Merge master into haskell-updates

lib/lists.nix

@@ -3,7 +3,7 @@
 { lib }:
 let
   inherit (lib.strings) toInt;
-  inherit (lib.trivial) compare min;
+  inherit (lib.trivial) compare min id;
   inherit (lib.attrsets) mapAttrs;
 in
 rec {
@@ -180,18 +180,18 @@ rec {
       else if len != 1 then multiple
       else head found;
 
-  /* Find the first element in the list matching the specified
+  /* Find the first index in the list matching the specified
      predicate or return `default` if no such element exists.
 
-     Type: findFirst :: (a -> bool) -> a -> [a] -> a
+     Type: findFirstIndex :: (a -> Bool) -> b -> [a] -> (Int | b)
 
      Example:
-       findFirst (x: x > 3) 7 [ 1 6 4 ]
-       => 6
-       findFirst (x: x > 9) 7 [ 1 6 4 ]
-       => 7
+       findFirstIndex (x: x > 3) null [ 0 6 4 ]
+       => 1
+       findFirstIndex (x: x > 9) null [ 0 6 4 ]
+       => null
   */
-  findFirst =
+  findFirstIndex =
     # Predicate
     pred:
     # Default value to return
@@ -229,7 +229,33 @@ rec {
     if resultIndex < 0 then
       default
     else
-      elemAt list resultIndex;
+      resultIndex;
+
+  /* Find the first element in the list matching the specified
+     predicate or return `default` if no such element exists.
+
+     Type: findFirst :: (a -> bool) -> a -> [a] -> a
+
+     Example:
+       findFirst (x: x > 3) 7 [ 1 6 4 ]
+       => 6
+       findFirst (x: x > 9) 7 [ 1 6 4 ]
+       => 7
+  */
+  findFirst =
+    # Predicate
+    pred:
+    # Default value to return
+    default:
+    # Input list
+    list:
+    let
+      index = findFirstIndex pred null list;
+    in
+    if index == null then
+      default
+    else
+      elemAt list index;
 
   /* Return true if function `pred` returns true for at least one
      element of `list`.
@@ -637,6 +663,32 @@ rec {
        else if start + count > len then len - start
        else count);
 
+  /* The common prefix of two lists.
+
+  Type: commonPrefix :: [a] -> [a] -> [a]
+
+  Example:
+    commonPrefix [ 1 2 3 4 5 6 ] [ 1 2 4 8 ]
+    => [ 1 2 ]
+    commonPrefix [ 1 2 3 ] [ 1 2 3 4 5 ]
+    => [ 1 2 3 ]
+    commonPrefix [ 1 2 3 ] [ 4 5 6 ]
+    => [ ]
+  */
+  commonPrefix =
+    list1:
+    list2:
+    let
+      # Zip the lists together into a list of booleans whether each element matches
+      matchings = zipListsWith (fst: snd: fst != snd) list1 list2;
+      # Find the first index where the elements don't match,
+      # which will then also be the length of the common prefix.
+      # If all elements match, we fall back to the length of the zipped list,
+      # which is the same as the length of the smaller list.
+      commonPrefixLength = findFirstIndex id (length matchings) matchings;
+    in
+    take commonPrefixLength list1;
+
   /* Return the last element of a list.
 
      This function throws an error if the list is empty.

lib/tests/misc.nix

@@ -500,6 +500,39 @@ runTests {
     expected = { a = [ 2 3 ]; b = [7]; c = [8];};
   };
 
+  testListCommonPrefixExample1 = {
+    expr = lists.commonPrefix [ 1 2 3 4 5 6 ] [ 1 2 4 8 ];
+    expected = [ 1 2 ];
+  };
+  testListCommonPrefixExample2 = {
+    expr = lists.commonPrefix [ 1 2 3 ] [ 1 2 3 4 5 ];
+    expected = [ 1 2 3 ];
+  };
+  testListCommonPrefixExample3 = {
+    expr = lists.commonPrefix [ 1 2 3 ] [ 4 5 6 ];
+    expected = [ ];
+  };
+  testListCommonPrefixEmpty = {
+    expr = lists.commonPrefix [ ] [ 1 2 3 ];
+    expected = [ ];
+  };
+  testListCommonPrefixSame = {
+    expr = lists.commonPrefix [ 1 2 3 ] [ 1 2 3 ];
+    expected = [ 1 2 3 ];
+  };
+  testListCommonPrefixLazy = {
+    expr = lists.commonPrefix [ 1 ] [ 1 (abort "lib.lists.commonPrefix shouldn't evaluate this")];
+    expected = [ 1 ];
+  };
+  # This would stack overflow if `commonPrefix` were implemented using recursion
+  testListCommonPrefixLong =
+    let
+      longList = genList (n: n) 100000;
+    in {
+      expr = lists.commonPrefix longList longList;
+      expected = longList;
+    };
+
   testSort = {
     expr = sort builtins.lessThan [ 40 2 30 42 ];
     expected = [2 30 40 42];
@@ -530,45 +563,55 @@ runTests {
     expected = false;
   };
 
-  testFindFirstExample1 = {
-    expr = findFirst (x: x > 3) 7 [ 1 6 4 ];
-    expected = 6;
+  testFindFirstIndexExample1 = {
+    expr = lists.findFirstIndex (x: x > 3) (abort "index found, so a default must not be evaluated") [ 1 6 4 ];
+    expected = 1;
   };
 
-  testFindFirstExample2 = {
-    expr = findFirst (x: x > 9) 7 [ 1 6 4 ];
-    expected = 7;
+  testFindFirstIndexExample2 = {
+    expr = lists.findFirstIndex (x: x > 9) "a very specific default" [ 1 6 4 ];
+    expected = "a very specific default";
   };
 
-  testFindFirstEmpty = {
-    expr = findFirst (abort "when the list is empty, the predicate is not needed") null [];
+  testFindFirstIndexEmpty = {
+    expr = lists.findFirstIndex (abort "when the list is empty, the predicate is not needed") null [];
     expected = null;
   };
 
-  testFindFirstSingleMatch = {
-    expr = findFirst (x: x == 5) null [ 5 ];
-    expected = 5;
+  testFindFirstIndexSingleMatch = {
+    expr = lists.findFirstIndex (x: x == 5) null [ 5 ];
+    expected = 0;
   };
 
-  testFindFirstSingleDefault = {
-    expr = findFirst (x: false) null [ (abort "if the predicate doesn't access the value, it must not be evaluated") ];
+  testFindFirstIndexSingleDefault = {
+    expr = lists.findFirstIndex (x: false) null [ (abort "if the predicate doesn't access the value, it must not be evaluated") ];
     expected = null;
   };
 
-  testFindFirstNone = {
-    expr = builtins.tryEval (findFirst (x: x == 2) null [ 1 (throw "the last element must be evaluated when there's no match") ]);
+  testFindFirstIndexNone = {
+    expr = builtins.tryEval (lists.findFirstIndex (x: x == 2) null [ 1 (throw "the last element must be evaluated when there's no match") ]);
     expected = { success = false; value = false; };
   };
 
   # Makes sure that the implementation doesn't cause a stack overflow
-  testFindFirstBig = {
-    expr = findFirst (x: x == 1000000) null (range 0 1000000);
+  testFindFirstIndexBig = {
+    expr = lists.findFirstIndex (x: x == 1000000) null (range 0 1000000);
     expected = 1000000;
   };
 
-  testFindFirstLazy = {
-    expr = findFirst (x: x == 1) 7 [ 1 (abort "list elements after the match must not be evaluated") ];
-    expected = 1;
+  testFindFirstIndexLazy = {
+    expr = lists.findFirstIndex (x: x == 1) null [ 1 (abort "list elements after the match must not be evaluated") ];
+    expected = 0;
+  };
+
+  testFindFirstExample1 = {
+    expr = lists.findFirst (x: x > 3) 7 [ 1 6 4 ];
+    expected = 6;
+  };
+
+  testFindFirstExample2 = {
+    expr = lists.findFirst (x: x > 9) 7 [ 1 6 4 ];
+    expected = 7;
   };
 
 # ATTRSETS

maintainers/maintainer-list.nix

@@ -1401,6 +1401,12 @@
     githubId = 37193992;
     name = "Arthur Teisseire";
   };
+  arti5an = {
+    email = "artis4n@outlook.com";
+    github = "arti5an";
+    githubId = 14922630;
+    name = "Richard Smith";
+  };
   artturin = {
     email = "artturin@artturin.com";
     matrix = "@artturin:matrix.org";
@@ -9963,6 +9969,12 @@
     githubId = 782440;
     name = "Luna Nova";
   };
+  lurkki = {
+    email = "jussi.kuokkanen@protonmail.com";
+    github = "Lurkki14";
+    githubId = 44469719;
+    name = "Jussi Kuokkanen";
+  };
   lux = {
     email = "lux@lux.name";
     github = "luxzeitlos";
@@ -15639,6 +15651,8 @@
   spalf = {
     email = "tom@tombarrett.xyz";
     name = "tom barrett";
+    github = "70m6";
+    githubId = 105207964;
   };
   spease = {
     email = "peasteven@gmail.com";

nixos/doc/manual/installation/installing.chapter.md

@@ -249,14 +249,14 @@ update /etc/fstab.
     which will be used by the boot partition.
 
     ```ShellSession
-    # parted /dev/sda -- mkpart primary 512MB -8GB
+    # parted /dev/sda -- mkpart root ext4 512MB -8GB
     ```
 
 3.  Next, add a *swap* partition. The size required will vary according
     to needs, here a 8GB one is created.
 
     ```ShellSession
-    # parted /dev/sda -- mkpart primary linux-swap -8GB 100%
+    # parted /dev/sda -- mkpart swap linux-swap -8GB 100%
     ```
 
     ::: {.note}
@@ -550,8 +550,8 @@ corresponding configuration Nix expression.
 ### Example partition schemes for NixOS on `/dev/sda` (UEFI)
 ```ShellSession
 # parted /dev/sda -- mklabel gpt
-# parted /dev/sda -- mkpart primary 512MB -8GB
-# parted /dev/sda -- mkpart primary linux-swap -8GB 100%
+# parted /dev/sda -- mkpart root ext4 512MB -8GB
+# parted /dev/sda -- mkpart swap linux-swap -8GB 100%
 # parted /dev/sda -- mkpart ESP fat32 1MB 512MB
 # parted /dev/sda -- set 3 esp on
 ```

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -34,6 +34,7 @@
 
 - [ebusd](https://ebusd.eu), a daemon for handling communication with eBUS devices connected to a 2-wire bus system (“energy bus” used by numerous heating systems). Available as [services.ebusd](#opt-services.ebusd.enable).
 
+- [systemd-sysupdate](https://www.freedesktop.org/software/systemd/man/systemd-sysupdate.html), atomically updates the host OS, container images, portable service images or other sources. Available as [systemd.sysupdate](opt-systemd.sysupdate).
 
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}
 
@@ -141,6 +142,8 @@ The module update takes care of the new config syntax and the data itself (user
 
 - `programs.gnupg.agent.pinentryFlavor` is now set in `/etc/gnupg/gpg-agent.conf`, and will no longer take precedence over a `pinentry-program` set in `~/.gnupg/gpg-agent.conf`.
 
+- `wrapHelm` now exposes `passthru.pluginsDir` which can be passed to `helmfile`. For convenience, a top-level package `helmfile-wrapped` has been added, which inherits `passthru.pluginsDir` from `kubernetes-helm-wrapped`. See [#217768](https://github.com/NixOS/nixpkgs/issues/217768) for details.
+
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
 
 - The `qemu-vm.nix` module by default now identifies block devices via

nixos/modules/module-list.nix

@@ -1398,6 +1398,7 @@
   ./system/boot/systemd/oomd.nix
   ./system/boot/systemd/repart.nix
   ./system/boot/systemd/shutdown.nix
+  ./system/boot/systemd/sysupdate.nix
   ./system/boot/systemd/tmpfiles.nix
   ./system/boot/systemd/user.nix
   ./system/boot/systemd/userdbd.nix

nixos/modules/services/misc/paperless.nix

@@ -176,7 +176,7 @@ in
       description = lib.mdDoc ''
         Extra paperless config options.
 
-        See [the documentation](https://paperless-ngx.readthedocs.io/en/latest/configuration.html)
+        See [the documentation](https://docs.paperless-ngx.com/configuration/)
         for available options.
 
         Note that some options such as `PAPERLESS_CONSUMER_IGNORE_PATTERN` expect JSON values. Use `builtins.toJSON` to ensure proper quoting.

nixos/modules/services/monitoring/osquery.nix

@@ -21,7 +21,7 @@ let
   osqueryi = pkgs.runCommand "osqueryi" { nativeBuildInputs = [ pkgs.makeWrapper ]; } ''
     mkdir -p $out/bin
     makeWrapper ${pkgs.osquery}/bin/osqueryi $out/bin/osqueryi \
-      --add-flags "--flagfile ${flagfile}"
+      --add-flags "--flagfile ${flagfile} --disable-database"
   '';
 in
 {

nixos/modules/services/networking/mosquitto.nix

@@ -42,12 +42,15 @@ let
       };
 
       passwordFile = mkOption {
-        type = uniq (nullOr types.path);
+        type = uniq (nullOr path);
         example = "/path/to/file";
         default = null;
         description = lib.mdDoc ''
           Specifies the path to a file containing the
           clear text password for the MQTT user.
+          The file is securely passed to mosquitto by
+          leveraging systemd credentials. No special
+          permissions need to be set on this file.
         '';
       };
 
@@ -64,7 +67,7 @@ let
       };
 
       hashedPasswordFile = mkOption {
-        type = uniq (nullOr types.path);
+        type = uniq (nullOr path);
         example = "/path/to/file";
         default = null;
         description = mdDoc ''
@@ -73,6 +76,9 @@ let
           To generate hashed password install the `mosquitto`
           package and use `mosquitto_passwd`, then remove the
           `username:` prefix from the generated file.
+          The file is securely passed to mosquitto by
+          leveraging systemd credentials. No special
+          permissions need to be set on this file.
         '';
       };
 
@@ -102,15 +108,43 @@ let
         message = "Cannot set more than one password option for user ${n} in ${prefix}";
       }) users;
 
-  makePasswordFile = users: path:
+  listenerScope = index: "listener-${toString index}";
+  userScope = prefix: index: "${prefix}-user-${toString index}";
+  credentialID = prefix: credential: "${prefix}-${credential}";
+
+  toScopedUsers = listenerScope: users: pipe users [
+    attrNames
+    (imap0 (index: user: nameValuePair user
+      (users.${user} // { scope = userScope listenerScope index; })
+    ))
+    listToAttrs
+  ];
+
+  userCredentials = user: credentials: pipe credentials [
+    (filter (credential: user.${credential} != null))
+    (map (credential: "${credentialID user.scope credential}:${user.${credential}}"))
+  ];
+  usersCredentials = listenerScope: users: credentials: pipe users [
+    (toScopedUsers listenerScope)
+    (mapAttrsToList (_: user: userCredentials user credentials))
+    concatLists
+  ];
+  systemdCredentials = listeners: listenerCredentials: pipe listeners [
+    (imap0 (index: listener: listenerCredentials (listenerScope index) listener))
+    concatLists
+  ];
+
+  makePasswordFile = listenerScope: users: path:
     let
-      makeLines = store: file:
+      makeLines = store: file: let
+        scopedUsers = toScopedUsers listenerScope users;
+      in
         mapAttrsToList
-          (n: u: "addLine ${escapeShellArg n} ${escapeShellArg u.${store}}")
-          (filterAttrs (_: u: u.${store} != null) users)
+          (name: user: ''addLine ${escapeShellArg name} "''$(systemd-creds cat ${credentialID user.scope store})"'')
+          (filterAttrs (_: user: user.${store} != null) scopedUsers)
         ++ mapAttrsToList
-          (n: u: "addFile ${escapeShellArg n} ${escapeShellArg "${u.${file}}"}")
-          (filterAttrs (_: u: u.${file} != null) users);
+          (name: user: ''addFile ${escapeShellArg name} "''${CREDENTIALS_DIRECTORY}/${credentialID user.scope file}"'')
+          (filterAttrs (_: user: user.${file} != null) scopedUsers);
       plainLines = makeLines "password" "passwordFile";
       hashedLines = makeLines "hashedPassword" "hashedPasswordFile";
     in
@@ -581,6 +615,19 @@ in
         ExecStart = "${cfg.package}/bin/mosquitto -c ${configFile}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
 
+        # Credentials
+        SetCredential = let
+          listenerCredentials = listenerScope: listener:
+            usersCredentials listenerScope listener.users [ "password" "hashedPassword" ];
+        in
+          systemdCredentials cfg.listeners listenerCredentials;
+
+        LoadCredential = let
+          listenerCredentials = listenerScope: listener:
+            usersCredentials listenerScope listener.users [ "passwordFile" "hashedPasswordFile" ];
+        in
+          systemdCredentials cfg.listeners listenerCredentials;
+
         # Hardening
         CapabilityBoundingSet = "";
         DevicePolicy = "closed";
@@ -653,7 +700,7 @@ in
         concatStringsSep
           "\n"
           (imap0
-            (idx: listener: makePasswordFile listener.users "${cfg.dataDir}/passwd-${toString idx}")
+            (idx: listener: makePasswordFile (listenerScope idx) listener.users "${cfg.dataDir}/passwd-${toString idx}")
             cfg.listeners);
     };
 

nixos/modules/services/networking/networkmanager.nix

@@ -461,6 +461,8 @@ in {
       "d /var/lib/NetworkManager-fortisslvpn 0700 root root -"
 
       "d /var/lib/misc 0755 root root -" # for dnsmasq.leases
+      # ppp isn't able to mkdir that directory at runtime
+      "d /run/pppd/lock 0700 root root -"
     ];
 
     systemd.services.NetworkManager = {

nixos/modules/services/web-apps/sogo.nix

@@ -232,8 +232,8 @@ in {
         proxy_connect_timeout 90;
         proxy_send_timeout 90;
         proxy_read_timeout 90;
-        proxy_buffer_size 4k;
-        proxy_buffers 4 32k;
+        proxy_buffer_size 64k;
+        proxy_buffers 8 64k;
         proxy_busy_buffers_size 64k;
         proxy_temp_file_write_size 64k;
         client_max_body_size 50m;

nixos/modules/system/boot/systemd/sysupdate.nix

@@ -0,0 +1,142 @@
+{ config, lib, pkgs, utils, ... }:
+
+let
+  cfg = config.systemd.sysupdate;
+
+  format = pkgs.formats.ini { };
+
+  listOfDefinitions = lib.mapAttrsToList
+    (name: format.generate "${name}.conf")
+    (lib.filterAttrs (k: _: !(lib.hasPrefix "_" k)) cfg.transfers);
+
+  definitionsDirectory = pkgs.runCommand "sysupdate.d" { } ''
+    mkdir -p $out
+    ${(lib.concatStringsSep "\n"
+      (map (pkg: "cp ${pkg} $out/${pkg.name}") listOfDefinitions)
+    )}
+  '';
+in
+{
+  options.systemd.sysupdate = {
+
+    enable = lib.mkEnableOption (lib.mdDoc "systemd-sysupdate") // {
+      description = lib.mdDoc ''
+        Atomically update the host OS, container images, portable service
+        images or other sources.
+
+        If enabled, updates are triggered in regular intervals via a
+        `systemd.timer` unit.
+
+        Please see
+        <https://www.freedesktop.org/software/systemd/man/systemd-sysupdate.html>
+        for more details.
+      '';
+    };
+
+    timerConfig = utils.systemdUtils.unitOptions.timerOptions.options.timerConfig // {
+      default = { };
+      description = lib.mdDoc ''
+        The timer configuration for performing the update.
+
+        By default, the upstream configuration is used:
+        <https://github.com/systemd/systemd/blob/main/units/systemd-sysupdate.timer>
+      '';
+    };
+
+    reboot = {
+      enable = lib.mkEnableOption (lib.mdDoc "automatically rebooting after an update") // {
+        description = lib.mdDoc ''
+          Whether to automatically reboot after an update.
+
+          If set to `true`, the system will automatically reboot via a
+          `systemd.timer` unit but only after a new version was installed.
+
+          This uses a unit completely separate from the one performing the
+          update because it is typically advisable to download updates
+          regularly while the system is up, but delay reboots until the
+          appropriate time (i.e. typically at night).
+
+          Set this to `false` if you do not want to reboot after an update. This
+          is useful when you update a container image or another source where
+          rebooting is not necessary in order to finalize the update.
+        '';
+      };
+
+      timerConfig = utils.systemdUtils.unitOptions.timerOptions.options.timerConfig // {
+        default = { };
+        description = lib.mdDoc ''
+          The timer configuration for rebooting after an update.
+
+          By default, the upstream configuration is used:
+          <https://github.com/systemd/systemd/blob/main/units/systemd-sysupdate-reboot.timer>
+        '';
+      };
+    };
+
+    transfers = lib.mkOption {
+      type = with lib.types; attrsOf format.type;
+      default = { };
+      example = {
+        "10-uki.conf" = {
+          Transfer = {
+            ProtectVersion = "%A";
+          };
+
+          Source = {
+            Type = "url-file";
+            Path = "https://download.example.com/";
+            MatchPattern = "nixos_@v.efi.xz";
+          };
+
+          Target = {
+            Type = "regular-file";
+            Path = "/EFI/Linux";
+            PathRelativeTo = "boot";
+            MatchPattern = ''
+              nixos_@v+@l-@d.efi"; \
+              nixos_@v+@l.efi \
+              nixos_@v.efi
+            '';
+            Mode = "0444";
+            TriesLeft = 3;
+            TriesDone = 0;
+            InstancesMax = 2;
+          };
+        };
+      };
+      description = lib.mdDoc ''
+        Specify transfers as a set of the names of the transfer files as the
+        key and the configuration as its value. The configuration can use all
+        upstream options. See
+        <https://www.freedesktop.org/software/systemd/man/sysupdate.d.html>
+        for all available options.
+      '';
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    systemd.additionalUpstreamSystemUnits = [
+      "systemd-sysupdate.service"
+      "systemd-sysupdate.timer"
+      "systemd-sysupdate-reboot.service"
+      "systemd-sysupdate-reboot.timer"
+    ];
+
+    systemd.timers = {
+      "systemd-sysupdate" = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = cfg.timerConfig;
+      };
+      "systemd-sysupdate-reboot" = lib.mkIf cfg.reboot.enable {
+        wantedBy = [ "timers.target" ];
+        timerConfig = cfg.reboot.timerConfig;
+      };
+    };
+
+    environment.etc."sysupdate.d".source = definitionsDirectory;
+  };
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+}

nixos/modules/virtualisation/docker.nix

@@ -158,6 +158,15 @@ in
         Docker package to be used in the module.
       '';
     };
+
+    extraPackages = mkOption {
+      type = types.listOf types.package;
+      default = [ ];
+      example = literalExpression "with pkgs; [ criu ]";
+      description = lib.mdDoc ''
+        Extra packages to add to PATH for the docker daemon process.
+      '';
+    };
   };
 
   ###### implementation
@@ -194,7 +203,8 @@ in
         };
 
         path = [ pkgs.kmod ] ++ optional (cfg.storageDriver == "zfs") pkgs.zfs
-          ++ optional cfg.enableNvidia pkgs.nvidia-docker;
+          ++ optional cfg.enableNvidia pkgs.nvidia-docker
+          ++ cfg.extraPackages;
       };
 
       systemd.sockets.docker = {

nixos/tests/all-tests.nix

@@ -772,6 +772,7 @@ in {
   systemd-portabled = handleTest ./systemd-portabled.nix {};
   systemd-repart = handleTest ./systemd-repart.nix {};
   systemd-shutdown = handleTest ./systemd-shutdown.nix {};
+  systemd-sysupdate = runTest ./systemd-sysupdate.nix;
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
   systemd-user-tmpfiles-rules = handleTest ./systemd-user-tmpfiles-rules.nix {};
   systemd-misc = handleTest ./systemd-misc.nix {};

nixos/tests/common/gpg-keyring.nix

@@ -0,0 +1,21 @@
+{ pkgs, ... }:
+
+pkgs.runCommand "gpg-keyring" { nativeBuildInputs = [ pkgs.gnupg ]; } ''
+  mkdir -p $out
+  export GNUPGHOME=$out
+  cat > foo <<EOF
+    %echo Generating a basic OpenPGP key
+    %no-protection
+    Key-Type: EdDSA
+    Key-Curve: ed25519
+    Name-Real: Bob Foobar
+    Name-Email: bob@foo.bar
+    Expire-Date: 0
+    # Do a commit here, so that we can later print "done"
+    %commit
+    %echo done
+  EOF
+  gpg --batch --generate-key foo
+  rm $out/S.gpg-agent $out/S.gpg-agent.*
+  gpg --export bob@foo.bar -a > $out/pubkey.gpg
+''

nixos/tests/systemd-nspawn.nix

@@ -1,26 +1,6 @@
 import ./make-test-python.nix ({pkgs, lib, ...}:
 let
-  gpgKeyring = (pkgs.runCommand "gpg-keyring" { buildInputs = [ pkgs.gnupg ]; } ''
-    mkdir -p $out
-    export GNUPGHOME=$out
-    cat > foo <<EOF
-      %echo Generating a basic OpenPGP key
-      %no-protection
-      Key-Type: DSA
-      Key-Length: 1024
-      Subkey-Type: ELG-E
-      Subkey-Length: 1024
-      Name-Real: Bob Foobar
-      Name-Email: bob@foo.bar
-      Expire-Date: 0
-      # Do a commit here, so that we can later print "done"
-      %commit
-      %echo done
-    EOF
-    gpg --batch --generate-key foo
-    rm $out/S.gpg-agent $out/S.gpg-agent.*
-    gpg --export bob@foo.bar -a > $out/pubkey.gpg
-  '');
+  gpgKeyring = import ./common/gpg-keyring.nix { inherit pkgs; };
 
   nspawnImages = (pkgs.runCommand "localhost" { buildInputs = [ pkgs.coreutils pkgs.gnupg ]; } ''
     mkdir -p $out

nixos/tests/systemd-sysupdate.nix

@@ -0,0 +1,66 @@
+# Tests downloading a signed update aritfact from a server to a target machine.
+# This test does not rely on the `systemd.timer` units provided by the
+# `systemd-sysupdate` module but triggers the `systemd-sysupdate` service
+# manually to make the test more robust.
+
+{ lib, pkgs, ... }:
+
+let
+  gpgKeyring = import ./common/gpg-keyring.nix { inherit pkgs; };
+in
+{
+  name = "systemd-sysupdate";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes = {
+    server = { pkgs, ... }: {
+      networking.firewall.enable = false;
+      services.nginx = {
+        enable = true;
+        virtualHosts."server" = {
+          root = pkgs.runCommand "sysupdate-artifacts" { buildInputs = [ pkgs.gnupg ]; } ''
+            mkdir -p $out
+            cd $out
+
+            echo "nixos" > nixos_1.efi
+            sha256sum nixos_1.efi > SHA256SUMS
+
+            export GNUPGHOME="$(mktemp -d)"
+            cp -R ${gpgKeyring}/* $GNUPGHOME
+
+            gpg --batch --sign --detach-sign --output SHA256SUMS.gpg SHA256SUMS
+          '';
+        };
+      };
+    };
+
+    target = {
+      systemd.sysupdate = {
+        enable = true;
+        transfers = {
+          "uki" = {
+            Source = {
+              Type = "url-file";
+              Path = "http://server/";
+              MatchPattern = "nixos_@v.efi";
+            };
+            Target = {
+              Path = "/boot/EFI/Linux";
+              MatchPattern = "nixos_@v.efi";
+            };
+          };
+        };
+      };
+
+      environment.etc."systemd/import-pubring.gpg".source = "${gpgKeyring}/pubkey.gpg";
+    };
+  };
+
+  testScript = ''
+    server.wait_for_unit("nginx.service")
+
+    target.succeed("systemctl start systemd-sysupdate")
+    assert "nixos" in target.wait_until_succeeds("cat /boot/EFI/Linux/nixos_1.efi", timeout=5)
+  '';
+}

pkgs/applications/audio/reaper/default.nix

@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "6.80";
+  version = "6.81";
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
     hash = {
-      x86_64-linux = "sha256-By97OxGC9YO7yEHzSjDAZHCtVaub1wNwWMOn4F+Qzpg=";
-      aarch64-linux = "sha256-11DiFfqULIi4tespho+yOH+Qy4s+lithCt19kb4RfhI=";
+      x86_64-linux = "sha256-Zzt/g96yAztE0NjVa4uaWXBckSvnGxP0K87Hmq82Mi0=";
+      aarch64-linux = "sha256-PNUUm7xNpPRyQaZm9YDXysJ1yo/IzxUz+kqI6/Z6fpo=";
     }.${stdenv.hostPlatform.system};
   };
 

pkgs/applications/blockchains/stellar-core/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "stellar-core";
-  version = "19.11.0";
+  version = "19.12.0";
 
   src = fetchFromGitHub {
     owner = "stellar";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-48fEVbK5yswPkTwlfemXB2ieAs2+SIM6dspqOBiRKCU=";
+    sha256 = "sha256-WpzUEn3BuC2OxrsqYete595m6YWv27QXnTfW1F6CX9k=";
     fetchSubmodules = true;
   };
 

pkgs/applications/blockchains/taproot-assets/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "taproot-assets";
-  version = "0.2.2";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "lightninglabs";
     repo = "taproot-assets";
     rev = "v${version}";
-    hash = "sha256-DOtCnPnS5Oq5B4xaYmNCXxMYJ9fhPZ11OfPKXH7eKUg=";
+    hash = "sha256-nTgIoYajpnlEvyXPcwXbm/jOfG+C83TTZiPmoB2kK24=";
   };
 
   vendorHash = "sha256-fc++0M7Mnn1nJOkV2gzAVRQCp3vOqsO2OQNlOKaMmB4=";

pkgs/applications/editors/android-studio/default.nix

@@ -17,7 +17,10 @@ let
     version = "2022.3.1.16"; # "Android Studio Giraffe (2022.3.1) Beta 5"
     sha256Hash = "sha256-D+Hoa50fzvtO0/6DsExmGSDzcgDIT2Bg+HvI6mCle14=";
   };
-  latestVersion = betaVersion;
+  latestVersion = {
+    version = "2023.1.1.12"; # Android Studio Hedgehog (2023.1.1) Canary 12
+    sha256Hash = "sha256-/BKtjX3O6PCqtzVfVMPICcip6tf6W/JV5UzWgON+kZY=";
+  };
 in {
   # Attributes are named by their corresponding release channels
 

pkgs/applications/editors/neovim/default.nix

@@ -4,6 +4,7 @@
 , libvterm-neovim
 , tree-sitter
 , fetchurl
+, buildPackages
 , treesitter-parsers ? import ./treesitter-parsers.nix { inherit fetchurl; }
 , CoreServices
 , glibcLocales ? null, procps ? null
@@ -15,22 +16,32 @@
 }:
 
 let
-  neovimLuaEnv = lua.withPackages(ps:
-    (with ps; [ lpeg luabitop mpack ]
-    ++ lib.optionals doCheck [
-        nvim-client luv coxpcall busted luafilesystem penlight inspect
-      ]
-    ));
+  requiredLuaPkgs = ps: (with ps; [
+    lpeg
+    luabitop
+    mpack
+  ] ++ lib.optionals doCheck [
+    nvim-client
+    luv
+    coxpcall
+    busted
+    luafilesystem
+    penlight
+    inspect
+  ]
+  );
+  neovimLuaEnv = lua.withPackages requiredLuaPkgs;
+  neovimLuaEnvOnBuild = lua.luaOnBuild.withPackages requiredLuaPkgs;
   codegenLua =
-    if lua.pkgs.isLuaJIT
+    if lua.luaOnBuild.pkgs.isLuaJIT
       then
         let deterministicLuajit =
-          lua.override {
+          lua.luaOnBuild.override {
             deterministicStringIds = true;
             self = deterministicLuajit;
           };
         in deterministicLuajit.withPackages(ps: [ ps.mpack ps.lpeg ])
-      else lua;
+      else lua.luaOnBuild;
 
   pyEnv = python3.withPackages(ps: with ps; [ pynvim msgpack ]);
 in
@@ -99,6 +110,11 @@ in
     # nvim --version output retains compilation flags and references to build tools
     postPatch = ''
       substituteInPlace src/nvim/version.c --replace NVIM_VERSION_CFLAGS "";
+    '' + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      sed -i runtime/CMakeLists.txt \
+        -e "s|\".*/bin/nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
+      sed -i src/nvim/po/CMakeLists.txt \
+        -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
     '';
     # check that the above patching actually works
     disallowedReferences = [ stdenv.cc ] ++ lib.optional (lua != codegenLua) codegenLua;
@@ -117,6 +133,7 @@ in
       cmakeFlagsArray+=(
         "-DLUAC_PRG=${codegenLua}/bin/luajit -b -s %s -"
         "-DLUA_GEN_PRG=${codegenLua}/bin/luajit"
+        "-DLUA_PRG=${neovimLuaEnvOnBuild}/bin/luajit"
       )
     '' + lib.optionalString stdenv.isDarwin ''
       substituteInPlace src/nvim/CMakeLists.txt --replace "    util" ""

pkgs/applications/editors/netbeans/default.nix

@@ -3,7 +3,7 @@
 }:
 
 let
-  version = "16";
+  version = "18";
   desktopItem = makeDesktopItem {
     name = "netbeans";
     exec = "netbeans";
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   inherit version;
   src = fetchurl {
     url = "mirror://apache/netbeans/netbeans/${version}/netbeans-${version}-bin.zip";
-    hash = "sha512-k+Zj6TKW0tOSYvM6V1okF4Qz62gZMETC6XG98W23Vtz3+vdiaddd8BC2DBg7p9Z1CofRq8sbwtpeTJM3FaXv0g==";
+    hash = "sha256-CTWOW1vd200oZZYqDRT4wqr4v5I3AAgEcqA/qi9Ief8=";
   };
 
   buildCommand = ''

pkgs/applications/editors/standardnotes/src.json

@@ -1,13 +1,13 @@
 {
-  "version": "3.166.9",
+  "version": "3.167.2",
   "deb": {
     "x86_64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.166.9/standard-notes-3.166.9-linux-amd64.deb",
-      "hash": "sha512-D85W50K3jRBKhrPz3Wa9aClnHFMRPQ0YgP71uypfcCcuKVnKd3Ol1sFzsyMzl2uhB0aGOkpd2OB+OHceVFqmag=="
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.167.2/standard-notes-3.167.2-linux-amd64.deb",
+      "hash": "sha512-xW08R1oZm8lw8Iap/TT29WJCagmcQNWXzdSDY8pArG9Fjv8nm+DcV6paVL35Hj35Dk9CJdf1KxeTRB9JW6u3dg=="
     },
     "aarch64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.166.9/standard-notes-3.166.9-linux-arm64.deb",
-      "hash": "sha512-pbBLqIaDjQoVGCOfpOxwjWRSMoQsefsYOHTRNTNlDDNO7DRUa/WeSbOYOgLJM5yGIBVXQoRmO7ycWfAWVAPIDQ=="
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.167.2/standard-notes-3.167.2-linux-arm64.deb",
+      "hash": "sha512-ua0lg6aK++RDi4WyCYygHoQasYD4+I21ip5To9ImMN072vJSyAoz9gxs8HBF+uEl4/uUBdlMCQHEioYMeJCwbw=="
     }
   }
 }

pkgs/applications/emulators/ryujinx/default.nix

@@ -28,13 +28,13 @@
 
 buildDotnetModule rec {
   pname = "ryujinx";
-  version = "1.1.960"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.968"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
 
   src = fetchFromGitHub {
     owner = "Ryujinx";
     repo = "Ryujinx";
-    rev = "ac2444f908bee5b5c1a13fe64e997315cea4b23c";
-    sha256 = "0nv55x775lzbqa724ba2bpbkk6r7jbrgxgbir5bhyj0yz5ckl4v5";
+    rev = "487261592eb9e9c31cacd08860f8894027bb1a07";
+    sha256 = "002qgnh7xb9i9yqm4a3m9m7sbx1iz7ng8k5nnanlq897djs3hy0g";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_7_0;

pkgs/applications/emulators/ryujinx/deps.nix

@@ -133,7 +133,7 @@
   (fetchNuGet { pname = "Ryujinx.Graphics.Vulkan.Dependencies.MoltenVK"; version = "1.2.0"; sha256 = "1qkas5b6k022r57acpc4h981ddmzz9rwjbgbxbphrjd8h7lz1l5x"; })
   (fetchNuGet { pname = "Ryujinx.GtkSharp"; version = "3.24.24.59-ryujinx"; sha256 = "0dri508x5kca2wk0mpgwg6fxj4n5n3kplapwdmlcpfcbwbmrrnyr"; })
   (fetchNuGet { pname = "Ryujinx.PangoSharp"; version = "3.24.24.59-ryujinx"; sha256 = "1bdxm5k54zs0h6n2dh20j5jlyn0yml9r8qr828ql0k8zl7yhlq40"; })
-  (fetchNuGet { pname = "Ryujinx.SDL2-CS"; version = "2.26.3-build25"; sha256 = "190gqalpkhw1zb3pvb92dxrciyn1giznl125vxxx9gsy8a6cipka"; })
+  (fetchNuGet { pname = "Ryujinx.SDL2-CS"; version = "2.28.1-build28"; sha256 = "0kn7f6cgvb2rsybiif6g7xkw1srmfr306zpv029lvi264dv6aj6l"; })
   (fetchNuGet { pname = "shaderc.net"; version = "0.1.0"; sha256 = "0f35s9h0vj9f1rx9bssj66hibc3j9bzrb4wgb5q2jwkf5xncxbpq"; })
   (fetchNuGet { pname = "SharpZipLib"; version = "1.4.2"; sha256 = "0ijrzz2szxjmv2cipk7rpmg14dfaigdkg7xabjvb38ih56m9a27y"; })
   (fetchNuGet { pname = "ShimSkiaSharp"; version = "0.5.18"; sha256 = "1i97f2zbsm8vhcbcfj6g4ml6g261gijdh7s3rmvwvxgfha6qyvkg"; })

pkgs/applications/graphics/hello-wayland/default.nix

@@ -14,6 +14,8 @@ stdenv.mkDerivation {
     sha256 = "NMQE2zU858b6OZhdS2oZnGvLK+eb7yU0nFaMAcpNw04=";
   };
 
+  separateDebugInfo = true;
+
   depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ imagemagick pkg-config wayland-scanner ];
   buildInputs = [ wayland wayland-protocols ];

pkgs/applications/misc/ausweisapp2/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "AusweisApp2";
-  version = "1.26.4";
+  version = "1.26.5";
 
   src = fetchFromGitHub {
     owner = "Governikus";
     repo = "AusweisApp2";
     rev = version;
-    hash = "sha256-l/sPqXkr4rSMEbPi/ahl/74RYqNrjcb28v6/scDrh1w=";
+    hash = "sha256-6/acpPMHsMj/8GkLGNE8yg/apt8ynhN3O35lkA95HYQ=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

pkgs/applications/misc/xmrig/default.nix

@@ -15,13 +15,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "xmrig";
-  version = "6.19.3";
+  version = "6.20.0";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig";
     rev = "v${version}";
-    hash = "sha256-mvEmxN7spyQkavAcjW4bVt7xjtRTP77OwHzJ5UqsSoE=";
+    hash = "sha256-csJfmjKm/uAlINhijeqUsDVTemchlzWqJg/YHtmNlAk=";
   };
 
   patches = [

pkgs/applications/networking/avalanchego/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "avalanchego";
-  version = "1.10.4";
+  version = "1.10.5";
 
   src = fetchFromGitHub {
     owner = "ava-labs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-aeO1rjKYoO6KF+oe0FKIa8D3j6G01uyC79OvUg9Qpfk=";
+    hash = "sha256-mGie45sIvl8BjBB4JJF/U/OJ7naT6iWjo3l50qZvyaY=";
   };
 
-  vendorHash = "sha256-Rh3S7Qy89ctsKlFz0lNNs8pZ5lHG5yB//DQzffD6eL8=";
+  vendorHash = "sha256-/pNXCRHtoaJvgYsSMyYB05IKH4wG7hTlEHjuoOuifQ0=";
   # go mod vendor has a bug, see: https://github.com/golang/go/issues/57529
   proxyVendor = true;
 

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "115.0.5790.102",
-    "sha256": "0sxhhsrn4cg9akpnb2qpn7kkgp286rh8y2mmypm2409s5grf1xh6",
-    "sha256bin64": "18n7xqbvcdd68856wmbrxx1f5lqj61g9cyiir9dzlfmf0a9wxvml",
+    "version": "115.0.5790.110",
+    "sha256": "0wgp44qnvmdqf2kk870ndm51rcvar36li2qq632ay4n8gfpbrm79",
+    "sha256bin64": "1w2jl92x78s4vxv4p1imkz7qaq51yvs0wiz2bclbjz0hjlw9akr3",
     "deps": {
       "gn": {
         "version": "2023-05-19",
@@ -19,15 +19,15 @@
     }
   },
   "beta": {
-    "version": "115.0.5790.98",
-    "sha256": "1wbasmwdqkg5jcmzpidvzjsq2n2dr73bxz85pr8a5j4grw767gpz",
-    "sha256bin64": "0xbizb3d539h1cw1kj9ahd8azmkcdfjdmqb5bpp8cr21bh2qbqp5",
+    "version": "116.0.5845.50",
+    "sha256": "0r5m2bcrh2zpl2m8wnzyl4afh8s0dh2m2fnfjf50li94694vy4jz",
+    "sha256bin64": "047wsszg4c23vxq93a335iymiqpy7lw5izzz4f0zk1a4sijafd59",
     "deps": {
       "gn": {
-        "version": "2023-05-19",
+        "version": "2023-06-09",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "e9e83d9095d3234adf68f3e2866f25daf766d5c7",
-        "sha256": "0y07c18xskq4mclqiz3a63fz8jicz2kqridnvdhqdf75lhp61f8a"
+        "rev": "4bd1a77e67958fb7f6739bd4542641646f264e5d",
+        "sha256": "14h9jqspb86sl5lhh6q0kk2rwa9zcak63f8drp7kb3r4dx08vzsw"
       }
     }
   },

pkgs/applications/networking/cluster/argo/default.nix

@@ -35,16 +35,16 @@ let
 in
 buildGoModule rec {
   pname = "argo";
-  version = "3.4.7";
+  version = "3.4.8";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jvrt8CwYkeZky5xg9a2U/CuenoBe86yX31x2iCb/7EY=";
+    hash = "sha256-cN1uLy0QHABks99BJqEpLDf2VbYUzLM2iCTTBvcY0es=";
   };
 
-  vendorHash = "sha256-6vHZxBcmhu6s3qQSX0iNIAR0hvXQB/bbpTA1/R08pj0=";
+  vendorHash = "sha256-kO4ME0r3MoOjn+83X+8bbkgF7zL/Id2+hKabQjEob+Y=";
 
   doCheck = false;
 

pkgs/applications/networking/cluster/helm/plugins/default.nix

@@ -12,4 +12,6 @@
 
   helm-secrets = callPackage ./helm-secrets.nix { };
 
+  helm-unittest = callPackage ./helm-unittest.nix { };
+
 }

pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix

@@ -0,0 +1,34 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "helm-unittest";
+  version = "0.3.3";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-11rgARUfTbr8FkmR2lI4uoIqzi9cRuVPalUOsxsnO3E=";
+  };
+
+  vendorHash = "sha256-E9HSP8c/rGG+PLbnT8V5GflpnFItCeXyeLGiqDj4tRI=";
+
+  # NOTE: Remove the install and upgrade hooks.
+  postPatch = ''
+    sed -i '/^hooks:/,+2 d' plugin.yaml
+  '';
+
+  postInstall = ''
+    install -dm755 $out/${pname}
+    mv $out/bin/helm-unittest $out/${pname}/untt
+    rmdir $out/bin
+    install -m644 -Dt $out/${pname} plugin.yaml
+  '';
+
+  meta = with lib; {
+    description = "BDD styled unit test framework for Kubernetes Helm charts as a Helm plugin";
+    homepage = "https://github.com/helm-unittest/helm-unittest";
+    license = licenses.mit;
+    maintainers = with maintainers; [ yurrriq ];
+  };
+}

pkgs/applications/networking/cluster/helm/wrapper.nix

@@ -31,7 +31,10 @@ in
     preferLocalBuild = true;
 
     nativeBuildInputs = [ makeWrapper ];
-    passthru = { unwrapped = helm; };
+    passthru = {
+      inherit pluginsDir;
+      unwrapped = helm;
+    };
 
     meta = helm.meta // {
       # To prevent builds on hydra

pkgs/applications/networking/cluster/helmfile/default.nix

@@ -1,4 +1,10 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+, makeWrapper
+, pluginsDir ? null
+}:
 
 buildGoModule rec {
   pname = "helmfile";
@@ -19,9 +25,14 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-w" "-X go.szostok.io/version.version=v${version}" ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs =
+    [ installShellFiles ] ++
+    lib.optional (pluginsDir != null) makeWrapper;
 
-  postInstall = ''
+  postInstall = lib.optionalString (pluginsDir != null) ''
+    wrapProgram $out/bin/helmfile \
+      --set HELM_PLUGINS "${pluginsDir}"
+  '' + ''
     installShellCompletion --cmd helmfile \
       --bash <($out/bin/helmfile completion bash) \
       --fish <($out/bin/helmfile completion fish) \

pkgs/applications/networking/cluster/weave-gitops/default.nix

@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "weave-gitops";
-  version = "0.26.0";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sHk9ULh/792BEjPRcaeY3umx3pcLb41urrrouunm9nw=";
+    sha256 = "sha256-q19oKawv7hLHMaPAIIdGLl+4N+HiXuIow8f3k9bTt3A=";
   };
 
   ldflags = [ "-s" "-w" "-X github.com/weaveworks/weave-gitops/cmd/gitops/version.Version=${version}" ];
 
-  vendorSha256 = "sha256-Q9LjKgaFUx4txJlPcrG/YIbHV4hh5oWHVXIBDDgKYRg=";
+  vendorHash = "sha256-EV8MDHiQBmp/mEB+ug/yALPhcqytp0W8V6IPP+nt9DA=";
 
   subPackages = [ "cmd/gitops" ];
 

pkgs/applications/networking/flexget/default.nix

@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.7.10";
+  version = "3.7.11";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5wf1oQzriawhthAfHMMtZbUMvGNviBPzmnLKahRkmXQ=";
+    hash = "sha256-rrxY5liF4IzuaZ3kjJ2zEUzK1p7jGbS/T/bM1HQGzbA=";
   };
 
   postPatch = ''

pkgs/applications/networking/instant-messengers/slack/default.nix

@@ -45,14 +45,14 @@ let
 
   pname = "slack";
 
-  x86_64-darwin-version = "4.32.122";
-  x86_64-darwin-sha256 = "sha256-aKvMtuo3cNJsw42RNezmETsLAtl6G2yqYGOGp2Pt32U=3";
+  x86_64-darwin-version = "4.33.73";
+  x86_64-darwin-sha256 = "0y8plkl3pm8250xpavc91kn5b9gcdwr7bqzd3i79n48395lx11ka";
 
-  x86_64-linux-version = "4.32.122";
-  x86_64-linux-sha256 = "sha256-ViJHG7s7xqnatNOss5mfa7GqqlHbBrLGHBzTqqo7W/w=";
+  x86_64-linux-version = "4.33.73";
+  x86_64-linux-sha256 = "007i8sjnm1ikjxvgw6nisj4nmv99bwk0r4sfpvc2j4w4wk68sx3m";
 
-  aarch64-darwin-version = "4.32.122";
-  aarch64-darwin-sha256 = "sha256-j3PbH/5cKN5+vUiLvXaxyPYilt6GX6FsGo+1hlJKrls=";
+  aarch64-darwin-version = "4.33.73";
+  aarch64-darwin-sha256 = "15s3ss15yawb04dyzn82xmk1gs70sg2i3agsj2aw0xdx73yjl34p";
 
   version = {
     x86_64-darwin = x86_64-darwin-version;

pkgs/applications/networking/instant-messengers/zoom-us/default.nix

@@ -48,23 +48,23 @@ let
   # and often with different versions.  We write them on three lines
   # like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "5.15.3.20121";
-  versions.x86_64-darwin = "5.15.3.20121";
-  versions.x86_64-linux = "5.15.3.4839";
+  versions.aarch64-darwin = "5.15.5.20753";
+  versions.x86_64-darwin = "5.15.5.20753";
+  versions.x86_64-linux = "5.15.5.5603";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-FEgLtKhjODZGuwzOWUK//TilXM3Gvka7B5E48eyrBuw=";
+      hash = "sha256-yDdmr0lHmhsJpTpvw4Qr4ZUk7SfEZw/53bVL3yV+a/Q=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-q4//skfKwAuPqPxJedVACbSQQiTKmc8J24t7mCY6c/w=";
+      hash = "sha256-qZ5jiNL7I6IHwm1bZ8rgjVwwFJKPeAViQvx+qatGPug=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-4r1jayWHg+5Oerksj7DSc5xV15l7miA0a+CgPDUkpa0=";
+      hash = "sha256-JIS+jxBiW/ek47iz+yCcmoCZ8+UBzEXMC1Yd7Px0ofg=";
     };
   };
 

pkgs/applications/networking/localproxy/default.nix

@@ -0,0 +1,39 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, openssl
+, protobuf3_19
+, catch2
+, boost181
+, icu
+}:
+let
+  boost = boost181.override { enableStatic = true; };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "localproxy";
+  version = "3.1.0";
+
+    src = fetchFromGitHub {
+      owner = "aws-samples";
+      repo = "aws-iot-securetunneling-localproxy";
+      rev = "v${finalAttrs.version}";
+      hash = "sha256-ec72bvBkRBj4qlTNfzNPeQt02OfOPA8y2PoejHpP9cY=";
+    };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ openssl protobuf3_19 catch2 boost icu ];
+
+  # causes redefinition of _FORTIFY_SOURCE
+  hardeningDisable = [ "fortify3" ];
+
+    meta = with lib; {
+      description = "AWS IoT Secure Tunneling Local Proxy Reference Implementation C++";
+      homepage = "https://github.com/aws-samples/aws-iot-securetunneling-localproxy";
+      license = licenses.asl20;
+      maintainers = with maintainers; [spalf];
+      platforms = platforms.unix;
+    };
+  })

pkgs/applications/networking/newsreaders/pan/default.nix

@@ -1,11 +1,12 @@
 { spellChecking ? true
 , lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
+, autoreconfHook
 , pkg-config
 , gtk3
 , gtkspell3
-, gmime2
+, gmime3
 , gettext
 , intltool
 , itstool
@@ -21,21 +22,19 @@
 
 stdenv.mkDerivation rec {
   pname = "pan";
-  version = "0.146";
+  version = "0.154";
 
-  src = fetchurl {
-    url = "https://pan.rebelbase.com/download/releases/${version}/source/pan-${version}.tar.bz2";
-    sha256 = "17agd27sn4a7nahvkpg0w39kv74njgdrrygs74bbvpaj8rk2hb55";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-o+JFUraSoQ0HDmldHvTX+X7rl2L4n4lJmI4UFZrsfkQ=";
   };
 
-  patches = [
-    # Take <glib.h>, <gmime.h>, "gtk-compat.h" out of extern "C"
-    ./move-out-of-extern-c.diff
-  ];
+  nativeBuildInputs = [ autoreconfHook pkg-config gettext intltool itstool libxml2 makeWrapper ];
 
-  nativeBuildInputs = [ pkg-config gettext intltool itstool libxml2 makeWrapper ];
-
-  buildInputs = [ gtk3 gmime2 libnotify gnutls ]
+  buildInputs = [ gtk3 gmime3 libnotify gnutls ]
     ++ lib.optional spellChecking gtkspell3
     ++ lib.optionals gnomeSupport [ libsecret gcr ];
 

pkgs/applications/office/libreoffice/default.nix

@@ -226,9 +226,10 @@ in
   # in the binary causing the closure size to blow up because of many unnecessary
   # dependencies to dev outputs. This behavior was patched away in nixpkgs
   # (see above), make sure these don't leak again by accident.
-  disallowedRequisites = lib.concatMap
-    (x: lib.optional (x?dev) x.dev)
-    buildInputs;
+  disallowedRequisites = lib.optionals (!kdeIntegration)
+    (lib.concatMap
+      (x: lib.optional (x?dev) x.dev)
+      buildInputs);
 
   ### QT/KDE
   #

pkgs/applications/radio/freedv/default.nix

@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freedv";
-  version = "1.8.11";
+  version = "1.8.12";
 
   src = fetchFromGitHub {
     owner = "drowe67";
     repo = "freedv-gui";
     rev = "v${version}";
-    hash = "sha256-uI81dz0rU2/UnLvoQffuFOB3NGaTK0MJmCWGvGQKw24=";
+    hash = "sha256-5qq7EDCLAiCReFS1V8R2SkFI8CesmQclimcE3USGV/U=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''

pkgs/applications/science/biology/last/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1456";
+  version = "1460";
 
   src = fetchFromGitLab {
     owner = "mcfrith";
     repo = "last";
     rev = "refs/tags/${version}";
-    hash = "sha256-9DkmqqovVqaahoHoY30CfINEHTKn3Rqb9yVtU4fIgKw=";
+    hash = "sha256-9Er15zsq9Xrw66M8QOmARC1S/O5NvmpdUvOZUGc92P0=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/logic/abc/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "abc-verifier";
-  version = "unstable-2023-02-23";
+  version = "unstable-2023-06-28";
 
   src = fetchFromGitHub {
     owner = "yosyshq";
     repo  = "abc";
-    rev   = "2c1c83f75b8078ced51f92c697da3e712feb3ac3";
-    hash  = "sha256-THcyEifIp9v1bOofFVm9NFPqgI6NfKKys+Ea2KyNpv8=";
+    rev   = "bb64142b07794ee685494564471e67365a093710";
+    hash  = "sha256-Qkk61Lh84ervtehWskSB9GKh+JPB7mI1IuG32OSZMdg=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/science/logic/egglog/Cargo.lock

@@ -249,6 +249,7 @@ name = "egglog"
 version = "0.1.0"
 dependencies = [
  "clap",
+ "egraph-serialize",
  "env_logger",
  "glob",
  "hashbrown 0.14.0",
@@ -265,12 +266,25 @@ dependencies = [
  "ordered-float",
  "regex",
  "rustc-hash",
+ "serde_json",
  "smallvec",
  "symbol_table",
  "symbolic_expressions",
  "thiserror",
 ]
 
+[[package]]
+name = "egraph-serialize"
+version = "0.1.0"
+source = "git+https://github.com/egraphs-good/egraph-serialize?rev=54b1a4f1e2f2135846b084edcb495cd159839540#54b1a4f1e2f2135846b084edcb495cd159839540"
+dependencies = [
+ "indexmap 2.0.0",
+ "once_cell",
+ "ordered-float",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "either"
 version = "1.8.1"
@@ -404,6 +418,7 @@ checksum = "d5477fe2230a79769d8dc68e0eabf5437907c0457a5614a9e8dddb67f65eb65d"
 dependencies = [
  "equivalent",
  "hashbrown 0.14.0",
+ "serde",
 ]
 
 [[package]]
@@ -438,6 +453,12 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itoa"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+
 [[package]]
 name = "js-sys"
 version = "0.3.64"
@@ -607,6 +628,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2fc2dbde8f8a79f2102cc474ceb0ad68e3b80b85289ea62389b60e66777e4213"
 dependencies = [
  "num-traits",
+ "rand",
+ "serde",
 ]
 
 [[package]]
@@ -681,6 +704,25 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "rand_core",
+ "serde",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.2.16"
@@ -764,12 +806,50 @@ version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc31bd9b61a32c31f9650d18add92aa83a49ba979c143eefd27fe7177b05bd5f"
 
+[[package]]
+name = "ryu"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
+
 [[package]]
 name = "scopeguard"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
 
+[[package]]
+name = "serde"
+version = "1.0.171"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30e27d1e4fd7659406c492fd6cfaf2066ba8773de45ca75e855590f856dc34a9"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.171"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389894603bd18c46fa56231694f8d827779c0951a667087194cf9de94ed24682"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d03b412469450d4404fe8499a268edd7f8b79fecb074b0d812ad64ca21f4031b"
+dependencies = [
+ "indexmap 2.0.0",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
 [[package]]
 name = "siphasher"
 version = "0.3.10"

pkgs/applications/science/logic/egglog/default.nix

@@ -5,18 +5,19 @@
 
 rustPlatform.buildRustPackage {
   pname = "egglog";
-  version = "unstable-2023-07-11";
+  version = "unstable-2023-07-19";
 
   src = fetchFromGitHub {
     owner = "egraphs-good";
     repo = "egglog";
-    rev = "14a6fc6060c09541728ae460e0a92909fabf508f";
-    hash = "sha256-1osdjd86xZHUAwvPBNxWYlkX6tKt+jI05AEVYr77YSQ=";
+    rev = "9fe03ad35a2a975a2c9140a641ba91266b7a72ce";
+    hash = "sha256-9JeJJdZW8ecogReJzQrp3hFkK/pp/+pLxJMNREWuiyI=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
+      "egraph-serialize-0.1.0" = "sha256-1lDaoR/1TNFW+uaf3UdfDZgXlxyAb37Ij7yky16xCG8=";
       "symbol_table-0.2.0" = "sha256-f9UclMOUig+N5L3ibBXou0pJ4S/CQqtaji7tnebVbis=";
       "symbolic_expressions-5.0.3" = "sha256-mSxnhveAItlTktQC4hM8o6TYjgtCUgkdZj7i6MR4Oeo=";
     };

pkgs/applications/science/math/fricas/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fricas";
-  version = "1.3.8";
+  version = "1.3.9";
 
   src = fetchurl {
     url = "mirror://sourceforge/fricas/fricas/${version}/fricas-${version}-full.tar.bz2";
-    sha256 = "sha256-amAGPLQo70nKATyZM7h3yX5mMUxCwOFwb/fTIWB5hUQ=";
+    sha256 = "sha256-5RPcffM0GN0l6r8IgHJlwdxwwp2y4kIdJ5M3JnGZCzc=";
   };
 
   buildInputs = [ sbcl libX11 libXpm libICE libSM libXt libXau libXdmcp ];

pkgs/applications/science/math/labplot/default.nix

@@ -42,11 +42,11 @@
 
 stdenv.mkDerivation rec {
   pname = "labplot";
-  version = "2.10.0";
+  version = "2.10.1";
 
   src = fetchurl {
     url = "https://download.kde.org/stable/labplot/labplot-${version}.tar.xz";
-    sha256 = "sha256-XfxnQxCQSkOHXWnj4mCh/t2WjmwbHs2rp1WrGqOMupA=";
+    sha256 = "sha256-K24YFRfPtuDf/3uJXz6yDHzjWeZzLThUXgdXya6i2u8=";
   };
 
   cmakeFlags = [

pkgs/applications/system/booster/default.nix

@@ -16,16 +16,16 @@
 
 buildGoModule rec {
   pname = "booster";
-  version = "0.10";
+  version = "0.11";
 
   src = fetchFromGitHub {
     owner = "anatol";
     repo = pname;
     rev = version;
-    hash = "sha256-mUmh2oAD3G9cpv7yiKcFaXJkEdo18oMD/sttnYnAQL8=";
+    hash = "sha256-+0pY4/f/qfIT1lLn2DXmJBZcDDEOil4H3zNY3911ACQ=";
   };
 
-  vendorHash = "sha256-czzNAUO4eRYTwfnidNLqyvIsR0nyzR9cb+G9/5JRvKs=";
+  vendorHash = "sha256-RmRY+HoNuijfcK8gNbOIyWCOa50BVJd3IZv2+Pc3FYw=";
 
   postPatch = ''
     substituteInPlace init/main.go --replace "/usr/bin/fsck" "${unixtools.fsck}/bin/fsck"

pkgs/applications/version-management/dvc/default.nix

@@ -26,6 +26,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   postPatch = ''
+    substituteInPlace dvc/analytics.py --replace 'enabled = not os.getenv(DVC_NO_ANALYTICS)' 'enabled = False'
     substituteInPlace dvc/daemon.py \
       --subst-var-by dvc "$out/bin/dcv"
   '';

pkgs/applications/version-management/glab/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "glab";
-  version = "1.30.0";
+  version = "1.31.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-mNwjyKde9xlaGVwK7oIbPGPipxKTvLwf6uMZVjL+joc=";
+    hash = "sha256-K7yGRuIfYEqs4ziystxLMK+dYUZoyGlBJAmx2qmY08Q=";
   };
 
   vendorHash = "sha256-WfzN70HHLatBuV+GW2VC+5laR3rBfDOqPydyxMSmL3s=";

pkgs/applications/video/vokoscreen-ng/default.nix

@@ -22,13 +22,13 @@
 
 mkDerivation rec {
   pname = "vokoscreen-ng";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "vkohaupt";
     repo = "vokoscreenNG";
     rev = version;
-    sha256 = "sha256-Du/Dq7AUH5CeEKYr0kxcqguAyRVI5Ame41nU3FGvG+U=";
+    sha256 = "sha256-epz/KoXo84zzCD1dzclRWgeQSqrgwEtaIGvrTPuN9hw=";
   };
 
   qmakeFlags = [ "src/vokoscreenNG.pro" ];

pkgs/build-support/node/fetch-yarn-deps/index.js

@@ -22,7 +22,14 @@ const exec = async (...args) => {
 
 const downloadFileHttps = (fileName, url, expectedHash, hashType = 'sha1') => {
 	return new Promise((resolve, reject) => {
-		https.get(url, (res) => {
+		const get = (url, redirects = 0) => https.get(url, (res) => {
+			if(redirects > 10) {
+				reject('Too many redirects!');
+				return;
+			}
+			if(res.statusCode === 301 || res.statusCode === 302) {
+				return get(res.headers.location, redirects + 1)
+			}
 			const file = fs.createWriteStream(fileName)
 			const hash = crypto.createHash(hashType)
 			res.pipe(file)
@@ -35,6 +42,7 @@ const downloadFileHttps = (fileName, url, expectedHash, hashType = 'sha1') => {
 			})
                         res.on('error', e => reject(e))
 		})
+		get(url)
 	})
 }
 

pkgs/build-support/release/default.nix

@@ -5,7 +5,7 @@ with pkgs;
 rec {
 
   sourceTarball = args: import ./source-tarball.nix (
-    { inherit stdenv autoconf automake libtool;
+    { inherit lib stdenv autoconf automake libtool;
     } // args);
 
   makeSourceTarball = sourceTarball; # compatibility

pkgs/build-support/release/nix-build.nix

@@ -154,8 +154,8 @@ stdenv.mkDerivation (
 
   //
 
-  (if buildOutOfSourceTree
-   then {
+  (lib.optionalAttrs buildOutOfSourceTree
+   {
      preConfigure =
        # Build out of source tree and make the source tree read-only.  This
        # helps catch violations of the GNU Coding Standards (info
@@ -170,5 +170,5 @@ stdenv.mkDerivation (
           ${lib.optionalString (preConfigure != null) preConfigure}
        '';
    }
-   else {})
+  )
 )

pkgs/build-support/release/source-tarball.nix

@@ -10,7 +10,7 @@
     if officialRelease
     then ""
     else "pre${toString (src.rev or src.revCount or "")}"
-, src, stdenv, autoconf, automake, libtool
+, src, lib, stdenv, autoconf, automake, libtool
 , # By default, provide all the GNU Build System as input.
   bootstrapBuildInputs ? [ autoconf automake libtool ]
 , ... } @ args:
@@ -73,7 +73,7 @@ stdenv.mkDerivation (
   }
 
   # Then, the caller-supplied attributes.
-  // args //
+  // (builtins.removeAttrs args [ "lib" ]) //
 
   # And finally, our own stuff.
   {
@@ -117,7 +117,7 @@ stdenv.mkDerivation (
       version = version + versionSuffix;
     };
 
-    meta = (if args ? meta then args.meta else {}) // {
+    meta = (lib.optionalAttrs (args ? meta) args.meta) // {
       description = "Source distribution";
 
       # Tarball builds are generally important, so give them a high

pkgs/data/fonts/iosevka/bin.nix

@@ -11,7 +11,7 @@ let
     (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "25.0.1";
+  version = "25.1.1";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";

pkgs/data/fonts/iosevka/variants.nix

@@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "0lmr4xqmyr4pz1xz0iw71zjwa9xn0nbkzxr1q3mdv3x12pdp0r11";
-  iosevka-aile = "1l4bmn1cangjn91rq2w40np6dkcw34l8yvfbsqpmbzfqsz34ga61";
-  iosevka-curly = "1sp8ig31s8rq91vl2ziv3ixqh50qdvnnlx6fjiccyxza079kxjw0";
-  iosevka-curly-slab = "08jmmshflmhwwaa184aggxbmwfj4q1czynl52cz1may3cgvjr9za";
-  iosevka-etoile = "1zvd8n7vm5za2jlply796hvzar92g73ibkhdc4r8d38148xxmwp2";
-  iosevka-slab = "1xfrs95d1dzjz9dlgyn49xryyjzm711frxi45931l6i2jxppgz74";
-  iosevka-ss01 = "0q9q5vx4p1r29l404yadbi4qslrjzgkisk6hk04xrhhrmkhh4b5j";
-  iosevka-ss02 = "1nd7lyjcciirq146lj9crxrbxp82q29lclbhmxvkszlymif36vr5";
-  iosevka-ss03 = "1rkgqhbh3c77jzysn0hdci2lgw1ss0f98zdnc2xfwhzimhlcsb2n";
-  iosevka-ss04 = "17dcgbjhvyjcmk4jzf55faqwb30inhx98qldpjx66rkjg274dady";
-  iosevka-ss05 = "1prpxj9hphhpmjpn001gznwmphijv4fkd1m5yr6zyyq10zyawx1j";
-  iosevka-ss06 = "0narnyrfk88rclgm1caaqd7rmisbviizzrp4g54naxsmwhxj6zvd";
-  iosevka-ss07 = "00v615vs6kmnxv7zql04b01dxc0ngdkpin51qi8fdld1nwy3gw4j";
-  iosevka-ss08 = "1rzjpp82s2y2zybyh20406c131wk1mfazc4fzc766an87gip8409";
-  iosevka-ss09 = "0amq785n58f1f92vi7xv4zsx91v5a3rkksk5yifysnc6pkxjs56w";
-  iosevka-ss10 = "062x74l5df1ahxb7a27nrya6nh49dl0pi5c88v78hi2m85baviar";
-  iosevka-ss11 = "06ak3wlxf472vpl5z02fg92z4hiycxvqj411g9cpfz7kg6y006fb";
-  iosevka-ss12 = "1jny1y27swpzm2cqbavkkkbi3k1v2z2hy17l9arr9dv54bnm2d57";
-  iosevka-ss13 = "0aylmsnhbrjckj012s7j6x0gikldiln60grjnp4h1z80nhs6md3a";
-  iosevka-ss14 = "0j6v8bihckwp0bhs80zwr1rsrdf4bhaqjzwjx2mr9d63dnhj5lp9";
-  iosevka-ss15 = "0xs52nbmj1g43x943vvb4pnms1i98ffidkad79f63nhw0x0ygr01";
-  iosevka-ss16 = "0p9g432d44rdiv9bs5z0irdamqsknsi82snxyrmjplgy7m1frv9k";
-  iosevka-ss17 = "1bvc9782yry9klkinfwrbn59mclcpizmv3yndz4b1ixv8dgym65z";
-  iosevka-ss18 = "1a4m0drdg4f3rpxcjm899rzpym2m0hhiypwg61506nww1jcl8kk8";
-  sgr-iosevka = "1xwpg3cq2587m8az2sfpd0k3pmvd8w4ci1jl7717fap38drl86ba";
-  sgr-iosevka-aile = "0qjds4jhdzgnar0xdbz315kb2f4hxgh6xi8sdqpfbg84wjaj9872";
-  sgr-iosevka-curly = "1qxyncllbbi1pcq7ajq63127k4q119cag76yyh3xpwl2f235ybrx";
-  sgr-iosevka-curly-slab = "1bp44hgmc81avvpwdckjkmh049igfdfppnmmmpxmy55xzpmy30ik";
-  sgr-iosevka-etoile = "0jvnlrz7mxrm0lg7wkdh3pz529xmssw63rgi0nfdy77zga3gv8r4";
-  sgr-iosevka-fixed = "0bqdfq1xaanqpv1s9skapch184hcvbmdpcnjh7skms5ggcal7s3n";
-  sgr-iosevka-fixed-curly = "0a7agrgi4qi3dk8yix3p9kbjvyqbxvm4lc0b75ywa8330g42khf5";
-  sgr-iosevka-fixed-curly-slab = "0kxgkhvhz4l7ifc591c1n112wkcimfl417p49s3k5rx19yadz3rv";
-  sgr-iosevka-fixed-slab = "1aq7qc6jjm7wkd5ng937gbv5l82gqx9snm4ffpp2k5zk8nnm38lv";
-  sgr-iosevka-fixed-ss01 = "12gfppvi8vfp6y6y96zd6yvpb8xlr907gzhz04vm3j9m2dx8mdpz";
-  sgr-iosevka-fixed-ss02 = "1ip6yx99rfa09bx64ah8bk5jp8w0x1qsdjknda7fwd8n1ian9qb1";
-  sgr-iosevka-fixed-ss03 = "0cbayci1j0qj0xbydkxl4g8p4rdhjpdkjy6vb5zsxrx8rcxzmh6r";
-  sgr-iosevka-fixed-ss04 = "1nm1wbax6xlxhsnw3522wi9dzzzr8k92464p9w31krrajlji46bn";
-  sgr-iosevka-fixed-ss05 = "0y68rh0352idl0ncmx0lngbc6jj98incsnlh8xn55qggawah2g7l";
-  sgr-iosevka-fixed-ss06 = "0x4azqmmznzaimg3ahv8kl0zcl3bdmrq4lqrvy94qz5ivgfnr7zv";
-  sgr-iosevka-fixed-ss07 = "1l29i7q8zyw4cz21dqz2bc74c60grmmasiy3l31awrbwmabncqms";
-  sgr-iosevka-fixed-ss08 = "1zlfqrkbsysi2nzfmvmz4yfbjngx3wpi3c68b4nkd8wdabll7a4m";
-  sgr-iosevka-fixed-ss09 = "1631yavmr59lvmqhp3940n19200zsphy2fvq9kdg0xnrr9hgcgk0";
-  sgr-iosevka-fixed-ss10 = "131crnfgvhxakggmvgk6apji8w3wkbgzm9ma77sz9ib9hcfrcn1f";
-  sgr-iosevka-fixed-ss11 = "1gwz51ck1jdfww1g2yxzrjhyl3i41mqm6cykm2587r9kr5igxbyq";
-  sgr-iosevka-fixed-ss12 = "198v6chwk948q7yikv06s4lydhyg4vq4s6ssl4fvay7d7jg33s5j";
-  sgr-iosevka-fixed-ss13 = "1fg77lzw05qijap03l8f5k5lmfrn6phxpswvmzvlzzdscb5f2f3a";
-  sgr-iosevka-fixed-ss14 = "1rhlja6vl1rdgp3r1ls3ycdr19x4bb0azyras7pamv2g5wbcrzv8";
-  sgr-iosevka-fixed-ss15 = "03i2cr65368w8naqqyvhmry2sphihcdy3vw7pbq2mknn1ygrhafp";
-  sgr-iosevka-fixed-ss16 = "1zxjik8z4jmq73fwfzg3y74wfp8a4yiy1dvm5g73b1r3jjc413dz";
-  sgr-iosevka-fixed-ss17 = "0hxsa0bkf6yfh4hvs3h83myp3iil40c0629biys6h5a79nvqgxpr";
-  sgr-iosevka-fixed-ss18 = "1zrnzrrzv1iw1aqa24khcxpwsg8fhvcbbs71j91j7yp5s070szar";
-  sgr-iosevka-slab = "1d9lffq7xd6liglrr8kcymkq2bkvnz9cxnq4m5bby5h48vxr72j5";
-  sgr-iosevka-ss01 = "1aa36415rpn4ihsd43mj1pgsjsiy4y2wr4ybckjyg7av1wi0n0rs";
-  sgr-iosevka-ss02 = "0khj2j30q5zdygabmx45wn20g140zafifyg93fk9zp0ivs7xm13g";
-  sgr-iosevka-ss03 = "0qvhlqc51bislhdhs61vv21dw0rvvf5sg9m7zk81d74harxba0qz";
-  sgr-iosevka-ss04 = "0zpx6dpgivmk4gnf5w17978pd7cpq0f4j7ly53ykwa6ngjwq7cxq";
-  sgr-iosevka-ss05 = "0jsaf52jydp4hah5q8l7sky1d7j3amkj7hs08qraw1h4bxbhqdq2";
-  sgr-iosevka-ss06 = "0yh39c3bb59imysb0jyb0w006lhf5627ck4lkbv3pffa3jaskfrm";
-  sgr-iosevka-ss07 = "1pm7pml2y9hfl8xpf0ggprvzc9yqxf2dpi64zsrbh950d41wmxyj";
-  sgr-iosevka-ss08 = "11dqssnw6bhvsplc4sd8jvwhnmk6k8f506m8j26v2gr5iqk773kj";
-  sgr-iosevka-ss09 = "014182zym2rw5zakpjaf921mpvxlr6ic24ag09c79c0w9mi2jnff";
-  sgr-iosevka-ss10 = "0wzfxrhx173yga3s1ln1709wwxf4hbqym4sdg9jz3dn2hdn1f55j";
-  sgr-iosevka-ss11 = "0wh1dy6w3sgw9xw2nda0xpa931v66nxv4kd4q4s8r9g6s5kbpj35";
-  sgr-iosevka-ss12 = "1dnh7gs5lyyc4n7jmnl6c9qcsj7fnhzlyy8kxmsgn5hxfzjn42i8";
-  sgr-iosevka-ss13 = "0g47da6ah2skrxs522q9w3aamrpyfhixg9cpqy0sgyxraw2iaq3d";
-  sgr-iosevka-ss14 = "1if7hs8wjw7fs0j46camazmc93p0z1hz43i0rrkjxnai6cjqkaqj";
-  sgr-iosevka-ss15 = "05h5yzpzx9xlf8xwkw8inp16x0arpdcfrklc62qdi87mdnfpkw8w";
-  sgr-iosevka-ss16 = "01d3w7yblfbca3l2cmazh72f5a0z3wnb5d77rlw9wlvgw0drj8b0";
-  sgr-iosevka-ss17 = "0sl94iaw038kljr78ms42vjqyj55pbyslxbm0b81fg6xkjy6q60n";
-  sgr-iosevka-ss18 = "17395mrpjz1rmh5661s1v1ja53qhygf3zalqabya7cwfb1hz0xqy";
-  sgr-iosevka-term = "10zg4365w5f554zdcdq4h7ixq3aq1lm21qndffp4q5c0kv57ggak";
-  sgr-iosevka-term-curly = "19lkavcwpy7hsgmxz2jwlvbx9lsi8wm3xrypcb0wbcy80hjgkms2";
-  sgr-iosevka-term-curly-slab = "1asdfglxskg6cikhhxx83jpwqsq3adrb5zgk94h1m2sv2xpcd65i";
-  sgr-iosevka-term-slab = "0rsl048jzbf4fwindxxrlb2fwivjjayydc3fs8v92xg239y45m35";
-  sgr-iosevka-term-ss01 = "17hin55idhzvcvrpvgpgjwkn29zsckmvjygbsjf560vy3cv48nlg";
-  sgr-iosevka-term-ss02 = "0xnr89bdifbydgy7xbkg1msqxyjxp7l0rxby19bayd6f5lyh552s";
-  sgr-iosevka-term-ss03 = "1ijz7qjym1fdrrjyi4g7lkl75frbcyh5ds548szwdavffh9ad74d";
-  sgr-iosevka-term-ss04 = "1xrmlsp0gggqzgqckgp5r3h445xyglqid2g6f0fblcv5a79kp04w";
-  sgr-iosevka-term-ss05 = "1d4llq2g6s9pp3ajl9spca5bpkk24kba4ki847gi55i7lpw4d1kl";
-  sgr-iosevka-term-ss06 = "1wbqsgng4r3b588lnip0li321ibrnc4i39jjmvrs9c8xmgzswfjg";
-  sgr-iosevka-term-ss07 = "0jxq4ygc6afq4vfgzrpsvhdw52535yqk6702nb5frlf9bllxpali";
-  sgr-iosevka-term-ss08 = "1hqs6j38sghi1v86l83rhkyl7frsph7dp9jnhmzzb6w70ikbmajx";
-  sgr-iosevka-term-ss09 = "0h8cf76s7dsa6gfsf9sxiri98d8crsdq2a2cjmn5iz9cxwnnrf0h";
-  sgr-iosevka-term-ss10 = "0p3643d444r03y74djhpmgdz4f6ydwkhddgw4fpjhx4sg226yvfc";
-  sgr-iosevka-term-ss11 = "0ak3w6h58wnpcxahdmdij52izvlq49allvrlq1syziaqd6b95qpz";
-  sgr-iosevka-term-ss12 = "0km4sfg4q1z6b999piiiaiv6qxnvanw1s0jgrvy933fxyv7n4h7a";
-  sgr-iosevka-term-ss13 = "0xhimnsspan0mcmspvz1r412q4rzririjnj744mgxs339w1bi6bh";
-  sgr-iosevka-term-ss14 = "0h1v4lvf367p7w5m8s3mncp2ssfncxrixn1grj1nigijdc53m7ws";
-  sgr-iosevka-term-ss15 = "1pppczbfv0dh7dnf39rw23qmr1h8ixkgw3gc6yashjni0jd9rr3r";
-  sgr-iosevka-term-ss16 = "06fradackj5xi8j79sv16mnrxv91s596n04w6l3s29dcsmahf3yv";
-  sgr-iosevka-term-ss17 = "0g4pv6v09n0xpxai3i79bhjspabvadv4wd4r1ryms6jyfdn9n367";
-  sgr-iosevka-term-ss18 = "00zv631z48ifkpaw4idr9r6q2zdjv7m7i19xb33gv8yvfv96s3hz";
+  iosevka = "1qs8z085mwg3ay0pn2b7ka21cb4xd1hf9yziiszajb94bkxwl77s";
+  iosevka-aile = "12dg6s8bhx739y8slp2s783af3ysipdb640xl67v8jnznmj2vyg1";
+  iosevka-curly = "1ypbfv41qvwpg7dc9hhsyqrnavd6926568rcnvj9j99j5dm8nl37";
+  iosevka-curly-slab = "0r7n83ddq8w8ih6fsij7v9xkr8z5cvnfq6i921jsm0l5x03f7rxh";
+  iosevka-etoile = "1gazc1vz54lgg3hxcqryh5nl1grlngpkph4l4i292k014ky32gf6";
+  iosevka-slab = "02lgwmvzcpjz8n78vvxm7w7pff9s6008ca5i8fvl4m24k051jfdy";
+  iosevka-ss01 = "07gir5wszdnzrh32978kwg8rhychkjjqqwhdgslrxjfwnlrzpjq3";
+  iosevka-ss02 = "15sqkk0w39cj8lyjfhs70if7k1adgql18kkmyf3bx1h92xys18ca";
+  iosevka-ss03 = "0gi3gm0byg8vhicgfxvcvja1cz9qs8ahryk9yn5896yiyps1djfa";
+  iosevka-ss04 = "19l3g2vdms6nnyhpi5fjnsk0ym0b8ypa30riha1z8pkzhfk650gp";
+  iosevka-ss05 = "1zl2mc0yxb4gwx47pzhcg8q8vk3k269sf8x2i6l4iki5qapi3436";
+  iosevka-ss06 = "1d28ks82y74wyla8y7203bpdi6rz304glwmkbv2blfn3n4d5ncga";
+  iosevka-ss07 = "1fw0n005b8lhy36qcy0a8flnv6y0mi7s4d9dx6gjbl1hsyykhppl";
+  iosevka-ss08 = "1w0invhhwqy2braxm6n99g33l8sxdi0y5lbdxrhdypqrrg32bk2n";
+  iosevka-ss09 = "1ai0r32s5y1sjsidxal1ah5bj6agh33ljiklnjs3ni9f6kxcqbds";
+  iosevka-ss10 = "1qwzzndnhivs3m7kk3izhyd07vb3zx7pankkq0vdxiynpais9pjy";
+  iosevka-ss11 = "14nw87kcidm9hds4z0rw3c5alnilgzrkgrbxg7kvsb0xxvw2xlha";
+  iosevka-ss12 = "0gpy6pmirsp69vyyq7v3cxvn5dyv5k740qs76a13n5x0lvvapjyj";
+  iosevka-ss13 = "1gsggzar1kqk1mqncp7jry8pp8nmr9p2ip309dl6di4b4c6cfplh";
+  iosevka-ss14 = "1km4a6jhjmwl4wmapfhshqvf64dc87bfi89n5m34x91qlnw1xmfw";
+  iosevka-ss15 = "02pj2mhyx3j4md9v2n1kbr4b1cx84rc5fcggl9i718qwryh55bg5";
+  iosevka-ss16 = "0a4nwl4am410nklvzmr66z5vmbmq2v243div3r73nkwx6qzn7g64";
+  iosevka-ss17 = "1hmdhp87qy0q4wnrfnc5vrv0n8dfn3cnlmc6j817pazra5lv0b09";
+  iosevka-ss18 = "12jhd998m976cz65y8r12jaiy6ybrzc0zxb1i9sl72k9c9qdsy87";
+  sgr-iosevka = "16n0y3qa7914xv1x8md12hfv1fz1alfgj16lsxcb8zmp8phbswqd";
+  sgr-iosevka-aile = "1dmyx30yq1avdnr7f9hz9mjyi4awd6k0sr4svmhxihr4lmvzabhn";
+  sgr-iosevka-curly = "0mgyh6qf5c85z9j8kcnfzyzmak6pj9s6k2da0ggyrhv1iqsjnpai";
+  sgr-iosevka-curly-slab = "0va38lmja77mnnyr3xzdqa37xv4cz7jf8hcxr1p21yhd681gznbg";
+  sgr-iosevka-etoile = "1r6ai6ph5nbqxyrrzs945y02mcd4kdj2ckaadar4mlc8hwmdvdkx";
+  sgr-iosevka-fixed = "0dwk1gvszq0d8x22fa57ka3l0n7c6yga2k2vdk2kpv9aq2rlb6p9";
+  sgr-iosevka-fixed-curly = "11vwsdhkqwzmifx6snxffn503bli0ikqnhc12q1y4j8rccn7xyhz";
+  sgr-iosevka-fixed-curly-slab = "06r4rl696250ny0jw9v8z13f10yp64g09kk8hpcm3rq9xwvfkra4";
+  sgr-iosevka-fixed-slab = "1wi92bykv4v7dsnm6qbhh5ydy3mwzxwjkvmycvwjac64hpicj2as";
+  sgr-iosevka-fixed-ss01 = "1nacy9lr64v0lfhq61b442b9fr1q14bchydbh33fvk7wnkydkfnl";
+  sgr-iosevka-fixed-ss02 = "1cb55b07f339q6mbv1v5rqh37m3b4zhlzz2fg08h97xvb3vd7n7d";
+  sgr-iosevka-fixed-ss03 = "1sjwndp4zmqjc95da9al24g5nzzlv7x9lsm9dljpcznfw88wrhsy";
+  sgr-iosevka-fixed-ss04 = "07p9fv5aarwrbl9b9gbfwi26px53zfw14472jrasp10cl0dha12a";
+  sgr-iosevka-fixed-ss05 = "1hvdnyibzkjd89vm6ir3bpskhi75ijjcbpr7y2iir6z7xj11mzmn";
+  sgr-iosevka-fixed-ss06 = "1ram41z53w2khzhhf472a9qyhk3ikd180vnzvfasa0510c7fp2n0";
+  sgr-iosevka-fixed-ss07 = "1kkbch8zx3dzacwhkqi6yxihf3w2g0kblhdicdfhqfb57pb63ka8";
+  sgr-iosevka-fixed-ss08 = "1lw4917p842yp21m73n1k6inbdqacnqcrqr6f9995qvl9ls9l8qg";
+  sgr-iosevka-fixed-ss09 = "033wyyxyza0lvq53gaaxy1r4f9li6rmvqdqw66jq2c5mr75xajs6";
+  sgr-iosevka-fixed-ss10 = "0x0by1hbc6x89ac44x47bxn5r07znnsykhf8wx9dy82kj841h2wk";
+  sgr-iosevka-fixed-ss11 = "10rlp2xl9509rhaccyy2asi95idddzvllnwgnlr3ny9n27a9bakn";
+  sgr-iosevka-fixed-ss12 = "0jljdyya4mxxjcmfxr1q37cy95wi56swjryvn99m0d5sahim3y28";
+  sgr-iosevka-fixed-ss13 = "0524p8xrhbn0vgbc2ls3l0hpkidkksxqysrjm9c10m9z88l46laj";
+  sgr-iosevka-fixed-ss14 = "13gpnjh54583r1kl3ra3l36zmvg81kknij9a8jrgp27d3dad95wq";
+  sgr-iosevka-fixed-ss15 = "1gmwckl83r9lfizsdc5f806vism27g54wwn849dhgp8ckpp8w3sp";
+  sgr-iosevka-fixed-ss16 = "0r5r9gpjzws9j6z5a64j3sjfii7c28vshmly47rj5npgrzflanmf";
+  sgr-iosevka-fixed-ss17 = "1yyx48liizjbprfh2pi74c26sqggvnya5ajx7gyg7z4nwgw8hirv";
+  sgr-iosevka-fixed-ss18 = "0lcjcl33qsd6xmldqv4s46l9isjfgnv2xd61c71swag0qsqavwr9";
+  sgr-iosevka-slab = "1hy9ldl53slr30zcpj1bz1nbcx2316yycmwmrrmd5pjbplbbm1kj";
+  sgr-iosevka-ss01 = "1kxzidydpr8y0fxhzm892zpl1nk3a1xdpdcx3ndnkbj99rhqbkfv";
+  sgr-iosevka-ss02 = "02fzavi20m00l4rg995811x97x7bnv5hgc6bfllqy5x7vwry2a0g";
+  sgr-iosevka-ss03 = "0vb863m8gxy7iq7b4a9lmphn39pz1v46x131isqd2n1d06bbn80r";
+  sgr-iosevka-ss04 = "0fv506x069bgcvrhyzqw1vmd9s553k8pixsgyqy86dn3gy7hdaxz";
+  sgr-iosevka-ss05 = "1mk8f5kk41dpf16hf44ikb2a4hx9i7k1y9dnxnd3f2j8wwizg9mw";
+  sgr-iosevka-ss06 = "1v0llv8s98fihim8ay01qv4jc5dyn0hcczh9m63ap733m5rsi97d";
+  sgr-iosevka-ss07 = "1rbb6imadzlwrraa4y4bs967h4lz6jvxqjrlr6xgrc11ndb1zfng";
+  sgr-iosevka-ss08 = "13h027413rsx8x9snmjq4d4apsxwgjx6nqxrr3ndm16w3qqv6hwx";
+  sgr-iosevka-ss09 = "162m4rnad25gsgc80jvf9ipzxf32ls4pr5279ffypjglxb37vfmx";
+  sgr-iosevka-ss10 = "1jywagwqna5sw4q7973g85fj93gbhzmbhhwnz56yziywc52nh050";
+  sgr-iosevka-ss11 = "0y7fr7hd1gd6cbfhnfdbhxsa46i1mlh86qkp3397knjqx81i6mi0";
+  sgr-iosevka-ss12 = "1hd9p48mg4i4h8agyc9wbss0870g76mr8b9cvzf9dpn2p3nf7s96";
+  sgr-iosevka-ss13 = "1x6wvl2v8alqk3iybw05z8k8fwwv4j3si5f2308db9r9phhh5qj0";
+  sgr-iosevka-ss14 = "1rgk6g80x6gllk5zkragsnlv38jyzlisjcc802xwpq163lvq135q";
+  sgr-iosevka-ss15 = "010fqzcfv9i5z23wbd393vgwcy22am2ly3i44np2ihbkb47aq6v9";
+  sgr-iosevka-ss16 = "01f8827cx7nhflrvw2qflz3ahb2a5fdl832x18vaz81qbgkrn9lj";
+  sgr-iosevka-ss17 = "11z67iwj6njlg35wm35wx8wpx2vmg1w8pl3fhncm25vi245mjd9g";
+  sgr-iosevka-ss18 = "1h7ggiqvc169fk66kmxfpgbpmh7949smlanjcxamicsdllrr1ib8";
+  sgr-iosevka-term = "0bdshfvapw0c0l6jd2fbkyfz07nxjhi4hjvc8r18r8i1ij8ak4w7";
+  sgr-iosevka-term-curly = "1smkblav040fh7jslqa20p9zprcan5cfb8q0bi767rrnmnwndxf7";
+  sgr-iosevka-term-curly-slab = "07si1d5vly2q88hmws4fjaia3758dllhqjvbv67hyhfxrvr17nbg";
+  sgr-iosevka-term-slab = "1kw395l5xs674y9g55074rvv4p24qvy61yvjvx9vs51h5il0cvp0";
+  sgr-iosevka-term-ss01 = "11i2fymlaz841vc1m05ig6qr49sks1zymg3wi8a63gx8nq0m0c0d";
+  sgr-iosevka-term-ss02 = "06nffhxmyzz1x28i4cmp5g6a07wm8f91715lngajgm6jzm168vgp";
+  sgr-iosevka-term-ss03 = "1yrdaqdpcxx7d6cljlmna9zc9avsmv94156q9yg1q638rxj34kp6";
+  sgr-iosevka-term-ss04 = "186s3b8zqid0yj6a0qwvi5pxnfw54yzs4vvw94apka0yl4857ipk";
+  sgr-iosevka-term-ss05 = "177z1hlrk5agrsh2sn6xmggpq7xfjlh5nz4azi71nzg60c0k6312";
+  sgr-iosevka-term-ss06 = "0l69ajjil23qr3p4xw0578nj666ry0q370fyzb0mv9jk3q9yv3yc";
+  sgr-iosevka-term-ss07 = "0hr9ls5l6ik5i5j6kx6imr3m9ymdbnkf6gmvswlikw21q609nvxm";
+  sgr-iosevka-term-ss08 = "11bs0swb8vz138yb91gx901r3cg0snz7334hbdl4nxsa8wrphrmw";
+  sgr-iosevka-term-ss09 = "1279gxl2j81shnh6s85p6xgb651mn83f9g0dr0bic53gbqfjxs26";
+  sgr-iosevka-term-ss10 = "1v0x771pk0qdpb50hsihqvzf0q8fgg9z8fliwjpgjfkzgx85fl95";
+  sgr-iosevka-term-ss11 = "1jg92awghy3qgziw7shizc35pwdxnm6xi3ss4381xbcmg3vhr64j";
+  sgr-iosevka-term-ss12 = "1jy5nq0zpv6bnxd4c5vi13p8p4fgsc3q6b4wbzq30hipq4ikq9ci";
+  sgr-iosevka-term-ss13 = "1hnqmfz82a39myzw93pwx5jcv6hh626plysmsxv96qds3qyzz646";
+  sgr-iosevka-term-ss14 = "181d1alrk0amdbpg96s0qgzmqgmgs248wmrmkrzzamj4r5a981qp";
+  sgr-iosevka-term-ss15 = "1a0naw45cjq6pdizy9sqq0lqbv7aawy7cjy2mf98f5059hmarqr2";
+  sgr-iosevka-term-ss16 = "1a5lby135y5l65fpz5fcd7hdf7xy7dmi8mrjc68ihb1b52p1vp99";
+  sgr-iosevka-term-ss17 = "00m0f1infr6qgd7126szbp4xkz3x0wpnybwbchyf28rm3jrjcnrr";
+  sgr-iosevka-term-ss18 = "0i0kp7jfwlb73dx44q8pfwpyzzn24hinfhaxnvf78dv2k9623q5a";
 }

pkgs/data/icons/banana-cursor/default.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "banana-cursor";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "ful1e5";
+    repo = "banana-cursor";
+    rev = "v${version}";
+    sha256 = "sha256-PI7381xf/GctQTnfcE0W3M3z2kqbX4VexMf17C61hT8=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/share/icons
+    mv themes/Banana $out/share/icons
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/ful1e5/banana-cursor";
+    description = "The banana cursor theme";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ yrd ];
+  };
+}

pkgs/data/icons/numix-icon-theme-circle/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "23.07.08";
+  version = "23.07.21";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-JToou95HIrfqdT0IVh0colgGFXq3GR2D3FQU0Qc57Y4=";
+    sha256 = "sha256-QwbjJ38fWRkzd1nmsPWcwUQ7p96S/tGEvIfhLsOX1bg=";
   };
 
   nativeBuildInputs = [ gtk3 ];

pkgs/data/misc/v2ray-domain-list-community/default.nix

@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20230717050659";
+    version = "20230725085751";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-HmP5V02TUL48vlQ9bFRePV5l1J0ECszVzQ48UENDvuQ=";
+      hash = "sha256-4D975ASoDoXjEi0kkwsUIIT6nwOE3ggBzNUVp0ojsbQ=";
     };
     vendorHash = "sha256-dYaGR5ZBORANKAYuPAi9i+KQn2OAGDGTZxdyVjkcVi8=";
     meta = with lib; {

pkgs/desktops/pantheon/apps/elementary-calendar/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , meson
 , ninja
@@ -20,28 +19,20 @@
 , libgee
 , libhandy
 , libical
+, libportal-gtk3
 }:
 
 stdenv.mkDerivation rec {
   pname = "elementary-calendar";
-  version = "6.1.2";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "calendar";
     rev = version;
-    sha256 = "sha256-psUVgl/7pmmf+8dP8ghBx5C1u4UT9ncXuVYvDJOYeOI=";
+    sha256 = "sha256-qZvSzhLGr4Gg9DSJ638IQRLlPiZkbJUCJ7tZ8ZFZZ1E=";
   };
 
-  patches = [
-    # build: support evolution-data-server 3.46
-    # https://github.com/elementary/calendar/pull/758
-    (fetchpatch {
-      url = "https://github.com/elementary/calendar/commit/62c20e5786accd68b96c423b04e32c043e726cac.patch";
-      sha256 = "sha256-xatxoSwAIHiUA03vvBdM8HSW27vhPLvAxEuGK0gLiio=";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
@@ -63,6 +54,7 @@ stdenv.mkDerivation rec {
     libgee
     libhandy
     libical
+    libportal-gtk3
   ];
 
   postPatch = ''

pkgs/desktops/pantheon/apps/elementary-tasks/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , meson
 , ninja
@@ -19,28 +18,20 @@
 , libgee
 , libhandy
 , libical
+, libportal-gtk3
 }:
 
 stdenv.mkDerivation rec {
   pname = "elementary-tasks";
-  version = "6.3.1";
+  version = "6.3.2";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "tasks";
     rev = version;
-    sha256 = "sha256-b8KUlfpZxRFDiBjgrV/4XicCcEw2fWaN78NaOq6jQBk=";
+    sha256 = "sha256-6Vwx+NRVGDqZzN5IVk4cQxGjSkYwrrNhUVoB8TRo28U=";
   };
 
-  patches = [
-    # Port to libsoup 3
-    # https://github.com/elementary/tasks/pull/345
-    (fetchpatch {
-      url = "https://github.com/elementary/tasks/commit/22e0d18693932e9eea3d2a22329f845575ce26e6.patch";
-      sha256 = "sha256-nLJlKf4L7G12ZnCo4wezyMRyeAf+Tf0OGHyT8I1ZuDA=";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
@@ -61,6 +52,7 @@ stdenv.mkDerivation rec {
     libgee
     libhandy
     libical
+    libportal-gtk3
   ];
 
   postPatch = ''

pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "switchboard-plug-keyboard";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-DofAOv7sCe7RAJpgz9PEYm+C8RAl0a1KgFm9jToMsEY=";
+    sha256 = "sha256-X5EGDS8/EazIHiDBHCisd+XPE9dMx/0lQ8hrz9imUno=";
   };
 
   patches = [

pkgs/desktops/pantheon/apps/switchboard-plugs/pantheon-shell/default.nix

@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "switchboard-plug-pantheon-shell";
-  version = "6.4.0";
+  version = "6.5.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-GJjtGLCBRISaopZWli/MfqrPcG+xjY7nHZKS+S806GI=";
+    sha256 = "sha256-iq1QXC6eQ2w5j9RCxhTc0dApMfiDGcVuj8nocEFLFNk=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/pantheon/apps/switchboard-plugs/sound/default.nix

@@ -7,6 +7,7 @@
 , pkg-config
 , vala
 , libgee
+, libhandy
 , granite
 , gtk3
 , pulseaudio
@@ -16,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "switchboard-plug-sound";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-a3GYtV0f+I9grnwndGI782/shpUWpR6GrRRD380Q6+o=";
+    sha256 = "sha256-JXt/S+vNzuRaRC0DMX13Lxv+OoAPRQmSLv9fsvnkWY4=";
   };
 
   nativeBuildInputs = [
@@ -37,6 +38,7 @@ stdenv.mkDerivation rec {
     gtk3
     libcanberra-gtk3
     libgee
+    libhandy
     pulseaudio
     switchboard
   ];

pkgs/desktops/pantheon/services/elementary-notifications/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , meson
 , ninja
@@ -27,6 +28,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-i7fSKnP4W12cfax5IXm/Zgy5vP5z7S43S80gvzWpFCE=";
   };
 
+  patches = [
+    # Fix broken notification filter
+    # https://github.com/elementary/notifications/pull/207
+    (fetchpatch {
+      url = "https://github.com/elementary/notifications/commit/4691ec869316be94598d8e55e1cd3bd525e8e149.patch";
+      sha256 = "sha256-4x/Us92Mgws5v+ZQiKvjQ4ixfBnU8oTQ92rc+nf8Zdg=";
+    })
+  ];
+
   nativeBuildInputs = [
     glib # for glib-compile-schemas
     meson

pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix

@@ -10,6 +10,7 @@
 , accountsservice
 , dbus
 , desktop-file-utils
+, fwupd
 , geoclue2
 , glib
 , gobject-introspection
@@ -22,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-settings-daemon";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "settings-daemon";
     rev = version;
-    sha256 = "sha256-5QdCj2Z31t7dxZi7ZZ5g6qLgsMyw7rM5dRw0G8uoC6o=";
+    sha256 = "sha256-464caR36oSUhxCU0utP5eMYiiBekU6W4bVIbsUoiFRI=";
   };
 
   nativeBuildInputs = [
@@ -45,6 +46,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     accountsservice
     dbus
+    fwupd
     geoclue2
     glib
     gtk3
@@ -56,8 +58,20 @@ stdenv.mkDerivation rec {
   postPatch = ''
     chmod +x meson/post_install.py
     patchShebangs meson/post_install.py
+
+    substituteInPlace data/io.elementary.settings-daemon.check-for-firmware-updates.service \
+      --replace "/usr/bin/busctl" "${systemd}/bin/busctl"
   '';
 
+  postInstall = ''
+    # https://github.com/elementary/settings-daemon/pull/75
+    mkdir -p $out/etc/xdg/autostart
+    ln -s $out/share/applications/io.elementary.settings-daemon.desktop $out/etc/xdg/autostart/io.elementary.settings-daemon.desktop
+  '';
+
+  # https://github.com/elementary/settings-daemon/pull/74
+  PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
+
   passthru = {
     updateScript = nix-update-script { };
   };

pkgs/development/compilers/cudatoolkit/common.nix

@@ -138,7 +138,7 @@ backendStdenv.mkDerivation rec {
     (ucx.override { enableCuda = false; }) # Avoid infinite recursion
     xorg.libxshmfence
     xorg.libxkbfile
-  ] ++ (lib.optionals (lib.versionAtLeast version "12.1") (map lib.getLib ([
+  ] ++ (lib.optionals (lib.versionAtLeast version "12") (map lib.getLib ([
     # Used by `/target-linux-x64/CollectX/clx` and `/target-linux-x64/CollectX/libclx_api.so` for:
     # - `libcurl.so.4`
     curlMinimal
@@ -183,7 +183,9 @@ backendStdenv.mkDerivation rec {
     "libcom_err.so.2"
   ];
 
-  preFixup = ''
+  preFixup = if lib.versionOlder version "11" then ''
+    patchelf $out/targets/*/lib/libnvrtc.so --add-needed libnvrtc-builtins.so
+  '' else ''
     patchelf $out/lib64/libnvrtc.so --add-needed libnvrtc-builtins.so
   '';
 

pkgs/development/compilers/jsonnet/default.nix

@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DUSE_SYSTEM_GTEST=ON"
     "-DBUILD_STATIC_LIBS=${if stdenv.hostPlatform.isStatic then "ON" else "OFF"}"
+  ] ++ lib.optionals (!stdenv.isDarwin) [
     "-DBUILD_SHARED_BINARIES=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
   ];
 

pkgs/development/compilers/purescript/purescript/default.nix

@@ -15,7 +15,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "purescript";
-  version = "0.15.9";
+  version = "0.15.10";
 
   # These hashes can be updated automatically by running the ./update.sh script.
   src =
@@ -25,17 +25,17 @@ in stdenv.mkDerivation rec {
       then
       fetchurl {
         url = "https://github.com/${pname}/${pname}/releases/download/v${version}/macos-arm64.tar.gz";
-        sha256 = "16ci26pgrw0zmnyn1zj129y9624cqwzrhqglc8mgfg4k7rxvqy2a";
+        sha256 = "1pk6mkjy09qvh8lsygb5gb77i2fqwjzz8jdjkxlyzynp3wpkcjp7";
       }
       else
       fetchurl {
-        url = "https://123.github.com/${pname}/${pname}/releases/download/v${version}/macos.tar.gz";
-        sha256 = "1xxg79rlf7li9f73wdbwif1dyy4hnzpypy6wx4zbnvap53habq9f";
+        url = "https://github.com/${pname}/${pname}/releases/download/v${version}/macos.tar.gz";
+        sha256 = "14yd00v3dsnnwj2f645vy0apnp1843ms9ffd2ccv7bj5p4kxsdzg";
       })
     else
     fetchurl {
       url = "https://github.com/${pname}/${pname}/releases/download/v${version}/linux64.tar.gz";
-      sha256 = "0rabinklsd8bs16f03zv7ij6d1lv4w2xwvzzgkwc862gpqvz9jq3";
+      sha256 = "03p5f2m5xvrqgiacs4yfc2dgz6frlxy90h6z1nm6wan40p2vd41r";
     };
 
 

pkgs/development/compilers/yosys/default.nix

@@ -71,13 +71,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname   = "yosys";
-  version = "0.30";
+  version = "0.31";
 
   src = fetchFromGitHub {
     owner = "YosysHQ";
     repo  = "yosys";
     rev   = "${pname}-${version}";
-    hash  = "sha256-qhMcXJFEuBPl7vh+gYTu7PnSWi+L3YMLrBMQyYqfc0w=";
+    hash  = "sha256-BGeqI0U2AdKgsQQw3f/C0l1ENPTlQ3Eoa8TaLRE+aWI=";
   };
 
   enableParallelBuilding = true;

pkgs/development/embedded/blisp/default.nix

@@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, argtable
+, cmake
+, libserialport
+, pkg-config
+, IOKit
+}:
+
+stdenv.mkDerivation {
+  pname = "blisp";
+  version = "unstable-2023-06-03";
+
+  src = fetchFromGitHub {
+    owner = "pine64";
+    repo = "blisp";
+    rev = "048a72408218788d519a87bcdfb23bcf9ed91a84";
+    hash = "sha256-hipJrr0D4uEN2hk8ooXeg0gv0X3w4U9ReXbC4oPEPwI=";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  buildInputs = [
+    argtable
+    libserialport
+  ] ++ lib.optional stdenv.isDarwin IOKit;
+
+  cmakeFlags = [
+    "-DBLISP_BUILD_CLI=ON"
+    "-DBLISP_USE_SYSTEM_LIBRARIES=ON"
+  ];
+
+  meta = with lib; {
+    description = "ISP tool & library for Bouffalo Labs RISC-V Microcontrollers and SoCs";
+    license = licenses.mit;
+    homepage = "https://github.com/pine64/blisp";
+    maintainers = [ maintainers.fortuneteller2k ];
+  };
+}
+# TODO: update when next stable release supports building without vendored
+# libraries

pkgs/development/interpreters/janet/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "janet";
-  version = "1.28.0";
+  version = "1.29.1";
 
   src = fetchFromGitHub {
     owner = "janet-lang";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QfW17BDP+xa+Qy9FuIioe8UY6BBGsvbSyyz6GFODg5g=";
+    sha256 = "sha256-waBOPrcZ1mNsvb2PrivYUmbUKv1mxD/rMFOCZXslyKA=";
   };
 
   postPatch = ''

pkgs/development/interpreters/python/hooks/default.nix

@@ -1,9 +1,9 @@
-self: super: with self;
+self: dontUse: with self;
 
 let
-  pythonInterpreter = super.python.pythonForBuild.interpreter;
-  pythonSitePackages = super.python.sitePackages;
-  pythonCheckInterpreter = super.python.interpreter;
+  pythonInterpreter = python.pythonForBuild.interpreter;
+  pythonSitePackages = python.sitePackages;
+  pythonCheckInterpreter = python.interpreter;
   setuppy = ../run_setup.py;
 in {
   makePythonHook = args: pkgs.makeSetupHook ({passthru.provides.setupHook = true; } // args);

pkgs/development/interpreters/python/passthrufun.nix

@@ -47,12 +47,13 @@
         selfTargetTarget = pythonOnTargetForTarget.pkgs or {}; # There is no Python TargetTarget.
       };
       hooks = import ./hooks/default.nix;
-      keep = lib.extends hooks pythonPackagesFun;
+      keep = self: hooks self {};
       extra = _: {};
       optionalExtensions = cond: as: lib.optionals cond as;
       pythonExtension = import ../../../top-level/python-packages.nix;
       python2Extension = import ../../../top-level/python2-packages.nix;
       extensions = lib.composeManyExtensions ([
+        hooks
         pythonExtension
       ] ++ (optionalExtensions (!self.isPy3k) [
         python2Extension
@@ -64,7 +65,7 @@
       otherSplices
       keep
       extra
-      (lib.extends (lib.composeExtensions aliases extensions) keep))
+      (lib.extends (lib.composeExtensions aliases extensions) pythonPackagesFun))
     {
       overrides = packageOverrides;
       python = self;

pkgs/development/libraries/armadillo/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "12.4.1";
+  version = "12.6.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    hash = "sha256-gSdjXSffuZb6tJXeb/nOhL2bXgTePAA3/CrG3pbc85c=";
+    hash = "sha256-tBAqOEeRrxbZ5fuzBvEf41ar+8oKfXynq7yaipRmECo=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/avro-c/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "avro-c";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchurl {
     url = "mirror://apache/avro/avro-${version}/c/avro-c-${version}.tar.gz";
-    sha256 = "sha256-EliMTjED5/RKHgWrWD8d0Era9qEKov1z4cz1kEVTX5I=";
+    sha256 = "sha256-nx+ZqXsmcS0tQ/5+ck8Z19vdXO81R4uuRqGSDfIEV/U=";
   };
 
   postPatch = ''

pkgs/development/libraries/cjose/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cjose";
-  version = "0.6.2.1";
+  version = "0.6.2.2";
 
   src = fetchFromGitHub {
     owner = "zmartzone";
     repo = "cjose";
     rev = "v${version}";
-    sha256 = "sha256-QgSO4jFouowDJeUTT4kUEXD+ctQ7JiY/5DkiPyb+Z/I=";
+    sha256 = "sha256-vDvCxMpgCdteGvNxy2HCNRaxbhxOuTadL0nM2wkFHtk=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config doxygen ];

pkgs/development/libraries/gexiv2/default.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gexiv2";
-  version = "0.14.1";
+  version = "0.14.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "7D7j7DhguceJWKVdqJz3auIwWEjhL0GUW3tSEk2PbPk=";
+    sha256 = "Kgyc9I++izQ1AIhm/9QLjt2wZn0iErQjlv32iOk84L4=";
   };
 
   nativeBuildInputs = [
@@ -54,11 +54,6 @@ stdenv.mkDerivation rec {
     "-Dtests=true"
   ];
 
-  # Needed for darwin due to std::auto_ptr in exiv2 header files & enabling C++ 17
-  # https://github.com/Exiv2/exiv2/issues/2359
-  # https://gitlab.gnome.org/GNOME/gexiv2/-/issues/73
-  env.NIX_CFLAGS_COMPILE = "-D_LIBCPP_ENABLE_CXX17_REMOVED_AUTO_PTR";
-
   doCheck = true;
 
   preCheck = let

pkgs/development/libraries/hfst-ospell/default.nix

@@ -0,0 +1,46 @@
+{ lib
+, stdenv
+, autoreconfHook
+, fetchFromGitHub
+, icu
+, libarchive
+, pkg-config
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hfst-ospell";
+  version = "0.5.3";
+
+  src = fetchFromGitHub {
+    owner = "hfst";
+    repo = "hfst-ospell";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-16H1nbAIe+G71+TnlLG0WnH9LktZwmc0d0O+oYduH1k=";
+  };
+
+  buildInputs = [
+    icu
+    libarchive
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  # libxmlxx is listed as a dependency but Darwin build fails with it,
+  # might also be better in general since libxmlxx in Nixpkgs is 8 years old
+  # https://github.com/hfst/hfst-ospell/issues/48#issuecomment-546535653
+  configureFlags = [
+    "--without-libxmlpp"
+    "--without-tinyxml2"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/hfst/hfst-ospell/";
+    description = "HFST spell checker library and command line tool ";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ lurkki ];
+    platforms = platforms.unix;
+  };
+})

pkgs/development/libraries/hfst/default.nix

@@ -0,0 +1,53 @@
+{ lib
+, autoreconfHook
+, bison
+, flex
+, foma
+, fetchFromGitHub
+, gettext
+, icu
+, stdenv
+, swig
+, pkg-config
+, zlib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hfst";
+  version = "3.16.0";
+
+  src = fetchFromGitHub {
+    owner = "hfst";
+    repo = "hfst";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-2ST0s08Pcp+hTn7rUTgPE1QkH6PPWtiuFezXV3QW0kU=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+    flex
+    pkg-config
+    swig
+  ];
+
+  buildInputs = [
+    foma
+    gettext
+    icu
+    zlib
+  ];
+
+  configureFlags = [
+    "--enable-all-tools"
+    "--with-foma-upstream=true"
+  ];
+
+  meta = with lib; {
+    description = "FST language processing library";
+    homepage = "https://github.com/hfst/hfst";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ lurkki ];
+    platforms = platforms.unix;
+  };
+})

pkgs/development/libraries/jsoncpp/default.nix

@@ -40,19 +40,13 @@ stdenv.mkDerivation rec {
     "-DBUILD_SHARED_LIBS=ON"
     "-DBUILD_OBJECT_LIBS=OFF"
     "-DJSONCPP_WITH_CMAKE_PACKAGE=ON"
+    "-DBUILD_STATIC_LIBS=${if enableStatic then "ON" else "OFF"}"
   ]
     # the test's won't compile if secureMemory is used because there is no
     # comparison operators and conversion functions between
     # std::basic_string<..., Json::SecureAllocator<char>> vs.
     # std::basic_string<..., [default allocator]>
-    ++ lib.optional ((stdenv.buildPlatform != stdenv.hostPlatform) || secureMemory) "-DJSONCPP_WITH_TESTS=OFF"
-    ++ lib.optional (!enableStatic) "-DBUILD_STATIC_LIBS=OFF";
-
-  # this is fixed and no longer necessary in 1.9.5 but there they use
-  # memset_s without switching to a different c++ standard in the cmake files
-  postInstall = lib.optionalString enableStatic ''
-    (cd $out/lib && ln -sf libjsoncpp_static.a libjsoncpp.a)
-  '';
+    ++ lib.optional ((stdenv.buildPlatform != stdenv.hostPlatform) || secureMemory) "-DJSONCPP_WITH_TESTS=OFF";
 
   meta = with lib; {
     homepage = "https://github.com/open-source-parsers/jsoncpp";

pkgs/development/libraries/libevent/default.nix

@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  configureFlags = lib.optional (!sslSupport) "--disable-openssl";
+
   preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
     MACOSX_DEPLOYMENT_TARGET=10.16
   '';

pkgs/development/libraries/libvoikko/default.nix

@@ -0,0 +1,40 @@
+{ stdenv
+, lib
+, autoreconfHook
+, hfst-ospell
+, fetchFromGitHub
+, pkg-config
+, python3
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libvoikko";
+  version = "4.3.2";
+
+  src = fetchFromGitHub {
+    owner = "voikko";
+    repo = "corevoikko";
+    rev = "refs/tags/rel-libvoikko-${finalAttrs.version}";
+    hash = "sha256-0MIQ54dCxyAfdgYWmmTVF+Yfa15K2sjJyP1JNxwHP2M=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/libvoikko";
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    hfst-ospell
+  ];
+
+  meta = with lib; {
+    homepage = "https://voikko.puimula.org/";
+    description = "Finnish language processing library";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ lurkki ];
+    platforms = platforms.unix;
+  };
+})

pkgs/development/libraries/libzip/default.nix

@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libzip";
-  version = "1.9.2";
+  version = "1.10.0";
 
   src = fetchurl {
     url = "https://libzip.org/download/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-/Wp/dF3j1pz1YD7cnLM9KJDwGY5BUlXQmHoM8Q2CTG8=";
+    sha256 = "sha256-UqYLRhglh+CDtx4rgvyqumTdXrAcWx8bxxBpo4WOQP4=";
   };
 
   outputs = [ "out" "dev" "man" ];

pkgs/development/libraries/movit/default.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "movit";
-  version = "1.6.3";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "https://movit.sesse.net/${pname}-${version}.tar.gz";
-    sha256 = "164lm5sg95ca6k546zf775g3s79mgff0az96wl6hbmlrxh4z26gb";
+    sha256 = "sha256-I1l7k+pTdi1E33Y+zCtwIwj3b8Fzggmek4UiAIHOZhA=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/omorfi/default.nix

@@ -0,0 +1,81 @@
+{ lib
+, stdenv
+, autoreconfHook
+, cg3
+, fetchFromGitHub
+, hfst
+, hfst-ospell
+, icu
+, libvoikko
+, makeWrapper
+, pkg-config
+, python3
+, zip
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "omorfi";
+  version = "0.9.9";
+
+  src = fetchFromGitHub {
+    owner = "flammie";
+    repo = "omorfi";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-UoqdwNWCNOPX6u1YBlnXUcB/fmcvcy/HXbYciVrMBOY=";
+  };
+
+  # Fix for omorfi-hyphenate.sh file not found error
+  postInstall = ''
+    ln -s $out/share/omorfi/{omorfi.hyphenate-rules.hfst,omorfi.hyphenate.hfst}
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    cg3
+    makeWrapper
+    pkg-config
+    python3
+    zip
+    python3.pkgs.wrapPython
+  ];
+
+  buildInputs = [
+    python3.pkgs.hfst
+    hfst-ospell
+    libvoikko
+  ];
+
+  # Supplied pkg-config file doesn't properly expose these
+  propagatedBuildInputs = [
+    hfst
+    icu
+  ];
+
+  # Wrap shell scripts so they find the Python scripts
+  # omorfi.bash inexplicably fails when wrapped
+  preFixup = ''
+    wrapPythonProgramsIn "$out/bin" "$out ${python3.pkgs.hfst}"
+    for i in "$out/bin"/*.{sh,bash}; do
+      if [ $(basename "$i") != "omorfi.bash" ]; then
+        wrapProgram "$i" --prefix "PATH" : "$out/bin/"
+      fi
+    done
+  '';
+
+  # Enable all features
+  configureFlags = [
+    "--enable-labeled-segments"
+    "--enable-lemmatiser"
+    "--enable-segmenter"
+    "--enable-hyphenator"
+  ];
+
+  meta = with lib; {
+    description = "Analysis for Finnish text";
+    homepage = "https://github.com/flammie/omorfi";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ lurkki ];
+    # Darwin build fails due to hfst not being found
+    broken = stdenv.isDarwin;
+  };
+})

pkgs/development/libraries/science/math/cudnn/generic.nix

@@ -94,6 +94,7 @@ in
     # Without --add-needed autoPatchelf forgets $ORIGIN on cuda>=8.0.5.
     postFixup = strings.optionalString (strings.versionAtLeast versionTriple "8.0.5") ''
       patchelf $out/lib/libcudnn.so --add-needed libcudnn_cnn_infer.so
+      patchelf $out/lib/libcudnn_ops_infer.so --add-needed libcublas.so --add-needed libcublasLt.so
     '';
 
     passthru = {

pkgs/development/libraries/tclap/1.4.nix

@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, fetchgit
+, cmake
+, doxygen
+, python3
+}:
+stdenv.mkDerivation {
+  pname = "tclap";
+
+  # This version is slightly newer than 1.4.0-rc1:
+  # See https://github.com/mirror/tclap/compare/1.4.0-rc1..3feeb7b2499b37d9cb80890cadaf7c905a9a50c6
+  version = "1.4-3feeb7b";
+
+  src = fetchgit {
+    url = "git://git.code.sf.net/p/tclap/code";
+    rev = "3feeb7b2499b37d9cb80890cadaf7c905a9a50c6"; # 1.4 branch
+    hash = "sha256-byLianB6Vf+I9ABMmsmuoGU2o5RO9c5sMckWW0F+GDM=";
+  };
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace '$'{CMAKE_INSTALL_LIBDIR_ARCHIND} '$'{CMAKE_INSTALL_LIBDIR}
+    substituteInPlace packaging/pkgconfig.pc.in \
+      --replace '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    doxygen
+    python3
+  ];
+
+  # Installing docs is broken in this package+version so we stub out some files
+  preInstall = ''
+    touch docs/manual.html
+  '';
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Templatized C++ Command Line Parser Library (v1.4)";
+    homepage = "https://tclap.sourceforge.net/";
+    license = licenses.mit;
+    maintainers = teams.deshaw.members;
+    platforms = platforms.all;
+  };
+}

pkgs/development/lisp-modules/packages.nix

@@ -296,12 +296,12 @@ let
 
   nclasses = build-asdf-system {
     pname = "nclasses";
-    version = "0.5.0";
+    version = "0.6.0";
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "nclasses";
-      rev = "0.5.0";
-      sha256 = "sha256-UcavZ0fCA2hkVU/CqUZfyCqJ8gXKPpXTCP0WLUIF1Ss=";
+      rev = "0.6.0";
+      sha256 = "sha256-JupP+TIxavUoyOPnp57FqpEjWfgKspdFoSRnV2rk5U4=";
     };
     lispLibs = [ self.nasdf super.moptilities ];
   };
@@ -330,10 +330,12 @@ let
 
   nhooks = build-asdf-system {
     pname = "nhooks";
-    version = "20230214-git";
-    src = pkgs.fetchzip {
-      url = "http://beta.quicklisp.org/archive/nhooks/2023-02-14/nhooks-20230214-git.tgz";
-      sha256 = "0rapn9v942yd2snlskvlr1g22hmyhlsrclahxjsgn4pbvqc5gwyw";
+    version = "1.2.1";
+    src = pkgs.fetchFromGitHub {
+      owner = "atlas-engineer";
+      repo = "nhooks";
+      rev = "1.2.1";
+      hash = "sha256-D61QHxHTceIu5mCGKf3hy53niQMfs0idEYQK1ZYn1YM=";
     };
     lispLibs = with self; [ bordeaux-threads closer-mop serapeum ];
   };
@@ -368,7 +370,7 @@ let
 
   nyxt-gtk = build-asdf-system {
     pname = "nyxt";
-    version = "3.4.0";
+    version = "3.5.0";
 
     lispLibs = (with super; [
       alexandria
@@ -437,8 +439,8 @@ let
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "nyxt";
-      rev = "3.4.0";
-      sha256 = "sha256-o+GAMHKi+9q+EGY6SEZrxKCEO4IxdOiB4oPpJPGYO0w=";
+      rev = "3.5.0";
+      sha256 = "sha256-/x3S4qAvvHxUxDcs6MAuZvAtqLTQdwlH7r4zFlKIjY4=";
     };
 
     nativeBuildInputs = [ pkgs.makeWrapper ];
@@ -451,15 +453,17 @@ let
       pkgs.gnome.adwaita-icon-theme
     ];
 
-    # This is needed since asdf:make tries to write in the directory of the .asd file of the system it's compiling
-    postConfigure = ''
-      export CL_SOURCE_REGISTRY=$CL_SOURCE_REGISTRY:$(pwd)//
-    '';
+    # This patch removes the :build-operation component from the nyxt/gi-gtk-application system.
+    # This is done because if asdf:operate is used and the operation matches the system's :build-operation
+    # then output translations are ignored, causing the result of the operation to be placed where
+    # the .asd is located, which in this case is the nix store.
+    # see: https://gitlab.common-lisp.net/asdf/asdf/-/blob/master/doc/asdf.texinfo#L2582
+    patches = [ ./patches/nyxt-remove-build-operation.patch ];
 
     buildScript = pkgs.writeText "build-nyxt.lisp" ''
       (load "${super.alexandria.asdfFasl}/asdf.${super.alexandria.faslExt}")
-      ;; There's a weird error while copy/pasting in Nyxt that manifests with sb-ext:save-lisp-and-die, so we use asdf:make instead
-      (asdf:make :nyxt/gi-gtk-application)
+      ;; There's a weird error while copy/pasting in Nyxt that manifests with sb-ext:save-lisp-and-die, so we use asdf:operare :program-op instead
+      (asdf:operate :program-op :nyxt/gi-gtk-application)
     '';
 
     # TODO(kasper): use wrapGAppsHook

pkgs/development/lisp-modules/patches/nyxt-remove-build-operation.patch

@@ -0,0 +1,12 @@
+diff --git a/nyxt.asd b/nyxt.asd
+index ea2630ce..fdf837e4 100644
+--- a/nyxt.asd
++++ b/nyxt.asd
+@@ -480,7 +480,6 @@ The renderer is configured from NYXT_RENDERER or `*nyxt-renderer*'."))
+   :defsystem-depends-on ("nasdf")
+   :class :nasdf-system
+   :depends-on (nyxt/gi-gtk)
+-  :build-operation "program-op"
+   :build-pathname "nyxt"
+   :entry-point "nyxt:entry-point")
+ 

pkgs/development/node-packages/aliases.nix

@@ -39,9 +39,11 @@ in
 
 mapAliases {
   "@antora/cli" = pkgs.antora; # Added 2023-05-06
+  "@bitwarden/cli" = pkgs.bitwarden-cli; # added 2023-07-25
   "@githubnext/github-copilot-cli" = pkgs.github-copilot-cli; # Added 2023-05-02
   "@google/clasp" = pkgs.google-clasp; # Added 2023-05-07
   "@nestjs/cli" = pkgs.nest-cli; # Added 2023-05-06
+  bitwarden-cli = pkgs.bitwarden-cli; # added 2023-07-25
   eslint_d = pkgs.eslint_d; # Added 2023-05-26
   manta = pkgs.node-manta; # Added 2023-05-06
   readability-cli = pkgs.readability-cli; # Added 2023-06-12

pkgs/development/node-packages/node-packages.nix

@@ -84332,426 +84332,6 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-  "@bitwarden/cli" = nodeEnv.buildNodePackage {
-    name = "_at_bitwarden_slash_cli";
-    packageName = "@bitwarden/cli";
-    version = "2023.7.0";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/@bitwarden/cli/-/cli-2023.7.0.tgz";
-      sha512 = "xFurknMuDhsHFcwhewZxES1rP6bWOUqI4CfHlHI+vY//vOqUGzpz3Wo/H77ki1ufpNQLq4NEFJBZsuEwF8PRgA==";
-    };
-    dependencies = [
-      sources."@ampproject/remapping-2.2.1"
-      sources."@babel/code-frame-7.22.5"
-      sources."@babel/compat-data-7.22.9"
-      sources."@babel/core-7.22.9"
-      sources."@babel/generator-7.22.9"
-      sources."@babel/helper-compilation-targets-7.22.9"
-      sources."@babel/helper-environment-visitor-7.22.5"
-      sources."@babel/helper-function-name-7.22.5"
-      sources."@babel/helper-hoist-variables-7.22.5"
-      sources."@babel/helper-module-imports-7.22.5"
-      sources."@babel/helper-module-transforms-7.22.9"
-      sources."@babel/helper-plugin-utils-7.22.5"
-      sources."@babel/helper-simple-access-7.22.5"
-      sources."@babel/helper-split-export-declaration-7.22.6"
-      sources."@babel/helper-string-parser-7.22.5"
-      sources."@babel/helper-validator-identifier-7.22.5"
-      sources."@babel/helper-validator-option-7.22.5"
-      sources."@babel/helpers-7.22.6"
-      (sources."@babel/highlight-7.22.5" // {
-        dependencies = [
-          sources."chalk-2.4.2"
-        ];
-      })
-      sources."@babel/parser-7.22.7"
-      sources."@babel/plugin-proposal-export-namespace-from-7.18.9"
-      sources."@babel/plugin-syntax-export-namespace-from-7.8.3"
-      sources."@babel/plugin-transform-modules-commonjs-7.22.5"
-      sources."@babel/template-7.22.5"
-      sources."@babel/traverse-7.22.8"
-      sources."@babel/types-7.22.5"
-      sources."@jridgewell/gen-mapping-0.3.3"
-      sources."@jridgewell/resolve-uri-3.1.0"
-      sources."@jridgewell/set-array-1.1.2"
-      sources."@jridgewell/sourcemap-codec-1.4.15"
-      (sources."@jridgewell/trace-mapping-0.3.18" // {
-        dependencies = [
-          sources."@jridgewell/sourcemap-codec-1.4.14"
-        ];
-      })
-      (sources."@koa/multer-3.0.2" // {
-        dependencies = [
-          sources."multer-1.4.4"
-        ];
-      })
-      sources."@koa/router-12.0.0"
-      (sources."@mapbox/node-pre-gyp-1.0.11" // {
-        dependencies = [
-          sources."lru-cache-6.0.0"
-          sources."semver-7.5.4"
-          sources."yallist-4.0.0"
-        ];
-      })
-      sources."@phc/format-1.0.0"
-      sources."@tootallnate/once-2.0.0"
-      sources."abab-2.0.6"
-      sources."abbrev-1.1.1"
-      sources."accepts-1.3.8"
-      sources."agent-base-6.0.2"
-      sources."ansi-escapes-4.3.2"
-      sources."ansi-regex-5.0.1"
-      sources."ansi-styles-3.2.1"
-      sources."append-field-1.0.0"
-      sources."aproba-2.0.0"
-      (sources."are-we-there-yet-2.0.0" // {
-        dependencies = [
-          sources."readable-stream-3.6.2"
-          sources."safe-buffer-5.2.1"
-          sources."string_decoder-1.3.0"
-        ];
-      })
-      sources."argon2-0.30.3"
-      sources."asynckit-0.4.0"
-      sources."balanced-match-1.0.2"
-      sources."base64-js-1.5.1"
-      sources."big-integer-1.6.51"
-      (sources."bl-4.1.0" // {
-        dependencies = [
-          sources."readable-stream-3.6.2"
-          sources."safe-buffer-5.2.1"
-          sources."string_decoder-1.3.0"
-        ];
-      })
-      sources."brace-expansion-1.1.11"
-      sources."browser-hrtime-1.1.8"
-      sources."browserslist-4.21.9"
-      sources."buffer-5.7.1"
-      sources."buffer-from-1.1.2"
-      sources."bufferutil-4.0.7"
-      sources."busboy-0.2.14"
-      sources."bytes-3.1.2"
-      sources."cache-content-type-1.0.1"
-      sources."call-bind-1.0.2"
-      sources."caniuse-lite-1.0.30001517"
-      sources."canvas-2.11.2"
-      (sources."chalk-4.1.2" // {
-        dependencies = [
-          sources."ansi-styles-4.3.0"
-          sources."color-convert-2.0.1"
-          sources."color-name-1.1.4"
-          sources."has-flag-4.0.0"
-          sources."supports-color-7.2.0"
-        ];
-      })
-      sources."chardet-0.7.0"
-      sources."chownr-2.0.0"
-      sources."cli-cursor-3.1.0"
-      sources."cli-spinners-2.9.0"
-      sources."cli-width-3.0.0"
-      sources."clone-1.0.4"
-      sources."co-4.6.0"
-      sources."co-body-6.1.0"
-      sources."color-convert-1.9.3"
-      sources."color-name-1.1.3"
-      sources."color-support-1.1.3"
-      sources."combined-stream-1.0.8"
-      sources."commander-7.2.0"
-      sources."concat-map-0.0.1"
-      (sources."concat-stream-1.6.2" // {
-        dependencies = [
-          sources."isarray-1.0.0"
-          sources."readable-stream-2.3.8"
-          sources."string_decoder-1.1.1"
-        ];
-      })
-      sources."console-control-strings-1.1.0"
-      (sources."content-disposition-0.5.4" // {
-        dependencies = [
-          sources."safe-buffer-5.2.1"
-        ];
-      })
-      sources."content-type-1.0.5"
-      sources."convert-source-map-1.9.0"
-      sources."cookies-0.8.0"
-      sources."copy-to-2.0.1"
-      sources."core-util-is-1.0.3"
-      sources."cssstyle-3.0.0"
-      sources."data-urls-4.0.0"
-      sources."debug-4.3.4"
-      sources."decimal.js-10.4.3"
-      sources."decompress-response-4.2.1"
-      sources."deep-equal-1.0.1"
-      sources."defaults-1.0.4"
-      sources."define-lazy-prop-2.0.0"
-      sources."delayed-stream-1.0.0"
-      sources."delegates-1.0.0"
-      sources."depd-2.0.0"
-      sources."destroy-1.2.0"
-      sources."detect-libc-2.0.2"
-      sources."dicer-0.2.5"
-      sources."domexception-4.0.0"
-      sources."ee-first-1.1.1"
-      sources."electron-to-chromium-1.4.466"
-      sources."emoji-regex-8.0.0"
-      sources."encodeurl-1.0.2"
-      (sources."encoding-0.1.13" // {
-        dependencies = [
-          sources."iconv-lite-0.6.3"
-        ];
-      })
-      sources."entities-4.5.0"
-      sources."escalade-3.1.1"
-      sources."escape-html-1.0.3"
-      sources."escape-string-regexp-1.0.5"
-      sources."external-editor-3.1.0"
-      sources."figures-3.2.0"
-      sources."fix-esm-1.0.1"
-      sources."form-data-4.0.0"
-      sources."fresh-0.5.2"
-      (sources."fs-minipass-2.1.0" // {
-        dependencies = [
-          sources."minipass-3.3.6"
-          sources."yallist-4.0.0"
-        ];
-      })
-      sources."fs.realpath-1.0.0"
-      sources."function-bind-1.1.1"
-      sources."gauge-3.0.2"
-      sources."gensync-1.0.0-beta.2"
-      sources."get-intrinsic-1.2.1"
-      sources."glob-7.2.3"
-      sources."globals-11.12.0"
-      sources."graceful-fs-4.2.11"
-      sources."has-1.0.3"
-      sources."has-flag-3.0.0"
-      sources."has-proto-1.0.1"
-      sources."has-symbols-1.0.3"
-      sources."has-tostringtag-1.0.0"
-      sources."has-unicode-2.0.1"
-      sources."html-encoding-sniffer-3.0.0"
-      (sources."http-assert-1.5.0" // {
-        dependencies = [
-          sources."depd-1.1.2"
-          sources."http-errors-1.8.1"
-          sources."statuses-1.5.0"
-        ];
-      })
-      sources."http-errors-2.0.0"
-      sources."http-proxy-agent-5.0.0"
-      sources."https-proxy-agent-5.0.1"
-      sources."iconv-lite-0.4.24"
-      sources."ieee754-1.2.1"
-      sources."immediate-3.0.6"
-      sources."inflation-2.0.0"
-      sources."inflight-1.0.6"
-      sources."inherits-2.0.4"
-      sources."inquirer-8.2.5"
-      sources."is-docker-2.2.1"
-      sources."is-fullwidth-code-point-3.0.0"
-      sources."is-generator-function-1.0.10"
-      sources."is-interactive-1.0.0"
-      sources."is-potential-custom-element-name-1.0.1"
-      sources."is-promise-2.2.2"
-      sources."is-unicode-supported-0.1.0"
-      sources."is-wsl-2.2.0"
-      sources."isarray-0.0.1"
-      sources."js-tokens-4.0.0"
-      sources."jsdom-22.1.0"
-      sources."jsesc-2.5.2"
-      sources."json-stringify-safe-5.0.1"
-      sources."json5-2.2.3"
-      (sources."jszip-3.10.1" // {
-        dependencies = [
-          sources."isarray-1.0.0"
-          sources."readable-stream-2.3.8"
-          sources."string_decoder-1.1.1"
-        ];
-      })
-      sources."keygrip-1.1.0"
-      (sources."koa-2.14.2" // {
-        dependencies = [
-          (sources."http-errors-1.8.1" // {
-            dependencies = [
-              sources."depd-1.1.2"
-            ];
-          })
-          sources."statuses-1.5.0"
-        ];
-      })
-      sources."koa-bodyparser-4.4.0"
-      sources."koa-compose-4.2.0"
-      sources."koa-convert-2.0.0"
-      sources."koa-is-json-1.0.0"
-      sources."koa-json-2.0.2"
-      sources."lie-3.3.0"
-      sources."lodash-4.17.21"
-      sources."log-symbols-4.1.0"
-      sources."lowdb-1.0.0"
-      sources."lru-cache-5.1.1"
-      sources."lunr-2.3.9"
-      sources."make-dir-3.1.0"
-      sources."media-typer-0.3.0"
-      sources."methods-1.1.2"
-      sources."mime-db-1.52.0"
-      sources."mime-types-2.1.35"
-      sources."mimic-fn-2.1.0"
-      sources."mimic-response-2.1.0"
-      sources."minimatch-3.1.2"
-      sources."minimist-1.2.8"
-      sources."minipass-5.0.0"
-      (sources."minizlib-2.1.2" // {
-        dependencies = [
-          sources."minipass-3.3.6"
-          sources."yallist-4.0.0"
-        ];
-      })
-      sources."mkdirp-0.5.6"
-      sources."ms-2.1.2"
-      (sources."multer-1.4.5-lts.1" // {
-        dependencies = [
-          sources."busboy-1.6.0"
-          sources."streamsearch-1.1.0"
-        ];
-      })
-      sources."mute-stream-0.0.8"
-      sources."nan-2.17.0"
-      sources."negotiator-0.6.3"
-      sources."node-addon-api-5.1.0"
-      (sources."node-fetch-2.6.11" // {
-        dependencies = [
-          sources."tr46-0.0.3"
-          sources."webidl-conversions-3.0.1"
-          sources."whatwg-url-5.0.0"
-        ];
-      })
-      sources."node-forge-1.3.1"
-      sources."node-gyp-build-4.6.0"
-      sources."node-releases-2.0.13"
-      sources."nopt-5.0.0"
-      sources."npmlog-5.0.1"
-      sources."nwsapi-2.2.7"
-      sources."object-assign-4.1.1"
-      sources."object-inspect-1.12.3"
-      sources."on-finished-2.4.1"
-      sources."once-1.4.0"
-      sources."onetime-5.1.2"
-      sources."only-0.0.2"
-      sources."open-8.4.2"
-      sources."ora-5.4.1"
-      sources."os-tmpdir-1.0.2"
-      sources."pako-1.0.11"
-      sources."papaparse-5.4.1"
-      sources."parse5-7.1.2"
-      sources."parseurl-1.3.3"
-      sources."path-is-absolute-1.0.1"
-      sources."path-to-regexp-6.2.1"
-      sources."picocolors-1.0.0"
-      sources."pify-3.0.0"
-      sources."process-nextick-args-2.0.1"
-      sources."proper-lockfile-4.1.2"
-      sources."psl-1.9.0"
-      sources."punycode-2.3.0"
-      sources."qs-6.11.2"
-      sources."querystringify-2.2.0"
-      sources."raw-body-2.5.2"
-      sources."readable-stream-1.1.14"
-      sources."requires-port-1.0.0"
-      sources."restore-cursor-3.1.0"
-      sources."retry-0.12.0"
-      sources."rimraf-3.0.2"
-      sources."rrweb-cssom-0.6.0"
-      sources."run-async-2.4.1"
-      sources."rxjs-7.8.1"
-      sources."safe-buffer-5.1.2"
-      sources."safer-buffer-2.1.2"
-      sources."saxes-6.0.0"
-      sources."semver-6.3.1"
-      sources."set-blocking-2.0.0"
-      sources."setimmediate-1.0.5"
-      sources."setprototypeof-1.2.0"
-      sources."side-channel-1.0.4"
-      sources."signal-exit-3.0.7"
-      sources."simple-concat-1.0.1"
-      sources."simple-get-3.1.1"
-      sources."statuses-2.0.1"
-      sources."steno-0.4.4"
-      (sources."streaming-json-stringify-3.1.0" // {
-        dependencies = [
-          sources."isarray-1.0.0"
-          sources."readable-stream-2.3.8"
-          sources."string_decoder-1.1.1"
-        ];
-      })
-      sources."streamsearch-0.1.2"
-      sources."string-width-4.2.3"
-      sources."string_decoder-0.10.31"
-      sources."strip-ansi-6.0.1"
-      sources."supports-color-5.5.0"
-      sources."symbol-tree-3.2.4"
-      (sources."tar-6.1.15" // {
-        dependencies = [
-          sources."mkdirp-1.0.4"
-          sources."yallist-4.0.0"
-        ];
-      })
-      sources."through-2.3.8"
-      sources."tldts-6.0.5"
-      sources."tldts-core-6.0.11"
-      sources."tmp-0.0.33"
-      sources."to-fast-properties-2.0.0"
-      sources."toidentifier-1.0.1"
-      sources."tough-cookie-4.1.3"
-      sources."tr46-4.1.1"
-      sources."tslib-2.6.0"
-      sources."tsscmp-1.0.6"
-      sources."type-fest-0.21.3"
-      sources."type-is-1.6.18"
-      sources."typedarray-0.0.6"
-      sources."universalify-0.2.0"
-      sources."unpipe-1.0.0"
-      sources."update-browserslist-db-1.0.11"
-      sources."url-parse-1.5.10"
-      sources."utf-8-validate-6.0.3"
-      sources."util-deprecate-1.0.2"
-      sources."vary-1.1.2"
-      sources."w3c-xmlserializer-4.0.0"
-      sources."wcwidth-1.0.1"
-      sources."webidl-conversions-7.0.0"
-      (sources."whatwg-encoding-2.0.0" // {
-        dependencies = [
-          sources."iconv-lite-0.6.3"
-        ];
-      })
-      sources."whatwg-mimetype-3.0.0"
-      sources."whatwg-url-12.0.1"
-      sources."wide-align-1.1.5"
-      (sources."wrap-ansi-7.0.0" // {
-        dependencies = [
-          sources."ansi-styles-4.3.0"
-          sources."color-convert-2.0.1"
-          sources."color-name-1.1.4"
-        ];
-      })
-      sources."wrappy-1.0.2"
-      sources."ws-8.13.0"
-      sources."xml-name-validator-4.0.0"
-      sources."xmlchars-2.2.0"
-      sources."xtend-4.0.2"
-      sources."yallist-3.1.1"
-      sources."ylru-1.3.2"
-      sources."zxcvbn-4.4.2"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "A secure and free password manager for all of your devices.";
-      homepage = "https://bitwarden.com";
-      license = "GPL-3.0-only";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
   "@commitlint/cli" = nodeEnv.buildNodePackage {
     name = "_at_commitlint_slash_cli";
     packageName = "@commitlint/cli";

pkgs/development/node-packages/remove-attr.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p
+#!nix-shell -i python3 -p python3
 
 import collections.abc
 import fileinput

pkgs/development/ocaml-modules/mm/default.nix

@@ -4,7 +4,7 @@
 
 buildDunePackage rec {
   pname = "mm";
-  version = "0.8.3";
+  version = "0.8.4";
 
   duneVersion = "3";
 
@@ -14,7 +14,7 @@ buildDunePackage rec {
     owner = "savonet";
     repo = "ocaml-mm";
     rev = "v${version}";
-    sha256 = "sha256-pL1e7U5EtbI8bVum7mMHUD8QFMV4jc3YFjhTOvR43kg=";
+    sha256 = "sha256-RM+vsWf2RK5dY84KcqeR/OHwO42EDycrYgfOUFpUE44=";
   };
 
   buildInputs = [ dune-configurator ];