG.md";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/remotezip/default.nix
+++ b/pkgs/development/python-modules/remotezip/default.nix
@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, requests
+, tabulate
+, pytestCheckHook
+, requests-mock
+}:
+
+buildPythonPackage {
+  pname = "remotezip";
+  version = "0.12.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "gtsystem";
+    repo = "python-remotezip";
+    # upstream does not tag releases, determined with git blame
+    # pypi archive lacks files for tests
+    rev = "da62e115bdb2071ad08a8c91f7ae48f2c1827e0c";
+    hash = "sha256-su4dlV8KZuewf/yGdTnGHK9hNLHwGe10ditmFcne4Us=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    tabulate
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    requests-mock
+  ];
+
+  pythonImportsCheck = [
+    "remotezip"
+  ];
+
+  meta = with lib; {
+    description = "Python module to access single members of a zip archive without downloading the full content";
+    homepage = "https://github.com/gtsystem/python-remotezip";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nickcao ];
+  };
+}
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@ -11,11 +11,12 @@
 , pygtrie
 , pythonOlder
 , setuptools
+, shortuuid
 }:

 buildPythonPackage rec {
  pname = "scmrepo";
-  version = "0.1.7";
+  version = "0.1.9";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -24,7 +25,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-F+t/3Nfcw+LG9Kh0Je2JwPWUWBNsZXTEaQOKaTT5ig0=";
+    hash = "sha256-WXePQMHCAmcGUHNNHBaqNQisewMUR87iJC0K2ltYVBE=";
  };

  postPatch = ''
@ -46,6 +47,7 @@ buildPythonPackage rec {
    pathspec
    pygit2
    pygtrie
+    shortuuid
  ];

  # Requires a running Docker instance
--- a/pkgs/development/python-modules/shortuuid/default.nix
+++ b/pkgs/development/python-modules/shortuuid/default.nix
@ -28,6 +28,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Library to generate concise, unambiguous and URL-safe UUIDs";
    homepage = "https://github.com/stochastic-technologies/shortuuid/";
+    changelog = "https://github.com/skorokithakis/shortuuid/blob/v${version}/CHANGELOG.md";
    license = licenses.bsd3;
    maintainers = with maintainers; [ zagy ];
  };
--- a/pkgs/development/python-modules/tesserocr/default.nix
+++ b/pkgs/development/python-modules/tesserocr/default.nix
@ -24,6 +24,11 @@ buildPythonPackage rec {
    sha256 = "1bmj76gi8401lcqdaaznfmz9yf11myy1bzivqwwq08z3dwzxswck";
  };

+  # https://github.com/sirfz/tesserocr/issues/314
+  postPatch = ''
+    sed -i '/allheaders.h/a\    pass\n\ncdef extern from "leptonica/pix_internal.h" nogil:' tesseract.pxd
+  '';
+
  nativeBuildInputs = [
    cython
    pkg-config
--- a/pkgs/development/python-modules/xmlschema/default.nix
+++ b/pkgs/development/python-modules/xmlschema/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "xmlschema";
-  version = "2.2.0";
+  version = "2.2.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "sissaschool";
    repo = "xmlschema";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KK1F8OVK+19ZWwu+2UtTMiVNyPPoPOv3V1qJFZAu2h4=";
+    hash = "sha256-yF2L5VxUkqJjen5JeCQis4Q1o1KCJtRJ+S52wnS5VQg=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/development/tools/analysis/tflint/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "tflint";
-  version = "0.44.1";
+  version = "0.45.0";

  src = fetchFromGitHub {
    owner = "terraform-linters";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-O758CU70NqRFlbtiy5cmfIHiHdQLxH88BHNZLQVvZ+M=";
+    sha256 = "sha256-tsnW6KoLHEWd/uDZrK2cnVZ2IWftoxZ5zGdYhRdUp9Q=";
  };

-  vendorSha256 = "sha256-4ODf6Er7V5KsVUdWjqjv+dfH84PPR+5T29V1AJluoJA=";
+  vendorSha256 = "sha256-crGs7j9hAnGCCFjhigIJVpTM0rr9WgvBq3/ZGt6hwqQ=";

  doCheck = false;

--- a/pkgs/development/tools/bpf-linker/default.nix
+++ b/pkgs/development/tools/bpf-linker/default.nix
@ -2,7 +2,7 @@
 , stdenv
 , rustPlatform
 , fetchFromGitHub
-, llvmPackages_14
+, llvmPackages_15
 , zlib
 , ncurses
 , libxml2
@ -10,21 +10,21 @@

 rustPlatform.buildRustPackage rec {
  pname = "bpf-linker";
-  version = "0.9.4";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "aya-rs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-jYuBk78aGQLUeNF6d6kjGPuMxEF22XJquHcs23WVGm0=";
+    hash = "sha256-LEZ2to1bzJ/H/XYytuh/7NT7+04aI8chpKIFxxVzM+4=";
  };

-  cargoHash = "sha256-X8EVpOxDHwE/wj/gly/wdZ6tsrMrz3kkDe9gEPbk6iw=";
+  cargoHash = "sha256-s8cW7lXtvgemuQueTtAywewnDVJ/WDcz8SBqsC/tO80=";

  buildNoDefaultFeatures = true;
  buildFeatures = [ "system-llvm" ];

-  nativeBuildInputs = [ llvmPackages_14.llvm ];
+  nativeBuildInputs = [ llvmPackages_15.llvm ];
  buildInputs = [ zlib ncurses libxml2 ];

  # fails with: couldn't find crate `core` with expected target triple bpfel-unknown-none
--- a/pkgs/development/tools/coder/default.nix
+++ b/pkgs/development/tools/coder/default.nix
@ -5,19 +5,19 @@
 }:
 buildGoModule rec {
  pname = "coder";
-  version = "0.16.0";
+  version = "0.17.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-3rGpyJzGkZYUEvKKDzj2I5sqrUImmmX7cXWM9UClPLY=";
+    hash = "sha256-FHBaefwSGZXwn1jdU7zK8WhwjarknvyeUJTlhmk/hPM=";
  };

  # integration tests require network access
  doCheck = false;

-  vendorHash = "sha256-bb9jBno7elO6qKGjacpX3rxgrpJpGpTxMQtdBYjBzMk=";
+  vendorHash = "sha256-+AvmJkZCFovE2+5Lg98tUvA7f2kBHUMzhl5IyrEGuy8=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "fly";
-  version = "7.9.0";
+  version = "7.9.1";

  src = fetchFromGitHub {
    owner = "concourse";
    repo = "concourse";
    rev = "v${version}";
-    sha256 = "sha256-YatN0VG3oEUK+vzJzthRnX+EkvUgKq2uIunAoPMoRag=";
+    sha256 = "sha256-ySyarky92+VSo/KzQFrWeh35KDMTQDV34F5iFrARHJs=";
  };

-  vendorSha256 = "sha256-nX0r/7V+rgJb3/9O91QskYzBpWXIca7m3Do1QtGuHgg=";
+  vendorHash = "sha256-Oy1wP82ZhdpGHs/gpfdveOK/jI9yuo0D3JtxjLg+W/w=";

  subPackages = [ "fly" ];

--- a/pkgs/development/tools/gci/default.nix
+++ b/pkgs/development/tools/gci/default.nix
@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
  pname = "gci";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "daixiang0";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-qWEEcIbTgYmGVnnTW+hM8e8nw5VLWN1TwzdUIZrxF3s=";
+    sha256 = "sha256-VbN4lRK+6stOApMEdtX32JhKGkCSrafMJbizpWmHRXA=";
  };

-  vendorSha256 = "sha256-dlt+i/pEP3RzW4JwndKTU7my2Nn7/2rLFlk8n1sFR60=";
+  vendorHash = "sha256-dlt+i/pEP3RzW4JwndKTU7my2Nn7/2rLFlk8n1sFR60=";

  meta = with lib; {
    description = "Controls golang package import order and makes it always deterministic";
--- a/pkgs/development/tools/kustomize/kustomize-sops.nix
+++ b/pkgs/development/tools/kustomize/kustomize-sops.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kustomize-sops";
-  version = "4.0.0";
+  version = "4.1.0";

  src = fetchFromGitHub {
    owner = "viaduct-ai";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-8CZcPZLainc7iRZ5Ul27QxW3oK7sikCjzCBEkfCeNUc=";
+    sha256 = "sha256-piCsae2B+FC+wi/vCCtPY76O4eMXJeNufFo31QkHCAU=";
  };

-  vendorHash = "sha256-GBjMN6pyB+48e5LNqLBbh6a5fC9P0T53CZUPGNcbBDc=";
+  vendorHash = "sha256-vTP2wM7MqiSfP+3Gd0Ab5t0al5xL8rw3kl7bOT19zU4=";

  installPhase = ''
    mkdir -p $out/lib/viaduct.ai/v1/ksops-exec/
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "circleci-cli";
-  version = "0.1.23334";
+  version = "0.1.23391";

  src = fetchFromGitHub {
    owner = "CircleCI-Public";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-1+PcjameB9/1MoyM0RAxrhuE649INyLlhgxA5xJQ9Pw=";
+    sha256 = "sha256-mTqrckoYbxtlwonXp6mtbXSpmVB3WfSXaOkyycBVjx0=";
  };

-  vendorHash = "sha256-E24b8PUA1Hy+OepQe2n6TecCMKKicdr5KUdiJ663Td0=";
+  vendorHash = "sha256-7k5jmXvNtxezialavNz8NM7esl2vpXcjRW2n/9GAycs=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/development/tools/misc/saleae-logic-2/default.nix
+++ b/pkgs/development/tools/misc/saleae-logic-2/default.nix
@ -1,10 +1,10 @@
 { lib, fetchurl, makeDesktopItem, appimageTools }:
 let
  name = "saleae-logic-2";
-  version = "2.4.3";
+  version = "2.4.6";
  src = fetchurl {
    url = "https://downloads.saleae.com/logic2/Logic-${version}-master.AppImage";
-    hash = "sha256-xF87Q1K25/9pUYt660RY2RCIC6u2m2ArBQb2nWhiKvw=";
+    hash = "sha256-FYLjg4lzr8M22r4yoKfMIAx2HKGi2fcD28AaV1ChkLk=";
  };
  desktopItem = makeDesktopItem {
    inherit name;
--- a/pkgs/development/tools/picotool/default.nix
+++ b/pkgs/development/tools/picotool/default.nix
@ -2,25 +2,19 @@

 stdenv.mkDerivation rec {
  pname = "picotool";
-  version = "1.1.0";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "raspberrypi";
    repo = pname;
    rev = version;
-    sha256 = "sha256-YjDHoRcDoezyli42bJ0bnfjdNNY8l6ZilrxhOudqvwE=";
+    sha256 = "sha256-KP5Cq6pYKQI5dV6S4lLapu9EcwAgLgYpK0qreNDZink=";
  };

  buildInputs = [ libusb1 pico-sdk ];
  nativeBuildInputs = [ cmake pkg-config ];
  cmakeFlags = [ "-DPICO_SDK_PATH=${pico-sdk}/lib/pico-sdk" ];

-  installPhase = ''
-    runHook preInstall
-    install -Dm755 ./picotool -t $out/bin
-    runHook postInstall
-  '';
-
  meta = with lib; {
    homepage = "https://github.com/raspberrypi/picotool";
    description = "Tool for interacting with a RP2040 device in BOOTSEL mode, or with a RP2040 binary";
--- a/pkgs/os-specific/darwin/xcode/default.nix
+++ b/pkgs/os-specific/darwin/xcode/default.nix
@ -41,31 +41,44 @@ let requireXcode = version: sha256:
  in app.overrideAttrs ( oldAttrs: oldAttrs // { inherit meta; });

 in lib.makeExtensible (self: {
-  xcode_8_1 = requireXcode "8.1" "18xjvfipwzia66gm3r9p770xdd4r375vak7chw5vgqnv9yyjiq2n";
-  xcode_8_2 = requireXcode "8.2" "13nd1zsfqcp9hwp15hndr0rsbb8rgprrz7zr2ablj4697qca06m2";
-  xcode_9_1 = requireXcode "9.1" "0ab1403wy84ys3yn26fj78cazhpnslmh3nzzp1wxib3mr1afjvic";
-  xcode_9_2 = requireXcode "9.2" "1bgfgdp266cbbqf2axcflz92frzvhi0qw0jdkcw6r85kdpc8dj4c";
-  xcode_9_3 = requireXcode "9.3" "12m9kb4759s2ky42b1vf7y38qqxn2j99s99adzc6ljnmy26ii12w";
-  xcode_9_4 = requireXcode "9.4" "00az1cf9pm8zmvzs6yq04prdmxp8xi3ymxw94jjh4mh7hlbkhcb7";
-  xcode_9_4_1 = requireXcode "9.4.1" "0y9kphj86c14jl6aibv57sd7ln0w06vdhzm8ysp0s98rfgyq2lbw";
-  xcode_10_1 = requireXcode "10.1" "1ssdbg4v8r11fjf4jl38pwyry2aia1qihbxyxapz0v0n5gfnp05v";
-  xcode_10_2 = requireXcode "10.2" "1xzybl1gvb3q5qwlwchanzpws4sb70i3plf0vrzvlfdp2hsb3pg7";
-  xcode_10_2_1 = requireXcode "10.2.1" "11sdb54nr0x7kp987qq839x6k5gdx7vqdxjiy5xm5279n1n47bmg";
-  xcode_10_3 = requireXcode "10.3" "1i628vfn6zad81fsz3zpc6z15chhskvyp8qnajp2wnpzvrwl6ngb";
-  xcode_11 = requireXcode "11" "1r03j3kkp4blfp2kqpn538w3dx57ms930fj8apjkq6dk7fv3jcqh";
-  xcode_11_1 = requireXcode "11.1" "1c2gzc4jhhx5a7ncg19sh1r99izhipybaqxl1ll52x5y8689awc1";
-  xcode_11_2 = requireXcode "11.2" "1lm3q8zpvm184246h5j9mw4c1y9kk9sxnr3j98kfm0312n0l98gj";
-  xcode_11_3 = requireXcode "11.3" "04rv6xlywy8xqfx9ma8ygsdw4yhckk2mq0qnklxnfly899iw4wza";
-  xcode_11_3_1 = requireXcode "11.3.1" "1p6nicj91kr6ad3rmycahd1i7z4hj7ccjs93ixsiximjzaahx3q4";
-  xcode_11_4 = requireXcode "11.4" "065rpb3rdk19nv3rwyf9bk32ccbd0lld12gj12l89cyg65mhpyy7";
-  xcode_11_5 = requireXcode "11.5" "1dizazq9nz1vjkc5gy7dd4x760mkfjiifk1hf6d9mscchdq8rfkw";
-  xcode_11_6 = requireXcode "11.6" "1y4fhw1kiphzxdb4wpv697z5r0algvaldwq5iqv266797rnfql4x";
-  xcode_11_7 = requireXcode "11.7" "0422rdc4j5qwyk59anbybxyfv0p26x0xryszm0wd8i44g66smlmj";
-  xcode_12 = requireXcode "12" "1w3xm268pyn5m04wv22invd5kr2k4jqllgrzapv6n1sxxynxrh8z";
-  xcode_12_0_1 = requireXcode "12.0.1" "1p6vd5ai0hh3cq6aflh4h21ar0shxnz8wlkaxwq7liwsdmkwzbl0";
-  xcode_12_1 = requireXcode "12.1" "1widy74dk43wx8iqgd7arzf6q4kzdmaz8pfwymzs8chnq9dqr3wp";
-  xcode_12_2 = requireXcode "12.2" "17i0wf4pwrxwfgjw7rpw9mcd59nkmys1k5h2rqsw81snzyxy9j0v";
-  xcode_12_3 = requireXcode "12.3" "0kwf1y4llysf1p0nsbqyzccn7d77my0ldagr5fi3by4k0xy3d189";
+  xcode_8_1 = requireXcode "8.1" "sha256-VuAovU/b4rcLh+xMtcsZmbTWwTk35VGfMSp+fqPbsqM=";
+  xcode_8_2 = requireXcode "8.2" "sha256-ohqgGD7JEEmXEvmfn/N9Ga2lM8jNwhIuh+ky7PQPzY4=";
+  xcode_9_1 = requireXcode "9.1" "sha256-LG7pVMh1rNh5uP/bASvV9sKvGDrSGWH90J4gzwcgYSk=";
+  xcode_9_2 = requireXcode "9.2" "sha256-jMiG2G2zoGw4m00CjkGE+2cn0qeOdSUcXosZI2577q0=";
+  xcode_9_3 = requireXcode "9.3" "sha256-XIQYjfDVSmrYbyolnZIUtmOMhj9uhyWIn0KncsiaqYo=";
+  xcode_9_4 = requireXcode "9.4" "sha256-ZzE4F4UHVgKlJIn36kfs6Pba8iUAe6P/rh/VmxwLXwE=";
+  xcode_9_4_1 = requireXcode "9.4.1" "sha256-fFGB/XMZJQ2u9qh+2LYBHFh6mj5lr6gMlSQwgyS8M3k=";
+  xcode_10_1 = requireXcode "10.1" "sha256-u4Br3SsWbPCv6r4vGHFQUQmfPb9oUEmcdCFktMlbTes=";
+  xcode_10_2 = requireXcode "10.2" "sha256-592xNBS3Obp/3sDROyI4SxPN77cKMk45Lnis/QJd/vc=";
+  xcode_10_2_1 = requireXcode "10.2.1" "sha256-r65DbLDpiFJ78VH2hvfp7ZVpehoI44PSnaeDbElZTYc=";
+  xcode_10_3 = requireXcode "10.3" "sha256-61lDed7/Wi6uVBaj6/fUELISvmH3j69dQE19Y91GwsQ=";
+  xcode_11 = requireXcode "11" "sha256-EDM5tjuzGTzlVUg6MJKup/Q2OBrFXjzFdXSRO+eQA+Q=";
+  xcode_11_1 = requireXcode "11.1" "sha256-gXGVkEG+dFEoDbRjtfyN8MeUcoA6hcfsUaVDKAn7T7A=";
+  xcode_11_2 = requireXcode "11.2" "sha256-8qFEgRVhgOomSnJk23WaM/nACK9JFmiIICjUfT/Co9I=";
+  xcode_11_3 = requireXcode "11.3" "sha256-6nPCY0rIU2c7nRYDXMWcDHrCm34eqZq6wx157mk3OxM=";
+  xcode_11_3_1 = requireXcode "11.3.1" "sha256-BI8Olfqyxh51jyNpydiRkPwTQ4OK+ZpHUybPkCSL1tw=";
+  xcode_11_4 = requireXcode "11.4" "sha256-x/sLazHPs4SoCPKJ0CgFbTEmxlzJeZ7HtinMlse6uRg=";
+  xcode_11_5 = requireXcode "11.5" "sha256-fLqMcIOM6ZqacTBMF6N0swJzOmnt+FfYlDt8m/BXP7Y=";
+  xcode_11_6 = requireXcode "11.6" "sha256-nVDsbD7pGCM2jgXzRtV+VIFc/klmX05W6x/eOAOHjvg=";
+  xcode_11_7 = requireXcode "11.7" "sha256-stKqjXmERNQ4qF/73EE34oLtfF9+WZXK9BwXSVjLQhA=";
+  xcode_12 = requireXcode "12" "sha256-H8Hcre9dB2v2VT8/SrEkU+RZ2rZRiM0JqMX6i4yoffA=";
+  xcode_12_0_1 = requireXcode "12.0.1" "sha256-gK7PZ22aR3ow72pSjr7tUIOsgoAEUqcMZgNCEFVp29w=";
+  xcode_12_1 = requireXcode "12.1" "sha256-l4+MW8IWMqR/9dxd9FVtfxJs3M/qtIcj6nyQ2cjxLfI=";
+  xcode_12_2 = requireXcode "12.2" "sha256-G8jku/9WB8Q1zgKWGbSv06bSWE385sPlc7xnfonjIJ4=";
+  xcode_12_3 = requireXcode "12.3" "sha256-CYU2fAeT+DWiK/mpRoGv57RjGfseL23BDU57SokPjk8=";
+  xcode_12_4 = requireXcode "12.4" "sha256-Qw4j+XFry85/AviHQVhjjjKLAfmRNNwMGN5G8FheJwQ=";
+  xcode_12_5 = requireXcode "12.5" "sha256-xiGffnV0P9Ojd6IrJSXILUX4oznPif7zm00WAksn3qU=";
+  xcode_12_5_1 = requireXcode "12.5.1" "sha256-zL0kS86ZzBkIrKLPKvWguDvXj9Tqbr7uR/VZaT/uZ9A=";
+  xcode_13 = requireXcode "13" "sha256-uTY6d5DBu4OOQLkxs3ExDfLXh50rE2LLlqtCbk3Qn6E=";
+  xcode_13_1 = requireXcode "13.1" "sha256-vd+4eFVaAyvXsdaExcfbDZSXOwkpt+rEbkBYSMjdUEA=";
+  xcode_13_2 = requireXcode "13.2" "sha256-guJXm/QnMfvUZwAcJwoy0QeO+DpDcUhs8AxVKvm9tYQ=";
+  xcode_13_2_1 = requireXcode "13.2.1" "sha256-r832Uu+Q8utK4zN0CtwiMCvMYT5HstWInyq4cNIaZJM=";
+  xcode_13_3 = requireXcode "13.3" "sha256-p2zaWMpmUeNHQtYOOaVdhCt3cgapvzL3l73/J+UwzCE=";
+  xcode_13_3_1 = requireXcode "13.3.1" "sha256-j71vpJVJpyj/IOlL+4+5lYgOlhf/zn+7ExIHbxL51cQ=";
+  xcode_13_4 = requireXcode "13.4" "sha256-IY1coss90GlBeJg/HQPMU8v2rOOxsqlY5q+2Qxe8nnY=";
+  xcode_13_4_1 = requireXcode "13.4.1" "sha256-Jk8fLgvnODoIhuVJqfV0KrpBBL40fRrHJbFmm44NRKE=";
+  xcode_14 = requireXcode "14" "sha256-E+wjPgQx/lbYAsauksdmGsygL5VPBA8R9pHB93eA7T0=";
+  xcode_14_1 = requireXcode "14.1" "sha256-QJGAUVIhuDYyzDNttBPv5lIGOfvkYqdOFSUAr5tlkfs=";
  xcode = self."xcode_${lib.replaceStrings ["."] ["_"] (if (stdenv.targetPlatform ? xcodeVer) then stdenv.targetPlatform.xcodeVer else "12.3")}";
 })

--- a/pkgs/os-specific/linux/dracut/default.nix
+++ b/pkgs/os-specific/linux/dracut/default.nix
@ -10,24 +10,17 @@
 , bash
 , kmod
 , binutils
-, busybox
 , bzip2
 , coreutils
 , cpio
 , findutils
-, glibc
 , gnugrep
 , gnused
 , gnutar
 , gzip
-, kbd
-, lvm2
 , lz4
 , lzop
-, procps
-, rng-tools
 , squashfsTools
-, systemd
 , util-linux
 , xz
 , zstd
@ -76,23 +69,16 @@ stdenv.mkDerivation rec {
    wrapProgram $out/bin/dracut --prefix PATH : ${lib.makeBinPath [
      coreutils
      util-linux
-    ]} --prefix DRACUT_PATH : ${lib.makeBinPath [
+    ]} --suffix DRACUT_PATH : ${lib.makeBinPath [
      bash
      binutils
      coreutils
      findutils
-      glibc
      gnugrep
      gnused
      gnutar
-      kbd
-      lvm2
-      procps
-      rng-tools
-      squashfsTools
-      systemd
+      stdenv.cc.libc  # for ldd command
      util-linux
-      busybox
    ]}
    wrapProgram $out/bin/dracut-catimages --set PATH ${lib.makeBinPath [
      coreutils
--- a/pkgs/servers/gemini/molly-brown/default.nix
+++ b/pkgs/servers/gemini/molly-brown/default.nix
@ -1,19 +1,18 @@
-{ lib, buildGoPackage, fetchgit, nixosTests }:
+{ lib, buildGoModule, fetchgit, nixosTests }:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "molly-brown";
-  version = "unstable-2020-08-19";
-  rev = "48f9a206c03c0470e1c132b9667c6daa3583dada";
-
-  goPackagePath = "tildegit.org/solderpunk/molly-brown";
+  version = "unstable-2023-02-10";

  src = fetchgit {
-    inherit rev;
    url = "https://tildegit.org/solderpunk/molly-brown.git";
-    sha256 = "1w79a25mbgav95p78fkdm9j62chwwpkqv0m2wmh5my03yq398gya";
+    rev = "56d8dde14abc90b784b7844602f12100af9756e0";
+    hash = "sha256-kfopRyCrDaiVjKYseyWacIT9MJ8PzB8LAs6YMgYqCrs=";
  };

-  goDeps = ./deps.nix;
+  vendorHash = "sha256-czfHnXS9tf5vQQNXhWH7DStmhsorSc4Di/yZuv4LHRk=";
+
+  ldflags = [ "-s" "-w" ];

  passthru.tests.basic = nixosTests.molly-brown;

--- a/pkgs/servers/gemini/molly-brown/deps.nix
+++ b/pkgs/servers/gemini/molly-brown/deps.nix
@ -1,12 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "3012a1dbe2e4bd1391d42b32f0577cb7bbc7f005";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-]
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@ -351,8 +351,8 @@ let self = {
    name = "njs";
    src = fetchhg {
      url = "https://hg.nginx.org/njs";
-      rev = "0.7.8";
-      sha256 = "sha256-jsR8EOeW8tAo2utKznuUaCG4hK0oU0ZJSnnGmI5HUDk=";
+      rev = "0.7.10";
+      sha256 = "sha256-/yKzY+BUFxLk8bWo+mqKfRVRsC2moe+WvhaRYIGdr6Y=";
      name = "nginx-njs";
    };

--- a/pkgs/servers/pounce/default.nix
+++ b/pkgs/servers/pounce/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "pounce";
-  version = "3.0";
+  version = "3.1";

  src = fetchzip {
    url = "https://git.causal.agency/pounce/snapshot/pounce-${version}.tar.gz";
-    sha256 = "17vmbfr7ika6kmq9jqa3rpd4cr71arapav7hlmggnj7a9yw5b9mg";
+    sha256 = "sha256-6PGiaU5sOwqO4V2PKJgIi3kI2jXsBOldEH51D7Sx9tg=";
  };

  buildInputs = [ libressl libxcrypt ];
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "eksctl";
-  version = "0.128.0";
+  version = "0.129.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = pname;
    rev = version;
-    sha256 = "sha256-CKtDj9Ht81i8EcpjHqluWfwkEU15a/TZd6N+jCSzIc8=";
+    sha256 = "sha256-p9haEozDc1ZTGar89Clm7eEFFLJCYcw+gBN40Zg5vi8=";
  };

-  vendorHash = "sha256-aSXj21JNqX/cc62oFqyedmvczmudcV7RhLyWrKsdOMQ=";
+  vendorHash = "sha256-Vb0sgOOIQI0rTJDITFoMbXJcnN7BondbFTm3AF1JTLo=";

  doCheck = false;

--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@ -5,17 +5,17 @@

 buildGoModule rec {
  pname = "trivy";
-  version = "0.37.1";
+  version = "0.37.2";

  src = fetchFromGitHub {
    owner = "aquasecurity";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-4kjsNaiXnmJk88ivVnpTemOOc/asKrcZLGpO8gtV0J8=";
+    sha256 = "sha256-k5S0ttOhI+vjiGJpIPVi9ro6n3f2Cxe7HiADvs14Zuo=";
  };
  # hash missmatch on across linux and darwin
  proxyVendor = true;
-  vendorSha256 = "sha256-qI29Qb8im9Xii83ayG1jZtZsrsAT0JQOcuKOM7VYro0=";
+  vendorSha256 = "sha256-EJw5DxiBF+gw5X+vqrnZsNCm2umOHEq6GeQ5V/Z0DrE=";

  excludedPackages = "misc";

--- a/pkgs/tools/cd-dvd/vobsub2srt/default.nix
+++ b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-i6V2Owb8GcTcWowgb/BmdupOSFsYiCF2SbC9hXa26uY=";
  };

+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [ "-std=c++11" ];
+
  nativeBuildInputs = [ cmake pkg-config ];
  buildInputs = [ libtiff ];
  propagatedBuildInputs = [ tesseract ];
--- a/pkgs/tools/filesystems/httm/default.nix
+++ b/pkgs/tools/filesystems/httm/default.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "httm";
-  version = "0.20.5";
+  version = "0.21.1";

  src = fetchFromGitHub {
    owner = "kimono-koans";
    repo = pname;
    rev = version;
-    sha256 = "sha256-8SizRNjA+lvp8ZD14SoRcymhYmJXlwoeZQjrekIbdL4=";
+    sha256 = "sha256-uSCFm6aWNPFPcja+KB6TU7iVVYkDdD82pFjA9dOpSs8=";
  };

-  cargoHash = "sha256-tXV1G0qWN0jLOKlnZfHHlOZw+wUItLzQtSg4o2f96u0=";
+  cargoHash = "sha256-uxtZ+aUUhfWGCLysOcWi5En1eRui8Ja+nyD3S2WEWQM=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/graphics/jbig2enc/53ce5fe7e73d7ed95c9e12b52dd4984723f865fa.patch
+++ b/pkgs/tools/graphics/jbig2enc/53ce5fe7e73d7ed95c9e12b52dd4984723f865fa.patch
@ -1,47 +0,0 @@
-From 53ce5fe7e73d7ed95c9e12b52dd4984723f865fa Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zdenko=20Podobn=C3=BD?= <zdenop@gmail.com>
-Date: Sun, 6 Apr 2014 21:25:27 +0200
-Subject: [PATCH] fix build with leptonica 1.70
-
---
- configure.ac |  1 +
- src/jbig2.cc | 13 +++++++++----
- 2 files changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index fe37c22..753a607 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -55,6 +55,7 @@ AC_CHECK_LIB([lept], [findFileFormatStream], [], [
-			echo "Error! Leptonica not detected."
-			exit -1
-			])
-+AC_CHECK_FUNCS(expandBinaryPower2Low,,)
- # test for function - it should detect leptonica dependecies
-
- # Check for possible dependancies of leptonica.
-diff --git a/src/jbig2.cc b/src/jbig2.cc
-index e10f042..515c1ef 100644
--- a/src/jbig2.cc
-+++ b/src/jbig2.cc
-@@ -130,11 +130,16 @@ segment_image(PIX *pixb, PIX *piximg) {
-   // input color image, so we have to do it this way...
-   // is there a better way?
-   // PIX *pixd = pixExpandBinary(pixd4, 4);
-  PIX *pixd = pixCreate(piximg->w, piximg->h, 1);
-  pixCopyResolution(pixd, piximg);
-  if (verbose) pixInfo(pixd, "mask image: ");
-  expandBinaryPower2Low(pixd->data, pixd->w, pixd->h, pixd->wpl,
-+  PIX *pixd;
-+#ifdef HAVE_EXPANDBINARYPOWER2LOW
-+    pixd = pixCreate(piximg->w, piximg->h, 1);
-+    pixCopyResolution(pixd, piximg);
-+    expandBinaryPower2Low(pixd->data, pixd->w, pixd->h, pixd->wpl,
-                         pixd4->data, pixd4->w, pixd4->h, pixd4->wpl, 4);
-+#else
-+    pixd = pixExpandBinaryPower2(pixd4, 4);
-+#endif
-+  if (verbose) pixInfo(pixd, "mask image: ");
-
-   pixDestroy(&pixd4);
-   pixDestroy(&pixsf4);
--- a/pkgs/tools/graphics/jbig2enc/default.nix
+++ b/pkgs/tools/graphics/jbig2enc/default.nix
@ -1,35 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, leptonica, zlib, libwebp, giflib, libjpeg, libpng, libtiff }:
-
-stdenv.mkDerivation rec {
-  pname = "jbig2enc";
-  version = "0.28";
-
-  src = fetchFromGitHub {
-    owner = "agl";
-    repo = "jbig2enc";
-    rev = "${version}-dist";
-    hash = "sha256-Y3IVTjvO5tqn/O076y/llnTyenKpbx1WyT/JFZ/s0VY=";
-  };
-
-  propagatedBuildInputs = [ leptonica zlib libwebp giflib libjpeg libpng libtiff ];
-
-  patches = [
-    # https://github.com/agl/jbig2enc/commit/53ce5fe7e73d7ed95c9e12b52dd4984723f865fa
-    ./53ce5fe7e73d7ed95c9e12b52dd4984723f865fa.patch
-  ];
-
-  # This is necessary, because the resulting library has
-  # /tmp/nix-build-jbig2enc/src/.libs before /nix/store/jbig2enc/lib
-  # in its rpath, which means that patchelf --shrink-rpath removes
-  # the /nix/store one.  By cleaning up before fixup, we ensure that
-  # the /tmp/nix-build-jbig2enc/src/.libs directory is gone.
-  preFixup = ''
-    make clean
-  '';
-
-  meta = {
-    description = "Encoder for the JBIG2 image compression format";
-    license = lib.licenses.asl20;
-    platforms = lib.platforms.all;
-  };
-}
--- a/pkgs/tools/misc/boxxy/default.nix
+++ b/pkgs/tools/misc/boxxy/default.nix
@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "boxxy";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "queer";
+    repo = "boxxy";
+    rev = "v${version}";
+    hash = "sha256-mvSarA0rZuOQvgf2NJXWIWoeZtvb+D/GofAHPKQDH6U=";
+  };
+
+  cargoHash = "sha256-Psc9qErqi3aangNowXxhkEXphFCR7pp+DKTKtk6tMo0=";
+
+  meta = with lib; {
+    description = "Puts bad Linux applications in a box with only their files";
+    homepage = "https://github.com/queer/boxxy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dit7ya ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/tools/misc/steampipe/default.nix
+++ b/pkgs/tools/misc/steampipe/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "steampipe";
-  version = "0.18.4";
+  version = "0.18.5";

  src = fetchFromGitHub {
    owner = "turbot";
    repo = "steampipe";
    rev = "v${version}";
-    sha256 = "sha256-sCnKnBxZuueH8XgXPqCLrJvS4zUbraz3mZr/2Xn+7YU=";
+    sha256 = "sha256-Y/Nn2jAkz135HxRNpeotoPRvyexG9QgtvIcTdXsj034=";
  };

  vendorHash = "sha256-W30f7QYgm+QyLDJICpjMn7mtUIziTR1igThEbv+Aa7M=";
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "frp";
-  version = "0.46.1";
+  version = "0.47.0";

  src = fetchFromGitHub {
    owner = "fatedier";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-/itziNmIDIuj3sKpB+SEiiwvJqdH5nmTkpFdMSY5L0g=";
+    sha256 = "sha256-S2qccDzS+Kj1tEAUR4a0G/4Eu3DAF7lY7ffxU6aykVU=";
  };

-  vendorHash = "sha256-dU9rhYgYgP1qTPR3ykUgyg+B1bBVJwizWooyCpdpnm0=";
+  vendorHash = "sha256-ffkXNE3LkgdCGfO6K9lGxEMxT/9Q1o0m3BMtu6tDHdk=";

  doCheck = false;

--- a/pkgs/tools/networking/grpc_cli/default.nix
+++ b/pkgs/tools/networking/grpc_cli/default.nix
@ -0,0 +1,31 @@
+{ lib, stdenv, fetchFromGitHub, automake, cmake, autoconf, curl, numactl }:
+
+stdenv.mkDerivation rec {
+  pname = "grpc_cli";
+  version = "1.46.6";
+  src = fetchFromGitHub {
+    owner = "grpc";
+    repo = "grpc";
+    rev = "v${version}";
+    hash = "sha256-UPenQh6+FBryQiOoeijsXkCZjlMzYljkg2aUtSFJFL4=";
+    fetchSubmodules = true;
+  };
+  nativeBuildInputs = [ automake cmake autoconf ];
+  buildInputs = [ curl numactl ];
+  cmakeFlags = [ "-DgRPC_BUILD_TESTS=ON" ];
+  makeFlags = [ "grpc_cli" ];
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm555 grpc_cli "$out/bin/grpc_cli"
+
+    runHook postInstall
+  '';
+  meta = with lib; {
+    description = "The command line tool for interacting with grpc services.";
+    homepage = "https://github.com/grpc/grpc";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ doriath ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/tools/networking/snowflake/default.nix
+++ b/pkgs/tools/networking/snowflake/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "snowflake";
-  version = "2.5.0";
+  version = "2.5.1";

  src = fetchFromGitLab {
    domain = "gitlab.torproject.org";
@ -10,10 +10,10 @@ buildGoModule rec {
    owner = "anti-censorship/pluggable-transports";
    repo = "snowflake";
    rev = "v${version}";
-    sha256 = "sha256-7iwRbik3hUj6Zv3tqLKqhGUIag6OnWRhpWqW6NTI+FU=";
+    sha256 = "sha256-r2NRIb6qbA1B5HlVNRqa9ongQpyiyPskhembPHX3Lgc=";
  };

-  vendorHash = "sha256-wHLYVf8QurMbmdLNkTFGgmncOJlJHZF8PwYTUniXOGY=";
+  vendorHash = "sha256-dnfm4KiVD89bnHV7bfw5aXWHGdcH9JBdrtvuS6s8N5w=";

  meta = with lib; {
    description = "System to defeat internet censorship";
--- a/pkgs/tools/package-management/nfpm/default.nix
+++ b/pkgs/tools/package-management/nfpm/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "nfpm";
-  version = "2.25.0";
+  version = "2.25.1";

  src = fetchFromGitHub {
    owner = "goreleaser";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Mu0/mWkdrhaybI0iAB/MuD7UTbDDC73ZMxr8kU7R23I=";
+    sha256 = "sha256-J5vAvF22NKMvvaftfVugWYAP6uM6pcyKEPqRDf+J9A4=";
  };

-  vendorHash = "sha256-YDV816jTLAqbSjiKXvbkwPbPCLPplH+NFN1SCVjWcbk=";
+  vendorHash = "sha256-GaESwr7rvDvjQ7zi/LbndiB2lQGmIELTx7wAJitj5kw=";

  ldflags = [ "-s" "-w" "-X main.version=${version}" ];

--- a/pkgs/tools/security/erosmb/default.nix
+++ b/pkgs/tools/security/erosmb/default.nix
@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "erosmb";
-  version = "0.1.4";
+  version = "0.1.5";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "viktor02";
    repo = "EroSmb";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ThJwBKpxoTwHP84OlVKH62gQ3kfv83J8HNs5Mizi8Ck=";
+    hash = "sha256-9Zs5Z+3JiBiJkV9Ixl5pPmLv0dUT59CT0UkQDsmneWc=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/tools/system/ddrescue/default.nix
+++ b/pkgs/tools/system/ddrescue/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  pname = "ddrescue";
-  version = "1.26";
+  version = "1.27";

  src = fetchurl {
    url = "mirror://gnu/ddrescue/ddrescue-${version}.tar.lz";
-    sha256 = "sha256-5RPNOpDZgQ392RGX1AqkD23wFZe/tez9+yBd4RJ8VR8=";
+    sha256 = "sha256-OMgMmMWkTxXlNmPkUQCX/WjW7CB1jv3zqSUDfBgyMus=";
  };

  nativeBuildInputs = [ lzip ];
--- a/Show more
+++ b/Show more