Merge master into staging-next

2023-09-26 18:01:12 +00:00 · 2023-09-26 18:01:12 +00:00 · 4bfb61a48c
commit 4bfb61a48c
parent 2717201e72 8ab2b1221d
72 changed files with 4806 additions and 9077 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -759,6 +759,12 @@
    github = "Alexnortung";
    githubId = 1552267;
  };
+  alexoundos = {
+    email = "alexoundos@gmail.com";
+    github = "AleXoundOS";
+    githubId = 464913;
+    name = "Alexander Tomokhov";
+  };
  alexshpilkin = {
    email = "ashpilkin@gmail.com";
    github = "alexshpilkin";
@ -11409,6 +11415,12 @@
    githubId = 43088426;
    name = "Mihnea Stoian";
  };
+  mikaelfangel = {
+    email = "nixpkgs.bottle597@passfwd.com";
+    github = "MikaelFangel";
+    githubId = 34864484;
+    name = "Mikael Fangel";
+  };
  mikefaille = {
    email = "michael@faille.io";
    github = "mikefaille";
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -46,6 +46,8 @@

 - [GoToSocial](https://gotosocial.org/), an ActivityPub social network server, written in Golang. Available as [services.gotosocial](#opt-services.gotosocial.enable).

+- [Castopod](https://castopod.org/), an open-source hosting platform made for podcasters who want to engage and interact with their audience. Available as [services.castopod](#opt-services.castopod.enable).
+
 - [Typesense](https://github.com/typesense/typesense), a fast, typo-tolerant search engine for building delightful search experiences. Available as [services.typesense](#opt-services.typesense.enable).

 * [NS-USBLoader](https://github.com/developersu/ns-usbloader/), an all-in-one tool for managing Nintendo Switch homebrew. Available as [programs.ns-usbloader](#opt-programs.ns-usbloader.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -324,6 +324,7 @@
  ./services/amqp/rabbitmq.nix
  ./services/audio/alsa.nix
  ./services/audio/botamusique.nix
+  ./services/audio/castopod.nix
  ./services/audio/gmediarender.nix
  ./services/audio/gonic.nix
  ./services/audio/goxlr-utility.nix
--- a/nixos/modules/services/audio/castopod.md
+++ b/nixos/modules/services/audio/castopod.md
@ -0,0 +1,22 @@
+# Castopod {#module-services-castopod}
+
+Castopod is an open-source hosting platform made for podcasters who want to engage and interact with their audience.
+
+## Quickstart {#module-services-castopod-quickstart}
+
+Use the following configuration to start a public instance of Castopod on `castopod.example.com` domain:
+
+```nix
+networking.firewall.allowedTCPPorts = [ 80 443 ];
+services.castopod = {
+  enable = true;
+  database.createLocally = true;
+  nginx.virtualHost = {
+    serverName = "castopod.example.com";
+    enableACME = true;
+    forceSSL = true;
+  };
+};
+```
+
+Go to `https://castopod.example.com/cp-install` to create superadmin account after applying the above configuration.
--- a/nixos/modules/services/audio/castopod.nix
+++ b/nixos/modules/services/audio/castopod.nix
@ -0,0 +1,287 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.castopod;
+  fpm = config.services.phpfpm.pools.castopod;
+
+  user = "castopod";
+  stateDirectory = "/var/lib/castopod";
+
+  # https://docs.castopod.org/getting-started/install.html#requirements
+  phpPackage = pkgs.php.withExtensions ({ enabled, all }: with all; [
+    intl
+    curl
+    mbstring
+    gd
+    exif
+    mysqlnd
+  ] ++ enabled);
+in
+{
+  meta.doc = ./castopod.md;
+  meta.maintainers = with lib.maintainers; [ alexoundos misuzu ];
+
+  options.services = {
+    castopod = {
+      enable = lib.mkEnableOption (lib.mdDoc "Castopod");
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.castopod;
+        defaultText = lib.literalMD "pkgs.castopod";
+        description = lib.mdDoc "Which Castopod package to use.";
+      };
+      database = {
+        createLocally = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = lib.mdDoc ''
+            Create the database and database user locally.
+          '';
+        };
+        hostname = lib.mkOption {
+          type = lib.types.str;
+          default = "localhost";
+          description = lib.mdDoc "Database hostname.";
+        };
+        name = lib.mkOption {
+          type = lib.types.str;
+          default = "castopod";
+          description = lib.mdDoc "Database name.";
+        };
+        user = lib.mkOption {
+          type = lib.types.str;
+          default = user;
+          description = lib.mdDoc "Database user.";
+        };
+        passwordFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          example = "/run/keys/castopod-dbpassword";
+          description = lib.mdDoc ''
+            A file containing the password corresponding to
+            [](#opt-services.castopod.database.user).
+          '';
+        };
+      };
+      settings = lib.mkOption {
+        type = with lib.types; attrsOf (oneOf [ str int bool ]);
+        default = { };
+        example = {
+          "email.protocol" = "smtp";
+          "email.SMTPHost" = "localhost";
+          "email.SMTPUser" = "myuser";
+          "email.fromEmail" = "castopod@example.com";
+        };
+        description = lib.mdDoc ''
+          Environment variables used for Castopod.
+          See [](https://code.castopod.org/adaures/castopod/-/blob/main/.env.example)
+          for available environment variables.
+        '';
+      };
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        example = "/run/keys/castopod-env";
+        description = lib.mdDoc ''
+          Environment file to inject e.g. secrets into the configuration.
+          See [](https://code.castopod.org/adaures/castopod/-/blob/main/.env.example)
+          for available environment variables.
+        '';
+      };
+      configureNginx = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = lib.mdDoc "Configure nginx as a reverse proxy for CastoPod.";
+      };
+      localDomain = lib.mkOption {
+        type = lib.types.str;
+        example = "castopod.example.org";
+        description = lib.mdDoc "The domain serving your CastoPod instance.";
+      };
+      poolSettings = lib.mkOption {
+        type = with lib.types; attrsOf (oneOf [ str int bool ]);
+        default = {
+          "pm" = "dynamic";
+          "pm.max_children" = "32";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "2";
+          "pm.max_spare_servers" = "4";
+          "pm.max_requests" = "500";
+        };
+        description = lib.mdDoc ''
+          Options for Castopod's PHP pool. See the documentation on `php-fpm.conf` for details on configuration directives.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.castopod.settings =
+      let
+        sslEnabled = with config.services.nginx.virtualHosts.${cfg.localDomain}; addSSL || forceSSL || onlySSL || enableACME || useACMEHost != null;
+        baseURL = "http${lib.optionalString sslEnabled "s"}://${cfg.localDomain}";
+      in
+      lib.mapAttrs (name: lib.mkDefault) {
+        "app.forceGlobalSecureRequests" = sslEnabled;
+        "app.baseURL" = baseURL;
+
+        "media.baseURL" = "/";
+        "media.root" = "media";
+        "media.storage" = stateDirectory;
+
+        "admin.gateway" = "admin";
+        "auth.gateway" = "auth";
+
+        "database.default.hostname" = cfg.database.hostname;
+        "database.default.database" = cfg.database.name;
+        "database.default.username" = cfg.database.user;
+        "database.default.DBPrefix" = "cp_";
+
+        "cache.handler" = "file";
+      };
+
+    services.phpfpm.pools.castopod = {
+      inherit user;
+      group = config.services.nginx.group;
+      phpPackage = phpPackage;
+      phpOptions = ''
+        # https://code.castopod.org/adaures/castopod/-/blob/main/docker/production/app/uploads.ini
+        file_uploads = On
+        memory_limit = 512M
+        upload_max_filesize = 500M
+        post_max_size = 512M
+        max_execution_time = 300
+        max_input_time = 300
+      '';
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+      } // cfg.poolSettings;
+    };
+
+    systemd.services.castopod-setup = {
+      after = lib.optional config.services.mysql.enable "mysql.service";
+      requires = lib.optional config.services.mysql.enable "mysql.service";
+      wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.openssl phpPackage ];
+      script =
+        let
+          envFile = "${stateDirectory}/.env";
+          media = "${cfg.settings."media.storage"}/${cfg.settings."media.root"}";
+        in
+        ''
+          mkdir -p ${stateDirectory}/writable/{cache,logs,session,temp,uploads}
+
+          if [ ! -d ${lib.escapeShellArg media} ]; then
+            cp --no-preserve=mode,ownership -r ${cfg.package}/share/castopod/public/media ${lib.escapeShellArg media}
+          fi
+
+          if [ ! -f ${stateDirectory}/salt ]; then
+            openssl rand -base64 33 > ${stateDirectory}/salt
+          fi
+
+          cat <<'EOF' > ${envFile}
+          ${lib.generators.toKeyValue { } cfg.settings}
+          EOF
+
+          echo "analytics.salt=$(cat ${stateDirectory}/salt)" >> ${envFile}
+
+          ${if (cfg.database.passwordFile != null) then ''
+            echo "database.default.password=$(cat ${lib.escapeShellArg cfg.database.passwordFile})" >> ${envFile}
+          '' else ''
+            echo "database.default.password=" >> ${envFile}
+          ''}
+
+          ${lib.optionalString (cfg.environmentFile != null) ''
+            cat ${lib.escapeShellArg cfg.environmentFile}) >> ${envFile}
+          ''}
+
+          php spark castopod:database-update
+        '';
+      serviceConfig = {
+        StateDirectory = "castopod";
+        WorkingDirectory = "${cfg.package}/share/castopod";
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = user;
+        Group = config.services.nginx.group;
+      };
+    };
+
+    systemd.services.castopod-scheduled = {
+      after = [ "castopod-setup.service" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ phpPackage ];
+      script = ''
+        php public/index.php scheduled-activities
+        php public/index.php scheduled-websub-publish
+        php public/index.php scheduled-video-clips
+      '';
+      serviceConfig = {
+        StateDirectory = "castopod";
+        WorkingDirectory = "${cfg.package}/share/castopod";
+        Type = "oneshot";
+        User = user;
+        Group = config.services.nginx.group;
+      };
+    };
+
+    systemd.timers.castopod-scheduled = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "*-*-* *:*:00";
+        Unit = "castopod-scheduled.service";
+      };
+    };
+
+    services.mysql = lib.mkIf cfg.database.createLocally {
+      enable = true;
+      package = lib.mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [{
+        name = cfg.database.user;
+        ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+      }];
+    };
+
+    services.nginx = lib.mkIf cfg.configureNginx {
+      enable = true;
+      virtualHosts."${cfg.localDomain}" = {
+        root = lib.mkForce "${cfg.package}/share/castopod/public";
+
+        extraConfig = ''
+          try_files $uri $uri/ /index.php?$args;
+          index index.php index.html;
+        '';
+
+        locations."^~ /${cfg.settings."media.root"}/" = {
+          root = cfg.settings."media.storage";
+          extraConfig = ''
+            add_header Access-Control-Allow-Origin "*";
+            expires max;
+            access_log off;
+          '';
+        };
+
+        locations."~ \.php$" = {
+          fastcgiParams = {
+            SERVER_NAME = "$host";
+          };
+          extraConfig = ''
+            fastcgi_intercept_errors on;
+            fastcgi_index index.php;
+            fastcgi_pass unix:${fpm.socket};
+            try_files $uri =404;
+            fastcgi_read_timeout 3600;
+            fastcgi_send_timeout 3600;
+          '';
+        };
+      };
+    };
+
+    users.users.${user} = lib.mapAttrs (name: lib.mkDefault) {
+      description = "Castopod user";
+      isSystemUser = true;
+      group = config.services.nginx.group;
+    };
+  };
+}
--- a/nixos/modules/services/web-apps/peering-manager.nix
+++ b/nixos/modules/services/web-apps/peering-manager.nix
@ -2,40 +2,15 @@

 let
  cfg = config.services.peering-manager;
-  configFile = pkgs.writeTextFile {
-    name = "configuration.py";
-    text = ''
-      ALLOWED_HOSTS = ['*']
-      DATABASE = {
-        'NAME': 'peering-manager',
-        'USER': 'peering-manager',
-        'HOST': '/run/postgresql',
-      }

-      # Redis database settings. Redis is used for caching and for queuing background tasks such as webhook events. A separate
-      # configuration exists for each. Full connection details are required in both sections, and it is strongly recommended
-      # to use two separate database IDs.
-      REDIS = {
-        'tasks': {
-          'UNIX_SOCKET_PATH': '${config.services.redis.servers.peering-manager.unixSocket}',
-          'DATABASE': 0,
-        },
-        'caching': {
-          'UNIX_SOCKET_PATH': '${config.services.redis.servers.peering-manager.unixSocket}',
-          'DATABASE': 1,
-        }
-      }
-
-      with open("${cfg.secretKeyFile}", "r") as file:
-        SECRET_KEY = file.readline()
-    '' + lib.optionalString (cfg.peeringdbApiKeyFile != null) ''
-      with open("${cfg.peeringdbApiKeyFile}", "r") as file:
-        PEERINGDB_API_KEY = file.readline()
-    '' + ''
-
-      ${cfg.extraConfig}
-    '';
+  pythonFmt = pkgs.formats.pythonVars {};
+  settingsFile = pythonFmt.generate "peering-manager-settings.py" cfg.settings;
+  extraConfigFile = pkgs.writeTextFile {
+    name = "peering-manager-extraConfig.py";
+    text = cfg.extraConfig;
  };
+  configFile = pkgs.concatText "configuration.py" [ settingsFile extraConfigFile ];
+
  pkg = (pkgs.peering-manager.overrideAttrs (old: {
    postInstall = ''
      ln -s ${configFile} $out/opt/peering-manager/peering_manager/configuration.py
@ -106,6 +81,30 @@ in {
      '';
    };

+    settings = lib.mkOption {
+      description = lib.mdDoc ''
+        Configuration options to set in `configuration.py`.
+        See the [documentation](https://peering-manager.readthedocs.io/en/stable/configuration/optional-settings/) for more possible options.
+      '';
+
+      default = { };
+
+      type = lib.types.submodule {
+        freeformType = pythonFmt.type;
+
+        options = {
+          ALLOWED_HOSTS = lib.mkOption {
+            type = with lib.types; listOf str;
+            default = ["*"];
+            description = lib.mdDoc ''
+              A list of valid fully-qualified domain names (FQDNs) and/or IP
+              addresses that can be used to reach the peering manager service.
+            '';
+          };
+        };
+      };
+    };
+
    extraConfig = mkOption {
      type = types.lines;
      default = "";
@ -135,7 +134,39 @@ in {
  };

  config = lib.mkIf cfg.enable {
-    services.peering-manager.plugins = lib.mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+    services.peering-manager = {
+      settings = {
+        DATABASE = {
+          NAME = "peering-manager";
+          USER = "peering-manager";
+          HOST = "/run/postgresql";
+        };
+
+        # Redis database settings. Redis is used for caching and for queuing background tasks such as webhook events. A separate
+        # configuration exists for each. Full connection details are required in both sections, and it is strongly recommended
+        # to use two separate database IDs.
+        REDIS = {
+          tasks = {
+            UNIX_SOCKET_PATH = config.services.redis.servers.peering-manager.unixSocket;
+            DATABASE = 0;
+          };
+          caching = {
+            UNIX_SOCKET_PATH = config.services.redis.servers.peering-manager.unixSocket;
+            DATABASE = 1;
+          };
+        };
+      };
+
+      extraConfig = ''
+        with open("${cfg.secretKeyFile}", "r") as file:
+          SECRET_KEY = file.readline()
+      '' + lib.optionalString (cfg.peeringdbApiKeyFile != null) ''
+        with open("${cfg.peeringdbApiKeyFile}", "r") as file:
+          PEERINGDB_API_KEY = file.readline()
+      '';
+
+      plugins = lib.mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+    };

    system.build.peeringManagerPkg = pkg;

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -158,6 +158,7 @@ in {
  cagebreak = handleTest ./cagebreak.nix {};
  calibre-web = handleTest ./calibre-web.nix {};
  calibre-server = handleTest ./calibre-server.nix {};
+  castopod = handleTest ./castopod.nix {};
  cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; };
  cassandra_3_11 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_11; };
  cassandra_4 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_4; };
--- a/nixos/tests/castopod.nix
+++ b/nixos/tests/castopod.nix
@ -0,0 +1,87 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+{
+  name = "castopod";
+  meta = with lib.maintainers; {
+    maintainers = [ alexoundos misuzu ];
+  };
+  nodes.castopod = { nodes, ... }: {
+    networking.firewall.allowedTCPPorts = [ 80 ];
+    networking.extraHosts = ''
+      127.0.0.1 castopod.example.com
+    '';
+    services.castopod = {
+      enable = true;
+      database.createLocally = true;
+      localDomain = "castopod.example.com";
+    };
+    environment.systemPackages =
+      let
+        username = "admin";
+        email = "admin@castood.example.com";
+        password = "v82HmEp5";
+        testRunner = pkgs.writers.writePython3Bin "test-runner"
+          {
+            libraries = [ pkgs.python3Packages.selenium ];
+            flakeIgnore = [
+              "E501"
+            ];
+          } ''
+          from selenium.webdriver.common.by import By
+          from selenium.webdriver import Firefox
+          from selenium.webdriver.firefox.options import Options
+          from selenium.webdriver.support.ui import WebDriverWait
+          from selenium.webdriver.support import expected_conditions as EC
+
+          options = Options()
+          options.add_argument('--headless')
+          driver = Firefox(options=options)
+          try:
+              driver.implicitly_wait(20)
+              driver.get('http://castopod.example.com/cp-install')
+
+              wait = WebDriverWait(driver, 10)
+
+              wait.until(EC.title_contains("installer"))
+
+              driver.find_element(By.CSS_SELECTOR, '#username').send_keys(
+                  '${username}'
+              )
+              driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
+                  '${email}'
+              )
+              driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
+                  '${password}'
+              )
+              driver.find_element(By.XPATH, "//button[contains(., 'Finish install')]").click()
+
+              wait.until(EC.title_contains("Auth"))
+
+              driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
+                  '${email}'
+              )
+              driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
+                  '${password}'
+              )
+              driver.find_element(By.XPATH, "//button[contains(., 'Login')]").click()
+
+              wait.until(EC.title_contains("Admin dashboard"))
+          finally:
+              driver.close()
+              driver.quit()
+        '';
+      in
+      [ pkgs.firefox-unwrapped pkgs.geckodriver testRunner ];
+  };
+  testScript = ''
+    start_all()
+    castopod.wait_for_unit("castopod-setup.service")
+    castopod.wait_for_file("/run/phpfpm/castopod.sock")
+    castopod.wait_for_unit("nginx.service")
+    castopod.wait_for_open_port(80)
+    castopod.wait_until_succeeds("curl -sS -f http://castopod.example.com")
+    castopod.succeed("curl -s http://localhost/cp-install | grep 'Create your Super Admin account' > /dev/null")
+
+    with subtest("Create superadmin and log in"):
+        castopod.succeed("PYTHONUNBUFFERED=1 test-runner | systemd-cat -t test-runner")
+  '';
+})
--- a/pkgs/applications/audio/castopod/default.nix
+++ b/pkgs/applications/audio/castopod/default.nix
@ -0,0 +1,53 @@
+{ stdenv
+, fetchurl
+, ffmpeg-headless
+, lib
+, nixosTests
+, stateDirectory ? "/var/lib/castopod"
+}:
+stdenv.mkDerivation {
+  pname = "castopod";
+  version = "1.6.4";
+
+  src = fetchurl {
+    url = "https://code.castopod.org/adaures/castopod/uploads/ce56d4f149242f12bedd20f9a2b0916d/castopod-1.6.4.tar.gz";
+    sha256 = "080jj91yxbn3xsbs0sywzwa2f5in9bp9qi2zwqcfqpaxlq9ga62v";
+  };
+
+  dontBuild = true;
+  dontFixup = true;
+
+  postPatch = ''
+    # not configurable at runtime unfortunately:
+    substituteInPlace app/Config/Paths.php \
+      --replace "__DIR__ . '/../../writable'" "'${stateDirectory}/writable'"
+
+    # configuration file must be writable, place it to ${stateDirectory}
+    substituteInPlace modules/Install/Controllers/InstallController.php \
+      --replace "ROOTPATH" "'${stateDirectory}/'"
+    substituteInPlace public/index.php spark \
+      --replace "DotEnv(ROOTPATH)" "DotEnv('${stateDirectory}')"
+
+    # ffmpeg is required for Video Clips feature
+    substituteInPlace modules/MediaClipper/VideoClipper.php \
+      --replace "ffmpeg" "${ffmpeg-headless}/bin/ffmpeg"
+    substituteInPlace modules/Admin/Controllers/VideoClipsController.php \
+      --replace "which ffmpeg" "echo ${ffmpeg-headless}/bin/ffmpeg"
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/castopod
+    cp -r . $out/share/castopod
+  '';
+
+  passthru.tests.castopod = nixosTests.castopod;
+  passthru.updateScript = ./update.sh;
+
+  meta = with lib; {
+    description = "An open-source hosting platform made for podcasters who want to engage and interact with their audience";
+    homepage = "https://castopod.org";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ alexoundos misuzu ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/audio/castopod/update.sh
+++ b/pkgs/applications/audio/castopod/update.sh
@ -0,0 +1,89 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p curl jq
+set -euo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+castopod_nix="$nixpkgs/pkgs/applications/audio/castopod/default.nix"
+
+# https://www.meetup.com/api/guide/#p02-querying-section
+query='
+query allReleases($fullPath: ID!, $first: Int, $last: Int, $before: String, $after: String, $sort: ReleaseSort) {
+  project(fullPath: $fullPath) {
+    id
+    releases(
+      first: $first
+      last: $last
+      before: $before
+      after: $after
+      sort: $sort
+    ) {
+      nodes {
+        ...Release
+        __typename
+      }
+      __typename
+    }
+    __typename
+  }
+}
+
+fragment Release on Release {
+  id
+  name
+  tagName
+  releasedAt
+  createdAt
+  upcomingRelease
+  historicalRelease
+  assets {
+    links {
+      nodes {
+        id
+        name
+        url
+        directAssetUrl
+        linkType
+        __typename
+      }
+      __typename
+    }
+    __typename
+  }
+  __typename
+}
+'
+variables='{
+  "fullPath": "adaures/castopod",
+  "first": 1,
+  "sort": "RELEASED_AT_DESC"
+}'
+
+post=$(cat <<EOF
+{"query": "$(echo $query)", "variables": $(echo $variables)}
+EOF
+)
+
+json="$(curl -s -X POST https://code.castopod.org/api/graphql \
+  -H 'Content-Type: application/json' \
+  -d "$post")"
+
+echo "$json"
+TAG=$(echo $json | jq -r '.data.project.releases.nodes[].tagName')
+ASSET_URL=$(echo $json | jq -r '.data.project.releases.nodes[].assets.links.nodes[].url' | grep .tar.gz$)
+
+CURRENT_VERSION=$(nix eval -f "$nixpkgs" --raw castopod.version)
+VERSION=${TAG:1}
+
+if [[ "$CURRENT_VERSION" == "$VERSION" ]]; then
+  echo "castopod is up-to-date: ${CURRENT_VERSION}"
+  exit 0
+fi
+
+SHA256=$(nix-prefetch-url "$ASSET_URL")
+
+URL=$(echo $ASSET_URL | sed -e 's/[\/&]/\\&/g')
+
+sed -e "s/version =.*;/version = \"$VERSION\";/g" \
+    -e "s/url =.*;/url = \"$URL\";/g" \
+    -e "s/sha256 =.*;/sha256 = \"$SHA256\";/g" \
+    -i "$castopod_nix"
--- a/pkgs/applications/editors/orbiton/default.nix
+++ b/pkgs/applications/editors/orbiton/default.nix
@ -4,13 +4,13 @@

 buildGoModule rec {
  pname = "orbiton";
-  version = "2.64.3";
+  version = "2.65.0";

  src = fetchFromGitHub {
    owner = "xyproto";
    repo = "orbiton";
    rev = "v${version}";
-    hash = "sha256-mx6k6OXr3iTCD1FTC7J1fnz7Gs/GyggHXnVywuPo5BY=";
+    hash = "sha256-ul5E5xOtH5qh5tNE+S/VhUOr079wHwgtXF7ZIAwGzgU=";
  };

  vendorHash = null;
--- a/pkgs/applications/misc/zola/default.nix
+++ b/pkgs/applications/misc/zola/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , rustPlatform
 , cmake
 , pkg-config
@ -26,6 +27,14 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-AAub8UwAvX3zNX+SM/T9biyNxFTgfqUQG/MUGfwWuno=";

+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-40274.patch";
+      url = "https://github.com/getzola/zola/commit/fe1967fb0fe063b1cee1ad48820870ab2ecc0e5b.patch";
+      hash = "sha256-B/SVGhVX5hAbvMhBYO+mU5+xdZXU2JyS4uKmOj+aZuI=";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
--- a/pkgs/applications/networking/browsers/librewolf/librewolf.nix
+++ b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
@ -29,9 +29,9 @@ rec {
    sed -i '/MOZ_NORMANDY/ s/True/False/' browser/moz.configure
  '';

-  extraPrefsFiles = [ "${source}/submodules/settings/librewolf.cfg" ];
+  extraPrefsFiles = [ "${src.settings}/librewolf.cfg" ];

-  extraPoliciesFiles = [ "${source}/submodules/settings/distribution/policies.json" ];
+  extraPoliciesFiles = [ "${src.settings}/distribution/policies.json" ];

  extraPassthru = {
    librewolf = { inherit src extraPatches; };
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@ -1,11 +1,15 @@
 {
-  "packageVersion": "116.0.3-1",
+  "packageVersion": "117.0.1-1",
  "source": {
-    "rev": "116.0.3-1",
-    "sha256": "19l5nny96p89xm8c9f5m1435sglshn7izmjnj338c8qh217zxiyq"
+    "rev": "117.0.1-1",
+    "sha256": "06j85b6v54vxj99hgrlibpsg6f8w8cqj912vz7gwyfa17pawax9z"
+  },
+  "settings": {
+    "rev": "9c862f06f970d69e00c1035e0d4774fb44fd84a6",
+    "sha256": "0ay58wrhfn0b56748phpn0ahz11ls9y8d2fd1z4zrj6dv398vlmb"
  },
  "firefox": {
-    "version": "116.0.3",
-    "sha512": "194c50e9ba5a918c37fbef8cd72ffb98e5e9f51955d8172b6666a758b5f20777ca0a7f79dff0328305fb6dafefb102ab002e326f47d0965a4dc6d3e9287c42b9"
+    "version": "117.0.1",
+    "sha512": "1583b0ad3b3b17c59bfbfb3e416074766327d0b926ef4f6c6b1e3b2d7cf6a18dec592b7d17fab9493ba1506f3540a02277096d28616dd29b6e7b9e93905f2071"
  }
 }
--- a/pkgs/applications/networking/browsers/librewolf/src.nix
+++ b/pkgs/applications/networking/browsers/librewolf/src.nix
@ -1,4 +1,4 @@
-{ lib, fetchurl, fetchFromGitLab }:
+{ lib, fetchurl, fetchFromGitLab, fetchFromGitea }:
 let src = lib.importJSON ./src.json;
 in
 {
@ -9,6 +9,12 @@ in
    fetchSubmodules = true;
    inherit (src.source) rev sha256;
  };
+  settings = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "librewolf";
+    repo = "settings";
+    inherit (src.settings) rev sha256;
+  };
  firefox = fetchurl {
    url =
      "mirror://mozilla/firefox/releases/${src.firefox.version}/source/firefox-${src.firefox.version}.source.tar.xz";
--- a/pkgs/applications/networking/browsers/librewolf/update.nix
+++ b/pkgs/applications/networking/browsers/librewolf/update.nix
@ -57,9 +57,18 @@ writeScript "update-librewolf" ''
  ffHash=$(grep '\.source\.tar\.xz$' "$HOME"/shasums | grep '^[^ ]*' -o)
  echo "ffHash=$ffHash"

+  # upstream does not specify settings rev, so just get the latest. see https://github.com/NixOS/nixpkgs/issues/252276
+  settingsRev=$(curl 'https://codeberg.org/api/v1/repos/librewolf/settings/commits?sha=master&limit=1' | jq -r .[0].sha)
+  echo "settingsRev=$settingsRev"
+  repoUrl=https://codeberg.org/librewolf/settings
+  nix-prefetch-git $repoUrl --quiet --rev $settingsRev > $prefetchOut
+  settingsSha256=$(jq -r .sha256 < $prefetchOut)
+
  jq ".source.rev = \"$latestTag\"" $srcJson | sponge $srcJson
  jq ".source.sha256 = \"$srcHash\"" $srcJson | sponge $srcJson
  jq ".firefox.version = \"$ffVersion\"" $srcJson | sponge $srcJson
  jq ".firefox.sha512 = \"$ffHash\"" $srcJson | sponge $srcJson
  jq ".packageVersion = \"$lwVersion\"" $srcJson | sponge $srcJson
+  jq ".settings.rev = \"$settingsRev\"" $srcJson | sponge $srcJson
+  jq ".settings.sha256 = \"$settingsSha256\"" $srcJson | sponge $srcJson
 ''
--- a/pkgs/applications/networking/cluster/rancher/default.nix
+++ b/pkgs/applications/networking/cluster/rancher/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "rancher";
-  version = "2.7.0";
+  version = "2.7.7";

  src = fetchFromGitHub {
    owner  = "rancher";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "sha256-co4LVd5A0bJ4CIuCfv6WyV8XCMbPCFAAcV12WekYrw4=";
+    hash   = "sha256-HgLV4iuZXkL6BOKtUul1pFuIWv09VnUSPbdrtFd6Khk=";
  };

  ldflags = [
@ -19,7 +19,7 @@ buildGoModule rec {
    "-static"
  ];

-  vendorHash = "sha256-oclMnt6uJa8SG2fNM0fi+HCVMMi4rkykx8VpK/tXilQ=";
+  vendorHash = "sha256-mXLZMnGJ1m5gFroJcSoE4SbVvsyuS73hfXFeWBRtUdI=";

  postInstall = ''
    mv $out/bin/cli $out/bin/rancher
--- a/pkgs/applications/networking/instant-messengers/caprine-bin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/caprine-bin/default.nix
@ -1,7 +1,7 @@
 { lib, callPackage, stdenvNoCC }:
 let
  pname = "caprine";
-  version = "2.58.0";
+  version = "2.58.3";
  metaCommon = with lib; {
    description = "An elegant Facebook Messenger desktop app";
    homepage = "https://sindresorhus.com/caprine";
@ -10,11 +10,11 @@ let
  };
  x86_64-appimage = callPackage ./build-from-appimage.nix {
    inherit pname version metaCommon;
-    sha256 = "7iK2RyA63okJLH2Xm97fFilJHzqFuP96xkUr2+ADbC4=";
+    sha256 = "sha256-w0nBQhHYzFLsNu0MxWhoju6fh4JpAKC7MWWVxwDkRYk=";
  };
  x86_64-dmg = callPackage ./build-from-dmg.nix {
    inherit pname version metaCommon;
-    sha256 = "RqK+fJJAt9W+m7zg6ZYI6PEAOa3V1UxsptEpG1qjibg=";
+    sha256 = "sha256-6Mx2ZkT2hdnaSVt2hKMMV9xc7rYPFFbxcj6vb84ojYU=";
  };
 in
 (if stdenvNoCC.isDarwin then x86_64-dmg else x86_64-appimage).overrideAttrs (oldAttrs: {
--- a/pkgs/applications/window-managers/notion/default.nix
+++ b/pkgs/applications/window-managers/notion/default.nix
@ -1,44 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config
-, lua, gettext, which, groff, xmessage, xterm
-, readline, fontconfig, libX11, libXext, libSM
-, libXinerama, libXrandr, libXft
-, makeWrapper
-}:
-
-stdenv.mkDerivation rec {
-  pname = "notion";
-  version = "4.0.2";
-
-  src = fetchFromGitHub {
-    owner = "raboof";
-    repo = pname;
-    rev = version;
-    sha256 = "14swd0yqci8lxn259fkd9w92bgyf4rmjwgvgyqp78wlfix6ai4mv";
-  };
-
-  # error: 'PATH_MAX' undeclared
-  postPatch = ''
-    sed 1i'#include <linux/limits.h>' -i mod_notionflux/notionflux/notionflux.c
-  '';
-
-  nativeBuildInputs = [ pkg-config makeWrapper groff ];
-  buildInputs = [ lua gettext which readline fontconfig libX11 libXext libSM
-                  libXinerama libXrandr libXft ];
-
-  buildFlags = [ "LUA_DIR=${lua}" "X11_PREFIX=/no-such-path" ];
-
-  makeFlags = [ "NOTION_RELEASE=${version}" "PREFIX=\${out}" ];
-
-  postInstall = ''
-    wrapProgram $out/bin/notion \
-      --prefix PATH ":" "${xmessage}/bin:${xterm}/bin" \
-  '';
-
-  meta = with lib; {
-    description = "Tiling tabbed window manager";
-    homepage = "https://notionwm.net";
-    license   = licenses.lgpl21;
-    maintainers = with maintainers; [ jfb AndersonTorres raboof ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/window-managers/smallwm/default.nix
+++ b/pkgs/applications/window-managers/smallwm/default.nix
@ -1,38 +0,0 @@
-{ lib, stdenv, fetchFromGitHub
-, doxygen, graphviz, libX11, libXrandr }:
-
-stdenv.mkDerivation rec {
-
-  pname = "smallwm";
-  version = "2020-02-28";
-
-  src = fetchFromGitHub {
-    owner = "adamnew123456";
-    repo = "SmallWM";
-    rev = "c2dc72afa87241bcf7e646630f4aae216ce78613";
-    sha256 = "0cqhy81ymdcdyvgi55a401rr96h2akskcxi9ddzjbln4a71yjlz8";
-  };
-
-  nativeBuildInputs = [ doxygen graphviz ];
-  buildInputs = [ libX11 libXrandr ];
-
-  dontConfigure = true;
-
-  makeFlags = [ "CC=${stdenv.cc}/bin/cc" "CXX=${stdenv.cc}/bin/c++" ];
-
-  buildFlags = [ "all" "doc" ];
-
-  installPhase = ''
-    install -dm755 $out/bin $out/share/doc/${pname}-${version}
-    install -m755 bin/smallwm -t $out/bin
-    cp -r README.markdown doc/html doc/latex $out/share/doc/${pname}-${version}
-  '';
-
-  meta = with lib;{
-    description = "A small X window manager, extended from tinywm";
-    homepage = "https://github.com/adamnew123456/SmallWM";
-    license = licenses.bsd2;
-    maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/window-managers/afterstep/default.nix
+++ b/pkgs/applications/window-managers/afterstep/default.nix
@ -1,26 +1,31 @@
-{ lib, stdenv, fetchurl, pkg-config
-, libtiff
-, fltk, gtk
-, libICE, libSM
-, dbus
+{ lib
+, stdenv
+, fetchFromGitHub
 , fetchpatch
+, dbus
+, fltk13
+, gtk2
+, libICE
+, libSM
+, libtiff
+, pkg-config
 }:

-stdenv.mkDerivation rec {
-
+stdenv.mkDerivation (finalAttrs: {
  pname = "afterstep";
  version = "2.2.12";
-  sourceName = "AfterStep-${version}";

-  src = fetchurl {
-    urls = [ "ftp://ftp.afterstep.org/stable/${sourceName}.tar.bz2" ];
-    sha256 = "1j7vkx1ig4kzwffdxnkqv3kld9qi3sam4w2nhq18waqjsi8xl5gz";
+  src = fetchFromGitHub {
+    owner = "afterstep";
+    repo = "afterstep";
+    rev = finalAttrs.version;
+    hash = "sha256-j1ADTRZ3Mxv9VNZWhWCFMnM/CJfkphdrgbw9Ca3bBw0=";
  };

  patches = [
    (fetchpatch {
      url = "https://salsa.debian.org/debian/afterstep/raw/master/debian/patches/44-Fix-build-with-gcc-5.patch";
-      sha256 = "1vipy2lzzd2gqrsqk85pwgcdhargy815fxlbn57hsm45zglc3lj4";
+      hash = "sha256-RNLB6PuFVA1PsYt2VwLyLyvY2OO3oIl1xk+0/6nwN+4=";
    })

    # Fix pending upstream inclusion for binutils-2.36 support:
@ -28,7 +33,7 @@ stdenv.mkDerivation rec {
    (fetchpatch {
      name = "binutils-2.36.patch";
      url = "https://github.com/afterstep/afterstep/commit/5e9e897cf8c455390dd6f5b27fec49707f6b9088.patch";
-      sha256 = "1kk97max05r2p1a71pvpaza79ff0klz32rggik342p7ki3516qv8";
+      hash = "sha256-aGMTyojzXEHGjO9lMT6dwLl01Fd333BUuCIX0FU9ac4=";
    })
  ];

@ -40,8 +45,22 @@ stdenv.mkDerivation rec {
    done
  '';

-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libtiff fltk gtk libICE libSM dbus ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    dbus
+    fltk13
+    gtk2
+    libICE
+    libSM
+    libtiff
+  ];
+
+  outputs = [ "out" "man" ];
+
+  strictDeps = true;

  # A strange type of bug: dbus is not immediately found by pkg-config
  preConfigure = ''
@ -66,20 +85,19 @@ stdenv.mkDerivation rec {
  #   https://github.com/afterstep/afterstep/issues/8
  enableParallelBuilding = false;

-  meta = with lib; {
+  meta = {
+    homepage = "http://www.afterstep.org/";
    description = "A NEXTStep-inspired window manager";
    longDescription = ''
-      AfterStep is a window manager for the Unix X Window
-      System. Originally based on the look and feel of the NeXTStep
-      interface, it provides end users with a consistent, clean, and
-      elegant desktop. The goal of AfterStep development is to provide
-      for flexibility of desktop configuration, improving aestetics,
-      and efficient use of system resources.
+      AfterStep is a window manager for the Unix X Window System. Originally
+      based on the look and feel of the NeXTStep interface, it provides end
+      users with a consistent, clean, and elegant desktop. The goal of AfterStep
+      development is to provide for flexibility of desktop configuration,
+      improving aestetics, and efficient use of system resources.
    '';
-    homepage = "http://www.afterstep.org/";
-    license = licenses.gpl2;
-    maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    mainProgram = "afterstep";
+    platforms = lib.platforms.linux;
  };
-
-}
+})
--- a/pkgs/applications/window-managers/berry/default.nix
+++ b/pkgs/applications/window-managers/berry/default.nix
@ -13,14 +13,14 @@
 , which
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "berry";
  version = "0.1.12";

  src = fetchFromGitHub {
    owner = "JLErvin";
-    repo = pname;
-    rev = version;
+    repo = "berry";
+    rev = finalAttrs.version;
    hash = "sha256-xMJRiLNtwVRQf9HiCF3ClLKEmdDNxcY35IYxe+L7+Hk=";
  };

@ -39,8 +39,12 @@ stdenv.mkDerivation rec {
    freetype
  ];

+  outputs = [ "out" "man" ];
+
+  strictDeps = true;
+
  postPatch = ''
-    sed -i --regexp-extended 's/(pkg_verstr=").*(")/\1${version}\2/' configure
+    sed -i --regexp-extended 's/(pkg_verstr=").*(")/\1${finalAttrs.version}\2/' configure
  '';

  preConfigure = ''
@ -49,16 +53,16 @@ stdenv.mkDerivation rec {

  desktopItems = [
    (makeDesktopItem {
-      name = pname;
+      name = "berry";
      exec = "berry";
-      comment = meta.description;
+      comment = "A healthy, bite-sized window manager";
      desktopName = "Berry Window Manager";
      genericName = "Berry Window Manager";
      categories = [ "Utility" ];
    })
  ];

-  meta = with lib; {
+  meta = {
    homepage = "https://berrywm.org/";
    description = "A healthy, bite-sized window manager";
    longDescription = ''
@ -74,8 +78,9 @@ stdenv.mkDerivation rec {
      - Intuitively place new windows in unoccupied spaces.
      - Virtual desktops.
    '';
-    license = licenses.mit;
-    maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    mainProgram = "berry";
+    maintainers = [ lib.maintainers.AndersonTorres ];
+    inherit (libX11.meta) platforms;
  };
-}
+})
--- a/pkgs/by-name/no/notion/package.nix
+++ b/pkgs/by-name/no/notion/package.nix
@ -0,0 +1,86 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fontconfig
+, gettext
+, groff
+, libSM
+, libX11
+, libXext
+, libXft
+, libXinerama
+, libXrandr
+, lua
+, makeWrapper
+, pkg-config
+, readline
+, which
+, xmessage
+, xterm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "notion";
+  version = "4.0.2";
+
+  src = fetchFromGitHub {
+    owner = "raboof";
+    repo = "notion";
+    rev = finalAttrs.version;
+    hash = "sha256-u5KoTI+OcnQu9m8/Lmsmzr8lEk9tulSE7RRFhj1oXJM=";
+  };
+
+  # error: 'PATH_MAX' undeclared
+  postPatch = ''
+    sed 1i'#include <linux/limits.h>' -i mod_notionflux/notionflux/notionflux.c
+  '';
+
+  nativeBuildInputs = [
+    gettext
+    groff
+    lua
+    makeWrapper
+    pkg-config
+    which
+  ];
+
+  buildInputs = [
+    fontconfig
+    libSM
+    libX11
+    libXext
+    libXft
+    libXinerama
+    libXrandr
+    lua
+    readline
+  ];
+
+  outputs = [ "out" "man" ];
+
+  strictDeps = true;
+
+  buildFlags = [
+    "LUA_DIR=${lua}"
+    "X11_PREFIX=/no-such-path"
+  ];
+
+  makeFlags = [
+    "NOTION_RELEASE=${finalAttrs.version}"
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/notion \
+      --prefix PATH ":" "${lib.makeBinPath [ xmessage xterm ]}" \
+  '';
+
+  meta = {
+    description = "Tiling tabbed window manager";
+    homepage = "https://notionwm.net";
+    license = lib.licenses.lgpl21;
+    mainProgram = "notion";
+    maintainers = with lib.maintainers; [ jfb AndersonTorres raboof ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/applications/window-managers/pekwm/default.nix
+++ b/pkgs/applications/window-managers/pekwm/default.nix
@ -2,10 +2,8 @@
 , stdenv
 , fetchFromGitHub
 , awk
-, grep
-, sed
-, runtimeShell
 , cmake
+, grep
 , libXext
 , libXft
 , libXinerama
@ -14,6 +12,8 @@
 , libjpeg
 , libpng
 , pkg-config
+, runtimeShell
+, sed
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -32,13 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
  ];

-  cmakeFlags = [
-    "-DAWK=${awk}/bin/awk"
-    "-DGREP=${grep}/bin/grep"
-    "-DSED=${sed}/bin/sed"
-    "-DSH=${runtimeShell}"
-  ];
-
  buildInputs = [
    libXext
    libXft
@ -49,6 +42,17 @@ stdenv.mkDerivation (finalAttrs: {
    libpng
  ];

+  outputs = [ "out" "man" ];
+
+  strictDeps = true;
+
+  cmakeFlags = [
+    "-DAWK=${lib.getBin awk}/bin/awk"
+    "-DGREP=${lib.getBin grep}/bin/grep"
+    "-DSED=${lib.getBin sed}/bin/sed"
+    "-DSH=${runtimeShell}"
+  ];
+
  meta = {
    homepage = "https://www.pekwm.se/";
    description = "A lightweight window manager";
@ -67,6 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    changelog = "https://raw.githubusercontent.com/pekwm/pekwm/release-${finalAttrs.version}/NEWS.md";
    license = lib.licenses.gpl2Plus;
+    mainProgram = "pekwm";
    maintainers = [ lib.maintainers.AndersonTorres ];
    platforms = lib.platforms.linux;
  };
--- a/pkgs/by-name/po/poethepoet/package.nix
+++ b/pkgs/by-name/po/poethepoet/package.nix
@ -0,0 +1,43 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "poethepoet";
+  version = "0.23.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "nat-n";
+    repo = "poethepoet";
+    rev = "v${version}";
+    hash = "sha256-bT+lRPqR7mxfZSlOyhqCkpBE0etiLh0wkg62nyK751Q=";
+  };
+
+  nativeBuildInputs = [
+    python3.pkgs.poetry-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pastel
+    tomli
+  ];
+
+  passthru.optional-dependencies = with python3.pkgs; {
+    poetry_plugin = [
+      poetry
+    ];
+  };
+
+  pythonImportsCheck = [ "poethepoet" ];
+
+  meta = with lib; {
+    description = "A task runner that works well with poetry";
+    homepage = "https://github.com/nat-n/poethepoet";
+    changelog = "https://github.com/nat-n/poethepoet/releases/tag/${src.rev}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "poe";
+  };
+}
--- a/pkgs/applications/window-managers/ratpoison/default.nix
+++ b/pkgs/applications/window-managers/ratpoison/default.nix
@ -1,42 +1,71 @@
-{ lib, stdenv, fetchurl, pkg-config, perl, autoconf, automake
-, libX11, xorgproto, libXt, libXpm, libXft, libXtst, libXi
-, libXrandr, fontconfig, freetype, readline
+{ lib
+, stdenv
+, fetchurl
+, autoreconfHook
+, fontconfig
+, freetype
+, libX11
+, libXft
+, libXi
+, libXpm
+, libXrandr
+, libXt
+, libXtst
+, perl
+, pkg-config
+, readline
+, texinfo
+, xorgproto
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "ratpoison";
  version = "1.4.9";

  src = fetchurl {
-    url = "mirror://savannah/ratpoison/${pname}-${version}.tar.xz";
-    sha256 = "1wfir1gvh5h7izgvx2kd1pr2k7wlncd33zq7qi9s9k2y0aza93yr";
+    url = "mirror://savannah/ratpoison/ratpoison-${finalAttrs.version}.tar.xz";
+    hash = "sha256-2Y+kvgJezKRTxAf/MRqzlJ8p8g1tir7fjwcWuF/I0fE=";
  };

+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    texinfo
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+    libX11
+    libXft
+    libXi
+    libXpm
+    libXrandr
+    libXt
+    libXtst
+    perl
+    readline
+    xorgproto
+  ];
+
  outputs = [ "out" "contrib" "man" "doc" "info" ];

+  strictDeps = true;
+
  configureFlags = [
    # >=1.4.9 requires this even with readline in inputs
    "--enable-history"
  ];

-  nativeBuildInputs = [ pkg-config autoconf automake ];
-
-  buildInputs =
-    [ perl
-      libX11 xorgproto libXt libXpm libXft libXtst libXi libXrandr
-      fontconfig freetype readline ];
-
  postInstall = ''
    mkdir -p $contrib/{bin,share}
    mv $out/bin/rpws $contrib/bin
    mv $out/share/ratpoison $contrib/share
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://www.nongnu.org/ratpoison/";
    description = "Simple mouse-free tiling window manager";
-    license = licenses.gpl2Plus;
-
    longDescription = ''
       Ratpoison is a simple window manager with no fat library
       dependencies, no fancy graphics, no window decorations, and no
@ -51,8 +80,9 @@ stdenv.mkDerivation rec {
       Ratpoison has a prefix map to minimize the key clobbering that
       cripples Emacs and other quality pieces of software.
    '';
-
-    platforms = platforms.unix;
-    maintainers = [ maintainers.AndersonTorres ];
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "ratpoison";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (libX11.meta) platforms;
  };
-}
+})
--- a/pkgs/by-name/si/simplex-chat-desktop/package.nix
+++ b/pkgs/by-name/si/simplex-chat-desktop/package.nix
@ -0,0 +1,46 @@
+{ lib
+, appimageTools
+, fetchurl
+}:
+
+let
+  pname = "simplex-chat-desktop";
+  version = "5.3.1";
+
+  src = fetchurl {
+    url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-x86_64.AppImage";
+    hash = "sha256-vykdi7SXKKsjYE/yixGrKQoWuUIOAjofLUn/fsdmLMc=";
+  };
+
+  appimageContents = appimageTools.extract {
+    inherit pname version src;
+  };
+in appimageTools.wrapType2 {
+    inherit pname version src;
+
+    extraPkgs = pkgs: with pkgs; [
+      makeWrapper
+    ];
+
+    extraBwrapArgs = [
+      "--setenv _JAVA_AWT_WM_NONREPARENTING 1"
+    ];
+
+    extraInstallCommands = ''
+      mv $out/bin/${pname}-${version} $out/bin/${pname}
+
+      install --mode=444 -D ${appimageContents}/chat.simplex.app.desktop --target-directory=$out/share/applications
+      substituteInPlace $out/share/applications/chat.simplex.app.desktop \
+        --replace 'Exec=simplex' 'Exec=${pname}'
+      cp -r ${appimageContents}/usr/share/icons $out/share
+    '';
+
+  meta = with lib; {
+    description = "Desktop application for SimpleX Chat";
+    homepage = "https://simplex.chat";
+    changelog = "https://github.com/simplex-chat/simplex-chat/releases/tag/v${version}";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ yuu ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/by-name/sl/slurm-nm/package.nix
+++ b/pkgs/by-name/sl/slurm-nm/package.nix
@ -0,0 +1,32 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, pkg-config
+, meson
+, ncurses
+, ninja
+}:
+
+stdenv.mkDerivation rec {
+  pname = "slurm";
+  version = "0.4.4";
+
+  src = fetchFromGitHub {
+    owner = "mattthias";
+    repo = "slurm";
+    rev = "upstream/${version}";
+    hash = "sha256-w77SIXFctMwwNw9cQm0HQaEaMs/5NXQjn1LpvkpCCB8=";
+  };
+
+  nativeBuildInputs = [ pkg-config meson ninja ];
+  buildInputs = [ ncurses ];
+
+  meta = with lib; {
+    description = "A generic network load monitor";
+    homepage = "https://github.com/mattthias/slurm";
+    license = licenses.gpl2Plus;
+    platforms = with platforms; [ "x86_64-linux" ];
+    maintainers = with maintainers; [ mikaelfangel ];
+    mainProgram = "slurm";
+  };
+}
--- a/pkgs/by-name/sm/smallwm/package.nix
+++ b/pkgs/by-name/sm/smallwm/package.nix
@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, doxygen
+, graphviz
+, libX11
+, libXrandr
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "smallwm";
+  version = "unstable-2020-02-28";
+
+  src = fetchFromGitHub {
+    owner = "adamnew123456";
+    repo = "SmallWM";
+    rev = "c2dc72afa87241bcf7e646630f4aae216ce78613";
+    hash = "sha256-6FPpw1HE0iV/ayl2NvVUApqUcwBElRLf9o216gPyEDM=";
+  };
+
+  nativeBuildInputs = [
+    doxygen
+    graphviz
+  ];
+
+  buildInputs = [
+    libX11
+    libXrandr
+  ];
+
+  strictDeps = true;
+
+  dontConfigure = true;
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "CXX=${stdenv.cc.targetPrefix}c++"
+  ];
+
+  buildFlags = [ "all" "doc" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -dm755 $out/bin $out/share/doc/smallwm-${finalAttrs.version}
+    install -m755 bin/smallwm -t $out/bin
+    cp -r README.markdown doc/html doc/latex $out/share/doc/smallwm-${finalAttrs.version}
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A small X window manager, extended from tinywm";
+    homepage = "https://github.com/adamnew123456/SmallWM";
+    license = lib.licenses.bsd2;
+    mainProgram = "smallwm";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (libX11.meta) platforms;
+  };
+})
--- a/pkgs/applications/window-managers/tinywm/default.nix
+++ b/pkgs/applications/window-managers/tinywm/default.nix
@ -1,36 +1,49 @@
-{ lib, stdenv, fetchFromGitHub
-, libX11 }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, libX11
+}:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "tinywm";
-  version = "2014-04-22";
+  version = "1.1-unstable-2014-04-22";

  src = fetchFromGitHub {
    owner = "mackstann";
-    repo = pname;
+    repo = "tinywm";
    rev = "9d05612f41fdb8bc359f1fd9cc930bf16315abb1";
-    sha256 = "1s7r4f2d3lk1i8h089v2vyrr02hh0y9i3ihl9kqgk9s87hqw8q5b";
+    hash = "sha256-q2DEMTxIp/nwTBTGEZMHEAqQs99iJwQgimHS0YQj+eg=";
  };

  buildInputs = [ libX11 ];

+  strictDeps = true;
+
  dontConfigure = true;

  buildPhase = ''
+    runHook preBuild
+
    $CC -Wall -pedantic -I${libX11}/include tinywm.c -L${libX11}/lib -lX11 -o tinywm
+
+    runHook postBuild
  '';

  installPhase = ''
-    install -dm755 $out/bin $out/share/doc/${pname}-${version}
+    runHook preInstall
+
+    install -dm755 $out/bin $out/share/doc/tinywm-${finalAttrs.version}
    install -m755 tinywm -t $out/bin/
    # The annotated source code is a piece of documentation
-    install -m644 annotated.c README -t $out/share/doc/${pname}-${version}
+    install -m644 annotated.c README -t $out/share/doc/tinywm-${finalAttrs.version}
+
+    runHook postInstall
  '';

-  meta = with lib;{
+  meta = {
+    homepage = "http://incise.org/tinywm.html";
    description = "A tiny window manager for X11";
    longDescription = ''
-
      TinyWM is a tiny window manager that I created as an exercise in
      minimalism. It is also maybe helpful in learning some of the very basics
      of creating a window manager. It is only around 50 lines of C. There is
@ -44,9 +57,9 @@ stdenv.mkDerivation rec {
        keybinding in there somewhere)
      - Focus windows with the mouse pointer (X does this on its own)
    '';
-    homepage = "http://incise.org/tinywm.html";
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = libX11.meta.platforms;
-    license = licenses.publicDomain;
+    license = lib.licenses.publicDomain;
+    mainProgram = "tinywm";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (libX11.meta) platforms;
  };
-}
+})
--- a/pkgs/applications/window-managers/waybox/default.nix
+++ b/pkgs/applications/window-managers/waybox/default.nix
@ -1,62 +1,65 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, pkg-config
-, meson
 , cmake
-, ninja
-, libxkbcommon
-, wayland
-, wayland-scanner
-, wayland-protocols
-, wlroots
-, pixman
-, udev
 , libGL
+, libxkbcommon
 , libxml2
 , mesa
+, meson
+, ninja
+, pixman
+, pkg-config
+, udev
+, wayland
+, wayland-protocols
+, wayland-scanner
+, wlroots
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "waybox";
  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "wizbright";
-    repo = pname;
-    rev = version;
+    repo = "waybox";
+    rev = finalAttrs.version;
    hash = "sha256-G8dRa4hgev3x58uqp5To5OzF3zcPSuT3NL9MPnWf2M8=";
  };

  nativeBuildInputs = [
-    pkg-config
-    meson
    cmake
+    meson
    ninja
+    pkg-config
    wayland-scanner
  ];

-  dontUseCmakeConfigure = true;
-
  buildInputs = [
+    libGL
    libxkbcommon
    libxml2
+    mesa # for libEGL
+    pixman
+    udev
    wayland
    wayland-protocols
    wlroots
-    pixman
-    udev
-    libGL
-    mesa # for libEGL
  ];

+  strictDeps = true;
+
+  dontUseCmakeConfigure = true;
+
  passthru.providedSessions = [ "waybox" ];

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/wizbright/waybox";
    description = "An openbox clone on Wayland";
-    license = licenses.mit;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    mainProgram = "waybox";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (wayland.meta) platforms;
  };
-}
+})
--- a/pkgs/applications/window-managers/yeahwm/default.nix
+++ b/pkgs/applications/window-managers/yeahwm/default.nix
@ -1,40 +1,63 @@
-{ lib, stdenv, fetchurl
+{ lib
+, stdenv
+, fetchurl
+, installShellFiles
 , lesstif
-, libX11, libXext, libXmu, libXinerama }:
-
-stdenv.mkDerivation rec {
+, libX11
+, libXext
+, libXinerama
+, libXmu
+}:

+stdenv.mkDerivation (finalAttrs: {
  pname = "yeahwm";
  version = "0.3.5";

  src = fetchurl {
-    url = "http://phrat.de/${pname}_${version}.tar.gz";
-    sha256 = "01gfzjvb40n16m2ja4238nk08k4l203y6a61cydqvf68924fjb69";
+    url = "http://phrat.de/yeahwm_${finalAttrs.version}.tar.gz";
+    hash = "sha256-ySzpiEjIuI2bZ8Eo4wcQlEwEpkVDECVFNcECsrb87gU=";
  };

-  buildInputs = [ lesstif libX11 libXext libXinerama libXmu ];
+  nativeBuildInputs = [
+    installShellFiles
+  ];

-  dontConfigure = true;
+  buildInputs = [
+    lesstif
+    libX11
+    libXext
+    libXinerama
+    libXmu
+  ];

-  preBuild = ''
+  strictDeps = true;
+
+  preBuild = let
+    includes = builtins.concatStringsSep " "
+      (builtins.map (l: "-I${lib.getDev l}/include")
+        finalAttrs.buildInputs);
+    ldpath = builtins.concatStringsSep " "
+      (builtins.map (l: "-L${lib.getLib l}/lib")
+        finalAttrs.buildInputs);
+  in ''
    makeFlagsArray+=( CC="${stdenv.cc}/bin/cc" \
                      XROOT="${libX11}" \
-                      INCLUDES="-I${libX11.dev}/include -I${libXext.dev}/include -I${libXinerama.dev}/include -I${libXmu.dev}/include" \
-                      LDPATH="-L${libX11}/lib -L${libXext}/lib -L${libXinerama}/lib -L${libXmu}/lib" \
+                      INCLUDES="${includes}" \
+                      LDPATH="${ldpath}" \
                      prefix="${placeholder "out"}" )
  '';

-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
+  # Workaround build failure on -fno-common toolchains like upstream gcc-10.
+  # Otherwise build fails as:
  #   ld: screen.o:(.bss+0x40): multiple definition of `fg'; client.o:(.bss+0x40): first defined here
  env.NIX_CFLAGS_COMPILE = "-fcommon";

  postInstall = ''
-    gzip -9 --stdout yeahwm.1 > yeahwm.1.gz
-    install -m644 yeahwm.1.gz ${placeholder "out"}/share/man/man1/
+    installManPage yeahwm.1
  '';

-  meta = with lib;{
+  meta = {
+    homepage = "http://phrat.de/index.html";
    description = "An X window manager based on evilwm and aewm";
    longDescription = ''
      YeahWM is a h* window manager for X based on evilwm and aewm.
@ -55,9 +78,10 @@ stdenv.mkDerivation rec {
      - Little resource usage.
      - It's slick.
    '';
-    homepage = "http://phrat.de/index.html";
-    license = licenses.isc;
-    maintainers = [ maintainers.AndersonTorres ];
-    platforms = libX11.meta.platforms;
+    changelog = "http://phrat.de/README";
+    license = lib.licenses.isc;
+    mainProgram = "yeahwm";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (libX11.meta) platforms;
  };
-}
+})
--- a/pkgs/development/coq-modules/serapi/default.nix
+++ b/pkgs/development/coq-modules/serapi/default.nix
@ -89,7 +89,7 @@ in
    then [
      ./janestreet-0.15.patch
    ]
-    else if version == "8.17.0+0.17.0"
+    else if version == "8.16.0+0.16.3" || version == "8.17.0+0.17.0"
    then [
      ./janestreet-0.16.patch
    ]
--- a/pkgs/development/interpreters/clisp/bits_ipctypes_to_sys_ipc.patch
+++ b/pkgs/development/interpreters/clisp/bits_ipctypes_to_sys_ipc.patch
@ -1,12 +0,0 @@
-diff -ru a/modules/bindings/glibc/linux.lisp b/modules/bindings/glibc/linux.lisp
--- a/modules/bindings/glibc/linux.lisp	2008-10-10 16:15:49.000000000 +0300
-+++ b/modules/bindings/glibc/linux.lisp	2012-12-04 01:01:35.000000000 +0200
-@@ -86,7 +86,7 @@
- 
- (def-c-type __key_t)            ; int
- 
-(c-lines "#include <bits/ipctypes.h>~%")
-+(c-lines "#include <sys/ipc.h>~%")
- (def-c-type __ipc_pid_t)        ; ushort
- 
- ; --------------------------- <sys/types.h> -----------------------------------
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@ -3,10 +3,26 @@
 # - base (default): contains readline and i18n, regexp and syscalls modules
 #   by default
 # - full: contains base plus modules in withModules
-{ lib, stdenv, fetchurl, libsigsegv, gettext, ncurses, readline, libX11
-, libXau, libXt, pcre, zlib, libXpm, xorgproto, libXext
+{ lib
+, stdenv
+, fetchFromGitLab
+, autoconf269
+, automake
+, libtool
+, libsigsegv
+, gettext
+, ncurses
+, pcre
+, zlib
+, readline
 , libffi
 , libffcall
+, libX11
+, libXau
+, libXt
+, libXpm
+, libXext
+, xorgproto
 , coreutils
 # build options
 , threadSupport ? stdenv.hostPlatform.isx86
@ -16,26 +32,30 @@
    "pcre"
    "rawsock"
  ]
-  ++ lib.optionals stdenv.isLinux [ "bindings/glibc" "zlib" "wildcard" ]
+  ++ lib.optionals stdenv.isLinux [ "bindings/glibc" "zlib" ]
  ++ lib.optional x11Support "clx/new-clx"
 }:

 assert x11Support -> (libX11 != null && libXau != null && libXt != null
  && libXpm != null && xorgproto != null && libXext != null);

-stdenv.mkDerivation rec {
-  version = "2.49";
+let
+  ffcallAvailable = stdenv.isLinux && (libffcall != null);
+in
+
+stdenv.mkDerivation {
+  version = "2.50pre20230112";
  pname = "clisp";

-  src = fetchurl {
-    url = "mirror://gnu/clisp/release/${version}/clisp-${version}.tar.bz2";
-    sha256 = "8132ff353afaa70e6b19367a25ae3d5a43627279c25647c220641fed00f8e890";
+  src = fetchFromGitLab {
+    owner = "gnu-clisp";
+    repo = "clisp";
+    rev = "bf72805c4dace982a6d3399ff4e7f7d5e77ab99a";
+    hash = "sha256-sQoN2FUg9BPaCgvCF91lFsU/zLja1NrgWsEIr2cPiqo=";
  };

-  inherit libsigsegv gettext coreutils;
-
-  ffcallAvailable = stdenv.isLinux && (libffcall != null);
-
+  strictDeps = true;
+  nativeBuildInputs = lib.optionals stdenv.isDarwin [ autoconf269 automake libtool ];
  buildInputs = [libsigsegv]
  ++ lib.optional (gettext != null) gettext
  ++ lib.optional (ncurses != null) ncurses
@ -49,24 +69,28 @@ stdenv.mkDerivation rec {
  ];

  patches = [
-    ./bits_ipctypes_to_sys_ipc.patch # from Gentoo
-    # The cfree alias no longer exists since glibc 2.26
-    ./remove-cfree-binding.patch
+    ./gnulib_aarch64.patch
  ];

  # First, replace port 9090 (rather low, can be used)
  # with 64237 (much higher, IANA private area, not
  # anything rememberable).
-  # Also remove reference to a type that disappeared from recent glibc
-  # (seems the correct thing to do, found no reference to any solution)
  postPatch = ''
    sed -e 's@9090@64237@g' -i tests/socket.tst
    sed -i 's@/bin/pwd@${coreutils}&@' src/clisp-link.in
    find . -type f | xargs sed -e 's/-lICE/-lXau &/' -i
-
-    substituteInPlace modules/bindings/glibc/linux.lisp --replace "(def-c-type __swblk_t)" ""
  '';

+  preConfigure = lib.optionalString stdenv.isDarwin (''
+    cd src
+    autoreconf -f -i -I m4 -I glm4
+    cd -
+  '' + lib.concatMapStrings (x: ''
+    cd modules/${x}
+    autoreconf -f -i -I ../../src -I ../../src/m4 -I ../../src/glm4
+    cd -
+  '') withModules);
+
  configureFlags = [ "builddir" ]
  ++ lib.optional (!dllSupport) "--without-dynamic-modules"
  ++ lib.optional (readline != null) "--with-readline"
@ -74,35 +98,27 @@ stdenv.mkDerivation rec {
  ++ lib.optional (ffcallAvailable && (libffi != null)) "--with-dynamic-ffi"
  ++ lib.optional ffcallAvailable "--with-ffcall"
  ++ lib.optional (!ffcallAvailable) "--without-ffcall"
-  ++ builtins.map (x: "--with-module=" + x) withModules
+  ++ builtins.map (x: " --with-module=" + x) withModules
  ++ lib.optional threadSupport "--with-threads=POSIX_THREADS";

  preBuild = ''
    sed -e '/avcall.h/a\#include "config.h"' -i src/foreign.d
+    sed -i -re '/ cfree /d' -i modules/bindings/glibc/linux.lisp
    cd builddir
  '';

-  # Fails to build in parallel due to missing gnulib header dependency used in charstrg.d:
-  #   ../src/charstrg.d:319:10: fatal error: uniwidth.h: No such file or directory
-  enableParallelBuilding = false;
-
  postInstall =
    lib.optionalString (withModules != [])
      (''./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full''
      + lib.concatMapStrings (x: " " + x) withModules);

-  env.NIX_CFLAGS_COMPILE = "-O0 ${lib.optionalString (!stdenv.is64bit) "-falign-functions=4"}";
-
-  # TODO : make mod-check fails
-  doCheck = false;
+  env.NIX_CFLAGS_COMPILE = "-O0 -falign-functions=${if stdenv.is64bit then "8" else "4"}";

  meta = {
    description = "ANSI Common Lisp Implementation";
-    homepage = "http://clisp.cons.org";
+    homepage = "http://clisp.org";
    maintainers = lib.teams.lisp.members;
-    platforms = lib.platforms.unix;
-    # problems on Darwin: https://github.com/NixOS/nixpkgs/issues/20062
-    broken = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAarch64;
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Plus;
+    platforms = with lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/development/interpreters/clisp/gnulib_aarch64.patch
+++ b/pkgs/development/interpreters/clisp/gnulib_aarch64.patch
@ -0,0 +1,13 @@
+diff --git a/src/gllib/vma-iter.c b/src/gllib/vma-iter.c
+index 6045f21d7..d50a3a398 100644
+--- a/src/gllib/vma-iter.c
+++ b/src/gllib/vma-iter.c
+@@ -1327,7 +1327,7 @@ vma_iterate (vma_iterate_callback_fn callback, void *data)
+          In 64-bit processes, we could use vm_region_64 or mach_vm_region.
+          I choose vm_region_64 because it uses the same types as vm_region,
+          resulting in less conditional code.  */
+-# if defined __ppc64__ || defined __x86_64__
+# if defined __aarch64__ || defined __ppc64__ || defined __x86_64__
+       struct vm_region_basic_info_64 info;
+       mach_msg_type_number_t info_count = VM_REGION_BASIC_INFO_COUNT_64;
+ 
--- a/pkgs/development/interpreters/clisp/hg.nix
+++ b/pkgs/development/interpreters/clisp/hg.nix
@ -1,98 +0,0 @@
-# there are the following linking sets:
-# - boot (not installed): without modules, only used when building clisp
-# - base (default): contains readline and i18n, regexp and syscalls modules
-#   by default
-# - full: contains base plus modules in withModules
-{ lib, stdenv, fetchhg, libsigsegv, gettext, ncurses, readline, libX11
-, libXau, libXt, pcre, zlib, libXpm, xorgproto, libXext
-, libffi, libffcall, automake
-, coreutils
-# build options
-, threadSupport ? stdenv.hostPlatform.isx86
-, x11Support ? stdenv.hostPlatform.isx86
-, dllSupport ? true
-, withModules ? [
-    "pcre"
-    "rawsock"
-  ]
-  ++ lib.optionals stdenv.isLinux [ "bindings/glibc" "zlib" ]
-  ++ lib.optional x11Support "clx/new-clx"
-}:
-
-assert x11Support -> (libX11 != null && libXau != null && libXt != null
-  && libXpm != null && xorgproto != null && libXext != null);
-
-stdenv.mkDerivation rec {
-  version = "2.50pre20171114";
-  pname = "clisp";
-
-  src = fetchhg {
-    url = "http://hg.code.sf.net/p/clisp/clisp";
-    rev = "36df6dc59b8f";
-    sha256 = "1pidiv1m55lvc4ln8vx0ylnnhlj95y6hrfdq96nrj14f4v8fkvmr";
-  };
-
-  inherit libsigsegv gettext coreutils;
-
-  ffcallAvailable = stdenv.isLinux && (libffcall != null);
-
-  nativeBuildInputs = [ automake ]; # sometimes fails otherwise
-  buildInputs = [libsigsegv]
-  ++ lib.optional (gettext != null) gettext
-  ++ lib.optional (ncurses != null) ncurses
-  ++ lib.optional (pcre != null) pcre
-  ++ lib.optional (zlib != null) zlib
-  ++ lib.optional (readline != null) readline
-  ++ lib.optional (ffcallAvailable && (libffi != null)) libffi
-  ++ lib.optional ffcallAvailable libffcall
-  ++ lib.optionals x11Support [
-    libX11 libXau libXt libXpm xorgproto libXext
-  ];
-
-  # First, replace port 9090 (rather low, can be used)
-  # with 64237 (much higher, IANA private area, not
-  # anything rememberable).
-  # Also remove reference to a type that disappeared from recent glibc
-  # (seems the correct thing to do, found no reference to any solution)
-  postPatch = ''
-    sed -e 's@9090@64237@g' -i tests/socket.tst
-    sed -i 's@/bin/pwd@${coreutils}&@' src/clisp-link.in
-    find . -type f | xargs sed -e 's/-lICE/-lXau &/' -i
-
-    substituteInPlace modules/bindings/glibc/linux.lisp --replace "(def-c-type __swblk_t)" ""
-  '';
-
-  configureFlags = [ "builddir" ]
-  ++ lib.optional (!dllSupport) "--without-dynamic-modules"
-  ++ lib.optional (readline != null) "--with-readline"
-  # --with-dynamic-ffi can only exist with --with-ffcall - foreign.d does not compile otherwise
-  ++ lib.optional (ffcallAvailable && (libffi != null)) "--with-dynamic-ffi"
-  ++ lib.optional ffcallAvailable "--with-ffcall"
-  ++ lib.optional (!ffcallAvailable) "--without-ffcall"
-  ++ builtins.map (x: " --with-module=" + x) withModules
-  ++ lib.optional threadSupport "--with-threads=POSIX_THREADS";
-
-  preBuild = ''
-    sed -e '/avcall.h/a\#include "config.h"' -i src/foreign.d
-    sed -i -re '/ cfree /d' -i modules/bindings/glibc/linux.lisp
-    cd builddir
-  '';
-
-  postInstall =
-    lib.optionalString (withModules != [])
-      (''./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full''
-      + lib.concatMapStrings (x: " " + x) withModules);
-
-  env.NIX_CFLAGS_COMPILE = "-O0 ${lib.optionalString (!stdenv.is64bit) "-falign-functions=4"}";
-
-  # TODO : make mod-check fails
-  doCheck = false;
-
-  meta = {
-    description = "ANSI Common Lisp Implementation";
-    homepage = "http://clisp.cons.org";
-    maintainers = lib.teams.lisp.members;
-    # problems on Darwin: https://github.com/NixOS/nixpkgs/issues/20062
-    platforms = lib.platforms.linux;
-  };
-}
--- a/pkgs/development/interpreters/clisp/remove-cfree-binding.patch
+++ b/pkgs/development/interpreters/clisp/remove-cfree-binding.patch
@ -1,12 +0,0 @@
-diff --git a/modules/bindings/glibc/linux.lisp b/modules/bindings/glibc/linux.lisp
-index c40b4f8..1c8edca 100644
--- a/modules/bindings/glibc/linux.lisp
-+++ b/modules/bindings/glibc/linux.lisp
-@@ -648,7 +648,6 @@
- (def-call-out calloc (:arguments (nmemb size_t) (size size_t))
-   (:return-type c-pointer))
- (def-call-out free (:arguments (ptr c-pointer)) (:return-type nil))
-(def-call-out cfree (:arguments (ptr c-pointer)) (:return-type nil))
- (def-call-out valloc (:arguments (size size_t)) (:return-type c-pointer))
- 
- (def-call-out abort (:arguments) (:return-type nil))
--- a/pkgs/development/interpreters/micropython/default.nix
+++ b/pkgs/development/interpreters/micropython/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "micropython";
-  version = "1.19.1";
+  version = "1.20.0";

  src = fetchFromGitHub {
    owner = "micropython";
    repo = "micropython";
    rev = "v${version}";
-    sha256 = "sha256-BoX3Z3Zr/AQqkgRrq+UVgdoDqNESDTNsY9AtrElpzfA=";
+    sha256 = "sha256-XTkw0M2an13xlRlDusyHYqwNeHqhq4mryRC5/pk+5Ko=";
    fetchSubmodules = true;
  };

@ -33,7 +33,6 @@ stdenv.mkDerivation rec {
  doCheck = true;

  skippedTests = ""
-    + lib.optionalString (stdenv.isDarwin) " -e uasyncio_basic -e uasyncio_heaplock -e uasyncio_wait_task"
    + lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) " -e ffi_callback"
    + lib.optionalString (stdenv.isLinux && stdenv.isAarch64) " -e float_parse"
  ;
@ -49,7 +48,7 @@ stdenv.mkDerivation rec {
  installPhase = ''
    runHook preInstall
    mkdir -p $out/bin
-    install -Dm755 ports/unix/micropython -t $out/bin
+    install -Dm755 ports/unix/build-standard/micropython -t $out/bin
    runHook postInstall
  '';

--- a/pkgs/development/libraries/gtkmm/3.x.nix
+++ b/pkgs/development/libraries/gtkmm/3.x.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "gtkmm";
-  version = "3.24.7";
+  version = "3.24.8";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "HXo1r5xc7MrLJE7jwt65skVyDYUQrFx+b0tvmUfmeJw=";
+    sha256 = "0pQMZJIuW5WFVLI9TEHRg56p5D4NLls4Gc+0aCSgmMQ=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/libfyaml/default.nix
+++ b/pkgs/development/libraries/libfyaml/default.nix
@ -1,31 +1,39 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook, testers }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libfyaml";
-  version = "0.8";
+  version = "0.9";

  src = fetchFromGitHub {
    owner = "pantoniou";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-b/jRKe23NIVSydoczI+Ax2VjBJLfAEwF8SW61vIDTwA=";
+    repo = "libfyaml";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Id5pdFzjA9q67okfESO3LZH8jIz93mVgIEEuBbPjuGI=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];

  outputs = [ "bin" "dev" "out" "man" ];

+  configureFlags = [ "--disable-network" ];
+
  doCheck = true;

  preCheck = ''
    patchShebangs test
  '';

+  passthru.tests.pkg-config = testers.hasPkgConfigModules {
+    package = finalAttrs.finalPackage;
+  };
+
  meta = with lib; {
-    homepage = "https://github.com/pantoniou/libfyaml";
    description = "Fully feature complete YAML parser and emitter, supporting the latest YAML spec and passing the full YAML testsuite";
+    homepage = "https://github.com/pantoniou/libfyaml";
+    changelog = "https://github.com/pantoniou/libfyaml/releases/tag/v${finalAttrs.version}";
    license = licenses.mit;
    maintainers = [ maintainers.marsam ];
+    pkgConfigModules = [ "libfyaml" ];
    platforms = platforms.all;
  };
-}
+})
--- a/pkgs/development/libraries/libsolv/default.nix
+++ b/pkgs/development/libraries/libsolv/default.nix
@ -16,14 +16,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "0.7.24";
+  version = "0.7.25";
  pname = "libsolv";

  src = fetchFromGitHub {
    owner = "openSUSE";
    repo = "libsolv";
    rev = version;
-    sha256 = "sha256-UTVnGJO/9mQF9RwK75hh6IkoP1MwAlFaLCtdYU8uS34=";
+    sha256 = "sha256-OSYfv8dTyoa2f1T/zCEruKczickP5jS05xjYLQQiFaY=";
  };

  cmakeFlags = [
--- a/pkgs/development/libraries/nghttp3/default.nix
+++ b/pkgs/development/libraries/nghttp3/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "nghttp3";
-  version = "0.14.0";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "ngtcp2";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-DqqT8rgGlbV0upe0E37AR8bk3SIsoyCXt8xJzIkz9xc=";
+    hash = "sha256-ZnfwPgjBAI2elHrx7uzc3JX2MdeX/hsrFKj4TfMK2tI=";
  };

  outputs = [ "out" "dev" "doc" ];
--- a/pkgs/development/libraries/science/astronomy/stellarsolver/default.nix
+++ b/pkgs/development/libraries/science/astronomy/stellarsolver/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "stellarsolver";
-  version = "2.4";
+  version = "2.5";

  src = fetchFromGitHub {
    owner = "rlancaste";
    repo = pname;
    rev = version;
-    sha256 = "sha256-HYNkpgkiRtA1ZsiFkmYk3MT3fKgs2d2neSExVXBbsPc=";
+    sha256 = "sha256-0bFGHlkZnAZlnxlj8tY3s9yTWgkNtSsPFfudB3uvyOA=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -191,6 +191,7 @@
 , "patch-package"
 , "peerflix"
 , "peerflix-server"
+, {"pgrok-build-deps": "../../tools/networking/pgrok/build-deps"}
 , "pkg"
 , "pm2"
 , "pnpm"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/python-modules/aws-encryption-sdk/default.nix
+++ b/pkgs/development/python-modules/aws-encryption-sdk/default.nix
@ -48,7 +48,7 @@ buildPythonPackage rec {
    homepage = "https://aws-encryption-sdk-python.readthedocs.io/";
    changelog = "https://github.com/aws/aws-encryption-sdk-python/blob/v${version}/CHANGELOG.rst";
    description = "Fully compliant, native Python implementation of the AWS Encryption SDK.";
-    license = licenses.apsl20;
+    license = licenses.asl20;
    maintainers = with maintainers; [ anthonyroussel ];
  };
 }
--- a/pkgs/development/python-modules/base64io/default.nix
+++ b/pkgs/development/python-modules/base64io/default.nix
@ -23,7 +23,7 @@ buildPythonPackage rec {
    homepage = "https://base64io-python.readthedocs.io/";
    changelog = "https://github.com/aws/base64io-python/blob/${version}/CHANGELOG.rst";
    description = "Python stream implementation for base64 encoding/decoding";
-    license = licenses.apsl20;
+    license = licenses.asl20;
    maintainers = with maintainers; [ anthonyroussel ];
  };
 }
--- a/pkgs/development/python-modules/django-treebeard/default.nix
+++ b/pkgs/development/python-modules/django-treebeard/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "django-treebeard";
-  version = "4.6.1";
+  version = "4.7";
  format = "setuptools";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-hKs1BAJ31STrd5OeI1VoychWy1I8yWVXk7Zv6aPvRos=";
+    hash = "sha256-x1Gj+SQVjCiP6omvwlpxUZefrwG/Ef3HvjuFgJnfpW0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/led-ble/default.nix
+++ b/pkgs/development/python-modules/led-ble/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "led-ble";
-  version = "1.0.0";
+  version = "1.0.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-XAb/tJPUe/sNvcU7t63inMPBIz+AREioWXBuQa/c9T0=";
+    hash = "sha256-8DBA01QjW99OVYI9zC1Q+utnwzc10idUG7y+lmUbO4A=";
  };

  postPatch = ''
@ -34,10 +34,11 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
-    async-timeout
    bleak
    bleak-retry-connector
    flux-led
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    async-timeout
  ];

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/lifelines/default.nix
+++ b/pkgs/development/python-modules/lifelines/default.nix
@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "lifelines";
-  version = "0.27.7";
+  version = "0.27.8";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -29,7 +29,7 @@ buildPythonPackage rec {
    owner = "CamDavidsonPilon";
    repo = "lifelines";
    rev = "refs/tags/v${version}";
-    hash = "sha256-6ulg3R59QHy31CXit8tddi6F0vPKVRZDIu0zdS19xu0=";
+    hash = "sha256-2AjqN4TtBY1KtgFlY0E2UcFUHniHe2Hge+JaUQd4gO8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/primer3/default.nix
+++ b/pkgs/development/python-modules/primer3/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "primer3";
-  version = "2.0.0";
+  version = "2.0.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "libnano";
    repo = "primer3-py";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Ku2PVrWYWPKnNXeUQmstQedJg1O0hsQl4/iEnAMMEaY=";
+    hash = "sha256-WYn88Xv7WSc67TfYCq+i05tG8aKtWLUgc6axntvLF+8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
+++ b/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "pytelegrambotapi";
-  version = "4.13.0";
+  version = "4.14.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "eternnoir";
    repo = "pyTelegramBotAPI";
    rev = "refs/tags/${version}";
-    hash = "sha256-5P0DfQL8lwCY4nvp5efB7fO7YyBMTRaB4qflkc+Arso=";
+    hash = "sha256-R52j4JnoM0nlZvlcDox2Wz3WjTEstNaqbg8SPiPHD4c=";
  };

  passthru.optional-dependencies = {
--- a/pkgs/development/python-modules/pyfibaro/default.nix
+++ b/pkgs/development/python-modules/pyfibaro/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pyfibaro";
-  version = "0.7.3";
+  version = "0.7.4";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "rappenze";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-pCj69lLcoNTyZRe6SVkFpPK2Ex8927WzAJ5OCot9xP4=";
+    hash = "sha256-Z+JWwu40ober/9RNG9DLqlOlQyPwlAO3LhLnpr+4dL8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyixapi/default.nix
+++ b/pkgs/development/python-modules/pyixapi/default.nix
@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools-scm
+, requests
+, pyjwt
+}:
+
+buildPythonPackage rec {
+  pname = "pyixapi";
+  version = "0.2.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-c5a8Ldbzgh8gXuCDYbKk9zR6AoiBF3Y/VQvGlSwXpR4=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+  propagatedBuildInputs = [
+    requests
+    pyjwt
+  ];
+
+  pythonImportsCheck = [ "pyixapi" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/peering-manager/pyixapi/";
+    changelog = "https://github.com/peering-manager/pyixapi/releases/tag/${version}";
+    description = "Python API client library for IX-API";
+    license = licenses.asl20;
+    maintainers = teams.wdz.members;
+  };
+}
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "rapidfuzz";
-  version = "3.3.0";
+  version = "3.3.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "maxbachmann";
    repo = "RapidFuzz";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5JlEd7X0I/OmL260v2OMVI3h99TIpglv6Nt3EciEBEM=";
+    hash = "sha256-C+jQN0QXZzH0IKdC3O5uPNAEd+XSffi3nkwFSv2HqPY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@ -26,7 +26,7 @@

 buildPythonPackage rec {
  pname = "sagemaker";
-  version = "2.184.0.post0";
+  version = "2.187.0";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -35,7 +35,7 @@ buildPythonPackage rec {
    owner = "aws";
    repo = "sagemaker-python-sdk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-gQQsHJ9b5ZbbPW0nJRdudSwaL+Hc8kwBpK9um8QWQio=";
+    hash = "sha256-WxlWJfaxY7YhekOks/acCdtw2LCdX31H71BEfsQddxw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/yamlordereddictloader/default.nix
+++ b/pkgs/development/python-modules/yamlordereddictloader/default.nix
@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "yamlordereddictloader";
-  version = "0.4.0";
+  version = "0.4.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "03h8wa6pzqjiw25s3jv9gydn77gs444mf31lrgvpgy53kswz0c3z";
+    sha256 = "sha256-Nq8vYhD8/12k/EwS4dgV+XPc60EETnleHwYRXWNLyhM=";
  };

  propagatedBuildInputs = [ pyyaml ];
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-compute-runtime";
-  version = "23.26.26690.22";
+  version = "23.30.26918.20";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "compute-runtime";
    rev = version;
-    hash = "sha256-2ZFDnVfLYKNZbgFARYMWqLDjgH8aZY5SA3ZwQ85nPYo=";
+    hash = "sha256-dEznHRgAcJa/BBTD/AWJHlA7fNj2IXHHrYcKM4M+/1o=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/servers/web-apps/peering-manager/default.nix
+++ b/pkgs/servers/web-apps/peering-manager/default.nix
@ -9,21 +9,30 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "peering-manager";
-  version = "1.7.4";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-mXva4c5Rtjq/jFJl3yGGlVrggzGJ3awN0+xoDnDWBSA=";
+    sha256 = "sha256-N34piaSP+QKZzjT42nAR47DTtqGtZ/GMeTeTyRQw3/4=";
  };

+  patches = [
+    # restore support unix sockets for redis connections
+    # https://github.com/peering-manager/peering-manager/pull/773
+    (fetchpatch {
+      url = "https://github.com/peering-manager/peering-manager/commit/ff66823c04d8c545a46dcec91d61eda7c21f99aa.patch";
+      hash = "sha256-x5E0LFhGrc5LPY4pwAMNUtigltLGqqbRCe1PIm0yLA8=";
+    })
+  ];
+
  format = "other";

  propagatedBuildInputs = with python3.pkgs; [
    django
    djangorestframework
-    django-cacheops
+    django-redis
    django-debug-toolbar
    django-filter
    django-postgresql-netfields
@ -32,11 +41,13 @@ python3.pkgs.buildPythonApplication rec {
    django-tables2
    django-taggit
    drf-spectacular
+    drf-spectacular-sidecar
    jinja2
    markdown
    napalm
    packaging
    psycopg2
+    pyixapi
    pynetbox
    pyyaml
    requests
--- a/pkgs/tools/admin/aws-encryption-sdk-cli/default.nix
+++ b/pkgs/tools/admin/aws-encryption-sdk-cli/default.nix
@ -46,7 +46,8 @@ python3Packages.buildPythonApplication rec {
    homepage = "https://aws-encryption-sdk-cli.readthedocs.io/";
    changelog = "https://github.com/aws/aws-encryption-sdk-cli/blob/v${version}/CHANGELOG.rst";
    description = "CLI wrapper around aws-encryption-sdk-python";
-    license = licenses.apsl20;
+    license = licenses.asl20;
+    mainProgram = "aws-encryption-cli";
    maintainers = with maintainers; [ anthonyroussel ];
  };
 }
--- a/pkgs/tools/misc/tailspin/default.nix
+++ b/pkgs/tools/misc/tailspin/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "tailspin";
-  version = "1.4.0";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = "bensadeh";
    repo = "tailspin";
    rev = "refs/tags/${version}";
-    hash = "sha256-mtMUHiuGuzLEJk4S+AnpyYGPn0naIP45R9itzXLhG8g=";
+    hash = "sha256-Uqo47g0AXyRNFb1RmVVJzdFI2g1Oakx85Sg+zIN5B2A=";
  };

-  cargoHash = "sha256-M+TUdKtR8/vpkyJiO17LBPDgXq207pC2cUKE7krarfY=";
+  cargoHash = "sha256-0ROLrdS3oBZuh+nXW9mTS2Jn/D+iLAUaYqhKvmKAPTo=";

  meta = with lib; {
    description = "A log file highlighter";
--- a/pkgs/tools/networking/kea/default.nix
+++ b/pkgs/tools/networking/kea/default.nix
@ -51,6 +51,10 @@ stdenv.mkDerivation rec {
    "--with-mysql=${lib.getDev libmysqlclient}/bin/mysql_config"
    "--with-pgsql=${postgresql}/bin/pg_config"
  ];
+  postConfigure = ''
+    # Mangle embedded paths to dev-only inputs.
+    sed -e "s|$NIX_STORE/[a-z0-9]\{32\}-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" -i config.report
+  '';

  nativeBuildInputs = [
    autoreconfHook
--- a/pkgs/tools/networking/pgrok/add_version_to_package.json.patch
+++ b/pkgs/tools/networking/pgrok/add_version_to_package.json.patch
@ -1,11 +0,0 @@
-diff --git a/package.json b/package.json
-index 35d34c5..82eda74 100644
--- a/package.json
-+++ b/package.json
-@@ -1,5 +1,6 @@
- {
-   "name": "pgrokd",
-+  "version": "0.0.0",
-   "scripts": {
-     "dev": "vite",
-     "build": "tsc && vite build --outDir=../cli/dist --emptyOutDir",
--- a/pkgs/tools/networking/pgrok/build-deps/package.json
+++ b/pkgs/tools/networking/pgrok/build-deps/package.json
@ -0,0 +1,38 @@
+{
+  "name": "pgrokd",
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc && vite build --outDir=dist --emptyOutDir",
+    "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0"
+  },
+  "version": "1.4.0",
+  "dependencies": {
+    "axios": "~1.4.0",
+    "react": "~18.2.0",
+    "react-dom": "~18.2.0",
+    "react-router-dom": "~6.15.0",
+    "@headlessui/react": "~1.7.17",
+    "@heroicons/react": "~2.0.18",
+    "@tailwindcss/forms": "~0.5.4",
+    "@trivago/prettier-plugin-sort-imports": "~4.2.0",
+    "@types/node": "~20.5.1",
+    "@types/react": "~18.2.15",
+    "@types/react-dom": "~18.2.7",
+    "@typescript-eslint/eslint-plugin": "~6.0.0",
+    "@typescript-eslint/parser": "~6.0.0",
+    "@vitejs/plugin-react": "~4.0.3",
+    "autoprefixer": "~10.4.15",
+    "code-inspector-plugin": "v0.1.9",
+    "eslint": "~8.45.0",
+    "eslint-plugin-import": "~2.28.0",
+    "eslint-plugin-react": "~7.33.2",
+    "eslint-plugin-react-hooks": "~4.6.0",
+    "eslint-plugin-react-refresh": "~0.4.3",
+    "eslint-plugin-unicorn": "~48.0.1",
+    "postcss": "~8.4.28",
+    "prettier": "~3.0.2",
+    "tailwindcss": "~3.3.3",
+    "typescript": "~5.0.2",
+    "vite": "~4.4.5"
+  }
+}
--- a/pkgs/tools/networking/pgrok/default.nix
+++ b/pkgs/tools/networking/pgrok/default.nix
@ -3,23 +3,22 @@
 , callPackage
 , fetchFromGitHub
 }:
-let
+buildGoModule rec {
+  pname = "pgrok";
  version = "1.4.0";
+
  src = fetchFromGitHub {
    owner = "pgrok";
    repo = "pgrok";
    rev = "v${version}";
    hash = "sha256-2k3XLXmf1Xnx4HvS7sD/aq+78Z4I7uY4djV958n5TX4=";
  };
-  web = callPackage ./web.nix { inherit src version; };
-in
-buildGoModule {
-  pname = "pgrok";
-  inherit version src;

  vendorHash = "sha256-M0xVHRh9NKPxmUEmx1dDQUZc8aXcdAfHisQAnt72RdY=";

-  outputs = [ "out" "server" "web" ];
+  outputs = [ "out" "server" ];
+
+  web = callPackage ./web.nix { inherit src version; };

  ldflags = [
    "-s"
@ -43,7 +42,6 @@ buildGoModule {

  postInstall = ''
    moveToOutput bin/pgrokd $server
-    cp -r ${web} $web
  '';

  passthru.updateScript = ./update.sh;
--- a/pkgs/tools/networking/pgrok/package-lock.json
+++ b/pkgs/tools/networking/pgrok/package-lock.json
--- a/pkgs/tools/networking/pgrok/update.sh
+++ b/pkgs/tools/networking/pgrok/update.sh
@ -1,58 +1,40 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nix wget nix-prefetch-github moreutils jq prefetch-npm-deps nodejs
-
-# adapted from https://github.com/NixOS/nixpkgs/blob/f4ffbe5ecb8039816f2dae60526e0a47f65a2b4e/pkgs/servers/memos/update.sh
+#!nix-shell -i bash -p nix curl nix-update jq

 set -euo pipefail

+nix-update
+
+cd "$(dirname "$0")"
+
+nixpkgs=../../../..
+node_packages="$nixpkgs/pkgs/development/node-packages"
+pgrok="$nixpkgs/pkgs/tools/networking/pgrok"
+
 TARGET_VERSION_REMOTE=$(curl -s https://api.github.com/repos/pgrok/pgrok/releases/latest | jq -r ".tag_name")
 TARGET_VERSION=${TARGET_VERSION_REMOTE#v}

-if [[ "$UPDATE_NIX_OLD_VERSION" == "$TARGET_VERSION" ]]; then
-  echo "pgrok is up-to-date: ${UPDATE_NIX_OLD_VERSION}"
-  exit 0
-fi
-
-extractVendorHash() {
-  original="${1?original hash missing}"
-  result="$(nix-build -A pgrok.goModules 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
-  [ -z "$result" ] && { echo "$original"; } || { echo "$result"; }
-}
-
-replaceHash() {
-  old="${1?old hash missing}"
-  new="${2?new hash missing}"
-  awk -v OLD="$old" -v NEW="$new" '{
-    if (i=index($0, OLD)) {
-      $0 = substr($0, 1, i-1) NEW substr($0, i+length(OLD));
-    }
-    print $0;
-  }' ./pkgs/tools/networking/pgrok/default.nix | sponge ./pkgs/tools/networking/pgrok/default.nix
-}
-
-# change version number
-sed -e "s/version =.*;/version = \"$TARGET_VERSION\";/g" \
-    -i ./pkgs/tools/networking/pgrok/default.nix
-
-# update hash
-SRC_HASH="$(nix-instantiate --eval -A pgrok.src.outputHash | tr -d '"')"
-NEW_HASH="$(nix-prefetch-github pgrok pgrok --rev v$TARGET_VERSION | jq -r .hash)"
-
-replaceHash "$SRC_HASH" "$NEW_HASH"
-
-GO_HASH="$(nix-instantiate --eval -A pgrok.vendorHash | tr -d '"')"
-EMPTY_HASH="$(nix-instantiate --eval -A lib.fakeHash | tr -d '"')"
-replaceHash "$GO_HASH" "$EMPTY_HASH"
-replaceHash "$EMPTY_HASH" "$(extractVendorHash "$GO_HASH")"
-
-# update src yarn lock
 SRC_FILE_BASE="https://raw.githubusercontent.com/pgrok/pgrok/v$TARGET_VERSION"

-pushd ./pkgs/tools/networking/pgrok
-wget -q "$SRC_FILE_BASE/pgrokd/web/package.json"
-npm install --package-lock-only
-rm package.json*
-NPM_HASH=$(prefetch-npm-deps ./package-lock.json)
-popd
+# replace ^ versions with ~, replace outdir to dist
+curl https://raw.githubusercontent.com/pgrok/pgrok/main/pgrokd/web/package.json \
+    | jq "{name,scripts,version: \"${TARGET_VERSION}\",dependencies: (.dependencies + .devDependencies) }" \
+    | sed -e 's/"\^/"~/g' -e 's/\.\.\/cli\/dist/dist/g' \
+    > "$pgrok/build-deps/package.json.new"
+
+old_deps="$(jq '.dependencies' "$pgrok/build-deps/package.json")"
+new_deps="$(jq '.dependencies' "$pgrok/build-deps/package.json.new")"
+
+if [[ "$old_deps" == "$new_deps" ]]; then
+    echo "package.json dependencies not changed, do simple version change"
+
+    sed -e '/^  "pgrok-build-deps/,+3 s/version = ".*"/version = "'"$TARGET_VERSION"'"/' \
+        --in-place "$node_packages"/node-packages.nix
+    mv build-deps/package.json{.new,}
+else
+    echo "package.json dependencies changed, updating nodePackages"
+    mv build-deps/package.json{.new,}
+
+    ./"$node_packages"/generate.sh
+fi

-sed -i -E -e "s#npmDepsHash = \".*\"#npmDepsHash = \"$NPM_HASH\"#" ./pkgs/tools/networking/pgrok/web.nix
--- a/pkgs/tools/networking/pgrok/web.nix
+++ b/pkgs/tools/networking/pgrok/web.nix
@ -1,29 +1,30 @@
-{ buildNpmPackage
-, src
+{ src
 , version
+, nodejs
+, nodePackages
+, stdenvNoCC
 }:
-buildNpmPackage {
-    name = "pgrok-web";
-    inherit src version;
-    sourceRoot = "${src.name}/pgrokd/web";
+let
+  build-deps = nodePackages."pgrok-build-deps-../../tools/networking/pgrok/build-deps";
+in
+stdenvNoCC.mkDerivation {
+  pname = "pgrok-web";
+  inherit version;
+  src = "${src}/pgrokd/web";

-    npmDepsHash = "sha256-f4pDBoG6sTJE3aUknqUvHHpBR9KWo/B4YMrWHkGbvA8=";
+  nativeBuildInputs = [ nodejs ];

-    # Upstream doesn't have a lockfile
-    postPatch = ''
-      cp ${./package-lock.json} ./package-lock.json
-      substituteInPlace ./package.json \
-        --replace "../cli/dist" "$out"
-    '';
+  buildPhase = ''
+    runHook preBuild
+    cp ${./build-deps/package.json} package.json
+    ln -s ${build-deps}/lib/node_modules/pgrokd/node_modules node_modules
+    npm run build
+    runHook postBuild
+  '';

-    patches = [
-      ./add_version_to_package.json.patch
-    ];
-
-    dontInstall = true;
-    dontFixup = true;
-
-    NODE_OPTIONS = "--openssl-legacy-provider";
-
-    npmPackFlags = [ "--ignore-scripts" ];
-  }
+  installPhase = ''
+    runHook preInstall
+    cp -r dist $out
+    runHook postInstall
+  '';
+}
--- a/pkgs/tools/networking/sing-box/default.nix
+++ b/pkgs/tools/networking/sing-box/default.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "sing-box";
-  version = "1.4.3";
+  version = "1.4.5";

  src = fetchFromGitHub {
    owner = "SagerNet";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-ptnppqh7f6Cn5pMrqtqM39zFh2nEpOSrZtTxhSzFXS0=";
+    hash = "sha256-Tb+4k0fwb22gif4SSNDmIBDq346CinhyqxwE0fhkXq4=";
  };

-  vendorHash = "sha256-XHZoXnQJMfnaPbHHoC1toxqjq/jifAI2UqZ4cc6y034=";
+  vendorHash = "sha256-EZ+ehh/FuQWNHqfXWMoSI+z9+OKDTVzRn51CYR/ezZw=";

  tags = [
    "with_quic"
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -3583,6 +3583,8 @@ with pkgs;

  callaudiod = callPackage ../applications/audio/callaudiod { };

+  castopod = callPackage ../applications/audio/castopod { };
+
  calls = callPackage ../applications/networking/calls { };

  castnow = callPackage ../tools/networking/castnow { };
@ -26162,18 +26164,7 @@ with pkgs;

  # CLISP
  clisp = wrapLisp {
-    pkg = callPackage ../development/interpreters/clisp {
-    # On newer readline8 fails as:
-    #  #<FOREIGN-VARIABLE "rl_readline_state" #x...>
-    #   does not have the required size or alignment
-    readline = readline63;
-    };
-    faslExt = "fas";
-    flags = ["-E" "UTF-8"];
-  };
-
-  clisp-tip = wrapLisp {
-    pkg = callPackage ../development/interpreters/clisp/hg.nix { };
+    pkg = callPackage ../development/interpreters/clisp { };
    faslExt = "fas";
    flags = ["-E" "UTF-8"];
  };
@ -30546,11 +30537,6 @@ with pkgs;

  aewan = callPackage ../applications/editors/aewan { };

-  afterstep = callPackage ../applications/window-managers/afterstep {
-    fltk = fltk13;
-    gtk = gtk2;
-  };
-
  agedu = callPackage ../tools/misc/agedu { };

  agenda = callPackage ../applications/office/agenda { };
@ -30824,8 +30810,6 @@ with pkgs;

  bchoppr = callPackage ../applications/audio/bchoppr { };

-  berry = callPackage ../applications/window-managers/berry { };
-
  bespokesynth = darwin.apple_sdk_11_0.callPackage ../applications/audio/bespokesynth {
    inherit (darwin.apple_sdk_11_0.frameworks) Accelerate Cocoa WebKit CoreServices CoreAudioKit IOBluetooth MetalKit;
  };
@ -32814,8 +32798,6 @@ with pkgs;

  spectmorph = callPackage ../applications/audio/spectmorph { };

-  smallwm = callPackage ../applications/window-managers/smallwm { };
-
  smooth = callPackage ../development/libraries/smooth { };

  spectrwm = callPackage ../applications/window-managers/spectrwm { };
@ -32958,7 +32940,7 @@ with pkgs;

  kitti3 = python3.pkgs.callPackage ../applications/window-managers/i3/kitti3.nix { };

-  waybox = callPackage ../applications/window-managers/waybox {
+  waybox = callPackage ../by-name/wa/waybox/package.nix {
    wlroots = wlroots_0_15;
  };

@ -34271,8 +34253,6 @@ with pkgs;

  nncp = darwin.apple_sdk_11_0.callPackage ../tools/misc/nncp { };

-  notion = callPackage ../applications/window-managers/notion { };
-
  nootka = qt5.callPackage ../applications/audio/nootka { };

  novnc = callPackage ../applications/networking/novnc { };
@ -34867,7 +34847,7 @@ with pkgs;

  pdfslicer = callPackage ../applications/misc/pdfslicer { };

-  pekwm = callPackage ../applications/window-managers/pekwm {
+  pekwm = callPackage ../by-name/pe/pekwm/package.nix {
    awk = gawk;
    grep = gnugrep;
    sed = gnused;
@ -35279,8 +35259,6 @@ with pkgs;

  ratox = callPackage ../applications/networking/instant-messengers/ratox { };

-  ratpoison = callPackage ../applications/window-managers/ratpoison { };
-
  rawtherapee = callPackage ../applications/graphics/rawtherapee {
    fftw = fftwSinglePrec;
  };
@ -36170,8 +36148,6 @@ with pkgs;

  tinywl = callPackage ../applications/window-managers/tinywl { };

-  tinywm = callPackage ../applications/window-managers/tinywm { };
-
  tree-from-tags = callPackage ../applications/audio/tree-from-tags { };

  tdrop = callPackage ../applications/misc/tdrop { };
@ -36551,8 +36527,6 @@ with pkgs;

  vwm = callPackage ../applications/window-managers/vwm { };

-  yeahwm = callPackage ../applications/window-managers/yeahwm { };
-
  vym = callPackage ../applications/misc/vym {
    inherit (libsForQt5) qmake qtscript qtsvg qtbase wrapQtAppsHook;
  };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -8319,6 +8319,8 @@ self: super: with self; {

  pyisy = callPackage ../development/python-modules/pyisy { };

+  pyixapi = callPackage ../development/python-modules/pyixapi { };
+
  pykrakenapi = callPackage ../development/python-modules/pykrakenapi { };

  pylddwrap = callPackage ../development/python-modules/pylddwrap { };