Merge staging-next into staging

2022-10-06 18:03:42 +00:00 · 2022-10-06 18:03:42 +00:00 · 0b4912d905
commit 0b4912d905
parent da40c2836e c5f0d725df
45 changed files with 692 additions and 210 deletions
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -20,6 +20,7 @@ fluent,,,,,,alerque
 gitsigns.nvim,https://github.com/lewis6991/gitsigns.nvim.git,,,,5.1,
 http,,,,0.3-0,,vcunat
 inspect,,,,,,
+jsregexp,,,,,,
 ldbus,,,http://luarocks.org/dev,,,
 ldoc,https://github.com/stevedonovan/LDoc.git,,,,,
 lgi,,,,,,
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -536,6 +536,16 @@
          <literal>services.datadog-agent</literal> module.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>teleport</literal> has been upgraded to major version
+          10. Please see upstream
+          <link xlink:href="https://goteleport.com/docs/ver/10.0/management/operations/upgrading/">upgrade
+          instructions</link> and
+          <link xlink:href="https://goteleport.com/docs/ver/10.0/changelog/#1000">release
+          notes</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          lemmy module option
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -180,6 +180,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).

 - dd-agent package removed along with the `services.dd-agent` module, due to the project being deprecated in favor of `datadog-agent`,  which is available via the `services.datadog-agent` module.

+- `teleport` has been upgraded to major version 10. Please see upstream [upgrade instructions](https://goteleport.com/docs/ver/10.0/management/operations/upgrading/) and [release notes](https://goteleport.com/docs/ver/10.0/changelog/#1000).
+
 - lemmy module option `services.lemmy.settings.database.createLocally`
  moved to `services.lemmy.database.createLocally`.

--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@ -190,7 +190,7 @@ let
    );
    renewOpts = escapeShellArgs (
      commonOpts
-      ++ [ "renew" ]
+      ++ [ "renew" "--no-random-sleep" ]
      ++ optionals data.ocspMustStaple [ "--must-staple" ]
      ++ data.extraLegoRenewFlags
    );
@ -223,9 +223,9 @@ let
        # have many certificates, the renewals are distributed over
        # the course of the day to avoid rate limits.
        AccuracySec = "${toString (_24hSecs / numCerts)}s";
-
        # Skew randomly within the day, per https://letsencrypt.org/docs/integration-guide/.
        RandomizedDelaySec = "24h";
+        FixedRandomDelay = true;
      };
    };

@ -325,6 +325,7 @@ let
        '');
      } // optionalAttrs (data.listenHTTP != null && toInt (elemAt (splitString ":" data.listenHTTP) 1) < 1024) {
        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
      };

      # Working directory will be /tmp
@ -376,7 +377,8 @@ let

        # Check if we can renew.
        # We can only renew if the list of domains has not changed.
-        if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(ls -1 accounts)" ]; then
+        # We also need an account key. Avoids #190493
+        if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(find accounts -name '${data.email}.key')" ]; then

          # Even if a cert is not expired, it may be revoked by the CA.
          # Try to renew, and silently fail if the cert is not expired.
--- a/nixos/modules/services/networking/firefox-syncserver.nix
+++ b/nixos/modules/services/networking/firefox-syncserver.nix
@ -19,6 +19,9 @@ let
      fxa_email_domain = "api.accounts.firefox.com";
      fxa_oauth_server_url = "https://oauth.accounts.firefox.com/v1";
      run_migrations = true;
+      # if JWK caching is not enabled the token server must verify tokens
+      # using the fxa api, on a thread pool with a static size.
+      additional_blocking_threads_for_fxa_requests = 10;
    } // lib.optionalAttrs cfg.singleNode.enable {
      # Single-node mode is likely to be used on small instances with little
      # capacity. The default value (0.1) can only ever release capacity when
@ -309,11 +312,7 @@ in
        enableACME = cfg.singleNode.enableTLS;
        forceSSL = cfg.singleNode.enableTLS;
        locations."/" = {
-          proxyPass = "http://localhost:${toString cfg.settings.port}";
-          # source mentions that this header should be set
-          extraConfig = ''
-            add_header X-Content-Type-Options nosniff;
-          '';
+          proxyPass = "http://127.0.0.1:${toString cfg.settings.port}";
        };
      };
    };
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@ -41,6 +41,16 @@
    inherit documentRoot;
  };

+  simpleConfig = {
+    security.acme = {
+      certs."http.example.test" = {
+        listenHTTP = ":80";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 80 ];
+  };
+
  # Base specialisation config for testing general ACME features
  webserverBasicConfig = {
    services.nginx.enable = true;
@ -173,6 +183,26 @@ in {
      services.nginx.logError = "stderr info";

      specialisation = {
+        # Tests HTTP-01 verification using Lego's built-in web server
+        http01lego.configuration = simpleConfig;
+
+        renew.configuration = lib.mkMerge [
+          simpleConfig
+          {
+            # Pebble provides 5 year long certs,
+            # needs to be higher than that to test renewal
+            security.acme.certs."http.example.test".validMinDays = 9999;
+          }
+        ];
+
+        # Tests that account creds can be safely changed.
+        accountchange.configuration = lib.mkMerge [
+          simpleConfig
+          {
+            security.acme.certs."http.example.test".email = "admin@example.test";
+          }
+        ];
+
        # First derivation used to test general ACME features
        general.configuration = { ... }: let
          caDomain = nodes.acme.test-support.acme.caDomain;
@ -446,7 +476,35 @@ in {

      download_ca_certs(client)

-      # Perform general tests first
+      # Perform http-01 w/ lego test first
+      with subtest("Can request certificate with Lego's built in web server"):
+          switch_to(webserver, "http01lego")
+          webserver.wait_for_unit("acme-finished-http.example.test.target")
+          check_fullchain(webserver, "http.example.test")
+          check_issuer(webserver, "http.example.test", "pebble")
+
+      # Perform renewal test
+      with subtest("Can renew certificates when they expire"):
+          hash = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")
+          switch_to(webserver, "renew")
+          webserver.wait_for_unit("acme-finished-http.example.test.target")
+          check_fullchain(webserver, "http.example.test")
+          check_issuer(webserver, "http.example.test", "pebble")
+          hash_after = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")
+          assert hash != hash_after
+
+      # Perform account change test
+      with subtest("Handles email change correctly"):
+          hash = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")
+          switch_to(webserver, "accountchange")
+          webserver.wait_for_unit("acme-finished-http.example.test.target")
+          check_fullchain(webserver, "http.example.test")
+          check_issuer(webserver, "http.example.test", "pebble")
+          hash_after = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")
+          # Has to do a full run to register account, which creates new certs.
+          assert hash != hash_after
+
+      # Perform general tests
      switch_to(webserver, "general")

      with subtest("Can request certificate with HTTP-01 challenge"):
--- a/pkgs/applications/blockchains/erigon.nix
+++ b/pkgs/applications/blockchains/erigon.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "erigon";
-  version = "2022.09.03";
+  version = "2022.10.01";

  src = fetchFromGitHub {
    owner = "ledgerwatch";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-dilsoJw7VPA7SerpAOhYUviE2zt2qMBmSLWaPm0ux2Y=";
+    sha256 = "sha256-FuOVI59vfhm5q92hnfgarh3zpLXSDRmZQJuERHf4I7A=";
    fetchSubmodules = true;
  };

-  vendorSha256 = "sha256-W8hEMfn2qW/3+V6x/RH1azj49V26fyQ+1y2re3tXsTk=";
+  vendorSha256 = "sha256-zdm11bGkCcwnz+8dve2pdcpg6pDgLe4UG3Ob/mbqhko=";
  proxyVendor = true;

  # Build errors in mdbx when format hardening is enabled:
--- a/pkgs/applications/blockchains/fulcrum/default.nix
+++ b/pkgs/applications/blockchains/fulcrum/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "fulcrum";
-  version = "1.8.1";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "cculianu";
    repo = "Fulcrum";
    rev = "v${version}";
-    sha256 = "sha256-GaXXqIHuMTGn8iLymAhL8i0HzXmaO6RxtvIzgWw6QI0=";
+    sha256 = "sha256-sX9GeY+c/mcsAWApQ0E5LwoXZgWUC4w7YY8/PEzMhl8=";
  };

  nativeBuildInputs = [ pkg-config qmake ];
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -10,16 +10,16 @@ let
    inherit tiling_wm;
  };
  stableVersion = {
-    version = "2021.2.1.15"; # "Android Studio Chipmunk (2021.2.1)"
-    sha256Hash = "ABjg38DdKSFwBRb3osRDN3xVd4jaf7CkUkPstDAHRb4=";
+    version = "2021.3.1.16"; # "Android Studio Dolphin (2021.3.1)"
+    sha256Hash = "GnJbWFeG9DuUQzbK9wM2BEbj9LXm4jQFf/Eh5Q75HZo=";
  };
  betaVersion = {
-    version = "2021.3.1.14"; # "Android Studio Dolphin (2021.3.1) Beta 5"
-    sha256Hash = "k1Qt54u45rwHsQNz9TVqnFB65kBKtfFZ3OknpfutKPI=";
+    version = "2022.1.1.11"; # "Android Studio Electic Eel (2022.1.1) Beta 1"
+    sha256Hash = "YQ20VQME9bQ2vOI7RWfA00npewOL3D6y1dGgNnJXnHc=";
  };
  latestVersion = { # canary & dev
-    version = "2022.1.1.8"; # "Android Studio Electric Eel (2022.1.1) Canary 8"
-    sha256Hash = "0bZXx4YpMztLAnwuBaSaNT3GJNfYnqCDanwR+Q7qyUc=";
+    version = "2022.2.1.2"; # "Android Studio Flamingo (2022.2.1) Canary 2"
+    sha256Hash = "hlHlgyl9If2LH4aExpElx0rqmWeoFX+qx4w6RRb5e8U=";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1409,23 +1409,6 @@ let
        };
      };

-      jakebecker.elixir-ls = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "elixir-ls";
-          publisher = "JakeBecker";
-          version = "0.11.0";
-          sha256 = "sha256-okvwyD0m2r8ar85VtuBUNMUZGGrCfJ4DB9v7aSX5PjM=";
-        };
-        meta = with lib; {
-          changelog = "https://marketplace.visualstudio.com/items/JakeBecker.elixir-ls/changelog";
-          description = "Elixir support with debugger, autocomplete, and more. Powered by ElixirLS.";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=JakeBecker.elixir-ls";
-          homepage = "https://github.com/elixir-lsp/elixir-ls";
-          license = licenses.mit;
-          maintainers = with maintainers; [ datafoo ];
-        };
-      };
-
      james-yu.latex-workshop = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "latex-workshop";
@ -2805,6 +2788,7 @@ let

  aliases = self: super: {
    # aliases
+    jakebecker.elixir-ls = super.elixir-lsp.vscode-elixir-ls;
    ms-vscode = lib.recursiveUpdate super.ms-vscode { inherit (super.golang) go; };
  };

--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@ -10,14 +10,14 @@

 python3Packages.buildPythonPackage rec {
  pname = "hydrus";
-  version = "500";
+  version = "501";
  format = "other";

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-gsOto37++++ucpDC0ri3HhROp7v6qlHENjFvsbuyM6k=";
+    sha256 = "sha256-dmQD3CAAAhE6IOfT38PHUIlHdDFdk6HZ6ZEZmKw7+WM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/kubectl-doctor/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-doctor/default.nix
@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:

 buildGoModule rec {
  pname = "kubectl-doctor";
@ -11,7 +11,16 @@ buildGoModule rec {
    sha256 = "sha256-yp5OfSDxIASiCgISUVNxfe3dsLukgIoHARVPALIaQfY=";
  };

-  vendorSha256 = "sha256-pdg65q7iMkcpFvSVUTa07m5URLQNNEfWQ4mdGu4suBM=";
+  patches = [
+    (fetchpatch {
+      # https://github.com/emirozer/kubectl-doctor/pull/21
+      name = "go-1.19-client-go-0.25.patch";
+      url = "https://github.com/emirozer/kubectl-doctor/commit/a987ef58063e305409034af280d688a11682dbb9.patch";
+      sha256 = "sha256-NQd/WxUfYwBDowhnoUWaOV8k7msiOhff3Bjux+a9R9E=";
+    })
+  ];
+
+  vendorSha256 = "sha256-qhffg/s1RZFNW0nHLbJ89yqLzdC72ARXdbSfMLJK2pQ=";

  postInstall = ''
    mv $out/bin/{cmd,kubectl-doctor}
--- a/pkgs/applications/networking/cluster/nomad/1.2.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.2.nix
@ -4,7 +4,7 @@

 callPackage ./generic.nix {
  inherit buildGoModule;
-  version = "1.2.12";
-  sha256 = "sha256-PdMo96/foN7rSNvMOQ16N3advy+h0GX7LYtfl23xRfs=";
-  vendorSha256 = "sha256-fmqhaM3yK2ThiD+qwQTr+d5FqhZWzkwcGTSPdXNNFTU=";
+  version = "1.2.13";
+  sha256 = "sha256-yDcvN6cKG1BlBq1ygYB58bS1YRHWqJgLXRlqI7lrW1A=";
+  vendorSha256 = "sha256-dPErDlJ4oNpER3Ij4yrN77V8sZvDUuXY7dM39u9xT4I=";
 }
--- a/pkgs/applications/networking/cluster/nomad/1.3.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.3.nix
@ -4,7 +4,7 @@

 callPackage ./generic.nix {
  inherit buildGoModule;
-  version = "1.3.5";
-  sha256 = "sha256-WKS7EfZxysy/oyq1fa8rKvmfgHRiB7adSVhALZNFYgo=";
-  vendorSha256 = "sha256-byc6wAxpqhxlN3kyHyFQeBS9/oIjHeoz6ldYskizgaI=";
+  version = "1.3.6";
+  sha256 = "sha256-E1+QFaakAsqeXxAfY80ExWVIud7Q/q2TaUVsmADjsgo=";
+  vendorSha256 = "sha256-kgTRjPr7GsoBeE/s9wrmUWE5jv1ZmszfVDsVaRbdx14=";
 }
--- a/pkgs/applications/networking/cluster/nomad/1.4.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.4.nix
@ -0,0 +1,10 @@
+{ callPackage
+, buildGoModule
+}:
+
+callPackage ./generic.nix {
+  inherit buildGoModule;
+  version = "1.4.0";
+  sha256 = "sha256-iAAnXhJdfgBsuBsuIkFQB4AbTplX3HJuf5HfUGAUEeM=";
+  vendorSha256 = "sha256-kfT2UGC8Wl7CM9lOU75UqKc0/O1okGCoGDpmQntakbU=";
+}
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "v2ray-geoip";
-  version = "202209290111";
+  version = "202210060105";

  src = fetchFromGitHub {
    owner = "v2fly";
    repo = "geoip";
-    rev = "1aa11a6dd94b708175a81b12037486459fa090a8";
-    sha256 = "sha256-CVze/QyoBKZmd+U8bfjxr+u8W95W+fs9+mAdPgyIpg4=";
+    rev = "0bb2420d643555aa19b21f3c06b517a7c14826b6";
+    sha256 = "sha256-5vr7iO2vny9yalJblBVgNwupEQ9w3LZXM+VKb4xSVD0=";
  };

  installPhase = ''
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@ -153,7 +153,7 @@ buildLuarocksPackage {
 }) {};

 busted = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, penlight, luafilesystem, dkjson, lua_cliargs, lua, say, mediator_lua, luasystem, lua-term, luassert
+, fetchgit, say, luassert, lua_cliargs, luasystem, luafilesystem, lua, mediator_lua, penlight, lua-term, dkjson
 }:
 buildLuarocksPackage {
  pname = "busted";
@ -176,7 +176,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ penlight luafilesystem dkjson lua_cliargs lua say mediator_lua luasystem lua-term luassert ];
+  propagatedBuildInputs = [ say luassert lua_cliargs luasystem luafilesystem lua mediator_lua penlight lua-term dkjson ];

  meta = {
    homepage = "https://lunarmodules.github.io/busted/";
@ -186,7 +186,7 @@ buildLuarocksPackage {
 }) {};

 cassowary = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, penlight, lua
+, fetchgit, lua, penlight
 }:
 buildLuarocksPackage {
  pname = "cassowary";
@ -209,7 +209,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ penlight lua ];
+  propagatedBuildInputs = [ lua penlight ];

  meta = {
    homepage = "https://github.com/sile-typesetter/cassowary.lua";
@ -399,7 +399,7 @@ buildLuarocksPackage {
 }) {};

 digestif = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lpeg, lua
+, fetchgit, lua, lpeg
 }:
 buildLuarocksPackage {
  pname = "digestif";
@ -419,7 +419,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.3");
-  propagatedBuildInputs = [ lpeg lua ];
+  propagatedBuildInputs = [ lua lpeg ];

  meta = {
    homepage = "https://github.com/astoff/digestif/";
@ -504,7 +504,7 @@ buildLuarocksPackage {
 }) {};

 fluent = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, penlight, cldr, luaepnf, lua
+, fetchgit, luaepnf, penlight, cldr, lua
 }:
 buildLuarocksPackage {
  pname = "fluent";
@ -527,7 +527,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ penlight cldr luaepnf lua ];
+  propagatedBuildInputs = [ luaepnf penlight cldr lua ];

  meta = {
    homepage = "https://github.com/alerque/fluent-lua";
@ -546,10 +546,10 @@ buildLuarocksPackage {

  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
  "url": "https://github.com/lewis6991/gitsigns.nvim",
-  "rev": "d7e0bcbe45bd9d5d106a7b2e11dc15917d272c7a",
-  "date": "2022-09-01T14:06:41+01:00",
-  "path": "/nix/store/3i20afjhjknqk3wggbrk3kwcbnnjqqxd-gitsigns.nvim",
-  "sha256": "1h4gxyamynwygxpqfib2a7sd1xbi6sh8ixg85j6qiaqqpahr0a4k",
+  "rev": "f98c85e7c3d65a51f45863a34feb4849c82f240f",
+  "date": "2022-09-19T00:23:17+01:00",
+  "path": "/nix/store/7gx7accssqrpn18g9325a8d4wx48467b-gitsigns.nvim",
+  "sha256": "0ljzja43jdkv77nh4253x3gwk2hjx968yk7b5ag4y1mvyp1540qn",
  "fetchLFS": false,
  "fetchSubmodules": true,
  "deepClone": false,
@ -568,7 +568,7 @@ buildLuarocksPackage {
 }) {};

 http = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchzip, basexx, lpeg_patterns, compat53, bit32, fifo, lua, binaryheap, cqueues, lpeg, luaossl
+, fetchzip, compat53, lpeg, cqueues, luaossl, bit32, lua, binaryheap, basexx, lpeg_patterns, fifo
 }:
 buildLuarocksPackage {
  pname = "http";
@ -583,7 +583,7 @@ buildLuarocksPackage {
  };

  disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ basexx lpeg_patterns compat53 bit32 fifo lua binaryheap cqueues lpeg luaossl ];
+  propagatedBuildInputs = [ compat53 lpeg cqueues luaossl bit32 lua binaryheap basexx lpeg_patterns fifo ];

  meta = {
    homepage = "https://github.com/daurnimator/lua-http";
@ -618,6 +618,39 @@ buildLuarocksPackage {
  };
 }) {};

+jsregexp = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
+, fetchgit, lua
+}:
+buildLuarocksPackage {
+  pname = "jsregexp";
+  version = "0.0.5-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/jsregexp-0.0.5-1.rockspec";
+    sha256 = "03zln61vxrgml71chrqdz8id076610rb0n9f2yah2nvjfpqpla68";
+  }).outPath;
+  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
+  "url": "https://github.com/kmarius/jsregexp.git",
+  "rev": "dd65498ae2c29b882d6c02c0a30577b08d660b94",
+  "date": "2022-08-16T21:04:46+02:00",
+  "path": "/nix/store/6kalvlazs50gna9k4ah0wg2avlah6nmr-jsregexp",
+  "sha256": "01hxql0z3yyzd17r3kyjx2kx0ng7zjc8dp2h2gqmpmjb9ssd4sf1",
+  "fetchLFS": false,
+  "fetchSubmodules": true,
+  "deepClone": false,
+  "leaveDotGit": false
+}
+ '') ["date" "path"]) ;
+
+  disabled = with lua; (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = {
+    homepage = "https://github.com/kmarius/jsregexp";
+    description = "javascript (ECMA19) regular expressions for lua";
+    license.fullName = "MIT";
+  };
+}) {};
+
 ldbus = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
 , fetchgit, lua
 }:
@ -873,7 +906,7 @@ buildLuarocksPackage {
 }) {};

 lpeg_patterns = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchzip, lua, lpeg
+, fetchzip, lpeg, lua
 }:
 buildLuarocksPackage {
  pname = "lpeg_patterns";
@ -887,7 +920,7 @@ buildLuarocksPackage {
    sha256 = "1s3c179a64r45ffkawv9dnxw4mzwkzj00nr9z2gs5haajgpjivw6";
  };

-  propagatedBuildInputs = [ lua lpeg ];
+  propagatedBuildInputs = [ lpeg lua ];

  meta = {
    homepage = "https://github.com/daurnimator/lpeg_patterns/archive/v0.5.zip";
@ -1138,7 +1171,7 @@ buildLuarocksPackage {
 }) {};

 lua-lsp = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, inspect, lpeglabel, dkjson
+, fetchgit, dkjson, inspect, lpeglabel, lua
 }:
 buildLuarocksPackage {
  pname = "lua-lsp";
@ -1161,7 +1194,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.4");
-  propagatedBuildInputs = [ lua inspect lpeglabel dkjson ];
+  propagatedBuildInputs = [ dkjson inspect lpeglabel lua ];

  meta = {
    homepage = "https://github.com/Alloyed/lua-lsp";
@ -1296,7 +1329,7 @@ buildLuarocksPackage {
 }) {};

 lua-resty-openidc = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua-resty-http, lua-resty-jwt, lua-resty-session, lua
+, fetchgit, lua-resty-http, lua, lua-resty-session, lua-resty-jwt
 }:
 buildLuarocksPackage {
  pname = "lua-resty-openidc";
@ -1319,7 +1352,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ lua-resty-http lua-resty-jwt lua-resty-session lua ];
+  propagatedBuildInputs = [ lua-resty-http lua lua-resty-session lua-resty-jwt ];

  meta = {
    homepage = "https://github.com/zmartzone/lua-resty-openidc";
@ -1598,7 +1631,7 @@ buildLuarocksPackage {
 }) {};

 luacheck = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, luafilesystem, argparse
+, fetchgit, lua, argparse, luafilesystem
 }:
 buildLuarocksPackage {
  pname = "luacheck";
@ -1621,7 +1654,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ lua luafilesystem argparse ];
+  propagatedBuildInputs = [ lua argparse luafilesystem ];

  meta = {
    homepage = "https://github.com/lunarmodules/luacheck";
@ -1697,7 +1730,7 @@ buildLuarocksPackage {
 }) {};

 luadbi-mysql = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, luadbi
+, fetchgit, luadbi, lua
 }:
 buildLuarocksPackage {
  pname = "luadbi-mysql";
@ -1720,7 +1753,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.4");
-  propagatedBuildInputs = [ lua luadbi ];
+  propagatedBuildInputs = [ luadbi lua ];

  meta = {
    homepage = "https://github.com/mwild1/luadbi";
@ -1730,7 +1763,7 @@ buildLuarocksPackage {
 }) {};

 luadbi-postgresql = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, luadbi, lua
+, fetchgit, lua, luadbi
 }:
 buildLuarocksPackage {
  pname = "luadbi-postgresql";
@ -1753,7 +1786,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.4");
-  propagatedBuildInputs = [ luadbi lua ];
+  propagatedBuildInputs = [ lua luadbi ];

  meta = {
    homepage = "https://github.com/mwild1/luadbi";
@ -1796,7 +1829,7 @@ buildLuarocksPackage {
 }) {};

 luaepnf = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, lpeg
+, fetchgit, lpeg, lua
 }:
 buildLuarocksPackage {
  pname = "luaepnf";
@ -1819,7 +1852,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.5");
-  propagatedBuildInputs = [ lua lpeg ];
+  propagatedBuildInputs = [ lpeg lua ];

  meta = {
    homepage = "http://siffiejoe.github.io/lua-luaepnf/";
@ -1959,17 +1992,17 @@ lualogging = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
 }:
 buildLuarocksPackage {
  pname = "lualogging";
-  version = "1.6.0-2";
+  version = "1.7.0-1";
  knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lualogging-1.6.0-2.rockspec";
-    sha256 = "1235sfss0gmcw744rnhzfffhd1z732g2b2vsbpbz9kcvvhznmamb";
+    url    = "mirror://luarocks/lualogging-1.7.0-1.rockspec";
+    sha256 = "1h6zrhp3jvx4257gkskg8b6kd7pm6pd9wzhqb20vllyhj5vfb53h";
  }).outPath;
  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
  "url": "https://github.com/lunarmodules/lualogging.git",
-  "rev": "0bc4415de03ff1a99c92c02a5bed14a45b078079",
-  "date": "2021-11-09T20:20:42+01:00",
-  "path": "/nix/store/p3cyhqjw12bj7s6y4hndzqdkdfwq3958-lualogging",
-  "sha256": "18664k4kfi4zq9n0217j57h42li6ws8s3f6d4yj0rcqsl19fxa7c",
+  "rev": "540df4424165b622d7c408b1f9d2d3420a5206e8",
+  "date": "2022-09-21T22:50:18+02:00",
+  "path": "/nix/store/69jb23b1gv0pcb20jwan342zzp0zjw1f-lualogging",
+  "sha256": "1rwbf593qx67cbk45vm155d7ws1y0xgxmwca508l8clq7d6rv3x0",
  "fetchLFS": false,
  "fetchSubmodules": true,
  "deepClone": false,
@ -2339,10 +2372,10 @@ buildLuarocksPackage {

  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
  "url": "https://github.com/rktjmp/lush.nvim",
-  "rev": "6b9f399245de7bea8dac2c3bf91096ffdedfcbb7",
-  "date": "2022-08-10T01:43:55+10:00",
-  "path": "/nix/store/ljfhbz8s6pjnngbixk3m6ivpb7nx1gv0-lush.nvim",
-  "sha256": "0rb77rwmbm438bmbjfk5hwrrcn5sihsa1413bdpc27rw3rrn8v8z",
+  "rev": "fabf012e243bc58c4785ab4c44f05e94b34c431a",
+  "date": "2022-09-14T20:24:03+10:00",
+  "path": "/nix/store/z7nnsj480w2v8i3w0idy0z49yysvsa90-lush.nvim",
+  "sha256": "0bxxdlbay4r48xng1djljbgb93ls3xa83nb79gzvagfaiwgf6pn8",
  "fetchLFS": false,
  "fetchSubmodules": true,
  "deepClone": false,
@ -2498,7 +2531,7 @@ buildLuarocksPackage {
 }) {};

 moonscript = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, luafilesystem, lpeg, argparse
+, fetchgit, argparse, lua, lpeg, luafilesystem
 }:
 buildLuarocksPackage {
  pname = "moonscript";
@ -2518,7 +2551,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ lua luafilesystem lpeg argparse ];
+  propagatedBuildInputs = [ argparse lua lpeg luafilesystem ];

  meta = {
    homepage = "http://moonscript.org";
@ -2551,7 +2584,7 @@ buildLuarocksPackage {
 }) {};

 nvim-client = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchurl, coxpcall, luv, mpack, lua
+, fetchurl, luv, coxpcall, mpack, lua
 }:
 buildLuarocksPackage {
  pname = "nvim-client";
@ -2563,7 +2596,7 @@ buildLuarocksPackage {
  };

  disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ coxpcall luv mpack lua ];
+  propagatedBuildInputs = [ luv coxpcall mpack lua ];

  meta = {
    homepage = "https://github.com/neovim/lua-client";
@ -2598,7 +2631,7 @@ buildLuarocksPackage {
 }) {};

 penlight = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, luafilesystem, lua
+, fetchgit, lua, luafilesystem
 , busted}:
 buildLuarocksPackage {
  pname = "penlight";
@ -2618,7 +2651,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1");
-  propagatedBuildInputs = [ luafilesystem lua ];
+  propagatedBuildInputs = [ lua luafilesystem ];
  checkInputs = [ busted ];

  meta = {
@ -2630,7 +2663,7 @@ buildLuarocksPackage {
 }) {};

 plenary-nvim = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, luassert
+, fetchgit, luassert, lua
 }:
 buildLuarocksPackage {
  pname = "plenary.nvim";
@ -2638,10 +2671,10 @@ buildLuarocksPackage {

  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
  "url": "https://github.com/nvim-lua/plenary.nvim",
-  "rev": "4b66054e75356ac0b909bbfee9c682e703f535c2",
-  "date": "2022-09-03T11:21:04+02:00",
-  "path": "/nix/store/gaphh0qlf40ryk2000plscvzcbzg0kz5-plenary.nvim",
-  "sha256": "1yl5m7is35bk30swr5m1pcl2i0wf8gjcnas6bpahlxqa4x0yr1x8",
+  "rev": "4b7e52044bbb84242158d977a50c4cbcd85070c7",
+  "date": "2022-10-01T09:05:53+02:00",
+  "path": "/nix/store/hkj69cqq4qg3d98irg8wszgl7i1bg6lv-plenary.nvim",
+  "sha256": "11815h0h2mf5ym282ghk7xav90635r88qbgaflpgbyk2banl31wl",
  "fetchLFS": false,
  "fetchSubmodules": true,
  "deepClone": false,
@ -2650,7 +2683,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.4");
-  propagatedBuildInputs = [ lua luassert ];
+  propagatedBuildInputs = [ luassert lua ];

  meta = {
    homepage = "http://github.com/nvim-lua/plenary.nvim";
@ -2691,22 +2724,22 @@ buildLuarocksPackage {
 }) {};

 readline = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchurl, luaposix, lua
+, fetchurl, lua, luaposix
 }:
 buildLuarocksPackage {
  pname = "readline";
-  version = "3.1-0";
+  version = "3.2-0";
  knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/readline-3.1-0.rockspec";
-    sha256 = "0bl5hsplnlg8fx3v83sz48y2p1rlxfig3iycnk1pn3xi724kscnc";
+    url    = "mirror://luarocks/readline-3.2-0.rockspec";
+    sha256 = "1r0sgisxm4xd1r6i053iibxh30j7j3rcj4wwkd8rzkj8nln20z24";
  }).outPath;
  src = fetchurl {
-    url    = "http://www.pjb.com.au/comp/lua/readline-3.1.tar.gz";
-    sha256 = "0i02jsywj9mb4lwiyp742xgz53i9z5xzpx34lh54hcd6q3xkcrw2";
+    url    = "http://www.pjb.com.au/comp/lua/readline-3.2.tar.gz";
+    sha256 = "1mk9algpsvyqwhnq7jlw4cgmfzj30l7n2r6ak4qxgdxgc39f48k4";
  };

  disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.5");
-  propagatedBuildInputs = [ luaposix lua ];
+  propagatedBuildInputs = [ lua luaposix ];

  meta = {
    homepage = "http://pjb.com.au/comp/lua/readline.html";
@ -2736,6 +2769,7 @@ buildLuarocksPackage {
  meta = {
    homepage = "https://github.com/rest-nvim/rest.nvim";
    description = "A fast Neovim http client written in Lua";
+    maintainers = with lib.maintainers; [ teto ];
    license.fullName = "MIT";
  };
 }) {};
@ -2869,7 +2903,7 @@ buildLuarocksPackage {
 }) {};

 std-normalize = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, lua, std-_debug
+, fetchgit, std-_debug, lua
 }:
 buildLuarocksPackage {
  pname = "std.normalize";
@ -2889,7 +2923,7 @@ buildLuarocksPackage {
 '') ["date" "path"]) ;

  disabled = with lua; (luaOlder "5.1") || (luaAtLeast "5.5");
-  propagatedBuildInputs = [ lua std-_debug ];
+  propagatedBuildInputs = [ std-_debug lua ];

  meta = {
    homepage = "https://lua-stdlib.github.io/normalize";
@ -2925,7 +2959,7 @@ buildLuarocksPackage {
 }) {};

 tl = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchgit, compat53, luafilesystem, argparse
+, fetchgit, argparse, luafilesystem, compat53
 , dkjson}:
 buildLuarocksPackage {
  pname = "tl";
@ -2947,7 +2981,7 @@ buildLuarocksPackage {
 }
 '') ["date" "path"]) ;

-  propagatedBuildInputs = [ compat53 luafilesystem argparse ];
+  propagatedBuildInputs = [ argparse luafilesystem compat53 ];
  checkInputs = [ dkjson ];

  meta = {
--- a/pkgs/development/python-modules/detect-secrets/default.nix
+++ b/pkgs/development/python-modules/detect-secrets/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "detect-secrets";
-  version = "1.3.0";
+  version = "1.4.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "Yelp";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Dl/2HgCacDko/ug9nGA9X+LyOkuDot11H28lxrgkwdE=";
+    hash = "sha256-6EmL6XPySqcA3EA+FFkfw7Dkxl5LvyBorIw0hesV5eU=";
    leaveDotGit = true;
  };

--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "slack-sdk";
-  version = "3.18.5";
+  version = "3.19.1";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "slackapi";
    repo = "python-slack-sdk";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-b778qmf0LkSAo8/eho1zoC0kc4byexqCG3R/fRBlr6M=";
+    sha256 = "sha256-DYDyWlNl/3SjSiA0kyMfz4/t42Oxh7VX43ZDL94eFzo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/slither-analyzer/default.nix
+++ b/pkgs/development/python-modules/slither-analyzer/default.nix
@ -13,16 +13,16 @@

 buildPythonPackage rec {
  pname = "slither-analyzer";
-  version = "0.8.3";
+  version = "0.9.0";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "crytic";
    repo = "slither";
-    rev = version;
-    sha256 = "sha256-Kh5owlkRB9hDlfIRiS+aNFe4YtZj38CLeE3Fe+R7diM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Td7WBPpc+ZYlFroZNzvUqQZJag0lbkCgj8TVOPrAAPY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "twilio";
-  version = "7.14.1";
+  version = "7.14.2";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "twilio";
    repo = "twilio-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-VKAeM1a1TMXrewJ+j+Outyp7vxh9xovqjJ+GneYa6eg=";
+    hash = "sha256-lamP7ltKLizwPGX1063bZ90M89oPmXVSogi3HNksvHE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/types-pytz/default.nix
+++ b/pkgs/development/python-modules/types-pytz/default.nix
@ -5,12 +5,12 @@

 buildPythonPackage rec {
  pname = "types-pytz";
-  version = "2022.2.1.0";
+  version = "2022.4.0.0";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-R8+xnFK591iWRAVB2zkv0xKjWyecYwelMdtxFS6mPis=";
+    sha256 = "sha256-F9ZuSxboDOrgeHcm86IiiN99P5/evrCR3GS5LA5OoJ0=";
  };

  # Modules doesn't have tests
--- a/pkgs/development/python-modules/weconnect-mqtt/default.nix
+++ b/pkgs/development/python-modules/weconnect-mqtt/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "weconnect-mqtt";
-  version = "0.40.1";
+  version = "0.40.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "tillsteinbach";
    repo = "WeConnect-mqtt";
    rev = "refs/tags/v${version}";
-    hash = "sha256-WnaVE9WEJmdlxsPUZcEmeCf4DK1GCyd2yQmBiQZ7NkI=";
+    hash = "sha256-TRBS51ZlE4TbDAQdQyODUNDVfIuKZtrf38iBPIGyRhI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/bashate/default.nix
+++ b/pkgs/development/tools/bashate/default.nix
@ -12,12 +12,12 @@

 buildPythonApplication rec {
  pname = "bashate";
-  version = "2.1.0";
+  version = "2.1.1";
  disabled = pythonOlder "3.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "a0df143639715dc2fb6cf9aa6907e4a372d6f0a43afeffc55c5fb3ecfe3523c8";
+    sha256 = "sha256-S6tul3+DBacgU1+Pk/H7QsUh/LxKbCs9PXZx9C8iH0w=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/wp4nix/default.nix
+++ b/pkgs/development/tools/wp4nix/default.nix
@ -1,4 +1,10 @@
-{ lib, buildGoModule, fetchFromGitLab, nix, subversion }:
+{ lib
+, buildGoModule
+, fetchFromGitLab
+, nix
+, subversion
+, makeWrapper
+}:

 buildGoModule rec {
  pname = "wp4nix";
@ -14,9 +20,13 @@ buildGoModule rec {

  vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";

-  postPatch = ''
-    substituteInPlace main.go --replace nix-hash ${nix}/bin/nix-hash
-    substituteInPlace svn.go --replace '"svn"' '"${subversion}/bin/svn"'
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/wp4nix \
+      --prefix PATH : ${lib.makeBinPath [ nix subversion ]}
  '';

  meta = with lib; {
--- a/pkgs/servers/dict/dictd-db.nix
+++ b/pkgs/servers/dict/dictd-db.nix
@ -56,6 +56,16 @@ in rec {
    url = "mirror://sourceforge/freedict/eng-fra.tar.gz";
    sha256 = "0fi6rrnbqnhc6lq8d0nmn30zdqkibrah0mxfg27hsn9z7alwbj3m";
  }) "eng-fra" "en_UK";
+  jpn2eng = makeDictdDB (fetchurl {
+    url = let version = "0.1";
+          in "mirror://sourceforge/freedict/jpn-eng/${version}/freedict-jpn-eng-${version}.dictd.tar.xz";
+    sha256 = "sha256-juJBoEq7EztLZzOomc7uoZhXVaQPKoUvIxxPLB0xByc=";
+  }) "jpn-eng" "jpn-eng" "ja_JP";
+  eng2jpn = makeDictdDB (fetchurl {
+    url = let version = "2022.04.06";
+          in "https://download.freedict.org/dictionaries/eng-jpn/${version}/freedict-eng-jpn-${version}.dictd.tar.xz";
+    sha256 = "sha256-kfRT2kgbV3XKarCr4mqDRT5A1jR8M8APky5M5MFYatE=";
+  }) "eng-jpn" "eng-jpn" "en_UK";
  mueller_eng2rus_pkg = makeDictdDB (fetchurl {
    url = "mirror://sourceforge/mueller-dict/mueller-dict-3.1.tar.gz";
    sha256 = "04r5xxznvmcb8hkxqbjgfh2gxvbdd87jnhqn5gmgvxxw53zpwfmq";
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "klipper";
-  version = "unstable-2022-09-16";
+  version = "unstable-2022-10-06";

  src = fetchFromGitHub {
    owner = "KevinOConnor";
    repo = "klipper";
-    rev = "7527e57e5a778d069aaa05b01e03869c63a1a712";
-    sha256 = "sha256-k3tvV7uCdmPN4SvZixvPmOqt5jTN9tz0W6SUXN5g3Ss=";
+    rev = "7290c14531211d027b430f36db5645ce496be900";
+    sha256 = "sha256-+BSsk2G6g4IJsbG6pggYb9vcaezqNUXEAXXAcMMhAfw=";
  };

  sourceRoot = "source/klippy";
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@ -48,13 +48,13 @@ in {
  '';

  nextcloud23 = generic {
-    version = "23.0.9";
-    sha256 = "sha256-Ysxapp8IpRcRBC3CRM4yxoGYCuedAVURT3FhDD4jNBY=";
+    version = "23.0.10";
+    sha256 = "c68cff7f40b1e73e8d173f068e7d9c02d37e3f94a6a36a556a49c3ff5def4267";
  };

  nextcloud24 = generic {
-    version = "24.0.5";
-    sha256 = "sha256-sieIN3zLk5Hn+eztP2mpI2Zprqqy4OpSUKc+318e8CY=";
+    version = "24.0.6";
+    sha256 = "b26dff9980a47e7e722805fdbbf87e07f59a3817b03ecc32698e028e9baf0301";
  };

  # tip: get the sha with:
--- a/pkgs/servers/syncstorage-rs/default.nix
+++ b/pkgs/servers/syncstorage-rs/default.nix
@ -21,13 +21,13 @@ in

 rustPlatform.buildRustPackage rec {
  pname = "syncstorage-rs";
-  version = "0.12.0";
+  version = "0.12.3";

  src = fetchFromGitHub {
    owner = "mozilla-services";
    repo = pname;
    rev = version;
-    hash = "sha256-VfIpjpBS7LXe32fxIFp7xmbm40VwxUdHIEm5PnMpd4s=";
+    hash = "sha256-al3SgpJPg8dfdghV1dl00wShrKSJFegRVTilaOi0RHQ=";
  };

  nativeBuildInputs = [
@ -47,7 +47,7 @@ rustPlatform.buildRustPackage rec {
      --prefix PATH : ${lib.makeBinPath [ pyFxADeps ]}
  '';

-  cargoSha256 = "sha256-JXxArKA/2SIYJvjNA1yZHR9xDKt3N2U7HVMP/6M3BxE=";
+  cargoSha256 = "sha256-+9Yi+oKctFiTR8cXN6ajtwKEC0kkOP3+kPfUPSYsx5A=";

  buildFeatures = [ "grpcio/openssl" ];

--- a/pkgs/servers/teleport/default.nix
+++ b/pkgs/servers/teleport/default.nix
@ -5,6 +5,7 @@
 , makeWrapper
 , symlinkJoin
 , CoreFoundation
+, libfido2
 , openssl
 , pkg-config
 , protobuf
@ -14,7 +15,6 @@
 , nixosTests

 , withRdpClient ? true
-, withRoleTester ? true
 }:
 let
  # This repo has a private submodule "e" which fetchgit cannot handle without failing.
@ -22,13 +22,13 @@ let
    owner = "gravitational";
    repo = "teleport";
    rev = "v${version}";
-    sha256 = "sha256-KQfdeMuZ9LJHhEJLMl58Yb0+gxgDT7VcVnK1JxjVZaI=";
+    hash = "sha256-F5v3/eKPLhSxW7FImTbE+QMtfn8w5WVTrxMWhgNr3YA=";
  };
-  version = "9.1.2";
+  version = "10.3.1";

  rdpClient = rustPlatform.buildRustPackage rec {
-    name = "teleport-rdpclient";
-    cargoSha256 = "sha256-Jz7bB/f4HRxBhSevmfELSrIm+IXUVlADIgp2qWQd5PY=";
+    pname = "teleport-rdpclient";
+    cargoHash = "sha256-Xmabjoq1NXxXemeR06Gg8R/HwdSE+rsxxX645pQ3SuI=";
    inherit version src;

    buildAndTestSubdir = "lib/srv/desktop/rdp/rdpclient";
@ -44,46 +44,32 @@ let
    OPENSSL_NO_VENDOR = "1";

    postInstall = ''
-      cp -r target $out
-    '';
-  };
-
-  roleTester = rustPlatform.buildRustPackage {
-    name = "teleport-roletester";
-    inherit version src;
-
-    cargoSha256 = "sha256-gCm4ETbXy6tGJQVSzUkoAWUmKD3poYgkw133LtziASI=";
-    buildAndTestSubdir = "lib/datalog/roletester";
-
-    PROTOC = "${protobuf}/bin/protoc";
-    PROTOC_INCLUDE = "${protobuf}/include";
-
-    postInstall = ''
-      cp -r target $out
+      mkdir -p $out/include
+      cp ${buildAndTestSubdir}/librdprs.h $out/include/
    '';
  };

  webassets = fetchFromGitHub {
    owner = "gravitational";
    repo = "webassets";
-    rev = "67e608db77300d8a6cb17709be67f12c1d3271c3";
-    sha256 = "sha256-o4qjXGaNi5XDSUQrUuU+G77EdRnvJ1WUPWrryZU1CUE=";
+    # Submodule rev from https://github.com/gravitational/teleport/tree/v10.3.1
+    rev = "6710dcd0dc19ad101bac3259c463ef940f2ab1f3";
+    hash = "sha256-A13FSpgJODmhugAwy4kqiDw4Rihr//DhQX/bjwaeo2A=";
  };
 in
 buildGoModule rec {
  pname = "teleport";

  inherit src version;
-  vendorSha256 = "sha256-UMgWM7KHag99JR4i4mwVHa6yd9aHQ6Dy+pmUijNL4Ew=";
+  vendorHash = "sha256-2Zrd3CbZvxns9lNVtwaaor1mi97IhPc+MRJhj3rU760=";

  subPackages = [ "tool/tbot" "tool/tctl" "tool/teleport" "tool/tsh" ];
-  tags = [ "webassets_embed" ]
-    ++ lib.optional withRdpClient "desktop_access_rdp"
-    ++ lib.optional withRoleTester "roletester";
+  tags = [ "libfido2" "webassets_embed" ]
+    ++ lib.optional withRdpClient "desktop_access_rdp";

-  buildInputs = [ openssl ]
+  buildInputs = [ openssl libfido2 ]
    ++ lib.optionals (stdenv.isDarwin && withRdpClient) [ CoreFoundation Security ];
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper pkg-config ];

  patches = [
    # https://github.com/NixOS/nixpkgs/issues/120738
@ -97,31 +83,26 @@ buildGoModule rec {
  # Reduce closure size for client machines
  outputs = [ "out" "client" ];

-  preBuild =
-    let rustDeps = symlinkJoin {
-      name = "teleport-rust-deps";
-      paths = lib.optional withRdpClient rdpClient
-        ++ lib.optional withRoleTester roleTester;
-    };
-    in
-    ''
-      mkdir -p build
-      echo "making webassets"
-      cp -r ${webassets}/* webassets/
-      make lib/web/build/webassets
-
-      cp -r ${rustDeps}/. .
-    '';
+  preBuild = ''
+    mkdir -p build
+    echo "making webassets"
+    cp -r ${webassets}/* webassets/
+    make -j$NIX_BUILD_CORES lib/web/build/webassets
+  '' + lib.optionalString withRdpClient ''
+    ln -s ${rdpClient}/lib/* lib/
+    ln -s ${rdpClient}/include/* lib/srv/desktop/rdp/rdpclient/
+  '';

  # Multiple tests fail in the build sandbox
  # due to trying to spawn nixbld's shell (/noshell), etc.
  doCheck = false;

  postInstall = ''
-    install -Dm755 -t $client/bin $out/bin/tsh
+    mkdir -p $client/bin
+    mv {$out,$client}/bin/tsh
    # make xdg-open overrideable at runtime
    wrapProgram $client/bin/tsh --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
-    wrapProgram $out/bin/tsh --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
+    ln -s {$client,$out}/bin/tsh
  '';

  doInstallCheck = true;
--- a/pkgs/servers/teleport/rdpclient.patch
+++ b/pkgs/servers/teleport/rdpclient.patch
@ -1,17 +1,22 @@
 diff --git a/lib/srv/desktop/rdp/rdpclient/client.go b/lib/srv/desktop/rdp/rdpclient/client.go
-index d191c768f..71117a30d 100644
+index 4357d7aa1..7e21a0076 100644
 --- a/lib/srv/desktop/rdp/rdpclient/client.go
 +++ b/lib/srv/desktop/rdp/rdpclient/client.go
-@@ -56,10 +56,10 @@ package rdpclient
- #cgo linux,amd64 LDFLAGS: -L${SRCDIR}/../../../../../target/x86_64-unknown-linux-gnu/release
- #cgo linux,arm LDFLAGS: -L${SRCDIR}/../../../../../target/arm-unknown-linux-gnueabihf/release
- #cgo linux,arm64 LDFLAGS: -L${SRCDIR}/../../../../../target/aarch64-unknown-linux-gnu/release
+@@ -52,14 +52,9 @@ package rdpclient
+ 
+ /*
+ // Flags to include the static Rust library.
+-#cgo linux,386 LDFLAGS: -L${SRCDIR}/../../../../../target/i686-unknown-linux-gnu/release
+-#cgo linux,amd64 LDFLAGS: -L${SRCDIR}/../../../../../target/x86_64-unknown-linux-gnu/release
+-#cgo linux,arm LDFLAGS: -L${SRCDIR}/../../../../../target/arm-unknown-linux-gnueabihf/release
+-#cgo linux,arm64 LDFLAGS: -L${SRCDIR}/../../../../../target/aarch64-unknown-linux-gnu/release
 -#cgo linux LDFLAGS: -l:librdp_client.a -lpthread -ldl -lm
-+#cgo linux LDFLAGS: -l:librdp_client.a -lpthread -ldl -lm -lssl -lcrypto
- #cgo darwin,amd64 LDFLAGS: -L${SRCDIR}/../../../../../target/x86_64-apple-darwin/release
- #cgo darwin,arm64 LDFLAGS: -L${SRCDIR}/../../../../../target/aarch64-apple-darwin/release
+-#cgo darwin,amd64 LDFLAGS: -L${SRCDIR}/../../../../../target/x86_64-apple-darwin/release
+-#cgo darwin,arm64 LDFLAGS: -L${SRCDIR}/../../../../../target/aarch64-apple-darwin/release
 -#cgo darwin LDFLAGS: -framework CoreFoundation -framework Security -lrdp_client -lpthread -ldl -lm
-+#cgo darwin LDFLAGS: -framework CoreFoundation -framework Security -lrdp_client -lpthread -ldl -lm -lssl -lcrypto
+#cgo LDFLAGS: -L${SRCDIR}/../../../../../lib -lpthread -ldl -lm -lssl -lcrypto
+#cgo linux LDFLAGS: -l:librdp_client.a
+#cgo darwin LDFLAGS: -framework CoreFoundation -framework Security -lrdp_client
 #include <librdprs.h>
 */
 import "C"
--- a/pkgs/servers/web-apps/wordpress/packages/README.md
+++ b/pkgs/servers/web-apps/wordpress/packages/README.md
@ -0,0 +1,46 @@
+= Adding plugin, theme or language =
+
+To extend the wordpressPackages set, add a new line to the corresponding json
+file with the codename of the package:
+
+- `wordpress-languages.json` for language packs
+- `wordpress-themes.json` for themes
+- `wordpress-plugins.json` for plugins
+
+The codename is the last part in the url of the plugin or theme page, for
+example `cookie-notice` in in the url
+`https://wordpress.org/plugins/cookie-notice/` or `twentytwenty` in
+`https://wordpress.org/themes/twentytwenty/`.
+
+In case of language packages, the name consists of country and language codes.
+For example `de_DE` for country code `de` (Germany) and language `DE` (German).
+For available translations and language codes see [upstream translation repository](https://translate.wordpress.org).
+
+To regenerate the nixpkgs wordpressPackages set, run:
+
+``` 
+./generate.sh
+``` 
+
+After that you can commit and submit the changes.
+
+= Usage with the Wordpress module =
+
+The plugins will be available in the namespace `wordpressPackages.plugins`.
+Using it together with the Wordpress module could look like this:
+
+``` 
+services.wordpress = {
+  sites."blog.${config.networking.domain}" = {
+    plugins = with pkgs.wordpressPackages.plugins; [
+      anti-spam-bee
+      code-syntax-block
+      cookie-notice
+      lightbox-with-photoswipe
+      wp-gdpr-compliance
+    ];
+  };
+};
+```
+
+The same scheme applies to `themes` and `languages`.
--- a/pkgs/servers/web-apps/wordpress/packages/default.nix
+++ b/pkgs/servers/web-apps/wordpress/packages/default.nix
@ -0,0 +1,85 @@
+# Source: https://git.helsinki.tools/helsinki-systems/wp4nix/-/blob/master/default.nix
+# Licensed under: MIT
+# Slightly modified
+
+{ lib, newScope, plugins, themes, languages }:
+
+let packages = self:
+  let
+    generatedJson = {
+      inherit plugins themes languages;
+    };
+
+  in {
+    # Create a generic WordPress package. Most arguments are just passed
+    # to `mkDerivation`. The version is automatically filtered for weird characters.
+    mkWordpressDerivation = self.callPackage ({ stdenvNoCC, lib, filterWPString, gettext, wp-cli }:
+      { type, pname, version, ... }@args:
+        assert lib.any (x: x == type) [ "plugin" "theme" "language" ];
+        stdenvNoCC.mkDerivation ({
+          pname = "wordpress-${type}-${pname}";
+          version = filterWPString version;
+
+          dontConfigure = true;
+          dontBuild = true;
+
+          installPhase = ''
+            runHook preInstall
+            cp -R ./. $out
+            runHook postInstall
+          '';
+
+          passthru = {
+            wpName = pname;
+          } // (args.passthru or {});
+        } // lib.optionalAttrs (type == "language") {
+          nativeBuildInputs = [ gettext wp-cli ];
+          dontBuild = false;
+          buildPhase = ''
+            runHook preBuild
+
+            find -name '*.po' -print0 | while IFS= read -d "" -r po; do
+              msgfmt -o $(basename "$po" .po).mo "$po"
+            done
+            wp i18n make-json .
+            rm *.po
+
+            runHook postBuild
+          '';
+        } // removeAttrs args [ "type" "pname" "version" "passthru" ])) {};
+
+    # Create a derivation from the official wordpress.org packages.
+    # This takes the type, the pname and the data generated from the go tool.
+    mkOfficialWordpressDerivation = self.callPackage ({ mkWordpressDerivation, fetchWordpress }:
+      { type, pname, data }:
+      mkWordpressDerivation {
+        inherit type pname;
+        version = data.version;
+
+        src = fetchWordpress type data;
+      }) {};
+
+    # Filter out all characters that might occur in a version string but that that are not allowed
+    # in store paths.
+    filterWPString = builtins.replaceStrings [ " " "," "/" "&" ";" ''"'' "'" "$" ":" "(" ")" "[" "]" "{" "}" "|" "*" "\t" ] [ "_" "." "." "" "" "" "" "" "" "" "" "" "" "" "" "-" "" "" ];
+
+    # Fetch a package from the official wordpress.org SVN.
+    # The data supplied is the data straight from the go tool.
+    fetchWordpress = self.callPackage ({ fetchsvn }: type: data: fetchsvn {
+      inherit (data) rev sha256;
+      url = if type == "plugin" || type == "theme" then
+        "https://" + type + "s.svn.wordpress.org/" + data.path
+      else if type == "language" then
+        "https://i18n.svn.wordpress.org/core/" + data.version + "/" + data.path
+      else if type == "pluginLanguage" then
+        "https://i18n.svn.wordpress.org/plugins/" + data.path
+      else if type == "themeLanguage" then
+        "https://i18n.svn.wordpress.org/themes/" + data.path
+      else
+        throw "fetchWordpress: invalid package type ${type}";
+    }) {};
+
+  } // lib.mapAttrs (type: pkgs: lib.makeExtensible (_: lib.mapAttrs (pname: data: self.mkOfficialWordpressDerivation { type = lib.removeSuffix "s" type; inherit pname data; }) pkgs)) generatedJson;
+
+# This creates an extensible scope.
+in (lib.makeExtensible (_: (lib.makeScope newScope packages))).extend (selfWP: superWP: {})
--- a/pkgs/servers/web-apps/wordpress/packages/generate.sh
+++ b/pkgs/servers/web-apps/wordpress/packages/generate.sh
@ -0,0 +1,26 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -I nixpkgs=../../../../.. -i bash -p wp4nix
+
+set -e
+set -u
+set -o pipefail
+set -x
+
+NIX_VERSION=$(nix --version|cut -d ' ' -f 3|cut -c -3)
+if [[ "$NIX_VERSION" > 2.3 ]]; then
+  nixFlags="--option experimental-features nix-command eval --raw --impure --expr"
+else
+  nixFlags="eval --raw"
+fi
+
+export WP_VERSION=$(nix $nixFlags '(import <nixpkgs> {}).wordpress.version')
+
+PLUGINS=`cat wordpress-plugins.json | jq -r '.[]' | sed -z 's/\n/,/g;s/,$/\n/'`
+THEMES=`cat wordpress-themes.json | jq -r '.[]' | sed -z 's/\n/,/g;s/,$/\n/'`
+LANGUAGES=`cat wordpress-languages.json | jq -r '.[]' | sed -z 's/\n/,/g;s/,$/\n/'`
+
+wp4nix -p $PLUGINS -pl en
+wp4nix -t $THEMES -tl en
+wp4nix -l $LANGUAGES
+
+rm *.log themeLanguages.json pluginLanguages.json
--- a/pkgs/servers/web-apps/wordpress/packages/languages.json
+++ b/pkgs/servers/web-apps/wordpress/packages/languages.json
@ -0,0 +1,14 @@
+{
+  "de_DE": {
+    "path": "de_DE",
+    "rev": "932483",
+    "sha256": "1n4rf1bkr8xr6yqxd7c6s4ha3ll819fbfiqln57is9knfpdd6fnq",
+    "version": "5.8"
+  },
+  "fr_FR": {
+    "path": "fr_FR",
+    "rev": "932480",
+    "sha256": "0lmbalcvwfc6331vdazmhr2lp3w418rsp78mrj1rs7a44y8f1igj",
+    "version": "5.8"
+  }
+}
--- a/pkgs/servers/web-apps/wordpress/packages/plugins.json
+++ b/pkgs/servers/web-apps/wordpress/packages/plugins.json
@ -0,0 +1,122 @@
+{
+  "add-widget-after-content": {
+    "path": "add-widget-after-content/tags/2.4.4",
+    "rev": "2671853",
+    "sha256": "0snrkd783f1qxry01858l3r0ll9381xhsig7wlmrvi1zm5jf2drc",
+    "version": "2.4.4"
+  },
+  "antispam-bee": {
+    "path": "antispam-bee/tags/2.11.1",
+    "rev": "2748316",
+    "sha256": "1hjq1yazvypc84lwcjq7za1n3s7vcxd9mc50adpinkwjjph1cgxn",
+    "version": "2.11.1"
+  },
+  "async-javascript": {
+    "path": "async-javascript/tags/2.21.08.31",
+    "rev": "2760769",
+    "sha256": "1yf3pj0nn4gyl0a2wfvznpwb7y0glxg19rgny3bh38k4pj9mli49",
+    "version": "2.21.08.31"
+  },
+  "breeze": {
+    "path": "breeze/tags/2.0.9",
+    "rev": "2786857",
+    "sha256": "0nn3kalwb50kyd563jiixc134hiygkbzs8zkxgsbgmsi511vfzkz",
+    "version": "2.0.9"
+  },
+  "co-authors-plus": {
+    "path": "co-authors-plus/tags/3.5.2",
+    "rev": "2735979",
+    "sha256": "0ph3iskixi2j6bsnlpd4x8wixzm2hbdzchnyfz9mxzzys93qb41k",
+    "version": "3.5.2"
+  },
+  "code-syntax-block": {
+    "path": "code-syntax-block/tags/3.1.1",
+    "rev": "2747615",
+    "sha256": "0dqdsl7f3ihshvly6cqd5l4cbimx5skmips514wvifspwggwmmjm",
+    "version": "3.1.1"
+  },
+  "cookie-notice": {
+    "path": "cookie-notice/tags/2.4.1",
+    "rev": "2790369",
+    "sha256": "1a1qnmi81z8c30d6zgcd5xqd08cxkq71g2hzb6xcbdv04036nf77",
+    "version": "2.4.1"
+  },
+  "disable-xml-rpc": {
+    "path": "disable-xml-rpc/tags/1.0.1",
+    "rev": "2561901",
+    "sha256": "04x5dj79bx5avx8db991nlhrpd3qv3maniqmzwnyd8ab2zblzx83",
+    "version": "1.0.1"
+  },
+  "jetpack": {
+    "path": "jetpack/tags/11.4",
+    "rev": "2794223",
+    "sha256": "123kfn6wn23sz7zv8yk8rszrxwnjgjfrm0cqpwmrs3h1plfqv7kg",
+    "version": "11.4"
+  },
+  "jetpack-lite": {
+    "path": "jetpack-lite/tags/3.0.3",
+    "rev": "1895157",
+    "sha256": "04wq8cnhzgzrhm5pjwicsnavc46n6wdmb6xf8gz4wwl1di2hl471",
+    "version": "3.0.3"
+  },
+  "lightbox-photoswipe": {
+    "path": "lightbox-photoswipe/tags/5.0.16",
+    "rev": "2790158",
+    "sha256": "1pd83v7nz2l002z1y27h97gmhcdcbvsfi8x7llrg9vzijrx0vf18",
+    "version": "5.0.16"
+  },
+  "mailpoet": {
+    "path": "mailpoet/tags/3.100.1",
+    "rev": "2795092",
+    "sha256": "0wgzmicf6mmkmkwsxxaz2d8sylvq6v0a98nbc2yswd11l4igc8ld",
+    "version": "3.100.1"
+  },
+  "opengraph": {
+    "path": "opengraph/tags/1.11.0",
+    "rev": "2730257",
+    "sha256": "133mzlccbdpppps1aq83n2az4xzikak61k4rdzg9aax23l5ggss6",
+    "version": "1.11.0"
+  },
+  "simple-login-captcha": {
+    "path": "simple-login-captcha/tags/1.3.3",
+    "rev": "2729196",
+    "sha256": "1wy9cbibbngjarc8c9qn4bil3qc8i0h2kz0k364zcsnfpwi8jk3c",
+    "version": "1.3.3"
+  },
+  "webp-converter-for-media": {
+    "path": "webp-converter-for-media/tags/5.2.4",
+    "rev": "2791011",
+    "sha256": "18y0yrngywz0zlxd67cn16nvzypb395rhsfavfyl6pq0ygymcxnm",
+    "version": "5.2.4"
+  },
+  "wp-change-email-sender": {
+    "path": "wp-change-email-sender/trunk",
+    "rev": "2655179",
+    "sha256": "0dv5604mn4ly2zm6mwqf5y8vp9cfiw70v66bimvgbahxz4i2w23q",
+    "version": "1.0"
+  },
+  "wp-gdpr-compliance": {
+    "path": "wp-gdpr-compliance/tags/2.0.20",
+    "rev": "2793947",
+    "sha256": "1vvwmi03hjyqw566m75m8lxbhnl3y4h461531a26xwsbmjgbmf9a",
+    "version": "2.0.20"
+  },
+  "wp-mail-smtp": {
+    "path": "wp-mail-smtp/tags/3.6.1",
+    "rev": "2795051",
+    "sha256": "14ry7302c4h7d7lrasiql9jiy3x54ylim3y7j5b633g5lyzadynl",
+    "version": "3.6.1"
+  },
+  "wp-statistics": {
+    "path": "wp-statistics/tags/13.2.6",
+    "rev": "2781181",
+    "sha256": "0vzlhlnna2dx4kyi24rqhbrx5n5zsw51hqgsaslfiyyir64dkzgz",
+    "version": "13.2.6"
+  },
+  "wp-user-avatars": {
+    "path": "wp-user-avatars/trunk",
+    "rev": "2540784",
+    "sha256": "1g21nl6xs9zyq0ainjwa06wl90975l8f9rj0fa20zkmw17w2mdgl",
+    "version": "1.4.1"
+  }
+}
--- a/pkgs/servers/web-apps/wordpress/packages/themes.json
+++ b/pkgs/servers/web-apps/wordpress/packages/themes.json
@ -0,0 +1,14 @@
+{
+  "twentytwentyone": {
+    "path": "twentytwentyone/1.6",
+    "rev": "168450",
+    "sha256": "0wfqdyd59hifnncjv59ywjak050gaggsvjx7r01agh44nzkr84fs",
+    "version": "1.6"
+  },
+  "twentytwentytwo": {
+    "path": "twentytwentytwo/1.2",
+    "rev": "168451",
+    "sha256": "0ry7h5bd9h97q38jmsgymm05dfml0ycdhqn7iskpdlc1nnrjrk04",
+    "version": "1.2"
+  }
+}
--- a/pkgs/servers/web-apps/wordpress/packages/wordpress-languages.json
+++ b/pkgs/servers/web-apps/wordpress/packages/wordpress-languages.json
@ -0,0 +1,4 @@
+[
+  "de_DE"
+, "fr_FR"
+]
--- a/pkgs/servers/web-apps/wordpress/packages/wordpress-plugins.json
+++ b/pkgs/servers/web-apps/wordpress/packages/wordpress-plugins.json
@ -0,0 +1,22 @@
+[
+  "add-widget-after-content"
+, "antispam-bee"
+, "async-javascript"
+, "breeze"
+, "code-syntax-block"
+, "cookie-notice"
+, "co-authors-plus"
+, "disable-xml-rpc"
+, "jetpack"
+, "jetpack-lite"
+, "lightbox-photoswipe"
+, "mailpoet"
+, "opengraph"
+, "simple-login-captcha"
+, "webp-converter-for-media"
+, "wp-mail-smtp"
+, "wp-gdpr-compliance"
+, "wp-statistics"
+, "wp-user-avatars"
+, "wp-change-email-sender"
+]
--- a/pkgs/servers/web-apps/wordpress/packages/wordpress-themes.json
+++ b/pkgs/servers/web-apps/wordpress/packages/wordpress-themes.json
@ -0,0 +1,4 @@
+[
+  "twentytwentytwo"
+, "twentytwentyone"
+]
--- a/pkgs/tools/admin/wander/default.nix
+++ b/pkgs/tools/admin/wander/default.nix
@ -1,17 +1,41 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ wander, buildGoModule, fetchFromGitHub, fetchpatch, installShellFiles, lib, testers }:

 buildGoModule rec {
  pname = "wander";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "robinovitch61";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-aQqJDUDYHoUZ6ixnY3lmFOx29QpRRke5XHFIpsA+Bnw=";
+    sha256 = "sha256-G/TrfnmEyomdUCN5nUS9v5iqeUzgZzMLUZnfroQLZuk=";
  };

-  vendorSha256 = "sha256-T+URnRLumXFz48go9TN0Wha99T03OWGfDK7cQ+zKeRI=";
+  vendorSha256 = "sha256-iTaZ5/0UrLJ3JE3FwQpvjKKrhqklG4n1WFTJhWfj/rI=";
+
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/robinovitch61/wander/commit/b3d3249541de005404a41c17a15218a4f73f68e5.patch";
+      sha256 = "sha256-z8bdSFcAqnwEu0gupxW/L1o/asyxbvTYIdtLZNmQpz8=";
+    })
+  ];
+
+  ldflags = [ "-X github.com/robinovitch61/wander/cmd.Version=v${version}" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd wander \
+      --fish <($out/bin/wander completion fish) \
+      --bash <($out/bin/wander completion bash) \
+      --zsh <($out/bin/wander completion zsh)
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = wander;
+    command = "wander --version";
+    version = "v${version}";
+  };

  meta = with lib; {
    description = "Terminal app/TUI for HashiCorp Nomad";
--- a/pkgs/tools/networking/dhcp/default.nix
+++ b/pkgs/tools/networking/dhcp/default.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "dhcp";
-  version = "4.4.3";
+  version = "4.4.3-P1";

  src = fetchurl {
    url = "https://ftp.isc.org/isc/dhcp/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Dj7GtMKgXsAUiHS82ZmmbQVRg3jXdCH2B/sLydATWBg=";
+    sha256 = "sha256-CsQWu1WZfKhjIXT9EHN/1hzbjbonUhYKM1d1vCHcc8c=";
  };

  patches =
--- a/pkgs/tools/networking/mosh/default.nix
+++ b/pkgs/tools/networking/mosh/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch, zlib, protobuf, ncurses, pkg-config
 , makeWrapper, perl, openssl, autoreconfHook, openssh, bash-completion
-, withUtempter ? stdenv.isLinux, libutempter }:
+, withUtempter ? stdenv.isLinux && !stdenv.hostPlatform.isMusl, libutempter }:

 stdenv.mkDerivation rec {
  pname = "mosh";
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -9418,6 +9418,9 @@ with pkgs;
  nomad_1_3 = callPackage ../applications/networking/cluster/nomad/1.3.nix {
    buildGoModule = buildGo119Module;
  };
+  nomad_1_4 = callPackage ../applications/networking/cluster/nomad/1.4.nix {
+    buildGoModule = buildGo119Module;
+  };

  nomad-autoscaler = callPackage ../applications/networking/cluster/nomad-autoscaler { };

@ -29364,10 +29367,7 @@ with pkgs;

  kuttl = callPackage ../applications/networking/cluster/kuttl { };

-  kubectl-doctor = callPackage ../applications/networking/cluster/kubectl-doctor {
-    # pinned due to build failure or vendoring problems. When unpinning double check with: nix-build -A $name.go-modules --rebuild
-    buildGoModule = buildGo117Module;
-  };
+  kubectl-doctor = callPackage ../applications/networking/cluster/kubectl-doctor { };

  kubectl-example = callPackage ../applications/networking/cluster/kubectl-example { };

@ -36940,6 +36940,12 @@ with pkgs;

  wordpress = callPackage ../servers/web-apps/wordpress { };

+  wordpressPackages = ( callPackage ../servers/web-apps/wordpress/packages {
+    plugins = lib.importJSON ../servers/web-apps/wordpress/packages/plugins.json;
+    themes = lib.importJSON ../servers/web-apps/wordpress/packages/themes.json;
+    languages = lib.importJSON ../servers/web-apps/wordpress/packages/languages.json;
+  });
+
  wprecon = callPackage ../tools/security/wprecon { };

  wraith = callPackage ../applications/networking/irc/wraith {
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -22612,12 +22612,12 @@ let

  SysVirt = buildPerlModule rec {
    pname = "Sys-Virt";
-    version = "8.5.0";
+    version = "8.8.0";
    src = fetchFromGitLab {
      owner = "libvirt";
      repo = "libvirt-perl";
      rev = "v${version}";
-      hash = "sha256-VuM4rPrG15vXnF5e1MBSGB76zLI+8nkSiJmwWg8aJgE=";
+      hash = "sha256-8maLIW4hBbMbq+rnwEfaHsUgpppaU5K4aQTwTgUjdcI=";
    };
    nativeBuildInputs = [ pkgs.pkg-config ];
    buildInputs = [ pkgs.libvirt CPANChanges TestPod TestPodCoverage XMLXPath ];