Merge master into staging-next

2024-01-22 12:01:10 +00:00 · 2024-01-22 12:01:10 +00:00 · 3a8094730e
commit 3a8094730e
parent 78b0905b1b 4e2e46fe89
96 changed files with 9183 additions and 5959 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -84,7 +84,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
 /nixos/README.md @infinisil
 /pkgs/README.md @infinisil
 /maintainers/README.md @infinisil
-/maintainers/* @piegamesde @Janik-Haag

 # User-facing development documentation
 /doc/development.md @infinisil
--- a/nixos/doc/manual/configuration/profiles.chapter.md
+++ b/nixos/doc/manual/configuration/profiles.chapter.md
@ -29,6 +29,7 @@ profiles/graphical.section.md
 profiles/hardened.section.md
 profiles/headless.section.md
 profiles/installation-device.section.md
+profiles/perlless.section.md
 profiles/minimal.section.md
 profiles/qemu-guest.section.md
 ```
--- a/nixos/doc/manual/configuration/profiles/perlless.section.md
+++ b/nixos/doc/manual/configuration/profiles/perlless.section.md
@ -0,0 +1,11 @@
+# Perlless {#sec-perlless}
+
+::: {.warning}
+If you enable this profile, you will NOT be able to switch to a new
+configuration and thus you will not be able to rebuild your system with
+nixos-rebuild!
+:::
+
+Render your system completely perlless (i.e. without the perl interpreter). This
+includes a mechanism so that your build fails if it contains a Nix store path
+that references the string "perl".
--- a/nixos/doc/manual/configuration/user-mgmt.chapter.md
+++ b/nixos/doc/manual/configuration/user-mgmt.chapter.md
@ -89,3 +89,18 @@ A user can be deleted using `userdel`:
 The flag `-r` deletes the user's home directory. Accounts can be
 modified using `usermod`. Unix groups can be managed using `groupadd`,
 `groupmod` and `groupdel`.
+
+## Create users and groups with `systemd-sysusers` {#sec-systemd-sysusers}
+
+::: {.note}
+This is experimental.
+:::
+
+Instead of using a custom perl script to create users and groups, you can use
+systemd-sysusers:
+
+```nix
+systemd.sysusers.enable = true;
+```
+
+The primary benefit of this is to remove a dependency on perl.
--- a/nixos/doc/manual/development/etc-overlay.section.md
+++ b/nixos/doc/manual/development/etc-overlay.section.md
@ -0,0 +1,36 @@
+# `/etc` via overlay filesystem {#sec-etc-overlay}
+
+::: {.note}
+This is experimental and requires a kernel version >= 6.6 because it uses
+new overlay features and relies on the new mount API.
+:::
+
+Instead of using a custom perl script to activate `/etc`, you activate it via an
+overlay filesystem:
+
+```nix
+system.etc.overlay.enable = true;
+```
+
+Using an overlay has two benefits:
+
+1. it removes a dependency on perl
+2. it makes activation faster (up to a few seconds)
+
+By default, the `/etc` overlay is mounted writable (i.e. there is a writable
+upper layer). However, you can also mount `/etc` immutably (i.e. read-only) by
+setting:
+
+```nix
+system.etc.overlay.mutable = false;
+```
+
+The overlay is atomically replaced during system switch. However, files that
+have been modified will NOT be overwritten. This is the biggest change compared
+to the perl-based system.
+
+If you manually make changes to `/etc` on your system and then switch to a new
+configuration where `system.etc.overlay.mutable = false;`, you will not be able
+to see the previously made changes in `/etc` anymore. However the changes are
+not completely gone, they are still in the upperdir of the previous overlay in
+`/.rw-etc/upper`.
--- a/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
+++ b/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
@ -56,4 +56,5 @@ explained in the next sections.
 unit-handling.section.md
 activation-script.section.md
 non-switchable-systems.section.md
+etc-overlay.section.md
 ```
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -18,6 +18,22 @@ In addition to numerous new and upgraded packages, this release has the followin

 - Julia environments can now be built with arbitrary packages from the ecosystem using the `.withPackages` function. For example: `julia.withPackages ["Plots"]`.

+- A new option `systemd.sysusers.enable` was added. If enabled, users and
+  groups are created with systemd-sysusers instead of with a custom perl script.
+
+- A new option `system.etc.overlay.enable` was added. If enabled, `/etc` is
+  mounted via an overlayfs instead of being created by a custom perl script.
+
+- It is now possible to have a completely perlless system (i.e. a system
+  without perl). Previously, the NixOS activation depended on two perl scripts
+  which can now be replaced via an opt-in mechanism. To make your system
+  perlless, you can use the new perlless profile:
+  ```
+  { modulesPath, ... }: {
+    imports = [ "${modulesPath}/profiles/perlless.nix" ];
+  }
+  ```
+
 ## New Services {#sec-release-24.05-new-services}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@ -685,7 +685,7 @@ in {
      shadow.gid = ids.gids.shadow;
    };

-    system.activationScripts.users = {
+    system.activationScripts.users = if !config.systemd.sysusers.enable then {
      supportsDryActivation = true;
      text = ''
        install -m 0700 -d /root
@ -694,7 +694,7 @@ in {
        ${pkgs.perl.withPackages (p: [ p.FileSlurp p.JSON ])}/bin/perl \
        -w ${./update-users-groups.pl} ${spec}
      '';
-    };
+    } else ""; # keep around for backwards compatibility

    system.activationScripts.update-lingering = let
      lingerDir = "/var/lib/systemd/linger";
@ -711,7 +711,9 @@ in {
    '';

    # Warn about user accounts with deprecated password hashing schemes
-    system.activationScripts.hashes = {
+    # This does not work when the users and groups are created by
+    # systemd-sysusers because the users are created too late then.
+    system.activationScripts.hashes = if !config.systemd.sysusers.enable then {
      deps = [ "users" ];
      text = ''
        users=()
@ -729,7 +731,7 @@ in {
          printf ' - %s\n' "''${users[@]}"
        fi
      '';
-    };
+    } else ""; # keep around for backwards compatibility

    # for backwards compatibility
    system.activationScripts.groups = stringAfter [ "users" ] "";
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1488,6 +1488,7 @@
  ./system/boot/systemd/repart.nix
  ./system/boot/systemd/shutdown.nix
  ./system/boot/systemd/sysupdate.nix
+  ./system/boot/systemd/sysusers.nix
  ./system/boot/systemd/tmpfiles.nix
  ./system/boot/systemd/user.nix
  ./system/boot/systemd/userdbd.nix
--- a/nixos/modules/profiles/perlless.nix
+++ b/nixos/modules/profiles/perlless.nix
@ -0,0 +1,31 @@
+# WARNING: If you enable this profile, you will NOT be able to switch to a new
+# configuration and thus you will not be able to rebuild your system with
+# nixos-rebuild!
+
+{ lib, ... }:
+
+{
+
+  # Disable switching to a new configuration. This is not a necessary
+  # limitation of a perlless system but just a current one. In the future,
+  # perlless switching might be possible.
+  system.switch.enable = lib.mkDefault false;
+
+  # Remove perl from activation
+  boot.initrd.systemd.enable = lib.mkDefault true;
+  system.etc.overlay.enable = lib.mkDefault true;
+  systemd.sysusers.enable = lib.mkDefault true;
+
+  # Random perl remnants
+  system.disableInstallerTools = lib.mkDefault true;
+  programs.less.lessopen = lib.mkDefault null;
+  programs.command-not-found.enable = lib.mkDefault false;
+  boot.enableContainers = lib.mkDefault false;
+  environment.defaultPackages = lib.mkDefault [ ];
+  documentation.info.enable = lib.mkDefault false;
+
+  # Check that the system does not contain a Nix store path that contains the
+  # string "perl".
+  system.forbiddenDependenciesRegex = "perl";
+
+}
--- a/nixos/modules/services/system/dbus.nix
+++ b/nixos/modules/services/system/dbus.nix
@ -95,6 +95,7 @@ in
        uid = config.ids.uids.messagebus;
        description = "D-Bus system message bus daemon user";
        home = homeDir;
+        homeMode = "0755";
        group = "messagebus";
      };

--- a/nixos/modules/system/boot/systemd/sysusers.nix
+++ b/nixos/modules/system/boot/systemd/sysusers.nix
@ -0,0 +1,169 @@
+{ config, lib, pkgs, utils, ... }:
+
+let
+
+  cfg = config.systemd.sysusers;
+  userCfg = config.users;
+
+  sysusersConfig = pkgs.writeTextDir "00-nixos.conf" ''
+    # Type Name ID GECOS Home directory Shell
+
+    # Users
+    ${lib.concatLines (lib.mapAttrsToList
+      (username: opts:
+        let
+          uid = if opts.uid == null then "-" else toString opts.uid;
+        in
+          ''u ${username} ${uid}:${opts.group} "${opts.description}" ${opts.home} ${utils.toShellPath opts.shell}''
+      )
+      userCfg.users)
+    }
+
+    # Groups
+    ${lib.concatLines (lib.mapAttrsToList
+      (groupname: opts: ''g ${groupname} ${if opts.gid == null then "-" else toString opts.gid}'') userCfg.groups)
+    }
+
+    # Group membership
+    ${lib.concatStrings (lib.mapAttrsToList
+      (groupname: opts: (lib.concatMapStrings (username: "m ${username} ${groupname}\n")) opts.members ) userCfg.groups)
+    }
+  '';
+
+  staticSysusersCredentials = pkgs.runCommand "static-sysusers-credentials" { } ''
+    mkdir $out; cd $out
+    ${lib.concatLines (
+      (lib.mapAttrsToList
+        (username: opts: "echo -n '${opts.initialHashedPassword}' > 'passwd.hashed-password.${username}'")
+        (lib.filterAttrs (_username: opts: opts.initialHashedPassword != null) userCfg.users))
+        ++
+      (lib.mapAttrsToList
+        (username: opts: "echo -n '${opts.initialPassword}' > 'passwd.plaintext-password.${username}'")
+        (lib.filterAttrs (_username: opts: opts.initialPassword != null) userCfg.users))
+        ++
+      (lib.mapAttrsToList
+        (username: opts: "cat '${opts.hashedPasswordFile}' > 'passwd.hashed-password.${username}'")
+        (lib.filterAttrs (_username: opts: opts.hashedPasswordFile != null) userCfg.users))
+      )
+    }
+  '';
+
+  staticSysusers = pkgs.runCommand "static-sysusers"
+    {
+      nativeBuildInputs = [ pkgs.systemd ];
+    } ''
+    mkdir $out
+    export CREDENTIALS_DIRECTORY=${staticSysusersCredentials}
+    systemd-sysusers --root $out ${sysusersConfig}/00-nixos.conf
+  '';
+
+in
+
+{
+
+  options = {
+
+    # This module doesn't set it's own user options but reuses the ones from
+    # users-groups.nix
+
+    systemd.sysusers = {
+      enable = lib.mkEnableOption (lib.mdDoc "systemd-sysusers") // {
+        description = lib.mdDoc ''
+          If enabled, users are created with systemd-sysusers instead of with
+          the custom `update-users-groups.pl` script.
+
+          Note: This is experimental.
+        '';
+      };
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = config.system.activationScripts.users == "";
+        message = "system.activationScripts.users has to be empty to use systemd-sysusers";
+      }
+      {
+        assertion = config.users.mutableUsers -> config.system.etc.overlay.enable;
+        message = "config.users.mutableUsers requires config.system.etc.overlay.enable.";
+      }
+    ];
+
+    systemd = lib.mkMerge [
+      ({
+
+        # Create home directories, do not create /var/empty even if that's a user's
+        # home.
+        tmpfiles.settings.home-directories = lib.mapAttrs'
+          (username: opts: lib.nameValuePair opts.home {
+            d = {
+              mode = opts.homeMode;
+              user = username;
+              group = opts.group;
+            };
+          })
+          (lib.filterAttrs (_username: opts: opts.home != "/var/empty") userCfg.users);
+      })
+
+      (lib.mkIf config.users.mutableUsers {
+        additionalUpstreamSystemUnits = [
+          "systemd-sysusers.service"
+        ];
+
+        services.systemd-sysusers = {
+          # Enable switch-to-configuration to restart the service.
+          unitConfig.ConditionNeedsUpdate = [ "" ];
+          requiredBy = [ "sysinit-reactivation.target" ];
+          before = [ "sysinit-reactivation.target" ];
+          restartTriggers = [ "${config.environment.etc."sysusers.d".source}" ];
+
+          serviceConfig = {
+            LoadCredential = lib.mapAttrsToList
+              (username: opts: "passwd.hashed-password.${username}:${opts.hashedPasswordFile}")
+              (lib.filterAttrs (_username: opts: opts.hashedPasswordFile != null) userCfg.users);
+            SetCredential = (lib.mapAttrsToList
+              (username: opts: "passwd.hashed-password.${username}:${opts.initialHashedPassword}")
+              (lib.filterAttrs (_username: opts: opts.initialHashedPassword != null) userCfg.users))
+            ++
+            (lib.mapAttrsToList
+              (username: opts: "passwd.plaintext-password.${username}:${opts.initialPassword}")
+              (lib.filterAttrs (_username: opts: opts.initialPassword != null) userCfg.users))
+            ;
+          };
+        };
+      })
+    ];
+
+    environment.etc = lib.mkMerge [
+      (lib.mkIf (!userCfg.mutableUsers) {
+        "passwd" = {
+          source = "${staticSysusers}/etc/passwd";
+          mode = "0644";
+        };
+        "group" = {
+          source = "${staticSysusers}/etc/group";
+          mode = "0644";
+        };
+        "shadow" = {
+          source = "${staticSysusers}/etc/shadow";
+          mode = "0000";
+        };
+        "gshadow" = {
+          source = "${staticSysusers}/etc/gshadow";
+          mode = "0000";
+        };
+      })
+
+      (lib.mkIf userCfg.mutableUsers {
+        "sysusers.d".source = sysusersConfig;
+      })
+    ];
+
+  };
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+}
--- a/nixos/modules/system/etc/build-composefs-dump.py
+++ b/nixos/modules/system/etc/build-composefs-dump.py
@ -0,0 +1,209 @@
+#!/usr/bin/env python3
+
+"""Build a composefs dump from a Json config
+
+See the man page of composefs-dump for details about the format:
+https://github.com/containers/composefs/blob/main/man/composefs-dump.md
+
+Ensure to check the file with the check script when you make changes to it:
+
+./check-build-composefs-dump.sh ./build-composefs_dump.py
+"""
+
+import glob
+import json
+import os
+import sys
+from enum import Enum
+from pathlib import Path
+from typing import Any
+
+Attrs = dict[str, Any]
+
+
+class FileType(Enum):
+    """The filetype as defined by the `st_mode` stat field in octal
+
+    You can check the st_mode stat field of a path in Python with
+    `oct(os.stat("/path/").st_mode)`
+    """
+
+    directory = "4"
+    file = "10"
+    symlink = "12"
+
+
+class ComposefsPath:
+    path: str
+    size: int
+    filetype: FileType
+    mode: str
+    uid: str
+    gid: str
+    payload: str
+    rdev: str = "0"
+    nlink: int = 1
+    mtime: str = "1.0"
+    content: str = "-"
+    digest: str = "-"
+
+    def __init__(
+        self,
+        attrs: Attrs,
+        size: int,
+        filetype: FileType,
+        mode: str,
+        payload: str,
+        path: str | None = None,
+    ):
+        if path is None:
+            path = attrs["target"]
+        self.path = "/" + path
+        self.size = size
+        self.filetype = filetype
+        self.mode = mode
+        self.uid = attrs["uid"]
+        self.gid = attrs["gid"]
+        self.payload = payload
+
+    def write_line(self) -> str:
+        line_list = [
+            str(self.path),
+            str(self.size),
+            f"{self.filetype.value}{self.mode}",
+            str(self.nlink),
+            str(self.uid),
+            str(self.gid),
+            str(self.rdev),
+            str(self.mtime),
+            str(self.payload),
+            str(self.content),
+            str(self.digest),
+        ]
+        return " ".join(line_list)
+
+
+def eprint(*args, **kwargs) -> None:
+    print(args, **kwargs, file=sys.stderr)
+
+
+def leading_directories(path: str) -> list[str]:
+    """Return the leading directories of path
+
+    Given the path "alsa/conf.d/50-pipewire.conf", for example, this function
+    returns `[ "alsa", "alsa/conf.d" ]`.
+    """
+    parents = list(Path(path).parents)
+    parents.reverse()
+    # remove the implicit `.` from the start of a relative path or `/` from an
+    # absolute path
+    del parents[0]
+    return [str(i) for i in parents]
+
+
+def add_leading_directories(
+    target: str, attrs: Attrs, paths: dict[str, ComposefsPath]
+) -> None:
+    """Add the leading directories of a target path to the composefs paths
+
+    mkcomposefs expects that all leading directories are explicitly listed in
+    the dump file. Given the path "alsa/conf.d/50-pipewire.conf", for example,
+    this function adds "alsa" and "alsa/conf.d" to the composefs paths.
+    """
+    path_components = leading_directories(target)
+    for component in path_components:
+        composefs_path = ComposefsPath(
+            attrs,
+            path=component,
+            size=4096,
+            filetype=FileType.directory,
+            mode="0755",
+            payload="-",
+        )
+        paths[component] = composefs_path
+
+
+def main() -> None:
+    """Build a composefs dump from a Json config
+
+    This config describes the files that the final composefs image is supposed
+    to contain.
+    """
+    config_file = sys.argv[1]
+    if not config_file:
+        eprint("No config file was supplied.")
+        sys.exit(1)
+
+    with open(config_file, "rb") as f:
+        config = json.load(f)
+
+    if not config:
+        eprint("Config is empty.")
+        sys.exit(1)
+
+    eprint("Building composefs dump...")
+
+    paths: dict[str, ComposefsPath] = {}
+    for attrs in config:
+        target = attrs["target"]
+        source = attrs["source"]
+        mode = attrs["mode"]
+
+        if "*" in source:  # Path with globbing
+            glob_sources = glob.glob(source)
+            for glob_source in glob_sources:
+                basename = os.path.basename(glob_source)
+                glob_target = f"{target}/{basename}"
+
+                composefs_path = ComposefsPath(
+                    attrs,
+                    path=glob_target,
+                    size=100,
+                    filetype=FileType.symlink,
+                    mode="0777",
+                    payload=glob_source,
+                )
+
+                paths[glob_target] = composefs_path
+                add_leading_directories(glob_target, attrs, paths)
+        else:  # Without globbing
+            if mode == "symlink":
+                composefs_path = ComposefsPath(
+                    attrs,
+                    # A high approximation of the size of a symlink
+                    size=100,
+                    filetype=FileType.symlink,
+                    mode="0777",
+                    payload=source,
+                )
+            else:
+                if os.path.isdir(source):
+                    composefs_path = ComposefsPath(
+                        attrs,
+                        size=4096,
+                        filetype=FileType.directory,
+                        mode=mode,
+                        payload=source,
+                    )
+                else:
+                    composefs_path = ComposefsPath(
+                        attrs,
+                        size=os.stat(source).st_size,
+                        filetype=FileType.file,
+                        mode=mode,
+                        payload=target,
+                    )
+            paths[target] = composefs_path
+            add_leading_directories(target, attrs, paths)
+
+    composefs_dump = ["/ 4096 40755 1 0 0 0 0.0 - - -"]  # Root directory
+    for key in sorted(paths):
+        composefs_path = paths[key]
+        eprint(composefs_path.path)
+        composefs_dump.append(composefs_path.write_line())
+
+    print("\n".join(composefs_dump))
+
+
+if __name__ == "__main__":
+    main()
--- a/nixos/modules/system/etc/check-build-composefs-dump.sh
+++ b/nixos/modules/system/etc/check-build-composefs-dump.sh
@ -0,0 +1,8 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p black ruff mypy
+
+file=$1
+
+black --check --diff $file
+ruff --line-length 88 $file
+mypy --strict $file
--- a/nixos/modules/system/etc/etc-activation.nix
+++ b/nixos/modules/system/etc/etc-activation.nix
@ -1,12 +1,96 @@
 { config, lib, ... }:
-let
-  inherit (lib) stringAfter;
-in {
+
+{

  imports = [ ./etc.nix ];

-  config = {
-    system.activationScripts.etc =
-      stringAfter [ "users" "groups" ] config.system.build.etcActivationCommands;
-  };
+  config = lib.mkMerge [
+
+    {
+      system.activationScripts.etc =
+        lib.stringAfter [ "users" "groups" ] config.system.build.etcActivationCommands;
+    }
+
+    (lib.mkIf config.system.etc.overlay.enable {
+
+      assertions = [
+        {
+          assertion = config.boot.initrd.systemd.enable;
+          message = "`system.etc.overlay.enable` requires `boot.initrd.systemd.enable`";
+        }
+        {
+          assertion = (!config.system.etc.overlay.mutable) -> config.systemd.sysusers.enable;
+          message = "`system.etc.overlay.mutable = false` requires `systemd.sysusers.enable`";
+        }
+        {
+          assertion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.6";
+          message = "`system.etc.overlay.enable requires a newer kernel, at least version 6.6";
+        }
+        {
+          assertion = config.systemd.sysusers.enable -> (config.users.mutableUsers == config.system.etc.overlay.mutable);
+          message = ''
+            When using systemd-sysusers and mounting `/etc` via an overlay, users
+            can only be mutable when `/etc` is mutable and vice versa.
+          '';
+        }
+      ];
+
+      boot.initrd.availableKernelModules = [ "loop" "erofs" "overlay" ];
+
+      boot.initrd.systemd = {
+        mounts = [
+          {
+            where = "/run/etc-metadata";
+            what = "/sysroot${config.system.build.etcMetadataImage}";
+            type = "erofs";
+            options = "loop";
+            unitConfig.RequiresMountsFor = [
+              "/sysroot/nix/store"
+            ];
+          }
+          {
+            where = "/sysroot/etc";
+            what = "overlay";
+            type = "overlay";
+            options = lib.concatStringsSep "," ([
+              "relatime"
+              "redirect_dir=on"
+              "metacopy=on"
+              "lowerdir=/run/etc-metadata::/sysroot${config.system.build.etcBasedir}"
+            ] ++ lib.optionals config.system.etc.overlay.mutable [
+              "rw"
+              "upperdir=/sysroot/.rw-etc/upper"
+              "workdir=/sysroot/.rw-etc/work"
+            ] ++ lib.optionals (!config.system.etc.overlay.mutable) [
+              "ro"
+            ]);
+            wantedBy = [ "initrd-fs.target" ];
+            before = [ "initrd-fs.target" ];
+            requires = lib.mkIf config.system.etc.overlay.mutable [ "rw-etc.service" ];
+            after = lib.mkIf config.system.etc.overlay.mutable [ "rw-etc.service" ];
+            unitConfig.RequiresMountsFor = [
+              "/sysroot/nix/store"
+              "/run/etc-metadata"
+            ];
+          }
+        ];
+        services = lib.mkIf config.system.etc.overlay.mutable {
+          rw-etc = {
+            unitConfig = {
+              DefaultDependencies = false;
+              RequiresMountsFor = "/sysroot";
+            };
+            serviceConfig = {
+              Type = "oneshot";
+              ExecStart = ''
+                /bin/mkdir -p -m 0755 /sysroot/.rw-etc/upper /sysroot/.rw-etc/work
+              '';
+            };
+          };
+        };
+      };
+
+    })
+
+  ];
 }
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@ -62,6 +62,16 @@ let
    ]) etc'}
  '';

+  etcHardlinks = filter (f: f.mode != "symlink") etc';
+
+  build-composefs-dump = pkgs.runCommand "build-composefs-dump.py"
+    {
+      buildInputs = [ pkgs.python3 ];
+    } ''
+    install ${./build-composefs-dump.py} $out
+    patchShebangs --host $out
+  '';
+
 in

 {
@ -72,6 +82,30 @@ in

  options = {

+    system.etc.overlay = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Mount `/etc` as an overlayfs instead of generating it via a perl script.
+
+          Note: This is currently experimental. Only enable this option if you're
+          confident that you can recover your system if it breaks.
+        '';
+      };
+
+      mutable = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc ''
+          Whether to mount `/etc` mutably (i.e. read-write) or immutably (i.e. read-only).
+
+          If this is false, only the immutable lowerdir is mounted. If it is
+          true, a writable upperdir is mounted on top.
+        '';
+      };
+    };
+
    environment.etc = mkOption {
      default = {};
      example = literalExpression ''
@ -190,12 +224,84 @@ in
  config = {

    system.build.etc = etc;
-    system.build.etcActivationCommands =
-      ''
-        # Set up the statically computed bits of /etc.
-        echo "setting up /etc..."
-        ${pkgs.perl.withPackages (p: [ p.FileSlurp ])}/bin/perl ${./setup-etc.pl} ${etc}/etc
+    system.build.etcActivationCommands = let
+      etcOverlayOptions = lib.concatStringsSep "," ([
+        "relatime"
+        "redirect_dir=on"
+        "metacopy=on"
+      ] ++ lib.optionals config.system.etc.overlay.mutable [
+        "upperdir=/.rw-etc/upper"
+        "workdir=/.rw-etc/work"
+      ]);
+    in if config.system.etc.overlay.enable then ''
+      # This script atomically remounts /etc when switching configuration. On a (re-)boot
+      # this should not run because /etc is mounted via a systemd mount unit
+      # instead. To a large extent this mimics what composefs does. Because
+      # it's relatively simple, however, we avoid the composefs dependency.
+      if [[ ! $IN_NIXOS_SYSTEMD_STAGE1 ]]; then
+        echo "remounting /etc..."
+
+        tmpMetadataMount=$(mktemp --directory)
+        mount --type erofs ${config.system.build.etcMetadataImage} $tmpMetadataMount
+
+        # Mount the new /etc overlay to a temporary private mount.
+        # This needs the indirection via a private bind mount because you
+        # cannot move shared mounts.
+        tmpEtcMount=$(mktemp --directory)
+        mount --bind --make-private $tmpEtcMount $tmpEtcMount
+        mount --type overlay overlay \
+          --options lowerdir=$tmpMetadataMount::${config.system.build.etcBasedir},${etcOverlayOptions} \
+          $tmpEtcMount
+
+        # Move the new temporary /etc mount underneath the current /etc mount.
+        #
+        # This should eventually use util-linux to perform this move beneath,
+        # however, this functionality is not yet in util-linux. See this
+        # tracking issue: https://github.com/util-linux/util-linux/issues/2604
+        ${pkgs.move-mount-beneath}/bin/move-mount --move --beneath $tmpEtcMount /etc
+
+        # Unmount the top /etc mount to atomically reveal the new mount.
+        umount /etc
+
+      fi
+    '' else ''
+      # Set up the statically computed bits of /etc.
+      echo "setting up /etc..."
+      ${pkgs.perl.withPackages (p: [ p.FileSlurp ])}/bin/perl ${./setup-etc.pl} ${etc}/etc
+    '';
+
+    system.build.etcBasedir = pkgs.runCommandLocal "etc-lowerdir" { } ''
+      set -euo pipefail
+
+      makeEtcEntry() {
+        src="$1"
+        target="$2"
+
+        mkdir -p "$out/$(dirname "$target")"
+        cp "$src" "$out/$target"
+      }
+
+      mkdir -p "$out"
+      ${concatMapStringsSep "\n" (etcEntry: escapeShellArgs [
+        "makeEtcEntry"
+        # Force local source paths to be added to the store
+        "${etcEntry.source}"
+        etcEntry.target
+      ]) etcHardlinks}
+    '';
+
+    system.build.etcMetadataImage =
+      let
+        etcJson = pkgs.writeText "etc-json" (builtins.toJSON etc');
+        etcDump = pkgs.runCommand "etc-dump" { } "${build-composefs-dump} ${etcJson} > $out";
+      in
+      pkgs.runCommand "etc-metadata.erofs" {
+        nativeBuildInputs = [ pkgs.composefs pkgs.erofs-utils ];
+      } ''
+        mkcomposefs --from-file ${etcDump} $out
+        fsck.erofs $out
      '';
+
  };

 }
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@ -207,7 +207,10 @@ in
    networking.usePredictableInterfaceNames = false;

    # Make it easy to log in as root when running the test interactively.
-    users.users.root.initialHashedPassword = mkOverride 150 "";
+    # This needs to be a file because of a quirk in systemd credentials,
+    # where you cannot specify an empty string as a value. systemd-sysusers
+    # uses credentials to set passwords on users.
+    users.users.root.hashedPasswordFile = mkOverride 150 "${pkgs.writeText "hashed-password.root" ""}";

    services.xserver.displayManager.job.logToJournal = true;

--- a/nixos/tests/activation/etc-overlay-immutable.nix
+++ b/nixos/tests/activation/etc-overlay-immutable.nix
@ -0,0 +1,30 @@
+{ lib, ... }: {
+
+  name = "activation-etc-overlay-immutable";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine = { pkgs, ... }: {
+    system.etc.overlay.enable = true;
+    system.etc.overlay.mutable = false;
+
+    # Prerequisites
+    systemd.sysusers.enable = true;
+    users.mutableUsers = false;
+    boot.initrd.systemd.enable = true;
+    boot.kernelPackages = pkgs.linuxPackages_latest;
+
+    specialisation.new-generation.configuration = {
+      environment.etc."newgen".text = "newgen";
+    };
+  };
+
+  testScript = ''
+    machine.succeed("findmnt --kernel --type overlay /etc")
+    machine.fail("stat /etc/newgen")
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+    assert machine.succeed("cat /etc/newgen") == "newgen"
+  '';
+}
--- a/nixos/tests/activation/etc-overlay-mutable.nix
+++ b/nixos/tests/activation/etc-overlay-mutable.nix
@ -0,0 +1,30 @@
+{ lib, ... }: {
+
+  name = "activation-etc-overlay-mutable";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine = { pkgs, ... }: {
+    system.etc.overlay.enable = true;
+    system.etc.overlay.mutable = true;
+
+    # Prerequisites
+    boot.initrd.systemd.enable = true;
+    boot.kernelPackages = pkgs.linuxPackages_latest;
+
+    specialisation.new-generation.configuration = {
+      environment.etc."newgen".text = "newgen";
+    };
+  };
+
+  testScript = ''
+    machine.succeed("findmnt --kernel --type overlay /etc")
+    machine.fail("stat /etc/newgen")
+    machine.succeed("echo -n 'mutable' > /etc/mutable")
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+    assert machine.succeed("cat /etc/newgen") == "newgen"
+    assert machine.succeed("cat /etc/mutable") == "mutable"
+  '';
+}
--- a/nixos/tests/activation/perlless.nix
+++ b/nixos/tests/activation/perlless.nix
@ -0,0 +1,24 @@
+{ lib, ... }:
+
+{
+
+  name = "activation-perlless";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine = { pkgs, modulesPath, ... }: {
+    imports = [ "${modulesPath}/profiles/perlless.nix" ];
+
+    boot.kernelPackages = pkgs.linuxPackages_latest;
+
+    virtualisation.mountHostNixStore = false;
+    virtualisation.useNixStoreImage = true;
+  };
+
+  testScript = ''
+    perl_store_paths = machine.succeed("ls /nix/store | grep perl || true")
+    print(perl_store_paths)
+    assert len(perl_store_paths) == 0
+  '';
+
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -285,6 +285,9 @@ in {
  activation = pkgs.callPackage ../modules/system/activation/test.nix { };
  activation-var = runTest ./activation/var.nix;
  activation-nix-channel = runTest ./activation/nix-channel.nix;
+  activation-etc-overlay-mutable = runTest ./activation/etc-overlay-mutable.nix;
+  activation-etc-overlay-immutable = runTest ./activation/etc-overlay-immutable.nix;
+  activation-perlless = runTest ./activation/perlless.nix;
  etcd = handleTestOn ["x86_64-linux"] ./etcd.nix {};
  etcd-cluster = handleTestOn ["x86_64-linux"] ./etcd-cluster.nix {};
  etebase-server = handleTest ./etebase-server.nix {};
@ -867,6 +870,8 @@ in {
  systemd-repart = handleTest ./systemd-repart.nix {};
  systemd-shutdown = handleTest ./systemd-shutdown.nix {};
  systemd-sysupdate = runTest ./systemd-sysupdate.nix;
+  systemd-sysusers-mutable = runTest ./systemd-sysusers-mutable.nix;
+  systemd-sysusers-immutable = runTest ./systemd-sysusers-immutable.nix;
  systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
  systemd-timesyncd-nscd-dnssec = handleTest ./systemd-timesyncd-nscd-dnssec.nix {};
  systemd-user-tmpfiles-rules = handleTest ./systemd-user-tmpfiles-rules.nix {};
--- a/nixos/tests/systemd-sysusers-immutable.nix
+++ b/nixos/tests/systemd-sysusers-immutable.nix
@ -0,0 +1,64 @@
+{ lib, ... }:
+
+let
+  rootPassword = "$y$j9T$p6OI0WN7.rSfZBOijjRdR.$xUOA2MTcB48ac.9Oc5fz8cxwLv1mMqabnn333iOzSA6";
+  normaloPassword = "$y$j9T$3aiOV/8CADAK22OK2QT3/0$67OKd50Z4qTaZ8c/eRWHLIM.o3ujtC1.n9ysmJfv639";
+  newNormaloPassword = "mellow";
+in
+
+{
+
+  name = "activation-sysusers-immutable";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine = {
+    systemd.sysusers.enable = true;
+    users.mutableUsers = false;
+
+    # Override the empty root password set by the test instrumentation
+    users.users.root.hashedPasswordFile = lib.mkForce null;
+    users.users.root.initialHashedPassword = rootPassword;
+    users.users.normalo = {
+      isNormalUser = true;
+      initialHashedPassword = normaloPassword;
+    };
+
+    specialisation.new-generation.configuration = {
+      users.users.new-normalo = {
+        isNormalUser = true;
+        initialPassword = newNormaloPassword;
+      };
+    };
+  };
+
+  testScript = ''
+    with subtest("Users are not created with systemd-sysusers"):
+      machine.fail("systemctl status systemd-sysusers.service")
+      machine.fail("ls /etc/sysusers.d")
+
+    with subtest("Correct mode on the password files"):
+      assert machine.succeed("stat -c '%a' /etc/passwd") == "644\n"
+      assert machine.succeed("stat -c '%a' /etc/group") == "644\n"
+      assert machine.succeed("stat -c '%a' /etc/shadow") == "0\n"
+      assert machine.succeed("stat -c '%a' /etc/gshadow") == "0\n"
+
+    with subtest("root user has correct password"):
+      print(machine.succeed("getent passwd root"))
+      assert "${rootPassword}" in machine.succeed("getent shadow root"), "root user password is not correct"
+
+    with subtest("normalo user is created"):
+      print(machine.succeed("getent passwd normalo"))
+      assert machine.succeed("stat -c '%U' /home/normalo") == "normalo\n"
+      assert "${normaloPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
+
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+
+    with subtest("new-normalo user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-normalo"))
+      print(machine.succeed("getent shadow new-normalo"))
+      assert machine.succeed("stat -c '%U' /home/new-normalo") == "new-normalo\n"
+  '';
+}
--- a/nixos/tests/systemd-sysusers-mutable.nix
+++ b/nixos/tests/systemd-sysusers-mutable.nix
@ -0,0 +1,71 @@
+{ lib, ... }:
+
+let
+  rootPassword = "$y$j9T$p6OI0WN7.rSfZBOijjRdR.$xUOA2MTcB48ac.9Oc5fz8cxwLv1mMqabnn333iOzSA6";
+  normaloPassword = "hello";
+  newNormaloPassword = "$y$j9T$p6OI0WN7.rSfZBOijjRdR.$xUOA2MTcB48ac.9Oc5fz8cxwLv1mMqabnn333iOzSA6";
+in
+
+{
+
+  name = "activation-sysusers-mutable";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine = { pkgs, ... }: {
+    systemd.sysusers.enable = true;
+    users.mutableUsers = true;
+
+    # Prerequisites
+    system.etc.overlay.enable = true;
+    boot.initrd.systemd.enable = true;
+    boot.kernelPackages = pkgs.linuxPackages_latest;
+
+    # Override the empty root password set by the test instrumentation
+    users.users.root.hashedPasswordFile = lib.mkForce null;
+    users.users.root.initialHashedPassword = rootPassword;
+    users.users.normalo = {
+      isNormalUser = true;
+      initialPassword = normaloPassword;
+    };
+
+    specialisation.new-generation.configuration = {
+      users.users.new-normalo = {
+        isNormalUser = true;
+        initialHashedPassword = newNormaloPassword;
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("systemd-sysusers.service")
+
+    with subtest("systemd-sysusers.service contains the credentials"):
+      sysusers_service = machine.succeed("systemctl cat systemd-sysusers.service")
+      print(sysusers_service)
+      assert "SetCredential=passwd.plaintext-password.normalo:${normaloPassword}" in sysusers_service
+
+    with subtest("Correct mode on the password files"):
+      assert machine.succeed("stat -c '%a' /etc/passwd") == "644\n"
+      assert machine.succeed("stat -c '%a' /etc/group") == "644\n"
+      assert machine.succeed("stat -c '%a' /etc/shadow") == "0\n"
+      assert machine.succeed("stat -c '%a' /etc/gshadow") == "0\n"
+
+    with subtest("root user has correct password"):
+      print(machine.succeed("getent passwd root"))
+      assert "${rootPassword}" in machine.succeed("getent shadow root"), "root user password is not correct"
+
+    with subtest("normalo user is created"):
+      print(machine.succeed("getent passwd normalo"))
+      assert machine.succeed("stat -c '%U' /home/normalo") == "normalo\n"
+
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+
+    with subtest("new-normalo user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-normalo"))
+      assert machine.succeed("stat -c '%U' /home/new-normalo") == "new-normalo\n"
+      assert "${newNormaloPassword}" in machine.succeed("getent shadow new-normalo"), "new-normalo user password is not correct"
+  '';
+}
--- a/pkgs/applications/audio/go-musicfox/default.nix
+++ b/pkgs/applications/audio/go-musicfox/default.nix
@ -1,5 +1,5 @@
 { lib
-, buildGo121Module
+, buildGoModule
 , fetchFromGitHub
 , pkg-config
 , alsa-lib
@ -7,7 +7,7 @@
 , nix-update-script
 }:

-buildGo121Module rec {
+buildGoModule rec {
  pname = "go-musicfox";
  version = "4.3.0";

--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "pt2-clone";
-  version = "1.65.1";
+  version = "1.66.1";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${version}";
-    sha256 = "sha256-0bZGiulLeAZ8bR0lj0Bm7te3T3YhxSOBFgMgWADRkIY=";
+    sha256 = "sha256-j7VPC1sj1Q+wL2TBgv06uYLPqym8F57HG1SRvj0Ggeo=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/backup/unifi-protect-backup/default.nix
+++ b/pkgs/applications/backup/unifi-protect-backup/default.nix
@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "unifi-protect-backup";
-  version = "0.10.2";
+  version = "0.10.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ep1cman";
    repo = "unifi-protect-backup";
    rev = "refs/tags/v${version}";
-    hash = "sha256-EQCI7TkkOhDASMo5yKfAca/gB4ayyPOaDVK6WEaAIgc=";
+    hash = "sha256-jICnm9EfPyOLVbZfF+TYcQJo0ZXUDpFgYpL5Zf9b8Bc=";
  };

  pythonRelaxDeps = [
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1267,8 +1267,8 @@ let
        mktplcRef = {
          name = "elixir-ls";
          publisher = "JakeBecker";
-          version = "0.18.1";
-          sha256 = "sha256-PdXoc9+ejYr1SiikuabUH+2tt1tByJn5gycaHrHuaBE=";
+          version = "0.19.0";
+          sha256 = "sha256-31eenBOVUEY3MFaVmAjZsypr7U0d6IfVR3ZJfDqi3OY=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/JakeBecker.elixir-ls/changelog";
--- a/pkgs/applications/emulators/yuzu/compat-list.nix
+++ b/pkgs/applications/emulators/yuzu/compat-list.nix
@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, unstableGitUpdater }:
 stdenv.mkDerivation {
  pname = "yuzu-compatibility-list";
-  version = "unstable-2024-01-08";
+  version = "unstable-2024-01-21";

  src = fetchFromGitHub {
    owner = "flathub";
    repo = "org.yuzu_emu.yuzu";
-    rev = "0f5500f50e2a5ac7e40e6f5f8aeb160d46348828";
-    hash = "sha256-0JHl7myoa3MlfucmbKB5tubJ6sQ2IlTIL3i2yveOvaU=";
+    rev = "a3dd360e8b6e8c0c93d40f00416534c8b4bcd59a";
+    hash = "sha256-nXh5cJTS1zCa6GoH+AoisTIohsRruycqosxpmFAsaSw=";
  };

  buildCommand = ''
--- a/pkgs/applications/emulators/yuzu/early-access/sources.nix
+++ b/pkgs/applications/emulators/yuzu/early-access/sources.nix
@ -1,7 +1,7 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2024-01-10
+# Last updated: 2024-01-22
 {
-  version = "4056";
-  distHash = "sha256:14qd5v238pka9axrxjbaawr0kpkkbd95mzri6jdjxjyzbkk03hmb";
-  fullHash = "sha256:0fb4i6708q59ql9ffrw2myanqgxpy20z971y6l7yvxm1pqw9qhyx";
+  version = "4079";
+  distHash = "sha256:12cwzgdnpla9m24cla1596p773zpdgmi0zlyvdypmdx0qzwgwkpp";
+  fullHash = "sha256:1zp2nz9blsim2xmwb3pah38nrdysa3yrlqgb051n8b8qp6fp5979";
 }
--- a/pkgs/applications/emulators/yuzu/mainline.nix
+++ b/pkgs/applications/emulators/yuzu/mainline.nix
@ -47,13 +47,13 @@
 }:
 stdenv.mkDerivation(finalAttrs: {
  pname = "yuzu";
-  version = "1676";
+  version = "1689";

  src = fetchFromGitHub {
    owner = "yuzu-emu";
    repo = "yuzu-mainline";
    rev = "mainline-0-${finalAttrs.version}";
-    hash = "sha256-vRrliVuGXI/Dpmdkbj+P5hshzPzB6nijrXQfLXHaGqk=";
+    hash = "sha256-5ITGFWS0OJLXyNoAleZrJob2jz1He1LEOvQzjIlMmPQ=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -2,13 +2,13 @@

 buildPythonApplication rec {
  pname = "gallery-dl";
-  version = "1.26.6";
+  version = "1.26.7";
  format = "setuptools";

  src = fetchPypi {
    inherit version;
    pname = "gallery_dl";
-    sha256 = "sha256-QgvwxH8wbwxfjZaea89sINtHbSXyIq5XGpWUi6rOX+k=";
+    sha256 = "sha256-+aoXcxJVBp9nXKS+3+CG7XkDMemSgvExMXtnR2FDhYs=";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/misc/orpie/default.nix
+++ b/pkgs/applications/misc/orpie/default.nix
@ -4,8 +4,6 @@ ocamlPackages.buildDunePackage rec {
  pname = "orpie";
  version = "1.6.1";

-  duneVersion = "3";
-
  src = fetchFromGitHub {
    owner = "pelzlpj";
    repo = pname;
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@ -18,14 +18,14 @@

 mkDerivation rec {
  pname = "qcad";
-  version = "3.29.0.0";
+  version = "3.29.2.0";

  src = fetchFromGitHub {
    name = "qcad-${version}-src";
    owner = "qcad";
    repo = "qcad";
    rev = "v${version}";
-    sha256 = "sha256-Nx16TJrtxUUdeSobTYdgoDUzm1IcTGbaKnW/9YXozgo=";
+    sha256 = "sha256-7SX0hBSySY8AgmIwVjuszrfdfVKZ8axQzkpON9mjHgg=";
  };

  patches = [
--- a/pkgs/applications/misc/timewarrior/default.nix
+++ b/pkgs/applications/misc/timewarrior/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "timewarrior";
-  version = "1.7.0";
+  version = "1.7.1";

  src = fetchFromGitHub {
    owner = "GothenburgBitFactory";
    repo = "timewarrior";
    rev = "v${version}";
-    sha256 = "sha256-6s/fifjGCkk8JiADPbeiqsKMgY0fkIJBqRPco+rmP1A=";
+    sha256 = "sha256-sc4AfdXLuA9evoGU6Z97+Hq7zj9nx093+nPALRkhziQ=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/cluster/k0sctl/default.nix
+++ b/pkgs/applications/networking/cluster/k0sctl/default.nix
@ -1,10 +1,10 @@
 { lib
-, buildGo121Module
+, buildGoModule
 , fetchFromGitHub
 , installShellFiles
 }:

-buildGo121Module rec {
+buildGoModule rec {
  pname = "k0sctl";
  version = "0.17.4";

--- a/pkgs/applications/networking/cluster/kubectl-klock/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-klock/default.nix
@ -1,6 +1,6 @@
-{ lib, buildGo121Module, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:

-buildGo121Module rec {
+buildGoModule rec {
  pname = "kubectl-klock";
  version = "0.5.0";

--- a/pkgs/applications/networking/cluster/timoni/default.nix
+++ b/pkgs/applications/networking/cluster/timoni/default.nix
@ -1,10 +1,10 @@
 { lib
-, buildGo121Module
+, buildGoModule
 , fetchFromGitHub
 , installShellFiles
 }:

-buildGo121Module rec {
+buildGoModule rec {
  pname = "timoni";
  version = "0.17.0";

--- a/pkgs/applications/networking/ktailctl/default.nix
+++ b/pkgs/applications/networking/ktailctl/default.nix
@ -1,11 +1,11 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, buildGo121Module
+, buildGoModule
 , cmake
 , extra-cmake-modules
 , git
-, go_1_21
+, go
 , wrapQtAppsHook
 , qtbase
 , qtquickcontrols2
@ -28,13 +28,14 @@ let
    hash = "sha256-nY6DEHkDVWIlvc64smXb9KshrhNgNLKiilYydbMKCqc=";
  };

-  goDeps = (buildGo121Module {
+  goDeps = (buildGoModule {
    pname = "tailwrap";
    inherit src version;
    modRoot = "tailwrap";
    vendorHash = "sha256-Y9xhoTf3vCtiNi5qOPg020EQmASo58BZI3rAoUEC8qE=";
  }).goModules;
-in stdenv.mkDerivation {
+in
+stdenv.mkDerivation {
  pname = "ktailctl";
  inherit version src;

@ -56,7 +57,7 @@ in stdenv.mkDerivation {
    cmake
    extra-cmake-modules
    git
-    go_1_21
+    go
    wrapQtAppsHook
  ];

--- a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
+++ b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , buildFHSEnvChroot
+, copyDesktopItems
 , fetchurl
 , gsettings-desktop-schemas
 , makeDesktopItem
@ -10,7 +11,7 @@
 , configText ? ""
 }:
 let
-  version = "2306";
+  version = "2309.1";

  sysArch =
    if stdenv.hostPlatform.system == "x86_64-linux" then "x64"
@ -19,17 +20,13 @@ let

  # For USB support, ensure that /var/run/vmware/<YOUR-UID>
  # exists and is owned by you. Then run vmware-usbarbitrator as root.
-  bins = [
-    "vmware-view"
-    "vmware-usbarbitrator"
-  ];

  mainProgram = "vmware-view";

  # This forces the default GTK theme (Adwaita) because Horizon is prone to
  # UI usability issues when using non-default themes, such as Adwaita-dark.
-  wrapBinCommands = name: ''
-    makeWrapper "$out/bin/${name}" "$out/bin/${name}_wrapper" \
+  wrapBinCommands = path: name: ''
+    makeWrapper "$out/${path}/${name}" "$out/bin/${name}_wrapper" \
    --set GTK_THEME Adwaita \
    --suffix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}" \
    --suffix LD_LIBRARY_PATH : "$out/lib/vmware/view/crtbora:$out/lib/vmware"
@ -39,8 +36,8 @@ let
    pname = "vmware-horizon-files";
    inherit version;
    src = fetchurl {
-      url = "https://download3.vmware.com/software/CART24FQ2_LIN_2306_TARBALL/VMware-Horizon-Client-Linux-2306-8.10.0-21964631.tar.gz";
-      sha256 = "6051f6f1617385b3c211b73ff42dad27e2d22362df6ffd2f3d9f559d0b5743ea";
+      url = "https://download3.vmware.com/software/CART24FQ4_LIN_2309.1_TARBALL/VMware-Horizon-Client-Linux-2309.1-8.11.1-22775487.tar.gz";
+      sha256 = "3f66d21c0e97324d1cb85ac75132a69768e8e7ff57da33841e4e8bd37089d245";
    };
    nativeBuildInputs = [ makeWrapper ];
    installPhase = ''
@ -49,7 +46,7 @@ let

      chmod -R u+w ext/usr/lib
      mv ext/usr $out
-      cp -r ext/bin ext/lib $out/
+      cp -r ext/lib $out/

      # Horizon includes a copy of libstdc++ which is loaded via $LD_LIBRARY_PATH
      # when it cannot detect a new enough version already present on the system.
@ -62,7 +59,8 @@ let
      mkdir $out/lib/vmware/view/pkcs11
      ln -s ${opensc}/lib/pkcs11/opensc-pkcs11.so $out/lib/vmware/view/pkcs11/libopenscpkcs11.so

-      ${lib.concatMapStrings wrapBinCommands bins}
+      ${wrapBinCommands "bin" "vmware-view"}
+      ${wrapBinCommands "lib/vmware/view/usb" "vmware-usbarbitrator"}
    '';
  };

@ -121,11 +119,6 @@ let
    mimeTypes = [ "x-scheme-handler/vmware-view" ];
  };

-  binLinkCommands = lib.concatMapStringsSep
-    "\n"
-    (bin: "ln -s ${vmwareFHSUserEnv bin}/bin/${bin} $out/bin/")
-    bins;
-
 in
 stdenv.mkDerivation {
  pname = "vmware-horizon-client";
@ -133,10 +126,16 @@ stdenv.mkDerivation {

  dontUnpack = true;

+  nativeBuildInputs = [ copyDesktopItems ];
+
+  desktopItems = [ desktopItem ];
+
  installPhase = ''
-    mkdir -p $out/bin $out/share/applications
-    cp ${desktopItem}/share/applications/* $out/share/applications/
-    ${binLinkCommands}
+    runHook preInstall
+    mkdir -p $out/bin
+    ln -s ${vmwareFHSUserEnv "vmware-view"}/bin/vmware-view $out/bin/
+    ln -s ${vmwareFHSUserEnv "vmware-usbarbitrator"}/bin/vmware-usbarbitrator $out/bin/
+    runHook postInstall
  '';

  unwrapped = vmwareHorizonClientFiles;
--- a/pkgs/applications/radio/abracadabra/default.nix
+++ b/pkgs/applications/radio/abracadabra/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "abracadabra";
-  version = "2.3.4";
+  version = "2.3.5";

  src = fetchFromGitHub {
    owner = "KejPi";
    repo = "AbracaDABra";
    rev = "v${version}";
-    hash = "sha256-giQJ6lOD5TaOa98e7nXf6/HHxP6/TxD9Pgr7xAxvZzs=";
+    hash = "sha256-iWXQ4Tjqz9Y+pihuMDBKi3iwuo5eAyyAMNtRBxojOhs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/electronics/nanovna-saver/default.nix
+++ b/pkgs/applications/science/electronics/nanovna-saver/default.nix
@ -7,13 +7,13 @@
 }:
 python3.pkgs.buildPythonApplication rec {
  pname = "nanovna-saver";
-  version = "0.6.0";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "NanoVNA-Saver";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-2vDjAdEL8eNje5bm/1m+Fdi+PCGxpXwpxe2KvlLYB58=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-lL6n3hcsIbLmrRKPi/ckWW2XUAtmBqvMSplkWOF4VKQ=";
  };

   nativeBuildInputs = [
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -3,7 +3,8 @@
 , libX11, libXi, libxcb, libXext, libXcursor, glib, libXScrnSaver, libxkbfile, libXtst
 , nss, nspr, cups, fetchzip, expat, gdk-pixbuf, libXdamage, libXrandr, dbus
 , makeDesktopItem, openssl, wrapGAppsHook, at-spi2-atk, at-spi2-core, libuuid
-, e2fsprogs, krb5, libdrm, mesa, unzip, copyDesktopItems, libxshmfence, libxkbcommon
+, e2fsprogs, krb5, libdrm, mesa, unzip, copyDesktopItems, libxshmfence, libxkbcommon, git
+, libGL, zlib, cacert
 }:

 with lib;
@ -91,12 +92,14 @@ let
      mesa
      libxshmfence
      libxkbcommon
+      libGL
+      zlib
    ];

    desktopItems = [ (makeDesktopItem {
-      name = pname;
-      exec = pname;
-      icon = pname;
+      name = "GitKraken";
+      exec = "gitkraken";
+      icon = "gitkraken";
      desktopName = "GitKraken";
      genericName = "Git Client";
      categories = [ "Development" ];
@ -112,25 +115,37 @@ let
      mkdir -p $out/share/${pname}/
      cp -R $src/* $out/share/${pname}

-      mkdir -p $out/bin
-      ln -s $out/share/${pname}/${pname} $out/bin/
-
      mkdir -p $out/share/pixmaps
-      cp ${pname}.png $out/share/pixmaps/${pname}.png
+      cp gitkraken.png $out/share/pixmaps/

      runHook postInstall
    '';

    postFixup = ''
      pushd $out/share/${pname}
-      for file in ${pname} chrome-sandbox chrome_crashpad_handler; do
+      for file in gitkraken chrome-sandbox chrome_crashpad_handler; do
        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $file
      done

-      for file in $(find . -type f \( -name \*.node -o -name ${pname} -o -name \*.so\* \) ); do
+      for file in $(find . -type f \( -name \*.node -o -name gitkraken -o -name git -o -name git-\* -o -name scalar -o -name \*.so\* \) ); do
        patchelf --set-rpath ${libPath}:$out/share/${pname} $file || true
      done
      popd
+
+      # SSL and permissions fix for bundled nodegit
+      pushd $out/share/${pname}/resources/app.asar.unpacked/node_modules/@axosoft/nodegit/build/Release
+      mv nodegit-ubuntu-18.node nodegit-ubuntu-18-ssl-1.1.1.node
+      mv nodegit-ubuntu-18-ssl-static.node nodegit-ubuntu-18.node
+      chmod 755 nodegit-ubuntu-18.node
+      popd
+
+      # Devendor bundled git
+      rm -rf $out/share/${pname}/resources/app.asar.unpacked/git
+      ln -s ${git} $out/share/${pname}/resources/app.asar.unpacked/git
+
+      # GitKraken expects the CA bundle to be located in the bundled git directory. Since we replace it with
+      # the one from nixpkgs, which doesn't provide a CA bundle, we need to explicitly set its location at runtime
+      makeWrapper $out/share/${pname}/gitkraken $out/bin/gitkraken --set GIT_SSL_CAINFO "${cacert}/etc/ssl/certs/ca-bundle.crt"
    '';
  };

--- a/pkgs/applications/video/obs-studio/plugins/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/default.nix
@ -20,6 +20,8 @@

  obs-command-source = callPackage ./obs-command-source.nix { };

+  obs-composite-blur = callPackage ./obs-composite-blur.nix { };
+
  obs-freeze-filter = qt6Packages.callPackage ./obs-freeze-filter.nix { };

  obs-gradient-source = callPackage ./obs-gradient-source.nix { };
--- a/pkgs/applications/video/obs-studio/plugins/obs-composite-blur.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-composite-blur.nix
@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, obs-studio
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-composite-blur";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "FiniteSingularity";
+    repo = "obs-composite-blur";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-icn0X+c7Uf0nTFaVDVTPi26sfWTSeoAj7+guEn9gi9Y=";
+  };
+
+  buildInputs = [
+    obs-studio
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  meta = with lib; {
+    description = "A comprehensive blur plugin for OBS that provides several different blur algorithms, and proper compositing";
+    homepage = "https://github.com/FiniteSingularity/obs-composite-blur";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ GaetanLepage ];
+    mainProgram = "obs-composite-blur";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/video/vdr/markad/default.nix
+++ b/pkgs/applications/video/vdr/markad/default.nix
@ -19,12 +19,12 @@
 }:
 stdenv.mkDerivation rec {
  pname = "vdr-markad";
-  version = "3.4.3";
+  version = "3.4.5";

  src = fetchFromGitHub {
    repo = "vdr-plugin-markad";
    owner = "kfb77";
-    sha256 = "sha256-1+NpfZaXUaNSRbN07FrjDNqbOotmvrAwf4uLKhnKGkQ=";
+    sha256 = "sha256-qg3Y449n0xPMQSEn8QwvFC1FA8/MfhY0KPHPHGbApbA=";
    rev = "V${version}";
  };

--- a/pkgs/by-name/mo/move-mount-beneath/package.nix
+++ b/pkgs/by-name/mo/move-mount-beneath/package.nix
@ -0,0 +1,29 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation {
+  pname = "move-mount-beneath";
+  version = "unstable-2023-11-26";
+
+  src = fetchFromGitHub {
+    owner = "brauner";
+    repo = "move-mount-beneath";
+    rev = "d3d16c0d7766eb1892fcc24a75f8d35df4b0fe45";
+    hash = "sha256-hUboFthw9ABwK6MRSNg7+iu9YbiJALNdsw9Ub3v43n4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -D move-mount $out/bin/move-mount
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Toy binary to illustrate adding a mount beneath an existing mount";
+    homepage = "https://github.com/brauner/move-mount-beneath";
+    license = lib.licenses.mit0;
+    maintainers = with lib.maintainers; [ nikstur ];
+  };
+}
--- a/pkgs/by-name/nv/nvdtools/package.nix
+++ b/pkgs/by-name/nv/nvdtools/package.nix
@ -0,0 +1,31 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "nvdtools";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "facebookincubator";
+    repo = "nvdtools";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uB7dfqGaoP9Xx04BykscIFQ2rckaMaj93gh5mhgMqfw=";
+  };
+
+  vendorHash = "sha256-DzhP42DaddIm+/Z3a83rWX5WY+tM1P+vBNe6B91L7E8=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = with lib; {
+    description = "Tools to work with the feeds (vulnerabilities, CPE dictionary etc.) distributed by National Vulnerability Database";
+    homepage = "https://github.com/facebookincubator/nvdtools";
+    changelog = "https://github.com/facebookincubator/nvdtools/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/by-name/st/static-server/package.nix
+++ b/pkgs/by-name/st/static-server/package.nix
@ -1,5 +1,5 @@
 { lib
-, buildGo121Module
+, buildGoModule
 , fetchFromGitHub
 , curl
 , stdenv
@ -8,7 +8,7 @@
 , substituteAll
 }:

-buildGo121Module rec {
+buildGoModule rec {
  pname = "static-server";
  version = "1.2.1";

--- a/pkgs/by-name/sy/symbolicator/package.nix
+++ b/pkgs/by-name/sy/symbolicator/package.nix
@ -40,6 +40,7 @@ rustPlatform.buildRustPackage rec {
    zstd
  ] ++ lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
  ];

  env = {
--- a/pkgs/by-name/up/uplosi/package.nix
+++ b/pkgs/by-name/up/uplosi/package.nix
@ -1,8 +1,8 @@
 { lib
 , fetchFromGitHub
-, buildGo121Module
+, buildGoModule
 }:
-buildGo121Module rec {
+buildGoModule rec {
  pname = "uplosi";
  version = "0.1.2";

--- a/pkgs/by-name/zi/zitadel/package.nix
+++ b/pkgs/by-name/zi/zitadel/package.nix
@ -1,5 +1,5 @@
 { stdenv
-, buildGo121Module
+, buildGoModule
 , callPackage
 , fetchFromGitHub
 , lib
@ -25,7 +25,7 @@ let
  goModulesHash = "sha256-IVf1YVnhyEYgZqM31Cv3aBFnPG7v5WW6fCEvlN+sTIE=";

  buildZitadelProtocGen = name:
-    buildGo121Module {
+    buildGoModule {
      pname = "protoc-gen-${name}";
      inherit version;

@ -94,7 +94,7 @@ let
    hash = "sha256-xrEF1B4pMoCZs1WO9F6IoqHnSyt5BhPVTIABMWK/q2E=";
  };
 in
-buildGo121Module rec {
+buildGoModule rec {
  name = "zitadel";
  inherit version;

--- a/pkgs/development/interpreters/luau/default.nix
+++ b/pkgs/development/interpreters/luau/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "luau";
-  version = "0.607";
+  version = "0.609";

  src = fetchFromGitHub {
    owner = "luau-lang";
    repo = "luau";
    rev = version;
-    hash = "sha256-2O+nOgOWXPEbBJlRYnW8PlpG2oeQNZB7k08lFgF+ceE=";
+    hash = "sha256-L8ANZW4TyFNBn8tb5Y3k9zdGBbWbEVFUnjAkhfaZu3M=";
  };

  nativeBuildInputs = [ cmake ];
@ -42,5 +42,6 @@ stdenv.mkDerivation rec {
    license = licenses.mit;
    platforms = platforms.all;
    maintainers = [ maintainers.marsam ];
+    mainProgram = "luau";
  };
 }
--- a/pkgs/development/interpreters/risor/default.nix
+++ b/pkgs/development/interpreters/risor/default.nix
@ -1,11 +1,11 @@
 { lib
-, buildGo121Module
+, buildGoModule
 , fetchFromGitHub
 , testers
 , risor
 }:

-buildGo121Module rec {
+buildGoModule rec {
  pname = "risor";
  version = "1.1.2";

--- a/pkgs/development/libraries/ada/spark2014/default.nix
+++ b/pkgs/development/libraries/ada/spark2014/default.nix
@ -5,7 +5,6 @@
 , gnatcoll-core
 , gprbuild
 , python3
-, ocaml
 , ocamlPackages
 , makeWrapper
 }:
@ -27,7 +26,7 @@ stdenv.mkDerivation rec {
    gnat12
    gprbuild
    python3
-    ocaml
+    ocamlPackages.ocaml
    makeWrapper
  ];

--- a/pkgs/development/libraries/kdsoap/default.nix
+++ b/pkgs/development/libraries/kdsoap/default.nix
@ -28,10 +28,8 @@ in stdenv.mkDerivation rec {

  postInstall = ''
    moveToOutput bin/kdwsdl2cpp* "$dev"
-    sed -i "$out/lib/cmake/${cmakeName}/KDSoapTargets.cmake" \
-        -e "/^  INTERFACE_INCLUDE_DIRECTORIES/ c   INTERFACE_INCLUDE_DIRECTORIES \"$dev/include\""
-    sed -i "$out/lib/cmake/${cmakeName}/KDSoapTargets-release.cmake" \
-        -e "s@$out/bin@$dev/bin@"
+    substituteInPlace "$out/lib/cmake/${cmakeName}/KDSoapTargets-release.cmake" \
+      --replace $out/bin $dev/bin
  '';

  meta = with lib; {
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/ocaml-modules/containers/default.nix
+++ b/pkgs/development/ocaml-modules/containers/default.nix
@ -5,14 +5,16 @@
 }:

 buildDunePackage rec {
-  version = "3.12";
+  version = "3.13.1";
  pname = "containers";

+  minimalOCamlVersion = "4.08";
+
  src = fetchFromGitHub {
    owner = "c-cube";
    repo = "ocaml-containers";
    rev = "v${version}";
-    hash = "sha256-15Wd6k/NvjAvTmxlPlZPClODBtFXM6FG3VxniC66u88=";
+    hash = "sha256-jkXh/dBRotWXvA77M/+tm39qsCiBsH/HSs+Y9D9QCek=";
  };

  buildInputs = [ dune-configurator ];
--- a/pkgs/development/php-packages/phalcon/default.nix
+++ b/pkgs/development/php-packages/phalcon/default.nix
@ -2,13 +2,13 @@

 buildPecl rec {
  pname = "phalcon";
-  version = "5.5.0";
+  version = "5.6.0";

  src = fetchFromGitHub {
    owner = "phalcon";
    repo = "cphalcon";
    rev = "v${version}";
-    hash = "sha256-ycE8A3ESV97COTdbjkrOJCZpEmP1l9nkmNnhjJGaBeE=";
+    hash = "sha256-EtwhWRBqJOMndmsy+Rgc4MVjFZg/Fm97qkSuTGxqHhI=";
  };

  internalDeps = [ php.extensions.session php.extensions.pdo ];
--- a/pkgs/development/python-modules/msal-extensions/default.nix
+++ b/pkgs/development/python-modules/msal-extensions/default.nix
@ -1,46 +1,47 @@
-{ buildPythonPackage
-, fetchPypi
-, lib
-, isPy27
-
-# pythonPackages
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
 , msal
-, pathlib2
 , portalocker
+, setuptools
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "msal-extensions";
-  version = "1.0.0";
-  format = "setuptools";
+  version = "1.1.0";
+  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-xnarpWsMzjeD3htcXs/oKNuZgWeHUSbKS0fcZDZFE1Q=";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "AzureAD";
+    repo = "microsoft-authentication-extensions-for-python";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ScInTvOgFxP5mgep5FRu6YZHPTtXhrcZGFE7Wdvcm4c=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    msal
    portalocker
-  ] ++ lib.optionals isPy27 [
-    pathlib2
  ];

-  # upstream doesn't update this requirement probably because they use pip
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "portalocker~=1.0" "portalocker"
-  '';
-
  # No tests found
  doCheck = false;

+  pythonImportsCheck = [
+    "msal_extensions"
+  ];
+
  meta = with lib; {
    description = "The Microsoft Authentication Library Extensions (MSAL-Extensions) for Python";
    homepage = "https://github.com/AzureAD/microsoft-authentication-extensions-for-python";
+    changelog = "https://github.com/AzureAD/microsoft-authentication-extensions-for-python/releases/tag/${version}";
    license = licenses.mit;
-    maintainers = with maintainers; [
-      kamadorueda
-    ];
+    maintainers = with maintainers; [ kamadorueda ];
  };
 }
--- a/pkgs/development/python-modules/msal/default.nix
+++ b/pkgs/development/python-modules/msal/default.nix
@ -1,24 +1,31 @@
 { lib
+, cryptography
 , buildPythonPackage
 , fetchPypi
 , pyjwt
 , pythonOlder
 , requests
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "msal";
-  version = "1.25.0";
-  format = "setuptools";
+  version = "1.26.0";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-9EMp/bWfTwRMd5Fko0R0uKRK2eSUCvvEw6Oiu+kDJNk=";
+    hash = "sha256-IkdWB5/jOL6DhzdoK0n468IKh8HF7q9ZDarkUyuD3hU=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
+    cryptography
    pyjwt
    requests
  ]
--- a/pkgs/development/python-modules/parsedmarc/default.nix
+++ b/pkgs/development/python-modules/parsedmarc/default.nix
@ -5,6 +5,7 @@
 , buildPythonPackage
 , dateparser
 , dnspython
+, elastic-transport
 , elasticsearch
 , elasticsearch-dsl
 , expiringdict
@ -51,7 +52,8 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace "elasticsearch<7.14.0" "elasticsearch"
+      --replace "elasticsearch<7.14.0" "elasticsearch" \
+      --replace "elasticsearch-dsl==7.4.0" "elasticsearch-dsl"
  '';

  nativeBuildInputs = [
@ -64,6 +66,7 @@ buildPythonPackage rec {
    boto3
    dateparser
    dnspython
+    elastic-transport
    elasticsearch
    elasticsearch-dsl
    expiringdict
@ -89,7 +92,9 @@ buildPythonPackage rec {
  # https://github.com/domainaware/parsedmarc/issues/426
  doCheck = false;

-  pythonImportsCheck = [ "parsedmarc" ];
+  pythonImportsCheck = [
+    "parsedmarc"
+  ];

  passthru = {
    inherit dashboard;
@ -97,11 +102,11 @@ buildPythonPackage rec {
  };

  meta = with lib; {
-    changelog = "https://github.com/domainaware/parsedmarc/blob/master/CHANGELOG.md#${lib.replaceStrings [ "." ] [ "" ] version}";
    description = "Python module and CLI utility for parsing DMARC reports";
    homepage = "https://domainaware.github.io/parsedmarc/";
-    mainProgram = "parsedmarc";
-    maintainers = with maintainers; [ talyz ];
+    changelog = "https://github.com/domainaware/parsedmarc/blob/master/CHANGELOG.md#${lib.replaceStrings [ "." ] [ "" ] version}";
    license = licenses.asl20;
+    maintainers = with maintainers; [ talyz ];
+    mainProgram = "parsedmarc";
  };
 }
--- a/pkgs/development/python-modules/pybids/default.nix
+++ b/pkgs/development/python-modules/pybids/default.nix
@ -26,14 +26,17 @@ buildPythonPackage rec {
    hash = "sha256-pahl8wi6Sf8AuVqkvi7H90ViHr+9utb14ZVmKK3rFm4=";
  };

+  pythonRelaxDeps = [
+    "formulaic"
+    "sqlalchemy"
+  ];
+
  nativeBuildInputs = [
    pythonRelaxDepsHook
    setuptools
    versioneer
  ] ++ versioneer.optional-dependencies.toml;

-  pythonRelaxDeps = [ "sqlalchemy" ];
-
  propagatedBuildInputs = [
    bids-validator
    click
@ -65,6 +68,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python tools for querying and manipulating BIDS datasets";
    homepage = "https://github.com/bids-standard/pybids";
+    changelog = "https://github.com/bids-standard/pybids/blob/${version}/CHANGELOG.rst";
    license = licenses.mit;
    maintainers = with maintainers; [ jonringer ];
  };
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "python-gitlab";
-  version = "4.2.0";
+  version = "4.4.0";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-+HDXb5jJXQXEM5nXOx6qtZxnGzJ5ODDNL53fMsyTVB4=";
+    hash = "sha256-HRF797QzroJV5ddOcsZgl49Q7oXrYiSMn7Uu9Dw+OBQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/python-trovo/default.nix
+++ b/pkgs/development/python-modules/python-trovo/default.nix
@ -14,7 +14,8 @@ buildPythonPackage rec {
  disabled = pythonOlder "3.8";

  src = fetchPypi {
-    inherit pname version;
+    pname = "python_trovo";
+    inherit version;
    hash = "sha256-3EVSF4+nLvvM2RocNM2xz9Us5VrRRTCu/MWCcqwwikw=";
  };

--- a/pkgs/development/python-modules/qingping-ble/default.nix
+++ b/pkgs/development/python-modules/qingping-ble/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "qingping-ble";
-  version = "0.9.0";
+  version = "0.10.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "bluetooth-devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-h2PVrwesUaJfwJtuNf44bd1MefpSmOm7Q4A/URvd+IY=";
+    hash = "sha256-5w3KGJLdHFv6kURKTz3YImZNjaETiVqbbJTJpBSLSo8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/types-aiobotocore-packages/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore-packages/default.nix
--- a/pkgs/development/python-modules/types-aiobotocore/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore/default.nix
@ -364,12 +364,12 @@

 buildPythonPackage rec {
  pname = "types-aiobotocore";
-  version = "2.9.0";
+  version = "2.11.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-QSZDFXiVEXFHTE7FrLZVUeLOOyPTG96PIMg9lziiwDc=";
+    hash = "sha256-gw6q/ht30klxav7Du4siFvAkU6Mx2VIzNyDbJzaK47Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/types-aiobotocore/update.sh
+++ b/pkgs/development/python-modules/types-aiobotocore/update.sh
@ -5,7 +5,7 @@ set -eu -o pipefail

 source_file=pkgs/development/python-modules/types-aiobotocore-packages/default.nix

-version="2.9.0"
+version="2.11.0"

 nix-update python311Packages.types-aiobotocore --commit --build

--- a/pkgs/development/python-modules/vulture/default.nix
+++ b/pkgs/development/python-modules/vulture/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "vulture";
-  version = "2.10";
+  version = "2.11";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-KlwxYL/7p3WVtubfzEEgFr0qCc1LZs33+7qRNoSJn28=";
+    hash = "sha256-8Pu2C85lEarYfuBzbFAkVnN0kKgtkZpE5tkiYss18cI=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/watermark/default.nix
+++ b/pkgs/development/python-modules/watermark/default.nix
@ -29,7 +29,6 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    ipython
-  ] ++ lib.optionals (pythonOlder "3.8") [
    importlib-metadata
  ];

--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "weaviate-client";
-  version = "3.26.0";
+  version = "3.26.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-7oCb8tH1pQDJpoxe3C6xdKtRQqNoAuJ0qySv5nX/sos=";
+    hash = "sha256-7lWiY4cPnKwZ+9/QHg20RbPtGBEzHHWgJAdErUS4rZU=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/yaramod/default.nix
+++ b/pkgs/development/python-modules/yaramod/default.nix
@ -20,7 +20,7 @@ let
 in
  buildPythonPackage rec {
    pname = "yaramod";
-    version = "3.20.2";
+    version = "3.21.0";
    format = "setuptools";

    disabled = pythonOlder "3.7";
@ -29,7 +29,7 @@ in
      owner = "avast";
      repo = pname;
      rev = "refs/tags/v${version}";
-      hash = "sha256-OLsTvG+qaUJlKdHwswGBifzoT/uNunrrVWQg7hJxkhE=";
+      hash = "sha256-YkMDoFwWPrDhAgDnPpNCU1NlnAPhwYQF/KFaRFn+juQ=";
    };

    postPatch = ''
--- a/pkgs/development/python-modules/yfinance/default.nix
+++ b/pkgs/development/python-modules/yfinance/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "yfinance";
-  version = "0.2.35";
+  version = "0.2.36";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "ranaroussi";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-uLcnTH3teLxW6LZCJUD3jOPLm1a2jAK1bg4tKSSNXKU=";
+    hash = "sha256-oBpkWKQZ5FA+nyNWVOlRzoEyShCfh6SqCCrkFZBu1rQ=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/yolink-api/default.nix
+++ b/pkgs/development/python-modules/yolink-api/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "yolink-api";
-  version = "0.3.4";
+  version = "0.3.6";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "YoSmart-Inc";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-wDZlzl178SIXxo5SacbbXWHhF4wOsjBU4a9h0jBYA4c=";
+    hash = "sha256-KqQUaPac0nv8L3mrGn+nlzlB6mzqa5uMAceHlVKS1Ew=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/analysis/frama-c/default.nix
+++ b/pkgs/development/tools/analysis/frama-c/default.nix
@ -45,6 +45,10 @@ stdenv.mkDerivation rec {
    hash = "sha256-KWEogjMOy27d0LTKOvwEkrcND+szeaG46JMZTG4XOYM=";
  };

+  preConfigure = ''
+    substituteInPlace src/dune --replace " bytes " " "
+  '';
+
  postConfigure = "patchShebangs src/plugins/eva/gen-api.sh";

  strictDeps = true;
--- a/pkgs/development/tools/changie/default.nix
+++ b/pkgs/development/tools/changie/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "changie";
-  version = "1.17.0";
+  version = "1.18.0";

  src = fetchFromGitHub {
    owner = "miniscruff";
    repo = "changie";
    rev = "v${version}";
-    hash = "sha256-IS4KKvAi4VutJADSpst56ZdeqoqVkSMQ1TyQR12pqNg=";
+    hash = "sha256-pZe9T/WALFX5xwCiZKbf8fpaG3wmBJbqgM7FTPqlN2k=";
  };

-  vendorHash = "sha256-JmK7bcS8UYCOUvJGs0PAYPNc8iwvCSFzjLlkBEVUa40=";
+  vendorHash = "sha256-SdaDu9LXgelSEXdOCAbtvt1LnrSVpAIoN6MDSjTeEOs=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/development/tools/database/pg_activity/default.nix
+++ b/pkgs/development/tools/database/pg_activity/default.nix
@ -2,14 +2,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "pg_activity";
-  version = "3.0.3";
+  version = "3.4.2";
  disabled = python3Packages.pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "dalibo";
    repo = pname;
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-djpBdhCgtlm6+DiZVKSKh0nu30YVm/qZHlBHPtdObfU=";
+    sha256 = "sha256-7ML/xI1rQUqD9gm+1+yOdIesivAnl7fA8fgk67ru3Kc=";
  };

  propagatedBuildInputs = with python3Packages; [
--- a/pkgs/development/tools/rust/rtthost/default.nix
+++ b/pkgs/development/tools/rust/rtthost/default.nix
@ -1,33 +0,0 @@
-{ lib
-, stdenv
-, rustPlatform
-, fetchCrate
-, pkg-config
-, libusb1
-, DarwinTools
-, AppKit
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "rtthost";
-  version = "0.22.0";
-
-  src = fetchCrate {
-    inherit pname version;
-    hash = "sha256-Pb7Df3JI6ACcJ81+9KZ8qMM5Y/VT0kO5kubC3g0Wtlk=";
-  };
-
-  cargoHash = "sha256-Wb+ZPUrNA3LW4huT1QnyW8RKkh4Ow6gBT1VByHlEwGg=";
-
-  nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
-
-  buildInputs = [ libusb1 ] ++ lib.optionals stdenv.isDarwin [ AppKit ];
-
-  meta = with lib; {
-    description = "RTT (Real-Time Transfer) client";
-    homepage = "https://probe.rs/";
-    changelog = "https://github.com/probe-rs/probe-rs/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ asl20 /* or */ mit ];
-    maintainers = with maintainers; [ samueltardieu ];
-  };
-}
--- a/pkgs/development/tools/turso-cli/default.nix
+++ b/pkgs/development/tools/turso-cli/default.nix
@ -1,12 +1,12 @@
 {
  lib,
  stdenv,
-  buildGo121Module,
+  buildGoModule,
  fetchFromGitHub,
  installShellFiles,
  nix-update-script,
 }:
-buildGo121Module rec {
+buildGoModule rec {
  pname = "turso-cli";
  version = "0.88.2";

--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@ -4,9 +4,9 @@ let
  # comments with variant added for update script
  # ./update-zen.py zen
  zenVariant = {
-    version = "6.7"; #zen
-    suffix = "zen3"; #zen
-    sha256 = "0iflyip1a70i7bhll5bpls513g3q1hwsi1irm42rmjsysh4fb188"; #zen
+    version = "6.7.1"; #zen
+    suffix = "zen1"; #zen
+    sha256 = "0zk7rdbqszdcs86azkycqgaci077a621qzndvs0i3zsw79wr6dnh"; #zen
    isLqx = false;
  };
  # ./update-zen.py lqx
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@ -9,13 +9,13 @@

 buildDotnetModule rec {
  pname = "jackett";
-  version = "0.21.1510";
+  version = "0.21.1588";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha512-isoKpyxrjr+Kq+Ni7+suQDSWEhTieDzFpdFsf7oxm3+9J2/ziHgh7qfiaaicwqIjSnfUhykvXqAGzrf/Yc/+7g==";
+    hash = "sha512-HJSim0I7hLZqJIKU4GoGFQEPY8w9SWp6MxfAxDHuklWKn1dvoQBWh83s8aEz3VOGHXj+SvqciA0o5rWL23camA==";
  };

  projectFile = "src/Jackett.Server/Jackett.Server.csproj";
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@ -25,11 +25,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "postfix";
-  version = "3.8.4";
+  version = "3.8.5";

  src = fetchurl {
    url = "https://de.postfix.org/ftpmirror/official/${pname}-${version}.tar.gz";
-    hash = "sha256-b1hIxdi2p9LFrwqfdbC9PxA0UekSWRRkq4Z/3gheYjY=";
+    hash = "sha256-8+gnorLkEDWa0l0xNBlwQ0qwfjYTn5ou+TmBsOxWTIU=";
  };

  nativeBuildInputs = [ makeWrapper m4 ];
--- a/pkgs/servers/mail/rspamd/default.nix
+++ b/pkgs/servers/mail/rspamd/default.nix
@ -27,13 +27,13 @@ assert withHyperscan -> stdenv.isx86_64;

 stdenv.mkDerivation rec {
  pname = "rspamd";
-  version = "3.7.5";
+  version = "3.8.0";

  src = fetchFromGitHub {
    owner = "rspamd";
    repo = "rspamd";
    rev = version;
-    hash = "sha256-Y9Xq6mEq52AeTBGMQOh4jO4BUcSS9YfCs1/Wka5zkK4=";
+    hash = "sha256-7OL0VZKOhIqJb31/VEUgcYDCLifMs1Rfh3SZUKeFAqk=";
  };

  hardeningEnable = [ "pie" ];
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "syft";
-  version = "0.100.0";
+  version = "0.101.1";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-NF+Cjf3EZ9nNi10ckEuL6CnUJZssSuv3cq95QIoj+e8=";
+    hash = "sha256-k5Oes8nqS21lauEIQkieONwdbwNxguNKeg/CbSizOzc=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -22,7 +22,7 @@ buildGoModule rec {
  };
  # hash mismatch with darwin
  proxyVendor = true;
-  vendorHash = "sha256-C6I9NGIt++FesC86NgZc2jrPHQvS5Xmgdc/tlvPJzMo=";
+  vendorHash = "sha256-xYEAO0VP+UoZRcgTqHuBRExtqdAZMQ3hknJLw0XR06Q=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fluent-bit";
-  version = "2.2.1";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "fluent";
    repo = "fluent-bit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-XGmCEzFa0f+s2J+ZyNXeExxrwS3B7Fr4MUeH5y+hG78=";
+    hash = "sha256-+AkIoGIAwz5dqQGtTJQjz+a9jgtxU1zwDuivj862Rw0=";
  };

  nativeBuildInputs = [ cmake flex bison ];
--- a/pkgs/tools/misc/gh-dash/default.nix
+++ b/pkgs/tools/misc/gh-dash/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "gh-dash";
-  version = "3.11.1";
+  version = "3.12.0";

  src = fetchFromGitHub {
    owner = "dlvhdr";
    repo = "gh-dash";
    rev = "v${version}";
-    hash = "sha256-07tp8kfmK/YXfV0Yi4Z27BBAefbdJ0gj2ySq2xDB1nw=";
+    hash = "sha256-ijqEsjBNncrtg1DaVvwH2gxTgB3QOJCF1RxetnPBVII=";
  };

-  vendorHash = "sha256-33W2xd/T1g65eujTTr0q3gYn9np2iELWBEDAjcefwQc=";
+  vendorHash = "sha256-ezxwUfI8FevfeRmXN4Og9Gfw1GX9noagzWIg6GSPOPc=";

  ldflags = [
    "-s"
--- a/pkgs/tools/misc/xilinx-bootgen/default.nix
+++ b/pkgs/tools/misc/xilinx-bootgen/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "xilinx-bootgen";
-  version = "xilinx_v2023.1";
+  version = "xilinx_v2023.2";

  src = fetchFromGitHub {
    owner = "xilinx";
    repo = "bootgen";
    rev = version;
-    sha256 = "sha256-pEkpZachZX2tOhH2Odb2fZWqJehLILE/0Z500xRuRzU=";
+    hash = "sha256-YRaq36N6uBHyjuHQ5hCO35Y+y818NuSjg/js181iItA=";
  };

  buildInputs = [ openssl ];
--- a/pkgs/tools/networking/goflow2/default.nix
+++ b/pkgs/tools/networking/goflow2/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "goflow2";
-  version = "2.1.1";
+  version = "2.1.2";

  src = fetchFromGitHub {
    owner = "netsampler";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-RgHCUuP2EE38X6iMaYD2a8f/C2fBcBEHM5ErlKBkMqI=";
+    hash = "sha256-eI5Czx721aty1b+rs8uHrx0IBM/DK7bkPck1QIYPcNI=";
  };

  ldflags = [
--- a/pkgs/tools/networking/juicity/default.nix
+++ b/pkgs/tools/networking/juicity/default.nix
@ -1,8 +1,8 @@
 { lib
 , fetchFromGitHub
-, buildGo121Module
+, buildGoModule
 }:
-buildGo121Module rec {
+buildGoModule rec {
  pname = "juicity";
  version = "0.3.0";

--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@ -31,16 +31,16 @@ let
 in
 buildGoModule rec {
  pname = "netbird";
-  version = "0.25.2";
+  version = "0.25.4";

  src = fetchFromGitHub {
    owner = "netbirdio";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-308t/yaFFabFC9nr1eN/SMF+uBBnpGaaWiWD0wm/dtI=";
+    hash = "sha256-M6n7uD1HPG0RA8PqNc7misIM9+w3uoJDjRhRcBQZKZM=";
  };

-  vendorHash = "sha256-3jjCAsqbD5HUM8972jGBxCiewSLh2aIRE68rpV03KqQ=";
+  vendorHash = "sha256-HPP1XOOX0YShrsMFwmfJ1CZq9wHjqYSFK+a+b7FEFdc=";

  nativeBuildInputs = [ installShellFiles ] ++ lib.optional ui pkg-config;

--- a/pkgs/tools/security/sslscan/default.nix
+++ b/pkgs/tools/security/sslscan/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "sslscan";
-  version = "2.1.2";
+  version = "2.1.3";

  src = fetchFromGitHub {
    owner = "rbsec";
    repo = "sslscan";
    rev = "refs/tags/${version}";
-    hash = "sha256-6teCWzv9DXhGSBjyIurRW3ymSTwMUlbJGjuXmsqpkUc=";
+    hash = "sha256-oLlMeFVicDwr2XjCX/0cBMTXLKB8js50646uAf3tP9k=";
  };

  buildInputs = [ openssl ];
--- a/pkgs/tools/system/netdata/go.d.plugin.nix
+++ b/pkgs/tools/system/netdata/go.d.plugin.nix
@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, buildGo121Module, nixosTests }:
+{ lib, fetchFromGitHub, buildGoModule, nixosTests }:

-buildGo121Module rec {
+buildGoModule rec {
  pname = "netdata-go-plugins";
  version = "0.57.2";

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -751,11 +751,6 @@ with pkgs;
    inherit (darwin) DarwinTools;
  };

-  rtthost = callPackage ../development/tools/rust/rtthost {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-    inherit (darwin) DarwinTools;
-  };
-
  mix2nix = callPackage ../development/tools/mix2nix {
    elixir = elixir_1_14;
  };
@ -1889,7 +1884,9 @@ with pkgs;

  grizzly = callPackage ../tools/misc/grizzly { };

-  guestfs-tools = callPackage ../tools/virtualization/guestfs-tools { };
+  guestfs-tools = callPackage ../tools/virtualization/guestfs-tools {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  fabs = callPackage ../tools/backup/fabs { };

@ -2093,7 +2090,9 @@ with pkgs;

  supercronic = callPackage ../tools/system/supercronic { };

-  supermin = callPackage ../tools/virtualization/supermin { };
+  supermin = callPackage ../tools/virtualization/supermin {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  sx-go = callPackage ../tools/security/sx-go { };

@ -5397,7 +5396,9 @@ with pkgs;

  ### TOOLS/TYPESETTING/TEX

-  advi = callPackage ../tools/typesetting/tex/advi { };
+  advi = callPackage ../tools/typesetting/tex/advi {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  auctex = callPackage ../tools/typesetting/tex/auctex { };

@ -9975,6 +9976,7 @@ with pkgs;

  liquidsoap = callPackage ../tools/audio/liquidsoap/full.nix {
    ffmpeg = ffmpeg-full;
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
  };

  linuxwave = callPackage ../tools/audio/linuxwave { };
@ -15690,7 +15692,9 @@ with pkgs;

  coffeescript = callPackage ../development/compilers/coffeescript { };

-  comby = callPackage ../development/tools/comby { };
+  comby = callPackage ../development/tools/comby {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  inherit (coqPackages_8_17) compcert;

@ -16334,6 +16338,7 @@ with pkgs;
  fsharp = callPackage ../development/compilers/fsharp { };

  fstar = callPackage ../development/compilers/fstar {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
    z3 = z3_4_8_5;
  };

@ -16400,7 +16405,9 @@ with pkgs;
    inherit (emacs.pkgs.melpaStablePackages) irony;
  };

-  heptagon = callPackage ../development/compilers/heptagon { };
+  heptagon = callPackage ../development/compilers/heptagon {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  holo-build = callPackage ../tools/package-management/holo-build { };

@ -16889,7 +16896,9 @@ with pkgs;

  rgbds = callPackage ../development/compilers/rgbds { };

-  rml = callPackage ../development/compilers/rml { };
+  rml = callPackage ../development/compilers/rml {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  rgxg = callPackage ../tools/text/rgxg { };

@ -17299,7 +17308,7 @@ with pkgs;
  };

  teyjus = callPackage ../development/compilers/teyjus {
-    inherit (ocamlPackages) buildDunePackage;
+    inherit (ocaml-ng.ocamlPackages_4_14) buildDunePackage;
  };

  thrust = callPackage ../development/tools/thrust {
@ -18024,7 +18033,9 @@ with pkgs;

  sparkleshare = callPackage ../applications/version-management/sparkleshare { };

-  spark2014 = callPackage ../development/libraries/ada/spark2014 { };
+  spark2014 = callPackage ../development/libraries/ada/spark2014 {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  spidermonkey_78 = callPackage ../development/interpreters/spidermonkey/78.nix {
    inherit (darwin) libobjc;
@ -18879,7 +18890,9 @@ with pkgs;
  # Does not actually depend on Qt 5
  inherit (plasma5Packages) extra-cmake-modules;

-  coccinelle = callPackage ../development/tools/misc/coccinelle { };
+  coccinelle = callPackage ../development/tools/misc/coccinelle {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  cpptest = callPackage ../development/libraries/cpptest { };

@ -19147,6 +19160,7 @@ with pkgs;

  flow = callPackage ../development/tools/analysis/flow {
    inherit (darwin.apple_sdk.frameworks) CoreServices;
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
  };

  fly = callPackage ../development/tools/continuous-integration/fly { };
@ -22438,7 +22452,7 @@ with pkgs;
  libbacktrace = callPackage ../development/libraries/libbacktrace { };

  libbap = callPackage ../development/libraries/libbap {
-    inherit (ocaml-ng.ocamlPackages) bap ocaml findlib ctypes;
+    inherit (ocaml-ng.ocamlPackages_4_14) bap ocaml findlib ctypes;
  };

  libbaseencode = callPackage ../development/libraries/libbaseencode { };
@ -22910,6 +22924,7 @@ with pkgs;
  libguestfs-appliance = callPackage ../development/libraries/libguestfs/appliance.nix { };
  libguestfs = callPackage ../development/libraries/libguestfs {
    autoreconfHook = buildPackages.autoreconfHook264;
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
  };
  libguestfs-with-appliance = libguestfs.override {
    appliance = libguestfs-appliance;
@ -32452,7 +32467,9 @@ with pkgs;
    electron = electron_19;
  };

-  jackline = callPackage ../applications/networking/instant-messengers/jackline { };
+  jackline = callPackage ../applications/networking/instant-messengers/jackline {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  jay = callPackage ../applications/window-managers/jay { };

@ -34468,7 +34485,9 @@ with pkgs;

  opusTools = callPackage ../applications/audio/opus-tools { };

-  orpie = callPackage ../applications/misc/orpie { };
+  orpie = callPackage ../applications/misc/orpie {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  osmo = callPackage ../applications/office/osmo { };

@ -36136,7 +36155,9 @@ with pkgs;

  virt-viewer = callPackage ../applications/virtualization/virt-viewer { };

-  virt-top = callPackage ../applications/virtualization/virt-top { };
+  virt-top = callPackage ../applications/virtualization/virt-top {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  virt-what = callPackage ../applications/virtualization/virt-what { };

@ -39449,7 +39470,9 @@ with pkgs;

  crypto-org-wallet = callPackage ../applications/blockchains/crypto-org-wallet { };

-  cubicle = callPackage ../applications/science/logic/cubicle { };
+  cubicle = callPackage ../applications/science/logic/cubicle {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  cvc3 = callPackage ../applications/science/logic/cvc3 {
    gmp = lib.overrideDerivation gmp (_: { dontDisableStatic = true; });
@ -39577,7 +39600,9 @@ with pkgs;

  proverif = callPackage ../applications/science/logic/proverif { };

-  satallax = callPackage ../applications/science/logic/satallax { };
+  satallax = callPackage ../applications/science/logic/satallax {
+    inherit (ocaml-ng.ocamlPackages_4_14) ocaml;
+  };

  saw-tools = callPackage ../applications/science/logic/saw-tools { };

@ -39927,7 +39952,9 @@ with pkgs;
    perl = perl536;
  };

-  megam = callPackage ../applications/science/misc/megam { };
+  megam = callPackage ../applications/science/misc/megam {
+    inherit (ocaml-ng.ocamlPackages_4_14) ocaml;
+  };

  netlogo = callPackage ../applications/science/misc/netlogo { };

@ -41029,7 +41056,9 @@ with pkgs;

  sanoid = callPackage ../tools/backup/sanoid { };

-  satysfi = callPackage ../tools/typesetting/satysfi { };
+  satysfi = callPackage ../tools/typesetting/satysfi {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+  };

  sc-controller = python3Packages.callPackage ../misc/drivers/sc-controller {
    inherit libusb1; # Shadow python.pkgs.libusb1.
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@ -33,6 +33,7 @@ let
      );
      compcert = callPackage ../development/coq-modules/compcert {
        inherit fetchpatch makeWrapper coq2html lib stdenv;
+        ocamlPackages = ocamlPackages_4_14;
      };
      coq-bits = callPackage ../development/coq-modules/coq-bits {};
      coq-elpi = callPackage ../development/coq-modules/coq-elpi {};
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -1981,7 +1981,7 @@ in let inherit (pkgs) callPackage; in rec

  ocamlPackages_latest = ocamlPackages_5_1;

-  ocamlPackages = ocamlPackages_4_14;
+  ocamlPackages = ocamlPackages_5_1;

  # This is a nasty way to replace toplevel janestreet attributes in the scope,
  # so that modules outside of ocamlPackages that depend on JS OCaml libraries
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -1333,7 +1333,7 @@ self: super: with self; {
  bangla = callPackage ../development/python-modules/bangla { };

  bap = callPackage ../development/python-modules/bap {
-    inherit (pkgs.ocaml-ng.ocamlPackages) bap;
+    inherit (pkgs.ocaml-ng.ocamlPackages_4_14) bap;
  };

  barectf = callPackage ../development/python-modules/barectf { };