Merge master into haskell-updates

2023-10-27 00:11:47 +00:00 · 2023-10-27 00:11:47 +00:00 · 5846ae4489
commit 5846ae4489
parent 26df24d5d1 aaccf42b1b
211 changed files with 4844 additions and 6191 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -149,6 +149,8 @@
 # C compilers
 /pkgs/development/compilers/gcc @amjoseph-nixpkgs
 /pkgs/development/compilers/llvm @RaitoBezarius
+/pkgs/development/compilers/emscripten @raitobezarius
+/doc/languages-frameworks/emscripten.section.md @raitobezarius

 # Audio
 /nixos/modules/services/audio/botamusique.nix @mweinelt
--- a/doc/languages-frameworks/emscripten.section.md
+++ b/doc/languages-frameworks/emscripten.section.md
@ -2,168 +2,159 @@

 [Emscripten](https://github.com/kripken/emscripten): An LLVM-to-JavaScript Compiler

-This section of the manual covers how to use `emscripten` in nixpkgs.
+If you want to work with `emcc`, `emconfigure` and `emmake` as you are used to from Ubuntu and similar distributions,

-Minimal requirements:
-
-* nix
-* nixpkgs
-
-Modes of use of `emscripten`:
-
-* **Imperative usage** (on the command line):
-
-   If you want to work with `emcc`, `emconfigure` and `emmake` as you are used to from Ubuntu and similar distributions you can use these commands:
-
-    * `nix-env -f "<nixpkgs>" -iA emscripten`
-    * `nix-shell -p emscripten`
-
-* **Declarative usage**:
-
-    This mode is far more power full since this makes use of `nix` for dependency management of emscripten libraries and targets by using the `mkDerivation` which is implemented by `pkgs.emscriptenStdenv` and `pkgs.buildEmscriptenPackage`. The source for the packages is in `pkgs/top-level/emscripten-packages.nix` and the abstraction behind it in `pkgs/development/em-modules/generic/default.nix`. From the root of the nixpkgs repository:
-    * build and install all packages:
-        * `nix-env -iA emscriptenPackages`
-
-    * dev-shell for zlib implementation hacking:
-        * `nix-shell -A emscriptenPackages.zlib`
-
-## Imperative usage {#imperative-usage}
+```console
+nix-shell -p emscripten
+```

 A few things to note:

 * `export EMCC_DEBUG=2` is nice for debugging
-* `~/.emscripten`, the build artifact cache sometimes creates issues and needs to be removed from time to time
+* The build artifact cache in `~/.emscripten` sometimes creates issues and needs to be removed from time to time

-## Declarative usage {#declarative-usage}
+## Examples {#declarative-usage}

 Let's see two different examples from `pkgs/top-level/emscripten-packages.nix`:

 * `pkgs.zlib.override`
 * `pkgs.buildEmscriptenPackage`

-Both are interesting concepts.
+A special requirement of the `pkgs.buildEmscriptenPackage` is the `doCheck = true`.
+This means each Emscripten package requires that a [`checkPhase`](#ssec-check-phase) is implemented.

-A special requirement of the `pkgs.buildEmscriptenPackage` is the `doCheck = true` is a default meaning that each emscriptenPackage requires a `checkPhase` implemented.
+* Use `export EMCC_DEBUG=2` from within a phase to get more detailed debug output what is going wrong.
+* The cache at `~/.emscripten` requires to set `HOME=$TMPDIR` in individual phases.
+  This makes compilation slower but also more deterministic.

-* Use `export EMCC_DEBUG=2` from within a emscriptenPackage's `phase` to get more detailed debug output what is going wrong.
-* ~/.emscripten cache is requiring us to set `HOME=$TMPDIR` in individual phases. This makes compilation slower but also makes it more deterministic.
+::: {.example #usage-1-pkgs.zlib.override}

-### Usage 1: pkgs.zlib.override {#usage-1-pkgs.zlib.override}
+# Using `pkgs.zlib.override {}`

-This example uses `zlib` from nixpkgs but instead of compiling **C** to **ELF** it compiles **C** to **JS** since we were using `pkgs.zlib.override` and changed stdenv to `pkgs.emscriptenStdenv`. A few adaptions and hacks were set in place to make it working. One advantage is that when `pkgs.zlib` is updated, it will automatically update this package as well. However, this can also be the downside...
+This example uses `zlib` from Nixpkgs, but instead of compiling **C** to **ELF** it compiles **C** to **JavaScript** since we were using `pkgs.zlib.override` and changed `stdenv` to `pkgs.emscriptenStdenv`.

-See the `zlib` example:
+A few adaptions and hacks were put in place to make it work.
+One advantage is that when `pkgs.zlib` is updated, it will automatically update this package as well.

-    zlib = (pkgs.zlib.override {
-      stdenv = pkgs.emscriptenStdenv;
-    }).overrideAttrs
-    (old: rec {
-      buildInputs = old.buildInputs ++ [ pkg-config ];
-      # we need to reset this setting!
-      env = (old.env or { }) // { NIX_CFLAGS_COMPILE = ""; };
-      configurePhase = ''
-        # FIXME: Some tests require writing at $HOME
-        HOME=$TMPDIR
-        runHook preConfigure

-        #export EMCC_DEBUG=2
-        emconfigure ./configure --prefix=$out --shared
+```nix
+(pkgs.zlib.override {
+  stdenv = pkgs.emscriptenStdenv;
+}).overrideAttrs
+(old: rec {
+  buildInputs = old.buildInputs ++ [ pkg-config ];
+  # we need to reset this setting!
+  env = (old.env or { }) // { NIX_CFLAGS_COMPILE = ""; };
+  configurePhase = ''
+    # FIXME: Some tests require writing at $HOME
+    HOME=$TMPDIR
+    runHook preConfigure

-        runHook postConfigure
-      '';
-      dontStrip = true;
-      outputs = [ "out" ];
-      buildPhase = ''
-        emmake make
-      '';
-      installPhase = ''
-        emmake make install
-      '';
-      checkPhase = ''
-        echo "================= testing zlib using node ================="
+    #export EMCC_DEBUG=2
+    emconfigure ./configure --prefix=$out --shared

-        echo "Compiling a custom test"
-        set -x
-        emcc -O2 -s EMULATE_FUNCTION_POINTER_CASTS=1 test/example.c -DZ_SOLO \
-        libz.so.${old.version} -I . -o example.js
+    runHook postConfigure
+  '';
+  dontStrip = true;
+  outputs = [ "out" ];
+  buildPhase = ''
+    emmake make
+  '';
+  installPhase = ''
+    emmake make install
+  '';
+  checkPhase = ''
+    echo "================= testing zlib using node ================="

-        echo "Using node to execute the test"
-        ${pkgs.nodejs}/bin/node ./example.js
+    echo "Compiling a custom test"
+    set -x
+    emcc -O2 -s EMULATE_FUNCTION_POINTER_CASTS=1 test/example.c -DZ_SOLO \
+    libz.so.${old.version} -I . -o example.js

-        set +x
-        if [ $? -ne 0 ]; then
-          echo "test failed for some reason"
-          exit 1;
-        else
-          echo "it seems to work! very good."
-        fi
-        echo "================= /testing zlib using node ================="
-      '';
+    echo "Using node to execute the test"
+    ${pkgs.nodejs}/bin/node ./example.js

-      postPatch = pkgs.lib.optionalString pkgs.stdenv.isDarwin ''
-        substituteInPlace configure \
-          --replace '/usr/bin/libtool' 'ar' \
-          --replace 'AR="libtool"' 'AR="ar"' \
-          --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
-      '';
-    });
+    set +x
+    if [ $? -ne 0 ]; then
+      echo "test failed for some reason"
+      exit 1;
+    else
+      echo "it seems to work! very good."
+    fi
+    echo "================= /testing zlib using node ================="
+  '';

-### Usage 2: pkgs.buildEmscriptenPackage {#usage-2-pkgs.buildemscriptenpackage}
+  postPatch = pkgs.lib.optionalString pkgs.stdenv.isDarwin ''
+    substituteInPlace configure \
+      --replace '/usr/bin/libtool' 'ar' \
+      --replace 'AR="libtool"' 'AR="ar"' \
+      --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
+  '';
+})
+```

-This `xmlmirror` example features a emscriptenPackage which is defined completely from this context and no `pkgs.zlib.override` is used.
+:::{.example #usage-2-pkgs.buildemscriptenpackage}

-    xmlmirror = pkgs.buildEmscriptenPackage rec {
-      name = "xmlmirror";
+# Using `pkgs.buildEmscriptenPackage {}`

-      buildInputs = [ pkg-config autoconf automake libtool gnumake libxml2 nodejs openjdk json_c ];
-      nativeBuildInputs = [ pkg-config zlib ];
+This `xmlmirror` example features an Emscripten package that is defined completely from this context and no `pkgs.zlib.override` is used.

-      src = pkgs.fetchgit {
-        url = "https://gitlab.com/odfplugfest/xmlmirror.git";
-        rev = "4fd7e86f7c9526b8f4c1733e5c8b45175860a8fd";
-        hash = "sha256-i+QgY+5PYVg5pwhzcDnkfXAznBg3e8sWH2jZtixuWsk=";
-      };
+```nix
+pkgs.buildEmscriptenPackage rec {
+  name = "xmlmirror";

-      configurePhase = ''
-        rm -f fastXmlLint.js*
-        # a fix for ERROR:root:For asm.js, TOTAL_MEMORY must be a multiple of 16MB, was 234217728
-        # https://gitlab.com/odfplugfest/xmlmirror/issues/8
-        sed -e "s/TOTAL_MEMORY=234217728/TOTAL_MEMORY=268435456/g" -i Makefile.emEnv
-        # https://github.com/kripken/emscripten/issues/6344
-        # https://gitlab.com/odfplugfest/xmlmirror/issues/9
-        sed -e "s/\$(JSONC_LDFLAGS) \$(ZLIB_LDFLAGS) \$(LIBXML20_LDFLAGS)/\$(JSONC_LDFLAGS) \$(LIBXML20_LDFLAGS) \$(ZLIB_LDFLAGS) /g" -i Makefile.emEnv
-        # https://gitlab.com/odfplugfest/xmlmirror/issues/11
-        sed -e "s/-o fastXmlLint.js/-s EXTRA_EXPORTED_RUNTIME_METHODS='[\"ccall\", \"cwrap\"]' -o fastXmlLint.js/g" -i Makefile.emEnv
-      '';
+  buildInputs = [ pkg-config autoconf automake libtool gnumake libxml2 nodejs openjdk json_c ];
+  nativeBuildInputs = [ pkg-config zlib ];

-      buildPhase = ''
-        HOME=$TMPDIR
-        make -f Makefile.emEnv
-      '';
+  src = pkgs.fetchgit {
+    url = "https://gitlab.com/odfplugfest/xmlmirror.git";
+    rev = "4fd7e86f7c9526b8f4c1733e5c8b45175860a8fd";
+    hash = "sha256-i+QgY+5PYVg5pwhzcDnkfXAznBg3e8sWH2jZtixuWsk=";
+  };

-      outputs = [ "out" "doc" ];
+  configurePhase = ''
+    rm -f fastXmlLint.js*
+    # a fix for ERROR:root:For asm.js, TOTAL_MEMORY must be a multiple of 16MB, was 234217728
+    # https://gitlab.com/odfplugfest/xmlmirror/issues/8
+    sed -e "s/TOTAL_MEMORY=234217728/TOTAL_MEMORY=268435456/g" -i Makefile.emEnv
+    # https://github.com/kripken/emscripten/issues/6344
+    # https://gitlab.com/odfplugfest/xmlmirror/issues/9
+    sed -e "s/\$(JSONC_LDFLAGS) \$(ZLIB_LDFLAGS) \$(LIBXML20_LDFLAGS)/\$(JSONC_LDFLAGS) \$(LIBXML20_LDFLAGS) \$(ZLIB_LDFLAGS) /g" -i Makefile.emEnv
+    # https://gitlab.com/odfplugfest/xmlmirror/issues/11
+    sed -e "s/-o fastXmlLint.js/-s EXTRA_EXPORTED_RUNTIME_METHODS='[\"ccall\", \"cwrap\"]' -o fastXmlLint.js/g" -i Makefile.emEnv
+  '';

-      installPhase = ''
-        mkdir -p $out/share
-        mkdir -p $doc/share/${name}
+  buildPhase = ''
+    HOME=$TMPDIR
+    make -f Makefile.emEnv
+  '';

-        cp Demo* $out/share
-        cp -R codemirror-5.12 $out/share
-        cp fastXmlLint.js* $out/share
-        cp *.xsd $out/share
-        cp *.js $out/share
-        cp *.xhtml $out/share
-        cp *.html $out/share
-        cp *.json $out/share
-        cp *.rng $out/share
-        cp README.md $doc/share/${name}
-      '';
-      checkPhase = ''
+  outputs = [ "out" "doc" ];

-      '';
-    };
+  installPhase = ''
+    mkdir -p $out/share
+    mkdir -p $doc/share/${name}

-### Declarative debugging {#declarative-debugging}
+    cp Demo* $out/share
+    cp -R codemirror-5.12 $out/share
+    cp fastXmlLint.js* $out/share
+    cp *.xsd $out/share
+    cp *.js $out/share
+    cp *.xhtml $out/share
+    cp *.html $out/share
+    cp *.json $out/share
+    cp *.rng $out/share
+    cp README.md $doc/share/${name}
+  '';
+  checkPhase = ''
+
+  '';
+}
+```
+
+:::
+
+## Debugging {#declarative-debugging}

 Use `nix-shell -I nixpkgs=/some/dir/nixpkgs -A emscriptenPackages.libz` and from there you can go trough the individual steps. This makes it easy to build a good `unit test` or list the files of the project.

@ -174,9 +165,3 @@ Use `nix-shell -I nixpkgs=/some/dir/nixpkgs -A emscriptenPackages.libz` and from
 5. `configurePhase`
 6. `buildPhase`
 7. ... happy hacking...
-
-## Summary {#summary}
-
-Using this toolchain makes it easy to leverage `nix` from NixOS, MacOSX or even Windows (WSL+ubuntu+nix). This toolchain is reproducible, behaves like the rest of the packages from nixpkgs and contains a set of well working examples to learn and adapt from.
-
-If in trouble, ask the maintainers.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1386,6 +1386,12 @@
    githubId = 59743220;
    name = "Vinícius Müller";
  };
+  arcuru = {
+    email = "patrick@jackson.dev";
+    github = "arcuru";
+    githubId = 160646;
+    name = "Patrick Jackson";
+  };
  ardumont = {
    email = "eniotna.t@gmail.com";
    github = "ardumont";
@ -12085,6 +12091,16 @@
    githubId = 839693;
    name = "Ingolf Wanger";
  };
+  msanft = {
+    email = "moritz.sanft@outlook.de";
+    matrix = "@msanft:matrix.org";
+    name = "Moritz Sanft";
+    github = "msanft";
+    githubId = 58110325;
+    keys = [{
+      fingerprint = "3CAC 1D21 3D97 88FF 149A  E116 BB8B 30F5 A024 C31C";
+    }];
+  };
  mschristiansen = {
    email = "mikkel@rheosystems.com";
    github = "mschristiansen";
@ -13541,12 +13557,6 @@
    githubId = 6931743;
    name = "pasqui23";
  };
-  patricksjackson = {
-    email = "patrick@jackson.dev";
-    github = "patricksjackson";
-    githubId = 160646;
-    name = "Patrick Jackson";
-  };
  patryk27 = {
    email = "pwychowaniec@pm.me";
    github = "Patryk27";
@ -13629,6 +13639,7 @@
  pbsds = {
    name = "Peder Bergebakken Sundt";
    email = "pbsds@hotmail.com";
+    matrix = "@pederbs:pvv.ntnu.no";
    github = "pbsds";
    githubId = 140964;
  };
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -125,6 +125,8 @@

 - [Rosenpass](https://rosenpass.eu/), a service for post-quantum-secure VPNs with WireGuard. Available as [services.rosenpass](#opt-services.rosenpass.enable).

+- [c2FmZQ](https://github.com/c2FmZQ/c2FmZQ/), an application that can securely encrypt, store, and share files, including but not limited to pictures and videos. Available as [services.c2fmzq-server](#opt-services.c2fmzq-server.enable).
+
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}

 - `network-online.target` has been fixed to no longer time out for systems with `networking.useDHCP = true` and `networking.useNetworkd = true`.
@ -335,6 +337,8 @@

 - `services.kea.{ctrl-agent,dhcp-ddns,dhcp,dhcp6}` now use separate runtime directories instead of `/run/kea` to work around the runtime directory being cleared on service start.

+- `mkDerivation` now rejects MD5 hashes.
+
 ## Other Notable Changes {#sec-release-23.11-notable-changes}

 - The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration.
--- a/nixos/modules/config/iproute2.nix
+++ b/nixos/modules/config/iproute2.nix
@ -18,15 +18,10 @@ in
  };

  config = mkIf cfg.enable {
-    environment.etc."iproute2/bpf_pinning" = { mode = "0644"; text = fileContents "${pkgs.iproute2}/etc/iproute2/bpf_pinning"; };
-    environment.etc."iproute2/ematch_map"  = { mode = "0644"; text = fileContents "${pkgs.iproute2}/etc/iproute2/ematch_map";  };
-    environment.etc."iproute2/group"       = { mode = "0644"; text = fileContents "${pkgs.iproute2}/etc/iproute2/group";       };
-    environment.etc."iproute2/nl_protos"   = { mode = "0644"; text = fileContents "${pkgs.iproute2}/etc/iproute2/nl_protos";   };
-    environment.etc."iproute2/rt_dsfield"  = { mode = "0644"; text = fileContents "${pkgs.iproute2}/etc/iproute2/rt_dsfield";  };
-    environment.etc."iproute2/rt_protos"   = { mode = "0644"; text = fileContents "${pkgs.iproute2}/etc/iproute2/rt_protos";   };
-    environment.etc."iproute2/rt_realms"   = { mode = "0644"; text = fileContents "${pkgs.iproute2}/etc/iproute2/rt_realms";   };
-    environment.etc."iproute2/rt_scopes"   = { mode = "0644"; text = fileContents "${pkgs.iproute2}/etc/iproute2/rt_scopes";   };
-    environment.etc."iproute2/rt_tables"   = { mode = "0644"; text = (fileContents "${pkgs.iproute2}/etc/iproute2/rt_tables")
-                                                                   + (optionalString (cfg.rttablesExtraConfig != "") "\n\n${cfg.rttablesExtraConfig}"); };
+    environment.etc."iproute2/rt_tables" = {
+      mode = "0644";
+      text = (fileContents "${pkgs.iproute2}/lib/iproute2/rt_tables")
+        + (optionalString (cfg.rttablesExtraConfig != "") "\n\n${cfg.rttablesExtraConfig}");
+    };
  };
 }
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1232,6 +1232,7 @@
  ./services/web-apps/atlassian/jira.nix
  ./services/web-apps/audiobookshelf.nix
  ./services/web-apps/bookstack.nix
+  ./services/web-apps/c2fmzq-server.nix
  ./services/web-apps/calibre-web.nix
  ./services/web-apps/coder.nix
  ./services/web-apps/changedetection-io.nix
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@ -938,13 +938,10 @@ in {
            and remove the wildcard from the path.
          '';
        }
-        {
-          assertion = lib.length (lib.filter (x: x != null) [
-            data.dnsProvider
-            data.webroot
-            data.listenHTTP
-            data.s3Bucket
-          ]) != 1;
+        (let exclusiveAttrs = {
+          inherit (data) dnsProvider webroot listenHTTP s3Bucket;
+        }; in {
+          assertion = lib.length (lib.filter (x: x != null) (builtins.attrValues exclusiveAttrs)) == 1;
          message = ''
            Exactly one of the options
            `security.acme.certs.${cert}.dnsProvider`,
@ -952,8 +949,9 @@ in {
            `security.acme.certs.${cert}.listenHTTP` and
            `security.acme.certs.${cert}.s3Bucket`
            is required.
+            Current values: ${(lib.generators.toPretty {} exclusiveAttrs)}.
          '';
-        }
+        })
        {
          assertion = all (hasSuffix "_FILE") (attrNames data.credentialFiles);
          message = ''
--- a/nixos/modules/services/audio/wyoming/faster-whisper.nix
+++ b/nixos/modules/services/audio/wyoming/faster-whisper.nix
@ -37,6 +37,9 @@ in
            enable = mkEnableOption (mdDoc "Wyoming faster-whisper server");

            model = mkOption {
+              # Intersection between available and referenced models here:
+              # https://github.com/rhasspy/models/releases/tag/v1.0
+              # https://github.com/rhasspy/rhasspy3/blob/wyoming-v1/programs/asr/faster-whisper/server/wyoming_faster_whisper/download.py#L17-L27
              type = enum [
                "tiny"
                "tiny-int8"
@ -44,7 +47,6 @@ in
                "base-int8"
                "small"
                "small-int8"
-                "medium"
                "medium-int8"
              ];
              default = "tiny-int8";
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@ -113,12 +113,15 @@ in
        };

        paths = mkOption {
+          # This is nullable for legacy reasons only. We should consider making it a pure listOf
+          # after some time has passed since this comment was added.
          type = types.nullOr (types.listOf types.str);
-          default = null;
+          default = [ ];
          description = lib.mdDoc ''
-            Which paths to backup.  If null or an empty array, no
-            backup command will be run.  This can be used to create a
-            prune-only job.
+            Which paths to backup, in addition to ones specified via
+            `dynamicFilesFrom`.  If null or an empty array and
+            `dynamicFilesFrom` is also null, no backup command will be run.
+             This can be used to create a prune-only job.
          '';
          example = [
            "/var/lib/postgresql"
@ -231,7 +234,7 @@ in
          description = lib.mdDoc ''
            A script that produces a list of files to back up.  The
            results of this command are given to the '--files-from'
-            option.
+            option. The result is merged with paths specified via `paths`.
          '';
          example = "find /home/matt/git -type d -name .git";
        };
@ -310,10 +313,7 @@ in
            resticCmd = "${backup.package}/bin/restic${extraOptions}";
            excludeFlags = optional (backup.exclude != []) "--exclude-file=${pkgs.writeText "exclude-patterns" (concatStringsSep "\n" backup.exclude)}";
            filesFromTmpFile = "/run/restic-backups-${name}/includes";
-            backupPaths =
-              if (backup.dynamicFilesFrom == null)
-              then optionalString (backup.paths != null) (concatStringsSep " " backup.paths)
-              else "--files-from ${filesFromTmpFile}";
+            doBackup = (backup.dynamicFilesFrom != null) || (backup.paths != null && backup.paths != []);
            pruneCmd = optionals (builtins.length backup.pruneOpts > 0) [
              (resticCmd + " forget --prune " + (concatStringsSep " " backup.pruneOpts))
              (resticCmd + " check " + (concatStringsSep " " backup.checkOpts))
@ -348,7 +348,7 @@ in
            after = [ "network-online.target" ];
            serviceConfig = {
              Type = "oneshot";
-              ExecStart = (optionals (backupPaths != "") [ "${resticCmd} backup ${concatStringsSep " " (backup.extraBackupArgs ++ excludeFlags)} ${backupPaths}" ])
+              ExecStart = (optionals doBackup [ "${resticCmd} backup ${concatStringsSep " " (backup.extraBackupArgs ++ excludeFlags)} --files-from=${filesFromTmpFile}" ])
                ++ pruneCmd;
              User = backup.user;
              RuntimeDirectory = "restic-backups-${name}";
@ -366,8 +366,11 @@ in
              ${optionalString (backup.initialize) ''
                ${resticCmd} snapshots || ${resticCmd} init
              ''}
+              ${optionalString (backup.paths != null && backup.paths != []) ''
+                cat ${pkgs.writeText "staticPaths" (concatStringsSep "\n" backup.paths)} >> ${filesFromTmpFile}
+              ''}
              ${optionalString (backup.dynamicFilesFrom != null) ''
-                ${pkgs.writeScript "dynamicFilesFromScript" backup.dynamicFilesFrom} > ${filesFromTmpFile}
+                ${pkgs.writeScript "dynamicFilesFromScript" backup.dynamicFilesFrom} >> ${filesFromTmpFile}
              ''}
            '';
          } // optionalAttrs (backup.dynamicFilesFrom != null || backup.backupCleanupCommand != null) {
--- a/nixos/modules/services/networking/mullvad-vpn.nix
+++ b/nixos/modules/services/networking/mullvad-vpn.nix
@ -76,5 +76,5 @@ with lib;
    };
  };

-  meta.maintainers = with maintainers; [ patricksjackson ymarkus ];
+  meta.maintainers = with maintainers; [ arcuru ymarkus ];
 }
--- a/nixos/modules/services/web-apps/c2fmzq-server.md
+++ b/nixos/modules/services/web-apps/c2fmzq-server.md
@ -0,0 +1,42 @@
+# c2FmZQ {#module-services-c2fmzq}
+
+c2FmZQ is an application that can securely encrypt, store, and share files,
+including but not limited to pictures and videos.
+
+The service `c2fmzq-server` can be enabled by setting
+```
+{
+  services.c2fmzq-server.enable = true;
+}
+```
+This will spin up an instance of the server which is API-compatible with
+[Stingle Photos](https://stingle.org) and an experimental Progressive Web App
+(PWA) to interact with the storage via the browser.
+
+In principle the server can be exposed directly on a public interface and there
+are command line options to manage HTTPS certificates directly, but the module
+is designed to be served behind a reverse proxy or only accessed via localhost.
+
+```
+{
+  services.c2fmzq-server = {
+    enable = true;
+    bindIP = "127.0.0.1"; # default
+    port = 8080; # default
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    virtualHosts."example.com" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8080";
+      };
+    };
+  };
+}
+```
+
+For more information, see <https://github.com/c2FmZQ/c2FmZQ/>.
--- a/nixos/modules/services/web-apps/c2fmzq-server.nix
+++ b/nixos/modules/services/web-apps/c2fmzq-server.nix
@ -0,0 +1,125 @@
+{ lib, pkgs, config, ... }:
+
+let
+  inherit (lib) mkEnableOption mkPackageOption mkOption types;
+
+  cfg = config.services.c2fmzq-server;
+
+  argsFormat = {
+    type = with lib.types; nullOr (oneOf [ bool int str ]);
+    generate = lib.cli.toGNUCommandLineShell { };
+  };
+in {
+  options.services.c2fmzq-server = {
+    enable = mkEnableOption "c2fmzq-server";
+
+    bindIP = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      description = "The local address to use.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8080;
+      description = "The local port to use.";
+    };
+
+    passphraseFile = mkOption {
+      type = types.str;
+      example = "/run/secrets/c2fmzq/pwfile";
+      description = "Path to file containing the database passphrase";
+    };
+
+    package = mkPackageOption pkgs "c2fmzq" { };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = argsFormat.type;
+
+        options = {
+          address = mkOption {
+            internal = true;
+            type = types.str;
+            default = "${cfg.bindIP}:${toString cfg.port}";
+          };
+
+          database = mkOption {
+            type = types.str;
+            default = "%S/c2fmzq-server/data";
+            description = "Path of the database";
+          };
+
+          verbose = mkOption {
+            type = types.ints.between 1 3;
+            default = 2;
+            description = "The level of logging verbosity: 1:Error 2:Info 3:Debug";
+          };
+        };
+      };
+      description = ''
+        Configuration for c2FmZQ-server passed as CLI arguments.
+        Run {command}`c2FmZQ-server help` for supported values.
+      '';
+      example = {
+        verbose = 3;
+        allow-new-accounts = true;
+        auto-approve-new-accounts = true;
+        encrypt-metadata = true;
+        enable-webapp = true;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.c2fmzq-server = {
+      description = "c2FmZQ-server";
+      documentation = [ "https://github.com/c2FmZQ/c2FmZQ/blob/main/README.md" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" "network-online.target" ];
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} ${argsFormat.generate cfg.settings}";
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        DynamicUser = true;
+        Environment = "C2FMZQ_PASSPHRASE_FILE=%d/passphrase-file";
+        IPAccounting = true;
+        IPAddressAllow = cfg.bindIP;
+        IPAddressDeny = "any";
+        LoadCredential = "passphrase-file:${cfg.passphraseFile}";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateIPC = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SocketBindAllow = cfg.port;
+        SocketBindDeny = "any";
+        StateDirectory = "c2fmzq-server";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged @obsolete" ];
+      };
+    };
+  };
+
+  meta = {
+    doc = ./c2fmzq-server.md;
+    maintainers = with lib.maintainers; [ hmenke ];
+  };
+}
--- a/nixos/modules/services/web-apps/snipe-it.nix
+++ b/nixos/modules/services/web-apps/snipe-it.nix
@ -18,15 +18,19 @@ let
  inherit (snipe-it.passthru) phpPackage;

  # shell script for local administration
-  artisan = pkgs.writeScriptBin "snipe-it" ''
+  artisan = (pkgs.writeScriptBin "snipe-it" ''
    #! ${pkgs.runtimeShell}
-    cd ${snipe-it}
+    cd "${snipe-it}/share/php/snipe-it"
    sudo=exec
    if [[ "$USER" != ${user} ]]; then
      sudo='exec /run/wrappers/bin/sudo -u ${user}'
    fi
    $sudo ${phpPackage}/bin/php artisan $*
-  '';
+  '').overrideAttrs (old: {
+    meta = old.meta // {
+      mainProgram = "snipe-it";
+    };
+  });
 in {
  options.services.snipe-it = {

@ -357,7 +361,7 @@ in {
    services.nginx = {
      enable = mkDefault true;
      virtualHosts."${cfg.hostName}" = mkMerge [ cfg.nginx {
-        root = mkForce "${snipe-it}/public";
+        root = mkForce "${snipe-it}/share/php/snipe-it/public";
        extraConfig = optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;";
        locations = {
          "/" = {
@ -394,7 +398,7 @@ in {
        RuntimeDirectory = "snipe-it/cache";
        RuntimeDirectoryMode = "0700";
      };
-      path = [ pkgs.replace-secret ];
+      path = [ pkgs.replace-secret artisan ];
      script =
        let
          isSecret  = v: isAttrs v && v ? _secret && (isString v._secret || builtins.isPath v._secret);
@ -451,7 +455,7 @@ in {
          rm "${cfg.dataDir}"/bootstrap/cache/*.php || true

          # migrate db
-          ${phpPackage}/bin/php artisan migrate --force
+          ${lib.getExe artisan} migrate --force

          # A placeholder file for invalid barcodes
          invalid_barcode_location="${cfg.dataDir}/public/uploads/barcodes/invalid_barcode.gif"
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -1020,7 +1020,7 @@ let
          "MulticastToUnicast"
          "NeighborSuppression"
          "Learning"
-          "Hairpin"
+          "HairPin"
          "Isolated"
          "UseBPDU"
          "FastLeave"
@ -1036,7 +1036,7 @@ let
        (assertValueOneOf "MulticastToUnicast" boolValues)
        (assertValueOneOf "NeighborSuppression" boolValues)
        (assertValueOneOf "Learning" boolValues)
-        (assertValueOneOf "Hairpin" boolValues)
+        (assertValueOneOf "HairPin" boolValues)
        (assertValueOneOf "Isolated" boolValues)
        (assertValueOneOf "UseBPDU" boolValues)
        (assertValueOneOf "FastLeave" boolValues)
--- a/nixos/modules/system/boot/systemd/tmpfiles.nix
+++ b/nixos/modules/system/boot/systemd/tmpfiles.nix
@ -20,6 +20,102 @@ in
      '';
    };

+    systemd.tmpfiles.settings = mkOption {
+      description = lib.mdDoc ''
+        Declare systemd-tmpfiles rules to create, delete, and clean up volatile
+        and temporary files and directories.
+
+        Even though the service is called `*tmp*files` you can also create
+        persistent files.
+      '';
+      example = {
+        "10-mypackage" = {
+          "/var/lib/my-service/statefolder".d = {
+            mode = "0755";
+            user = "root";
+            group = "root";
+          };
+        };
+      };
+      default = {};
+      type = types.attrsOf (types.attrsOf (types.attrsOf (types.submodule ({ name, config, ... }: {
+        options.type = mkOption {
+          type = types.str;
+          default = name;
+          example = "d";
+          description = lib.mdDoc ''
+            The type of operation to perform on the file.
+
+            The type consists of a single letter and optionally one or more
+            modifier characters.
+
+            Please see the upstream documentation for the available types and
+            more details:
+            <https://www.freedesktop.org/software/systemd/man/tmpfiles.d>
+          '';
+        };
+        options.mode = mkOption {
+          type = types.str;
+          default = "-";
+          example = "0755";
+          description = lib.mdDoc ''
+            The file access mode to use when creating this file or directory.
+          '';
+        };
+        options.user = mkOption {
+          type = types.str;
+          default = "-";
+          example = "root";
+          description = lib.mdDoc ''
+            The user of the file.
+
+            This may either be a numeric ID or a user/group name.
+
+            If omitted or when set to `"-"`, the user and group of the user who
+            invokes systemd-tmpfiles is used.
+          '';
+        };
+        options.group = mkOption {
+          type = types.str;
+          default = "-";
+          example = "root";
+          description = lib.mdDoc ''
+            The group of the file.
+
+            This may either be a numeric ID or a user/group name.
+
+            If omitted or when set to `"-"`, the user and group of the user who
+            invokes systemd-tmpfiles is used.
+          '';
+        };
+        options.age = mkOption {
+          type = types.str;
+          default = "-";
+          example = "10d";
+          description = lib.mdDoc ''
+            Delete a file when it reaches a certain age.
+
+            If a file or directory is older than the current time minus the age
+            field, it is deleted.
+
+            If set to `"-"` no automatic clean-up is done.
+          '';
+        };
+        options.argument = mkOption {
+          type = types.str;
+          default = "";
+          example = "";
+          description = lib.mdDoc ''
+            An argument whose meaning depends on the type of operation.
+
+            Please see the upstream documentation for the meaning of this
+            parameter in different situations:
+            <https://www.freedesktop.org/software/systemd/man/tmpfiles.d>
+          '';
+        };
+      }))));
+    };
+
    systemd.tmpfiles.packages = mkOption {
      type = types.listOf types.package;
      default = [];
@ -100,7 +196,13 @@ in
          ${concatStringsSep "\n" cfg.rules}
        '';
      })
-    ];
+    ] ++ (mapAttrsToList (name: paths:
+      pkgs.writeTextDir "lib/tmpfiles.d/${name}.conf" (concatStrings (mapAttrsToList (path: types:
+        concatStrings (mapAttrsToList (_type: entry: ''
+          '${entry.type}' '${path}' '${entry.mode}' '${entry.user}' '${entry.group}' '${entry.age}' ${entry.argument}
+        '') types)
+      ) paths ))
+    ) cfg.settings);

    systemd.tmpfiles.rules = [
      "d  /nix/var                           0755 root root - -"
--- a/nixos/modules/tasks/filesystems/vfat.nix
+++ b/nixos/modules/tasks/filesystems/vfat.nix
@ -21,7 +21,7 @@ in
        ln -sv dosfsck $out/bin/fsck.vfat
      '';

-    boot.initrd.systemd.extraBin = mkIf inInitrd [ pkgs.dosfstools ];
+    boot.initrd.systemd.initrdBin = mkIf inInitrd [ pkgs.dosfstools ];

  };
 }
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@ -97,6 +97,7 @@ in rec {
        (onSystems ["x86_64-linux"] "nixos.tests.installer.simpleUefiSystemdBoot")
        (onSystems ["x86_64-linux"] "nixos.tests.installer.simple")
        (onSystems ["x86_64-linux"] "nixos.tests.installer.swraid")
+        (onSystems ["x86_64-linux"] "nixos.tests.installer.zfsroot")
        (onSystems ["x86_64-linux"] "nixos.tests.nixos-rebuild-specialisations")
        (onFullSupported "nixos.tests.ipv6")
        (onFullSupported "nixos.tests.keymap.azerty")
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -153,6 +153,7 @@ in {
  budgie = handleTest ./budgie.nix {};
  buildbot = handleTest ./buildbot.nix {};
  buildkite-agents = handleTest ./buildkite-agents.nix {};
+  c2fmzq = handleTest ./c2fmzq.nix {};
  caddy = handleTest ./caddy.nix {};
  cadvisor = handleTestOn ["x86_64-linux"] ./cadvisor.nix {};
  cage = handleTest ./cage.nix {};
--- a/nixos/tests/c2fmzq.nix
+++ b/nixos/tests/c2fmzq.nix
@ -0,0 +1,75 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "c2FmZQ";
+  meta.maintainers = with lib.maintainers; [ hmenke ];
+
+  nodes.machine = {
+    services.c2fmzq-server = {
+      enable = true;
+      port = 8080;
+      passphraseFile = builtins.toFile "pwfile" "hunter2"; # don't do this on real deployments
+      settings = {
+        verbose = 3; # debug
+      };
+    };
+    environment = {
+      sessionVariables = {
+        C2FMZQ_PASSPHRASE = "lol";
+        C2FMZQ_API_SERVER = "http://localhost:8080";
+      };
+      systemPackages = [
+        pkgs.c2fmzq
+        (pkgs.writeScriptBin "c2FmZQ-client-wrapper" ''
+          #!${pkgs.expect}/bin/expect -f
+          spawn c2FmZQ-client {*}$argv
+          expect {
+            "Enter password:" { send "$env(PASSWORD)\r" }
+            "Type YES to confirm:" { send "YES\r" }
+            timeout { exit 1 }
+            eof { exit 0 }
+          }
+          interact
+        '')
+      ];
+    };
+  };
+
+  testScript = { nodes, ... }: ''
+    machine.start()
+    machine.wait_for_unit("c2fmzq-server.service")
+    machine.wait_for_open_port(8080)
+
+    with subtest("Create accounts for alice and bob"):
+        machine.succeed("PASSWORD=foobar c2FmZQ-client-wrapper -- -v 3 create-account alice@example.com")
+        machine.succeed("PASSWORD=fizzbuzz c2FmZQ-client-wrapper -- -v 3 create-account bob@example.com")
+
+    with subtest("Log in as alice"):
+        machine.succeed("PASSWORD=foobar c2FmZQ-client-wrapper -- -v 3 login alice@example.com")
+        msg = machine.succeed("c2FmZQ-client -v 3 status")
+        assert "Logged in as alice@example.com" in msg, f"ERROR: Not logged in as alice:\n{msg}"
+
+    with subtest("Create a new album, upload a file, and delete the uploaded file"):
+        machine.succeed("c2FmZQ-client -v 3 create-album 'Rarest Memes'")
+        machine.succeed("echo 'pls do not steal' > meme.txt")
+        machine.succeed("c2FmZQ-client -v 3 import meme.txt 'Rarest Memes'")
+        machine.succeed("c2FmZQ-client -v 3 sync")
+        machine.succeed("rm meme.txt")
+
+    with subtest("Share the album with bob"):
+        machine.succeed("c2FmZQ-client-wrapper -- -v 3 share 'Rarest Memes' bob@example.com")
+
+    with subtest("Log in as bob"):
+        machine.succeed("PASSWORD=fizzbuzz c2FmZQ-client-wrapper -- -v 3 login bob@example.com")
+        msg = machine.succeed("c2FmZQ-client -v 3 status")
+        assert "Logged in as bob@example.com" in msg, f"ERROR: Not logged in as bob:\n{msg}"
+
+    with subtest("Download the shared file"):
+        machine.succeed("c2FmZQ-client -v 3 download 'shared/Rarest Memes/meme.txt'")
+        machine.succeed("c2FmZQ-client -v 3 export 'shared/Rarest Memes/meme.txt' .")
+        msg = machine.succeed("cat meme.txt")
+        assert "pls do not steal\n" == msg, f"File content is not the same:\n{msg}"
+
+    with subtest("Test that PWA is served"):
+        msg = machine.succeed("curl -sSfL http://localhost:8080")
+        assert "c2FmZQ" in msg, f"Could not find 'c2FmZQ' in the output:\n{msg}"
+  '';
+})
--- a/nixos/tests/misc.nix
+++ b/nixos/tests/misc.nix
@ -13,6 +13,7 @@ in {
      environment.variables.EDITOR = lib.mkOverride 0 "emacs";
      documentation.nixos.enable = lib.mkOverride 0 true;
      systemd.tmpfiles.rules = [ "d /tmp 1777 root root 10d" ];
+      systemd.tmpfiles.settings."10-test"."/tmp/somefile".d = {};
      virtualisation.fileSystems = { "/tmp2" =
        { fsType = "tmpfs";
          options = [ "mode=1777" "noauto" ];
@ -117,6 +118,9 @@ in {
          )
          machine.fail("[ -e /tmp/foo ]")

+      with subtest("whether systemd-tmpfiles settings works"):
+          machine.succeed("[ -e /tmp/somefile ]")
+
      with subtest("whether automounting works"):
          machine.fail("grep '/tmp2 tmpfs' /proc/mounts")
          machine.succeed("touch /tmp2/x")
--- a/nixos/tests/restic.nix
+++ b/nixos/tests/restic.nix
@ -21,7 +21,10 @@ import ./make-test-python.nix (
      unpackPhase = "true";
      installPhase = ''
        mkdir $out
-        touch $out/some_file
+        echo some_file > $out/some_file
+        echo some_other_file > $out/some_other_file
+        mkdir $out/a_dir
+        echo a_file > $out/a_dir/a_file
      '';
    };

@ -53,9 +56,13 @@ import ./make-test-python.nix (
              initialize = true;
            };
            remote-from-file-backup = {
-              inherit passwordFile paths exclude pruneOpts;
+              inherit passwordFile exclude pruneOpts;
              initialize = true;
              repositoryFile = pkgs.writeText "repositoryFile" remoteFromFileRepository;
+              paths = [ "/opt/a_dir" ];
+              dynamicFilesFrom = ''
+                find /opt -mindepth 1 -maxdepth 1 ! -name a_dir # all files in /opt except for a_dir
+              '';
            };
            rclonebackup = {
              inherit passwordFile paths exclude pruneOpts;
@ -123,13 +130,18 @@ import ./make-test-python.nix (
          "systemctl start restic-backups-remote-from-file-backup.service",
          'restic-remote-from-file-backup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',

+          # test that restoring that snapshot produces the same directory
+          "mkdir /tmp/restore-2",
+          "${pkgs.restic}/bin/restic -r ${remoteRepository} -p ${passwordFile} restore latest -t /tmp/restore-2",
+          "diff -ru ${testDir} /tmp/restore-2/opt",
+
          # test that rclonebackup produces a snapshot
          "systemctl start restic-backups-rclonebackup.service",
          'restic-rclonebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',

          # test that custompackage runs both `restic backup` and `restic check` with reasonable commandlines
          "systemctl start restic-backups-custompackage.service",
-          "grep 'backup.* /opt' /root/fake-restic.log",
+          "grep 'backup' /root/fake-restic.log",
          "grep 'check.* --some-check-option' /root/fake-restic.log",

          # test that we can create four snapshots in remotebackup and rclonebackup
--- a/pkgs/applications/audio/sonic-pi/default.nix
+++ b/pkgs/applications/audio/sonic-pi/default.nix
@ -25,6 +25,7 @@
 , boost
 , aubio
 , jack2
+, jack-example-tools
 , supercollider-with-sc3-plugins
 , parallel

@ -187,14 +188,14 @@ stdenv.mkDerivation rec {
  preFixup = ''
    # Wrap Qt GUI (distributed binary)
    wrapQtApp $out/bin/sonic-pi \
-      --prefix PATH : ${lib.makeBinPath [ ruby supercollider-with-sc3-plugins jack2 ]}
+      --prefix PATH : ${lib.makeBinPath [ ruby supercollider-with-sc3-plugins jack2 jack-example-tools ]}

    # If ImGui was built
    if [ -e $out/app/build/gui/imgui/sonic-pi-imgui ]; then
      # Wrap ImGui into bin
      makeWrapper $out/app/build/gui/imgui/sonic-pi-imgui $out/bin/sonic-pi-imgui \
        --inherit-argv0 \
-        --prefix PATH : ${lib.makeBinPath [ ruby supercollider-with-sc3-plugins jack2 ]}
+        --prefix PATH : ${lib.makeBinPath [ ruby supercollider-with-sc3-plugins jack2 jack-example-tools ]}
    fi

    # Remove runtime Erlang references
--- a/pkgs/applications/blockchains/lighthouse/Cargo.lock
+++ b/pkgs/applications/blockchains/lighthouse/Cargo.lock
--- a/pkgs/applications/blockchains/lighthouse/default.nix
+++ b/pkgs/applications/blockchains/lighthouse/default.nix
@ -23,7 +23,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "lighthouse";
-  version = "4.1.0";
+  version = "4.5.0";

  # lighthouse/common/deposit_contract/build.rs
  depositContractSpecVersion = "0.12.1";
@ -33,7 +33,7 @@ rustPlatform.buildRustPackage rec {
    owner = "sigp";
    repo = "lighthouse";
    rev = "v${version}";
-    hash = "sha256-QVAFzV9sao8+eegI7bLfm+pPHyvDFhnADS80+nqqgtE=";
+    hash = "sha256-UUOvTxOQXT1zfhDYEL/J6moHAyejZn7GyGS/XBmXxRQ=";
  };

  patches = [
@ -47,15 +47,15 @@ rustPlatform.buildRustPackage rec {
  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "amcl-0.3.0" = "sha256-Mj4dXTlGVSleFfuTKgVDQ7S3jANMsdtVE5L90WGxA4U=";
-      "arbitrary-1.3.0" = "sha256-BMxcBfxBRf+Kb0Tz55jtFbwokSeD2GPtB+KV8Wbne0g=";
-      "beacon-api-client-0.1.0" = "sha256-fI8qST6HZrchg7yr/nVtRNrsW3f5ONSX+mGRYW+iiqA=";
-      "ethereum-consensus-0.1.1" = "sha256-aBrZ786Me0BWpnncxQc5MT3r+O0yLQhqGKFBiNTdqSA=";
+      "amcl-0.3.0" = "sha256-kc8k/ls4W0TwFBsRcyyotyz8ZBEjsZXHeJnJtsnW/LM=";
+      "anvil-rpc-0.1.0" = "sha256-L38OioxnWEn94g3GJT4j3U1cJZ8jQDHp8d1QOHaVEuU=";
+      "beacon-api-client-0.1.0" = "sha256-Z0CoPxZzl2bjb8vgmHWxq2orMawhMMs7beKGopilKjE=";
+      "ethereum-consensus-0.1.1" = "sha256-biTrw3yMJUo9+56QK5RGWXLCoPPZEWp18SCs+Y9QWg4=";
      "libmdbx-0.1.4" = "sha256-NMsR/Wl1JIj+YFPyeMMkrJFfoS07iEAKEQawO89a+/Q=";
      "lmdb-rkv-0.14.0" = "sha256-sxmguwqqcyOlfXOZogVz1OLxfJPo+Q0+UjkROkbbOCk=";
-      "mev-rs-0.2.1" = "sha256-n3ns1oynw5fKQtp/CQHER41+C1EmLCVEBqggkHc3or4=";
-      "ssz-rs-0.8.0" = "sha256-k1JLu+jZrSqUyHou76gbJeA5CDWwdL0fPkek3Vzl4Gs=";
-      "warp-0.3.2" = "sha256-m9lkEgeSs0yEc+6N6DG7IfQY/evkUMoNyst2hMUR//c=";
+      "mev-rs-0.3.0" = "sha256-LCO0GTvWTLcbPt7qaSlLwlKmAjt3CIHVYTT/JRXpMEo=";
+      "testcontainers-0.14.0" = "sha256-mSsp21G7MLEtFROWy88Et5s07PO0tjezovCGIMh+/oQ=";
+      "warp-0.3.5" = "sha256-d5e6ASdL7+Dl3KsTNOb9B5RHpStrupOKsbGWsdu9Jfk=";
    };
  };

@ -103,8 +103,8 @@ rustPlatform.buildRustPackage rec {
  cargoTestFlags = [
    "--workspace"
    "--exclude beacon_node"
-    "--exclude http_api"
    "--exclude beacon_chain"
+    "--exclude http_api"
    "--exclude lighthouse"
    "--exclude lighthouse_network"
    "--exclude slashing_protection"
@ -114,10 +114,21 @@ rustPlatform.buildRustPackage rec {

  # All of these tests require network access
  checkFlags = [
+    "--skip basic"
+    "--skip deposit_tree::cache_consistency"
+    "--skip deposit_tree::double_update"
+    "--skip deposit_tree::updating"
+    "--skip eth1_cache::big_skip"
+    "--skip eth1_cache::double_update"
+    "--skip eth1_cache::pruning"
+    "--skip eth1_cache::simple_scenario"
+    "--skip fast::deposit_cache_query"
+    "--skip http::incrementing_deposits"
+    "--skip persist::test_persist_caches"
    "--skip service::tests::tests::test_dht_persistence"
    "--skip time::test::test_reinsertion_updates_timeout"
-
  ] ++ lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [
+    "--skip subnet_service::tests::attestation_service::test_subscribe_same_subnet_several_slots_apart"
    "--skip subnet_service::tests::sync_committee_service::same_subscription_with_lower_until_epoch"
    "--skip subnet_service::tests::sync_committee_service::subscribe_and_unsubscribe"
  ];
--- a/pkgs/applications/blockchains/lighthouse/use-system-sqlite.patch
+++ b/pkgs/applications/blockchains/lighthouse/use-system-sqlite.patch
@ -1,26 +1,13 @@
-diff --git a/consensus/types/Cargo.toml b/consensus/types/Cargo.toml
-index 46b88af66..c8c909234 100644
--- a/consensus/types/Cargo.toml
-+++ b/consensus/types/Cargo.toml
-@@ -37,7 +37,7 @@ cached_tree_hash = { path = "../cached_tree_hash" }
- serde_yaml = "0.8.13"
- tempfile = "3.1.0"
- derivative = "2.1.1"
-rusqlite = { version = "0.28.0", features = ["bundled"], optional = true }
-+rusqlite = { version = "0.28.0", optional = true }
- # The arbitrary dependency is enabled by default since Capella to avoid complexity introduced by
- # `AbstractExecPayload`
- arbitrary = { version = "1.0", features = ["derive"] }
-diff --git a/validator_client/slashing_protection/Cargo.toml b/validator_client/slashing_protection/Cargo.toml
-index 631e54dc4..dec95156b 100644
--- a/validator_client/slashing_protection/Cargo.toml
-+++ b/validator_client/slashing_protection/Cargo.toml
-@@ -12,7 +12,7 @@ path = "tests/main.rs"
- [dependencies]
- tempfile = "3.1.0"
- types = { path = "../../consensus/types" }
-rusqlite = { version = "0.28.0", features = ["bundled"] }
-+rusqlite = { version = "0.28.0" }
- r2d2 = "0.8.9"
- r2d2_sqlite = "0.21.0"
- serde = "1.0.116"
+diff --git a/Cargo.toml b/Cargo.toml
+index 62c0e7bd2..a089e3c5b 100644
+--- a/Cargo.toml
+++ b/Cargo.toml
+@@ -138,7 +138,7 @@ rayon = "1.7"
+ regex = "1"
+ reqwest = { version = "0.11", default-features = false, features = ["blocking", "json", "stream", "rustls-tls"] }
+ ring = "0.16"
+-rusqlite = { version = "0.28", features = ["bundled"] }
+rusqlite = { version = "0.28" }
+ serde = { version = "1", features = ["derive"] }
+ serde_json = "1"
+ serde_repr = "0.1"
--- a/pkgs/applications/editors/helix/default.nix
+++ b/pkgs/applications/editors/helix/default.nix
@ -2,24 +2,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "helix";
-  version = "23.05";
+  version = "23.10";

  # This release tarball includes source code for the tree-sitter grammars,
  # which is not ordinarily part of the repository.
  src = fetchzip {
    url = "https://github.com/helix-editor/helix/releases/download/${version}/helix-${version}-source.tar.xz";
-    hash = "sha256-3ZEToXwW569P7IFLqz6Un8rClnWrW5RiYKmRVFt7My8=";
+    hash = "sha256-PH4n+zm5ShwOrzzQm0Sn8b8JzAW/CF8UzzKZYE3e2WA=";
    stripRoot = false;
  };

-  cargoHash = "sha256-/LCtfyDAA2JuioBD/CDMv6OOxM0B9A3PpuVP/YY5oF0=";
-
-  patches = [
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/helix-editor/helix/pull/7227.patch";
-      hash = "sha256-dObMKHNJfc5TODUjZ28TVxuTen02rl8HzcXpFWnhB1k=";
-    })
-  ];
+  cargoHash = "sha256-B8RO6BADDbPchowSfNVgviGvVgH23iF42DdhEBKBQzs=";

  nativeBuildInputs = [ git installShellFiles makeWrapper ];

--- a/pkgs/applications/editors/setzer/default.nix
+++ b/pkgs/applications/editors/setzer/default.nix
@ -20,13 +20,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "setzer";
-  version = "60";
+  version = "61";

  src = fetchFromGitHub {
    owner = "cvfosammmm";
    repo = "Setzer";
    rev = "v${version}";
-    hash = "sha256-SfMqGQKJtPTMSv4B70jOvTAIzNQc0AC16mum4fuNch4=";
+    hash = "sha256-7qkQelB0Y+DBihhaYVVQjK66pk8p2Sjhno87bW554SY=";
  };

  format = "other";
--- a/pkgs/applications/editors/textadept/default.nix
+++ b/pkgs/applications/editors/textadept/default.nix
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
    description = "An extensible text editor based on Scintilla with Lua scripting.";
    homepage = "http://foicica.com/textadept";
    license = licenses.mit;
-    maintainers = with maintainers; [ raskin mirrexagon patricksjackson ];
+    maintainers = with maintainers; [ raskin mirrexagon arcuru ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -532,8 +532,8 @@ let
        mktplcRef = {
          name = "emojisense";
          publisher = "bierner";
-          version = "0.9.1";
-          sha256 = "sha256-bfhImi2qMHWkgKqkoStS0NtbXTfj6GpcLkI0PSMjuvg=";
+          version = "0.10.0";
+          sha256 = "sha256-PD8edYuJu6QHPYIM08kV85LuKh0H0/MIgFmMxSJFK5M=";
        };
        meta = {
          license = lib.licenses.mit;
@ -3298,8 +3298,8 @@ let
        mktplcRef = {
          name = "svelte-vscode";
          publisher = "svelte";
-          version = "107.4.3";
-          sha256 = "sha256-z1foIJXVKmJ0G4FfO9xsjiQgmq/ZtoB3b6Ch8Nyj1zY=";
+          version = "107.12.0";
+          sha256 = "036ri011fd0cf91iwv59j57m05mxliy27ms4di2y9jlk7jzmr4s2";
        };
        meta = {
          changelog = "https://github.com/sveltejs/language-tools/releases";
@ -3478,6 +3478,22 @@ let
        };
      };

+      tsandall.opa = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "opa";
+          publisher = "tsandall";
+          version = "0.12.2";
+          sha256 = "sha256-/eJzDhnQyvC9OBr4M03wLIWPiBeVtvX7ztSnO+YoCZM=";
+        };
+        meta = {
+          changelog = "https://github.com/open-policy-agent/vscode-opa/blob/master/CHANGELOG.md";
+          description = "An extension for VS Code which provides support for OPA";
+          homepage = "https://github.com/open-policy-agent/vscode-opa";
+          license = lib.licenses.asl20;
+          maintainers = [ lib.maintainers.msanft ];
+        };
+      };
+
      tuttieee.emacs-mcx = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "emacs-mcx";
@ -3521,8 +3537,8 @@ let
        mktplcRef = {
          name = "uiua-vscode";
          publisher = "uiua-lang";
-          version = "0.0.19";
-          sha256 = "sha256-Tww1urq6CfLma254Sn5lwOYwbvxAeDZuBuFBQlzks1c=";
+          version = "0.0.21";
+          sha256 = "sha256-u57U/MmxvionFZp/tLK/KpddaxA/SUffeggKBSzmsXo=";
        };
        meta = {
          description = "VSCode language extension for Uiua";
--- a/pkgs/applications/emulators/retroarch/cores.nix
+++ b/pkgs/applications/emulators/retroarch/cores.nix
@ -568,6 +568,7 @@ in

  mame2015 = mkLibretroCore {
    core = "mame2015";
+    patches = [ ./patches/mame2015-python311.patch ];
    makeFlags = [ "PYTHON=python3" ];
    extraNativeBuildInputs = [ python3 ];
    extraBuildInputs = [ alsa-lib ];
@ -581,6 +582,7 @@ in

  mame2016 = mkLibretroCore {
    core = "mame2016";
+    patches = [ ./patches/mame2016-python311.patch ];
    extraNativeBuildInputs = [ python3 ];
    extraBuildInputs = [ alsa-lib ];
    makeFlags = [ "PYTHON_EXECUTABLE=python3" ];
--- a/pkgs/applications/emulators/retroarch/patches/mame2015-python311.patch
+++ b/pkgs/applications/emulators/retroarch/patches/mame2015-python311.patch
@ -0,0 +1,61 @@
+diff --git a/src/emu/cpu/m6502/m6502make.py b/src/emu/cpu/m6502/m6502make.py
+index da29fc722a..3de641dd69 100755
+--- a/src/emu/cpu/m6502/m6502make.py
+++ b/src/emu/cpu/m6502/m6502make.py
+@@ -16,7 +16,7 @@ def load_opcodes(fname):
+     opcodes = []
+     logging.info("load_opcodes: %s", fname)
+     try:
+-        f = open(fname, "rU")
+        f = open(fname, "r")
+     except Exception:
+         err = sys.exc_info()[1]
+         logging.error("cannot read opcodes file %s [%s]", fname, err)
+@@ -39,7 +39,7 @@ def load_disp(fname):
+     logging.info("load_disp: %s", fname)
+     states = []
+     try:
+-        f = open(fname, "rU")
+        f = open(fname, "r")
+     except Exception:
+         err = sys.exc_info()[1]
+         logging.error("cannot read display file %s [%s]", fname, err)
+diff --git a/src/emu/cpu/m6809/m6809make.py b/src/emu/cpu/m6809/m6809make.py
+index c3d5b0f66e..79f6f90cdd 100644
+--- a/src/emu/cpu/m6809/m6809make.py
+++ b/src/emu/cpu/m6809/m6809make.py
+@@ -14,7 +14,7 @@ def load_file(fname, lines):
+ 	if path != "":
+ 		path += '/'
+ 	try:
+-		f = open(fname, "rU")
+		f = open(fname, "r")
+ 	except Exception:
+ 		err = sys.exc_info()[1]
+ 		sys.stderr.write("Cannot read opcodes file %s [%s]\n" % (fname, err))
+diff --git a/src/emu/cpu/mcs96/mcs96make.py b/src/emu/cpu/mcs96/mcs96make.py
+index ec5ec37a78..7ab806a653 100644
+--- a/src/emu/cpu/mcs96/mcs96make.py
+++ b/src/emu/cpu/mcs96/mcs96make.py
+@@ -71,7 +71,7 @@ def __init__(self, fname, is_196):
+         self.ea = {}
+         self.macros = {}
+         try:
+-            f = open(fname, "rU")
+            f = open(fname, "r")
+         except Exception:
+             err = sys.exc_info()[1]
+             sys.stderr.write("Cannot read opcodes file %s [%s]\n" % (fname, err))
+diff --git a/src/emu/cpu/tms57002/tmsmake.py b/src/emu/cpu/tms57002/tmsmake.py
+index 62092097d9..78f9fe43cd 100755
+--- a/src/emu/cpu/tms57002/tmsmake.py
+++ b/src/emu/cpu/tms57002/tmsmake.py
+@@ -326,7 +326,7 @@ def ins_cmp_dasm(a, b):
+ def LoadLst(filename):
+     instructions = []
+     ins = None
+-    for n, line in enumerate(open(filename, "rU")):
+    for n, line in enumerate(open(filename, "r")):
+         line = line.rstrip()
+         if not line and ins:
+             # new lines separate intructions
--- a/pkgs/applications/emulators/retroarch/patches/mame2016-python311.patch
+++ b/pkgs/applications/emulators/retroarch/patches/mame2016-python311.patch
@ -0,0 +1,74 @@
+diff --git a/scripts/build/verinfo.py b/scripts/build/verinfo.py
+index a73d8ad268..82a80c0984 100644
+--- a/scripts/build/verinfo.py
+++ b/scripts/build/verinfo.py
+@@ -63,7 +63,7 @@ def extract_version(input):
+ build, outfmt, srcfile, dstfile = parse_args()
+ 
+ try:
+-    fp = open(srcfile, 'rU')
+    fp = open(srcfile, 'r')
+ except IOError:
+     sys.stderr.write("Unable to open source file '%s'\n" % srcfile)
+     sys.exit(1)
+diff --git a/src/devices/cpu/m6502/m6502make.py b/src/devices/cpu/m6502/m6502make.py
+index 8bcd85f8e2..557b175966 100755
+--- a/src/devices/cpu/m6502/m6502make.py
+++ b/src/devices/cpu/m6502/m6502make.py
+@@ -18,7 +18,7 @@ def load_opcodes(fname):
+     opcodes = []
+     logging.info("load_opcodes: %s", fname)
+     try:
+-        f = open(fname, "rU")
+        f = open(fname, "r")
+     except Exception:
+         err = sys.exc_info()[1]
+         logging.error("cannot read opcodes file %s [%s]", fname, err)
+@@ -41,7 +41,7 @@ def load_disp(fname):
+     logging.info("load_disp: %s", fname)
+     states = []
+     try:
+-        f = open(fname, "rU")
+        f = open(fname, "r")
+     except Exception:
+         err = sys.exc_info()[1]
+         logging.error("cannot read display file %s [%s]", fname, err)
+diff --git a/src/devices/cpu/m6809/m6809make.py b/src/devices/cpu/m6809/m6809make.py
+index 8838b96019..e1ea25db06 100644
+--- a/src/devices/cpu/m6809/m6809make.py
+++ b/src/devices/cpu/m6809/m6809make.py
+@@ -16,7 +16,7 @@ def load_file(fname, lines):
+ 	if path != "":
+ 		path += '/'
+ 	try:
+-		f = open(fname, "rU")
+		f = open(fname, "r")
+ 	except Exception:
+ 		err = sys.exc_info()[1]
+ 		sys.stderr.write("Cannot read opcodes file %s [%s]\n" % (fname, err))
+diff --git a/src/devices/cpu/mcs96/mcs96make.py b/src/devices/cpu/mcs96/mcs96make.py
+index b4844942e3..207208d2b6 100644
+--- a/src/devices/cpu/mcs96/mcs96make.py
+++ b/src/devices/cpu/mcs96/mcs96make.py
+@@ -73,7 +73,7 @@ def __init__(self, fname, is_196):
+         self.ea = {}
+         self.macros = {}
+         try:
+-            f = open(fname, "rU")
+            f = open(fname, "r")
+         except Exception:
+             err = sys.exc_info()[1]
+             sys.stderr.write("Cannot read opcodes file %s [%s]\n" % (fname, err))
+diff --git a/src/devices/cpu/tms57002/tmsmake.py b/src/devices/cpu/tms57002/tmsmake.py
+index e2e12b5a4b..942ec09537 100755
+--- a/src/devices/cpu/tms57002/tmsmake.py
+++ b/src/devices/cpu/tms57002/tmsmake.py
+@@ -323,7 +323,7 @@ def AddInfo(self, line):
+ def LoadLst(filename):
+     instructions = []
+     ins = None
+-    for n, line in enumerate(open(filename, "rU")):
+    for n, line in enumerate(open(filename, "r")):
+         line = line.rstrip()
+         if not line and ins:
+             # new lines separate intructions
--- a/pkgs/applications/gis/grass/default.nix
+++ b/pkgs/applications/gis/grass/default.nix
@ -34,13 +34,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "grass";
-  version = "8.3.0";
+  version = "8.3.1";

  src = fetchFromGitHub {
    owner = "OSGeo";
    repo = "grass";
    rev = finalAttrs.version;
-    hash = "sha256-YHQtvp/AYMWme46yIc4lE/izjqVePnPxn3GY5RRfPq4=";
+    hash = "sha256-SoJq4SuDYImfkM2e991s47vYusrmnrQaXn7p3xwyOOQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/pineapple-pictures/default.nix
+++ b/pkgs/applications/graphics/pineapple-pictures/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pineapple-pictures";
-  version = "0.7.2";
+  version = "0.7.3";

  src = fetchFromGitHub {
    owner = "BLumia";
    repo = "pineapple-pictures";
    rev = finalAttrs.version;
-    hash = "sha256-dD0pHqw1Gxp+yxzYdm2ZgxiHKyuJKBGYpjv99B1Da1g=";
+    hash = "sha256-UZVpyrUFf/uJNs2GHLYXpb81e7yzC8EFuoD+0Bzj6xQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@ -9,7 +9,7 @@
 let

  pname = "1password";
-  version = if channel == "stable" then "8.10.18" else "8.10.18-19.BETA";
+  version = if channel == "stable" then "8.10.18" else "8.10.20-1.BETA";

  sources = {
    stable = {
@ -33,19 +33,19 @@ let
    beta = {
      x86_64-linux = {
        url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-siQ6w1byDkfNrbkvjLWmQRbJ5nVZZv24vg0RFWaRHmE=";
+        hash = "sha256-+wHxtlE0zeVEObzdpcIP75LKbbjsG8LMqdIPFkY0BoU=";
      };
      aarch64-linux = {
        url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-WX6NzBXBSBf/hIl1kTIuUvCnEZ1+B0NBHfKvMeIZOw4=";
+        hash = "sha256-BRsp/hhBwgQFU+5Tt1M9V5Lx8oRLN3uaqLrzrPo/xpo=";
      };
      x86_64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-HQRw1OGIT/cVjDk4PGa8x4QdYHQxtqMePsUh+cpyysM=";
+        hash = "sha256-WVP5a007cU1GR/lnL7C6QiJpTTsjzaiS69H2LJzYm70=";
      };
      aarch64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-1KcTgmxDhbvB6gzTqF3bhu5toCSjskGjCflrBSNYzk4=";
+        hash = "sha256-BBSUSSnot1ktC0ik7yMhqsgLdkeQBrJUpHBvwu0w9m0=";
      };
    };
  };
--- a/pkgs/applications/misc/diff-pdf/default.nix
+++ b/pkgs/applications/misc/diff-pdf/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "diff-pdf";
-  version = "0.5";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "vslavik";
    repo = "diff-pdf";
    rev = "v${version}";
-    sha256 = "sha256-Si8v5ZY1Q/AwQTaxa1bYG8bgqxWj++c4Hh1LzXSmSwE=";
+    sha256 = "sha256-jt11wssl8cH2cH3NXF+iWHxVNxPJm0I8toignBHq3q0=";
  };

  nativeBuildInputs = [ autoconf automake pkg-config ];
--- a/pkgs/applications/misc/kickoff/default.nix
+++ b/pkgs/applications/misc/kickoff/default.nix
@ -10,23 +10,23 @@

 rustPlatform.buildRustPackage rec {
  pname = "kickoff";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "j0ru";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-AolJXFolMEwoK3AtC93naphZetytzRl1yI10SP9Rnzo=";
+    hash = "sha256-9QupKpB3T/6gdGSeLjRknjPdgOzbfzEeJreIamWwpSw=";
  };

-  cargoHash = "sha256-Twg2C29OwXfCK/rYXnyjbhmCClnsFHz8le9h4AmzXfA=";
+  cargoHash = "sha256-a7FZpMtgTdqpLV/OfgN4W4GpTJlkfEtPO7F//FmVA/s=";

  libPath = lib.makeLibraryPath [
    wayland
    libxkbcommon
  ];

-  buildInputs = [ fontconfig ];
+  buildInputs = [ fontconfig libxkbcommon ];
  nativeBuildInputs = [ makeWrapper pkg-config ];

  postInstall = ''
--- a/pkgs/applications/misc/pot/Cargo.lock
+++ b/pkgs/applications/misc/pot/Cargo.lock
@ -4176,21 +4176,6 @@ dependencies = [
 "windows 0.37.0",
 ]

-[[package]]
-name = "ring"
-version = "0.16.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
-dependencies = [
- "cc",
- "libc",
- "once_cell",
- "spin 0.5.2",
- "untrusted",
- "web-sys",
- "winapi",
-]
-
 [[package]]
 name = "rsa"
 version = "0.9.2"
@ -4255,36 +4240,6 @@ dependencies = [
 "windows-sys 0.48.0",
 ]

-[[package]]
-name = "rustls"
-version = "0.21.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd8d6c9f025a446bc4d18ad9632e69aec8f287aa84499ee335599fabd20c3fd8"
-dependencies = [
- "ring",
- "rustls-webpki",
- "sct",
-]
-
-[[package]]
-name = "rustls-pemfile"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d3987094b1d07b653b7dfdc3f70ce9a1da9c51ac18c1b06b662e4f9a0e9f4b2"
-dependencies = [
- "base64 0.21.4",
-]
-
-[[package]]
-name = "rustls-webpki"
-version = "0.101.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c7d5dece342910d9ba34d259310cae3e0154b873b35408b787b59bce53d34fe"
-dependencies = [
- "ring",
- "untrusted",
-]
-
 [[package]]
 name = "rustversion"
 version = "1.0.14"
@ -4351,16 +4306,6 @@ dependencies = [
 "xcb",
 ]

-[[package]]
-name = "sct"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
-dependencies = [
- "ring",
- "untrusted",
-]
-
 [[package]]
 name = "security-framework"
 version = "2.9.2"
@ -4785,8 +4730,6 @@ dependencies = [
 "once_cell",
 "paste",
 "percent-encoding",
- "rustls",
- "rustls-pemfile",
 "serde",
 "serde_json",
 "sha2",
@ -4798,7 +4741,6 @@ dependencies = [
 "tokio-stream",
 "tracing",
 "url",
- "webpki-roots",
 ]

 [[package]]
@ -5377,7 +5319,7 @@ dependencies = [
 [[package]]
 name = "tauri-plugin-sql"
 version = "0.0.0"
-source = "git+https://github.com/tauri-apps/plugins-workspace?branch=v1#9b20f28d747f6ec3ba5a80bfcd5edc1d573b4c90"
+source = "git+https://github.com/tauri-apps/plugins-workspace?branch=v1#77b81af36cc6c03b07c59a2988b0f6d20960f1b0"
 dependencies = [
 "futures-core",
 "log",
@ -5905,12 +5847,6 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"

-[[package]]
-name = "untrusted"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
-
 [[package]]
 name = "url"
 version = "2.4.1"
@ -6232,15 +6168,6 @@ dependencies = [
 "system-deps 6.1.2",
 ]

-[[package]]
-name = "webpki-roots"
-version = "0.24.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b291546d5d9d1eab74f069c77749f2cb8504a12caa20f0f2de93ddbf6f411888"
-dependencies = [
- "rustls-webpki",
-]
-
 [[package]]
 name = "webview2-com"
 version = "0.19.1"
--- a/pkgs/applications/misc/pot/default.nix
+++ b/pkgs/applications/misc/pot/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "pot";
-  version = "2.6.3";
+  version = "2.6.6";

  src = fetchFromGitHub {
    owner = "pot-app";
    repo = "pot-desktop";
    rev = version;
-    hash = "sha256-ag54ns4lqIGjjHj6n8mDJTalQfBjqLxqSudjyeRRSs4=";
+    hash = "sha256-ZpN+SgBq2vA2p4MjrT07j22VB67FdiXIIl9puGiGJA4=";
  };

  sourceRoot = "${src.name}/src-tauri";
@ -74,6 +74,7 @@ stdenv.mkDerivation rec {
    outputHashes = {
      # All other crates in the same workspace reuse this hash.
      "tauri-plugin-autostart-0.0.0" = "sha256-wgVsF3H9BT8lBew7tQ308eIQ6cLZT93hD/4eYCDEq98=";
+      "tauri-plugin-sql-0.0.0" = "sha256-e9iwcHwW8MaRzkaAbewrq6b9+n3ZofMTBnvA23ZF2ro=";
    };
  };

--- a/pkgs/applications/misc/todoist-electron/default.nix
+++ b/pkgs/applications/misc/todoist-electron/default.nix
@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, appimageTools, makeWrapper, electron_24, libsecret }:
+{ lib, stdenv, fetchurl, appimageTools, makeWrapper, electron_25, libsecret }:

 stdenv.mkDerivation rec {
  pname = "todoist-electron";
-  version = "8.3.3";
+  version = "8.6.0";

  src = fetchurl {
    url = "https://electron-dl.todoist.com/linux/Todoist-linux-x86_64-${version}.AppImage";
-    hash = "sha256-X928hCrYVOBTEZq1hmZWgWlabtOzQrLUuptF/SJcAto=";
+    hash = "sha256-LjztKgpPm4RN1Pn5gIiPg8UCO095kzTQ9BTEG5Rlv10=";
  };

  appimageContents = appimageTools.extractType2 {
@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
  '';

  postFixup = ''
-    makeWrapper ${electron_24}/bin/electron $out/bin/todoist-electron \
+    makeWrapper ${electron_25}/bin/electron $out/bin/todoist-electron \
      --add-flags $out/share/${pname}/resources/app.asar \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc libsecret ]}" \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
--- a/pkgs/applications/networking/browsers/tor-browser/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser/default.nix
@ -86,7 +86,7 @@ lib.warnIf (useHardenedMalloc != null)
    ffmpeg
  ];

-  version = "13.0";
+  version = "13.0.1";

  sources = {
    x86_64-linux = fetchurl {
@ -96,7 +96,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-zdmPbmJo5FDoOjob+9TDCvCgKgLHvLi3bOMhcZg8DVM=";
+      hash = "sha256-ORa973US2VY9Can4Nr35YSpZrYGqBP4I/S/ulsbRJLc=";
    };

    i686-linux = fetchurl {
@ -106,7 +106,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
      ];
-      hash = "sha256-Hlvx2C4DF/wcHo9ES+g9UUgNFGDokW5OAX3FeOvR+fY=";
+      hash = "sha256-OBUleXLTNFG+aFuftnphgBtQCfyoIWDcoVFs5elJ0tA=";
    };
  };

--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.10.10";
+  version = "0.10.13";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    hash = "sha256-Lu/itKaF7mSG/jwg2sA4wNkbzBWdDY4pfwHB0elI1Bc=";
+    hash = "sha256-DhMoNI1eRzP9FK752Z8sAcuj5dpu2vRqXRv4tbSYmLE=";
  };

  CGO_ENABLED = 0;
--- a/pkgs/applications/networking/cluster/kubeshark/default.nix
+++ b/pkgs/applications/networking/cluster/kubeshark/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubeshark";
-  version = "50.4";
+  version = "51.0.14";

  src = fetchFromGitHub {
    owner = "kubeshark";
    repo = "kubeshark";
-    rev = version;
-    sha256 = "sha256-+9AnzY/vnB1OGzkKmYL0sxWS17NV+MGnHNXGOtt+BKU=";
+    rev = "v${version}";
+    hash = "sha256-aFeegAFGRofGa54roJ3EACvk9179YAwsgO97eeoOd6s=";
  };

  vendorHash = "sha256-Vcn1Ky/J/3QiV6M5fLedDcpkLp5WsVcXRkOEgkKPYEQ=";
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@ -2,14 +2,14 @@

 buildGoModule rec {
  pname = "velero";
-  version = "1.12.0";
+  version = "1.12.1";


  src = fetchFromGitHub {
    owner = "vmware-tanzu";
    repo = "velero";
    rev = "v${version}";
-    sha256 = "sha256-NrOdnsdKxobJkMUGxdWQyzqB+2fDCjvTjnIt5S9fL0U=";
+    sha256 = "sha256-qa/Ic3qi+CAW9h4W2G8x6UdxPC2SkrMLMJEcxN7eDGY=";
  };

  ldflags = [
@ -20,7 +20,7 @@ buildGoModule rec {
    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
  ];

-  vendorHash = "sha256-mPRBmCqyQWCbWArORXL9sF8B4AlXHtA7Zs9NZD0TqoE=";
+  vendorHash = "sha256-TisGl0kM4vMVh9vk6/mRVOaRm9yoTwKkPedTPqdySDY=";

  excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];

--- a/pkgs/applications/networking/cluster/weave-gitops/default.nix
+++ b/pkgs/applications/networking/cluster/weave-gitops/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "weave-gitops";
-  version = "0.33.0";
+  version = "0.34.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-MJX9OrfvzGwrJria1Ki6QHprvoDLxBRPCnKRqPdnbUw=";
+    sha256 = "sha256-W7Q5rsmNEDUGofQumbs9HaByQEb7sj4tOT7ZpIe98E4=";
  };

  ldflags = [ "-s" "-w" "-X github.com/weaveworks/weave-gitops/cmd/gitops/version.Version=${version}" ];

-  vendorHash = "sha256-3woVoEh+bU8QOzOEk7hnxxVe0mlPozqUDuP0Rn/9J6k=";
+  vendorHash = "sha256-+UxrhtwYP+ctn+y7IxKKLO5RVoiUSl4ky0xprXr98Jc=";

  subPackages = [ "cmd/gitops" ];

--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -8,6 +8,7 @@ let
  python = python3.override {
    # FlexGet doesn't support transmission-rpc>=5 yet
    # https://github.com/NixOS/nixpkgs/issues/258504
+    # https://github.com/Flexget/Flexget/issues/3847
    packageOverrides = self: super: {
      transmission-rpc = super.transmission-rpc.overridePythonAttrs (old: rec {
        version = "4.3.1";
@ -23,7 +24,7 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.9.13";
+  version = "3.9.16";
  format = "pyproject";

  # Fetch from GitHub in order to use `requirements.in`
@ -31,7 +32,7 @@ python.pkgs.buildPythonApplication rec {
    owner = "Flexget";
    repo = "Flexget";
    rev = "refs/tags/v${version}";
-    hash = "sha256-7qHJqxKGHgj/Th513EfFbk5CLEAX24AtWJF2uS1dRLs=";
+    hash = "sha256-p92wiQ01NBFs5910wngkNHnE/mOfs9XnOLUEOyk9VpA=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@ -2,11 +2,11 @@

 let
  pname = "rambox";
-  version = "2.2.0";
+  version = "2.2.1";

  src = fetchurl {
    url = "https://github.com/ramboxapp/download/releases/download/v${version}/Rambox-${version}-linux-x64.AppImage";
-    sha256 = "sha256-9CtE29bcE4CIWZmwSbSa/MxuDdwn0vlQT0wOYAoNkcg=";
+    sha256 = "sha256-6fnO/e5lFrY5t2sCbrrYHck29NKt2Y+FH0N2cxunvZs=";
  };

  desktopItem = (makeDesktopItem {
@ -31,6 +31,8 @@ appimageTools.wrapType2 {
    install -Dm644 ${desktopItem}/share/applications/* $out/share/applications
  '';

+  extraPkgs = pkgs: with pkgs; [ procps ];
+
  meta = with lib; {
    description = "Workspace Simplifier - a cross-platform application organizing web services into Workspaces similar to browser profiles";
    homepage = "https://rambox.app";
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@ -8,7 +8,7 @@
 , nodejs
 , fetchYarnDeps
 , fixup_yarn_lock
-, electron_24
+, electron
 , libpulseaudio
 , pipewire
 , alsa-utils
@ -52,8 +52,8 @@ stdenv.mkDerivation (finalAttrs: {

    yarn --offline electron-builder \
      --dir ${if stdenv.isDarwin then "--macos" else "--linux"} ${if stdenv.hostPlatform.isAarch64 then "--arm64" else "--x64"} \
-      -c.electronDist=${electron_24}/libexec/electron \
-      -c.electronVersion=${electron_24.version}
+      -c.electronDist=${electron}/libexec/electron \
+      -c.electronVersion=${electron.version}

    runHook postBuild
  '';
@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
    popd

    # Linux needs 'aplay' for notification sounds, 'libpulse' for meeting sound, and 'libpipewire' for screen sharing
-    makeWrapper '${electron_24}/bin/electron' "$out/bin/teams-for-linux" \
+    makeWrapper '${electron}/bin/electron' "$out/bin/teams-for-linux" \
      ${lib.optionalString stdenv.isLinux ''
        --prefix PATH : ${lib.makeBinPath [ alsa-utils which ]} \
        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio pipewire ]} \
--- a/pkgs/applications/networking/qv2ray/default.nix
+++ b/pkgs/applications/networking/qv2ray/default.nix
@ -21,13 +21,13 @@

 mkDerivation rec {
  pname = "qv2ray";
-  version = "unstable-2023-06-09";
+  version = "unstable-2023-07-11";

  src = fetchFromGitHub {
    owner = "Qv2ray";
    repo = "Qv2ray";
-    rev = "aea9981cc28fe25de55207b93d86036b30d467d2";
-    hash = "sha256-ySXAF6fkkKsafuSa3DxkOuRjSyiCDUZRevcfJRp7LPM=";
+    rev = "b3080564809dd8aef864a54ca1b79f0984fe986b";
+    hash = "sha256-LwBjuX5x3kQcdEfPLEirWpkMqOigkhNoh/VNmBfPAzw=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/trayscale/default.nix
+++ b/pkgs/applications/networking/trayscale/default.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "trayscale";
-  version = "0.9.7";
+  version = "0.10.4";

  src = fetchFromGitHub {
    owner = "DeedleFake";
    repo = "trayscale";
    rev = "v${version}";
-    hash = "sha256-PMcpVBJVJNX+5vICubBUqlyHC0CEZC9EGUfw6O3pCeA=";
+    hash = "sha256-/31QKCyMeEdpP59B+iXS5hL9W5sWz7R/I2nxBtj+0s4=";
  };

-  vendorHash = "sha256-K1Za2j4kUtsktFi9DjZYXrtfsWF1r6vIbyocLUrj5IU=";
+  vendorHash = "sha256-xYBiO6Zm32Do19I/cm4T6fubXY++Bhkn+RNAmKzM5cY=";

  subPackages = [ "cmd/trayscale" ];

--- a/pkgs/applications/office/micropad/default.nix
+++ b/pkgs/applications/office/micropad/default.nix
@ -15,25 +15,25 @@ let
 in
  mkYarnPackage rec {
    pname = "micropad";
-    version = "4.3.0";
+    version = "4.4.0";

    src = fetchFromGitHub {
      owner = "MicroPad";
      repo = "Micropad-Electron";
      rev = "v${version}";
-      hash = "sha256-Rr3mOz2OlCq2tibxutR8zBANhswnkz70aP9BBS/pXp0=";
+      hash = "sha256-VK3sSXYW/Dev7jCdkgrU9PXFbJ6+R2hy6QMRjj6bJ5M=";
    };

    micropad-core = fetchzip {
      url = "https://github.com/MicroPad/MicroPad-Core/releases/download/v${version}/micropad.tar.xz";
-      hash = "sha256-7yFTD8bXsxT6kBKxBGGxwzYpa0rZYLYV6KRYtImQ58c=";
+      hash = "sha256-KfS13p+mjIh7VShVCT6vFuQY0e/EO/sENOx4GPAORHU=";
    };

    packageJSON = ./package.json;

    offlineCache = fetchYarnDeps {
      yarnLock = "${src}/yarn.lock";
-      hash = "sha256-PKCi1c8WY1BG/H1kUJ8xSCVoLF/9DEn5Kh29is2BTYY=";
+      hash = "sha256-8M0VZI5I4fLoLLmXkIVeCqouww+CyiXbd+vJc8+2tIs=";
    };

    nativeBuildInputs = [ copyDesktopItems makeWrapper ]
--- a/pkgs/applications/office/micropad/package.json
+++ b/pkgs/applications/office/micropad/package.json
@ -1,6 +1,6 @@
 {
  "name": "micropad",
-  "version": "4.3.0",
+  "version": "4.4.0",
  "description": "A powerful note-taking app that helps you organise + take notes without restrictions.",
  "main": "main.js",
  "scripts": {
@ -27,9 +27,10 @@
  "devDependencies": {
    "@types/mime": "^3.0.1",
    "@types/node": "^18.7.18",
-    "electron": "^25.5.0",
-    "electron-builder": "^24.6.3",
-    "typescript": "~4.9.5"
+    "@types/typo-js": "^1.2.1",
+    "electron": "^27.0.2",
+    "electron-builder": "^24.6.4",
+    "typescript": "~5.2.2"
  },
  "dependencies": {
    "dictionary-en": "^3.0.0",
--- a/pkgs/applications/radio/cloudlog/default.nix
+++ b/pkgs/applications/radio/cloudlog/default.nix
@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cloudlog";
-  version = "2.4.10";
+  version = "2.4.11";

  src = fetchFromGitHub {
    owner = "magicbug";
    repo = "Cloudlog";
    rev = version;
-    hash = "sha256-Hj/Qtx9g73H3eKPQgQE+nRqjG344IbxzRX1y/iPgJAc=";
+    hash = "sha256-w1QCEow0K8uzbHlyASCggw2U+1RXjPbmxd5XRSdp6yE=";
  };

  postPath = ''
--- a/pkgs/applications/version-management/glab/default.nix
+++ b/pkgs/applications/version-management/glab/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "glab";
-  version = "1.33.0";
+  version = "1.34.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-sBovwqL+3UmOdGf5pnAVzAiAbu69PJi7YhfcJqdejTY=";
+    hash = "sha256-YMiT1eJyBwKKFxonQCAu7st+JoU/YLpxKCcMfs/sZ1U=";
  };

-  vendorHash = "sha256-HiU6Kx/du8QLNKUDsSMm349msxSxyNRppxadtIpglBg=";
+  vendorHash = "sha256-o/B5enbrmv/+zJYBQkxbdUaiieaFyOJDc8Fm6tV//uM=";

  ldflags = [
    "-s"
--- a/pkgs/applications/virtualization/tart/default.nix
+++ b/pkgs/applications/virtualization/tart/default.nix
@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "tart";
-  version = "1.6.0";
+  version = "2.0.0";

  src = fetchurl {
    url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart.tar.gz";
-    sha256 = "1n052nwsccc3sr0jqnvhyl0six8wi46vysxjchwrdm8brnsdpf84";
+    sha256 = "sha256-uDNB49HF++WTV28VkfZCt32zkp+h0W5xXAuqtaFTmPI=";
  };
  sourceRoot = ".";

--- a/pkgs/applications/virtualization/youki/default.nix
+++ b/pkgs/applications/virtualization/youki/default.nix
@ -10,13 +10,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "youki";
-  version = "0.1.0";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "containers";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Nz3paJiR5Jtv8gLBq6mBUyLDfIFJCpnc/RMsDLT09Vg=";
+    sha256 = "sha256-XoHGRCGLEG/a6gb+3ejYoeOuIml64U/p6CcxsFLoTWY=";
  };

  nativeBuildInputs = [ pkg-config installShellFiles ];
@ -33,7 +33,7 @@ rustPlatform.buildRustPackage rec {
  cargoBuildFlags = [ "-p" "youki" ];
  cargoTestFlags = [ "-p" "youki" ];

-  cargoHash = "sha256-luzKyN09lauflAict9zqVdGPbDLFAfe5P8121a5YBsA=";
+  cargoHash = "sha256-L5IhOPo8BDQAvaSs3IJzJHN0TbgmUcEyv60IDLN4kn0=";

  meta = with lib; {
    description = "A container runtime written in Rust";
--- a/pkgs/by-name/am/amazon-ssm-agent/package.nix
+++ b/pkgs/by-name/am/amazon-ssm-agent/package.nix
@ -40,13 +40,13 @@ let
 in
 buildGoModule rec {
  pname = "amazon-ssm-agent";
-  version = "3.2.1630.0";
+  version = "3.2.1705.0";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "amazon-ssm-agent";
    rev = "refs/tags/${version}";
-    hash = "sha256-0tN0rBfz2VZ4UkYLFDGg9218O9vyyRT2Lrppu9TETao=";
+    hash = "sha256-4KhDD5G/fS1rHitQdbYqIz6RSQ3PTMZsUENC202a/Do=";
  };

  vendorHash = null;
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ast-grep";
-  version = "0.12.4";
+  version = "0.12.5";

  src = fetchFromGitHub {
    owner = "ast-grep";
    repo = "ast-grep";
    rev = version;
-    hash = "sha256-rWfuPk8PWxOmy/WDXGnqBCuGPEI7tBwuOc0IP2FhAq8=";
+    hash = "sha256-oFe3AbMpBVBAm/W4IowXAKcEN7CDrrAXhx4dzMXppUM=";
  };

-  cargoHash = "sha256-M3eNvY8UwsnV9mvkGD//u1zTiJzV1ce7ODyQjnDSZTo=";
+  cargoHash = "sha256-f4tcJqT3l9G6FimBb0D4PATgQYUkSG5uIQ9BbsbgC/U=";

  # error: linker `aarch64-linux-gnu-gcc` not found
  postPatch = ''
--- a/pkgs/by-name/c2/c2fmzq/package.nix
+++ b/pkgs/by-name/c2/c2fmzq/package.nix
@ -0,0 +1,36 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, nixosTests
+}:
+
+buildGoModule rec {
+  pname = "c2FmZQ";
+  version = "0.4.8";
+
+  src = fetchFromGitHub {
+    owner = "c2FmZQ";
+    repo = "c2FmZQ";
+    rev = "v${version}";
+    hash = "sha256-IYSmGzjTDMBgEMVZsi6CuUz6L7BzpmbrJYVPUhFr7rw=";
+  };
+
+  ldflags = [ "-s" "-w" ];
+
+  sourceRoot = "source/c2FmZQ";
+
+  vendorHash = "sha256-Hz6P+ptn1i+8Ek3pp8j+iB8NN5Xks50jyZuT8Ullxbo=";
+
+  subPackages = [ "c2FmZQ-client" "c2FmZQ-server" ];
+
+  passthru.tests = { inherit (nixosTests) c2fmzq; };
+
+  meta = with lib; {
+    description = "Securely encrypt, store, and share files, including but not limited to pictures and videos";
+    homepage = "https://github.com/c2FmZQ/c2FmZQ";
+    license = licenses.gpl3Only;
+    mainProgram = "c2FmZQ-server";
+    maintainers = with maintainers; [ hmenke ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/pr/prox/package.nix
+++ b/pkgs/by-name/pr/prox/package.nix
@ -0,0 +1,31 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "prox";
+  # While upstream did release a v1.0.0, v0.5.2 is actually newer: https://github.com/fgrosse/prox/releases/tag/v0.5.2
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "fgrosse";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-mqx8ICne0NnyW0N1Jeu+PJXWDBr12OASLxlePI6v6Bc=";
+  };
+
+  vendorHash = "sha256-4gZfEbyAzAzxtOR6FhP7eUSdln+fANn87+duCq1aq5A=";
+
+  postPatch = ''
+    substituteInPlace cmd/prox/version.go \
+      --replace '0.0.0-unknown' '${version}'
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/fgrosse/prox";
+    description = "A process runner for Procfile-based applications ";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ lucperkins ];
+  };
+}
--- a/pkgs/by-name/pz/pzip/package.nix
+++ b/pkgs/by-name/pz/pzip/package.nix
@ -0,0 +1,34 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, unzip
+}:
+
+buildGoModule rec {
+  pname = "pzip";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "ybirader";
+    repo = "pzip";
+    rev = "v${version}";
+    hash = "sha256-bb2TSSyA7TwgoV53M/7WkNcTq8F0EjCA7ObHfnGL9l0=";
+  };
+
+  vendorHash = "sha256-MRZlv4eN1Qbu+QXr//YexTDYSK4pCXAPO7VvGqZhjho=";
+
+  nativeBuildInputs = [
+    unzip
+  ];
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    description = "A fast concurrent zip archiver and extractor";
+    homepage = "https://github.com/ybirader/pzip";
+    changelog = "https://github.com/ybirader/pzip/releases/tag/${src.rev}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "pzip";
+  };
+}
--- a/pkgs/by-name/su/supersonic/package.nix
+++ b/pkgs/by-name/su/supersonic/package.nix
@ -20,16 +20,16 @@ assert waylandSupport -> stdenv.isLinux;

 buildGoModule rec {
  pname = "supersonic" + lib.optionalString waylandSupport "-wayland";
-  version = "0.5.2";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "dweymouth";
    repo = "supersonic";
    rev = "v${version}";
-    hash = "sha256-4SLAUqLMoUxTSi4I/QeHqudO62Gmhpm1XbCGf+3rPlc=";
+    hash = "sha256-elDVkhRW1mTez56OKQJJ0m0VxP8/Bq+HcXf5iokeY5I=";
  };

-  vendorHash = "sha256-6Yp5OoybFpoBuIKodbwnyX3crLCl8hJ2r4plzo0plsY=";
+  vendorHash = "sha256-z1sDlyc7HW+tYfG0Z4EjUCEM3Su4JjmWIKxU2MV6GOA=";

  nativeBuildInputs = [
    copyDesktopItems
@ -62,6 +62,7 @@ buildGoModule rec {
    darwin.apple_sdk_11_0.frameworks.Kernel
    darwin.apple_sdk_11_0.frameworks.OpenGL
    darwin.apple_sdk_11_0.frameworks.UserNotifications
+    darwin.apple_sdk_11_0.frameworks.MediaPlayer
  ];

  postInstall = ''
--- a/pkgs/by-name/ui/uiua/package.nix
+++ b/pkgs/by-name/ui/uiua/package.nix
@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "uiua";
-  version = "0.0.22";
+  version = "0.0.23";

  src = fetchFromGitHub {
    owner = "uiua-lang";
    repo = "uiua";
-    rev = "refs/tags/${version}";
-    hash = "sha256-x1xZH+AVJqnvwxgBgcVB5LvDb54C+HnPBCTIqZ8Dv7E=";
+    rev = version;
+    hash = "sha256-+Q/dn0pGZ3R+UlAt9stQZU1n+WITujJzTxY5dpXc+Bc=";
  };

-  cargoHash = "sha256-gY+KeE2ATsCydpxcRoLtRDeyEvOGv7+I0SskLq8b9rw=";
+  cargoHash = "sha256-R4jQ9Or9vh3dtqJH7nPvYM4o1h277sFUf+nC1VQl1Uk=";

  nativeBuildInputs = lib.optionals stdenv.isDarwin [
    rustPlatform.bindgenHook
@ -41,13 +41,14 @@ rustPlatform.buildRustPackage rec {

  buildFeatures = lib.optional audioSupport "audio";

-  passthru.tests.run = runCommand "uiua-test-run" {nativeBuildInputs = [uiua];} ''
+  passthru.tests.run = runCommand "uiua-test-run" { nativeBuildInputs = [ uiua ]; } ''
    uiua init;
    diff -U3 --color=auto <(uiua run main.ua) <(echo '"Hello, World!"')
    touch $out;
  '';

-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/uiua-lang/uiua/releases/tag/${src.rev}";
    description = "A stack-oriented array programming language with a focus on simplicity, beauty, and tacit code";
    longDescription = ''
      Uiua combines the stack-oriented and array-oriented paradigms in a single
@ -55,8 +56,8 @@ rustPlatform.buildRustPackage rec {
      high information density and little syntactic noise.
    '';
    homepage = "https://www.uiua.org/";
-    license = licenses.mit;
+    license = lib.licenses.mit;
    mainProgram = "uiua";
-    maintainers = with maintainers; [ cafkafk tomasajt ];
+    maintainers = with lib.maintainers; [ cafkafk tomasajt ];
  };
 }
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , stdenvNoCC
+, gcc13Stdenv
 , fetchFromGitHub
 , substituteAll
 , makeWrapper
@ -9,6 +10,7 @@
 , vencord
 , electron
 , pipewire
+, libpulseaudio
 , libicns
 , jq
 , moreutils
@ -16,13 +18,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "vesktop";
-  version = "0.3.3";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "Vencord";
    repo = "Vesktop";
    rev = "v${version}";
-    sha256 = "sha256-Njs3tACxUyRolYUtS/q2lITIQnUBFXVXWZEfQ66HpPM=";
+    hash = "sha256-jSGad3qMhAdiGdwomQO6BIyHIbKrGLRGniGrJN97gN8=";
  };

  pnpm-deps = stdenvNoCC.mkDerivation {
@ -51,7 +53,7 @@ stdenv.mkDerivation rec {

    dontFixup = true;
    outputHashMode = "recursive";
-    outputHash = "sha256-vInaSLGahRUgvwAeUcI+oV84L+tgNRCmfFpE0aUD4X4=";
+    outputHash = "sha256-lTeL+8QujWzx4ys2T+G55NUP51c8i5lB1vAkUtzkJlA=";
  };

  nativeBuildInputs = [
@ -92,7 +94,12 @@ stdenv.mkDerivation rec {
  # yes, upstream really packages it as "vesktop" but uses "vencorddesktop" file names
  installPhase =
    let
-      libPath = lib.makeLibraryPath [ pipewire ];
+      # this is mainly required for venmic
+      libPath = lib.makeLibraryPath [
+        libpulseaudio
+        pipewire
+        gcc13Stdenv.cc.cc.lib
+      ];
    in
    ''
      runHook preInstall
@ -132,7 +139,8 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/Vencord/Vesktop";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ getchoo Scrumplex vgskye ];
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
    mainProgram = "vencorddesktop";
+    broken = stdenv.hostPlatform.isAarch64;
  };
 }
--- a/pkgs/by-name/wh/whistle/package.nix
+++ b/pkgs/by-name/wh/whistle/package.nix
@ -0,0 +1,26 @@
+{ lib, buildNpmPackage, fetchFromGitHub }:
+
+buildNpmPackage rec {
+  pname = "whistle";
+  version = "2.9.58";
+
+  src = fetchFromGitHub {
+    owner = "avwo";
+    repo = "whistle";
+    rev = "v${version}";
+    hash = "sha256-/dt4xwUZrvymCpc3xRyWM2Wsh7zk7ndepgOWJwJ2Das=";
+  };
+
+  npmDepsHash = "sha256-9GBhC2PQyaqi64ncIuMZSf9CLB8l+cywT7QTzW9WiTs=";
+
+  dontNpmBuild = true;
+
+  meta = with lib; {
+    description = "HTTP, HTTP2, HTTPS, Websocket debugging proxy";
+    homepage = "https://github.com/avwo/whistle";
+    changelog = "https://github.com/avwo/whistle/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+    mainProgram = "whistle";
+  };
+}
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "27.2.0";
+  version = "27.3.1";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;

 buildNpmPackage rec {
  pname = if set != null then "iosevka-${set}" else "iosevka";
-  version = "27.2.1";
+  version = "27.3.1";

  src = fetchFromGitHub {
    owner = "be5invis";
    repo = "iosevka";
    rev = "v${version}";
-    hash = "sha256-+d6pONsAoA0iI7VCuDHBGGjZPaxgLToouQpFTaX6edY=";
+    hash = "sha256-7ndJDdgDn5tnnUeB4etQ8bBZnH7NuiYoNQ9CrF2HtwQ=";
  };

-  npmDepsHash = "sha256-c/QvrDjjoq2o1le++e7D0Lb18wyZc/q6ct++rkgYtzg=";
+  npmDepsHash = "sha256-MNlT8VJTIvoZDAAdEs0Fa8gqO7dWhRR9I4Kw4qlW5Ig=";

  nativeBuildInputs = [
    remarshal
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1jn883s4vvpfih31yxap2hg6xya9jfjnqa8f7iqkqyxxqrnx7zzm";
-  iosevka-aile = "1p2s5nslifmdbjbqqlk02kl0rvpmr5pkq71hr9xim2dqb11kmcdl";
-  iosevka-curly = "0rs7jmgpl1ki7b9i3l78fn63xbgd02wraixqb1yjc3lmxi9jbhxn";
-  iosevka-curly-slab = "09rf82w41fbw7pm1ak9vv1i9450h2ia7x434gn9czx01wnb3s2zb";
-  iosevka-etoile = "1621a74z378rz4l1gn9dr7fqqvnd1g7ipr5bw13qhwl5ljf170xs";
-  iosevka-slab = "06x3hbi05bzlaci7hr3wk8j92zn97i41bw8xjnj8sh63mla36w9p";
-  iosevka-ss01 = "1plp7lk9yzizfz9c5k4m51ynvp0zkz7r7vgx416rkwb3yh23fjpv";
-  iosevka-ss02 = "0zpl9a8nccnrywaxj61glj4x7ai1fas9x463xqpy38w686n0jjyn";
-  iosevka-ss03 = "1xrxvsj2ja9miwvgq7p6kxysn8858gk8qh2pp1bw1n67vppvhkp9";
-  iosevka-ss04 = "1y0ac2dq8xmrbw84nar2jsxbyf9nck8fxh3dbl8vhvpnbwan150w";
-  iosevka-ss05 = "1z722m5chr8jq24i7czph1qgkasah7y7i4wv2wv0n2j89mc2fbc2";
-  iosevka-ss06 = "1fzsj9389cah6zp23vlr375j107jxfabqxaa7iv1hjbw3fa2vmdk";
-  iosevka-ss07 = "18psmz6kfhdmpac408w1fsqfarahn60bypm8ci8y3gd8bk8js13c";
-  iosevka-ss08 = "0hjlrly98hd4w5l6cm361h4cyvkdrlf3bp1g6f438aip0bj2y94w";
-  iosevka-ss09 = "13jdlmamfbxnkqii6bkh0xm71fgqdvgnqs88dnq8pjyqhbl32sca";
-  iosevka-ss10 = "15ak510q6di9hsy2p8k7gkp5d1kzgrmk2m55zh90w5irbr5fmbjp";
-  iosevka-ss11 = "0x42pjik0iy2v11iq8i83wa88f6b6qymc3v2sih28rjhijxl7lsm";
-  iosevka-ss12 = "15s7imcm4w61555crah1pxzc9yn3zffkj13zk8zidgk6v7jzb6rs";
-  iosevka-ss13 = "1q3d3fyjsk6iwq1w6dv9rc7ivk021i3v2px574dfbqlswvb2sg86";
-  iosevka-ss14 = "0r1fkrcqcccx4zz9qgzgq9si8xcbn7y1f2821cjs6cbfaxmrkwmc";
-  iosevka-ss15 = "0vgwgkfnch5rn7kc9rblg1km4pzqwsglb31zqnx3rxhszm66j9q6";
-  iosevka-ss16 = "009whnydn5rb6dj06scnc3722y8sddsv4jl42r70x2zzra14qdgk";
-  iosevka-ss17 = "01j1gqrmlx3b6rlv6sg3kv9j39s2dwqvj35h4v0v7min2vn1hydj";
-  iosevka-ss18 = "1pbwqgrkv560237marp5msq1y93llxvjrpixka15a79a7lmpd36i";
-  sgr-iosevka = "0p31qdby1znrsz4hplrq81ngv1l2pxbn9x26hcpjxrbgv2mmvhfq";
-  sgr-iosevka-aile = "00zapw8mk0z40jw69ynvdzhpd67rvi9lp509hf3vb7x3cq1ka1wz";
-  sgr-iosevka-curly = "1rgxkc2ps8pmp3mgi2b51lv4j5cc5q7m6iizw8gbfl36qmzlfdlh";
-  sgr-iosevka-curly-slab = "1fdxr0mkb40fa0605i8b8h51pg8p3cskjsggil9gp1376wzhr42q";
-  sgr-iosevka-etoile = "1r91042avgn0f0p2rf09pam4wfjndkj7wml9vs082kc40aqgh9m5";
-  sgr-iosevka-fixed = "13b5nkyxpm9izj0dmwc97lqbfvbxqyjg3677hpi6ywl3c6m1h542";
-  sgr-iosevka-fixed-curly = "06r0lzcrhf9897yi9h6xh5n1mfb8j4v21nz81igs616w7gjlz0dk";
-  sgr-iosevka-fixed-curly-slab = "1l9qaialwq2xygznylbwkizbqwghzl4625d845f8kwyl9krd92na";
-  sgr-iosevka-fixed-slab = "199s1cdn22rjirrh1f9xhqbh77namriw077g11hykr4ibwy6sc6n";
-  sgr-iosevka-fixed-ss01 = "1y51qk0pfq9r8hpcgmcykrvddl8rw5rjfysrbsjvf6zi59z5rk02";
-  sgr-iosevka-fixed-ss02 = "12x3qrw6baxfwbj2wgawf9qpbk8nv7ccd9grqgw7b4qmy5j31n39";
-  sgr-iosevka-fixed-ss03 = "1sf8xybh8l76dbm8vgk0y4lgdm5lb5pb4kgnipygqj9z0kasj07d";
-  sgr-iosevka-fixed-ss04 = "0pbpqnv6kdnnl4yix3ysfrnxg3ainsl9m0pnkb1i21q5sav20ph5";
-  sgr-iosevka-fixed-ss05 = "1vgfiqxwfg3m68dlk4s1x5ms293nbwgdq34y80hysp8pfzl7d07z";
-  sgr-iosevka-fixed-ss06 = "17f3rxsh2nla6a8fhim88vxqj1kzafvcfbara1iwzsw3fw9gz2ai";
-  sgr-iosevka-fixed-ss07 = "1j3r197jx51b7l5cpm2g5b7mzq53wp05f8ra3cz04r69qc0dj8i5";
-  sgr-iosevka-fixed-ss08 = "1gj784bi4wy0282xbq3f24sqlm7b2s1gz2f8sna4bd5bgci8avb7";
-  sgr-iosevka-fixed-ss09 = "0hhqvghq0mxbjzfhfcjgij94b40129vhg6x4slgk579kdfmr21y4";
-  sgr-iosevka-fixed-ss10 = "044dam3cg2s29j0zbq03ypyyskws31dfvyyp01smds7njf8f2w39";
-  sgr-iosevka-fixed-ss11 = "1xxmcai145rfjhlx4n5hcs7kdz298pxn9b3if85cpmdd9qhdmy48";
-  sgr-iosevka-fixed-ss12 = "13rbsql91z2ndbx121j1yb3m10a2fwil0jilhfjj17rn0kh0a5qi";
-  sgr-iosevka-fixed-ss13 = "19y6x2jln772afqy7y2k97kzpin73y5wq72fh7c9n9cmh1n24628";
-  sgr-iosevka-fixed-ss14 = "0ndm0yk95a10qv95c9d5qhjx4vzc28wkahlxjadndxh82hn8zlqm";
-  sgr-iosevka-fixed-ss15 = "107lwn4d01hry6jyk2blxdy7gx80ka6wrgxs80l5czx4jsk6kr66";
-  sgr-iosevka-fixed-ss16 = "0ka5rp7svqp5hs2zdf0bq5lfhgfmqij93f53q1a0snispx1qnsn6";
-  sgr-iosevka-fixed-ss17 = "18kvws3r66b1lqqpyphpf1nk6qdv6pv9c36zf0kpi7hpfcp1dvaa";
-  sgr-iosevka-fixed-ss18 = "1s9gzh2ghs66rjjz7317x163072gy2fxbqmvhghngd7bpvbajdd6";
-  sgr-iosevka-slab = "0b78y7pikcrlilzn2xlvg5f7liqp0zvzcknx9l47nh32sqn11f5j";
-  sgr-iosevka-ss01 = "1nrj6dl3znakj3h0fvd37k71gcp2l0yfgqggdn6ms4cyyrq16z38";
-  sgr-iosevka-ss02 = "0mhn1jx2ibllp8h05lm9ms8wh960yyncblx4pkj95sswm5kdv8vv";
-  sgr-iosevka-ss03 = "0xxanqcpqh5fvhfad6cyk89yr2nza9lpig6dralizi8b1vxl7bnl";
-  sgr-iosevka-ss04 = "1566hvq2lwnh6p7v55j8khi56y61cg88g7vnb306a0rakg5jv17y";
-  sgr-iosevka-ss05 = "111pwbwp8fkiph6mrzblbx1nzdnzv9d6aphmkxlmrf1cs19jv71k";
-  sgr-iosevka-ss06 = "0p57cqqfhyhri2r1ss8pcd2hdn4pvp0dwr8ls1iws5gaj2s5zbjx";
-  sgr-iosevka-ss07 = "0clchkildx4vmk4xpd3xjx0xbihfkn61pcha00md4qf471ysnpmp";
-  sgr-iosevka-ss08 = "17ici8in0sh2zy1ya9319k9qqjzg5nl7ky6mbb2skpgmh85figfp";
-  sgr-iosevka-ss09 = "0fcwxcvzpc9l5dvmkqxf1g32xr4fk5rr389d6s3qbkdxdlc2vx63";
-  sgr-iosevka-ss10 = "1d59vw8caj9nlpmfijwpgkbb6kxphgdrw2hd5ldcvxs0ny0r8fcd";
-  sgr-iosevka-ss11 = "0d60zpdq7n73cn0lgnwhddxzw3x0i2cpqwpc1k78s8r8h36qmd05";
-  sgr-iosevka-ss12 = "15sc20f2kf6i0wlcfy60ss2j6dyg6figd18g22zmm7msz2lda1b0";
-  sgr-iosevka-ss13 = "0qi8ala5dm3r9gljwf5i84624h6arasd9mhww8nk3822cx8c8jd0";
-  sgr-iosevka-ss14 = "0i9p2rz8ppwl6x9d2j4gry7l386nbv4g2jrrna6bwgk4nh12izg0";
-  sgr-iosevka-ss15 = "0d4s197v96ka5c4b63kisiy8j694vskspc5vry4bgj4pbl7vl6lg";
-  sgr-iosevka-ss16 = "1a02r483ihfnlzx0kir6p84q6bscrs798i5qaw7qiz3zi8kxdrgb";
-  sgr-iosevka-ss17 = "1hi7dikls7x5zn79waki77bcp4w5hzx12mqmh0zx77aah3ghcax1";
-  sgr-iosevka-ss18 = "1mkjyn5mjnlwrxfhxr1f3ja2fd6lbv54fxx0xy9zm1banz0pp3y1";
-  sgr-iosevka-term = "0cmycg6vygxi3c1pdqddmh8mqpcrnkmn9y5c8xjzd1lygm41668q";
-  sgr-iosevka-term-curly = "1q7r3qclmkniin8hx8digwk1rfgfcm4jz6mvjay5sfi5wa6g9fd0";
-  sgr-iosevka-term-curly-slab = "07bf92s5zf9vny3560dr8zwxdg1jpdvz5ksmqcm74ib1024yk17r";
-  sgr-iosevka-term-slab = "1am42m5jggfy0fv3580rsksklaiq8827da1s20ngiyxfzcgbgwf3";
-  sgr-iosevka-term-ss01 = "09igqk8b4hmgmh1q1idvcjpz0vj15yzrsmcqhyrs1ygxyl2d6g5v";
-  sgr-iosevka-term-ss02 = "143czw61bilpim4lqqzp9d2gz4igijyl2p87iy3f5pvh75qzk8fx";
-  sgr-iosevka-term-ss03 = "02s7dsjxsm6dgp2rcz6n9dyi6priz9k5q5wd1rajfs6rgb01j1h7";
-  sgr-iosevka-term-ss04 = "10paacm4gb0823pqacj1ps8s79k6zbayrqqqnhvklkqki2iiay4g";
-  sgr-iosevka-term-ss05 = "0nn49fgxciwpfddcksb5krhvyqbr2zfx2zq1m5nswb70nzwwk8sj";
-  sgr-iosevka-term-ss06 = "1r6xlbf9si5ycg96av2pjjak82qgj1sqdq634wkl41x4mj39zkjl";
-  sgr-iosevka-term-ss07 = "1sfjv2ggqrgxjqykgycia62xa2g523yf61gix9dp79gyg6ga25nr";
-  sgr-iosevka-term-ss08 = "0rk66nzjc4d7bjx9sfgnlzsx52mdrdmgl4xri6jd0ad3543j43bh";
-  sgr-iosevka-term-ss09 = "0y12s0ynb5fda8kprwlbw6a9kkb7fwjfna2axgz5rxlz0ja14gs1";
-  sgr-iosevka-term-ss10 = "0hy31v083cd9lcb7xfvh6lj4nvzlqkbm8lni092sp21iv43xpp4f";
-  sgr-iosevka-term-ss11 = "0wb1c4l8327vsnkpj34grplw1v1mlr3wdavi7i0z5383qx4l3cn0";
-  sgr-iosevka-term-ss12 = "0x8zgm1yl37ij1hq6bcdf0whfbyv4gdkqk94yi3xm74a744pzsvx";
-  sgr-iosevka-term-ss13 = "1ia9q4gn9a6mr0n4vb6d8mnnp9s6l5v5y4fgi6ip0g49n0n8fw4r";
-  sgr-iosevka-term-ss14 = "0ipfjn23jaz6xjb0v2pbirrvi18czir6nijh79kxrrs1k83mc4yq";
-  sgr-iosevka-term-ss15 = "0pdlsd8qsp80y5rgp3vrhl1wjbj4b3bgqyavz1ayqccg939dvzqv";
-  sgr-iosevka-term-ss16 = "0bz3i0cnijq84skhsjgy0p6p6ww364gnkrny1hgcw7w21d69n2x5";
-  sgr-iosevka-term-ss17 = "1sfpaqviv1gqz4c29kmrm1v3zbr3615w90w96s5yxh2lr6zqxi7v";
-  sgr-iosevka-term-ss18 = "02f7i400qk9pbyid4dr6p690sqphz52pvgprqp54q1lw07jksqa6";
+  iosevka = "0l14c39r68x14maw9hyiqd0lqz7q2pq4drw68i0j4jwa58l0r2x1";
+  iosevka-aile = "1pl59kga3ab2jm3y4lh0lqp9nqjggykqrpnh27s99abkf5cvgkzr";
+  iosevka-curly = "1nv3r2c2zj9y3zgaa2r8s0w4l28a3pzkyvcm1br650mb4l469j6c";
+  iosevka-curly-slab = "1ik3affc11w0q3xjrm9pdpzp6hdq9623f1nhsbc4ih5980mvki0j";
+  iosevka-etoile = "16fsysywpf7zdkl0sszi5im42idlmxl273ml0zs9dajd5zdwhm08";
+  iosevka-slab = "1xksbmzzfp6mnd90nfnqyg02ps36makrcr311l1xcl9v4drcnsiq";
+  iosevka-ss01 = "1pzl1adnbi4m2bi4p754k82viqksxjd39q5sqljjrs60p5mwxbw6";
+  iosevka-ss02 = "0r1vrg6b6c4ixw0fzi4g3q7c1hah2szw2rv5gkqmdg0kiw6sddl1";
+  iosevka-ss03 = "0rg6hb0xjzmf8s410x7v5m1pv246p1xfxfggw4lhs19h6f7jcy0v";
+  iosevka-ss04 = "1690xgfyk6gqxwx70dsvq5ba7vf5906pf1qrrd916fkg2a28fxxp";
+  iosevka-ss05 = "1zbiq0hczg2dhld82nyw7x6rkh6y812cvawqqpjmhzxjhd2wn6hv";
+  iosevka-ss06 = "0290w7812pqlix1zmpanksbinzkzv6gw0y5k5dvaf4jrg5c3163m";
+  iosevka-ss07 = "0z7irkdcwwxpj52a6j1b4s1xz9nlib6jm66fxva7pqd9dhsjp1ph";
+  iosevka-ss08 = "1jd12mjcnjs6md3lj182ph9zlb66cmmm2cz49fwdxpx54laawn3i";
+  iosevka-ss09 = "0zggxrk2a315rzz684c06pk0vmp9cw5bcn9zkh61hcn0mii10xdv";
+  iosevka-ss10 = "14mshgnpq5sn4z81a8cwsq6hjarlrmwfqyhkyzcmqymi6gyljs6k";
+  iosevka-ss11 = "14p8fbvd4b4vddnmydyn0v5iffkq1s15pdxpmmwl2aplxnrgshiy";
+  iosevka-ss12 = "1r2p1f0mdkx7sqkv29gdpq78c905gcc7kfbr8l907awhv80fzsgg";
+  iosevka-ss13 = "0ara2w4zav48rk019hnhr3fq8kqzzvlgshq18cq5gralbcgjw883";
+  iosevka-ss14 = "1yqmm13bafrz7siq7q95921ipn3p6ms3dmsxn5zbcmm3pdxxyq1c";
+  iosevka-ss15 = "1y84vzqpwa060q3qrxc77kk3hnrgyjqwwxq4s9fq8hww9d01jb5d";
+  iosevka-ss16 = "0cszx4s3bi9j5l46sh33dkn9cqn9s7v6rk23d4srlfg19bfs19ga";
+  iosevka-ss17 = "0ld6pr8rx1ldszgdd2ixmfj341ry9ajfcpk6k1f9jmfilp4cjnzr";
+  iosevka-ss18 = "19787429v0am3qsjyxlgqwbkn50s54w26481h46ybn7nrskgxl7a";
+  sgr-iosevka = "1i5zg7wwyczf2ljxjvwk4n75j1nvn6wavc3w1zycfcgim458x8s6";
+  sgr-iosevka-aile = "0m0imj778l6zb4y5kb882z4f6abw6q1ww0d8fn4vyqk2csm3kx9v";
+  sgr-iosevka-curly = "071jpj9cj56hszqjy5cmj40gq6n47fp117ckypi0npk6cvrvrl7a";
+  sgr-iosevka-curly-slab = "1f33iy0nrkm76alyzs7bjdfvc7c4j7cqrzrk769y40wx68l5sbji";
+  sgr-iosevka-etoile = "19rgrrk4p9k94s887vv2kqb7zj1wjh5kjncalzbisjpv8ns6l3qq";
+  sgr-iosevka-fixed = "03ccy1f8hswslr7n9dhj9l3zvfkahqi742giim34f360f5chpmdi";
+  sgr-iosevka-fixed-curly = "14czka86s0yj1h0mq4ajn5yx1lnb9l3hp9yw8h558dy8hf6xk9pi";
+  sgr-iosevka-fixed-curly-slab = "1i0hjw0121l83znyfq3zl0z1pl4p57yf2qqrp35qqp0vpsxnjlcy";
+  sgr-iosevka-fixed-slab = "1cz1lj2qa8yiwbxpk3c6hdkgg44q9019yai3iz0c17gw8vwj6xxh";
+  sgr-iosevka-fixed-ss01 = "1966jyi9j01s094kz1k67ds4k4z1sfahwfxsasi59bc4r5srq3p7";
+  sgr-iosevka-fixed-ss02 = "1l08id1p2z2m8vrprlrg0rphspbz17lnc1l483wadffbfrlqrhpr";
+  sgr-iosevka-fixed-ss03 = "0g98s0w2lvskq9fyh47b8rx7rha24k4vzza9svl25kx55ixznzjm";
+  sgr-iosevka-fixed-ss04 = "0wjq34b6xv17ma75lysmwfqxyp57zr0h9hrxyl9c6sgdmlvf7jqx";
+  sgr-iosevka-fixed-ss05 = "080i32z64y9dm19fagc5jh3gkynbim0w03i42bc19im07ryyq79h";
+  sgr-iosevka-fixed-ss06 = "17ggkvz3y17zqkn1m864vgqbc5zvn63gsh39n4w1p9wi9v360984";
+  sgr-iosevka-fixed-ss07 = "1nazbkhr46larr0hgxwx2h5zvi9yr3qlg2npnmpprwqrhvlvlpah";
+  sgr-iosevka-fixed-ss08 = "08i420lx329py3slc99r73hysdnjbc12nm15fs17f505c2zj7war";
+  sgr-iosevka-fixed-ss09 = "0zc9wmxjrpzss7cdczg6af6sckdr22k0q9gj90hggyyjlc08cvz0";
+  sgr-iosevka-fixed-ss10 = "15qzf9zir1rqfpfspkgy9azf6m73lgpl79xhidf47hkvcw9zxjr7";
+  sgr-iosevka-fixed-ss11 = "1z6kji0h5vb3my47h2ccdl2vafh58pyqwp83yy3xgsvsj2qd0835";
+  sgr-iosevka-fixed-ss12 = "0wyk8kyllm35wlsqkxgh3sxvn3f52w7kicq64hdax8k8piaj584x";
+  sgr-iosevka-fixed-ss13 = "052jrfqwi4qbs9k9mqmdk2s82qb8q6175ajy3f6186grnzd73nnq";
+  sgr-iosevka-fixed-ss14 = "0wba9g5q8h5n5c50rncbbkbkc06xs9zxydxz1b0a6dl37drgmvkf";
+  sgr-iosevka-fixed-ss15 = "1kds5pl4vxcniksfp4mslpfr0ba30m754w7vxvzvqamgazmyf0pp";
+  sgr-iosevka-fixed-ss16 = "12hb9laxbhkbgf2rnbzq7zwwl7bg3n3n2yyjlr3vlsik5kd7aznz";
+  sgr-iosevka-fixed-ss17 = "18rvf78xif6p06nzha9nvp725f6mr79f1rk0a6n7ifh1ygdy4lvx";
+  sgr-iosevka-fixed-ss18 = "019gzj9s3wh3i9bxalazx9x8nfljf191idh6ygxpqjz4z3yzxh9n";
+  sgr-iosevka-slab = "0l9bcvrfbxp0pi3hj3zlirq800h63dyqf8dy307r7xg8m3l48xgr";
+  sgr-iosevka-ss01 = "1rb49rx12vgdjvkbyyg63pmxbwqd4v5cfvn5q3k2q4w5m3yhsbm9";
+  sgr-iosevka-ss02 = "07xz0iayqk2hqalmrj8c7kp8b80d6qgazrxwvs22y8nymignzq2s";
+  sgr-iosevka-ss03 = "0skq1kqmkwhs9d1p0lpksxqdgvpjz2krlfqa7idq1sdykpwsvmhi";
+  sgr-iosevka-ss04 = "0cgjh4c3vmmcgb43g0l2dmwcwnwwwqkrr80b9rsbrx43v6lkavda";
+  sgr-iosevka-ss05 = "16y8rm0byaf2xqh31h4vfan6il2m98a225nv3vsb7f42ga185vw0";
+  sgr-iosevka-ss06 = "0v9nd1h0gzgwa5sw9lrxvd5g77y9wn3fqsw86ivpsqn1vmgpqrzq";
+  sgr-iosevka-ss07 = "1h49qx02kn683ax3vh090r7fwlq7ya802zywcws2b9h2hs6p799x";
+  sgr-iosevka-ss08 = "1zk08x7chnj1ach4ghh26kr9kndzlgzzsrrw9aa3f0s7qk1lx2yg";
+  sgr-iosevka-ss09 = "12mrzd7viia71r9ixw1bzsqfaycxpl8zf20qv83ndbjsgzxh9ary";
+  sgr-iosevka-ss10 = "1cq8ii94jdskd0p5g2iigprbzzs3qnjxj7m2rkhl8mricwxdxxs4";
+  sgr-iosevka-ss11 = "1wmzaqcy0xy831010fsdhlm3aly2j01j7z10ka83ga3h8ymg1wla";
+  sgr-iosevka-ss12 = "00xfyvf50ykippnr1cfxy17s0k0gqkgx61vf7x9dmsgl2y6qigpl";
+  sgr-iosevka-ss13 = "0ynmx67c96qslzggjign8g3q7k11ny0mdrdwa7zwi2p0mm61n2jd";
+  sgr-iosevka-ss14 = "19s3a6csc4wq4cjjc2qll8fv00hmzsp5z7hwaq09wls8swz5kmmq";
+  sgr-iosevka-ss15 = "0d8ljkjcf0y263lwpnlh07305k6xlznk9gysk63dhcyxv0ajhrq1";
+  sgr-iosevka-ss16 = "12jbanrv31zxkh5a3a4w2wv0gqvj03mcs7v0zpnylp8jgfmpf8qa";
+  sgr-iosevka-ss17 = "1p088x66grn9bs4k1y6mxb0ka4y4vm74v6nbm74qsarjbyc0kx0a";
+  sgr-iosevka-ss18 = "0ff8lnhhgknj2sq40fkx7pqmiklnjl9ryjrnjcjviwzvs2dgzbmh";
+  sgr-iosevka-term = "0ny2p3hmzwbmzwxr8k1hbv0r3fqwngnz6kind1p3yddrqz8l5rrz";
+  sgr-iosevka-term-curly = "0qdys5q9fw273q58yvs71kqhal2mrh1400kf33mjp80pm1dy0j5j";
+  sgr-iosevka-term-curly-slab = "1bfn60arcb78lllf1lpdi2gscazvy3k9irp3ik0x12qdf9jgzgw0";
+  sgr-iosevka-term-slab = "1grdywa132zl3m5vf7w47lq7wgk6p5n8nab6rgg7pim839f1cn9q";
+  sgr-iosevka-term-ss01 = "14an4f8gm741zz22g854zxbfys2z33sf20kjrlzdp239376k72b7";
+  sgr-iosevka-term-ss02 = "0lqzcn4ykvkvylnlp4c1cfcl72hy3i18q15zng79d8v439w7cbds";
+  sgr-iosevka-term-ss03 = "0kmfmdv5rvfgm8p85dcqb28fsmkwsrgpjkjh1n787nvd2vs96l23";
+  sgr-iosevka-term-ss04 = "0p6hspr95p8hxas05rgp2dq00425i7nnz3nbyfrv4mnjzj66ir60";
+  sgr-iosevka-term-ss05 = "0izgz7rgjivzzvqywj3d2gma2sh83nhvc4scb7x3cbwwkzg9m5jx";
+  sgr-iosevka-term-ss06 = "0syp2mqnqq2gs4zsa3vvx0yz7pa23s995jc8sjrh01la6kpdk332";
+  sgr-iosevka-term-ss07 = "0dzfrw30aych0a0ic643w11ww42rncgyzvm5fkgqnkj1zjsdpgsw";
+  sgr-iosevka-term-ss08 = "0d9b2rwcdpwbdlsyjcd3qd0pip9km4hg9ihjymsi3xj7bihd0wp5";
+  sgr-iosevka-term-ss09 = "06bbj7c99wpjfh7ib7990nayxvbwy69ijlrjbi2mj45pm5i5lswq";
+  sgr-iosevka-term-ss10 = "1i6cfzgbnga999851k7gg6b5awq1i9253fz8sngsb6b34c45zw5c";
+  sgr-iosevka-term-ss11 = "1jb4lg0cjwv8xvhc5j9qp921zawgp2say6dnj6zncv0ys0rs6qwm";
+  sgr-iosevka-term-ss12 = "01w3vj7pw0714r6xp4rq5rlirch9h2d22mk76hsnqb0igzhlkvhy";
+  sgr-iosevka-term-ss13 = "0ywjr4j31v31z1cvvz7jvn7mcj2zhdpgljmvsfvix1j26cy5lr95";
+  sgr-iosevka-term-ss14 = "1cxsxriayzvrxzr3i6k6dwq08ywl9dk78iz4jqgy5jvrh942km0w";
+  sgr-iosevka-term-ss15 = "0j6rvsww2783hrdca3hfvv02s2whswwld7icf0bijdb3p799qi6w";
+  sgr-iosevka-term-ss16 = "0hgi40g030s1ylnp1whxz47wg2lzzqwhblx894dzz7rpnwbgff38";
+  sgr-iosevka-term-ss17 = "0hbdhc3z75n814r2xffnw6lnkwc31p0fmrvsan3z0db35c5kz54i";
+  sgr-iosevka-term-ss18 = "18c3i4l4j9wi7rx191hzmhlc8zblyqpx7bhq9g2lxs9asp8svqsa";
 }
--- a/pkgs/desktops/pantheon/third-party/pantheon-tweaks/default.nix
+++ b/pkgs/desktops/pantheon/third-party/pantheon-tweaks/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "pantheon-tweaks";
-  version = "1.1.0";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "pantheon-tweaks";
    repo = pname;
    rev = version;
-    sha256 = "sha256-wj9bvcES8JAgDtW0Damfd8VQNLK+SCFTDVWp/nYGcgI=";
+    sha256 = "sha256-KYnrQnh/Zz3EjMAqasdk2CZMXzw15txKtPm/K5+FzhI=";
  };

  patches = [
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@ -1,5 +1,4 @@
 { mkXfceDerivation
-, fetchpatch
 , lib
 , docbook_xsl
 , exo
@ -22,18 +21,9 @@
 let unwrapped = mkXfceDerivation {
  category = "xfce";
  pname = "thunar";
-  version = "4.18.7";
+  version = "4.18.8";

-  sha256 = "sha256-pxIblhC40X0wdE6+uvmV5ypp4sOZtzn/evcS33PlNpU=";
-
-  patches = [
-    # Fix log spam with new GLib
-    # https://gitlab.xfce.org/xfce/thunar/-/issues/1204
-    (fetchpatch {
-      url = "https://gitlab.xfce.org/xfce/thunar/-/commit/2f06fcdbedbc59d9f90ccd3df07fce417cea391d.patch";
-      sha256 = "sha256-nvYakT4GJkQYmubgZF8GJIA/m7+6ZPbmD0HSgMcCh10=";
-    })
-  ];
+  sha256 = "sha256-+VS8Mn9J8VySNEKUMq4xUXXvVgMpWkNVdpv5dzxhZ/M=";

  nativeBuildInputs = [
    docbook_xsl
--- a/pkgs/development/compilers/vlang/default.nix
+++ b/pkgs/development/compilers/vlang/default.nix
@ -97,6 +97,7 @@ stdenv.mkDerivation {
    $out/lib/v -v $out/lib/cmd/tools/vdoc
    $out/lib/v -v $out/lib/cmd/tools/vast
    $out/lib/v -v $out/lib/cmd/tools/vvet
+    $out/lib/v -v $out/lib/cmd/tools/vcreate

    runHook postInstall
  '';
--- a/pkgs/development/libraries/audio/zix/default.nix
+++ b/pkgs/development/libraries/audio/zix/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "zix";
-  version = "unstable-2023-02-13";
+  version = "0.4.2";

  src = fetchFromGitLab {
    owner = "drobilla";
    repo = pname;
-    rev = "262d4a1522c38be0588746e874159da5c7bb457d";
-    hash = "sha256-3vuefgnirM4ksK3j9sjBHgOmx0JpL+6tCPb69/7jI00=";
+    rev = "v${version}";
+    hash = "sha256-nMm3Mdqc4ncCae8SoyGxZYURzmXLNcp1GjsSExfB6x4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@ -3,7 +3,7 @@
 , profilingLibraries ? false
 , withGd ? false
 , withLibcrypt? false
-, buildPackages
+, pkgsBuildBuild
 , libgcc
 }:

@ -95,17 +95,26 @@ in
        "user-defined-trusted-dirs=${libgcc}/lib"
      ];

-    postInstall = previousAttrs.postInstall + (if stdenv.hostPlatform == stdenv.buildPlatform then ''
+    postInstall = previousAttrs.postInstall + (if stdenv.buildPlatform.canExecute stdenv.hostPlatform then ''
      echo SUPPORTED-LOCALES=C.UTF-8/UTF-8 > ../glibc-2*/localedata/SUPPORTED
      make -j''${NIX_BUILD_CORES:-1} localedata/install-locales
-    '' else lib.optionalString stdenv.buildPlatform.isLinux ''
+    '' else lib.optionalString stdenv.buildPlatform.isLinux
      # This is based on http://www.linuxfromscratch.org/lfs/view/development/chapter06/glibc.html
      # Instead of using their patch to build a build-native localedef,
-      # we simply use the one from buildPackages
+      # we simply use the one from pkgsBuildBuild.
+      #
+      # Note that we can't use pkgsBuildHost (aka buildPackages) here, because
+      # that will cause an eval-time infinite recursion: "buildPackages.glibc
+      # depended on buildPackages.libgcc, which, since it's GCC, depends on the
+      # target's bintools, which depend on the target's glibc, which, again,
+      # depends on buildPackages.glibc, causing an infinute recursion when
+      # evaluating buildPackages.glibc when glibc hasn't come from stdenv
+      # (e.g. on musl)." https://github.com/NixOS/nixpkgs/pull/259964
+    ''
      pushd ../glibc-2*/localedata
      export I18NPATH=$PWD GCONV_PATH=$PWD/../iconvdata
-      mkdir -p $NIX_BUILD_TOP/${buildPackages.glibc}/lib/locale
-      ${lib.getBin buildPackages.glibc}/bin/localedef \
+      mkdir -p $NIX_BUILD_TOP/${pkgsBuildBuild.glibc}/lib/locale
+      ${lib.getBin pkgsBuildBuild.glibc}/bin/localedef \
        --alias-file=../intl/locale.alias \
        -i locales/C \
        -f charmaps/UTF-8 \
@ -115,7 +124,7 @@ in
          else
            "--big-endian"} \
        C.UTF-8
-      cp -r $NIX_BUILD_TOP/${buildPackages.glibc}/lib/locale $out/lib
+      cp -r $NIX_BUILD_TOP/${pkgsBuildBuild.glibc}/lib/locale $out/lib
      popd
    '') + ''

--- a/pkgs/development/libraries/kweathercore/default.nix
+++ b/pkgs/development/libraries/kweathercore/default.nix
@ -9,14 +9,14 @@

 mkDerivation rec {
  pname = "kweathercore";
-  version = "0.6";
+  version = "0.7";

  src = fetchFromGitLab {
    domain = "invent.kde.org";
    owner = "libraries";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-LIgUSXKHcRqcBwGTRxU5Z4eHuWmPLerorlrnI6Cf9k4=";
+    sha256 = "sha256-CnnoPkgz97SfDG13zfyIWweVnp2oxAChTPKFxJC+L8A=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/libvarlink/default.nix
+++ b/pkgs/development/libraries/libvarlink/default.nix
@ -19,18 +19,15 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "sha256-oUy9HhybNMjRBWoqqal1Mw8cC5RddgN4izxAl0cgnKE=";
  };

-  nativeBuildInputs = [ meson ninja ];
+  nativeBuildInputs = [ meson ninja python3 ];

  postPatch = ''
-    substituteInPlace varlink-wrapper.py \
-      --replace "/usr/bin/env python3" "${python3}/bin/python3"
-
    # test-object: ../lib/test-object.c:129: main: Assertion `setlocale(LC_NUMERIC, "de_DE.UTF-8") != 0' failed.
    # PR that added it https://github.com/varlink/libvarlink/pull/27
    substituteInPlace lib/test-object.c \
      --replace 'assert(setlocale(LC_NUMERIC, "de_DE.UTF-8") != 0);' ""

-    patchShebangs lib/test-symbols.sh
+    patchShebangs lib/test-symbols.sh varlink-wrapper.py
  '';

  doCheck = true;
--- a/pkgs/development/libraries/openmpi/default.nix
+++ b/pkgs/development/libraries/openmpi/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, gfortran, perl, libnl
 , rdma-core, zlib, numactl, libevent, hwloc, targetPackages, symlinkJoin
-, libpsm2, libfabric, pmix, ucx
+, libpsm2, libfabric, pmix, ucx, ucc
 , config
 # Enable CUDA support
 , cudaSupport ? config.cudaSupport, cudatoolkit
@ -25,11 +25,11 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "openmpi";
-  version = "4.1.5";
+  version = "4.1.6";

  src = with lib.versions; fetchurl {
    url = "https://www.open-mpi.org/software/ompi/v${major version}.${minor version}/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-pkCYa8JXOJ3TeYhv2uYmTIz6VryYtxzjrj372M5h2+M=";
+    sha256 = "sha256-90CZRIVRbetjtTEa8SLCZRefUyig2FelZ7hdsAsR5BU=";
  };

  postPatch = ''
@ -46,7 +46,7 @@ in stdenv.mkDerivation rec {
  outputs = [ "out" "man" ];

  buildInputs = [ zlib ]
-    ++ lib.optionals stdenv.isLinux [ libnl numactl pmix ucx ]
+    ++ lib.optionals stdenv.isLinux [ libnl numactl pmix ucx ucc ]
    ++ lib.optionals cudaSupport [ cudatoolkit ]
    ++ [ libevent hwloc ]
    ++ lib.optional (stdenv.isLinux || stdenv.isFreeBSD) rdma-core
--- a/pkgs/development/libraries/pmix/default.nix
+++ b/pkgs/development/libraries/pmix/default.nix
@ -1,16 +1,17 @@
 { lib, stdenv, fetchFromGitHub, perl, autoconf, automake
-, libtool, flex, libevent, hwloc, munge, zlib, pandoc
+, libtool, python3, flex, libevent, hwloc, munge, zlib, pandoc, gitMinimal
 } :

 stdenv.mkDerivation rec {
  pname = "pmix";
-  version = "3.2.4";
+  version = "5.0.1";

  src = fetchFromGitHub {
    repo = "openpmix";
    owner = "openpmix";
    rev = "v${version}";
-    sha256 = "sha256-79zTZm549VRsqeziCuBT6l4jTJ6D/gZaMAvgHZm7jn4=";
+    hash = "sha256-ZuuzQ8j5zqQ/9mBFEODAaoX9/doWB9Nt9Sl75JkJyqU=";
+    fetchSubmodules = true;
  };

  postPatch = ''
@ -18,14 +19,25 @@ stdenv.mkDerivation rec {
    patchShebangs ./config
  '';

-  nativeBuildInputs = [ pandoc perl autoconf automake libtool flex ];
+  nativeBuildInputs = [
+    pandoc
+    perl
+    autoconf
+    automake
+    libtool
+    flex
+    gitMinimal
+    python3
+  ];

  buildInputs = [ libevent hwloc munge zlib ];

  configureFlags = [
    "--with-libevent=${lib.getDev libevent}"
+    "--with-libevent-libdir=${lib.getLib libevent}/lib"
    "--with-munge=${munge}"
    "--with-hwloc=${lib.getDev hwloc}"
+    "--with-hwloc-libdir=${lib.getLib hwloc}/lib"
  ];

  preConfigure = ''
--- a/pkgs/development/libraries/science/chemistry/tblite/python.nix
+++ b/pkgs/development/libraries/science/chemistry/tblite/python.nix
@ -1,4 +1,5 @@
 { buildPythonPackage
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@ -42,8 +43,17 @@ buildPythonPackage {

  propagatedBuildInputs = [ tblite simple-dftd3 cffi numpy ];

-  # Add multicharge to the meson deps; otherwise we get missing mod_multicharge errors
-  patches = [ ./0001-fix-multicharge-dep-needed-for-static-compilation.patch ];
+
+  patches = [
+    # Add multicharge to the meson deps; otherwise we get missing mod_multicharge errors
+    ./0001-fix-multicharge-dep-needed-for-static-compilation.patch
+
+    # Toml-f 0.4.0 compatibility https://github.com/tblite/tblite/pull/108
+    (fetchpatch {
+      url = "https://github.com/tblite/tblite/commit/e4255519b58a5198a5fa8f3073bef1c78a4bbdbe.diff";
+      hash = "sha256-BMwYsdWfK+vG3BFgzusLYfwo0WXrYSPxJoEJIyOvbPg=";
+    })
+  ];

  format = "other";
  pythonImportsCheck = [ "tblite" "tblite.interface" ];
--- a/pkgs/development/libraries/utf8proc/default.nix
+++ b/pkgs/development/libraries/utf8proc/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "utf8proc";
-  version = "2.8.0";
+  version = "2.9.0";

  src = fetchFromGitHub {
    owner = "JuliaStrings";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-/lSD78kj133rpcSAOh8T8XFW/Z0c3JKkGQM5Z6DcMtU=";
+    sha256 = "sha256-Sgh8vTbclUV+lFZdR29PtNUy8F+9L/OAXk647B+l2mg=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@ -5,37 +5,63 @@
 , autoreconfHook
 , util-linux
 , openssl
+# The primary --enable-XXX variant. 'all' enables most features, but causes build-errors for some software,
+# requiring to build a special variant for that software. Example: 'haproxy'
+, variant ? "all"
+, extraConfigureFlags ? []
+, enableLto ? !(stdenv.isDarwin || stdenv.hostPlatform.isStatic || stdenv.cc.isClang)
 }:
-
-stdenv.mkDerivation rec {
-  pname = "wolfssl";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "wolfssl-${variant}";
  version = "5.6.3";

  src = fetchFromGitHub {
    owner = "wolfSSL";
    repo = "wolfssl";
-    rev = "refs/tags/v${version}-stable";
+    rev = "refs/tags/v${finalAttrs.version}-stable";
    hash = "sha256-UN4zs+Rxh/bsLD1BQA+f1YN/UOJ6OB2HduhoetEp10Y=";
  };

  postPatch = ''
    patchShebangs ./scripts
-    # ocsp tests require network access
-    sed -i -e '/ocsp\.test/d' -e '/ocsp-stapling\.test/d' scripts/include.am
+    # ocsp stapling tests require network access, so skip them
+    sed -i -e'2s/.*/exit 77/' scripts/ocsp-stapling.test
    # ensure test detects musl-based systems too
    substituteInPlace scripts/ocsp-stapling2.test \
      --replace '"linux-gnu"' '"linux-"'
  '';

-  # Almost same as Debian but for now using --enable-all --enable-reproducible-build instead of --enable-distro to ensure options.h gets installed
  configureFlags = [
-    "--enable-all"
-    "--enable-base64encode"
+    "--enable-${variant}"
+    "--enable-reproducible-build"
+  ] ++ lib.optionals (variant == "all") [
+    # Extra feature flags to add while building the 'all' variant.
+    # Since they conflict while building other variants, only specify them for this one.
    "--enable-pkcs11"
    "--enable-writedup"
-    "--enable-reproducible-build"
-    "--enable-tls13"
-  ];
+    "--enable-base64encode"
+  ] ++ [
+    # We're not on tiny embedded machines.
+    # Increase TLS session cache from 33 sessions to 20k.
+    "--enable-bigcache"
+
+    # Use WolfSSL's Single Precision Math with timing-resistant cryptography.
+    "--enable-sp=yes${lib.optionalString (!stdenv.isx86_32) ",asm"}"
+    "--enable-sp-math-all"
+    "--enable-harden"
+  ] ++ lib.optionals (stdenv.hostPlatform.isx86_64) [
+    # Enable AVX/AVX2/AES-NI instructions, gated by runtime detection via CPUID.
+    "--enable-intelasm"
+    "--enable-aesni"
+  ] ++ lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [
+    # No runtime detection under ARM and no platform function checks like for X86.
+    # However, all ARM macOS systems have the supported extensions autodetected in the configure script.
+    "--enable-armasm=inline"
+  ] ++ extraConfigureFlags;
+
+  # LTO should help with the C implementations.
+  env.NIX_CFLAGS_COMPILE = lib.optionalString enableLto "-flto";
+  env.NIX_LDFLAGS_COMPILE = lib.optionalString enableLto "-flto";

  outputs = [
    "dev"
@ -60,19 +86,19 @@ stdenv.mkDerivation rec {
  ];

  postInstall = ''
-     # fix recursive cycle:
-     # wolfssl-config points to dev, dev propagates bin
-     moveToOutput bin/wolfssl-config "$dev"
-     # moveToOutput also removes "$out" so recreate it
-     mkdir -p "$out"
+    # fix recursive cycle:
+    # wolfssl-config points to dev, dev propagates bin
+    moveToOutput bin/wolfssl-config "$dev"
+    # moveToOutput also removes "$out" so recreate it
+    mkdir -p "$out"
  '';

  meta = with lib; {
    description = "A small, fast, portable implementation of TLS/SSL for embedded devices";
    homepage = "https://www.wolfssl.com/";
-    changelog = "https://github.com/wolfSSL/wolfssl/releases/tag/v${version}-stable";
+    changelog = "https://github.com/wolfSSL/wolfssl/releases/tag/v${finalAttrs.version}-stable";
    platforms = platforms.all;
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ fab ];
+    maintainers = with maintainers; [ fab vifino ];
  };
-}
+})
--- a/pkgs/development/misc/breakpad/default.nix
+++ b/pkgs/development/misc/breakpad/default.nix
@ -1,30 +1,27 @@
-{ lib, stdenv, fetchgit }:
+{ lib, stdenv, fetchgit, zlib }:
 let
  lss = fetchgit {
    url = "https://chromium.googlesource.com/linux-syscall-support";
-    rev = "d9ad2969b369a9f1c455fef92d04c7628f7f9eb8";
-    sha256 = "952dv+ZE1ge/WF5RyHmEqht+AofoRHKAeFmGasVF9BA=";
+    rev = "v2022.10.12";
+    hash = "sha256-rF10v5oH4u9i9vnmFCVVl2Ew3h+QTiOsW64HeB0nRQU=";
  };
-in stdenv.mkDerivation {
+in stdenv.mkDerivation (finalAttrs: {
  pname = "breakpad";

-  version = "unstable-3b3469e";
+  version = "2023.01.27";

  src = fetchgit {
    url = "https://chromium.googlesource.com/breakpad/breakpad";
-    rev = "3b3469e9ed0de3d02e4450b9b95014a4266cf2ff";
-    sha256 = "bRGOBrGPK+Zxp+KK+E5MFkYlDUNVhVeInVSwq+eCAF0=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-8msKz0K10r13TwM3oS6GCIlMdf8k8HBKfKJkPmrUrIs=";
  };

+  buildInputs = [ zlib ];
+
  postUnpack = ''
    ln -s ${lss} $sourceRoot/src/third_party/lss
  '';

-  postPatch = ''
-    substituteInPlace src/client/linux/handler/exception_handler.cc \
-      --replace "max(16384" "max(static_cast<long>(16384)"
-  '';
-
  meta = with lib; {
    description = "An open-source multi-platform crash reporting system";
    homepage = "https://chromium.googlesource.com/breakpad";
@ -32,4 +29,4 @@ in stdenv.mkDerivation {
    maintainers = with maintainers; [ berberman ];
    platforms = platforms.all;
  };
-}
+})
--- a/pkgs/development/ocaml-modules/brr/default.nix
+++ b/pkgs/development/ocaml-modules/brr/default.nix
@ -2,18 +2,17 @@
 , ocaml, findlib, ocamlbuild, topkg
 , js_of_ocaml-compiler
 , js_of_ocaml-toplevel
-, note
 }:

 stdenv.mkDerivation rec {
  pname = "ocaml${ocaml.version}-brr";
-  version = "0.0.4";
+  version = "0.0.6";
  src = fetchurl {
    url = "https://erratique.ch/software/brr/releases/brr-${version}.tbz";
-    hash = "sha256-v+Ik1tdRBVnNDqhmNoJuLelL3k5OhxIsUorGdTb9sbw=";
+    hash = "sha256-paYZlzujXsG1S+s/4/kAPBlDuV1Ljorw7okAu4qaAV0=";
  };
  buildInputs = [ ocaml findlib ocamlbuild topkg ];
-  propagatedBuildInputs = [ js_of_ocaml-compiler js_of_ocaml-toplevel note ];
+  propagatedBuildInputs = [ js_of_ocaml-compiler js_of_ocaml-toplevel ];
  inherit (topkg) buildPhase installPhase;

  meta = {
--- a/pkgs/development/ocaml-modules/cooltt/default.nix
+++ b/pkgs/development/ocaml-modules/cooltt/default.nix
@ -2,6 +2,7 @@
 , fetchFromGitHub
 , fetchurl
 , buildDunePackage
+, bos
 , bwd
 , cmdliner
 , containers
@ -16,22 +17,21 @@
 , yuujinchou
 , ounit2
 , qcheck
+, qcheck-core
 }:

 let
  bantorra = buildDunePackage rec {
    pname = "bantorra";
-    version = "unstable-2022-04-20";
+    version = "unstable-2022-05-08";
    src = fetchFromGitHub {
      owner = "RedPRL";
      repo = "bantorra";
-      rev = "1e78633d9a2ef7104552a24585bb8bea36d4117b";
-      sha256 = "sha256:15v1cggm7awp11iwl3lzpaar91jzivhdxggp5mr48gd28kfipzk2";
+      rev = "d05c34295727dd06d0ac4416dc2e258732e8593d";
+      hash = "sha256-s6lUTs3VRl6YhLAn3PO4aniANhFp8ytoTsFAgcOlee4=";
    };

-    duneVersion = "3";
-
-    propagatedBuildInputs = [ ezjsonm findlib ];
+    propagatedBuildInputs = [ bos ezjsonm findlib ];

    meta = {
      description = "Extensible Library Management and Path Resolution";
@ -41,19 +41,18 @@ let
  };
  kado = buildDunePackage rec {
    pname = "kado";
-    version = "unstable-2022-04-30";
+    version = "unstable-2023-10-03";
    src = fetchFromGitHub {
      owner = "RedPRL";
      repo = "kado";
-      rev = "8dce50e7d759d482b82565090e550d3860d64729";
-      sha256 = "sha256:1xb754fha4s0bgjfqjxzqljvalmkfdwdn5y4ycsp51wiah235bsy";
+      rev = "6b2e9ba2095e294e6e0fc6febc280d80c5799c2b";
+      hash = "sha256-fP6Ade3mJeyOMjuDIvrW88m6E3jfb2z3L8ufgloz4Tc=";
    };

-    duneVersion = "3";
-
    propagatedBuildInputs = [ bwd ];

    doCheck = true;
+    checkInputs = [ qcheck-core ];

    meta = {
      description = "Cofibrations in Cartecian Cubical Type Theory";
@ -65,16 +64,15 @@ in

 buildDunePackage {
  pname = "cooltt";
-  version = "unstable-2022-04-28";
+  version = "unstable-2023-10-03";

-  minimalOCamlVersion = "4.13";
-  duneVersion = "3";
+  minimalOCamlVersion = "5.0";

  src = fetchFromGitHub {
    owner = "RedPRL";
    repo = "cooltt";
-    rev = "88511e10cb9e17286f585882dee334f3d8ace47c";
-    sha256 = "sha256:1n9bh86r2n9s3mm7ayfzwjbnjqcphpsf8yqnf4whd3yi930sqisw";
+    rev = "a5eaf4db195b5166a7102d47d42724f59cf3de19";
+    hash = "sha256-48bEf59rtPRrCRjab7+GxppjfR2c87HjQ+uKY2Bag0I=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/ocaml-modules/hacl-star/default.nix
+++ b/pkgs/development/ocaml-modules/hacl-star/default.nix
@ -4,9 +4,9 @@
 buildDunePackage {
  pname = "hacl-star";

-  inherit (hacl-star-raw) version src meta doCheck minimalOCamlVersion;
+  inherit (hacl-star-raw) version src meta doCheck;

-  duneVersion = "3";
+  minimalOCamlVersion = "4.08";

  propagatedBuildInputs = [
    hacl-star-raw
--- a/pkgs/development/ocaml-modules/hacl-star/raw.nix
+++ b/pkgs/development/ocaml-modules/hacl-star/raw.nix
@ -12,11 +12,11 @@
 }:
 stdenv.mkDerivation rec {
  pname = "ocaml${ocaml.version}-hacl-star-raw";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchzip {
    url = "https://github.com/cryspen/hacl-packages/releases/download/ocaml-v${version}/hacl-star.${version}.tar.gz";
-    sha256 = "sha256-jJtxVYhQgP8ItfLhQ2wcF8RKNRnYhB2j0nR7/YH1NfY=";
+    hash = "sha256-TcAEaJou4BOVXSz5DYewzKfvIpjXmhLAlgF0hlq3ToQ=";
    stripRoot = false;
  };

@ -24,8 +24,6 @@ stdenv.mkDerivation rec {
    ./aligned-alloc.patch
  ];

-  minimalOCamlVersion = "4.08";
-
  # strictoverflow is disabled because it breaks aarch64-darwin
  hardeningDisable = [ "strictoverflow" ];

--- a/pkgs/development/ocaml-modules/note/default.nix
+++ b/pkgs/development/ocaml-modules/note/default.nix
@ -1,18 +1,20 @@
-{ stdenv, lib, fetchurl, ocaml, findlib, ocamlbuild, topkg }:
+{ stdenv, lib, fetchurl, ocaml, findlib, ocamlbuild, topkg, brr }:

 lib.throwIfNot (lib.versionAtLeast ocaml.version "4.08")
  "note is not available for OCaml ${ocaml.version}"

 stdenv.mkDerivation rec {
  pname = "ocaml${ocaml.version}-note";
-  version = "0.0.2";
+  version = "0.0.3";
  src = fetchurl {
    url = "https://erratique.ch/software/note/releases/note-${version}.tbz";
-    hash = "sha256-b35XcaDUXQLqwkNfsJKX5A1q1pAhw/mgdwyOdacZiiY=";
+    hash = "sha256-ZZOvCnyz7UWzFtGFI1uC0ZApzyylgZYM/HYIXGVXY2k=";
  };
  buildInputs = [ ocaml findlib ocamlbuild topkg ];
  inherit (topkg) buildPhase installPhase;

+  propagatedBuildInputs = [ brr ];
+
  meta = {
    homepage = "https://erratique.ch/software/note";
    description = "An OCaml module for functional reactive programming";
--- a/pkgs/development/ocaml-modules/sail/default.nix
+++ b/pkgs/development/ocaml-modules/sail/default.nix
@ -13,20 +13,20 @@
 , z3
 , linksem
 , num
+, yojson
 }:

 buildDunePackage rec {
  pname = "sail";
-  version = "0.15";
+  version = "0.16";

  src = fetchFromGitHub {
    owner = "rems-project";
    repo = "sail";
    rev = version;
-    hash = "sha256-eNdFOSzkniNvSCZeORRJ/IYAu+9P4HSouwmhd4BQLPk=";
+    hash = "sha256-HY/rgWi0S7ZiAWZF0fVIRK6fpoJ7Xp5EQcxoPRCPJ5Y=";
  };

-  duneVersion = "3";
  minimalOCamlVersion = "4.08";

  nativeBuildInputs = [
@ -43,6 +43,7 @@ buildDunePackage rec {
    linenoise
    pprint
    linksem
+    yojson
  ];

  preBuild = ''
--- a/pkgs/development/ocaml-modules/yuujinchou/default.nix
+++ b/pkgs/development/ocaml-modules/yuujinchou/default.nix
@ -4,8 +4,8 @@
 }:

 let params = if lib.versionAtLeast ocaml.version "5.0" then {
-    version = "4.0.0";
-    hash = "sha256-yNLN5bBe4aft9Rl5VHmlOYTlnCdR2NgDWsc3uJHaZy4=";
+    version = "5.1.0";
+    hash = "sha256-J3qkytgJkk2gT83KJ47nNM4cXqVHbx4iTPK+fLwR7Wk=";
    propagatedBuildInputs = [ algaeff bwd ];
  } else {
    version = "2.0.0";
@ -18,7 +18,6 @@ buildDunePackage rec {
  inherit (params) version;

  minimalOCamlVersion = "4.12";
-  duneVersion = "3";

  src = fetchFromGitHub {
    owner = "RedPRL";
--- a/pkgs/development/python-modules/accuweather/default.nix
+++ b/pkgs/development/python-modules/accuweather/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "accuweather";
-  version = "1.0.0";
+  version = "2.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "bieniu";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-CWPhdu0lttYhAS6hzyKPL3vtNRVqbDexxY6nvMya3jA=";
+    hash = "sha256-elpVclH/sVQHEp3kTiwbDproJcB85F7m5sEjXwSEtNk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.73";
+  version = "9.2.74";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-wMHyp6l7a5MuVX/q1QVfwZbuqBT6NbFltZsGopCjj3I=";
+    hash = "sha256-lZJLYIZ44FXGavDCrO90DYSl4yaNDpAYeIIihk5Bk14=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "aioesphomeapi";
-  version = "18.1.0";
+  version = "18.2.0";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "esphome";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-aKE2/xVkO2uYg9BuDT9/ZxcKB9rARCipPn7B/eeth9M=";
+    hash = "sha256-uOF9VSASzGA4pVW3puQtGrr2dy7sRESa1a6DPUsMmL4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aiosmtplib/default.nix
+++ b/pkgs/development/python-modules/aiosmtplib/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "aiosmtplib";
-  version = "2.0.2";
+  version = "3.0.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "cole";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Wo9WH3fwGN1upLAyj6aThxpQE7hortISjaCATTPee40=";
+    hash = "sha256-A9pvHj2riIHCd1F+ve6aLdbtl3tPPDovV1AZeWNeOEo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aiostream/default.nix
+++ b/pkgs/development/python-modules/aiostream/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "aiostream";
-  version = "0.5.1";
+  version = "0.5.2";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "vxgmichel";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-YdVvUP1b/NfXpbJ83ktjtXaVLHS6CQUGCw+EVygB4fU=";
+    hash = "sha256-g2W2TtCh2ANPjeTdASVgEu+qKfz/Ugh1rDWJcFvOJpI=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.73";
+  version = "9.2.74";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "angr";
    rev = "refs/tags/v${version}";
-    hash = "sha256-WwgcKZWKM6x36AuynVHaDJgDt4B2b3K1ZaX9efxiDKc=";
+    hash = "sha256-8t7S+VR9AqYpaAP772Wn1foVy/XN9MiEUZb5+u47G+k=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.73";
+  version = "9.2.74";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-D6ZMZzuWoCSKSAEnVqU5iM4ttpeBNojofMW/vsV8gVw=";
+    hash = "sha256-n/51N1D5UI2FTKv7GBN/iPYE/+/o/2JnFTRee+1FVWg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@ -65,7 +65,7 @@
 }:
 let
  pname = "argilla";
-  version = "1.17.0";
+  version = "1.18.0";
  optional-dependencies = {
    server = [
      fastapi
@ -126,7 +126,7 @@ buildPythonPackage {
    owner = "argilla-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-ggw6ABPn3d+aOj+0ETKYWWTha/2Recdnp/LGBXG1HY4=";
+    hash = "sha256-2VWzmNMdd4WXSBrMSmclpjSZ9jDKNG7GbndUh8zLmgQ=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "auth0-python";
-  version = "4.4.2";
+  version = "4.5.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "auth0";
    repo = "auth0-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-RBkAuZQx7mBxVCpo5PoBiEge8+yTmp0XpcnxCkOsM6U=";
+    hash = "sha256-kWlfckSjBxgzLd1ND4M0btt/+zfSHj5h4V/uDLmnHaA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/autoit-ripper/default.nix
+++ b/pkgs/development/python-modules/autoit-ripper/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "autoit-ripper";
-  version = "1.1.0";
+  version = "1.1.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-fluG/2XlUh3kPtYtSotrP02c7kdmem92Hy1R93SaTzk=";
+    hash = "sha256-a30SDJdKoljWjV0O1sZ35NnQPFcJ0XOPcmTanozWpHY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aws-adfs/default.nix
+++ b/pkgs/development/python-modules/aws-adfs/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "aws-adfs";
-  version = "2.8.2";
+  version = "2.9.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "venth";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-hMM7Z0s9t5vetgskiy7nb1W/kKCKHe0Q3kT2ngUVADA=";
+    hash = "sha256-IZeEb87NX3fyw1hENF1LldbgbaXXPG3u2AiCeci6MIw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-containerservice";
-  version = "26.0.0";
+  version = "27.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-BpvnSqee5wodtMXPxo/pHCBk8Yy4yPnEdK164d9ILuM=";
+    hash = "sha256-IdGo2A65YiMJJ8S18Ji+FfnnylNhs8vFOQpfA91wgNM=";
  };

  propagatedBuildInputs = [
--- a/Show More
+++ b/Show More