Merge master into haskell-updates

2022-12-30 00:12:38 +00:00 · 2022-12-30 00:12:38 +00:00 · 70598b7796
commit 70598b7796
parent 31cbc81000 a8ce53810a
155 changed files with 6005 additions and 12383 deletions
--- a/doc/builders/special/darwin-builder.section.md
+++ b/doc/builders/special/darwin-builder.section.md
@ -47,7 +47,7 @@ To delegate builds to the remote builder, add the following options to your
 ```
 # - Replace ${ARCH} with either aarch64 or x86_64 to match your host machine
 # - Replace ${MAX_JOBS} with the maximum number of builds (pick 4 if you're not sure)
-builders = ssh-ng://builder@localhost ${ARCH}-linux /etc/nix/builder_ed25519 ${MAX_JOBS} - - - c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUpCV2N4Yi9CbGFxdDFhdU90RStGOFFVV3JVb3RpQzVxQkorVXVFV2RWQ2Igcm9vdEBuaXhvcwo='
+builders = ssh-ng://builder@localhost ${ARCH}-linux /etc/nix/builder_ed25519 ${MAX_JOBS} - - - c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUpCV2N4Yi9CbGFxdDFhdU90RStGOFFVV3JVb3RpQzVxQkorVXVFV2RWQ2Igcm9vdEBuaXhvcwo=

 # Not strictly necessary, but this will reduce your disk utilization
 builders-use-substitutes = true
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -9170,6 +9170,12 @@
    githubId = 1575834;
    name = "Michael Adler";
  };
+  michaelBelsanti = {
+    email = "mbels03@protonmail.com";
+    name = "Mike Belsanti";
+    github = "michaelBelsanti";
+    githubId = 62124625;
+  };
  michaelpj = {
    email = "michaelpj@gmail.com";
    github = "michaelpj";
@ -13718,6 +13724,12 @@
    githubId = 66133083;
    name = "Tomas Bravo";
  };
+  tchab = {
+    email = "dev@chabs.name";
+    github = "t-chab";
+    githubId = 2120966;
+    name = "t-chab";
+  };
  tchekda = {
    email = "contact@tchekda.fr";
    github = "Tchekda";
@ -16128,12 +16140,6 @@
    github = "zuzuleinen";
    githubId = 944919;
  };
-  quasigod-io = {
-    email = "quasigod-io@protonmail.com";
-    name = "Michael Belsanti";
-    github = "quasigod-io";
-    githubId = 62124625;
-  };
  waelwindows = {
    email = "waelwindows9922@gmail.com";
    github = "Waelwindows";
--- a/nixos/doc/manual/development/writing-nixos-tests.section.md
+++ b/nixos/doc/manual/development/writing-nixos-tests.section.md
@ -273,12 +273,13 @@ The following methods are available on machine objects:

 `wait_for_open_port`

-:   Wait until a process is listening on the given TCP port (on
-    `localhost`, at least).
+:   Wait until a process is listening on the given TCP port and IP address
+    (default `localhost`).

 `wait_for_closed_port`

-:   Wait until nobody is listening on the given TCP port.
+:   Wait until nobody is listening on the given TCP port and IP address
+    (default `localhost`).

 `wait_for_x`

--- a/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
+++ b/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
@ -483,8 +483,8 @@ start_all()
        </term>
        <listitem>
          <para>
-            Wait until a process is listening on the given TCP port (on
-            <literal>localhost</literal>, at least).
+            Wait until a process is listening on the given TCP port and
+            IP address (default <literal>localhost</literal>).
          </para>
        </listitem>
      </varlistentry>
@ -494,7 +494,8 @@ start_all()
        </term>
        <listitem>
          <para>
-            Wait until nobody is listening on the given TCP port.
+            Wait until nobody is listening on the given TCP port and IP
+            address (default <literal>localhost</literal>).
          </para>
        </listitem>
      </varlistentry>
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@ -355,6 +355,14 @@
          NixOS manual.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>services.grafana</literal> listens only on localhost
+          by default again. This was changed to upstreams default of
+          <literal>0.0.0.0</literal> by accident in the freeform setting
+          conversion.
+        </para>
+      </listitem>
      <listitem>
        <para>
          A new <literal>virtualisation.rosetta</literal> module was
@ -383,6 +391,14 @@
          option.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          A new option <literal>recommendedBrotliSettings</literal> has
+          been added to <literal>services.nginx</literal>. Learn more
+          about compression in Brotli format
+          <link xlink:href="https://github.com/google/ngx_brotli/blob/master/README.md">here</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          Resilio sync secret keys can now be provided using a secrets
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -99,12 +99,16 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.

+- `services.grafana` listens only on localhost by default again. This was changed to upstreams default of `0.0.0.0` by accident in the freeform setting conversion.
+
 - A new `virtualisation.rosetta` module was added to allow running `x86_64` binaries through [Rosetta](https://developer.apple.com/documentation/apple-silicon/about-the-rosetta-translation-environment) inside virtualised NixOS guests on Apple silicon. This feature works by default with the [UTM](https://docs.getutm.app/) virtualisation [package](https://search.nixos.org/packages?channel=unstable&show=utm&from=0&size=1&sort=relevance&type=packages&query=utm).

 - The new option `users.motdFile` allows configuring a Message Of The Day that can be updated dynamically.

 - Enabling global redirect in `services.nginx.virtualHosts` now allows one to add exceptions with the `locations` option.

+- A new option `recommendedBrotliSettings` has been added to `services.nginx`. Learn more about compression in Brotli format [here](https://github.com/google/ngx_brotli/blob/master/README.md).
+
 - Resilio sync secret keys can now be provided using a secrets file at runtime, preventing these secrets from ending up in the Nix store.

 - The `firewall` and `nat` module now has a nftables based implementation. Enable `networking.nftables` to use it.
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@ -699,20 +699,22 @@ class Machine:
        with self.nested("waiting for file ‘{}‘".format(filename)):
            retry(check_file)

-    def wait_for_open_port(self, port: int) -> None:
+    def wait_for_open_port(self, port: int, addr: str = "localhost") -> None:
        def port_is_open(_: Any) -> bool:
-            status, _ = self.execute("nc -z localhost {}".format(port))
+            status, _ = self.execute("nc -z {} {}".format(addr, port))
            return status == 0

-        with self.nested("waiting for TCP port {}".format(port)):
+        with self.nested("waiting for TCP port {} on {}".format(port, addr)):
            retry(port_is_open)

-    def wait_for_closed_port(self, port: int) -> None:
+    def wait_for_closed_port(self, port: int, addr: str = "localhost") -> None:
        def port_is_closed(_: Any) -> bool:
-            status, _ = self.execute("nc -z localhost {}".format(port))
+            status, _ = self.execute("nc -z {} {}".format(addr, port))
            return status != 0

-        with self.nested("waiting for TCP port {} to be closed".format(port)):
+        with self.nested(
+            "waiting for TCP port {} on {} to be closed".format(port, addr)
+        ):
            retry(port_is_closed)

    def start_job(self, jobname: str, user: Optional[str] = None) -> Tuple[int, str]:
--- a/nixos/modules/services/hardware/supergfxd.nix
+++ b/nixos/modules/services/hardware/supergfxd.nix
@ -23,7 +23,10 @@ in
  config = lib.mkIf cfg.enable {
    environment.systemPackages = [ pkgs.supergfxctl ];

-    environment.etc."supergfxd.conf" = lib.mkIf (cfg.settings != null) { source = json.generate "supergfxd.conf" cfg.settings; };
+    environment.etc."supergfxd.conf" = lib.mkIf (cfg.settings != null) {
+      source = json.generate "supergfxd.conf" cfg.settings;
+      mode = "0644";
+    };

    services.dbus.enable = true;

--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@ -364,9 +364,15 @@ in {
            };

            http_addr = mkOption {
-              description = lib.mdDoc "Listening address.";
-              default = "";
              type = types.str;
+              default = "127.0.0.1";
+              description = lib.mdDoc ''
+                Listening address.
+
+                ::: {.note}
+                This setting intentionally varies from upstream's default to be a bit more secure by default.
+                :::
+              '';
            };

            http_port = mkOption {
--- a/nixos/modules/services/monitoring/uptime-kuma.nix
+++ b/nixos/modules/services/monitoring/uptime-kuma.nix
@ -28,7 +28,7 @@ in
        };
        description = lib.mdDoc ''
          Additional configuration for Uptime Kuma, see
-          <https://github.com/louislam/uptime-kuma/wiki/Environment-Variables">
+          <https://github.com/louislam/uptime-kuma/wiki/Environment-Variables>
          for supported values.
        '';
      };
--- a/nixos/modules/services/networking/powerdns.nix
+++ b/nixos/modules/services/networking/powerdns.nix
@ -5,6 +5,7 @@ with lib;
 let
  cfg = config.services.powerdns;
  configDir = pkgs.writeTextDir "pdns.conf" "${cfg.extraConfig}";
+  finalConfigDir = if cfg.secretFile == null then configDir else "/run/pdns";
 in {
  options = {
    services.powerdns = {
@ -19,6 +20,19 @@ in {
          for details on supported values.
        '';
      };
+
+      secretFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/run/keys/powerdns.env";
+        description = lib.mdDoc ''
+          Environment variables from this file will be interpolated into the
+          final config file using envsubst with this syntax: `$ENVIRONMENT`
+          or `''${VARIABLE}`.
+          The file should contain lines formatted as `SECRET_VAR=SECRET_VALUE`.
+          This is useful to avoid putting secrets into the nix store.
+        '';
+      };
    };
  };

@ -31,7 +45,13 @@ in {
      after = [ "network.target" "mysql.service" "postgresql.service" "openldap.service" ];

      serviceConfig = {
-        ExecStart = [ "" "${pkgs.pdns}/bin/pdns_server --config-dir=${configDir} --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no" ];
+        EnvironmentFile = lib.optional (cfg.secretFile != null) cfg.secretFile;
+        ExecStartPre = lib.optional (cfg.secretFile != null)
+          (pkgs.writeShellScript "pdns-pre-start" ''
+            umask 077
+            ${pkgs.envsubst}/bin/envsubst -i "${configDir}/pdns.conf" > ${finalConfigDir}/pdns.conf
+          '');
+        ExecStart = [ "" "${pkgs.pdns}/bin/pdns_server --config-dir=${finalConfigDir} --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no" ];
      };
    };

--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@ -820,10 +820,10 @@ in

    services.nginx = lib.mkIf cfg.nginx.enable {
      enable = true;
-      additionalModules = [ pkgs.nginxModules.brotli ];

      recommendedTlsSettings = true;
      recommendedOptimisation = true;
+      recommendedBrotliSettings = true;
      recommendedGzipSettings = true;
      recommendedProxySettings = true;

--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -29,6 +29,43 @@ let
  ) cfg.virtualHosts;
  enableIPv6 = config.networking.enableIPv6;

+  # Mime.types values are taken from brotli sample configuration - https://github.com/google/ngx_brotli
+  # and Nginx Server Configs - https://github.com/h5bp/server-configs-nginx
+  compressMimeTypes = [
+    "application/atom+xml"
+    "application/geo+json"
+    "application/json"
+    "application/ld+json"
+    "application/manifest+json"
+    "application/rdf+xml"
+    "application/vnd.ms-fontobject"
+    "application/wasm"
+    "application/x-rss+xml"
+    "application/x-web-app-manifest+json"
+    "application/xhtml+xml"
+    "application/xliff+xml"
+    "application/xml"
+    "font/collection"
+    "font/otf"
+    "font/ttf"
+    "image/bmp"
+    "image/svg+xml"
+    "image/vnd.microsoft.icon"
+    "text/cache-manifest"
+    "text/calendar"
+    "text/css"
+    "text/csv"
+    "text/html"
+    "text/javascript"
+    "text/markdown"
+    "text/plain"
+    "text/vcard"
+    "text/vnd.rim.location.xloc"
+    "text/vtt"
+    "text/x-component"
+    "text/xml"
+  ];
+
  defaultFastcgiParams = {
    SCRIPT_FILENAME   = "$document_root$fastcgi_script_name";
    QUERY_STRING      = "$query_string";
@ -140,6 +177,16 @@ let
        ssl_stapling_verify on;
      ''}

+      ${optionalString (cfg.recommendedBrotliSettings) ''
+        brotli on;
+        brotli_static on;
+        brotli_comp_level 5;
+        brotli_window 512k;
+        brotli_min_length 256;
+        brotli_types ${lib.concatStringsSep " " compressMimeTypes};
+        brotli_buffers 32 8k;
+      ''}
+
      ${optionalString (cfg.recommendedGzipSettings) ''
        gzip on;
        gzip_proxied any;
@ -456,6 +503,16 @@ in
        '';
      };

+      recommendedBrotliSettings = mkOption {
+        default = false;
+        type = types.bool;
+        description = lib.mdDoc ''
+          Enable recommended brotli settings. Learn more about compression in Brotli format [here](https://github.com/google/ngx_brotli/blob/master/README.md).
+
+          This adds `pkgs.nginxModules.brotli` to `services.nginx.additionalModules`.
+        '';
+      };
+
      recommendedGzipSettings = mkOption {
        default = false;
        type = types.bool;
@ -537,11 +594,10 @@ in
      additionalModules = mkOption {
        default = [];
        type = types.listOf (types.attrsOf types.anything);
-        example = literalExpression "[ pkgs.nginxModules.brotli ]";
+        example = literalExpression "[ pkgs.nginxModules.echo ]";
        description = lib.mdDoc ''
          Additional [third-party nginx modules](https://www.nginx.com/resources/wiki/modules/)
-          to install. Packaged modules are available in
-          `pkgs.nginxModules`.
+          to install. Packaged modules are available in `pkgs.nginxModules`.
        '';
      };

@ -999,6 +1055,8 @@ in
      groups = config.users.groups;
    }) dependentCertNames;

+    services.nginx.additionalModules = optional cfg.recommendedBrotliSettings pkgs.nginxModules.brotli;
+
    systemd.services.nginx = {
      description = "Nginx Web Server";
      wantedBy = [ "multi-user.target" ];
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -97,10 +97,15 @@ let
    in
      map (x: "${mountPoint x}.mount") (getPoolFilesystems pool);

-  getKeyLocations = pool:
-    if isBool cfgZfs.requestEncryptionCredentials
-    then "${cfgZfs.package}/sbin/zfs list -rHo name,keylocation,keystatus ${pool}"
-    else "${cfgZfs.package}/sbin/zfs list -Ho name,keylocation,keystatus ${toString (filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials)}";
+  getKeyLocations = pool: if isBool cfgZfs.requestEncryptionCredentials then {
+    hasKeys = cfgZfs.requestEncryptionCredentials;
+    command = "${cfgZfs.package}/sbin/zfs list -rHo name,keylocation,keystatus ${pool}";
+  } else let
+    keys = filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials;
+  in {
+    hasKeys = keys != [];
+    command = "${cfgZfs.package}/sbin/zfs list -Ho name,keylocation,keystatus ${toString keys}";
+  };

  createImportService = { pool, systemd, force, prefix ? "" }:
    nameValuePair "zfs-import-${pool}" {
@ -124,7 +129,9 @@ let
        RemainAfterExit = true;
      };
      environment.ZFS_FORCE = optionalString force "-f";
-      script = (importLib {
+      script = let
+        keyLocations = getKeyLocations pool;
+      in (importLib {
        # See comments at importLib definition.
        zpoolCmd = "${cfgZfs.package}/sbin/zpool";
        awkCmd = "${pkgs.gawk}/bin/awk";
@ -139,10 +146,8 @@ let
        done
        poolImported "${pool}" || poolImport "${pool}"  # Try one last time, e.g. to import a degraded pool.
        if poolImported "${pool}"; then
-          ${optionalString (if isBool cfgZfs.requestEncryptionCredentials
-                            then cfgZfs.requestEncryptionCredentials
-                            else cfgZfs.requestEncryptionCredentials != []) ''
-            ${getKeyLocations pool} | while IFS=$'\t' read ds kl ks; do
+          ${optionalString keyLocations.hasKeys ''
+            ${keyLocations.command} | while IFS=$'\t' read ds kl ks; do
              {
              if [[ "$ks" != unavailable ]]; then
                continue
@ -565,7 +570,7 @@ in
              ''
              else concatMapStrings (fs: ''
                zfs load-key -- ${escapeShellArg fs}
-              '') cfgZfs.requestEncryptionCredentials}
+              '') (filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials)}
        '') rootPools));

        # Systemd in stage 1
--- a/nixos/tests/zfs.nix
+++ b/nixos/tests/zfs.nix
@ -17,103 +17,151 @@ let
    makeTest {
      name = "zfs-" + name;
      meta = with pkgs.lib.maintainers; {
-        maintainers = [ adisbladis ];
+        maintainers = [ adisbladis elvishjerricco ];
      };

      nodes.machine = { pkgs, lib, ... }:
        let
          usersharePath = "/var/lib/samba/usershares";
        in {
-        virtualisation.emptyDiskImages = [ 4096 ];
+        virtualisation = {
+          emptyDiskImages = [ 4096 4096 ];
+          useBootLoader = true;
+          useEFIBoot = true;
+        };
+        boot.loader.systemd-boot.enable = true;
+        boot.loader.timeout = 0;
+        boot.loader.efi.canTouchEfiVariables = true;
        networking.hostId = "deadbeef";
        boot.kernelPackages = kernelPackage;
        boot.supportedFilesystems = [ "zfs" ];
        boot.zfs.enableUnstable = enableUnstable;

-        services.samba = {
-          enable = true;
-          extraConfig = ''
-            registry shares = yes
-            usershare path = ${usersharePath}
-            usershare allow guests = yes
-            usershare max shares = 100
-            usershare owner only = no
-          '';
-        };
-        systemd.services.samba-smbd.serviceConfig.ExecStartPre =
-          "${pkgs.coreutils}/bin/mkdir -m +t -p ${usersharePath}";
-
        environment.systemPackages = [ pkgs.parted ];

-        # Setup regular fileSystems machinery to ensure forceImportAll can be
-        # tested via the regular service units.
-        virtualisation.fileSystems = {
-          "/forcepool" = {
-            device = "forcepool";
+        # /dev/disk/by-id doesn't get populated in the NixOS test framework
+        boot.zfs.devNodes = "/dev/disk/by-uuid";
+
+        specialisation.samba.configuration = {
+          services.samba = {
+            enable = true;
+            extraConfig = ''
+              registry shares = yes
+              usershare path = ${usersharePath}
+              usershare allow guests = yes
+              usershare max shares = 100
+              usershare owner only = no
+            '';
+          };
+          systemd.services.samba-smbd.serviceConfig.ExecStartPre =
+            "${pkgs.coreutils}/bin/mkdir -m +t -p ${usersharePath}";
+          virtualisation.fileSystems = {
+            "/tmp/mnt" = {
+              device = "rpool/root";
+              fsType = "zfs";
+            };
+          };
+        };
+
+        specialisation.encryption.configuration = {
+          boot.zfs.requestEncryptionCredentials = [ "automatic" ];
+          virtualisation.fileSystems."/automatic" = {
+            device = "automatic";
+            fsType = "zfs";
+          };
+          virtualisation.fileSystems."/manual" = {
+            device = "manual";
+            fsType = "zfs";
+          };
+          virtualisation.fileSystems."/manual/encrypted" = {
+            device = "manual/encrypted";
            fsType = "zfs";
            options = [ "noauto" ];
          };
        };

-        # forcepool doesn't exist at first boot, and we need to manually test
-        # the import after tweaking the hostId.
-        systemd.services.zfs-import-forcepool.wantedBy = lib.mkVMOverride [];
-        systemd.targets.zfs.wantedBy = lib.mkVMOverride [];
-        boot.zfs.forceImportAll = true;
-        # /dev/disk/by-id doesn't get populated in the NixOS test framework
-        boot.zfs.devNodes = "/dev/disk/by-uuid";
+        specialisation.forcepool.configuration = {
+          systemd.services.zfs-import-forcepool.wantedBy = lib.mkVMOverride [ "forcepool.mount" ];
+          systemd.targets.zfs.wantedBy = lib.mkVMOverride [];
+          boot.zfs.forceImportAll = true;
+          virtualisation.fileSystems."/forcepool" = {
+            device = "forcepool";
+            fsType = "zfs";
+            options = [ "noauto" ];
+          };
+        };
      };

      testScript = ''
+        machine.wait_for_unit("multi-user.target")
        machine.succeed(
-            "modprobe zfs",
            "zpool status",
-            "ls /dev",
-            "mkdir /tmp/mnt",
-            "udevadm settle",
-            "parted --script /dev/vdb mklabel msdos",
-            "parted --script /dev/vdb -- mkpart primary 1024M -1s",
-            "udevadm settle",
-            "zpool create rpool /dev/vdb1",
-            "zfs create -o mountpoint=legacy rpool/root",
-            # shared datasets cannot have legacy mountpoint
-            "zfs create rpool/shared_smb",
-            "mount -t zfs rpool/root /tmp/mnt",
-            "udevadm settle",
-            # wait for samba services
-            "systemctl is-system-running --wait",
-            "zfs set sharesmb=on rpool/shared_smb",
-            "zfs share rpool/shared_smb",
-            "smbclient -gNL localhost | grep rpool_shared_smb",
-            "umount /tmp/mnt",
-            "zpool destroy rpool",
-            "udevadm settle",
+            "parted --script /dev/vdc mklabel msdos",
+            "parted --script /dev/vdc -- mkpart primary 1024M -1s",
+            "parted --script /dev/vdd mklabel msdos",
+            "parted --script /dev/vdd -- mkpart primary 1024M -1s",
        )

-        machine.succeed(
-            'echo password | zpool create -o altroot="/tmp/mnt" '
-            + "-O encryption=aes-256-gcm -O keyformat=passphrase rpool /dev/vdb1",
-            "zfs create -o mountpoint=legacy rpool/root",
-            "mount -t zfs rpool/root /tmp/mnt",
-            "udevadm settle",
-            "umount /tmp/mnt",
-            "zpool destroy rpool",
-            "udevadm settle",
-        )
+        with subtest("sharesmb works"):
+            machine.succeed(
+                "zpool create rpool /dev/vdc1",
+                "zfs create -o mountpoint=legacy rpool/root",
+                # shared datasets cannot have legacy mountpoint
+                "zfs create rpool/shared_smb",
+                "bootctl set-default nixos-generation-1-specialisation-samba.conf",
+                "sync",
+            )
+            machine.crash()
+            machine.wait_for_unit("multi-user.target")
+            machine.succeed(
+                "zfs set sharesmb=on rpool/shared_smb",
+                "zfs share rpool/shared_smb",
+                "smbclient -gNL localhost | grep rpool_shared_smb",
+                "umount /tmp/mnt",
+                "zpool destroy rpool",
+            )
+
+        with subtest("encryption works"):
+            machine.succeed(
+                'echo password | zpool create -O mountpoint=legacy '
+                + "-O encryption=aes-256-gcm -O keyformat=passphrase automatic /dev/vdc1",
+                "zpool create -O mountpoint=legacy manual /dev/vdd1",
+                "echo otherpass | zfs create "
+                + "-o encryption=aes-256-gcm -o keyformat=passphrase manual/encrypted",
+                "bootctl set-default nixos-generation-1-specialisation-encryption.conf",
+                "sync",
+                "zpool export automatic",
+                "zpool export manual",
+            )
+            machine.crash()
+            machine.start()
+            machine.wait_for_console_text("Starting password query on")
+            machine.send_console("password\n")
+            machine.wait_for_unit("multi-user.target")
+            machine.succeed(
+                "zfs get keystatus manual/encrypted | grep unavailable",
+                "echo otherpass | zfs load-key manual/encrypted",
+                "systemctl start manual-encrypted.mount",
+                "umount /automatic /manual/encrypted /manual",
+                "zpool destroy automatic",
+                "zpool destroy manual",
+            )

        with subtest("boot.zfs.forceImportAll works"):
            machine.succeed(
                "rm /etc/hostid",
                "zgenhostid deadcafe",
-                "zpool create forcepool /dev/vdb1 -O mountpoint=legacy",
+                "zpool create forcepool /dev/vdc1 -O mountpoint=legacy",
+                "bootctl set-default nixos-generation-1-specialisation-forcepool.conf",
+                "rm /etc/hostid",
+                "sync",
            )
-            machine.shutdown()
-            machine.start()
-            machine.succeed("udevadm settle")
+            machine.crash()
+            machine.wait_for_unit("multi-user.target")
            machine.fail("zpool import forcepool")
            machine.succeed(
-                "systemctl start zfs-import-forcepool.service",
-                "mount -t zfs forcepool /tmp/mnt",
+                "systemctl start forcepool.mount",
+                "mount | grep forcepool",
            )
      '' + extraTest;

--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@ -53,30 +53,21 @@
 , libpng
 , libjpeg
 , AppKit
-, AudioToolbox
-, AudioUnit
-, Carbon
-, CoreAudio
 , CoreAudioKit
-, CoreServices
 }:

 # TODO
 # 1. detach sbsms

-let
-  inherit (lib) optionals;
-  pname = "audacity";
-  version = "3.2.2";
-in
 stdenv.mkDerivation rec {
-  inherit pname version;
+  pname = "audacity";
+  version = "3.2.3";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "Audacity-${version}";
-    sha256 = "sha256-vDkIBsXINo7g8lbDfXYTaz2AB6HWPc5resITllVNd6o=";
+    sha256 = "sha256-0F9+4hyUoKb0UP5t02yws/ErogscvI1nsdnSTpcr53E=";
  };

  postPatch = ''
@ -84,10 +75,6 @@ stdenv.mkDerivation rec {
  '' + lib.optionalString stdenv.isLinux ''
    substituteInPlace libraries/lib-files/FileNames.cpp \
      --replace /usr/include/linux/magic.h ${linuxHeaders}/include/linux/magic.h
-  ''
-  # error: unknown type name 'NSAppearanceName'
-  + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
-    sed -z -i "s/if (@available(macOS 10.14, \*)).*}/}/g" src/AudacityApp.mm
  '';

  nativeBuildInputs = [
@ -97,7 +84,7 @@ stdenv.mkDerivation rec {
    python3
    makeWrapper
    wrapGAppsHook
-  ] ++ optionals stdenv.isLinux [
+  ] ++ lib.optionals stdenv.isLinux [
    linuxHeaders
  ];

@ -106,6 +93,9 @@ stdenv.mkDerivation rec {
    ffmpeg_4
    file
    flac
+  ] ++ lib.optionals stdenv.isDarwin [
+    AppKit
+  ] ++ [
    gtk3
    lame
    libid3tag
@ -131,7 +121,7 @@ stdenv.mkDerivation rec {
    portaudio
    wavpack
    wxGTK32
-  ] ++ optionals stdenv.isLinux [
+  ] ++ lib.optionals stdenv.isLinux [
    alsa-lib # for portaudio
    at-spi2-core
    dbus
@ -144,10 +134,8 @@ stdenv.mkDerivation rec {
    libsepol
    libuuid
    util-linux
-  ] ++ optionals stdenv.isDarwin [
-    AppKit
-    CoreAudioKit
-    AudioUnit AudioToolbox CoreAudio CoreServices Carbon # for portaudio
+  ] ++ lib.optionals stdenv.isDarwin [
+    CoreAudioKit # for portaudio
    libpng
    libjpeg
  ];
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "reaper";
-  version = "6.71";
+  version = "6.73";

  src = fetchurl {
    url = url_for_platform version stdenv.hostPlatform.qemuArch;
    hash = {
-      x86_64-linux = "sha256-AHi0US3U4PU/IrlCahJbm+tkmsz+nh0AFOk0lB2lI3M=";
-      aarch64-linux = "sha256-/yCV7wllQ024rux4u4Tp9TZK8JMN9Tk0DFJY3W2BGAk=";
+      x86_64-linux = "sha256-omQ2XdL4C78BQRuYKy90QlMko2XYHoVhd4X0C+Zyp8E=";
+      aarch64-linux = "sha256-XHohznrfFMHHgif4iFrpXb0FNddYiBb0gB7ZznlU834=";
    }.${stdenv.hostPlatform.system};
  };

--- a/pkgs/applications/emulators/mgba/default.nix
+++ b/pkgs/applications/emulators/mgba/default.nix
@ -3,21 +3,27 @@
 , fetchFromGitHub
 , SDL2
 , cmake
-, ffmpeg
+, ffmpeg_4
 , imagemagick
 , libedit
 , libelf
 , libepoxy
 , libzip
-, lua
+, lua5_4
 , minizip
 , pkg-config
-, qtbase
-, qtmultimedia
-, qttools
-, wrapQtAppsHook
+, libsForQt5
 }:

+let
+    ffmpeg = ffmpeg_4;
+    lua = lua5_4;
+    inherit (libsForQt5)
+      qtbase
+      qtmultimedia
+      qttools
+      wrapQtAppsHook;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mgba";
  version = "0.10.0";
--- a/pkgs/applications/kde/okular.nix
+++ b/pkgs/applications/kde/okular.nix
@ -1,23 +1,25 @@
-{
-  stdenv, mkDerivation, lib,
-  extra-cmake-modules, kdoctools,
-  breeze-icons, chmlib, discount, djvulibre, ebook_tools, kactivities,
-  karchive, kbookmarks, kcompletion, kconfig, kconfigwidgets, kcoreaddons,
-  kdbusaddons, kdegraphics-mobipocket, kiconthemes, kjs, khtml, kio, kparts,
-  kpty, kpurpose, kwallet, kwindowsystem, libkexiv2, libspectre, libzip, phonon, poppler,
-  qca-qt5, qtdeclarative, qtsvg, threadweaver, kcrash, qtspeech
+{ stdenv, mkDerivation, lib
+, extra-cmake-modules, kdoctools
+, breeze-icons, chmlib, discount, djvulibre, ebook_tools, kactivities
+, karchive, kbookmarks, kcompletion, kconfig, kconfigwidgets, kcoreaddons
+, kdbusaddons, kdegraphics-mobipocket, kiconthemes, kjs, khtml, kio, kparts
+, kpty, kpurpose, kwallet, kwindowsystem, libkexiv2, libspectre, libzip, phonon, poppler
+, qca-qt5, qtdeclarative, qtsvg, threadweaver, kcrash
+, withSpeech ? true, qtspeech
 }:

 mkDerivation {
  pname = "okular";
+
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+
  buildInputs = [
    breeze-icons discount djvulibre ebook_tools kactivities karchive kbookmarks
    kcompletion kconfig kconfigwidgets kcoreaddons kdbusaddons
    kdegraphics-mobipocket kiconthemes kjs khtml kio kparts kpty kpurpose kwallet
    kwindowsystem libkexiv2 libspectre libzip phonon poppler qca-qt5
-    qtdeclarative qtsvg threadweaver kcrash qtspeech chmlib
-  ];
+    qtdeclarative qtsvg threadweaver kcrash chmlib
+  ] ++ lib.optional withSpeech qtspeech;

  # InitialPreference values are too high and end up making okular
  # default for anything considered text/plain. Resetting to 1, which
@ -27,6 +29,8 @@ mkDerivation {
      --replace InitialPreference=3 InitialPreference=1
  '';

+  cmakeFlags = lib.optional (!withSpeech) "-DFORCE_NOT_REQUIRED_DEPENDENCIES=Qt5TextToSpeech";
+
  meta = with lib; {
    homepage = "http://www.kde.org";
    description = "KDE document viewer";
--- a/pkgs/applications/misc/gramps/default.nix
+++ b/pkgs/applications/misc/gramps/default.nix
@ -29,7 +29,7 @@ in buildPythonApplication rec {
    sha256 = "00358nzyw686ypqv45imc5k9frcqnhla0hpx9ynna3iy6iz5006x";
  };

-  pythonPath = with pythonPackages; [ bsddb3 PyICU pygobject3 pycairo ];
+  pythonPath = with pythonPackages; [ bsddb3 pyicu pygobject3 pycairo ];

  # Same installPhase as in buildPythonApplication but without --old-and-unmanageble
  # install flag.
--- a/pkgs/applications/misc/khal/default.nix
+++ b/pkgs/applications/misc/khal/default.nix
@ -90,6 +90,8 @@ python3.pkgs.buildPythonApplication rec {
  disabledTests = [
    # timing based
    "test_etag"
+    "test_bogota"
+    "test_event_no_dst"
  ];

  meta = with lib; {
--- a/pkgs/applications/misc/parsec/bin.nix
+++ b/pkgs/applications/misc/parsec/bin.nix
@ -67,6 +67,10 @@ stdenvNoCC.mkDerivation {
      --prefix LD_LIBRARY_PATH : "$runtimeDependenciesPath" \
      --run "$prepareParsec"

+    substituteInPlace $out/share/applications/parsecd.desktop \
+      --replace "/usr/bin/parsecd" "parsecd" \
+      --replace "/usr/share/icons" "${placeholder "out"}/share/icons"
+
    runHook postInstall
  '';

--- a/pkgs/applications/misc/raider/default.nix
+++ b/pkgs/applications/misc/raider/default.nix
@ -0,0 +1,58 @@
+{ appstream-glib
+, blueprint-compiler
+, desktop-file-utils
+, fetchFromGitHub
+, gettext
+, glib
+, gtk4
+, itstool
+, lib
+, libadwaita
+, meson
+, mesonEmulatorHook
+, ninja
+, pkg-config
+, stdenv
+, wrapGAppsHook4
+}:
+stdenv.mkDerivation rec {
+  pname = "raider";
+  version = "1.3.1";
+
+  src = fetchFromGitHub {
+    owner = "ADBeveridge";
+    repo = "raider";
+    rev = "v${version}";
+    hash = "sha256-fyE0CsQp2UVh+7bAQo+GHEF0k8Gwl9j4qclh04AQiVI=";
+  };
+
+  nativeBuildInputs = [
+    appstream-glib
+    blueprint-compiler
+    desktop-file-utils
+    itstool
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
+  ];
+
+  buildInputs = [
+    gtk4
+    libadwaita
+  ];
+
+  postInstall = ''
+    glib-compile-schemas $out/share/glib-2.0/schemas
+  '';
+
+  meta = with lib; {
+    description = "Securely delete your files";
+    homepage = "https://apps.gnome.org/app/com.github.ADBeveridge.Raider";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ benediktbroich ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/misc/stylish/default.nix
+++ b/pkgs/applications/misc/stylish/default.nix
@ -0,0 +1,39 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "stylish";
+  version = "unstable-2022-12-05";
+
+  src = fetchFromGitHub {
+    owner = "thevinter";
+    repo = "styli.sh";
+    rev = "d595412a949c6cdc7e151ae0cf929aa1958aa7f1";
+    hash = "sha256-lFnzrYnTFWe8bvK//aC1+TapWIFNsNP60Msn7D0tk/0=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp "${src}/styli.sh" $out/bin
+    chmod +x $out/bin/styli.sh
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/thevinter/styli.sh";
+    description = "A shell script to manage wallpapers";
+    longDescription = ''
+      Styli.sh is a Bash script that aims to automate the tedious process
+      of finding new wallpapers, downloading and switching them via the
+      configs.
+      Styli.sh can search for specific wallpapers from unsplash or download
+      a random image from the specified subreddits. If you have pywal it also
+      can set automatically your terminal colors.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ tchab ];
+  };
+}
--- a/pkgs/applications/misc/wbg/default.nix
+++ b/pkgs/applications/misc/wbg/default.nix
@ -16,12 +16,6 @@
 , libjpeg
 }:

-let
-  # Courtesy of sternenseemann and FRidh, commit c9a7fdfcfb420be8e0179214d0d91a34f5974c54
-  mesonFeatureFlag = feature: flag:
-    "-D${feature}=${if flag then "enabled" else "disabled"}";
-in
-
 stdenv.mkDerivation rec {
  pname = "wbg";
  version = "1.0.2";
@ -52,8 +46,8 @@ stdenv.mkDerivation rec {
  mesonBuildType = "release";

  mesonFlags = [
-    (mesonFeatureFlag "png" enablePNG)
-    (mesonFeatureFlag "jpeg" enableJPEG)
+    (lib.mesonEnable "png" enablePNG)
+    (lib.mesonEnable "jpeg" enableJPEG)
  ];

  meta = with lib; {
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "talosctl";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "talos";
    rev = "v${version}";
-    sha256 = "sha256-2/myjkALv5gz/mbT/unRBC2Hi0jWPBzcoDKhOOHq/bw=";
+    sha256 = "sha256-K5eslPo4Ou/JJoZGASJsZ331Nyc14Dva+cead3ngw0U=";
  };

-  vendorSha256 = "sha256-NAGq4HX4A3Sq8QlWSD/UBBVwY6EgT/1MC5s8uTJX2Po=";
+  vendorSha256 = "sha256-N+sFJtC+9VCt3GJoAbRsNl7vCXiFFlewsIkwTdleUhk=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -167,11 +167,11 @@
    "vendorHash": null
  },
  "bitbucket": {
-    "hash": "sha256-DRczX/UQB/0KVZG7wcMCvNerOSIjiEl222Nhq0HjpZM=",
+    "hash": "sha256-rE9kEMC/b3J5YjF94HBqUhorjcsMAx40jnxgsShNNUc=",
    "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
    "owner": "DrFaust92",
    "repo": "terraform-provider-bitbucket",
-    "rev": "v2.26.0",
+    "rev": "v2.27.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-8/ZEO0cxseXqQHx+/wKjsM0T3l+tBdCTFZqNfjaTOpo="
  },
@ -222,13 +222,13 @@
    "vendorHash": "sha256-PALZGyGZ6Ggccl4V9gG+gsEdNipYG+DCaZkqF0W1IMQ="
  },
  "cloudflare": {
-    "hash": "sha256-Vlugad/EF53rbMOz2djIPEeTpO62y9OpiDHlDDeu/jI=",
+    "hash": "sha256-0hQpnJU1qLHqk8nUO+Ibvh9y8dpBBoDqQj3wiYWMTbg=",
    "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
    "owner": "cloudflare",
    "repo": "terraform-provider-cloudflare",
-    "rev": "v3.30.0",
+    "rev": "v3.31.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-s0z+CvCH3SCbddppwdXKD+Fle4MmHM5eRV07r+DNrnU="
+    "vendorHash": "sha256-Y5z0bRiNu1gOm7nIcQieLWll/sOSgBlKrJlqng2kizQ="
  },
  "cloudfoundry": {
    "hash": "sha256-RIzAUhusyA+lMHkfsWk/27x3ZRGVcAzqgBaoI8erQSY=",
@ -625,11 +625,11 @@
    "vendorHash": "sha256-nDvnLEOtXkUJFY22pKogOzkWrj4qjyQbdlJ5pa/xnK8="
  },
  "ksyun": {
-    "hash": "sha256-vmENjW/r+d6UWdq8q/x9kO16CQkRVQRdBYAFkBKa1vI=",
+    "hash": "sha256-HtZ+uEbI+UFO51rj9P8rKWNjRZaX6QhIZ1c9TO1USvI=",
    "homepage": "https://registry.terraform.io/providers/kingsoftcloud/ksyun",
    "owner": "kingsoftcloud",
    "repo": "terraform-provider-ksyun",
-    "rev": "v1.3.61",
+    "rev": "v1.3.62",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-miHKAz+ONXtuC1DNukcyZbbaYReY69dz9Zk6cJdORdQ="
  },
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@ -8,7 +8,7 @@
 , liblinphone
 , mediastreamer
 , mediastreamer-openh264
-, minizip2
+, minizip-ng
 , mkDerivation
 , qtgraphicaleffects
 , qtquickcontrols2
@ -70,7 +70,7 @@ mkDerivation rec {
    mediastreamer
    mediastreamer-openh264

-    minizip2
+    minizip-ng
    qtgraphicaleffects
    qtquickcontrols2
    qttranslations
@ -81,7 +81,7 @@ mkDerivation rec {
  ];

  cmakeFlags = [
-    "-DMINIZIP_INCLUDE_DIRS=${minizip2}/include"
+    "-DMINIZIP_INCLUDE_DIRS=${minizip-ng}/include"
    "-DMINIZIP_LIBRARIES=minizip"

    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
--- a/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
+++ b/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
@ -43,13 +43,13 @@ assert enablePsiMedia -> enablePlugins;

 mkDerivation rec {
  pname = "psi-plus";
-  version = "1.5.1642";
+  version = "1.5.1644";

  src = fetchFromGitHub {
    owner = "psi-plus";
    repo = "psi-plus-snapshots";
    rev = version;
-    sha256 = "sha256-voaGYYt1CZTxiumKvIVupMxdrLKACnfxvtnYfGuya1I=";
+    sha256 = "sha256-wSfgV0moBar27xa91ywky7Apr5QHISZ27lQlp02J1Mg=";
  };

  cmakeFlags = [
--- a/pkgs/applications/networking/instant-messengers/qq/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/default.nix
@ -0,0 +1,100 @@
+{ alsa-lib
+, cups
+, dpkg
+, fetchurl
+, gjs
+, glib
+, gtk3
+, lib
+, libdrm
+, libgcrypt
+, libkrb5
+, mesa # for libgbm
+, nss
+, xorg
+, systemd
+, stdenv
+, at-spi2-core
+, autoPatchelfHook
+, wrapGAppsHook
+, copyDesktopItems
+, makeDesktopItem
+}:
+
+let
+  version = "2.0.3-543";
+  srcs = {
+    x86_64-linux = fetchurl {
+      url = "https://dldir1.qq.com/qqfile/qq/QQNT/50eed662/QQ-v${version}_x64.deb";
+      sha256 = "sha256-O8zaVHt/oXserPVHe/r6pAFpWFeLDVsiaazgaX7kxu8=";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://dldir1.qq.com/qqfile/qq/QQNT/50eed662/QQ-v${version}_arm64.deb";
+      sha256 = "sha256-01ZpcoSDc5b0MCKAMq16N4cXzbouHNckOGsv+Z4et7w=";
+    };
+  };
+  src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation {
+  pname = "qq";
+  inherit version src;
+
+  unpackCmd = "dpkg-deb -x $curSrc source";
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    wrapGAppsHook
+    copyDesktopItems
+    dpkg
+  ];
+
+  buildInputs = [
+    alsa-lib
+    at-spi2-core
+    cups
+    libdrm
+    libgcrypt
+    libkrb5
+    mesa
+    nss
+    xorg.libXdamage
+  ];
+
+  runtimeDependencies = [
+    gtk3
+    (lib.getLib systemd)
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p "$out/share/icons/hicolor/0x0/apps"
+    cp usr/share/icons/hicolor/0x0/apps/qq.png $out/share/icons/hicolor/0x0/apps
+
+    mkdir -p "$out/opt"
+    cp -r "opt/"* $out/opt
+
+    mkdir -p "$out/bin"
+    ln -s "$out/opt/QQ/qq" "$out/bin/qq"
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      desktopName = "Tencent QQ";
+      genericName = "A messaging app";
+      categories = [ "Network" ];
+      icon = "qq";
+      exec = "qq";
+      name = "qq";
+    })
+  ];
+
+  meta = with lib; {
+    homepage = "https://im.qq.com/linuxqq/";
+    description = "Messaging app";
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    license = licenses.unfree;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [ fee1-dead ];
+  };
+}
--- a/pkgs/applications/networking/sync/openrsync/default.nix
+++ b/pkgs/applications/networking/sync/openrsync/default.nix
@ -0,0 +1,29 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openrsync";
+  version = "unstable-2022-05-08";
+
+  src = fetchFromGitHub {
+    owner = "kristapsdz";
+    repo = "openrsync";
+    rev = "f50d0f8204ea18306a0c29c6ae850292ea826995";
+    hash = "sha256-4tygoCQGIM0wqLfdWp55/oOPhD3lPUuTd9/LXQAASXU=";
+  };
+
+  # Uses oconfigure
+  prefixKey = "PREFIX=";
+
+  meta = with lib; {
+    homepage = "https://www.openrsync.org/";
+    description = "BSD-licensed implementation of rsync";
+    license = licenses.isc;
+    maintainers = with maintainers; [ fgaz ];
+    # https://github.com/kristapsdz/openrsync#portability
+    # https://github.com/kristapsdz/oconfigure#readme
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/version-management/dvc/default.nix
+++ b/pkgs/applications/version-management/dvc/default.nix
@ -97,6 +97,6 @@ python3.pkgs.buildPythonApplication rec {
    description = "Version Control System for Machine Learning Projects";
    homepage = "https://dvc.org";
    license = licenses.asl20;
-    maintainers = with maintainers; [ cmcdragonkai fab anthonyroussel ];
+    maintainers = with maintainers; [ cmcdragonkai fab ];
  };
 }
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@ -38,15 +38,15 @@ assert usbSupport -> !udevSupport; # libusb-compat-0_1 won't be used if udev is
 assert gbmSupport || waylandSupport || x11Support;

 let
-  kodiReleaseDate = "20220303";
-  kodiVersion = "19.4";
+  kodiReleaseDate = "20221204";
+  kodiVersion = "19.5";
  rel = "Matrix";

  kodi_src = fetchFromGitHub {
    owner  = "xbmc";
    repo   = "xbmc";
    rev    = "${kodiVersion}-${rel}";
-    sha256 = "sha256-XDtmY3KthiD91kvueQRSamBcdM7fBpRntmZX6KRsCzE=";
+    sha256 = "sha256-vprhEPxYpY3/AsUgvPNnhBlh0Dl73ekALAblHaUKzd0=";
  };

  ffmpeg = stdenv.mkDerivation rec {
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -99,21 +99,19 @@ in stdenv.mkDerivation rec {

  NIX_LDFLAGS = lib.optionalString x11Support "-lX11 -lXext ";

-  mesonFlags = let
-    inherit (lib) mesonOption mesonBool mesonEnable;
-  in [
-    (mesonOption "default_library" "shared")
-    (mesonBool "libmpv" true)
-    (mesonEnable "libarchive" archiveSupport)
-    (mesonEnable "manpage-build" true)
-    (mesonEnable "cdda" cddaSupport)
-    (mesonEnable "dvbin" dvbinSupport)
-    (mesonEnable "dvdnav" dvdnavSupport)
-    (mesonEnable "openal" openalSupport)
-    (mesonEnable "sdl2" sdl2Support)
+  mesonFlags = [
+    (lib.mesonOption "default_library" "shared")
+    (lib.mesonBool "libmpv" true)
+    (lib.mesonEnable "libarchive" archiveSupport)
+    (lib.mesonEnable "manpage-build" true)
+    (lib.mesonEnable "cdda" cddaSupport)
+    (lib.mesonEnable "dvbin" dvbinSupport)
+    (lib.mesonEnable "dvdnav" dvdnavSupport)
+    (lib.mesonEnable "openal" openalSupport)
+    (lib.mesonEnable "sdl2" sdl2Support)
    # Disable whilst Swift isn't supported
-    (mesonEnable "swift-build" swiftSupport)
-    (mesonEnable "macos-cocoa-cb" swiftSupport)
+    (lib.mesonEnable "swift-build" swiftSupport)
+    (lib.mesonEnable "macos-cocoa-cb" swiftSupport)
  ];

  mesonAutoFeatures = "auto";
--- a/pkgs/applications/video/olive-editor/default.nix
+++ b/pkgs/applications/video/olive-editor/default.nix
@ -13,6 +13,10 @@ stdenv.mkDerivation rec {
    sha256 = "151g6jwhipgbq4llwib92sq23p1s9hm6avr7j4qq3bvykzrm8z1a";
  };

+  patches = [
+    ./q-painter-path.patch
+  ];
+
  nativeBuildInputs = [
    pkg-config
    which
--- a/pkgs/applications/video/olive-editor/q-painter-path.patch
+++ b/pkgs/applications/video/olive-editor/q-painter-path.patch
@ -0,0 +1,48 @@
+diff --git a/effects/internal/texteffect.cpp b/effects/internal/texteffect.cpp
+index 279f406d9..7fe9e8e72 100644
+--- a/effects/internal/texteffect.cpp
+++ b/effects/internal/texteffect.cpp
+@@ -20,6 +20,7 @@
+ 
+ #include "texteffect.h"
+ 
+#include <QPainterPath>
+ #include <QGridLayout>
+ #include <QLabel>
+ #include <QOpenGLTexture>
+diff --git a/effects/internal/timecodeeffect.cpp b/effects/internal/timecodeeffect.cpp
+index 4de3e3497..fd0fa6224 100644
+--- a/effects/internal/timecodeeffect.cpp
+++ b/effects/internal/timecodeeffect.cpp
+@@ -20,6 +20,7 @@
+ 
+ #include "timecodeeffect.h"
+ 
+#include <QPainterPath>
+ #include <QGridLayout>
+ #include <QLabel>
+ #include <QOpenGLTexture>
+diff --git a/ui/graphview.cpp b/ui/graphview.cpp
+index 3e13075cd..c441133a8 100644
+--- a/ui/graphview.cpp
+++ b/ui/graphview.cpp
+@@ -20,6 +20,7 @@
+ 
+ #include "graphview.h"
+ 
+#include <QPainterPath>
+ #include <QPainter>
+ #include <QMouseEvent>
+ #include <QtMath>
+diff --git a/ui/timelineheader.cpp b/ui/timelineheader.cpp
+index f39065b4f..aa7fd638d 100644
+--- a/ui/timelineheader.cpp
+++ b/ui/timelineheader.cpp
+@@ -20,6 +20,7 @@
+ 
+ #include "timelineheader.h"
+ 
+#include <QPainterPath>
+ #include <QPainter>
+ #include <QMouseEvent>
+ #include <QScrollBar>
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@ -21,6 +21,7 @@ let
  version = lib.getVersion edk2;

  suffixes = {
+    i686 = "FV/OVMF";
    x86_64 = "FV/OVMF";
    aarch64 = "FV/AAVMF";
  };
--- a/pkgs/applications/window-managers/picom/picom-jonaburg.nix
+++ b/pkgs/applications/window-managers/picom/picom-jonaburg.nix
@ -13,6 +13,6 @@ picom.overrideAttrs (oldAttrs: rec {
  meta = with lib; {
    description = "A fork of picom featuring animations and improved rounded corners.";
    homepage = "https://github.com/jonaburg/picom";
-    maintainers = with maintainers; oldAttrs.meta.maintainers ++ [ quasigod-io ];
+    maintainers = with maintainers; oldAttrs.meta.maintainers ++ [ michaelBelsanti ];
  };
 })
--- a/pkgs/build-support/build-pecl.nix
+++ b/pkgs/build-support/build-pecl.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, php, autoreconfHook, fetchurl, re2c }:
+{ stdenv, lib, php, autoreconfHook, fetchurl, re2c, nix-update-script }:

 { pname
 , version
@ -12,6 +12,7 @@
    url = "https://pecl.php.net/get/${pname}-${version}.tgz";
    inherit (args) sha256;
  }
+, passthru ? { }
 , ...
 }@args:

@ -34,4 +35,12 @@ stdenv.mkDerivation (args // {
      internalDeps}
  '';
  checkPhase = "NO_INTERACTON=yes make test";
+
+  passthru = passthru // {
+    # Thes flags were introduced for `nix-update` so that it can update
+    # PHP extensions correctly.
+    # See the corresponding PR: https://github.com/Mic92/nix-update/pull/123
+    isPhpExtension = true;
+    updateScript = nix-update-script {};
+  };
 })
--- a/pkgs/desktops/xfce/applications/ristretto/default.nix
+++ b/pkgs/desktops/xfce/applications/ristretto/default.nix
@ -1,14 +1,28 @@
-{ lib, mkXfceDerivation, gtk3, glib, libexif
-, libxfce4ui, libxfce4util, xfconf }:
+{ lib
+, mkXfceDerivation
+, gtk3
+, glib
+, libexif
+, libxfce4ui
+, libxfce4util
+, xfconf
+}:

 mkXfceDerivation {
  category = "apps";
  pname = "ristretto";
-  version = "0.12.3";
+  version = "0.12.4";

-  sha256 = "sha256-Tkjl01OD6yDbKAHzZVRG7c7KnP0MURmsc0d0DbcFuFk=";
+  sha256 = "sha256-pspS9zRvDOMz4+Ud43uT4gsDQhB51bwmaXPXcGlOhsY=";

-  buildInputs = [ glib gtk3 libexif libxfce4ui libxfce4util xfconf ];
+  buildInputs = [
+    glib
+    gtk3
+    libexif
+    libxfce4ui
+    libxfce4util
+    xfconf
+  ];

  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";

--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@ -21,9 +21,9 @@
 let unwrapped = mkXfceDerivation {
  category = "xfce";
  pname = "thunar";
-  version = "4.18.0";
+  version = "4.18.1";

-  sha256 = "sha256-vsc5vEdyYEtpKktBiIRayZl7MjHrxKzL7iwzvBCAqG0=";
+  sha256 = "sha256-n624TZGygFrOjkQ9fUVJUetRV8JDXYSg89tOHm4Va+M=";

  nativeBuildInputs = [
    docbook_xsl
@ -46,8 +46,6 @@ let unwrapped = mkXfceDerivation {

  configureFlags = [ "--with-custom-thunarx-dirs-enabled" ];

-  NIX_CFLAGS_COMPILE = "-I${libxfce4ui.dev}/include/xfce4";
-
  # the desktop file … is in an insecure location»
  # which pops up when invoking desktop files that are
  # symlinks to the /nix/store
--- a/pkgs/desktops/xfce/core/xfce4-settings/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-settings/default.nix
@ -1,13 +1,24 @@
-{ lib, mkXfceDerivation, exo, garcon, gtk3, glib
-, libnotify, libxfce4ui, libxfce4util, libxklavier
-, upower, xfconf, xf86inputlibinput }:
+{ lib
+, mkXfceDerivation
+, exo
+, garcon
+, gtk3
+, glib
+, libnotify
+, libxfce4ui
+, libxfce4util
+, libxklavier
+, upower
+, xfconf
+, xf86inputlibinput
+}:

 mkXfceDerivation {
  category = "xfce";
  pname = "xfce4-settings";
-  version = "4.18.0";
+  version = "4.18.1";

-  sha256 = "sha256-T0sPcsyGqa0hEXIb/mhxb29OnuLmHey6Tt/iB4nQvoM=";
+  sha256 = "sha256-Uy5dObnMV+fpt8RdyFOsYVPN8Dyx1zzOu0pDak01ipQ=";

  postPatch = ''
    for f in xfsettingsd/pointers.c dialogs/mouse-settings/main.c; do
--- a/pkgs/development/compilers/blueprint/default.nix
+++ b/pkgs/development/compilers/blueprint/default.nix
@ -1,26 +1,27 @@
-{ python3
+{ gtk4
+, python3
 , stdenv
 , fetchFromGitLab
 , gobject-introspection
 , lib
 , meson
 , ninja
+, testers
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "blueprint-compiler";
-  version = "0.2.0";
+  version = "0.6.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "jwestman";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-LXZ6n1oCbPa0taVbUZf52mGECrzXIcF8EaMVJ30rMtc=";
+    repo = "blueprint-compiler";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-L6EGterkZ8EB6xSnJDZ3IMuOumpTpEGnU74X3UgC7k0=";
  };

-  # Requires pythonfuzz, which I've found difficult to package
-  doCheck = false;
+  doCheck = true;

  nativeBuildInputs = [
    meson
@ -29,18 +30,32 @@ stdenv.mkDerivation rec {

  buildInputs = [
    python3
-  ];
+    gtk4
+  ] ++ (with python3.pkgs; [
+    pygobject3
+    wrapPython
+  ]);

  propagatedBuildInputs = [
-    # So that the compiler can find GIR and .ui files
    gobject-introspection
  ];

+  postFixup = ''
+    makeWrapperArgs="\
+      --prefix GI_TYPELIB_PATH : $GI_TYPELIB_PATH \
+      --prefix PYTHONPATH : \"$(toPythonPath $out):$(toPythonPath ${python3.pkgs.pygobject3})\""
+    wrapPythonPrograms
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+  };
+
  meta = with lib; {
    description = "A markup language for GTK user interface files";
    homepage = "https://gitlab.gnome.org/jwestman/blueprint-compiler";
    license = licenses.lgpl3Plus;
-    maintainers = [ maintainers.ranfdev ];
-    platforms = platforms.all;
+    maintainers = with maintainers; [ benediktbroich ranfdev ];
+    platforms = platforms.unix;
  };
-}
+})
--- a/pkgs/development/libraries/fcft/default.nix
+++ b/pkgs/development/libraries/fcft/default.nix
@ -13,10 +13,6 @@ let
    "grapheme"
    "run"
  ];
-
-  # Courtesy of sternenseemann and FRidh, commit c9a7fdfcfb420be8e0179214d0d91a34f5974c54
-  mesonFeatureFlag = feature: flag:
-    "-D${feature}=${if flag then "enabled" else "disabled"}";
 in

 stdenv.mkDerivation rec {
@ -40,7 +36,7 @@ stdenv.mkDerivation rec {

  mesonBuildType = "release";
  mesonFlags = builtins.map (t:
-    mesonFeatureFlag "${t}-shaping" (lib.elem t withShapingTypes)
+    lib.mesonEnable "${t}-shaping" (lib.elem t withShapingTypes)
  ) availableShapingTypes;

  doCheck = true;
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@ -30,16 +30,9 @@
 , qt5
 }:

-let
+stdenv.mkDerivation rec {
+  pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
  version = "5.3.1";
-  inherit (lib) optional optionals optionalString;
-  mesonFeatureFlag = feature: flag:
-    "-D${feature}=${if flag then "enabled" else "disabled"}";
-in
-
-stdenv.mkDerivation {
-  pname = "harfbuzz${optionalString withIcu "-icu"}";
-  inherit version;

  src = fetchurl {
    url = "https://github.com/harfbuzz/harfbuzz/releases/download/${version}/harfbuzz-${version}.tar.xz";
@ -72,12 +65,12 @@ stdenv.mkDerivation {
    # and is not part of the library.
    # Cairo causes transitive (build) dependencies on various X11 or other
    # GUI-related libraries, so it shouldn't be re-added lightly.
-    (mesonFeatureFlag "cairo" false)
+    (lib.mesonEnable "cairo" false)
    # chafa is only used in a development utility, not in the library
-    (mesonFeatureFlag "chafa" false)
-    (mesonFeatureFlag "coretext" withCoreText)
-    (mesonFeatureFlag "graphite" withGraphite2)
-    (mesonFeatureFlag "icu" withIcu)
+    (lib.mesonEnable "chafa" false)
+    (lib.mesonEnable "coretext" withCoreText)
+    (lib.mesonEnable "graphite" withGraphite2)
+    (lib.mesonEnable "icu" withIcu)
  ];

  depsBuildBuild = [
@ -99,17 +92,17 @@ stdenv.mkDerivation {
  buildInputs = [ glib freetype gobject-introspection ]
    ++ lib.optionals withCoreText [ ApplicationServices CoreText ];

-  propagatedBuildInputs = optional withGraphite2 graphite2
-    ++ optionals withIcu [ icu harfbuzz ];
+  propagatedBuildInputs = lib.optional withGraphite2 graphite2
+    ++ lib.optionals withIcu [ icu harfbuzz ];

  doCheck = true;

  # Slightly hacky; some pkgs expect them in a single directory.
-  postFixup = optionalString withIcu ''
+  postFixup = lib.optionalString withIcu ''
    rm "$out"/lib/libharfbuzz.* "$dev/lib/pkgconfig/harfbuzz.pc"
    ln -s {'${harfbuzz.out}',"$out"}/lib/libharfbuzz.la
    ln -s {'${harfbuzz.dev}',"$dev"}/lib/pkgconfig/harfbuzz.pc
-    ${optionalString stdenv.isDarwin ''
+    ${lib.optionalString stdenv.isDarwin ''
      ln -s {'${harfbuzz.out}',"$out"}/lib/libharfbuzz.dylib
      ln -s {'${harfbuzz.out}',"$out"}/lib/libharfbuzz.0.dylib
    ''}
--- a/pkgs/development/libraries/minizip-ng/default.nix
+++ b/pkgs/development/libraries/minizip-ng/default.nix
@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, gtest
+, pkg-config
+, zlib
+, bzip2
+, xz
+, zstd
+, openssl
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "minizip-ng";
+  version = "3.0.7";
+
+  src = fetchFromGitHub {
+    owner = "zlib-ng";
+    repo = finalAttrs.pname;
+    rev = finalAttrs.version;
+    sha256 = "sha256-m/zSVx8vYzLA23Cusd1p/ZSGd1mV3gM6UqDnmEXqpq4=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "find-system-gtest.patch";
+      url = "https://github.com/zlib-ng/minizip-ng/commit/be23c8d3b7e2cb5ba619e60517cad277ee510fb7.patch";
+      sha256 = "sha256-azwrGj6kgTyTepGAmOlxDOFOwJKQE5J2bwUIn6sgKUY=";
+    })
+
+    # otherwise signing unit tests fail
+    (fetchpatch {
+      name = "disable-mz-signing-by-default.patch";
+      url = "https://github.com/zlib-ng/minizip-ng/commit/60649ada97581afc0bc2fffc50ce402ff1e6df5d.patch";
+      sha256 = "sha256-bHGM4H8RPYkfAjxcS1bPohR9IFOFT0Mx4Mg34UnnD+w=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ zlib bzip2 xz zstd openssl ];
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
+    "-DMZ_OPENSSL=ON"
+    "-DMZ_BUILD_TESTS=${if finalAttrs.doCheck then "ON" else "OFF"}"
+    "-DMZ_BUILD_UNIT_TESTS=${if finalAttrs.doCheck then "ON" else "OFF"}"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # missing header file
+    "-DMZ_LIBCOMP=OFF"
+  ];
+
+  postInstall = let
+    libext = if stdenv.hostPlatform.isStatic then ".a" else ".so";
+  in ''
+    # make lib findable as libminizip-ng even if compat is enabled
+    if [ ! -e $out/lib/libminizip-ng${libext} ]; then
+      ln -s $out/lib/libminizip${libext} $out/lib/libminizip-ng${libext}
+    fi
+    if [ ! -e $out/include/minizip-ng ]; then
+      ln -s $out/include $out/include/minizip-ng
+    fi
+  '';
+
+  doCheck = stdenv.buildPlatform == stdenv.hostPlatform;
+  checkInputs = [ gtest ];
+  enableParallelChecking = false;
+
+  meta = with lib; {
+    description = "Fork of the popular zip manipulation library found in the zlib distribution";
+    homepage = "https://github.com/zlib-ng/minizip-ng";
+    license = licenses.zlib;
+    maintainers = with maintainers; [ gebner ris ];
+    platforms = platforms.unix;
+  };
+})
--- a/pkgs/development/libraries/minizip2/default.nix
+++ b/pkgs/development/libraries/minizip2/default.nix
@ -1,30 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, zlib, bzip2, xz, zstd, openssl }:
-
-stdenv.mkDerivation rec {
-  pname = "minizip";
-  version = "2.10.6";
-
-  src = fetchFromGitHub {
-    owner = "nmoinvaz";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-OAm4OZeQdP2Q/UKYI9bR7OV9RmLmYF/j2NpK5TPoE60=";
-  };
-
-  nativeBuildInputs = [ cmake pkg-config ];
-
-  cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=YES"
-    "-DMZ_OPENSSL=ON"
-  ];
-
-  buildInputs = [ zlib bzip2 xz zstd openssl ];
-
-  meta = with lib; {
-    description = "Compression library implementing the deflate compression method found in gzip and PKZIP";
-    homepage = "https://github.com/nmoinvaz/minizip";
-    license = licenses.zlib;
-    maintainers = with maintainers; [ gebner ];
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@ -16,7 +16,7 @@
 , qtsvg
 , fftw
 , vid-stab
-, opencv3
+, opencv4
 , ladspa-sdk
 , gitUpdater
 , ladspaPlugins
@ -51,7 +51,7 @@ mkDerivation rec {
    sox
    fftw
    vid-stab
-    opencv3
+    opencv4
    ladspa-sdk
    ladspaPlugins
    rubberband
@ -64,6 +64,7 @@ mkDerivation rec {
  cmakeFlags = [
    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+    "-DMOD_OPENCV=ON"
  ];

  qtWrapperArgs = [
--- a/pkgs/development/libraries/olm/default.nix
+++ b/pkgs/development/libraries/olm/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "olm";
-  version = "3.2.13";
+  version = "3.2.14";

  src = fetchFromGitLab {
    domain = "gitlab.matrix.org";
    owner = "matrix-org";
    repo = pname;
    rev = version;
-    sha256 = "sha256-s1OleVRvJRFvN9MwXT7lAjDjyHkbIkbpl/F8P/91oaU=";
+    sha256 = "sha256-Bcdl3myzWZb8vu3crYDKt8hEXD9QcZGOphT2KIZ+R14=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/process-cpp/default.nix
+++ b/pkgs/development/libraries/process-cpp/default.nix
@ -0,0 +1,50 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, cmake
+, boost
+, properties-cpp
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "process-cpp";
+  version = "unstable-2021-05-11";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.com";
+    owner = "ubports";
+    repo = "development/core/lib-cpp/process-cpp";
+    rev = "ee6d99a3278343f5fdcec7ed3dad38763e257310";
+    sha256 = "sha256-jDYXKCzrg/ZGFC2xpyfkn/f7J3t0cdOwHK2mLlYWNN0=";
+  };
+
+  postPatch = ''
+    # Excludes tests from tainting nativeBuildInputs with their dependencies when not being run
+    # Tests fail upon verifying OOM score adjustment via /proc/<pid>/oom_score
+    # [ RUN      ] LinuxProcess.adjusting_proc_oom_score_adj_works
+    # /build/source/tests/linux_process_test.cpp:83: Failure
+    # Value of: is_approximately_equal(oom_score.value, core::posix::linux::proc::process::OomScoreAdj::max_value())
+    #   Actual: false (333 > 10)
+    # Expected: true
+    sed -i '/tests/d' CMakeLists.txt
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    properties-cpp
+  ];
+
+  meta = with lib; {
+    description = "A simple convenience library for handling processes in C++11";
+    homepage = "https://gitlab.com/ubports/development/core/lib-cpp/process-cpp";
+    license = with licenses; [ gpl3Only lgpl3Only ];
+    maintainers = with maintainers; [ onny ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/psol/default.nix
+++ b/pkgs/development/libraries/psol/default.nix
@ -1,5 +1,19 @@
-{ callPackage }:
-callPackage ./generic.nix {} {
+{ fetchzip, lib }:
+
+fetchzip rec {
+  pname = "psol";
  version = "1.13.35.2"; # Latest stable, 2018-02-05
-  sha256  = "0xi2srf9gx0x2sz9r45zb35k2n0iv457if1lqzvbanls3f935cmr";
+
+  url = "https://dl.google.com/dl/page-speed/psol/${version}-x64.tar.gz";
+  sha256 = "0xi2srf9gx0x2sz9r45zb35k2n0iv457if1lqzvbanls3f935cmr";
+
+  meta = with lib; {
+    description = "PageSpeed Optimization Libraries";
+    homepage = "https://developers.google.com/speed/pagespeed/psol";
+    license = licenses.asl20;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    # WARNING: This only works with Linux because the pre-built PSOL binary is only supplied for Linux.
+    # TODO: Build PSOL from source to support more platforms.
+    platforms = platforms.linux;
+  };
 }
--- a/pkgs/development/libraries/psol/generic.nix
+++ b/pkgs/development/libraries/psol/generic.nix
@ -1,17 +0,0 @@
-{ fetchzip, lib }:
-{ version, sha256 }:
-{ inherit version; } // fetchzip {
-  inherit sha256;
-  name   = "psol-${version}";
-  url    = "https://dl.google.com/dl/page-speed/psol/${version}-x64.tar.gz";
-
-  meta = {
-    description = "PageSpeed Optimization Libraries";
-    homepage    = "https://developers.google.com/speed/pagespeed/psol";
-    license     = lib.licenses.asl20;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    # WARNING: This only works with Linux because the pre-built PSOL binary is only supplied for Linux.
-    # TODO: Build PSOL from source to support more platforms.
-    platforms   = lib.platforms.linux;
-  };
-}
--- a/pkgs/development/libraries/quarto/default.nix
+++ b/pkgs/development/libraries/quarto/default.nix
@ -13,10 +13,10 @@

 stdenv.mkDerivation rec {
  pname = "quarto";
-  version = "1.2.269";
+  version = "1.2.280";
  src = fetchurl {
    url = "https://github.com/quarto-dev/quarto-cli/releases/download/v${version}/quarto-${version}-linux-amd64.tar.gz";
-    sha256 = "sha256-liZc7Ewo7HaIXdcXpdfQ3SW5JlOmZiZDawusjgJt8pE=";
+    sha256 = "sha256-mbChS3GL36ySWo2jDZGJIDZIkBJ/UDUmypJjP5HW6KE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/sptk/default.nix
+++ b/pkgs/development/libraries/sptk/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "sptk";
-  version = "4.0";
+  version = "4.1";

  src = fetchFromGitHub {
    owner = "sp-nitech";
    repo = "SPTK";
    rev = "v${version}";
-    hash = "sha256-Be3Pbg+vt/P3FplZN7yBL+HVq/BmzaBcwKOBsbH7r9g=";
+    hash = "sha256-t8XVdKrrewfqefUnEz5xHgRHF0NThNQD1KGPMLOO/o8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/ocaml-modules/conduit/default.nix
+++ b/pkgs/development/ocaml-modules/conduit/default.nix
@ -5,13 +5,13 @@

 buildDunePackage rec {
  pname = "conduit";
-  version = "5.1.0";
+  version = "6.1.0";

  minimalOCamlVersion = "4.03";

  src = fetchurl {
    url = "https://github.com/mirage/ocaml-conduit/releases/download/v${version}/conduit-${version}.tbz";
-    sha256 = "sha256-5RyMPoecu+ngmYmwBZUJODLchmQgiAcuA+Wlmiojkc0=";
+    sha256 = "sha256-ouKQiGMLvvksGpAhkqCVSKtKaz91p+7mciQm7KHvwF8=";
  };

  propagatedBuildInputs = [ astring ipaddr ipaddr-sexp sexplib uri ppx_sexp_conv ];
--- a/pkgs/development/ocaml-modules/tsdl/default.nix
+++ b/pkgs/development/ocaml-modules/tsdl/default.nix
@ -6,7 +6,7 @@ else

 let
  pname = "tsdl";
-  version = "0.9.8";
+  version = "0.9.9";
  webpage = "https://erratique.ch/software/${pname}";
 in

@ -15,7 +15,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "${webpage}/releases/${pname}-${version}.tbz";
-    sha256 = "sha256-zjXz2++42FHmbE0nIDeryNQeX+avGwh9rwAs8O0pZYU=";
+    sha256 = "sha256-GqFz+bYG2ESkAEJyP8DKud4JFfU5MGLulzJa5Z4sptQ=";
  };

  nativeBuildInputs = [ pkg-config ocaml findlib ocamlbuild topkg ];
--- a/pkgs/development/php-packages/amqp/default.nix
+++ b/pkgs/development/php-packages/amqp/default.nix
@ -1,16 +1,24 @@
-{ buildPecl, lib, rabbitmq-c }:
+{ buildPecl, lib, rabbitmq-c, fetchFromGitHub }:

-buildPecl {
+let
+  version = "1.11.0";
+in buildPecl {
+  inherit version;
  pname = "amqp";

-  version = "1.11.0beta";
-  sha256 = "sha256-HbVLN6fg2htYZgAFw+IhYHP+XN8j7cTLG6S0YHHOC14=";
+  src = fetchFromGitHub {
+    owner = "php-amqp";
+    repo = "php-amqp";
+    rev = "v${version}";
+    sha256 = "sha256-CDhNDk78D15MtljbtyYj8euPnCruLZnc2NEHqXDX8HY=";
+  };

  buildInputs = [ rabbitmq-c ];

  AMQP_DIR = rabbitmq-c;

  meta = with lib; {
+    changelog = "https://github.com/php-amqp/php-amqp/releases/tag/v${version}";
    description = "PHP extension to communicate with any AMQP compliant server";
    license = licenses.php301;
    homepage = "https://github.com/php-amqp/php-amqp";
--- a/pkgs/development/php-packages/apcu/default.nix
+++ b/pkgs/development/php-packages/apcu/default.nix
@ -1,10 +1,17 @@
-{ buildPecl, lib, pcre2 }:
+{ buildPecl, lib, pcre2, fetchFromGitHub }:

-buildPecl {
+let
+  version = "5.1.22";
+in buildPecl {
+  inherit version;
  pname = "apcu";

-  version = "5.1.22";
-  sha256 = "sha256-AQoNj9ES4e16UqNWGR2jaWprdjGUI/ew396u6vy0Gh4=";
+  src = fetchFromGitHub {
+    owner = "krakjoe";
+    repo = "apcu";
+    rev = "v${version}";
+    sha256 = "sha256-L4a+/kWT95a1Km+FzFNiAaBw8enU6k4ZiCFRErjj9o8=";
+  };

  buildInputs = [ pcre2 ];
  doCheck = true;
@ -14,6 +21,7 @@ buildPecl {
  outputs = [ "out" "dev" ];

  meta = with lib; {
+    changelog = "https://github.com/krakjoe/apcu/releases/tag/v${version}";
    description = "Userland cache for PHP";
    license = licenses.php301;
    homepage = "https://pecl.php.net/package/APCu";
--- a/pkgs/development/php-packages/ast/default.nix
+++ b/pkgs/development/php-packages/ast/default.nix
@ -1,12 +1,20 @@
-{ buildPecl, lib }:
+{ buildPecl, lib, fetchFromGitHub }:

-buildPecl {
+let
+  version = "1.1.0";
+in buildPecl {
+  inherit version;
  pname = "ast";

-  version = "1.1.0";
-  sha256 = "sha256-7j1PZ+JNguTTQIBqJAUgEuSVTSIxIpSTd2ZUJ0Q+bRM=";
+  src = fetchFromGitHub {
+    owner = "nikic";
+    repo = "php-ast";
+    rev = "v${version}";
+    sha256 = "sha256-e9J6O4A+8xRBlR9m4OK1kTVpzgzsviD0Eqi0iY4AgkY=";
+  };

  meta = with lib; {
+    changelog = "https://github.com/nikic/php-ast/releases/tag/v${version}";
    description = "Exposes the abstract syntax tree generated by PHP";
    license = licenses.bsd3;
    homepage = "https://pecl.php.net/package/ast";
--- a/pkgs/development/php-packages/box/default.nix
+++ b/pkgs/development/php-packages/box/default.nix
@ -1,14 +1,15 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
+
 let
  pname = "box";
-  version = "4.1.0";
+  version = "4.2.0";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/box-project/box/releases/download/${version}/box.phar";
-    sha256 = "sha256-DtrTsCocCpLngiEPrKBrFeU+OnND8AoI83g+Y7+zHzs=";
+    sha256 = "sha256-9pPhqFq9t3MKI/y6/7iCYB8ddWFrafGVcV/k+Exb+KQ=";
  };

  dontUnpack = true;
@ -25,6 +26,7 @@ mkDerivation {
  '';

  meta = with lib; {
+    changelog = "https://github.com/box-project/box/releases/tag/${version}";
    description = "An application for building and managing Phars";
    license = licenses.mit;
    homepage = "https://github.com/box-project/box";
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@ -1,4 +1,5 @@
 { mkDerivation, fetchurl, makeWrapper, unzip, lib, php }:
+
 let
  pname = "composer";
  version = "2.5.1";
@ -7,7 +8,7 @@ mkDerivation {
  inherit pname version;

  src = fetchurl {
-    url = "https://getcomposer.org/download/${version}/composer.phar";
+    url = "https://github.com/composer/composer/releases/download/${version}/composer.phar";
    sha256 = "sha256-8blP7hGlvWoarl13yNomnfJ8cF/MgG6/TIwub6hkXCA=";
  };

--- a/pkgs/development/php-packages/couchbase/default.nix
+++ b/pkgs/development/php-packages/couchbase/default.nix
@ -25,6 +25,7 @@ buildPecl {
  ];

  meta = with lib; {
+    changelog = "https://github.com/couchbase/php-couchbase/releases/tag/v${version}";
    description = "Couchbase Server PHP extension";
    license = licenses.asl20;
    homepage = "https://docs.couchbase.com/php-sdk/current/project-docs/sdk-release-notes.html";
--- a/pkgs/development/php-packages/ds/default.nix
+++ b/pkgs/development/php-packages/ds/default.nix
@ -1,14 +1,22 @@
-{ buildPecl, lib, pcre2, php }:
+{ buildPecl, lib, pcre2, php, fetchFromGitHub }:

-buildPecl {
+let
+  version = "1.4.0";
+in buildPecl {
+  inherit version;
  pname = "ds";

-  version = "1.4.0";
-  sha256 = "1vwk5d27zd746767l8cvbcdr8r70v74vw0im38mlw1g85mc31fd9";
+  src = fetchFromGitHub {
+    owner = "php-ds";
+    repo = "ext-ds";
+    rev = "v${version}";
+    sha256 = "sha256-IqNv2jVW1Hg1hV8H9vEyLT5BWsFkGHR+WlAOHJhlW84=";
+  };

  buildInputs = [ pcre2 ];

  meta = with lib; {
+    changelog = "https://github.com/php-ds/ext-ds/releases/tag/v${version}";
    description = "An extension providing efficient data structures for PHP";
    license = licenses.mit;
    homepage = "https://github.com/php-ds/ext-ds";
--- a/pkgs/development/php-packages/gnupg/default.nix
+++ b/pkgs/development/php-packages/gnupg/default.nix
@ -1,10 +1,18 @@
-{ buildPecl, lib, gpgme, file, gnupg, php }:
+{ buildPecl, lib, gpgme, file, gnupg, php, fetchFromGitHub }:

-buildPecl {
+let
+  version = "1.5.1";
+in buildPecl {
+  inherit version;
  pname = "gnupg";

-  version = "1.5.1";
-  sha256 = "sha256-qZBvRlqyNDyy8xJ+4gnHJ2Ajh0XDSHjZu8FXZIYhklI=";
+  src = fetchFromGitHub {
+    owner = "php-gnupg";
+    repo = "php-gnupg";
+    rev = "gnupg-${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-kEc0883sYgmAf1mkH0zRjHzUASnZgQvdYE6VzT5X2RI=";
+  };

  buildInputs = [ gpgme ];
  checkInputs = [ gnupg ];
@ -29,6 +37,7 @@ buildPecl {
  doCheck = true;

  meta = with lib; {
+    changelog = "https://github.com/php-gnupg/php-gnupg/releases/tag/gnupg-${version}";
    broken = lib.versionOlder php.version "8.1"; # Broken on PHP older than 8.1.
    description = "PHP wrapper for GpgME library that provides access to GnuPG";
    license = licenses.bsd3;
--- a/pkgs/development/php-packages/grumphp/default.nix
+++ b/pkgs/development/php-packages/grumphp/default.nix
@ -1,11 +1,12 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
+
 mkDerivation rec {
  pname = "grumphp";
-  version = "1.8.1";
+  version = "1.15.0";

  src = fetchurl {
    url = "https://github.com/phpro/${pname}/releases/download/v${version}/${pname}.phar";
-    sha256 = "sha256-3XPMyH2F3ZfRr8DmvlBY3Z6uolhaRraQxwKIskIwPq8=";
+    sha256 = "sha256-EqzJb7DYZb7PnebErLVI/EZLxj0m26cniZlsu1feif0=";
  };

  dontUnpack = true;
@ -22,6 +23,7 @@ mkDerivation rec {
  '';

  meta = with lib; {
+    changelog = "https://github.com/phpro/grumphp/releases/tag/v${version}";
    description = "A PHP code-quality tool";
    homepage = "https://github.com/phpro/grumphp";
    license = licenses.mit;
--- a/pkgs/development/php-packages/openswoole/default.nix
+++ b/pkgs/development/php-packages/openswoole/default.nix
@ -1,17 +1,23 @@
-{ lib, stdenv, buildPecl, php, valgrind, pcre2 }:
+{ lib, stdenv, buildPecl, php, valgrind, pcre2, fetchFromGitHub }:
+
 let
  pname = "openswoole";
-  version = "4.12.0";
-in
-buildPecl {
-  inherit pname version;
+  version = "22.0.0";
+in buildPecl {
+  inherit version;
+  pname = "openswoole";

-  sha256 = "16fxwkjqihinzsmjbpzslf13m8yp0wnsqa2y5g0b07cf15g6qbny";
+  src = fetchFromGitHub {
+    owner = "openswoole";
+    repo = "swoole-src";
+    rev = "v${version}";
+    sha256 = "sha256-4Z7mBNGHXS/giSCmPpSyu9/99MEjCnoXgymDM/s1gk8=";
+  };

  buildInputs = [ pcre2 ] ++ lib.optionals (!stdenv.isDarwin) [ valgrind ];

  meta = with lib; {
-    changelog = "https://pecl.php.net/package/openswoole/${version}";
+    changelog = "https://github.com/openswoole/swoole-src/releases/tag/v${version}";
    description = "Coroutine-based concurrency library and high performance programmatic server for PHP";
    homepage = "https://www.openswoole.com/";
    license = licenses.asl20;
--- a/pkgs/development/php-packages/pcov/default.nix
+++ b/pkgs/development/php-packages/pcov/default.nix
@ -1,14 +1,22 @@
-{ buildPecl, lib, pcre2 }:
+{ buildPecl, lib, php, pcre2, fetchFromGitHub }:

-buildPecl {
+let
+  version = "1.0.11";
+in buildPecl {
+  inherit version;
  pname = "pcov";

-  version = "1.0.11";
-  sha256 = "sha256-rSLmTNOvBlMwGCrBQsHDq0Dek0SCzUAPi9dgZBMKwkI=";
+  src = fetchFromGitHub {
+    owner = "krakjoe";
+    repo = "pcov";
+    rev = "v${version}";
+    sha256 = "sha256-lyY17Y9chpTO8oeWmDGSh0YSnipYqCuy1qmn9su5Eu8=";
+  };

  buildInputs = [ pcre2 ];

  meta = with lib; {
+    changelog = "https://github.com/krakjoe/pcov/releases/tag/v${version}";
    description = "A self contained php-code-coverage compatible driver for PHP.";
    license = licenses.php301;
    homepage = "https://github.com/krakjoe/pcov";
--- a/pkgs/development/php-packages/phan/default.nix
+++ b/pkgs/development/php-packages/phan/default.nix
@ -0,0 +1,42 @@
+{ lib
+, php
+, mkDerivation
+, fetchurl
+, makeWrapper
+}:
+let
+  php' = php.withExtensions ({ enabled, all }: enabled ++ [ all.ast ]);
+in
+mkDerivation rec {
+  pname = "phan";
+  version = "5.4.1";
+
+  src = fetchurl {
+    url = "https://github.com/phan/phan/releases/download/${version}/phan.phar";
+    hash = "sha256-DJr1BWAfNI3hYvmBui5Dp+n7ec+f+gkOso21KEd6m8I=";
+  };
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    install -D $src $out/libexec/phan/phan.phar
+    makeWrapper ${php'}/bin/php $out/bin/phan \
+      --add-flags "$out/libexec/phan/phan.phar"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Static analyzer for PHP";
+    longDescription = ''
+      Phan is a static analyzer for PHP. Phan prefers to avoid false-positives
+      and attempts to prove incorrectness rather than correctness.
+    '';
+    license = licenses.mit;
+    homepage = "https://github.com/phan/phan";
+    maintainers = [ maintainers.apeschar ];
+  };
+}
--- a/pkgs/development/php-packages/phing/default.nix
+++ b/pkgs/development/php-packages/phing/default.nix
@ -1,4 +1,5 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
+
 let
  pname = "phing";
  version = "2.17.4";
@ -7,7 +8,7 @@ mkDerivation {
  inherit pname version;

  src = fetchurl {
-    url = "https://www.phing.info/get/phing-${version}.phar";
+    url = "https://github.com/phingofficial/phing/releases/download/v${version}/phing-${version}.phar";
    sha256 = "sha256-3QZsl5QJkFX5Z4RovMtw2ELCp8Zl4xiZsIBikakJ474=";
  };

--- a/pkgs/development/php-packages/phive/default.nix
+++ b/pkgs/development/php-packages/phive/default.nix
@ -2,11 +2,11 @@

 mkDerivation rec {
  pname = "phive";
-  version = "0.15.0";
+  version = "0.15.2";

  src = fetchurl {
    url = "https://github.com/phar-io/phive/releases/download/${version}/phive-${version}.phar";
-    sha256 = "sha256-crMr8d5nsVt7+zQ5xPeph/JXmTEn6jJFVtp3mOgylB4=";
+    sha256 = "K7B2dT7F1nL14vlql6D+fo6ewkpDnu0A/SnvlCx5Bfk=";
  };

  dontUnpack = true;
@ -23,6 +23,7 @@ mkDerivation rec {
  '';

  meta = with lib; {
+    changelog = "https://github.com/phar-io/phive/releases/tag/${version}";
    description = "The Phar Installation and Verification Environment (PHIVE)";
    homepage = "https://github.com/phar-io/phive";
    license = licenses.bsd3;
--- a/pkgs/development/php-packages/php-cs-fixer/default.nix
+++ b/pkgs/development/php-packages/php-cs-fixer/default.nix
@ -1,14 +1,15 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
+
 let
  pname = "php-cs-fixer";
-  version = "3.11.0";
+  version = "3.13.1";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v${version}/php-cs-fixer.phar";
-    sha256 = "sha256-hnSHR/tDX1w/4SV6fafvUHg4JwTQJxfwKaKvEbUWJjs=";
+    sha256 = "4bQrCjuaWN4Dbs1tkk4m1WxSb510ue7G59HA+gQ52yk=";
  };

  dontUnpack = true;
@ -25,6 +26,7 @@ mkDerivation {
  '';

  meta = with lib; {
+    changelog = "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases/tag/${version}";
    description = "A tool to automatically fix PHP coding standards issues";
    license = licenses.mit;
    homepage = "https://cs.symfony.com/";
--- a/pkgs/development/php-packages/phpcbf/default.nix
+++ b/pkgs/development/php-packages/phpcbf/default.nix
@ -1,14 +1,15 @@
 { mkDerivation, fetchurl, lib, php, makeWrapper }:
+
 let
  pname = "phpcbf";
-  version = "3.6.0";
+  version = "3.7.1";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/squizlabs/PHP_CodeSniffer/releases/download/${version}/phpcbf.phar";
-    sha256 = "04wb1imm4934mpy2hxcmqh4cn7md1vwmfii39p6mby809325b5z1";
+    sha256 = "sha256-yTwOg8vaIcIfhJzPD0tCl50gAEpaYXLtDqJw7Keub6g=";
  };

  dontUnpack = true;
@ -25,6 +26,7 @@ mkDerivation {
  '';

  meta = with lib; {
+    changelog = "https://github.com/squizlabs/PHP_CodeSniffer/releases/tag/${version}";
    description = "PHP coding standard beautifier and fixer";
    license = licenses.bsd3;
    homepage = "https://squizlabs.github.io/PHP_CodeSniffer/";
--- a/pkgs/development/php-packages/phpcs/default.nix
+++ b/pkgs/development/php-packages/phpcs/default.nix
@ -1,14 +1,15 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
+
 let
  pname = "phpcs";
-  version = "3.6.0";
+  version = "3.7.1";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/squizlabs/PHP_CodeSniffer/releases/download/${version}/phpcs.phar";
-    sha256 = "0sdi78hrwd3r5p1b38qmp89m41kfszh2qn4n5zhq2dmhsjdhjziz";
+    sha256 = "sha256-ehQyOhSvn1gwLRVEJJLuEHaozXLAGKgWy0SWW/OpsBU=";
  };

  dontUnpack = true;
@ -25,6 +26,7 @@ mkDerivation {
  '';

  meta = with lib; {
+    changelog = "https://github.com/squizlabs/PHP_CodeSniffer/releases/tag/${version}";
    description = "PHP coding standard tool";
    license = licenses.bsd3;
    homepage = "https://squizlabs.github.io/PHP_CodeSniffer/";
--- a/pkgs/development/php-packages/phpmd/default.nix
+++ b/pkgs/development/php-packages/phpmd/default.nix
@ -1,14 +1,15 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
+
 let
  pname = "phpmd";
-  version = "2.8.2";
+  version = "2.13.0";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/phpmd/phpmd/releases/download/${version}/phpmd.phar";
-    sha256 = "1i8qgzxniw5d8zjpypalm384y7qfczapfq70xmg129laq6xiqlqb";
+    sha256 = "LNR7qT3KIhIeq9WPdXVGsnuzzXN4ze/juDMpt1Ke/A0=";
  };

  dontUnpack = true;
@ -25,6 +26,7 @@ mkDerivation {
  '';

  meta = with lib; {
+    changelog = "https://github.com/phpmd/phpmd/releases/tag/${version}";
    description = "PHP code quality analyzer";
    license = licenses.bsd3;
    homepage = "https://phpmd.org/";
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@ -1,14 +1,15 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
+
 let
  pname = "phpstan";
-  version = "1.8.6";
+  version = "1.9.4";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-    sha256 = "sha256-8scUd8BT6u9rqBPoaXozkn6H9PIWF/MWNWT9y8RwPkg=";
+    sha256 = "sha256-A+F/ZoL6dLYx4MWN0eWXtQnmWJPYBqEcSgY4A1oR3mo=";
  };

  dontUnpack = true;
@ -25,6 +26,7 @@ mkDerivation {
  '';

  meta = with lib; {
+    changelog = "https://github.com/phpstan/phpstan/releases/tag/${version}";
    description = "PHP Static Analysis Tool";
    longDescription = ''
      PHPStan focuses on finding errors in your code without actually
--- a/pkgs/development/php-packages/psalm/default.nix
+++ b/pkgs/development/php-packages/psalm/default.nix
@ -1,14 +1,15 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
+
 let
  pname = "psalm";
-  version = "4.29.0";
+  version = "5.4.0";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/vimeo/psalm/releases/download/${version}/psalm.phar";
-    sha256 = "q+OjEPNAPwSjtnbfBynbbJy3WDITr01ci8O74BMO0Og=";
+    sha256 = "sha256-d5jf68s+LppUDwERQaqr+ry8L+Zmob8VwetYkQ+vIUg=";
  };

  dontUnpack = true;
@ -25,6 +26,7 @@ mkDerivation {
  '';

  meta = with lib; {
+    changelog = "https://github.com/vimeo/psalm/releases/tag/${version}";
    description = "A static analysis tool for finding errors in PHP applications";
    license = licenses.mit;
    homepage = "https://github.com/vimeo/psalm";
--- a/pkgs/development/php-packages/psysh/default.nix
+++ b/pkgs/development/php-packages/psysh/default.nix
@ -1,14 +1,15 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
+
 let
  pname = "psysh";
-  version = "0.11.8";
+  version = "0.11.10";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/bobthecow/psysh/releases/download/v${version}/psysh-v${version}.tar.gz";
-    sha256 = "sha256-VK1e3qQGaN6Kc/5dUaGwrHAqk9yiJCwbW29x6i6nHQ4=";
+    sha256 = "sha256-2U9HMA3OAA9Nl9JVJjepB2vi0O483xGpr8nQUGhOrpI=";
  };

  dontUnpack = true;
@ -25,6 +26,7 @@ mkDerivation {
  '';

  meta = with lib; {
+    changelog = "https://github.com/bobthecow/psysh/releases/tag/v${version}";
    description = "PsySH is a runtime developer console, interactive debugger and REPL for PHP.";
    license = licenses.mit;
    homepage = "https://psysh.org/";
--- a/pkgs/development/php-packages/redis/default.nix
+++ b/pkgs/development/php-packages/redis/default.nix
@ -1,16 +1,24 @@
-{ buildPecl, lib, php }:
+{ buildPecl, lib, php, fetchFromGitHub }:

-buildPecl {
+let
+  version = "5.3.7";
+in buildPecl {
+  inherit version;
  pname = "redis";

-  version = "5.3.7";
-  sha256 = "sha256-uVgWbM2k9AvRfGmY+eIjkCGuZERnzYrVwV3vQgqtZbA=";
+  src = fetchFromGitHub {
+    repo = "phpredis";
+    owner = "phpredis";
+    rev = version;
+    sha256 = "sha256-Cc9Mtx28j3kpyV8Yq+JSYQt5XQnELaVjuUbkkbG45kw=";
+  };

  internalDeps = with php.extensions; [
    session
  ];

  meta = with lib; {
+    changelog = "https://github.com/phpredis/phpredis/releases/tag/${version}";
    description = "PHP extension for interfacing with Redis";
    license = licenses.php301;
    homepage = "https://github.com/phpredis/phpredis/";
--- a/pkgs/development/php-packages/swoole/default.nix
+++ b/pkgs/development/php-packages/swoole/default.nix
@ -1,10 +1,17 @@
-{ lib, stdenv, buildPecl, php, valgrind, pcre2 }:
+{ lib, stdenv, buildPecl, php, valgrind, pcre2, fetchFromGitHub }:

-buildPecl {
+let
+  version = "5.0.1";
+in buildPecl {
+  inherit version;
  pname = "swoole";

-  version = "5.0.1";
-  sha256 = "1zq5vvwjqpg3d4qv8902w54gvghjgcb3c7szi7fpqi6f51mhhwvf";
+  src = fetchFromGitHub {
+    owner = "swoole";
+    repo = "swoole-src";
+    rev = "v${version}";
+    sha256 = "sha256-d0xccbfOmebWR14oTUviWz/mB5IA7iXn0uUWxTQRd9w=";
+  };

  buildInputs = [ pcre2 ] ++ lib.optionals (!stdenv.isDarwin) [ valgrind ];

@ -12,6 +19,7 @@ buildPecl {
  checkTarget = "tests";

  meta = with lib; {
+    changelog = "https://github.com/swoole/swoole-src/releases/tag/v${version}";
    description = "Coroutine-based concurrency library for PHP";
    license = licenses.asl20;
    homepage = "https://www.swoole.co.uk/";
--- a/pkgs/development/php-packages/xdebug/default.nix
+++ b/pkgs/development/php-packages/xdebug/default.nix
@ -1,10 +1,18 @@
-{ buildPecl, lib }:
+{ buildPecl, lib, fetchFromGitHub }:
+
+let
+  version = "3.2.0";
+in buildPecl {
+  inherit version;

-buildPecl {
  pname = "xdebug";

-  version = "3.2.0";
-  sha256 = "1drj00z8ididm2iw7a7pnrsvakrr1g0i49aqkyz5zpysxh7b4sbp";
+  src = fetchFromGitHub {
+    owner = "xdebug";
+    repo = "xdebug";
+    rev = version;
+    sha256 = "sha256-GQB69aETp8STyT4GHQQSPJBVEynWifbmGQXUeISvLRI=";
+  };

  doCheck = true;
  checkTarget = "test";
@ -12,6 +20,7 @@ buildPecl {
  zendExtension = true;

  meta = with lib; {
+    changelog = "https://github.com/xdebug/xdebug/releases/tag/${version}";
    description = "Provides functions for function traces and profiling";
    license = licenses.php301;
    homepage = "https://xdebug.org/";
--- a/pkgs/development/python-modules/agate/default.nix
+++ b/pkgs/development/python-modules/agate/default.nix
@ -9,7 +9,7 @@
 , lxml
 , nose
 , parsedatetime
-, PyICU
+, pyicu
 , python-slugify
 , pytimeparse
 , pythonOlder
@ -46,7 +46,7 @@ buildPythonPackage rec {
    glibcLocales
    lxml
    nose
-    PyICU
+    pyicu
    pytz
  ];

--- a/pkgs/development/python-modules/aioairzone/default.nix
+++ b/pkgs/development/python-modules/aioairzone/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "aioairzone";
-  version = "0.5.1";
+  version = "0.5.2";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "Noltari";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-L2R4Qu72bvUjJyE/bBMeKufK/TAFw9u/oGowS1rCqP4=";
+    hash = "sha256-x4OtYUJjRDSDd0FzlbMf7syjUIVxKsqgEfRWS1wgvPo=";
  };

  propagatedBuildInputs = [
@ -33,6 +33,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Module to control AirZone devices";
    homepage = "https://github.com/Noltari/aioairzone";
+    changelog = "https://github.com/Noltari/aioairzone/releases/tag/${version}";
    license = with licenses; [ asl20 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "aiohomekit";
-  version = "2.4.1";
+  version = "2.4.3";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "Jc2k";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-xgk42/g5mRQiTjYuUnXCfLnQm6DNIJsvMbBOhr2NncQ=";
+    hash = "sha256-VuWhD5S1hOys/TcofQfPe3QzSGA0/Uvl9xnxavxJR60=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aiosmtplib/default.nix
+++ b/pkgs/development/python-modules/aiosmtplib/default.nix
@ -7,11 +7,12 @@
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, trustme
 }:

 buildPythonPackage rec {
  pname = "aiosmtplib";
-  version = "1.1.7";
+  version = "2.0.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -20,7 +21,7 @@ buildPythonPackage rec {
    owner = "cole";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-ZVNYMVg2qeMoSojmPllvJLv2Xm5IYN9h5N13oHPFXSk=";
+    hash = "sha256-NdGap6sl+3tqr/8jhDSDsun/4SiuznfqLf1banIp9EQ=";
  };

  nativeBuildInputs = [
@ -32,6 +33,7 @@ buildPythonPackage rec {
    hypothesis
    pytest-asyncio
    pytestCheckHook
+    trustme
  ];

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@ -19,14 +19,14 @@

 buildPythonPackage rec {
  pname = "apprise";
-  version = "1.2.0";
+  version = "1.2.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-bjGvoY9HRS6szVb7fug9kkUsU00V85JAftGg48RlJEs=";
+    hash = "sha256-Z+DCJ+7O4mAACYDbv4uh5e69vklPRzCAgpfJ5kXANXk=";
  };

  nativeBuildInputs = [
@ -72,6 +72,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Push Notifications that work with just about every platform";
    homepage = "https://github.com/caronc/apprise";
+    changelog = "https://github.com/caronc/apprise/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ marsam ];
  };
--- a/pkgs/development/python-modules/ariadne/default.nix
+++ b/pkgs/development/python-modules/ariadne/default.nix
@ -1,12 +1,13 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
 , fetchFromGitHub
 , freezegun
 , graphql-core
-, lib
 , opentracing
 , pytest-asyncio
 , pytest-mock
 , pytestCheckHook
+, pythonOlder
 , snapshottest
 , starlette
 , typing-extensions
@ -15,16 +16,23 @@

 buildPythonPackage rec {
  pname = "ariadne";
-  version = "0.16.1";
+  version = "0.17.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "mirumee";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-HiIg+80vaMzQdqF2JKzP7oZzfpqSTrumXmUHGLT/wF8=";
+    hash = "sha256-LRsijp2N0L4QCvPt0vWBX0qE4yqDDKtMcTBQ/eAkljA=";
  };

-  propagatedBuildInputs = [ graphql-core starlette typing-extensions ];
+  propagatedBuildInputs = [
+    graphql-core
+    starlette
+    typing-extensions
+  ];

  checkInputs = [
    freezegun
@ -36,9 +44,21 @@ buildPythonPackage rec {
    werkzeug
  ];

+  pythonImportsCheck = [
+    "ariadne"
+  ];
+
+  disabledTests = [
+    # TypeError: TestClient.request() got an unexpected keyword argument 'content'
+    "test_attempt_parse_request_missing_content_type_raises_bad_request_error"
+    "test_attempt_parse_non_json_request_raises_bad_request_error"
+    "test_attempt_parse_non_json_request_body_raises_bad_request_error"
+  ];
+
  meta = with lib; {
    description = "Python library for implementing GraphQL servers using schema-first approach";
    homepage = "https://ariadnegraphql.org";
+    changelog = "https://github.com/mirumee/ariadne/blob/${version}/CHANGELOG.md";
    license = licenses.bsd3;
    maintainers = with maintainers; [ samuela ];
  };
--- a/pkgs/development/python-modules/asyncssh/default.nix
+++ b/pkgs/development/python-modules/asyncssh/default.nix
@ -20,14 +20,14 @@

 buildPythonPackage rec {
  pname = "asyncssh";
-  version = "2.12.0";
+  version = "2.13.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-J0EBMixLlBgjru2OGrbnvlGRaGxtstK9Na/rowUF54A=";
+    hash = "sha256-vn4ctHIl3JiZ5WRy/cTarANYSmhDZ1MpwM5nF5yyDik=";
  };

  propagatedBuildInputs = [
@ -81,6 +81,7 @@ buildPythonPackage rec {
    broken = stdenv.isDarwin;
    description = "Asynchronous SSHv2 Python client and server library";
    homepage = "https://asyncssh.readthedocs.io/";
+    changelog = "https://github.com/ronf/asyncssh/blob/v${version}/docs/changes.rst";
    license = licenses.epl20;
    maintainers = with maintainers; [ ];
  };
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "awscrt";
-  version = "0.16.1";
+  version = "0.16.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-j9++euxSsvf6ZLkVJtyGdlOx6WWrAXEOczqwypYZkXA=";
+    hash = "sha256-w39Qt046dWDzbt41t9LVMCJNM2uGOv9VTZf3yfWUlNM=";
  };

  buildInputs = lib.optionals stdenv.isDarwin [
--- a/pkgs/development/python-modules/distrax/default.nix
+++ b/pkgs/development/python-modules/distrax/default.nix
@ -6,7 +6,8 @@
 , chex
 , dm-haiku
 , pytestCheckHook
-, jaxlib }:
+, jaxlib
+}:

 buildPythonPackage rec {
  pname = "distrax";
@ -53,5 +54,7 @@ buildPythonPackage rec {
    homepage = "https://github.com/deepmind/distrax";
    license = licenses.asl20;
    maintainers = with maintainers; [ onny ];
+    # Broken on all platforms (starting 2022-07-27)
+    broken = true;
  };
 }
--- a/pkgs/development/python-modules/dvc-render/default.nix
+++ b/pkgs/development/python-modules/dvc-render/default.nix
@ -58,6 +58,6 @@ buildPythonPackage rec {
    description = "Library for rendering DVC plots";
    homepage = "https://github.com/iterative/dvc-render";
    license = licenses.asl20;
-    maintainers = with maintainers; [ fab anthonyroussel ];
+    maintainers = with maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/dvc-task/default.nix
+++ b/pkgs/development/python-modules/dvc-task/default.nix
@ -55,6 +55,6 @@ buildPythonPackage rec {
    description = "Celery task queue used in DVC";
    homepage = "https://github.com/iterative/dvc-task";
    license = licenses.asl20;
-    maintainers = with maintainers; [ anthonyroussel ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/emborg/default.nix
+++ b/pkgs/development/python-modules/emborg/default.nix
@ -0,0 +1,78 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, pytestCheckHook
+, pythonOlder
+, borgbackup
+, appdirs
+, arrow
+, docopt
+, inform
+, nestedtext
+, parametrize-from-file
+, quantiphy
+, requests
+, shlib
+, voluptuous
+}:
+
+buildPythonPackage rec {
+  pname = "emborg";
+  version = "1.34";
+  format = "flit";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "KenKundert";
+    repo = "emborg";
+    rev = "v${version}";
+    hash = "sha256-bnlELPZzTU9KyVsz5Q0aW9xWvVrgwpowQrjkQvX844g=";
+  };
+
+  propagatedBuildInputs = [
+    appdirs
+    arrow
+    docopt
+    inform
+    quantiphy
+    requests
+  ];
+
+  checkInputs = [
+    nestedtext
+    parametrize-from-file
+    pytestCheckHook
+    shlib
+    voluptuous
+    borgbackup
+  ];
+
+  # this disables testing fuse mounts
+  MISSING_DEPENDENCIES = "fuse";
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  # this patch fixes a whitespace issue in the message that a test is expecting, https://github.com/KenKundert/emborg/pull/67
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/KenKundert/emborg/commit/afac6d1ddcecdb4bddbec87b6c8eed4cfbf4ebf9.diff";
+      sha256 = "3xg2z03FLKH4ckmiBZqE1FDjpgjgdO8OZL1ewrJlQ4o=";
+    })
+  ];
+
+  pythonImportsCheck = [
+    "emborg"
+  ];
+
+  meta = with lib; {
+    description = "Interactive command line interface to Borg Backup";
+    homepage = "https://github.com/KenKundert/emborg";
+    changelog = "https://github.com/KenKundert/emborg/releases/tag/v${version}";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ jpetrucciani ];
+  };
+}
--- a/pkgs/development/python-modules/fastapi-mail/default.nix
+++ b/pkgs/development/python-modules/fastapi-mail/default.nix
@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "fastapi-mail";
-  version = "1.2.2";
+  version = "1.2.4";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -28,12 +28,16 @@ buildPythonPackage rec {
    owner = "sabuhish";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-+i/p4KVppsOkj2TEoZKmjrlnkhk2wxPg2enh2QCXiQI=";
+    hash = "sha256-6Iwgl15adc6wK7i8sFLeSf2HSvMo/Sx/BI44qboNnRM=";
  };

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace 'starlette = "^0.21.0"' 'starlette = "*"'
+      --replace 'version = "1.2.2"' 'version = "${version}"' \
+      --replace 'aiosmtplib = "^2.0"' 'aiosmtplib = "*"' \
+      --replace 'pydantic = "^1.8"' 'pydantic = "*"' \
+      --replace 'starlette = "^0.22.0"' 'starlette = "*"' \
+      --replace 'black = "^22.12.0"' ""
  '';

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/fastecdsa/default.nix
+++ b/pkgs/development/python-modules/fastecdsa/default.nix
@ -3,21 +3,28 @@
 , fetchPypi
 , gmp
 , pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "fastecdsa";
-  version = "2.2.3";
+  version = "2.3.1";
  format = "setuptools";

+  disabled = pythonOlder "3.7";
+
  src = fetchPypi {
    inherit pname version;
-    sha256 = "269bdb0f618b38f8f6aec9d23d23db518046c3cee01a954fa6aa7322a1a7db8f";
+    hash = "sha256-8ZjORPaUbKuwKYip9J0U78QQ26XiEemDIbqdhzeyP/g=";
  };

-  buildInputs = [ gmp ];
+  buildInputs = [
+    gmp
+  ];

-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [
+    pytestCheckHook
+  ];

  disabledTestPaths = [
    # skip tests which require being online to download test vectors
@ -30,11 +37,14 @@ buildPythonPackage rec {
  # but the installed package works just fine
  doCheck = false;

-  pythonImportsCheck = [ "fastecdsa" ];
+  pythonImportsCheck = [
+    "fastecdsa"
+  ];

  meta = with lib; {
    description = "Fast elliptic curve digital signatures";
    homepage = "https://github.com/AntonKueltz/fastecdsa";
+    changelog = "https://github.com/AntonKueltz/fastecdsa/blob/v${version}/CHANGELOG.md";
    license = licenses.unlicense;
    maintainers = with maintainers; [ prusnak ];
  };
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "holidays";
-  version = "0.17.2";
+  version = "0.18";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-EWBFNfZq2dj4TlHBcQKWDof8OBn4RESvaLHrh1aGZjA=";
+    hash = "sha256-6U2dNTb/Gipw1tL1bLBV65qV0LmjpfuBuej5024zN4k=";
  };

  propagatedBuildInputs = [
@ -36,6 +36,10 @@ buildPythonPackage rec {
    "holidays"
  ];

+  disabledTestPaths = [
+    "test/test_imports.py"
+  ];
+
  meta = with lib; {
    description = "Generate and work with holidays in Python";
    homepage = "https://github.com/dr-prodigy/python-holidays";
--- a/pkgs/development/python-modules/meross-iot/default.nix
+++ b/pkgs/development/python-modules/meross-iot/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "meross-iot";
-  version = "0.4.5.0";
+  version = "0.4.5.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "albertogeniola";
    repo = "MerossIot";
    rev = "refs/tags/${version}";
-    sha256 = "sha256-6TWtqPYbHZKiAEHAGxZrPxvIiLdNhwOtqtgG+HtQGjI=";
+    hash = "sha256-gT4HxdmyX7oOQFBo1frkmmoXrNfGOcqL0hPZ40kRZeo=";
  };

  propagatedBuildInputs = [
@ -40,6 +40,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python library to interact with Meross devices";
    homepage = "https://github.com/albertogeniola/MerossIot";
+    changelog = "https://github.com/albertogeniola/MerossIot/releases/tag/${version}";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "meshtastic";
-  version = "2.0.7";
+  version = "2.0.8";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "meshtastic";
    repo = "Meshtastic-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-2CzWX+hMH1gN9WytRUf9BGiJ/bfEu2e0Kzg4ScDMrBo=";
+    hash = "sha256-4zhwMCEIVYHrf9gT6Eoiw9huR5D2njDo62L0MvXqrgE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/mizani/default.nix
+++ b/pkgs/development/python-modules/mizani/default.nix
@ -7,12 +7,13 @@
 , pytestCheckHook
 , pythonOlder
 , scipy
+, setuptools-scm
 }:

 buildPythonPackage rec {
  pname = "mizani";
-  version = "0.7.4";
-  format = "setuptools";
+  version = "0.8.1";
+  format = "pyproject";

  disabled = pythonOlder "3.8";

@ -20,9 +21,13 @@ buildPythonPackage rec {
    owner = "has2k1";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-oqbo/aQ5L1nQO8BvXH6/8PBPiWcv2m/LUjwow8+J90w=";
+    hash = "sha256-VE0M5/s8/XmmAe8EE/FcHBFGc9ppVWuYOYMuajQeZww=";
  };

+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
  propagatedBuildInputs = [
    matplotlib
    palettable
@ -46,6 +51,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Scales for Python";
    homepage = "https://github.com/has2k1/mizani";
+    changelog = "https://github.com/has2k1/mizani/releases/tag/v${version}";
    license = licenses.bsd3;
    maintainers = with maintainers; [ samuela ];
  };
--- a/pkgs/development/python-modules/natsort/default.nix
+++ b/pkgs/development/python-modules/natsort/default.nix
@ -4,7 +4,7 @@
 , fetchPypi
 , glibcLocales
 , hypothesis
-, PyICU
+, pyicu
 , pytest-mock
 , pytestCheckHook
 , pythonOlder
@ -24,7 +24,7 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    fastnumbers
-    PyICU
+    pyicu
  ];

  checkInputs = [
--- a/pkgs/development/python-modules/normality/default.nix
+++ b/pkgs/development/python-modules/normality/default.nix
@ -4,7 +4,7 @@
 , text-unidecode
 , chardet
 , banal
-, PyICU
+, pyicu
 , pytestCheckHook
 }:
 buildPythonPackage rec {
@ -22,7 +22,7 @@ buildPythonPackage rec {
    text-unidecode
    chardet
    banal
-    PyICU
+    pyicu
  ];

  checkInputs = [
--- a/Show More
+++ b/Show More