Merge master into haskell-updates

2024-02-08 00:12:04 +00:00 · 2024-02-08 00:12:04 +00:00 · 1e13dfffc6
commit 1e13dfffc6
parent 388426667a 392580561c
170 changed files with 7339 additions and 1936 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -6989,6 +6989,11 @@
    githubId = 615606;
    name = "Glenn Searby";
  };
+  Gliczy = {
+    name = "Gliczy";
+    github = "Gliczy";
+    githubId = 129636582;
+  };
  glittershark = {
    name = "Griffin Smith";
    email = "root@gws.fyi";
@ -9162,6 +9167,12 @@
      fingerprint = "7249 70E6 A661 D84E 8B47  678A 0590 93B1 A278 BCD0";
    }];
  };
+  jokatzke = {
+    email = "jokatzke@fastmail.com";
+    github = "jokatzke";
+    githubId = 46931073;
+    name = "Jonas Katzke";
+  };
  joko = {
    email = "ioannis.koutras@gmail.com";
    github = "jokogr";
@ -10751,6 +10762,12 @@
    name = "Yanning Chen";
    matrix = "@self:lightquantum.me";
  };
+  Ligthiago = {
+    email = "donets.andre@gmail.com";
+    github = "Ligthiago";
+    githubId = 142721811;
+    name = "Andrey Donets";
+  };
  lihop = {
    email = "nixos@leroy.geek.nz";
    github = "lihop";
@ -14505,6 +14522,12 @@
    githubId = 72527881;
    name = "PassiveLemon";
  };
+  patka = {
+    email = "patka@patka.dev";
+    github = "patka-123";
+    githubId = 69802930;
+    name = "patka";
+  };
  patricksjackson = {
    email = "patrick@jackson.dev";
    github = "patricksjackson";
--- a/nixos/doc/manual/installation/building-images-via-systemd-repart.chapter.md
+++ b/nixos/doc/manual/installation/building-images-via-systemd-repart.chapter.md
@ -75,9 +75,10 @@ image with a new one or by updating partitions via an A/B scheme. See the
 [Chrome OS update process][chrome-os-update] for an example of how to achieve
 this. The appliance image built in the following example does not contain a
 `configuration.nix` and thus you will not be able to call `nixos-rebuild` from
-this system.
+this system. Furthermore, it uses a [Unified Kernel Image][unified-kernel-image].

 [chrome-os-update]: https://chromium.googlesource.com/aosp/platform/system/update_engine/+/HEAD/README.md
+[unified-kernel-image]: https://uapi-group.org/specifications/specs/unified_kernel_image/

 ```nix
 let
@ -101,18 +102,8 @@ in
            "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source =
              "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";

-            "/loader/entries/nixos.conf".source = pkgs.writeText "nixos.conf" ''
-              title NixOS
-              linux /EFI/nixos/kernel.efi
-              initrd /EFI/nixos/initrd.efi
-              options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}
-            '';
-
-            "/EFI/nixos/kernel.efi".source =
-              "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}";
-
-            "/EFI/nixos/initrd.efi".source =
-              "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
+            "/EFI/Linux/${config.system.boot.loader.ukiFile}".source =
+              "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
          };
          repartConfig = {
            Type = "esp";
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@ -5,34 +5,39 @@ let
  opt = options.system.nixos;

  inherit (lib)
-    concatStringsSep mapAttrsToList toLower
+    concatStringsSep mapAttrsToList toLower optionalString
    literalExpression mkRenamedOptionModule mkDefault mkOption trivial types;

  needsEscaping = s: null != builtins.match "[a-zA-Z0-9]+" s;
  escapeIfNecessary = s: if needsEscaping s then s else ''"${lib.escape [ "\$" "\"" "\\" "\`" ] s}"'';
  attrsToText = attrs:
-    concatStringsSep "\n" (
-      mapAttrsToList (n: v: ''${n}=${escapeIfNecessary (toString v)}'') attrs
-    ) + "\n";
+    concatStringsSep "\n"
+      (mapAttrsToList (n: v: ''${n}=${escapeIfNecessary (toString v)}'') attrs)
+    + "\n";

-  osReleaseContents = {
-    NAME = "${cfg.distroName}";
-    ID = "${cfg.distroId}";
-    VERSION = "${cfg.release} (${cfg.codeName})";
-    VERSION_CODENAME = toLower cfg.codeName;
-    VERSION_ID = cfg.release;
-    BUILD_ID = cfg.version;
-    PRETTY_NAME = "${cfg.distroName} ${cfg.release} (${cfg.codeName})";
-    LOGO = "nix-snowflake";
-    HOME_URL = lib.optionalString (cfg.distroId == "nixos") "https://nixos.org/";
-    DOCUMENTATION_URL = lib.optionalString (cfg.distroId == "nixos") "https://nixos.org/learn.html";
-    SUPPORT_URL = lib.optionalString (cfg.distroId == "nixos") "https://nixos.org/community.html";
-    BUG_REPORT_URL = lib.optionalString (cfg.distroId == "nixos") "https://github.com/NixOS/nixpkgs/issues";
-    IMAGE_ID = lib.optionalString (config.system.image.id != null) config.system.image.id;
-    IMAGE_VERSION = lib.optionalString (config.system.image.version != null) config.system.image.version;
-  } // lib.optionalAttrs (cfg.variant_id != null) {
-    VARIANT_ID = cfg.variant_id;
-  };
+  osReleaseContents =
+    let
+      isNixos = cfg.distroId == "nixos";
+    in
+    {
+      NAME = "${cfg.distroName}";
+      ID = "${cfg.distroId}";
+      VERSION = "${cfg.release} (${cfg.codeName})";
+      VERSION_CODENAME = toLower cfg.codeName;
+      VERSION_ID = cfg.release;
+      BUILD_ID = cfg.version;
+      PRETTY_NAME = "${cfg.distroName} ${cfg.release} (${cfg.codeName})";
+      LOGO = "nix-snowflake";
+      HOME_URL = optionalString isNixos "https://nixos.org/";
+      DOCUMENTATION_URL = optionalString isNixos "https://nixos.org/learn.html";
+      SUPPORT_URL = optionalString isNixos "https://nixos.org/community.html";
+      BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
+      ANSI_COLOR = optionalString isNixos "1;34";
+      IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;
+      IMAGE_VERSION = optionalString (config.system.image.version != null) config.system.image.version;
+    } // lib.optionalAttrs (cfg.variant_id != null) {
+      VARIANT_ID = cfg.variant_id;
+    };

  initrdReleaseContents = (removeAttrs osReleaseContents [ "BUILD_ID" ]) // {
    PRETTY_NAME = "${osReleaseContents.PRETTY_NAME} (Initrd)";
@ -56,60 +61,61 @@ in
  };

  options.system = {
+    nixos = {
+      version = mkOption {
+        internal = true;
+        type = types.str;
+        description = lib.mdDoc "The full NixOS version (e.g. `16.03.1160.f2d4ee1`).";
+      };

-    nixos.version = mkOption {
-      internal = true;
-      type = types.str;
-      description = lib.mdDoc "The full NixOS version (e.g. `16.03.1160.f2d4ee1`).";
-    };
+      release = mkOption {
+        readOnly = true;
+        type = types.str;
+        default = trivial.release;
+        description = lib.mdDoc "The NixOS release (e.g. `16.03`).";
+      };

-    nixos.release = mkOption {
-      readOnly = true;
-      type = types.str;
-      default = trivial.release;
-      description = lib.mdDoc "The NixOS release (e.g. `16.03`).";
-    };
+      versionSuffix = mkOption {
+        internal = true;
+        type = types.str;
+        default = trivial.versionSuffix;
+        description = lib.mdDoc "The NixOS version suffix (e.g. `1160.f2d4ee1`).";
+      };

-    nixos.versionSuffix = mkOption {
-      internal = true;
-      type = types.str;
-      default = trivial.versionSuffix;
-      description = lib.mdDoc "The NixOS version suffix (e.g. `1160.f2d4ee1`).";
-    };
+      revision = mkOption {
+        internal = true;
+        type = types.nullOr types.str;
+        default = trivial.revisionWithDefault null;
+        description = lib.mdDoc "The Git revision from which this NixOS configuration was built.";
+      };

-    nixos.revision = mkOption {
-      internal = true;
-      type = types.nullOr types.str;
-      default = trivial.revisionWithDefault null;
-      description = lib.mdDoc "The Git revision from which this NixOS configuration was built.";
-    };
+      codeName = mkOption {
+        readOnly = true;
+        type = types.str;
+        default = trivial.codeName;
+        description = lib.mdDoc "The NixOS release code name (e.g. `Emu`).";
+      };

-    nixos.codeName = mkOption {
-      readOnly = true;
-      type = types.str;
-      default = trivial.codeName;
-      description = lib.mdDoc "The NixOS release code name (e.g. `Emu`).";
-    };
+      distroId = mkOption {
+        internal = true;
+        type = types.str;
+        default = "nixos";
+        description = lib.mdDoc "The id of the operating system";
+      };

-    nixos.distroId = mkOption {
-      internal = true;
-      type = types.str;
-      default = "nixos";
-      description = lib.mdDoc "The id of the operating system";
-    };
+      distroName = mkOption {
+        internal = true;
+        type = types.str;
+        default = "NixOS";
+        description = lib.mdDoc "The name of the operating system";
+      };

-    nixos.distroName = mkOption {
-      internal = true;
-      type = types.str;
-      default = "NixOS";
-      description = lib.mdDoc "The name of the operating system";
-    };
-
-    nixos.variant_id = mkOption {
-      type = types.nullOr (types.strMatching "^[a-z0-9._-]+$");
-      default = null;
-      description = lib.mdDoc "A lower-case string identifying a specific variant or edition of the operating system";
-      example = "installer";
+      variant_id = mkOption {
+        type = types.nullOr (types.strMatching "^[a-z0-9._-]+$");
+        default = null;
+        description = lib.mdDoc "A lower-case string identifying a specific variant or edition of the operating system";
+        example = "installer";
+      };
    };

    image = {
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -579,6 +579,7 @@
  ./services/home-automation/ebusd.nix
  ./services/home-automation/esphome.nix
  ./services/home-automation/evcc.nix
+  ./services/home-automation/govee2mqtt.nix
  ./services/home-automation/home-assistant.nix
  ./services/home-automation/homeassistant-satellite.nix
  ./services/home-automation/zigbee2mqtt.nix
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@ -219,7 +219,6 @@ in
            inherit (cert) action;
            authority = {
              inherit remote;
-              file.path = cert.caCert;
              root_ca = cert.caCert;
              profile = "default";
              auth_key_file = certmgrAPITokenPath;
--- a/nixos/modules/services/home-automation/govee2mqtt.nix
+++ b/nixos/modules/services/home-automation/govee2mqtt.nix
@ -0,0 +1,90 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.govee2mqtt;
+in {
+  meta.maintainers = with lib.maintainers; [ SuperSandro2000 ];
+
+  options.services.govee2mqtt = {
+    enable = lib.mkEnableOption "Govee2MQTT";
+
+    package = lib.mkPackageOption pkgs "govee2mqtt" { };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "govee2mqtt";
+      description = "User under which Govee2MQTT should run.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "govee2mqtt";
+      description = "Group under which Govee2MQTT should run.";
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.path;
+      example = "/var/lib/govee2mqtt/govee2mqtt.env";
+      description = ''
+        Environment file as defined in {manpage}`systemd.exec(5)`.
+
+        See upstream documentation <https://github.com/wez/govee2mqtt/blob/main/docs/CONFIG.md>.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users = {
+      groups.${cfg.group} = { };
+      users.${cfg.user} = {
+        description = "Govee2MQTT service user";
+        inherit (cfg) group;
+        isSystemUser = true;
+      };
+    };
+
+    systemd.services.govee2mqtt = {
+      description = "Govee2MQTT Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "networking.target" ];
+      serviceConfig = {
+        CacheDirectory = "govee2mqtt";
+        Environment = [
+          "GOVEE_CACHE_DIR=/var/cache/govee2mqtt"
+        ];
+        EnvironmentFile = cfg.environmentFile;
+        ExecStart = "${lib.getExe cfg.package} serve --govee-iot-key=/var/lib/govee2mqtt/iot.key --govee-iot-cert=/var/lib/govee2mqtt/iot.cert"
+          + " --amazon-root-ca=${pkgs.cacert.unbundled}/etc/ssl/certs/Amazon_Root_CA_1:66c9fcf99bf8c0a39e2f0788a43e696365bca.crt";
+        Group = cfg.group;
+        Restart = "on-failure";
+        StateDirectory = "govee2mqtt";
+        User = cfg.user;
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/home-automation/zigbee2mqtt.nix
+++ b/nixos/modules/services/home-automation/zigbee2mqtt.nix
@ -71,7 +71,6 @@ in
      after = [ "network.target" ];
      environment.ZIGBEE2MQTT_DATA = cfg.dataDir;
      serviceConfig = {
-        Type = "notify";
        ExecStart = "${cfg.package}/bin/zigbee2mqtt";
        User = "zigbee2mqtt";
        Group = "zigbee2mqtt";
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -1386,10 +1386,8 @@ in {

    systemd.services.gitlab-db-config = {
      after = [ "gitlab-config.service" "gitlab-postgresql.service" "postgresql.service" ];
-      bindsTo = [
-        "gitlab-config.service"
-      ] ++ optional (cfg.databaseHost == "") "postgresql.service"
-        ++ optional databaseActuallyCreateLocally "gitlab-postgresql.service";
+      wants = optional (cfg.databaseHost == "") "postgresql.service" ++ optional databaseActuallyCreateLocally "gitlab-postgresql.service";
+      bindsTo = [ "gitlab-config.service" ];
      wantedBy = [ "gitlab.target" ];
      partOf = [ "gitlab.target" ];
      serviceConfig = {
@ -1422,10 +1420,10 @@ in {
        "gitlab-db-config.service"
      ];
      bindsTo = [
-        "redis-gitlab.service"
        "gitlab-config.service"
        "gitlab-db-config.service"
-      ] ++ optional (cfg.databaseHost == "") "postgresql.service";
+      ];
+      wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.service";
      wantedBy = [ "gitlab.target" ];
      partOf = [ "gitlab.target" ];
      environment = gitlabEnv // (optionalAttrs cfg.sidekiq.memoryKiller.enable {
@ -1612,10 +1610,10 @@ in {
        "gitlab-db-config.service"
      ];
      bindsTo = [
-        "redis-gitlab.service"
        "gitlab-config.service"
        "gitlab-db-config.service"
-      ] ++ optional (cfg.databaseHost == "") "postgresql.service";
+      ];
+      wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.service";
      requiredBy = [ "gitlab.target" ];
      partOf = [ "gitlab.target" ];
      environment = gitlabEnv;
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@ -1197,8 +1197,6 @@ in {

    environment.systemPackages = [cfg.package];

-    services.udev.packages = with pkgs; [crda];
-
    systemd.services.hostapd = {
      description = "IEEE 802.11 Host Access-Point Daemon";

--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@ -165,10 +165,17 @@ in
      type = lib.types.submodule {
        freeformType = settingsFormat.type;

-        options.pam_allowed_login_groups = lib.mkOption {
-          description = lib.mdDoc "Kanidm groups that are allowed to login using PAM.";
-          example = "my_pam_group";
-          type = lib.types.listOf lib.types.str;
+        options = {
+          pam_allowed_login_groups = lib.mkOption {
+            description = lib.mdDoc "Kanidm groups that are allowed to login using PAM.";
+            example = "my_pam_group";
+            type = lib.types.listOf lib.types.str;
+          };
+          hsm_pin_path = lib.mkOption {
+            description = lib.mdDoc "Path to a HSM pin.";
+            default = "/var/cache/kanidm-unixd/hsm-pin";
+            type = lib.types.path;
+          };
        };
      };
      description = lib.mdDoc ''
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@ -4,6 +4,8 @@ with lib;
 let
  cfg = config.services.tt-rss;

+  inherit (cfg) phpPackage;
+
  configVersion = 26;

  dbPort = if cfg.database.port == null
@ -26,7 +28,7 @@ let
      ;
  in pkgs.writeText "config.php" ''
    <?php
-      putenv('TTRSS_PHP_EXECUTABLE=${pkgs.php}/bin/php');
+      putenv('TTRSS_PHP_EXECUTABLE=${phpPackage}/bin/php');

      putenv('TTRSS_LOCK_DIRECTORY=${cfg.root}/lock');
      putenv('TTRSS_CACHE_DIR=${cfg.root}/cache');
@ -456,6 +458,15 @@ let
        '';
      };

+      phpPackage = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.php;
+        defaultText = "pkgs.php";
+        description = lib.mdDoc ''
+          php package to use for php fpm and update daemon.
+        '';
+      };
+
      plugins = mkOption {
        type = types.listOf types.str;
        default = ["auth_internal" "note"];
@ -543,7 +554,7 @@ let
    services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
      ${poolName} = {
        inherit (cfg) user;
-        phpPackage = pkgs.php81;
+        inherit phpPackage;
        settings = mapAttrs (name: mkDefault) {
          "listen.owner" = "nginx";
          "listen.group" = "nginx";
@ -605,13 +616,13 @@ let
        description = "Tiny Tiny RSS feeds update daemon";

        preStart = ''
-          ${pkgs.php81}/bin/php ${cfg.root}/www/update.php --update-schema
+          ${phpPackage}/bin/php ${cfg.root}/www/update.php --update-schema --force-yes
        '';

        serviceConfig = {
          User = "${cfg.user}";
          Group = "tt_rss";
-          ExecStart = "${pkgs.php}/bin/php ${cfg.root}/www/update.php --daemon --quiet";
+          ExecStart = "${phpPackage}/bin/php ${cfg.root}/www/update.php --daemon --quiet";
          Restart = "on-failure";
          RestartSec = "60";
          SyslogIdentifier = "tt-rss";
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -361,10 +361,12 @@ let
            ${optionalString (vhost.acmeFallbackHost != null) "try_files $uri @acme-fallback;"}
            ${optionalString (vhost.acmeRoot != null) "root ${vhost.acmeRoot};"}
            auth_basic off;
+            auth_request off;
          }
          ${optionalString (vhost.acmeFallbackHost != null) ''
            location @acme-fallback {
              auth_basic off;
+              auth_request off;
              proxy_pass http://${vhost.acmeFallbackHost};
            }
          ''}
--- a/nixos/modules/services/x11/desktop-managers/phosh.nix
+++ b/nixos/modules/services/x11/desktop-managers/phosh.nix
@ -186,6 +186,21 @@ in
        UtmpIdentifier = "tty7";
        UtmpMode = "user";
      };
+      environment = {
+        # We are running without a display manager, so need to provide
+        # a value for XDG_CURRENT_DESKTOP.
+        #
+        # Among other things, this variable influences:
+        #  - visibility of desktop entries with "OnlyShowIn=Phosh;"
+        #    https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-1.5.html#key-onlyshowin
+        #  - the chosen xdg-desktop-portal configuration.
+        #    https://flatpak.github.io/xdg-desktop-portal/docs/portals.conf.html
+        XDG_CURRENT_DESKTOP = "Phosh:GNOME";
+        # pam_systemd uses these to identify the session in logind.
+        # https://www.freedesktop.org/software/systemd/man/latest/pam_systemd.html#desktop=
+        XDG_SESSION_DESKTOP = "phosh";
+        XDG_SESSION_TYPE = "wayland";
+      };
    };

    environment.systemPackages = [
--- a/nixos/modules/system/boot/systemd/sysupdate.nix
+++ b/nixos/modules/system/boot/systemd/sysupdate.nix
@ -3,7 +3,7 @@
 let
  cfg = config.systemd.sysupdate;

-  format = pkgs.formats.ini { };
+  format = pkgs.formats.ini { listToValue = toString; };

  definitionsDirectory = utils.systemdUtils.lib.definitions
    "sysupdate.d"
@ -79,7 +79,7 @@ in
          Source = {
            Type = "url-file";
            Path = "https://download.example.com/";
-            MatchPattern = "nixos_@v.efi.xz";
+            MatchPattern = [ "nixos_@v+@l-@d.efi" "nixos_@v+@l.efi" "nixos_@v.efi" ];
          };

          Target = {
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@ -419,7 +419,7 @@ in {
      gitlab.systemctl("start gitlab-backup.service")
      gitlab.wait_for_unit("gitlab-backup.service")
      gitlab.wait_for_file("${nodes.gitlab.services.gitlab.statePath}/backup/dump_gitlab_backup.tar")
-      gitlab.systemctl("stop postgresql.service gitlab.target")
+      gitlab.systemctl("stop postgresql.service gitlab-config.service gitlab.target")
      gitlab.succeed(
          "find ${nodes.gitlab.services.gitlab.statePath} -mindepth 1 -maxdepth 1 -not -name backup -execdir rm -r {} +"
      )
--- a/nixos/tests/systemd-sysupdate.nix
+++ b/nixos/tests/systemd-sysupdate.nix
@ -23,8 +23,8 @@ in
            mkdir -p $out
            cd $out

-            echo "nixos" > nixos_1.efi
-            sha256sum nixos_1.efi > SHA256SUMS
+            echo "nixos" > nixos_1.txt
+            sha256sum nixos_1.txt > SHA256SUMS

            export GNUPGHOME="$(mktemp -d)"
            cp -R ${gpgKeyring}/* $GNUPGHOME
@ -39,15 +39,15 @@ in
      systemd.sysupdate = {
        enable = true;
        transfers = {
-          "uki" = {
+          "text-file" = {
            Source = {
              Type = "url-file";
              Path = "http://server/";
-              MatchPattern = "nixos_@v.efi";
+              MatchPattern = "nixos_@v.txt";
            };
            Target = {
-              Path = "/boot/EFI/Linux";
-              MatchPattern = "nixos_@v.efi";
+              Path = "/";
+              MatchPattern = [ "nixos_@v.txt" ];
            };
          };
        };
@ -61,6 +61,6 @@ in
    server.wait_for_unit("nginx.service")

    target.succeed("systemctl start systemd-sysupdate")
-    assert "nixos" in target.wait_until_succeeds("cat /boot/EFI/Linux/nixos_1.efi", timeout=5)
+    assert "nixos" in target.wait_until_succeeds("cat /nixos_1.txt", timeout=5)
  '';
 }
--- a/pkgs/applications/file-managers/yazi/default.nix
+++ b/pkgs/applications/file-managers/yazi/default.nix
@ -31,16 +31,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "yazi";
-  version = "0.2.2";
+  version = "0.2.3";

  src = fetchFromGitHub {
    owner = "sxyazi";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-XF5zCFXiViFsRPqI6p1Z7093NSWrGmcoyWcGEagIoEA=";
+    hash = "sha256-2AiaJs6xY8hsB1DBxpPwdZtc8IZvsoCGWBOFVMf4dvk=";
  };

-  cargoHash = "sha256-9fXHpq5lXG9Gup1dZPlXiNilbP79fJ3Jp3+ZD7mAzP4=";
+  cargoHash = "sha256-fRUmXv27sHYz8z0cc795JCPLHDQGgTV4wAWAtQ/pbg4=";

  env.YAZI_GEN_COMPLETIONS = true;

--- a/pkgs/applications/graphics/xv/default.nix
+++ b/pkgs/applications/graphics/xv/default.nix
@ -7,26 +7,25 @@
  libpng,
  libwebp,
  libtiff,
-  libjpeg,
  jasper,
 }:

 stdenv.mkDerivation rec {
  pname = "xv";
-  version = "4.2.0";
+  version = "5.0.0";

  src = fetchFromGitHub {
    owner = "jasper-software";
    repo = "xv";
    rev = "v${version}";
-    sha256 = "TXUcdrwtPNiS7z795RbzBXzNYRADeVtF5uz4aovLo/M=";
+    sha256 = "sha256-ATV/LxXQNJB6rjBmurx6a1gRPR8zNuILstvEJoQJhUs=";
  };

  nativeBuildInputs = [ cmake ];
  buildInputs = [ xorg.libX11 xorg.libXt libpng libwebp libtiff jasper ];

  meta = {
-    description = "Classic image viewer and editor for X.";
+    description = "Classic image viewer and editor for X";
    homepage = "http://www.trilon.com/xv/";
    license = {
      fullName = "XV License";
--- a/pkgs/applications/misc/camunda-modeler/default.nix
+++ b/pkgs/applications/misc/camunda-modeler/default.nix
@ -9,11 +9,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "camunda-modeler";
-  version = "5.18.0";
+  version = "5.19.0";

  src = fetchurl {
    url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-f7XYcFleEe1f6Uh6mOqfakzfWzOiQtBPhowTJUZU1MU=";
+    hash = "sha256-EKtdja55KFF394sHIh1C/cXxdjedBPbmHzicDVrbXCA=";
  };
  sourceRoot = "camunda-modeler-${version}-linux-x64";

--- a/pkgs/applications/misc/phoc/default.nix
+++ b/pkgs/applications/misc/phoc/default.nix
@ -1,7 +1,7 @@
 { lib
 , stdenv
+, stdenvNoCC
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@ -17,30 +17,19 @@
 , libxkbcommon
 , wlroots
 , xorg
-, gitUpdater
+, directoryListingUpdater
 , nixosTests
+, testers
 }:

-let
-  phocWlroots = wlroots.overrideAttrs (old: {
-    patches = (old.patches or []) ++ [
-      # Revert "layer-shell: error on 0 dimension without anchors"
-      # https://source.puri.sm/Librem5/phosh/-/issues/422
-      (fetchpatch {
-        name = "0001-Revert-layer-shell-error-on-0-dimension-without-anch.patch";
-        url = "https://gitlab.gnome.org/World/Phosh/phoc/-/raw/acb17171267ae0934f122af294d628ad68b09f88/subprojects/packagefiles/wlroots/0001-Revert-layer-shell-error-on-0-dimension-without-anch.patch";
-        hash = "sha256-uNJaYwkZImkzNUEqyLCggbXAoIRX5h2eJaGbSHj1B+o=";
-      })
-    ];
-  });
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "phoc";
-  version = "0.31.0";
+  version = "0.35.0";

  src = fetchurl {
    # This tarball includes the meson wrapped subproject 'gmobile'.
-    url = "https://storage.puri.sm/releases/phoc/phoc-${version}.tar.xz";
-    hash = "sha256-P7Bs9JMv6KNKo4d2ID0/Ba4+Nel6DMn8o4I7EDvY4vY=";
+    url = with finalAttrs; "https://sources.phosh.mobi/releases/${pname}/${pname}-${version}.tar.xz";
+    hash = "sha256-q2wyM0R7Mi/XuckNb6ZDkStaV9yJH1BgJ4cjqQc6EI4=";
  };

  nativeBuildInputs = [
@ -61,23 +50,33 @@ in stdenv.mkDerivation rec {
    # For keybindings settings schemas
    gnome.mutter
    wayland
-    phocWlroots
+    finalAttrs.wlroots
    xorg.xcbutilwm
  ];

  mesonFlags = ["-Dembed-wlroots=disabled"];

-  postPatch = ''
-    chmod +x build-aux/post_install.py
-    patchShebangs build-aux/post_install.py
-  '';
+  # Patch wlroots to remove a check which crashes Phosh.
+  # This patch can be found within the phoc source tree.
+  wlroots = wlroots.overrideAttrs (old: {
+    patches = (old.patches or []) ++ [
+      (stdenvNoCC.mkDerivation {
+        name = "0001-Revert-layer-shell-error-on-0-dimension-without-anch.patch";
+        inherit (finalAttrs) src;
+        preferLocalBuild = true;
+        allowSubstitutes = false;
+        phases = "unpackPhase installPhase";
+        installPhase = "cp subprojects/packagefiles/wlroots/$name $out";
+      })
+    ];
+  });

  passthru = {
    tests.phosh = nixosTests.phosh;
-    updateScript = gitUpdater {
-      url = "https://gitlab.gnome.org/World/Phosh/phoc";
-      rev-prefix = "v";
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
    };
+    updateScript = directoryListingUpdater { };
  };

  meta = with lib; {
@ -87,4 +86,4 @@ in stdenv.mkDerivation rec {
    maintainers = with maintainers; [ masipcat tomfitzhenry zhaofengli ];
    platforms = platforms.linux;
  };
-}
+})
--- a/pkgs/applications/misc/tuxclocker/default.nix
+++ b/pkgs/applications/misc/tuxclocker/default.nix
@ -11,19 +11,20 @@
 , qtbase
 , qtcharts
 , tuxclocker-plugins
+, tuxclocker-without-unfree
 , wrapQtAppsHook
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "tuxclocker";
-  version = "1.4.0";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "Lurkki14";
    repo = "tuxclocker";
    fetchSubmodules = true;
-    rev = "${finalAttrs.version}";
-    hash = "sha256-8dtuZXBWftXNQpqYgNQOayPGfvEIu9QfbqDShfkt1qA=";
+    rev = finalAttrs.version;
+    hash = "sha256-VJchgImSGykenss4/TyLATljYMMXNmgLSMT8ixSnReA=";
  };

  # Meson doesn't find boost without these
@ -56,6 +57,10 @@ stdenv.mkDerivation (finalAttrs: {
    "-Dplugins=false"
  ];

+  passthru.tests = {
+    inherit tuxclocker-without-unfree;
+  };
+
  meta = with lib; {
    description = "Qt overclocking tool for GNU/Linux";
    homepage = "https://github.com/Lurkki14/tuxclocker";
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -15,9 +15,9 @@
        version = "2023-11-28";
      };
    };
-    hash = "sha256-pZHa4YSJ4rK24f7dNUFeoyf6nDSQeY4MTR81YzPKCtQ=";
-    hash_deb_amd64 = "sha256-cMoYBCuOYzXS7OzFvvBfSL80hBY/PcEv9kWGSx3mCKw=";
-    version = "121.0.6167.139";
+    hash = "sha256-mncN1Np/70r0oMnJ4oV7PU6Ivi5AiRar5O2G8bNdwY8=";
+    hash_deb_amd64 = "sha256-t/5Mx3P3LaH/6GjwMFP+lVoz7xq7jqAKYxLqlWBnwIE=";
+    version = "121.0.6167.160";
  };
  ungoogled-chromium = {
    deps = {
--- a/pkgs/applications/networking/cluster/aiac/default.nix
+++ b/pkgs/applications/networking/cluster/aiac/default.nix
@ -2,14 +2,14 @@

 buildGoModule rec {
  pname = "aiac";
-  version = "4.1.0";
+  version = "4.2.0";
  excludedPackages = [".ci"];

  src = fetchFromGitHub {
    owner = "gofireflyio";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-X3KmqKltoIFyMjLF1h8EN3RLbZ+EZu0mOH2koN0FJh8=";
+    hash = "sha256-83htckX3AIgLKxxSIaM3HUJDDv4GrpJsZ7nGln5trKw=";
  };

  vendorHash = "sha256-JWQQUB4/yIDGzWeshtcWnkXQS7jYcDHwG/tef6sBizQ=";
--- a/pkgs/applications/networking/cluster/cmctl/default.nix
+++ b/pkgs/applications/networking/cluster/cmctl/default.nix
@ -8,18 +8,18 @@

 buildGoModule rec {
  pname = "cmctl";
-  version = "1.13.3";
+  version = "1.14.1";

  src = fetchFromGitHub {
    owner = "cert-manager";
    repo = "cert-manager";
    rev = "v${version}";
-    hash = "sha256-bmlM5WyJd5EtL3e4mPHwCqoIyDAgN7Ce7/vS6bhVuP0=";
+    hash = "sha256-tS/s8zrOomuUBIoIh81RMdwmPM9pcz4cNSKVQfNxlrI=";
  };

  sourceRoot = "${src.name}/cmd/ctl";

-  vendorHash = "sha256-PQKPZXgp6ggWymVBOErmLps0cilOsE54t108ApZoiDQ=";
+  vendorHash = "sha256-9Y8u6DVS08liliMNEalX6XQU50qRFy5qZq/9EvRSBRQ=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "k9s";
-  version = "0.31.7";
+  version = "0.31.8";

  src = fetchFromGitHub {
    owner = "derailed";
    repo = "k9s";
    rev = "v${version}";
-    hash = "sha256-DRxS2zhDLAC1pfsHiOEU9Xi7DhKcPwzdI3yw5JbbT18=";
+    hash = "sha256-sZtMeFoi3UJO5uV4zOez1TbpBCtfclGhZTrYGZ/+Mio=";
  };

  ldflags = [
@ -23,7 +23,7 @@ buildGoModule rec {

  proxyVendor = true;

-  vendorHash = "sha256-7eeGME3KOebYYEJEFrrA+5F8rdtYT18WnRoouGyEMD8=";
+  vendorHash = "sha256-0Tq74BtSk5mp0eZjTevvDFWnEc5tnSwO7ZckcJXd/Yo=";

  # TODO investigate why some config tests are failing
  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
@ -42,6 +42,11 @@ buildGoModule rec {

  nativeBuildInputs = [ installShellFiles ];
  postInstall = ''
+    # k9s requires a writeable log directory
+    # Otherwise an error message is printed
+    # into the completion scripts
+    export K9S_LOGS_DIR=$(mktemp -d)
+
    installShellCompletion --cmd k9s \
      --bash <($out/bin/k9s completion bash) \
      --fish <($out/bin/k9s completion fish) \
--- a/pkgs/applications/networking/irc/halloy/default.nix
+++ b/pkgs/applications/networking/irc/halloy/default.nix
@ -82,5 +82,6 @@ rustPlatform.buildRustPackage rec {
    changelog = "https://github.com/squidowl/halloy/blob/${version}/CHANGELOG.md";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ fab ];
+    mainProgram = "halloy";
  };
 }
--- a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
+++ b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
@ -44,6 +44,11 @@ let
        --replace "igraph_scg_grouping3" "" \
        --replace "igraph_scg_semiprojectors2" ""
    '';
+    NIX_CFLAGS_COMPILE = (prev.NIX_CFLAGS_COMPILE or []) ++ lib.optionals stdenv.cc.isClang [
+      "-Wno-strict-prototypes"
+      "-Wno-unused-but-set-parameter"
+      "-Wno-unused-but-set-variable"
+    ];
    # general options brought back from the old 0.9.x package
    buildInputs = prev.buildInputs ++ [ suitesparse ];
    cmakeFlags = prev.cmakeFlags ++ [ "-DIGRAPH_USE_INTERNAL_CXSPARSE=OFF" ];
@ -138,7 +143,6 @@ in stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "A comprehensive reverse engineering and manipulation framework for gate-level netlists";
    homepage = "https://github.com/emsec/hal";
    license = licenses.mit;
--- a/pkgs/applications/science/robotics/mujoco/default.nix
+++ b/pkgs/applications/science/robotics/mujoco/default.nix
@ -129,7 +129,7 @@ let

 in stdenv.mkDerivation rec {
  pname = "mujoco";
-  version = "3.1.1";
+  version = "3.1.2";

  # Bumping version? Make sure to look though the MuJoCo's commit
  # history for bumped dependency pins!
@ -137,7 +137,7 @@ in stdenv.mkDerivation rec {
    owner = "google-deepmind";
    repo = "mujoco";
    rev = "refs/tags/${version}";
-    hash = "sha256-+2nt7G8j6Pi60cfMBPYWPGwD8wpxDOSylenm0oCitzM=";
+    hash = "sha256-Zbz6qq2Sjhcrf8QAGFlYkSZ8mA/wQaP81gRzMj3xh+g=";
  };

  patches = [ ./mujoco-system-deps-dont-fetch.patch ];
@ -183,5 +183,6 @@ in stdenv.mkDerivation rec {
    changelog = "https://github.com/google-deepmind/mujoco/releases/tag/${version}";
    license = licenses.asl20;
    maintainers = with maintainers; [ samuela tmplt ];
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@ -11,7 +11,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "commitizen";
-  version = "3.13.0";
+  version = "3.14.1";
  format = "pyproject";

  disabled = python3.pythonOlder "3.8";
@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "commitizen-tools";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-6Zo+d1OuaHYVf/KX8hKlyp/YS/1tHFmpNK6ssnxg7h0=";
+    hash = "sha256-yRcc87V4XJuTyrngQgPGJozk+hd7SRHERLvsQ/yZKYQ=";
  };

  pythonRelaxDeps = [
--- a/pkgs/applications/version-management/gitstatus/romkatv_libgit2.nix
+++ b/pkgs/applications/version-management/gitstatus/romkatv_libgit2.nix
@ -21,5 +21,9 @@ libgit2.overrideAttrs (oldAttrs: {
    hash = "sha256-Bm3Gj9+AhNQMvkIqdrTkK5D9vrZ1qq6CS8Wrn9kfKiw=";
  };

+  # this is a heavy fork of the original libgit2
+  # the original checkPhase does not work for this fork
+  doCheck = false;
+
  patches = [ ];
 })
--- a/pkgs/applications/window-managers/phosh/default.nix
+++ b/pkgs/applications/window-managers/phosh/default.nix
@ -1,12 +1,12 @@
 { lib
 , stdenv
-, fetchFromGitLab
-, gitUpdater
+, fetchurl
+, directoryListingUpdater
 , meson
 , ninja
 , pkg-config
 , python3
-, wrapGAppsHook
+, wrapGAppsHook4
 , libadwaita
 , libhandy
 , libxkbcommon
@ -34,18 +34,14 @@
 , nixosTests
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "phosh";
-  version = "0.33.0";
+  version = "0.35.0";

-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    group = "World";
-    owner = "Phosh";
-    repo = pname;
-    rev = "v${version}";
-    fetchSubmodules = true; # including gvc and libcall-ui which are designated as subprojects
-    sha256 = "sha256-t+1MYfsz7KqsMvN8TyLIUrTLTQPWQQpOSk/ysxgE7kg=";
+  src = fetchurl {
+    # Release tarball which includes subprojects gvc and libcall-ui
+    url = with finalAttrs; "https://sources.phosh.mobi/releases/${pname}/${pname}-${version}.tar.xz";
+    hash = "sha256-hfm89G9uxVc8j8rDOg1ytI+Pm9s9WQWazH3yLZdWSRg=";
  };

  nativeBuildInputs = [
@ -54,7 +50,7 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    python3
-    wrapGAppsHook
+    wrapGAppsHook4
  ];

  buildInputs = [
@ -94,7 +90,10 @@ stdenv.mkDerivation rec {
    "-Dsystemd=true"
    "-Dcompositor=${phoc}/bin/phoc"
    # https://github.com/NixOS/nixpkgs/issues/36468
+    # https://gitlab.gnome.org/World/Phosh/phosh/-/merge_requests/1363
    "-Dc_args=-I${glib.dev}/include/gio-unix-2.0"
+    # Save some time building if tests are disabled
+    "-Dtests=${lib.boolToString finalAttrs.finalPackage.doCheck}"
  ];

  checkPhase = ''
@ -114,30 +113,19 @@ stdenv.mkDerivation rec {
    )
  '';

-  postFixup = ''
-    mkdir -p $out/share/wayland-sessions
-    ln -s $out/share/applications/sm.puri.Phosh.desktop $out/share/wayland-sessions/
-  '';
-
  passthru = {
-    providedSessions = [
-      "sm.puri.Phosh"
-    ];
-
+    providedSessions = [ "phosh" ];
    tests.phosh = nixosTests.phosh;
-
-    updateScript = gitUpdater {
-      rev-prefix = "v";
-    };
+    updateScript = directoryListingUpdater { };
  };

  meta = with lib; {
    description = "A pure Wayland shell prototype for GNOME on mobile devices";
    homepage = "https://gitlab.gnome.org/World/Phosh/phosh";
-    changelog = "https://gitlab.gnome.org/World/Phosh/phosh/-/blob/v${version}/debian/changelog";
+    changelog = "https://gitlab.gnome.org/World/Phosh/phosh/-/blob/v${finalAttrs.version}/debian/changelog";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ masipcat tomfitzhenry zhaofengli ];
    platforms = platforms.linux;
    mainProgram = "phosh-session";
  };
-}
+})
--- a/pkgs/applications/window-managers/phosh/phosh-mobile-settings.nix
+++ b/pkgs/applications/window-managers/phosh/phosh-mobile-settings.nix
@ -1,7 +1,7 @@
 { lib
 , stdenv
-, fetchFromGitLab
-, gitUpdater
+, fetchurl
+, directoryListingUpdater
 , meson
 , ninja
 , pkg-config
@ -14,18 +14,18 @@
 , phoc
 , phosh
 , wayland-protocols
+, json-glib
+, gsound
 }:

 stdenv.mkDerivation rec {
  pname = "phosh-mobile-settings";
-  version = "0.23.1";
+  version = "0.35.1";

-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "guidog";
-    repo = "phosh-mobile-settings";
-    rev = "v${version}";
-    sha256 = "sha256-D605efn25Dl3Bj92DZiagcx+MMcRz0GRaWxplBRcZhA=";
+  src = fetchurl {
+    # This tarball includes the meson wrapped subproject 'gmobile'.
+    url = "https://sources.phosh.mobi/releases/${pname}/${pname}-${version}.tar.xz";
+    hash = "sha256-Kg3efPs0knbJ9b0buIkgqIL1XplcZpGIi0hxJptG6UI=";
  };

  nativeBuildInputs = [
@ -44,29 +44,29 @@ stdenv.mkDerivation rec {
    lm_sensors
    phoc
    wayland-protocols
+    json-glib
+    gsound
  ];

+  postPatch = ''
+    # There are no schemas to compile.
+    substituteInPlace meson.build \
+      --replace 'glib_compile_schemas: true' 'glib_compile_schemas: false'
+  '';
+
  postInstall = ''
    # this is optional, but without it phosh-mobile-settings won't know about lock screen plugins
    ln -s '${phosh}/lib/phosh' "$out/lib/phosh"
-
-    # .desktop files marked `OnlyShowIn=Phosh;` aren't displayed even in our phosh, so remove that.
-    # also make the Exec path absolute.
-    substituteInPlace "$out/share/applications/org.sigxcpu.MobileSettings.desktop" \
-      --replace 'OnlyShowIn=Phosh;' "" \
-      --replace 'Exec=phosh-mobile-settings' "Exec=$out/bin/phosh-mobile-settings"
  '';

-  passthru.updateScript = gitUpdater {
-    rev-prefix = "v";
-  };
+  passthru.updateScript = directoryListingUpdater { };

  meta = with lib; {
    description = "A settings app for mobile specific things";
    homepage = "https://gitlab.gnome.org/guidog/phosh-mobile-settings";
    changelog = "https://gitlab.gnome.org/guidog/phosh-mobile-settings/-/blob/v${version}/debian/changelog";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ colinsane ];
+    maintainers = with maintainers; [ rvl ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/tools/filesystems/apfsprogs/default.nix
+++ b/pkgs/tools/filesystems/apfsprogs/default.nix
@ -4,17 +4,27 @@
 , nixosTests
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "apfsprogs";
-  version = "unstable-2023-06-06";
+  version = "unstable-2023-11-30";

  src = fetchFromGitHub {
    owner = "linux-apfs";
    repo = "apfsprogs";
-    rev = "91827679dfb1d6f5719fbe22fa67e89c17adb133";
-    hash = "sha256-gF7bOozAGGpuVP23mnPW81qH2gnVUdT9cxukzGJ+ydI=";
+    rev = "990163894d871f51ba102a75aed384a275c5991b";
+    hash = "sha256-yCShZ+ALzSe/svErt9/i1JyyEvbIeABGPbpS4lVil0A=";
  };

+  postPatch = let
+    shortRev = builtins.substring 0 9 finalAttrs.src.rev;
+  in ''
+    substituteInPlace \
+      apfs-snap/Makefile apfsck/Makefile mkapfs/Makefile \
+      --replace \
+        '$(shell git describe --always HEAD | tail -c 9)' \
+        '${shortRev}'
+  '';
+
  buildPhase = ''
    runHook preBuild
    make -C apfs-snap $makeFlags
@ -35,6 +45,8 @@ stdenv.mkDerivation {
    apfs = nixosTests.apfs;
  };

+  strictDeps = true;
+
  meta = with lib; {
    description = "Experimental APFS tools for linux";
    homepage = "https://github.com/linux-apfs/apfsprogs";
@ -42,4 +54,4 @@ stdenv.mkDerivation {
    platforms = platforms.linux;
    maintainers = with maintainers; [ Luflosi ];
  };
-}
+})
--- a/pkgs/by-name/aw/aws-gate/disable-bootstrap.patch
+++ b/pkgs/by-name/aw/aws-gate/disable-bootstrap.patch
@ -38,14 +38,3 @@ index ac37c2f..9743415 100644
     elif args.subcommand == "exec":
         exec(
             config=config,
-diff --git a/requirements/requirements.txt b/requirements/requirements.txt
-index 50b203e..8c3496f 100644
--- a/requirements/requirements.txt
-+++ b/requirements/requirements.txt
-@@ -3,5 +3,4 @@ cryptography==39.0.2
- marshmallow==3.19.0
- packaging==23.0
- PyYAML>=5.1,<6.1
-requests==2.28.2
- unix-ar==0.2.1
- wrapt==1.15.0
--- a/pkgs/by-name/aw/aws-gate/package.nix
+++ b/pkgs/by-name/aw/aws-gate/package.nix
@ -26,14 +26,25 @@ python3Packages.buildPythonApplication rec {
  '';

  nativeBuildInputs = [
+    installShellFiles
+    python3Packages.pythonRelaxDepsHook
    python3Packages.setuptools
    python3Packages.wheel
-    installShellFiles
  ];

-  propagatedBuildInputs = [ ssm-session-manager-plugin ] ++ builtins.attrValues {
-    inherit (python3Packages) marshmallow boto3 pyyaml wrapt cryptography;
-  };
+  pythonRelaxDeps = true;
+
+  propagatedBuildInputs = [
+    python3Packages.boto3
+    python3Packages.cryptography
+    python3Packages.marshmallow
+    python3Packages.packaging
+    python3Packages.pyyaml
+    python3Packages.requests
+    python3Packages.unix-ar
+    python3Packages.wrapt
+    ssm-session-manager-plugin
+  ];

  postInstall = ''
    installShellCompletion --bash completions/bash/aws-gate
--- a/pkgs/by-name/bi/bitmagnet/package.nix
+++ b/pkgs/by-name/bi/bitmagnet/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "bitmagnet";
-  version = "0.5.1";
+  version = "0.6.2";

  src = fetchFromGitHub {
    owner = "bitmagnet-io";
    repo = "bitmagnet";
    rev = "v${version}";
-    hash = "sha256-tqxmPr7O3WkFgo8tYk4iFr/k76Z5kq75YF+6uDuBOik=";
+    hash = "sha256-17jRktEqBCAXiddx8FnqHg3+c/03nqKHC8BQc9AhQA0=";
  };

  vendorHash = "sha256-YfsSz72CeHdrh5610Ilo1NYxlCT993hxWRWh0OsvEQc=";
--- a/pkgs/by-name/ds/dsda-doom/package.nix
+++ b/pkgs/by-name/ds/dsda-doom/package.nix
@ -0,0 +1,62 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, SDL2
+, SDL2_mixer
+, SDL2_image
+, fluidsynth
+, soundfont-fluid
+, portmidi
+, dumb
+, libvorbis
+, libmad
+, libGLU
+, libzip
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dsda-doom";
+  version = "0.27.5";
+
+  src = fetchFromGitHub {
+    owner = "kraflab";
+    repo = "dsda-doom";
+    rev = "v${version}";
+    hash = "sha256-+rvRj6RbJ/RaKmlDZdB2oBm/U6SuHNxye8TdpEOZwQw=";
+  };
+
+  sourceRoot = "${src.name}/prboom2";
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    SDL2
+    SDL2_mixer
+    SDL2_image
+    fluidsynth
+    portmidi
+    dumb
+    libvorbis
+    libmad
+    libGLU
+    libzip
+  ];
+
+  # Fixes impure path to soundfont
+  prePatch = ''
+    substituteInPlace src/m_misc.c --replace \
+      "/usr/share/sounds/sf3/default-GM.sf3" \
+      "${soundfont-fluid}/share/soundfonts/FluidR3_GM2-2.sf2"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/kraflab/dsda-doom";
+    description = "An advanced Doom source port with a focus on speedrunning, successor of PrBoom+";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.Gliczy ];
+  };
+}
--- a/pkgs/by-name/fo/foonathan-memory/package.nix
+++ b/pkgs/by-name/fo/foonathan-memory/package.nix
@ -0,0 +1,68 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, doctest
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "foonathan-memory";
+  version = "0.7-3";
+
+  src = fetchFromGitHub {
+    owner = "foonathan";
+    repo = "memory";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-nLBnxPbPKiLCFF2TJgD/eJKJJfzktVBW3SRW2m3WK/s=";
+  };
+
+  patches = [
+    # do not download doctest, use the system doctest instead
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/f/foonathan-memory/0.7.3-2/debian/patches/0001-Use-system-doctest.patch";
+      hash = "sha256-/MuDeeIh+7osz11VfsAsQzm9HMZuifff+MDU3bDDxRE=";
+    })
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "FOONATHAN_MEMORY_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  doCheck = true;
+
+  checkInputs = [ doctest ];
+
+  # fix a circular dependency between "out" and "dev" outputs
+  postInstall = ''
+    mkdir -p $dev/lib
+    mv $out/lib/foonathan_memory $dev/lib/
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/foonathan/memory";
+    changelog = "https://github.com/foonathan/memory/releases/tag/${finalAttrs.src.rev}";
+    description = "STL compatible C++ memory allocator library";
+
+    longDescription = ''
+      The C++ STL allocator model has various flaws. For example, they are
+      fixed to a certain type, because they are almost necessarily required to
+      be templates. So you can't easily share a single allocator for multiple
+      types. In addition, you can only get a copy from the containers and not
+      the original allocator object. At least with C++11 they are allowed to be
+      stateful and so can be made object not instance based. But still, the
+      model has many flaws. Over the course of the years many solutions have
+      been proposed, for example EASTL. This library is another. But instead of
+      trying to change the STL, it works with the current implementation.
+    '';
+
+    license = licenses.zlib;
+    maintainers = with maintainers; [ panicgh ];
+    platforms = with platforms; unix ++ windows;
+  };
+})
--- a/pkgs/by-name/go/govee2mqtt/dont-vendor-openssl.diff
+++ b/pkgs/by-name/go/govee2mqtt/dont-vendor-openssl.diff
@ -0,0 +1,41 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 303f6f8..952a7ff 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -1373,15 +1373,6 @@ version = "0.1.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
+ 
+-[[package]]
+-name = "openssl-src"
+-version = "300.2.1+3.2.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3fe476c29791a5ca0d1273c697e96085bbabbbea2ef7afd5617e78a4b40332d3"
+-dependencies = [
+- "cc",
+-]
+-
+ [[package]]
+ name = "openssl-sys"
+ version = "0.9.98"
+@@ -1390,7 +1381,6 @@ checksum = "c1665caf8ab2dc9aef43d1c0023bd904633a6a05cb30b0ad59bec2ae986e57a7"
+ dependencies = [
+  "cc",
+  "libc",
+- "openssl-src",
+  "pkg-config",
+  "vcpkg",
+ ]
+diff --git a/Cargo.toml b/Cargo.toml
+index a4cf25c..42fde6d 100644
+--- a/Cargo.toml
+++ b/Cargo.toml
+@@ -44,7 +44,7 @@ parking_lot = "0.12.1"
+ 
+ [dependencies.mosquitto-rs]
+ version="0.11.1"
+-features = ["vendored-openssl"]
+features = ["router"]
+ #path = "../mosquitto-rs/mosquitto-rs"
+ 
+ [dev-dependencies]
--- a/pkgs/by-name/go/govee2mqtt/package.nix
+++ b/pkgs/by-name/go/govee2mqtt/package.nix
@ -0,0 +1,56 @@
+{ rustPlatform
+, lib
+, fetchFromGitHub
+, fetchpatch
+, openssl
+, pkg-config
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "govee2mqtt";
+  version = "2024.01.24-ea3cd430";
+
+  src = fetchFromGitHub {
+    owner = "wez";
+    repo = "govee2mqtt";
+    rev = version;
+    hash = "sha256-iGOj0a4+wLd8QlM1tr+NYfd2tuwgHV+u5dt0zf+WscY=";
+  };
+
+  cargoPatches = [
+    ./dont-vendor-openssl.diff
+  ];
+
+  patches = [
+    # update test fixtures https://github.com/wez/govee2mqtt/pull/120
+    (fetchpatch {
+      url = "https://github.com/wez/govee2mqtt/commit/0c2dc3e1cc1ccd44ddf98ead34e081ac4b4335f1.patch";
+      hash = "sha256-0TNYyvRRcMkE9FYPcVoKburejhAn/cVYM3eaobS4nx8=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace src/service/http.rs \
+      --replace '"assets"' '"${placeholder "out"}/share/govee2mqtt/assets"'
+  '';
+
+  cargoHash = "sha256-wApf+H5T7HPkCGQwv8ePoDnStUn04oVvv3eIJ8aKVUw=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ];
+
+  postInstall = ''
+    mkdir -p $out/share/govee2mqtt/
+    cp -r assets $out/share/govee2mqtt/
+  '';
+
+  meta = with lib; {
+    description = "Connect Govee lights and devices to Home Assistant";
+    homepage = "https://github.com/wez/govee2mqtt";
+    changelog = "https://github.com/wez/govee2mqtt/blob/${src.rev}/addon/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+    mainProgram = "govee";
+  };
+}
--- a/pkgs/by-name/ig/ignite-cli/package.nix
+++ b/pkgs/by-name/ig/ignite-cli/package.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "ignite-cli";
-  version = "28.1.1";
+  version = "28.2.0";

  src = fetchFromGitHub {
    repo = "cli";
    owner = "ignite";
    rev = "v${version}";
-    hash = "sha256-8/YupS16j6+iMt09RO1RZrJNlxfmE27tOD+cYecKnbc=";
+    hash = "sha256-FRujRghSPSc2fq2Eiv4Hco4RIcv3D4zNI82NEhCGFhM=";
  };

-  vendorHash = "sha256-GpRTOjrPF+GS0XfavG7GYG5FcHc8ELxzhminncV2Qgk=";
+  vendorHash = "sha256-cH6zwkRMvUjYb6yh/6S/e4ky8f4GvhCAOnCJMfDTmrE=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/ma/manix/package.nix
+++ b/pkgs/by-name/ma/manix/package.nix
@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "manix";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "nix-community";
+    repo = "manix";
+    rev = "v${version}";
+    hash = "sha256-b/3NvY+puffiQFCQuhRMe81x2wm3vR01MR3iwe/gJkw=";
+  };
+
+  cargoHash = "sha256-45cb0yO/ypGLcvEgPOkN6Py99yqK09xnCmMOLOOYYSA=";
+
+  meta = with lib; {
+    description = "A fast CLI documentation searcher for Nix";
+    homepage = "https://github.com/nix-community/manix";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ iogamaster lecoqjacob ];
+    mainProgram = "manix";
+  };
+}
--- a/pkgs/by-name/nw/nwg-hello/package.nix
+++ b/pkgs/by-name/nw/nwg-hello/package.nix
@ -0,0 +1,67 @@
+{ lib
+, fetchFromGitHub
+, gobject-introspection
+, gtk-layer-shell
+, gtk3
+, python3Packages
+, wrapGAppsHook
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "nwg-hello";
+  version = "0.1.6";
+
+  src = fetchFromGitHub {
+    owner = "nwg-piotr";
+    repo = "nwg-hello";
+    rev = "v${version}";
+    hash = "sha256-+D89QTFUV7/dhfcOWnQshG8USh35Vdm/QPHbsxiV0j0=";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    gtk-layer-shell
+  ];
+
+  propagatedBuildInputs = [
+    python3Packages.pygobject3
+  ];
+
+  postPatch = ''
+    # hard coded paths
+    substituteInPlace nwg_hello/main.py \
+      --replace '/etc/nwg-hello' "$out/etc/nwg-hello" \
+      --replace "/usr/share/xsessions" "/run/current-system/sw/share/xsessions" \
+      --replace "/usr/share/wayland-sessions" "/run/current-system/sw/share/wayland-sessions"
+
+    substituteInPlace nwg-hello-default.json \
+      --replace "/usr/share/xsessions" "/run/current-system/sw/share/xsessions" \
+      --replace "/usr/share/wayland-sessions" "/run/current-system/sw/share/wayland-sessions"
+
+    substituteInPlace nwg_hello/ui.py --replace '/usr/share/nwg-hello' "$out/share/nwg-hello"
+  '';
+
+  postInstall = ''
+    install -D -m 644 -t "$out/etc/nwg-hello/" nwg-hello-default.json nwg-hello-default.css hyprland.conf sway-config README
+    install -D -m 644 -t "$out/share/nwg-hello/" nwg.jpg
+    install -D -m 644 -t "$out/share/nwg-hello/" img/*
+  '';
+
+  # Upstream has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "nwg_hello" ];
+
+  meta = {
+    homepage = "https://github.com/nwg-piotr/nwg-hello";
+    description = "GTK3-based greeter for the greetd daemon, written in python";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = [ ];
+    mainProgram = "nwg-hello";
+  };
+}
--- a/pkgs/tools/graphics/pdf-sign/default.nix
+++ b/pkgs/tools/graphics/pdf-sign/default.nix
@ -10,12 +10,12 @@
 }:

 let
-  python-env = python3.withPackages (ps: with ps; [ tkinter ]);
+  python = python3.withPackages (ps: with ps; [ tkinter ]);
  binPath = lib.makeBinPath [ ghostscript pdftk poppler_utils ];
 in
 stdenv.mkDerivation {
  pname = "pdf-sign";
-  version = "unstable-2023-08-08";
+  version = "0-unstable-2023-08-08";

  src = fetchFromGitHub {
    owner = "svenssonaxel";
@ -26,18 +26,14 @@ stdenv.mkDerivation {

  nativeBuildInputs = [ makeBinaryWrapper ];

+  buildInputs = [ python ];
+
  installPhase = ''
    runHook preInstall

-    mkdir -p $out
-    cp pdf-sign pdf-create-empty $out
-
-    makeWrapper ${python-env}/bin/python $out/bin/pdf-sign \
-          --add-flags $out/pdf-sign \
-          --prefix PATH : ${binPath}
-    makeWrapper ${python-env}/bin/python $out/bin/pdf-create-empty \
-          --add-flags $out/pdf-create-empty \
-          --prefix PATH : ${binPath}
+    install -Dm755 pdf-sign pdf-create-empty -t $out/bin
+    wrapProgram $out/bin/pdf-sign --prefix PATH : ${binPath}
+    wrapProgram $out/bin/pdf-create-empty --prefix PATH : ${binPath}

    runHook postInstall
  '';
--- a/pkgs/by-name/pe/pest/composer.lock
+++ b/pkgs/by-name/pe/pest/composer.lock
--- a/pkgs/by-name/pe/pest/package.nix
+++ b/pkgs/by-name/pe/pest/package.nix
@ -0,0 +1,25 @@
+{ lib, fetchFromGitHub, php }:
+
+php.buildComposerProject (finalAttrs: {
+  pname = "pest";
+  version = "2.33.4";
+
+  src = fetchFromGitHub {
+    owner = "pestphp";
+    repo = "pest";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-9AJww0mynlacBsQvqb++vWn0vsapxFeXsA/tJJEQGFI=";
+  };
+
+  composerLock = ./composer.lock;
+  vendorHash = "sha256-Z3vmHqySLU0zRqnDoVTt6FURxtJjVOyUXlURSsO6XE8=";
+
+  meta = {
+    changelog = "https://github.com/pestphp/pest/releases/tag/v${finalAttrs.version}";
+    description = "PHP testing framework";
+    homepage = "https://pestphp.com";
+    license = lib.licenses.mit;
+    mainProgram = "pest";
+    maintainers = with lib.maintainers; [ patka ];
+  };
+})
--- a/pkgs/applications/misc/posterazor/default.nix
+++ b/pkgs/applications/misc/posterazor/default.nix
@ -1,4 +1,13 @@
-{ lib, stdenv, fetchurl, cmake, unzip, pkg-config, libXpm, fltk13, freeimage }:
+{ lib
+, stdenv
+, fetchurl
+, cmake
+, unzip
+, pkg-config
+, libXpm
+, fltk13
+, freeimage
+}:

 stdenv.mkDerivation rec {
  pname = "posterazor";
@ -6,7 +15,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://sourceforge/posterazor/${version}/PosteRazor-${version}-Source.zip";
-    sha256 = "1dqpdk8zl0smdg4fganp3hxb943q40619qmxjlga9jhjc01s7fq5";
+    hash = "sha256-BbujA2ASyqQelb3iFAwgeJC0OhzXqufIa1UD+tFsF7c=";
  };

  hardeningDisable = [ "format" ];
@ -32,8 +41,9 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "http://posterazor.sourceforge.net/";
    description = "Cuts a raster image into pieces which can afterwards be printed out and assembled to a poster";
-    maintainers = [ maintainers.madjar ];
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
+    maintainers = [ maintainers.madjar ];
+    mainProgram = "PosteRazor";
  };
 }
--- a/pkgs/by-name/py/pysqlrecon/package.nix
+++ b/pkgs/by-name/py/pysqlrecon/package.nix
@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "pysqlrecon";
-  version = "0.1.3";
+  version = "0.1.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Tw1sm";
    repo = "PySQLRecon";
    rev = "refs/tags/v${version}";
-    hash = "sha256-IxIYJo2wG8xqetBqgUOePNWPSx9FaZPhqhOFy3kG6Uk=";
+    hash = "sha256-v6IO5fQLvzJhpMPNaZ+ehmU4NYgRDfnDRwQYv5QVx00=";
  };

  pythonRelaxDeps = [
--- a/pkgs/applications/misc/smb3-foundry/default.nix
+++ b/pkgs/applications/misc/smb3-foundry/default.nix
@ -2,11 +2,10 @@
 , stdenv
 , fetchFromGitHub
 , python3
-, makeWrapper
 }:

 let
-  pythonEnv = (python3.withPackages (ps: with ps; [
+  python = (python3.withPackages (ps: with ps; [
    pyside6
    py65
    qdarkstyle
@ -23,18 +22,16 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-8cf7VhvC372Cqi94n2FSHcoCGblpZoZvBXcXq5jU6CY=";
  };

-  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python ];

  installPhase = ''
    runHook preInstall

-    mkdir -p $out/app
-    cp -R smb3parse foundry scribe data doc VERSION smb3-foundry.py smb3-scribe.py $out/app
+    mkdir -p $out/share/smb3-foundry $out/bin
+    cp -r smb3parse foundry scribe data doc VERSION smb3-foundry.py smb3-scribe.py $out/share/smb3-foundry

-    makeWrapper ${pythonEnv}/bin/python $out/bin/smb3-foundry \
-          --add-flags "$out/app/smb3-foundry.py"
-    makeWrapper ${pythonEnv}/bin/python $out/bin/smb3-scribe \
-          --add-flags "$out/app/smb3-scribe.py"
+    ln -s $out/share/smb3-foundry/smb3-foundry.py $out/bin/smb3-foundry
+    ln -s $out/share/smb3-foundry/smb3-scribe.py $out/bin/smb3-scribe

    runHook postInstall
  '';
--- a/pkgs/by-name/sn/snicat/package.nix
+++ b/pkgs/by-name/sn/snicat/package.nix
@ -1,5 +1,4 @@
 { lib
-, stdenv
 , buildGoPackage
 , fetchFromGitHub
 }:
@ -14,19 +13,12 @@ buildGoPackage rec {
    hash = "sha256-fFlTBOz127le2Y7F9KKhbcldcyFEpAU5QiJ4VCAPs9Y=";
  };

-  patchPhase = ''
-    runHook prePatch
-
-    substituteInPlace snicat.go \
-      --replace-warn "v0.0.0" "v${version}"
-
-    runHook postPatch
-  '';
-
  goPackagePath = "github.com/CTFd/snicat";

  goDeps = ./deps.nix;

+  ldflags = [ "-s" "-w" "-X main.version=v${version}" ];
+
  installPhase = ''
    runHook preInstall

--- a/pkgs/by-name/td/tdl/package.nix
+++ b/pkgs/by-name/td/tdl/package.nix
@ -0,0 +1,34 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+buildGoModule rec {
+  pname = "tdl";
+  version = "0.15.1";
+
+  src = fetchFromGitHub {
+    owner = "iyear";
+    repo = "tdl";
+    rev = "v${version}";
+    hash = "sha256-vKcKHxPwF7kdsEASJ4VunPZ9kVztPq3yH8RnCd9uI9A=";
+  };
+
+  vendorHash = "sha256-v5okd7PAnA2JsgZ4SqvpZmXOQXSCzl+SwFx9NWo7C/0=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/iyear/tdl/pkg/consts.Version=${version}"
+  ];
+
+  # Requires network access
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A Telegram downloader/tools written in Golang";
+    homepage = "https://github.com/iyear/tdl";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ Ligthiago ];
+    mainProgram = "tdl";
+  };
+}
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "tigerbeetle";
-  version = "0.14.177";
+  version = "0.14.178";

  src = fetchFromGitHub {
    owner = "tigerbeetle";
    repo = "tigerbeetle";
    rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-oMsDHz/yOWtS1XhJcXR74pA3YvPzANUdRAy7tjNO5lc=";
+    hash = "sha256-QbNfy9S+h+o6WJTMdNzGsGZhrfCTGTyhcO3psbmQKaU=";
  };

  nativeBuildInputs = [ custom_zig_hook ];
--- a/pkgs/by-name/tu/tuxclocker-nvidia-plugin/no-cpu-plugin.patch
+++ b/pkgs/by-name/tu/tuxclocker-nvidia-plugin/no-cpu-plugin.patch
@ -1,14 +0,0 @@
-diff --git a/src/plugins/meson.build b/src/plugins/meson.build
-index cdd3b5b..a5a2174 100644
--- a/src/plugins/meson.build
-+++ b/src/plugins/meson.build
-@@ -63,9 +63,3 @@ if all_nvidia_linux_libs
- 		install : true,
- 		link_with : libtuxclocker)
- endif
-
-shared_library('cpu', 'CPU.cpp', 'Utils.cpp',
-        include_directories : [incdir, fplus_inc],
-        install_dir : get_option('libdir') / 'tuxclocker' / 'plugins',
-        install : true,
-        link_with : libtuxclocker)
--- a/pkgs/by-name/tu/tuxclocker-nvidia-plugin/package.nix
+++ b/pkgs/by-name/tu/tuxclocker-nvidia-plugin/package.nix
@ -22,13 +22,10 @@ stdenv.mkDerivation {
    openssl
  ];

-  # Build doesn't have a way to disable building the CPU plugin, which is already
-  # provided by 'tuxclocker-plugins'
-  patches = [ ./no-cpu-plugin.patch ];
-
  mesonFlags = [
    "-Ddaemon=false"
    "-Dgui=false"
    "-Drequire-nvidia=true"
+    "-Dplugins-cpu=false" # provided by tuxclocker-plugins
  ];
 }
--- a/pkgs/by-name/tu/tuxclocker-plugins/package.nix
+++ b/pkgs/by-name/tu/tuxclocker-plugins/package.nix
@ -3,7 +3,6 @@
 , boost
 , cmake
 , gettext
-, git
 , libdrm
 , meson
 , ninja
@ -20,7 +19,6 @@ stdenv.mkDerivation {

  nativeBuildInputs = [
    gettext
-    git
    meson
    ninja
    pkg-config
--- a/pkgs/data/icons/numix-icon-theme-square/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-square/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "numix-icon-theme-square";
-  version = "23.12.10";
+  version = "24.02.05";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = pname;
    rev = version;
-    sha256 = "sha256-kNO0YHHapoIKAosGvCMUEhjP6FkD/CRNhrv5D3dxgoI=";
+    sha256 = "sha256-IYfyoDoBQOFLGRS6v487GLAdUSJUuscLIUwi65ilu90=";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/data/misc/wireless-regdb/default.nix
+++ b/pkgs/data/misc/wireless-regdb/default.nix
@ -1,12 +1,12 @@
-{ lib, stdenvNoCC, fetchurl, directoryListingUpdater, crda }:
+{ lib, stdenvNoCC, fetchurl, directoryListingUpdater }:

 stdenvNoCC.mkDerivation rec {
  pname = "wireless-regdb";
-  version = "2023.09.01";
+  version = "2024.01.23";

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/network/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-JtTCpyfMWSObhHNarYVrfH0LBOMKpcI1xPf0f18FNJE=";
+    hash = "sha256-yKYcms92+n60I56J9kDe4+hwmNn2m001GMnGD8bSDFU=";
  };

  dontBuild = true;
@ -16,12 +16,7 @@ stdenvNoCC.mkDerivation rec {
    "PREFIX="
  ];

-  passthru = {
-    tests = {
-      inherit crda; # validate data base signature
-    };
-    updateScript = directoryListingUpdater { };
-  };
+  passthru.updateScript = directoryListingUpdater { };

  meta = with lib; {
    description = "Wireless regulatory database for CRDA";
--- a/pkgs/desktops/xfce/applications/mousepad/default.nix
+++ b/pkgs/desktops/xfce/applications/mousepad/default.nix
@ -12,10 +12,10 @@
 mkXfceDerivation {
  category = "apps";
  pname = "mousepad";
-  version = "0.6.1";
+  version = "0.6.2";
  odd-unstable = false;

-  sha256 = "sha256-MLdexhIsQa4XuVaLgtQ2aVJ00+pwkhAP3qMj0XXPqh0=";
+  sha256 = "sha256-A4siNxbTf9ObJJg8inPuH7Lo4dckLbFljV6aPFQxRto=";

  nativeBuildInputs = [ gobject-introspection ];

--- a/pkgs/desktops/xfce/applications/ristretto/default.nix
+++ b/pkgs/desktops/xfce/applications/ristretto/default.nix
@ -11,10 +11,10 @@
 mkXfceDerivation {
  category = "apps";
  pname = "ristretto";
-  version = "0.13.1";
+  version = "0.13.2";
  odd-unstable = false;

-  sha256 = "sha256-Tor4mA0uSpVCdK6mla1L0JswgURnGPOfkYBR2N1AbL0=";
+  sha256 = "sha256-FKgNKQ2l4FGvEvmppf+RTxMXU6TfsZVFBVii4zr4ASc=";

  buildInputs = [
    glib
--- a/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
@ -17,10 +17,10 @@
 mkXfceDerivation {
  category = "apps";
  pname = "xfce4-terminal";
-  version = "1.1.1";
+  version = "1.1.2";
  odd-unstable = false;

-  sha256 = "sha256-LDfZTZ2EaboIYz+xQNC2NKpJiN8qqfead2XzpKVpL6c=";
+  sha256 = "sha256-9RJmHYT9yYhtyzyTcg3nnD2hlCgENyi/3TNOGUto494=";

  nativeBuildInputs = [
    libxslt
--- a/pkgs/desktops/xfce/core/garcon/default.nix
+++ b/pkgs/desktops/xfce/core/garcon/default.nix
@ -3,9 +3,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "garcon";
-  version = "4.18.1";
+  version = "4.18.2";

-  sha256 = "sha256-0EcmI+C8B7oQl/cpbFeLjof1fnUi09nZAA5uJ0l15V4=";
+  sha256 = "sha256-J9f9MzZ1I9XIyvwuyINkvXDuXY6/MkjlH2Ct4yaEXsY=";

  nativeBuildInputs = [ gobject-introspection ];

--- a/pkgs/desktops/xfce/core/libxfce4ui/default.nix
+++ b/pkgs/desktops/xfce/core/libxfce4ui/default.nix
@ -4,9 +4,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "libxfce4ui";
-  version = "4.18.4";
+  version = "4.18.5";

-  sha256 = "sha256-HnLmZftvFvQAvmQ7jZCaYAQ5GB0YMjzhqZkILzvifoE=";
+  sha256 = "sha256-Jf+oxdUWXJJmMoJ9kIx9F+ndb2c6bNpf+JOzxpi2Lwo=";

  nativeBuildInputs = [ gobject-introspection vala ];
  buildInputs =  [ gtk3 libstartup_notification libgtop libepoxy xfconf ];
--- a/pkgs/desktops/xfce/core/libxfce4util/default.nix
+++ b/pkgs/desktops/xfce/core/libxfce4util/default.nix
@ -3,9 +3,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "libxfce4util";
-  version = "4.18.1";
+  version = "4.18.2";

-  sha256 = "sha256-nqASXyHR7wNiNPorlz2ix+Otyir6I9KCCr1vfS6GO8E=";
+  sha256 = "sha256-JQ6biE1gxtB6+LWxRGfbUhgJhhITGhLr+8BxFW4/8SU=";

  nativeBuildInputs = [ gobject-introspection vala ];

--- a/pkgs/development/compilers/erg/default.nix
+++ b/pkgs/development/compilers/erg/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "erg";
-  version = "0.6.29";
+  version = "0.6.30";

  src = fetchFromGitHub {
    owner = "erg-lang";
    repo = "erg";
    rev = "v${version}";
-    hash = "sha256-sHW0e8a8ZDmcA8u0leIJLxzJLI8guKlMB/u7CFhbyQE=";
+    hash = "sha256-lStTLDXgdaaqyzdzU1V2JnKX8jt27Z1A23fkuZU8dt0=";
  };

-  cargoHash = "sha256-3wrH++IItJQNueJoa5wuzN2ZXWa5OflBItjQxS/XhO0=";
+  cargoHash = "sha256-MsDan3wL9RhH0uhAuq0Lg8IRBXR8a3ooEBx6n2CMAVk=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "go";
-  version = "1.20.13";
+  version = "1.20.14";

  src = fetchurl {
    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-D+dFxTDy8dZxk688XqJSRr4HeYnsUXjfJm6XXzUyRJ4=";
+    hash = "sha256-Gu8yGg4+OLfpHS1+tkBAZmyr3Md9OD3jyVItDWm2f04=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/go/1.22.nix
+++ b/pkgs/development/compilers/go/1.22.nix
@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "go";
-  version = "1.22rc2";
+  version = "1.22.0";

  src = fetchurl {
    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-0ZOofbgiOCHh7oke3+42yOrJugz4PkLt5keVp96Kfyc=";
+    hash = "sha256-TRlsPUGg1sHfxk0E48wfYIsMQ2vYe3Bgzj4jI04fTVw=";
  };

  strictDeps = true;
--- a/pkgs/development/cuda-modules/nccl-tests/default.nix
+++ b/pkgs/development/cuda-modules/nccl-tests/default.nix
@ -26,13 +26,13 @@ backendStdenv.mkDerivation (
  finalAttrs: {

    pname = "nccl-tests";
-    version = "2.13.8";
+    version = "2.13.9";

    src = fetchFromGitHub {
      owner = "NVIDIA";
      repo = finalAttrs.pname;
      rev = "v${finalAttrs.version}";
-      hash = "sha256-dxLoflsTHDBnZRTzoXdm30OyKpLlRa73b784YWALBHg=";
+      hash = "sha256-QYuMBPhvHHVo2ku14jD1CVINLPW0cyiXJkXxb77IxbE=";
    };

    strictDeps = true;
--- a/pkgs/development/embedded/arduino/arduino-language-server/default.nix
+++ b/pkgs/development/embedded/arduino/arduino-language-server/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "arduino-language-server";
-  version = "0.7.5";
+  version = "0.7.6";

  src = fetchFromGitHub {
    owner = "arduino";
    repo = "arduino-language-server";
    rev = "refs/tags/${version}";
-    hash = "sha256-RBoDT/KnbQHeuE5WpoL4QWu3gojiNdsi+/NEY2e/sHs=";
+    hash = "sha256-PmPGhbB1HqxZRK+f28SdZNh4HhE0oseYsdJuEAAk90I=";
  };

  subPackages = [ "." ];
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@ -308,7 +308,10 @@ let
  passthru.updateScript = let
      filename = builtins.head (lib.splitString ":" self.meta.position);
    in attrs.passthru.updateScript or [ update-python-libraries filename ];
-in lib.extendDerivation
-  (disabled -> throw "${name} not supported for interpreter ${python.executable}")
-  passthru
-  self
+in
+  if disabled then
+    throw "${name} not supported for interpreter ${python.executable}"
+else
+  self.overrideAttrs (attrs: {
+    passthru = lib.recursiveUpdate passthru attrs.passthru;
+  })
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@ -52,16 +52,16 @@ let
    name = "arrow-testing";
    owner = "apache";
    repo = "arrow-testing";
-    rev = "47f7b56b25683202c1fd957668e13f2abafc0f12";
-    hash = "sha256-ZDznR+yi0hm5O1s9as8zq5nh1QxJ8kXCRwbNQlzXpnI=";
+    rev = "ad82a736c170e97b7c8c035ebd8a801c17eec170";
+    hash = "sha256-wN0dam0ZXOAJ+D8bGDMhsdaV3llI9LsiCXwqW9mR3gQ=";
  };

  parquet-testing = fetchFromGitHub {
    name = "parquet-testing";
    owner = "apache";
    repo = "parquet-testing";
-    rev = "b2e7cc755159196e3a068c8594f7acbaecfdaaac";
-    hash = "sha256-IFvGTOkaRSNgZOj8DziRj88yH5JRF+wgSDZ5N0GNvjk=";
+    rev = "d69d979223e883faef9dc6fe3cf573087243c28a";
+    hash = "sha256-CUckfNjfDW05crWigzMP5b9UynviXKGZUlIr754OoGU=";
  };

  aws-sdk-cpp-arrow = aws-sdk-cpp.override {
@ -76,16 +76,16 @@ let
  };

 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "arrow-cpp";
-  version = "14.0.1";
+  version = "15.0.0";

  src = fetchurl {
-    url = "mirror://apache/arrow/arrow-${version}/apache-arrow-${version}.tar.gz";
-    hash = "sha256-XHDq+xAR+dEkuvsyiv5U9izFuSgLcIDh49Zo94wOQH4=";
+    url = "mirror://apache/arrow/arrow-${finalAttrs.version}/apache-arrow-${finalAttrs.version}.tar.gz";
+    hash = "sha256-Ad0/cOhdm1uTPsksDbik71BKUQX3jS2GIuhCeftFwl0=";
  };

-  sourceRoot = "apache-arrow-${version}/cpp";
+  sourceRoot = "apache-arrow-${finalAttrs.version}/cpp";

  # versions are all taken from
  # https://github.com/apache/arrow/blob/apache-arrow-${version}/cpp/thirdparty/versions.txt
@ -211,8 +211,8 @@ stdenv.mkDerivation rec {
  ++ lib.optionals enableS3 [ "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h" ];

  doInstallCheck = true;
-  ARROW_TEST_DATA = lib.optionalString doInstallCheck "${arrow-testing}/data";
-  PARQUET_TEST_DATA = lib.optionalString doInstallCheck "${parquet-testing}/data";
+  ARROW_TEST_DATA = lib.optionalString finalAttrs.doInstallCheck "${arrow-testing}/data";
+  PARQUET_TEST_DATA = lib.optionalString finalAttrs.doInstallCheck "${parquet-testing}/data";
  GTEST_FILTER =
    let
      # Upstream Issue: https://issues.apache.org/jira/browse/ARROW-11398
@ -236,7 +236,7 @@ stdenv.mkDerivation rec {
        "ExecPlanExecution.StressSourceSinkStopped"
      ];
    in
-    lib.optionalString doInstallCheck "-${lib.concatStringsSep ":" filteredTests}";
+    lib.optionalString finalAttrs.doInstallCheck "-${lib.concatStringsSep ":" filteredTests}";

  __darwinAllowLocalNetworking = true;

@ -244,19 +244,21 @@ stdenv.mkDerivation rec {
    ++ lib.optionals enableS3 [ minio ]
    ++ lib.optionals enableFlight [ python3 ];

-  disabledTests = [
-    # requires networking
-    "arrow-gcsfs-test"
-    "arrow-flight-integration-test"
-  ];
+  installCheckPhase =
+    let
+      disabledTests = [
+        # requires networking
+        "arrow-gcsfs-test"
+        "arrow-flight-integration-test"
+      ];
+    in
+    ''
+      runHook preInstallCheck

-  installCheckPhase = ''
-    runHook preInstallCheck
+      ctest -L unittest --exclude-regex '^(${lib.concatStringsSep "|" disabledTests})$'

-    ctest -L unittest --exclude-regex '^(${lib.concatStringsSep "|" disabledTests})$'
-
-    runHook postInstallCheck
-  '';
+      runHook postInstallCheck
+    '';

  meta = with lib; {
    description = "A cross-language development platform for in-memory data";
@ -268,4 +270,4 @@ stdenv.mkDerivation rec {
  passthru = {
    inherit enableFlight enableJemalloc enableS3 enableGcs;
  };
-}
+})
--- a/pkgs/development/libraries/c-blosc/default.nix
+++ b/pkgs/development/libraries/c-blosc/default.nix
@ -1,22 +1,69 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, testers

-stdenv.mkDerivation rec {
+, static ? stdenv.hostPlatform.isStatic
+
+, lz4
+, zlib
+, zstd
+}:
+
+stdenv.mkDerivation (finalAttrs: {
  pname = "c-blosc";
-  version = "1.21.1";
+  version = "1.21.5";

  src = fetchFromGitHub {
    owner = "Blosc";
    repo = "c-blosc";
-    rev = "v${version}";
-    sha256 = "sha256-6SKEyciwDOxcbO8chvmxrLCxLkc93zxo6eH0c/lRyT8=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-bz922lWiap3vMy8qS9dmXa8zUg5NJlg0bx3+/xz7QAk=";
  };

+  # https://github.com/NixOS/nixpkgs/issues/144170
+  postPatch = ''
+    sed -i -E \
+      -e '/^libdir[=]/clibdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
+      -e '/^includedir[=]/cincludedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@' \
+      blosc.pc.in
+  '';
+
  nativeBuildInputs = [ cmake ];

+  buildInputs = [
+    lz4
+    zlib
+    zstd
+  ];
+
+  cmakeFlags = [
+    "-DBUILD_STATIC=${if static then "ON" else "OFF"}"
+    "-DBUILD_SHARED=${if static then "OFF" else "ON"}"
+
+    "-DPREFER_EXTERNAL_LZ4=ON"
+    "-DPREFER_EXTERNAL_ZLIB=ON"
+    "-DPREFER_EXTERNAL_ZSTD=ON"
+
+    "-DBUILD_EXAMPLES=OFF"
+    "-DBUILD_BENCHMARKS=OFF"
+    "-DBUILD_TESTS=${if finalAttrs.finalPackage.doCheck then "ON" else "OFF"}"
+  ];
+
+  doCheck = !static;
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
  meta = with lib; {
    description = "A blocking, shuffling and loss-less compression library";
    homepage = "https://www.blosc.org";
+    changelog = "https://github.com/Blosc/c-blosc/releases/tag/v${version}";
+    pkgConfigModules = [
+      "blosc"
+    ];
    license = licenses.bsd3;
    platforms = platforms.all;
+    maintainers = with maintainers; [ ris ];
  };
-}
+})
--- a/pkgs/development/libraries/libgit2/default.nix
+++ b/pkgs/development/libraries/libgit2/default.nix
@ -15,6 +15,7 @@
 # for passthru.tests
 , libgit2-glib
 , python3Packages
+, gitstatus
 }:

 stdenv.mkDerivation rec {
@ -51,6 +52,7 @@ stdenv.mkDerivation rec {
  passthru.tests = {
    inherit libgit2-glib;
    inherit (python3Packages) pygit2;
+    inherit gitstatus;
  };

  meta = with lib; {
--- a/pkgs/development/libraries/onnxruntime/0001-eigen-allow-dependency-injection.patch
+++ b/pkgs/development/libraries/onnxruntime/0001-eigen-allow-dependency-injection.patch
@ -0,0 +1,45 @@
+From a29cffa646356228d6ec7bd7ce21fe3ab90fdd19 Mon Sep 17 00:00:00 2001
+From: Someone Serge <sergei.kozlukov@aalto.fi>
+Date: Wed, 7 Feb 2024 16:59:09 +0000
+Subject: [PATCH] eigen: allow dependency injection
+
+---
+ cmake/external/eigen.cmake | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/cmake/external/eigen.cmake b/cmake/external/eigen.cmake
+index c0f7ddc50e..996b83d18a 100644
+--- a/cmake/external/eigen.cmake
+++ b/cmake/external/eigen.cmake
+@@ -1,4 +1,3 @@
+-
+ if (onnxruntime_USE_PREINSTALLED_EIGEN)
+     add_library(eigen INTERFACE)
+     file(TO_CMAKE_PATH ${eigen_SOURCE_PATH} eigen_INCLUDE_DIRS)
+@@ -10,14 +9,21 @@ else ()
+             URL ${DEP_URL_eigen}
+             URL_HASH SHA1=${DEP_SHA1_eigen}
+             PATCH_COMMAND ${Patch_EXECUTABLE} --ignore-space-change --ignore-whitespace < ${PROJECT_SOURCE_DIR}/patches/eigen/Fix_Eigen_Build_Break.patch
+            FIND_PACKAGE_ARGS NAMES Eigen3
+         )
+     else()
+         FetchContent_Declare(
+             eigen
+             URL ${DEP_URL_eigen}
+             URL_HASH SHA1=${DEP_SHA1_eigen}
+            FIND_PACKAGE_ARGS NAMES Eigen3
+         )
+     endif()
+-    FetchContent_Populate(eigen)
+-    set(eigen_INCLUDE_DIRS  "${eigen_SOURCE_DIR}")
+    FetchContent_MakeAvailable(eigen)
+    add_library(eigen ALIAS Eigen3::Eigen)
+
+    # Onnxruntime doesn't always use `eigen` as a target in
+    # `target_link_libraries`, sometimes it just uses
+    # `target_include_directories`:
+    get_target_property(eigen_INCLUDE_DIRS Eigen3::Eigen INTERFACE_INCLUDE_DIRECTORIES)
+ endif()
+-- 
+2.42.0
+
--- a/pkgs/development/libraries/onnxruntime/default.nix
+++ b/pkgs/development/libraries/onnxruntime/default.nix
@ -2,11 +2,11 @@
 , lib
 , fetchFromGitHub
 , fetchFromGitLab
-, fetchpatch
-, fetchurl
 , Foundation
 , abseil-cpp
 , cmake
+, eigen
+, gtest
 , libpng
 , nlohmann_json
 , nsync
@ -16,7 +16,6 @@
 , zlib
 , microsoft-gsl
 , iconv
-, gtest
 , protobuf_21
 , pythonSupport ? true
 }:
@ -30,25 +29,18 @@ let
    sha256 = "sha256-BYL7wxsYRI45l8C3VwxYIIocn5TzJnBtU0UZ9pHwwZw=";
  };

-  eigen = fetchFromGitLab {
-    owner = "libeigen";
-    repo = "eigen";
-    rev = "d10b27fe37736d2944630ecd7557cefa95cf87c9";
-    sha256 = "sha256-Lmco0s9gIm9sIw7lCr5Iewye3RmrHEE4HLfyzRkQCm0=";
-  };
-
  mp11 = fetchFromGitHub {
    owner = "boostorg";
    repo = "mp11";
    rev = "boost-1.79.0";
-    sha256 = "sha256-ZxgPDLvpISrjpEHKpLGBowRKGfSwTf6TBfJD18yw+LM=";
+    hash = "sha256-ZxgPDLvpISrjpEHKpLGBowRKGfSwTf6TBfJD18yw+LM=";
  };

  safeint = fetchFromGitHub {
    owner = "dcleblanc";
    repo = "safeint";
    rev = "ff15c6ada150a5018c5ef2172401cb4529eac9c0";
-    sha256 = "sha256-PK1ce4C0uCR4TzLFg+elZdSk5DdPCRhhwT3LvEwWnPU=";
+    hash = "sha256-PK1ce4C0uCR4TzLFg+elZdSk5DdPCRhhwT3LvEwWnPU=";
  };

  pytorch_cpuinfo = fetchFromGitHub {
@ -56,14 +48,14 @@ let
    repo = "cpuinfo";
    # There are no tags in the repository
    rev = "5916273f79a21551890fd3d56fc5375a78d1598d";
-    sha256 = "sha256-nXBnloVTuB+AVX59VDU/Wc+Dsx94o92YQuHp3jowx2A=";
+    hash = "sha256-nXBnloVTuB+AVX59VDU/Wc+Dsx94o92YQuHp3jowx2A=";
  };

  flatbuffers = fetchFromGitHub {
    owner = "google";
    repo = "flatbuffers";
    rev = "v1.12.0";
-    sha256 = "sha256-L1B5Y/c897Jg9fGwT2J3+vaXsZ+lfXnskp8Gto1p/Tg=";
+    hash = "sha256-L1B5Y/c897Jg9fGwT2J3+vaXsZ+lfXnskp8Gto1p/Tg=";
  };

  gtest' = gtest.overrideAttrs (oldAttrs: rec {
@ -74,44 +66,62 @@ let
      rev = "v${version}";
      hash = "sha256-LVLEn+e7c8013pwiLzJiiIObyrlbBHYaioO/SWbItPQ=";
    };
-    });
+  });
+
+  onnx = fetchFromGitHub {
+    owner = "onnx";
+    repo = "onnx";
+    rev = "refs/tags/v1.14.1";
+    hash = "sha256-ZVSdk6LeAiZpQrrzLxphMbc1b3rNUMpcxcXPP8s/5tE=";
+  };
 in
 stdenv.mkDerivation rec {
  pname = "onnxruntime";
-  version = "1.15.1";
+  version = "1.16.3";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "onnxruntime";
-    rev = "v${version}";
-    sha256 = "sha256-SnHo2sVACc++fog7Tg6f2LK/Sv/EskFzN7RZS7D113s=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-bTW9Pc3rvH+c8VIlDDEtAXyA3sajVyY5Aqr6+SxaMF4=";
    fetchSubmodules = true;
  };

+  patches = [
+    # If you stumble on these patches trying to update onnxruntime, check
+    # `git blame` and ping the introducers.
+
+    # Context: we want the upstream to
+    # - always try find_package first (FIND_PACKAGE_ARGS),
+    # - use MakeAvailable instead of the low-level Populate,
+    # - use Eigen3::Eigen as the target name (as declared by libeigen/eigen).
+    ./0001-eigen-allow-dependency-injection.patch
+  ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
    python3Packages.python
    protobuf_21
  ] ++ lib.optionals pythonSupport (with python3Packages; [
+    pip
+    python
+    pythonOutputDistHook
    setuptools
    wheel
-    pip
-    pythonOutputDistHook
  ]);

  buildInputs = [
+    eigen
    libpng
    zlib
    nlohmann_json
-    nsync
-    re2
    microsoft-gsl
-  ] ++ lib.optionals pythonSupport [
-    python3Packages.numpy
-    python3Packages.pybind11
-    python3Packages.packaging
-  ] ++ lib.optionals stdenv.isDarwin [
+  ] ++ lib.optionals pythonSupport (with python3Packages; [
+    numpy
+    pybind11
+    packaging
+  ]) ++ lib.optionals stdenv.isDarwin [
    Foundation
    iconv
  ];
@ -137,11 +147,10 @@ stdenv.mkDerivation rec {
    "-DFETCHCONTENT_QUIET=OFF"
    "-DFETCHCONTENT_SOURCE_DIR_ABSEIL_CPP=${abseil-cpp.src}"
    "-DFETCHCONTENT_SOURCE_DIR_DATE=${howard-hinnant-date}"
-    "-DFETCHCONTENT_SOURCE_DIR_EIGEN=${eigen}"
    "-DFETCHCONTENT_SOURCE_DIR_FLATBUFFERS=${flatbuffers}"
    "-DFETCHCONTENT_SOURCE_DIR_GOOGLE_NSYNC=${nsync.src}"
    "-DFETCHCONTENT_SOURCE_DIR_MP11=${mp11}"
-    "-DFETCHCONTENT_SOURCE_DIR_ONNX=${python3Packages.onnx.src}"
+    "-DFETCHCONTENT_SOURCE_DIR_ONNX=${onnx}"
    "-DFETCHCONTENT_SOURCE_DIR_PYTORCH_CPUINFO=${pytorch_cpuinfo}"
    "-DFETCHCONTENT_SOURCE_DIR_RE2=${re2.src}"
    "-DFETCHCONTENT_SOURCE_DIR_SAFEINT=${safeint}"
@ -165,14 +174,14 @@ stdenv.mkDerivation rec {

  postPatch = ''
    substituteInPlace cmake/libonnxruntime.pc.cmake.in \
-      --replace '$'{prefix}/@CMAKE_INSTALL_ @CMAKE_INSTALL_
+      --replace-fail '$'{prefix}/@CMAKE_INSTALL_ @CMAKE_INSTALL_
  '' + lib.optionalString (stdenv.hostPlatform.system == "aarch64-linux") ''
    # https://github.com/NixOS/nixpkgs/pull/226734#issuecomment-1663028691
    rm -v onnxruntime/test/optimizer/nhwc_transformer_test.cc
  '';

  postBuild = lib.optionalString pythonSupport ''
-    python ../setup.py bdist_wheel
+    ${python3Packages.python.interpreter} ../setup.py bdist_wheel
  '';

  postInstall = ''
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@ -151,7 +151,7 @@ rec {
    postInstall = ''
      ${linkPlugin { name = "platform-tools"; plugin = platform-tools; }}
      ${linkPlugin { name = "patcher"; plugin = patcher; }}
-      ${linkPlugin { name = "emulator"; plugin = emulator; }}
+      ${linkPlugin { name = "emulator"; plugin = emulator; check = includeEmulator; }}
    '';
  };

@ -171,14 +171,14 @@ rec {
    }
  ) buildToolsVersions;

-  emulator = callPackage ./emulator.nix {
+  emulator = lib.optionals includeEmulator (callPackage ./emulator.nix {
    inherit deployAndroidPackage os;
    package = check-version packages "emulator" emulatorVersion;

    postInstall = ''
      ${linkSystemImages { images = system-images; check = includeSystemImages; }}
    '';
-  };
+  });

  platforms = map (version:
    deployAndroidPackage {
@ -373,9 +373,11 @@ rec {
          ln -s $i $out/bin
      done

-      for i in ${emulator}/bin/*; do
-          ln -s $i $out/bin
-      done
+      ${lib.optionalString includeEmulator ''
+        for i in ${emulator}/bin/*; do
+            ln -s $i $out/bin
+        done
+      ''}

      find $ANDROID_SDK_ROOT/${cmdline-tools-package.path}/bin -type f -executable | while read i; do
          ln -s $i $out/bin
--- a/pkgs/development/mobile/androidenv/examples/shell-with-emulator.nix
+++ b/pkgs/development/mobile/androidenv/examples/shell-with-emulator.nix
@ -132,6 +132,39 @@ pkgs.mkShell rec {
      touch "$out"
    '';

+    shell-with-emulator-sdkmanager-excluded-packages-test = pkgs.runCommand "shell-with-emulator-sdkmanager-excluded-packages-test"
+      {
+        nativeBuildInputs = [ androidSdk jdk ];
+      } ''
+      output="$(sdkmanager --list)"
+      installed_packages_section=$(echo "''${output%%Available Packages*}" | awk 'NR>4 {print $1}')
+
+      excluded_packages=(
+        "platforms;android-23" "platforms;android-24" "platforms;android-25" "platforms;android-26" \
+        "platforms;android-27" "platforms;android-28" "platforms;android-29" "platforms;android-30" \
+        "platforms;android-31" "platforms;android-32" "platforms;android-33" \
+        "sources;android-23" "sources;android-24" "sources;android-25" "sources;android-26" \
+        "sources;android-27" "sources;android-28" "sources;android-29" "sources;android-30" \
+        "sources;android-31" "sources;android-32" "sources;android-33" "sources;android-34" \
+        "system-images;android-28" \
+        "system-images;android-29" \
+        "system-images;android-30" \
+        "system-images;android-31" \
+        "system-images;android-32" \
+        "system-images;android-33" \
+        "ndk"
+      )
+
+      for package in "''${excluded_packages[@]}"; do
+        if [[ $installed_packages_section =~ "$package" ]]; then
+          echo "$package package was installed, while it was excluded!"
+          exit 1
+        fi
+      done
+
+      touch "$out"
+    '';
+
    shell-with-emulator-avdmanager-create-avd-test = pkgs.runCommand "shell-with-emulator-avdmanager-create-avd-test" {
      nativeBuildInputs = [ androidSdk androidEmulator jdk ];
    } ''
--- a/pkgs/development/mobile/androidenv/examples/shell-without-emulator.nix
+++ b/pkgs/development/mobile/androidenv/examples/shell-without-emulator.nix
@ -0,0 +1,152 @@
+{
+  # To test your changes in androidEnv run `nix-shell android-sdk-with-emulator-shell.nix`
+
+  # If you copy this example out of nixpkgs, use these lines instead of the next.
+  # This example pins nixpkgs: https://nix.dev/tutorials/towards-reproducibility-pinning-nixpkgs.html
+  /*nixpkgsSource ? (builtins.fetchTarball {
+    name = "nixpkgs-20.09";
+    url = "https://github.com/NixOS/nixpkgs/archive/20.09.tar.gz";
+    sha256 = "1wg61h4gndm3vcprdcg7rc4s1v3jkm5xd7lw8r2f67w502y94gcy";
+    }),
+    pkgs ? import nixpkgsSource {
+    config.allowUnfree = true;
+    },
+  */
+
+  # If you want to use the in-tree version of nixpkgs:
+  pkgs ? import ../../../../.. {
+    config.allowUnfree = true;
+  }
+, config ? pkgs.config
+}:
+
+# Copy this file to your Android project.
+let
+  # Declaration of versions for everything. This is useful since these
+  # versions may be used in multiple places in this Nix expression.
+  android = {
+    versions = {
+      cmdLineToolsVersion = "11.0";
+      platformTools = "34.0.5";
+      buildTools = "34.0.0";
+    };
+    platforms = [ "34" ];
+  };
+
+  # If you copy this example out of nixpkgs, something like this will work:
+  /*androidEnvNixpkgs = fetchTarball {
+    name = "androidenv";
+    url = "https://github.com/NixOS/nixpkgs/archive/<fill me in from Git>.tar.gz";
+    sha256 = "<fill me in with nix-prefetch-url --unpack>";
+    };
+
+    androidEnv = pkgs.callPackage "${androidEnvNixpkgs}/pkgs/development/mobile/androidenv" {
+    inherit config pkgs;
+    licenseAccepted = true;
+    };*/
+
+  # Otherwise, just use the in-tree androidenv:
+  androidEnv = pkgs.callPackage ./.. {
+    inherit config pkgs;
+    # You probably need to uncomment below line to express consent.
+    # licenseAccepted = true;
+  };
+
+  sdkArgs = {
+    cmdLineToolsVersion = android.versions.cmdLineToolsVersion;
+    platformToolsVersion = android.versions.platformTools;
+    buildToolsVersions = [ android.versions.buildTools ];
+    platformVersions = android.platforms;
+    includeNDK = false;
+    includeSystemImages = false;
+    includeEmulator = false;
+
+    # Accepting more licenses declaratively:
+    extraLicenses = [
+      # Already accepted for you with the global accept_license = true or
+      # licenseAccepted = true on androidenv.
+      # "android-sdk-license"
+
+      # These aren't, but are useful for more uncommon setups.
+      "android-sdk-preview-license"
+      "android-googletv-license"
+      "android-sdk-arm-dbt-license"
+      "google-gdk-license"
+      "intel-android-extra-license"
+      "intel-android-sysimage-license"
+      "mips-android-sysimage-license"
+    ];
+  };
+
+  androidComposition = androidEnv.composeAndroidPackages sdkArgs;
+  androidSdk = androidComposition.androidsdk;
+  platformTools = androidComposition.platform-tools;
+  jdk = pkgs.jdk;
+in
+pkgs.mkShell rec {
+  name = "androidenv-example-without-emulator-demo";
+  packages = [ androidSdk platformTools jdk pkgs.android-studio ];
+
+  LANG = "C.UTF-8";
+  LC_ALL = "C.UTF-8";
+  JAVA_HOME = jdk.home;
+
+  # Note: ANDROID_HOME is deprecated. Use ANDROID_SDK_ROOT.
+  ANDROID_SDK_ROOT = "${androidSdk}/libexec/android-sdk";
+
+  shellHook = ''
+    # Write out local.properties for Android Studio.
+    cat <<EOF > local.properties
+    # This file was automatically generated by nix-shell.
+    sdk.dir=$ANDROID_SDK_ROOT
+    EOF
+  '';
+
+  passthru.tests = {
+
+    shell-without-emulator-sdkmanager-packages-test = pkgs.runCommand "shell-without-emulator-sdkmanager-packages-test"
+      {
+        nativeBuildInputs = [ androidSdk jdk ];
+      } ''
+      output="$(sdkmanager --list)"
+      installed_packages_section=$(echo "''${output%%Available Packages*}" | awk 'NR>4 {print $1}')
+      echo "installed_packages_section: ''${installed_packages_section}"
+
+      packages=(
+        "build-tools;34.0.0" "cmdline-tools;11.0" \
+        "patcher;v4" "platform-tools" "platforms;android-34"
+      )
+
+      for package in "''${packages[@]}"; do
+        if [[ ! $installed_packages_section =~ "$package" ]]; then
+          echo "$package package was not installed."
+          exit 1
+        fi
+      done
+
+      touch "$out"
+    '';
+
+    shell-without-emulator-sdkmanager-excluded-packages-test = pkgs.runCommand "shell-without-emulator-sdkmanager-excluded-packages-test"
+      {
+        nativeBuildInputs = [ androidSdk jdk ];
+      } ''
+      output="$(sdkmanager --list)"
+      installed_packages_section=$(echo "''${output%%Available Packages*}" | awk 'NR>4 {print $1}')
+
+      excluded_packages=(
+        "emulator" "ndk"
+      )
+
+      for package in "''${excluded_packages[@]}"; do
+        if [[ $installed_packages_section =~ "$package" ]]; then
+          echo "$package package was installed, while it was excluded!"
+          exit 1
+        fi
+      done
+
+      touch "$out"
+    '';
+  };
+}
+
--- a/pkgs/development/mobile/androidenv/test-suite.nix
+++ b/pkgs/development/mobile/androidenv/test-suite.nix
@ -1,9 +1,11 @@
-{callPackage, lib, stdenv}:
+{ callPackage, lib, stdenv }:
 let
-  examples-shell = callPackage ./examples/shell.nix {};
-  examples-shell-with-emulator = callPackage ./examples/shell-with-emulator.nix {};
+  examples-shell = callPackage ./examples/shell.nix { };
+  examples-shell-with-emulator = callPackage ./examples/shell-with-emulator.nix { };
+  examples-shell-without-emulator = callPackage ./examples/shell-without-emulator.nix { };
  all-tests = examples-shell.passthru.tests //
-    examples-shell-with-emulator.passthru.tests;
+    (examples-shell-with-emulator.passthru.tests //
+      examples-shell-without-emulator.passthru.tests);
 in
 stdenv.mkDerivation {
  name = "androidenv-test-suite";
--- a/pkgs/development/mobile/androidenv/tools.nix
+++ b/pkgs/development/mobile/androidenv/tools.nix
@ -1,7 +1,7 @@
 {deployAndroidPackage, lib, package, autoPatchelfHook, makeWrapper, os, pkgs, pkgsi686Linux, postInstall}:

 deployAndroidPackage {
-  name = "androidsdk";
+  name = "androidsdk-tools";
  inherit os package;
  nativeBuildInputs = [ makeWrapper ]
    ++ lib.optionals (os == "linux") [ autoPatchelfHook ];
--- a/pkgs/development/ocaml-modules/capnp/default.nix
+++ b/pkgs/development/ocaml-modules/capnp/default.nix
@ -0,0 +1,56 @@
+{ lib
+, buildDunePackage
+, fetchFromGitHub
+, base_quickcheck ? null
+, capnproto
+, ocplib-endian
+, ounit2
+, res
+, result
+, stdint
+, stdio
+}:
+
+buildDunePackage rec {
+  pname = "capnp";
+  version = "3.6.0";
+
+  minimalOCamlVersion = "4.08";
+
+  src = fetchFromGitHub {
+    owner = "capnproto";
+    repo = "capnp-ocaml";
+    rev = "v${version}";
+    hash = "sha256-G4B1llsHnGcuGIarDB248QMaRBvS47IEQB5B93wY7nA=";
+  };
+
+  nativeBuildInputs = [
+    capnproto
+  ];
+
+  buildInputs = [
+    stdio
+  ];
+
+  propagatedBuildInputs = [
+    ocplib-endian
+    res
+    result
+    stdint
+  ];
+
+  checkInputs = [
+    base_quickcheck
+    ounit2
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "OCaml code generation plugin for the Cap'n Proto serialization framework";
+    homepage = "https://github.com/capnproto/capnp-ocaml";
+    changelog = "https://github.com/capnproto/capnp-ocaml/blob/${version}/CHANGES.md";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ sixstring982 ];
+  };
+}
--- a/pkgs/development/ocaml-modules/res/default.nix
+++ b/pkgs/development/ocaml-modules/res/default.nix
@ -0,0 +1,24 @@
+{ lib , fetchurl , buildDunePackage }:
+
+buildDunePackage rec {
+  pname = "res";
+  version = "5.0.1";
+
+  minimalOCamlVersion = "4.08";
+
+  src = fetchurl {
+    url = "https://github.com/mmottl/res/releases/download/${version}/res-${version}.tbz";
+    hash = "sha256-rSrDMQBfnbWAr2LuajP3fveOtOwLyRbKPkaTKsnocQ4=";
+  };
+
+  doCheck = true;
+
+  meta = {
+    description = "Library for resizable, contiguous datastructures";
+    homepage = "https://github.com/mmottl/res";
+    changelog = "https://github.com/mmottl/res/blob/${version}/CHANGES.md";
+    license = lib.licenses.lgpl2Plus;
+    maintainers = with lib.maintainers; [ sixstring982 ];
+  };
+}
+
--- a/pkgs/development/python-modules/aio-georss-client/default.nix
+++ b/pkgs/development/python-modules/aio-georss-client/default.nix
@ -1,6 +1,6 @@
 { lib
 , aiohttp
-, aresponses
+, aioresponses
 , buildPythonPackage
 , dateparser
 , fetchFromGitHub
@ -10,23 +10,30 @@
 , pytestCheckHook
 , pythonOlder
 , requests
+, setuptools
 , xmltodict
 }:

 buildPythonPackage rec {
  pname = "aio-georss-client";
-  version = "0.11";
-  format = "setuptools";
+  version = "0.12";
+  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "exxamalte";
    repo = "python-aio-georss-client";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Voc1ME0iGQCMaDfBXDSVnRp8olvId+fLhH8sqHwB2Ak=";
+    hash = "sha256-qs0/TkGZlwsucnkgCBco2Pqr9mf5fZHY7ikMBKff+gA=";
  };

+  __darwinAllowLocalNetworking = true;
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    aiohttp
    haversine
@ -35,10 +42,8 @@ buildPythonPackage rec {
    dateparser
  ];

-  __darwinAllowLocalNetworking = true;
-
  nativeCheckInputs = [
-    aresponses
+    aioresponses
    mock
    pytest-asyncio
    pytestCheckHook
--- a/pkgs/development/python-modules/aio-georss-gdacs/default.nix
+++ b/pkgs/development/python-modules/aio-georss-gdacs/default.nix
@ -1,37 +1,42 @@
 { lib
 , aio-georss-client
-, aresponses
+, aioresponses
 , buildPythonPackage
 , dateparser
 , fetchFromGitHub
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "aio-georss-gdacs";
-  version = "0.8";
-  format = "setuptools";
+  version = "0.9";
+  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "exxamalte";
    repo = "python-aio-georss-gdacs";
    rev = "refs/tags/v${version}";
-    hash = "sha256-1mpOWd4Z2gTQtRewWfZsfEtmS6i5uMPAMTlC8UpawxM=";
+    hash = "sha256-B0qVCh2u0WleF0iv0o1/d5UIS2kbYCAqCgmNHyCpJ8Q=";
  };

+  __darwinAllowLocalNetworking = true;
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    aio-georss-client
    dateparser
  ];

-  __darwinAllowLocalNetworking = true;
-
  nativeCheckInputs = [
-    aresponses
+    aioresponses
    pytest-asyncio
    pytestCheckHook
  ];
--- a/pkgs/development/python-modules/blebox-uniapi/default.nix
+++ b/pkgs/development/python-modules/blebox-uniapi/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , aiohttp
 , semver
 , deepmerge
@ -11,8 +12,8 @@

 buildPythonPackage rec {
  pname = "blebox-uniapi";
-  version = "2.2.1";
-  format = "setuptools";
+  version = "2.2.2";
+  pyproject = true;

  disabled = pythonOlder "3.9";

@ -20,14 +21,18 @@ buildPythonPackage rec {
    owner = "blebox";
    repo = "blebox_uniapi";
    rev = "refs/tags/v${version}";
-    hash = "sha256-aVYk/N8dH0jc9BLQ2nZXulMCUqwEWpSX/JTiAxdn2sM=";
+    hash = "sha256-q1plIIcPY94zRD17srz5vMJzkk6K/xbbNIRB6zLlUo0=";
  };

  postPatch = ''
    substituteInPlace setup.py \
-      --replace "pytest-runner" ""
+      --replace-fail "pytest-runner" ""
  '';

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    aiohttp
    semver
--- a/pkgs/development/python-modules/bluecurrent-api/default.nix
+++ b/pkgs/development/python-modules/bluecurrent-api/default.nix
@ -0,0 +1,54 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, pythonRelaxDepsHook
+, setuptools
+, pytz
+, websockets
+, pytest-asyncio
+, pytest-mock
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "bluecurrent-api";
+  version = "1.0.6";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-XHVdtkiG0ff/OY8g+W5iur7OAyhhk1UGA+XUfB2L8/o=";
+  };
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  pythonRemoveDeps = [
+    "asyncio"
+  ];
+
+  propagatedBuildInputs = [
+    pytz
+    websockets
+  ];
+
+  pythonImportsCheck = [ "bluecurrent_api" ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Wrapper for the Blue Current websocket api";
+    homepage = "https://github.com/bluecurrent/HomeAssistantAPI";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@ -365,14 +365,14 @@

 buildPythonPackage rec {
  pname = "boto3-stubs";
-  version = "1.34.35";
+  version = "1.34.36";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-kXJa7GEJ+bTR03pQ58lHjOnK9B1b196+gKMew+H4SlA=";
+    hash = "sha256-AvhzNyVC7Seap0a5kIX5UyAyhUeyp7A0R7bZAMZ5XtI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.34.35";
+  version = "1.34.36";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-312PNpggpky4TxJKKEG2IDDz6Gtr0HlJN276sxw4RcU=";
+    hash = "sha256-+VvELnYPQr54AgvmqJ6lzrMHtgRzDiyiVdmMrkhoM40=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cmdstanpy/default.nix
+++ b/pkgs/development/python-modules/cmdstanpy/default.nix
@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , substituteAll
-, fetchpatch
 , cmdstan
 , pythonRelaxDepsHook
 , setuptools
@ -17,14 +16,14 @@

 buildPythonPackage rec {
  pname = "cmdstanpy";
-  version = "1.2.0";
+  version = "1.2.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "stan-dev";
    repo = "cmdstanpy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-1/X5JDvCx21qLNamNQXpg+w3d3DdSRlB+liIv2fThs4=";
+    hash = "sha256-q+AFhWEzjYElJpiHT4h6YfZrwZJ56pv+8R+001vREyQ=";
  };

  patches = [
@ -32,11 +31,6 @@ buildPythonPackage rec {
      src = ./use-nix-cmdstan-path.patch;
      cmdstan = "${cmdstan}/opt/cmdstan";
    })
-    (fetchpatch {
-      name = "stan-2.34-fix-parsing-of-unit_e-output-files.patch";
-      url = "https://github.com/stan-dev/cmdstanpy/commit/144d641739ccd1109055d13b5b96e4e76607305d.patch";
-      hash = "sha256-21hcbK3Xs7vGBNRs4hMfY5g7jIwEG49WYnsOxYJ6ccs=";
-    })
  ];

  postPatch = ''
@ -77,7 +71,6 @@ buildPythonPackage rec {
  ];

  disabledTests = [
-    "test_lp_good" # Fails for some reason
    "test_serialization" # Pickle class mismatch errors
    # These tests use the flag -DSTAN_THREADS which doesn't work in cmdstan (missing file)
    "test_multi_proc_threads"
--- a/pkgs/development/python-modules/comicon/default.nix
+++ b/pkgs/development/python-modules/comicon/default.nix
@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
+, pythonRelaxDepsHook
 , ebooklib
 , lxml
 , pillow
@ -10,18 +11,24 @@

 buildPythonPackage rec {
  pname = "comicon";
-  version = "1.0.0";
-  format = "pyproject";
+  version = "1.0.1";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "potatoeggy";
    repo = "comicon";
    rev = "v${version}";
-    hash = "sha256-D6nK+GlcG/XqMTH7h7mJcbZCRG2xDHRsnooSTtphDNs=";
+    hash = "sha256-e9YEr8IwttMlj6FOxk+/kw79qiF1N8/e2qusfw3WH00=";
  };

  nativeBuildInputs = [
    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "lxml"
+    "pillow"
  ];

  propagatedBuildInputs = [
@ -34,6 +41,7 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "comicon" ];

  meta = with lib; {
+    changelog = "https://github.com/potatoeggy/comicon/releases/tag/v${version}";
    description = "Lightweight comic converter library between CBZ, PDF, and EPUB";
    homepage = "https://github.com/potatoeggy/comicon";
    license = licenses.agpl3Only;
--- a/pkgs/development/python-modules/courlan/default.nix
+++ b/pkgs/development/python-modules/courlan/default.nix
@ -0,0 +1,54 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, langcodes
+, pytestCheckHook
+, tld
+, urllib3
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "courlan";
+  version = "0.9.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-ONw1suO/H11RbQDVGsEuveVD40F8a+b2oic8D8W1s1M=";
+  };
+
+  propagatedBuildInputs = [
+    langcodes
+    tld
+    urllib3
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  # disable tests that require an internet connection
+  disabledTests = [
+    "test_urlcheck"
+  ];
+
+  # nixify path to the courlan binary in the test suite
+  postPatch = ''
+    substituteInPlace tests/unit_tests.py \
+      --replace "\"courlan --help\"" "\"$out/bin/courlan --help\"" \
+      --replace "courlan_bin = \"courlan\"" "courlan_bin = \"$out/bin/courlan\""
+  '';
+
+  pythonImportsCheck = [ "courlan" ];
+
+  meta = with lib; {
+    description = "Clean, filter and sample URLs to optimize data collection";
+    homepage = "https://github.com/adbar/courlan";
+    changelog = "https://github.com/adbar/courlan/blob/v${version}/HISTORY.md";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ jokatzke ];
+  };
+}
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "django";
-  version = "3.2.23";
+  version = "3.2.24";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    pname = "Django";
    inherit version;
-    hash = "sha256-gpaPNkDinvSnc68sKESPX3oI0AHGrAWzLQKu7mUJUIs=";
+    hash = "sha256-qu6fsPtOvUMRUgiHrS4zMT02iEZgf4KpoO1GHNTDWxg=";
  };

  patches = [
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@ -42,14 +42,14 @@

 buildPythonPackage rec {
  pname = "Django";
-  version = "5.0.1";
+  version = "5.0.2";
  pyproject = true;

  disabled = pythonOlder "3.10";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-jIZZZlvG46RP7+GrCikeWj+zl5+agjC+Kd6XXlfo+FQ=";
+    hash = "sha256-tbsdEbJRil+RNyooLyRmL1j2Z0lmawooarBXAp9ygIA=";
  };

  patches = [
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-pubsub";
-  version = "2.19.0";
+  version = "2.19.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-apjDP361994q5S76BZsrX3WyzNnw8R8u3O/dqNFOQlw=";
+    hash = "sha256-wQ2V66+QP5I7FKqOxbfICRYTjt8pnGWhwalDH9VmXSU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@ -6,6 +6,7 @@
 , google-cloud-core
 , google-cloud-testutils
 , grpc-google-iam-v1
+, grpc-interceptor
 , libcst
 , mock
 , proto-plus
@ -19,14 +20,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-spanner";
-  version = "3.41.0";
+  version = "3.42.0";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-jK2hHdYdxwsEmk/aDp7ArXZwZbhEloqIuLJ2ZwMs9YI=";
+    hash = "sha256-E7arqGBZ/QPzbAMsQUMnTWiD054tMr91PgrT0tzQjhI=";
  };

  nativeBuildInputs = [
@ -38,6 +39,7 @@ buildPythonPackage rec {
    google-api-core
    google-cloud-core
    grpc-google-iam-v1
+    grpc-interceptor
    proto-plus
    protobuf
    sqlparse
--- a/pkgs/development/python-modules/grpc-interceptor/default.nix
+++ b/pkgs/development/python-modules/grpc-interceptor/default.nix
@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pythonOlder
 , poetry-core
 , grpcio
@ -12,8 +11,8 @@

 buildPythonPackage rec {
  pname = "grpc-interceptor";
-  version = "0.15.3";
-  format = "pyproject";
+  version = "0.15.4";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@ -21,18 +20,9 @@ buildPythonPackage rec {
    owner = "d5h-foss";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-tTi1X1r7584ZXa12eLp2G/Am8G6Dnd18eE5wF/Lp/EY=";
+    hash = "sha256-GJkVCslPXShJNDrqhFtCsAK5+VaG8qFJo0RQTsiMIFY=";
  };

-  patches = [
-    # https://github.com/d5h-foss/grpc-interceptor/pull/44
-    (fetchpatch {
-      name = "replace-poetry-with-poetry-core.patch";
-      url = "https://github.com/d5h-foss/grpc-interceptor/commit/916cb394acd8dd7abb4f5edcb4e88aee961a32d0.patch";
-      hash = "sha256-W2SF2zyjusTxgvCxBDLpisD03bofzDug1eyd4FLJmKs=";
-    })
-  ];
-
  nativeBuildInputs = [
    poetry-core
  ];
--- a/pkgs/development/python-modules/gudhi/default.nix
+++ b/pkgs/development/python-modules/gudhi/default.nix
@ -2,6 +2,7 @@
 , fetchFromGitHub
 , buildPythonPackage
 , cmake
+, setuptools
 , boost
 , eigen
 , gmp
@ -19,37 +20,44 @@

 buildPythonPackage rec {
  pname = "gudhi";
-  version = "3.8.0";
-  format = "setuptools";
+  version = "3.9.0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "GUDHI";
    repo = "gudhi-devel";
    rev = "tags/gudhi-release-${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-f2ajy4muG9vuf4JarGWZmdk/LF9OYd2KLSaGyY6BQrY=";
+    hash = "sha256-VL6RIPe8a2/cUHnHOql9e9EUMBB9QU311kMCaMZTbGI=";
  };

-  patches = [ ./remove_explicit_PYTHONPATH.patch ];
-
-  nativeBuildInputs = [ cmake numpy cython pybind11 matplotlib ];
+  nativeBuildInputs = [ cmake numpy cython pybind11 matplotlib setuptools ];
  buildInputs = [ boost eigen gmp cgal mpfr ]
    ++ lib.optionals enableTBB [ tbb ];
  propagatedBuildInputs = [ numpy scipy ];
  nativeCheckInputs = [ pytest ];

  cmakeFlags = [
-    "-DWITH_GUDHI_PYTHON=ON"
-    "-DPython_ADDITIONAL_VERSIONS=3"
+    (lib.cmakeBool "WITH_GUDHI_PYTHON" true)
+    (lib.cmakeFeature "Python_ADDITIONAL_VERSIONS" "3")
  ];

+  prePatch = ''
+    substituteInPlace src/python/CMakeLists.txt \
+      --replace '"''${GUDHI_PYTHON_PATH_ENV}"' ""
+  '';
+
  preBuild = ''
    cd src/python
  '';

  checkPhase = ''
+    runHook preCheck
+
    rm -r gudhi
-    ${cmake}/bin/ctest --output-on-failure
+    ctest --output-on-failure
+
+    runHook postCheck
  '';

  pythonImportsCheck = [ "gudhi" "gudhi.hera" "gudhi.point_cloud" "gudhi.clustering" ];
--- a/pkgs/development/python-modules/gudhi/remove_explicit_PYTHONPATH.patch
+++ b/pkgs/development/python-modules/gudhi/remove_explicit_PYTHONPATH.patch
@ -1,195 +0,0 @@
-diff --git a/src/python/CMakeLists.txt b/src/python/CMakeLists.txt
-index 86a409b6..09544fb5 100644
--- a/src/python/CMakeLists.txt
-+++ b/src/python/CMakeLists.txt
-@@ -329,15 +329,6 @@ if(PYTHONINTERP_FOUND)
-         WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-         COMMAND ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_BINARY_DIR}/setup.py" "build_ext" "--inplace")
- 
-    add_custom_target(python ALL DEPENDS gudhi.so
-                      COMMENT "Do not forget to add ${CMAKE_CURRENT_BINARY_DIR}/ to your PYTHONPATH before using examples or tests")
-
-    # Path separator management for windows
-    if (WIN32)
-      set(GUDHI_PYTHON_PATH_ENV "PYTHONPATH=${CMAKE_CURRENT_BINARY_DIR};$ENV{PYTHONPATH}")
-    else(WIN32)
-      set(GUDHI_PYTHON_PATH_ENV "PYTHONPATH=${CMAKE_CURRENT_BINARY_DIR}:$ENV{PYTHONPATH}")
-    endif(WIN32)
-     # Documentation generation is available through sphinx - requires all modules
-     # Make it first as sphinx test is by far the longest test which is nice when testing in parallel
-     if(SPHINX_PATH)
-@@ -358,13 +349,13 @@ if(PYTHONINTERP_FOUND)
-                       # sphinx target requires gudhi.so, because conf.py reads gudhi version from it
-                       add_custom_target(sphinx
-                           WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/doc
-                          COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+                          COMMAND ${CMAKE_COMMAND} -E env
-                           ${SPHINX_PATH} -b html ${CMAKE_CURRENT_SOURCE_DIR}/doc ${CMAKE_CURRENT_BINARY_DIR}/sphinx
-                           DEPENDS "${CMAKE_CURRENT_BINARY_DIR}/gudhi.so"
-                           COMMENT "${GUDHI_SPHINX_MESSAGE}" VERBATIM)
-                       add_test(NAME sphinx_py_test
-                                WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-                               COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+                               COMMAND ${CMAKE_COMMAND} -E env
-                                ${SPHINX_PATH} -b doctest ${CMAKE_CURRENT_SOURCE_DIR}/doc ${CMAKE_CURRENT_BINARY_DIR}/doctest)
-                       # Set missing or not modules
-                       set(GUDHI_MODULES ${GUDHI_MODULES} "python-documentation" CACHE INTERNAL "GUDHI_MODULES")
-@@ -408,13 +399,13 @@ if(PYTHONINTERP_FOUND)
-     # Cubical
-     add_test(NAME periodic_cubical_complex_barcode_persistence_from_perseus_file_example_py_test
-              WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-             COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+             COMMAND ${CMAKE_COMMAND} -E env
-              ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/periodic_cubical_complex_barcode_persistence_from_perseus_file_example.py"
-              --no-barcode -f ${CMAKE_SOURCE_DIR}/data/bitmap/CubicalTwoSphere.txt)
- 
-     add_test(NAME random_cubical_complex_persistence_example_py_test
-              WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-             COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+             COMMAND ${CMAKE_COMMAND} -E env
-              ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/random_cubical_complex_persistence_example.py"
-              10 10 10)
- 
-@@ -426,7 +417,7 @@ if(PYTHONINTERP_FOUND)
- 
-       add_test(NAME cubical_complex_sklearn_itf_py_test
-                WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-               COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+               COMMAND ${CMAKE_COMMAND} -E env
-                ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/cubical_complex_sklearn_itf.py")
-     endif()
- 
-@@ -435,7 +426,7 @@ if(PYTHONINTERP_FOUND)
-       # Bottleneck and Alpha
-       add_test(NAME alpha_rips_persistence_bottleneck_distance_py_test
-                WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-               COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+               COMMAND ${CMAKE_COMMAND} -E env
-                ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/alpha_rips_persistence_bottleneck_distance.py"
-                -f ${CMAKE_SOURCE_DIR}/data/points/tore3D_300.off -t 0.15 -d 3)
-     endif (NOT CGAL_WITH_EIGEN3_VERSION VERSION_LESS 5.1.0)
-@@ -443,7 +434,7 @@ if(PYTHONINTERP_FOUND)
-       # Tangential
-       add_test(NAME tangential_complex_plain_homology_from_off_file_example_py_test
-                WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-               COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+               COMMAND ${CMAKE_COMMAND} -E env
-                ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/tangential_complex_plain_homology_from_off_file_example.py"
-                --no-diagram -i 2 -f ${CMAKE_SOURCE_DIR}/data/points/tore3D_300.off)
- 
-@@ -452,13 +443,13 @@ if(PYTHONINTERP_FOUND)
-       # Witness complex
-       add_test(NAME euclidean_strong_witness_complex_diagram_persistence_from_off_file_example_py_test
-                WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-               COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+               COMMAND ${CMAKE_COMMAND} -E env
-                ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/euclidean_strong_witness_complex_diagram_persistence_from_off_file_example.py"
-                --no-diagram -f ${CMAKE_SOURCE_DIR}/data/points/tore3D_300.off -a 1.0 -n 20 -d 2)
- 
-       add_test(NAME euclidean_witness_complex_diagram_persistence_from_off_file_example_py_test
-                WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-               COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+               COMMAND ${CMAKE_COMMAND} -E env
-                ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/euclidean_witness_complex_diagram_persistence_from_off_file_example.py"
-                --no-diagram -f ${CMAKE_SOURCE_DIR}/data/points/tore3D_300.off -a 1.0 -n 20 -d 2)
- 
-@@ -467,7 +458,7 @@ if(PYTHONINTERP_FOUND)
-       # Bottleneck
-       add_test(NAME bottleneck_basic_example_py_test
-                WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-               COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+               COMMAND ${CMAKE_COMMAND} -E env
-                ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/bottleneck_basic_example.py")
- 
-       add_gudhi_py_test(test_bottleneck_distance)
-@@ -479,26 +470,26 @@ if(PYTHONINTERP_FOUND)
-     file(COPY ${CMAKE_SOURCE_DIR}/data/points/COIL_database/lucky_cat_PCA1 DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/)
-     add_test(NAME cover_complex_nerve_example_py_test
-              WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-             COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+             COMMAND ${CMAKE_COMMAND} -E env
-              ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/nerve_of_a_covering.py"
-              -f human.off -c 2 -r 10 -g 0.3)
- 
-     add_test(NAME cover_complex_coordinate_gic_example_py_test
-              WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-             COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+             COMMAND ${CMAKE_COMMAND} -E env
-              ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/coordinate_graph_induced_complex.py"
-              -f human.off -c 0 -v)
- 
-     add_test(NAME cover_complex_functional_gic_example_py_test
-              WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-             COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+             COMMAND ${CMAKE_COMMAND} -E env
-              ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/functional_graph_induced_complex.py"
-              -o lucky_cat.off
-              -f lucky_cat_PCA1 -v)
- 
-     add_test(NAME cover_complex_voronoi_gic_example_py_test
-              WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-             COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+             COMMAND ${CMAKE_COMMAND} -E env
-              ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/voronoi_graph_induced_complex.py"
-              -f human.off -n 700 -v)
- 
-@@ -506,15 +497,15 @@ if(PYTHONINTERP_FOUND)
-       # Alpha
-       add_test(NAME alpha_complex_from_points_example_py_test
-                WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-               COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+               COMMAND ${CMAKE_COMMAND} -E env
-                ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/alpha_complex_from_points_example.py")
-       add_test(NAME alpha_complex_from_generated_points_on_sphere_example_py_test
-                WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-               COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+               COMMAND ${CMAKE_COMMAND} -E env
-                ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/alpha_complex_from_generated_points_on_sphere_example.py")
-       add_test(NAME alpha_complex_diagram_persistence_from_off_file_example_py_test
-              WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-             COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+             COMMAND ${CMAKE_COMMAND} -E env
-              ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/alpha_complex_diagram_persistence_from_off_file_example.py"
-              --no-diagram -f ${CMAKE_SOURCE_DIR}/data/points/tore3D_300.off)
-       add_gudhi_py_test(test_alpha_complex)
-@@ -532,19 +523,19 @@ if(PYTHONINTERP_FOUND)
-     # Rips
-     add_test(NAME rips_complex_diagram_persistence_from_distance_matrix_file_example_py_test
-              WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-             COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+             COMMAND ${CMAKE_COMMAND} -E env
-              ${PYTHON_EXECUTABLE} "${CMAKE_CURRENT_SOURCE_DIR}/example/rips_complex_diagram_persistence_from_distance_matrix_file_example.py"
-              --no-diagram -f ${CMAKE_SOURCE_DIR}/data/distance_matrix/lower_triangular_distance_matrix.csv -s , -e 12.0 -d 3)
- 
-     add_test(NAME rips_complex_diagram_persistence_from_off_file_example_py_test
-              WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-             COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+             COMMAND ${CMAKE_COMMAND} -E env
-              ${PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/example/rips_complex_diagram_persistence_from_off_file_example.py
-              --no-diagram -f ${CMAKE_SOURCE_DIR}/data/points/tore3D_300.off  -e 0.25 -d 3)
- 
-     add_test(NAME rips_complex_from_points_example_py_test
-              WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-             COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+             COMMAND ${CMAKE_COMMAND} -E env
-              ${PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/example/rips_complex_from_points_example.py)
- 
-     add_gudhi_py_test(test_rips_complex)
-@@ -552,7 +543,7 @@ if(PYTHONINTERP_FOUND)
-     # Simplex tree
-     add_test(NAME simplex_tree_example_py_test
-              WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-             COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+             COMMAND ${CMAKE_COMMAND} -E env
-              ${PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/example/simplex_tree_example.py)
- 
-     add_gudhi_py_test(test_simplex_tree)
-@@ -565,7 +556,7 @@ if(PYTHONINTERP_FOUND)
-     # Witness
-     add_test(NAME witness_complex_from_nearest_landmark_table_py_test
-              WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-             COMMAND ${CMAKE_COMMAND} -E env "${GUDHI_PYTHON_PATH_ENV}"
-+             COMMAND ${CMAKE_COMMAND} -E env
-              ${PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/example/witness_complex_from_nearest_landmark_table.py)
- 
-     add_gudhi_py_test(test_witness_complex)
--- a/pkgs/development/python-modules/htmldate/default.nix
+++ b/pkgs/development/python-modules/htmldate/default.nix
@ -0,0 +1,56 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, charset-normalizer
+, dateparser
+, lxml
+, pytestCheckHook
+, python-dateutil
+, urllib3
+, backports-datetime-fromisoformat
+}:
+
+buildPythonPackage rec {
+  pname = "htmldate";
+  version = "1.6.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-WCfI9iahaACinlfoGIo9MtCwjKTHvWYlN7c7u/IsRaY=";
+  };
+
+  propagatedBuildInputs = [
+    charset-normalizer
+    dateparser
+    lxml
+    python-dateutil
+    urllib3
+  ] ++ lib.optionals (pythonOlder "3.7") [
+    backports-datetime-fromisoformat
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  # disable tests that require an internet connection
+  disabledTests = [
+    "test_input"
+    "test_cli"
+    "test_download"
+  ];
+
+  pythonImportsCheck = [ "htmldate" ];
+
+  meta = with lib; {
+    description = "Fast and robust extraction of original and updated publication dates from URLs and web pages";
+    homepage = "https://htmldate.readthedocs.io";
+    changelog = "https://github.com/adbar/htmldate/blob/v${version}/CHANGELOG.md";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ jokatzke ];
+  };
+}
--- a/pkgs/development/python-modules/justext/default.nix
+++ b/pkgs/development/python-modules/justext/default.nix
@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, lxml
+}:
+
+buildPythonPackage rec {
+  pname = "justext";
+  version = "3.0.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "miso-belica";
+    repo = "jusText";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-WNxDoM5666tEHS9pMl5dOoig4S7dSYaCLZq71tehWqw=";
+  };
+
+  propagatedBuildInputs = [
+    lxml
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  # patch out coverage report
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace " --cov=justext --cov-report=term-missing --no-cov-on-fail" ""
+  '';
+
+  pythonImportsCheck = [ "justext" ];
+
+  meta = with lib; {
+    description = "Heuristic based boilerplate removal tool";
+    homepage = "https://github.com/miso-belica/jusText";
+    changelog = "https://github.com/miso-belica/jusText/blob/v${version}/CHANGELOG.rst";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ jokatzke ];
+  };
+}
--- a/pkgs/development/python-modules/mandown/default.nix
+++ b/pkgs/development/python-modules/mandown/default.nix
@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
+, pythonRelaxDepsHook
 , beautifulsoup4
 , comicon
 , feedparser
@ -18,7 +19,7 @@
 buildPythonPackage rec {
  pname = "mandown";
  version = "1.7.0";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "potatoeggy";
@ -29,6 +30,12 @@ buildPythonPackage rec {

  nativeBuildInputs = [
    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "pillow"
+    "typer"
  ];

  propagatedBuildInputs = [
@ -50,13 +57,10 @@ buildPythonPackage rec {
    ];
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml --replace 'typer = "^0.7.0"' 'typer = "^0"'
-  '';
-
  pythonImportsCheck = [ "mandown" ];

  meta = with lib; {
+    changelog = "https://github.com/potatoeggy/mandown/releases/tag/v${version}";
    description = "Comic/manga/webtoon downloader and CBZ/EPUB/MOBI/PDF converter";
    homepage = "https://github.com/potatoeggy/mandown";
    license = licenses.agpl3Only;
--- a/Show More
+++ b/Show More