Merge staging-next into staging

2024-07-13 00:02:49 +00:00 · 2024-07-13 00:02:49 +00:00 · 345035df51
commit 345035df51
parent 1275c3f884 efdfac4a0d
88 changed files with 1388 additions and 238 deletions
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@ -24,7 +24,7 @@ jobs:
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Create backport PRs
-        uses: korthout/backport-action@ef20d86abccbac3ee3a73cb2efbdc06344c390e5 # v2.5.0
+        uses: korthout/backport-action@bd410d37cdcae80be6d969823ff5a225fe5c833f # v3.0.2
        with:
          # Config README: https://github.com/korthout/backport-action#backport-action
          copy_labels_pattern: 'severity:\ssecurity'
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@ -46,7 +46,7 @@ jobs:
        run: |
          git clean -f
      - name: create PR
-        uses: peter-evans/create-pull-request@9153d834b60caba6d51c9b9510b087acf9f33f83 # v6.0.4
+        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
        with:
          body: |
            Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.
--- a/pkgs/applications/backup/deja-dup/default.nix
+++ b/pkgs/applications/backup/deja-dup/default.nix
@ -18,18 +18,19 @@
 , libgpg-error
 , json-glib
 , duplicity
+, rclone
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "deja-dup";
-  version = "45.2";
+  version = "46.1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "deja-dup";
    rev = finalAttrs.version;
-    hash = "sha256-nscswpWX6UB1zuv6TXcT3YE1wkREJYDGQrEPryyUYUM=";
+    hash = "sha256-tKVY0wewBDx0AMzmTdko8vGg5bNGfYohgcSDg5Oky30=";
  };

  patches = [
@ -61,9 +62,17 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  mesonFlags = [
-    "-Dduplicity_command=${duplicity}/bin/duplicity"
+    "-Dduplicity_command=${lib.getExe duplicity}"
+    "-Drclone_command=${lib.getExe rclone}"
  ];

+  preFixup = ''
+    gappsWrapperArgs+=(
+      # Required by duplicity
+      --prefix PATH : "${lib.makeBinPath [ rclone ]}"
+    )
+  '';
+
  meta = with lib; {
    description = "Simple backup tool";
    longDescription = ''
--- a/pkgs/applications/backup/deja-dup/fix-paths.patch
+++ b/pkgs/applications/backup/deja-dup/fix-paths.patch
@ -1,11 +1,13 @@
 --- a/libdeja/duplicity/DuplicityInstance.vala
 +++ b/libdeja/duplicity/DuplicityInstance.vala
-@@ -114,7 +114,7 @@ internal class DuplicityInstance : Object
+@@ -114,8 +114,8 @@ internal class DuplicityInstance : Object
     // We already are pretty sure we don't have other duplicities in our
     // archive directories, because we use our own and we ensure we only have
     // one deja-dup running at a time via DBus.
-    Posix.system("/bin/rm -f " + Shell.quote(cache_dir) + "/*/lockfile.lock");
-+    Posix.system("@coreutils@/bin/rm -f " + Shell.quote(cache_dir) + "/*/lockfile.lock");
+     var lockfile_glob = Shell.quote(cache_dir) + "/*/lockfile.lock";
+-    if (Posix.system("/bin/rm -f " + lockfile_glob) != 0)
+    if (Posix.system("@coreutils@/bin/rm -f " + lockfile_glob) != 0)
+       warning("Could not delete '%s'", lockfile_glob);
 
     Process.spawn_async_with_pipes(null, real_argv, real_envp,
                         SpawnFlags.SEARCH_PATH |
--- a/pkgs/applications/editors/pixelorama/default.nix
+++ b/pkgs/applications/editors/pixelorama/default.nix
@ -69,6 +69,7 @@ in stdenv.mkDerivation (finalAttrs: {
    install -D -m 755 -t $out/libexec ./build/pixelorama
    install -D -m 644 -t $out/libexec ./build/pixelorama.pck
    install -D -m 644 -t $out/share/applications ./Misc/Linux/com.orama_interactive.Pixelorama.desktop
+    install -D -m 644 -T ./assets/graphics/icons/icon.png $out/share/icons/hicolor/256x256/apps/pixelorama.png
    install -d -m 755 $out/bin
    ln -s $out/libexec/pixelorama $out/bin/pixelorama

--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -3665,8 +3665,8 @@ let
        mktplcRef = {
          name = "phind";
          publisher = "phind";
-          version = "0.22.2";
-          hash = "sha256-nN/7IVa4WaA5V39CHx0nrvWBmBNtISvAINTQzk02x1w=";
+          version = "0.25.3";
+          hash = "sha256-GPFeI7tVLfzlGyal2LbsyTgPkWY/nPWnXtS38S9pvxo=";
        };
        meta = {
          description = "Using Phind AI service to provide answers based on the code context";
--- a/pkgs/applications/gis/qgis/set-pyqt-package-dirs-ltr.patch
+++ b/pkgs/applications/gis/qgis/set-pyqt-package-dirs-ltr.patch
@ -0,0 +1,59 @@
+diff --git a/cmake/FindPyQt5.cmake b/cmake/FindPyQt5.cmake
+index b51fd0075e..87ee317e05 100644
+--- a/cmake/FindPyQt5.cmake
+++ b/cmake/FindPyQt5.cmake
+@@ -25,7 +25,7 @@ ELSE(EXISTS PYQT5_VERSION_STR)
+   IF(SIP_BUILD_EXECUTABLE)
+     # SIP >= 5.0 path
+ 
+-    FILE(GLOB _pyqt5_metadata "${Python_SITEARCH}/PyQt5-*.dist-info/METADATA")
+    FILE(GLOB _pyqt5_metadata "@pyQt5PackageDir@/PyQt5-*.dist-info/METADATA")
+     IF(_pyqt5_metadata)
+       FILE(READ ${_pyqt5_metadata} _pyqt5_metadata_contents)
+       STRING(REGEX REPLACE ".*\nVersion: ([^\n]+).*$" "\\1" PYQT5_VERSION_STR ${_pyqt5_metadata_contents})
+@@ -34,8 +34,8 @@ ELSE(EXISTS PYQT5_VERSION_STR)
+     ENDIF(_pyqt5_metadata)
+ 
+     IF(PYQT5_VERSION_STR)
+-      SET(PYQT5_MOD_DIR "${Python_SITEARCH}/PyQt5")
+-      SET(PYQT5_SIP_DIR "${Python_SITEARCH}/PyQt5/bindings")
+      SET(PYQT5_MOD_DIR "@pyQt5PackageDir@/PyQt5")
+      SET(PYQT5_SIP_DIR "@pyQt5PackageDir@/PyQt5/bindings")
+       FIND_PROGRAM(__pyuic5 "pyuic5")
+       GET_FILENAME_COMPONENT(PYQT5_BIN_DIR ${__pyuic5} DIRECTORY)
+ 
+diff --git a/cmake/FindQsci.cmake b/cmake/FindQsci.cmake
+index 69e41c1fe9..5456c3d59b 100644
+--- a/cmake/FindQsci.cmake
+++ b/cmake/FindQsci.cmake
+@@ -24,7 +24,7 @@ ELSE(QSCI_MOD_VERSION_STR)
+   IF(SIP_BUILD_EXECUTABLE)
+     # SIP >= 5.0 path
+ 
+-    FILE(GLOB _qsci_metadata "${Python_SITEARCH}/QScintilla*.dist-info/METADATA")
+    FILE(GLOB _qsci_metadata "@qsciPackageDir@/QScintilla*.dist-info/METADATA")
+     IF(_qsci_metadata)
+       FILE(READ ${_qsci_metadata} _qsci_metadata_contents)
+       STRING(REGEX REPLACE ".*\nVersion: ([^\n]+).*$" "\\1" QSCI_MOD_VERSION_STR ${_qsci_metadata_contents})
+@@ -33,7 +33,7 @@ ELSE(QSCI_MOD_VERSION_STR)
+     ENDIF(_qsci_metadata)
+ 
+     IF(QSCI_MOD_VERSION_STR)
+-      SET(QSCI_SIP_DIR "${PYQT_SIP_DIR}")
+      SET(QSCI_SIP_DIR "@qsciPackageDir@/PyQt5/bindings")
+       SET(QSCI_FOUND TRUE)
+     ENDIF(QSCI_MOD_VERSION_STR)
+ 
+diff --git a/python/CMakeLists.txt b/python/CMakeLists.txt
+index 4cd19c3af4..668cc6a5e6 100644
+--- a/python/CMakeLists.txt
+++ b/python/CMakeLists.txt
+@@ -212,7 +212,7 @@ if (WITH_GUI)
+     install(FILES ${QGIS_PYTHON_OUTPUT_DIRECTORY}/_gui.pyi DESTINATION ${QGIS_PYTHON_DIR})
+   endif()
+   if(QSCI_SIP_DIR)
+-    set(SIP_EXTRA_OPTIONS ${SIP_EXTRA_OPTIONS} -I ${QSCI_SIP_DIR})
+    set(SIP_BUILD_EXTRA_OPTIONS ${SIP_BUILD_EXTRA_OPTIONS} --include-dir=${QSCI_SIP_DIR})
+   else()
+     message(STATUS "Qsci sip file not found - disabling bindings for derived classes")
+     set(SIP_DISABLE_FEATURES ${SIP_DISABLE_FEATURES} HAVE_QSCI_SIP)
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@ -139,7 +139,7 @@ in mkDerivation rec {

  patches = [
    (substituteAll {
-      src = ./set-pyqt-package-dirs.patch;
+      src = ./set-pyqt-package-dirs-ltr.patch;
      pyQt5PackageDir = "${py.pkgs.pyqt5}/${py.pkgs.python.sitePackages}";
      qsciPackageDir = "${py.pkgs.qscintilla-qt5}/${py.pkgs.python.sitePackages}";
    })
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@ -101,6 +101,15 @@ stdenv.mkDerivation rec {
      url = "https://gitlab.com/inkscape/inkscape/-/commit/694d8ae43d06efff21adebf377ce614d660b24cd.patch";
      hash = "sha256-9IXJzpZbNU5fnt7XKgqCzUDrwr08qxGwo8TqnL+xc6E=";
    })
+
+    # Improve distribute along path precision
+    # https://gitlab.com/inkscape/extensions/-/issues/580
+    (fetchpatch {
+      url = "https://gitlab.com/inkscape/extensions/-/commit/c576043c195cd044bdfc975e6367afb9b655eb14.patch";
+      extraPrefix = "share/extensions/";
+      stripLen = 1;
+      hash = "sha256-D9HxBx8RNkD7hHuExJqdu3oqlrXX6IOUw9m9Gx6+Dr8=";
+    })
  ];

  postPatch = ''
--- a/pkgs/applications/misc/kickoff/default.nix
+++ b/pkgs/applications/misc/kickoff/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "kickoff";
-  version = "0.7.3";
+  version = "0.7.4";

  src = fetchFromGitHub {
    owner = "j0ru";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-ha1pRViiOH0U0djUq1x8TIpVoUMn8l+2pA//YP70jdk=";
+    hash = "sha256-q/+Ik8L58LxOllpEosYyvD38RJb+NIQHslYpgGSwjKc=";
  };

-  cargoHash = "sha256-pdncUUGSfsn35VpwuNWZ/0DAIImBLAm0LyPbqQ06Xho=";
+  cargoHash = "sha256-8LSz/YeqdbtFXpWq2MMhEI9+8mxsLdE4LUyQHcgLkZY=";

  libPath = lib.makeLibraryPath [
    wayland
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@ -86,11 +86,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "appgate-sdp";
-  version = "6.2.3";
+  version = "6.3.2";

  src = fetchurl {
    url = "https://bin.appgate-sdp.com/${lib.versions.majorMinor version}/client/appgate-sdp_${version}_amd64.deb";
-    sha256 = "sha256-W6P83+DPd2VRz52UKPJp+D1WcjgDwyXYcx6rViHbmlk=";
+    sha256 = "sha256-7W2iUilSK4awrtgZc/c40oivzlyz3RN5U5TUicqavsc=";
  };

  # just patch interpreter
--- a/pkgs/applications/networking/browsers/ladybird/default.nix
+++ b/pkgs/applications/networking/browsers/ladybird/default.nix
@ -11,10 +11,13 @@
 , cmake
 , ninja
 , pkg-config
+, libavif
 , libxcrypt
 , python3
 , qt6Packages
 , woff2
+, ffmpeg
+, skia
 , nixosTests
 , AppKit
 , Cocoa
@ -52,13 +55,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ladybird";
-  version = "0-unstable-2024-06-08";
+  version = "0-unstable-2024-07-11";

  src = fetchFromGitHub {
    owner = "LadybirdWebBrowser";
    repo = "ladybird";
-    rev = "2f68e361370040d8cdc75a8ed8af4239134ae481";
-    hash = "sha256-EQZTsui4lGThSi+8a6KSyL5lJnO0A8fJ8HWY4jgkpUA=";
+    rev = "da8633b2d0ab3b9d8f1cdad39a8ad85ca2accf03";
+    hash = "sha256-NJSuhJWxeGPOVotK+s/mG2bfq19su08wBoxFDs/H9JU=";
  };

  postPatch = ''
@ -76,8 +79,8 @@ stdenv.mkDerivation (finalAttrs: {
    # expected version in the package's CMake.

    # Check that the versions match
-    grep -F 'set(CLDR_VERSION "${cldr_version}")' Meta/CMake/locale_data.cmake || (echo cldr_version mismatch && exit 1)
-    grep -F 'set(TZDB_VERSION "${tzdata.version}")' Meta/CMake/time_zone_data.cmake || (echo tzdata.version mismatch && exit 1)
+    grep -F 'locale_version = "${cldr_version}"' Meta/gn/secondary/Userland/Libraries/LibLocale/BUILD.gn || (echo cldr_version mismatch && exit 1)
+    grep -F 'tzdb_version = "${tzdata.version}"' Meta/gn/secondary/Userland/Libraries/LibTimeZone/BUILD.gn || (echo tzdata.version mismatch && exit 1)
    grep -F 'set(CACERT_VERSION "${cacert_version}")' Meta/CMake/ca_certificates_data.cmake || (echo cacert_version mismatch && exit 1)

    mkdir -p build/Caches
@ -116,9 +119,12 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = with qt6Packages; [
+    ffmpeg
+    libavif
    libxcrypt
    qtbase
    qtmultimedia
+    skia
    woff2
  ] ++ lib.optional stdenv.isLinux [
    qtwayland
@ -133,11 +139,8 @@ stdenv.mkDerivation (finalAttrs: {
    # Disable network operations
    "-DSERENITY_CACHE_DIR=Caches"
    "-DENABLE_NETWORK_DOWNLOADS=OFF"
-    "-DENABLE_COMMONMARK_SPEC_DOWNLOAD=OFF"
  ] ++ lib.optionals stdenv.isLinux [
    "-DCMAKE_INSTALL_LIBEXECDIR=libexec"
-    # FIXME: Enable this when launching with the commandline flag --enable-gpu-painting doesn't fail calling eglBindAPI on GNU/Linux
-    "-DENABLE_ACCELERATED_GRAPHICS=OFF"
  ];

  # FIXME: Add an option to -DENABLE_QT=ON on macOS to use Qt rather than Cocoa for the GUI
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubernetes-helm";
-  version = "3.15.2";
+  version = "3.15.3";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-gZfL9ejW9Md5X1S8Zvlc4OpywJfU2rlT+p78imgPjpw=";
+    sha256 = "sha256-m5k1MUncx9xSGu49Qjy1MByl3h6Qz7VCNrveqRVjtdQ=";
  };
  vendorHash = "sha256-2q5IziYSW2FFfRZvWKz6dVnJfauRlE9lRrb4/l2EGC0=";

--- a/pkgs/applications/networking/cluster/kaniko/default.nix
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "kaniko";
-  version = "1.23.1";
+  version = "1.23.2";

  src = fetchFromGitHub {
    owner = "GoogleContainerTools";
    repo = "kaniko";
    rev = "v${version}";
-    hash = "sha256-0FHhyUPZFddruZ3YV5SYB0b/bb0C+IVQpgIRaCoA1z8=";
+    hash = "sha256-8SLE9s+P6Xh4PzrvTwUtIAtkG9Gor/fGBwrqq/fz0UM=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/krelay/default.nix
+++ b/pkgs/applications/networking/cluster/krelay/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "krelay";
-  version = "0.0.10";
+  version = "0.1.0";

  src = fetchFromGitHub {
    owner = "knight42";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-1sAkNueP8qGwPwdX0oSJfB/oGvna6+G8Cay+3vGJ2IE=";
+    hash = "sha256-tZnHkjsAT8AOIpVDIiHnD6k/2S/S/+jM9uw18TaYJaA=";
  };

-  vendorHash = "sha256-iv0OJLhIZpdem2/JFirJnvmU44ylTomgB8UqCGqHbwA=";
+  vendorHash = "sha256-5lA7I/vrc6+XsiSCL61a/p7jbseLcJyXnOC5R/z85vQ=";

  subPackages = [ "cmd/client" ];

--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -65,13 +65,13 @@ let
 in
 buildGoModule rec {
  pname = "podman";
-  version = "5.1.1";
+  version = "5.1.2";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    rev = "v${version}";
-    hash = "sha256-3u4QOX7K0bMcbvwkXVoCpq7p5rKkvmOlOIRSUEbjFOY=";
+    hash = "sha256-IeGOagP1MGH92Si2i6HPwZ71XrYJ7RpxxRNbQN3HGOw=";
  };

  patches = [
--- a/pkgs/by-name/di/diesel-cli/package.nix
+++ b/pkgs/by-name/di/diesel-cli/package.nix
@ -0,0 +1,106 @@
+{
+  lib,
+  stdenv,
+  fetchCrate,
+  rustPlatform,
+  installShellFiles,
+  darwin,
+  libiconv,
+  libmysqlclient,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  postgresql,
+  sqlite,
+  testers,
+  zlib,
+  diesel-cli,
+  sqliteSupport ? true,
+  postgresqlSupport ? true,
+  mysqlSupport ? true,
+}:
+assert lib.assertMsg (lib.elem true [
+  postgresqlSupport
+  mysqlSupport
+  sqliteSupport
+]) "support for at least one database must be enabled";
+
+rustPlatform.buildRustPackage rec {
+  pname = "diesel-cli";
+  version = "2.1.1";
+
+  src = fetchCrate {
+    inherit version;
+    crateName = "diesel_cli";
+    hash = "sha256-fpvC9C30DJy5ih+sFTTMoiykUHqG6OzDhF9jvix1Ctg=";
+  };
+
+  cargoHash = "sha256-nPmUCww8sOJwnG7+uIflLPgT87xPX0s7g0AcuDKhY2I=";
+
+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+  ];
+
+  buildInputs =
+    [ openssl ]
+    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security
+    ++ lib.optional (stdenv.isDarwin && mysqlSupport) libiconv
+    ++ lib.optional sqliteSupport sqlite
+    ++ lib.optional postgresqlSupport postgresql
+    ++ lib.optionals mysqlSupport [
+      libmysqlclient
+      zlib
+    ];
+
+  buildNoDefaultFeatures = true;
+  buildFeatures =
+    lib.optional sqliteSupport "sqlite"
+    ++ lib.optional postgresqlSupport "postgres"
+    ++ lib.optional mysqlSupport "mysql";
+
+  checkFlags = [
+    # all of these require a live database to be running
+    # `DATABASE_URL must be set in order to run tests: NotPresent`
+    "--skip=infer_schema_internals::information_schema::tests::get_primary_keys_only_includes_primary_key"
+    "--skip=infer_schema_internals::information_schema::tests::load_table_names_loads_from_custom_schema"
+    "--skip=infer_schema_internals::information_schema::tests::load_table_names_loads_from_public_schema_if_none_given"
+    "--skip=infer_schema_internals::information_schema::tests::load_table_names_output_is_ordered"
+    "--skip=infer_schema_internals::information_schema::tests::skip_views"
+    "--skip=infer_schema_internals::mysql::test::get_table_data_loads_column_information"
+    "--skip=infer_schema_internals::mysql::test::gets_table_comment"
+    "--skip=infer_schema_internals::pg::test::get_foreign_keys_loads_foreign_keys"
+    "--skip=infer_schema_internals::pg::test::get_foreign_keys_loads_foreign_keys_with_same_name"
+    "--skip=infer_schema_internals::pg::test::get_table_data_loads_column_information"
+    "--skip=infer_schema_internals::pg::test::gets_table_comment"
+  ];
+  cargoCheckFeatures = buildFeatures;
+
+  postInstall = ''
+    installShellCompletion --cmd diesel \
+      --bash <($out/bin/diesel completions bash) \
+      --fish <($out/bin/diesel completions fish) \
+      --zsh <($out/bin/diesel completions zsh)
+  '';
+
+  # Fix the build with mariadb, which otherwise shows "error adding symbols:
+  # DSO missing from command line" errors for libz and libssl.
+  env.NIX_LDFLAGS = lib.optionalString mysqlSupport "-lz -lssl -lcrypto";
+
+  passthru = {
+    tests.version = testers.testVersion { package = diesel-cli; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Database tool for working with Rust projects that use Diesel";
+    homepage = "https://diesel.rs";
+    changelog = "https://github.com/diesel-rs/diesel/releases/tag/v${version}";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ getchoo ];
+    mainProgram = "diesel";
+  };
+}
--- a/pkgs/by-name/fr/fretboard/package.nix
+++ b/pkgs/by-name/fr/fretboard/package.nix
@ -18,19 +18,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fretboard";
-  version = "7.0";
+  version = "7.1";

  src = fetchFromGitHub {
    owner = "bragefuglseth";
    repo = "fretboard";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-8AfIvmL6ttmsH95KRMSv+1RaYYU2h+nVaZozLfxLWXc=";
+    hash = "sha256-ZBDsG59WLsTYdayqGMBAh9+gDtoaqlAuSdObcjAk6DA=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    src = finalAttrs.src;
    name = "${finalAttrs.pname}-${finalAttrs.version}";
-    hash = "sha256-kFV3zd7xp2hBMAdIXZAJhH/BSTKy6DgnFqz7h0yNWgs=";
+    hash = "sha256-W0gvSPVG0q1928uDky4Ad4VowuWcj6DyyWF2C2Y573c=";
  };

  nativeBuildInputs = [
@ -65,5 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
    mainProgram = "fretboard";
    maintainers = with maintainers; [ michaelgrahamevans ];
    platforms = platforms.unix;
+    broken = stdenv.isDarwin;
  };
 })
--- a/pkgs/by-name/go/got/package.nix
+++ b/pkgs/by-name/go/got/package.nix
@ -13,6 +13,10 @@
 , bison
 , autoPatchelfHook
 , testers
+, signify
+, withSsh ? true, openssh
+# Default editor to use when neither VISUAL nor EDITOR are defined
+, defaultEditor ? null
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -37,7 +41,18 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace configure --replace-fail 'xdarwin' 'xhomebrew'
  '';

-  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [
+  env.NIX_CFLAGS_COMPILE = toString (
+  lib.optionals (defaultEditor != null) [
+    ''-DGOT_DEFAULT_EDITOR="${lib.getExe defaultEditor}"''
+  ] ++ lib.optionals withSsh [
+    ''-DGOT_DIAL_PATH_SSH="${lib.getExe openssh}"''
+    ''-DGOT_TAG_PATH_SSH_KEYGEN="${lib.getExe' openssh "ssh-keygen"}"''
+  ] ++ lib.optionals stdenv.isLinux [
+    ''-DGOT_TAG_PATH_SIGNIFY="${lib.getExe signify}"''
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error=implicit-function-declaration"
+    "-Wno-error=int-conversion"
+  ] ++ lib.optionals stdenv.isDarwin [
    # error: conflicting types for 'strmode'
    "-DHAVE_STRMODE=1"
    # Undefined symbols for architecture arm64: "_bsd_getopt"
--- a/pkgs/by-name/hu/humioctl/package.nix
+++ b/pkgs/by-name/hu/humioctl/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "humioctl";
-  version = "0.35.0";
+  version = "0.35.1";

  src = fetchFromGitHub {
    owner = "humio";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-9VnF5R2O0OJ2nu+K+utHPxCTFEpjpd49RiXVh3H2PqA=";
+    hash = "sha256-naN/731Byn0E1h+Yk/8fAyeJpSHTn99jEcRC3rSh2c8=";
  };

  vendorHash = "sha256-vGX77+I/zdTBhVSywd7msjrJ0KtcdZRgvWZWQC9M9og=";
--- a/pkgs/by-name/im/imsprog/package.nix
+++ b/pkgs/by-name/im/imsprog/package.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "imsprog";
-  version = "1.4.1";
+  version = "1.4.2";

  src = fetchFromGitHub {
    owner = "bigbigmdm";
    repo = "IMSProg";
    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-eF6TGlFEnMgMw1i/sfuXIRzNySVZe7UTKVHSIqJ+cUs=";
+    hash = "sha256-9ALiYTUnrdoRHfcyuz4nPzXFHL7pPkFUTBL2/v1atz0=";
  };

  strictDeps = true;
--- a/pkgs/by-name/it/itsycal/package.nix
+++ b/pkgs/by-name/it/itsycal/package.nix
@ -1,15 +1,16 @@
-{ lib
-, fetchzip
-, stdenvNoCC
+{
+  lib,
+  fetchzip,
+  stdenvNoCC,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "itsycal";
-  version = "0.15.3";
+  version = "0.15.4";

  src = fetchzip {
    url = "https://itsycal.s3.amazonaws.com/Itsycal-${finalAttrs.version}.zip";
-    hash = "sha256-jpTlJY7yAARrkHzreQKbFaKj0sYp950R0qPPcDeY6AE=";
+    hash = "sha256-+Pi74xP5BcjhgtR3YCqJknl54wdNIU8ekEwQUaFp4T8=";
  };

  installPhase = ''
@ -22,6 +23,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  '';

  meta = {
+    changelog = "https://www.mowglii.com/itsycal/versionhistory.html";
    description = "Itsycal is a tiny menu bar calendar";
    homepage = "https://www.mowglii.com/itsycal/";
    license = lib.licenses.mit;
--- a/pkgs/by-name/md/mdk3-master/package.nix
+++ b/pkgs/by-name/md/mdk3-master/package.nix
@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, wirelesstools
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mdk3-master";
+  version = "6-unstable-2015-05-24";
+
+  src = fetchFromGitHub {
+    owner = "charlesxsh";
+    repo = "mdk3-master";
+    rev = "1bf2bd31b79560aa99fc42123f70f36a03154b9e";
+    hash = "sha256-Jxyv7aoL8l9M7JheazJ+/YqfkDcSNx3ARNhx3G5Y+cM=";
+  };
+
+  runtimeDependencies = [ wirelesstools ];
+
+  installPhase = ''
+    runHook preInstall
+    make -C osdep install
+    mkdir -p $out/bin
+    install -D -m 0755 mdk3 $out/bin/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "MDK3 fork able to force reboot Access Points";
+    homepage = "https://github.com/charlesxsh/mdk3-master";
+    changelog = "https://github.com/charlesxsh/mdk3-master/blob/${src.rev}/CHANGELOG";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ pinpox ];
+    mainProgram = "mdk3";
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/by-name/pw/pwru/package.nix
+++ b/pkgs/by-name/pw/pwru/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "pwru";
-  version = "1.0.6";
+  version = "1.0.7";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = "pwru";
    rev = "v${version}";
-    hash = "sha256-8pXyzmzMCxOzwstzvzeZB2HBMeMzGMLZesTURZD3Rt8=";
+    hash = "sha256-BjiFuM06YDlPyB578p2hweBay+4z0bOn7fUoxSvrDY8=";
  };

  vendorHash = null;
@ -27,6 +27,9 @@ buildGoModule rec {
      --replace "-static" ""
  '';

+  # this breaks go generate as bpf does not support -fzero-call-used-regs=used-gpr
+  hardeningDisable = [ "zerocallusedregs" ];
+
  preBuild = ''
    TARGET_GOARCH="$GOARCH" GOOS= GOARCH= go generate
  '';
--- a/pkgs/by-name/qr/qrtool/package.nix
+++ b/pkgs/by-name/qr/qrtool/package.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "qrtool";
-  version = "0.11.0";
+  version = "0.11.2";

  src = fetchFromGitHub {
    owner = "sorairolake";
    repo = "qrtool";
    rev = "v${version}";
-    sha256 = "sha256-p9iQznP7/eGSHB4V+AzscStjdnllKEW2igvaxjJ1LN4=";
+    sha256 = "sha256-l6OVNCIw69fAX4mhnG3U1PBdmWHMD1JJMtiOgRrv198=";
  };

-  cargoHash = "sha256-aGg50NEJbKnfMAlO0KhSztabuvcXDRnKAR8hdfMpAbA=";
+  cargoHash = "sha256-1sYX54h/HQzotOOTQEdmhtQZAm+KD5G3BXnEbWSzQGA=";

  nativeBuildInputs = [ asciidoctor installShellFiles ];

--- a/pkgs/by-name/ri/rippkgs/package.nix
+++ b/pkgs/by-name/ri/rippkgs/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "rippkgs";
-  version = "1.1.0";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "replit";
    repo = "rippkgs";
    rev = "refs/tags/v${version}";
-    hash = "sha256-qQZnD9meczfsQv1R68IiUfPq730I2IyesurrOhtA3es=";
+    hash = "sha256-k50q78ycjrFVFTDstTdOLF8aJjsUpQ3lFRbFD1nL8xM=";
  };

-  cargoHash = "sha256-hGSHgJ2HVCNqTBsTQIZlSE89FKqdMifuJyAGl3utF2I=";
+  cargoHash = "sha256-EQvIJXIQ6UrevNkhqMZddUde+6iNBcBTOaanimZNkaA=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/sc/scip-go/package.nix
+++ b/pkgs/by-name/sc/scip-go/package.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "scip-go";
-  version = "0.1.14";
+  version = "0.1.15";

  src = fetchFromGitHub {
    owner = "sourcegraph";
    repo = "scip-go";
    rev = "v${version}";
-    hash = "sha256-yRYNct1Ok7E57iB01u33QS7ok1kjv6U/7Hm4s/eKKOo=";
+    hash = "sha256-2UKiPKeGDkNiI96RieYWaJygz/ZqfdcBmm9PCuby7qQ=";
  };

-  vendorHash = "sha256-R+0E+BnE912vgqUqaaP2dlbbPyJuaCiNxRcedNKGODU=";
+  vendorHash = "sha256-UID2mLrkY86k5Ms0cDgIsZR8s6h4TVwRLvLtoLXAXl4=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/by-name/su/surrealdb/package.nix
+++ b/pkgs/by-name/su/surrealdb/package.nix
@ -16,16 +16,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "surrealdb";
-  version = "1.5.3";
+  version = "1.5.4";

  src = fetchFromGitHub {
    owner = "surrealdb";
    repo = "surrealdb";
    rev = "v${version}";
-    hash = "sha256-lRXQq834KYDW/ugpFudrmSDPlzBaGDuS/pC2riElF04=";
+    hash = "sha256-KtR+qU2Xys4NkEARZBbO8mTPa7EI9JplWvXdtuLt2vE=";
  };

-  cargoHash = "sha256-XQu1I4ufQZKpeDBTb13g2vECmdWAGRckQjWz8BbHMHA=";
+  cargoHash = "sha256-b0KmL6RQevO7oLPZCgUc4EUkgv99DbMFD/RkE/fwAHw=";

  # error: linker `aarch64-linux-gnu-gcc` not found
  postPatch = ''
--- a/pkgs/by-name/wh/where-is-my-sddm-theme/package.nix
+++ b/pkgs/by-name/wh/where-is-my-sddm-theme/package.nix
@ -34,13 +34,13 @@ lib.checkListOfEnum "where-is-my-sddm-theme: variant" validVariants variants
  stdenvNoCC.mkDerivation
  (finalAttrs: {
    pname = "where-is-my-sddm-theme";
-    version = "1.9.2";
+    version = "1.10.0";

    src = fetchFromGitHub {
      owner = "stepanzubkov";
      repo = "where-is-my-sddm-theme";
      rev = "refs/tags/v${finalAttrs.version}";
-      hash = "sha256-7I8ucPuPPpUH/KyJoiwlfS7r4Bsh8ZnkHdOEED12TOQ=";
+      hash = "sha256-hv0s2ZnfLE3DJ60G6ZL/Z+sXth9plzjlUNwII8TMuOo=";
    };

    propagatedUserEnvPkgs =
--- a/pkgs/development/libraries/hmat-oss/default.nix
+++ b/pkgs/development/libraries/hmat-oss/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "hmat-oss";
-  version = "1.9.0";
+  version = "1.10.0";

  src = fetchFromGitHub {
    owner = "jeromerobert";
    repo = "hmat-oss";
    rev = "refs/tags/${version}";
-    sha256 = "sha256-JW6zghoYnF7NcAuAACgTQoxANEnmwjUAB8jCpof7Ums=";
+    sha256 = "sha256-GnFlvZCEzSCcBVLjFWLe+AKXVA6UMs/gycrOJ2TBqrE=";
  };

  cmakeFlags = [
--- a/pkgs/development/libraries/science/chemistry/openmm/default.nix
+++ b/pkgs/development/libraries/science/chemistry/openmm/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "openmm";
-  version = "8.1.1";
+  version = "8.1.2";

  src = fetchFromGitHub {
    owner = "openmm";
    repo = pname;
    rev = version;
-    hash = "sha256-pYWBniV1J+UZBOPPjuUxVevONHaclo+GvGBEpr7Zmxg=";
+    hash = "sha256-2UFccB+xXAw3uRw0G1TKlqTVl9tUl1sRPFG4H05vq04=";
  };

  # "This test is stochastic and may occassionally fail". It does.
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "adafruit-platformdetect";
-  version = "3.71.0";
+  version = "3.72.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -16,7 +16,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "adafruit_platformdetect";
    inherit version;
-    hash = "sha256-sgXU1m3SuEP2HIgIOKM2Sz8noLGSruzFe+zf0dA9p2A=";
+    hash = "sha256-HjIAYbE7EUE0GOnOEfC63QJWO11cAjMERbORBbjadGM=";
  };

  build-system = [ setuptools-scm ];
--- a/pkgs/development/python-modules/aioairzone-cloud/default.nix
+++ b/pkgs/development/python-modules/aioairzone-cloud/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "aioairzone-cloud";
-  version = "0.5.3";
+  version = "0.5.4";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "Noltari";
    repo = "aioairzone-cloud";
    rev = "refs/tags/${version}";
-    hash = "sha256-HI6ZSplKS8V+lfkyx1H8wcSPbNxJNF7h5qn7s75qCtI=";
+    hash = "sha256-XQkrhLOvkYsX8+rb3qkeOcOev8WcB/6tchIfDF4N+i0=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "aioshelly";
-  version = "11.0.0";
+  version = "11.1.0";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "home-assistant-libs";
    repo = "aioshelly";
    rev = "refs/tags/${version}";
-    hash = "sha256-158b4lsxebtLXXsPhzbkXP9ioPlFIsJcS5G5eDqFY98=";
+    hash = "sha256-uCvwqGsQuiFRhpEj9mIBNE8JsG/3uvMptzOXOwUhY3o=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/asteval/default.nix
+++ b/pkgs/development/python-modules/asteval/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "asteval";
-  version = "1.0.0";
+  version = "1.0.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "lmfit";
    repo = "asteval";
    rev = "refs/tags/${version}";
-    hash = "sha256-2Oj/3tMDC5s4OouSarAJo3TCwBOCY3DYjAZk3TcV9CQ=";
+    hash = "sha256-Ee7EAcSfLmo9ijm4oa3nEVPoz1pgLx4ozbSXBW3kRPw=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/autarco/default.nix
+++ b/pkgs/development/python-modules/autarco/default.nix
@ -16,16 +16,16 @@

 buildPythonPackage rec {
  pname = "autarco";
-  version = "0.3.0";
+  version = "2.0.0";
  pyproject = true;

-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.11";

  src = fetchFromGitHub {
    owner = "klaasnicolaas";
    repo = "python-autarco";
    rev = "refs/tags/v${version}";
-    hash = "sha256-IBf6Dw2Yf7m+5bQ72K0kPxGdtpl8JowQ9IO3gWS3Vso=";
+    hash = "sha256-e/wi4suDMSQTaSdyYsTiBxVUNvisYBVPqy9Rpk0lwJw=";
  };

  pythonRelaxDeps = [ "orjson" ];
@ -37,11 +37,9 @@ buildPythonPackage rec {
      --replace "--cov" ""
  '';

-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    aiohttp
    mashumaro
    orjson
@ -63,7 +61,7 @@ buildPythonPackage rec {
    description = "Module for the Autarco Inverter";
    homepage = "https://github.com/klaasnicolaas/python-autarco";
    changelog = "https://github.com/klaasnicolaas/python-autarco/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/dploot/default.nix
+++ b/pkgs/development/python-modules/dploot/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "dploot";
-  version = "2.7.2";
+  version = "2.7.3";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Vbaghcomf9gRso4DN/cpJ4j7t6AU2vg2OhucKbfS1hc=";
+    hash = "sha256-YlRXUSCzVRXxRQcmPzTeyPQ3zK+UlhO9BmZVx6qVRpc=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
+++ b/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "faraday-agent-parameters-types";
-  version = "1.6.0";
+  version = "1.7.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "faraday_agent_parameters_types";
    inherit version;
-    hash = "sha256-yw4u1xhfY9WYLSf9CNAsiDpY7y2Llf8j4gDoNZjACw0=";
+    hash = "sha256-xFrTOsoh/qCCnzJq97pHW2TogiWfnw4zL4Lul4jRaA0=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/faraday-plugins/default.nix
+++ b/pkgs/development/python-modules/faraday-plugins/default.nix
@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "faraday-plugins";
-  version = "1.18.0";
+  version = "1.18.1";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -29,7 +29,7 @@ buildPythonPackage rec {
    owner = "infobyte";
    repo = "faraday_plugins";
    rev = "refs/tags/${version}";
-    hash = "sha256-oYE7Iik0+CbOfxF9IeeZotpGqV8TTz15MxJEC4VBrhk=";
+    hash = "sha256-ogfshtuHQ1UBNX24gTevWKGsFFaA097oEW3J3fzcXFo=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/influxdb3-python/default.nix
+++ b/pkgs/development/python-modules/influxdb3-python/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "influxdb3-python";
-  version = "0.6.1";
+  version = "0.7.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "InfluxCommunity";
    repo = "influxdb3-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-xu1uWVhZCFIjyOjE144X0JFtYY/nIoBHp/eHtysARYc=";
+    hash = "sha256-jncJUurkH1XzC6Hjcpet1fZejcYjcPq2OWI//FmZcmI=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/inkex/default.nix
+++ b/pkgs/development/python-modules/inkex/default.nix
@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  inkscape,
+  fetchpatch,
  poetry-core,
  cssselect,
  lxml,
@ -25,6 +26,17 @@ buildPythonPackage {

  inherit (inkscape) src;

+  patches = [
+    # Fix “distribute along path” test with Python 3.12.
+    # https://gitlab.com/inkscape/extensions/-/issues/580
+    (fetchpatch {
+      url = "https://gitlab.com/inkscape/extensions/-/commit/c576043c195cd044bdfc975e6367afb9b655eb14.patch";
+      extraPrefix = "share/extensions/";
+      stripLen = 1;
+      hash = "sha256-D9HxBx8RNkD7hHuExJqdu3oqlrXX6IOUw9m9Gx6+Dr8=";
+    })
+  ];
+
  nativeBuildInputs = [ poetry-core ];

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/itunespy/default.nix
+++ b/pkgs/development/python-modules/itunespy/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "itunespy";
-  version = "1.6";
+  version = "1.6.1";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "sleepyfran";
    repo = pname;
-    rev = version;
-    sha256 = "0yc3az5531qs8nbcw4rhgrszwczgy4bikfwfar7xb2044360sslw";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-QvSKJAZa8v0tGURXwo4Dwo73JqsYs1xsBHW0lcaM7bk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/jupytext/default.nix
+++ b/pkgs/development/python-modules/jupytext/default.nix
@ -20,14 +20,14 @@

 buildPythonPackage rec {
  pname = "jupytext";
-  version = "1.16.2";
+  version = "1.16.3";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-hifdm+y769ecxKTtRyfYnXjmBrS0ZOq3I1ezsCkCOhQ=";
+    hash = "sha256-HrrJkEYd2fR3/3/uyeMAP6GsyJ88FroBtz95/XbwGpg=";
  };

  build-system = [
--- a/pkgs/development/python-modules/microsoft-kiota-http/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-http/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "microsoft-kiota-http";
-  version = "1.3.1";
+  version = "1.3.2";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "microsoft";
    repo = "kiota-http-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-I16WARk6YBr8KgE9MtHcA5VdsnLXBKcZOaqRL/eqwKE=";
+    hash = "sha256-9Xf/M9d+lScCTWXakJ+BMeBbbRGshtzRzhOg5FGbC5o=";
  };

  build-system = [ flit-core ];
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "pipdeptree";
-  version = "2.23.0";
+  version = "2.23.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "tox-dev";
    repo = "pipdeptree";
    rev = "refs/tags/${version}";
-    hash = "sha256-Er47yUaRCtTYQOhttOMIaM2EFf0l5rMH5YV1kpMCDls=";
+    hash = "sha256-yEiehHcJcVC0hjb9NFgsrSxmAsxNki8HNGKk8dEk75s=";
  };

  build-system = [
--- a/pkgs/development/python-modules/pymsteams/default.nix
+++ b/pkgs/development/python-modules/pymsteams/default.nix
@ -4,23 +4,26 @@
  fetchFromGitHub,
  pythonOlder,
  requests,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "pymsteams";
-  version = "0.2.2";
-  format = "setuptools";
+  version = "0.2.3";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "rveachkc";
-    repo = pname;
-    rev = version;
-    hash = "sha256-H1AEjUnEK+seKsnFnHpn1/aHxXcbyz67NbzhlGDtbk4=";
+    repo ="pymsteams";
+    rev = "refs/tags/${version}";
+    hash = "sha256-suPCAzjQp46+kKFiCtm65lxBbsn78Owq4dVmWCdhIpA=";
  };

-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];

  # Tests require network access
  doCheck = false;
@ -30,6 +33,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python module to interact with Microsoft Teams";
    homepage = "https://github.com/rveachkc/pymsteams";
+    changelog = "https://github.com/rveachkc/pymsteams/releases/tag/${version}";
    license = with licenses; [ asl20 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "pyoverkiz";
-  version = "1.13.12";
+  version = "1.13.13";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "iMicknl";
    repo = "python-overkiz-api";
    rev = "refs/tags/v${version}";
-    hash = "sha256-zcFcF0a3gyY3WmRiRlQntO8hjbkUm2Cxumn2aKHchvY=";
+    hash = "sha256-ras9JXLbWydxRfTlDocNpBYQFPccEbmPB3sknTuMryU=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "pyswitchbot";
-  version = "0.48.0";
+  version = "0.48.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "Danielhiversen";
    repo = "pySwitchbot";
    rev = "refs/tags/${version}";
-    hash = "sha256-UVLB1SdtYiMsXR3od2gIxNxiQ6wyW2ItAJQrxv0w1tk=";
+    hash = "sha256-zJzNVwrG5R2cLN7mJY9kjji2p1jP/b3b0qU7CMOPXCE=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/python-ecobee-api/default.nix
+++ b/pkgs/development/python-modules/python-ecobee-api/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "python-ecobee-api";
-  version = "0.2.18";
+  version = "0.2.19";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "nkgilley";
    repo = "python-ecobee-api";
    rev = "refs/tags/${version}";
-    hash = "sha256-WBVHlA7cAQGCFRNSANX6PqPQYMRw74GEAlTFwSBxVQU=";
+    hash = "sha256-osEqDUVf7fU5DWRUQyFaM8jOi2OgSqbtMaLSWMKQMPw=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/smhi-pkg/default.nix
+++ b/pkgs/development/python-modules/smhi-pkg/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "smhi-pkg";
-  version = "1.0.16";
+  version = "1.0.17";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "joysoftware";
    repo = "pypi_smhi";
    rev = "refs/tags/${version}";
-    hash = "sha256-jcIXzAZO9SxC/0apdjAVv1GmBTbdlasfXr1/Tj9adNc=";
+    hash = "sha256-dJh44JGWy3VafTnwwxWcr5cXClmzY1YuySy1RJzOak8=";
  };

  propagatedBuildInputs = [ aiohttp ];
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "tencentcloud-sdk-python";
-  version = "3.0.1187";
+  version = "3.0.1188";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-L0HiPTOLZt48IZLJrh1sbtGmcMk10EoNCerbeiXyeok=";
+    hash = "sha256-crpn9OLOqS1EAFaz1ZUNpc7CYyxDG3aA6/tubHHZm9g=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/tools/diesel-cli/default.nix
+++ b/pkgs/development/tools/diesel-cli/default.nix
@ -1,82 +0,0 @@
-{ lib
-, sqliteSupport ? true
-, postgresqlSupport ? true
-, mysqlSupport ? true
-, rustPlatform
-, fetchCrate
-, installShellFiles
-, pkg-config
-, openssl
-, stdenv
-, Security
-, libiconv
-, sqlite
-, postgresql
-, libmysqlclient
-, zlib
-}:
-
-assert lib.assertMsg (sqliteSupport == true || postgresqlSupport == true || mysqlSupport == true)
-  "support for at least one database must be enabled";
-
-let
-  inherit (lib) optional optionals optionalString;
-in
-
-rustPlatform.buildRustPackage rec {
-  pname = "diesel-cli";
-  version = "2.1.1";
-
-  src = fetchCrate {
-    inherit version;
-    crateName = "diesel_cli";
-    hash = "sha256-fpvC9C30DJy5ih+sFTTMoiykUHqG6OzDhF9jvix1Ctg=";
-  };
-
-  cargoHash = "sha256-nPmUCww8sOJwnG7+uIflLPgT87xPX0s7g0AcuDKhY2I=";
-
-  nativeBuildInputs = [ installShellFiles pkg-config ];
-
-  buildInputs = [ openssl ]
-    ++ optional stdenv.isDarwin Security
-    ++ optional (stdenv.isDarwin && mysqlSupport) libiconv
-    ++ optional sqliteSupport sqlite
-    ++ optional postgresqlSupport postgresql
-    ++ optionals mysqlSupport [ libmysqlclient zlib ];
-
-  buildNoDefaultFeatures = true;
-  buildFeatures = optional sqliteSupport "sqlite"
-    ++ optional postgresqlSupport "postgres"
-    ++ optional mysqlSupport "mysql";
-
-  checkPhase = ''
-    runHook preCheck
-  '' + optionalString sqliteSupport ''
-    cargo check --features sqlite
-  '' + optionalString postgresqlSupport ''
-    cargo check --features postgres
-  '' + optionalString mysqlSupport ''
-    cargo check --features mysql
-  '' + ''
-    runHook postCheck
-  '';
-
-  postInstall = ''
-    installShellCompletion --cmd diesel \
-      --bash <($out/bin/diesel completions bash) \
-      --fish <($out/bin/diesel completions fish) \
-      --zsh <($out/bin/diesel completions zsh)
-  '';
-
-  # Fix the build with mariadb, which otherwise shows "error adding symbols:
-  # DSO missing from command line" errors for libz and libssl.
-  NIX_LDFLAGS = optionalString mysqlSupport "-lz -lssl -lcrypto";
-
-  meta = with lib; {
-    description = "Database tool for working with Rust projects that use Diesel";
-    homepage = "https://github.com/diesel-rs/diesel/tree/master/diesel_cli";
-    license = with licenses; [ mit asl20 ];
-    maintainers = with maintainers; [ ];
-    mainProgram = "diesel";
-  };
-}
--- a/pkgs/development/tools/metal-cli/default.nix
+++ b/pkgs/development/tools/metal-cli/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "metal-cli";
-  version = "0.23.0";
+  version = "0.23.1";

  src = fetchFromGitHub {
    owner = "equinix";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-6bdDxxY5HwYXer8R1C5b7UIXy0wdBVDYYNtTR6eHv10=";
+    hash = "sha256-EuwLsrLwTM3FsUt1oa4N9y5Vq8TjTXQW+5UArXZHxuc=";
  };

-  vendorHash = "sha256-fNpfcBHxjPdWpfM9/OVdZ+ng13+Z/qdZE/MITTCjeC0=";
+  vendorHash = "sha256-X+GfM73LAWk2pT4ZOPT2pg8YaKyT+SNjQ14LgB+C7Wo=";

  ldflags = [
    "-s"
--- a/pkgs/development/tools/opcr-policy/default.nix
+++ b/pkgs/development/tools/opcr-policy/default.nix
@ -5,15 +5,15 @@

 buildGoModule rec {
  pname = "opcr-policy";
-  version = "0.2.15";
+  version = "0.2.16";

  src = fetchFromGitHub {
    owner = "opcr-io";
    repo = "policy";
    rev = "v${version}";
-    sha256 = "sha256-ffUggy1Ubs3pnBbznPR3JN0QrSBfkUI9bk+dSq4oxfs=";
+    sha256 = "sha256-nHxP9Dzc0sbgUE/SOqNIvofoi9/voYp8fFdRzMoBOHw=";
  };
-  vendorHash = "sha256-vqH3f1kfcOG04PPzC4izzKBJPZ3SSlK7y7nKhOJ9GdE=";
+  vendorHash = "sha256-KxMODAjpqDqQO2nfqMrEPa/WZDU3XKPDQCoil/vkqEI=";

  ldflags = [ "-s" "-w" "-X github.com/opcr-io/policy/pkg/version.ver=${version}" ];

--- a/pkgs/development/tools/skopeo/default.nix
+++ b/pkgs/development/tools/skopeo/default.nix
@ -18,13 +18,13 @@

 buildGoModule rec {
  pname = "skopeo";
-  version = "1.15.1";
+  version = "1.15.2";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "containers";
    repo = "skopeo";
-    hash = "sha256-Zv36vSPfXcpBmxyEA8b3Xoo9HhSWtxnWPP/SubIcHDo=";
+    hash = "sha256-qE6c7+NMGmz1zDqtEfAQQp/gQ0FP034q8wVCdHZ1wY8=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/development/tools/viceroy/default.nix
+++ b/pkgs/development/tools/viceroy/default.nix
@ -2,18 +2,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "viceroy";
-  version = "0.10.0";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "fastly";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-/B07J1VVrg8kqvJSEWaWbvAu1/3Xr4g1j4uLjuUdCh8=";
+    hash = "sha256-B6+ooPsKSsZNVyf9ObRM+iXYCsev3hztst4lU2z1p7A=";
  };

  buildInputs = lib.optional stdenv.isDarwin Security;

-  cargoHash = "sha256-k/BYHbZb0lfHDSXXApcM/BiAJByeH3dwrn71i9b8Aqs=";
+  cargoHash = "sha256-vu/x5SAHUx/L/gBQ22spXHHpc39E+Eg7olFNRimVB2s=";

  cargoTestFlags = [
    "--package viceroy-lib"
--- a/pkgs/games/commandergenius/default.nix
+++ b/pkgs/games/commandergenius/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "commandergenius";
-  version = "3.5.0";
+  version = "3.5.1";

  src = fetchFromGitLab {
    owner = "Dringgstein";
    repo = "Commander-Genius";
    rev = "v${version}";
-    hash = "sha256-w5DP7vkvWOs8qcHqoQaEWHnaBwUoi1I4gnE+Z3haHxE=";
+    hash = "sha256-sWnx2UdnuuLcTxhuXhfG2ssnFvuGi9kOBrpc4jiKgTs=";
  };

  buildInputs = [ SDL2 SDL2_image SDL2_mixer SDL2_ttf libGL boost libvorbis zlib curl python3 ];
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/CLTools_Executables.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/CLTools_Executables.nix
@ -0,0 +1,27 @@
+{
+  stdenvNoCC,
+  fetchurl,
+  cpio,
+  pbzx,
+  version,
+}:
+
+let
+  releases = builtins.fromJSON (builtins.readFile ./apple-sdk-releases.json);
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "CLTools_Executables";
+  inherit version;
+
+  src = fetchurl releases.${version}.${finalAttrs.pname};
+
+  nativeBuildInputs = [
+    cpio
+    pbzx
+  ];
+
+  buildCommand = ''
+    pbzx $src | cpio -idm
+    mv Library/Developer/CommandLineTools $out
+  '';
+})
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/CLTools_macOSNMOS_SDK.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/CLTools_macOSNMOS_SDK.nix
@ -0,0 +1,28 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  cpio,
+  pbzx,
+  version,
+}:
+
+let
+  releases = builtins.fromJSON (builtins.readFile ./apple-sdk-releases.json);
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "CLTools_macOSNMOS_SDK";
+  inherit version;
+
+  src = fetchurl releases.${version}.${finalAttrs.pname};
+
+  nativeBuildInputs = [
+    cpio
+    pbzx
+  ];
+
+  buildCommand = ''
+    pbzx $src | cpio -idm
+    mv Library/Developer/CommandLineTools/SDKs/MacOSX${lib.versions.majorMinor version}.sdk $out
+  '';
+})
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/apple-sdk-releases.json
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/apple-sdk-releases.json
@ -0,0 +1,20 @@
+{
+  "12.3": {
+    "CLTools_Executables": {
+      "hash": "sha256-XlxHwCq+rtBF3Yyfdob3UEHN7YKzb7JF84lRmZbB/50=",
+      "url": "https://swcdn.apple.com/content/downloads/24/42/002-83793-A_74JRE8GVAT/rlnkct919wgc5c0pjq986z5bb9h62uvni2/CLTools_Executables.pkg"
+    },
+    "CLTools_macOSLMOS_SDK": {
+      "hash": "sha256-mY9YTlyTujV6R89WaNmkJrfOQatXnoSW8gKxnawQz5Q=",
+      "url": "https://swcdn.apple.com/content/downloads/24/42/002-83793-A_74JRE8GVAT/rlnkct919wgc5c0pjq986z5bb9h62uvni2/CLTools_macOSLMOS_SDK.pkg"
+    },
+    "CLTools_macOSNMOS_SDK": {
+      "hash": "sha256-Tr9VCeCP5udmh09U/zPQG2c4ky1LXscBwPfgpRy8uds=",
+      "url": "https://swcdn.apple.com/content/downloads/24/42/002-83793-A_74JRE8GVAT/rlnkct919wgc5c0pjq986z5bb9h62uvni2/CLTools_macOSNMOS_SDK.pkg"
+    },
+    "CLTools_macOS_SDK": {
+      "hash": "sha256-2xwYLfiYuEdck7/8NY3iqiPKvoG9HAjXt8Ewyp9c0Es=",
+      "url": "https://swcdn.apple.com/content/downloads/24/42/002-83793-A_74JRE8GVAT/rlnkct919wgc5c0pjq986z5bb9h62uvni2/CLTools_macOS_SDK.pkg"
+    }
+  }
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/default.nix
@ -0,0 +1,49 @@
+{
+  lib,
+  newScope,
+  overrideCC,
+  pkgs,
+  stdenv,
+  stdenvNoCC,
+}:
+
+let
+  version = "12.3";
+
+  MacOSX-SDK = callPackage ./CLTools_macOSNMOS_SDK.nix { inherit version; };
+  callPackage = newScope (pkgs.darwin // packages);
+
+  packages = {
+    # Make sure we pass our special `callPackage` instead of using packages.callPackage which
+    # does not have necessary attributes in scope.
+    frameworks = callPackage ./frameworks { inherit callPackage; };
+    libs = callPackage ./libs { inherit callPackage; };
+
+    CLTools_Executables = callPackage ./CLTools_Executables.nix { inherit version; };
+    Libsystem = callPackage ./libSystem.nix { };
+    LibsystemCross = callPackage ./libSystem.nix { };
+    libunwind = callPackage ./libunwind.nix { };
+    libnetwork = callPackage ./libnetwork.nix { };
+    libpm = callPackage ./libpm.nix { };
+    # Avoid introducing a new objc4 if stdenv already has one, to prevent
+    # conflicting LLVM modules.
+    objc4 = stdenv.objc4 or (callPackage ./libobjc.nix { });
+
+    darwin-stubs = stdenvNoCC.mkDerivation {
+      pname = "darwin-stubs";
+      inherit (MacOSX-SDK) version;
+
+      preferLocalBuild = true;
+      allowSubstitutes = false;
+
+      buildCommand = ''
+        mkdir -p "$out"
+        ln -s ${MacOSX-SDK}/System "$out/System"
+        ln -s ${MacOSX-SDK}/usr "$out/usr"
+      '';
+    };
+
+    sdkRoot = pkgs.callPackage ../apple-sdk/sdkRoot.nix { sdkVersion = version; };
+  };
+in
+packages
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/default.nix
@ -0,0 +1,146 @@
+{
+  lib,
+  stdenvNoCC,
+  buildPackages,
+  # macOS things
+  callPackage,
+  darwin-stubs,
+}:
+
+let
+  inherit (darwin-stubs) version;
+  fixup-frameworks = callPackage ./fixups.nix { };
+  private-frameworks = callPackage ./private.nix { };
+  public-frameworks = callPackage ./public.nix { };
+
+  mkDepsRewrites =
+    deps:
+    let
+      mergeRewrites = x: y: {
+        prefix = lib.mergeAttrs (x.prefix or { }) (y.prefix or { });
+        const = lib.mergeAttrs (x.const or { }) (y.const or { });
+      };
+
+      rewriteArgs =
+        {
+          prefix ? { },
+          const ? { },
+        }:
+        lib.concatLists (
+          (lib.mapAttrsToList (from: to: [
+            "-p"
+            "${from}:${to}"
+          ]) prefix)
+          ++ (lib.mapAttrsToList (from: to: [
+            "-c"
+            "${from}:${to}"
+          ]) const)
+        );
+
+      rewrites =
+        depList:
+        lib.fold mergeRewrites { } (
+          map (dep: dep.tbdRewrites) (lib.filter (dep: dep ? tbdRewrites) depList)
+        );
+    in
+    lib.escapeShellArgs (rewriteArgs (rewrites (lib.attrValues deps)));
+
+  mkFramework =
+    {
+      name,
+      deps,
+      private ? false,
+    }:
+    let
+      standardFrameworkPath =
+        name: private:
+        "/System/Library/${lib.optionalString private "Private"}Frameworks/${name}.framework";
+
+      self = stdenvNoCC.mkDerivation {
+        pname = "apple-${lib.optionalString private "private-"}framework-${name}";
+        inherit (darwin-stubs) version;
+
+        # because we copy files from the system
+        preferLocalBuild = true;
+
+        dontUnpack = true;
+        dontBuild = true;
+
+        disallowedRequisites = [ darwin-stubs ];
+
+        nativeBuildInputs = [ buildPackages.darwin.rewrite-tbd ];
+
+        installPhase = ''
+          mkdir -p $out/Library/Frameworks
+
+          cp -r ${darwin-stubs}${standardFrameworkPath name private} $out/Library/Frameworks
+
+          if [[ -d ${darwin-stubs}/usr/lib/swift/${name}.swiftmodule ]]; then
+            mkdir -p $out/lib/swift
+            cp -r -t $out/lib/swift \
+              ${darwin-stubs}/usr/lib/swift/${name}.swiftmodule \
+              ${darwin-stubs}/usr/lib/swift/libswift${name}.tbd
+          fi
+
+          # Fix and check tbd re-export references
+          chmod u+w -R $out
+          find $out -name '*.tbd' -type f | while IFS=$'\n' read tbd; do
+            echo "Fixing re-exports in $tbd"
+            rewrite-tbd \
+              -p ${standardFrameworkPath name private}/:$out/Library/Frameworks/${name}.framework/ \
+              -p /usr/lib/swift/:$out/lib/swift/ \
+              ${mkDepsRewrites deps} \
+              -r ${builtins.storeDir} \
+              "$tbd"
+          done
+        '';
+
+        propagatedBuildInputs = lib.attrValues deps;
+
+        passthru.tbdRewrites.prefix."${standardFrameworkPath name private}/" = "${self}/Library/Frameworks/${name}.framework/";
+
+        meta = with lib; {
+          description = "Apple SDK framework ${name}";
+          maintainers = with maintainers; [ ];
+          platforms = platforms.darwin;
+        };
+      };
+    in
+    self;
+
+  # Helper functions for creating framework derivations.
+  framework =
+    name: deps:
+    mkFramework {
+      inherit name deps;
+      private = false;
+    };
+
+  # Helper functions for creating private framework derivations.
+  privateFramework =
+    name: deps:
+    mkFramework {
+      inherit name deps;
+      private = true;
+    };
+
+  # Merge addToFrameworks into public-frameworks and remove elements of removeFromFrameworks.
+  deps =
+    let
+      inherit (fixup-frameworks) addToFrameworks removeFromFrameworks;
+      fixupDeps =
+        name: deps:
+        lib.pipe deps [
+          # Add dependencies from addToFrameworks.
+          (deps: lib.recursiveUpdate deps (addToFrameworks.${name} or { }))
+          # Keep dependencies not in removeFromFrameworks.
+          (lib.filterAttrs (depName: _: !(removeFromFrameworks.${name}.${depName} or false)))
+        ];
+    in
+    lib.mapAttrs fixupDeps public-frameworks;
+
+  # Create derivations and add private frameworks.
+  bareFrameworks =
+    (lib.mapAttrs framework deps) // (lib.mapAttrs privateFramework private-frameworks);
+in
+bareFrameworks // fixup-frameworks.overrideFrameworks bareFrameworks
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/fixups.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/fixups.nix
@ -0,0 +1,160 @@
+{
+  lib,
+  # macOS things
+  frameworks,
+  libnetwork,
+  libs,
+  darwin-stubs,
+  objc4,
+}:
+
+{
+  # Used to add dependencies which are not picked up by gen-frameworks.py.
+  # Some of these are simply private frameworks the generator does not see.
+  # Trial and error, building things and adding dependencies when they fail.
+  addToFrameworks =
+    let
+      inherit (libs) libDER;
+      libobjc = objc4;
+    in
+    with frameworks;
+    {
+      # Below this comment are entries migrated from before the generator was
+      # added. If, for a given framework, you are able to reverify the extra
+      # deps are really necessary on top of the generator deps, move it above
+      # this comment (and maybe document your findings).
+      AVFoundation = {
+        inherit ApplicationServices AVFCapture AVFCore;
+      };
+      Accelerate = {
+        inherit CoreWLAN IOBluetooth;
+      };
+      AddressBook = {
+        inherit AddressBookCore ContactsPersistence libobjc;
+      };
+      AppKit = {
+        inherit AudioToolbox AudioUnit UIFoundation;
+      };
+      AudioToolbox = {
+        inherit AudioToolboxCore;
+      };
+      AudioUnit = {
+        inherit Carbon CoreAudio;
+      };
+      Carbon = {
+        inherit IOKit QuartzCore libobjc;
+      };
+      CoreAudio = {
+        inherit IOKit;
+      };
+      CoreFoundation = {
+        inherit libobjc;
+      };
+      CoreGraphics = {
+        inherit SystemConfiguration;
+      };
+      CoreMIDIServer = {
+        inherit CoreMIDI;
+      };
+      CoreMedia = {
+        inherit ApplicationServices AudioToolbox AudioUnit;
+      };
+      CoreServices = {
+        inherit CoreAudio NetFS ServiceManagement;
+      };
+      CoreWLAN = {
+        inherit SecurityFoundation;
+      };
+      DiscRecording = {
+        inherit IOKit libobjc;
+      };
+      Foundation = {
+        inherit SystemConfiguration libobjc;
+      };
+      GameKit = {
+        inherit
+          GameCenterFoundation
+          GameCenterUI
+          GameCenterUICore
+          ReplayKit
+          ;
+      };
+      ICADevices = {
+        inherit Carbon libobjc;
+      };
+      IOBluetooth = {
+        inherit CoreBluetooth;
+      };
+      JavaScriptCore = {
+        inherit libobjc;
+      };
+      Kernel = {
+        inherit IOKit;
+      };
+      LinkPresentation = {
+        inherit URLFormatting;
+      };
+      MediaToolbox = {
+        inherit AudioUnit;
+      };
+      MetricKit = {
+        inherit SignpostMetrics;
+      };
+      Network = {
+        inherit libnetwork;
+      };
+      PCSC = {
+        inherit CoreData;
+      };
+      PassKit = {
+        inherit PassKitCore;
+      };
+      QTKit = {
+        inherit
+          CoreMedia
+          CoreMediaIO
+          MediaToolbox
+          VideoToolbox
+          ;
+      };
+      Quartz = {
+        inherit QTKit;
+      };
+      QuartzCore = {
+        inherit
+          ApplicationServices
+          CoreImage
+          CoreVideo
+          Metal
+          OpenCL
+          libobjc
+          ;
+      };
+      Security = {
+        inherit IOKit libDER;
+      };
+      TWAIN = {
+        inherit Carbon;
+      };
+      VideoDecodeAcceleration = {
+        inherit CoreVideo;
+      };
+      WebKit = {
+        inherit ApplicationServices Carbon libobjc;
+      };
+    };
+
+  # Used to remove dependencies which are picked up by gen-frameworks.py -- used mainly to break
+  # cyclic dependencies.
+  removeFromFrameworks = { };
+
+  # Overrides for framework derivations.
+  overrideFrameworks = super: {
+    # This framework doesn't exist in newer SDKs (somewhere around 10.13), but
+    # there are references to it in nixpkgs.
+    QuickTime = throw "QuickTime framework not available";
+
+    # Seems to be appropriate given https://developer.apple.com/forums/thread/666686
+    JavaVM = super.JavaNativeFoundation;
+  };
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/private.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/private.nix
@ -0,0 +1,35 @@
+{ objc4, frameworks }:
+
+# generated by hand to avoid exposing all private frameworks
+# frameworks here are only the necessary ones used by public frameworks.
+{
+  AVFCapture = { };
+  AVFCore = { };
+  AddressBookCore = {
+    inherit (frameworks) ContactsPersistence;
+  };
+  AudioToolboxCore = { };
+  ContactsPersistence = { };
+  UIFoundation = { };
+  GameCenterFoundation = { };
+  GameCenterUI = { };
+  GameCenterUICore = { };
+  URLFormatting = { };
+  SignpostMetrics = { };
+  PassKitCore = { };
+  SkyLight = { };
+
+  # Also expose CoreSymbolication; used by `root` package.
+  CoreSymbolication = { };
+
+  # Also expose DebugSymbols; used by `llvmPackages_8.lldb` package.
+  DebugSymbols = { };
+
+  # Also expose DisplayServices; used by `sketchybar` package.
+  DisplayServices = {
+    libobjc = objc4;
+  };
+
+  # Also expose MultitouchSupport; used by `chuck` package.
+  MultitouchSupport = { };
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/public.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/public.nix
@ -0,0 +1,209 @@
+# This file is generated by gen-frameworks.nix.
+# Do not edit, put overrides in apple_sdk.nix instead.
+{ libs, frameworks }: with libs; with frameworks;
+{
+  AGL                              = { inherit Carbon OpenGL; };
+  AVFAudio                         = { inherit AudioToolbox CoreAudioTypes CoreMIDI CoreMedia Foundation; };
+  AVFoundation                     = { inherit AVFAudio CoreAudio CoreFoundation CoreGraphics CoreImage CoreMIDI CoreMedia CoreVideo Foundation IOKit ImageIO MediaToolbox Metal QuartzCore UniformTypeIdentifiers simd; };
+  AVKit                            = { inherit AVFoundation AppKit Cocoa Foundation; };
+  Accelerate                       = { inherit CoreFoundation CoreGraphics CoreVideo Foundation IOKit Metal; };
+  Accessibility                    = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  Accounts                         = { inherit Foundation; };
+  AdServices                       = { inherit Foundation; };
+  AdSupport                        = { inherit Foundation; };
+  AddressBook                      = { inherit Carbon Cocoa CoreFoundation Foundation; };
+  AppKit                           = { inherit Accessibility ApplicationServices CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal OpenGL QuartzCore; };
+  AppTrackingTransparency          = { inherit Foundation; };
+  AppleScriptKit                   = {};
+  AppleScriptObjC                  = { inherit Foundation; };
+  ApplicationServices              = { inherit ColorSync CoreFoundation CoreGraphics CoreServices CoreText ImageIO; };
+  AudioToolbox                     = { inherit Carbon CoreAudio CoreAudioTypes CoreFoundation CoreMIDI Foundation; };
+  AudioUnit                        = { inherit AudioToolbox; };
+  AudioVideoBridging               = { inherit Foundation IOKit; };
+  AuthenticationServices           = { inherit AppKit Foundation; };
+  AutomaticAssessmentConfiguration = { inherit Foundation; };
+  Automator                        = { inherit AppKit Cocoa Foundation OSAKit; };
+  BackgroundTasks                  = { inherit Foundation; };
+  BusinessChat                     = { inherit Cocoa Foundation; };
+  CFNetwork                        = { inherit CoreFoundation; };
+  CHIP                             = { inherit Foundation Security; };
+  CalendarStore                    = {};
+  CallKit                          = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  Carbon                           = { inherit ApplicationServices CoreServices Foundation Security; };
+  ClassKit                         = { inherit CoreGraphics Foundation; };
+  CloudKit                         = { inherit CoreFoundation CoreGraphics CoreLocation Foundation IOKit; };
+  Cocoa                            = { inherit AppKit CoreData Foundation; };
+  Collaboration                    = { inherit AppKit CoreServices Foundation; };
+  ColorSync                        = { inherit CoreFoundation; };
+  Combine                          = {};
+  Contacts                         = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  ContactsUI                       = { inherit AppKit; };
+  CoreAudio                        = { inherit CoreAudioTypes CoreFoundation; };
+  CoreAudioKit                     = { inherit AppKit AudioUnit Cocoa Foundation; };
+  CoreAudioTypes                   = { inherit CoreFoundation; };
+  CoreBluetooth                    = { inherit Foundation; };
+  CoreData                         = { inherit Combine CoreFoundation CoreGraphics Foundation IOKit; };
+  CoreDisplay                      = {};
+  CoreFoundation                   = {};
+  CoreGraphics                     = { inherit CoreFoundation IOKit; };
+  CoreHaptics                      = { inherit Foundation; };
+  CoreImage                        = { inherit ApplicationServices CoreFoundation CoreGraphics CoreVideo Foundation IOKit IOSurface ImageIO Metal OpenGL; };
+  CoreLocation                     = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  CoreMIDI                         = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  CoreMIDIServer                   = {};
+  CoreML                           = { inherit CoreFoundation CoreGraphics CoreVideo Foundation IOKit ImageIO Metal; };
+  CoreMedia                        = { inherit CoreAudio CoreAudioTypes CoreFoundation CoreGraphics CoreVideo Foundation IOKit Metal; };
+  CoreMediaIO                      = { inherit CoreAudio CoreFoundation CoreGraphics CoreMedia Foundation IOKit Metal; };
+  CoreMotion                       = { inherit Foundation; };
+  CoreServices                     = { inherit CFNetwork CoreFoundation DiskArbitration Security; };
+  CoreSpotlight                    = { inherit Foundation UniformTypeIdentifiers; };
+  CoreTelephony                    = {};
+  CoreText                         = { inherit CoreFoundation CoreGraphics; };
+  CoreVideo                        = { inherit ApplicationServices CoreFoundation CoreGraphics IOSurface Metal OpenGL; };
+  CoreWLAN                         = { inherit Foundation IOKit; };
+  CreateML                         = { inherit AVFoundation Combine CoreAudio CoreFoundation CoreGraphics CoreImage CoreML CoreMedia CoreServices CoreVideo Foundation IOKit ImageIO Metal MetalPerformanceShaders NaturalLanguage TabularData VideoToolbox Vision simd; };
+  CryptoKit                        = { inherit CoreFoundation CoreGraphics Foundation IOKit LocalAuthentication Security; };
+  CryptoTokenKit                   = { inherit CoreFoundation CoreGraphics Foundation IOKit Security; };
+  DVDPlayback                      = { inherit ApplicationServices CoreFoundation Security; };
+  DataDetection                    = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  DeveloperToolsSupport            = {};
+  DeviceActivity                   = { inherit Foundation ManagedSettings; };
+  DeviceCheck                      = { inherit Foundation; };
+  DirectoryService                 = { inherit CoreFoundation; };
+  DiscRecording                    = { inherit CoreServices Foundation; };
+  DiscRecordingUI                  = { inherit Carbon Cocoa DiscRecording; };
+  DiskArbitration                  = { inherit CoreFoundation IOKit; };
+  DriverKit                        = {};
+  EventKit                         = { inherit CoreGraphics CoreLocation Foundation; };
+  ExceptionHandling                = { inherit Foundation; };
+  ExecutionPolicy                  = { inherit Foundation; };
+  ExposureNotification             = { inherit Foundation; };
+  ExternalAccessory                = { inherit Foundation; };
+  FWAUserLib                       = { inherit IOKit; };
+  FileProvider                     = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  FileProviderUI                   = { inherit AppKit FileProvider Foundation; };
+  FinderSync                       = { inherit AppKit Foundation; };
+  ForceFeedback                    = { inherit CoreFoundation IOKit; };
+  Foundation                       = { inherit Combine CoreFoundation CoreGraphics CoreServices IOKit Security; };
+  GLKit                            = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal ModelIO OpenGL QuartzCore simd; };
+  GLUT                             = { inherit OpenGL; };
+  GSS                              = { inherit CoreFoundation; };
+  GameController                   = { inherit AppKit Foundation IOKit; };
+  GameKit                          = { inherit AppKit Cocoa Contacts CoreGraphics Foundation GameController GameplayKit Metal MetalKit ModelIO SceneKit SpriteKit simd; };
+  GameplayKit                      = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation GLKit IOKit Metal ModelIO QuartzCore SceneKit SpriteKit simd; };
+  GroupActivities                  = { inherit AVFoundation Combine CoreGraphics CryptoKit Foundation Network UniformTypeIdentifiers; };
+  Hypervisor                       = {};
+  ICADevices                       = { inherit CoreFoundation CoreGraphics CoreServices IOBluetooth; };
+  IMServicePlugIn                  = { inherit Foundation; };
+  IOBluetooth                      = { inherit CoreAudio CoreFoundation CoreServices Foundation IOKit; };
+  IOBluetoothUI                    = { inherit Cocoa IOBluetooth; };
+  IOKit                            = { inherit CoreFoundation; };
+  IOSurface                        = { inherit CoreFoundation Foundation IOKit; };
+  IOUSBHost                        = { inherit Foundation IOKit; };
+  IdentityLookup                   = { inherit Foundation; };
+  ImageCaptureCore                 = { inherit Cocoa CoreGraphics Foundation; };
+  ImageIO                          = { inherit CoreFoundation CoreGraphics; };
+  InputMethodKit                   = { inherit Carbon Cocoa Foundation; };
+  InstallerPlugins                 = {};
+  InstantMessage                   = {};
+  Intents                          = { inherit CoreFoundation CoreGraphics CoreLocation Foundation IOKit UserNotifications; };
+  IntentsUI                        = { inherit AppKit; };
+  JavaNativeFoundation             = { inherit Foundation; };
+  JavaRuntimeSupport               = { inherit ApplicationServices Cocoa Foundation QuartzCore; };
+  JavaScriptCore                   = { inherit CoreFoundation CoreGraphics Foundation; };
+  Kerberos                         = {};
+  Kernel                           = {};
+  KernelManagement                 = { inherit Foundation; };
+  LDAP                             = {};
+  LatentSemanticMapping            = { inherit Carbon CoreFoundation; };
+  LinkPresentation                 = { inherit AppKit Foundation; };
+  LocalAuthentication              = { inherit Foundation; };
+  LocalAuthenticationEmbeddedUI    = { inherit AppKit Foundation LocalAuthentication; };
+  MLCompute                        = { inherit CoreFoundation CoreGraphics Foundation IOKit Metal; };
+  MailKit                          = { inherit AppKit Foundation; };
+  ManagedSettings                  = { inherit Combine Foundation; };
+  MapKit                           = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal QuartzCore; };
+  MediaAccessibility               = { inherit CoreFoundation CoreGraphics CoreText; };
+  MediaLibrary                     = { inherit Foundation; };
+  MediaPlayer                      = { inherit AVFoundation CoreGraphics Foundation; };
+  MediaToolbox                     = { inherit AudioToolbox CoreFoundation CoreMedia; };
+  Message                          = {};
+  Metal                            = { inherit CoreFoundation CoreGraphics Foundation IOKit IOSurface; };
+  MetalKit                         = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal ModelIO QuartzCore simd; };
+  MetalPerformanceShaders          = { inherit CoreGraphics Foundation Metal simd; };
+  MetalPerformanceShadersGraph     = { inherit Foundation MetalPerformanceShaders; };
+  MetricKit                        = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  ModelIO                          = { inherit CoreFoundation CoreGraphics Foundation IOKit simd; };
+  MultipeerConnectivity            = { inherit Cocoa Foundation; };
+  MusicKit                         = { inherit Combine CoreGraphics Foundation; };
+  NaturalLanguage                  = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  NearbyInteraction                = { inherit CoreFoundation CoreGraphics Foundation IOKit simd; };
+  NetFS                            = { inherit CoreFoundation; };
+  Network                          = { inherit CoreFoundation Foundation Security; };
+  NetworkExtension                 = { inherit Foundation Network Security; };
+  NotificationCenter               = { inherit AppKit Foundation; };
+  OSAKit                           = { inherit Carbon Cocoa; };
+  OSLog                            = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  OpenAL                           = {};
+  OpenCL                           = { inherit OpenGL; };
+  OpenDirectory                    = { inherit CoreFoundation Foundation; };
+  OpenGL                           = {};
+  PCSC                             = {};
+  PDFKit                           = { inherit AppKit Cocoa; };
+  PHASE                            = { inherit AVFAudio AVFoundation CoreAudioTypes Foundation ModelIO simd; };
+  ParavirtualizedGraphics          = { inherit AppKit CoreVideo Foundation IOSurface Metal; };
+  PassKit                          = { inherit AppKit Contacts CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal QuartzCore; };
+  PencilKit                        = { inherit AppKit Cocoa CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal QuartzCore; };
+  Photos                           = { inherit AVFoundation CoreAudio CoreFoundation CoreGraphics CoreImage CoreLocation CoreMIDI CoreMedia Foundation IOKit ImageIO Metal QuartzCore UniformTypeIdentifiers simd; };
+  PhotosUI                         = { inherit AppKit Foundation MapKit Photos; };
+  PreferencePanes                  = { inherit Cocoa; };
+  PushKit                          = { inherit Foundation; };
+  QTKit                            = {};
+  Quartz                           = { inherit AppKit ApplicationServices Cocoa Foundation ImageCaptureCore OpenGL PDFKit QuartzCore QuickLookUI; };
+  QuartzCore                       = { inherit CoreFoundation CoreGraphics CoreImage CoreVideo Foundation IOKit Metal OpenGL; };
+  QuickLook                        = { inherit ApplicationServices CoreFoundation; };
+  QuickLookThumbnailing            = { inherit CoreGraphics Foundation UniformTypeIdentifiers; };
+  QuickLookUI                      = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal PDFKit QuartzCore QuickLook UniformTypeIdentifiers; };
+  RealityFoundation                = { inherit AVFAudio AVFoundation AppKit AudioToolbox Combine CoreAudio CoreFoundation CoreGraphics CoreMIDI CoreMedia CoreMotion CoreText CoreVideo Foundation IOKit Metal QuartzCore simd; };
+  RealityKit                       = { inherit AppKit Combine CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal MultipeerConnectivity QuartzCore RealityFoundation simd; };
+  ReplayKit                        = { inherit AVFoundation AppKit Foundation; };
+  Ruby                             = {};
+  SafariServices                   = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal QuartzCore; };
+  SceneKit                         = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation GLKit IOKit Metal ModelIO QuartzCore simd; };
+  ScreenCaptureKit                 = { inherit AppKit CoreGraphics CoreMedia Foundation; };
+  ScreenSaver                      = { inherit AppKit Foundation; };
+  ScreenTime                       = { inherit AppKit Foundation; };
+  ScriptingBridge                  = { inherit ApplicationServices CoreServices Foundation; };
+  Security                         = { inherit CoreFoundation; };
+  SecurityFoundation               = { inherit Foundation Security; };
+  SecurityInterface                = { inherit AppKit Cocoa Security SecurityFoundation; };
+  SensorKit                        = { inherit CoreFoundation CoreLocation Foundation; };
+  ServiceManagement                = { inherit CoreFoundation Security; };
+  ShazamKit                        = { inherit AVFAudio CoreAudio CoreFoundation CoreGraphics CoreMIDI CoreMedia Foundation IOKit Metal MusicKit; };
+  Social                           = { inherit AppKit Foundation; };
+  SoundAnalysis                    = { inherit AVFoundation CoreAudio CoreFoundation CoreGraphics CoreImage CoreMIDI CoreML CoreMedia Foundation IOKit Metal QuartzCore UniformTypeIdentifiers simd; };
+  Speech                           = { inherit AVFoundation CoreAudio CoreFoundation CoreGraphics CoreImage CoreMIDI CoreMedia Foundation IOKit Metal QuartzCore UniformTypeIdentifiers simd; };
+  SpriteKit                        = { inherit AppKit Cocoa CoreData CoreFoundation CoreGraphics CoreImage Foundation GLKit IOKit Metal ModelIO QuartzCore simd; };
+  StoreKit                         = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage CryptoKit Foundation IOKit Metal QuartzCore Security; };
+  SwiftUI                          = { inherit Accessibility AppKit Combine CoreData CoreFoundation CoreGraphics CoreImage DeveloperToolsSupport Foundation IOKit Metal QuartzCore UniformTypeIdentifiers; };
+  SyncServices                     = {};
+  System                           = {};
+  SystemConfiguration              = { inherit CoreFoundation Security; };
+  SystemExtensions                 = { inherit Foundation; };
+  TWAIN                            = {};
+  TabularData                      = { inherit Combine Foundation; };
+  Tcl                              = {};
+  Tk                               = {};
+  UniformTypeIdentifiers           = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  UserNotifications                = { inherit Foundation; };
+  UserNotificationsUI              = { inherit AppKit; };
+  VideoDecodeAcceleration          = {};
+  VideoSubscriberAccount           = { inherit Foundation; };
+  VideoToolbox                     = { inherit CoreFoundation CoreGraphics CoreMedia CoreVideo; };
+  Virtualization                   = { inherit AppKit Cocoa CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal QuartzCore; };
+  Vision                           = { inherit CoreAudio CoreFoundation CoreGraphics CoreML CoreMedia CoreVideo Foundation IOKit ImageIO Metal simd; };
+  WebKit                           = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit JavaScriptCore Metal QuartzCore; };
+  WidgetKit                        = { inherit Combine CoreFoundation CoreGraphics Foundation IOKit Intents SwiftUI UniformTypeIdentifiers; };
+  iTunesLibrary                    = { inherit Foundation; };
+  vmnet                            = {};
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/libSystem.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libSystem.nix
@ -0,0 +1,96 @@
+{
+  stdenvNoCC,
+  buildPackages,
+  darwin-stubs,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "libSystem";
+  inherit (darwin-stubs) version;
+
+  nativeBuildInputs = [ buildPackages.darwin.rewrite-tbd ];
+
+  csu = [
+    "bundle1.o"
+    "crt0.o"
+    "crt1.10.5.o"
+    "crt1.10.6.o"
+    "crt1.o"
+    "dylib1.10.5.o"
+    "dylib1.o"
+    "gcrt1.o"
+    "lazydylib1.o"
+  ];
+
+  buildCommand =
+    ''
+      mkdir -p $out/{include,lib/swift}
+    ''
+    # Copy each directory in ${darwin-stubs}/usr/include into $out/include
+    + ''
+      for dir in $(ls -d ${darwin-stubs}/usr/include/*/); do
+        cp -dr $dir $out/include
+      done
+    ''
+    # Copy each header and modulemap file in ${darwin-stubs}/usr/include into $out/include
+    + ''
+      cp -d \
+        ${darwin-stubs}/usr/include/*.h \
+        ${darwin-stubs}/usr/include/*.modulemap \
+        $out/include
+    ''
+    # Remove curses.h, ncurses.h, ncurses_dll.h, and unctrl.h which conflict with ncurses.
+    # Then, remove the module map for ncurses.
+    # NOTE: The sed expression expects the module map to use consistent indentation across
+    #   releases. If this changes, the sed expression will need to be updated.
+    #
+    #   For example, right now we assume that there is one leading space before the
+    #   "explicit" keyword and that the closing brace is on its own line (also with one
+    #   leading space).
+    + ''
+      rm $out/include/{curses,ncurses,ncurses_dll,unctrl}.h
+      sed -i -e '/^ explicit module ncurses {/,/^ }$/d' $out/include/module.modulemap
+    ''
+    + ''
+      rm $out/include/tk*.h $out/include/tcl*.h
+
+      cp -dr \
+        ${darwin-stubs}/usr/lib/libSystem.* \
+        ${darwin-stubs}/usr/lib/system \
+        $out/lib
+
+      # Extra libraries
+      for name in c dbm dl info m mx poll proc pthread rpcsvc util gcc_s.1 resolv; do
+        cp -d \
+          ${darwin-stubs}/usr/lib/lib$name.tbd \
+          ${darwin-stubs}/usr/lib/lib$name.*.tbd \
+          $out/lib
+      done
+
+      for name in os Dispatch; do
+        cp -dr \
+          ${darwin-stubs}/usr/lib/swift/$name.swiftmodule \
+          ${darwin-stubs}/usr/lib/swift/libswift$name.tbd \
+          $out/lib/swift
+      done
+
+      for f in $csu; do
+        from=${darwin-stubs}/usr/lib/$f
+        if [ -e "$from" ]; then
+          cp -d $from $out/lib
+        else
+          echo "Csu file '$from' doesn't exist: skipping"
+        fi
+      done
+
+      chmod u+w -R $out/lib
+      find $out -name '*.tbd' -type f | while read tbd; do
+        rewrite-tbd \
+          -c /usr/lib/libsystem.dylib:$out/lib/libsystem.dylib \
+          -p /usr/lib/system/:$out/lib/system/ \
+          -p /usr/lib/swift/:$out/lib/swift/ \
+          -r ${builtins.storeDir} \
+          "$tbd"
+      done
+    '';
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/libnetwork.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libnetwork.nix
@ -0,0 +1,16 @@
+{ stdenvNoCC, darwin-stubs }:
+
+let
+  self = stdenvNoCC.mkDerivation {
+    pname = "libnetwork";
+    inherit (darwin-stubs) version;
+
+    buildCommand = ''
+      mkdir -p $out/lib
+      cp ${darwin-stubs}/usr/lib/libnetwork* $out/lib
+    '';
+
+    passthru.tbdRewrites.const."/usr/lib/libnetwork.dylib" = "${self}/lib/libnetwork.dylib";
+  };
+in
+self
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/libobjc.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libobjc.nix
@ -0,0 +1,22 @@
+{ stdenvNoCC, darwin-stubs }:
+
+let
+  self = stdenvNoCC.mkDerivation {
+    pname = "libobjc";
+    inherit (darwin-stubs) version;
+
+    buildCommand = ''
+      mkdir -p $out/{include,lib/swift}
+      cp -r ${darwin-stubs}/usr/include/objc $out/include
+      cp ${darwin-stubs}/usr/lib/libobjc* $out/lib
+      cp -r ${darwin-stubs}/usr/lib/swift/ObjectiveC.swiftmodule $out/lib/swift
+      cp ${darwin-stubs}/usr/lib/swift/libswiftObjectiveC.tbd $out/lib/swift
+    '';
+
+    passthru.tbdRewrites = {
+      const."/usr/lib/libobjc.A.dylib" = "${self}/lib/libobjc.A.dylib";
+      const."/usr/lib/swift/libswiftObjectiveC.dylib" = "${self}/lib/swift/libswiftObjectiveC.dylib";
+    };
+  };
+in
+self
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/libpm.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libpm.nix
@ -0,0 +1,25 @@
+{
+  stdenvNoCC,
+  buildPackages,
+  darwin-stubs,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "libpm";
+  inherit (darwin-stubs) version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ buildPackages.darwin.checkReexportsHook ];
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp ${darwin-stubs}/usr/lib/libpm* $out/lib
+  '';
+
+  passthru.tbdRewrites = {
+    const."/usr/lib/libpmenergy.dylib" = "${placeholder "out"}/lib/libpmenergy.dylib";
+    const."/usr/lib/libpmsample.dylib" = "${placeholder "out"}/lib/libpmsample.dylib";
+  };
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/Xplugin.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/Xplugin.nix
@ -0,0 +1,30 @@
+{
+  frameworks,
+  darwin-stubs,
+  stdenvNoCC,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "apple-lib-Xplugin";
+  inherit (darwin-stubs) version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  propagatedBuildInputs = with frameworks; [
+    OpenGL
+    ApplicationServices
+    Carbon
+    IOKit
+    CoreGraphics
+    CoreServices
+    CoreText
+  ];
+
+  installPhase = ''
+    mkdir -p $out/include $out/lib
+    cp "${darwin-stubs}/include/Xplugin.h" $out/include/Xplugin.h
+    cp ${darwin-stubs}/usr/lib/libXplugin.1.tbd $out/lib
+    ln -s libXplugin.1.tbd $out/lib/libXplugin.tbd
+  '';
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/default.nix
@ -0,0 +1,10 @@
+{ callPackage }:
+
+{
+  libDER = callPackage ./libDER.nix { };
+  sandbox = callPackage ./sandbox.nix { };
+  simd = callPackage ./simd.nix { };
+  utmp = callPackage ./utmp.nix { };
+  xpc = callPackage ./xpc.nix { };
+  Xplugin = callPackage ./Xplugin.nix { };
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/libDER.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/libDER.nix
@ -0,0 +1,11 @@
+{ darwin-stubs, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation {
+  pname = "apple-lib-libDER";
+  inherit (darwin-stubs) version;
+
+  buildCommand = ''
+    mkdir -p $out/include
+    cp -r ${darwin-stubs}/usr/include/libDER $out/include
+  '';
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/sandbox.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/sandbox.nix
@ -0,0 +1,13 @@
+{ darwin-stubs, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation {
+  pname = "apple-lib-sandbox";
+  inherit (darwin-stubs) version;
+
+  buildCommand = ''
+    mkdir -p $out/include $out/lib
+    cp "${darwin-stubs}/usr/include/sandbox.h" $out/include/sandbox.h
+    cp "${darwin-stubs}/usr/lib/libsandbox.1.tbd" $out/lib
+    ln -s libsandbox.1.tbd $out/lib/libsandbox.tbd
+  '';
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/simd.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/simd.nix
@ -0,0 +1,11 @@
+{ darwin-stubs, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation {
+  pname = "apple-lib-simd";
+  inherit (darwin-stubs) version;
+
+  buildCommand = ''
+    mkdir -p $out/include
+    cp -r ${darwin-stubs}/usr/include/simd $out/include
+  '';
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/utmp.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/utmp.nix
@ -0,0 +1,12 @@
+{ darwin-stubs, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation {
+  pname = "apple-lib-utmp";
+  inherit (darwin-stubs) version;
+
+  buildCommand = ''
+    mkdir -p $out/include
+    cp "${darwin-stubs}/include/utmp.h" $out/include
+    cp "${darwin-stubs}/include/utmpx.h" $out/include
+  '';
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/xpc.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/xpc.nix
@ -0,0 +1,12 @@
+{ darwin-stubs, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation {
+  pname = "apple-lib-xpc";
+  inherit (darwin-stubs) version;
+
+  buildCommand = ''
+    mkdir -p $out/include
+    cp -r "${darwin-stubs}/usr/include/xpc" $out/include/xpc
+    cp "${darwin-stubs}/usr/include/launch.h" $out/include/launch.h
+  '';
+}
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/libunwind.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libunwind.nix
@ -0,0 +1,28 @@
+{
+  stdenvNoCC,
+  buildPackages,
+  darwin-stubs,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "libunwind";
+  inherit (darwin-stubs) version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ buildPackages.darwin.checkReexportsHook ];
+
+  installPhase = ''
+    mkdir -p $out/include/mach-o
+
+    cp \
+      ${darwin-stubs}/usr/include/libunwind.h \
+      ${darwin-stubs}/usr/include/unwind.h \
+      $out/include
+
+    cp \
+      ${darwin-stubs}/usr/include/mach-o/compact_unwind_encoding.h \
+      $out/include/mach-o
+  '';
+}
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cpio, pbzx, pkgs, lib, darwin-stubs, print-reexports }:
+{ stdenv, stdenvNoCC, fetchurl, cpio, pbzx, pkgs, lib, darwin-stubs, print-reexports }:

 let
  # sadly needs to be exported because security_tool needs it
@ -263,6 +263,15 @@ in rec {
        ln -s libsandbox.1.tbd $out/lib/libsandbox.tbd
      '';
    };
+
+    simd = stdenvNoCC.mkDerivation {
+      name = "apple-lib-simd";
+
+      preferLocalBuild = true;
+      allowSubstitutes = false;
+
+      buildCommand = "echo 'simd library not available in the 10.12 SDK'; exit 1";
+    };
  };

  overrides = super: {
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.40.3.8555-fef15d30c";
+  version = "1.40.4.8679-424562606";
  pname = "plexmediaserver";

  # Fetch the source
  src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
    url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "0v415di48dg5mvkvb374lbx089iavrbqiaada1wdhaz87gb54lww";
+    sha256 = "sha256-EZAMZ8GLOLCWhgi2Xxtn+EIHavSwLrw32aCwzAQfu8s=";
  } else fetchurl {
    url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "0m2b9xalrvnwiblwygkjrypr8kpbcxh8mw30ka1sf4cxmny4g5lq";
+    sha256 = "sha256-wVyA70xqZ9T8brPlzjov2j4C9W+RJYo99hO3VtNBVqw=";
  };

  outputs = [ "out" "basedb" ];
--- a/pkgs/servers/unpackerr/default.nix
+++ b/pkgs/servers/unpackerr/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "unpackerr";
-  version = "0.13.1";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "davidnewhall";
    repo = "unpackerr";
    rev = "v${version}";
-    sha256 = "sha256-K6ZDRDtxeqtjToElix1qVgclHaEeOY0W6hOwehFNIgo=";
+    sha256 = "sha256-boDDxQVEUnPOt+ido8J1MvkVUrZRusdSORY0/mPfjDw=";
  };

-  vendorHash = "sha256-1OSZzs/hUvauRIE5lzlXPIS2EkHm4aNK1iddjKCb6zA=";
+  vendorHash = "sha256-rxoAHcVxjKII945FQ4/HD3UjtZTwmlFx8zJx0Rfumu4=";

  buildInputs = lib.optionals stdenv.isDarwin [ Cocoa WebKit ];

--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@ -150,6 +150,7 @@ let self = python3.pkgs.buildPythonApplication rec {
    description = "Encrypted bandwidth-efficient backup using the rsync algorithm";
    homepage = "https://duplicity.gitlab.io/duplicity-web/";
    license = licenses.gpl2Plus;
+    mainProgram = "duplicity";
    maintainers = with maintainers; [ corngood ];
  };
 };
--- a/pkgs/tools/misc/org-stats/default.nix
+++ b/pkgs/tools/misc/org-stats/default.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "org-stats";
-  version = "1.11.2";
+  version = "1.12.1";

  src = fetchFromGitHub {
    owner = "caarlos0";
    repo = "org-stats";
    rev = "v${version}";
-    hash = "sha256-b0Cfs4EqQOft/HNAoJvRriCMzNiOgYagBLiPYgsDgJM=";
+    hash = "sha256-osgxdKpQjTiBwlA2uGLxlybNdd9Tltj0rq8/g+0/PSQ=";
  };

-  vendorHash = "sha256-LKpnEXVfxBR3cebv46QontDVeA64MJe0vNiKSnTjLtQ=";
+  vendorHash = "sha256-0biuv94wGXiME181nlkvozhB+x4waGMgwXD9ColQWPw=";

  patches = [
    # patch in version information
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "cnspec";
-  version = "11.12.1";
+  version = "11.12.2";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    rev = "refs/tags/v${version}";
-    hash = "sha256-9EQOenHcPecRLqM7p0qKrOOVoa9Sr1fQNqAbxiiM0Hc=";
+    hash = "sha256-y3mATllBgvgAAqlwfCtS92fAmfqOs4yxy2oFxJMxJWM=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-DKhDPqfS330iL/WwmHkq07RCM7IJc2YXQrhvNEGzTZI=";
+  vendorHash = "sha256-/Mg1jZ2rL+3NlrG/fZ2t0z9TVSfrJMvKGa1FRhTeicU=";

  subPackages = [ "apps/cnspec" ];

--- a/pkgs/tools/security/faraday-agent-dispatcher/default.nix
+++ b/pkgs/tools/security/faraday-agent-dispatcher/default.nix
@ -28,9 +28,6 @@ python3.pkgs.buildPythonApplication rec {
    setuptools-scm
  ];

-  nativeBuildInputs = with python3.pkgs; [
-  ];
-
  dependencies = with python3.pkgs; [
    aiohttp
    click
@ -65,6 +62,7 @@ python3.pkgs.buildPythonApplication rec {
  disabledTestPaths = [
    # Tests require a running Docker instance
    "tests/plugins-docker/test_executors.py"
+    "tests/unittests/test_import_official_executors.py"
  ];

  pythonImportsCheck = [
--- a/pkgs/tools/security/kubeclarity/default.nix
+++ b/pkgs/tools/security/kubeclarity/default.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "kubeclarity";
-  version = "2.23.1";
+  version = "2.23.2";

  src = fetchFromGitHub {
    owner = "openclarity";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-buEahr6lr+C/99ANAgYdexPX76ECW6yGMes8u2GZKh4=";
+    hash = "sha256-L5uhuloexa5T7FwuSKCIIXSD+teiCJksOQFOIRzUBiE=";
  };

  vendorHash = "sha256-JY64fqzNBpo9Jwo8sWsWTVVAO5zzwxwXy0A2bgqJHuU=";
--- a/pkgs/tools/virtualization/cri-tools/default.nix
+++ b/pkgs/tools/virtualization/cri-tools/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "cri-tools";
-  version = "1.30.0";
+  version = "1.30.1";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-MuyXcdV29sLn9Vt0WE31nXtY9ofjEC0b5zSrmGXR0mw=";
+    hash = "sha256-mCBGLnNlAfq7qThsbsGsBSEJEI85fg0xAbFENyIRyBU=";
  };

  vendorHash = null;
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -4859,10 +4859,6 @@ with pkgs;

  dieharder = callPackage ../tools/security/dieharder { };

-  diesel-cli = callPackage ../development/tools/diesel-cli {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
  digitemp = callPackage ../tools/misc/digitemp { };

  dijo = callPackage ../tools/misc/dijo {
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@ -47,6 +47,9 @@ makeScopeWithSplicing' {
    fetchurl = fetchurlBoot;
  };

+  # macOS 12.3 SDK
+  apple_sdk_12_3 = pkgs.callPackage ../os-specific/darwin/apple-sdk-12.3 { };
+
  # Pick an SDK
  apple_sdk = {
    "10.12" = apple_sdk_10_12;
@ -80,7 +83,7 @@ in

 impure-cmds // appleSourcePackages // chooseLibs // {

-  inherit apple_sdk apple_sdk_10_12 apple_sdk_11_0;
+  inherit apple_sdk apple_sdk_10_12 apple_sdk_11_0 apple_sdk_12_3;

  stdenvNoCF = stdenv.override {
    extraBuildInputs = [];
@ -183,9 +186,13 @@ impure-cmds // appleSourcePackages // chooseLibs // {

  lsusb = callPackage ../os-specific/darwin/lsusb { };

-  moltenvk = pkgs.darwin.apple_sdk_11_0.callPackage ../os-specific/darwin/moltenvk {
-    inherit (apple_sdk_11_0.frameworks) AppKit Foundation Metal QuartzCore;
-    inherit (apple_sdk_11_0.libs) simd;
+  moltenvk = callPackage ../os-specific/darwin/moltenvk {
+    stdenv = pkgs.overrideSDK stdenv {
+      darwinMinVersion = "10.15";
+      darwinSdkVersion = "12.3";
+    };
+    inherit (apple_sdk.frameworks) AppKit Foundation Metal QuartzCore;
+    inherit (apple_sdk.libs) simd;
  };

  openwith = callPackage ../os-specific/darwin/openwith { };