Merge master into haskell-updates

2023-05-07 00:12:45 +00:00 · 2023-05-07 00:12:45 +00:00 · 2e989fab1d
commit 2e989fab1d
parent 81dc7d6709 590d05ac6c
244 changed files with 25585 additions and 2334 deletions
--- a/doc/build-aux/pandoc-filters/link-manpages.nix
+++ b/doc/build-aux/pandoc-filters/link-manpages.nix
@ -1,7 +1,7 @@
 { pkgs ? import ../../.. {} }:
 let
  inherit (pkgs) lib;
-  manpageURLs = builtins.fromJSON (builtins.readFile (pkgs.path + "/doc/manpage-urls.json"));
+  manpageURLs = lib.importJSON (pkgs.path + "/doc/manpage-urls.json");
 in pkgs.writeText "link-manpages.lua" ''
  --[[
  Adds links to known man pages that aren't already in a link.
--- a/doc/doc-support/default.nix
+++ b/doc/doc-support/default.nix
@ -45,7 +45,10 @@ let
  # NB: This file describes the Nixpkgs manual, which happens to use module
  #     docs infra originally developed for NixOS.
  optionsDoc = pkgs.nixosOptionsDoc {
-    inherit (pkgs.lib.evalModules { modules = [ ../../pkgs/top-level/config.nix ]; }) options;
+    inherit (pkgs.lib.evalModules {
+      modules = [ ../../pkgs/top-level/config.nix ];
+      class = "nixpkgsConfig";
+    }) options;
    documentType = "none";
    transformOptions = opt:
      opt // {
--- a/doc/languages-frameworks/ocaml.section.md
+++ b/doc/languages-frameworks/ocaml.section.md
@ -38,12 +38,12 @@ Here is a simple package example.

 - It uses the `fetchFromGitHub` fetcher to get its source.

- `duneVersion = "2"` ensures that Dune version 2 is used for the
-  build (this is the default; valid values are `"1"`, `"2"`, and `"3"`);
-  note that there is also a legacy `useDune2` boolean attribute:
-  set to `false` it corresponds to `duneVersion = "1"`; set to `true` it
-  corresponds to `duneVersion = "2"`. If both arguments (`duneVersion` and
-  `useDune2`) are given, the second one (`useDune2`) is silently ignored.
+- It also accept `duneVersion` parameter (valid value are `"1"`, `"2"`, and
+  `"3"`). The recommended practice it to set only if you don't want the default
+  value and/or it depends on something else like package version. You might see
+  a not-supported argument `useDune2`. The behavior was `useDune2 = true;` =>
+  `duneVersion = "2";` and `useDune2 = false;` => `duneVersion = "1";`. It was
+  used at the time when dune3 didn't existed.

 - It sets the optional `doCheck` attribute such that tests will be run with
  `dune runtest -p angstrom` after the build (`dune build -p angstrom`) is
@ -71,7 +71,6 @@ Here is a simple package example.
 buildDunePackage rec {
  pname = "angstrom";
  version = "0.15.0";
-  duneVersion = "2";

  minimalOCamlVersion = "4.04";

@ -104,8 +103,6 @@ buildDunePackage rec {
  pname = "wtf8";
  version = "1.0.2";

-  useDune2 = true;
-
  minimalOCamlVersion = "4.02";

  src = fetchurl {
--- a/doc/manual.xml
+++ b/doc/manual.xml
@ -12,7 +12,11 @@
  <xi:include href="using/configuration.chapter.xml" />
  <xi:include href="using/overlays.chapter.xml" />
  <xi:include href="using/overrides.chapter.xml" />
+ </part>
+ <part>
+  <title>Nixpkgs <code>lib</code></title>
  <xi:include href="functions.xml" />
+  <xi:include href="module-system/module-system.chapter.xml" />
 </part>
 <part xml:id="part-stdenv">
  <title>Standard environment</title>
--- a/doc/module-system/module-system.chapter.md
+++ b/doc/module-system/module-system.chapter.md
@ -0,0 +1,105 @@
+# Module System {#module-system}
+
+## Introduction {#module-system-introduction}
+
+The module system is a language for handling configuration, implemented as a Nix library.
+
+Compared to plain Nix, it adds documentation, type checking and composition or extensibility.
+
+::: {.note}
+This chapter is new and not complete yet. For a gentle introduction to the module system, in the context of NixOS, see [Writing NixOS Modules](https://nixos.org/manual/nixos/unstable/index.html#sec-writing-modules) in the NixOS manual.
+:::
+
+
+## `lib.evalModules` {#module-system-lib-evalModules}
+
+Evaluate a set of modules. This function is typically only used once per application (e.g. once in NixOS, once in Home Manager, ...).
+
+### Parameters {#module-system-lib-evalModules-parameters}
+
+#### `modules` {#module-system-lib-evalModules-param-modules}
+
+A list of modules. These are merged together to form the final configuration.
+<!-- TODO link to section about merging, TBD -->
+
+#### `specialArgs` {#module-system-lib-evalModules-param-specialArgs}
+
+An attribute set of module arguments that can be used in `imports`.
+
+This is in contrast to `config._module.args`, which is only available after all `imports` have been resolved.
+
+#### `class` {#module-system-lib-evalModules-param-class}
+
+If the `class` attribute is set and non-`null`, the module system will reject `imports` with a different `_class` declaration.
+
+The `class` value should be a string in lower [camel case](https://en.wikipedia.org/wiki/Camel_case).
+
+If applicable, the `class` should match the "prefix" of the attributes used in (experimental) [flakes](https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-flake.html#description). Some examples are:
+
+ - `nixos` as in `flake.nixosModules`
+ - `nixosTest`: modules that constitute a [NixOS VM test](https://nixos.org/manual/nixos/stable/index.html#sec-nixos-tests)
+<!-- We've only just started with `class`. You're invited to add a few more. -->
+
+#### `prefix` {#module-system-lib-evalModules-param-prefix}
+
+A list of strings representing the location at or below which all options are evaluated. This is used by `types.submodule` to improve error reporting and find the implicit `name` module argument.
+
+### Return value {#module-system-lib-evalModules-return-value}
+
+The result is an attribute set with the following attributes:
+
+#### `options` {#module-system-lib-evalModules-return-value-options}
+
+The nested attribute set of all option declarations.
+
+#### `config` {#module-system-lib-evalModules-return-value-config}
+
+The nested attribute set of all option values.
+
+#### `type` {#module-system-lib-evalModules-return-value-type}
+
+A module system type. This type is an instance of `types.submoduleWith` containing the current [`modules`](#module-system-lib-evalModules-param-modules).
+
+The option definitions that are typed with this type will extend the current set of modules, like [`extendModules`](#module-system-lib-evalModules-return-value-extendModules).
+
+However, the value returned from the type is just the [`config`](#module-system-lib-evalModules-return-value-config), like any submodule.
+
+If you're familiar with prototype inheritance, you can think of this `evalModules` invocation as the prototype, and usages of this type as the instances.
+
+This type is also available to the [`modules`](#module-system-lib-evalModules-param-modules) as the module argument `moduleType`.
+<!-- TODO: document the module arguments. Using moduleType is like saying: suppose this configuration was extended. -->
+
+#### `extendModules` {#module-system-lib-evalModules-return-value-extendModules}
+
+A function similar to `evalModules` but building on top of the already passed [`modules`](#module-system-lib-evalModules-param-modules). Its arguments, `modules` and `specialArgs` are added to the existing values.
+
+If you're familiar with prototype inheritance, you can think of the current, actual `evalModules` invocation as the prototype, and the return value of `extendModules` as the instance.
+
+This functionality is also available to modules as the `extendModules` module argument.
+
+::: {.note}
+
+**Evaluation Performance**
+
+`extendModules` returns a configuration that shares very little with the original `evalModules` invocation, because the module arguments may be different.
+
+So if you have a configuration that has been (or will be) largely evaluated, almost none of the computation is shared with the configuration returned by `extendModules`.
+
+The real work of module evaluation happens while computing the values in `config` and `options`, so multiple invocations of `extendModules` have a particularly small cost, as long as only the final `config` and `options` are evaluated.
+
+If you do reference multiple `config` (or `options`) from before and after `extendModules`, evaluation performance is the same as with multiple `evalModules` invocations, because the new modules' ability to override existing configuration fundamentally requires constructing a new `config` and `options` fixpoint.
+:::
+
+#### `_module` {#module-system-lib-evalModules-return-value-_module}
+
+A portion of the configuration tree which is elided from `config`.
+
+<!-- TODO: when markdown migration is complete, make _module docs visible again and reference _module docs. Maybe move those docs into this chapter? -->
+
+#### `_type` {#module-system-lib-evalModules-return-value-_type}
+
+A nominal type marker, always `"configuration"`.
+
+#### `class` {#module-system-lib-evalModules-return-value-_configurationClass}
+
+The [`class` argument](#module-system-lib-evalModules-param-class).
--- a/lib/modules.nix
+++ b/lib/modules.nix
@ -63,39 +63,8 @@ let
          decls
      ));

-in
-
-rec {
-
-  /*
-    Evaluate a set of modules.  The result is a set with the attributes:
-
-      ‘options’: The nested set of all option declarations,
-
-      ‘config’: The nested set of all option values.
-
-      ‘type’: A module system type representing the module set as a submodule,
-            to be extended by configuration from the containing module set.
-
-            This is also available as the module argument ‘moduleType’.
-
-      ‘extendModules’: A function similar to ‘evalModules’ but building on top
-            of the module set. Its arguments, ‘modules’ and ‘specialArgs’ are
-            added to the existing values.
-
-            Using ‘extendModules’ a few times has no performance impact as long
-            as you only reference the final ‘options’ and ‘config’.
-            If you do reference multiple ‘config’ (or ‘options’) from before and
-            after ‘extendModules’, performance is the same as with multiple
-            ‘evalModules’ invocations, because the new modules' ability to
-            override existing configuration fundamentally requires a new
-            fixpoint to be constructed.
-
-            This is also available as a module argument.
-
-      ‘_module’: A portion of the configuration tree which is elided from
-            ‘config’. It contains some values that are mostly internal to the
-            module system implementation.
+  /* See https://nixos.org/manual/nixpkgs/unstable/#module-system-lib-evalModules
+     or file://./../doc/module-system/module-system.chapter.md

     !!! Please think twice before adding to this argument list! The more
     that is specified here instead of in the modules themselves the harder
@ -110,8 +79,12 @@ rec {
                  # there's _module.args. If specialArgs.modulesPath is defined it will be
                  # used as the base path for disabledModules.
                  specialArgs ? {}
-                , # This would be remove in the future, Prefer _module.args option instead.
-                  args ? {}
+                , # `class`:
+                  # A nominal type for modules. When set and non-null, this adds a check to
+                  # make sure that only compatible modules are imported.
+                  # This would be remove in the future, Prefer _module.args option instead.
+                  class ? null
+                , args ? {}
                , # This would be remove in the future, Prefer _module.check option instead.
                  check ? true
                }:
@ -260,6 +233,7 @@ rec {

      merged =
        let collected = collectModules
+          class
          (specialArgs.modulesPath or "")
          (regularModules ++ [ internalModule ])
          ({ inherit lib options config specialArgs; } // specialArgs);
@ -336,38 +310,64 @@ rec {
        prefix ? [],
        }:
          evalModules (evalModulesArgs // {
+            inherit class;
            modules = regularModules ++ modules;
            specialArgs = evalModulesArgs.specialArgs or {} // specialArgs;
            prefix = extendArgs.prefix or evalModulesArgs.prefix or [];
          });

      type = lib.types.submoduleWith {
-        inherit modules specialArgs;
+        inherit modules specialArgs class;
      };

      result = withWarnings {
+        _type = "configuration";
        options = checked options;
        config = checked (removeAttrs config [ "_module" ]);
        _module = checked (config._module);
        inherit extendModules type;
+        class = class;
      };
    in result;

-  # collectModules :: (modulesPath: String) -> (modules: [ Module ]) -> (args: Attrs) -> [ Module ]
+  # collectModules :: (class: String) -> (modulesPath: String) -> (modules: [ Module ]) -> (args: Attrs) -> [ Module ]
  #
  # Collects all modules recursively through `import` statements, filtering out
  # all modules in disabledModules.
-  collectModules = let
+  collectModules = class: let

      # Like unifyModuleSyntax, but also imports paths and calls functions if necessary
      loadModule = args: fallbackFile: fallbackKey: m:
-        if isFunction m || isAttrs m then
-          unifyModuleSyntax fallbackFile fallbackKey (applyModuleArgsIfFunction fallbackKey m args)
+        if isFunction m then
+          unifyModuleSyntax fallbackFile fallbackKey (applyModuleArgs fallbackKey m args)
+        else if isAttrs m then
+          if m._type or "module" == "module" then
+            unifyModuleSyntax fallbackFile fallbackKey m
+          else if m._type == "if" || m._type == "override" then
+            loadModule args fallbackFile fallbackKey { config = m; }
+          else
+            throw (
+              "Could not load a value as a module, because it is of type ${lib.strings.escapeNixString m._type}"
+              + lib.optionalString (fallbackFile != unknownModule) ", in file ${toString fallbackFile}."
+              + lib.optionalString (m._type == "configuration") " If you do intend to import this configuration, please only import the modules that make up the configuration. You may have to create a `let` binding, file or attribute to give yourself access to the relevant modules.\nWhile loading a configuration into the module system is a very sensible idea, it can not be done cleanly in practice."
+               # Extended explanation: That's because a finalized configuration is more than just a set of modules. For instance, it has its own `specialArgs` that, by the nature of `specialArgs` can't be loaded through `imports` or the the `modules` argument. So instead, we have to ask you to extract the relevant modules and use those instead. This way, we keep the module system comparatively simple, and hopefully avoid a bad surprise down the line.
+            )
        else if isList m then
          let defs = [{ file = fallbackFile; value = m; }]; in
          throw "Module imports can't be nested lists. Perhaps you meant to remove one level of lists? Definitions: ${showDefs defs}"
        else unifyModuleSyntax (toString m) (toString m) (applyModuleArgsIfFunction (toString m) (import m) args);

+      checkModule =
+        if class != null
+        then
+          m:
+            if m._class != null -> m._class == class
+            then m
+            else
+              throw "The module ${m._file or m.key} was imported into ${class} instead of ${m._class}."
+        else
+          m: m;
+
      /*
      Collects all modules recursively into the form

@ -401,7 +401,7 @@ rec {
          };
        in parentFile: parentKey: initialModules: args: collectResults (imap1 (n: x:
          let
-            module = loadModule args parentFile "${parentKey}:anon-${toString n}" x;
+            module = checkModule (loadModule args parentFile "${parentKey}:anon-${toString n}" x);
            collectedImports = collectStructuredModules module._file module.key module.imports args;
          in {
            key = module.key;
@ -465,11 +465,12 @@ rec {
        else config;
    in
    if m ? config || m ? options then
-      let badAttrs = removeAttrs m ["_file" "key" "disabledModules" "imports" "options" "config" "meta" "freeformType"]; in
+      let badAttrs = removeAttrs m ["_class" "_file" "key" "disabledModules" "imports" "options" "config" "meta" "freeformType"]; in
      if badAttrs != {} then
        throw "Module `${key}' has an unsupported attribute `${head (attrNames badAttrs)}'. This is caused by introducing a top-level `config' or `options' attribute. Add configuration attributes immediately on the top level instead, or move all of them (namely: ${toString (attrNames badAttrs)}) into the explicit `config' attribute."
      else
        { _file = toString m._file or file;
+          _class = m._class or null;
          key = toString m.key or key;
          disabledModules = m.disabledModules or [];
          imports = m.imports or [];
@ -480,14 +481,18 @@ rec {
      # shorthand syntax
      lib.throwIfNot (isAttrs m) "module ${file} (${key}) does not look like a module."
      { _file = toString m._file or file;
+        _class = m._class or null;
        key = toString m.key or key;
        disabledModules = m.disabledModules or [];
        imports = m.require or [] ++ m.imports or [];
        options = {};
-        config = addFreeformType (removeAttrs m ["_file" "key" "disabledModules" "require" "imports" "freeformType"]);
+        config = addFreeformType (removeAttrs m ["_class" "_file" "key" "disabledModules" "require" "imports" "freeformType"]);
      };

-  applyModuleArgsIfFunction = key: f: args@{ config, options, lib, ... }: if isFunction f then
+  applyModuleArgsIfFunction = key: f: args@{ config, options, lib, ... }:
+    if isFunction f then applyModuleArgs key f args else f;
+
+  applyModuleArgs = key: f: args@{ config, options, lib, ... }:
    let
      # Module arguments are resolved in a strict manner when attribute set
      # deconstruction is used.  As the arguments are now defined with the
@ -511,9 +516,7 @@ rec {
      # context on the explicit arguments of "args" too. This update
      # operator is used to make the "args@{ ... }: with args.lib;" notation
      # works.
-    in f (args // extraArgs)
-  else
-    f;
+    in f (args // extraArgs);

  /* Merge a list of modules.  This will recurse over the option
     declarations in all modules, combining them into a single set.
@ -1218,4 +1221,67 @@ rec {
    _file = file;
    config = lib.importTOML file;
  };
+
+  private = lib.mapAttrs
+    (k: lib.warn "External use of `lib.modules.${k}` is deprecated. If your use case isn't covered by non-deprecated functions, we'd like to know more and perhaps support your use case well, instead of providing access to these low level functions. In this case please open an issue in https://github.com/nixos/nixpkgs/issues/.")
+    {
+      inherit
+        applyModuleArgsIfFunction
+        dischargeProperties
+        evalOptionValue
+        mergeModules
+        mergeModules'
+        pushDownProperties
+        unifyModuleSyntax
+        ;
+      collectModules = collectModules null;
+    };
+
+in
+private //
+{
+  # NOTE: not all of these functions are necessarily public interfaces; some
+  #       are just needed by types.nix, but are not meant to be consumed
+  #       externally.
+  inherit
+    defaultOrderPriority
+    defaultOverridePriority
+    defaultPriority
+    doRename
+    evalModules
+    filterOverrides
+    filterOverrides'
+    fixMergeModules
+    fixupOptionType  # should be private?
+    importJSON
+    importTOML
+    mergeDefinitions
+    mergeOptionDecls  # should be private?
+    mkAfter
+    mkAliasAndWrapDefinitions
+    mkAliasAndWrapDefsWithPriority
+    mkAliasDefinitions
+    mkAliasIfDef
+    mkAliasOptionModule
+    mkAliasOptionModuleMD
+    mkAssert
+    mkBefore
+    mkChangedOptionModule
+    mkDefault
+    mkDerivedConfig
+    mkFixStrictness
+    mkForce
+    mkIf
+    mkImageMediaOverride
+    mkMerge
+    mkMergedOptionModule
+    mkOptionDefault
+    mkOrder
+    mkOverride
+    mkRemovedOptionModule
+    mkRenamedOptionModule
+    mkRenamedOptionModuleWith
+    mkVMOverride
+    setDefaultModuleLocation
+    sortProperties;
 }
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@ -166,6 +166,7 @@ checkConfigError 'The option .* does not exist. Definition values:\n\s*- In .*'
 checkConfigOutput '^true$' "$@" ./define-module-check.nix

 # Check coerced value.
+set --
 checkConfigOutput '^"42"$' config.value ./declare-coerced-value.nix
 checkConfigOutput '^"24"$' config.value ./declare-coerced-value.nix ./define-value-string.nix
 checkConfigError 'A definition for option .* is not.*string or signed integer convertible to it.*. Definition values:\n\s*- In .*: \[ \]' config.value ./declare-coerced-value.nix ./define-value-list.nix
@ -254,6 +255,8 @@ checkConfigError 'A definition for option .* is not of type .*' \
 ## Freeform modules
 # Assigning without a declared option should work
 checkConfigOutput '^"24"$' config.value ./freeform-attrsOf.nix ./define-value-string.nix
+# Shorthand modules interpret `meta` and `class` as config items
+checkConfigOutput '^true$' options._module.args.value.result ./freeform-attrsOf.nix ./define-freeform-keywords-shorthand.nix
 # No freeform assignments shouldn't make it error
 checkConfigOutput '^{ }$' config ./freeform-attrsOf.nix
 # but only if the type matches
@ -359,6 +362,24 @@ checkConfigOutput 'ok' config.freeformItems.foo.bar ./adhoc-freeformType-survive
 # because of an `extendModules` bug, issue 168767.
 checkConfigOutput '^1$' config.sub.specialisation.value ./extendModules-168767-imports.nix

+# Class checks, evalModules
+checkConfigOutput '^{ }$' config.ok.config ./class-check.nix
+checkConfigOutput '"nixos"' config.ok.class ./class-check.nix
+checkConfigError 'The module .*/module-class-is-darwin.nix was imported into nixos instead of darwin.' config.fail.config ./class-check.nix
+checkConfigError 'The module foo.nix#darwinModules.default was imported into nixos instead of darwin.' config.fail-anon.config ./class-check.nix
+
+# Class checks, submoduleWith
+checkConfigOutput '^{ }$' config.sub.nixosOk ./class-check.nix
+checkConfigError 'The module .*/module-class-is-darwin.nix was imported into nixos instead of darwin.' config.sub.nixosFail.config ./class-check.nix
+
+# submoduleWith type merge with different class
+checkConfigError 'error: A submoduleWith option is declared multiple times with conflicting class values "darwin" and "nixos".' config.sub.mergeFail.config ./class-check.nix
+
+# _type check
+checkConfigError 'Could not load a value as a module, because it is of type "flake", in file .*/module-imports-_type-check.nix' config.ok.config ./module-imports-_type-check.nix
+checkConfigOutput '^true$' "$@" config.enable ./declare-enable.nix ./define-enable-with-top-level-mkIf.nix
+checkConfigError 'Could not load a value as a module, because it is of type "configuration", in file .*/import-configuration.nix.*please only import the modules that make up the configuration.*' config ./import-configuration.nix
+
 # doRename works when `warnings` does not exist.
 checkConfigOutput '^1234$' config.c.d.e ./doRename-basic.nix
 # doRename adds a warning.
--- a/lib/tests/modules/class-check.nix
+++ b/lib/tests/modules/class-check.nix
@ -0,0 +1,76 @@
+{ lib, ... }: {
+  options = {
+    sub = {
+      nixosOk = lib.mkOption {
+        type = lib.types.submoduleWith {
+          class = "nixos";
+          modules = [ ];
+        };
+      };
+      # Same but will have bad definition
+      nixosFail = lib.mkOption {
+        type = lib.types.submoduleWith {
+          class = "nixos";
+          modules = [ ];
+        };
+      };
+
+      mergeFail = lib.mkOption {
+        type = lib.types.submoduleWith {
+          class = "nixos";
+          modules = [ ];
+        };
+        default = { };
+      };
+    };
+  };
+  imports = [
+    {
+      options = {
+        sub = {
+          mergeFail = lib.mkOption {
+            type = lib.types.submoduleWith {
+              class = "darwin";
+              modules = [ ];
+            };
+          };
+        };
+      };
+    }
+  ];
+  config = {
+    _module.freeformType = lib.types.anything;
+    ok =
+      lib.evalModules {
+        class = "nixos";
+        modules = [
+          ./module-class-is-nixos.nix
+        ];
+      };
+
+    fail =
+      lib.evalModules {
+        class = "nixos";
+        modules = [
+          ./module-class-is-nixos.nix
+          ./module-class-is-darwin.nix
+        ];
+      };
+
+    fail-anon =
+      lib.evalModules {
+        class = "nixos";
+        modules = [
+          ./module-class-is-nixos.nix
+          { _file = "foo.nix#darwinModules.default";
+            _class = "darwin";
+            config = {};
+            imports = [];
+          }
+        ];
+      };
+
+    sub.nixosOk = { _class = "nixos"; };
+    sub.nixosFail = { imports = [ ./module-class-is-darwin.nix ]; };
+  };
+}
--- a/lib/tests/modules/define-enable-with-top-level-mkIf.nix
+++ b/lib/tests/modules/define-enable-with-top-level-mkIf.nix
@ -0,0 +1,5 @@
+{ lib, ... }:
+# I think this might occur more realistically in a submodule
+{
+  imports = [ (lib.mkIf true { enable = true; }) ];
+}
--- a/lib/tests/modules/define-freeform-keywords-shorthand.nix
+++ b/lib/tests/modules/define-freeform-keywords-shorthand.nix
@ -0,0 +1,15 @@
+{ config, ... }: {
+  class = { "just" = "data"; };
+  a = "one";
+  b = "two";
+  meta = "meta";
+
+  _module.args.result =
+    let r = builtins.removeAttrs config [ "_module" ];
+    in builtins.trace (builtins.deepSeq r r) (r == {
+      a = "one";
+      b = "two";
+      class = { "just" = "data"; };
+      meta = "meta";
+    });
+}
--- a/lib/tests/modules/import-configuration.nix
+++ b/lib/tests/modules/import-configuration.nix
@ -0,0 +1,12 @@
+{ lib, ... }:
+let
+  myconf = lib.evalModules { modules = [ { } ]; };
+in
+{
+  imports = [
+    # We can't do this. A configuration is not equal to its set of a modules.
+    # Equating those would lead to a mess, as specialArgs, anonymous modules
+    # that can't be deduplicated, and possibly more come into play.
+    myconf
+  ];
+}
--- a/lib/tests/modules/module-class-is-darwin.nix
+++ b/lib/tests/modules/module-class-is-darwin.nix
@ -0,0 +1,4 @@
+{
+  _class = "darwin";
+  config = {};
+}
--- a/lib/tests/modules/module-class-is-nixos.nix
+++ b/lib/tests/modules/module-class-is-nixos.nix
@ -0,0 +1,4 @@
+{
+  _class = "nixos";
+  config = {};
+}
--- a/lib/tests/modules/module-imports-_type-check.nix
+++ b/lib/tests/modules/module-imports-_type-check.nix
@ -0,0 +1,3 @@
+{
+  imports = [ { _type = "flake"; } ];
+}
--- a/lib/types.nix
+++ b/lib/types.nix
@ -696,6 +696,7 @@ rec {
      , specialArgs ? {}
      , shorthandOnlyDefinesConfig ? false
      , description ? null
+      , class ? null
      }@attrs:
      let
        inherit (lib.modules) evalModules;
@ -707,7 +708,7 @@ rec {
        ) defs;

        base = evalModules {
-          inherit specialArgs;
+          inherit class specialArgs;
          modules = [{
            # This is a work-around for the fact that some sub-modules,
            # such as the one included in an attribute set, expects an "args"
@ -762,9 +763,14 @@ rec {
        functor = defaultFunctor name // {
          type = types.submoduleWith;
          payload = {
-            inherit modules specialArgs shorthandOnlyDefinesConfig description;
+            inherit modules class specialArgs shorthandOnlyDefinesConfig description;
          };
          binOp = lhs: rhs: {
+            class =
+              if lhs.class == null then rhs.class
+              else if rhs.class == null then lhs.class
+              else if lhs.class == rhs.class then lhs.class
+              else throw "A submoduleWith option is declared multiple times with conflicting class values \"${toString lhs.class}\" and \"${toString rhs.class}\".";
            modules = lhs.modules ++ rhs.modules;
            specialArgs =
              let intersecting = builtins.intersectAttrs lhs.specialArgs rhs.specialArgs;
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1654,6 +1654,16 @@
    githubId = 1017537;
    name = "Bruno Bieth";
  };
+  badele = {
+    name = "Bruno Adelé";
+    email = "brunoadele@gmail.com";
+    matrix = "@badele:matrix.org";
+    github = "badele";
+    githubId = 2806307;
+    keys = [{
+      fingerprint = "00F4 21C4 C537 7BA3 9820 E13F 6B95 E13D E469 CC5D";
+    }];
+  };
  badmutex = {
    email = "github@badi.sh";
    github = "badmutex";
@ -14685,12 +14695,6 @@
    githubId = 6391601;
    name = "Roger Mason";
  };
-  spwhitt = {
-    email = "sw@swhitt.me";
-    github = "spwhitt";
-    githubId = 1414088;
-    name = "Spencer Whitt";
-  };
  squalus = {
    email = "squalus@squalus.net";
    github = "squalus";
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -70,6 +70,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [opensearch](https://opensearch.org), a search server alternative to Elasticsearch. Available as [services.opensearch](options.html#opt-services.opensearch.enable).

+- [kavita](https://kavitareader.com), a self-hosted digital library. Available as [services.kavita](options.html#opt-services.kavita.enable).
+
 - [monica](https://www.monicahq.com), an open source personal CRM. Available as [services.monica](options.html#opt-services.monica.enable).

 - [authelia](https://www.authelia.com/), is an open-source authentication and authorization server. Available under [services.authelia](options.html#opt-services.authelia.enable).
--- a/nixos/lib/eval-cacheable-options.nix
+++ b/nixos/lib/eval-cacheable-options.nix
@ -33,6 +33,7 @@ let
    ];
    specialArgs = {
      inherit config pkgs utils;
+      class = "nixos";
    };
  };
  docs = import "${nixosPath}/doc/manual" {
--- a/nixos/lib/eval-config-minimal.nix
+++ b/nixos/lib/eval-config-minimal.nix
@ -38,6 +38,7 @@ let
  #       is experimental.
  lib.evalModules {
    inherit prefix modules;
+    class = "nixos";
    specialArgs = {
      modulesPath = builtins.toString ../modules;
    } // specialArgs;
--- a/nixos/lib/testing/default.nix
+++ b/nixos/lib/testing/default.nix
@ -1,7 +1,10 @@
 { lib }:
 let

-  evalTest = module: lib.evalModules { modules = testModules ++ [ module ]; };
+  evalTest = module: lib.evalModules {
+    modules = testModules ++ [ module ];
+    class = "nixosTest";
+  };
  runTest = module: (evalTest ({ config, ... }: { imports = [ module ]; result = config.test; })).config.result;

  testModules = [
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@ -127,7 +127,7 @@ in
    system.nixos-generate-config.configuration = mkDefault ''
      # Edit this configuration file to define what should be installed on
      # your system.  Help is available in the configuration.nix(5) man page
-      # and in the NixOS manual (accessible by running ‘nixos-help’).
+      # and in the NixOS manual (accessible by running `nixos-help`).

      { config, pkgs, ... }:

@ -218,7 +218,7 @@ in

        # This value determines the NixOS release from which the default
        # settings for stateful data, like file locations and database versions
-        # on your system were taken. It’s perfectly fine and recommended to leave
+        # on your system were taken. It's perfectly fine and recommended to leave
        # this value at the release version of the first install of this system.
        # Before changing this value read the documentation for this option
        # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@ -38,6 +38,7 @@ let
          modules = [ {
            _module.check = false;
          } ] ++ docModules.eager;
+          class = "nixos";
          specialArgs = specialArgs // {
            pkgs = scrubDerivations "pkgs" pkgs;
            # allow access to arbitrary options for eager modules, eg for getting
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1184,6 +1184,7 @@
  ./services/web-apps/jirafeau.nix
  ./services/web-apps/jitsi-meet.nix
  ./services/web-apps/kasmweb/default.nix
+  ./services/web-apps/kavita.nix
  ./services/web-apps/keycloak.nix
  ./services/web-apps/komga.nix
  ./services/web-apps/lemmy.nix
--- a/nixos/modules/programs/fzf.nix
+++ b/nixos/modules/programs/fzf.nix
@ -1,8 +1,9 @@
-{pkgs, config, lib, ...}:
+{ pkgs, config, lib, ... }:
 with lib;
 let
  cfg = config.programs.fzf;
-in {
+in
+{
  options = {
    programs.fzf = {
      fuzzyCompletion = mkEnableOption (mdDoc "fuzzy completion with fzf");
@ -11,17 +12,21 @@ in {
  };
  config = {
    environment.systemPackages = optional (cfg.keybindings || cfg.fuzzyCompletion) pkgs.fzf;
+
    programs.bash.interactiveShellInit = optionalString cfg.fuzzyCompletion ''
      source ${pkgs.fzf}/share/fzf/completion.bash
    '' + optionalString cfg.keybindings ''
      source ${pkgs.fzf}/share/fzf/key-bindings.bash
    '';

-    programs.zsh.interactiveShellInit = optionalString cfg.fuzzyCompletion ''
-      source ${pkgs.fzf}/share/fzf/completion.zsh
-    '' + optionalString cfg.keybindings ''
-      source ${pkgs.fzf}/share/fzf/key-bindings.zsh
-    '';
+    programs.zsh.interactiveShellInit = optionalString (!config.programs.zsh.ohMyZsh.enable)
+      (optionalString cfg.fuzzyCompletion ''
+        source ${pkgs.fzf}/share/fzf/completion.zsh
+      '' + optionalString cfg.keybindings ''
+        source ${pkgs.fzf}/share/fzf/key-bindings.zsh
+      '');
+
+    programs.zsh.ohMyZsh.plugins = optional (cfg.keybindings || cfg.fuzzyCompletion) [ "fzf" ];
  };
  meta.maintainers = with maintainers; [ laalsaas ];
 }
--- a/nixos/modules/services/misc/tandoor-recipes.nix
+++ b/nixos/modules/services/misc/tandoor-recipes.nix
@ -9,6 +9,7 @@ let
  env = {
    GUNICORN_CMD_ARGS = "--bind=${cfg.address}:${toString cfg.port}";
    DEBUG = "0";
+    DEBUG_TOOLBAR = "0";
    MEDIA_ROOT = "/var/lib/tandoor-recipes";
  } // optionalAttrs (config.time.timeZone != null) {
    TIMEZONE = config.time.timeZone;
--- a/nixos/modules/services/system/cloud-init.nix
+++ b/nixos/modules/services/system/cloud-init.nix
@ -2,18 +2,22 @@

 with lib;

-let cfg = config.services.cloud-init;
-    path = with pkgs; [
-      cloud-init
-      iproute2
-      nettools
-      openssh
-      shadow
-      util-linux
-      busybox
-    ] ++ optional cfg.btrfs.enable btrfs-progs
-      ++ optional cfg.ext4.enable e2fsprogs
-    ;
+let
+  cfg = config.services.cloud-init;
+  path = with pkgs; [
+    cloud-init
+    iproute2
+    nettools
+    openssh
+    shadow
+    util-linux
+    busybox
+  ]
+  ++ optional cfg.btrfs.enable btrfs-progs
+  ++ optional cfg.ext4.enable e2fsprogs
+  ;
+  settingsFormat = pkgs.formats.yaml { };
+  cfgfile = settingsFormat.generate "cloud.cfg" cfg.settings;
 in
 {
  options = {
@ -21,7 +25,7 @@ in
      enable = mkOption {
        type = types.bool;
        default = false;
-        description = lib.mdDoc ''
+        description = mdDoc ''
          Enable the cloud-init service. This services reads
          configuration metadata in a cloud environment and configures
          the machine according to this metadata.
@ -40,7 +44,7 @@ in
      btrfs.enable = mkOption {
        type = types.bool;
        default = false;
-        description = lib.mdDoc ''
+        description = mdDoc ''
          Allow the cloud-init service to operate `btrfs` filesystem.
        '';
      };
@ -48,7 +52,7 @@ in
      ext4.enable = mkOption {
        type = types.bool;
        default = true;
-        description = lib.mdDoc ''
+        description = mdDoc ''
          Allow the cloud-init service to operate `ext4` filesystem.
        '';
      };
@ -56,141 +60,170 @@ in
      network.enable = mkOption {
        type = types.bool;
        default = false;
-        description = lib.mdDoc ''
+        description = mdDoc ''
          Allow the cloud-init service to configure network interfaces
          through systemd-networkd.
        '';
      };

+      settings = mkOption {
+        description = mdDoc ''
+          Structured cloud-init configuration.
+        '';
+        type = types.submodule {
+          freeformType = settingsFormat.type;
+        };
+        default = { };
+      };
+
      config = mkOption {
        type = types.str;
-        default = ''
-          system_info:
-            distro: nixos
-            network:
-              renderers: [ 'networkd' ]
-          users:
-             - root
+        default = "";
+        description = mdDoc ''
+          raw cloud-init configuration.

-          disable_root: false
-          preserve_hostname: false
-
-          cloud_init_modules:
-           - migrator
-           - seed_random
-           - bootcmd
-           - write-files
-           - growpart
-           - resizefs
-           - update_hostname
-           - resolv_conf
-           - ca-certs
-           - rsyslog
-           - users-groups
-
-          cloud_config_modules:
-           - disk_setup
-           - mounts
-           - ssh-import-id
-           - set-passwords
-           - timezone
-           - disable-ec2-metadata
-           - runcmd
-           - ssh
-
-          cloud_final_modules:
-           - rightscale_userdata
-           - scripts-vendor
-           - scripts-per-once
-           - scripts-per-boot
-           - scripts-per-instance
-           - scripts-user
-           - ssh-authkey-fingerprints
-           - keys-to-console
-           - phone-home
-           - final-message
-           - power-state-change
-          '';
-        description = lib.mdDoc "cloud-init configuration.";
+          Takes precedence over the `settings` option if set.
+        '';
      };

    };

  };

-  config = mkIf cfg.enable {
+  config = {
+    services.cloud-init.settings = {
+      system_info = mkDefault {
+        distro = "nixos";
+        network = {
+          renderers = [ "networkd" ];
+        };
+      };

-    environment.etc."cloud/cloud.cfg".text = cfg.config;
+      users = mkDefault [ "root" ];
+      disable_root = mkDefault false;
+      preserve_hostname = mkDefault false;
+
+      cloud_init_modules = mkDefault [
+        "migrator"
+        "seed_random"
+        "bootcmd"
+        "write-files"
+        "growpart"
+        "resizefs"
+        "update_hostname"
+        "resolv_conf"
+        "ca-certs"
+        "rsyslog"
+        "users-groups"
+      ];
+
+      cloud_config_modules = mkDefault [
+        "disk_setup"
+        "mounts"
+        "ssh-import-id"
+        "set-passwords"
+        "timezone"
+        "disable-ec2-metadata"
+        "runcmd"
+        "ssh"
+      ];
+
+      cloud_final_modules = mkDefault [
+        "rightscale_userdata"
+        "scripts-vendor"
+        "scripts-per-once"
+        "scripts-per-boot"
+        "scripts-per-instance"
+        "scripts-user"
+        "ssh-authkey-fingerprints"
+        "keys-to-console"
+        "phone-home"
+        "final-message"
+        "power-state-change"
+      ];
+    };
+  } // (mkIf cfg.enable {
+
+    environment.etc."cloud/cloud.cfg" =
+      if cfg.config == "" then
+        { source = cfgfile; }
+      else
+        { text = cfg.config; }
+    ;

    systemd.network.enable = cfg.network.enable;

-    systemd.services.cloud-init-local =
-      { description = "Initial cloud-init job (pre-networking)";
-        wantedBy = [ "multi-user.target" ];
-        before = ["systemd-networkd.service"];
-        path = path;
-        serviceConfig =
-          { Type = "oneshot";
-            ExecStart = "${pkgs.cloud-init}/bin/cloud-init init --local";
-            RemainAfterExit = "yes";
-            TimeoutSec = "infinity";
-            StandardOutput = "journal+console";
-          };
+    systemd.services.cloud-init-local = {
+      description = "Initial cloud-init job (pre-networking)";
+      wantedBy = [ "multi-user.target" ];
+      before = [ "systemd-networkd.service" ];
+      path = path;
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.cloud-init}/bin/cloud-init init --local";
+        RemainAfterExit = "yes";
+        TimeoutSec = "infinity";
+        StandardOutput = "journal+console";
      };
+    };

-    systemd.services.cloud-init =
-      { description = "Initial cloud-init job (metadata service crawler)";
-        wantedBy = [ "multi-user.target" ];
-        wants = [ "network-online.target" "cloud-init-local.service"
-                  "sshd.service" "sshd-keygen.service" ];
-        after = [ "network-online.target" "cloud-init-local.service" ];
-        before = [ "sshd.service" "sshd-keygen.service" ];
-        requires = [ "network.target"];
-        path = path;
-        serviceConfig =
-          { Type = "oneshot";
-            ExecStart = "${pkgs.cloud-init}/bin/cloud-init init";
-            RemainAfterExit = "yes";
-            TimeoutSec = "infinity";
-            StandardOutput = "journal+console";
-          };
+    systemd.services.cloud-init = {
+      description = "Initial cloud-init job (metadata service crawler)";
+      wantedBy = [ "multi-user.target" ];
+      wants = [
+        "network-online.target"
+        "cloud-init-local.service"
+        "sshd.service"
+        "sshd-keygen.service"
+      ];
+      after = [ "network-online.target" "cloud-init-local.service" ];
+      before = [ "sshd.service" "sshd-keygen.service" ];
+      requires = [ "network.target" ];
+      path = path;
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.cloud-init}/bin/cloud-init init";
+        RemainAfterExit = "yes";
+        TimeoutSec = "infinity";
+        StandardOutput = "journal+console";
      };
+    };

-    systemd.services.cloud-config =
-      { description = "Apply the settings specified in cloud-config";
-        wantedBy = [ "multi-user.target" ];
-        wants = [ "network-online.target" ];
-        after = [ "network-online.target" "syslog.target" "cloud-config.target" ];
+    systemd.services.cloud-config = {
+      description = "Apply the settings specified in cloud-config";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" "syslog.target" "cloud-config.target" ];

-        path = path;
-        serviceConfig =
-          { Type = "oneshot";
-            ExecStart = "${pkgs.cloud-init}/bin/cloud-init modules --mode=config";
-            RemainAfterExit = "yes";
-            TimeoutSec = "infinity";
-            StandardOutput = "journal+console";
-          };
+      path = path;
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.cloud-init}/bin/cloud-init modules --mode=config";
+        RemainAfterExit = "yes";
+        TimeoutSec = "infinity";
+        StandardOutput = "journal+console";
      };
+    };

-    systemd.services.cloud-final =
-      { description = "Execute cloud user/final scripts";
-        wantedBy = [ "multi-user.target" ];
-        wants = [ "network-online.target" ];
-        after = [ "network-online.target" "syslog.target" "cloud-config.service" "rc-local.service" ];
-        requires = [ "cloud-config.target" ];
-        path = path;
-        serviceConfig =
-          { Type = "oneshot";
-            ExecStart = "${pkgs.cloud-init}/bin/cloud-init modules --mode=final";
-            RemainAfterExit = "yes";
-            TimeoutSec = "infinity";
-            StandardOutput = "journal+console";
-          };
+    systemd.services.cloud-final = {
+      description = "Execute cloud user/final scripts";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" "syslog.target" "cloud-config.service" "rc-local.service" ];
+      requires = [ "cloud-config.target" ];
+      path = path;
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.cloud-init}/bin/cloud-init modules --mode=final";
+        RemainAfterExit = "yes";
+        TimeoutSec = "infinity";
+        StandardOutput = "journal+console";
      };
+    };

-    systemd.targets.cloud-config =
-      { description = "Cloud-config availability";
-        requires = [ "cloud-init-local.service" "cloud-init.service" ];
-      };
-  };
+    systemd.targets.cloud-config = {
+      description = "Cloud-config availability";
+      requires = [ "cloud-init-local.service" "cloud-init.service" ];
+    };
+  });
 }
--- a/nixos/modules/services/web-apps/kavita.nix
+++ b/nixos/modules/services/web-apps/kavita.nix
@ -0,0 +1,83 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.kavita;
+in {
+  options.services.kavita = {
+    enable = lib.mkEnableOption (lib.mdDoc "Kavita reading server");
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "kavita";
+      description = lib.mdDoc "User account under which Kavita runs.";
+    };
+
+    package = lib.mkPackageOptionMD pkgs "kavita" { };
+
+    dataDir = lib.mkOption {
+      default = "/var/lib/kavita";
+      type = lib.types.str;
+      description = lib.mdDoc "The directory where Kavita stores its state.";
+    };
+
+    tokenKeyFile = lib.mkOption {
+      type = lib.types.path;
+      description = lib.mdDoc ''
+        A file containing the TokenKey, a secret with at 128+ bits.
+        It can be generated with `head -c 32 /dev/urandom | base64`.
+      '';
+    };
+    port = lib.mkOption {
+      default = 5000;
+      type = lib.types.port;
+      description = lib.mdDoc "Port to bind to.";
+    };
+    ipAdresses = lib.mkOption {
+      default = ["0.0.0.0" "::"];
+      type = lib.types.listOf lib.types.str;
+      description = lib.mdDoc "IP Adresses to bind to. The default is to bind
+      to all IPv4 and IPv6 addresses.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.kavita = {
+      description = "Kavita";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      preStart = ''
+        umask u=rwx,g=rx,o=
+        cat > "${cfg.dataDir}/config/appsettings.json" <<EOF
+        {
+          "TokenKey": "$(cat ${cfg.tokenKeyFile})",
+          "Port": ${toString cfg.port},
+          "IpAddresses": "${lib.concatStringsSep "," cfg.ipAdresses}"
+        }
+        EOF
+      '';
+      serviceConfig = {
+        WorkingDirectory = cfg.dataDir;
+        ExecStart = "${lib.getExe cfg.package}";
+        Restart = "always";
+        User = cfg.user;
+      };
+    };
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.dataDir}'        0750 ${cfg.user} ${cfg.user} - -"
+      "d '${cfg.dataDir}/config' 0750 ${cfg.user} ${cfg.user} - -"
+    ];
+
+    users = {
+      users.${cfg.user} = {
+        description = "kavita service user";
+        isSystemUser = true;
+        group = cfg.user;
+        home = cfg.dataDir;
+      };
+      groups.${cfg.user} = { };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ misterio77 ];
+}
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -272,7 +272,7 @@ let
  suggestedRootDevice = {
    "efi_bootloading_with_default_fs" = "${cfg.bootLoaderDevice}2";
    "legacy_bootloading_with_default_fs" = "${cfg.bootLoaderDevice}1";
-    "direct_boot_with_default_fs" = lookupDriveDeviceName "root" cfg.qemu.drives;
+    "direct_boot_with_default_fs" = cfg.bootLoaderDevice;
    # This will enforce a NixOS module type checking error
    # to ask explicitly the user to set a rootDevice.
    # As it will look like `rootDevice = lib.mkDefault null;` after
@ -344,14 +344,14 @@ in

    virtualisation.bootLoaderDevice =
      mkOption {
-        type = types.nullOr types.path;
-        default = if cfg.useBootLoader then lookupDriveDeviceName "root" cfg.qemu.drives else null;
-        defaultText = literalExpression ''if cfg.useBootLoader then lookupDriveDeviceName "root" cfg.qemu.drives else null;'';
+        type = types.path;
+        default = lookupDriveDeviceName "root" cfg.qemu.drives;
+        defaultText = literalExpression ''lookupDriveDeviceName "root" cfg.qemu.drives'';
        example = "/dev/vda";
        description =
          lib.mdDoc ''
            The disk to be used for the boot filesystem.
-            By default, it is the same disk as the root filesystem if you use a bootloader, otherwise it's null.
+            By default, it is the same disk as the root filesystem.
          '';
        };

@ -862,16 +862,6 @@ in
                Invalid virtualisation.forwardPorts.<entry ${toString i}>.guest.address:
                  The address must be in the default VLAN (10.0.2.0/24).
              '';
-            }
-          { assertion = cfg.useBootLoader -> cfg.diskImage != null;
-            message =
-              ''
-                Currently, bootloaders cannot be used with a tmpfs disk image.
-                It would require some rework in the boot configuration mechanism
-                to detect the proper boot partition in UEFI scenarios for example.
-
-                If you are interested into this feature, please open an issue or open a pull request.
-              '';
          }
        ]));

@ -899,8 +889,7 @@ in
    # legacy and UEFI. In order to avoid this, we have to put "nodev" to force UEFI-only installs.
    # Otherwise, we set the proper bootloader device for this.
    # FIXME: make a sense of this mess wrt to multiple ESP present in the system, probably use boot.efiSysMountpoint?
-    boot.loader.grub.enable = cfg.useBootLoader;
-    boot.loader.grub.device = mkIf cfg.useBootLoader (mkVMOverride (if cfg.useEFIBoot then "nodev" else cfg.bootLoaderDevice));
+    boot.loader.grub.device = mkVMOverride (if cfg.useEFIBoot then "nodev" else cfg.bootLoaderDevice);
    boot.loader.grub.gfxmodeBios = with cfg.resolution; "${toString x}x${toString y}";
    virtualisation.rootDevice = mkDefault suggestedRootDevice;

@ -908,13 +897,13 @@ in

    boot.loader.supportsInitrdSecrets = mkIf (!cfg.useBootLoader) (mkVMOverride false);

-    boot.initrd.extraUtilsCommands = lib.mkIf (cfg.useDefaultFilesystems && !config.boot.initrd.systemd.enable && cfg.diskImage != null)
+    boot.initrd.extraUtilsCommands = lib.mkIf (cfg.useDefaultFilesystems && !config.boot.initrd.systemd.enable)
      ''
        # We need mke2fs in the initrd.
        copy_bin_and_libs ${pkgs.e2fsprogs}/bin/mke2fs
      '';

-    boot.initrd.postDeviceCommands = lib.mkIf (cfg.useDefaultFilesystems && !config.boot.initrd.systemd.enable && cfg.diskImage != null)
+    boot.initrd.postDeviceCommands = lib.mkIf (cfg.useDefaultFilesystems && !config.boot.initrd.systemd.enable)
      ''
        # If the disk image appears to be empty, run mke2fs to
        # initialise.
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -352,6 +352,7 @@ in {
  kafka = handleTest ./kafka.nix {};
  kanidm = handleTest ./kanidm.nix {};
  karma = handleTest ./karma.nix {};
+  kavita = handleTest ./kavita.nix {};
  kbd-setfont-decompress = handleTest ./kbd-setfont-decompress.nix {};
  kbd-update-search-paths-patch = handleTest ./kbd-update-search-paths-patch.nix {};
  kea = handleTest ./kea.nix {};
--- a/nixos/tests/kavita.nix
+++ b/nixos/tests/kavita.nix
@ -0,0 +1,36 @@
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "kavita";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ misterio77 ];
+  };
+
+  nodes = {
+    kavita = { config, pkgs, ... }: {
+      services.kavita = {
+        enable = true;
+        port = 5000;
+        tokenKeyFile = builtins.toFile "kavita.key" "QfpjFvjT83BLtZ74GE3U3Q==";
+      };
+    };
+  };
+
+  testScript = let
+    regUrl = "http://kavita:5000/api/Account/register";
+    payload = builtins.toFile "payload.json" (builtins.toJSON {
+      username = "foo";
+      password = "correcthorsebatterystaple";
+      email = "foo@bar";
+    });
+  in ''
+    kavita.start
+    kavita.wait_for_unit("kavita.service")
+
+    # Check that static assets are working
+    kavita.wait_until_succeeds("curl http://kavita:5000/site.webmanifest | grep Kavita")
+
+    # Check that registration is working
+    kavita.succeed("curl -fX POST ${regUrl} --json @${payload}")
+    # But only for the first one
+    kavita.fail("curl -fX POST ${regUrl} --json @${payload}")
+  '';
+})
--- a/pkgs/applications/audio/butt/default.nix
+++ b/pkgs/applications/audio/butt/default.nix
@ -0,0 +1,47 @@
+{ lib, stdenv, fetchurl, pkg-config, fltk13, portaudio, lame, libvorbis, libogg
+, flac, libopus, libsamplerate, fdk_aac, dbus, openssl, curl }:
+
+stdenv.mkDerivation rec {
+  pname = "butt";
+  version = "0.1.37";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
+    hash = "sha256-FI8xRCaGSMC6KEf5v87Q4syO3kVPWXYXgnL24+myRKo=";
+  };
+
+  postPatch = ''
+    # remove advertising
+    substituteInPlace src/FLTK/flgui.cpp \
+      --replace 'idata_radio_co_badge, 124, 61, 4,' 'nullptr, 0, 0, 0,'
+  '';
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    fltk13
+    portaudio
+    lame
+    libvorbis
+    libogg
+    flac
+    libopus
+    libsamplerate
+    fdk_aac
+    dbus
+    openssl
+    curl
+  ];
+
+  postInstall = ''
+    cp -r usr/share $out/
+  '';
+
+  meta = {
+    description =
+      "butt (broadcast using this tool) is an easy to use, multi OS streaming tool";
+    homepage = "https://danielnoethen.de/butt/";
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ ehmry ];
+  };
+}
--- a/pkgs/applications/audio/hqplayer-desktop/default.nix
+++ b/pkgs/applications/audio/hqplayer-desktop/default.nix
@ -1,11 +1,13 @@
 { mkDerivation
 , alsa-lib
 , autoPatchelfHook
+, evince
 , fetchurl
 , flac
-, gcc11
+, gcc12
 , lib
 , libmicrohttpd
+, libusb-compat-0_1
 , llvmPackages_10
 , qtcharts
 , qtdeclarative
@ -18,15 +20,15 @@

 mkDerivation rec {
  pname = "hqplayer-desktop";
-  version = "4.13.1-38";
+  version = "4.22.0-65";

  src = fetchurl {
-    url = "https://www.signalyst.eu/bins/hqplayer/fc34/hqplayer4desktop-${version}.fc34.x86_64.rpm";
-    sha256 = "sha256-DEZWEGk5SfhcNQddehCBVbfeTH8KfVCdaxQ+F3MrRe8=";
+    url = "https://www.signalyst.eu/bins/hqplayer4desktop-${version}.fc36.x86_64.rpm";
+    sha256 = "sha256-PA8amsqy4O9cMruNYVhG+uBiUGQ5WfnZC2ARppmZd7g=";
  };

  unpackPhase = ''
-    ${rpmextract}/bin/rpmextract $src
+    ${rpmextract}/bin/rpmextract "$src"
  '';

  nativeBuildInputs = [ autoPatchelfHook rpmextract ];
@ -34,8 +36,9 @@ mkDerivation rec {
  buildInputs = [
    alsa-lib
    flac
-    gcc11.cc.lib
+    gcc12.cc.lib
    libmicrohttpd
+    libusb-compat-0_1
    llvmPackages_10.openmp
    qtcharts
    qtdeclarative
@ -45,41 +48,52 @@ mkDerivation rec {
    wavpack
  ];

+  dontPatch = true;
  dontConfigure = true;
  dontBuild = true;

  installPhase = ''
    runHook preInstall

-    # main executable
-    mkdir -p $out/bin
-    cp ./usr/bin/* $out/bin
+    # additional library
+    mkdir -p "$out"/lib
+    mv ./opt/hqplayer4desktop/lib/* "$out"/lib

-    # desktop files
-    mkdir -p $out/share/applications
-    cp ./usr/share/applications/* $out/share/applications
+    # main executable
+    mkdir -p "$out"/bin
+    mv ./usr/bin/* "$out"/bin

    # documentation
-    mkdir -p $out/share/doc/${pname}
-    cp ./usr/share/doc/hqplayer4desktop/* $out/share/doc/${pname}
+    mkdir -p "$doc/share/doc/${pname}" "$doc/share/applications"
+    mv ./usr/share/doc/hqplayer4desktop/* "$doc/share/doc/${pname}"
+    mv ./usr/share/applications/hqplayer4desktop-manual.desktop "$doc/share/applications"
+
+    # desktop files
+    mkdir -p "$out/share/applications"
+    mv ./usr/share/applications/* "$out/share/applications"

    # pixmaps
-    mkdir -p $out/share/pixmaps
-    cp ./usr/share/pixmaps/* $out/share/pixmaps
+    mkdir -p "$out/share/pixmaps"
+    mv ./usr/share/pixmaps/* "$out/share/pixmaps"

    runHook postInstall
  '';

+  # doc has dependencies on evince that is not required by main app
+  outputs = [ "out" "doc" ];
+
  postInstall = ''
-    for desktopFile in $out/share/applications/*; do
+    for desktopFile in $out/share/applications/hqplayer4{desktop-nostyle,desktop-highdpi,-client,desktop}.desktop; do
      substituteInPlace "$desktopFile" \
-        --replace /usr/bin/ $out/bin/ \
-        --replace /usr/share/doc/ $out/share/doc/
+        --replace /usr/bin "$out"/bin
    done
+    substituteInPlace "$doc/share/applications/hqplayer4desktop-manual.desktop" \
+        --replace /usr/share/doc/hqplayer4desktop "$doc/share/doc/${pname}" \
+        --replace evince "${evince}/bin/evince"
  '';

  postFixup = ''
-    patchelf --replace-needed libomp.so.5 libomp.so $out/bin/.hqplayer4desktop-wrapped
+    patchelf --replace-needed libomp.so.5 libomp.so "$out/bin/.hqplayer4desktop-wrapped"
  '';

  meta = with lib; {
@ -89,7 +103,5 @@ mkDerivation rec {
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ lovesegfault ];
-    # src link returns 403
-    broken = true;
  };
 }
--- a/pkgs/applications/audio/mopidy/musicbox-webclient.nix
+++ b/pkgs/applications/audio/mopidy/musicbox-webclient.nix
@ -26,6 +26,6 @@ pythonPackages.buildPythonApplication rec {
    homepage = "https://github.com/pimusicbox/mopidy-musicbox-webclient";
    changelog = "https://github.com/pimusicbox/mopidy-musicbox-webclient/blob/v${version}/CHANGELOG.rst";
    license = licenses.asl20;
-    maintainers = with maintainers; [ spwhitt ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/audio/mopidy/soundcloud.nix
+++ b/pkgs/applications/audio/mopidy/soundcloud.nix
@ -18,6 +18,6 @@ pythonPackages.buildPythonApplication rec {
  meta = with lib; {
    description = "Mopidy extension for playing music from SoundCloud";
    license = licenses.mit;
-    maintainers = [ maintainers.spwhitt ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/mopidy/youtube.nix
+++ b/pkgs/applications/audio/mopidy/youtube.nix
@ -52,6 +52,6 @@ python3.pkgs.buildPythonApplication rec {
    description = "Mopidy extension for playing music from YouTube";
    homepage = "https://github.com/natumbri/mopidy-youtube";
    license = licenses.asl20;
-    maintainers = with maintainers; [ spwhitt ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/audio/nootka/default.nix
+++ b/pkgs/applications/audio/nootka/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
  ];

  cmakeFlags = [
-    "-DCMAKE_INCLUDE_PATH=${libjack2}/include/jack;${libpulseaudio.dev}/include/pulse"
+    "-DCMAKE_INCLUDE_PATH=${lib.getDev libjack2}/include/jack;${lib.getDev libpulseaudio}/include/pulse"
    "-DENABLE_JACK=ON"
    "-DENABLE_PULSEAUDIO=ON"
  ];
--- a/pkgs/applications/blockchains/stellar-core/default.nix
+++ b/pkgs/applications/blockchains/stellar-core/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "stellar-core";
-  version = "19.9.0";
+  version = "19.10.0";

  src = fetchFromGitHub {
    owner = "stellar";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-00bTqc3YDl/o03Y7NBsgGFwUzb2zYe/A3ccpHPIann8=";
+    sha256 = "sha256-BcZsj2TbeJW91aiZ2I7NbDa+rgjfs6lQUsWOnhFQXtw=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/display-managers/emptty/default.nix
+++ b/pkgs/applications/display-managers/emptty/default.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "emptty";
-  version = "0.9.1";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "tvrzna";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-CbTPJgnKMWMXdG6Hr8xT9ae4Q9MxAfhITn5WSCzCmI4=";
+    hash = "sha256-8JVF3XNNzmcaJCINnv8B6l2IB5c8q/AvGOzwAlIFYq8=";
  };

  buildInputs = [ pam libX11 ];
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@ -522,6 +522,13 @@ let
          '';
        });

+        tokei = super.tokei.overrideAttrs (attrs: {
+          postPatch = attrs.postPatch or "" + ''
+            substituteInPlace tokei.el \
+              --replace 'tokei-program "tokei"' 'tokei-program "${lib.getExe pkgs.tokei}"'
+          '';
+        });
+
        treemacs-magit = super.treemacs-magit.overrideAttrs (attrs: {
          # searches for Git at build time
          nativeBuildInputs =
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -775,12 +775,12 @@ final: prev:

  auto-session = buildVimPluginFrom2Nix {
    pname = "auto-session";
-    version = "2023-04-29";
+    version = "2023-05-05";
    src = fetchFromGitHub {
      owner = "rmagatti";
      repo = "auto-session";
-      rev = "9752e6b11327329ed3ba5ec2bec36abe4535a8e0";
-      sha256 = "0hqh8mzs9vxfasxb1sr4vx2igcjl9f9vmf5spd7vriaxi331sf1p";
+      rev = "21033c6815f249a7839c3a85fc8a6b44d74925c9";
+      sha256 = "1xw2azfkwn2q0nz3g67wy6wkaqlmhxy26x7bnjl7n21lh2gxv7fm";
    };
    meta.homepage = "https://github.com/rmagatti/auto-session/";
  };
@ -2827,6 +2827,18 @@ final: prev:
    meta.homepage = "https://github.com/sainnhe/edge/";
  };

+  edgedb-vim = buildVimPluginFrom2Nix {
+    pname = "edgedb-vim";
+    version = "2022-10-26";
+    src = fetchFromGitHub {
+      owner = "edgedb";
+      repo = "edgedb-vim";
+      rev = "a888b285a30ede6f5fcb03617733b3974356c450";
+      sha256 = "012jd6652f681ja22gvnrnlvsn1fllj9vmf6idghcdzz6lyjir07";
+    };
+    meta.homepage = "https://github.com/edgedb/edgedb-vim/";
+  };
+
  editorconfig-vim = buildVimPluginFrom2Nix {
    pname = "editorconfig-vim";
    version = "2023-03-22";
@ -3288,12 +3300,12 @@ final: prev:

  fzf-lua = buildVimPluginFrom2Nix {
    pname = "fzf-lua";
-    version = "2023-04-27";
+    version = "2023-05-05";
    src = fetchFromGitHub {
      owner = "ibhagwan";
      repo = "fzf-lua";
-      rev = "79c7c3480cc363b3d4ecdfcb8b56623d9decd570";
-      sha256 = "0vay2k6hv30fhchjd59m4xqdyl9642xs5gjlc1rrb9v3s2xs9g53";
+      rev = "2dbedc91386a78ce08967135969d39392f7f36d7";
+      sha256 = "11850qbyr83bh5im75lf74ssizw956gf3n34s3wcqdhxx6nv5xbp";
    };
    meta.homepage = "https://github.com/ibhagwan/fzf-lua/";
  };
@ -6419,12 +6431,12 @@ final: prev:

  nvim-highlite = buildVimPluginFrom2Nix {
    pname = "nvim-highlite";
-    version = "2023-05-04";
+    version = "2023-05-05";
    src = fetchFromGitHub {
      owner = "Iron-E";
      repo = "nvim-highlite";
-      rev = "624fddaf856add7a4a9a40b33fad3bb3818f4fc8";
-      sha256 = "1r65wcpbdqi05mpa9382bawv32l2r0s8avr9in5q07sl66wd59v8";
+      rev = "d5654c3a8951f6c503cb8083a0e9dbfc35a5f59c";
+      sha256 = "1c00jijxqa83xbg3spn8830h8gmn1mqh6m4jifhahglanh3y5228";
    };
    meta.homepage = "https://github.com/Iron-E/nvim-highlite/";
  };
@ -14305,12 +14317,12 @@ final: prev:

  vista-vim = buildVimPluginFrom2Nix {
    pname = "vista.vim";
-    version = "2023-04-17";
+    version = "2023-05-05";
    src = fetchFromGitHub {
      owner = "liuchengxu";
      repo = "vista.vim";
-      rev = "cbe87c86505d80fe5ad7fd508f2d92185f2e2aa1";
-      sha256 = "0vx99bhrgwr72az85imp7qwni54q9kk1v9vhdbglfc4h1rd3fzm5";
+      rev = "522a5e0ef955c037d530d5c89944043c92e4e8da";
+      sha256 = "0g9vjji4760824q7w0ik89b1wrq0k0rv54c3wmpxk9hxfd34wlb1";
    };
    meta.homepage = "https://github.com/liuchengxu/vista.vim/";
  };
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -236,6 +236,7 @@ https://github.com/Mofiqul/dracula.nvim/,HEAD,
 https://github.com/stevearc/dressing.nvim/,,
 https://github.com/Shougo/echodoc.vim/,,
 https://github.com/sainnhe/edge/,,
+https://github.com/edgedb/edgedb-vim/,,
 https://github.com/editorconfig/editorconfig-vim/,,
 https://github.com/gpanders/editorconfig.nvim/,,
 https://github.com/elixir-tools/elixir-tools.nvim/,HEAD,
--- a/pkgs/applications/emulators/retroarch/cores.nix
+++ b/pkgs/applications/emulators/retroarch/cores.nix
@ -42,7 +42,7 @@
 }:

 let
-  hashesFile = builtins.fromJSON (builtins.readFile ./hashes.json);
+  hashesFile = lib.importJSON ./hashes.json;

  getCoreSrc = core:
    fetchFromGitHub (builtins.getAttr core hashesFile);
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@ -9,7 +9,7 @@
 let

  pname = "1password";
-  version = if channel == "stable" then "8.10.4" else "8.10.5-10.BETA";
+  version = if channel == "stable" then "8.10.4" else "8.10.6-20.BETA";

  sources = {
    stable = {
@ -33,19 +33,19 @@ let
    beta = {
      x86_64-linux = {
        url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-GM93nW7kGeC2Mmq1ZtOK72RQc0QHvlWedDLEAmqtPt4=";
+        sha256 = "sha256-zhZF6BlJMlEcjKUv43f5yKv8cOzjX01yiVtIrAgw578=";
      };
      aarch64-linux = {
        url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-f0K35utZ/WPv08wRe/ZQPWC/IYiXsf/tBqhKjgeNBHc=";
+        sha256 = "sha256-pzZSV4mKhdm/zGErWSLwaf0WISvYBheGzCgB34ysCe4=";
      };
      x86_64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-zWS1nmRNm2SjMKWRbCJp4DRCzvVsdATdf/EMlpvRz1k=";
+        sha256 = "sha256-2Lbh5WPhBAJxvZ7J8/DDXDHkN8Th595RdA/S4Dwi3+0=";
      };
      aarch64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-fQ98NJI5h0IBvrcsV8GBt9RBWDiyYq0NPtS5B5ikz8k=";
+        sha256 = "sha256-XpVT5yfo6HkvbmZWyoPLD7/M3FrNIKec6yt450bPUxQ=";
      };
    };
  };
--- a/pkgs/applications/misc/furtherance/default.nix
+++ b/pkgs/applications/misc/furtherance/default.nix
@ -3,19 +3,19 @@

 stdenv.mkDerivation rec {
  pname = "furtherance";
-  version = "1.6.0";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "lakoliu";
    repo = "Furtherance";
    rev = "v${version}";
-    sha256 = "xshZpwL5AQvYSPoyt9Qutaym5IGBQHWwz4ev3xnVcSk=";
+    sha256 = "sha256-M3k2q32/vMG9uTHk2qqUz0E4ptzxfCOrs9NMjtyxZ5Y=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    sha256 = "J/e8NYd9JjmANj+4Eh3/Uq2/vS711CwERgmJ7i5orNw=";
+    sha256 = "sha256-qLrX3X8wgNrI8G0RgWydVA35cdxcblSUxTKHty+eCds=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/imaginer/default.nix
+++ b/pkgs/applications/misc/imaginer/default.nix
@ -0,0 +1,68 @@
+{ stdenv
+, lib
+, appstream-glib
+, blueprint-compiler
+, desktop-file-utils
+, fetchFromGitHub
+, gettext
+, glib
+, gobject-introspection
+, libadwaita
+, libsoup_3
+, meson
+, ninja
+, pkg-config
+, python3Packages
+, wrapGAppsHook4
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "imaginer";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "ImaginerApp";
+    repo = "Imaginer";
+    rev = "v${version}";
+    hash = "sha256-x1ZnmfaMfxnITiuFDlMPfTU8KZbd1ME9jDevnlsrbJs=";
+  };
+
+  format = "other";
+  dontWrapGApps = true;
+
+  nativeBuildInputs = [
+    appstream-glib
+    blueprint-compiler
+    desktop-file-utils
+    gettext
+    glib
+    gobject-introspection
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    libadwaita
+    libsoup_3
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    openai
+    pillow
+    pygobject3
+    requests
+  ];
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/ImaginerApp/Imaginer";
+    description = "Imaginer with AI";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ _0xMRTT ];
+  };
+}
--- a/pkgs/applications/misc/mob/default.nix
+++ b/pkgs/applications/misc/mob/default.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "mob";
-  version = "4.4.0";
+  version = "4.4.1";

  src = fetchFromGitHub {
    owner = "remotemobprogramming";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-g2l/XeSyFem2Xi/lVgfbWW+nWHxAcQV/v+2AIqB0apM=";
+    sha256 = "sha256-Ovp+JsNqFcOMk054khSdvPebFsv/fQD1Ghox8J3YcgA=";
  };

  vendorHash = null;
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.17.2";
+  version = "2.18.0";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-WVatvMdCp4BeCe5+hz933OAJIKaR4ChR22nVrl8tmIc=";
+    sha256 = "sha256-k9fbChpHy997Mj+U9n/iiSGDdsHZ22AoYUkCHUMGfbo=";
  };

  vendorHash = "sha256-mAtwbYuzkHUqG4fr2JffcM8PmBsBrnHWyl4DvVzfJCw=";
--- a/pkgs/applications/misc/tandoor-recipes/common.nix
+++ b/pkgs/applications/misc/tandoor-recipes/common.nix
@ -1,15 +1,15 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "1.4.4";
+  version = "1.4.9";

  src = fetchFromGitHub {
    owner = "TandoorRecipes";
    repo = "recipes";
    rev = version;
-    sha256 = "sha256-1wqZoOT2Aafbs2P0mL33jw5HkrLIitUcRt6bQQcHx40=";
+    sha256 = "sha256-h424lUm/wmCHXkMW2XejogvH3wL/+J67cG4m8rIWM1U=";
  };

-  yarnSha256 = "sha256-gH0q3pJ2BC5pAU9KSo3C9DDRUnpypoyLOEqKSrkxYrk=";
+  yarnSha256 = "sha256-LJ0uL66tcK6zL8Mkd2UB8dHsslMTtf8wQmgbZdvOT6s=";

  meta = with lib; {
    homepage = "https://tandoor.dev/";
--- a/pkgs/applications/misc/tandoor-recipes/default.nix
+++ b/pkgs/applications/misc/tandoor-recipes/default.nix
@ -2,6 +2,7 @@
 , nixosTests
 , python3
 , fetchFromGitHub
+, fetchpatch
 }:
 let
  python = python3.override {
@ -41,6 +42,12 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
  patches = [
    # Allow setting MEDIA_ROOT through environment variable
    ./media-root.patch
+    # Address CVE-2023-31047 on Django 4.2.1+
+    (fetchpatch {
+      name = "fix-multiple-file-field";
+      url = "https://github.com/TandoorRecipes/recipes/pull/2458/commits/6b04c922977317354a367487427b15a8ed619be9.patch";
+      hash = "sha256-KmfjJSrB/4tOWtU7zrDJ/AOG4XlmWy/halw8IEEXdZ0=";
+    })
  ];

  propagatedBuildInputs = with python.pkgs; [
@ -101,8 +108,10 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
  buildPhase = ''
    runHook preBuild

-    # Avoid dependency on django debug toolbar
+    # Disable debug logging
    export DEBUG=0
+    # Avoid dependency on django debug toolbar
+    export DEBUG_TOOLBAR=0

    # See https://github.com/TandoorRecipes/recipes/issues/2043
    mkdir cookbook/static/themes/maps/
--- a/pkgs/applications/misc/tandoor-recipes/frontend.nix
+++ b/pkgs/applications/misc/tandoor-recipes/frontend.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchYarnDeps, fixup_yarn_lock, callPackage, nodejs_16 }:
+{ stdenv, fetchYarnDeps, fixup_yarn_lock, callPackage, nodejs }:
 let
  common = callPackage ./common.nix { };
 in
@ -15,9 +15,8 @@ stdenv.mkDerivation {

  nativeBuildInputs = [
    fixup_yarn_lock
-    # Use Node JS 16 because of @achrinza/node-ipc@9.2.2
-    nodejs_16
-    nodejs_16.pkgs.yarn
+    nodejs
+    nodejs.pkgs.yarn
  ];

  configurePhase = ''
--- a/pkgs/applications/misc/valent/default.nix
+++ b/pkgs/applications/misc/valent/default.nix
@ -22,14 +22,14 @@

 stdenv.mkDerivation rec {
  pname = "valent";
-  version = "unstable-2023-03-31";
+  version = "unstable-2023-05-01";

  src = fetchFromGitHub {
    owner = "andyholmes";
    repo = "valent";
-    rev = "bb9fc25a58eeb81abea2bb651accc9538a3a82fd";
+    rev = "74f5d9349a60f0d9fcf88cda01713980a221d639";
    fetchSubmodules = true;
-    sha256 = "sha256-3pEPE96gFjDGesFs/EZswuv6D3JQEpnAnlCw0IWYkR0=";
+    sha256 = "sha256-wqdujEKizrDFXtsjSTWpFgDL7MH3tsLTc7yd3LFgIQU=";
  };

  nativeBuildInputs = [
@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/andyholmes/valent/";
    changelog = "https://github.com/andyholmes/valent/blob/${src.rev}/CHANGELOG.md";
    license = with licenses; [ gpl3Plus cc0 ];
-    maintainers = with maintainers; [ federicoschonborn ];
+    maintainers = with maintainers; [ federicoschonborn aleksana ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/networking/browsers/librewolf/src.nix
+++ b/pkgs/applications/networking/browsers/librewolf/src.nix
@ -1,5 +1,5 @@
-{ fetchurl, fetchFromGitLab }:
-let src = builtins.fromJSON (builtins.readFile ./src.json);
+{ lib, fetchurl, fetchFromGitLab }:
+let src = lib.importJSON ./src.json;
 in
 {
  inherit (src) packageVersion;
--- a/pkgs/applications/networking/browsers/vieb/default.nix
+++ b/pkgs/applications/networking/browsers/vieb/default.nix
@ -2,20 +2,20 @@

 buildNpmPackage rec {
  pname = "vieb";
-  version = "9.7.0";
+  version = "9.7.1";

  src = fetchFromGitHub {
    owner = "Jelmerro";
    repo = pname;
    rev = version;
-    hash = "sha256-uo5V5RRDSR+f9+AqojikrlybmtcWTmB7TPXEvLG9n4E=";
+    hash = "sha256-1G3hhqWMClxdwt3aOmnAbEV+n2ui5X6Cgf30391OVi0=";
  };

  postPatch = ''
    sed -i '/"electron"/d' package.json
  '';

-  npmDepsHash = "sha256-RUpeqbb8bnSQ6sCYH8O9mL3Rpb+ZlcPi7fq6LlbkSic=";
+  npmDepsHash = "sha256-t8fKbh9M63CCkxwlXj3zGvP8y5uLMqbyNd8BimBhIBc=";
  dontNpmBuild = true;

  nativeBuildInputs = [ makeWrapper ] ++ lib.optional stdenv.isAarch64 python3;
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "cloudflared";
-  version = "2023.4.2";
+  version = "2023.5.0";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "cloudflared";
    rev = "refs/tags/${version}";
-    hash = "sha256-oHiaRdTEiTcGQkYoGw8TT0KZMFR8Rkce/4+cxSXAHMM=";
+    hash = "sha256-0zUKlacB6aTj0UQ8dIQSU8F6SvVOTAU/GdbUqbJ8okI=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/bosh-cli/default.nix
+++ b/pkgs/applications/networking/cluster/bosh-cli/default.nix
@ -8,13 +8,13 @@
 buildGoModule rec {
  pname = "bosh-cli";

-  version = "7.2.2";
+  version = "7.2.3";

  src = fetchFromGitHub {
    owner = "cloudfoundry";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-cSix1muhmPrL7fDGznkFAOAoArZoDvptli7uRo71Dlk=";
+    sha256 = "sha256-sN6+hPH+VziXs94RkPdPlg6TKo/as4xC8Gd8MxAKluk=";
  };
  vendorHash = null;

--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cilium-cli";
-  version = "0.14.0";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-E/14YYX4EFakzBsaUxy1SZAaBCIKmgpWlY/9EazWWFI=";
+    sha256 = "sha256-y7R9+YxkPWVEjcN8Czfp8UC47AAAt554XLo/nStoGLY=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/kube-router/default.nix
+++ b/pkgs/applications/networking/cluster/kube-router/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kube-router";
-  version = "1.5.3";
+  version = "1.5.4";

  src = fetchFromGitHub {
    owner = "cloudnativelabs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-aO72wvq31kue75IKfEByhKxUwSSGGmPLzHDBSvTChTM=";
+    sha256 = "sha256-/ruSSq+iHmJDFHH+mLoqtdljAGlc15lXjTqq+luJIU8=";
  };

-  vendorSha256 = "sha256-+3uTIaXuiwbU0fUgn2th4RNDQ5gCDi3ntPMu92S+mXc=";
+  vendorHash = "sha256-U2TvH4TPBI6verEcyv0Z+ZFAKbADgzncJhW1IAJw4Ms=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/cluster/kubecm/default.nix
+++ b/pkgs/applications/networking/cluster/kubecm/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubecm";
-  version = "0.22.1";
+  version = "0.23.0";

  src = fetchFromGitHub {
    owner = "sunny0826";
    repo = "kubecm";
    rev = "v${version}";
-    hash = "sha256-0oQOuBYCDNnOODM2ZSqTgOI+jHWuHTtsk2NfGIPMy5A=";
+    hash = "sha256-BywtQ6YVGPz5A0GE2q0zRoBZNU6HZgVbr6H0OMR05wM=";
  };

-  vendorHash = "sha256-fVPiEDB6WFu2x5EY7NjmJEEq297QxP10593cXxxv8iI=";
+  vendorHash = "sha256-WZxjv4v2nfJjbzFfaDh2kE7ZBREB+Q8BmHhUrAiDd7g=";
  ldflags = [ "-s" "-w" "-X github.com/sunny0826/kubecm/version.Version=${version}"];

  doCheck = false;
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -9,14 +9,14 @@
    "vendorHash": null
  },
  "acme": {
-    "hash": "sha256-uyycmae+OAZ/dC4GReEF5xrClQvophLX1/EZv+kpFU4=",
+    "hash": "sha256-Q8uoWKdpo6S3XHyZrMvUqxY08IOoHmRhmS/3fuShr8s=",
    "homepage": "https://registry.terraform.io/providers/vancluever/acme",
    "owner": "vancluever",
    "proxyVendor": true,
    "repo": "terraform-provider-acme",
-    "rev": "v2.13.1",
+    "rev": "v2.14.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-C78RPGpENvn6mBm8xsnl3DXKUQ0xtdN8k25t8USigWE="
+    "vendorHash": "sha256-VizPxWLvNpZ9FAs8FGuBhXjJoxhePiB/RIzbNfiEwOQ="
  },
  "age": {
    "hash": "sha256-bJrzjvkrCX93bNqCA+FdRibHnAw6cb61StqtwUY5ok4=",
@ -110,11 +110,11 @@
    "vendorHash": null
  },
  "aws": {
-    "hash": "sha256-oD8I7wWLdn9Yv6naRcq0myg1L2DcvP/a6VL/fUfdC+g=",
+    "hash": "sha256-bJScfyTNDW0cKGp93cffDcZ/PZQ8trNbemHT5OoCkvg=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
    "owner": "hashicorp",
    "repo": "terraform-provider-aws",
-    "rev": "v4.66.0",
+    "rev": "v4.66.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-tetNRSjQTgFzFLSdmRL6f+UlwKp62zr00JzFXJs8nMs="
  },
@ -128,11 +128,11 @@
    "vendorHash": null
  },
  "azurerm": {
-    "hash": "sha256-1K+uM8uRpFigr9scvBL/FDoqc7TKh4ZnppEHnl8i8EA=",
+    "hash": "sha256-frIlEojIK/6KhPquliQPveP279bFHvLAy830bx6Yd2c=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
    "owner": "hashicorp",
    "repo": "terraform-provider-azurerm",
-    "rev": "v3.54.0",
+    "rev": "v3.55.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -182,11 +182,11 @@
    "vendorHash": "sha256-jOscYbwZ8m4smGiAy2vNhPMTAUnINkpuVRQ8E6LpWVw="
  },
  "buildkite": {
-    "hash": "sha256-nwGnt/+pSR1rGiXZ1RJIpekT+i0k4ZmMN27VpYCDVU0=",
+    "hash": "sha256-5R3aX0tzUnewsYguHlelYXn1JrfowrOCaqYtfvrnoSE=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v0.17.0",
+    "rev": "v0.17.1",
    "spdx": "MIT",
    "vendorHash": "sha256-ZXjmR1maiiLeWipXGOAGfLEuot9TsrzAX4EPRNQ5Gbo="
  },
@ -209,13 +209,13 @@
    "vendorHash": null
  },
  "cloudamqp": {
-    "hash": "sha256-cFXQgB++BcTKCFuJ3bMm8Qw3Zdr9m9d6LaZMz5tKXBM=",
+    "hash": "sha256-z7SE69j+9qlwO53xbvSvBQd41zL+1jDDhJ0ByfVEqqo=",
    "homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
    "owner": "cloudamqp",
    "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.26.0",
+    "rev": "v1.26.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wyPwStUCprrnq0S6jKzDqAXeWTZW43ml+vBOuX05eRs="
+    "vendorHash": "sha256-IXhs9fSrIKuhLUwamaSd8vY4ePK8DAre9crvonpUvys="
  },
  "cloudflare": {
    "hash": "sha256-0bHKQe4wIieKdxPF0S7Qv8QLlg+AZzBOG8n2qiMOM0g=",
@ -282,13 +282,13 @@
    "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
  },
  "datadog": {
-    "hash": "sha256-i6v55pIooA+7L5V2yNL+T2KCgGNLU5ZrqeKzdzdvNoA=",
+    "hash": "sha256-bay1hBIfgYBqY1SSpbezPMW4L6ZpJIYfH/5up13wgUo=",
    "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
    "owner": "DataDog",
    "repo": "terraform-provider-datadog",
-    "rev": "v3.24.1",
+    "rev": "v3.25.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-MMPE1Urnlt7QCoiEnHqWnFZzmeSs/i4UtiotyrXZF2U="
+    "vendorHash": "sha256-0KuoVcM/pvXMxdLL1HO6XsVTUOfQylzl6yGfQF6HdvQ="
  },
  "dhall": {
    "hash": "sha256-K0j90YAzYqdyJD4aofyxAJF9QBYNMbhSVm/s1GvWuJ4=",
@ -419,11 +419,11 @@
    "vendorHash": "sha256-uWTY8cFztXFrQQ7GW6/R+x9M6vHmsb934ldq+oeW5vk="
  },
  "github": {
-    "hash": "sha256-gMuQNI0+zvveVqyhRdIyPyxVNfdk6PUXpf4Iv2Y+jI4=",
+    "hash": "sha256-BDYnzyda7I+Oz3YVUSpR24S+FxZwRPjmBgFeyzr0iZQ=",
    "homepage": "https://registry.terraform.io/providers/integrations/github",
    "owner": "integrations",
    "repo": "terraform-provider-github",
-    "rev": "v5.24.0",
+    "rev": "v5.25.0",
    "spdx": "MIT",
    "vendorHash": null
  },
@ -728,13 +728,13 @@
    "vendorHash": "sha256-QxbZv6YMa5/I4bTeQBNdmG3EKtLEmstnH7HMiZzFJrI="
  },
  "minio": {
-    "hash": "sha256-URn6XFqKTE3nXE5ZcaXmRvGl6qLdffLLSoMRq70zh4I=",
+    "hash": "sha256-LL3jOuNNCd5isNPyt+I35j5BdxAbnWRQ2o2RBLSOc/E=",
    "homepage": "https://registry.terraform.io/providers/aminueza/minio",
    "owner": "aminueza",
    "repo": "terraform-provider-minio",
-    "rev": "v1.14.0",
+    "rev": "v1.15.0",
    "spdx": "Apache-2.0",
-    "vendorHash": "sha256-Mdy9uXYb7MH9XHqSNkG0QqTVzjvTy4+/Mr6VHXJBEZE="
+    "vendorHash": "sha256-Xz6WxAxzvLfgJTD2oDgZoeHffcdA7dyfgwY1g6lFkbk="
  },
  "mongodbatlas": {
    "hash": "sha256-NvKthj+rVT23v/V1C8w8CMTfOy3yNsMjg2knXECzay4=",
@ -1226,13 +1226,13 @@
    "vendorHash": null
  },
  "vsphere": {
-    "hash": "sha256-VScIcK4bInS9yhIYkYRsU8Hhzex9iyVkPiyjnnjshkI=",
+    "hash": "sha256-XVMTKYb9RuK5sErVHsP0j5otUEioxp6C7GV7/J6OYVA=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/vsphere",
    "owner": "hashicorp",
    "repo": "terraform-provider-vsphere",
-    "rev": "v2.3.1",
+    "rev": "v2.4.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-guUjkk7oW+Gvu015LUAxGqUwZF4H+4xmmOaMqKixZaI="
+    "vendorHash": "sha256-wKKrBSJkbdqqnDLoS+jhvI26rOzvMWjjsN8wh67Le5U="
  },
  "vultr": {
    "hash": "sha256-4Um4UyDjtamy2s15K3Idm5edZj5BOy13+kr39wl9e0Q=",
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@ -5,13 +5,13 @@ buildGoModule rec {
  /* Do not use "dev" as a version. If you do, Tilt will consider itself
    running in development environment and try to serve assets from the
    source tree, which is not there once build completes.  */
-  version = "0.32.2";
+  version = "0.32.3";

  src = fetchFromGitHub {
    owner  = "tilt-dev";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "sha256-YB/stG+7gxIaB+vMx8PwmUm4W32fCNeRnVrOvOXba5k=";
+    sha256 = "sha256-5QTZUapHhSSI+UZu77IUZdflCIm+oCu4kPQVhLHCsUQ=";
  };
  vendorHash = null;

--- a/pkgs/applications/networking/instant-messengers/zulip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zulip/default.nix
@ -5,11 +5,11 @@

 let
  pname = "zulip";
-  version = "5.9.5";
+  version = "5.10.0";

  src = fetchurl {
    url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
-    hash = "sha256-w2thmF/UA42j3u3m4L+/onilQhwMOa7IJoOMZ/ERypw=";
+    hash = "sha256-rfFEhoykCStFCyBasQV6Cpb5ey+wvQLMXloIR0A1z7g=";
    name="${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/networking/netmaker/default.nix
+++ b/pkgs/applications/networking/netmaker/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "netmaker";
-  version = "0.18.7";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "gravitl";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-XnBz5dUBu6VqxLFsBXOvdLu/LsrfyEp9MLR/+nNggBk=";
+    hash = "sha256-wiexultPliYD3WrLVtWUdLs762OzLAmoH66phwjOuUw=";
  };

-  vendorHash = "sha256-a2ecHdxX82/JScRPGKpgEtrISD7qkPoZyv9kvO6SzaQ=";
+  vendorHash = "sha256-Msvonap1soJExzBymouY8kZJnHT4SIwpfJjBgpkO2Rw=";

  inherit subPackages;

--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -39,14 +39,14 @@
 , makeWrapper
 , wrapGAppsHook
 , withQt ? true
-, qt5 ? null
+, qt6 ? null
 , ApplicationServices
 , SystemConfiguration
 , gmp
 , asciidoctor
 }:

-assert withQt -> qt5 != null;
+assert withQt -> qt6 != null;

 let
  version = "4.0.5";
@ -70,6 +70,7 @@ stdenv.mkDerivation {
    # Fix `extcap` and `plugins` paths. See https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16444
    "-DCMAKE_INSTALL_LIBDIR=lib"
    "-DLEMON_C_COMPILER=cc"
+    "-DUSE_qt6=ON"
  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
    "-DHAVE_C99_VSNPRINTF_EXITCODE=0"
    "-DHAVE_C99_VSNPRINTF_EXITCODE__TRYRUN_OUTPUT="
@ -79,7 +80,7 @@ stdenv.mkDerivation {
  env.NIX_CFLAGS_COMPILE = toString [ "-DQT_NO_DEBUG" ];

  nativeBuildInputs = [ asciidoctor bison cmake ninja flex makeWrapper pkg-config python3 perl ]
-    ++ lib.optionals withQt [ qt5.wrapQtAppsHook wrapGAppsHook ];
+    ++ lib.optionals withQt [ qt6.wrapQtAppsHook wrapGAppsHook ];

  depsBuildBuild = [ buildPackages.stdenv.cc ];

@ -108,11 +109,10 @@ stdenv.mkDerivation {
    c-ares
    glib
    zlib
-  ] ++ lib.optionals withQt (with qt5; [ qtbase qtmultimedia qtsvg qttools ])
-  ++ lib.optionals (withQt && stdenv.isLinux) [ qt5.qtwayland ]
+  ] ++ lib.optionals withQt (with qt6; [ qtbase qtmultimedia qtsvg qttools qt5compat ])
+  ++ lib.optionals (withQt && stdenv.isLinux) [ qt6.qtwayland ]
  ++ lib.optionals stdenv.isLinux [ libcap libnl sbc ]
-  ++ lib.optionals stdenv.isDarwin [ SystemConfiguration ApplicationServices gmp ]
-  ++ lib.optionals (withQt && stdenv.isDarwin) (with qt5; [ qtmacextras ]);
+  ++ lib.optionals stdenv.isDarwin [ SystemConfiguration ApplicationServices gmp ];

  strictDeps = true;

--- a/pkgs/applications/networking/soju/default.nix
+++ b/pkgs/applications/networking/soju/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "soju";
-  version = "0.5.2";
+  version = "0.6.1";

  src = fetchFromSourcehut {
    owner = "~emersion";
    repo = "soju";
    rev = "v${version}";
-    hash = "sha256-lpLWqaSFx/RJg73n5XNN/qUXHfZsBkbABoYcgxpK3rU=";
+    hash = "sha256-e3yA8gXuLxRzJIQQIjhajIOWVtikd+gNVxbhzfy56b0=";
  };

-  vendorHash = "sha256-n1wwi7I2hDLOe08RkJOiopDUGI6uhipNpBdeOLARIoU=";
+  vendorHash = "sha256-iT/QMm6RM6kvw69Az+aLTtBuaCX7ELAiYlj5wXAtBd4=";

  subPackages = [
    "cmd/soju"
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "treesheets";
-  version = "unstable-2023-05-03";
+  version = "unstable-2023-05-04";

  src = fetchFromGitHub {
    owner = "aardappel";
    repo = "treesheets";
-    rev = "b942b919a2f6b4e6d04ea62a4a82623f9e815cdd";
-    sha256 = "rfYEpbhfWiviojqWWMhmYjpDh04hfRPGPdDQtcqhr8o=";
+    rev = "3694b16809daaa59b9198cd9645662e2a8cf4650";
+    sha256 = "NShLLBTBS88UXWWjsSeMVxj8HnnN4yA8gmz83wdpIzE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/fldigi/default.nix
+++ b/pkgs/applications/radio/fldigi/default.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "fldigi";
-  version = "4.1.25";
+  version = "4.1.26";

  src = fetchurl {
    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-TsS/OS2mXwqsk+E+9MEoETIHRWks8Hg/qw8WRmAxB2M=";
+    sha256 = "sha256-RIrTWjQPnn0I8bzV3kMQEesNaAkIQnhikLMaYivrWRc=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/radio/noaa-apt/Cargo.lock
+++ b/pkgs/applications/radio/noaa-apt/Cargo.lock
--- a/pkgs/applications/radio/noaa-apt/default.nix
+++ b/pkgs/applications/radio/noaa-apt/default.nix
@ -13,13 +13,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "noaa-apt";
-  version = "1.3.1";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "martinber";
    repo = "noaa-apt";
    rev = "v${version}";
-    sha256 = "sha256-A78O5HkD/LyfvjLJjf7PpJDuftkNbaxq7Zs5kNUaULk=";
+    sha256 = "sha256-wmjglF2+BFmlTfvqt90nbCxuldN8AEFXj7y9tgTvA2Y=";
  };

  nativeBuildInputs = [
@ -55,15 +55,15 @@ rustPlatform.buildRustPackage rec {

    # Desktop icon.
    install -Dm644 -t $out/share/applications $src/debian/ar.com.mbernardi.noaa-apt.desktop
-    install -Dm644 -t $out/share/icons/hicolor/48x48/apps $src/debian/noaa-apt.png
-    install -Dm644 -t $out/share/icons/hicolor/scalable/apps $src/debian/noaa-apt.svg
+    install -Dm644 -t $out/share/icons/hicolor/48x48/apps $src/debian/ar.com.mbernardi.noaa-apt.png
+    install -Dm644 -t $out/share/icons/hicolor/scalable/apps $src/debian/ar.com.mbernardi.noaa-apt.svg
  '';

  meta = with lib; {
    description = "NOAA APT image decoder";
    homepage = "https://noaa-apt.mbernardi.com.ar/";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ trepetti ];
+    maintainers = with maintainers; [ trepetti tmarkus ];
    platforms = platforms.all;
    changelog = "https://github.com/martinber/noaa-apt/releases/tag/v${version}";
  };
--- a/pkgs/applications/science/astronomy/gnuastro/default.nix
+++ b/pkgs/applications/science/astronomy/gnuastro/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "gnuastro";
-  version = "0.19";
+  version = "0.20";

  src = fetchurl {
    url = "mirror://gnu/gnuastro/gnuastro-${version}.tar.gz";
-    sha256 = "sha256-4bPNW0sSb/J34vSOit8BA9Z/wK0Hz5o9OqfgVSlDDjU=";
+    sha256 = "sha256-kkuLtqwc0VFj3a3Dqb/bi4jKx7UJnV+CHs7bw/Cwac0=";
  };

  nativeBuildInputs = [ libtool ];
--- a/pkgs/applications/science/electronics/qucs-s/default.nix
+++ b/pkgs/applications/science/electronics/qucs-s/default.nix
@ -1,27 +1,39 @@
-{ stdenv, lib, fetchFromGitHub, flex, bison, qt4, libX11, cmake, gperf, adms,
-ngspice, wrapGAppsHook,
-kernels ? [ ngspice ] }:
+{ stdenv
+, lib
+, fetchFromGitHub
+, flex
+, bison
+, qtbase
+, qttools
+, qtsvg
+, qtwayland
+, wrapQtAppsHook
+, libX11
+, cmake
+, gperf
+, adms
+, ngspice
+, kernels ? [ ngspice ]
+}:

 stdenv.mkDerivation rec {
  pname = "qucs-s";
-  version = "0.0.22";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "ra3xdh";
    repo = "qucs_s";
    rev = version;
-    sha256 = "0rrq2ddridc09m6fixdmbngn42xmv8cmdf6r8zzn2s98fqib5qd6";
+    sha256 = "sha256-2YyVeeUnLBS1Si9gwEsQLZVG98715dz/v+WCYjB3QlI=";
  };

-  nativeBuildInputs = [ wrapGAppsHook cmake ];
-  buildInputs = [ flex bison qt4 libX11 gperf adms ] ++ kernels;
+  nativeBuildInputs = [ flex bison wrapQtAppsHook cmake ];
+  buildInputs = [ qtbase qttools qtsvg qtwayland libX11 gperf adms ] ++ kernels;

-  preConfigure = ''
-    # Make custom kernels avaible from qucs-s
-    gappsWrapperArgs+=(--prefix PATH ":" ${lib.escapeShellArg (lib.makeBinPath kernels)})
-  '';
+  # Make custom kernels avaible from qucs-s
+  qtWrapperArgs = [ "--prefix" "PATH" ":" (lib.makeBinPath kernels) ];

-  QTDIR=qt4;
+  QTDIR = qtbase.dev;

  doInstallCheck = true;
  installCheck = ''
--- a/pkgs/applications/science/electronics/verilog/default.nix
+++ b/pkgs/applications/science/electronics/verilog/default.nix
@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoconf
 , bison
 , bzip2
@ -7,56 +8,62 @@
 , gperf
 , ncurses
 , perl
+, python3
 , readline
 , zlib
 }:

-let
-  # iverilog-test has been merged to the main iverilog main source tree
-  # in January 2022, so it won't be longer necessary.
-  # For now let's fetch it from the separate repo, since 11.0 was released in 2020.
-  iverilog-test = fetchFromGitHub {
-    owner  = "steveicarus";
-    repo   = "ivtest";
-    rev    = "a19e629a1879801ffcc6f2e6256ca435c20570f3";
-    sha256 = "sha256-3EkmrAXU0/mRxrxp5Hy7C3yWTVK16L+tPqqeEryY/r8=";
-  };
-in
 stdenv.mkDerivation rec {
  pname   = "iverilog";
-  version = "11.0";
+  version = "12.0";

  src = fetchFromGitHub {
    owner  = "steveicarus";
    repo   = pname;
    rev    = "v${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "0nzcyi6l2zv9wxzsv9i963p3igyjds0n55x0ph561mc3pfbc7aqp";
+    hash   = "sha256-J9hedSmC6mFVcoDnXBtaTXigxrSCFa2AhhFd77ueo7I=";
  };

  nativeBuildInputs = [ autoconf bison flex gperf ];

+  CC_FOR_BUILD="${stdenv.cc}/bin/cc";
+  CXX_FOR_BUILD="${stdenv.cc}/bin/c++";
+
+  patches = [
+    # NOTE(jleightcap): `-Werror=format-security` warning patched shortly after release, backport the upstream fix
+    (fetchpatch {
+      name = "format-security";
+      url = "https://github.com/steveicarus/iverilog/commit/23e51ef7a8e8e4ba42208936e0a6a25901f58c65.patch";
+      hash = "sha256-fMWfBsCl2fuXe+6AR10ytb8QpC84bXlP5RSdrqsWzEk=";
+    })
+  ];
+
  buildInputs = [ bzip2 ncurses readline zlib ];

  preConfigure = "sh autoconf.sh";

  enableParallelBuilding = true;

-  nativeInstallCheckInputs = [ perl ];
+  # NOTE(jleightcap): the `make check` target only runs a "Hello, World"-esque sanity check.
+  # the tests in the doInstallCheck phase run a full regression test suite.
+  # however, these tests currently fail upstream on aarch64
+  # (see https://github.com/steveicarus/iverilog/issues/917)
+  # so disable the full suite for now.
+  doCheck = true;
+  doInstallCheck = !stdenv.isAarch64;
+
+  nativeInstallCheckInputs = [
+    perl
+    (python3.withPackages (pp: with pp; [
+      docopt
+    ]))
+  ];

  installCheckPhase = ''
-    # copy tests to allow writing results
-    export TESTDIR=$(mktemp -d)
-    cp -r ${iverilog-test}/* $TESTDIR
-
-    pushd $TESTDIR
-
-    # Run & check tests
-    PATH=$out/bin:$PATH perl vvp_reg.pl
-    # Check the tests, will error if unexpected tests fail. Some failures MIGHT be normal.
-    diff regression_report-devel.txt regression_report.txt
-    PATH=$out/bin:$PATH perl vpi_reg.pl
-
-    popd
+    runHook preInstallCheck
+    export PATH="$PATH:$out/bin"
+    sh .github/test.sh
+    runHook postInstallCheck
  '';

  meta = with lib; {
--- a/pkgs/applications/version-management/git-extras/default.nix
+++ b/pkgs/applications/version-management/git-extras/default.nix
@ -42,6 +42,6 @@ stdenv.mkDerivation rec {
    description = "GIT utilities -- repo summary, repl, changelog population, author commit percentages and more";
    license = licenses.mit;
    platforms = platforms.all;
-    maintainers = with maintainers; [ spwhitt cko SuperSandro2000 ];
+    maintainers = with maintainers; [ cko SuperSandro2000 ];
  };
 }
--- a/pkgs/applications/version-management/git-imerge/default.nix
+++ b/pkgs/applications/version-management/git-imerge/default.nix
@ -19,6 +19,6 @@ buildPythonApplication rec {
    homepage = "https://github.com/mhagger/git-imerge";
    description = "Perform a merge between two branches incrementally";
    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.spwhitt ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@ -19,6 +19,7 @@
 , pkg-config, glib, libsecret
 , gzip # needed at runtime by gitweb.cgi
 , withSsh ? false
+, sysctl
 , doInstallCheck ? !stdenv.isDarwin  # extremely slow on darwin
 , tests
 }:
@ -294,6 +295,8 @@ stdenv.mkDerivation (finalAttrs: {
    "PERL_PATH=${buildPackages.perl}/bin/perl"
  ];

+  nativeInstallCheckInputs = lib.optional stdenv.isDarwin sysctl;
+
  preInstallCheck = ''
    installCheckFlagsArray+=(
      GIT_PROVE_OPTS="--jobs $NIX_BUILD_CORES --failures --state=failed,save"
--- a/pkgs/applications/window-managers/i3/status-rust.nix
+++ b/pkgs/applications/window-managers/i3/status-rust.nix
@ -15,16 +15,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "i3status-rust";
-  version = "0.31.1";
+  version = "0.31.2";

  src = fetchFromGitHub {
    owner = "greshake";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-nAwAQUjoKeGaTixTdk9yIgdy4+j6t6cbvH4NpBdSyns=";
+    hash = "sha256-4lr2ibtBtJYXeeArBK4M35L4CUNqZcUDB+3Nm1kqp4w=";
  };

-  cargoHash = "sha256-/Z6HKOMIhQm52MlPty8ED9QPPJcM7juDpQQKgJVozyU=";
+  cargoHash = "sha256-5LIXzfYSuHOdxYxfp1eMdxsqyP+3sldBCV0mgv7SRRI=";

  nativeBuildInputs = [ pkg-config makeWrapper ];

--- a/pkgs/build-support/flutter/default.nix
+++ b/pkgs/build-support/flutter/default.nix
@ -135,11 +135,11 @@ let
  packageOverrideRepository = (callPackage ../../development/compilers/flutter/package-overrides { }) // customPackageOverrides;
  productPackages = builtins.filter (package: package.kind != "dev")
    (if autoDepsList
-    then builtins.fromJSON (builtins.readFile deps.depsListFile)
+    then lib.importJSON deps.depsListFile
    else
      if depsListFile == null
      then [ ]
-      else builtins.fromJSON (builtins.readFile depsListFile));
+      else lib.importJSON depsListFile);
 in
 builtins.foldl'
  (prev: package:
--- a/pkgs/build-support/ocaml/dune.nix
+++ b/pkgs/build-support/ocaml/dune.nix
@ -3,7 +3,7 @@
 { pname, version, nativeBuildInputs ? [], enableParallelBuilding ? true, ... }@args:

 let Dune =
-  let dune-version = args . duneVersion or (if args.useDune2 or true then "2" else "1"); in
+  let dune-version = args.duneVersion or "2"; in
  { "1" = dune_1; "2" = dune_2; "3" = dune_3; }."${dune-version}"
 ; in

@ -39,7 +39,7 @@ stdenv.mkDerivation ({

  strictDeps = true;

-} // (builtins.removeAttrs args [ "minimalOCamlVersion"  "duneVersion" ]) // {
+} // (builtins.removeAttrs args [ "minimalOCamlVersion" "duneVersion" ]) // {

  name = "ocaml${ocaml.version}-${pname}-${version}";

--- a/pkgs/data/fonts/lxgw-wenkai/default.nix
+++ b/pkgs/data/fonts/lxgw-wenkai/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "lxgw-wenkai";
-  version = "1.250";
+  version = "1.300";

  src = fetchurl {
    url = "https://github.com/lxgw/LxgwWenKai/releases/download/v${version}/${pname}-v${version}.tar.gz";
-    hash = "sha256-Nkd0xXYCnR0NZAk/JCxy+zOlxIxD52Px4F9o2L9mgRE=";
+    hash = "sha256-pPN8siF/8D78sEcXoF+vZ4BIeYWyXAuk4HBQJP+G3O8=";
  };

  installPhase = ''
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@ -89,7 +89,7 @@ rec {
      };
    };

-  mkNotoCJK = { typeface, version, rev, sha256 }:
+  mkNotoCJK = { typeface, version, sha256 }:
    stdenvNoCC.mkDerivation {
      pname = "noto-fonts-cjk-${lib.toLower typeface}";
      inherit version;
@ -97,7 +97,8 @@ rec {
      src = fetchFromGitHub {
        owner = "googlefonts";
        repo = "noto-cjk";
-        inherit rev sha256;
+        rev = "${typeface}${version}";
+        inherit sha256;
        sparseCheckout = [ "${typeface}/Variable/OTC" ];
      };

@ -154,15 +155,13 @@ rec {
  noto-fonts-cjk-sans = mkNotoCJK {
    typeface = "Sans";
    version = "2.004";
-    rev = "9f7f3c38eab63e1d1fddd8d50937fe4f1eacdb1d";
-    sha256 = "sha256-PWpcTBnBRK87ZuRI/PsGp2UMQgCCyfkLHwvB1mOl5K0=";
+    sha256 = "sha256-IgalJkiOAVjNxKaPAQWfb5hKeqclliR4qVXCq63FGWY=";
  };

  noto-fonts-cjk-serif = mkNotoCJK {
    typeface = "Serif";
-    version = "2.000";
-    rev = "9f7f3c38eab63e1d1fddd8d50937fe4f1eacdb1d";
-    sha256 = "sha256-1w66Ge7DZjbONGhxSz69uFhfsjMsDiDkrGl6NsoB7dY=";
+    version = "2.001";
+    sha256 = "sha256-y1103SS0qkZMhEL5+7kQZ+OBs5tRaqkqOcs4796Fzhg=";
  };

  noto-fonts-emoji =
--- a/pkgs/data/misc/hackage/default.nix
+++ b/pkgs/data/misc/hackage/default.nix
@ -2,7 +2,7 @@
 # and callHackage
 { lib, fetchurl }:
 let
-  pin = builtins.fromJSON (builtins.readFile ./pin.json);
+  pin = lib.importJSON ./pin.json;
 in
 fetchurl {
  inherit (pin) url sha256;
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "v2ray-geoip";
-  version = "202304270044";
+  version = "202305040042";

  src = fetchFromGitHub {
    owner = "v2fly";
    repo = "geoip";
-    rev = "015e040dbd71ec79f57555d9c2721326e4254b34";
-    sha256 = "sha256-yY+mEsnc4x6zgslpu8755tGt7I17xBB1RXdAzSLtf2U=";
+    rev = "ef62a770a54006accfdfa8e3e38e2bdf5997baf0";
+    sha256 = "sha256-CThhxFVBIz9H0YiI3+fdy76kwq7bsMdONyRAvMQ5VrA=";
  };

  installPhase = ''
--- a/pkgs/data/themes/obsidian2/default.nix
+++ b/pkgs/data/themes/obsidian2/default.nix
@ -1,21 +1,26 @@
 { lib
-, stdenv
+, stdenvNoCC
 , fetchurl
 , gtk-engine-murrine
+, jdupes
 , gitUpdater
 }:

-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
  pname = "theme-obsidian2";
-  version = "2.22";
+  version = "2.23";

  src = fetchurl {
    url = "https://github.com/madmaxms/theme-obsidian-2/releases/download/v${version}/obsidian-2-theme.tar.xz";
-    sha256 = "sha256-WvSlzCock0UMdvajHRBNHSugVMStR1FDt9vjzX5Kp8A=";
+    sha256 = "sha256-yJoMS5XrHlMss+rdJ+xLJx0F9Hs1Cc+MFk+xyhRXaf0=";
  };

  sourceRoot = ".";

+  nativeBuildInputs = [
+    jdupes
+  ];
+
  propagatedUserEnvPkgs = [
    gtk-engine-murrine
  ];
@ -24,6 +29,7 @@ stdenv.mkDerivation rec {
    runHook preInstall
    mkdir -p $out/share/themes
    cp -a Obsidian-2* $out/share/themes
+    jdupes --quiet --link-soft --recurse $out/share
    runHook postInstall
  '';

--- a/pkgs/desktops/cinnamon/default.nix
+++ b/pkgs/desktops/cinnamon/default.nix
@ -38,6 +38,8 @@ lib.makeScope pkgs.newScope (self: with self; {
  nemo-with-extensions = callPackage ./nemo/wrapper.nix { };
  mint-artwork = callPackage ./mint-artwork { };
  mint-cursor-themes = callPackage ./mint-cursor-themes { };
+  mint-l-icons = callPackage ./mint-l-icons { };
+  mint-l-theme = callPackage ./mint-l-theme { };
  mint-themes = callPackage ./mint-themes { };
  mint-x-icons = callPackage ./mint-x-icons { };
  mint-y-icons = callPackage ./mint-y-icons { };
--- a/pkgs/desktops/cinnamon/mint-l-icons/default.nix
+++ b/pkgs/desktops/cinnamon/mint-l-icons/default.nix
@ -0,0 +1,53 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+, gnome
+, gnome-icon-theme
+, hicolor-icon-theme
+, gtk3
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "mint-l-icons";
+  version = "1.6.4";
+
+  src = fetchFromGitHub {
+    owner = "linuxmint";
+    repo = pname;
+    rev = version;
+    hash = "sha256-C6BnBIOKeewsaQPPXWWo70eQpO1pJS0+xVQghPj/TTE=";
+  };
+
+  propagatedBuildInputs = [
+    gnome.adwaita-icon-theme
+    gnome-icon-theme
+    hicolor-icon-theme
+  ];
+
+  nativeBuildInputs = [
+    gtk3
+  ];
+
+  dontDropIconThemeCache = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    mv usr/share $out
+
+    for theme in $out/share/icons/*; do
+      gtk-update-icon-cache $theme
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/linuxmint/mint-l-icons";
+    description = "Mint-L icon theme";
+    license = licenses.gpl3Plus; # from debian/copyright
+    platforms = platforms.linux;
+    maintainers = teams.cinnamon.members;
+  };
+}
--- a/pkgs/desktops/cinnamon/mint-l-theme/default.nix
+++ b/pkgs/desktops/cinnamon/mint-l-theme/default.nix
@ -0,0 +1,46 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+, python3
+, sassc
+, sass
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "mint-l-theme";
+  version = "1.9.3";
+
+  src = fetchFromGitHub {
+    owner = "linuxmint";
+    repo = pname;
+    rev = version;
+    hash = "sha256-x+elC1NWcd+x8dNewwKPZBdkxSzEbo7jsG8B9DcWdoA=";
+  };
+
+  nativeBuildInputs = [
+    python3
+    sassc
+    sass
+  ];
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    mv usr/share $out
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/linuxmint/mint-l-theme";
+    description = "Mint-L theme for the Cinnamon desktop";
+    license = licenses.gpl3Plus; # from debian/copyright
+    platforms = platforms.linux;
+    maintainers = teams.cinnamon.members;
+  };
+}
--- a/pkgs/desktops/gnome/core/gdm/default.nix
+++ b/pkgs/desktops/gnome/core/gdm/default.nix
@ -43,13 +43,13 @@ in

 stdenv.mkDerivation rec {
  pname = "gdm";
-  version = "44.0";
+  version = "44.1";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gdm/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "ziCwoiHb+M3gBktQH9jzj3ODkVKFfEU1M36wnMUvf2w=";
+    sha256 = "aCZrOr59KPxGnQBnqsnF2rsMp5UswffCOKBJUfPcWw0=";
  };

  mesonFlags = [
--- a/pkgs/desktops/gnome/core/zenity/default.nix
+++ b/pkgs/desktops/gnome/core/zenity/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch2
 , meson
 , ninja
 , pkg-config
@ -15,13 +16,41 @@

 stdenv.mkDerivation rec {
  pname = "zenity";
-  version = "3.91.0";
+  version = "3.92.0";

  src = fetchurl {
    url = "mirror://gnome/sources/zenity/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "N2GeCYAwgXj9vPaDItmaB7MzbBwLuY7ysyycsQkCI5k=";
+    sha256 = "bSvCP2bL2PfhlVVvDDG9ZfClx4vLGuow6XFty/qxqKk=";
  };

+  patches = [
+    # Add non-fatal deprecation warning for --attach, --icon-name, --hint
+    # To reduce issues like https://github.com/BuddiesOfBudgie/budgie-desktop/issues/356
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/zenity/-/commit/181ca36ad4790b425f79b20be40dd25804208463.patch";
+      sha256 = "Z6XOn5XnBzJSti8tD4EGezCpHmYAsIxBf7s4W3rBc9I=";
+    })
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/zenity/-/commit/70abb01173562dba40916c522bd20b4ba5a55904.patch";
+      sha256 = "yBm7AxJiTPh2BFb+79L4WSh8xOcM6AHuvLzIEEFY80s=";
+    })
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/zenity/-/commit/df445feb0c0fab6865d96fb693a32fbc26503d83.patch";
+      sha256 = "DTeBCsahceNZCfNziO2taXiMEdAFgm5Bx9OrlZv0LsM=";
+    })
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/zenity/-/commit/54bd43cbe30fbe5c9f01e42e8f3de63405770e2a.patch";
+      sha256 = "tR9CKt24w7D3EA6FLu6qroS5rTkfIsaQnuY4KzgDKMY=";
+    })
+
+    # Restore the availability of running multiple instances of zenity
+    # https://gitlab.gnome.org/GNOME/zenity/-/issues/58
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/zenity/-/commit/cd32ad7d3fa66dccc77d96a0fd3a61bf137250f6.patch";
+      sha256 = "4XCuJgXsNIiBXv4NM1JRoiqgBqyxnro0HHapkK2fM8o=";
+    })
+  ];
+
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/desktops/mate/engrampa/default.nix
+++ b/pkgs/desktops/mate/engrampa/default.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "engrampa";
-  version = "1.26.0";
+  version = "1.26.1";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1qsy0ynhj1v0kyn3g3yf62g31rwxmpglfh9xh0w5lc9j5k1b5kcp";
+    sha256 = "8CJBB6ek6epjCcnniqX6rIAsTPcqSawoOqnnrh6KbEo=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/marco/default.nix
+++ b/pkgs/desktops/mate/marco/default.nix
@ -21,11 +21,11 @@

 stdenv.mkDerivation rec {
  pname = "marco";
-  version = "1.26.1";
+  version = "1.26.2";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "tPpVUL+J1Pnv9a5ufWFQ42YaItUw1q3cZ1e86N0qXT0=";
+    sha256 = "EvGiVP4QcvAwSIRxHgiaVoJ4CgEVk0Au043muUgOB6M=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@ -3,7 +3,7 @@
 let

  # To control nodejs version we pass down
-  nodejs = pkgs.nodejs_14;
+  nodejs = pkgs.nodejs_16;

  fetchElmDeps = pkgs.callPackage ./fetchElmDeps.nix { };

--- a/pkgs/development/compilers/jetbrains-jdk/jcef.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/jcef.nix
@ -75,9 +75,12 @@ let rpath = lib.makeLibraryPath [
 buildType = if debugBuild then "Debug" else "Release";

 in stdenv.mkDerivation rec {
-  name = "jcef-jetbrains";
-  rev = "153d40c761a25a745d7ebf0ee3a024bbc2c840b5";
-  commit-num = "611";  # Run `git rev-list --count HEAD`
+  pname = "jcef-jetbrains";
+  rev = "3dfde2a70f1f914c6a84ba967123a0e38f51053f";
+  # This is the commit number
+  # Currently from the 231 branch: https://github.com/JetBrains/jcef/tree/231
+  # Run `git rev-list --count HEAD`
+  version = "654";

  nativeBuildInputs = [ cmake python3 jdk17 git rsync ant ninja ];
  buildInputs = [ libX11 libXdamage nss nspr ];
@ -86,7 +89,7 @@ in stdenv.mkDerivation rec {
    owner = "jetbrains";
    repo = "jcef";
    inherit rev;
-    hash = "sha256-Vud4nIT2c7uOK7GKKw3plf41WzKqhg+2xpIwB/LyqnE=";
+    hash = "sha256-g8jWzRI2uYzu8O7JHENn0u9yY08fvY6g0Uym02oYUMI=";
  };
  cef-bin = let
    fileName = "cef_binary_104.4.26+g4180781+chromium-104.0.5112.102_linux64_minimal";
@ -116,7 +119,7 @@ in stdenv.mkDerivation rec {
      -e 's|os.path.isdir(os.path.join(path, \x27.git\x27))|True|' \
      -e 's|"%s rev-parse %s" % (git_exe, branch)|"echo '${rev}'"|' \
      -e 's|"%s config --get remote.origin.url" % git_exe|"echo 'https://github.com/jetbrains/jcef'"|' \
-      -e 's|"%s rev-list --count %s" % (git_exe, branch)|"echo '${commit-num}'"|' \
+      -e 's|"%s rev-list --count %s" % (git_exe, branch)|"echo '${version}'"|' \
      -i tools/git_util.py

    cp ${clang-fmt} tools/buildtools/linux64/clang-format
--- a/pkgs/development/compilers/terra/default.nix
+++ b/pkgs/development/compilers/terra/default.nix
@ -32,13 +32,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "terra";
-  version = "1.0.6";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "terralang";
    repo = "terra";
    rev = "release-${version}";
-    sha256 = "1bs76ibzb469rlqs7slw8pm65csjq1nf0lqh6i9kcvbzavmdfds7";
+    sha256 = "0v9vpxcp9ybwnfljskqn41vjq7c0srdfv7qs890a6480pnk4kavd";
  };

  nativeBuildInputs = [ cmake ];
@ -50,6 +50,7 @@ in stdenv.mkDerivation rec {
    "-DHAS_TERRA_VERSION=0"
    "-DTERRA_VERSION=${version}"
    "-DTERRA_LUA=luajit"
+    "-DTERRA_SKIP_LUA_DOWNLOAD=ON"
    "-DCLANG_RESOURCE_DIR=${llvmMerged}/lib/clang/${clangVersion}"
  ] ++ lib.optional enableCUDA "-DTERRA_ENABLE_CUDA=ON";

@ -60,9 +61,6 @@ in stdenv.mkDerivation rec {
  patches = [ ./nix-cflags.patch ];

  postPatch = ''
-    sed -i '/file(DOWNLOAD "''${LUAJIT_URL}" "''${LUAJIT_TAR}")/d' \
-      cmake/Modules/GetLuaJIT.cmake
-
    substituteInPlace src/terralib.lua \
      --subst-var-by NIX_LIBC_INCLUDE ${lib.getDev stdenv.cc.libc}/include
  '';
--- a/pkgs/development/interpreters/rakudo/default.nix
+++ b/pkgs/development/interpreters/rakudo/default.nix
@ -1,12 +1,15 @@
-{ stdenv, fetchurl, perl, icu, zlib, gmp, lib, nqp, removeReferencesTo }:
+{ stdenv, fetchFromGitHub, perl, icu, zlib, gmp, lib, nqp, removeReferencesTo }:

 stdenv.mkDerivation rec {
  pname = "rakudo";
-  version = "2023.02";
+  version = "2023.04";

-  src = fetchurl {
-    url = "https://rakudo.org/dl/rakudo/rakudo-${version}.tar.gz";
-    hash = "sha256-/RaGqizzLrnw630Nb5bfyJfPU8z4ntp9Iltoc4CTqhE=";
+  src = fetchFromGitHub {
+    owner = "rakudo";
+    repo = "rakudo";
+    rev = version;
+    hash = "sha256-m5rXriBKfp/i9AIcBGCYGfXIGBRsxgVmBbLJPXXc5AY=";
+    fetchSubmodules = true;
  };

  nativeBuildInputs = [ removeReferencesTo ];
--- a/pkgs/development/interpreters/rakudo/moarvm.nix
+++ b/pkgs/development/interpreters/rakudo/moarvm.nix
@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitHub
 , perl
 , CoreServices
 , ApplicationServices
@ -8,11 +8,14 @@

 stdenv.mkDerivation rec {
  pname = "moarvm";
-  version = "2023.02";
+  version = "2023.04";

-  src = fetchurl {
-    url = "https://moarvm.org/releases/MoarVM-${version}.tar.gz";
-    hash = "sha256-Z+IU1E1fYmeHyn8EQkBDpjkwikOnd3tvpBkmtyQODcU=";
+  src = fetchFromGitHub {
+    owner = "moarvm";
+    repo = "moarvm";
+    rev = version;
+    hash = "sha256-QYA4nSsrouYFaw1eju/6gNWwMcE/VeL0sNJmsTvtU3I=";
+    fetchSubmodules = true;
  };

  postPatch = ''
--- a/pkgs/development/interpreters/rakudo/nqp.nix
+++ b/pkgs/development/interpreters/rakudo/nqp.nix
@ -1,12 +1,15 @@
-{ stdenv, fetchurl, perl, lib, moarvm }:
+{ stdenv, fetchFromGitHub, perl, lib, moarvm }:

 stdenv.mkDerivation rec {
  pname = "nqp";
-  version = "2023.02";
+  version = "2023.04";

-  src = fetchurl {
-    url = "https://github.com/raku/nqp/releases/download/${version}/nqp-${version}.tar.gz";
-    hash = "sha256-417V7ZTsMqbXMO6BW/hcX8+IqGf6xlZjaMGtSf5jtT8=";
+  src = fetchFromGitHub {
+    owner = "raku";
+    repo = "nqp";
+    rev = version;
+    hash = "sha256-6V9d01aacDc+770XPSbQd4m1bg7Bbe47TTNOUxc2Fpw=";
+    fetchSubmodules = true;
  };

  buildInputs = [ perl ];
--- a/pkgs/development/interpreters/renpy/default.nix
+++ b/pkgs/development/interpreters/renpy/default.nix
@ -3,15 +3,16 @@
 , makeWrapper
 }:

-stdenv.mkDerivation rec {
-  pname = "renpy";
-
+let
  # https://renpy.org/doc/html/changelog.html#versioning
  # base_version is of the form major.minor.patch
  # vc_version is of the form YYMMDDCC
  # version corresponds to the tag on GitHub
  base_version = "8.0.3";
  vc_version = "22090809";
+in stdenv.mkDerivation rec {
+  pname = "renpy";
+
  version = "${base_version}.${vc_version}";

  src = fetchFromGitHub {
@ -46,7 +47,7 @@ stdenv.mkDerivation rec {

  postPatch = ''
    substituteInPlace module/setup.py \
-      --replace "@fribidi@" "${fribidi}"
+      --replace "@fribidi@" "${fribidi.dev}"

    cp tutorial/game/tutorial_director.rpy{m,}

@ -87,4 +88,6 @@ stdenv.mkDerivation rec {
    platforms = platforms.linux;
    maintainers = with maintainers; [ shadowrz ];
  };
+
+  passthru = { inherit base_version vc_version; };
 }
--- a/pkgs/development/libraries/dsdcc/default.nix
+++ b/pkgs/development/libraries/dsdcc/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "dsdcc";
-  version = "1.9.3";
+  version = "1.9.4";

  src = fetchFromGitHub {
    owner = "f4exb";
    repo = "dsdcc";
    rev = "v${version}";
-    sha256 = "sha256-8lO2c4fkQCaVO8IM05+Rdpo6oMxoEIObBm0y08i+/0k=";
+    sha256 = "sha256-EsjmU0LQOXnOoTFrnn63hAbvqbE6NVlSQTngot5Zuf4=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/faudio/default.nix
+++ b/pkgs/development/libraries/faudio/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "faudio";
-  version = "23.04";
+  version = "23.05";

  src = fetchFromGitHub {
    owner = "FNA-XNA";
    repo = "FAudio";
    rev = version;
-    sha256 = "sha256-XajCJ8wmKzvLxPaA/SVETRiDM3gcd3NFxmdoz+WzkF8=";
+    sha256 = "sha256-uZSKbLQ36Kw6useAKyDoxLKD1xtKbigq/ejWErxvkcE=";
  };

  nativeBuildInputs = [cmake];
--- a/pkgs/development/libraries/fftw/default.nix
+++ b/pkgs/development/libraries/fftw/default.nix
@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Fastest Fourier Transform in the West library";
    homepage = "http://www.fftw.org/";
    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.spwhitt ];
+    maintainers = [ ];
    pkgConfigModules = [
      {
        "single" = "fftw3f";
--- a/pkgs/development/libraries/gcc/libgcc/default.nix
+++ b/pkgs/development/libraries/gcc/libgcc/default.nix
@ -78,8 +78,7 @@ stdenvNoLibs.mkDerivation rec {
        tm.h \
        options.h \
        insn-constants.h \
-        insn-modes.h \
-        gcov-iov.h
+        insn-modes.h
    )
    mkdir -p "$buildRoot/gcc/include"
  ''
@ -141,6 +140,9 @@ stdenvNoLibs.mkDerivation rec {
    # Do not have dynamic linker without libc
    "--enable-static"
    "--disable-shared"
+
+    # Avoid dependency on gcc.
+    "--disable-gcov"
  ];

  makeFlags = [ "MULTIBUILDTOP:=../" ];
--- a/Show more
+++ b/Show more