Merge remote-tracking branch 'origin/master' into staging-next

2023-03-09 17:03:45 +01:00 · 2023-03-09 17:03:45 +01:00 · bda90e08eb
commit bda90e08eb
parent a765d4b299 287805fcb7
67 changed files with 635 additions and 233 deletions
--- a/lib/modules.nix
+++ b/lib/modules.nix
@ -21,6 +21,7 @@ let
    isBool
    isFunction
    isList
+    isPath
    isString
    length
    mapAttrs
@ -45,6 +46,9 @@ let
    showOption
    unknownModule
    ;
+  inherit (lib.strings)
+    isConvertibleWithToString
+    ;

  showDeclPrefix = loc: decl: prefix:
    " - option(s) with prefix `${showOption (loc ++ [prefix])}' in module `${decl._file}'";
@ -403,7 +407,7 @@ rec {
            key = module.key;
            module = module;
            modules = collectedImports.modules;
-            disabled = module.disabledModules ++ collectedImports.disabled;
+            disabled = (if module.disabledModules != [] then [{ file = module._file; disabled = module.disabledModules; }] else []) ++ collectedImports.disabled;
          }) initialModules);

      # filterModules :: String -> { disabled, modules } -> [ Module ]
@ -412,10 +416,30 @@ rec {
      # modules recursively. It returns the final list of unique-by-key modules
      filterModules = modulesPath: { disabled, modules }:
        let
-          moduleKey = m: if isString m && (builtins.substring 0 1 m != "/")
-            then toString modulesPath + "/" + m
-            else toString m;
-          disabledKeys = map moduleKey disabled;
+          moduleKey = file: m:
+            if isString m
+            then
+              if builtins.substring 0 1 m == "/"
+              then m
+              else toString modulesPath + "/" + m
+
+            else if isConvertibleWithToString m
+            then
+              if m?key && m.key != toString m
+              then
+                throw "Module `${file}` contains a disabledModules item that is an attribute set that can be converted to a string (${toString m}) but also has a `.key` attribute (${m.key}) with a different value. This makes it ambiguous which module should be disabled."
+              else
+                toString m
+
+            else if m?key
+            then
+              m.key
+
+            else if isAttrs m
+            then throw "Module `${file}` contains a disabledModules item that is an attribute set, presumably a module, that does not have a `key` attribute. This means that the module system doesn't have any means to identify the module that should be disabled. Make sure that you've put the correct value in disabledModules: a string path relative to modulesPath, a path value, or an attribute set with a `key` attribute."
+            else throw "Each disabledModules item must be a path, string, or a attribute set with a key attribute, or a value supported by toString. However, one of the disabledModules items in `${toString file}` is none of that, but is of type ${builtins.typeOf m}.";
+
+          disabledKeys = concatMap ({ file, disabled }: map (moduleKey file) disabled) disabled;
          keyFilter = filter (attrs: ! elem attrs.key disabledKeys);
        in map (attrs: attrs.module) (builtins.genericClosure {
          startSet = keyFilter modules;
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@ -141,6 +141,14 @@ checkConfigError "The option .*enable.* does not exist. Definition values:\n\s*-
 checkConfigError "attribute .*enable.* in selection path .*config.enable.* not found" "$@" ./disable-define-enable.nix ./disable-declare-enable.nix
 checkConfigError "attribute .*enable.* in selection path .*config.enable.* not found" "$@" ./disable-enable-modules.nix

+checkConfigOutput '^true$' 'config.positive.enable' ./disable-module-with-key.nix
+checkConfigOutput '^false$' 'config.negative.enable' ./disable-module-with-key.nix
+checkConfigError 'Module ..*disable-module-bad-key.nix. contains a disabledModules item that is an attribute set, presumably a module, that does not have a .key. attribute. .*' 'config.enable' ./disable-module-bad-key.nix
+
+# Not sure if we want to keep supporting module keys that aren't strings, paths or v?key, but we shouldn't remove support accidentally.
+checkConfigOutput '^true$' 'config.positive.enable' ./disable-module-with-toString-key.nix
+checkConfigOutput '^false$' 'config.negative.enable' ./disable-module-with-toString-key.nix
+
 # Check _module.args.
 set -- config.enable ./declare-enable.nix ./define-enable-with-custom-arg.nix
 checkConfigError 'while evaluating the module argument .*custom.* in .*define-enable-with-custom-arg.nix.*:' "$@"
@ -358,6 +366,10 @@ checkConfigOutput '^"The option `a\.b. defined in `.*/doRename-warnings\.nix. ha
  config.result \
  ./doRename-warnings.nix

+# Anonymous modules get deduplicated by key
+checkConfigOutput '^"pear"$' config.once.raw ./merge-module-with-key.nix
+checkConfigOutput '^"pear\\npear"$' config.twice.raw ./merge-module-with-key.nix
+
 cat <<EOF
 ====== module tests ======
 $pass Pass
--- a/lib/tests/modules/disable-module-bad-key.nix
+++ b/lib/tests/modules/disable-module-bad-key.nix
@ -0,0 +1,16 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+
+  moduleWithKey = { config, ... }: {
+    config = {
+      enable = true;
+    };
+  };
+in
+{
+  imports = [
+    ./declare-enable.nix
+  ];
+  disabledModules = [ { } ];
+}
--- a/lib/tests/modules/disable-module-with-key.nix
+++ b/lib/tests/modules/disable-module-with-key.nix
@ -0,0 +1,34 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+
+  moduleWithKey = {
+    key = "disable-module-with-key.nix#moduleWithKey";
+    config = {
+      enable = true;
+    };
+  };
+in
+{
+  options = {
+    positive = mkOption {
+      type = types.submodule {
+        imports = [
+          ./declare-enable.nix
+          moduleWithKey
+        ];
+      };
+      default = {};
+    };
+    negative = mkOption {
+      type = types.submodule {
+        imports = [
+          ./declare-enable.nix
+          moduleWithKey
+        ];
+        disabledModules = [ moduleWithKey ];
+      };
+      default = {};
+    };
+  };
+}
--- a/lib/tests/modules/disable-module-with-toString-key.nix
+++ b/lib/tests/modules/disable-module-with-toString-key.nix
@ -0,0 +1,34 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+
+  moduleWithKey = {
+    key = 123;
+    config = {
+      enable = true;
+    };
+  };
+in
+{
+  options = {
+    positive = mkOption {
+      type = types.submodule {
+        imports = [
+          ./declare-enable.nix
+          moduleWithKey
+        ];
+      };
+      default = {};
+    };
+    negative = mkOption {
+      type = types.submodule {
+        imports = [
+          ./declare-enable.nix
+          moduleWithKey
+        ];
+        disabledModules = [ 123 ];
+      };
+      default = {};
+    };
+  };
+}
--- a/lib/tests/modules/merge-module-with-key.nix
+++ b/lib/tests/modules/merge-module-with-key.nix
@ -0,0 +1,49 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+
+  moduleWithoutKey = {
+    config = {
+      raw = "pear";
+    };
+  };
+
+  moduleWithKey = {
+    key = __curPos.file + "#moduleWithKey";
+    config = {
+      raw = "pear";
+    };
+  };
+
+  decl = {
+    options = {
+      raw = mkOption {
+        type = types.lines;
+      };
+    };
+  };
+in
+{
+  options = {
+    once = mkOption {
+      type = types.submodule {
+        imports = [
+          decl
+          moduleWithKey
+          moduleWithKey
+        ];
+      };
+      default = {};
+    };
+    twice = mkOption {
+      type = types.submodule {
+        imports = [
+          decl
+          moduleWithoutKey
+          moduleWithoutKey
+        ];
+      };
+      default = {};
+    };
+  };
+}
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -8948,7 +8948,8 @@
    githubId = 13547699;
    name = "Corin Hoad";
    keys = [{
-      fingerprint = "BA3A 5886 AE6D 526E 20B4  57D6 6A37 DF94 8318 8492";
+      # fingerprint = "BA3A 5886 AE6D 526E 20B4  57D6 6A37 DF94 8318 8492"; # old key, superseded
+      fingerprint = "6E69 6A19 4BD8 BFAE 7362  ACDB 6437 4619 95CA 7F16";
    }];
  };
  lux = {
--- a/nixos/doc/manual/development/replace-modules.section.md
+++ b/nixos/doc/manual/development/replace-modules.section.md
@ -8,8 +8,15 @@ the system on a stable release.

 `disabledModules` is a top level attribute like `imports`, `options` and
 `config`. It contains a list of modules that will be disabled. This can
-either be the full path to the module or a string with the filename
-relative to the modules path (eg. \<nixpkgs/nixos/modules> for nixos).
+either be:
+ - the full path to the module,
+ - or a string with the filename relative to the modules path (eg. \<nixpkgs/nixos/modules> for nixos),
+ - or an attribute set containing a specific `key` attribute.
+
+The latter allows some modules to be disabled, despite them being distributed
+via attributes instead of file paths. The `key` should be globally unique, so
+it is recommended to include a file path in it, or rely on a framework to do it
+for you.

 This example will replace the existing postgresql module with the
 version defined in the nixos-unstable channel while keeping the rest of
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -15,11 +15,11 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1qayw19mb7f0gcgcvl57gpacrqsyx2jvc6s63vzbx8jmf5qnk71a";
-    x86_64-darwin = "02z9026kp66lx6pll46xx790jj7c7wh2ca7xim373x90k8hm4kwz";
-    aarch64-linux = "1izqhzvv46p05k1z2yg380ddwmar4w2pbrd0dyvkdysvp166y931";
-    aarch64-darwin = "1zcr653ssck4nc3vf04l6bilnjdsiqscw62g1wzbyk6s50133cx8";
-    armv7l-linux = "0n914rcfn2m9zsbnkd82cmw88qbpssv6jk3g8ig3wqlircbgrw0h";
+    x86_64-linux = "11w2gzhp0vlpygk93cksxhkimc9y8w862gn9450xkzi1jsps5lj4";
+    x86_64-darwin = "0ya17adx2vbi800ws5sfqq03lrjjk6kbclrfrc2zfij2ha05xl8z";
+    aarch64-linux = "15kzjs1ha5x2hcq28nkbb0rim1v694jj6p9sz226rai3bmq9airg";
+    aarch64-darwin = "1cggppblr42jzpcz3g8052w5y1b9392iizpvg6y7001kw66ndp3n";
+    armv7l-linux = "01qqhhl5ffvba1pk4jj3q7sbahq7cvy81wvmgng1cmaj5b8m8dgp";
  }.${system} or throwSystem;

  sourceRoot = if stdenv.isDarwin then "" else ".";
@ -29,7 +29,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.75.0.23033";
+    version = "1.76.0.23062";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/misc/organicmaps/default.nix
+++ b/pkgs/applications/misc/organicmaps/default.nix
@ -15,17 +15,19 @@
 , zlib
 , icu
 , freetype
+, pugixml
+, nix-update-script
 }:

 mkDerivation rec {
  pname = "organicmaps";
-  version = "2023.01.25-3";
+  version = "2023.03.05-5";

  src = fetchFromGitHub {
    owner = "organicmaps";
    repo = "organicmaps";
    rev = "${version}-android";
-    sha256 = "sha256-4nlD/GFOoBOCXVWtC7i6SUquEbob5++GyagZOTznygU=";
+    sha256 = "sha256-PfudozmrL8jNS/99nxSn0B3E53W34m4/ZN0y2ucB2WI=";
    fetchSubmodules = true;
  };

@ -55,6 +57,7 @@ mkDerivation rec {
    zlib
    icu
    freetype
+    pugixml
  ];

  # Yes, this is PRE configure. The configure phase uses cmake
@ -62,6 +65,13 @@ mkDerivation rec {
    bash ./configure.sh
  '';

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+      extraArgs = [ "-vr" "(.*)-android" ];
+    };
+  };
+
  meta = with lib; {
    # darwin: "invalid application of 'sizeof' to a function type"
    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
--- a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
@ -3,6 +3,7 @@
 { stdenv
 , fetchurl
 , lib
+, makeWrapper

 , binutils-unwrapped
 , xz
@ -62,6 +63,10 @@ stdenv.mkDerivation rec {
    inherit sha256;
  };

+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
  unpackCmd = "${binutils-unwrapped}/bin/ar p $src data.tar.xz | ${xz}/bin/xz -dc | ${gnutar}/bin/tar -xf -";
  sourceRoot = ".";

@ -170,7 +175,7 @@ stdenv.mkDerivation rec {
      --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}

    substituteInPlace $out/opt/microsoft/${shortName}/xdg-mime \
-      --replace "''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
+      --replace "\''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "\''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
      --replace "xdg_system_dirs=/usr/local/share/:/usr/share/" "xdg_system_dirs=/run/current-system/sw/share/" \
      --replace /usr/bin/file ${file}/bin/file

@ -178,8 +183,13 @@ stdenv.mkDerivation rec {
      --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}

    substituteInPlace $out/opt/microsoft/${shortName}/xdg-settings \
-      --replace "''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
-      --replace "''${XDG_CONFIG_DIRS:-/etc/xdg}" "''${XDG_CONFIG_DIRS:-/run/current-system/sw/etc/xdg}"
+      --replace "\''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "\''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
+      --replace "\''${XDG_CONFIG_DIRS:-/etc/xdg}" "\''${XDG_CONFIG_DIRS:-/run/current-system/sw/etc/xdg}"
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/${longName}" \
+      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.pname}-${gtk3.version}"
  '';

  meta = with lib; {
--- a/pkgs/applications/networking/instant-messengers/jackline/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jackline/default.nix
@ -4,7 +4,7 @@ with ocamlPackages;

 buildDunePackage rec {
  pname = "jackline";
-  version = "unstable-2022-05-27";
+  version = "unstable-2023-02-24";

  minimalOCamlVersion = "4.08";

@ -13,8 +13,8 @@ buildDunePackage rec {
  src = fetchFromGitHub {
    owner  = "hannesm";
    repo   = "jackline";
-    rev    = "d8f7c504027a0dd51966b2b7304d6daad155a05b";
-    hash = "sha256-6SWYl2mB0g8JNVHBeTnZEbzOaTmVbsRMMEs+3j/ewwk=";
+    rev    = "846be4e7fcddf45e66e0ff5b29fb5a212d6ee8c3";
+    hash = "sha256-/j3VJRx/w9HQUnfoq/4gMWV5oVdRiPGddrgbCDk5y8c=";
  };

  nativeBuildInpts = [
--- a/pkgs/applications/networking/mullvad/mullvad.nix
+++ b/pkgs/applications/networking/mullvad/mullvad.nix
@ -15,6 +15,7 @@
 , enableOpenvpn ? true
 , openvpn-mullvad
 , shadowsocks-rust
+, installShellFiles
 }:
 rustPlatform.buildRustPackage rec {
  pname = "mullvad";
@ -44,6 +45,7 @@ rustPlatform.buildRustPackage rec {
    protobuf
    makeWrapper
    git
+    installShellFiles
  ];

  buildInputs = [
@ -59,6 +61,17 @@ rustPlatform.buildRustPackage rec {
    ln -s ${libwg}/lib/libwg.a $dest
  '';

+  postInstall = ''
+    compdir=$(mktemp -d)
+    for shell in bash zsh fish; do
+      $out/bin/mullvad shell-completions $shell $compdir
+    done
+    installShellCompletion --cmd mullvad \
+      --bash $compdir/mullvad.bash \
+      --zsh $compdir/_mullvad \
+      --fish $compdir/mullvad.fish
+  '';
+
  postFixup =
    # Place all binaries in the 'mullvad-' namespace, even though these
    # specific binaries aren't used in the lifetime of the program.
--- a/pkgs/applications/version-management/redmine/Gemfile.lock
+++ b/pkgs/applications/version-management/redmine/Gemfile.lock
@ -60,14 +60,14 @@ GEM
      xpath (~> 3.2)
    childprocess (3.0.0)
    chunky_png (1.4.0)
-    concurrent-ruby (1.1.10)
+    concurrent-ruby (1.2.2)
    crass (1.0.6)
-    css_parser (1.12.0)
+    css_parser (1.14.0)
      addressable
    csv (3.1.9)
    docile (1.4.0)
-    erubi (1.11.0)
-    globalid (1.0.0)
+    erubi (1.12.0)
+    globalid (1.1.0)
      activesupport (>= 5.0)
    htmlentities (4.3.4)
    i18n (1.8.11)
@ -81,11 +81,11 @@ GEM
    method_source (1.0.0)
    mini_magick (4.11.0)
    mini_mime (1.0.3)
-    mini_portile2 (2.8.0)
-    minitest (5.16.3)
+    mini_portile2 (2.8.1)
+    minitest (5.18.0)
    mocha (2.0.2)
      ruby2_keywords (>= 0.0.5)
-    mysql2 (0.5.4)
+    mysql2 (0.5.5)
    net-ldap (0.17.1)
    nio4r (2.5.8)
    nokogiri (1.13.10)
@ -94,14 +94,14 @@ GEM
    nokogiri (1.13.10-x86_64-linux)
      racc (~> 1.4)
    parallel (1.22.1)
-    parser (3.1.3.0)
+    parser (3.2.1.1)
      ast (~> 2.4.1)
    pg (1.2.3)
    public_suffix (5.0.1)
    puma (5.6.5)
      nio4r (~> 2.0)
-    racc (1.6.1)
-    rack (2.2.4)
+    racc (1.6.2)
+    rack (2.2.6.3)
    rack-openid (1.4.2)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
@ -123,7 +123,7 @@ GEM
    rails-dom-testing (2.0.3)
      activesupport (>= 4.2.0)
      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.4.4)
+    rails-html-sanitizer (1.5.0)
      loofah (~> 2.19, >= 2.19.1)
    railties (5.2.8.1)
      actionpack (= 5.2.8.1)
@ -163,8 +163,8 @@ GEM
      rubocop-ast (>= 1.2.0, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.24.0)
-      parser (>= 3.1.1.0)
+    rubocop-ast (1.27.0)
+      parser (>= 3.2.1.0)
    rubocop-performance (1.10.2)
      rubocop (>= 0.90.0, < 2.0)
      rubocop-ast (>= 0.4.0)
@ -173,7 +173,7 @@ GEM
      rack (>= 1.1)
      rubocop (>= 0.90.0, < 2.0)
    ruby-openid (2.9.2)
-    ruby-progressbar (1.11.0)
+    ruby-progressbar (1.13.0)
    ruby2_keywords (0.0.5)
    rubyzip (2.3.2)
    selenium-webdriver (3.142.7)
@ -183,18 +183,18 @@ GEM
      docile (~> 1.1)
      simplecov-html (~> 0.11)
    simplecov-html (0.12.3)
-    sprockets (4.1.1)
+    sprockets (4.2.0)
      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
+      rack (>= 2.2.4, < 4)
    sprockets-rails (3.4.2)
      actionpack (>= 5.2)
      activesupport (>= 5.2)
      sprockets (>= 3.0.0)
    thor (1.2.1)
    thread_safe (0.3.6)
-    tzinfo (1.2.10)
+    tzinfo (1.2.11)
      thread_safe (~> 0.1)
-    unicode-display_width (2.3.0)
+    unicode-display_width (2.4.2)
    webdrivers (4.7.0)
      nokogiri (~> 1.6)
      rubyzip (>= 1.3.0)
@ -251,7 +251,7 @@ DEPENDENCIES
  yard

 RUBY VERSION
-   ruby 2.7.6p219
+   ruby 2.7.7p221

 BUNDLED WITH
   2.3.26
--- a/pkgs/applications/version-management/redmine/default.nix
+++ b/pkgs/applications/version-management/redmine/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, bundlerEnv, ruby, makeWrapper, nixosTests }:

 let
-  version = "4.2.9";
+  version = "4.2.10";
  rubyEnv = bundlerEnv {
    name = "redmine-env-${version}";

@ -16,7 +16,7 @@ in

    src = fetchurl {
      url = "https://www.redmine.org/releases/${pname}-${version}.tar.gz";
-      sha256 = "sha256-04dBNF9u/RDAeYmAk7JZ2NxNzY5B38T2RkloWueoyx4=";
+      sha256 = "sha256-byY4jCOJKWJVLKSR1e/tq9QtrIiGHdnYC8M0WPZb4ek=";
    };

    nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/version-management/redmine/gemset.nix
+++ b/pkgs/applications/version-management/redmine/gemset.nix
@ -186,10 +186,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0s4fpn3mqiizpmpy2a24k4v365pv75y50292r8ajrv4i1p5b2k14";
+      sha256 = "0krcwb6mn0iklajwngwsg850nk8k9b35dhmc2qkbdqvmifdi2y9q";
      type = "gem";
    };
-    version = "1.1.10";
+    version = "1.2.2";
  };
  crass = {
    groups = ["default"];
@ -207,10 +207,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1107j3frhmcd95wcsz0rypchynnzhnjiyyxxcl6dlmr2lfy08z4b";
+      sha256 = "04q1vin8slr3k8mp76qz0wqgap6f9kdsbryvgfq9fljhrm463kpj";
      type = "gem";
    };
-    version = "1.12.0";
+    version = "1.14.0";
  };
  csv = {
    groups = ["default"];
@ -237,10 +237,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "11bz1v1cxabm8672gabrw542zyg51dizlcvdck6vvwzagxbjv9zx";
+      sha256 = "08s75vs9cxlc4r1q2bjg4br8g9wc5lc5x5vl0vv4zq5ivxsdpgi7";
      type = "gem";
    };
-    version = "1.11.0";
+    version = "1.12.0";
  };
  globalid = {
    dependencies = ["activesupport"];
@ -248,10 +248,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1n5yc058i8xhi1fwcp1w7mfi6xaxfmrifdb4r4hjfff33ldn8lqj";
+      sha256 = "0kqm5ndzaybpnpxqiqkc41k4ksyxl41ln8qqr6kb130cdxsf2dxk";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.1.0";
  };
  htmlentities = {
    groups = ["default"];
@ -341,20 +341,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0rapl1sfmfi3bfr68da4ca16yhc0pp93vjwkj7y3rdqrzy3b41hy";
+      sha256 = "1af4yarhbbx62f7qsmgg5fynrik0s36wjy3difkawy536xg343mp";
      type = "gem";
    };
-    version = "2.8.0";
+    version = "2.8.1";
  };
  minitest = {
    groups = ["default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0516ypqlx0mlcfn5xh7qppxqc3xndn1fnadxawa8wld5dkcimy30";
+      sha256 = "0ic7i5z88zcaqnpzprf7saimq2f6sad57g5mkkqsrqrcd6h3mx06";
      type = "gem";
    };
-    version = "5.16.3";
+    version = "5.18.0";
  };
  mocha = {
    dependencies = ["ruby2_keywords"];
@ -380,10 +380,10 @@
    }];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0xsy70mg4p854jska7ff7cy8fyn9nhlkrmfdvkkfmk8qxairbfq1";
+      sha256 = "1gjvj215qdhwk3292sc7xsn6fmwnnaq2xs35hh5hc8d8j22izlbn";
      type = "gem";
    };
-    version = "0.5.4";
+    version = "0.5.5";
  };
  net-ldap = {
    groups = ["ldap"];
@ -432,10 +432,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "17qfhjvnr9q2gp1gfdl6kndy2mb6qdwsls3vnjhb1h8ddimdm4s5";
+      sha256 = "1a2v5f8fw7nxm41xp422p1pbr41hafy62bp95m7vg42cqp5y4grc";
      type = "gem";
    };
-    version = "3.1.3.0";
+    version = "3.2.1.1";
  };
  pg = {
    groups = ["default"];
@ -481,20 +481,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0p685i23lr8pl7l09g9l2mcj615fr7g33w3mkcr472lcg34nq8n8";
+      sha256 = "09jgz6r0f7v84a7jz9an85q8vvmp743dqcsdm3z9c8rqcqv6pljq";
      type = "gem";
    };
-    version = "1.6.1";
+    version = "1.6.2";
  };
  rack = {
    groups = ["default" "openid" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0axc6w0rs4yj0pksfll1hjgw1k6a5q0xi2lckh91knfb72v348pa";
+      sha256 = "17wg99w29hpiq9p4cmm8c6kdg4lcw0ll2c36qw7y50gy1cs4h5j2";
      type = "gem";
    };
-    version = "2.2.4";
+    version = "2.2.6.3";
  };
  rack-openid = {
    dependencies = ["rack" "ruby-openid"];
@ -546,10 +546,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1mcb75qvldfz6zsr4inrfx7dmb0ngxy507awx28khqmnla3hqpc9";
+      sha256 = "0ygav4xyq943qqyhjmi3mzirn180j565mc9h5j4css59x1sn0cmz";
      type = "gem";
    };
-    version = "1.4.4";
+    version = "1.5.0";
  };
  railties = {
    dependencies = ["actionpack" "activesupport" "method_source" "rake" "thor"];
@ -724,10 +724,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0sqkg84npyq9z4d3z46w59zyr1r1rbd1mrrlglws9ksw04wdq5x9";
+      sha256 = "16iabkwqhzqh3cd4pcrp0nqv4ks2whcz84csawi78ynfk12vd20a";
      type = "gem";
    };
-    version = "1.24.0";
+    version = "1.27.0";
  };
  rubocop-performance = {
    dependencies = ["rubocop" "rubocop-ast"];
@ -766,10 +766,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "02nmaw7yx9kl7rbaan5pl8x5nn0y4j5954mzrkzi9i3dhsrps4nc";
+      sha256 = "0cwvyb7j47m7wihpfaq7rc47zwwx9k4v7iqd9s1xch5nm53rrz40";
      type = "gem";
    };
-    version = "1.11.0";
+    version = "1.13.0";
  };
  ruby2_keywords = {
    groups = ["default" "test"];
@ -829,10 +829,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1qj82dcfkk6c4zw357k5r05s5iwvyddh57bpwj0a1hjgaw70pcb8";
+      sha256 = "0k0236g4h3ax7v6vp9k0l2fa0w6f1wqp7dn060zm4isw4n3k89sw";
      type = "gem";
    };
-    version = "4.1.1";
+    version = "4.2.0";
  };
  sprockets-rails = {
    dependencies = ["actionpack" "activesupport" "sprockets"];
@ -871,20 +871,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0rw89y3zj0wcybcyiazgcprg6hi42k8ipp1n2lbl95z1dmpgmly6";
+      sha256 = "1dk1cfnhgl14l580b650qyp8m5xpqb3zg0wb251h5jkm46hzc0b5";
      type = "gem";
    };
-    version = "1.2.10";
+    version = "1.2.11";
  };
  unicode-display_width = {
    groups = ["default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ra70s8prfacpqwj5v2mqn1rbfz6xds3n9nsr9cwzs3z2c0wm5j7";
+      sha256 = "1gi82k102q7bkmfi7ggn9ciypn897ylln1jk9q67kjhr39fj043a";
      type = "gem";
    };
-    version = "2.3.0";
+    version = "2.4.2";
  };
  webdrivers = {
    dependencies = ["nokogiri" "rubyzip" "selenium-webdriver"];
--- a/pkgs/data/fonts/monocraft/default.nix
+++ b/pkgs/data/fonts/monocraft/default.nix
@ -1,15 +1,25 @@
-{ stdenv, lib, fetchFromGitHub }:
+{ stdenv, lib, fetchurl }:

-stdenv.mkDerivation rec {
-  pname = "monocraft";
-  version = "1.4";
-
-  src = fetchFromGitHub {
-    owner = "IdreesInc";
-    repo = "Monocraft";
-    rev = "v${version}";
-    sha256 = "sha256-YF0uPCc+dajJtG6mh/JpoSr6GirAhif5L5sp6hFmKLE=";
+let
+  version = "2.4";
+  relArtifact = name: hash: fetchurl {
+    inherit name hash;
+    url = "https://github.com/IdreesInc/Monocraft/releases/download/v${version}/${name}";
  };
+in
+stdenv.mkDerivation {
+  pname = "monocraft";
+  inherit version;
+
+  srcs = [
+    (relArtifact "Monocraft.otf" "sha256-PA1W+gOUStGw7cDmtEbG+B6M+sAYr8cft+Ckxj5LciU=")
+    (relArtifact "Monocraft.ttf" "sha256-S4j5v2bTJbhujT3Bt8daNN1YGYYP8zVPf9XXjuR64+o=")
+    (relArtifact "Monocraft-no-ligatures.ttf" "sha256-MuHfoP+dsXe+ODN4vWFIj50jwOxYyIiS0dd1tzVxHts=")
+    (relArtifact "Monocraft-nerd-fonts-patched.ttf" "sha256-QxMp8UwcRjWySNHWoNeX2sX9teZ4+tCFj+DG41azsXw=")
+  ];
+
+  sourceRoot = ".";
+  unpackCmd = ''cp "$curSrc" $(basename $curSrc)'';

  dontConfigure = true;
  dontBuild = true;
@ -17,6 +27,7 @@ stdenv.mkDerivation rec {
  installPhase = ''
    runHook preInstall
    install -Dm644 -t $out/share/fonts/opentype *.otf
+    install -Dm644 -t $out/share/fonts/truetype *.ttf
    runHook postInstall
  '';

--- a/pkgs/development/coq-modules/coq-elpi/default.nix
+++ b/pkgs/development/coq-modules/coq-elpi/default.nix
@ -8,6 +8,7 @@ with builtins; with lib; let
    { case = "8.14"; out = { version = "1.13.7"; };}
    { case = "8.15"; out = { version = "1.15.0"; };}
    { case = "8.16"; out = { version = "1.16.5"; };}
+    { case = "8.17"; out = { version = "1.16.5"; };}
  ] {} );
 in mkCoqDerivation {
  pname = "elpi";
@ -15,6 +16,7 @@ in mkCoqDerivation {
  owner = "LPCIC";
  inherit version;
  defaultVersion = lib.switch coq.coq-version [
+    { case = "8.17"; out = "1.17.0"; }
    { case = "8.16"; out = "1.15.6"; }
    { case = "8.15"; out = "1.14.0"; }
    { case = "8.14"; out = "1.11.2"; }
@ -22,6 +24,7 @@ in mkCoqDerivation {
    { case = "8.12"; out = "1.8.3_8.12"; }
    { case = "8.11"; out = "1.6.3_8.11"; }
  ] null;
+  release."1.17.0".sha256     = "sha256-J8GatRKFU0ekNCG3V5dBI+FXypeHcLgC5QJYGYzFiEM=";
  release."1.15.6".sha256     = "sha256-qc0q01tW8NVm83801HHOBHe/7H1/F2WGDbKO6nCXfno=";
  release."1.15.1".sha256     = "sha256-NT2RlcIsFB9AvBhMxil4ZZIgx+KusMqDflj2HgQxsZg=";
  release."1.14.0".sha256     = "sha256:1v2p5dlpviwzky2i14cj7gcgf8cr0j54bdm9fl5iz1ckx60j6nvp";
--- a/pkgs/development/coq-modules/coqeal/default.nix
+++ b/pkgs/development/coq-modules/coqeal/default.nix
@ -8,7 +8,7 @@

  inherit version;
  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
-      { cases = [ (range "8.13" "8.16") (isGe "1.13.0") ]; out = "1.1.1"; }
+      { cases = [ (range "8.13" "8.17") (isGe "1.13.0") ]; out = "1.1.1"; }
      { cases = [ (range "8.10" "8.15") (isGe "1.12.0") ]; out = "1.1.0"; }
      { cases = [ (isGe "8.10") (range "1.11.0" "1.12.0") ]; out = "1.0.5"; }
      { cases = [ (isGe "8.7") "1.11.0" ]; out = "1.0.4"; }
--- a/pkgs/development/coq-modules/coquelicot/default.nix
+++ b/pkgs/development/coq-modules/coquelicot/default.nix
@ -7,7 +7,7 @@ mkCoqDerivation {
  domain = "gitlab.inria.fr";
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.12" "8.16"; out = "3.3.0"; }
+    { case = range "8.12" "8.17"; out = "3.3.0"; }
    { case = range "8.8" "8.16"; out = "3.2.0"; }
    { case = range "8.8" "8.13"; out = "3.1.0"; }
    { case = range "8.5" "8.9";  out = "3.0.2"; }
--- a/pkgs/development/coq-modules/flocq/default.nix
+++ b/pkgs/development/coq-modules/flocq/default.nix
@ -7,10 +7,12 @@ mkCoqDerivation {
  domain = "gitlab.inria.fr";
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.14" "8.17"; out = "4.1.1"; }
    { case = range "8.14" "8.16"; out = "4.1.0"; }
    { case = range "8.7" "8.15"; out = "3.4.3"; }
    { case = range "8.5" "8.8"; out = "2.6.1"; }
  ] null;
+  release."4.1.1".sha256 = "sha256-FbClxlV0ZaxITe7s9SlNbpeMNDJli+Dfh2TMrjaMtHo=";
  release."4.1.0".sha256 = "sha256:09rak9cha7q11yfqracbcq75mhmir84331h1218xcawza48rbjik";
  release."3.4.3".sha256 = "sha256-YTdWlEmFJjCcHkl47jSOgrGqdXoApJY4u618ofCaCZE=";
  release."3.4.2".sha256 = "1s37hvxyffx8ccc8mg5aba7ivfc39p216iibvd7f2cb9lniqk1pw";
--- a/pkgs/development/coq-modules/graph-theory/default.nix
+++ b/pkgs/development/coq-modules/graph-theory/default.nix
@ -1,19 +1,21 @@
 { lib, mkCoqDerivation, coq, mathcomp-algebra, mathcomp-finmap, mathcomp-fingroup
-, hierarchy-builder, version ? null }:
+, fourcolor, hierarchy-builder, version ? null }:

 mkCoqDerivation {
  pname = "graph-theory";

  release."0.9".sha256 = "sha256-Hl3JS9YERD8QQziXqZ9DqLHKp63RKI9HxoFYWSkJQZI=";
+  release."0.9.1".sha256 = "sha256-lRRY+501x+DqNeItBnbwYIqWLDksinWIY4x/iojRNYU=";

  releaseRev = v: "v${v}";

  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.13" "8.16"; out = "0.9"; }
+    { case = range "8.14" "8.16"; out = "0.9.1"; }
+    { case = range "8.12" "8.12"; out = "0.9"; }
  ] null;

-  propagatedBuildInputs = [ mathcomp-algebra mathcomp-finmap mathcomp-fingroup hierarchy-builder ];
+  propagatedBuildInputs = [ mathcomp-algebra mathcomp-finmap mathcomp-fingroup fourcolor hierarchy-builder ];

  meta = with lib; {
    description = "Library of formalized graph theory results in Coq";
--- a/pkgs/development/coq-modules/hierarchy-builder/default.nix
+++ b/pkgs/development/coq-modules/hierarchy-builder/default.nix
@ -5,7 +5,7 @@ let hb = mkCoqDerivation {
  owner = "math-comp";
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.15" "8.16"; out = "1.4.0"; }
+    { case = range "8.15" "8.17"; out = "1.4.0"; }
    { case = range "8.13" "8.14"; out = "1.2.0"; }
    { case = range "8.12" "8.13"; out = "1.1.0"; }
    { case = isEq "8.11";         out = "0.10.0"; }
--- a/pkgs/development/coq-modules/interval/default.nix
+++ b/pkgs/development/coq-modules/interval/default.nix
@ -7,12 +7,14 @@ mkCoqDerivation rec {
  domain = "gitlab.inria.fr";
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.12" "8.17"; out = "4.6.1"; }
    { case = range "8.12" "8.16"; out = "4.6.0"; }
    { case = range "8.8" "8.16"; out = "4.5.2"; }
    { case = range "8.8" "8.12"; out = "4.0.0"; }
    { case = range "8.7" "8.11"; out = "3.4.2"; }
    { case = range "8.5" "8.6";  out = "3.3.0"; }
  ] null;
+  release."4.6.1".sha256 = "sha256-ZZSxt8ksz0g6dl/LEido5qJXgsaxHrVLqkGUHu90+e0=";
  release."4.6.0".sha256 = "sha256-n9ECKnV0L6XYcIcbYyOJKwlbisz/RRbNW5YESHo07X0=";
  release."4.5.2".sha256 = "sha256-r0yE9pkC4EYlqsimxkdlCXevRcwKa3HGFZiUH+ueUY8=";
  release."4.5.1".sha256 = "sha256-5OxbSPdw/1FFENubulKSk6fEIEYSPCxfvMMgtgN6j6s=";
--- a/pkgs/development/coq-modules/mathcomp-analysis/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
@ -26,10 +26,10 @@ let
  defaultVersion = with versions; lib.switch [ coq.version mathcomp.version ]  [
      { cases = [ (isGe "8.14") (isGe "1.13.0") ];               out = "0.6.1"; }
      { cases = [ (isGe "8.14") (range "1.13" "1.15") ];         out = "0.5.2"; }
-      { cases = [ (isGe "8.13") (range "1.13" "1.14") ];         out = "0.5.1"; }
+      { cases = [ (range "8.13" "8.15") (range "1.13" "1.14") ]; out = "0.5.1"; }
      { cases = [ (range "8.13" "8.15") (range "1.12" "1.14") ]; out = "0.3.13"; }
-      { cases = [ (range "8.11" "8.14") (isGe "1.12.0") ];       out = "0.3.10"; }
-      { cases = [ (range "8.11" "8.13") "1.11.0" ];              out = "0.3.4"; }
+      { cases = [ (range "8.11" "8.14") (range "1.12" "1.13") ]; out = "0.3.10"; }
+      { cases = [ (range "8.11" "8.12") "1.11.0" ];              out = "0.3.4"; }
      { cases = [ (range "8.10" "8.12") "1.11.0" ];              out = "0.3.3"; }
      { cases = [ (range "8.10" "8.11") "1.11.0" ];              out = "0.3.1"; }
      { cases = [ (range "8.8"  "8.11") (range "1.8" "1.10") ];  out = "0.2.3"; }
--- a/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
@ -12,7 +12,7 @@ mkCoqDerivation {
  };
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.version [
-    { case = range "8.10" "8.16"; out = "1.0.1"; }
+    { case = range "8.10" "8.17"; out = "1.0.1"; }
    { case = range "8.5"  "8.14"; out = "1.0.0"; }
  ] null;

--- a/pkgs/development/coq-modules/mathcomp-finmap/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
@ -7,7 +7,7 @@ mkCoqDerivation {
  owner = "math-comp";
  inherit version;
  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
-      { cases = [ (range "8.13" "8.16")  (isGe "1.12") ];         out = "1.5.2"; }
+      { cases = [ (range "8.13" "8.17")  (isGe "1.12") ];         out = "1.5.2"; }
      { cases = [ (isGe "8.10")          (isGe "1.11") ];         out = "1.5.1"; }
      { cases = [ (range "8.7" "8.11")   "1.11.0" ];              out = "1.5.0"; }
      { cases = [ (isEq "8.11")          (range "1.8" "1.10") ];  out = "1.4.0+coq-8.11"; }
--- a/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
@ -8,6 +8,7 @@ mkCoqDerivation {
  owner = "math-comp";
  inherit version;
  release = {
+    "1.1.4".sha256 = "sha256-8Hs6XfowbpeRD8RhMRf4ZJe2xf8kE0e8m7bPUzR/IM4=";
    "1.1.3".sha256 = "1vwmmnzy8i4f203i2s60dn9i0kr27lsmwlqlyyzdpsghvbr8h5b7";
    "1.1.2".sha256 = "0907x4nf7nnvn764q3x9lx41g74rilvq5cki5ziwgpsdgb98pppn";
    "1.1.1".sha256 = "0ksjscrgq1i79vys4zrmgvzy2y4ylxa8wdsf4kih63apw6v5ws6b";
@ -18,6 +19,7 @@ mkCoqDerivation {
  };

  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
+      { cases = [ (isGe "8.13")  (isGe "1.13.0") ]; out = "1.1.4"; }
      { cases = [ (isGe "8.13")  (isGe "1.12.0") ]; out = "1.1.3"; }
      { cases = [ (isGe "8.10")  (isGe "1.12.0") ]; out = "1.1.2"; }
      { cases = [ (isGe "8.7")   "1.11.0" ]; out = "1.1.1"; }
--- a/pkgs/development/coq-modules/mathcomp-zify/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-zify/default.nix
@ -9,11 +9,13 @@ mkCoqDerivation rec {

  defaultVersion = with lib.versions;
     lib.switch [ coq.coq-version mathcomp-algebra.version ] [
+       { cases = [ (range "8.13" "8.17") (isGe "1.12") ]; out = "1.3.0+1.12+8.13"; }
       { cases = [ (range "8.13" "8.16") (isGe "1.12") ]; out = "1.1.0+1.12+8.13"; }
     ] null;

  release."1.0.0+1.12+8.13".sha256 = "1j533vx6lacr89bj1bf15l1a0s7rvrx4l00wyjv99aczkfbz6h6k";
  release."1.1.0+1.12+8.13".sha256 = "1plf4v6q5j7wvmd5gsqlpiy0vwlw6hy5daq2x42gqny23w9mi2pr";
+  release."1.3.0+1.12+8.13".sha256 = "sha256-ebfY8HatP4te44M6o84DSLpDCkMu4IroPCy+HqzOnTE=";

  propagatedBuildInputs = [ mathcomp-algebra mathcomp-ssreflect mathcomp-fingroup ];

--- a/pkgs/development/coq-modules/mathcomp/default.nix
+++ b/pkgs/development/coq-modules/mathcomp/default.nix
@ -19,6 +19,7 @@ let
  owner = "math-comp";
  withDoc = single && (args.withDoc or false);
  defaultVersion = with versions; lib.switch coq.coq-version [
+      { case = range "8.13" "8.17"; out = "1.16.0"; }
      { case = range "8.14" "8.16"; out = "1.15.0"; }
      { case = range "8.11" "8.15"; out = "1.14.0"; }
      { case = range "8.11" "8.15"; out = "1.13.0"; }
@ -31,6 +32,7 @@ let
      { case = range "8.5" "8.7";   out = "1.6.4";  }
    ] null;
  release = {
+    "1.16.0".sha256 = "sha256-gXTKhRgSGeRBUnwdDezMsMKbOvxdffT+kViZ9e1gEz0=";
    "1.15.0".sha256 = "1bp0jxl35ms54s0mdqky15w9af03f3i0n06qk12k4gw1xzvwqv21";
    "1.14.0".sha256 = "07yamlp1c0g5nahkd2gpfhammcca74ga2s6qr7a3wm6y6j5pivk9";
    "1.13.0".sha256 = "0j4cz2y1r1aw79snkcf1pmicgzf8swbaf9ippz0vg99a572zqzri";
--- a/pkgs/development/coq-modules/multinomials/default.nix
+++ b/pkgs/development/coq-modules/multinomials/default.nix
@ -9,7 +9,8 @@

  inherit version;
  defaultVersion =  with lib.versions; lib.switch [ coq.version mathcomp.version ] [
-      { cases = [ (isGe "8.10") (isGe "1.12.0") ];      out = "1.5.5"; }
+      { cases = [ (isGe "8.10") (isGe "1.13.0") ];      out = "1.5.6"; }
+      { cases = [ (range "8.10" "8.16") (range "1.12.0" "1.15.0") ]; out = "1.5.5"; }
      { cases = [ (range "8.10" "8.12") "1.12.0" ];             out = "1.5.3"; }
      { cases = [ (range "8.7" "8.12")  "1.11.0" ];             out = "1.5.2"; }
      { cases = [ (range "8.7" "8.11")  (range "1.8" "1.10") ]; out = "1.5.0"; }
@ -17,6 +18,7 @@
      { cases = [ "8.6"                 (range "1.6" "1.7") ];  out = "1.1"; }
    ] null;
  release = {
+    "1.5.6".sha256 = "sha256-cMixgc34T9Ic6v+tYmL49QUNpZpPV5ofaNuHqblX6oY=";
    "1.5.5".sha256 = "sha256-VdXA51vr7DZl/wT/15YYMywdD7Gh91dMP9t7ij47qNQ=";
    "1.5.4".sha256 = "0s4sbh4y88l125hdxahr56325hdhxxdmqmrz7vv8524llyv3fciq";
    "1.5.3".sha256 = "1462x40y2qydjd2wcg8r6qr8cx3xv4ixzh2h8vp9h7arylkja1qd";
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@ -879,17 +879,17 @@ self: super: builtins.intersectAttrs super {
  domaindriven-core = dontCheck super.domaindriven-core;

  cachix = overrideCabal (drv: {
-    version = "1.3";
+    version = "1.3.1";
    src = pkgs.fetchFromGitHub {
      owner = "cachix";
      repo = "cachix";
-      rev = "v1.3";
-      sha256 = "sha256-y0CqfFIWd2nl1o2XvskHfaQRg8qqRZf16BYLAqJ+Q2Q=";
+      rev = "v1.3.1";
+      sha256 = "sha256-fYQrAgxEMdtMAYadff9Hg4MAh0PSfGPiYw5Z4BrvgFU=";
    };
    buildDepends = [ self.conduit-concurrent-map ];
    postUnpack = "sourceRoot=$sourceRoot/cachix";
    postPatch = ''
-      sed -i 's/1.2/1.3/' cachix.cabal
+      sed -i 's/1.3/1.3.1/' cachix.cabal
    '';
  }) (super.cachix.override {
    nix = self.hercules-ci-cnix-store.passthru.nixPackage;
@ -897,12 +897,12 @@ self: super: builtins.intersectAttrs super {
    hnix-store-core = super.hnix-store-core_0_6_1_0;
  });
  cachix-api = overrideCabal (drv: {
-    version = "1.3";
+    version = "1.3.1";
    src = pkgs.fetchFromGitHub {
      owner = "cachix";
      repo = "cachix";
-      rev = "v1.3";
-      sha256 = "sha256-y0CqfFIWd2nl1o2XvskHfaQRg8qqRZf16BYLAqJ+Q2Q=";
+      rev = "v1.3.1";
+      sha256 = "sha256-fYQrAgxEMdtMAYadff9Hg4MAh0PSfGPiYw5Z4BrvgFU=";
    };
    postUnpack = "sourceRoot=$sourceRoot/cachix-api";
  }) super.cachix-api;
--- a/pkgs/development/interpreters/erlang/R25.nix
+++ b/pkgs/development/interpreters/erlang/R25.nix
@ -1,6 +1,6 @@
 { mkDerivation }:

 mkDerivation {
-  version = "25.2.3";
-  sha256 = "peTH8hDOEuMq18exbFhtEMrQQEqg2FPkapfNnnEfTYE=";
+  version = "25.3";
+  sha256 = "UOBrDaXpvpeM79VN0PxVQ1XsYI+OYWBbaBfYE5lZXgE=";
 }
--- a/pkgs/development/libraries/hunspell/dictionaries.nix
+++ b/pkgs/development/libraries/hunspell/dictionaries.nix
@ -29,14 +29,14 @@ let
    { shortName, shortDescription, dictFileName }:
    mkDict rec {
      inherit dictFileName;
-      version = "2.2";
+      version = "2.5";
      pname = "hunspell-dict-${shortName}-rla";
      readmeFile = "README.txt";
      src = fetchFromGitHub {
        owner = "sbosio";
        repo = "rla-es";
        rev = "v${version}";
-        sha256 = "0n9ms092k7vg7xpd3ksadxydbrizkb7js7dfxr08nbnnb9fgy0i8";
+        sha256 = "sha256-oGnxOGHzDogzUMZESydIxRTbq9Dmd03flwHx16AK1yk=";
      };
      meta = with lib; {
        description = "Hunspell dictionary for ${shortDescription} from rla";
@ -46,13 +46,13 @@ let
        platforms = platforms.all;
      };
      nativeBuildInputs = [ bash coreutils which zip unzip ];
-      patchPhase = ''
+      postPatch = ''
        substituteInPlace ortograf/herramientas/make_dict.sh \
-           --replace /bin/bash bash \
+           --replace /bin/bash ${bash}/bin/bash \
           --replace /dev/stderr stderr.log

        substituteInPlace ortograf/herramientas/remover_comentarios.sh \
-           --replace /bin/bash bash \
+           --replace /bin/bash ${bash}/bin/bash \
      '';
      buildPhase = ''
        cd ortograf/herramientas
@ -442,7 +442,7 @@ rec {
  es_CR = es-cr;
  es-cr = mkDictFromRla {
    shortName = "es-cr";
-    shortDescription = "Spanish (Costra Rica)";
+    shortDescription = "Spanish (Costa Rica)";
    dictFileName = "es_CR";
  };

--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@ -8,14 +8,14 @@

 buildDunePackage rec {
  pname = "awa";
-  version = "0.1.1";
+  version = "0.1.2";

  minimalOCamlVersion = "4.08";
  duneVersion = "3";

  src = fetchurl {
    url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-${version}.tbz";
-    hash = "sha256-ae1gTx3Emmkof/2Gnhq0d5RyfkFx21hHkVEVgyPdXuo=";
+    hash = "sha256-HfIqvmvmdizPSfSHthj2syszVZXVhju7tI8yNEetc38=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/ocaml-modules/conduit/default.nix
+++ b/pkgs/development/ocaml-modules/conduit/default.nix
@ -5,14 +5,14 @@

 buildDunePackage rec {
  pname = "conduit";
-  version = "6.1.0";
+  version = "6.2.0";

  minimalOCamlVersion = "4.08";
  duneVersion = "3";

  src = fetchurl {
    url = "https://github.com/mirage/ocaml-conduit/releases/download/v${version}/conduit-${version}.tbz";
-    sha256 = "sha256-ouKQiGMLvvksGpAhkqCVSKtKaz91p+7mciQm7KHvwF8=";
+    sha256 = "sha256-PtRAsO3aGyEt12K9skgx85TcoFmF3RtKxPlFgdFFI5Q=";
  };

  propagatedBuildInputs = [ astring ipaddr ipaddr-sexp sexplib uri ppx_sexp_conv ];
--- a/pkgs/development/ocaml-modules/conduit/mirage.nix
+++ b/pkgs/development/ocaml-modules/conduit/mirage.nix
@ -1,7 +1,7 @@
 { buildDunePackage, conduit-lwt
 , ppx_sexp_conv, sexplib, uri, cstruct, mirage-flow
 , mirage-flow-combinators, mirage-random, mirage-time, mirage-clock
-, dns-client, vchan, xenstore, tls, tls-mirage, ipaddr, ipaddr-sexp
+, dns-client-mirage, vchan, xenstore, tls, tls-mirage, ipaddr, ipaddr-sexp
 , tcpip, ca-certs-nss
 }:

@ -16,7 +16,7 @@ buildDunePackage {
  propagatedBuildInputs = [
    sexplib uri cstruct mirage-clock mirage-flow
    mirage-flow-combinators mirage-random mirage-time
-    dns-client conduit-lwt vchan xenstore tls tls-mirage
+    dns-client-mirage conduit-lwt vchan xenstore tls tls-mirage
    ipaddr ipaddr-sexp tcpip ca-certs-nss
  ];

--- a/pkgs/development/ocaml-modules/dns/cli.nix
+++ b/pkgs/development/ocaml-modules/dns/cli.nix
@ -1,4 +1,4 @@
-{ buildDunePackage, dns, dns-tsig, dns-client, dns-server, dns-certify, dnssec
+{ buildDunePackage, dns, dns-tsig, dns-client-lwt, dns-server, dns-certify, dnssec
 , bos, cmdliner, fpath, x509, mirage-crypto, mirage-crypto-pk
 , mirage-crypto-rng, hex, ptime, mtime, logs, fmt, ipaddr, lwt
 , randomconv, alcotest
@ -17,7 +17,7 @@ buildDunePackage {
  buildInputs = [
    dns
    dns-tsig
-    dns-client
+    dns-client-lwt
    dns-server
    dns-certify
    dnssec
--- a/pkgs/development/ocaml-modules/dns/client-lwt.nix
+++ b/pkgs/development/ocaml-modules/dns/client-lwt.nix
@ -0,0 +1,30 @@
+{ lib, buildDunePackage, dns, dns-client, lwt, mirage-clock, mirage-time
+, mirage-random, mirage-crypto-rng, mtime, randomconv
+, cstruct, fmt, logs, rresult, domain-name, ipaddr, alcotest
+, ca-certs, ca-certs-nss
+, happy-eyeballs
+, tcpip
+, tls-lwt
+}:
+
+buildDunePackage {
+  pname = "dns-client-lwt";
+  inherit (dns) src version;
+  duneVersion = "3";
+
+  propagatedBuildInputs = [
+    dns
+    dns-client
+    ipaddr
+    lwt
+    ca-certs
+    happy-eyeballs
+    tls-lwt
+    mtime
+    mirage-crypto-rng
+  ];
+  checkInputs = [ alcotest ];
+  doCheck = true;
+
+  meta = dns-client.meta;
+}
--- a/pkgs/development/ocaml-modules/dns/client-mirage.nix
+++ b/pkgs/development/ocaml-modules/dns/client-mirage.nix
@ -0,0 +1,32 @@
+{ lib, buildDunePackage, dns, dns-client, lwt, mirage-clock, mirage-time
+, mirage-random, mirage-crypto-rng, mtime, randomconv
+, cstruct, fmt, logs, rresult, domain-name, ipaddr, alcotest
+, ca-certs, ca-certs-nss
+, happy-eyeballs
+, tcpip
+, tls, tls-mirage
+}:
+
+buildDunePackage {
+  pname = "dns-client-mirage";
+  inherit (dns) src version;
+  duneVersion = "3";
+
+  propagatedBuildInputs = [
+    dns-client
+    domain-name
+    ipaddr
+    lwt
+    mirage-random
+    mirage-time
+    mirage-clock
+    ca-certs-nss
+    happy-eyeballs
+    tcpip
+    tls
+    tls-mirage
+  ];
+  doCheck = true;
+
+  meta = dns-client.meta;
+}
--- a/pkgs/development/ocaml-modules/dns/client.nix
+++ b/pkgs/development/ocaml-modules/dns/client.nix
@ -13,23 +13,9 @@ buildDunePackage {
  duneVersion = "3";

  propagatedBuildInputs = [
-    cstruct
-    fmt
-    logs
    dns
    randomconv
    domain-name
-    ipaddr
-    lwt
-    mirage-random
-    mirage-time
-    mirage-clock
-    ca-certs
-    ca-certs-nss
-    happy-eyeballs
-    tcpip
-    tls
-    tls-mirage
    mtime
    mirage-crypto-rng
  ];
--- a/pkgs/development/ocaml-modules/dns/default.nix
+++ b/pkgs/development/ocaml-modules/dns/default.nix
@ -17,14 +17,14 @@

 buildDunePackage rec {
  pname = "dns";
-  version = "6.4.1";
+  version = "7.0.1";

  minimalOCamlVersion = "4.08";
  duneVersion = "3";

  src = fetchurl {
    url = "https://github.com/mirage/ocaml-dns/releases/download/v${version}/dns-${version}.tbz";
-    hash = "sha256-omG0fKZAHGc+4ERC8cyK47jeEkiBZkB+1fz46j6SDno=";
+    hash = "sha256-vDe1U1NbbIPcD1AmMG265ke7651C64mds7KcFHUN4fU=";
  };

  propagatedBuildInputs = [ fmt logs ptime domain-name gmap cstruct ipaddr lru duration metrics base64 ];
--- a/pkgs/development/ocaml-modules/dns/stub.nix
+++ b/pkgs/development/ocaml-modules/dns/stub.nix
@ -1,4 +1,4 @@
-{ buildDunePackage, dns, dns-client, dns-mirage, dns-resolver, dns-tsig
+{ buildDunePackage, dns, dns-client-mirage, dns-mirage, dns-resolver, dns-tsig
 , dns-server, duration, randomconv, lwt, mirage-time, mirage-clock
 , mirage-random, tcpip, metrics
 }:
@ -11,7 +11,7 @@ buildDunePackage {

  propagatedBuildInputs = [
    dns
-    dns-client
+    dns-client-mirage
    dns-mirage
    dns-resolver
    dns-tsig
--- a/pkgs/development/ocaml-modules/git/unix.nix
+++ b/pkgs/development/ocaml-modules/git/unix.nix
@ -1,4 +1,4 @@
-{ buildDunePackage, git
+{ buildDunePackage, fetchpatch, git
 , rresult, result, bigstringaf
 , fmt, bos, fpath, uri, digestif, logs, lwt
 , mirage-clock, mirage-clock-unix, astring, awa, cmdliner
@ -14,6 +14,13 @@ buildDunePackage {
  pname = "git-unix";
  inherit (git) version src;

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mirage/ocaml-git/commit/b708db8319cc456a5640618210d740a1e00468e9.patch";
+      hash = "sha256-Fe+eDhU/beZT/8br8XmOhHYJowaVEha16eGqyuu2Zr4=";
+    })
+  ];
+
  minimalOCamlVersion = "4.08";
  duneVersion = "3";

--- a/pkgs/development/ocaml-modules/happy-eyeballs/default.nix
+++ b/pkgs/development/ocaml-modules/happy-eyeballs/default.nix
@ -4,13 +4,13 @@

 buildDunePackage rec {
  pname = "happy-eyeballs";
-  version = "0.4.0";
+  version = "0.5.0";

  minimalOCamlVersion = "4.08";

  src = fetchurl {
    url = "https://github.com/roburio/happy-eyeballs/releases/download/v${version}/happy-eyeballs-${version}.tbz";
-    hash = "sha256-gR9q4J/DnYJz8oYmk/wy17h4F6wxbllba/gkor5i1nQ=";
+    hash = "sha256-T4BOFlSj3xfUFhP9v8UaCHgmhvGrMyeqNUQf79bdBh4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/ocaml-modules/happy-eyeballs/lwt.nix
+++ b/pkgs/development/ocaml-modules/happy-eyeballs/lwt.nix
@ -1,7 +1,7 @@
 { buildDunePackage
 , happy-eyeballs
 , cmdliner
-, dns-client
+, dns-client-lwt
 , duration
 , domain-name
 , ipaddr
@ -29,7 +29,7 @@ buildDunePackage {
  ];

  propagatedBuildInputs = [
-    dns-client
+    dns-client-lwt
    happy-eyeballs
    logs
    lwt
--- a/pkgs/development/ocaml-modules/happy-eyeballs/mirage.nix
+++ b/pkgs/development/ocaml-modules/happy-eyeballs/mirage.nix
@ -1,7 +1,7 @@
 { buildDunePackage
 , happy-eyeballs
 , duration
-, dns-client
+, dns-client-mirage
 , domain-name
 , ipaddr
 , fmt
@ -32,7 +32,7 @@ buildDunePackage {
  ];

  propagatedBuildInputs = [
-    dns-client
+    dns-client-mirage
    happy-eyeballs
    logs
    lwt
--- a/pkgs/development/ocaml-modules/letsencrypt/default.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/default.nix
@ -21,11 +21,11 @@

 buildDunePackage rec {
  pname = "letsencrypt";
-  version = "0.4.1";
+  version = "0.5.0";

  src = fetchurl {
-    url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${version}/letsencrypt-v${version}.tbz";
-    hash = "sha256-+Qh19cm9yrTIvl7H6+nqdjAw+nCOAoVzAJlrsW58IHA=";
+    url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${version}/letsencrypt-${version}.tbz";
+    hash = "sha256-XGroZiNyP0ItOMrXK07nrVqT4Yz9RKXYvZuRkDp089M=";
  };

  minimalOCamlVersion = "4.08";
--- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@ -7,11 +7,11 @@ buildDunePackage rec {
  minimalOCamlVersion = "4.08";

  pname = "mirage-crypto";
-  version = "0.10.7";
+  version = "0.11.0";

  src = fetchurl {
    url = "https://github.com/mirage/mirage-crypto/releases/download/v${version}/mirage-crypto-${version}.tbz";
-    sha256 = "sha256-PoGKdgwjXFtoTHtrQ7HN0qfdBOAQW2gNUk+DbrmIppw=";
+    sha256 = "sha256-A5SCuVmcIJo3dL0Tu//fQqEV0v3FuCxuANWnBo7hUeQ=";
  };

  doCheck = true;
--- a/pkgs/development/ocaml-modules/mirage-crypto/rng-lwt.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/rng-lwt.nix
@ -0,0 +1,15 @@
+{ buildDunePackage, mirage-crypto, mirage-crypto-rng, dune-configurator
+, duration, logs, mtime, ocaml_lwt }:
+
+buildDunePackage rec {
+  pname = "mirage-crypto-rng-lwt";
+
+  inherit (mirage-crypto) version src;
+
+  doCheck = true;
+
+  buildInputs = [ dune-configurator ];
+  propagatedBuildInputs = [ mirage-crypto mirage-crypto-rng duration logs mtime ocaml_lwt ];
+
+  meta = mirage-crypto-rng.meta;
+}
--- a/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
@ -10,7 +10,7 @@ buildDunePackage rec {
  checkInputs = [ ounit2 randomconv ];

  buildInputs = [ dune-configurator ];
-  propagatedBuildInputs = [ cstruct mirage-crypto duration logs mtime ocaml_lwt ];
+  propagatedBuildInputs = [ cstruct mirage-crypto duration logs mtime ];

  strictDeps = true;

--- a/pkgs/development/ocaml-modules/paf/cohttp.nix
+++ b/pkgs/development/ocaml-modules/paf/cohttp.nix
@ -22,6 +22,7 @@ buildDunePackage {
  inherit (paf)
    version
    src
+    patches
    ;

  duneVersion = "3";
--- a/pkgs/development/ocaml-modules/paf/default.nix
+++ b/pkgs/development/ocaml-modules/paf/default.nix
@ -32,6 +32,14 @@ buildDunePackage rec {
    hash = "sha256-ux8fk4XDdih4Ua9NGOJVSuPseJBPv6+6ND/esHrluQE=";
  };

+  patches = [
+    # Compatibility with mirage-crypto 0.11.0
+    (fetchpatch {
+      url = "https://github.com/dinosaure/paf-le-chien/commit/2f308c1c4d3ff49d42136f8ff86a4385661e4d1b.patch";
+      hash = "sha256-jmSeUpoRoUMPUNEH3Av2LxgRZs+eAectK+CpoH+SdpY=";
+    })
+  ];
+
  minimalOCamlVersion = "4.08";
  duneVersion = "3";

--- a/pkgs/development/ocaml-modules/paf/le.nix
+++ b/pkgs/development/ocaml-modules/paf/le.nix
@ -1,7 +1,7 @@
 { lib
 , buildDunePackage
 , paf
-, dns-client
+, dns-client-mirage
 , duration
 , emile
 , httpaf
@ -18,13 +18,14 @@ buildDunePackage {
  inherit (paf)
    version
    src
+    patches
  ;

  duneVersion = "3";

  propagatedBuildInputs = [
    paf
-    dns-client
+    dns-client-mirage
    duration
    emile
    httpaf
--- a/pkgs/development/ocaml-modules/tls/default.nix
+++ b/pkgs/development/ocaml-modules/tls/default.nix
@ -6,11 +6,11 @@

 buildDunePackage rec {
  pname = "tls";
-  version = "0.15.4";
+  version = "0.16.0";

  src = fetchurl {
    url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-${version}.tbz";
-    sha256 = "sha256-X40dVrBvYGnv0dCj3gxFy0iNPRPrfxMshOx7o/DRw4I=";
+    sha256 = "sha256-uvIDZLNy6E/ce7YmzUUVaOeGRaHqPSUzuEPQDMu09tM=";
  };

  minimalOCamlVersion = "4.08";
--- a/pkgs/development/ocaml-modules/tls/lwt.nix
+++ b/pkgs/development/ocaml-modules/tls/lwt.nix
@ -0,0 +1,19 @@
+{ lib, buildDunePackage, tls, lwt, mirage-crypto-rng-lwt, cmdliner, x509 }:
+
+buildDunePackage rec {
+  pname = "tls-lwt";
+
+  inherit (tls) src meta version;
+
+  minimalOCamlVersion = "4.11";
+  duneVersion = "3";
+
+  doCheck = true;
+
+  propagatedBuildInputs = [
+    lwt
+    mirage-crypto-rng-lwt
+    tls
+    x509
+  ];
+}
--- a/pkgs/development/ocaml-modules/x509/default.nix
+++ b/pkgs/development/ocaml-modules/x509/default.nix
@ -8,13 +8,13 @@ buildDunePackage rec {
  minimalOCamlVersion = "4.08";

  pname = "x509";
-  version = "0.16.2";
+  version = "0.16.4";

  duneVersion = "3";

  src = fetchurl {
    url = "https://github.com/mirleft/ocaml-x509/releases/download/v${version}/x509-${version}.tbz";
-    hash = "sha256-Zf/ZZjUAkeWe04XLmqMKgbxN/qe/Z1mpKM82veXVf2I=";
+    hash = "sha256-XegxhdASQK/I7Xd0gJSLumTGbCYFpWsjR7PlZSWqaVo=";
  };

  checkInputs = [ alcotest cstruct-unix ];
--- a/pkgs/development/python-modules/pyinsteon/default.nix
+++ b/pkgs/development/python-modules/pyinsteon/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "pyinsteon";
-  version = "1.3.3";
+  version = "1.3.4";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-zbqgwCukTmvCIXpAvaKQl7voOI4ATqsT9NPUyRhw2EE=";
+    hash = "sha256-P/5kCXmUWQ/2yvzu/Pr0XBY8zm3fMMyoapGmdtRmxXo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/go-mockery/default.nix
+++ b/pkgs/development/tools/go-mockery/default.nix
@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, go-mockery, runCommand, go }:

 buildGoModule rec {
  pname = "go-mockery";
@ -24,6 +24,37 @@ buildGoModule rec {

  vendorHash = "sha256-3lx3wHnPQ/slRXnlVAnI1ZqSykDXNivjwg1WUITGj64=";

+  passthru.tests = {
+    generateMock = runCommand "${pname}-test" {
+      nativeBuildInputs = [ go-mockery ];
+      buildInputs = [ go ];
+    } ''
+      if [[ $(mockery --version) != *"${version}"* ]]; then
+        echo "Error: program version does not match package version"
+        exit 1
+      fi
+
+      export HOME=$TMPDIR
+
+      cat <<EOF > foo.go
+      package main
+
+      type Foo interface {
+        Bark() string
+      }
+      EOF
+
+      mockery --name Foo --dir .
+
+      if [[ ! -f "mocks/Foo.go" ]]; then
+        echo "Error: mocks/Foo.go was not generated by ${pname}"
+        exit 1
+      fi
+
+      touch $out
+    '';
+  };
+
  meta = with lib; {
    homepage = "https://github.com/vektra/mockery";
    description = "A mock code autogenerator for Golang";
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@ -32,7 +32,7 @@ let

    extraMeta = {
      branch = lib.versions.majorMinor version + "/master";
-      maintainers = with lib.maintainers; [ andresilva pedrohlc ];
+      maintainers = with lib.maintainers; [ pedrohlc ];
      description = "Built using the best configuration and kernel sources for desktop, multimedia, and gaming workloads." +
        lib.optionalString isLqx " (Same as linux_zen but less aggressive release schedule)";
    };
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2023.3.1";
+  version = "2023.3.2";
  components = {
    "3_day_blinds" = ps: with ps; [
    ];
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -180,6 +180,22 @@ let
        doCheck = false;
      });

+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+        version = "2.0.5.post1";
+        src = super.fetchPypi {
+          pname = "SQLAlchemy";
+          inherit version;
+          hash = "sha256-E+sqWILP2fTu2q7BSlYDoJbwEl98PLSGEbO/o8JT8l0=";
+        };
+        nativeCheckInputs = oldAttrs.nativeCheckInputs ++ (with super; [
+          pytest-xdist
+        ]);
+        disabledTestPaths = (oldAttrs.disabledTestPaths or []) ++ [
+          "test/aaa_profiling"
+          "test/ext/mypy"
+        ];
+      });
+
      # Pinned due to API changes in 0.3.0
      tailscale = super.tailscale.overridePythonAttrs (oldAttrs: rec {
        version = "0.2.0";
@ -247,7 +263,7 @@ let
  extraBuildInputs = extraPackages python.pkgs;

  # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.3.1";
+  hassVersion = "2023.3.2";

 in python.pkgs.buildPythonApplication rec {
  pname = "homeassistant";
@ -263,7 +279,7 @@ in python.pkgs.buildPythonApplication rec {
  # Primary source is the pypi sdist, because it contains translations
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-FvdMNtiLJ6p9I6aEeICukx9mykGGMoONGNdM/I4u/eY=";
+    hash = "sha256-I6NSVoMS3xbUqh/7BxJj/Evkk7+g3N0dZVJjEbr2pCs=";
  };

  # Secondary source is git for tests
@ -271,7 +287,7 @@ in python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    rev = "refs/tags/${version}";
-    hash = "sha256-2usXU1a/QKEIaeg8JFBf/4ID2nzZLoGsfK7KXreKEBE=";
+    hash = "sha256-Qd++/73c9VDNe4AMdiDIVJXxh4qFx2x4HDkY1An2VjE=";
  };

  nativeBuildInputs = with python3.pkgs; [
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@ -4,7 +4,7 @@ buildPythonPackage rec {
  # the frontend version corresponding to a specific home-assistant version can be found here
  # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
  pname = "home-assistant-frontend";
-  version = "20230302.0";
+  version = "20230306.0";
  format = "wheel";

  src = fetchPypi {
@ -12,7 +12,7 @@ buildPythonPackage rec {
    pname = "home_assistant_frontend";
    dist = "py3";
    python = "py3";
-    hash = "sha256-G+XexUc5yvADjbXBgg97FB03Al3zR9WTb4cuVBBrSuI=";
+    hash = "sha256-E/e1XyhwFiNMLz7+o99eG9sW2ZCCfPFnkBcu3BpCbxQ=";
  };

  # there is nothing to strip in this package
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "homeassistant-stubs";
-  version = "2023.3.1";
+  version = "2023.3.2";
  format = "pyproject";

  disabled = python.version != home-assistant.python.version;
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "KapJI";
    repo = "homeassistant-stubs";
    rev = "refs/tags/${version}";
-    hash = "sha256-WMuQgoWwri4nfKkZ8cW5o6S6G3PbHqlUxC9wyJSZhxQ=";
+    hash = "sha256-tgXjACNGD3QTrsgYtcTinW4HflwGSoCR6k6SrawQz6A=";
  };

  nativeBuildInputs = [
@ -25,6 +25,14 @@ buildPythonPackage rec {
    home-assistant
  ];

+  postPatch = ''
+    # Relax constraint to year and month
+    substituteInPlace pyproject.toml --replace \
+      'homeassistant = "${version}"' \
+      'homeassistant = "~${lib.versions.majorMinor home-assistant.version}"'
+    cat pyproject.toml
+  '';
+
  pythonImportsCheck = [
    "homeassistant-stubs"
  ];
--- a/pkgs/tools/misc/pre-commit/default.nix
+++ b/pkgs/tools/misc/pre-commit/default.nix
@ -1,28 +1,32 @@
 { lib
-, python3Packages
 , fetchFromGitHub
-  # tests
+, python3Packages
+, libiconv
 , cargo
+, coursier
 , dotnet-sdk
 , git
+, glibcLocales
 , go
-, libiconv
 , nodejs
+, perl
+, testers
+, pre-commit
 }:

 with python3Packages;
-buildPythonPackage rec {
+buildPythonApplication rec {
  pname = "pre-commit";
-  version = "2.20.0";
+  version = "3.1.0";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "pre-commit";
    repo = "pre-commit";
-    rev = "refs/tags/v${version}";
-    sha256 = "sha256-+JrnJz+wFbzVw9ysPX85DDE6suF3VU7gQZdp66x5TKY=";
+    rev = "v${version}";
+    hash = "sha256-riAXvpJmuQHOfruwebijiAgN2AvqpUUI07p758qO+4k=";
  };

  patches = [
@ -37,18 +41,18 @@ buildPythonPackage rec {
    pyyaml
    toml
    virtualenv
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    importlib-metadata
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    importlib-resources
  ];

  nativeCheckInputs = [
    cargo
+    coursier
    dotnet-sdk
    git
+    glibcLocales
    go
+    libiconv # For rust tests on Darwin
    nodejs
+    perl
    pytest-env
    pytest-forked
    pytest-xdist
@ -56,11 +60,6 @@ buildPythonPackage rec {
    re-assert
  ];

-  buildInputs = [
-    # Required for rust test on x86_64-darwin
-    libiconv
-  ];
-
  # i686-linux: dotnet-sdk not available
  doCheck = stdenv.buildPlatform.system != "i686-linux";

@ -79,19 +78,23 @@ buildPythonPackage rec {
    "--forked"
  ];

-  preCheck = ''
+  preCheck = lib.optionalString (!(stdenv.isLinux && stdenv.isAarch64)) ''
+    # Disable outline atomics for rust tests on aarch64-linux.
+    export RUSTFLAGS="-Ctarget-feature=-outline-atomics"
+  '' + ''
    export GIT_AUTHOR_NAME=test GIT_COMMITTER_NAME=test \
           GIT_AUTHOR_EMAIL=test@example.com GIT_COMMITTER_EMAIL=test@example.com \
           VIRTUALENV_NO_DOWNLOAD=1 PRE_COMMIT_NO_CONCURRENCY=1 LANG=en_US.UTF-8

-    git init -b master
+    # Resolve `.NET location: Not found` errors for dotnet tests
+    export DOTNET_ROOT="${dotnet-sdk}"

    export HOME=$(mktemp -d)

+    git init -b master
+
    python -m venv --system-site-packages venv
    source "$PWD/venv/bin/activate"
-    #$out/bin/pre-commit install
-    python setup.py develop
  '';

  postCheck = ''
@ -106,7 +109,7 @@ buildPythonPackage rec {

    # /build/pytest-of-nixbld/pytest-0/test_install_ruby_with_version0/rbenv-2.7.2/libexec/rbenv-init:
    # /usr/bin/env: bad interpreter: No such file or directory
-    "ruby"
+    "test_ruby_"

    # network
    "test_additional_dependencies_roll_forward"
@ -114,60 +117,59 @@ buildPythonPackage rec {
    "test_additional_node_dependencies_installed"
    "test_additional_rust_cli_dependencies_installed"
    "test_additional_rust_lib_dependencies_installed"
-    "test_dart_hook"
-    "test_dotnet_hook"
+    "test_coursier_hook"
+    "test_coursier_hook_additional_dependencies"
+    "test_dart"
+    "test_dart_additional_deps"
+    "test_dart_additional_deps_versioned"
+    "test_docker_hook"
+    "test_docker_image_hook_via_args"
+    "test_docker_image_hook_via_entrypoint"
+    "test_golang_default_version"
    "test_golang_hook"
    "test_golang_hook_still_works_when_gobin_is_set"
+    "test_golang_infer_go_version_default"
+    "test_golang_system"
+    "test_golang_versioned"
+    "test_language_version_with_rustup"
+    "test_installs_rust_missing_rustup"
    "test_installs_without_links_outside_env"
-    "test_local_dart_additional_dependencies"
-    "test_local_golang_additional_dependencies"
-    "test_local_lua_additional_dependencies"
-    "test_local_perl_additional_dependencies"
-    "test_local_rust_additional_dependencies"
-    "test_lua_hook"
-    "test_perl_hook"
+    "test_local_golang_additional_deps"
+    "test_lua"
+    "test_lua_additional_dependencies"
+    "test_node_additional_deps"
+    "test_node_hook_versions"
+    "test_perl_additional_dependencies"
    "test_r_hook"
+    "test_r_inline"
    "test_r_inline_hook"
    "test_r_local_with_additional_dependencies_hook"
    "test_r_with_additional_dependencies_hook"
    "test_run_a_node_hook_default_version"
+    "test_run_lib_additional_dependencies"
    "test_run_versioned_node_hook"
-
-    # python2, no explanation needed
-    "python2"
-    "test_switch_language_versions_doesnt_clobber"
-
-    # docker
-    "test_run_a_docker_hook"
+    "test_rust_cli_additional_dependencies"
+    "test_swift_language"

    # i don't know why these fail
    "test_install_existing_hooks_no_overwrite"
    "test_installed_from_venv"
    "test_uninstall_restores_legacy_hooks"
+    "test_dotnet_"

    # Expects `git commit` to fail when `pre-commit` is not in the `$PATH`,
    # but we use an absolute path so it's not an issue.
    "test_environment_not_sourced"
-
-    # broken with Git 2.38.1, upstream issue filed at https://github.com/pre-commit/pre-commit/issues/2579
-    "test_golang_with_recursive_submodule"
-    "test_install_in_submodule_and_run"
-    "test_is_in_merge_conflict_submodule"
-    "test_get_conflicted_files_in_submodule"
-    "test_sub_nothing_unstaged"
-    "test_sub_something_unstaged"
-    "test_sub_staged"
-    "test_submodule_does_not_discard_changes"
-    "test_submodule_does_not_discard_changes_recurse"
-  ] ++ lib.optionals (stdenv.isLinux && stdenv.isAarch64) [
-    # requires gcc bump
-    "test_rust_hook"
  ];

  pythonImportsCheck = [
    "pre_commit"
  ];

+  passthru.tests.version = testers.testVersion {
+    package = pre-commit;
+  };
+
  meta = with lib; {
    description = "A framework for managing and maintaining multi-language pre-commit hooks";
    homepage = "https://pre-commit.com/";
--- a/pkgs/tools/misc/pre-commit/languages-use-the-hardcoded-path-to-python-binaries.patch
+++ b/pkgs/tools/misc/pre-commit/languages-use-the-hardcoded-path-to-python-binaries.patch
@ -1,24 +1,24 @@
 diff --git a/pre_commit/languages/node.py b/pre_commit/languages/node.py
-index 26f4919..4885ec1 100644
+index 66d6136..e3f1bac 100644
 --- a/pre_commit/languages/node.py
 +++ b/pre_commit/languages/node.py
-@@ -82,7 +82,7 @@ def install_environment(
+@@ -83,7 +83,7 @@ def install_environment(
+     # https://msdn.microsoft.com/en-us/library/windows/desktop/aa365247(v=vs.85).aspx?f=255&MSPPError=-2147217396#maxpath
+     if sys.platform == 'win32':  # pragma: no cover
         envdir = fr'\\?\{os.path.normpath(envdir)}'
-     with clean_path_on_failure(envdir):
-         cmd = [
-            sys.executable, '-mnodeenv', '--prebuilt', '--clean-src', envdir,
-+            '@nodeenv@/bin/nodeenv', '--prebuilt', '--clean-src', envdir,
-         ]
-         if version != C.DEFAULT:
-             cmd.extend(['-n', version])
+-    cmd = [sys.executable, '-mnodeenv', '--prebuilt', '--clean-src', envdir]
+    cmd = ['@nodeenv@/bin/nodeenv', '--prebuilt', '--clean-src', envdir]
+     if version != C.DEFAULT:
+         cmd.extend(['-n', version])
+     cmd_output_b(*cmd)
 diff --git a/pre_commit/languages/python.py b/pre_commit/languages/python.py
-index 43b7280..f0f2338 100644
+index 976674e..485fe2d 100644
 --- a/pre_commit/languages/python.py
 +++ b/pre_commit/languages/python.py
-@@ -192,7 +192,7 @@ def install_environment(
+@@ -203,7 +203,7 @@ def install_environment(
         additional_dependencies: Sequence[str],
 ) -> None:
-     envdir = prefix.path(helpers.environment_dir(ENVIRONMENT_DIR, version))
+     envdir = lang_base.environment_dir(prefix, ENVIRONMENT_DIR, version)
 -    venv_cmd = [sys.executable, '-mvirtualenv', envdir]
 +    venv_cmd = ['@virtualenv@/bin/virtualenv', envdir]
     python = norm_version(version)
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -312,6 +312,10 @@ let

    dns-client =  callPackage ../development/ocaml-modules/dns/client.nix { };

+    dns-client-lwt = callPackage ../development/ocaml-modules/dns/client-lwt.nix { };
+
+    dns-client-mirage = callPackage ../development/ocaml-modules/dns/client-mirage.nix { };
+
    dns-mirage = callPackage ../development/ocaml-modules/dns/mirage.nix { };

    dns-resolver = callPackage ../development/ocaml-modules/dns/resolver.nix { };
@ -906,6 +910,8 @@ let

    mirage-crypto-rng-async = callPackage ../development/ocaml-modules/mirage-crypto/rng-async.nix { };

+    mirage-crypto-rng-lwt = callPackage ../development/ocaml-modules/mirage-crypto/rng-lwt.nix { };
+
    mirage-crypto-rng-mirage = callPackage ../development/ocaml-modules/mirage-crypto/rng-mirage.nix { };

    mirage-device = callPackage ../development/ocaml-modules/mirage-device { };
@ -1294,6 +1300,8 @@ let

    tls-async = callPackage ../development/ocaml-modules/tls/async.nix { };

+    tls-lwt = callPackage ../development/ocaml-modules/tls/lwt.nix { };
+
    tls-mirage = callPackage ../development/ocaml-modules/tls/mirage.nix { };

    torch = callPackage ../development/ocaml-modules/torch {