Merge master into haskell-updates

2023-10-31 00:12:20 +00:00 · 2023-10-31 00:12:20 +00:00 · 0c46b29501
commit 0c46b29501
parent ca760999da 8cd7bb130c
149 changed files with 13095 additions and 6514 deletions
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@ -24,7 +24,7 @@ jobs:
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Create backport PRs
-        uses: korthout/backport-action@v1.3.1
+        uses: korthout/backport-action@v2.0.0
        with:
          # Config README: https://github.com/korthout/backport-action#backport-action
          copy_labels_pattern: 'severity:\ssecurity'
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@ -424,7 +424,7 @@ rec {
      # Filter suited when there's some files
      # This can't be used for when there's no files, because the base directory is always included
      nonEmpty =
-        path: _:
+        path: type:
        let
          # Add a slash to the path string, turning "/foo" to "/foo/",
          # making sure to not have any false prefix matches below.
@ -433,25 +433,37 @@ rec {
          # meaning this function can never receive "/" as an argument
          pathSlash = path + "/";
        in
-        # Same as `hasPrefix pathSlash baseString`, but more efficient.
-        # With base /foo/bar we need to include /foo:
-        # hasPrefix "/foo/" "/foo/bar/"
-        if substring 0 (stringLength pathSlash) baseString == pathSlash then
-          true
-        # Same as `! hasPrefix baseString pathSlash`, but more efficient.
-        # With base /foo/bar we need to exclude /baz
-        # ! hasPrefix "/baz/" "/foo/bar/"
-        else if substring 0 baseLength pathSlash != baseString then
-          false
-        else
-          # Same as `removePrefix baseString path`, but more efficient.
-          # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
-          # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
-          # With base /foo and path /foo/bar/baz this gives
-          # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
-          # == inTree (split "/" "bar/baz")
-          # == inTree [ "bar" "baz" ]
-          inTree (split "/" (substring baseLength (-1) path));
+        (
+          # Same as `hasPrefix pathSlash baseString`, but more efficient.
+          # With base /foo/bar we need to include /foo:
+          # hasPrefix "/foo/" "/foo/bar/"
+          if substring 0 (stringLength pathSlash) baseString == pathSlash then
+            true
+          # Same as `! hasPrefix baseString pathSlash`, but more efficient.
+          # With base /foo/bar we need to exclude /baz
+          # ! hasPrefix "/baz/" "/foo/bar/"
+          else if substring 0 baseLength pathSlash != baseString then
+            false
+          else
+            # Same as `removePrefix baseString path`, but more efficient.
+            # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
+            # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
+            # With base /foo and path /foo/bar/baz this gives
+            # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
+            # == inTree (split "/" "bar/baz")
+            # == inTree [ "bar" "baz" ]
+            inTree (split "/" (substring baseLength (-1) path))
+        )
+        # This is a way have an additional check in case the above is true without any significant performance cost
+        && (
+          # This relies on the fact that Nix only distinguishes path types "directory", "regular", "symlink" and "unknown",
+          # so everything except "unknown" is allowed, seems reasonable to rely on that
+          type != "unknown"
+          || throw ''
+            lib.fileset.toSource: `fileset` contains a file that cannot be added to the store: ${path}
+                This file is neither a regular file nor a symlink, the only file types supported by the Nix store.
+                Therefore the file set cannot be added to the Nix store as is. Make sure to not include that file to avoid this error.''
+        );
    in
    # Special case because the code below assumes that the _internalBase is always included in the result
    # which shouldn't be done when we have no files at all in the base
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@ -332,7 +332,7 @@ expectFailure 'with ((import <nixpkgs/lib>).extend (import <nixpkgs/lib/fileset/
 \s*`root`: root "'"$work"'/foo/mock-root"
 \s*`fileset`: root "'"$work"'/bar/mock-root"
 \s*Different roots are not supported.'
-rm -rf *
+rm -rf -- *

 # `root` needs to exist
 expectFailure 'toSource { root = ./a; fileset = ./.; }' 'lib.fileset.toSource: `root` \('"$work"'/a\) does not exist.'
@ -342,7 +342,7 @@ touch a
 expectFailure 'toSource { root = ./a; fileset = ./a; }' 'lib.fileset.toSource: `root` \('"$work"'/a\) is a file, but it should be a directory instead. Potential solutions:
 \s*- If you want to import the file into the store _without_ a containing directory, use string interpolation or `builtins.path` instead of this function.
 \s*- If you want to import the file into the store _with_ a containing directory, set `root` to the containing directory, such as '"$work"', and set `fileset` to the file path.'
-rm -rf *
+rm -rf -- *

 # The fileset argument should be evaluated, even if the directory is empty
 expectFailure 'toSource { root = ./.; fileset = abort "This should be evaluated"; }' 'evaluation aborted with the following error message: '\''This should be evaluated'\'
@ -352,7 +352,14 @@ mkdir a
 expectFailure 'toSource { root = ./a; fileset = ./.; }' 'lib.fileset.toSource: `fileset` could contain files in '"$work"', which is not under the `root` \('"$work"'/a\). Potential solutions:
 \s*- Set `root` to '"$work"' or any directory higher up. This changes the layout of the resulting store path.
 \s*- Set `fileset` to a file set that cannot contain files outside the `root` \('"$work"'/a\). This could change the files included in the result.'
-rm -rf *
+rm -rf -- *
+
+# non-regular and non-symlink files cannot be added to the Nix store
+mkfifo a
+expectFailure 'toSource { root = ./.; fileset = ./a; }' 'lib.fileset.toSource: `fileset` contains a file that cannot be added to the store: '"$work"'/a
+\s*This file is neither a regular file nor a symlink, the only file types supported by the Nix store.
+\s*Therefore the file set cannot be added to the Nix store as is. Make sure to not include that file to avoid this error.'
+rm -rf -- *

 # Path coercion only works for paths
 expectFailure 'toSource { root = ./.; fileset = 10; }' 'lib.fileset.toSource: `fileset` is of type int, but it should be a file set or a path instead.'
@ -493,7 +500,7 @@ expectFailure 'with ((import <nixpkgs/lib>).extend (import <nixpkgs/lib/fileset/
 \s*element 0: root "'"$work"'/foo/mock-root"
 \s*element 1: root "'"$work"'/bar/mock-root"
 \s*Different roots are not supported.'
-rm -rf *
+rm -rf -- *

 # Coercion errors show the correct context
 expectFailure 'toSource { root = ./.; fileset = union ./a ./.; }' 'lib.fileset.union: first argument \('"$work"'/a\) does not exist.'
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3680,6 +3680,15 @@
      fingerprint = "2017 E152 BB81 5C16 955C  E612 45BC C1E2 709B 1788";
    }];
  };
+  Cryolitia = {
+    name = "Beiyan Cryolitia";
+    email = "Cryolitia@gmail.com";
+    github = "Cryolitia";
+    githubId = 23723294;
+    keys = [{
+      fingerprint = "1C3C 6547 538D 7152 310C 0EEA 84DD 0C01 30A5 4DF7";
+    }];
+  };
  cryptix = {
    email = "cryptix@riseup.net";
    github = "cryptix";
--- a/nixos/modules/services/audio/wyoming/faster-whisper.nix
+++ b/nixos/modules/services/audio/wyoming/faster-whisper.nix
@ -138,6 +138,7 @@ in
              --data-dir $STATE_DIRECTORY \
              --download-dir $STATE_DIRECTORY \
              --uri ${options.uri} \
+              --device ${options.device} \
              --model ${options.model} \
              --language ${options.language} \
              --beam-size ${options.beamSize} ${options.extraArgs}
--- a/nixos/modules/services/audio/wyoming/openwakeword.nix
+++ b/nixos/modules/services/audio/wyoming/openwakeword.nix
@ -8,6 +8,7 @@ let
  cfg = config.services.wyoming.openwakeword;

  inherit (lib)
+    concatStringsSep
    concatMapStringsSep
    escapeShellArgs
    mkOption
@ -15,6 +16,7 @@ let
    mkEnableOption
    mkIf
    mkPackageOptionMD
+    mkRemovedOptionModule
    types
    ;

@ -22,18 +24,13 @@ let
    toString
    ;

-  models = [
-    # wyoming_openwakeword/models/*.tflite
-    "alexa"
-    "hey_jarvis"
-    "hey_mycroft"
-    "hey_rhasspy"
-    "ok_nabu"
-  ];
-
 in

 {
+  imports = [
+    (mkRemovedOptionModule [ "services" "wyoming" "openwakeword" "models" ] "Configuring models has been removed, they are now dynamically discovered and loaded at runtime")
+  ];
+
  meta.buildDocsInSandbox = false;

  options.services.wyoming.openwakeword = with types; {
@ -50,19 +47,27 @@ in
      '';
    };

-    models = mkOption {
-      type = listOf (enum models);
-      default = models;
-      description = mdDoc ''
-        List of wake word models that should be made available.
+    customModelsDirectories = mkOption {
+      type = listOf types.path;
+      default = [];
+      description = lib.mdDoc ''
+        Paths to directories with custom wake word models (*.tflite model files).
      '';
    };

    preloadModels = mkOption {
-      type = listOf (enum models);
+      type = listOf str;
      default = [
        "ok_nabu"
      ];
+      example = [
+        # wyoming_openwakeword/models/*.tflite
+        "alexa"
+        "hey_jarvis"
+        "hey_mycroft"
+        "hey_rhasspy"
+        "ok_nabu"
+      ];
      description = mdDoc ''
        List of wake word models to preload after startup.
      '';
@ -114,14 +119,15 @@ in
        DynamicUser = true;
        User = "wyoming-openwakeword";
        # https://github.com/home-assistant/addons/blob/master/openwakeword/rootfs/etc/s6-overlay/s6-rc.d/openwakeword/run
-        ExecStart = ''
-          ${cfg.package}/bin/wyoming-openwakeword \
-            --uri ${cfg.uri} \
-            ${concatMapStringsSep " " (model: "--model ${model}") cfg.models} \
-            ${concatMapStringsSep " " (model: "--preload-model ${model}") cfg.preloadModels} \
-            --threshold ${cfg.threshold} \
-            --trigger-level ${cfg.triggerLevel} ${cfg.extraArgs}
-        '';
+        ExecStart = concatStringsSep " " [
+          "${cfg.package}/bin/wyoming-openwakeword"
+          "--uri ${cfg.uri}"
+          (concatMapStringsSep " " (model: "--preload-model ${model}") cfg.preloadModels)
+          (concatMapStringsSep " " (dir: "--custom-model-dir ${toString dir}") cfg.customModelsDirectories)
+          "--threshold ${cfg.threshold}"
+          "--trigger-level ${cfg.triggerLevel}"
+          "${cfg.extraArgs}"
+        ];
        CapabilityBoundingSet = "";
        DeviceAllow = "";
        DevicePolicy = "closed";
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@ -350,7 +350,7 @@ in

    boot.kernelParams = mkIf (!config.networking.usePredictableInterfaceNames) [ "net.ifnames=0" ];

-    boot.initrd.extraUdevRulesCommands = optionalString (!config.boot.initrd.systemd.enable && config.boot.initrd.services.udev.rules != "")
+    boot.initrd.extraUdevRulesCommands = mkIf (!config.boot.initrd.systemd.enable && config.boot.initrd.services.udev.rules != "")
      ''
        cat <<'EOF' > $out/99-local.rules
        ${config.boot.initrd.services.udev.rules}
--- a/nixos/modules/services/misc/xmrig.nix
+++ b/nixos/modules/services/misc/xmrig.nix
@ -59,8 +59,8 @@ with lib;
      after = [ "network.target" ];
      description = "XMRig Mining Software Service";
      serviceConfig = {
-        ExecStartPre = "${cfg.package}/bin/xmrig --config=${configFile} --dry-run";
-        ExecStart = "${cfg.package}/bin/xmrig --config=${configFile}";
+        ExecStartPre = "${lib.getExe cfg.package} --config=${configFile} --dry-run";
+        ExecStart = "${lib.getExe cfg.package} --config=${configFile}";
        # https://xmrig.com/docs/miner/randomx-optimization-guide/msr
        # If you use recent XMRig with root privileges (Linux) or admin
        # privileges (Windows) the miner configure all MSR registers
--- a/nixos/modules/services/networking/multipath.nix
+++ b/nixos/modules/services/networking/multipath.nix
@ -546,8 +546,9 @@ in {
    # We do not have systemd in stage-1 boot so must invoke `multipathd`
    # with the `-1` argument which disables systemd calls. Invoke `multipath`
    # to display the multipath mappings in the output of `journalctl -b`.
+    # TODO: Implement for systemd stage 1
    boot.initrd.kernelModules = [ "dm-multipath" "dm-service-time" ];
-    boot.initrd.postDeviceCommands = ''
+    boot.initrd.postDeviceCommands = mkIf (!config.boot.initrd.systemd.enable) ''
      modprobe -a dm-multipath dm-service-time
      multipathd -s
      (set -x && sleep 1 && multipath -ll)
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@ -22,6 +22,7 @@ use JSON::PP;
 use IPC::Cmd;
 use Sys::Syslog qw(:standard :macros);
 use Cwd qw(abs_path);
+use Fcntl ':flock';

 ## no critic(ControlStructures::ProhibitDeepNests)
 ## no critic(ErrorHandling::RequireCarping)
@ -91,6 +92,8 @@ if (!-f "/etc/NIXOS" && (read_file("/etc/os-release", err_mode => "quiet") // ""
 }

 make_path("/run/nixos", { mode => oct(755) });
+open(my $stc_lock, '>>', '/run/nixos/switch-to-configuration.lock') or die "Could not open lock - $!";
+flock($stc_lock, LOCK_EX) or die "Could not acquire lock - $!";
 openlog("nixos", "", LOG_USER);

 # Install or update the bootloader.
@ -985,4 +988,5 @@ if ($res == 0) {
    syslog(LOG_ERR, "switching to system configuration $toplevel failed (status $res)");
 }

+close($stc_lock) or die "Could not close lock - $!";
 exit($res);
--- a/nixos/modules/system/boot/initrd-network.nix
+++ b/nixos/modules/system/boot/initrd-network.nix
@ -116,11 +116,11 @@ in

    boot.initrd.kernelModules = [ "af_packet" ];

-    boot.initrd.extraUtilsCommands = ''
+    boot.initrd.extraUtilsCommands = mkIf (!config.boot.initrd.systemd.enable) ''
      copy_bin_and_libs ${pkgs.klibc}/lib/klibc/bin.static/ipconfig
    '';

-    boot.initrd.preLVMCommands = mkBefore (
+    boot.initrd.preLVMCommands = mkIf (!config.boot.initrd.systemd.enable) (mkBefore (
      # Search for interface definitions in command line.
      ''
        ifaces=""
@ -148,9 +148,9 @@ in
        done
      ''

-      + cfg.postCommands);
+      + cfg.postCommands));

-    boot.initrd.postMountCommands = mkIf cfg.flushBeforeStage2 ''
+    boot.initrd.postMountCommands = mkIf (cfg.flushBeforeStage2 && !config.boot.initrd.systemd.enable) ''
      for iface in $ifaces; do
        ip address flush dev "$iface"
        ip link set dev "$iface" down
--- a/nixos/modules/system/boot/stage-2-init.sh
+++ b/nixos/modules/system/boot/stage-2-init.sh
@ -54,7 +54,7 @@ if [ ! -e /proc/1 ]; then
 fi


-if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" = true ]; then
+if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" = true ] || [ ! -c /dev/kmsg ] ; then
    echo "booting system configuration ${systemConfig}"
 else
    echo "booting system configuration $systemConfig" > /dev/kmsg
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -128,10 +128,6 @@ in {
        stage 2 counterparts such as {option}`systemd.services`,
        except that `restartTriggers` and `reloadTriggers` are not
        supported.
-
-        Note: This is experimental. Some of the `boot.initrd` options
-        are not supported when this is enabled, and the options under
-        `boot.initrd.systemd` are subject to change.
      '';
    };

@ -348,6 +344,27 @@ in {
  };

  config = mkIf (config.boot.initrd.enable && cfg.enable) {
+    assertions = map (name: {
+      assertion = lib.attrByPath name (throw "impossible") config.boot.initrd == "";
+      message = ''
+        systemd stage 1 does not support 'boot.initrd.${lib.concatStringsSep "." name}'. Please
+          convert it to analogous systemd units in 'boot.initrd.systemd'.
+
+            Definitions:
+        ${lib.concatMapStringsSep "\n" ({ file, ... }: "    - ${file}") (lib.attrByPath name (throw "impossible") options.boot.initrd).definitionsWithLocations}
+      '';
+    }) [
+      [ "preFailCommands" ]
+      [ "preDeviceCommands" ]
+      [ "preLVMCommands" ]
+      [ "postDeviceCommands" ]
+      [ "postMountCommands" ]
+      [ "extraUdevRulesCommands" ]
+      [ "extraUtilsCommands" ]
+      [ "extraUtilsCommandsTest" ]
+      [ "network" "postCommands" ]
+    ];
+
    system.build = { inherit initialRamdisk; };

    boot.initrd.availableKernelModules = [
--- a/nixos/modules/tasks/encrypted-devices.nix
+++ b/nixos/modules/tasks/encrypted-devices.nix
@ -110,10 +110,11 @@ in
          }) earlyEncDevs);
        forceLuksSupportInInitrd = true;
      };
-      postMountCommands =
-        concatMapStrings (dev:
+      # TODO: systemd stage 1
+      postMountCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
+        (concatMapStrings (dev:
          "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.blkDev} ${dev.encrypted.label};\n"
-        ) lateEncDevs;
+        ) lateEncDevs);
    };
  };
 }
--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@ -102,11 +102,11 @@ in
        copy_bin_and_libs ${pkgs.bcachefs-tools}/bin/bcachefs
        copy_bin_and_libs ${mountCommand}/bin/mount.bcachefs
      '';
-      boot.initrd.extraUtilsCommandsTest = ''
+      boot.initrd.extraUtilsCommandsTest = lib.mkIf (!config.boot.initrd.systemd.enable) ''
        $out/bin/bcachefs version
      '';

-      boot.initrd.postDeviceCommands = commonFunctions + concatStrings (mapAttrsToList openCommand bootFs);
+      boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable) (commonFunctions + concatStrings (mapAttrsToList openCommand bootFs));

      boot.initrd.systemd.services = lib.mapAttrs' (mkUnits "/sysroot") bootFs;
    })
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -584,17 +584,17 @@ in
      boot.initrd = mkIf inInitrd {
        kernelModules = [ "zfs" ] ++ optional (!cfgZfs.enableUnstable) "spl";
        extraUtilsCommands =
-          ''
+          mkIf (!config.boot.initrd.systemd.enable) ''
            copy_bin_and_libs ${cfgZfs.package}/sbin/zfs
            copy_bin_and_libs ${cfgZfs.package}/sbin/zdb
            copy_bin_and_libs ${cfgZfs.package}/sbin/zpool
          '';
-        extraUtilsCommandsTest = mkIf inInitrd
-          ''
+        extraUtilsCommandsTest =
+          mkIf (!config.boot.initrd.systemd.enable) ''
            $out/bin/zfs --help >/dev/null 2>&1
            $out/bin/zpool --help >/dev/null 2>&1
          '';
-        postDeviceCommands = concatStringsSep "\n" ([''
+        postDeviceCommands = mkIf (!config.boot.initrd.systemd.enable) (concatStringsSep "\n" ([''
            ZFS_FORCE="${optionalString cfgZfs.forceImportRoot "-f"}"
          ''] ++ [(importLib {
            # See comments at importLib definition.
@ -623,10 +623,10 @@ in
              else concatMapStrings (fs: ''
                zfs load-key -- ${escapeShellArg fs}
              '') (filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials)}
-        '') rootPools));
+        '') rootPools)));

        # Systemd in stage 1
-        systemd = {
+        systemd = mkIf config.boot.initrd.systemd.enable {
          packages = [cfgZfs.package];
          services = listToAttrs (map (pool: createImportService {
            inherit pool;
--- a/nixos/modules/tasks/swraid.nix
+++ b/nixos/modules/tasks/swraid.nix
@ -62,13 +62,13 @@ in {
        cp -v ${pkgs.mdadm}/lib/udev/rules.d/*.rules $out/
      '';

-      extraUtilsCommands = ''
+      extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
        # Add RAID mdadm tool.
        copy_bin_and_libs ${pkgs.mdadm}/sbin/mdadm
        copy_bin_and_libs ${pkgs.mdadm}/sbin/mdmon
      '';

-      extraUtilsCommandsTest = ''
+      extraUtilsCommandsTest = lib.mkIf (!config.boot.initrd.systemd.enable) ''
        $out/bin/mdadm --version
      '';

--- a/nixos/tests/common/auto-format-root-device.nix
+++ b/nixos/tests/common/auto-format-root-device.nix
@ -5,19 +5,19 @@
 # `virtualisation.fileSystems."/".autoFormat = true;`
 # instead.

-{ config, pkgs, ... }:
+{ lib, config, pkgs, ... }:

 let
  rootDevice = config.virtualisation.rootDevice;
 in
 {

-  boot.initrd.extraUtilsCommands = ''
+  boot.initrd.extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
    # We need mke2fs in the initrd.
    copy_bin_and_libs ${pkgs.e2fsprogs}/bin/mke2fs
  '';

-  boot.initrd.postDeviceCommands = ''
+  boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
    # If the disk image appears to be empty, run mke2fs to
    # initialise.
    FSTYPE=$(blkid -o value -s TYPE ${rootDevice} || true)
--- a/nixos/tests/xfce.nix
+++ b/nixos/tests/xfce.nix
@ -66,6 +66,9 @@ import ./make-test-python.nix ({ pkgs, ...} : {
        machine.succeed("su - ${user.name} -c 'DISPLAY=:0 thunar >&2 &'")
        machine.wait_for_window("Thunar")
        machine.wait_for_text('(Pictures|Public|Templates|Videos)')
+
+      with subtest("Check if any coredumps are found"):
+        machine.succeed("(coredumpctl --json=short 2>&1 || true) | grep 'No coredumps found'")
        machine.sleep(10)
        machine.screenshot("screen")
    '';
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
@ -27,11 +27,11 @@

 stdenv.mkDerivation rec {
  pname = "bitwig-studio";
-  version = "5.0.9";
+  version = "5.0.11";

  src = fetchurl {
    url = "https://downloads.bitwig.com/stable/${version}/${pname}-${version}.deb";
-    sha256 = "sha256-B6s8FuNvJ3NdU7uZ+AsZkiFf9p6WcLzoZPsfzors1kk=";
+    sha256 = "sha256-c9bRWVWCC9hLxmko6EHgxgmghrxskJP4PQf3ld2BHoY=";
  };

  nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , fetchpatch
 , avahi
@ -50,6 +51,12 @@ stdenv.mkDerivation rec {
    sha256 = "d+g9dU9RrDjFQj847rVd5bPiYSjmC1EbAtLe/PNubBg=";
  };

+  # doesnt apply cleanly, so doing with substituteInPlace
+  # https://github.com/brummer10/guitarix/commit/39d7c21c4173eb0f121b1bbff439d9cf43331a00.patch
+  postPatch = ''
+    substituteInPlace wscript --replace "open(src_fname, 'rU')" "open(src_fname, 'r')"
+  '';
+
  nativeBuildInputs = [
    gettext
    hicolor-icon-theme
--- a/pkgs/applications/audio/mus/Cargo.lock
+++ b/pkgs/applications/audio/mus/Cargo.lock
@ -1,382 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi 0.1.19",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bufstream"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40e38929add23cdf8a366df9b0e088953150724bcbe5fc330b0d8eb3b328eec8"
-
-[[package]]
-name = "cc"
-version = "1.0.79"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
-
-[[package]]
-name = "clap"
-version = "4.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0b0588d44d4d63a87dbd75c136c166bbfd9a86a31cb89e09906521c7d3f5e3"
-dependencies = [
- "bitflags",
- "clap_derive",
- "clap_lex",
- "is-terminal",
- "once_cell",
- "strsim",
- "termcolor",
-]
-
-[[package]]
-name = "clap_derive"
-version = "4.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "684a277d672e91966334af371f1a7b5833f9aa00b07c84e92fbce95e00208ce8"
-dependencies = [
- "heck",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "clap_lex"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "783fe232adfca04f90f56201b26d79682d4cd2625e0bc7290b95123afe558ade"
-dependencies = [
- "os_str_bytes",
-]
-
-[[package]]
-name = "colored"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3616f750b84d8f0de8a58bda93e08e2a81ad3f523089b05f1dffecab48c6cbd"
-dependencies = [
- "atty",
- "lazy_static",
- "winapi",
-]
-
-[[package]]
-name = "errno"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f639046355ee4f37944e44f60642c6f3a7efa3cf6b78c78a0d989a8ce6c396a1"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
-
-[[package]]
-name = "heck"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
-
-[[package]]
-name = "io-lifetimes"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1abeb7a0dd0f8181267ff8adc397075586500b81b28a73e8a0208b00fc170fb3"
-dependencies = [
- "libc",
- "windows-sys",
-]
-
-[[package]]
-name = "is-terminal"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e18b0a45d56fe973d6db23972bf5bc46f988a4a2385deac9cc29572f09daef"
-dependencies = [
- "hermit-abi 0.3.1",
- "io-lifetimes",
- "rustix",
- "windows-sys",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.139"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f051f77a7c8e6957c0696eac88f26b0117e54f52d3fc682ab19397a8812846a4"
-
-[[package]]
-name = "mpd"
-version = "0.1.0"
-source = "git+https://github.com/kstep/rust-mpd?rev=e8b5c3d#e8b5c3d67bb602960aa21910430380d6626b3be7"
-dependencies = [
- "bufstream",
-]
-
-[[package]]
-name = "mus"
-version = "0.1.0"
-dependencies = [
- "clap",
- "colored",
- "mpd",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
-
-[[package]]
-name = "os_str_bytes"
-version = "6.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b7820b9daea5457c9f21c69448905d723fbd21136ccf521748f23fd49e723ee"
-
-[[package]]
-name = "proc-macro-error"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
-dependencies = [
- "proc-macro-error-attr",
- "proc-macro2",
- "quote",
- "syn",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro-error-attr"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
-dependencies = [
- "proc-macro2",
- "quote",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.51"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d727cae5b39d21da60fa540906919ad737832fe0b1c165da3a34d6548c849d6"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8856d8364d252a14d474036ea1358d63c9e6965c8e5c1885c18f73d70bff9c7b"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "rustix"
-version = "0.36.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f43abb88211988493c1abb44a70efa56ff0ce98f233b7b276146f1f3f7ba9644"
-dependencies = [
- "bitflags",
- "errno",
- "io-lifetimes",
- "libc",
- "linux-raw-sys",
- "windows-sys",
-]
-
-[[package]]
-name = "strsim"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
-
-[[package]]
-name = "syn"
-version = "1.0.107"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f4064b5b16e03ae50984a5a8ed5d4f8803e6bc1fd170a3cda91a1be4b18e3f5"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84a22b9f218b40614adcb3f4ff08b703773ad44fa9423e4e0d346d5db86e4ebc"
-
-[[package]]
-name = "version_check"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2522491fbfcd58cc84d47aeb2958948c4b8982e9a2d8a2a35bbaed431390e7"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9864e83243fdec7fc9c5444389dcbbfd258f745e7853198f365e3c4968a608"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c8b1b673ffc16c47a9ff48570a9d85e25d265735c503681332589af6253c6c7"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de3887528ad530ba7bdbb1faa8275ec7a1155a45ffa57c37993960277145d640"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf4d1122317eddd6ff351aa852118a2418ad4214e6613a50e0191f7004372605"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1040f221285e17ebccbc2591ffdc2d44ee1f9186324dd3e84e99ac68d699c45"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "628bfdf232daa22b0d64fdb62b09fcc36bb01f05a3939e20ab73aaf9470d0463"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "447660ad36a13288b1db4d4248e857b510e8c3a225c822ba4fb748c0aafecffd"
--- a/pkgs/applications/audio/mus/default.nix
+++ b/pkgs/applications/audio/mus/default.nix
@ -2,21 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mus";
-  version = "0.1.0";
+  version = "0.2.0";

  src = fetchFromSourcehut {
    owner = "~sfr";
    repo = pname;
    rev = version;
-    hash = "sha256-s7rizOieOmzK0Stkk1SWe9h/5DoaH6MMmL/5QFeezt0=";
+    hash = "sha256-yvMV+lhU9Wtwrhw0RKRUNFNznvZP0zcnT6jqPaqzhUs=";
  };

-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "mpd-0.1.0" = "sha256-5UC6aFNJU9B5AlgJ7uPO+W7e2MHpvTu2OpktjiIXMfc=";
-    };
-  };
+  cargoHash = "sha256-K9B8y9pOHcAOrUCmCB0zW2wy81DTF3K97gPYmAiKwAM=";

  meta = with lib; {
    description = "a pretty good mpd client";
--- a/pkgs/applications/audio/pipecontrol/default.nix
+++ b/pkgs/applications/audio/pipecontrol/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "pipecontrol";
-  version = "0.2.10";
+  version = "0.2.11";

  src = fetchFromGitHub {
    owner = "portaloffreedom";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-MSm9rW41x8qvPuDermOPIYpxgblk5hlKIQsUEAvCzMo=";
+    sha256 = "sha256-jMP8hPv0Rv/OIVIzR/5R8LmEcyzwtcof9Ire86WtISc=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/file-managers/walk/default.nix
+++ b/pkgs/applications/file-managers/walk/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "walk";
-  version = "1.6.2";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "antonmedv";
    repo = "walk";
    rev = "v${version}";
-    hash = "sha256-Wo8i0nPAuzADLXlsEho9TSSbNh3d13iNsXXx5onPnIs=";
+    hash = "sha256-hif62WAyJyFHpJoP3ph7gJk1QkEL7qkcv/BJuoXkwFU=";
  };

-  vendorHash = "sha256-AmgCyq+N+EMdpIUCe6Lzd8bDXHsbOzclsHPp+H5ROMc=";
+  vendorHash = "sha256-e292ke0JiFEopLSozb+FkpwzSuhpIs/PdWOYuNI2M2o=";

  meta = with lib; {
    description = "Terminal file manager";
--- a/pkgs/applications/graphics/hydrus/0001-inform-nixpkgs.patch
+++ b/pkgs/applications/graphics/hydrus/0001-inform-nixpkgs.patch
@ -1,18 +0,0 @@
-diff --git a/hydrus/core/HydrusConstants.py b/hydrus/core/HydrusConstants.py
-index 809338ef..9125928f 100644
--- a/hydrus/core/HydrusConstants.py
-+++ b/hydrus/core/HydrusConstants.py
-@@ -59,12 +59,7 @@ elif PLATFORM_HAIKU:
- RUNNING_FROM_SOURCE = sys.argv[0].endswith( '.py' ) or sys.argv[0].endswith( '.pyw' )
- RUNNING_FROM_MACOS_APP = os.path.exists( os.path.join( BASE_DIR, 'running_from_app' ) )
- 
-if RUNNING_FROM_SOURCE:
-    NICE_RUNNING_AS_STRING = 'from source'
-elif RUNNING_FROM_FROZEN_BUILD:
-    NICE_RUNNING_AS_STRING = 'from frozen build'
-elif RUNNING_FROM_MACOS_APP:
-    NICE_RUNNING_AS_STRING = 'from App'
-+NICE_RUNNING_AS_STRING = "from nixpkgs (source)"
- 
- BIN_DIR = os.path.join( BASE_DIR, 'bin' )
- HELP_DIR = os.path.join( BASE_DIR, 'help' )
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@ -12,21 +12,16 @@

 python3Packages.buildPythonPackage rec {
  pname = "hydrus";
-  version = "544";
+  version = "549";
  format = "other";

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
    rev = "refs/tags/v${version}";
-    hash = "sha256-e3VvkdJAQx5heKDJ1Ms6XpXrXWdzv48f8yu0DHfPy1A=";
+    hash = "sha256-y3WFQhPE8H0198Xu3Dn9YAqaX8YvFJcdt90tebTg7qw=";
  };

-  patches = [
-    # Nixpkgs specific, can be removed if upstream makes a more reasonable check
-    ./0001-inform-nixpkgs.patch
-  ];
-
  nativeBuildInputs = [
    wrapQtAppsHook
    python3Packages.mkdocs-material
@ -75,31 +70,35 @@ python3Packages.buildPythonPackage rec {

  # most tests are failing, presumably because we are not using test.py
  checkPhase = ''
+    runHook preCheck
+
    nosetests $src/hydrus/test  \
-    -e TestClientAPI \
-    -e TestClientConstants \
-    -e TestClientDaemons \
-    -e TestClientData \
-    -e TestClientDB \
-    -e TestClientDBDuplicates \
-    -e TestClientDBTags \
-    -e TestClientImageHandling \
-    -e TestClientImportOptions \
-    -e TestClientListBoxes \
-    -e TestClientMigration \
-    -e TestClientNetworking \
-    -e TestClientTags \
-    -e TestClientThreading \
-    -e TestDialogs \
-    -e TestFunctions \
-    -e TestHydrusNetwork \
-    -e TestHydrusNATPunch \
-    -e TestHydrusSerialisable \
-    -e TestHydrusServer \
-    -e TestHydrusSessions \
-    -e TestServer \
-    -e TestClientMetadataMigration \
-    -e TestClientFileStorage \
+      -e TestClientAPI \
+      -e TestClientConstants \
+      -e TestClientDaemons \
+      -e TestClientData \
+      -e TestClientDB \
+      -e TestClientDBDuplicates \
+      -e TestClientDBTags \
+      -e TestClientImageHandling \
+      -e TestClientImportOptions \
+      -e TestClientListBoxes \
+      -e TestClientMigration \
+      -e TestClientNetworking \
+      -e TestClientTags \
+      -e TestClientThreading \
+      -e TestDialogs \
+      -e TestFunctions \
+      -e TestHydrusNetwork \
+      -e TestHydrusNATPunch \
+      -e TestHydrusSerialisable \
+      -e TestHydrusServer \
+      -e TestHydrusSessions \
+      -e TestServer \
+      -e TestClientMetadataMigration \
+      -e TestClientFileStorage \
+
+    runHook postCheck
  '';

  outputs = [ "out" "doc" ];
@ -112,7 +111,8 @@ python3Packages.buildPythonPackage rec {
    chmod -x $out/${python3Packages.python.sitePackages}/static/*.{png,svg,ico}
    # Build docs
    mkdocs build -d help
-    mv help $out/doc/
+    mkdir -p $doc/share/doc
+    mv help $doc/share/doc/hydrus

    # install the hydrus binaries
    mkdir -p $out/bin
--- a/pkgs/applications/misc/gimoji/default.nix
+++ b/pkgs/applications/misc/gimoji/default.nix
@ -26,6 +26,7 @@ rustPlatform.buildRustPackage rec {
    description = "Easily add emojis to your git commit messages";
    homepage = "https://github.com/zeenix/gimoji";
    license = licenses.mit;
+    mainProgram = "gimoji";
    maintainers = with maintainers; [ a-kenji ];
  };
 }
--- a/pkgs/applications/misc/hyprdim/default.nix
+++ b/pkgs/applications/misc/hyprdim/default.nix
@ -2,38 +2,41 @@
 , rustPlatform
 , fetchFromGitHub
 , installShellFiles
+, nix-update-script
 }:

 rustPlatform.buildRustPackage rec {
  pname = "hyprdim";
-  version = "2.2.1";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "donovanglover";
-    repo = pname;
+    repo = "hyprdim";
    rev = version;
-    hash = "sha256-6HeVLgEJDPy4cWL5td3Xl7+a6WUFZWUFynvBzPhItcg=";
+    hash = "sha256-b2T/ueinKiheuK+siV29vJfEsEodq6qT2J3XxvoD/14=";
  };

-  cargoHash = "sha256-qYX5o64X8PsFcTYuZ82lIShyUN69oTzQIHrQH4B7iIw=";
+  cargoHash = "sha256-Sf32vaqcxVdg6/kDidxBSr5XDWg3aNEBpEl31do2ZJ8=";

  nativeBuildInputs = [
    installShellFiles
  ];

  postInstall = ''
-    installManPage man/hyprdim.1
+    installManPage target/man/hyprdim.1

    installShellCompletion --cmd hyprdim \
-      --bash <(cat completions/hyprdim.bash) \
-      --fish <(cat completions/hyprdim.fish) \
-      --zsh <(cat completions/_hyprdim)
+      --bash <(cat target/completions/hyprdim.bash) \
+      --fish <(cat target/completions/hyprdim.fish) \
+      --zsh <(cat target/completions/_hyprdim)
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    description = "Automatically dim windows in Hyprland when switching between them";
    homepage = "https://github.com/donovanglover/hyprdim";
-    license = licenses.mit;
+    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    maintainers = with maintainers; [ donovanglover ];
    mainProgram = "hyprdim";
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@ -1,6 +1,7 @@
 { buildPythonApplication
 , lib
 , fetchFromGitHub
+, fetchpatch

  # build inputs
 , atk
@ -75,15 +76,24 @@ let
 in
 buildPythonApplication rec {
  pname = "lutris-unwrapped";
-  version = "0.5.13";
+  version = "0.5.14";

  src = fetchFromGitHub {
    owner = "lutris";
    repo = "lutris";
    rev = "v${version}";
-    hash = "sha256-ectrfbIkPhIqfhkavDpBCNdLPnGQhCnfFYwTf2IxB50=";
+    hash = "sha256-h7oHFVqMJU1HuuUgh5oKXxr9uaIPHz7Q4gf8ONLzric=";
  };

+  # Backport patch to fix a failing test
+  # FIXME: remove in next release
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/lutris/lutris/commit/1f1d554df3b38da64fc65557ad619e55e050641e.patch";
+      hash = "sha256-kVK1RX6T1ijffWVU7VEt2fR62QpvI6VZebiKPgEE/N8=";
+    })
+  ];
+
  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
  buildInputs = [
    atk
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.25.1";
+  version = "2.25.2";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = "spicetify-cli";
    rev = "v${version}";
-    hash = "sha256-81dfAekWvMcp1Jar+jlXRiJr6UmHCdJZ0ML/6fFnvRs=";
+    hash = "sha256-llPxR4awKBBv0jiLr5MbE33D5KZx3LmBo5BDwZI8ZM0=";
  };

  vendorHash = "sha256-VktAO3yKCdm5yz/RRLeLv6zzyGrwuHC/i8WdJtqZoYc=";
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@ -66,6 +66,7 @@ stdenv.mkDerivation rec {
    description = "Monero (XMR) CPU miner";
    homepage = "https://github.com/xmrig/xmrig";
    license = licenses.gpl3Plus;
+    mainProgram = "xmrig";
    platforms = platforms.unix;
    maintainers = with maintainers; [ kim0 ];
  };
--- a/pkgs/applications/misc/xmrig/moneroocean.nix
+++ b/pkgs/applications/misc/xmrig/moneroocean.nix
@ -15,6 +15,7 @@ xmrig.overrideAttrs (oldAttrs: rec {
    description = "A fork of the XMRig CPU miner with support for algorithm switching";
    homepage = "https://github.com/MoneroOcean/xmrig";
    license = licenses.gpl3Plus;
+    mainProgram = "xmrig";
    platforms = platforms.unix;
    maintainers = with maintainers; [ j0hax ];
  };
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -92,11 +92,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.59.120";
+  version = "1.59.124";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-fkIU6XuydF6Bo8V0uS4NObh2fRuKxOWMqVft81uUs9Q=";
+    sha256 = "sha256-uY9i0TxTsSvOfMA98amxwWpQh1nsRVEgxeSZ2sv8NEU=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/microsoft-edge/default.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
@ -1,20 +1,20 @@
 {
  stable = import ./browser.nix {
    channel = "stable";
-    version = "118.0.2088.46";
+    version = "118.0.2088.76";
    revision = "1";
-    sha256 = "sha256-/3lo/y/LhAmGqiOhZgDoJVS+c2631NB/Z/lBNFunU30=";
+    sha256 = "sha256-cd8W/0UZi+NhPSILR8e8aOLxy6ra+0DVwRowo2jG8DA=";
  };
  beta = import ./browser.nix {
    channel = "beta";
-    version = "118.0.2088.46";
+    version = "119.0.2151.32";
    revision = "1";
-    sha256 = "sha256-u0w7COYoAgcpqVEsB0t27iMD2AGVYFCJyE72uWKIY70=";
+    sha256 = "sha256-tsDFUKZDiusr/fGO5NMRqzTDIF+MTgC/1gJu95wXwAw=";
  };
  dev = import ./browser.nix {
    channel = "dev";
-    version = "119.0.2151.2";
+    version = "120.0.2172.1";
    revision = "1";
-    sha256 = "sha256-42wbnA9i1FdBq14Y+xxstAe9ciWDzEBVMULCSURQzj0=";
+    sha256 = "sha256-EvTS0AO3/A8Ut9H36mMOnS9PRR062WAoas9/Pd90NBM=";
  };
 }
--- a/pkgs/applications/networking/cluster/civo/default.nix
+++ b/pkgs/applications/networking/cluster/civo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "civo";
-  version = "1.0.67";
+  version = "1.0.68";

  src = fetchFromGitHub {
    owner  = "civo";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "sha256-EBpKJrQ+zdoMlTbOsWCAj2Hfu8OqQTFb0l+i2UdkNSs=";
+    sha256 = "sha256-qvcMA8oPDyi8WoIzr/3mu+2cHDXn5rgLUmnsGdOQXVM=";
  };

-  vendorHash = "sha256-AvAS3S7bepaTFPelE+Bj5/UuQIXEDvSAtDuFaPRC9sk=";
+  vendorHash = "sha256-C+XaX78iGKw6Ll7PMPFWWAy6fRwjrmbLhFdmqJPMrxc=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/gatekeeper/default.nix
+++ b/pkgs/applications/networking/cluster/gatekeeper/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "gatekeeper";
-  version = "3.13.2";
+  version = "3.13.3";

  src = fetchFromGitHub {
    owner = "open-policy-agent";
    repo = "gatekeeper";
    rev = "v${version}";
-    hash = "sha256-4d0AZknOPQR84HbZiYgXAR/HA82cYes+gzoLWw4SVgA=";
+    hash = "sha256-kLDriWkzOX4mC4VTpkyEtMTpOSoR0BsCwVeWLCfaY5w=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@ -1,16 +1,23 @@
-{ lib, stdenv, callPackage }:
+{ lib, callPackage, ... }@args:

 let
  k3s_builder = import ./builder.nix lib;
  common = opts: callPackage (k3s_builder opts);
+  # extraArgs is the extra arguments passed in by the caller to propogate downward.
+  # This is to allow all-packages.nix to do:
+  #
+  #     let k3s_1_23 = (callPackage ./path/to/k3s {
+  #       commonK3sArg = ....
+  #     }).k3s_1_23;
+  extraArgs = builtins.removeAttrs args [ "callPackage" ];
 in
 {
  k3s_1_26 = common ((import ./1_26/versions.nix) // {
    updateScript = [ ./update-script.sh "26" ];
-  }) { };
+  }) extraArgs;

  # 1_27 can be built with the same builder as 1_26
  k3s_1_27 = common ((import ./1_27/versions.nix) // {
    updateScript = [ ./update-script.sh "27" ];
-  }) { };
+  }) extraArgs;
 }
--- a/pkgs/applications/networking/instant-messengers/ferdium/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ferdium/default.nix
@ -6,13 +6,13 @@ let
    aarch64-linux = "arm64";
  }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  hash = {
-    amd64-linux_hash = "sha256-MmDU6Hn/s4IuTYBLYbz5okzHbx+dPOoKDtMXlLmZjQw=";
-    arm64-linux_hash = "sha256-m8sygpqWiwWzbHe+n8hfVdYr0YpZNfg1B+/nf5QXoyg=";
+    amd64-linux_hash = "sha256-ZCyAz+XVp2NJVUuMWyv5ubjMaoYBsjPAye/1vO2jv/w=";
+    arm64-linux_hash = "sha256-prdVwEn6eynzjLQ+aw2CS4PJ/JgG4QFKs9WDbzjV5oo=";
  }."${arch}-linux_hash";
 in mkFranzDerivation rec {
  pname = "ferdium";
  name = "Ferdium";
-  version = "6.5.2";
+  version = "6.6.0";
  src = fetchurl {
    url = "https://github.com/ferdium/ferdium-app/releases/download/v${version}/Ferdium-linux-${version}-${arch}.deb";
    inherit hash;
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "seaweedfs";
-  version = "3.55";
+  version = "3.58";

  src = fetchFromGitHub {
    owner = "seaweedfs";
    repo = "seaweedfs";
    rev = version;
-    hash = "sha256-qAyvGisj6GOjyRmqpTsxX/Zy8bx6+cAtmEId5us70+k=";
+    hash = "sha256-4USDCss2KYjyuwH55ZqMwBWsf7iDcjN7qxTSXvKDkus=";
  };

-  vendorHash = "sha256-F6Fqv5tUsty/uGwBnKM4r671Gh2T1+9Z2LRGAMF+M2g=";
+  vendorHash = "sha256-cbc6xKAneBCWpc4kUQUtgV5rrsggCGvVkt9tkypeCiE=";

  subPackages = [ "weed" ];

--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@ -27,13 +27,13 @@ assert !(pulseaudioSupport && portaudioSupport);

 gnuradioMinimal.pkgs.mkDerivation rec {
  pname = "gqrx";
-  version = "2.17.2";
+  version = "2.17.3";

  src = fetchFromGitHub {
    owner = "gqrx-sdr";
    repo = "gqrx";
    rev = "v${version}";
-    hash = "sha256-dwqb/TYNkaXSLXQ0QJEQpy1es0hgNrkNnZww9RpfTt8=";
+    hash = "sha256-dHbDy/aIsqBQG1raeN9nM/QtiFgy+Qhoj/ThN8LV6gI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/math/clp/default.nix
+++ b/pkgs/applications/science/math/clp/default.nix
@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, coin-utils, zlib, osi }:

 stdenv.mkDerivation rec {
-  version = "1.17.8";
+  version = "1.17.9";
  pname = "clp";
  src = fetchFromGitHub {
    owner = "coin-or";
    repo = "Clp";
    rev = "releases/${version}";
-    hash = "sha256-3Z6ysoCcDVB8UePiwbZNqvO/o/jgPcv6XFkpJZBK+Os=";
+    hash = "sha256-kHCDji+yIf5mCoxKB2b/HaATGmwwIAPEV74tthIMeMY=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/version-management/git-cliff/default.nix
+++ b/pkgs/applications/version-management/git-cliff/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-cliff";
-  version = "1.3.1";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "orhun";
    repo = "git-cliff";
    rev = "v${version}";
-    hash = "sha256-DzlCy8Y3OW3FiXO45wuUh3t87Za2jWQ4rnztZGRySYA=";
+    hash = "sha256-OK2eoWlqlpf/X8EGMnWTv9Gs5FkYvW5rmQDB/Mkbp60=";
  };

-  cargoHash = "sha256-+XyZqxjiOAIyc+FmnexIdV1RMzc+iqmo8nPahzUo43E=";
+  cargoHash = "sha256-gtkpZKOaG5p79uJ9cbbGdiOX57bDFTf2/Bd8+WToJrw=";

  # attempts to run the program on .git in src which is not deterministic
  doCheck = false;
--- a/pkgs/applications/video/qmplay2/default.nix
+++ b/pkgs/applications/video/qmplay2/default.nix
@ -26,14 +26,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "qmplay2";
-  version = "23.08.22";
+  version = "23.10.22";

  src = fetchFromGitHub {
    owner = "zaps166";
    repo = "QMPlay2";
    rev = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-Ug7WAqZ+BxspQUXweL/OnVBGCsU60DOWNexbi0GpDo0=";
+    hash = "sha256-yDymUXuILgT4AFTt302GniPi/WNwrTCOuOfdUiKOIyk=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/video/smplayer/default.nix
+++ b/pkgs/applications/video/smplayer/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "smplayer";
-  version = "23.6.0";
+  version = "23.6.0.10170";

  src = fetchFromGitHub {
    owner = "smplayer-dev";
    repo = "smplayer";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-xGy6/9aUftBTSo9HJ3zyuRSagqimP9XvXKP/4oBQTo4=";
+    hash = "sha256-ByheWIXvCw9jL3lY63oRzRZhl0jZz4jr+rw5Wi7Mm8w=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
@ -91,5 +91,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = licenses.bsd3;
    maintainers = with maintainers; [ fufexan ];
    platforms = wayland.meta.platforms;
+    mainProgram = "hyprpicker";
  };
 })
--- a/pkgs/by-name/fc/fcitx5-material-color/package.nix
+++ b/pkgs/by-name/fc/fcitx5-material-color/package.nix
@ -0,0 +1,41 @@
+{ stdenvNoCC
+, fetchFromGitHub
+, lib
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "fcitx5-material-color";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "hosxy";
+    repo = "Fcitx5-Material-Color";
+    rev = finalAttrs.version;
+    hash = "sha256-i9JHIJ+cHLTBZUNzj9Ujl3LIdkCllTWpO1Ta4OT1LTc=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    # https://gitlab.archlinux.org/archlinux/packaging/packages/fcitx5-material-color/-/blob/main/PKGBUILD?ref_type=heads#L16
+    install -Dm644 arrow.png radio.png -t $out/share/${finalAttrs.pname}/
+    for _variant in black blue brown deepPurple indigo orange pink red sakuraPink teal; do
+      _variant_name=Material-Color-$_variant
+      install -dm755 $_variant_name $out/share/fcitx5/themes/$_variant_name
+      ln -sv ../../../$pname/arrow.png $out/share/fcitx5/themes/$_variant_name/
+      ln -sv ../../../$pname/radio.png $out/share/fcitx5/themes/$_variant_name/
+      install -Dm644 theme-$_variant.conf $out/share/fcitx5/themes/$_variant_name/theme.conf
+      sed -i "s/^Name=.*/Name=$_variant_name/" $out/share/fcitx5/themes/$_variant_name/theme.conf
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Fcitx5 themes based on Material color";
+    homepage = "https://github.com/hosxy/Fcitx5-Material-Color";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ Cryolitia h7x4 ];
+    platforms = platforms.all;
+  };
+})
--- a/pkgs/by-name/fc/fcitx5-nord/package.nix
+++ b/pkgs/by-name/fc/fcitx5-nord/package.nix
@ -0,0 +1,33 @@
+{ stdenvNoCC
+, fetchFromGitHub
+, lib
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "fcitx5-nord";
+  version = "unstable-2021-07-27";
+
+  src = fetchFromGitHub {
+    owner = "tonyfettes";
+    repo = "fcitx5-nord";
+    rev = "bdaa8fb723b8d0b22f237c9a60195c5f9c9d74d1";
+    hash = "sha256-qVo/0ivZ5gfUP17G29CAW0MrRFUO0KN1ADl1I/rvchE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -pv $out/share/fcitx5/themes/
+    cp -rv Nord* $out/share/fcitx5/themes/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Fcitx5 theme based on Nord color";
+    homepage = "https://github.com/tonyfettes/fcitx5-nord";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Cryolitia ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/libraries/jasper/default.nix
+++ b/pkgs/development/libraries/jasper/default.nix
@ -5,15 +5,15 @@
 , pkg-config
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "jasper";
-  version = "2.0.32";
+  version = "4.0.0";

  src = fetchFromGitHub {
    owner = "jasper-software";
-    repo = pname;
-    rev = "version-${version}";
-    hash = "sha256-Uwgtex0MWC/pOmEr8itHMIa4wxd97c/tsTzcLgV8D0I=";
+    repo = "jasper";
+    rev = "version-${finalAttrs.version}";
+    hash = "sha256-v/AFx40JWdbTCa008tDz/n9cXgpAkKv4rSiGJ8yx1YQ=";
  };

  nativeBuildInputs = [
@ -21,7 +21,11 @@ stdenv.mkDerivation rec {
    pkg-config
  ];

-  meta = with lib; {
+  cmakeBuildDir = "build-directory";
+
+  strictDeps = true;
+
+  meta = {
    homepage = "https://jasper-software.github.io/jasper/";
    description = "Image processing/coding toolkit";
    longDescription = ''
@ -41,8 +45,8 @@ stdenv.mkDerivation rec {
      was chosen primarily due to the availability of C development environments
      for most computing platforms when JasPer was first developed, circa 1999.
    '';
-    license = licenses.free; # MIT-like
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/by-name/my/mystmd/package.nix
+++ b/pkgs/by-name/my/mystmd/package.nix
@ -1,17 +1,17 @@
-{ lib, buildNpmPackage, fetchFromGitHub }:
+{ lib, buildNpmPackage, fetchFromGitHub, mystmd, testers }:

 buildNpmPackage rec {
  pname = "mystmd";
-  version = "1.1.22";
+  version = "1.1.23";

  src = fetchFromGitHub {
    owner = "executablebooks";
    repo = "mystmd";
    rev = "mystmd@${version}";
-    hash = "sha256-jx/UCC/Cl5kqAbMzeikTmrx9xWS02OCp3rn0pvtIAPY=";
+    hash = "sha256-+zgAm3v7XcNhhVOFueRqJijteQqMCZmE33hDyR4d5bA=";
  };

-  npmDepsHash = "sha256-1qQ19iB7N+KvO1uUdEMU1iN91FMQs4wzfTCdv6wfn30=";
+  npmDepsHash = "sha256-8brgDSV0BBggYUnizV+24RQMXxPd6HUBDYrw9fJtL+M=";

  dontNpmInstall = true;

@ -23,6 +23,11 @@ buildNpmPackage rec {
    runHook postInstall
  '';

+  passthru.tests.version = testers.testVersion {
+    package = mystmd;
+    version = "v${version}";
+  };
+
  meta = with lib; {
    description = "Command line tools for working with MyST Markdown";
    homepage = "https://github.com/executablebooks/mystmd";
--- a/pkgs/applications/office/pyspread/default.nix
+++ b/pkgs/applications/office/pyspread/default.nix
@ -2,19 +2,24 @@
 , python3
 , fetchPypi
 , copyDesktopItems
-, wrapQtAppsHook
-, qtsvg
+, libsForQt5
 , makeDesktopItem
 }:

-python3.pkgs.buildPythonApplication rec {
+let
+  # get rid of rec
  pname = "pyspread";
-  version = "2.0.2";
-
+  version = "2.2.2";
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-rg2T9Y9FU2a+aWg0XM8jyQB9t8zDVlpad3TjUcx4//8=";
+    hash = "sha256-vbBu/dMXQf14F7qWvyHX5T8/AkjeZhaQt1eQ6Nidpsc=";
  };
+  inherit (libsForQt5)
+    qtsvg
+    wrapQtAppsHook;
+in
+python3.pkgs.buildPythonApplication {
+  inherit pname version src;

  nativeBuildInputs = [
    copyDesktopItems
@ -35,18 +40,20 @@ python3.pkgs.buildPythonApplication rec {
    setuptools
  ];

+  strictDeps = true;
+
  doCheck = false; # it fails miserably with a core dump

  pythonImportsCheck = [ "pyspread" ];

  desktopItems = [
-    (makeDesktopItem rec {
-      name = pname;
-      exec = name;
-      icon = name;
+    (makeDesktopItem {
+      name = "pyspread";
+      exec = "pyspread";
+      icon = "pyspread";
      desktopName = "Pyspread";
      genericName = "Spreadsheet";
-      comment = meta.description;
+      comment = "A Python-oriented spreadsheet application";
      categories = [ "Office" "Development" "Spreadsheet" ];
    })
  ];
@ -55,7 +62,7 @@ python3.pkgs.buildPythonApplication rec {
    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://pyspread.gitlab.io/";
    description = "A Python-oriented spreadsheet application";
    longDescription = ''
@ -68,8 +75,8 @@ python3.pkgs.buildPythonApplication rec {
      that can be accessed from other cells. These objects can represent
      anything including lists or matrices.
    '';
-    license = with licenses; gpl3Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = with platforms; all;
+    license = with lib.licenses; [ gpl3Plus ];
+    mainProgram = "pyspread";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
  };
 }
--- a/pkgs/by-name/sv/svix-server/Cargo.lock
+++ b/pkgs/by-name/sv/svix-server/Cargo.lock
--- a/pkgs/by-name/sv/svix-server/package.nix
+++ b/pkgs/by-name/sv/svix-server/package.nix
@ -0,0 +1,54 @@
+{ lib, rustPlatform, fetchFromGitHub, pkg-config, openssl, protobuf, stdenv
+, darwin }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "svix-server";
+  version = "1.13.0";
+
+  src = fetchFromGitHub {
+    owner = "svix";
+    repo = "svix-webhooks";
+    rev = "v${version}";
+    hash = "sha256-6758ej7bTvwZPWifl239rQMazM8uw+Y4+3EbjE8XsTg=";
+  };
+
+  sourceRoot = "source/server";
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "aide-0.10.0" = "sha256-hUUer5D6OA4F0Co3JgygY3g89cKIChFest67ABIX+4M=";
+      "hyper-0.14.23" = "sha256-7MBCAjKYCdDbqCmYg3eYE74h7K7yTjfVoo0sjxr4g/s=";
+    };
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    openssl
+    protobuf
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  # needed for internal protobuf c wrapper library
+  PROTOC = "${protobuf}/bin/protoc";
+  PROTOC_INCLUDE = "${protobuf}/include";
+
+  OPENSSL_NO_VENDOR = 1;
+
+  # disable tests because they require postgres and redis to be running
+  doCheck = false;
+
+  meta = with lib; {
+    mainProgram = "svix-server";
+    description = "The enterprise-ready webhooks service";
+    homepage = "https://github.com/svix/svix-webhooks";
+    changelog =
+      "https://github.com/svix/svix-webhooks/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ techknowlogick ];
+  };
+}
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@ -3,14 +3,14 @@
 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-domain-list-community";
-    version = "20231015073627";
+    version = "20231030084219";
    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "domain-list-community";
      rev = version;
-      hash = "sha256-DffJ9d5ppTVLMTfITKd0zwCqBEKKMCwupLAFMr/o+dw=";
+      hash = "sha256-5FVHjK68weGWjla8MBS1D/Ks5PjzBKLv/TeyjBSgYFw=";
    };
-    vendorHash = "sha256-dYaGR5ZBORANKAYuPAi9i+KQn2OAGDGTZxdyVjkcVi8=";
+    vendorHash = "sha256-6167kRAC5m5FlBr7uk+qKUcjWsb45P5Vvovyb6hHSVQ=";
    meta = with lib; {
      description = "community managed domain list";
      homepage = "https://github.com/v2fly/domain-list-community";
--- a/pkgs/data/themes/nordic/default.nix
+++ b/pkgs/data/themes/nordic/default.nix
@ -80,14 +80,11 @@ stdenv.mkDerivation rec {

  sourceRoot = ".";

+  outputs = [ "out" "sddm" ];
+
  nativeBuildInputs = [ jdupes ];

-  propagatedUserEnvPkgs = [
-    gtk-engine-murrine
-    breeze-icons
-    plasma-framework
-    plasma-workspace
-  ];
+  propagatedUserEnvPkgs = [ gtk-engine-murrine ];

  dontWrapQtApps = true;

@ -119,15 +116,18 @@ stdenv.mkDerivation rec {
    rmdir $out/share/themes/Nordic/extras{/wallpapers,}

    # move kde related contents to appropriate directories
-    mkdir -p $out/share/{aurorae/themes,color-schemes,Kvantum,plasma,sddm/themes,icons}
+    mkdir -p $out/share/{aurorae/themes,color-schemes,Kvantum,plasma,icons}
    mv -v $out/share/themes/Nordic/kde/aurorae/* $out/share/aurorae/themes/
    mv -v $out/share/themes/Nordic/kde/colorschemes/* $out/share/color-schemes/
    mv -v $out/share/themes/Nordic/kde/konsole $out/share/
    mv -v $out/share/themes/Nordic/kde/kvantum/* $out/share/Kvantum/
    mv -v $out/share/themes/Nordic/kde/plasma/look-and-feel $out/share/plasma/
-    mv -v $out/share/themes/Nordic/kde/sddm/* $out/share/sddm/themes/
    mv -v $out/share/themes/Nordic/kde/folders/* $out/share/icons/
    mv -v $out/share/themes/Nordic/kde/cursors/*-cursors $out/share/icons/
+
+    mkdir -p $sddm/share/sddm/themes
+    mv -v $out/share/themes/Nordic/kde/sddm/* $sddm/share/sddm/themes/
+
    rm -rf $out/share/themes/Nordic/kde

    # Replace duplicate files with symbolic links to the first file in
@ -137,6 +137,16 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

+  postFixup = ''
+    # Propagate sddm theme dependencies to user env otherwise sddm
+    # does find them. Putting them in buildInputs is not enough.
+
+    mkdir -p $sddm/nix-support
+
+    printWords ${breeze-icons} ${plasma-framework} ${plasma-workspace} \
+      >> $sddm/nix-support/propagated-user-env-packages
+  '';
+
  meta = with lib; {
    description = "Gtk and KDE themes using the Nord color pallete";
    homepage = "https://github.com/EliverLara/Nordic";
--- a/pkgs/desktops/deepin/go-package/dde-daemon/0006-fix-build-with-ddcutil-2.patch
+++ b/pkgs/desktops/deepin/go-package/dde-daemon/0006-fix-build-with-ddcutil-2.patch
@ -0,0 +1,17 @@
+diff --git a/bin/backlight_helper/ddcci/ddcci.go b/bin/backlight_helper/ddcci/ddcci.go
+index 679beea3..ccbfc508 100644
+--- a/bin/backlight_helper/ddcci/ddcci.go
+++ b/bin/backlight_helper/ddcci/ddcci.go
+@@ -103,11 +103,6 @@ func newDDCCI() (*ddcci, error) {
+ 		displayHandleMap: make(map[string]*displayHandle),
+ 	}
+ 
+-	status := C.ddca_set_max_tries(C.DDCA_MULTI_PART_TRIES, 5)
+-	if status < C.int(0) {
+-		return nil, fmt.Errorf("brightness: Error setting retries: %d", status)
+-	}
+-
+ 	err := ddc.RefreshDisplays()
+ 	if err != nil {
+ 		return nil, err
+
--- a/pkgs/desktops/deepin/go-package/dde-daemon/default.nix
+++ b/pkgs/desktops/deepin/go-package/dde-daemon/default.nix
@ -62,6 +62,7 @@ buildGoPackage rec {
      src = ./0005-fix-custom-wallpapers-path.diff;
      inherit coreutils;
    })
+    ./0006-fix-build-with-ddcutil-2.patch
  ];

  postPatch = ''
--- a/pkgs/development/interpreters/joker/default.nix
+++ b/pkgs/development/interpreters/joker/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "joker";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "candid82";
    repo = "joker";
-    sha256 = "sha256-D9maTCNNJ9ivj76SEjddFSYNu+RLEZG+3SgOWEAD7aU=";
+    sha256 = "sha256-9SsSXLZFwqsAeWFGsba8OG9bdmfQjn6qQHHQK6IdHK8=";
  };

-  vendorHash = "sha256-ioC7R5Pm2nmHXI+/ko1UoNJCvEFzvhZcAcVtaFECz2c=";
+  vendorHash = "sha256-VRQUbGJTC2v8w/l4iaNn3vPX3AdV9Likp2nuG0PQieU=";

  doCheck = false;

--- a/pkgs/development/libraries/ctranslate2/default.nix
+++ b/pkgs/development/libraries/ctranslate2/default.nix
@ -5,6 +5,9 @@
 , darwin # Accelerate
 , llvmPackages # openmp
 , withMkl ? false, mkl
+, withCUDA ? false
+, withCuDNN ? false
+, cudaPackages
 # Enabling both withOneDNN and withOpenblas is broken
 # https://github.com/OpenNMT/CTranslate2/issues/1294
 , withOneDNN ? false, oneDNN
@ -33,6 +36,8 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    cmake
+  ] ++ lib.optionals withCUDA [
+    cudaPackages.cuda_nvcc
  ];

  cmakeFlags = [
@ -40,6 +45,8 @@ stdenv.mkDerivation rec {
    # https://github.com/OpenNMT/CTranslate2/blob/54810350e662ebdb01ecbf8e4a746f02aeff1dd7/python/tools/prepare_build_environment_linux.sh#L53
    # https://github.com/OpenNMT/CTranslate2/blob/59d223abcc7e636c1c2956e62482bc3299cc7766/python/tools/prepare_build_environment_macos.sh#L12
    "-DOPENMP_RUNTIME=COMP"
+    "-DWITH_CUDA=${cmakeBool withCUDA}"
+    "-DWITH_CUDNN=${cmakeBool withCuDNN}"
    "-DWITH_DNNL=${cmakeBool withOneDNN}"
    "-DWITH_OPENBLAS=${cmakeBool withOpenblas}"
    "-DWITH_RUY=${cmakeBool withRuy}"
@ -49,6 +56,12 @@ stdenv.mkDerivation rec {

  buildInputs = lib.optionals withMkl [
    mkl
+  ] ++ lib.optionals withCUDA [
+    cudaPackages.cuda_cudart
+    cudaPackages.libcublas
+    cudaPackages.libcurand
+  ] ++ lib.optionals withCuDNN [
+    cudaPackages.cudnn
  ] ++ lib.optionals withOneDNN [
    oneDNN
  ] ++ lib.optionals withOpenblas [
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "enchant";
-  version = "2.6.1";
+  version = "2.6.2";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-8k4SRpE3rh0DFAu5AypHpZR8NvTR4vErkpBhAF6xUnk=";
+    hash = "sha256-ZoanKOVudg+N7gmiLw+1O0bunb59ZM+eW7NaZYv/fh0=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libhugetlbfs/default.nix
+++ b/pkgs/development/libraries/libhugetlbfs/default.nix
@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ qyliss ];
    license = licenses.lgpl21Plus;
    platforms = platforms.linux;
-    badPlatforms = [
+    badPlatforms = flatten [
      systems.inspect.platformPatterns.isStatic
      systems.inspect.patterns.isMusl
      systems.inspect.patterns.isAarch64
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -153,6 +153,7 @@
 , "katex"
 , "keyoxide"
 , "lcov-result-merger"
+, "lean-language-server"
 , "lerna"
 , "less"
 , "less-plugin-clean-css"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/python-modules/androidtv/default.nix
+++ b/pkgs/development/python-modules/androidtv/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "androidtv";
-  version = "0.0.72";
+  version = "0.0.73";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "JeffLIrion";
    repo = "python-androidtv";
    rev = "v${version}";
-    hash = "sha256-oDC5NWmdo6Ijxz2ER9CjtCZxWkancUNyxVe2ofH4c+Q=";
+    hash = "sha256-FJUTJfS9jiC7KDf6XcGVRNXf75bVUOBPZe8y9M39Uak=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/azure-mgmt-containerregistry/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerregistry/default.nix
@ -4,29 +4,25 @@
 , pythonOlder
 , azure-common
 , azure-mgmt-core
-, msrest
-, typing-extensions
+, isodate
 }:

 buildPythonPackage rec {
  pname = "azure-mgmt-containerregistry";
-  version = "10.1.0";
+  version = "10.2.0";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-VrX9YfYNvlA8+eNqHCp35BAeQZzQKakZs7ZZKwT8oYc=";
-    extension = "zip";
+    hash = "sha256-i7i/5ofGxiF9/wTAPnUOaZ6FAgK3EaBqoHeSC8HuXCo=";
  };

  propagatedBuildInputs = [
    azure-common
    azure-mgmt-core
-    msrest
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
+    isodate
  ];

  # no tests included
@ -40,6 +36,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Microsoft Azure Container Registry Client Library for Python";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-mgmt-containerregistry_${version}/sdk/containerregistry/azure-mgmt-containerregistry/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ jonringer ];
  };
--- a/pkgs/development/python-modules/azure-mgmt-netapp/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-netapp/default.nix
@ -4,28 +4,25 @@
 , pythonOlder
 , azure-common
 , azure-mgmt-core
-, msrest
-, msrestazure
+, isodate
 }:

 buildPythonPackage rec {
  pname = "azure-mgmt-netapp";
-  version = "10.1.0";
+  version = "11.0.0";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-eJiWTOCk2C79Jotku9bKlu3vU6H8004hWrX+h76MjQM=";
-    extension = "zip";
+    hash = "sha256-00cDFHpaEciRQLHM+Kt3uOtw/geOn5+onrY7lav6EeU=";
  };

  propagatedBuildInputs = [
    azure-common
    azure-mgmt-core
-    msrest
-    msrestazure
+    isodate
  ];

  # no tests included
@ -39,6 +36,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Microsoft Azure NetApp Files Management Client Library for Python";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-mgmt-netapp_${version}/sdk/netapp/azure-mgmt-netapp/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ jonringer ];
  };
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, setuptools

 # extras: babel
 , babel
@ -11,7 +12,6 @@
 , bcrypt
 , bleach
 , flask-mailman
-, qrcode

 # extras: fsqla
 , flask-sqlalchemy
@ -21,20 +21,21 @@
 # extras: mfa
 , cryptography
 , phonenumbers
+, webauthn
+, qrcode

 # propagates
-, blinker
 , email-validator
 , flask
 , flask-login
 , flask-principal
 , flask-wtf
-, itsdangerous
 , passlib
+, importlib-resources
+, wtforms

 # tests
 , argon2-cffi
-, flask-mongoengine
 , mongoengine
 , mongomock
 , peewee
@ -46,31 +47,30 @@

 buildPythonPackage rec {
  pname = "flask-security-too";
-  version = "5.3.0";
-  format = "setuptools";
+  version = "5.3.2";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    pname = "Flask-Security-Too";
    inherit version;
-    hash = "sha256-n12DCRPqxm8YhFeVrl99BEvdDYNq6rzP662rain3k1Q=";
+    hash = "sha256-wLUHXfDWSp7zWwTIjTH79AWlkkNzb21tChpLSEWr8+U=";
  };

-  postPatch = ''
-    # This should be removed after updating to version 5.3.0.
-    sed -i '/filterwarnings =/a ignore:pkg_resources is deprecated:DeprecationWarning' pytest.ini
-  '';
+  nativeBuildInputs = [
+    setuptools
+  ];

  propagatedBuildInputs = [
-    blinker
    email-validator
    flask
    flask-login
    flask-principal
    flask-wtf
-    itsdangerous
    passlib
+    importlib-resources
+    wtforms
  ];

  passthru.optional-dependencies = {
@ -82,7 +82,6 @@ buildPythonPackage rec {
      bcrypt
      bleach
      flask-mailman
-      qrcode
    ];
    fsqla = [
      flask-sqlalchemy
@ -92,12 +91,13 @@ buildPythonPackage rec {
    mfa = [
      cryptography
      phonenumbers
+      webauthn
+      qrcode
    ];
  };

  nativeCheckInputs = [
    argon2-cffi
-    flask-mongoengine
    mongoengine
    mongomock
    peewee
@ -112,6 +112,11 @@ buildPythonPackage rec {
  ++ passthru.optional-dependencies.mfa;


+  disabledTests = [
+    # needs /etc/resolv.conf
+    "test_login_email_whatever"
+  ];
+
  pythonImportsCheck = [
    "flask_security"
  ];
--- a/pkgs/development/python-modules/garminconnect/default.nix
+++ b/pkgs/development/python-modules/garminconnect/default.nix
@ -1,25 +1,25 @@
 { lib
 , buildPythonPackage
-, cloudscraper
 , fetchFromGitHub
 , garth
 , pdm-backend
 , pythonOlder
 , requests
+, withings-sync
 }:

 buildPythonPackage rec {
  pname = "garminconnect";
-  version = "0.2.8";
+  version = "0.2.9";
  format = "pyproject";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.10";

  src = fetchFromGitHub {
    owner = "cyberjunky";
    repo = "python-garminconnect";
    rev = "refs/tags/${version}";
-    hash = "sha256-jNDFSA6Mz0+7UhEVrCKcKDEX3B7yk6igBf59A6YlW2M=";
+    hash = "sha256-wQWOksI0nfzIMdxgZehMmNytuXWD22GLUNoI7Ki0C3s=";
  };

  nativeBuildInputs = [
@ -27,9 +27,9 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
-    cloudscraper
    garth
    requests
+    withings-sync
  ];

  # Tests require a token
--- a/pkgs/development/python-modules/google-cloud-vision/default.nix
+++ b/pkgs/development/python-modules/google-cloud-vision/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-vision";
-  version = "3.4.4";
+  version = "3.4.5";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-QFdErlCFIDTMR7MqmxuuUNP7Cc0eIWABQYKJHvV2ZpU=";
+    hash = "sha256-DfgkGrJ3GZuRnKODen3oUFk2P+oOPWYAYIcL587/wEc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/hap-python/default.nix
+++ b/pkgs/development/python-modules/hap-python/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "hap-python";
-  version = "4.9.0";
+  version = "4.9.1";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "ikalchev";
    repo = "HAP-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-bFSqMAZWE3xTfnc7FSQMfAhxhKlYm65VFpm+q3yrqpE=";
+    hash = "sha256-nnh8PSEcuPN1qGuInJ7uYe83zdne8axbTrHd4g1xoJs=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/home-assistant-chip-core/default.nix
+++ b/pkgs/development/python-modules/home-assistant-chip-core/default.nix
@ -37,7 +37,7 @@ buildPythonPackage rec {
    system = {
      "aarch64-linux" = {
        name = "aarch64";
-        hash = "sha256-fR+ea25SqOMksBJXgSjuVvv2xSBoadZmPWP0IwxpiMA=";
+        hash = "sha256-wmavXr7WL9q7u8lnOaEWbRs3rlagBd9ovhxzRbjnrwY=";
      };
      "x86_64-linux" = {
        name = "x86_64";
--- a/pkgs/development/python-modules/libusb1/default.nix
+++ b/pkgs/development/python-modules/libusb1/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "libusb1";
-  version = "3.0.0";
+  version = "3.1.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "5792a9defee40f15d330a40d9b1800545c32e47ba7fc66b6f28f133c9fcc8538";
+    sha256 = "4ee9b0a55f8bd0b3ea7017ae919a6c1f439af742c4a4b04543c5fd7af89b828c";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/notmuch2/default.nix
+++ b/pkgs/development/python-modules/notmuch2/default.nix
@ -16,9 +16,11 @@ buildPythonPackage {
    cffi
  ];
  buildInputs = [
-    python notmuch cffi
+    python notmuch
  ];

+  propagatedBuildInputs = [ cffi ];
+
  # since notmuch 0.35, this package expects _notmuch_config.py that is
  # generated by notmuch's configure script. We write one which references our
  # built libraries.
--- a/pkgs/development/python-modules/nunavut/default.nix
+++ b/pkgs/development/python-modules/nunavut/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "nunavut";
-  version = "2.1.1";
+  version = "2.3.0";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ENP1uhzQwFEk990b1RX2wNVpInaSSH80KNihX6XpQtU=";
+    hash = "sha256-+wqQ7JKC4aSgdM8YcYlO289CRpwX4VPxVqNlSABJJ0U=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "peaqevcore";
-  version = "19.5.10";
+  version = "19.5.12";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-izw41TUmqKOy34/RMHjBROQr88SChheKJVpPMaOubnE=";
+    hash = "sha256-NsQrfJQ1+WZ4wNBH8ZGGo9IMJ+yvWrVQmesDBQrfRKg=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pgcli/default.nix
+++ b/pkgs/development/python-modules/pgcli/default.nix
@ -22,11 +22,11 @@
 # integrating with ipython-sql
 buildPythonPackage rec {
  pname = "pgcli";
-  version = "3.5.0";
+  version = "4.0.0";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-zESNlRWfwJA9NhgpkneKCW7aV1LWYNR2cTg8jiv2M/E=";
+    hash = "sha256-C/X427yQR+BkbQFqQhMoomDEbP8hCJCLEbtVyWR17o0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pgvector/default.nix
+++ b/pkgs/development/python-modules/pgvector/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "pgvector";
-  version = "0.2.2";
+  version = "0.2.3";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "pgvector";
    repo = "pgvector-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-qvLDFnrTYibdhjSeeIFI4YdpPRsvNBnQ23uqsLCblEo=";
+    hash = "sha256-KQROG0cHvKmdWssr7Git3JH0YguRPno/ZzYiQL7VhwU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@ -5,20 +5,25 @@
 , pytestCheckHook
 , pythonOlder
 , requests
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "0.10.0.20231026";
-  format = "setuptools";
+  version = "0.10.0.20231030";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-q2rUBjbue3I3VnRLTF7UscBs51bGxUGjMYwAkgX5UMs=";
+    hash = "sha256-1yRv6zg9mKJTinR57QHvCx/0mi0b2O3CkcoH1v4QuNo=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  passthru.optional-dependencies = {
    update = [
      requests
--- a/pkgs/development/python-modules/pyschlage/default.nix
+++ b/pkgs/development/python-modules/pyschlage/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pyschlage";
-  version = "2023.9.1";
+  version = "2023.10.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "dknowles2";
    repo = "pyschlage";
    rev = "refs/tags/${version}";
-    hash = "sha256-HFgQXMUmjWW5syBwtCunQ/TeulPwtF48Nesy9iZ3hlU=";
+    hash = "sha256-9RXk3wDDX0sGNsci8EClfj17VCYwtUiMyNJj1FLLJKk=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/rotary-embedding-torch/default.nix
+++ b/pkgs/development/python-modules/rotary-embedding-torch/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "rotary-embedding-torch";
-  version = "0.3.3";
+  version = "0.3.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "lucidrains";
    repo = "rotary-embedding-torch";
    rev = version;
-    hash = "sha256-uTOKdxqbSLRJl0gnz3TvpVwhrfqflAp0wfn6d13+YrM=";
+    hash = "sha256-dST3eJnOcG2s9tiD/Fb9BvLS6nIpE8RXly92PK/gCC8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "scmrepo";
-  version = "1.4.0";
+  version = "1.4.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-3fU4BT0AwyFTg15Oca95JgDrHxIqKJOpJolDRvo7hxc=";
+    hash = "sha256-ZK3M689vv3Kr2OoNdxaCs9Spo6h6xJmhTsPajKHYtkA=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@ -14,6 +14,7 @@
 , lxml
 , packaging
 , parsel
+, pexpect
 , protego
 , pydispatcher
 , pyopenssl
@ -42,6 +43,18 @@ buildPythonPackage rec {
    hash = "sha256-PL3tzgw/DgSC1hvi10WGg758188UsO5q37rduA9bNqU=";
  };

+  patches = [
+    # Fix compatiblity with Twisted>=23.8. Remove with the next release.
+    (fetchpatch {
+      url = "https://github.com/scrapy/scrapy/commit/aa95ada42cdf570f840f55c463375f8a81b303f8.patch";
+      hash = "sha256-LuhA5BqtjSUgkotplvUCtvGNYOTrl0MJRCXiSBMDFzY=";
+      excludes = [
+        "tests/CrawlerProcess/sleeping.py"
+        "tests/test_crawler.py"
+      ];
+    })
+  ];
+
  nativeBuildInputs = [
    installShellFiles
  ];
@ -69,6 +82,7 @@ buildPythonPackage rec {
    botocore
    glibcLocales
    jmespath
+    pexpect
    pytestCheckHook
    sybil
    testfixtures
--- a/pkgs/development/python-modules/subarulink/default.nix
+++ b/pkgs/development/python-modules/subarulink/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "subarulink";
-  version = "0.7.7";
+  version = "0.7.8";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "G-Two";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-SrOFKXh/wG2+HKaLvyNP6/Le9R3Ri7+/xsUBAazo7js=";
+    hash = "sha256-lBAel9ueuyr6AFNCYk1nHRvf8KvtiszESzRIOqjBjHQ=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@ -145,10 +145,8 @@ in buildPythonPackage rec {
    ./pthreadpool-disable-gcd.diff
  ] ++ lib.optionals stdenv.isLinux [
    # Propagate CUPTI to Kineto by overriding the search path with environment variables.
-    (fetchpatch {
-      url = "https://github.com/pytorch/pytorch/pull/108847/commits/7ae4d7c0e2dec358b4fe81538efe9da5eb580ec9.patch";
-      hash = "sha256-skFaDg98xcJqJfzxWk+qhUxPLHDStqvd0mec3PgksIg=";
-    })
+    # https://github.com/pytorch/pytorch/pull/108847
+    ./pytorch-pr-108847.patch
  ];

  postPatch = lib.optionalString rocmSupport ''
--- a/pkgs/development/python-modules/torch/pytorch-pr-108847.patch
+++ b/pkgs/development/python-modules/torch/pytorch-pr-108847.patch
@ -0,0 +1,31 @@
+From bf4050edab9f294a8e0060c47f906cd7a80f25a2 Mon Sep 17 00:00:00 2001
+From: Samuel Ainsworth <skainsworth@gmail.com>
+Date: Sat, 9 Sep 2023 02:04:09 +0000
+Subject: [PATCH] Dependencies.cmake: support building against CUPTI outside of
+ CUDA_SOURCE_DIR
+
+Limitation discovered in https://github.com/NixOS/nixpkgs/pull/249259.
+---
+ cmake/Dependencies.cmake | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/cmake/Dependencies.cmake b/cmake/Dependencies.cmake
+index 0602d534dc4c14..5f6a5f79f3e3dc 100644
+--- a/cmake/Dependencies.cmake
+++ b/cmake/Dependencies.cmake
+@@ -1879,6 +1879,7 @@ if(USE_KINETO)
+         ${CUDA_SOURCE_DIR}/extras/CUPTI/lib64
+         ${CUDA_SOURCE_DIR}/lib
+         ${CUDA_SOURCE_DIR}/lib64
+        $ENV{CUPTI_LIBRARY_DIR}
+         NO_DEFAULT_PATH)
+ 
+     find_path(CUPTI_INCLUDE_DIR cupti.h PATHS
+@@ -1886,6 +1887,7 @@ if(USE_KINETO)
+         ${CUDA_INCLUDE_DIRS}
+         ${CUDA_SOURCE_DIR}
+         ${CUDA_SOURCE_DIR}/include
+        $ENV{CUPTI_INCLUDE_DIR}
+         NO_DEFAULT_PATH)
+ 
+     if(CUPTI_LIBRARY_PATH AND CUPTI_INCLUDE_DIR)
--- a/pkgs/development/python-modules/withings-sync/default.nix
+++ b/pkgs/development/python-modules/withings-sync/default.nix
@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, garth
+, lxml
+, pythonOlder
+, requests
+, setuptools
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "withings-sync";
+  version = "4.2.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "jaroslawhartman";
+    repo = "withings-sync";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-6igjUmgIA077/1SQMt10tRpnLVKxGFNJN1GeLhQLROg=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    garth
+    lxml
+    requests
+  ];
+
+  pythonImportsCheck = [
+    "withings_sync"
+  ];
+
+  meta = with lib; {
+    description = "Synchronisation of Withings weight";
+    homepage = "https://github.com/jaroslawhartman/withings-sync";
+    changelog = "https://github.com/jaroslawhartman/withings-sync/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/tools/build-managers/bazel/python-bin-path-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/python-bin-path-test.nix
@ -51,6 +51,7 @@ let
    py_binary(
      name = "bin",
      srcs = [ "bin.py" ],
+      imports = [ "." ],
      deps = [ ":lib" ],
    )
  '';
--- a/pkgs/development/tools/build-managers/scala-cli/sources.json
+++ b/pkgs/development/tools/build-managers/scala-cli/sources.json
@ -1,21 +1,21 @@
 {
-  "version": "1.0.4",
+  "version": "1.0.5",
  "assets": {
    "aarch64-darwin": {
      "asset": "scala-cli-aarch64-apple-darwin.gz",
-      "sha256": "1gqnsm8pcwrk1v1v4xaj0j0w5xsmh3xv61h6sv72297illxxkbgq"
+      "sha256": "1p2ibii71digdz7qqqyahvdmmxyx19crwgn4bmas0hahl6mz553x"
    },
    "aarch64-linux": {
      "asset": "scala-cli-aarch64-pc-linux.gz",
-      "sha256": "124xqn18xyn35pg18p0rz40d8vjgijp6sc6wg4i81ih2mrxqxsbc"
+      "sha256": "1y9ghb829jz9yg4l7bgwnbl3cm7z7c20cyfc71v9iz8bq5ns9akr"
    },
    "x86_64-darwin": {
      "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "0r581a1zzlk7qbcsfbv79asj5y56zzx9249h099k29rbdjc3ya26"
+      "sha256": "12qjrm979pfbr0j7s59dyn7xkk585av7l0qxf77rz71009kvql0a"
    },
    "x86_64-linux": {
      "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "018cmr71qhdqvmprrfb8clsj718gfkdvyw48dqkf2jsafq0kglk2"
+      "sha256": "17x4nv5f8g1kx8l4n8ncxf60zwhwpqg8fh5cl8qy9s5h9h81n0rz"
    }
  }
 }
--- a/pkgs/development/tools/continuous-integration/buildbot/master.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/master.nix
@ -31,6 +31,8 @@
 , parameterized
 , git
 , openssh
+, setuptools
+, pythonRelaxDepsHook
 , glibcLocales
 , nixosTests
 , callPackage
@ -88,6 +90,7 @@ let
      autobahn
      pyjwt
      pyyaml
+      setuptools
    ]
      # tls
      ++ twisted.optional-dependencies.tls;
@ -108,8 +111,11 @@ let
      git
      openssh
      glibcLocales
+      pythonRelaxDepsHook
    ];

+    pythonRelaxDeps = [ "Twisted" ];
+
    patches = [
      # This patch disables the test that tries to read /etc/os-release which
      # is not accessible in sandboxed builds.
--- a/pkgs/development/tools/mysql-shell/default.nix
+++ b/pkgs/development/tools/mysql-shell/default.nix
@ -5,7 +5,6 @@
 , fetchurl
 , git
 , cctools
-, developer_cmds
 , DarwinTools
 , makeWrapper
 , CoreServices
@ -38,16 +37,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mysql-shell";
-  version = "8.0.34";
+  version = "8.0.35";

  srcs = [
    (fetchurl {
      url = "https://cdn.mysql.com//Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
-      hash = "sha256-5l0Do8QmGLX7+ZBCrtMyCUAumyeqYsfIdD/9R4jY2x0=";
+      hash = "sha256-kXxe04cE6ZIRGFzkviTjOowZyRJB7XOvQYGm840VdMI=";
    })
    (fetchurl {
      url = "https://cdn.mysql.com//Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
-      hash = "sha256-QY1PmhGw3PhqZ79+H/Xbb9uOvmrBlFQRS7idnV5OXF0=";
+      hash = "sha256-2Dn/RR5BWHMsD/QzKYPo8tqyAQGmHCGwVl2+bzNfy5I=";
    })
  ];

@ -66,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [ pkg-config cmake git bison makeWrapper ]
    ++ lib.optionals (!stdenv.isDarwin) [ rpcsvc-proto ]
-    ++ lib.optionals stdenv.isDarwin [ cctools developer_cmds DarwinTools ];
+    ++ lib.optionals stdenv.isDarwin [ cctools DarwinTools ];

  buildInputs = [
    boost
--- a/pkgs/development/tools/rust/cargo-insta/default.nix
+++ b/pkgs/development/tools/rust/cargo-insta/default.nix
@ -5,18 +5,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-insta";
-  version = "1.32.0";
+  version = "1.33.0";

  src = fetchFromGitHub {
    owner = "mitsuhiko";
    repo = "insta";
    rev = "refs/tags/${version}";
-    hash = "sha256-s6d0q4K2UTG+BWzvH5KOAllzYAkEapEuDoiI9KQW31I=";
+    hash = "sha256-w/dxIQ7KRrn86PwiE/g5L9Gn8KszPF9u/zlwE/FYDu4=";
  };

  sourceRoot = "${src.name}/cargo-insta";

-  cargoHash = "sha256-ZQUzoKE3OGaY22VYiku7GqjGN9jUNx09a0EcgCRzzcM=";
+  cargoHash = "sha256-mEtmZ+wFo1WI1IMNYsVqSVScFDLdiXBbghH7c0l/3NQ=";

  meta = with lib; {
    description = "A Cargo subcommand for snapshot testing";
--- a/pkgs/development/tools/rust/cargo-make/default.nix
+++ b/pkgs/development/tools/rust/cargo-make/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-make";
-  version = "0.37.2";
+  version = "0.37.3";

  src = fetchFromGitHub {
    owner = "sagiegurari";
    repo = "cargo-make";
    rev = version;
-    hash = "sha256-uYMPRbh2stIkNxehPnJPryIo+bGxDG7g+l4bTkEQWoY=";
+    hash = "sha256-7xWxIvMaoKZ1TVgfdBUDvK8VJzW6alrO8xFvSlMusOY=";
  };

-  cargoHash = "sha256-CXGar3Xp6iBldBGOxjXRBGBwjNh4Kv6SwIkaNKEnkQs=";
+  cargoHash = "sha256-2I+VZD4KLTtoTIb2NNpfLcFH/lmD6Z/TTPJrr3FcZzI=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/development/tools/rust/cargo-modules/default.nix
+++ b/pkgs/development/tools/rust/cargo-modules/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-modules";
-  version = "0.9.4";
+  version = "0.10.2";

  src = fetchFromGitHub {
    owner = "regexident";
    repo = pname;
    rev = version;
-    hash = "sha256-BFASEf9WUVJHsakujjeBBxfxPYlsuzonqFuDLXmLgwc=";
+    hash = "sha256-71NRaIDWPbhDn6cfYhyZZzO2huQlj1vkKdBV6WJqI9s=";
  };

-  cargoHash = "sha256-FojpC4RMrW0hZ0jvXxznxR6rKDDxrNMPoLoHEscOPEo=";
+  cargoHash = "sha256-lgqe9pXg/PE9WrXVpSJWYE6FUMGBgUDpEyJ31RSEj5A=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.CoreServices
--- a/pkgs/development/tools/rust/cargo-semver-checks/default.nix
+++ b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-semver-checks";
-  version = "0.24.1";
+  version = "0.24.2";

  src = fetchFromGitHub {
    owner = "obi1kenobi";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-RElxCmffF1PKSgg9ATI7zY/lqD+vUaW/rnKtk7VEa+c=";
+    hash = "sha256-bfkRuFVlKfzyTomFhgnxbDj76Mfq/Q/Y3ZQUuMpkYQ0=";
  };

-  cargoHash = "sha256-ozd8bjsVCmUunFLXb/bdeMQZ1VjNPLnccO1fxp0N3m4=";
+  cargoHash = "sha256-poPTFF+XCAHhHftxOOPaN+dixX2uqtZVfn20DB+cZ5o=";

  nativeBuildInputs = [
    cmake
--- a/pkgs/development/web/minify/default.nix
+++ b/pkgs/development/web/minify/default.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "minify";
-  version = "2.20.0";
+  version = "2.20.1";

  src = fetchFromGitHub {
    owner = "tdewolff";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-E29bXPfQekp/X7yAvcEWHERO3aSCRa41csZqbZ3wOno=";
+    hash = "sha256-NcvgY3Aw3v8JpVc3Sfe2mFi6FFCojnUlhORgOElIaiM=";
  };

-  vendorHash = "sha256-hgxYk76M2vplOY63vvaWzErNCo7knmMrbenJcoa/t0U=";
+  vendorHash = "sha256-oTdHfvLGekcdppn9w1gZ18CY0vuuf9z6GsNUHncDFFs=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/games/brogue-ce/default.nix
+++ b/pkgs/games/brogue-ce/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "brogue-ce";
-  version = "1.12";
+  version = "1.13";

  src = fetchFromGitHub {
    owner = "tmewett";
    repo = "BrogueCE";
    rev = "v${version}";
-    hash = "sha256-bGAE0hRiKBo3ikyObGxAiPRRO24KtC+upO3XLj+f4yo=";
+    hash = "sha256-FUIdi1Ytn+INeD9550MW41qXtLb6in0QS3Snt8QaXUA=";
  };

  postPatch = ''
--- a/pkgs/games/minecraft-servers/versions.json
+++ b/pkgs/games/minecraft-servers/versions.json
@ -1,8 +1,8 @@
 {
  "1.20": {
-    "url": "https://piston-data.mojang.com/v1/objects/84194a2f286ef7c14ed7ce0090dba59902951553/server.jar",
-    "sha1": "84194a2f286ef7c14ed7ce0090dba59902951553",
-    "version": "1.20.1",
+    "url": "https://piston-data.mojang.com/v1/objects/5b868151bd02b41319f54c8d4061b8cae84e665c/server.jar",
+    "sha1": "5b868151bd02b41319f54c8d4061b8cae84e665c",
+    "version": "1.20.2",
    "javaVersion": 17
  },
  "1.19": {
--- a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@ -1,7 +1,7 @@
 # This file is autogenerated! Run ./update.sh to regenerate.
 {
-  version = "20230919";
-  revision = "20230919";
-  sourceHash = "sha256-xcGEaWCcCAhN4gnnaj03u7LekP4+cRtcioTYhvAOQtg=";
-  outputHash = "sha256-6W9QTShp/UzlcILwyyn56wppQORUGPff2TodEt4qhwQ=";
+  version = "20231030";
+  revision = "20231030";
+  sourceHash = "sha256-ocqikHJfvs4gWqnBeLgSnXHzUTPi8l8cSfNarhD8G3w=";
+  outputHash = "sha256-vaMYuAqkkuyY+bAxAe0uAokWZ7HlaR62UTu4L8yOofs=";
 }
--- a/pkgs/os-specific/linux/hd-idle/default.nix
+++ b/pkgs/os-specific/linux/hd-idle/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "hd-idle";
-  version = "1.20";
+  version = "1.21";

  src = fetchFromGitHub {
    owner = "adelolmo";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-7EXfI3E83ltpjq2M/qZX2P/bNtQQBWZRBCD7i5uit0I=";
+    sha256 = "sha256-WHJcysTN9LHI1WnDuFGTyTirxXirpLpJIeNDj4sZGY0=";
  };

  vendorHash = null;
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@ -558,6 +558,8 @@ let
      PERSISTENT_KEYRINGS              = yes;
      # enable temporary caching of the last request_key() result
      KEYS_REQUEST_CACHE               = whenAtLeast "5.3" yes;
+      # randomized slab caches
+      RANDOM_KMALLOC_CACHES            = whenAtLeast "6.6" yes;
    } // optionalAttrs stdenv.hostPlatform.isx86_64 {
      # Enable Intel SGX
      X86_SGX     = whenAtLeast "5.11" yes;
@ -572,6 +574,8 @@ let
      KVM_AMD_SEV     = yes;
      # AMD SEV-SNP
      SEV_GUEST       = whenAtLeast "5.19" module;
+      # Shadow stacks
+      X86_USER_SHADOW_STACK = whenAtLeast "6.6" yes;
    };

    microcode = {
--- a/Show More
+++ b/Show More