Merge master into haskell-updates

doc/functions.md

@@ -8,5 +8,4 @@ functions/generators.section.md
 functions/debug.section.md
 functions/prefer-remote-fetch.section.md
 functions/nix-gitignore.section.md
-functions/fileset.section.md
 ```

doc/functions/fileset.section.md

@@ -1,48 +0,0 @@
-<!-- TODO: Render this document in front of function documentation in case https://github.com/nix-community/nixdoc/issues/19 is ever supported -->
-
-# File sets {#sec-fileset}
-
-The [`lib.fileset`](#sec-functions-library-fileset) library allows you to work with _file sets_.
-A file set is a mathematical set of local files that can be added to the Nix store for use in Nix derivations.
-File sets are easy and safe to use, providing obvious and composable semantics with good error messages to prevent mistakes.
-
-See the [function reference](#sec-functions-library-fileset) for function-specific documentation.
-
-## Implicit coercion from paths to file sets {#sec-fileset-path-coercion}
-
-All functions accepting file sets as arguments can also accept [paths](https://nixos.org/manual/nix/stable/language/values.html#type-path) as arguments.
-Such path arguments are implicitly coerced to file sets containing all files under that path:
-- A path to a file turns into a file set containing that single file.
-- A path to a directory turns into a file set containing all files _recursively_ in that directory.
-
-If the path points to a non-existent location, an error is thrown.
-
-::: {.note}
-Just like in Git, file sets cannot represent empty directories.
-Because of this, a path to a directory that contains no files (recursively) will turn into a file set containing no files.
-:::
-
-:::{.note}
-File set coercion does _not_ add any of the files under the coerced paths to the store.
-Only the [`toSource`](#function-library-lib.fileset.toSource) function adds files to the Nix store, and only those files contained in the `fileset` argument.
-This is in contrast to using [paths in string interpolation](https://nixos.org/manual/nix/stable/language/values.html#type-path), which does add the entire referenced path to the store.
-:::
-
-### Example {#sec-fileset-path-coercion-example}
-
-Assume we are in a local directory with a file hierarchy like this:
-```
-├─ a/
-│  ├─ x (file)
-│  └─ b/
-│     └─ y (file)
-└─ c/
-   └─ d/
-```
-
-Here's a listing of which files get included when different path expressions get coerced to file sets:
-- `./.` as a file set contains both `a/x` and `a/b/y` (`c/` does not contain any files and is therefore omitted).
-- `./a` as a file set contains both `a/x` and `a/b/y`.
-- `./a/x` as a file set contains only `a/x`.
-- `./a/b` as a file set contains only `a/b/y`.
-- `./c` as a file set is empty, since neither `c` nor `c/d` contain any files.

doc/stdenv/stdenv.chapter.md

@@ -119,13 +119,18 @@ phases="${prePhases[*]:-} unpackPhase patchPhase" genericBuild
 ```
 
 Then, run more phases up until the failure is reached.
-For example, if the failure is in the build phase, the following phases would be required:
+If the failure is in the build or check phase, the following phases would be required:
 
 ```bash
-phases="${preConfigurePhases[*]:-} configurePhase ${preBuildPhases[*]:-} buildPhase" genericBuild
+phases="${preConfigurePhases[*]:-} configurePhase ${preBuildPhases[*]:-} buildPhase checkPhase" genericBuild
 ```
 
-Re-run a single phase as many times as necessary to examine the failure like so:
+Use this command to run all install phases:
+```bash
+phases="${preInstallPhases[*]:-} installPhase ${preFixupPhases[*]:-} fixupPhase installCheckPhase" genericBuild
+```
+
+Single phase can be re-run as many times as necessary to examine the failure like so:
 
 ```bash
 phases="buildPhase" genericBuild

lib/fileset/default.nix

@@ -1,3 +1,52 @@
+/*
+  <!-- This anchor is here for backwards compatibity -->
+  []{#sec-fileset}
+
+  The [`lib.fileset`](#sec-functions-library-fileset) library allows you to work with _file sets_.
+  A file set is a mathematical set of local files that can be added to the Nix store for use in Nix derivations.
+  File sets are easy and safe to use, providing obvious and composable semantics with good error messages to prevent mistakes.
+
+  See the [function reference](#sec-functions-library-fileset) for function-specific documentation.
+
+  ## Implicit coercion from paths to file sets {#sec-fileset-path-coercion}
+
+  All functions accepting file sets as arguments can also accept [paths](https://nixos.org/manual/nix/stable/language/values.html#type-path) as arguments.
+  Such path arguments are implicitly coerced to file sets containing all files under that path:
+  - A path to a file turns into a file set containing that single file.
+  - A path to a directory turns into a file set containing all files _recursively_ in that directory.
+
+  If the path points to a non-existent location, an error is thrown.
+
+  ::: {.note}
+  Just like in Git, file sets cannot represent empty directories.
+  Because of this, a path to a directory that contains no files (recursively) will turn into a file set containing no files.
+  :::
+
+  :::{.note}
+  File set coercion does _not_ add any of the files under the coerced paths to the store.
+  Only the [`toSource`](#function-library-lib.fileset.toSource) function adds files to the Nix store, and only those files contained in the `fileset` argument.
+  This is in contrast to using [paths in string interpolation](https://nixos.org/manual/nix/stable/language/values.html#type-path), which does add the entire referenced path to the store.
+  :::
+
+  ### Example {#sec-fileset-path-coercion-example}
+
+  Assume we are in a local directory with a file hierarchy like this:
+  ```
+  ├─ a/
+  │  ├─ x (file)
+  │  └─ b/
+  │     └─ y (file)
+  └─ c/
+     └─ d/
+  ```
+
+  Here's a listing of which files get included when different path expressions get coerced to file sets:
+  - `./.` as a file set contains both `a/x` and `a/b/y` (`c/` does not contain any files and is therefore omitted).
+  - `./a` as a file set contains both `a/x` and `a/b/y`.
+  - `./a/x` as a file set contains only `a/x`.
+  - `./a/b` as a file set contains only `a/b/y`.
+  - `./c` as a file set is empty, since neither `c` nor `c/d` contain any files.
+*/
 { lib }:
 let
 
@@ -263,7 +312,7 @@ in {
           lib.fileset.fromSource: The source origin of the argument is of type ${typeOf path}, but it should be a path instead.''
     else if ! pathExists path then
       throw ''
-        lib.fileset.fromSource: The source origin (${toString path}) of the argument does not exist.''
+        lib.fileset.fromSource: The source origin (${toString path}) of the argument is a path that does not exist.''
     else if isFiltered then
       _fromSourceFilter path source.filter
     else

lib/fileset/internal.nix

@@ -381,7 +381,7 @@ rec {
 
   # Turn a fileset into a source filter function suitable for `builtins.path`
   # Only directories recursively containing at least one files are recursed into
-  # Type: Path -> fileset -> (String -> String -> Bool)
+  # Type: fileset -> (String -> String -> Bool)
   _toSourceFilter = fileset:
     let
       # Simplify the tree, necessary to make sure all empty directories are null
@@ -753,9 +753,9 @@ rec {
 
       resultingTree =
         _differenceTree
-        positive._internalBase
+          positive._internalBase
-        positive._internalTree
+          positive._internalTree
-        negativeTreeWithPositiveBase;
+          negativeTreeWithPositiveBase;
     in
     # If the first file set is empty, we can never have any files in the result
     if positive._internalIsEmptyWithoutBase then

lib/fileset/tests.sh

@@ -1064,13 +1064,18 @@ rm -rf -- *
 ## lib.fileset.fromSource
 
 # Check error messages
-expectFailure 'fromSource null' 'lib.fileset.fromSource: The source origin of the argument is of type null, but it should be a path instead.'
 
+# String-like values are not supported
 expectFailure 'fromSource (lib.cleanSource "")' 'lib.fileset.fromSource: The source origin of the argument is a string-like value \(""\), but it should be a path instead.
 \s*Sources created from paths in strings cannot be turned into file sets, use `lib.sources` or derivations instead.'
 
+# Wrong type
+expectFailure 'fromSource null' 'lib.fileset.fromSource: The source origin of the argument is of type null, but it should be a path instead.'
 expectFailure 'fromSource (lib.cleanSource null)' 'lib.fileset.fromSource: The source origin of the argument is of type null, but it should be a path instead.'
 
+# fromSource on non-existent paths gives an error
+expectFailure 'fromSource ./a' 'lib.fileset.fromSource: The source origin \('"$work"'/a\) of the argument is a path that does not exist.'
+
 # fromSource on a path works and is the same as coercing that path
 mkdir a
 touch a/b c

maintainers/maintainer-list.nix

@@ -16279,6 +16279,13 @@
     githubId = 75371;
     name = "Stig Palmquist";
   };
+  sg-qwt = {
+    email = "hello@edgerunners.eu.org";
+    matrix = "@dhl:edgerunners.eu.org";
+    github = "sg-qwt";
+    name = "sg-qwt";
+    githubId = 115715554;
+  };
   sgraf = {
     email = "sgraf1337@gmail.com";
     github = "sgraf812";

nixos/modules/module-list.nix

@@ -799,6 +799,7 @@
   ./services/monitoring/munin.nix
   ./services/monitoring/nagios.nix
   ./services/monitoring/netdata.nix
+  ./services/monitoring/ocsinventory-agent.nix
   ./services/monitoring/opentelemetry-collector.nix
   ./services/monitoring/osquery.nix
   ./services/monitoring/parsedmarc.nix

nixos/modules/services/misc/amazon-ssm-agent.nix

@@ -33,19 +33,22 @@ in {
   };
 
   config = mkIf cfg.enable {
+    # See https://github.com/aws/amazon-ssm-agent/blob/mainline/packaging/linux/amazon-ssm-agent.service
     systemd.services.amazon-ssm-agent = {
       inherit (cfg.package.meta) description;
-      after    = [ "network.target" ];
+      after    = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
       path = [ fake-lsb-release pkgs.coreutils ];
+
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/amazon-ssm-agent";
         KillMode = "process";
         # We want this restating pretty frequently. It could be our only means
         # of accessing the instance.
         Restart = "always";
-        RestartSec = "1min";
+        RestartPreventExitStatus = 194;
+        RestartSec = "90";
       };
     };
 
@@ -70,7 +73,7 @@ in {
       group = "ssm-user";
     };
 
-    environment.etc."amazon/ssm/seelog.xml".source = "${cfg.package}/seelog.xml.template";
+    environment.etc."amazon/ssm/seelog.xml".source = "${cfg.package}/etc/amazon/ssm/seelog.xml.template";
 
     environment.etc."amazon/ssm/amazon-ssm-agent.json".source =  "${cfg.package}/etc/amazon/ssm/amazon-ssm-agent.json.template";
 

nixos/modules/services/monitoring/ocsinventory-agent.md

@@ -0,0 +1,33 @@
+# OCS Inventory Agent {#module-services-ocsinventory-agent}
+
+[OCS Inventory NG](https://ocsinventory-ng.org/) or Open Computers and Software inventory
+is an application designed to help IT administrator to keep track of the hardware and software
+configurations of computers that are installed on their network.
+
+OCS Inventory collects information about the hardware and software of networked machines
+through the **OCS Inventory Agent** program.
+
+This NixOS module enables you to install and configure this agent so that it sends information from your computer to the OCS Inventory server.
+
+For more technical information about OCS Inventory Agent, refer to [the Wiki documentation](https://wiki.ocsinventory-ng.org/03.Basic-documentation/Setting-up-the-UNIX-agent-manually-on-client-computers/).
+
+
+## Basic Usage {#module-services-ocsinventory-agent-basic-usage}
+
+A minimal configuration looks like this:
+
+```nix
+{
+  services.ocsinventory-agent = {
+    enable = true;
+    settings = {
+      server = "https://ocsinventory.localhost:8080/ocsinventory";
+      tag = "01234567890123";
+    };
+  };
+}
+```
+
+This configuration will periodically run the ocsinventory-agent SystemD service.
+
+The OCS Inventory Agent will inventory the computer and then sends the results to the specified OCS Inventory Server.

nixos/modules/services/monitoring/ocsinventory-agent.nix

@@ -0,0 +1,134 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.ocsinventory-agent;
+
+  settingsFormat = pkgs.formats.keyValue {
+    mkKeyValue = lib.generators.mkKeyValueDefault { } "=";
+  };
+
+in
+{
+  meta = {
+    doc = ./ocsinventory-agent.md;
+    maintainers = with lib.maintainers; [ anthonyroussel ];
+  };
+
+  options = {
+    services.ocsinventory-agent = {
+      enable = lib.mkEnableOption (lib.mdDoc "OCS Inventory Agent");
+
+      package = lib.mkPackageOptionMD pkgs "ocsinventory-agent" { };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type.nestedTypes.elemType;
+
+          options = {
+            server = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              example = "https://ocsinventory.localhost:8080/ocsinventory";
+              default = null;
+              description = lib.mdDoc ''
+                The URI of the OCS Inventory server where to send the inventory file.
+
+                This option is ignored if {option}`services.ocsinventory-agent.settings.local` is set.
+              '';
+            };
+
+            local = lib.mkOption {
+              type = lib.types.nullOr lib.types.path;
+              example = "/var/lib/ocsinventory-agent/reports";
+              default = null;
+              description = lib.mdDoc ''
+                If specified, the OCS Inventory Agent will run in offline mode
+                and the resulting inventory file will be stored in the specified path.
+              '';
+            };
+
+            ca = lib.mkOption {
+              type = lib.types.path;
+              default = "/etc/ssl/certs/ca-certificates.crt";
+              description = lib.mdDoc ''
+                Path to CA certificates file in PEM format, for server
+                SSL certificate validation.
+              '';
+            };
+
+            tag = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              example = "01234567890123";
+              description = lib.mdDoc "Tag for the generated inventory.";
+            };
+
+            debug = lib.mkEnableOption (lib.mdDoc "debug mode");
+          };
+        };
+        default = { };
+        example = {
+          ca = "/etc/ssl/certs/ca-certificates.crt";
+          debug = true;
+          server = "https://ocsinventory.localhost:8080/ocsinventory";
+          tag = "01234567890123";
+        };
+        description = lib.mdDoc ''
+          Configuration for /etc/ocsinventory-agent/ocsinventory-agent.cfg.
+
+          Refer to
+          {manpage}`ocsinventory-agent(1)` for available options.
+        '';
+      };
+
+      interval = lib.mkOption {
+        type = lib.types.str;
+        default = "daily";
+        example = "06:00";
+        description = lib.mdDoc ''
+          How often we run the ocsinventory-agent service. Runs by default every daily.
+
+          The format is described in
+          {manpage}`systemd.time(7)`.
+        '';
+      };
+    };
+  };
+
+  config =
+    let
+      configFile = settingsFormat.generate "ocsinventory-agent.cfg" cfg.settings;
+
+    in lib.mkIf cfg.enable {
+      # Path of the configuration file is hard-coded and cannot be changed
+      # https://github.com/OCSInventory-NG/UnixAgent/blob/v2.10.0/lib/Ocsinventory/Agent/Config.pm#L78
+      #
+      environment.etc."ocsinventory-agent/ocsinventory-agent.cfg".source = configFile;
+
+      systemd.services.ocsinventory-agent = {
+        description = "OCS Inventory Agent service";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+
+        reloadTriggers = [ configFile ];
+
+        serviceConfig = {
+          ExecStart = lib.getExe cfg.package;
+          ConfigurationDirectory = "ocsinventory-agent";
+          StateDirectory = "ocsinventory-agent";
+        };
+      };
+
+      systemd.timers.ocsinventory-agent = {
+        description = "Launch OCS Inventory Agent regularly";
+        wantedBy = [ "timers.target" ];
+
+        timerConfig = {
+          OnCalendar = cfg.interval;
+          AccuracySec = "1h";
+          RandomizedDelaySec = 240;
+          Persistent = true;
+          Unit = "ocsinventory-agent.service";
+        };
+      };
+    };
+}

nixos/modules/services/monitoring/thanos.nix

@@ -1,14 +1,37 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
+  inherit (lib)
+    collect
+    concatLists
+    concatStringsSep
+    flip
+    getAttrFromPath
+    hasPrefix
+    isList
+    length
+    literalExpression
+    literalMD
+    mapAttrsRecursiveCond
+    mapAttrsToList
+    mdDoc
+    mkEnableOption
+    mkIf
+    mkMerge
+    mkOption
+    mkPackageOptionMD
+    optional
+    optionalAttrs
+    optionalString
+    types
+    ;
+
   cfg = config.services.thanos;
 
   nullOpt = type: description: mkOption {
     type = types.nullOr type;
     default = null;
-    description = lib.mdDoc description;
+    description = mdDoc description;
   };
 
   optionToArgs = opt: v  : optional (v != null)  ''--${opt}="${toString v}"'';
@@ -32,7 +55,7 @@ let
     option = mkOption {
       type = types.bool;
       default = false;
-      description = lib.mdDoc description;
+      description = mdDoc description;
     };
   };
 
@@ -41,7 +64,7 @@ let
     option = mkOption {
       type = types.listOf types.str;
       default = [];
-      description = lib.mdDoc description;
+      description = mdDoc description;
     };
   };
 
@@ -50,7 +73,7 @@ let
     option = mkOption {
       type = types.attrsOf types.str;
       default = {};
-      description = lib.mdDoc description;
+      description = mdDoc description;
     };
   };
 
@@ -59,7 +82,7 @@ let
     option = mkOption {
       type = types.str;
       inherit default;
-      description = lib.mdDoc description;
+      description = mdDoc description;
     };
   };
 
@@ -86,7 +109,7 @@ let
     defaultText = literalMD ''
       calculated from `config.services.thanos.${cmd}`
     '';
-    description = lib.mdDoc ''
+    description = mdDoc ''
       Arguments to the `thanos ${cmd}` command.
 
       Defaults to a list of arguments formed by converting the structured
@@ -127,10 +150,10 @@ let
             if config.services.thanos.<cmd>.tracing.config == null then null
             else toString (toYAML "tracing.yaml" config.services.thanos.<cmd>.tracing.config);
           '';
-          description = lib.mdDoc ''
+          description = mdDoc ''
             Path to YAML file that contains tracing configuration.
 
-            See format details: <https://thanos.io/tracing.md/#configuration>
+            See format details: <https://thanos.io/tip/thanos/tracing.md/#configuration>
           '';
         };
       };
@@ -147,7 +170,7 @@ let
 
             If {option}`tracing.config-file` is set this option has no effect.
 
-            See format details: <https://thanos.io/tracing.md/#configuration>
+            See format details: <https://thanos.io/tip/thanos/tracing.md/#configuration>
           '';
         };
     };
@@ -192,10 +215,10 @@ let
             if config.services.thanos.<cmd>.objstore.config == null then null
             else toString (toYAML "objstore.yaml" config.services.thanos.<cmd>.objstore.config);
           '';
-          description = lib.mdDoc ''
+          description = mdDoc ''
             Path to YAML file that contains object store configuration.
 
-            See format details: <https://thanos.io/storage.md/#configuration>
+            See format details: <https://thanos.io/tip/thanos/storage.md/#configuring-access-to-object-storage>
           '';
         };
       };
@@ -212,7 +235,7 @@ let
 
             If {option}`objstore.config-file` is set this option has no effect.
 
-            See format details: <https://thanos.io/storage.md/#configuration>
+            See format details: <https://thanos.io/tip/thanos/storage.md/#configuring-access-to-object-storage>
           '';
         };
     };
@@ -231,7 +254,7 @@ let
           type = types.str;
           default = "/var/lib/${config.services.prometheus.stateDir}/data";
           defaultText = literalExpression ''"/var/lib/''${config.services.prometheus.stateDir}/data"'';
-          description = lib.mdDoc ''
+          description = mdDoc ''
             Data directory of TSDB.
           '';
         };
@@ -266,14 +289,14 @@ let
         Maximum size of concurrently allocatable bytes for chunks.
       '';
 
-      store.grpc.series-sample-limit = mkParamDef types.int 0 ''
+      store.limits.request-samples = mkParamDef types.int 0 ''
-        Maximum amount of samples returned via a single Series call.
+        The maximum samples allowed for a single Series request.
+        The Series call fails if this limit is exceeded.
 
         `0` means no limit.
 
-        NOTE: for efficiency we take 120 as the number of samples in chunk (it
+        NOTE: For efficiency the limit is internally implemented as 'chunks limit'
-        cannot be bigger than that), so the actual number of samples might be
+        considering each chunk contains a maximum of 120 samples.
-        lower, even though the maximum could be hit.
       '';
 
       store.grpc.series-max-concurrency = mkParamDef types.int 20 ''
@@ -371,24 +394,25 @@ let
         Maximum number of queries processed concurrently by query node.
       '';
 
-      query.replica-label = mkParam types.str ''
+      query.replica-labels = mkAttrsParam "query.replica-label" ''
-        Label to treat as a replica indicator along which data is
+        Labels to treat as a replica indicator along which data is
+
         deduplicated.
 
         Still you will be able to query without deduplication using
-        `dedup=false` parameter.
+        'dedup=false' parameter. Data includes time series, recording
+        rules, and alerting rules.
       '';
 
       selector-labels = mkAttrsParam "selector-label" ''
         Query selector labels that will be exposed in info endpoint.
       '';
 
-      store.addresses = mkListParam "store" ''
+      endpoints = mkListParam "endpoint" ''
-        Addresses of statically configured store API servers.
+        Addresses of statically configured Thanos API servers (repeatable).
 
-        The scheme may be prefixed with `dns+` or
+        The scheme may be prefixed with 'dns+' or 'dnssrv+' to detect
-        `dnssrv+` to detect store API servers through
+        Thanos API servers through respective DNS lookups.
-        respective DNS lookups.
       '';
 
       store.sd-files = mkListParam "store.sd-files" ''
@@ -430,6 +454,12 @@ let
       '';
     };
 
+    query-frontend = params.common cfg.query-frontend // {
+      query-frontend.downstream-url = mkParamDef types.str "http://localhost:9090" ''
+        URL of downstream Prometheus Query compatible API.
+      '';
+    };
+
     rule = params.common cfg.rule // params.objstore cfg.rule // {
 
       labels = mkAttrsParam "label" ''
@@ -447,7 +477,7 @@ let
         Rule files that should be used by rule manager. Can be in glob format.
       '';
 
-      eval-interval = mkParamDef types.str "30s" ''
+      eval-interval = mkParamDef types.str "1m" ''
         The default evaluation interval to use.
       '';
 
@@ -597,10 +627,6 @@ let
         to render all samples for a human eye anyway
       '';
 
-      block-sync-concurrency = mkParamDef types.int 20 ''
-        Number of goroutines to use when syncing block metadata from object storage.
-      '';
-
       compact.concurrency = mkParamDef types.int 1 ''
         Number of goroutines to use when compacting groups.
       '';
@@ -625,7 +651,7 @@ let
         Data directory relative to `/var/lib` of TSDB.
       '';
 
-      labels = mkAttrsParam "labels" ''
+      labels = mkAttrsParam "label" ''
         External labels to announce.
 
         This flag will be removed in the future when handling multiple tsdb
@@ -656,57 +682,56 @@ in {
 
   options.services.thanos = {
 
-    package = mkOption {
+    package = mkPackageOptionMD pkgs "thanos" {};
-      type = types.package;
-      default = pkgs.thanos;
-      defaultText = literalExpression "pkgs.thanos";
-      description = lib.mdDoc ''
-        The thanos package that should be used.
-      '';
-    };
 
     sidecar = paramsToOptions params.sidecar // {
       enable = mkEnableOption
-        (lib.mdDoc "the Thanos sidecar for Prometheus server");
+        (mdDoc "the Thanos sidecar for Prometheus server");
       arguments = mkArgumentsOption "sidecar";
     };
 
     store = paramsToOptions params.store // {
       enable = mkEnableOption
-        (lib.mdDoc "the Thanos store node giving access to blocks in a bucket provider.");
+        (mdDoc "the Thanos store node giving access to blocks in a bucket provider.");
       arguments = mkArgumentsOption "store";
     };
 
     query = paramsToOptions params.query // {
       enable = mkEnableOption
-        (lib.mdDoc ("the Thanos query node exposing PromQL enabled Query API " +
+        (mdDoc ("the Thanos query node exposing PromQL enabled Query API " +
          "with data retrieved from multiple store nodes"));
       arguments = mkArgumentsOption "query";
     };
 
+    query-frontend = paramsToOptions params.query-frontend // {
+      enable = mkEnableOption
+        (mdDoc ("the Thanos query frontend implements a service deployed in front of queriers to
+          improve query parallelization and caching."));
+      arguments = mkArgumentsOption "query-frontend";
+    };
+
     rule = paramsToOptions params.rule // {
       enable = mkEnableOption
-        (lib.mdDoc ("the Thanos ruler service which evaluates Prometheus rules against" +
+        (mdDoc ("the Thanos ruler service which evaluates Prometheus rules against" +
         " given Query nodes, exposing Store API and storing old blocks in bucket"));
       arguments = mkArgumentsOption "rule";
     };
 
     compact = paramsToOptions params.compact // {
       enable = mkEnableOption
-        (lib.mdDoc "the Thanos compactor which continuously compacts blocks in an object store bucket");
+        (mdDoc "the Thanos compactor which continuously compacts blocks in an object store bucket");
       arguments = mkArgumentsOption "compact";
     };
 
     downsample = paramsToOptions params.downsample // {
       enable = mkEnableOption
-        (lib.mdDoc "the Thanos downsampler which continuously downsamples blocks in an object store bucket");
+        (mdDoc "the Thanos downsampler which continuously downsamples blocks in an object store bucket");
       arguments = mkArgumentsOption "downsample";
     };
 
     receive = paramsToOptions params.receive // {
       enable = mkEnableOption
-        (lib.mdDoc ("the Thanos receiver which accept Prometheus remote write API requests " +
+        (mdDoc ("the Thanos receiver which accept Prometheus remote write API requests and write to local tsdb"));
-         "and write to local tsdb (EXPERIMENTAL, this may change drastically without notice)"));
       arguments = mkArgumentsOption "receive";
     };
   };
@@ -736,6 +761,7 @@ in {
           User = "prometheus";
           Restart = "always";
           ExecStart = thanos "sidecar";
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         };
       };
     })
@@ -751,6 +777,7 @@ in {
             StateDirectory = cfg.store.stateDir;
             Restart = "always";
             ExecStart = thanos "store";
+            ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
           };
         };
       }
@@ -764,6 +791,20 @@ in {
           DynamicUser = true;
           Restart = "always";
           ExecStart = thanos "query";
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        };
+      };
+    })
+
+    (mkIf cfg.query-frontend.enable {
+      systemd.services.thanos-query-frontend = {
+        wantedBy = [ "multi-user.target" ];
+        after    = [ "network.target" ];
+        serviceConfig = {
+          DynamicUser = true;
+          Restart = "always";
+          ExecStart = thanos "query-frontend";
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         };
       };
     })
@@ -779,6 +820,7 @@ in {
             StateDirectory = cfg.rule.stateDir;
             Restart = "always";
             ExecStart = thanos "rule";
+            ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
           };
         };
       }
@@ -797,6 +839,7 @@ in {
               DynamicUser = true;
               StateDirectory = cfg.compact.stateDir;
               ExecStart = thanos "compact";
+              ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
             };
           } // optionalAttrs (!wait) { inherit (cfg.compact) startAt; };
       }
@@ -813,6 +856,7 @@ in {
             StateDirectory = cfg.downsample.stateDir;
             Restart = "always";
             ExecStart = thanos "downsample";
+            ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
           };
         };
       }
@@ -829,6 +873,7 @@ in {
             StateDirectory = cfg.receive.stateDir;
             Restart = "always";
             ExecStart = thanos "receive";
+            ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
           };
         };
       }

nixos/modules/services/networking/ntp/chrony.nix

@@ -162,7 +162,7 @@ in
       };
 
       extraFlags = mkOption {
-        default = [];
+        default = [ ];
         example = [ "-s" ];
         type = types.listOf types.str;
         description = lib.mdDoc "Extra flags passed to the chronyd command.";
@@ -178,7 +178,8 @@ in
     users.groups.chrony.gid = config.ids.gids.chrony;
 
     users.users.chrony =
-      { uid = config.ids.uids.chrony;
+      {
+        uid = config.ids.uids.chrony;
         group = "chrony";
         description = "chrony daemon user";
         home = stateDir;
@@ -202,12 +203,13 @@ in
     ];
 
     systemd.services.chronyd =
-      { description = "chrony NTP daemon";
+      {
+        description = "chrony NTP daemon";
 
         wantedBy = [ "multi-user.target" ];
-        wants    = [ "time-sync.target" ];
+        wants = [ "time-sync.target" ];
-        before   = [ "time-sync.target" ];
+        before = [ "time-sync.target" ];
-        after    = [ "network.target" "nss-lookup.target" ];
+        after = [ "network.target" "nss-lookup.target" ];
         conflicts = [ "ntpd.service" "systemd-timesyncd.service" ];
 
         path = [ chronyPkg ];
@@ -255,5 +257,18 @@ in
           SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @resources" "@clock" "@setuid" "capset" "@chown" ];
         };
       };
+
+    assertions = [
+      {
+        assertion = !(cfg.enableRTCTrimming && builtins.any (line: (builtins.match "^ *rtcsync" line) != null) (lib.strings.splitString "\n" cfg.extraConfig));
+        message = ''
+          The chrony module now configures `rtcfile` and `rtcautotrim` for you.
+          These options conflict with `rtcsync` and cause chrony to crash.
+          Unless you are very sure the former isn't what you want, please remove
+          `rtcsync` from `services.chrony.extraConfig`.
+          Alternatively, disable this behaviour by `services.chrony.enableRTCTrimming = false;`
+        '';
+      }
+    ];
   };
 }

nixos/modules/services/networking/pixiecore.nix

@@ -16,7 +16,7 @@ in
         type = types.bool;
         default = false;
         description = lib.mdDoc ''
-          Open ports (67, 69 UDP and 4011, 'port', 'statusPort' TCP) in the firewall for Pixiecore.
+          Open ports (67, 69, 4011 UDP and 'port', 'statusPort' TCP) in the firewall for Pixiecore.
         '';
       };
 
@@ -103,8 +103,8 @@ in
     };
 
     networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 4011 cfg.port cfg.statusPort ];
+      allowedTCPPorts = [ cfg.port cfg.statusPort ];
-      allowedUDPPorts = [ 67 69 ];
+      allowedUDPPorts = [ 67 69 4011 ];
     };
 
     systemd.services.pixiecore = {

nixos/modules/services/networking/squid.nix

@@ -176,7 +176,7 @@ in
       serviceConfig = {
         PIDFile="/run/squid.pid";
         ExecStart  = "${cfg.package}/bin/squid --foreground -YCs -f ${squidConfig}";
-        ExecReload="kill -HUP $MAINPID";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         KillMode="mixed";
         NotifyAccess="all";
       };

nixos/modules/services/web-servers/caddy/default.nix

@@ -376,7 +376,9 @@ in
         ReadWriteDirectories = cfg.dataDir;
         StateDirectory = mkIf (cfg.dataDir == "/var/lib/caddy") [ "caddy" ];
         LogsDirectory = mkIf (cfg.logDir == "/var/log/caddy") [ "caddy" ];
-        Restart = "on-abnormal";
+        Restart = "on-failure";
+        RestartPreventExitStatus = 1;
+        RestartSecs = "5s";
 
         # TODO: attempt to upstream these options
         NoNewPrivileges = true;

nixos/modules/system/boot/stage-1.nix

@@ -435,7 +435,7 @@ let
          }
 
         # mindepth 1 so that we don't change the mode of /
-        (cd "$tmp" && find . -mindepth 1 -print0 | sort -z | bsdtar --uid 0 --gid 0 -cnf - -T - | bsdtar --null -cf - --format=newc @-) | \
+        (cd "$tmp" && find . -mindepth 1 | xargs touch -amt 197001010000 && find . -mindepth 1 -print0 | sort -z | bsdtar --uid 0 --gid 0 -cnf - -T - | bsdtar --null -cf - --format=newc @-) | \
           ${compressorExe} ${lib.escapeShellArgs initialRamdisk.compressorArgs} >> "$1"
       '';
 

nixos/tests/all-tests.nix

@@ -117,6 +117,7 @@ in {
   allTerminfo = handleTest ./all-terminfo.nix {};
   alps = handleTest ./alps.nix {};
   amazon-init-shell = handleTest ./amazon-init-shell.nix {};
+  amazon-ssm-agent = handleTest ./amazon-ssm-agent.nix {};
   amd-sev = runTest ./amd-sev.nix;
   anbox = runTest ./anbox.nix;
   anuko-time-tracker = handleTest ./anuko-time-tracker.nix {};
@@ -616,6 +617,7 @@ in {
   openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
   opentabletdriver = handleTest ./opentabletdriver.nix {};
   opentelemetry-collector = handleTest ./opentelemetry-collector.nix {};
+  ocsinventory-agent = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./ocsinventory-agent.nix {};
   owncast = handleTest ./owncast.nix {};
   outline = handleTest ./outline.nix {};
   image-contents = handleTest ./image-contents.nix {};

nixos/tests/amazon-ssm-agent.nix

@@ -0,0 +1,17 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "amazon-ssm-agent";
+  meta.maintainers = [ lib.maintainers.anthonyroussel ];
+
+  nodes.machine = { config, pkgs, ... }: {
+    services.amazon-ssm-agent.enable = true;
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_file("/etc/amazon/ssm/seelog.xml")
+    machine.wait_for_file("/etc/amazon/ssm/amazon-ssm-agent.json")
+
+    machine.wait_for_unit("amazon-ssm-agent.service")
+  '';
+})

nixos/tests/ocsinventory-agent.nix

@@ -0,0 +1,33 @@
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "ocsinventory-agent";
+
+  nodes.machine = { pkgs, ... }: {
+    services.ocsinventory-agent = {
+      enable = true;
+      settings = {
+        debug = true;
+        local = "/var/lib/ocsinventory-agent/reports";
+        tag = "MY_INVENTORY_TAG";
+      };
+    };
+  };
+
+  testScript = ''
+    path = "/var/lib/ocsinventory-agent/reports"
+
+    # Run the agent to generate the inventory file in offline mode
+    start_all()
+    machine.succeed("mkdir -p {}".format(path))
+    machine.wait_for_unit("ocsinventory-agent.service")
+    machine.wait_until_succeeds("journalctl -u ocsinventory-agent.service | grep 'Inventory saved in'")
+
+    # Fetch the path to the generated inventory file
+    report_file = machine.succeed("find {}/*.ocs -type f | head -n1".format(path))
+
+    with subtest("Check the tag value"):
+      tag = machine.succeed(
+        "${pkgs.libxml2}/bin/xmllint --xpath 'string(/REQUEST/CONTENT/ACCOUNTINFO/KEYVALUE)' {}".format(report_file)
+      ).rstrip()
+      assert tag == "MY_INVENTORY_TAG", f"tag is not valid, was '{tag}'"
+  '';
+})

nixos/tests/prometheus.nix

@@ -3,6 +3,7 @@ let
   queryPort  =  9090;
   minioPort  =  9000;
   pushgwPort =  9091;
+  frontPort  =  9092;
 
   s3 = {
     accessKey = "BKIKJAA5BMMU2RHO6IBB";
@@ -152,10 +153,15 @@ in import ./make-test-python.nix {
       services.thanos.query = {
         enable = true;
         http-address = "0.0.0.0:${toString queryPort}";
-        store.addresses = [
+        endpoints = [
           "prometheus:${toString grpcPort}"
         ];
       };
+      services.thanos.query-frontend = {
+        enable = true;
+        http-address = "0.0.0.0:${toString frontPort}";
+        query-frontend.downstream-url = "http://127.0.0.1:${toString queryPort}";
+      };
     };
 
     store = { pkgs, ... }: {
@@ -178,7 +184,7 @@ in import ./make-test-python.nix {
       services.thanos.query = {
         enable = true;
         http-address = "0.0.0.0:${toString queryPort}";
-        store.addresses = [
+        endpoints = [
           "localhost:${toString grpcPort}"
         ];
       };
@@ -262,6 +268,10 @@ in import ./make-test-python.nix {
     query.wait_for_unit("thanos-query.service")
     wait_for_metric(query)
 
+    # Test Thanos query frontend service
+    query.wait_for_unit("thanos-query-frontend.service")
+    query.succeed("curl -sS http://localhost:${toString frontPort}/-/healthy")
+
     # Test if the Thanos sidecar has correctly uploaded its TSDB to S3, if the
     # Thanos storage service has correctly downloaded it from S3 and if the Thanos
     # query service running on $store can correctly retrieve the metric:

pkgs/applications/audio/go-musicfox/default.nix

@@ -9,13 +9,13 @@
 
 buildGo121Module rec {
   pname = "go-musicfox";
-  version = "4.2.1";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "go-musicfox";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-yl7PirSt4zEy8ZoDGq3dn5TjJtbJeAgXgbynw/D0d38=";
+    hash = "sha256-JDR3D3tILT0q9jqcZmbfQC3yn7cmaSL/GEpCguqCFXI=";
   };
 
   deleteVendor = true;

pkgs/applications/audio/magnetophonDSP/VoiceOfFaust/default.nix

@@ -1,13 +1,13 @@
-{ lib, stdenv, fetchFromGitHub, faust2jack, faust2lv2, helmholtz, mrpeach, puredata-with-plugins }:
+{ lib, stdenv, fetchFromGitHub, faust2jack, faust2lv2, helmholtz, mrpeach, puredata-with-plugins, jack-example-tools }:
 stdenv.mkDerivation rec {
   pname = "VoiceOfFaust";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "magnetophon";
     repo = "VoiceOfFaust";
-    rev = "V${version}";
+    rev = version;
-    sha256 = "0la9b806qwrlsxgbir7n1db8v3w24wmd6k43p6qpr1fjjpkhrrgw";
+    sha256 = "sha256-vB8+ymvNuuovFXwOJ3BTIj5mGzCGa1+yhYs4nWMYIxU=";
   };
 
   plugins = [ helmholtz mrpeach ];
@@ -16,35 +16,18 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ faust2jack faust2lv2 ];
 
-  runtimeInputs = [ pitchTracker ];
+  enableParallelBuilding = true;
 
   dontWrapQtApps = true;
 
+  makeFlags = [
+    "PREFIX=$(out)"
+  ];
+
   patchPhase = ''
     sed -i "s@pd -nodac@${pitchTracker}/bin/pd -nodac@g" launchers/synthWrapper
-    sed -i "s@../PureData/OscSendVoc.pd@$out/PureData/OscSendVoc.pd@g" launchers/pitchTracker
+    sed -i "s@jack_connect@${jack-example-tools}/bin/jack_connect@g" launchers/synthWrapper
-  '';
+    sed -i "s@../PureData/OscSendVoc.pd@$out/bin/PureData/OscSendVoc.pd@g" launchers/pitchTracker
-
-  buildPhase = ''
-    sh install.sh
-    # so it doesn;t end up in /bin/ :
-    rm -f install.sh
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-
-    for f in $(find . -executable -type f); do
-      cp $f $out/bin/
-    done
-
-    cp launchers/* $out/bin/
-    mkdir $out/PureData/
-    # cp PureData/OscSendVoc.pd $out/PureData/OscSendVoc.pd
-    cp PureData/* $out/PureData/
-
-    mkdir -p $out/lib/lv2
-    cp -r *.lv2/ $out/lib/lv2
   '';
 
   meta = {

pkgs/applications/blockchains/go-ethereum/default.nix

@@ -9,16 +9,16 @@ let
 
 in buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.13.4";
+  version = "1.13.5";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RQlWWHoij3gtFwjJeEGsmd5YJNTGX0I84nOAQyWBx/M=";
+    sha256 = "sha256-UbRsY9fSUYAwPcLfGGDHeqvSsLKUKR+2a93jH5xA9uQ=";
   };
 
-  vendorHash = "sha256-YmUgKO3JtVOE/YACqL/QBiyR1jT/jPCH+Gb0xYwkJEc=";
+  vendorHash = "sha256-dOvpOCMxxmcAaticSLVlro1L4crAVJWyvgx/JZZ7buE=";
 
   doCheck = false;
 

pkgs/applications/editors/android-studio/default.nix

@@ -10,16 +10,16 @@ let
     inherit tiling_wm;
   };
   stableVersion = {
-    version = "2022.3.1.19"; # "Android Studio Giraffe (2022.3.1)"
+    version = "2022.3.1.20"; # "Android Studio Giraffe (2022.3.1) Patch 2"
-    sha256Hash = "sha256-JQYl3KsYPgxo6/Eu+KUir3NpUn128e/HBPk8BbAv+p4=";
+    sha256Hash = "sha256-IkxOt6DI4cBPUOztEBNJV0DHGruJjVdJ0skxcue+rdg=";
   };
   betaVersion = {
-    version = "2023.1.1.17"; # "Android Studio Hedgehog (2023.3.1)"
+    version = "2023.1.1.25"; # "Android Studio Hedgehog | 2023.1.1 RC 3"
-    sha256Hash = "sha256-0sN+B1RxxlbgxXrEs8gft4qjvIYtazJS6DllHZ2h768=";
+    sha256Hash = "sha256-jOqTAHYAk8j9+Ir01TLBsp20u7/iBKV8T/joZLITDs4=";
   };
   latestVersion = {
-    version = "2023.2.1.1"; # Android Studio Iguana (2023.2.1) Canary 1
+    version = "2023.2.1.14"; # "Android Studio Iguana | 2023.2.1 Canary 14"
-    sha256Hash = "sha256-7ub9GkJd9J37nG2drXOuU7r4w/gI+m9nlWANqIk2ddk=";
+    sha256Hash = "sha256-8szERftch1JWJ66BclJBq5DZcH1Xf1cyVj08WknLoS8=";
   };
 in {
   # Attributes are named by their corresponding release channels

pkgs/applications/editors/emacs/elisp-packages/elpa-devel-generated.nix

@@ -654,10 +654,10 @@
       elpaBuild {
         pname = "bufferlo";
         ename = "bufferlo";
-        version = "0.2.0.20231106.215852";
+        version = "0.3.0.20231111.144610";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/bufferlo-0.2.0.20231106.215852.tar";
+          url = "https://elpa.gnu.org/devel/bufferlo-0.3.0.20231111.144610.tar";
-          sha256 = "17qjjifdl3y8p4ldzami9b3ns9mzzqdacvkzsryv5885hzas67zz";
+          sha256 = "02vsgmfn7z4772dgfy9laraqrslzz7nqdaibzpj5qx2k0gxrh0nb";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -920,14 +920,17 @@
           license = lib.licenses.free;
         };
       }) {};
-    company = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+    company = callPackage ({ elpaBuild
+                           , emacs
+                           , fetchurl
+                           , lib }:
       elpaBuild {
         pname = "company";
         ename = "company";
-        version = "0.10.2.0.20231110.5234";
+        version = "0.10.2.0.20231115.182802";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/company-0.10.2.0.20231110.5234.tar";
+          url = "https://elpa.gnu.org/devel/company-0.10.2.0.20231115.182802.tar";
-          sha256 = "18533dlk7k77if51kjhwlf2yb872ixjf1cffg197bnfy29sdrm11";
+          sha256 = "0l18qi7m8anawl466xd7r3i3cjvhqprhwzclpw92x7hzgnjv73nl";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1000,10 +1003,10 @@
       elpaBuild {
         pname = "compat";
         ename = "compat";
-        version = "29.1.4.3.0.20231107.184238";
+        version = "29.1.4.4.0.20231113.72021";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/compat-29.1.4.3.0.20231107.184238.tar";
+          url = "https://elpa.gnu.org/devel/compat-29.1.4.4.0.20231113.72021.tar";
-          sha256 = "1mcfx5my48zr14syzmpidgr1kjji2v63sqmx3zh7spxxd274yviq";
+          sha256 = "0w6dy2356k1k0g4kbr81wv431fb9by03nc7rdgwnsyq4cs3dd46s";
         };
         packageRequires = [ emacs seq ];
         meta = {
@@ -1015,10 +1018,10 @@
       elpaBuild {
         pname = "consult";
         ename = "consult";
-        version = "0.35.0.20231107.212252";
+        version = "0.35.0.20231115.174657";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/consult-0.35.0.20231107.212252.tar";
+          url = "https://elpa.gnu.org/devel/consult-0.35.0.20231115.174657.tar";
-          sha256 = "1p9l79sxxa06cxky5z08mccf34hbbp742iza57riknf0zmrglkpc";
+          sha256 = "0j8kj3d2svqns4z2pp18rc6x9blfz0w41r73934wdjxw2fri9wbd";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -1067,10 +1070,10 @@
       elpaBuild {
         pname = "corfu";
         ename = "corfu";
-        version = "0.38.0.20231108.174629";
+        version = "0.38.0.20231112.81933";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/corfu-0.38.0.20231108.174629.tar";
+          url = "https://elpa.gnu.org/devel/corfu-0.38.0.20231112.81933.tar";
-          sha256 = "1ynkyw7mkl8y66kxwy51gwdj60b4nadk9qbwsjljbfdnc80y6ws5";
+          sha256 = "1zmd13qbdknw03l65fir3a4niq5lbacj28j5kqknka87f3lz4pd2";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -1332,10 +1335,10 @@
       elpaBuild {
         pname = "denote";
         ename = "denote";
-        version = "2.0.0.0.20231107.64253";
+        version = "2.1.0.0.20231115.111152";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/denote-2.0.0.0.20231107.64253.tar";
+          url = "https://elpa.gnu.org/devel/denote-2.1.0.0.20231115.111152.tar";
-          sha256 = "143pgnsfi3mf42n1yrwjr79b32k0081i19zdkwg97xhvfbqhiddw";
+          sha256 = "0mp57k3z1gyc21lj010yi9nb3qpqd6yirysf9ljcy9h5bxnqafmh";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1491,10 +1494,10 @@
       elpaBuild {
         pname = "dired-duplicates";
         ename = "dired-duplicates";
-        version = "0.2.0.20231109.135341";
+        version = "0.3.0.20231114.215046";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/dired-duplicates-0.2.0.20231109.135341.tar";
+          url = "https://elpa.gnu.org/devel/dired-duplicates-0.3.0.20231114.215046.tar";
-          sha256 = "07ridbcy3n0v3dax7kj3d7nk2k0w57dnapd4kki4xhkm4fklx6w6";
+          sha256 = "0rla938sj1zig7qcdxybl7qm4x1b0ndpf9xf9ikj0vfdghyg7z2s";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1634,6 +1637,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    drepl = callPackage ({ comint-mime, elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "drepl";
+        ename = "drepl";
+        version = "0.1.0.20231112.180047";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/devel/drepl-0.1.0.20231112.180047.tar";
+          sha256 = "09s55hfy11y7v1d2l6nggz8b27mrsvqabb5xwpipnnynkmif2q2q";
+        };
+        packageRequires = [ comint-mime emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/drepl.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     dts-mode = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "dts-mode";
@@ -1800,10 +1818,10 @@
       elpaBuild {
         pname = "eglot";
         ename = "eglot";
-        version = "1.15.0.20231107.90944";
+        version = "1.15.0.20231115.41203";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/eglot-1.15.0.20231107.90944.tar";
+          url = "https://elpa.gnu.org/devel/eglot-1.15.0.20231115.41203.tar";
-          sha256 = "135a3zyzjpv2n0c988b9g9mh93y7p1dp9nvmchm4i26mdmzn6jbz";
+          sha256 = "0xybf9czzkdpv94qsbmq725scmjjkm4gwn74ffa8r99a0i1w2nki";
         };
         packageRequires = [
           eldoc
@@ -1911,10 +1929,10 @@
       elpaBuild {
         pname = "embark";
         ename = "embark";
-        version = "0.23.0.20231104.193345";
+        version = "0.23.0.20231112.53804";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/embark-0.23.0.20231104.193345.tar";
+          url = "https://elpa.gnu.org/devel/embark-0.23.0.20231112.53804.tar";
-          sha256 = "10qny8wp74np12sczz08gfrxspvapwvz2zkdig76wcrpd4kdpjk4";
+          sha256 = "056kgr14msd6fhzwpdazzaxzmn65wm6qp59z22l5ykpr8awl4jxi";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -1931,10 +1949,10 @@
       elpaBuild {
         pname = "embark-consult";
         ename = "embark-consult";
-        version = "0.8.0.20231104.193345";
+        version = "0.8.0.20231112.53804";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/embark-consult-0.8.0.20231104.193345.tar";
+          url = "https://elpa.gnu.org/devel/embark-consult-0.8.0.20231112.53804.tar";
-          sha256 = "15syrabv26yq69g2lz2dqs8w4drw1v3whr0h2vzmc1p0pv9jpks2";
+          sha256 = "1fxk8hfid2ii912can7b1gp8fzkq31y1cfi53n9mw6p0nj26c1fh";
         };
         packageRequires = [ consult emacs embark ];
         meta = {
@@ -1956,10 +1974,10 @@
       elpaBuild {
         pname = "ement";
         ename = "ement";
-        version = "0.14pre0.20231029.40923";
+        version = "0.14pre0.20231111.212243";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/ement-0.14pre0.20231029.40923.tar";
+          url = "https://elpa.gnu.org/devel/ement-0.14pre0.20231111.212243.tar";
-          sha256 = "06r0s8dxlxr63a1zgdk0qxzd6x27r6mlymi6hxp8923yvwqddkdf";
+          sha256 = "13xd7m5pigfvqnrxqr40dg9139djb0m9l3p7scvi0fi05247kf5l";
         };
         packageRequires = [
           emacs
@@ -1985,10 +2003,10 @@
       elpaBuild {
         pname = "emms";
         ename = "emms";
-        version = "16.0.20231106.173540";
+        version = "16.0.20231110.185602";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/emms-16.0.20231106.173540.tar";
+          url = "https://elpa.gnu.org/devel/emms-16.0.20231110.185602.tar";
-          sha256 = "08l7nzz596jwqr4wcjcvsihdhai4faqihavrshvja2nhrdxxm79x";
+          sha256 = "114dsyncfcgrxjypf475n5kabcmm08szq4sa2grqv5gcm9l63qwr";
         };
         packageRequires = [ cl-lib nadvice seq ];
         meta = {
@@ -2054,10 +2072,10 @@
       elpaBuild {
         pname = "erc";
         ename = "erc";
-        version = "5.6snapshot0.20231104.154155";
+        version = "5.6snapshot0.20231112.203749";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/erc-5.6snapshot0.20231104.154155.tar";
+          url = "https://elpa.gnu.org/devel/erc-5.6snapshot0.20231112.203749.tar";
-          sha256 = "0z22cw6hgn4lsc1bp4ci75v03mvlra1nyfj8g7xkfdv75nbv2yga";
+          sha256 = "1zag35hnzc72gbjr00ljfz803z8rmz8qhyxxvcxaia769vhmh5j8";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -2633,10 +2651,10 @@
       elpaBuild {
         pname = "gpr-mode";
         ename = "gpr-mode";
-        version = "1.0.4.0.20231015.114428";
+        version = "1.0.5.0.20231115.90848";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/gpr-mode-1.0.4.0.20231015.114428.tar";
+          url = "https://elpa.gnu.org/devel/gpr-mode-1.0.5.0.20231115.90848.tar";
-          sha256 = "1y3571ymlrgiq5jxbwlyw43pmfxgq776pajb9hlvyz9l3w195c8g";
+          sha256 = "1z7v8kwamh217k0lfwcdycj4wnq4dj9lrryppqhjdqb7cj02bmdz";
         };
         packageRequires = [ emacs gnat-compiler wisi ];
         meta = {
@@ -2683,10 +2701,10 @@
       elpaBuild {
         pname = "greader";
         ename = "greader";
-        version = "0.6.0.0.20231104.45848";
+        version = "0.6.0.0.20231113.71128";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/greader-0.6.0.0.20231104.45848.tar";
+          url = "https://elpa.gnu.org/devel/greader-0.6.0.0.20231113.71128.tar";
-          sha256 = "1ppvgi17agzrsjfd9jaa5zszvqcm1n4rfy7z82da4rl5mbgnml9p";
+          sha256 = "19aj5bp72ic2j9fv4lygnpj01bl89ifcw4s75lqasff60mlv0320";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3113,10 +3131,10 @@
       elpaBuild {
         pname = "jinx";
         ename = "jinx";
-        version = "0.9.0.20231104.142700";
+        version = "0.9.0.20231111.85046";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/jinx-0.9.0.20231104.142700.tar";
+          url = "https://elpa.gnu.org/devel/jinx-0.9.0.20231111.85046.tar";
-          sha256 = "16qq42qmklyls2fc482x2pv1l14x3kn78l41imvg8jrv3z64j89p";
+          sha256 = "1dp2sclzrr5918n2zjzyxhxcf3sd393a3a4xr4c8wdi2wdpmn1vs";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -3720,10 +3738,10 @@
       elpaBuild {
         pname = "modus-themes";
         ename = "modus-themes";
-        version = "4.3.0.0.20231031.71656";
+        version = "4.3.0.0.20231115.130235";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/modus-themes-4.3.0.0.20231031.71656.tar";
+          url = "https://elpa.gnu.org/devel/modus-themes-4.3.0.0.20231115.130235.tar";
-          sha256 = "04hjhg596qfkrnll0wrg4f50ilns28jpf2ws7021wivr370xajki";
+          sha256 = "025iqd3c9kwrv1hwdr1szp1cl23bkf1vahad6nhx00x351rxv0r0";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -4139,10 +4157,10 @@
       elpaBuild {
         pname = "orderless";
         ename = "orderless";
-        version = "1.0.0.20231107.210315";
+        version = "1.0.0.20231110.144817";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/orderless-1.0.0.20231107.210315.tar";
+          url = "https://elpa.gnu.org/devel/orderless-1.0.0.20231110.144817.tar";
-          sha256 = "0j5fkmw4qy40ab2c6d0mf6637s8q95gi3sp7w477d6ymck5i2ck8";
+          sha256 = "0cfspqc7livr0m3s021gp2cl74qnv1pvyxba83af0088nb9z0aqz";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -4154,10 +4172,10 @@
       elpaBuild {
         pname = "org";
         ename = "org";
-        version = "9.7pre0.20231108.95550";
+        version = "9.7pre0.20231115.92033";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/org-9.7pre0.20231108.95550.tar";
+          url = "https://elpa.gnu.org/devel/org-9.7pre0.20231115.92033.tar";
-          sha256 = "01dk4sq5wfiwj9g5bfriqqkfrgdfy3c7kixd7y4cf9k6pbjl4sfp";
+          sha256 = "18sbwnw57xp9ss78f3xva3jysdvzk0lcppr2g4qgb696fkglp6w1";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -4773,10 +4791,10 @@
       elpaBuild {
         pname = "pulsar";
         ename = "pulsar";
-        version = "1.0.1.0.20231101.62313";
+        version = "1.0.1.0.20231115.55251";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/pulsar-1.0.1.0.20231101.62313.tar";
+          url = "https://elpa.gnu.org/devel/pulsar-1.0.1.0.20231115.55251.tar";
-          sha256 = "10k57sd29hkbja85sn5yf7wm0g5wyk216ykdjl4vr03891ic03dg";
+          sha256 = "15pvf6f0g423w3vi86l8djxvzzrvziml7rlqp314xskp8kz7w6g6";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -4940,10 +4958,10 @@
       elpaBuild {
         pname = "realgud";
         ename = "realgud";
-        version = "1.5.1.0.20231020.222710";
+        version = "1.5.1.0.20231113.141045";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/realgud-1.5.1.0.20231020.222710.tar";
+          url = "https://elpa.gnu.org/devel/realgud-1.5.1.0.20231113.141045.tar";
-          sha256 = "0lmq7x7x8cm6y8vp2gin1h6h7chkflj5fyzls4b61rh15yg8m1h0";
+          sha256 = "1lidmlrsg0jax0mmsxgpjk70x4i4vhiv5ira744rj7m3w0mwgmrw";
         };
         packageRequires = [ emacs load-relative loc-changes test-simple ];
         meta = {
@@ -5621,10 +5639,10 @@
       elpaBuild {
         pname = "spacious-padding";
         ename = "spacious-padding";
-        version = "0.1.0.0.20230606.175440";
+        version = "0.1.0.0.20231115.114712";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/spacious-padding-0.1.0.0.20230606.175440.tar";
+          url = "https://elpa.gnu.org/devel/spacious-padding-0.1.0.0.20231115.114712.tar";
-          sha256 = "01541k8j5g920vnj3ds6ancqyi36n6ak00g4rq5vc6ia1ybxiijh";
+          sha256 = "1why1wwbpasmag8czsgb65f8gkqjcg5hckgmk9106ml834krhhx5";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -5719,10 +5737,10 @@
       elpaBuild {
         pname = "srht";
         ename = "srht";
-        version = "0.3.0.20231103.213748";
+        version = "0.3.0.20231114.102408";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/srht-0.3.0.20231103.213748.tar";
+          url = "https://elpa.gnu.org/devel/srht-0.3.0.20231114.102408.tar";
-          sha256 = "1nr6faizww1nzv5lpdikbqxkc6i1hswg2qa50cybl05ycqq9b10a";
+          sha256 = "0s5xa8vqb6wzxmv3vx8cc8lkpnnkfzdjljra7lz105m3v2adz1a0";
         };
         packageRequires = [ emacs plz ];
         meta = {
@@ -6042,10 +6060,10 @@
       elpaBuild {
         pname = "tempel";
         ename = "tempel";
-        version = "0.8.0.20231106.72513";
+        version = "0.8.0.20231111.112832";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/tempel-0.8.0.20231106.72513.tar";
+          url = "https://elpa.gnu.org/devel/tempel-0.8.0.20231111.112832.tar";
-          sha256 = "1pbw7wrhz5h1xykbc1ihhpzqc0kki6k637wagx8yfz95n606808d";
+          sha256 = "1gd4dvill1vvdncibjfv7vl1rxlkhcq2nfppczyp2sr565fgcb0c";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -6230,10 +6248,10 @@
       elpaBuild {
         pname = "transient";
         ename = "transient";
-        version = "0.4.3.0.20231027.212124";
+        version = "0.4.3.0.20231112.92348";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/transient-0.4.3.0.20231027.212124.tar";
+          url = "https://elpa.gnu.org/devel/transient-0.4.3.0.20231112.92348.tar";
-          sha256 = "0rzc5ks0b9nlnvggj7hn9648y5siw9qjpg8n3swlmkb68m3b2c05";
+          sha256 = "01yvwx8psllys34fry1vp2h7w3jll8kcrglsri8p2d3bps45pn14";
         };
         packageRequires = [ compat emacs seq ];
         meta = {
@@ -6408,10 +6426,10 @@
       elpaBuild {
         pname = "urgrep";
         ename = "urgrep";
-        version = "0.3.0snapshot0.20231101.193012";
+        version = "0.3.0snapshot0.20231110.152111";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/urgrep-0.3.0snapshot0.20231101.193012.tar";
+          url = "https://elpa.gnu.org/devel/urgrep-0.3.0snapshot0.20231110.152111.tar";
-          sha256 = "12hmms0yr0vybayvzkbqbp5j428lsnirzwg93f1l8m05xxs3xm9w";
+          sha256 = "15vbi4vjqr9kz1q1525snl5pz35mgbzrjkysl7gm4zpj6s6qcbar";
         };
         packageRequires = [ compat emacs project ];
         meta = {
@@ -6643,10 +6661,10 @@
       elpaBuild {
         pname = "vertico";
         ename = "vertico";
-        version = "1.4.0.20231108.202420";
+        version = "1.4.0.20231115.164627";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/vertico-1.4.0.20231108.202420.tar";
+          url = "https://elpa.gnu.org/devel/vertico-1.4.0.20231115.164627.tar";
-          sha256 = "1c34pq5l7ckjlyimpa528d8a7q5pakz3li5bc4ka86mwf861kd7v";
+          sha256 = "1rb2lvk2h7qxddws53n0qp5mg71b6gy94rdqy6nz77f1p3rrxqwf";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -6663,10 +6681,10 @@
       elpaBuild {
         pname = "vertico-posframe";
         ename = "vertico-posframe";
-        version = "0.7.3.0.20230818.15224";
+        version = "0.7.3.0.20231115.51213";
         src = fetchurl {
-          url = "https://elpa.gnu.org/devel/vertico-posframe-0.7.3.0.20230818.15224.tar";
+          url = "https://elpa.gnu.org/devel/vertico-posframe-0.7.3.0.20231115.51213.tar";
-          sha256 = "0q23yw8dy9abawqlcpwjrk668kvxyffv972j0s6579z37i643gv6";
+          sha256 = "1ymjcby120181rfl353kdx1i4jpg5vb6vrag5775bknr3ijjqax9";
         };
         packageRequires = [ emacs posframe vertico ];
         meta = {

pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix

@@ -569,10 +569,10 @@
       elpaBuild {
         pname = "bufferlo";
         ename = "bufferlo";
-        version = "0.2";
+        version = "0.3";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/bufferlo-0.2.tar";
+          url = "https://elpa.gnu.org/packages/bufferlo-0.3.tar";
-          sha256 = "1dvpzxlnzs037wz9xhiwiz2qrc7r2i05z6p6p0sy8i4kb6scc6gy";
+          sha256 = "16fj1wiqymyys0wjnbmmfwpvqxnm3mlqfrg7nrsryfgpv2mv9z17";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -877,10 +877,10 @@
       elpaBuild {
         pname = "compat";
         ename = "compat";
-        version = "29.1.4.3";
+        version = "29.1.4.4";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/compat-29.1.4.3.tar";
+          url = "https://elpa.gnu.org/packages/compat-29.1.4.4.tar";
-          sha256 = "08lg6jph1hqkamf1fhm5ajwy4klh2a2260llr1z7wlbbq52032k5";
+          sha256 = "0710g552b1nznnfx2774gmg6yizs27s0bakqm95nsjrp6kgznbfr";
         };
         packageRequires = [ emacs seq ];
         meta = {
@@ -1177,10 +1177,10 @@
       elpaBuild {
         pname = "denote";
         ename = "denote";
-        version = "2.0.0";
+        version = "2.1.0";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/denote-2.0.0.tar";
+          url = "https://elpa.gnu.org/packages/denote-2.1.0.tar";
-          sha256 = "1wrfbirkzf9szss1rgpmgdr0gy2dvhnbzlnyhw3sp2jvw5sb1xz9";
+          sha256 = "1igp9h327b9x3fxrp34bz0x5slk659r3asjdia3jm8amajm4bw6s";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1318,10 +1318,10 @@
       elpaBuild {
         pname = "dired-duplicates";
         ename = "dired-duplicates";
-        version = "0.2";
+        version = "0.3";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/dired-duplicates-0.2.tar";
+          url = "https://elpa.gnu.org/packages/dired-duplicates-0.3.tar";
-          sha256 = "1n5n961f1mrvcqfrz56734qj1ynajdjblyf4y60pw9m3fn03db4s";
+          sha256 = "1b9drjkbs9anqil274jrn031agpkir9mhs96l2ylm13n8imx9msl";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1449,6 +1449,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    drepl = callPackage ({ comint-mime, elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "drepl";
+        ename = "drepl";
+        version = "0.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/drepl-0.1.tar";
+          sha256 = "0lx94kcxgp8s13w7hz9857r9baqfswvj7vc9frjq4crc4ps7fi7r";
+        };
+        packageRequires = [ comint-mime emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/drepl.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     dts-mode = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "dts-mode";
@@ -2357,10 +2372,10 @@
       elpaBuild {
         pname = "gpr-mode";
         ename = "gpr-mode";
-        version = "1.0.4";
+        version = "1.0.5";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/gpr-mode-1.0.4.tar";
+          url = "https://elpa.gnu.org/packages/gpr-mode-1.0.5.tar";
-          sha256 = "1c97m28i6lym07kb05jgssjxj6p9v3v56qrn48xwv55sriqrha4l";
+          sha256 = "1ksafa4nfd4n1kdxpjk6i59l5rxfdmcqjkkpmmc8w402xka0vwn4";
         };
         packageRequires = [ emacs gnat-compiler wisi ];
         meta = {
@@ -3753,10 +3768,10 @@
       elpaBuild {
         pname = "org";
         ename = "org";
-        version = "9.6.11";
+        version = "9.6.12";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-9.6.11.tar";
+          url = "https://elpa.gnu.org/packages/org-9.6.12.tar";
-          sha256 = "18hp5jx90wn9xsg8frql3r1kmn2q9qph6plcssj64fp34wcwxsd8";
+          sha256 = "0qkq7vx3kga18001clsac4rbg9bw5cp9k5qnixw7s39xajd4bcv3";
         };
         packageRequires = [ emacs ];
         meta = {

pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix

@@ -361,10 +361,10 @@
       elpaBuild {
         pname = "cider";
         ename = "cider";
-        version = "1.11.0";
+        version = "1.11.1";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/cider-1.11.0.tar";
+          url = "https://elpa.nongnu.org/nongnu/cider-1.11.1.tar";
-          sha256 = "010sl2l9vx3k095bkgvi7w1zvb68jh7lj4plmjn98lmzmbhq7q27";
+          sha256 = "1zp24p67w9wcc26s0b95idvzy1ndk35a8rabj3ckg1sgddgzh0p6";
         };
         packageRequires = [
           clojure-mode
@@ -1534,10 +1534,10 @@
       elpaBuild {
         pname = "haskell-mode";
         ename = "haskell-mode";
-        version = "17.4";
+        version = "17.5";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/haskell-mode-17.4.tar";
+          url = "https://elpa.nongnu.org/nongnu/haskell-mode-17.5.tar";
-          sha256 = "0xf8smasbb53ddg4vxckpg5w48dnm16v2k5vimfqr73cig49z87f";
+          sha256 = "0ld9wjak3fzwi9w2552fzq1562h7g19q69pigp16rj30smp5gkj7";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2375,10 +2375,10 @@
       elpaBuild {
         pname = "package-lint";
         ename = "package-lint";
-        version = "0.20";
+        version = "0.21";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/package-lint-0.20.tar";
+          url = "https://elpa.nongnu.org/nongnu/package-lint-0.21.tar";
-          sha256 = "13ff9g2lzcddi8n6bcmb7g93kxc8v9h3g9k8qcn42bl7jjy12iqf";
+          sha256 = "01yli62vcnh763pf1bp0f649hhrbl8y7ad89q7b98xgcciqgzm93";
         };
         packageRequires = [ cl-lib compat emacs let-alist ];
         meta = {
@@ -2608,10 +2608,10 @@
       elpaBuild {
         pname = "racket-mode";
         ename = "racket-mode";
-        version = "1.0.20231109.110741";
+        version = "1.0.20231115.104415";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20231109.110741.tar";
+          url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20231115.104415.tar";
-          sha256 = "19d1bs0ajc28wa49f1mphdwrpfywib5cvv3mxip6az9x6faand7g";
+          sha256 = "01ihh66c20c2dv6apswgww8wxwn1ldqhpk70mfbgjipc9a7ykwws";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2987,10 +2987,10 @@
       elpaBuild {
         pname = "subed";
         ename = "subed";
-        version = "1.2.6";
+        version = "1.2.7";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/subed-1.2.6.tar";
+          url = "https://elpa.nongnu.org/nongnu/subed-1.2.7.tar";
-          sha256 = "005nzmv5i24wxwhs1l76fpk06rpf8bw19fccrqkiph5k77lg42gr";
+          sha256 = "1rvc17pvig3ihc74d7i25kl3lnigp0h8lh634x0676hdx38h91ib";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3002,10 +3002,10 @@
       elpaBuild {
         pname = "sweeprolog";
         ename = "sweeprolog";
-        version = "0.26.2";
+        version = "0.27.0";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/sweeprolog-0.26.2.tar";
+          url = "https://elpa.nongnu.org/nongnu/sweeprolog-0.27.0.tar";
-          sha256 = "14rcg6rs4dd4a0pr4makkg1flwxfrxyg5xrs5sa034bzxj6zqal5";
+          sha256 = "1r0qspi9qdnsa4gm9bmxzsjyalqi14jhjx96jqw725pmhvjy9933";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -3471,10 +3471,10 @@
       elpaBuild {
         pname = "xah-fly-keys";
         ename = "xah-fly-keys";
-        version = "24.15.20231105091131";
+        version = "24.18.20231115084756";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-24.15.20231105091131.tar";
+          url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-24.18.20231115084756.tar";
-          sha256 = "13wvf6zn87xpglpycxmjmq6mfvpr21bsihsshx06my38832kw128";
+          sha256 = "1vj8l4g4hpdvs1yvgkcy79vbf2ibhwxfgcrg1mj26qj3f9naf25s";
         };
         packageRequires = [ emacs ];
         meta = {

pkgs/applications/editors/quartus-prime/default.nix

@@ -28,6 +28,7 @@ in buildFHSEnv rec {
     xorg.libICE
     xorg.libSM
     zlib
+    libudev0-shim
     # qsys requirements
     xorg.libXtst
     xorg.libXi
@@ -53,7 +54,6 @@ in buildFHSEnv rec {
     xorg.libX11
     xorg.libXext
     xorg.libXrender
-    libudev0-shim
     libxcrypt-legacy
   ];
 
@@ -95,7 +95,6 @@ in buildFHSEnv rec {
     # LD_PRELOAD fixes issues in the licensing system that cause memory corruption and crashes when
     # starting most operations in many containerized environments, including WSL2, Docker, and LXC
     # (a similiar fix involving LD_PRELOADing tcmalloc did not solve the issue in my situation)
-    # we use the name so that quartus can load the 64 bit verson and modelsim can load the 32 bit version
     # https://community.intel.com/t5/Intel-FPGA-Software-Installation/Running-Quartus-Prime-Standard-on-WSL-crashes-in-libudev-so/m-p/1189032
     #
     # But, as can be seen in the above resource, LD_PRELOADing libudev breaks
@@ -103,7 +102,7 @@ in buildFHSEnv rec {
     # `(vlog-2163) Macro `<protected> is undefined.`), so only use LD_PRELOAD
     # for non-ModelSim wrappers.
     if [ "$NIXPKGS_IS_MODELSIM_WRAPPER" != 1 ]; then
-        export LD_PRELOAD=''${LD_PRELOAD:+$LD_PRELOAD:}libudev.so.0
+        export LD_PRELOAD=''${LD_PRELOAD:+$LD_PRELOAD:}/usr/lib/libudev.so.0
     fi
   '';
 

pkgs/applications/editors/vscode/extensions/default.nix

@@ -20,6 +20,7 @@
 , millet
 , shfmt
 , typst-lsp
+, typst-preview
 , autoPatchelfHook
 , zlib
 , stdenv
@@ -2297,37 +2298,26 @@ let
         };
       };
 
+      # Keep pkgs/tools/typesetting/typst-preview/default.nix in sync with this
+      # extension
       mgt19937.typst-preview = buildVscodeMarketplaceExtension {
-        mktplcRef =
+        mktplcRef = {
-        let
-          sources = {
-            "x86_64-linux" = {
-              arch = "linux-x64";
-              sha256 = "sha256-O8sFv23tlhJS6N8LRKkHcTJTupZejCLDRdVVCdDlWbA=";
-            };
-            "x86_64-darwin" = {
-              arch = "darwin-x64";
-              sha256 = "1npzjch67agswh3nm14dbbsx777daq2rdw1yny10jf3858z2qynr";
-            };
-            "aarch64-linux" = {
-              arch = "linux-arm64";
-              sha256 = "1vv1jfgnyjbmshh4w6rf496d9dpdsk3f0049ii4d9vi23igk4xpk";
-            };
-            "aarch64-darwin" = {
-              arch = "darwin-arm64";
-              sha256 = "0dfchzqm61kddq20zvp1pcpk1625b9wgj32ymc08piq06pbadk29";
-            };
-          };
-        in
-        {
           name = "typst-preview";
           publisher = "mgt19937";
-          version = "0.6.1";
+          version = "0.9.1";
-        } // sources.${stdenv.system};
+          sha256 = "sha256-GHD/i+QOnItGEYG0bl/pVl+a4Dvn7SHhICJ14VfqMjE=";
+        };
 
-        nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
+        buildInputs = [
+          typst-preview
+        ];
 
-        buildInputs = lib.optionals stdenv.isLinux [ stdenv.cc.cc.lib ];
+        nativeBuildInputs = [ jq moreutils ];
+
+        postInstall = ''
+          cd "$out/$installPrefix"
+          jq '.contributes.configuration.properties."typst-preview.executable".default = "${lib.getExe typst-preview}"' package.json | sponge package.json
+        '';
 
         meta = {
           description = "Typst Preview is an extension for previewing your Typst files in vscode instantly";
@@ -2745,7 +2735,6 @@ let
         };
       };
 
-
       nvarner.typst-lsp = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "typst-lsp";
@@ -2758,9 +2747,13 @@ let
 
         nativeBuildInputs = [ jq moreutils ];
 
+        buildInputs = [
+          typst-lsp
+        ];
+
         postInstall = ''
           cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."typst-lsp.serverPath".default = "${typst-lsp}/bin/typst-lsp"' package.json | sponge package.json
+          jq '.contributes.configuration.properties."typst-lsp.serverPath".default = "${lib.getExe typst-lsp}"' package.json | sponge package.json
         '';
 
         meta = {

pkgs/applications/graphics/vipsdisp/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vipsdisp";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "jcupitt";
     repo = "vipsdisp";
     rev = "v${version}";
-    hash = "sha256-iLjS3vBhdPPQNtIaM++xKekYTsr1X9f6ED2A7DYV7Lc=";
+    hash = "sha256-vY3BTbCLf3JOB+eILMvaFUIgG3UBkSdckFAdC4W0OnU=";
   };
 
   postPatch = ''

pkgs/applications/misc/clipqr/default.nix

@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "clipqr";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitLab {
     owner = "imatt-foss";
     repo = "clipqr";
     rev = "v${version}";
-    hash = "sha256-RIzOkJx1eSik+3N6rSh+3LY2VZmbzNYyV5wpLQHFU2A=";
+    hash = "sha256-OQ45GV+bViIejGC03lAuvw/y8v1itA+6pFC4H/qL744=";
   };
 
   vendorHash = null;

pkgs/applications/misc/gpxsee/default.nix

@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpxsee";
-  version = "13.10";
+  version = "13.11";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = finalAttrs.version;
-    hash = "sha256-84F4B2yQREPosH1bK74nOby3o/C0isKq4t2CJprsblU=";
+    hash = "sha256-EJpyWuOyUVb34F5Pg8KPF9R3f3VpvZVeg8WBZ1oGbbE=";
   };
 
   buildInputs = [

pkgs/applications/misc/typioca/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "typioca";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "bloznelis";
     repo = "typioca";
     rev = version;
-    hash = "sha256-m6vt4wpLpKJJNP8qCCeLMgNfAAZengDGjBVmFI5ZeSQ=";
+    hash = "sha256-PVyEvPktb2ortmPf1afk6vXmcp91Zei8BLwGkRazFGA=";
   };
 
-  vendorHash = "sha256-q22t4/eum/RSWyzVQfJ0VZkEHgBu12nyRgmkJffi7PM=";
+  vendorHash = "sha256-XiKn18WCbhVvsrIvTN/Yquj4mhq4n1X1jqdGUaMacV4=";
 
   ldflags = [
     "-s"

pkgs/applications/networking/browsers/firefox/common.nix

@@ -7,6 +7,8 @@
 , application ? "browser"
 , applicationName ? "Mozilla Firefox"
 , branding ? null
+, requireSigning ? true
+, allowAddonSideload ? false
 , src
 , unpackPhase ? null
 , extraPatches ? []
@@ -367,6 +369,8 @@ buildStdenv.mkDerivation {
     configureFlagsArray+=("--with-mozilla-api-keyfile=$TMPDIR/mls-api-key")
   '' + lib.optionalString (enableOfficialBranding && !stdenv.is32bit) ''
     export MOZILLA_OFFICIAL=1
+  '' + lib.optionalString (!requireSigning) ''
+    export MOZ_REQUIRE_SIGNING=
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     # linking firefox hits the vm.max_map_count kernel limit with the default musl allocator
     # TODO: Default vm.max_map_count has been increased, retest without this
@@ -408,6 +412,7 @@ buildStdenv.mkDerivation {
   # https://bugzilla.mozilla.org/show_bug.cgi?id=1482204
   ++ lib.optional (ltoSupport && (buildStdenv.isAarch32 || buildStdenv.isi686 || buildStdenv.isx86_64)) "--disable-elf-hack"
   ++ lib.optional (!drmSupport) "--disable-eme"
+  ++ lib.optional (allowAddonSideload) "--allow-addon-sideload"
   ++ [
     (enableFeature alsaSupport "alsa")
     (enableFeature crashreporterSupport "crashreporter")

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -56,10 +56,11 @@
     };
   };
 
-  firefox-devedition = (buildMozillaMach rec {
+  firefox-devedition = buildMozillaMach rec {
     pname = "firefox-devedition";
     version = "120.0b9";
     applicationName = "Mozilla Firefox Developer Edition";
+    requireSigning = false;
     branding = "browser/branding/aurora";
     src = fetchurl {
       url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
@@ -84,9 +85,7 @@
       versionSuffix = "b[0-9]*";
       baseUrl = "https://archive.mozilla.org/pub/devedition/releases/";
     };
-  }).overrideAttrs (prev: {
+  };
-    env.MOZ_REQUIRE_SIGNING = "";
-  });
 
   firefox-esr-115 = buildMozillaMach rec {
     pname = "firefox-esr-115";

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -115,18 +115,15 @@ let
 
       nameArray = builtins.map(a: a.name) (lib.optionals usesNixExtensions nixExtensions);
 
-      requiresSigning = browser ? MOZ_REQUIRE_SIGNING
-                     -> toString browser.MOZ_REQUIRE_SIGNING != "";
-
       # Check that every extension has a unqiue .name attribute
       # and an extid attribute
       extensions = if nameArray != (lib.unique nameArray) then
         throw "Firefox addon name needs to be unique"
-      else if requiresSigning && !lib.hasSuffix "esr" browser.name then
+      else if browser.requireSigning || !browser.allowAddonSideload then
-        throw "Nix addons are only supported without signature enforcement (eg. Firefox ESR)"
+        throw "Nix addons are only supported with signature enforcement disabled and addon sideloading enabled (eg. LibreWolf)"
       else builtins.map (a:
         if ! (builtins.hasAttr "extid" a) then
-        throw "nixExtensions has an invalid entry. Missing extid attribute. Please use fetchfirefoxaddon"
+        throw "nixExtensions has an invalid entry. Missing extid attribute. Please use fetchFirefoxAddon"
         else
         a
       ) (lib.optionals usesNixExtensions nixExtensions);

pkgs/applications/networking/browsers/librewolf/default.nix

@@ -3,12 +3,14 @@
 let
   librewolf-src = callPackage ./librewolf.nix { };
 in
-((buildMozillaMach rec {
+(buildMozillaMach rec {
   pname = "librewolf";
   applicationName = "LibreWolf";
   binaryName = "librewolf";
   version = librewolf-src.packageVersion;
   src = librewolf-src.firefox;
+  requireSigning = false;
+  allowAddonSideload = true;
   inherit (librewolf-src) extraConfigureFlags extraPatches extraPostPatch extraPassthru;
 
   meta = {
@@ -30,6 +32,4 @@ in
 }).override {
   crashreporterSupport = false;
   enableOfficialBranding = false;
-}).overrideAttrs (prev: {
+}
-  MOZ_REQUIRE_SIGNING = "";
-})

pkgs/applications/networking/cluster/argocd/default.nix

@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.8.5";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    hash = "sha256-oYREaXUm60AkWO/2X6Cu55F+gCaPYpYqRigJW0ocDL0=";
+    hash = "sha256-5oSuExdkP+69AJD5U74yLD4e+5pvbFOY6T9mcKnJ5Jw=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-KzH4GmOeurcEMIDN3B8QSMZY1Fk+tNqy0SYzCXiRVlo=";
+  vendorHash = "sha256-/MmcWusqgEe8KEJcEBOqOkv1lJb06R3TKYFk4wvdWHk=";
 
   # Set target as ./cmd per cli-local
   # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227

pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.53.2";
+  version = "0.53.4";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-nolZ660rU7WisQdufswrH5vqAedKlA3Y0AQMul/+sTo=";
+    hash = "sha256-UPbiqo0HvBEIAimugNa7WwqwPsLk8C2gS0KqfgFMGQU=";
   };
 
-  vendorHash = "sha256-1+ebqMqtil2/KrFjRIfCx60aWu8ByIFV1my8RiUrSNo=";
+  vendorHash = "sha256-h1rDXxvPhQfGUpxOmnksy3l8kMq93nxOQ9adJFyZnOY=";
 
   doCheck = false;
 

pkgs/applications/networking/p2p/transmission/4.nix

@@ -35,6 +35,7 @@
 , enableCli ? true
 , installLib ? false
 , apparmorRulesFromClosure
+, extraAppArmorPaths ? []
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -134,7 +135,8 @@ stdenv.mkDerivation (finalAttrs: {
       r @{PROC}/@{pid}/mounts,
       rwk /tmp/tr_session_id_*,
 
-      r $out/share/transmission/web/**,
+      r $out/share/transmission/public_html/**,
+      ${lib.strings.concatMapStrings (x: "r ${x},\n") extraAppArmorPaths}
 
       include <local/bin.transmission-daemon>
     }

pkgs/applications/office/onlyoffice-bin/7_5.nix

@@ -26,6 +26,7 @@
 , libdrm
 , makeWrapper
 , mesa
+, noto-fonts-cjk-sans
 , nspr
 , nss
 , pulseaudio
@@ -54,18 +55,6 @@ let
   # TODO: Find out which of these fonts we'd be allowed to distribute along
   #       with this package, or how to make this easier for users otherwise.
 
-  # Not using the `noto-fonts-cjk` package from nixpkgs, because it was
-  # reported that its `.ttc` file is not picked up by OnlyOffice, see:
-  # https://github.com/NixOS/nixpkgs/pull/116343#discussion_r593979816
-  noto-fonts-cjk = fetchurl {
-    url =
-      let
-        version = "v20201206-cjk";
-      in
-      "https://github.com/googlefonts/noto-cjk/raw/${version}/NotoSansCJKsc-Regular.otf";
-    sha256 = "sha256-aJXSVNJ+p6wMAislXUn4JQilLhimNSedbc9nAuPVxo4=";
-  };
-
   runtimeLibs = lib.makeLibraryPath [
     curl
     glibc
@@ -76,11 +65,11 @@ let
 
   derivation = stdenv.mkDerivation rec {
     pname = "onlyoffice-desktopeditors";
-    version = "7.4.1";
+    version = "7.5.1";
     minor = null;
     src = fetchurl {
       url = "https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v${version}/onlyoffice-desktopeditors_amd64.deb";
-      sha256 = "sha256-vaBF3GJyLBldWdEruOeVpRvwGNwaRl7IKPguDLRoe8M=";
+      sha256 = "sha256-Hf5CNbUUMuHZHDY3fgD4qpF4UASevscK8DTZlauyHhY=";
     };
 
     nativeBuildInputs = [
@@ -134,10 +123,6 @@ let
       dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner
     '';
 
-    preConfigure = ''
-      cp --no-preserve=mode,ownership ${noto-fonts-cjk} opt/onlyoffice/desktopeditors/fonts/
-    '';
-
     installPhase = ''
       runHook preInstall
 
@@ -179,12 +164,14 @@ in
 
 # In order to download plugins, OnlyOffice uses /usr/bin/curl so we have to wrap it.
 # Curl still needs to be in runtimeLibs because the library is used directly in other parts of the code.
+# Fonts are also discovered by looking in /usr/share/fonts, so adding fonts to targetPkgs will include them
 buildFHSEnv {
   name = derivation.name;
 
   targetPkgs = pkgs': [
     curl
     derivation
+    noto-fonts-cjk-sans
   ];
 
   runScript = "/bin/onlyoffice-desktopeditors";

pkgs/applications/radio/qlog/default.nix

@@ -0,0 +1,53 @@
+{ fetchFromGitHub
+, qtbase
+, stdenv
+, lib
+, wrapQtAppsHook
+, qmake
+, qtcharts
+, qtwebengine
+, qtserialport
+, qtwebchannel
+, hamlib
+, qtkeychain
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "qlog";
+  version = "0.29.2";
+
+  src = fetchFromGitHub {
+    owner = "foldynl";
+    repo = "QLog";
+    rev = "v${version}";
+    hash = "sha256-g7WgFQPMOaD+3YllZqpykslmPYT/jNVK7/1xaPdbti4=";
+    fetchSubmodules = true;
+  };
+
+  env.NIX_LDFLAGS = "-lhamlib";
+
+  buildInputs = [
+    qtbase
+    qtcharts
+    qtwebengine
+    qtserialport
+    qtwebchannel
+    hamlib
+    qtkeychain
+  ];
+
+  nativeBuildInputs = [
+    wrapQtAppsHook
+    qmake
+    pkg-config
+  ];
+
+  meta = with lib; {
+    description = "Amateur radio logbook software";
+    license = with licenses; [ gpl3Only ];
+    homepage = "https://github.com/foldynl/QLog";
+    maintainers = with maintainers; [ mkg20001 ];
+    platforms = with platforms; unix;
+  };
+}

pkgs/applications/terminal-emulators/rio/default.nix

@@ -30,7 +30,7 @@
 let
   rlinkLibs = if stdenv.isDarwin then [
     darwin.libobjc
-    darwin.apple_sdk.frameworks.AppKit
+    darwin.apple_sdk_11_0.frameworks.AppKit
   ] else [
     (lib.getLib gcc-unwrapped)
     fontconfig
@@ -62,8 +62,8 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     ncurses
-    cmake
   ] ++ lib.optionals stdenv.isLinux [
+    cmake
     pkg-config
     autoPatchelfHook
   ];

pkgs/applications/version-management/fossil/default.nix

@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fossil";
-  version = "2.22";
+  version = "2.23";
 
   src = fetchurl {
     url = "https://www.fossil-scm.org/home/tarball/version-${finalAttrs.version}/fossil-${finalAttrs.version}.tar.gz";
-    hash = "sha256-gdgj/29dF1s4TfqE7roNBS2nOjfNZs1yt4bnFnEhDWs=";
+    hash = "sha256-dfgI6BNRAYqXFnRtnvGh/huxkEcz6LQYZDiB04GYhZM=";
   };
 
   # required for build time tool `./tools/translate.c`
@@ -66,5 +66,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.bsd2;
     maintainers = with maintainers; [ maggesi viric ];
     platforms = platforms.all;
+    mainProgram = "fossil";
   };
 })

pkgs/applications/video/glaxnimate/default.nix

@@ -37,19 +37,20 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "glaxnimate";
-  version = "0.5.1";
+  version = "0.5.4";
 
   src = fetchFromGitLab {
     owner = "mattbas";
     repo = "${pname}";
     rev = version;
-    sha256 = "G4ykcOvXXnVIQZUYpRIrALtDSsGqxMvDtcmobjjtlKw=";
+    sha256 = "sha256-8oHJCQdP2xxSSDM0MDkSrG89WgCtMKm1AKlddnq3gig=";
     fetchSubmodules = true;
   };
 
   nativeBuildInputs = [
     cmake
     wrapQtAppsHook
+    qttools
   ];
 
   buildInputs = [
@@ -65,6 +66,10 @@ stdenv.mkDerivation rec {
     python3WithLibs
   ];
 
+  # Translation needs to be separately compiled
+  # https://gitlab.com/mattbas/glaxnimate/-/issues/648
+  buildFlags = [ "translations" ];
+
   qtWrapperArgs = [ ''--prefix PATH : ${python3WithLibs}/bin'' ];
 
   passthru.tests.version = lib.optionalAttrs stdenv.isLinux (testers.testVersion {

pkgs/applications/video/subtitleedit/default.nix

@@ -1,26 +1,28 @@
 { lib
 , stdenv
-, copyDesktopItems
-, makeDesktopItem
-, makeWrapper
 , fetchzip
+, makeDesktopItem
+, nix-update-script
+
+, copyDesktopItems
+, icoutils
+, makeWrapper
+
 , ffmpeg
 , gtk2
 , hunspell
-, icoutils
 , mono
 , mpv
 , tesseract4
-, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "subtitleedit";
-  version = "4.0.1";
+  version = "4.0.2";
 
   src = fetchzip {
     url = "https://github.com/SubtitleEdit/subtitleedit/releases/download/${version}/SE${lib.replaceStrings [ "." ] [ "" ] version}.zip";
-    hash = "sha256-Z7NVn4F19Hx55YWPNmbpWZ8yQulXd50bcy2A/8pCqJ4=";
+    hash = "sha256-kcs2h6HeWniJhGDNsy+EBauXbiDIlLCOJkVOCIzLBzM=";
     stripRoot = false;
   };
 
@@ -80,16 +82,16 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A subtitle editor";
-    homepage = "https://nikse.dk/subtitleedit";
-    license = licenses.gpl3Plus;
     longDescription = ''
       With Subtitle Edit you can easily adjust a subtitle if it is out of sync with
       the video in several different ways. You can also use it for making
       new subtitles from scratch (using the time-line /waveform/spectrogram)
       or for translating subtitles.
     '';
-    maintainers = with maintainers; [ paveloom ];
+    homepage = "https://nikse.dk/subtitleedit";
+    license = licenses.gpl3Plus;
     platforms = platforms.all;
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ paveloom ];
   };
 }

pkgs/build-support/docker/default.nix

@@ -914,17 +914,30 @@ rec {
             (cd old_out; eval "$extraCommands" )
 
             mkdir $out
-            ${optionalString enableFakechroot ''proot -r $PWD/old_out ${bind-paths} --pwd=/ ''}fakeroot bash -c '
+            ${if enableFakechroot then ''
-              source $stdenv/setup
+              proot -r $PWD/old_out ${bind-paths} --pwd=/ --root-id bash -c '
-              ${optionalString (!enableFakechroot) ''cd old_out''}
+                source $stdenv/setup
-              eval "$fakeRootCommands"
+                eval "$fakeRootCommands"
-              tar \
+                tar \
-                --sort name \
+                  --sort name \
-                --numeric-owner --mtime "@$SOURCE_DATE_EPOCH" \
+                  --exclude=./proc \
-                --hard-dereference \
+                  --exclude=./sys \
-                -cf $out/layer.tar .
+                  --numeric-owner --mtime "@$SOURCE_DATE_EPOCH" \
-            '
+                  --hard-dereference \
-
+                  -cf $out/layer.tar .
+              '
+            '' else ''
+              fakeroot bash -c '
+                source $stdenv/setup
+                cd old_out
+                eval "$fakeRootCommands"
+                tar \
+                  --sort name \
+                  --numeric-owner --mtime "@$SOURCE_DATE_EPOCH" \
+                  --hard-dereference \
+                  -cf $out/layer.tar .
+              '
+            ''}
             sha256sum $out/layer.tar \
               | cut -f 1 -d ' ' \
               > $out/checksum

pkgs/build-support/rust/build-rust-crate/configure-crate.nix

@@ -7,6 +7,7 @@
 , completeBuildDeps
 , completeDeps
 , crateAuthors
+, crateLinks
 , crateDescription
 , crateHomepage
 , crateFeatures
@@ -134,6 +135,7 @@ in ''
   export CARGO_CFG_TARGET_VENDOR=${stdenv.hostPlatform.parsed.vendor.name}
 
   export CARGO_MANIFEST_DIR=$(pwd)
+  export CARGO_MANIFEST_LINKS=${crateLinks}
   export DEBUG="${toString (!release)}"
   export OPT_LEVEL="${toString optLevel}"
   export TARGET="${stdenv.hostPlatform.rust.rustcTargetSpec}"

pkgs/build-support/rust/build-rust-crate/default.nix

@@ -235,6 +235,7 @@ crate_: lib.makeOverridable
         "edition"
         "buildTests"
         "codegenUnits"
+        "links"
       ];
       extraDerivationAttrs = builtins.removeAttrs crate processedAttrs;
       nativeBuildInputs_ = nativeBuildInputs;
@@ -317,6 +318,7 @@ crate_: lib.makeOverridable
       crateDescription = crate.description or "";
       crateAuthors = if crate ? authors && lib.isList crate.authors then crate.authors else [ ];
       crateHomepage = crate.homepage or "";
+      crateLinks = crate.links or "";
       crateType =
         if lib.attrByPath [ "procMacro" ] false crate then [ "proc-macro" ] else
         if lib.attrByPath [ "plugin" ] false crate then [ "dylib" ] else
@@ -337,7 +339,7 @@ crate_: lib.makeOverridable
 
       configurePhase = configureCrate {
         inherit crateName buildDependencies completeDeps completeBuildDeps crateDescription
-          crateFeatures crateRenames libName build workspace_member release libPath crateVersion
+          crateFeatures crateRenames libName build workspace_member release libPath crateVersion crateLinks
           extraLinkFlags extraRustcOptsForBuildRs
           crateAuthors crateHomepage verbose colors codegenUnits;
       };

pkgs/by-name/ad/adafruit-nrfutil/package.nix

@@ -0,0 +1,47 @@
+{ lib
+, python3Packages
+, fetchFromGitHub
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "adafruit-nrfutil";
+  version = "0.5.3.post17";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "adafruit";
+    repo = "Adafruit_nRF52_nrfutil";
+    rev = "refs/tags/${version}";
+    hash = "sha256-mHHKOQE9AGBX8RAyaPOy+JS3fTs98+AFdq9qsVy7go4=";
+  };
+
+  nativeBuildInputs = with python3Packages; [
+    setuptools
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    click
+    ecdsa
+    pyserial
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    behave
+    nose
+  ];
+
+  preCheck = ''
+    mkdir test-reports
+  '';
+
+  pythonImportsCheck = [
+    "nordicsemi"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/adafruit/Adafruit_nRF52_nrfutil";
+    description = "Modified version of Nordic's nrfutil 0.5.x for use with the Adafruit Feather nRF52";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ stargate01 ];
+  };
+}

pkgs/by-name/am/amazon-ssm-agent/package.nix

@@ -11,6 +11,7 @@
 , dmidecode
 , bashInteractive
 , nix-update-script
+, nixosTests
 , testers
 , amazon-ssm-agent
 , overrideEtc ? true
@@ -147,11 +148,14 @@ buildGoModule rec {
   '';
 
   passthru = {
-    updateScript = nix-update-script { };
+    tests = {
-    tests.version = testers.testVersion {
+      inherit (nixosTests) amazon-ssm-agent;
-      package = amazon-ssm-agent;
+      version = testers.testVersion {
-      command = "amazon-ssm-agent --version";
+        package = amazon-ssm-agent;
+        command = "amazon-ssm-agent --version";
+      };
     };
+    updateScript = nix-update-script { };
   };
 
   __darwinAllowLocalNetworking = true;

pkgs/by-name/cl/cljfmt/package.nix

@@ -0,0 +1,44 @@
+{ lib
+, buildGraalvmNativeImage
+, fetchurl
+, nix-update-script
+, testers
+, cljfmt
+}:
+
+buildGraalvmNativeImage rec {
+  pname = "cljfmt";
+  version = "0.11.2";
+
+  src = fetchurl {
+    url = "https://github.com/weavejester/${pname}/releases/download/${version}/${pname}-${version}-standalone.jar";
+    sha256 = "sha256-vEldQ7qV375mHMn3OUdn0FaPd+f/v9g+C+PuzbSTWtk=";
+  };
+
+  extraNativeImageBuildArgs = [
+    "-H:+ReportExceptionStackTraces"
+    "-H:Log=registerResource:"
+    "--initialize-at-build-time"
+    "--diagnostics-mode"
+    "--report-unsupported-elements-at-runtime"
+    "--no-fallback"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  passthru.tests.version = testers.testVersion {
+    inherit version;
+    package = cljfmt;
+    command = "cljfmt --version";
+  };
+
+  meta = with lib; {
+    mainProgram = "cljfmt";
+    description = "A tool for formatting Clojure code";
+    homepage = "https://github.com/weavejester/cljfmt";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    license = licenses.epl10;
+    changelog = "https://github.com/weavejester/cljfmt/blob/${version}/CHANGELOG.md";
+    maintainers = with maintainers; [ sg-qwt ];
+  };
+}

pkgs/by-name/oc/ocsinventory-agent/package.nix

@@ -15,6 +15,7 @@
 , pciutils
 , usbutils
 , util-linux
+, nixosTests
 , testers
 , ocsinventory-agent
 , nix-update-script
@@ -75,11 +76,14 @@ perlPackages.buildPerlPackage rec {
   '';
 
   passthru = {
-    tests.version = testers.testVersion {
+    tests = {
-      package = ocsinventory-agent;
+      inherit (nixosTests) ocsinventory-agent;
-      command = "ocsinventory-agent --version";
+      version = testers.testVersion {
-      # upstream has not updated version in lib/Ocsinventory/Agent/Config.pm
+        package = ocsinventory-agent;
-      version = "2.10.0";
+        command = "ocsinventory-agent --version";
+        # upstream has not updated version in lib/Ocsinventory/Agent/Config.pm
+        version = "2.10.0";
+      };
     };
     updateScript = nix-update-script { };
   };

pkgs/by-name/op/open-fprintd/package.nix

@@ -0,0 +1,44 @@
+{ lib, fetchFromGitHub, python3Packages }:
+
+python3Packages.buildPythonPackage rec {
+  pname = "open-fprintd";
+  version = "0.6";
+
+  src = fetchFromGitHub {
+    owner = "uunicorn";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-uVFuwtsmR/9epoqot3lJ/5v5OuJjuRjL7FJF7oXNDzU=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [ dbus-python pygobject3 ];
+
+  checkInputs = with python3Packages; [ dbus-python ];
+
+  postInstall = ''
+    install -D -m 644 debian/open-fprintd.service \
+      $out/lib/systemd/system/open-fprintd.service
+    install -D -m 644 debian/open-fprintd-resume.service \
+      $out/lib/systemd/system/open-fprintd-resume.service
+    install -D -m 644 debian/open-fprintd-suspend.service \
+      $out/lib/systemd/system/open-fprintd-suspend.service
+    substituteInPlace $out/lib/systemd/system/open-fprintd.service \
+      --replace /usr/lib/open-fprintd "$out/lib/open-fprintd"
+    substituteInPlace $out/lib/systemd/system/open-fprintd-resume.service \
+      --replace /usr/lib/open-fprintd "$out/lib/open-fprintd"
+    substituteInPlace $out/lib/systemd/system/open-fprintd-suspend.service \
+      --replace /usr/lib/open-fprintd "$out/lib/open-fprintd"
+  '';
+
+  postFixup = ''
+    wrapPythonProgramsIn "$out/lib/open-fprintd" "$out $pythonPath"
+  '';
+
+  meta = with lib; {
+    description =
+      "Fprintd replacement which allows you to have your own backend as a standalone service";
+    homepage = "https://github.com/uunicorn/open-fprintd";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+  };
+}

pkgs/by-name/po/poethepoet/package.nix

@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "poethepoet";
-  version = "0.24.2";
+  version = "0.24.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nat-n";
     repo = "poethepoet";
     rev = "v${version}";
-    hash = "sha256-tumEwaHXFLSXOmyQba4wBU5irvzZBL3BsCtF+Nlly+c=";
+    hash = "sha256-RTV3TVNciJE7dC/gtViZcSWFXR2A4qNMAJ/1OEzMAus=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ty/typst-preview/Cargo.lock

@@ -3390,7 +3390,7 @@ dependencies = [
 
 [[package]]
 name = "typst-preview"
-version = "0.9.0"
+version = "0.9.1"
 dependencies = [
  "anyhow",
  "chrono",

pkgs/by-name/ty/typst-preview/package.nix

@@ -0,0 +1,94 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, mkYarnPackage
+, fetchYarnDeps
+, pkg-config
+, libgit2
+, openssl
+, zlib
+, stdenv
+, darwin
+}:
+
+let
+  # Keep the vscode "mgt19937.typst-preview" extension in sync when updating
+  # this package at pkgs/applications/editors/vscode/extensions/default.nix
+  version = "0.9.1";
+
+  src = fetchFromGitHub {
+    owner = "Enter-tainer";
+    repo = "typst-preview";
+    rev = "v${version}";
+    hash = "sha256-VmUcnmTe5Ngcje0SSpOY13HUIfdxBMg8KwvZ1wupCqc=";
+  };
+
+  frontendSrc = "${src}/addons/frontend";
+
+  frontend = mkYarnPackage {
+    inherit version;
+    pname = "typst-preview-frontend";
+    src = frontendSrc;
+    packageJSON = ./package.json;
+
+    offlineCache = fetchYarnDeps {
+      yarnLock = "${frontendSrc}/yarn.lock";
+      hash = "sha256-7a7/UOfau84nLIAKj6Tn9rTUmeBJ7rYDFAdr55ZDLgA=";
+    };
+
+    buildPhase = ''
+      runHook preBuild
+      yarn --offline build
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      cp -R deps/typst-preview-frontend/dist $out
+      runHook postInstall
+    '';
+
+    doDist = false;
+  };
+in
+rustPlatform.buildRustPackage {
+  pname = "typst-preview";
+  inherit version src;
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "hayagriva-0.4.0" = "sha256-377lXL3+TO8U91OopMYEI0NrWWwzy6+O7B65bLhP+X4=";
+      "typst-0.9.0" = "sha256-+rnsUSGi3QZlbC4i8racsM4U6+l8oA9YjjUOtQAIWOk=";
+      "typst-ts-compiler-0.4.0-rc9" = "sha256-NVmbAodDRJBJlGGDRjaEcTHGoCeN4hNjIynIDKqvNbM=";
+    };
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libgit2
+    openssl
+    zlib
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreFoundation
+    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  prePatch = ''
+    mkdir -p addons/vscode/out/frontend
+    cp -R ${frontend}/* addons/vscode/out/frontend/
+  '';
+
+  meta = {
+    description = "Typst preview extension for VSCode";
+    homepage = "https://github.com/Enter-tainer/typst-preview/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ berberman ];
+    mainProgram = "typst-preview";
+  };
+}

pkgs/data/misc/v2ray-domain-list-community/default.nix

@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20231031055637";
+    version = "20231118232758";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-wdWmpWsWroA7ecNRSVh3hEUSXz/MW+9kYDWhThWL44k=";
+      hash = "sha256-m4B1O8h6lRxArEyuE4XUF9eJtoBhl59QNXkVjWKx2ko=";
     };
     vendorHash = "sha256-6167kRAC5m5FlBr7uk+qKUcjWsb45P5Vvovyb6hHSVQ=";
     meta = with lib; {

pkgs/development/compilers/squeak/default.nix

@@ -1,15 +1,40 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl, fetchzip
+{ lib
-, autoconf, automake, autoreconfHook, clang, dos2unix, file, perl
+, stdenv
+, fetchFromGitHub
+, fetchurl
+, fetchzip
+, autoconf
+, automake
+, autoreconfHook
+, dos2unix
+, file
+, perl
 , pkg-config
-, alsa-lib, coreutils, freetype, glib, glibc, gnugrep, libGL, libpulseaudio
+, alsa-lib
-, libtool, libuuid, openssl, pango, xorg
+, coreutils
-, squeakImageHash ? null, squeakSourcesHash ? null, squeakSourcesVersion ? null
+, freetype
-, squeakVersion ? null, squeakVmCommitHash ? null, squeakVmCommitHashHash ? null
+, glib
+, glibc
+, gnugrep
+, libGL
+, libpulseaudio
+, libtool
+, libuuid
+, openssl
+, pango
+, xorg
+, squeakImageHash ? null
+, squeakSourcesHash ? null
+, squeakSourcesVersion ? null
+, squeakVersion ? null
+, squeakVmCommitHash ? null
+, squeakVmCommitHashHash ? null
 , squeakVmVersion ? null
 } @ args:
 
 let
-  inherit (builtins) elemAt;
+  inherit (builtins) elemAt toString;
+
   nullableOr = o: default: if o == null then default else o;
 
   bits = stdenv.hostPlatform.parsed.cpu.bits;
@@ -75,7 +100,6 @@ in stdenv.mkDerivation {
     autoconf
     automake
     autoreconfHook
-    clang
     dos2unix
     file
     perl
@@ -140,7 +164,16 @@ in stdenv.mkDerivation {
   # Workaround build failure on -fno-common toolchains:
   #   ld: vm/vm.a(cogit.o):spur64src/vm/cogitX64SysV.c:2552: multiple definition of
   #       `traceStores'; vm/vm.a(gcc3x-cointerp.o):spur64src/vm/cogit.h:140: first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = toString (
+    [ "-fcommon" ]
+    ++ (lib.optionals stdenv.cc.isClang [
+      # LLVM 16 turned these into errors (rightly, perhaps.)
+      # Allow this package to continue to build despite this change.
+      "-Wno-error=int-conversion"
+      "-Wno-error=implicit-function-declaration"
+      "-Wno-error=incompatible-function-pointer-types"
+    ])
+  );
 
   preAutoreconf = ''
     pushd ./platforms/unix/config > /dev/null

pkgs/development/libraries/libtiff/4.5.nix

@@ -0,0 +1,86 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, fetchpatch
+
+, autoreconfHook
+, pkg-config
+, sphinx
+
+, libdeflate
+, libjpeg
+, xz
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libtiff";
+  version = "4.5.1";
+
+  src = fetchFromGitLab {
+    owner = "libtiff";
+    repo = "libtiff";
+    rev = "v${version}";
+    hash = "sha256-qQEthy6YhNAQmdDMyoCIvK8f3Tx25MgqhJZW74CB93E=";
+  };
+
+  patches = [
+    # cf. https://bugzilla.redhat.com/2224974
+    (fetchpatch {
+      name = "CVE-2023-40745.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/bdf7b2621c62e04d0408391b7d5611502a752cd0.diff";
+      hash = "sha256-HdU02YJ1/T3dnCT+yG03tUyAHkgeQt1yjZx/auCQxyw=";
+    })
+    # cf. https://bugzilla.redhat.com/2224971
+    (fetchpatch {
+      name = "CVE-2023-41175.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/965fa243004e012adc533ae8e38db3055f101a7f.diff";
+      hash = "sha256-Pvg6JfJWOIaTrfFF0YSREZkS9saTG9IsXnsXtcyKILA=";
+    })
+    # FreeImage needs this patch
+    ./headers-4.5.patch
+    # libc++abi 11 has an `#include <version>`, this picks up files name
+    # `version` in the project's include paths
+    ./rename-version-4.5.patch
+  ];
+
+  postPatch = ''
+    mv VERSION VERSION.txt
+  '';
+
+  outputs = [ "bin" "dev" "dev_private" "out" "man" "doc" ];
+
+  postFixup = ''
+    moveToOutput include/tif_config.h $dev_private
+    moveToOutput include/tif_dir.h $dev_private
+    moveToOutput include/tif_hash_set.h $dev_private
+    moveToOutput include/tiffiop.h $dev_private
+  '';
+
+  # If you want to change to a different build system, please make
+  # sure cross-compilation works first!
+  nativeBuildInputs = [ autoreconfHook pkg-config sphinx ];
+
+  propagatedBuildInputs = [
+    libdeflate
+    libjpeg
+    xz
+    zlib
+  ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Library and utilities for working with the TIFF image file format";
+    homepage = "https://libtiff.gitlab.io/libtiff";
+    changelog = "https://libtiff.gitlab.io/libtiff/v${version}.html";
+    # XXX not enabled for now to keep hydra builds running,
+    # but we have to keep an eye on security updates in supported version
+    #knownVulnerabilities = [ "support for version 4.5 ended in Sept 2023" ];
+    maintainers = with maintainers; [ yarny ];
+    license = licenses.libtiff;
+    platforms = platforms.unix;
+  };
+}

pkgs/development/libraries/libtiff/default.nix

@@ -26,6 +26,9 @@ stdenv.mkDerivation rec {
   pname = "libtiff";
   version = "4.6.0";
 
+  # if you update this, please consider adding patches and/or
+  # setting `knownVulnerabilities` in libtiff `4.5.nix`
+
   src = fetchFromGitLab {
     owner = "libtiff";
     repo = "libtiff";

pkgs/development/libraries/libtiff/headers-4.5.patch

@@ -0,0 +1,16 @@
+export private headers for freeimage
+--- i/libtiff/Makefile.am
++++ w/libtiff/Makefile.am
+@@ -36,8 +36,12 @@ EXTRA_DIST = \
+ 	tiffconf.h.cmake.in
+
+ libtiffinclude_HEADERS = \
++	tif_config.h \
++	tif_dir.h \
++	tif_hash_set.h \
+ 	tiff.h \
+ 	tiffio.h \
++	tiffiop.h \
+ 	tiffvers.h
+
+ if HAVE_CXX

pkgs/development/libraries/libtiff/rename-version-4.5.patch

@@ -0,0 +1,21 @@
+fix case-insensitive build
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -34,7 +34,7 @@ docfiles = \
+ 	README.md \
+ 	RELEASE-DATE \
+ 	TODO \
+-	VERSION
++	VERSION.txt
+
+ EXTRA_DIST = \
+ 	cmake \
+@@ -61,7 +61,7 @@ SUBDIRS = port libtiff tools build contrib test doc
+
+ release:
+	(rm -f $(top_srcdir)/RELEASE-DATE && echo $(LIBTIFF_RELEASE_DATE) > $(top_srcdir)/RELEASE-DATE)
+-	(rm -f $(top_srcdir)/VERSION && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION)
++	(rm -f $(top_srcdir)/VERSION.txt && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION.txt)
+	(rm -f $(top_srcdir)/libtiff/tiffvers.h && sed 's,LIBTIFF_VERSION,$(LIBTIFF_VERSION),;s,LIBTIFF_RELEASE_DATE,$(LIBTIFF_RELEASE_DATE),;s,LIBTIFF_MAJOR_VERSION,$(LIBTIFF_MAJOR_VERSION),;s,LIBTIFF_MINOR_VERSION,$(LIBTIFF_MINOR_VERSION),;s,LIBTIFF_MICRO_VERSION,$(LIBTIFF_MICRO_VERSION),' $(top_srcdir)/libtiff/tiffvers.h.in > $(top_srcdir)/libtiff/tiffvers.h)
+
+ pkgconfigdir = $(libdir)/pkgconfig

pkgs/development/python-modules/adafruit-nrfutil/default.nix

@@ -1,62 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, fetchpatch
-, pythonOlder
-, pyserial
-, click
-, ecdsa
-, behave
-, nose
-}:
-
-buildPythonPackage rec {
-  pname = "adafruit-nrfutil";
-  version = "1";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
-
-  src = fetchFromGitHub {
-    owner = "adafruit";
-    repo = "Adafruit_nRF52_nrfutil";
-    rev = "refs/tags/appveyor-test-release-${version}";
-    hash = "sha256-wsspDg8XwEtJwJye6Z3TXaIN1TcfI7gYDah3L/xiiLo=";
-  };
-
-  patches = [
-    # Pull a patch which fixes the tests, but is not yet released in a new version:
-    # https://github.com/adafruit/Adafruit_nRF52_nrfutil/pull/38
-    (fetchpatch {
-      name = "fix-tests.patch";
-      url = "https://github.com/adafruit/Adafruit_nRF52_nrfutil/commit/e5fbcc8ee5958041db38c04139ba686bf7d1b845.patch";
-      hash = "sha256-0tbJldGtYcDdUzA3wZRv0lenXVn6dqV016U9nMpQ6/w=";
-    })
-  ];
-
-  propagatedBuildInputs = [
-    pyserial
-    click
-    ecdsa
-  ];
-
-  nativeCheckInputs = [
-    behave
-    nose
-  ];
-
-  preCheck = ''
-    mkdir test-reports
-  '';
-
-  pythonImportsCheck = [
-    "nordicsemi"
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/adafruit/Adafruit_nRF52_nrfutil";
-    description = "Modified version of Nordic's nrfutil 0.5.x for use with the Adafruit Feather nRF52";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ stargate01 ];
-  };
-}

pkgs/development/python-modules/awkward-cpp/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "awkward-cpp";
-  version = "25";
+  version = "26";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Fhq6XUt5CYz/l+Lf9WcCnt9rs3byMQIQs7hFexr2tjM=";
+    hash = "sha256-o3wI+JEmtjfUczRUob8/KLGNn3lH0h3GuhIDfYg7HGY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/edk2-pytool-library/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "edk2-pytool-library";
-  version = "0.19.4";
+  version = "0.19.5";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "tianocore";
     repo = "edk2-pytool-library";
     rev = "v${version}";
-    hash = "sha256-7pTi3pDD7245hbWqINchZNImv53a4afzaydE7vTtbVw=";
+    hash = "sha256-Gxza9bVLVVHejKNI9CQZQxfJuT71LBsxDQ8e4xAozS0=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/floret/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "floret";
-  version = "0.10.4";
+  version = "0.10.5";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "explosion";
     repo = "floret";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cOVyvRwprR7SvZjH4rtDK8uifv6+JGyRR7XYzOP5NLk=";
+    hash = "sha256-7vkw6H0ZQoHEwNusY6QWh/vPbSCdP1ZaaqABHsZH6hQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/kombu/default.nix

@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "kombu";
-  version = "5.3.3";
+  version = "5.3.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FJHfgmz8UXjIDz6J3W37po5ITvM024EHDrXLgJSzEWc=";
+    hash = "sha256-C7LieGRNEd6mJywXl0o9u5aIqUnzu2CutbeRMpxE+tw=";
   };
 
   propagatedBuildInputs = [
@@ -104,7 +104,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Messaging library for Python";
     homepage = "https://github.com/celery/kombu";
-    changelog = "https://github.com/celery/kombu/releases/tag/v${version}";
+    changelog = "https://github.com/celery/kombu/blob/v${version}/Changelog.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/nettigo-air-monitor/default.nix

@@ -9,22 +9,27 @@
 , pytest-error-for-skips
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "nettigo-air-monitor";
   version = "2.2.1";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "bieniu";
-    repo = pname;
+    repo = "nettigo-air-monitor";
     rev = "refs/tags/${version}";
     hash = "sha256-24O9Yl0+boxDtyPW4tBTsk2iDGGXf8ofkDHu8B+GxhE=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     aiohttp
     aqipy-atmotech

pkgs/development/python-modules/pvextractor/default.nix

@@ -17,15 +17,15 @@
 
 buildPythonPackage rec {
   pname = "pvextractor";
-  version = "0.3";
+  version = "0.4";
 
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "radio-astro-tools";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "sha256-HYus2Gk3hzKq+3lJLOJQ+EE6LeO+DrvqLK3NpqrUYeI=";
+    sha256 = "sha256-TjwoTtoGWU6C6HdFuS+gJj69PUnfchPHs7UjFqwftVQ=";
   };
 
   buildInputs = [ pyqt-builder ];

pkgs/development/python-modules/umap-learn/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "umap-learn";
-  version = "0.5.4";
+  version = "0.5.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,8 +24,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "lmcinnes";
     repo = "umap";
-    rev = version;
+    rev = "refs/tags/release-${version}";
-    hash = "sha256-cvAq9b7xDowLIfIAzV+X08SUEL0QOisr/wBXMYeQ/8A=";
+    hash = "sha256-bXAQjq7xBYn34tIZF96Sr5jDUii3s4FGkNx65rGKXkY=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/weasel/default.nix

@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "weasel";
-  version = "0.3.3";
+  version = "0.3.4";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "explosion";
     repo = "weasel";
     rev = "refs/tags/v${version}";
-    hash = "sha256-I8Omrez1wfAbCmr9hivqKN2fNgnFQRGm8OP7lb7YClk=";
+    hash = "sha256-6Ck8R10/YW2Nc6acNk2bzgyqSg+OPqwyJjhUgXP/umw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/xdg/default.nix

@@ -1,20 +1,23 @@
-{ lib, buildPythonPackage, fetchFromGitHub, isPy27
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
 , clikit
 , poetry-core
-, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   version = "6.0.0";
   pname = "xdg";
-  disabled = isPy27;
+  disabled = pythonOlder "3.7";
   format = "pyproject";
 
-  src = fetchFromGitHub {
+  # the github source uses `xdg_base_dirs`, but pypi's sdist maintains `xdg` for compatibility.
-    owner = "srstevenson";
+  # there are actually breaking changes in xdg_base_dirs,
-    repo = pname;
+  # and libraries that want to support python 3.9 and below need to use xdg.
-    rev = "refs/tags/${version}";
+  src = fetchPypi {
-    hash = "sha256-yVuruSKv99IZGNCpY9cKwAe6gJNAWjL+Lol2D1/0hiI=";
+    inherit pname version;
+    hash = "sha256-JCeAlPLUXoRtHrKKLruS17Z/wMq1JJ7jzojJX2SaHJI=";
   };
 
   nativeBuildInputs = [ poetry-core ];
@@ -23,7 +26,12 @@ buildPythonPackage rec {
     clikit
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  # sdist has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "xdg"
+  ];
 
   meta = with lib; {
     description = "XDG Base Directory Specification for Python";

pkgs/development/tools/database/dbmate/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gT+1ptQUZNobUG2etknCuyV2xxct5F6+P2J6/6yQkTk=";
+    hash = "sha256-6NeReekizEBRfsiRBshBD5WrGJpDdNpvvC7jslpsQoI=";
   };
 
-  vendorHash = "sha256-2HY5eqiVRKvP1YrlNtbEj7QvDfoMV6DF+WgQOwo9VuQ=";
+  vendorHash = "sha256-r3IuE5qdN3B9IZyRjLokaRZ99Ziypbfg4H/uiMzSB+w=";
 
   doCheck = false;
 

pkgs/development/tools/language-servers/lua-language-server/default.nix

@@ -43,6 +43,11 @@ stdenv.mkDerivation rec {
       -e '/cxx_/s,$cc,clang++,'
   '';
 
+  # Work around https://github.com/NixOS/nixpkgs/issues/166205.
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_LDFLAGS = "-l${stdenv.cc.libcxx.cxxabi.libName}";
+  };
+
   ninjaFlags = [
     "-fcompile/ninja/${if stdenv.isDarwin then "macos" else "linux"}.ninja"
   ];

pkgs/development/tools/rust/cargo-binstall/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.4.5";
+  version = "1.4.6";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     rev = "v${version}";
-    hash = "sha256-OVtSvlmMRngxhUeq4u+exVc7WQUqBnksDpb8esbly9Y=";
+    hash = "sha256-zCivxYHhaVqzPe3qBUKXgMgEE6niGqkHJM77rfEUoFo=";
   };
 
-  cargoHash = "sha256-3OuyN+nm2t+LH8lue3xYoBQp7OYjzhDbnc2LCGqFJgY=";
+  cargoHash = "sha256-O8X+oLKhKeQGeUrsRVeakZjaMKPiXdIns48rV8Q9JA8=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/development/tools/turso-cli/default.nix

@@ -8,16 +8,16 @@
 }:
 buildGo121Module rec {
   pname = "turso-cli";
-  version = "0.87.2";
+  version = "0.87.4";
 
   src = fetchFromGitHub {
     owner = "tursodatabase";
     repo = "turso-cli";
     rev = "v${version}";
-    hash = "sha256-EZSVKmOIzwokCKreLnZj4DWEhjjXo3TFhieGVR7w7NM=";
+    hash = "sha256-e5HuDWMmikTlWC2ezZ5zxxKYFlgz9jrpHtNfIwSiiok=";
   };
 
-  vendorHash = "sha256-3IV0MgDe71lqLQ6tB2NM2kYokXGWvR+hh4lvxw5QWjA=";
+  vendorHash = "sha256-EcWhpx93n+FzkXDOHwAxhn13qR4n9jLFeaKoe49x1x4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/os-specific/darwin/CoreSymbolication/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, stdenv }:
+{ lib, fetchFromGitHub, fetchpatch, stdenv }:
 
 stdenv.mkDerivation {
   pname = "core-symbolication";
@@ -11,6 +11,15 @@ stdenv.mkDerivation {
     hash = "sha256-PzvLq94eNhP0+rLwGMKcMzxuD6MlrNI7iT/eV0obtSE=";
   };
 
+  patches = [
+    # C99 compilation fix
+    # https://github.com/matthewbauer/CoreSymbolication/pull/1
+    (fetchpatch {
+      url = "https://github.com/boltzmannrain/CoreSymbolication/commit/1c26cc93f260bda9230a93e91585284e80aa231f.patch";
+      hash = "sha256-d/ieDEnvZ9kVOjBVUdJzGmdvC1AF3Jk4fbwp04Q6l/I=";
+    })
+  ];
+
   makeFlags = [ "PREFIX=$(out)" "CC=${stdenv.cc.targetPrefix}cc" ];
 
   meta = with lib; {

pkgs/os-specific/linux/nvidia-x11/open.nix

@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , kernel
 , nvidia_x11
 , hash
@@ -18,6 +19,13 @@ stdenv.mkDerivation ({
     inherit hash;
   };
 
+  patches = lib.optionals (nvidia_x11.version == "545.29.02")[
+    (fetchpatch {
+      url = "https://github.com/NVIDIA/open-gpu-kernel-modules/files/13310810/0001-nvkms-initialize-brightnessType-in-_BACKLIGHT_BRIGHT.patch.txt";
+      hash = "sha256-9N+DbyT4VmGNTHXWf23PJU4YWZS+0JK7yqkmkpnINPk=";
+    })
+  ];
+
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   makeFlags = kernel.makeFlags ++ [

pkgs/servers/http/nginx/generic.nix

@@ -124,7 +124,11 @@ stdenv.mkDerivation {
   ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") [
     # fix build vts module on gcc11
     "-Wno-error=stringop-overread"
-  ] ++ lib.optional stdenv.isDarwin "-Wno-error=deprecated-declarations");
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=gnu-folding-constant"
+    "-Wno-error=unused-but-set-variable"
+  ]);
 
   configurePlatforms = [];
 

pkgs/servers/jackett/default.nix

@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.21.1096";
+  version = "0.21.1234";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha512-j9PQa54Gv6kdCHZ9/WPnKYkxD4N0eu0KtMPpATSYVDo0mP9pXdQxSoCrKdmW2gOveuo5Z/wPW4BB4r3gvFxcOg==";
+    hash = "sha512-kI5HxBCx9moxnw90tqRLJ/muULEUOqIGcfWlFmgFwuOsOIoLc3arY1HDjRzeBDLYuz8BiG99lXUeAa5eHB3+Wg==";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";

pkgs/servers/klipper/simulator.cfg

@@ -4,8 +4,10 @@
 # CONFIG_MACH_ATSAMD is not set
 # CONFIG_MACH_LPC176X is not set
 # CONFIG_MACH_STM32 is not set
+# CONFIG_MACH_HC32F460 is not set
 # CONFIG_MACH_RP2040 is not set
 # CONFIG_MACH_PRU is not set
+# CONFIG_MACH_AR100 is not set
 # CONFIG_MACH_LINUX is not set
 CONFIG_MACH_SIMU=y
 CONFIG_BOARD_DIRECTORY="simulator"
@@ -16,6 +18,12 @@ CONFIG_SERIAL_BAUD=250000
 CONFIG_USB_VENDOR_ID=0x1d50
 CONFIG_USB_DEVICE_ID=0x614e
 CONFIG_USB_SERIAL_NUMBER="12345"
+CONFIG_WANT_GPIO_BITBANGING=y
+CONFIG_WANT_DISPLAYS=y
+CONFIG_WANT_SENSORS=y
+CONFIG_WANT_LIS2DW=y
+CONFIG_WANT_SOFTWARE_SPI=y
+CONFIG_CANBUS_FREQUENCY=1000000
 CONFIG_HAVE_GPIO=y
 CONFIG_HAVE_GPIO_ADC=y
 CONFIG_HAVE_GPIO_SPI=y

pkgs/servers/monitoring/prometheus/rabbitmq-exporter.nix

@@ -13,6 +13,13 @@ buildGoModule rec {
 
   vendorHash = "sha256-ER0vK0xYUbQT3bqUosQMFT7HBycb3U8oI4Eak72myzs=";
 
+  ldflags = [ "-s" "-w" ];
+
+  checkFlags = [
+    # Disable flaky tests on Darwin
+    "-skip=TestWholeApp|TestExporter"
+  ];
+
   meta = with lib; {
     description = "Prometheus exporter for RabbitMQ";
     homepage = "https://github.com/kbudde/rabbitmq_exporter";

pkgs/servers/monitoring/thanos/default.nix

@@ -1,24 +1,25 @@
-{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, go
+, nix-update-script
+, nixosTests
+, testers
+, thanos
+}:
+
 buildGoModule rec {
   pname = "thanos";
-  version = "0.31.0";
+  version = "0.32.5";
 
   src = fetchFromGitHub {
-    rev = "v${version}";
     owner = "thanos-io";
     repo = "thanos";
-    sha256 = "sha256-EJZGc4thu0WhVSSRolIRYg39S81Cgm+JHwpW5eE7mDc=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-A4bDCyvctHmDBYzvWpeEO4u6KhoICN7BbRQK4aZCbIA=";
   };
 
-  patches = [
+  vendorHash = "sha256-ZjkMvbWq96Rte9WoxAWzeouVA/6mBqanvY9yHr9F5MM=";
-    # https://github.com/thanos-io/thanos/pull/6126
-    (fetchpatch {
-      url = "https://github.com/thanos-io/thanos/commit/a4c218bd690259fc0c78fe67e0739bd33d38541e.patch";
-      hash = "sha256-Hxc1s5IXAyw01/o4JvOXuyYuOFy0+cBUv3OkRv4DCXs=";
-    })
-  ];
-
-  vendorHash = "sha256-8+MUMux6v/O2syVyTx758yUBfJkertzibz6yFB05nWk=";
 
   doCheck = true;
 
@@ -30,12 +31,26 @@ buildGoModule rec {
     "-X ${t}.Branch=unknown"
     "-X ${t}.BuildUser=nix@nixpkgs"
     "-X ${t}.BuildDate=unknown"
+    "-X ${t}.GoVersion=${lib.getVersion go}"
   ];
 
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      inherit (nixosTests) prometheus;
+      version = testers.testVersion {
+        command = "thanos --version";
+        package = thanos;
+      };
+    };
+  };
+
   meta = with lib; {
     description = "Highly available Prometheus setup with long term storage capabilities";
     homepage = "https://github.com/thanos-io/thanos";
+    changelog = "https://github.com/thanos-io/thanos/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ basvandijk ];
+    mainProgram = "thanos";
+    maintainers = with maintainers; [ basvandijk anthonyroussel ];
   };
 }

pkgs/servers/roundcube/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "roundcube";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchurl {
     url = "https://github.com/roundcube/roundcubemail/releases/download/${version}/roundcubemail-${version}-complete.tar.gz";
-    sha256 = "sha256-peq8fggo4CYYea7JCp1KbcAgPpiOFN4vk9bAYeZIkcg=";
+    sha256 = "sha256-Fktyy3jeidEEdB7pCQ9AJOY7+tpDlJA0hENl8/pwtf0=";
   };
 
   patches = [ ./0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch ];

pkgs/servers/windmill/default.nix

@@ -14,6 +14,7 @@
 , openssl
 , pango
 , pixman
+, giflib
 , pkg-config
 , python3
 , rustfmt
@@ -23,13 +24,13 @@
 
 let
   pname = "windmill";
-  version = "1.188.1";
+  version = "1.210.1";
 
   fullSrc = fetchFromGitHub {
     owner = "windmill-labs";
     repo = "windmill";
     rev = "v${version}";
-    hash = "sha256-IiCIiP5KYRw10aPlR40RPW0ynXq5itf0LLtpDtxCNE4=";
+    hash = "sha256-ss3EsIqfuctPOEdI5IQtyFFcDzIqnFm6UUG1vA+OlkQ=";
   };
 
   pythonEnv = python3.withPackages (ps: [ ps.pip-tools ]);
@@ -42,7 +43,7 @@ let
 
     sourceRoot = "${fullSrc.name}/frontend";
 
-    npmDepsHash = "sha256-TgAv3iUD0kP2mOvMVOW4yYCDCsf2Cr8IfXK+V+f35uw";
+    npmDepsHash = "sha256-l9MRaa6TaBg9vFoVuIGZNC9jLS29TlWeSniIBRNDRgU=";
 
     # without these you get a
     # FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
@@ -52,7 +53,7 @@ let
       npm run generate-backend-client
     '';
 
-    buildInputs = [ pixman cairo pango ];
+    buildInputs = [ pixman cairo pango giflib ];
     nativeBuildInputs = [ python3 pkg-config ];
 
     installPhase = ''
@@ -93,6 +94,8 @@ rustPlatform.buildRustPackage {
     outputHashes = {
       "progenitor-0.3.0" = "sha256-F6XRZFVIN6/HfcM8yI/PyNke45FL7jbcznIiqj22eIQ=";
       "tinyvector-0.1.0" = "sha256-NYGhofU4rh+2IAM+zwe04YQdXY8Aa4gTmn2V2HtzRfI=";
+      "archiver-rs-0.5.1" = "sha256-ZIik0mMABmhdx/ullgbOrKH5GAtqcOKq5A6vB7aBSjk=";
+      "pg-embed-0.7.2" = "sha256-R/SrlzNK7aAOyXVTQ/WPkiQb6FyMg9tpsmPTsiossDY=";
     };
   };
 
@@ -118,6 +121,7 @@ rustPlatform.buildRustPackage {
     openssl
     rustfmt
     lld
+    stdenv.cc.cc.lib
   ];
 
   nativeBuildInputs = [
@@ -146,6 +150,7 @@ rustPlatform.buildRustPackage {
 
     wrapProgram "$out/bin/windmill" \
       --prefix PATH : ${lib.makeBinPath [go pythonEnv deno nsjail bash]} \
+      --prefix LD_LIBRARY_PATH : "${stdenv.cc.cc.lib}/lib" \
       --set PYTHON_PATH "${pythonEnv}/bin/python3" \
       --set GO_PATH "${go}/bin/go" \
       --set DENO_PATH "${deno}/bin/deno" \

pkgs/test/nixpkgs-check-by-name/.envrc

@@ -1 +1,7 @@
+if has nix_direnv_watch_file; then
+  nix_direnv_watch_file default.nix shell.nix
+else
+  watch_file default.nix shell.nix
+fi
+
 use nix

pkgs/tools/misc/pipe-rename/default.nix

@@ -13,6 +13,12 @@ rustPlatform.buildRustPackage rec {
 
   nativeCheckInputs = [ python3 ];
 
+  checkFlags = [
+    # tests are failing upstream
+    "--skip=test_dot"
+    "--skip=test_dotdot"
+  ];
+
   preCheck = ''
     patchShebangs tests/editors/env-editor.py
   '';

pkgs/tools/text/gtree/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gtree";
-  version = "1.10.2";
+  version = "1.10.3";
 
   src = fetchFromGitHub {
     owner = "ddddddO";
     repo = "gtree";
     rev = "v${version}";
-    hash = "sha256-sfw+Si6g6NVUWZdB6q3wnoabMAqIR9/KT1HsXtbafDY=";
+    hash = "sha256-KFEYkhCLMcJ4NkHu0kkuG70EvJQ3HYDvicmomcMJZjc=";
   };
 
-  vendorHash = "sha256-3g47EuDElz1lrw7pgzD1jtTAs2Up97WWWFHe6aFE9zk=";
+  vendorHash = "sha256-rvVrVv73gW26UUy1MyxKDjUgX1mrMMii+l8qU2hLOek=";
 
   subPackages = [
     "cmd/gtree"

pkgs/tools/typesetting/typst-preview/default.nix

@@ -1,73 +0,0 @@
-{ lib, fetchFromGitHub, rustPlatform, fetchYarnDeps, mkYarnPackage, darwin
-, stdenv }:
-
-let
-  name = "typst-preview";
-  version = "0.9.0";
-  src = fetchFromGitHub {
-    owner = "Enter-tainer";
-    repo = name;
-    rev = "v${version}";
-    hash = "sha256-r/zDvfMvfvZqa3Xkzk70tIEyhc5LDwqc2A5MUuK2xC0=";
-  };
-  frontendSrc = "${src}/addons/frontend";
-  frontend = mkYarnPackage rec {
-    inherit version;
-    pname = "${name}-frontend";
-    src = frontendSrc;
-    packageJSON = ./package.json;
-
-    offlineCache = fetchYarnDeps {
-      yarnLock = "${frontendSrc}/yarn.lock";
-      hash = "sha256-7a7/UOfau84nLIAKj6Tn9rTUmeBJ7rYDFAdr55ZDLgA=";
-    };
-
-    buildPhase = ''
-      runHook preBuild
-      yarn --offline build
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-      cp -R deps/${pname}/dist $out
-      runHook postInstall
-    '';
-    doDist = false;
-  };
-
-in rustPlatform.buildRustPackage rec {
-
-  pname = name;
-  inherit version src;
-
-  buildInputs = lib.optionals stdenv.isDarwin
-    (with darwin.apple_sdk.frameworks; [
-      Security
-      SystemConfiguration
-      CoreServices
-    ]);
-
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "hayagriva-0.4.0" = "sha256-377lXL3+TO8U91OopMYEI0NrWWwzy6+O7B65bLhP+X4=";
-      "typst-0.9.0" = "sha256-+rnsUSGi3QZlbC4i8racsM4U6+l8oA9YjjUOtQAIWOk=";
-      "typst-ts-compiler-0.4.0-rc9" =
-        "sha256-NVmbAodDRJBJlGGDRjaEcTHGoCeN4hNjIynIDKqvNbM=";
-    };
-  };
-
-  prePatch = ''
-    mkdir -p addons/vscode/out/frontend
-    cp -R ${frontend}/* addons/vscode/out/frontend/
-  '';
-
-  meta = with lib; {
-    description = "Preview your Typst files in vscode";
-    homepage = "https://github.com/Enter-tainer/typse-preview";
-    license = licenses.mit;
-    maintainers = with maintainers; [ berberman ];
-    mainProgram = "typst-preview";
-  };
-}

pkgs/top-level/all-packages.nix

@@ -9304,7 +9304,10 @@ with pkgs;
     stdenv = gcc8Stdenv;
   };
 
-  hylafaxplus = callPackage ../servers/hylafaxplus { };
+  hylafaxplus = callPackage ../servers/hylafaxplus {
+    # libtiff >= 4.6 dropped many executables needed by hylafaxplus
+    libtiff = libtiff_4_5;
+  };
 
   hyphen = callPackage ../development/libraries/hyphen { };
 
@@ -12493,6 +12496,8 @@ with pkgs;
 
   qlcplus = libsForQt5.callPackage ../applications/misc/qlcplus { };
 
+  qlog = qt6Packages.callPackage ../applications/radio/qlog { };
+
   qnial = callPackage ../development/interpreters/qnial { };
 
   quickbms = pkgsi686Linux.callPackage ../tools/archivers/quickbms { };
@@ -14235,8 +14240,6 @@ with pkgs;
 
   typst-live = callPackage ../tools/typesetting/typst-live { };
 
-  typst-preview = callPackage ../tools/typesetting/typst-preview { };
-
   tz = callPackage ../tools/misc/tz { };
 
   u9fs = callPackage ../servers/u9fs { };
@@ -17273,7 +17276,9 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) SystemConfiguration CoreFoundation Security;
   };
 
-  squeak = callPackage ../development/compilers/squeak { };
+  squeak = callPackage ../development/compilers/squeak {
+    stdenv = clangStdenv;
+  };
 
   squirrel-sql = callPackage ../development/tools/database/squirrel-sql {
     drivers = [ jtds_jdbc mssql_jdbc mysql_jdbc postgresql_jdbc ];
@@ -23501,6 +23506,7 @@ with pkgs;
   libtifiles2 = callPackage ../development/libraries/libtifiles2 { };
 
   libtiff = callPackage ../development/libraries/libtiff { };
+  libtiff_4_5 = callPackage ../development/libraries/libtiff/4.5.nix { };
 
   libtiger = callPackage ../development/libraries/libtiger { };
 
@@ -34092,9 +34098,9 @@ with pkgs;
   okteto = callPackage ../development/tools/okteto { };
 
   onlyoffice-bin_7_2 = callPackage ../applications/office/onlyoffice-bin/7_2.nix { };
-  onlyoffice-bin_7_4 = callPackage ../applications/office/onlyoffice-bin/7_4.nix { };
+  onlyoffice-bin_7_5 = callPackage ../applications/office/onlyoffice-bin/7_5.nix { };
   onlyoffice-bin = onlyoffice-bin_7_2;
-  onlyoffice-bin_latest = onlyoffice-bin_7_4;
+  onlyoffice-bin_latest = onlyoffice-bin_7_5;
 
   onmetal-image = callPackage ../tools/virtualization/onmetal-image { };
 

pkgs/top-level/python-aliases.nix

@@ -35,6 +35,7 @@ in
 mapAliases ({
   abodepy = jaraco-abode; # added 2023-02-01
   acebinf = throw "acebinf has been removed because it is abandoned and broken."; # Added 2023-05-19
+  adafruit-nrfutil = throw "adafruit-nrfutil has been promoted to a top-level attribute."; # Added 2023-11-19
   aioh2 = throw "aioh2 has been removed because it is abandoned and broken."; # Added 2022-03-30
   aionotify = throw "aionotify has been removed because is unmaintained and incompatible with python3.11."; # Added 2023-10-27
   aiosenseme = throw "aiosenseme has been removed, because it does no longer work with the latest firmware and has become unmaintained"; # Added 2023-07-05

pkgs/top-level/python-packages.nix

@@ -54,8 +54,6 @@ self: super: with self; {
 
   adafruit-io = callPackage ../development/python-modules/adafruit-io { };
 
-  adafruit-nrfutil = callPackage ../development/python-modules/adafruit-nrfutil { };
-
   adafruit-platformdetect = callPackage ../development/python-modules/adafruit-platformdetect { };
 
   adafruit-pureio = callPackage ../development/python-modules/adafruit-pureio { };