Merge master into haskell-updates

2023-12-17 00:14:10 +00:00 · 2023-12-17 00:14:10 +00:00 · fccc614684
commit fccc614684
parent 7ee71fe716 e9bf7bcd34
160 changed files with 4313 additions and 3223 deletions
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@ -591,7 +591,7 @@ See also the section about [`passthru.tests`](#var-meta-tests).

 `stdenv.mkDerivation` sets the Nix [derivation](https://nixos.org/manual/nix/stable/expressions/derivations.html#derivations)'s builder to a script that loads the stdenv `setup.sh` bash library and calls `genericBuild`. Most packaging functions rely on this default builder.

-This generic command invokes a number of *phases*. Package builds are split into phases to make it easier to override specific parts of the build (e.g., unpacking the sources or installing the binaries).
+This generic command either invokes a script at *buildCommandPath*, or a *buildCommand*, or a number of *phases*. Package builds are split into phases to make it easier to override specific parts of the build (e.g., unpacking the sources or installing the binaries).

 Each phase can be overridden in its entirety either by setting the environment variable `namePhase` to a string containing some shell commands to be executed, or by redefining the shell function `namePhase`. The former is convenient to override a phase from the derivation, while the latter is convenient from a build script. However, typically one only wants to *add* some commands to a phase, e.g. by defining `postInstall` or `preFixup`, as skipping some of the default actions may have unexpected consequences. The default script for each phase is defined in the file `pkgs/stdenv/generic/setup.sh`.

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -8184,12 +8184,6 @@
    githubId = 1358764;
    name = "Jamie Magee";
  };
-  jammerful = {
-    email = "jammerful@gmail.com";
-    github = "jammerful";
-    githubId = 20176306;
-    name = "jammerful";
-  };
  janik = {
    name = "Janik";
    email = "janik@aq0.de";
@ -10730,6 +10724,16 @@
    githubId = 8555953;
    name = "Laure Tavard";
  };
+  ltstf1re = {
+    email = "ltstf1re@disroot.org";
+    github = "lsf1re";
+    githubId = 153414530;
+    matrix = "@ltstf1re:converser.eu";
+    name = "Little Starfire";
+    keys = [{
+      fingerprint = "FE6C C3C9 2ACF 4367 2B56  5B22 8603 2ACC 051A 873D";
+    }];
+  };
  lu15w1r7h = {
    email = "lwirth2000@gmail.com";
    github = "LU15W1R7H";
--- a/nixos/modules/programs/mosh.nix
+++ b/nixos/modules/programs/mosh.nix
@ -1,7 +1,5 @@
 { config, lib, pkgs, ... }:

-with lib;
-
 let

  cfg  = config.programs.mosh;
@ -9,28 +7,26 @@ let
 in
 {
  options.programs.mosh = {
-    enable = mkOption {
-      description = lib.mdDoc ''
-        Whether to enable mosh. Note, this will open ports in your firewall!
-      '';
-      default = false;
-      type = lib.types.bool;
+    enable = lib.mkEnableOption "mosh";
+    openFirewall = lib.mkEnableOption "" // {
+      description = "Whether to automatically open the necessary ports in the firewall.";
+      default = true;
    };
-    withUtempter = mkOption {
+    withUtempter = lib.mkEnableOption "" // {
      description = lib.mdDoc ''
        Whether to enable libutempter for mosh.
+
        This is required so that mosh can write to /var/run/utmp (which can be queried with `who` to display currently connected user sessions).
        Note, this will add a guid wrapper for the group utmp!
      '';
      default = true;
-      type = lib.types.bool;
    };
  };

-  config = mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [ mosh ];
-    networking.firewall.allowedUDPPortRanges = [ { from = 60000; to = 61000; } ];
-    security.wrappers = mkIf cfg.withUtempter {
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.mosh ];
+    networking.firewall.allowedUDPPortRanges = lib.optional cfg.openFirewall { from = 60000; to = 61000; };
+    security.wrappers = lib.mkIf cfg.withUtempter {
      utempter = {
        source = "${pkgs.libutempter}/lib/utempter/utempter";
        owner = "root";
--- a/nixos/modules/programs/starship.nix
+++ b/nixos/modules/programs/starship.nix
@ -44,21 +44,39 @@ in
  config = mkIf cfg.enable {
    programs.bash.${initOption} = ''
      if [[ $TERM != "dumb" ]]; then
-        export STARSHIP_CONFIG=${settingsFile}
+        # don't set STARSHIP_CONFIG automatically if there's a user-specified
+        # config file.  starship appears to use a hardcoded config location
+        # rather than one inside an XDG folder:
+        # https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
+        if [[ ! -f "$HOME/.config/starship.toml" ]]; then
+          export STARSHIP_CONFIG=${settingsFile}
+        fi
        eval "$(${pkgs.starship}/bin/starship init bash)"
      fi
    '';

    programs.fish.${initOption} = ''
      if test "$TERM" != "dumb"
-        set -x STARSHIP_CONFIG ${settingsFile}
+        # don't set STARSHIP_CONFIG automatically if there's a user-specified
+        # config file.  starship appears to use a hardcoded config location
+        # rather than one inside an XDG folder:
+        # https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
+        if not test -f "$HOME/.config/starship.toml";
+          set -x STARSHIP_CONFIG ${settingsFile}
+        end
        eval (${pkgs.starship}/bin/starship init fish)
      end
    '';

    programs.zsh.${initOption} = ''
      if [[ $TERM != "dumb" ]]; then
-        export STARSHIP_CONFIG=${settingsFile}
+        # don't set STARSHIP_CONFIG automatically if there's a user-specified
+        # config file.  starship appears to use a hardcoded config location
+        # rather than one inside an XDG folder:
+        # https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
+        if [[ ! -f "$HOME/.config/starship.toml" ]]; then
+          export STARSHIP_CONFIG=${settingsFile}
+        fi
        eval "$(${pkgs.starship}/bin/starship init zsh)"
      fi
    '';
--- a/nixos/modules/programs/winbox.nix
+++ b/nixos/modules/programs/winbox.nix
@ -18,6 +18,7 @@ in
  };

  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
    networking.firewall.allowedUDPPorts = lib.optionals cfg.openFirewall [ 5678 ];
  };
 }
--- a/nixos/modules/services/security/shibboleth-sp.nix
+++ b/nixos/modules/services/security/shibboleth-sp.nix
@ -1,44 +1,43 @@
-{pkgs, config, lib, ...}:
+{ config, lib, pkgs, ... }:

-with lib;
 let
  cfg = config.services.shibboleth-sp;
 in {
  options = {
    services.shibboleth-sp = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
        default = false;
        description = lib.mdDoc "Whether to enable the shibboleth service";
      };

-      configFile = mkOption {
-        type = types.path;
-        example = literalExpression ''"''${pkgs.shibboleth-sp}/etc/shibboleth/shibboleth2.xml"'';
+      configFile = lib.mkOption {
+        type = lib.types.path;
+        example = lib.literalExpression ''"''${pkgs.shibboleth-sp}/etc/shibboleth/shibboleth2.xml"'';
        description = lib.mdDoc "Path to shibboleth config file";
      };

-      fastcgi.enable = mkOption {
-        type = types.bool;
+      fastcgi.enable = lib.mkOption {
+        type = lib.types.bool;
        default = false;
        description = lib.mdDoc "Whether to include the shibauthorizer and shibresponder FastCGI processes";
      };

-      fastcgi.shibAuthorizerPort = mkOption {
-        type = types.int;
+      fastcgi.shibAuthorizerPort = lib.mkOption {
+        type = lib.types.int;
        default = 9100;
        description = lib.mdDoc "Port for shibauthorizer FastCGI process to bind to";
      };

-      fastcgi.shibResponderPort = mkOption {
-        type = types.int;
+      fastcgi.shibResponderPort = lib.mkOption {
+        type = lib.types.int;
        default = 9101;
        description = lib.mdDoc "Port for shibauthorizer FastCGI process to bind to";
      };
    };
  };

-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
    systemd.services.shibboleth-sp = {
      description = "Provides SSO and federation for web applications";
      after       = lib.optionals cfg.fastcgi.enable [ "shibresponder.service" "shibauthorizer.service" ];
@ -48,7 +47,7 @@ in {
      };
    };

-    systemd.services.shibresponder = mkIf cfg.fastcgi.enable {
+    systemd.services.shibresponder = lib.mkIf cfg.fastcgi.enable {
      description = "Provides SSO through Shibboleth via FastCGI";
      after       = [ "network.target" ];
      wantedBy    = [ "multi-user.target" ];
@ -59,7 +58,7 @@ in {
      };
    };

-    systemd.services.shibauthorizer = mkIf cfg.fastcgi.enable {
+    systemd.services.shibauthorizer = lib.mkIf cfg.fastcgi.enable {
      description = "Provides SSO through Shibboleth via FastCGI";
      after       = [ "network.target" ];
      wantedBy    = [ "multi-user.target" ];
@ -71,5 +70,5 @@ in {
    };
  };

-  meta.maintainers = with lib.maintainers; [ jammerful ];
+  meta.maintainers = with lib.maintainers; [ ];
 }
--- a/nixos/modules/services/web-apps/node-red.nix
+++ b/nixos/modules/services/web-apps/node-red.nix
@ -19,7 +19,7 @@ in
  options.services.node-red = {
    enable = mkEnableOption (lib.mdDoc "the Node-RED service");

-    package = mkPackageOption pkgs.nodePackages "node-red" { };
+    package = mkPackageOption pkgs [ "nodePackages" "node-red" ] { };

    openFirewall = mkOption {
      type = types.bool;
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -295,7 +295,7 @@ in
        ++ lib.optional config.powerManagement.enable powerdevil
        ++ lib.optional config.services.colord.enable pkgs.colord-kde
        ++ lib.optional config.services.hardware.bolt.enable pkgs.plasma5Packages.plasma-thunderbolt
-        ++ lib.optionals config.services.samba.enable [ kdenetwork-filesharing pkgs.samba ]
+        ++ lib.optional config.services.samba.enable kdenetwork-filesharing
        ++ lib.optional config.services.xserver.wacom.enable pkgs.wacomtablet
        ++ lib.optional config.services.flatpak.enable flatpak-kcm;

--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@ -2,11 +2,11 @@

 let
  pname = "ledger-live-desktop";
-  version = "2.71.1";
+  version = "2.73.0";

  src = fetchurl {
    url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-+1i4ycURuT0xSF2yLQM5uyDFzeeGQ8H4On2Pb3oIRYc=";
+    hash = "sha256-/eFzIIjHCAYskc68CGTyUKW04spX8YN69/3cPQ0Qtc0=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -10,16 +10,16 @@ let
    inherit tiling_wm;
  };
  stableVersion = {
-    version = "2022.3.1.20"; # "Android Studio Giraffe (2022.3.1) Patch 2"
-    sha256Hash = "sha256-IkxOt6DI4cBPUOztEBNJV0DHGruJjVdJ0skxcue+rdg=";
+    version = "2023.1.1.26"; # "Android Studio Hedgehog | 2023.1.1"
+    sha256Hash = "sha256-l36KmFVBT31BFX8L4OEPt0DEK9M392PV2Ws+BZeAZj0=";
  };
  betaVersion = {
    version = "2023.1.1.25"; # "Android Studio Hedgehog | 2023.1.1 RC 3"
    sha256Hash = "sha256-jOqTAHYAk8j9+Ir01TLBsp20u7/iBKV8T/joZLITDs4=";
  };
  latestVersion = {
-    version = "2023.2.1.14"; # "Android Studio Iguana | 2023.2.1 Canary 14"
-    sha256Hash = "sha256-8szERftch1JWJ66BclJBq5DZcH1Xf1cyVj08WknLoS8=";
+    version = "2023.2.1.17"; # "Android Studio Iguana | 2023.2.1 Canary 17"
+    sha256Hash = "sha256-RG1N06psRaRrC/57Trb23K0Iezp2VBViBRqJRHLssMI=";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/lapce/Cargo.lock
+++ b/pkgs/applications/editors/lapce/Cargo.lock
--- a/pkgs/applications/editors/lapce/default.nix
+++ b/pkgs/applications/editors/lapce/default.nix
@ -6,101 +6,95 @@
 , cmake
 , pkg-config
 , perl
+, python3
 , fontconfig
 , glib
 , gtk3
 , openssl
+, libGL
 , libobjc
+, libxkbcommon
 , Security
 , CoreServices
 , ApplicationServices
 , Carbon
 , AppKit
 , wrapGAppsHook
+, wayland
 , gobject-introspection
+, xorg
 }:
-
+let
+  rpathLibs = lib.optionals stdenv.isLinux [
+    libGL
+    libxkbcommon
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXxf86vm
+    xorg.libxcb
+    wayland
+  ];
+in
 rustPlatform.buildRustPackage rec {
  pname = "lapce";
-  version = "0.2.8";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "lapce";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-cfQQ+PaInUB6B61sZ9iS/zt3L6Vc/vPOJTtEwR0BLco=";
+    sha256 = "sha256-R7z3E6Moyc6yMFGzfggiYgglLs/A+iOx8ZJKMPhbAz0=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "druid-0.7.0" = "sha256-PJH+Y5PScM6KnPeb5lBLKpqe9nbG3bXIJK2y4V1IM9o=";
-      "font-kit-0.11.0" = "sha256-MsUbFhWd3GdqchzwrRPuzpz3mNYde00HwA9EIRBc2SQ=";
-      "fount-0.1.0" = "sha256-ptPnisGuzip3tQUuwtPU+ETiIzxMvIgAvlIGyGw/4wI=";
+      "alacritty_config-0.1.2-dev" = "sha256-6FSi5RU7YOzNIB2kd/O1OKswn54ak6qrLvN/FbJD3g0=";
+      "cosmic-text-0.7.0" = "sha256-ATBeQeSlRCuBZIV4Fdam3p+eW5YH8uJadJearZuONrQ=";
+      "floem-0.1.0" = "sha256-UVmqF2vkX71o4JBrhIIhd2SkLNBaqibwl51FKLJUo4c=";
      "human-sort-0.2.2" = "sha256-tebgIJGXOY7pwWRukboKAzXY47l4Cn//0xMKQTaGu8w=";
-      "parley-0.1.0" = "sha256-9xT+bhcZSBxQp10cbxQlqiG4D4NxaTkAxfgaHX0cqX4=";
-      "piet-wgpu-0.1.0" = "sha256-SOycknxo6wMDy/2D3cxsngI0MZO78B5QkhdCkvCkFyU=";
-      "psp-types-0.1.0" = "sha256-7scU/eR6S2hVS6UKoFmZP901DMZEEho35nVEuQJERR0=";
+      "peniko-0.1.0" = "sha256-FZu56HLN5rwSWOwIC00FvKShSv4QPCR44l9MURgC+iI=";
+      "psp-types-0.1.0" = "sha256-/oFt/AXxCqBp21hTSYrokWsbFYTIDCrHMUBuA2Nj5UU=";
      "structdesc-0.1.0" = "sha256-4j6mJ1H5hxJXr7Sz0UsZxweyAm9sYuxjq8yg3ZlpksI=";
-      "swash-0.1.4" = "sha256-oPjQF/nKnoHyed+4SZcc4zlc/I+0J6/DuigbHglQPMA=";
+      "tracing-0.2.0" = "sha256-Tc44Mg2Ue4HyB1z+9UBqpjdecJa60ekGXs+npqv22uA=";
      "tree-sitter-bash-0.19.0" = "sha256-gTsA874qpCI/N5tmBI5eT8KDaM25gXM4VbcCbUU2EeI=";
-      "tree-sitter-c-sharp-0.20.0" = "sha256-4R6+15ZbtC/LtSHpk7DqcMiFYjht+062Av31spK07rc=";
-      "tree-sitter-clojure-0.1.0" = "sha256-qeTQgJ3DAlqhRlATB34aPNzAgKOyIaxfKiZP9Z3Mx2k=";
-      "tree-sitter-css-0.19.0" = "sha256-xXDTi9HL46qHoeyf2ZQJRCIYCY4vWBmTBkt55EewgmQ=";
-      "tree-sitter-d-0.3.2" = "sha256-oWbggHlWVxc5QsHDvOVcWvjykLPmFuuoxkqgen7He4A=";
-      "tree-sitter-dart-0.0.1" = "sha256-JW9Hdzm/Sb56od+K/Wf0IlcfpgiEVY5e3ovOtMEeqpQ=";
-      "tree-sitter-dockerfile-0.1.0" = "sha256-sSkAR6CZ9MnjeggaQ3F0aG4m0oKKSa866EXQDgm6k3Q=";
-      "tree-sitter-elixir-0.19.0" = "sha256-5nopPahI6VDxu9z2lKaXWMPZ+1EWYRM2S9k3cfRrxGM=";
-      "tree-sitter-erlang-0.0.1" = "sha256-6eiRiTTPdMBRsxVHIHYuw0sIfRDvP4pZIEyckoo304Q=";
-      "tree-sitter-glimmer-0.0.1" = "sha256-qQQ94F/CMx0cMhqqpY0xkMi10Yx+XG1YiT+if6laJvM=";
-      "tree-sitter-glsl-0.1.3" = "sha256-k37NkUjYPzZnE21EYPBX4CAFdmZzJzy5BOJU+VjpcA4=";
-      "tree-sitter-haskell-0.14.0" = "sha256-94zxdt3JjC3iki639taHYmRwQIzOlOM6H9C3sKnRj/o=";
-      "tree-sitter-haxe-0.2.2" = "sha256-yUzJDaAu2kTompR6W0UDRgld/mveaDoj9bdE9Bz9GwI=";
-      "tree-sitter-hcl-0.0.1" = "sha256-GWUOATMa6ANnhH5k+P9GcCNQQnhqpyfblUG90rQN0iw=";
-      "tree-sitter-java-0.20.0" = "sha256-tGBi6gJJIPpp6oOwmAQdqBD6eaJRBRcYbWtm1BHsgBA=";
      "tree-sitter-json-0.20.0" = "sha256-pXa6WFJ4wliXHBiuHuqtAFWz+OscTOxbna5iymS547w=";
-      "tree-sitter-julia-0.19.0" = "sha256-z+E3sYS9fMBWlSmy/3wiQRzhrYhhNK5xH6MK1FroMi8=";
-      "tree-sitter-kotlin-0.2.11" = "sha256-aRMqhmZKbKoggtBOgtFIq0xTP+PgeD3Qz6DPJsAFPRQ=";
-      "tree-sitter-latex-0.2.0" = "sha256-0n42ZrlQdo1IbrURVJkcKV2JeQ7jUI2eSW7dkC1aXH4=";
-      "tree-sitter-lua-0.0.12" = "sha256-0gViT7PjduQsTTi4e0VVUFiXJjmrjFBnWdGY0B4iS/0=";
      "tree-sitter-md-0.1.2" = "sha256-gKbjAcY/x9sIxiG7edolAQp2JWrx78mEGeCpayxFOuE=";
-      "tree-sitter-nix-0.0.1" = "sha256-BYAVY0BISrJSwIMvLa/4QrkWdzMs36ZEz96w/CxWVVo=";
-      "tree-sitter-ocaml-0.20.0" = "sha256-gTmRBFFCBrA48Yn1MO2mMQPpa6u3uv5McC4BDuMXKuM=";
-      "tree-sitter-php-0.19.1" = "sha256-Lg4gEi6bCYosakr2McmgOwGHsmsVSjD+oyG6XNTd0j0=";
-      "tree-sitter-protobuf-0.0.1" = "sha256-h86NQAIRU+mUroa0LqokMtEVd7U5BXo/DADc2UUZQzI=";
-      "tree-sitter-ql-0.19.0" = "sha256-2QOtNguYAIhIhGuVqyx/33gFu3OqcxAPBZOk85Q226M=";
-      "tree-sitter-ruby-0.19.0" = "sha256-BjdgNxXoaZ+nYrszd8trL0Cu4hnQNZkSWejTThkAn0o=";
-      "tree-sitter-scheme-0.2.0" = "sha256-K3+zmykjq2DpCnk17Ko9LOyGQTBZb1/dgVXIVynCYd4=";
-      "tree-sitter-scss-0.0.1" = "sha256-zGnPZbdRfFvDmbfNMWxTpKCp0/Yl1WqlLjw05jtVofM=";
-      "tree-sitter-sql-0.0.2" = "sha256-PZSJ/8N/HNskFnkfqN11ZBOESXHGGGCPG/yET832hlE=";
-      "tree-sitter-svelte-0.10.2" = "sha256-ACRpn1/2d6/ambLvr0xr7kT9gTzFFHXtvbQRTxEoet0=";
-      "tree-sitter-wgsl-0.0.1" = "sha256-x42qHPwzv3uXVahHE9xYy3RkrYFctJGNEJmu6w1/2Qo=";
-      "tree-sitter-xml-0.0.1" = "sha256-3DwRrAkk0OU2bOxBYSPpUQm2dxg1AYosbV6HXfYax/Y=";
      "tree-sitter-yaml-0.0.1" = "sha256-bQ/APnFpes4hQLv37lpoADyjXDBY7J4Zg+rLyUtbra4=";
-      "tree-sitter-zig-0.0.1" = "sha256-E0q3nWsAMXBVM5LkOfrfBJyV9jQPJjiCSnD2ikXShFc=";
-      "wasi-experimental-http-wasmtime-0.10.0" = "sha256-vV2cwA+vxWcrozXparleZUqKxp2DDkaRJFOAT0m2uWo=";
+      "vger-0.2.7" = "sha256-evri/64mA0TQY7mFn+9bCl3c247V2QEYlwyMPpOcv5Y=";
+      "wasi-experimental-http-wasmtime-0.10.0" = "sha256-FuF3Ms1bT9bBasbLK+yQ2xggObm/lFDRyOvH21AZnQI=";
+      "winit-0.29.4" = "sha256-Y71QsRiHo0ldUAoAhid3yRDtHyIdd3HJ3AA6YJG04as=";
    };
  };

+  env = {
+    # Get openssl-sys to use pkg-config
+    OPENSSL_NO_VENDOR = 1;
+
+    # This variable is read by build script, so that Lapce editor knows its version
+    RELEASE_TAG_NAME = "v${version}";
+
+  } // lib.optionalAttrs stdenv.cc.isClang {
+    # Work around https://github.com/NixOS/nixpkgs/issues/166205.
+    NIX_LDFLAGS = "-l${stdenv.cc.libcxx.cxxabi.libName}";
+  };
+
  postPatch = ''
-    substituteInPlace lapce-ui/Cargo.toml --replace ", \"lapce-data/updater\"" ""
+    substituteInPlace lapce-app/Cargo.toml --replace ", \"updater\"" ""
  '';

  nativeBuildInputs = [
    cmake
    pkg-config
    perl
+    python3
    wrapGAppsHook # FIX: No GSettings schemas are installed on the system
    gobject-introspection
  ];

-  # Get openssl-sys to use pkg-config
-  OPENSSL_NO_VENDOR = 1;
-
-  # This variable is read by build script, so that Lapce editor knows its version
-  env.RELEASE_TAG_NAME = "v${version}";
-
-  buildInputs = [
+  buildInputs = rpathLibs ++ [
    glib
    gtk3
    openssl
@ -115,11 +109,21 @@ rustPlatform.buildRustPackage rec {
    AppKit
  ];

-  postInstall = ''
+  postInstall = if stdenv.isLinux then ''
    install -Dm0644 $src/extra/images/logo.svg $out/share/icons/hicolor/scalable/apps/dev.lapce.lapce.svg
    install -Dm0644 $src/extra/linux/dev.lapce.lapce.desktop $out/share/applications/lapce.desktop
+
+    $STRIP -S $out/bin/lapce
+
+    patchelf --add-rpath "${lib.makeLibraryPath rpathLibs}" $out/bin/lapce
+  '' else ''
+    mkdir $out/Applications
+    cp -r extra/macos/Lapce.app $out/Applications
+    ln -s $out/bin $out/Applications/Lapce.app/Contents/MacOS
  '';

+  dontPatchELF = true;
+
  passthru.updateScript = nix-update-script { };

  meta = with lib; {
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -6599,18 +6599,6 @@ final: prev:
    meta.homepage = "https://github.com/tamago324/nlsp-settings.nvim/";
  };

-  nlua-nvim = buildVimPlugin {
-    pname = "nlua.nvim";
-    version = "2022-12-20";
-    src = fetchFromGitHub {
-      owner = "tjdevries";
-      repo = "nlua.nvim";
-      rev = "01aa428ff00605d52d0c0ece560f6a6d7971726b";
-      sha256 = "1v80qmhhqc1frpvnz42wa84qaz6xkasyrz59aisifp1vqcn01lgk";
-    };
-    meta.homepage = "https://github.com/tjdevries/nlua.nvim/";
-  };
-
  nnn-vim = buildVimPlugin {
    pname = "nnn.vim";
    version = "2023-05-23";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -554,7 +554,6 @@ https://github.com/EdenEast/nightfox.nvim/,,
 https://github.com/zah/nim.vim/,,
 https://github.com/figsoda/nix-develop.nvim/,HEAD,
 https://github.com/tamago324/nlsp-settings.nvim/,main,
-https://github.com/tjdevries/nlua.nvim/,,
 https://github.com/mcchrish/nnn.vim/,,
 https://github.com/shortcuts/no-neck-pain.nvim/,HEAD,
 https://github.com/folke/noice.nvim/,HEAD,
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@ -38,14 +38,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mame";
-  version = "0.260";
+  version = "0.261";
  srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;

  src = fetchFromGitHub {
    owner = "mamedev";
    repo = "mame";
    rev = "mame${srcVersion}";
-    hash = "sha256-spWnaf7xXK2xzgdUagsgN5doVrpJk7EA6fzYd9FlFm0=";
+    hash = "sha256-Tbsu4dYOBGwsPW94W0xN2+t4vqb1cWI7J1C2l6WU3qI=";
  };

  outputs = [ "out" "tools" ];
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gpxsee";
-  version = "13.11";
+  version = "13.12";

  src = fetchFromGitHub {
    owner = "tumic0";
    repo = "GPXSee";
    rev = finalAttrs.version;
-    hash = "sha256-EJpyWuOyUVb34F5Pg8KPF9R3f3VpvZVeg8WBZ1oGbbE=";
+    hash = "sha256-jHqxCOxkM7RJmJYq+nKJfSfd0LGQ7jZnUhuAZLFEG58=";
  };

  buildInputs = [
--- a/pkgs/applications/networking/browsers/tor-browser/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser/default.nix
@ -1,8 +1,12 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , makeDesktopItem
+, copyDesktopItems
+, makeWrapper
 , writeText
 , autoPatchelfHook
+, wrapGAppsHook
 , callPackage

 , atk
@ -33,6 +37,9 @@
 , libdrm
 , libGL

+, mediaSupport ? true
+, ffmpeg
+
 , audioSupport ? mediaSupport

 , pipewireSupport ? audioSupport
@ -46,18 +53,6 @@
 , libvaSupport ? mediaSupport
 , libva

-# Media support (implies audio support)
-, mediaSupport ? true
-, ffmpeg
-
-# Wrapper runtime
-, coreutils
-, glibcLocales
-, gnome
-, runtimeShell
-, shared-mime-info
-, gsettings-desktop-schemas
-
 # Hardening
 , graphene-hardened-malloc
 # Whether to use graphene-hardened-malloc
@ -149,7 +144,7 @@ stdenv.mkDerivation rec {

  src = sources.${stdenv.hostPlatform.system} or (throw "unsupported system: ${stdenv.hostPlatform.system}");

-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = [ autoPatchelfHook copyDesktopItems makeWrapper wrapGAppsHook ];
  buildInputs = [
    gtk3
    alsa-lib
@ -160,15 +155,15 @@ stdenv.mkDerivation rec {
  preferLocalBuild = true;
  allowSubstitutes = false;

-  desktopItem = makeDesktopItem {
+  desktopItems = [(makeDesktopItem {
    name = "torbrowser";
-    exec = "tor-browser";
-    icon = "torbrowser";
+    exec = "tor-browser %U";
+    icon = "tor-browser";
    desktopName = "Tor Browser";
    genericName = "Web Browser";
    comment = meta.description;
    categories = [ "Network" "WebBrowser" "Security" ];
-  };
+  })];

  buildPhase = ''
    runHook preBuild
@ -191,6 +186,9 @@ stdenv.mkDerivation rec {
    # firefox is a wrapper that checks for a more recent libstdc++ & appends it to the ld path
    mv firefox.real firefox

+    # store state at `~/.tor browser` instead of relative to executable
+    touch "$TBB_IN_STORE/system-install"
+
    # The final libPath.  Note, we could split this into firefoxLibPath
    # and torLibPath for accuracy, but this is more convenient ...
    libPath=${libPath}:$TBB_IN_STORE:$TBB_IN_STORE/TorBrowser/Tor
@ -214,7 +212,6 @@ stdenv.mkDerivation rec {
    sed -i TorBrowser/Data/Tor/torrc-defaults \
        -e "s|\(ClientTransportPlugin snowflake\) exec|\1 exec $interp|"

-
    # Prepare for autoconfig.
    #
    # See https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment
@ -228,12 +225,11 @@ stdenv.mkDerivation rec {
    cat >mozilla.cfg <<EOF
    // First line must be a comment

-    // Always update via Nixpkgs
-    lockPref("app.update.auto", false);
-    lockPref("app.update.enabled", false);
-    lockPref("extensions.update.autoUpdateDefault", false);
-    lockPref("extensions.update.enabled", false);
-    lockPref("extensions.torbutton.versioncheck_enabled", false);
+    // Reset pref that captures store paths.
+    clearPref("extensions.xpiState");
+
+    // Stop obnoxious first-run redirection.
+    lockPref("noscript.firstRunRedirection", false);

    // User should never change these.  Locking prevents these
    // values from being written to prefs.js, avoiding Store
@ -241,12 +237,6 @@ stdenv.mkDerivation rec {
    lockPref("extensions.torlauncher.torrc-defaults_path", "$TBB_IN_STORE/TorBrowser/Data/Tor/torrc-defaults");
    lockPref("extensions.torlauncher.tor_path", "$TBB_IN_STORE/TorBrowser/Tor/tor");

-    // Reset pref that captures store paths.
-    clearPref("extensions.xpiState");
-
-    // Stop obnoxious first-run redirection.
-    lockPref("noscript.firstRunRedirection", false);
-
    // Insist on using IPC for communicating with Tor
    //
    // Defaults to creating \$XDG_RUNTIME_DIR/Tor/{socks,control}.socket
@ -269,18 +259,12 @@ stdenv.mkDerivation rec {
    ''}
    EOF

-    # Hard-code path to TBB fonts; see also FONTCONFIG_FILE in
-    # the wrapper below.
+    # FONTCONFIG_FILE is required to make fontconfig read the TBB
+    # fonts.conf; upstream uses FONTCONFIG_PATH, but FC_DEBUG=1024
+    # indicates the system fonts.conf being used instead.
    FONTCONFIG_FILE=$TBB_IN_STORE/fontconfig/fonts.conf
    sed -i "$FONTCONFIG_FILE" \
-        -e "s,<dir>fonts</dir>,<dir>$TBB_IN_STORE/fonts</dir>,"
-
-    # Preload extensions by moving into the runtime instead of storing under the
-    # user's profile directory.
-    # See https://support.mozilla.org/en-US/kb/deploying-firefox-with-extensions
-    mkdir -p "$TBB_IN_STORE/distribution/extensions"
-    mv "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/extensions/"* \
-      "$TBB_IN_STORE/distribution/extensions"
+      -e "s,<dir>fonts</dir>,<dir>$TBB_IN_STORE/fonts</dir>,"

    # Hard-code paths to geoip data files.  TBB resolves the geoip files
    # relative to torrc-defaults_path but if we do not hard-code them
@ -291,156 +275,20 @@ stdenv.mkDerivation rec {
    GeoIPv6File $TBB_IN_STORE/TorBrowser/Data/Tor/geoip6
    EOF

-    WRAPPER_LD_PRELOAD=${lib.optionalString (useHardenedMalloc == true)
-      "${graphene-hardened-malloc}/lib/libhardened_malloc.so"}
-
-    WRAPPER_XDG_DATA_DIRS=${lib.concatMapStringsSep ":" (x: "${x}/share") [
-      gnome.adwaita-icon-theme
-      shared-mime-info
-    ]}
-    WRAPPER_XDG_DATA_DIRS+=":"${lib.concatMapStringsSep ":" (x: "${x}/share/gsettings-schemas/${x.name}") [
-      glib
-      gsettings-desktop-schemas
-      gtk3
-    ]};
-
-    # Generate wrapper
    mkdir -p $out/bin
-    cat > "$out/bin/tor-browser" << EOF
-    #! ${runtimeShell}
-    set -o errexit -o nounset

-    PATH=${lib.makeBinPath [ coreutils ]}
-    export LC_ALL=C
-    export LOCALE_ARCHIVE=${glibcLocales}/lib/locale/locale-archive
-
-    # Enter local state directory.
-    REAL_HOME=\''${HOME%/}
-    TBB_HOME=\''${TBB_HOME:-''${XDG_DATA_HOME:-\$REAL_HOME/.local/share}/tor-browser}
-    HOME=\$TBB_HOME
-
-    mkdir -p "\$HOME"
-    cd "\$HOME"
-
-    # Initialize empty TBB local state directory hierarchy.  We
-    # intentionally mirror the layout that TBB would see if executed from
-    # the unpacked bundle dir.
-    mkdir -p "\$HOME/TorBrowser" "\$HOME/TorBrowser/Data"
-
-    # Initialize the Tor data directory.
-    mkdir -p "\$HOME/TorBrowser/Data/Tor"
-
-    # TBB will fail if ownership is too permissive
-    chmod 0700 "\$HOME/TorBrowser/Data/Tor"
-
-    # Initialize the browser profile state.
-    # All files under user's profile dir are generated by TBB.
-    mkdir -p "\$HOME/TorBrowser/Data/Browser/profile.default"
-
-    # Clear some files if the last known store path is different from the new one
-    : "\''${KNOWN_STORE_PATH:=\$HOME/known-store-path}"
-    if ! [ "\$KNOWN_STORE_PATH" -ef $out ]; then
-      echo "Cleanup files with outdated store references"
-      ln -Tsf $out "\$KNOWN_STORE_PATH"
-
-      # Clear out some files that tend to capture store references but are
-      # easily generated by firefox at startup.
-      rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/{addonStartup.json.lz4,compatibility.ini,extensions.ini,extensions.json}
-      rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/startupCache/*
-    fi
-
-    # XDG
-    : "\''${XDG_RUNTIME_DIR:=/run/user/\$(id -u)}"
-    : "\''${XDG_CONFIG_HOME:=\$REAL_HOME/.config}"
-
-    ${lib.optionalString pulseaudioSupport ''
-      # Figure out some envvars for pulseaudio
-      : "\''${PULSE_SERVER:=\$XDG_RUNTIME_DIR/pulse/native}"
-      : "\''${PULSE_COOKIE:=\$XDG_CONFIG_HOME/pulse/cookie}"
-    ''}
-
-    # Font cache files capture store paths; clear them out on the off
-    # chance that TBB would continue using old font files.
-    rm -rf "\$HOME/.cache/fontconfig"
-
-    # Manually specify data paths (by default TB attempts to create these in the store)
-    {
-      echo "user_pref(\"extensions.torlauncher.toronionauthdir_path\", \"\$HOME/TorBrowser/Data/Tor/onion-auth\");"
-      echo "user_pref(\"extensions.torlauncher.torrc_path\", \"\$HOME/TorBrowser/Data/Tor/torrc\");"
-      echo "user_pref(\"extensions.torlauncher.tordatadir_path\", \"\$HOME/TorBrowser/Data/Tor\");"
-    } >> "\$HOME/TorBrowser/Data/Browser/profile.default/prefs.js"
-
-    # Lift-off
-    #
-    # XAUTHORITY and DISPLAY are required for TBB to work at all.
-    #
-    # DBUS_SESSION_BUS_ADDRESS is inherited to avoid auto-launch; to
-    # prevent that, set it to an empty/invalid value prior to running
-    # tor-browser.
-    #
-    # PULSE_SERVER is necessary for audio playback.
-    #
-    # Setting FONTCONFIG_FILE is required to make fontconfig read the TBB
-    # fonts.conf; upstream uses FONTCONFIG_PATH, but FC_DEBUG=1024
-    # indicates the system fonts.conf being used instead.
-    #
-    # XDG_DATA_DIRS is set to prevent searching system dirs (looking for .desktop & icons)
-    exec env -i \
-      LD_PRELOAD=$WRAPPER_LD_PRELOAD \
-      \
-      TZ=":" \
-      TZDIR="\''${TZDIR:-}" \
-      LOCALE_ARCHIVE="\$LOCALE_ARCHIVE" \
-      \
-      TMPDIR="\''${TMPDIR:-/tmp}" \
-      HOME="\$HOME" \
-      XAUTHORITY="\''${XAUTHORITY:-\$HOME/.Xauthority}" \
-      DISPLAY="\''${DISPLAY:-}" \
-      DBUS_SESSION_BUS_ADDRESS="\''${DBUS_SESSION_BUS_ADDRESS:-unix:path=\$XDG_RUNTIME_DIR/bus}" \\
-      \
-      XDG_DATA_HOME="\$HOME/.local/share" \
-      XDG_DATA_DIRS="$WRAPPER_XDG_DATA_DIRS" \
-      \
-      PULSE_SERVER="\''${PULSE_SERVER:-}" \
-      PULSE_COOKIE="\''${PULSE_COOKIE:-}" \
-      \
-      MOZ_ENABLE_WAYLAND="\''${MOZ_ENABLE_WAYLAND:-}" \
-      WAYLAND_DISPLAY="\''${WAYLAND_DISPLAY:-}" \
-      XDG_RUNTIME_DIR="\''${XDG_RUNTIME_DIR:-}" \
-      XCURSOR_PATH="\''${XCURSOR_PATH:-}" \
-      \
-      APULSE_PLAYBACK_DEVICE="\''${APULSE_PLAYBACK_DEVICE:-plug:dmix}" \
-      \
-      TOR_SKIP_LAUNCH="\''${TOR_SKIP_LAUNCH:-}" \
-      TOR_CONTROL_HOST="\''${TOR_CONTROL_HOST:-}" \
-      TOR_CONTROL_PORT="\''${TOR_CONTROL_PORT:-}" \
-      TOR_CONTROL_COOKIE_AUTH_FILE="\''${TOR_CONTROL_COOKIE_AUTH_FILE:-}" \
-      TOR_CONTROL_PASSWD="\''${TOR_CONTROL_PASSWD:-}" \
-      TOR_SOCKS_HOST="\''${TOR_SOCKS_HOST:-}" \
-      TOR_SOCKS_PORT="\''${TOR_SOCKS_PORT:-}" \
-      \
-      FONTCONFIG_FILE="$FONTCONFIG_FILE" \
-      \
-      LD_LIBRARY_PATH="$libPath" \
-      \
-      "$TBB_IN_STORE/firefox" \
-        --class "Tor Browser" \
-        -no-remote \
-        -profile "\$HOME/TorBrowser/Data/Browser/profile.default" \
-        "\''${@}"
-    EOF
-    chmod +x $out/bin/tor-browser
+    makeWrapper "$TBB_IN_STORE/firefox" "$out/bin/tor-browser" \
+      --prefix LD_PRELOAD : "${lib.optionalString (useHardenedMalloc == true)
+        "${graphene-hardened-malloc}/lib/libhardened_malloc.so"}" \
+      --prefix LD_LIBRARY_PATH : "$libPath" \
+      --set FONTCONFIG_FILE "$FONTCONFIG_FILE" \
+      --set-default MOZ_ENABLE_WAYLAND 1

    # Easier access to docs
    mkdir -p $out/share/doc
    ln -s $TBB_IN_STORE/TorBrowser/Docs $out/share/doc/tor-browser

-    # Install .desktop item
-    mkdir -p $out/share/applications
-    cp $desktopItem/share/applications"/"* $out/share/applications
-    sed -i $out/share/applications/torbrowser.desktop \
-        -e "s,Exec=.*,Exec=$out/bin/tor-browser," \
-        -e "s,Icon=.*,Icon=tor-browser,"
+    # Install icons
    for i in 16 32 48 64 128; do
      mkdir -p $out/share/icons/hicolor/''${i}x''${i}/apps/
      ln -s $out/share/tor-browser/browser/chrome/icons/default/default$i.png $out/share/icons/hicolor/''${i}x''${i}/apps/tor-browser.png
@ -451,8 +299,7 @@ stdenv.mkDerivation rec {
    LD_LIBRARY_PATH=$libPath $TBB_IN_STORE/TorBrowser/Tor/tor --version >/dev/null

    echo "Checking tor-browser wrapper ..."
-      TBB_HOME=$(mktemp -d) \
-      $out/bin/tor-browser --version >/dev/null
+    $out/bin/tor-browser --version >/dev/null

    runHook postBuild
  '';
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -24,7 +24,7 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "6.4.3160.42";
+  version = "6.5.3206.39";

  suffix = {
    aarch64-linux = "arm64";
@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
    hash = {
-      aarch64-linux = "sha256-DQXlINbgZmYdmrp/VeWloWFk2REPMyWUaJkMVl0wDho=";
-      x86_64-linux = "sha256-udzdWNG0B9SidaOPsAOzkoviB3kwjaNCPZkSSIpLXNI=";
+      aarch64-linux = "sha256-7f3JRkkBGF+7EFGbzosUcKUUFswmKhpacbcd0AaY8fw=";
+      x86_64-linux = "sha256-louqE7Icf8qEiegzoVd/1jzA+wLFTrQyN3V8g64uQT8=";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "kubernetes-helm";
-  version = "3.13.2";
+  version = "3.13.3";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-WXtEXgKco50D1TR775lIm/VuD+MJMbOMQpPC0W4MAYo=";
+    sha256 = "sha256-tU6RdVdcOvNYgnVmeDVKVuKY5GLeqVzpleq6qNwD2yI=";
  };
-  vendorHash = "sha256-kvler6o4On4SbFF7AvPSCF5fRYtPNI5fsOcUbrTGYcQ=";
+  vendorHash = "sha256-ve2T2O9cISshAe5uAyXYZ6Mbb1TPhOqhV8vkF5uMrhY=";

  subPackages = [ "cmd/helm" ];
  ldflags = [
--- a/pkgs/applications/networking/cluster/kaniko/default.nix
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "kaniko";
-  version = "1.19.0";
+  version = "1.19.1";

  src = fetchFromGitHub {
    owner = "GoogleContainerTools";
    repo = "kaniko";
    rev = "v${version}";
-    hash = "sha256-XtEI+DJMbBRcvBqsbVCDhVZiXNKqNvmQAmTSLmWB5o4=";
+    hash = "sha256-iSiVRbq6ohAXAWhHUUFUG/6rjlsmgYmy9VAzx76JIt0=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubefirst";
-  version = "2.3.5";
+  version = "2.3.6";

  src = fetchFromGitHub {
    owner = "kubefirst";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-RqysUaHLgTNuTeLt5xsD06Qxv5qsGTPE0H7r4RqPf30=";
+    hash = "sha256-PFI7sBLcDIxes7fJnT1sgJbRITyoYptpupfOd6lisjs=";
  };

-  vendorHash = "sha256-IH43F809dr6LGb87pqW2G9xrJLsQcHfjOm5PUj8r4Qo=";
+  vendorHash = "sha256-blMKBgSBRCVlXu8n3wcd2iMkBTALe2gPxy0Z4uwxUWI=";

  ldflags = [ "-s" "-w" "-X github.com/kubefirst/runtime/configs.K1Version=v${version}"];

--- a/pkgs/applications/networking/cluster/kubeshark/default.nix
+++ b/pkgs/applications/networking/cluster/kubeshark/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubeshark";
-  version = "51.0.27";
+  version = "52.0.0";

  src = fetchFromGitHub {
    owner = "kubeshark";
    repo = "kubeshark";
    rev = "v${version}";
-    hash = "sha256-DGyvP2Z3fZNXqKuE42OPdaWfYpIGu9TIBBxbYzRPZ6M=";
+    hash = "sha256-CBiRQ3i3kPVMuhws30Pl/7deuEiUHnRiDKhad6/c7zU=";
  };

-  vendorHash = "sha256-Vcn1Ky/J/3QiV6M5fLedDcpkLp5WsVcXRkOEgkKPYEQ=";
+  vendorHash = "sha256-LBvQ9Z6bEBzAzdaEBRJbixBjy1u7MlVTAn6vD/ZvCNM=";

  ldflags = let t = "github.com/kubeshark/kubeshark"; in [
   "-s" "-w"
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dnscontrol";
-  version = "4.6.2";
+  version = "4.7.3";

  src = fetchFromGitHub {
    owner = "StackExchange";
    repo = "dnscontrol";
    rev = "v${version}";
-    hash = "sha256-FcEpUNFPwottpuIsO53voucKULTkWOdbDgEXKYLb9LQ=";
+    hash = "sha256-xxcoh7x6OvziVNCaCLnjqTfJCn2JOR0n23lfNUbZ2cg=";
  };

-  vendorHash = "sha256-cW6urAJ3H30HY4Q7JLWFsQebg6YhdGSBgICWMl85v9U=";
+  vendorHash = "sha256-fRK2ZFoqugZ9lb6VxZZHBQjTa2ZQs5NFBx6Z6NX3eWw=";

  subPackages = [ "." ];

--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -2,30 +2,30 @@
 let
  versions =
    if stdenv.isLinux then {
-      stable = "0.0.37";
-      ptb = "0.0.59";
-      canary = "0.0.213";
+      stable = "0.0.38";
+      ptb = "0.0.61";
+      canary = "0.0.224";
      development = "0.0.1";
    } else {
-      stable = "0.0.287";
-      ptb = "0.0.90";
-      canary = "0.0.365";
-      development = "0.0.10";
+      stable = "0.0.289";
+      ptb = "0.0.91";
+      canary = "0.0.374";
+      development = "0.0.15";
    };
  version = versions.${branch};
  srcs = rec {
    x86_64-linux = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-uyflZ1Zks7M1Re6DxuNUAkIuPY4wFSydf2AGMtIube8=";
+        hash = "sha256-0i3xtArA/5LDyGiNQ/FjV3tU7Jzs8E6ZRuSUFNEJyDo=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-WhDEyRMjuy2e1N51tUj3v97Y0qWabCFPThaehadXFWs=";
+        hash = "sha256-wyP1a1bMpMx3m61EA6vtak1K4HOtCl6eMjh1DlHz5J8=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-DGRq58Xj5p/7BunY/vFds9LVmxYOl9LcF8ESHrCLly4=";
+        hash = "sha256-SDF4woekFmy6VUqYTfSZi4aqtZ5ARgaex6+8qOMSHMQ=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@ -35,19 +35,19 @@ let
    x86_64-darwin = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-DTkWrUgSYP98IVFTWcm4muRR91Kfvs5pBxc1tvPmj/s=";
+        hash = "sha256-3XaiaWdP7GSnMeR6yU5lfeumrVm6WpUmitVuSs+xAvE=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-wOTgcHRUu/CjdnvQVNL+rkazhVbZjwI+UbfmsF6aveg=";
+        hash = "sha256-8pAoi8rAaHC17GxlDGEJxGX726qRe1LVMTQK6SngniM=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-a4MyO2Wst+ZYNSpUaF0TXJKtDQcPRLehapwRzp10R2k=";
+        hash = "sha256-CiE33dAcX/aAjOncpX62KX+XfrRd5FgH8qQ2picwe6Q=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-FoYRW5SaR/53yKs/T2XKVKQevA3MxMWAJFjixtwsEF4=";
+        hash = "sha256-Fxxrjkj3W1MagT4rCxVEtip1W9MImsdQOuHXKPKsEtM=";
      };
    };
    aarch64-darwin = x86_64-darwin;
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix {} rec {
  pname = "signal-desktop";
  dir = "Signal";
-  version = "6.40.0";
+  version = "6.42.0";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-vyXHlycPSyEyv938IKzGM6pdERHHerx2CLY/U+WMrH4=";
+  hash = "sha256-uGsVv/J8eMjPOdUs+8GcYopy9D2g3SUhS09banrA6hY=";
 }
--- a/pkgs/applications/networking/mailreaders/mailspring/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/default.nix
@ -20,13 +20,13 @@
 , libappindicator
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mailspring";
-  version = "1.12.0";
+  version = "1.13.2";

  src = fetchurl {
-    url = "https://github.com/Foundry376/Mailspring/releases/download/${version}/mailspring-${version}-amd64.deb";
-    hash = "sha256-6dTAPetJgYrvIEtu+2QxcBOeYFZfN/dFhM0CZFzcC/E=";
+    url = "https://github.com/Foundry376/Mailspring/releases/download/${finalAttrs.version}/mailspring-${finalAttrs.version}-amd64.deb";
+    hash = "sha256-KEoKUg5CRYP0kNT4jr7pjUp6gK4cQ/qQEiOBNCrhbFM=";
  };

  nativeBuildInputs = [
@ -88,18 +88,18 @@ stdenv.mkDerivation rec {
      --replace Exec=mailspring Exec=$out/bin/mailspring
  '';

-  meta = with lib; {
+  meta = {
    description = "A beautiful, fast and maintained fork of Nylas Mail by one of the original authors";
+    downloadPage = "https://github.com/Foundry376/Mailspring";
+    homepage = "https://getmailspring.com";
+    license = lib.licenses.gpl3Plus;
    longDescription = ''
      Mailspring is an open-source mail client forked from Nylas Mail and built with Electron.
      Mailspring's sync engine runs locally, but its source is not open.
    '';
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ toschmidt ];
-    homepage = "https://getmailspring.com";
-    downloadPage = "https://github.com/Foundry376/Mailspring";
+    mainProgram = "mailspring";
+    maintainers = with lib.maintainers; [ toschmidt ];
    platforms = [ "x86_64-linux" ];
-    knownVulnerabilities = [ "CVE-2023-4863" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
  };
-}
+})
--- a/pkgs/applications/networking/pcloud/default.nix
+++ b/pkgs/applications/networking/pcloud/default.nix
@ -38,13 +38,13 @@

 let
  pname = "pcloud";
-  version = "1.14.2";
-  code = "XZAwMrVZidapyDxpd2pCNlGy3BcjdbYCf1Yk";
+  version = "1.14.3";
+  code = "XZ7IM70ZtWFon9pgEbk4XuvzJsTduQUyGFwV";

  # Archive link's codes: https://www.pcloud.com/release-notes/linux.html
  src = fetchzip {
    url = "https://api.pcloud.com/getpubzip?code=${code}&filename=${pname}-${version}.zip";
-    hash = "sha256-5dTo0/R+RA+C0PKzaCmcSy7YwzT3Qlwq1xMw6wPJt28=";
+    hash = "sha256-huv1XXghWwh/oTtOsukffZP3nnHS2K5VcsuVs6CjFYc=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/version-management/gerrit/default.nix
+++ b/pkgs/applications/version-management/gerrit/default.nix
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
    license = licenses.asl20;
    description = "A web based code review and repository management for the git version control system";
    sourceProvenance = with sourceTypes; [ binaryBytecode ];
-    maintainers = with maintainers; [ flokli jammerful zimbatm ];
+    maintainers = with maintainers; [ flokli zimbatm ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/version-management/git-lfs/default.nix
+++ b/pkgs/applications/version-management/git-lfs/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "git-lfs";
-  version = "3.4.0";
+  version = "3.4.1";

  src = fetchFromGitHub {
    owner = "git-lfs";
    repo = "git-lfs";
    rev = "v${version}";
-    hash = "sha256-lZx+sJQttclZPET0jkv3dmpQysCpsYani+La7yfSUlI=";
+    hash = "sha256-XqxkNCC2yzUTVOi/1iDsnxtLkw4jfQuBh9UsjtZ1zVc=";
  };

  vendorHash = "sha256-VmPeQYWOHFqFLHKcKH3WHz50yx7GMHVIDPzqiVwwjSg=";
--- a/pkgs/applications/version-management/hut/default.nix
+++ b/pkgs/applications/version-management/hut/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "hut";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromSourcehut {
    owner = "~emersion";
    repo = "hut";
    rev = "v${version}";
-    sha256 = "sha256-kr5EWQ3zHUp/oNPZV2d3j9AyoEmHEX8/rETiMKTBi3s=";
+    sha256 = "sha256-9RSJ+SRXYBjdiuHScgFm5i0/Xi81pJfURPKAGCk+l04=";
  };

-  vendorHash = "sha256-aoqGb7g8UEC/ydmL3GbWGy3HDD1kfDJOMeUP4nO9waA=";
+  vendorHash = "sha256-OxnplvBx2sFctdNSVd0S0tgiRt5Yah3ga4mORT2Kz6U=";

  nativeBuildInputs = [
    scdoc
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@ -26,13 +26,13 @@

 mkDerivation rec {
  pname = "haruna";
-  version = "0.12.2";
+  version = "0.12.3";

  src = fetchFromGitLab {
    owner = "multimedia";
    repo = "haruna";
    rev = "v${version}";
-    hash = "sha256-6UXgAb42DttNgmO5KRFC5M6kuYrv+GIxQ0EQ4P5cgUI=";
+    hash = "sha256-iYf8oTMQ65+6E1dlOj0GU6EezPul6p1GG2CcrcjDUik=";
    domain = "invent.kde.org";
  };

--- a/pkgs/applications/video/kodi/addons/urllib3/default.nix
+++ b/pkgs/applications/video/kodi/addons/urllib3/default.nix
@ -3,11 +3,11 @@
 buildKodiAddon rec {
  pname = "urllib3";
  namespace = "script.module.urllib3";
-  version = "1.26.16+matrix.1";
+  version = "2.1.0";

  src = fetchzip {
    url = "https://mirrors.kodi.tv/addons/nexus/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-HI99Cle/SpwulbDCVoDNy/0EfHVt4q7+LR60YRMaSFY=";
+    sha256 = "sha256-UCvkeguxytPoP1gIIt8N79TVs98ATzsfrRSabtbgnGc=";
  };

  passthru = {
--- a/pkgs/applications/video/kodi/addons/websocket/default.nix
+++ b/pkgs/applications/video/kodi/addons/websocket/default.nix
@ -3,11 +3,11 @@
 buildKodiAddon rec {
  pname = "websocket";
  namespace = "script.module.websocket";
-  version = "1.6.2";
+  version = "1.6.4";

  src = fetchzip {
    url = "https://mirrors.kodi.tv/addons/nexus/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-vJGijCjIgLJAdJvl+hCAPtvq7fy2ksgjY90vjVyqDkI=";
+    sha256 = "sha256-1Wy+hxB059UoZnQlncytVT3sQ07dYAhNRnW3/QVD4ZE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch2
 , pkg-config
 , glib
 , glibc
@ -20,6 +21,14 @@ stdenv.mkDerivation rec {
    hash = "sha256-GDbCjR3UWDo/AEKO3TZq29fxO9EUfymxWtvLBikJJ04=";
  };

+  patches = [
+    (fetchpatch2 {
+      # Fix regression with several upstream bug reports; also caused podman NixOS tests to fail
+      url = "https://github.com/containers/conmon/commit/53531ac78d35aa9e18a20cfff9f30b910e25ecaa.patch";
+      hash = "sha256-rbLoXDmRK8P94rrhx2r22/EHZVpCsGTWItd/GW1VqZA=";
+    })
+  ];
+
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ glib libseccomp systemd ]
    ++ lib.optionals (!stdenv.hostPlatform.isMusl) [ glibc glibc.static ];
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "containerd";
-  version = "1.7.9";
+  version = "1.7.11";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = "containerd";
    rev = "v${version}";
-    hash = "sha256-/kCnzOL8CJuJJglHzmev3alt8cMwTUbIiZhNft9zwps=";
+    hash = "sha256-kvBD9Qh10kRowr32zDzjpHYh2IZC6+w+nOO4joShgEE=";
  };

  vendorHash = null;
--- a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
@ -149,6 +149,13 @@ let
      done
    fi

+    # propagate /etc from the actual host if nested
+    if [[ -e /.host-etc ]]; then
+      ro_mounts+=(--ro-bind /.host-etc /.host-etc)
+    else
+      ro_mounts+=(--ro-bind /etc /.host-etc)
+    fi
+
    for i in ${lib.escapeShellArgs etcBindEntries}; do
      if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
        continue
@ -193,7 +200,6 @@ let
      ${lib.optionalString unshareCgroup "--unshare-cgroup"}
      ${lib.optionalString dieWithParent "--die-with-parent"}
      --ro-bind /nix /nix
-      --ro-bind /etc /.host-etc
      ${lib.optionalString privateTmp "--tmpfs /tmp"}
      # Our glibc will look for the cache in its own path in `/nix/store`.
      # As such, we need a cache to exist there, because pressure-vessel
--- a/pkgs/build-support/rust/replace-workspace-values.py
+++ b/pkgs/build-support/rust/replace-workspace-values.py
@ -96,6 +96,13 @@ def main() -> None:
                workspace_manifest, crate_manifest["target"][key]
            )

+    if (
+        "lints" in crate_manifest
+        and "workspace" in crate_manifest["lints"]
+        and crate_manifest["lints"]["workspace"] is True
+    ):
+        crate_manifest["lints"] = workspace_manifest["lints"]
+
    if not changed:
        return

--- a/pkgs/by-name/co/codeium/package.nix
+++ b/pkgs/by-name/co/codeium/package.nix
@ -13,10 +13,10 @@ let
  }.${system} or throwSystem;

  hash = {
-    x86_64-linux = "sha256-/6ss/VRH4ehEgC0DCMoGHxnJzD7zNJXWZ0ZAE5odyig=";
-    aarch64-linux = "sha256-vIAy/2FNIZINyfYedvAsvmXntcvzeCilDsoLtTDDE8c=";
-    x86_64-darwin = "sha256-1nqAaU6zQ4cMmYBDffNpeO6cPQqwx4efZGSPX6fRRZA=";
-    aarch64-darwin = "sha256-TjPOr7+GbEyE8s3XZNczkjAzlEhz9Gd47nhU6rQiga4=";
+    x86_64-linux = "sha256-rgA0n0XxYmP9mjjz8lQGL4dbqpXj9CNx3d8qT7e9Ye4=";
+    aarch64-linux = "sha256-pX+CPvJbhrrAxmZhy/aBeNFq9ShgYDQXbBNa6lbPnSo=";
+    x86_64-darwin = "sha256-vQj7tZghYZOcDpGT4DmFIrwiY8hguTtyo83M2BaUOkw=";
+    aarch64-darwin = "sha256-qd6newnk/9nRMM/7aaVO+CkTP74mMwAPKu658c6KZyY=";
  }.${system} or throwSystem;

  bin = "$out/bin/codeium_language_server";
@ -24,7 +24,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "codeium";
-  version = "1.4.26";
+  version = "1.6.10";
  src = fetchurl {
    name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
    url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";
--- a/pkgs/by-name/co/composefs/package.nix
+++ b/pkgs/by-name/co/composefs/package.nix
@ -3,11 +3,10 @@
 , fetchFromGitHub

 , autoreconfHook
-, pandoc
+, go-md2man
 , pkg-config
 , openssl
 , fuse3
-, yajl
 , libcap
 , libseccomp
 , python3
@ -19,21 +18,18 @@
 , testers

 , fuseSupport ? lib.meta.availableOn stdenv.hostPlatform fuse3
-, yajlSupport ? lib.meta.availableOn stdenv.hostPlatform yajl
 , enableValgrindCheck ? false
 , installExperimentalTools ? false
 }:
-# https://github.com/containers/composefs/issues/204
-assert installExperimentalTools -> (!stdenv.hostPlatform.isMusl);
 stdenv.mkDerivation (finalAttrs: {
  pname = "composefs";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "composefs";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-8YbDKw4jYEU6l3Nmqu3gsT9VX0lwYF/39hhcwzgTynY=";
+    hash = "sha256-ViZkmuLFV5DN1nqWKGl+yaqhYUEOztZ1zGpxjr1U/dw=";
  };

  strictDeps = true;
@ -43,14 +39,14 @@ stdenv.mkDerivation (finalAttrs: {
    sed -i "s/noinst_PROGRAMS +\?=/bin_PROGRAMS +=/g" tools/Makefile.am
  '';

-  configureFlags = lib.optionals enableValgrindCheck [
-    (lib.enableFeature true "valgrind-test")
+  configureFlags = [
+    (lib.enableFeature true "man")
+    (lib.enableFeature enableValgrindCheck "valgrind-test")
  ];

-  nativeBuildInputs = [ autoreconfHook pandoc pkg-config ];
+  nativeBuildInputs = [ autoreconfHook go-md2man pkg-config ];
  buildInputs = [ openssl ]
    ++ lib.optional fuseSupport fuse3
-    ++ lib.optional yajlSupport yajl
    ++ lib.filter (lib.meta.availableOn stdenv.hostPlatform) (
    [
      libcap
@ -58,7 +54,6 @@ stdenv.mkDerivation (finalAttrs: {
    ]
  );

-  # yajl is required to read the test json files
  doCheck = true;
  nativeCheckInputs = [ python3 which ]
    ++ lib.optional enableValgrindCheck valgrind
@ -70,15 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace tests/*.sh \
      --replace " /tmp" " $TMPDIR" \
      --replace " /var/tmp" " $TMPDIR"
-  '' + lib.optionalString (stdenv.hostPlatform.isMusl || !yajlSupport) ''
-    # test relies on `composefs-from-json` tool
-    # MUSL: https://github.com/containers/composefs/issues/204
-    substituteInPlace tests/Makefile \
-      --replace " check-checksums" ""
-  '' + lib.optionalString enableValgrindCheck ''
-    # valgrind is incompatible with seccomp
-    substituteInPlace tests/test-checksums.sh \
-      --replace "composefs-from-json" "composefs-from-json --no-sandbox"
  '';

  passthru = {
--- a/pkgs/by-name/cr/crawley/package.nix
+++ b/pkgs/by-name/cr/crawley/package.nix
@ -0,0 +1,37 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "crawley";
+  version = "1.7.1";
+
+  src = fetchFromGitHub {
+    owner = "s0rg";
+    repo = "crawley";
+    rev = "v${version}";
+    hash = "sha256-IRhi6z2TQZOOw8EZkJ3/VEOBzAlg0DQjq9wSt+/c3ck=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  vendorHash = "sha256-0BUbALCBR9CGwkqz1cUnzF3xjQkkzfdS7JDDTXkGmN4=";
+
+  ldflags = [ "-w" "-s" ];
+
+  postInstall = ''
+    installShellCompletion --cmd crawley \
+      --bash <(echo "complete -C $out/bin/crawley crawley") \
+      --zsh <(echo "complete -o nospace -C $out/bin/crawley crawley")
+  '';
+
+  meta = with lib; {
+    description = "The unix-way web crawler";
+    homepage = "https://github.com/s0rg/crawley";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ltstf1re ];
+    mainProgram = "crawley";
+  };
+}
--- a/pkgs/by-name/de/dependabot-cli/package.nix
+++ b/pkgs/by-name/de/dependabot-cli/package.nix
@ -0,0 +1,62 @@
+{ buildGoModule
+, dependabot-cli
+, fetchFromGitHub
+, fetchpatch
+, installShellFiles
+, lib
+, testers
+}:
+let
+  pname = "dependabot-cli";
+  version = "1.39.0";
+in
+buildGoModule {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "dependabot";
+    repo = "cli";
+    rev = "v${version}";
+    hash = "sha256-QuhgFWF97B72KTX/QKSXNl/4RDAKUMDga7vLYiZw4SM=";
+  };
+
+  vendorHash = "sha256-mNpNp/zeQGgcljj2VhGl4IN1HG1R8CJSTWKzrgC0z44=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/dependabot/cli/cmd/dependabot/internal/cmd.version=v${version}"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd dependabot \
+      --bash <($out/bin/dependabot completion bash) \
+      --fish <($out/bin/dependabot completion fish) \
+      --zsh <($out/bin/dependabot completion zsh)
+  '';
+
+  checkFlags = [
+    "-skip=TestIntegration|TestNewProxy_customCert|TestRun"
+  ];
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/dependabot --help
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = dependabot-cli;
+    command = "dependabot --version";
+    version = "v${version}";
+  };
+
+  meta = with lib; {
+    changelog = "https://github.com/dependabot/cli/releases/tag/v${version}";
+    description = "A tool for testing and debugging Dependabot update jobs";
+    homepage = "https://github.com/dependabot/cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ l0b0 ];
+  };
+}
--- a/pkgs/by-name/pr/presenterm/package.nix
+++ b/pkgs/by-name/pr/presenterm/package.nix
@ -6,20 +6,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "presenterm";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "mfontanini";
    repo = "presenterm";
    rev = "refs/tags/v${version}";
-    hash = "sha256-uwLVg/bURz2jLAQZgLujDR2Zewu5pcE9bwEBg/DQ4Iw=";
+    hash = "sha256-8oLqZfpkSbGg85vj5V54D052vmmoMRzQmiQzOwCOSxg=";
  };

  buildInputs = [
    libsixel
  ];

-  cargoHash = "sha256-tEgXqvSyScO/J/56ykCda3ERrTDQj5jCxlMEDof/fCA=";
+  cargoHash = "sha256-SJpmQMUm5+0mUmYq2pv4JLV6PxZs2g3TrWqTlHElS3Q=";

  buildFeatures = [ "sixel" ];

--- a/pkgs/by-name/rq/rqbit/package.nix
+++ b/pkgs/by-name/rq/rqbit/package.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "rqbit";
-  version = "3.2.0";
+  version = "4.0.1";

  src = fetchFromGitHub {
    owner = "ikatson";
    repo = "rqbit";
    rev = "v${version}";
-    hash = "sha256-c0JYFr2yy1lcaJ+xOZnFsGzPVGPoFgCiFTGDlDaHdZk=";
+    hash = "sha256-qjjKS5UaBIGemw3lipTYNn+kmDlF7Yr+uwICw1cnxuE=";
  };

-  cargoHash = "sha256-VnkAokOC5xSqO7MVASssKs0EqQ+re5EsEar4eLspTSA=";
+  cargoHash = "sha256-LhVzubfiOq/u46tKFYaxzty5WnLHTP4bnObuNOYRt5A=";

  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];

--- a/pkgs/by-name/wi/wifi-qr/package.nix
+++ b/pkgs/by-name/wi/wifi-qr/package.nix
@ -0,0 +1,86 @@
+{ lib
+, fetchFromGitHub
+, installShellFiles
+, makeWrapper
+, gnome
+, ncurses
+, networkmanager
+, patsh
+, procps
+, qrencode
+, stdenvNoCC
+, xdg-utils
+, zbar
+}:
+stdenvNoCC.mkDerivation {
+  pname = "wifi-qr";
+  version = "0.3-unstable-2023-09-30";
+
+  outputs = [ "out" "man" ];
+
+  src = fetchFromGitHub {
+    owner = "kokoye2007";
+    repo = "wifi-qr";
+    rev = "821892001f735dc250a549ea36329cdc767db9c9";
+    hash = "sha256-kv0qjO+wn4t//NmKkHB+tZB4eRNm+WRUa5rij+7Syuk=";
+  };
+
+  buildInputs = [
+    gnome.zenity
+    ncurses
+    networkmanager
+    procps
+    qrencode
+    xdg-utils
+    zbar
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+    patsh
+  ];
+
+  dontBuild = true;
+
+  dontConfigure = true;
+
+  postPatch = ''
+    substituteInPlace src/wifi-qr.desktop \
+      --replace "Icon=wifi-qr.svg" "Icon=wifi-qr"
+    substituteInPlace src/wifi-qr \
+      --replace "/usr/share/doc/wifi-qr/copyright" "$out/share/doc/wifi-qr/copyright"
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 src/wifi-qr $out/bin/wifi-qr
+
+    install -Dm644 src/wifi-qr.desktop $out/share/applications/wifi-qr.desktop
+    install -Dm644 src/wifi-qr.svg $out/share/icons/hicolor/scalable/apps/wifi-qr.svg
+    install -Dm644 src/LICENSE $out/share/doc/wifi-qr/copyright
+
+    installManPage src/wifi-qr.1
+
+    runHook postInstall
+  '';
+
+  fixupPhase = ''
+    runHook preFixup
+
+    patchShebangs $out/bin/wifi-qr
+    patsh -f $out/bin/wifi-qr -s ${builtins.storeDir}
+
+    runHook postFixup
+  '';
+
+  meta = with lib; {
+    description = "WiFi password sharing via QR codes";
+    homepage = "https://github.com/kokoye2007/wifi-qr";
+    license = with licenses; [ gpl3Plus ];
+    maintainers = with maintainers; [ ambroisie ];
+    mainProgram = "wifi-qr";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@ -2,12 +2,12 @@

 stdenvNoCC.mkDerivation rec {
  pname = "JuliaMono-ttf";
-  version = "0.051";
+  version = "0.052";

  src = fetchzip {
    url = "https://github.com/cormullion/juliamono/releases/download/v${version}/${pname}.tar.gz";
    stripRoot = false;
-    hash = "sha256-JdoCblRW9Vih7zQyvTb/VXhZJJDNV0sPDfTQ+wRKotE=";
+    hash = "sha256-GXT1VHRQj8yiz/DpZtYb5wPz/MlOLSNS92/2Kd6Q7Qs=";
  };

  installPhase = ''
--- a/pkgs/data/fonts/lxgw-neoxihei/default.nix
+++ b/pkgs/data/fonts/lxgw-neoxihei/default.nix
@ -5,11 +5,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "lxgw-neoxihei";
-  version = "1.106";
+  version = "1.108";

  src = fetchurl {
    url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-AXEOoU9gvml1bqjPTYV+mmhVGLG4R6mH8e/h3wQgySo=";
+    hash = "sha256-Wx2fmvIEHgimu7BJ49xWK7c08Rsf3fsjMLTdyedgK3I=";
  };

  dontUnpack = true;
--- a/pkgs/data/fonts/lxgw-wenkai/default.nix
+++ b/pkgs/data/fonts/lxgw-wenkai/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "lxgw-wenkai";
-  version = "1.312";
+  version = "1.315";

  src = fetchurl {
    url = "https://github.com/lxgw/LxgwWenKai/releases/download/v${version}/${pname}-v${version}.tar.gz";
-    hash = "sha256-KU0cTzdHfWIqYbBksGym9JaN/M3VRASYcQOxrAxip4I=";
+    hash = "sha256-btiF6jij8sw/kynQedUdy9//5rPPhtnRhmZ59FY+S0c=";
  };

  installPhase = ''
--- a/pkgs/data/icons/kora-icon-theme/default.nix
+++ b/pkgs/data/icons/kora-icon-theme/default.nix
@ -10,13 +10,13 @@

 stdenvNoCC.mkDerivation rec  {
  pname = "kora-icon-theme";
-  version = "1.5.8";
+  version = "1.5.9";

  src = fetchFromGitHub  {
    owner = "bikass";
    repo = "kora";
    rev = "v${version}";
-    sha256 = "sha256-ZPjtY6s3Sgl0aU2pAxagTMFIOcwDAZQRYtvOC0FBJaI=";
+    sha256 = "sha256-ZXAS22Oe6C34DR1BfGmCGr1qh9mu1PCY5IQWxrm1EfY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/embedded/platformio/core.nix
+++ b/pkgs/development/embedded/platformio/core.nix
@ -1,42 +1,53 @@
-{ stdenv, lib, python3
+{ lib
+, python3Packages
 , fetchFromGitHub
-, fetchPypi
+, fetchpatch
 , git
 , spdx-license-list-data
+, substituteAll
 }:

-with python3.pkgs; buildPythonApplication rec {
-  pname = "platformio";

-  version = "6.1.6";
+with python3Packages; buildPythonApplication rec {
+  pname = "platformio";
+  version = "6.1.11";
+  pyproject = true;

  # pypi tarballs don't contain tests - https://github.com/platformio/platformio-core/issues/1964
  src = fetchFromGitHub {
    owner = "platformio";
    repo = "platformio-core";
    rev = "v${version}";
-    sha256 = "sha256-BEeMfdmAWqFbQUu8YKKrookQVgmhfZBqXnzeb2gfhms=";
+    hash = "sha256-NR4UyAt8q5sUGtz1Sy6E8Of7y9WrH9xpcAWzLBeDQmo=";
  };

  outputs = [ "out" "udev" ];

  patches = [
-    ./fix-searchpath.patch
-    ./use-local-spdx-license-list.patch
+    (substituteAll {
+      src = ./interpreter.patch;
+      interpreter = (python3Packages.python.withPackages (_: propagatedBuildInputs)).interpreter;
+    })
+    (substituteAll {
+      src = ./use-local-spdx-license-list.patch;
+      spdx_license_list_data = spdx-license-list-data.json;
+    })
    ./missing-udev-rules-nixos.patch
+    (fetchpatch {
+      # restore PYTHONPATH when calling scons
+      # https://github.com/platformio/platformio-core/commit/097de2be98af533578671baa903a3ae825d90b94
+      url = "https://github.com/platformio/platformio-core/commit/097de2be98af533578671baa903a3ae825d90b94.patch";
+      hash = "sha256-yq+/QHCkhAkFND11MbKFiiWT3oF1cHhgWj5JkYjwuY0=";
+      revert = true;
+    })
  ];

-  postPatch = ''
-    substitute platformio/package/manifest/schema.py platformio/package/manifest/schema.py \
-      --subst-var-by SPDX_LICENSE_LIST_DATA '${spdx-license-list-data.json}'
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+  ];

-    substituteInPlace setup.py \
-      --replace 'aiofiles==%s" % ("0.8.0" if PY36 else "22.1.*")' 'aiofiles"' \
-      --replace 'starlette==%s" % ("0.19.1" if PY36 else "0.23.*")' 'starlette"' \
-      --replace 'uvicorn==%s" % ("0.16.0" if PY36 else "0.20.*")' 'uvicorn"' \
-      --replace 'tabulate==%s" % ("0.8.10" if PY36 else "0.9.*")' 'tabulate>=0.8.10,<=0.9"' \
-      --replace 'wsproto==%s" % ("1.0.0" if PY36 else "1.2.*")' 'wsproto"'
-  '';
+  pythonRelaxDeps = true;

  propagatedBuildInputs = [
    aiofiles
@ -52,12 +63,14 @@ with python3.pkgs; buildPythonApplication rec {
    pyserial
    requests
    semantic-version
+    setuptools
    spdx-license-list-data.json
    starlette
    tabulate
    uvicorn
    wsproto
    zeroconf
+
  ];

  preCheck = ''
@ -163,11 +176,13 @@ with python3.pkgs; buildPythonApplication rec {
  ]);

  passthru = {
-    python = python3;
+    python = python3Packages.python;
  };

  meta = with lib; {
+    changelog = "https://github.com/platformio/platformio-core/releases/tag/v${version}";
    description = "An open source ecosystem for IoT development";
+    downloadPage = "https://github.com/platformio/platformio-core";
    homepage = "https://platformio.org";
    license = licenses.asl20;
    maintainers = with maintainers; [ mog makefu ];
--- a/pkgs/development/embedded/platformio/fix-searchpath.patch
+++ b/pkgs/development/embedded/platformio/fix-searchpath.patch
@ -1,9 +1,18 @@
 diff --git a/platformio/proc.py b/platformio/proc.py
-index 80e50201..15cee5a5 100644
+index 707245a1..cae17a29 100644
 --- a/platformio/proc.py
 +++ b/platformio/proc.py
+@@ -165,7 +165,7 @@ def is_container():
+ 
+ 
+ def get_pythonexe_path():
+-    return os.environ.get("PYTHONEXEPATH", os.path.normpath(sys.executable))
+    return "@interpreter@"
+ 
+ 
+ def copy_pythonpath_to_osenv():
@@ -181,7 +181,7 @@ def copy_pythonpath_to_osenv():
-             conditions.append(isdir(join(p, "click")) or isdir(join(p, "platformio")))
+             )
         if all(conditions):
             _PYTHONPATH.append(p)
 -    os.environ["PYTHONPATH"] = os.pathsep.join(_PYTHONPATH)
--- a/pkgs/development/embedded/platformio/missing-udev-rules-nixos.patch
+++ b/pkgs/development/embedded/platformio/missing-udev-rules-nixos.patch
@ -1,10 +1,12 @@
 diff --git a/platformio/exception.py b/platformio/exception.py
-index ef1d3bab..445174fc 100644
+index 80ffb496..ea064f97 100644
 --- a/platformio/exception.py
 +++ b/platformio/exception.py
-@@ -57,6 +57,7 @@ class MissedUdevRules(InvalidUdevRules):
+@@ -49,6 +49,7 @@ class MissedUdevRules(InvalidUdevRules):
     MESSAGE = (
         "Warning! Please install `99-platformio-udev.rules`. \nMore details: "
         "https://docs.platformio.org/en/latest/core/installation/udev-rules.html"
-+        "On NixOS add the platformio-core.udev package to services.udev.packages"
+        "On NixOS set `services.udev.packages = with pkgs; [ platformio-core.udev ];`."
     )
+ 
+ 
--- a/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
+++ b/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
@ -1,23 +1,17 @@
 diff --git a/platformio/package/manifest/schema.py b/platformio/package/manifest/schema.py
-index 1e5f935a..26d1ac6a 100644
+index 95e08108..6c2cfaed 100644
 --- a/platformio/package/manifest/schema.py
 +++ b/platformio/package/manifest/schema.py
-@@ -276,9 +276,12 @@ class ManifestSchema(BaseSchema):
+@@ -276,9 +276,6 @@ class ManifestSchema(BaseSchema):
     @staticmethod
     @memoized(expire="1h")
     def load_spdx_licenses():
-        version = "3.19"
+-        version = "3.21"
 -        spdx_data_url = (
 -            "https://raw.githubusercontent.com/spdx/license-list-data/"
-            "v%s/json/licenses.json" % version
+-            f"v{version}/json/licenses.json"
 -        )
 -        return json.loads(fetch_remote_content(spdx_data_url))
-+        # version = "3.19"
-+        # spdx_data_url = (
-+            # "https://raw.githubusercontent.com/spdx/license-list-data/"
-+            # "v%s/json/licenses.json" % version
-+        # )
-+        # return json.loads(fetch_remote_content(spdx_data_url))
-+        with open("@SPDX_LICENSE_LIST_DATA@/json/licenses.json") as f:
-+            spdx = json.load(f)
+        with open("@spdx_license_list_data@/json/licenses.json") as fd:
+            spdx = json.load(fd)
 +        return spdx
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -18,7 +18,7 @@ let
  # Contains the ruby version heuristics
  rubyVersion = import ./ruby-version.nix { inherit lib; };

-  generic = { version, sha256, cargoSha256 ? null }: let
+  generic = { version, hash, cargoHash ? null }: let
    ver = version;
    atLeast30 = lib.versionAtLeast ver.majMin "3.0";
    atLeast31 = lib.versionAtLeast ver.majMin "3.1";
@ -65,7 +65,7 @@ let

        src = fetchurl {
          url = "https://cache.ruby-lang.org/pub/ruby/${ver.majMin}/ruby-${ver}.tar.gz";
-          inherit sha256;
+          inherit hash;
        };

        # Have `configure' avoid `/usr/bin/nroff' in non-chroot builds.
@ -111,7 +111,7 @@ let
            # Ruby 3.0 adds `-fdeclspec` to $CC instead of $CFLAGS. Fixed in later versions.
            (fetchpatch {
              url = "https://github.com/ruby/ruby/commit/0acc05caf7518cd0d63ab02bfa036455add02346.patch";
-              sha256 = "sha256-43hI9L6bXfeujgmgKFVmiWhg7OXvshPCCtQ4TxqK1zk=";
+              hash = "sha256-43hI9L6bXfeujgmgKFVmiWhg7OXvshPCCtQ4TxqK1zk=";
            })
         ]
          ++ ops (!atLeast30 && rubygemsSupport) [
@ -126,7 +126,7 @@ let
            # See https://github.com/ruby/ruby/pull/2930
            (fetchpatch {
              url = "https://github.com/ruby/ruby/commit/261d8dd20afd26feb05f00a560abd99227269c1c.patch";
-              sha256 = "0wrii25cxcz2v8bgkrf7ibcanjlxwclzhayin578bf0qydxdm9qy";
+              hash = "sha256-HqfaevMYuIVOsdEr+CnjnUqr2IrH5fkW2uKzzoqIMXM=";
            })
          ]
          ++ ops atLeast31 [
@ -142,7 +142,7 @@ let
        cargoDeps = if yjitSupport then rustPlatform.fetchCargoTarball {
          inherit src;
          sourceRoot = "${pname}-${version}/${cargoRoot}";
-          sha256 = cargoSha256;
+          hash = cargoHash;
        } else null;

        postUnpack = opString rubygemsSupport ''
@ -318,24 +318,24 @@ in {

  ruby_2_7 = generic {
    version = rubyVersion "2" "7" "8" "";
-    sha256 = "sha256-wtq2PLyPKgVSYQitQZ76Y6Z+1AdNu8+fwrHKZky0W6A=";
+    hash = "sha256-wtq2PLyPKgVSYQitQZ76Y6Z+1AdNu8+fwrHKZky0W6A=";
  };

  ruby_3_1 = generic {
    version = rubyVersion "3" "1" "4" "";
-    sha256 = "sha256-o9VYeaDfqx1xQf3xDSKgfb+OXNxEFdob3gYSfVzDx7Y=";
+    hash = "sha256-o9VYeaDfqx1xQf3xDSKgfb+OXNxEFdob3gYSfVzDx7Y=";
  };

  ruby_3_2 = generic {
    version = rubyVersion "3" "2" "2" "";
-    sha256 = "sha256-lsV1WIcaZ0jeW8nydOk/S1qtBs2PN776Do2U57ikI7w=";
-    cargoSha256 = "sha256-6du7RJo0DH+eYMOoh3L31F3aqfR5+iG1iKauSV1uNcQ=";
+    hash = "sha256-lsV1WIcaZ0jeW8nydOk/S1qtBs2PN776Do2U57ikI7w=";
+    cargoHash = "sha256-6du7RJo0DH+eYMOoh3L31F3aqfR5+iG1iKauSV1uNcQ=";
  };

  ruby_3_3 = generic {
-    version = rubyVersion "3" "3" "0" "preview3";
-    sha256 = "sha256-CWkUG+kuZ+DtuEqPs1SsyY8BvXjmAqI6DxNgRcgvSAk=";
-    cargoSha256 = "sha256-GeelTMRFIyvz1QS2L+Q3KAnyQy7jc0ejhx3TdEFVEbk=";
+    version = rubyVersion "3" "3" "0" "rc1";
+    hash = "sha256-xP+COVqQ73bH+Qa3aHAm4KuWsJTc86Uy2auXeEoHMiI=";
+    cargoHash = "sha256-GeelTMRFIyvz1QS2L+Q3KAnyQy7jc0ejhx3TdEFVEbk=";
  };

 }
--- a/pkgs/development/libraries/fcft/default.nix
+++ b/pkgs/development/libraries/fcft/default.nix
@ -17,14 +17,14 @@ in

 stdenv.mkDerivation rec {
  pname = "fcft";
-  version = "3.1.6";
+  version = "3.1.7";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "dnkl";
    repo = "fcft";
    rev = version;
-    sha256 = "0cfyxf3xcj552bhd5awv5j0lb8xk3xhz87iixp3wnbvsgvl6dpwq";
+    sha256 = "sha256-QS39vbf2JowovTBtT4DKDRbLXieOrzbO4cQObOdE788=";
  };

  depsBuildBuild = [ pkg-config ];
--- a/pkgs/development/libraries/intel-gmmlib/default.nix
+++ b/pkgs/development/libraries/intel-gmmlib/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-gmmlib";
-  version = "22.3.14";
+  version = "22.3.15";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "gmmlib";
    rev = "intel-gmmlib-${version}";
-    sha256 = "sha256-hNewfGN/hO9hx2+1YmdPPqUORqpNwckQYSSO7zfeVAY=";
+    sha256 = "sha256-MVM5MfX+uVMik+332blWvqh6Wt1iq6DNR7/hrHC+rWI=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/libcotp/default.nix
+++ b/pkgs/development/libraries/libcotp/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libcotp";
-  version = "2.1.0";
+  version = "3.0.0";

  src = fetchFromGitHub {
    owner = "paolostivanin";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-5zyQSoz5d/HYrIaj0ChtZYK79bBNlYDsFMSDuzcVhY0=";
+    sha256 = "sha256-/IIzUMms4aS63psyxwL+Ynj78c38R3WwbD2HIpdHF88=";
  };

  postPatch = lib.optionalString stdenv.cc.isClang ''
--- a/pkgs/development/libraries/libebml/default.nix
+++ b/pkgs/development/libraries/libebml/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libebml";
-  version = "1.4.4";
+  version = "1.4.5";

  src = fetchFromGitHub {
    owner  = "Matroska-Org";
    repo   = "libebml";
    rev    = "release-${version}";
-    sha256 = "sha256-36SfZUHJ2sIvrrHox583cQqfWWcrL2zW1IHzgDchC9g=";
+    sha256 = "sha256-PIVBePTWceMgiENdaL9lvXIL/RQIrtg7l0OG2tO0SU8=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/libre/default.nix
+++ b/pkgs/development/libraries/libre/default.nix
@ -8,13 +8,13 @@
 }:

 stdenv.mkDerivation rec {
-  version = "3.6.2";
+  version = "3.7.0";
  pname = "libre";
  src = fetchFromGitHub {
    owner = "baresip";
    repo = "re";
    rev = "v${version}";
-    sha256 = "sha256-mbwi6tJer4JC7ijB6WGDNoC/EM5rqCtejbYRFi9Kwgk=";
+    sha256 = "sha256-7wNzYp6o3+71Jz/VuDWyVOj+OrAkDyDG0NWryYwuIT4=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/log4shib/default.nix
+++ b/pkgs/development/libraries/log4shib/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation {

  meta = with lib; {
    description = "A forked version of log4cpp that has been created for the Shibboleth project";
-    maintainers = [ maintainers.jammerful ];
+    maintainers = [ ];
    license = licenses.lgpl21;
    homepage = "http://log4cpp.sf.net";
  };
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@ -5,6 +5,6 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert

 import ./generic.nix {
-  version = "3.95";
-  hash = "sha256-qgSbzlRbU+gElC2ae3FEGRUFSM1JHd/lNGNXC0x4xt4=";
+  version = "3.96";
+  hash = "sha256-OdvJ7OLL3CDvJkgtnMsuE1CVaaKpmgRmzEzW0WmD8Jo=";
 }
--- a/pkgs/development/libraries/opensaml-cpp/default.nix
+++ b/pkgs/development/libraries/opensaml-cpp/default.nix
@ -28,6 +28,6 @@ stdenv.mkDerivation rec {
    description = "A low-level library written in C++ that provides support for producing and consuming SAML messages";
    platforms   = platforms.unix;
    license     = licenses.asl20;
-    maintainers = [ maintainers.jammerful ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/development/libraries/qtpbfimageplugin/default.nix
+++ b/pkgs/development/libraries/qtpbfimageplugin/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "qtpbfimageplugin";
-  version = "2.6";
+  version = "3.0";

  src = fetchFromGitHub {
    owner = "tumic0";
    repo = "QtPBFImagePlugin";
    rev = version;
-    sha256 = "sha256-tTpCbHiZTb/xmm3oRXsYAUWl1sYyAlGP9ss4xVQgPVo=";
+    sha256 = "sha256-RYZnuHjK6/ygFsjjnOTz7glYnibTwDNlou/4cQ7HfKM=";
  };

  nativeBuildInputs = [ qmake ];
--- a/pkgs/development/libraries/shibboleth-sp/default.nix
+++ b/pkgs/development/libraries/shibboleth-sp/default.nix
@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
    description = "Enables SSO and Federation web applications written with any programming language or framework";
    platforms   = platforms.unix;
    license     = licenses.asl20;
-    maintainers = [ maintainers.jammerful ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@ -70,7 +70,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "webkitgtk";
-  version = "2.42.3";
+  version = "2.42.4";
  name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "6.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";

  outputs = [ "out" "dev" "devdoc" ];
@ -81,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ChpGMARWKLOm/pXactxHhSz/INZr4axv0NZpyIwT2OI=";
+    hash = "sha256-UiiLML2iI3NELOy4b5yaVprY1HaaH5ezUikO2Spn7YY=";
  };

  patches = lib.optionals stdenv.isLinux [
--- a/pkgs/development/libraries/xml-tooling-c/default.nix
+++ b/pkgs/development/libraries/xml-tooling-c/default.nix
@ -23,6 +23,6 @@ stdenv.mkDerivation rec {
    description = "A low-level library that provides a high level interface to XML processing for OpenSAML 2";
    platforms   = platforms.unix;
    license     = licenses.asl20;
-    maintainers = [ maintainers.jammerful ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/development/lua-modules/aliases.nix
+++ b/pkgs/development/lua-modules/aliases.nix
@ -41,4 +41,5 @@ in
 mapAliases {
  lpty = throw "lpy was removed because broken and unmaintained "; # added 2023-10-14
  cyrussasl = throw "cyrussasl was removed because broken and unmaintained "; # added 2023-10-18
+  nlua-nvim = throw "nlua-nvim was removed, use neodev-nvim instead"; # added 2023-12-16
 }
--- a/pkgs/development/php-packages/xdebug/default.nix
+++ b/pkgs/development/php-packages/xdebug/default.nix
@ -1,7 +1,7 @@
 { buildPecl, lib, fetchFromGitHub }:

 let
-  version = "3.3.0";
+  version = "3.3.1";
 in buildPecl {
  inherit version;

@ -11,7 +11,7 @@ in buildPecl {
    owner = "xdebug";
    repo = "xdebug";
    rev = version;
-    hash = "sha256-i14po+0i25gRR87H6kUdyXF4rXZM70CqXi2EdFBn808=";
+    hash = "sha256-Zt1BIqNKsTHtIXy0Dar52sZxLi5k12LQAbxOLKQPMN8=";
  };

  doCheck = true;
--- a/pkgs/development/python-modules/aioairzone/default.nix
+++ b/pkgs/development/python-modules/aioairzone/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "aioairzone";
-  version = "0.6.9";
+  version = "0.7.2";
  format = "pyproject";

  disabled = pythonOlder "3.11";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "Noltari";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-0nbH0pnTYRuSOkzG5Yn/fJmRKtXBMd6ti6Z+AW72j3Q=";
+    hash = "sha256-ppzusDyGTh2HnDFjqXClyHzjK/TFKvGOWg5Nb2fDGnc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/bleak-esphome/default.nix
+++ b/pkgs/development/python-modules/bleak-esphome/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "bleak-esphome";
-  version = "0.2.0";
+  version = "0.3.0";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "bluetooth-devices";
    repo = "bleak-esphome";
    rev = "refs/tags/v${version}";
-    hash = "sha256-QtSkrX7xGaV/13FonQhYR4MpZxVwR8dAFCRvID0zSGo=";
+    hash = "sha256-XJxx9m8ZJtCmH9R1A4J+EFSTP4z9acDgRbaASKR/tZY=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "bthome-ble";
-  version = "3.2.0";
+  version = "3.3.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = "bthome-ble";
    rev = "refs/tags/v${version}";
-    hash = "sha256-UYW7yEAg4RJR1ERFDDS6s8OBr0XRTHTJLSuOF7FO6u4=";
+    hash = "sha256-dFnEgUmmB9P8bKownMp0NsTWPAeMmdKiaxII3O1gT6A=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/caldav/default.nix
+++ b/pkgs/development/python-modules/caldav/default.nix
@ -11,6 +11,7 @@
 , setuptools
 , tzlocal
 , vobject
+, xandikos
 }:

 buildPythonPackage rec {
@ -43,15 +44,9 @@ buildPythonPackage rec {

  nativeCheckInputs = [
    pytestCheckHook
+    xandikos
  ];

-  # xandikos and radicale are only optional test dependencies, not available for python3
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace xandikos "" \
-      --replace radicale ""
-  '';
-
  pythonImportsCheck = [ "caldav" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/deezer-python/default.nix
+++ b/pkgs/development/python-modules/deezer-python/default.nix
@ -14,17 +14,22 @@
 buildPythonPackage rec {
  pname = "deezer-python";
  version = "6.1.1";
-  format = "pyproject";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "browniebroke";
-    repo = pname;
+    repo = "deezer-python";
    rev = "refs/tags/v${version}";
    hash = "sha256-pzEXiWKMP2Wqme/pqfTMHxWH/4YcCS6u865wslHrUqI=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=deezer" ""
+  '';
+
  nativeBuildInputs = [
    poetry-core
  ];
@ -41,15 +46,16 @@ buildPythonPackage rec {
    tornado
  ];

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=deezer" ""
-  '';
-
  pythonImportsCheck = [
    "deezer"
  ];

+  disabledTests = [
+    # JSONDecodeError issue
+    "test_get_user_flow"
+    "test_with_language_header"
+  ];
+
  meta = with lib; {
    description = "Python wrapper around the Deezer API";
    homepage = "https://github.com/browniebroke/deezer-python";
--- a/pkgs/development/python-modules/diffusers/default.nix
+++ b/pkgs/development/python-modules/diffusers/default.nix
@ -30,7 +30,6 @@
 , pytest-xdist
 , pytestCheckHook
 , requests-mock
-, ruff
 , scipy
 , sentencepiece
 , torchsde
@ -99,7 +98,6 @@ buildPythonPackage rec {
    pytest-xdist
    pytestCheckHook
    requests-mock
-    ruff
    scipy
    sentencepiece
    torchsde
@ -141,6 +139,8 @@ buildPythonPackage rec {
    "test_deprecate_stacklevel"
    # fails due to precision of floating point numbers
    "test_model_cpu_offload_forward_pass"
+    # tries to run ruff which we have intentionally removed from nativeCheckInputs
+    "test_is_copy_consistent"
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/environs/default.nix
+++ b/pkgs/development/python-modules/environs/default.nix
@ -8,22 +8,27 @@
 , pytestCheckHook
 , python-dotenv
 , pythonOlder
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "environs";
-  version = "9.5.0";
-  format = "setuptools";
+  version = "10.0.0";
+  pyproject = true;

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "sloria";
-    repo = pname;
-    rev = version;
-    hash = "sha256-hucApIn7ul7+MC2W811VTxZNO8Pqb6HDXz9VRcEdmIc=";
+    repo = "environs";
+    rev = "refs/tags/${version}";
+    hash = "sha256-B/ICzopFuOAWMlDn950LXmi/XQaQxh5jFVmLdmt7Dlg=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    marshmallow
    python-dotenv
@ -43,6 +48,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python modle for environment variable parsing";
    homepage = "https://github.com/sloria/environs";
+    changelog = "https://github.com/sloria/environs/blob/${version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/latex2mathml/default.nix
+++ b/pkgs/development/python-modules/latex2mathml/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "latex2mathml";
-  version = "3.76.0";
+  version = "3.77.0";

  disabled = pythonOlder "3.8";

@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "roniemartinez";
    repo = pname;
    rev = version;
-    hash = "sha256-CoWXWgu1baM5v7OC+OlRHZB0NkPue4qFzylJk4Xq2e4=";
+    hash = "sha256-DLdSFMsNA0gD6Iw0kn+0IrbvyI0VEGOpz0ZYD48nRkY=";
  };

  format = "pyproject";
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "opower";
-  version = "0.0.40";
+  version = "0.0.41";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "tronikos";
    repo = "opower";
    rev = "refs/tags/v${version}";
-    hash = "sha256-0vk8LGqU3rOgjC8zXkijmIZG8inxwTw2IDneFfy5eQw=";
+    hash = "sha256-dqSMZ/4R4TbPEg/wRCTYKRbwj3mU+YUeYOsWQWIp5OM=";
  };

  pythonRemoveDeps = [
--- a/pkgs/development/python-modules/pymc/default.nix
+++ b/pkgs/development/python-modules/pymc/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "pymc";
-  version = "5.10.1";
+  version = "5.10.2";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "pymc-devs";
    repo = "pymc";
    rev = "refs/tags/v${version}";
-    hash = "sha256-+hRj39teuxlHOEQ40E2ZteU+tN73j+cHWbxzWsl1+mE=";
+    hash = "sha256-Yrhd9pTHxdpGkea6BO/dM1O3nnGIV2CRsg40dpotf0U=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@ -24,7 +24,7 @@

 buildPythonPackage rec {
  pname = "pytensor";
-  version = "2.18.2";
+  version = "2.18.4";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -33,7 +33,7 @@ buildPythonPackage rec {
    owner = "pymc-devs";
    repo = "pytensor";
    rev = "refs/tags/rel-${version}";
-    hash = "sha256-uB5VT4wP08pOkHlxdPJTXK4j5ubmf+hk5oHYPM6diHM=";
+    hash = "sha256-j7SNXFiQUofP5NtggSOwLxXkg267yneqoWH2uoDZogs=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/python-rapidjson/default.nix
+++ b/pkgs/development/python-modules/python-rapidjson/default.nix
@ -29,7 +29,7 @@ let
    cmakeFlags = old.cmakeFlags ++ [ "-DCMAKE_CTEST_ARGUMENTS=-E;valgrind_unittest" ];
  });
 in buildPythonPackage rec {
-  version = "1.13";
+  version = "1.14";
  pname = "python-rapidjson";
  disabled = pythonOlder "3.8";

@ -39,7 +39,7 @@ in buildPythonPackage rec {
    owner = "python-rapidjson";
    repo = "python-rapidjson";
    rev = "refs/tags/v${version}";
-    hash = "sha256-lWF/INhgeFQoPAhyL655UCcVamFELra29R6JPJSAmMg=";
+    hash = "sha256-fCC6jYUIB89HlEnbsmL0MeCBOO4NAZtePuPgZKYxoM8=";
  };

  setupPyBuildFlags = [
--- a/pkgs/development/python-modules/pytrafikverket/default.nix
+++ b/pkgs/development/python-modules/pytrafikverket/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "pytrafikverket";
-  version = "0.3.9.1";
+  version = "0.3.9.2";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-F0BMpZVzSK0i+tdvN//KZQqgxFrfLf0SCNztKCs6BYQ=";
+    hash = "sha256-NxxuyLnzJ8T2jaQ761O943rpBbNwp/F4PygyQULkXzw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyunifiprotect/default.nix
+++ b/pkgs/development/python-modules/pyunifiprotect/default.nix
@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "pyunifiprotect";
-  version = "4.22.0";
+  version = "4.22.3";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "briis";
    repo = "pyunifiprotect";
    rev = "refs/tags/v${version}";
-    hash = "sha256-qzom1mLTfP683GCYlUav/MlOkYj+AiEe13b74ceW7gI=";
+    hash = "sha256-KpijjKy5poiWghupXq8rNCtzuPXsPgu+ePAowhzOSYI=";
  };

  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/pyvlx/default.nix
+++ b/pkgs/development/python-modules/pyvlx/default.nix
@ -1,28 +1,35 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
 , pyyaml
+, setuptools
+, typing-extensions
 }:

 buildPythonPackage rec {
  pname = "pyvlx";
-  version = "0.2.20";
-  format = "setuptools";
+  version = "0.2.21";
+  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.10";

  src = fetchFromGitHub {
    owner = "Julius2342";
-    repo = pname;
-    rev = version;
-    sha256 = "1irjix9kr6qih84gii7k1a9c67n8133gpnmwfd09550jsqdmg006";
+    repo = "pyvlx";
+    rev = "refs/tags/${version}";
+    hash = "sha256-t6lbpP9IwNhXpoZ9+0n9vKCuZ+azWqP7w5v0BfqbMcs=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    pyyaml
+    typing-extensions
  ];

  nativeCheckInputs = [
@ -34,14 +41,15 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "Python client to work with Velux units";
    longDescription = ''
      PyVLX uses the Velux KLF 200 interface to control io-Homecontrol
      devices, e.g. Velux Windows.
    '';
    homepage = "https://github.com/Julius2342/pyvlx";
+    changelog = "https://github.com/Julius2342/pyvlx/releases/tag/${version}";
    license = with licenses; [ lgpl2Only ];
    maintainers = with maintainers; [ fab ];
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "twilio";
-  version = "8.10.3";
+  version = "8.11.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "twilio";
    repo = "twilio-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-6aTPPuQRRPd9mYJI8CHusejTTYdJX/06x+TubPgagJY=";
+    hash = "sha256-yz1jFEjbnG5hqC5wqvxcP3pNLI3GalXWbREToCwf9BU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/quickemu/default.nix
+++ b/pkgs/development/quickemu/default.nix
@ -50,13 +50,13 @@ in

 stdenv.mkDerivation rec {
  pname = "quickemu";
-  version = "4.9.1";
+  version = "4.9.2";

  src = fetchFromGitHub {
    owner = "quickemu-project";
    repo = "quickemu";
    rev = version;
-    hash = "sha256-tWl16dd0a6pDz+cUZx9Ku2ov+LJZabR2cDso5tPbML4=";
+    hash = "sha256-StYgnFBnEJUkJDyFluMm01xhgejXc99AEldGGxIvZU0=";
  };

  postPatch = ''
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "flow";
-  version = "0.223.2";
+  version = "0.224.0";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "flow";
    rev = "v${version}";
-    hash = "sha256-vjsqQuQxTywSx4c0lnDKrrNr5hfFog9UurhIctq14f4=";
+    hash = "sha256-HxJRsIjNXbalqfCBnx5yfWhxdgud1nCNlx1WPUJmALU=";
  };

  postPatch = ''
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@ -3,12 +3,12 @@

 buildGraalvmNativeImage rec {
  pname = "clj-kondo";
-  version = "2023.10.20";
+  version = "2023.12.15";

  src = fetchurl {
    url =
      "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-f9u/pk3CEEmiLgnS2biaUHpsMHjVEwZL2jyB/1PiZUY=";
+    sha256 = "sha256-YVFG7eY0wOB41kKJWydXfil8uyDSHRxPVry9L3u2P4k=";
  };

  graalvmDrv = graalvmCEPackages.graalvm-ce;
--- a/pkgs/development/tools/database/litefs/default.nix
+++ b/pkgs/development/tools/database/litefs/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "litefs";
-  version = "0.5.8";
+  version = "0.5.10";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-oF69bmWI4I/ok89Rgve4eedMR9MCcaxmQ4bGff831dI=";
+    sha256 = "sha256-e7RBiUHMndOz1n8gWlx+4ifnueWgPu482KIAXaSEhl0=";
  };

-  vendorHash = "sha256-6Dg1fU4y0eUeiX9uUwJ2IUxBr81vWR6eUuCV+iPBNBk=";
+  vendorHash = "sha256-FcYPe4arb+jbxj4Tl6bRRAnkEvw0rkECIo8/zC79lOA=";

  subPackages = [ "cmd/litefs" ];

--- a/pkgs/development/tools/hcloud/default.nix
+++ b/pkgs/development/tools/hcloud/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "hcloud";
-  version = "1.40.0";
+  version = "1.41.0";

  src = fetchFromGitHub {
    owner = "hetznercloud";
    repo = "cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-usHBlfEym39p8S6w2eNeXVKpqxlJxLCn9DwK2J1AqdI=";
+    hash = "sha256-NcEJgC3FtGgv0m7qisCB8vaHvD5Yw/UIHsOFBYiID4c=";
  };

-  vendorHash = "sha256-vytfRa4eiF53VTR50l/J2Df587u8xx3lj1QhMYSqglk=";
+  vendorHash = "sha256-qAgKotc+ypm0pHcbKCgpFmTY5W1b8Oq3XrrP6RVulig=";

  ldflags = [
    "-s"
--- a/pkgs/development/tools/infisical/default.nix
+++ b/pkgs/development/tools/infisical/default.nix
@ -15,7 +15,7 @@ let
  buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);

  # the version of infisical
-  version = "0.14.3";
+  version = "0.16.3";

  # the platform-specific, statically linked binary
  src =
--- a/pkgs/development/tools/infisical/hashes.json
+++ b/pkgs/development/tools/infisical/hashes.json
@ -1,6 +1,6 @@
 { "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
-, "x86_64-linux": "sha256-sTfwooMN5ckdaxpd4R3yQvDEYT7muYZTyFEm0exM33M="
-, "x86_64-darwin": "sha256-B94+mF5Wu0pHKIo8CuHAbrorzIxK2U64Np3JFlTc1kk="
-, "aarch64-linux": "sha256-eGuKnC6h1YPW0UdY5wcChbiSzATAcSmHZ6mKBI2sR80="
-, "aarch64-darwin": "sha256-s4s1la165cQ5I296ZCeW3ZIyYapTfRxa20QdZmXvido="
+, "x86_64-linux": "sha256-AxTTTX4rp881dJuNGIF9s09e5yLohTEeM0LHnsQ+/eQ="
+, "x86_64-darwin": "sha256-DKZUB84PbueRfwVAUH9z8N4JxNlK+db+fVH4jPIbDtc="
+, "aarch64-linux": "sha256-q62a5Ggw0Rikhzn0MY24sSurEPW1/nNehfqVzwBAq/k="
+, "aarch64-darwin": "sha256-9961CGekF8N0bVgtNQIxOoWKB2HgUJ3kBek1rSBHJNk="
 }
--- a/pkgs/development/tools/kubie/default.nix
+++ b/pkgs/development/tools/kubie/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "kubie";
-  version = "0.22.0";
+  version = "0.23.0";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "sbstp";
    repo = "kubie";
-    sha256 = "sha256-gqCCUK9xJJq+phYBXJ8gSwU0jclRP6RgifPt/py1PG0=";
+    sha256 = "sha256-3sFtYUFUYYHDqF22XJ+pmg+fW2f03IS5CgIXjWg2+Bo=";
  };

-  cargoHash = "sha256-usS3XZLY4SngEdpvpx+Dxywh7HR8uPgTJabXH5iNsuE=";
+  cargoHash = "sha256-9eUGGDBoeF6EM3Np95rFHU3luGuVZk5iE4kIYlUnEEw=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/development/tools/kustomize/kustomize-sops.nix
+++ b/pkgs/development/tools/kustomize/kustomize-sops.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kustomize-sops";
-  version = "4.2.5";
+  version = "4.3.0";

  src = fetchFromGitHub {
    owner = "viaduct-ai";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-zhu1fBqa6rNO2MoOFUE50I3dtAaOP4Dr9v2rTNB5oro=";
+    hash = "sha256-fN83o84GbfMVG20c1/ROwxYPgnJ4g1U2wsM6j/VGtMY=";
  };

-  vendorHash = "sha256-GuzBSFENkHTri1FF2Ar6paGId7Yj7HuWSEDirFZrqZM=";
+  vendorHash = "sha256-3AA7Zn9KYAJrcotiIpwm5eOfiuJuvLb0rl6FrcwGgSA=";

  installPhase = ''
    mkdir -p $out/lib/viaduct.ai/v1/ksops-exec/
--- a/pkgs/development/tools/language-servers/ruff-lsp/default.nix
+++ b/pkgs/development/tools/language-servers/ruff-lsp/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "ruff-lsp";
-  version = "0.0.45";
+  version = "0.0.47";
  pyproject = true;
  disabled = pythonOlder "3.7";

@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "astral-sh";
    repo = "ruff-lsp";
    rev = "refs/tags/v${version}";
-    hash = "sha256-jTLkex2K/IQTKZp2duM26/EaYhG5E2bGs/QKt5PA7lc=";
+    hash = "sha256-ZbSqqjvYzee79nSeyfU4FPoOzsQwOjPHjltS9QrWcqw=";
  };

  postPatch = ''
--- a/pkgs/development/tools/license-scanner/default.nix
+++ b/pkgs/development/tools/license-scanner/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "license-scanner";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "CycloneDX";
    repo = "license-scanner";
    rev = "refs/tags/v${version}";
-    hash = "sha256-X7omSecbb85dtxPJtgdjLLgJQRJ7dh12DGwzIG0tYcE=";
+    hash = "sha256-2KUaVDAZxMwZ3AAMEUmRiuvenPSFliUp6rZCZrVTDps=";
  };

  vendorHash = "sha256-7xa2tdCDCXkOZCLL8YPtO7i1VqD61Mow7un0690I8mM=";
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@ -114,6 +114,6 @@ stdenv.mkDerivation rec {
    license = licenses.mit;
    platforms = platforms.unix;
    mainProgram = "mold";
-    maintainers = with maintainers; [ azahi nitsky paveloom ];
+    maintainers = with maintainers; [ azahi paveloom ];
  };
 }
--- a/pkgs/development/tools/ocaml/opam/default.nix
+++ b/pkgs/development/tools/ocaml/opam/default.nix
@ -122,6 +122,11 @@ in stdenv.mkDerivation {
  outputs = [ "out" "installer" ];
  setOutputFlags = false;

+  # Work around https://github.com/NixOS/nixpkgs/issues/166205.
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_LDFLAGS = "-l${stdenv.cc.libcxx.cxxabi.libName}";
+  };
+
  # change argv0 to "opam" as a workaround for
  # https://github.com/ocaml/opam/issues/2142
  postInstall = ''
--- a/pkgs/development/tools/ocaml/opam/opam.nix.pl
+++ b/pkgs/development/tools/ocaml/opam/opam.nix.pl
@ -112,6 +112,11 @@ print <<'EOF';
  outputs = [ "out" "installer" ];
  setOutputFlags = false;

+  # Work around https://github.com/NixOS/nixpkgs/issues/166205.
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_LDFLAGS = "-l${stdenv.cc.libcxx.cxxabi.libName}";
+  };
+
  # change argv0 to "opam" as a workaround for
  # https://github.com/ocaml/opam/issues/2142
  postInstall = ''
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ruff";
-  version = "0.1.7";
+  version = "0.1.8";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "ruff";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Al256/8A/efLrf97xCwEocwgs3ngPnEAmkfcLWdlkTw=";
+    hash = "sha256-zf2280aSmGstcgxoU/IWtdtdWExvdKLBNh4Cn5tC1vU=";
  };

-  cargoHash = "sha256-4iC9pRmhxC29zIrRxQfNG3KCWtHqw8ml6MJoT/XZjSI=";
+  cargoHash = "sha256-UC47RXgvjHInJuHVYmnAAb7SACRqt4d59k9/Cl9+x4Q=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/development/tools/rust/cargo-mutants/default.nix
+++ b/pkgs/development/tools/rust/cargo-mutants/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-mutants";
-  version = "23.11.2";
+  version = "23.12.0";

  src = fetchFromGitHub {
    owner = "sourcefrog";
    repo = "cargo-mutants";
    rev = "v${version}";
-    hash = "sha256-Rx/3U/wSV4OivUzVyjS+sHiPqCHdaoornngvfn59Bbc=";
+    hash = "sha256-6p+ri6An0rQTPSFUSE4MBNP5dFiVFsS0UDXUoWJoY20=";
  };

-  cargoHash = "sha256-8PnxjZIOZ8DPso4Qd29mfiIPpfe3Erjnu5xXHf1eoGk=";
+  cargoHash = "sha256-4ej0Pl8n1Z001IdiM1u+/Z7ZTi9hwuoJLA4gHheQOsA=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.SystemConfiguration
--- a/pkgs/development/tools/rust/cargo-tally/default.nix
+++ b/pkgs/development/tools/rust/cargo-tally/default.nix
@ -2,14 +2,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-tally";
-  version = "1.0.31";
+  version = "1.0.32";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-2V2JXSlFzYoSidByWGFTGwNHM9c5Go1cdHLp0b7N+hI=";
+    hash = "sha256-sbSGqVH0pEFhNhIBu/RzrkEViN4ilEJbgYQEtxU986E=";
  };

-  cargoHash = "sha256-mcYAqzfZO0M/UQTeYp4eCD7VVIWhtHi7VxBZtrr/aCk=";
+  cargoHash = "sha256-VMFPWAdOeAYsr0tdlSxtYsahEm/8K0L25lOfPG0P+uU=";

  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk_11_0.frameworks; [
    DiskArbitration
--- a/Show more
+++ b/Show more