Merge master into staging-next

2023-10-07 12:00:58 +00:00 · 2023-10-07 12:00:58 +00:00 · 7520bf436a
commit 7520bf436a
parent 8e7d266685 5103716b44
25 changed files with 338 additions and 88 deletions
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -58,6 +58,7 @@ let
    "nut"
    "openldap"
    "openvpn"
+    "pgbouncer"
    "php-fpm"
    "pihole"
    "postfix"
@ -312,6 +313,25 @@ in
        Please specify either 'services.prometheus.exporters.nextcloud.passwordFile' or
          'services.prometheus.exporters.nextcloud.tokenFile'
      '';
+    } {
+      assertion =  cfg.pgbouncer.enable -> (
+        (cfg.pgbouncer.connectionStringFile != null || cfg.pgbouncer.connectionString != "")
+      );
+        message = ''
+          PgBouncer exporter needs either connectionStringFile or connectionString configured"
+        '';
+    } {
+      assertion = cfg.pgbouncer.enable -> (
+        config.services.pgbouncer.ignoreStartupParameters != null && builtins.match ".*extra_float_digits.*" config.services.pgbouncer.ignoreStartupParameters != null
+        );
+        message = ''
+          Prometheus PgBouncer exporter requires including `extra_float_digits` in services.pgbouncer.ignoreStartupParameters
+
+          Example:
+          services.pgbouncer.ignoreStartupParameters = extra_float_digits;
+
+          See https://github.com/prometheus-community/pgbouncer_exporter#pgbouncer-configuration
+        '';
    } {
      assertion = cfg.sql.enable -> (
        (cfg.sql.configFile == null) != (cfg.sql.configuration == null)
@ -350,12 +370,24 @@ in
        `openFirewall' is set to `true'!
      '';
    })) ++ config.services.prometheus.exporters.assertions;
-    warnings = [(mkIf (config.services.prometheus.exporters.idrac.enable && config.services.prometheus.exporters.idrac.configurationPath != null) ''
-        Configuration file in `services.prometheus.exporters.idrac.configurationPath` may override
-        `services.prometheus.exporters.idrac.listenAddress` and/or `services.prometheus.exporters.idrac.port`.
-        Consider using `services.prometheus.exporters.idrac.configuration` instead.
-      ''
-    )] ++ config.services.prometheus.exporters.warnings;
+    warnings = [
+      (mkIf (config.services.prometheus.exporters.idrac.enable && config.services.prometheus.exporters.idrac.configurationPath != null) ''
+          Configuration file in `services.prometheus.exporters.idrac.configurationPath` may override
+          `services.prometheus.exporters.idrac.listenAddress` and/or `services.prometheus.exporters.idrac.port`.
+          Consider using `services.prometheus.exporters.idrac.configuration` instead.
+        ''
+      )
+      (mkIf
+        (cfg.pgbouncer.enable && cfg.pgbouncer.connectionString != "") ''
+          config.services.prometheus.exporters.pgbouncer.connectionString is insecure. Use connectionStringFile instead.
+        ''
+      )
+      (mkIf
+        (cfg.pgbouncer.enable && config.services.pgbouncer.authType != "any") ''
+          Admin user (with password or passwordless) MUST exist in the services.pgbouncer.authFile if authType other than any is used.
+        ''
+      )
+    ] ++ config.services.prometheus.exporters.warnings;
  }] ++ [(mkIf config.services.minio.enable {
    services.prometheus.exporters.minio.minioAddress  = mkDefault "http://localhost:9000";
    services.prometheus.exporters.minio.minioAccessKey = mkDefault config.services.minio.accessKey;
--- a/nixos/modules/services/monitoring/prometheus/exporters/pgbouncer.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/pgbouncer.nix
@ -0,0 +1,145 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.pgbouncer;
+in
+{
+  port = 9127;
+  extraOpts = {
+
+    telemetryPath = mkOption {
+      type = types.str;
+      default = "/metrics";
+      description = lib.mdDoc ''
+        Path under which to expose metrics.
+      '';
+    };
+
+    connectionString = mkOption {
+      type = types.str;
+      default = "";
+      example = "postgres://admin:@localhost:6432/pgbouncer?sslmode=require";
+      description = lib.mdDoc ''
+        Connection string for accessing pgBouncer.
+
+        NOTE: You MUST keep pgbouncer as database name (special internal db)!!!
+
+        NOTE: Admin user (with password or passwordless) MUST exist
+        in the services.pgbouncer.authFile if authType other than any is used.
+
+        WARNING: this secret is stored in the world-readable Nix store!
+        Use {option}`connectionStringFile` instead.
+      '';
+    };
+
+    connectionStringFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/keys/pgBouncer-connection-string";
+      description = lib.mdDoc ''
+        File that contains pgBouncer connection string in format:
+        postgres://admin:@localhost:6432/pgbouncer?sslmode=require
+
+        NOTE: You MUST keep pgbouncer as database name (special internal db)!!!
+
+        NOTE: Admin user (with password or passwordless) MUST exist
+        in the services.pgbouncer.authFile if authType other than any is used.
+
+        {option}`connectionStringFile` takes precedence over {option}`connectionString`
+      '';
+    };
+
+    pidFile = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = lib.mdDoc ''
+        Path to PgBouncer pid file.
+
+        If provided, the standard process metrics get exported for the PgBouncer
+        process, prefixed with 'pgbouncer_process_...'. The pgbouncer_process exporter
+        needs to have read access to files owned by the PgBouncer process. Depends on
+        the availability of /proc.
+
+        https://prometheus.io/docs/instrumenting/writing_clientlibs/#process-metrics.
+
+      '';
+    };
+
+    webSystemdSocket = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Use systemd socket activation listeners instead of port listeners (Linux only).
+      '';
+    };
+
+    logLevel = mkOption {
+      type = types.enum ["debug" "info" "warn" "error" ];
+      default = "info";
+      description = lib.mdDoc ''
+        Only log messages with the given severity or above.
+      '';
+    };
+
+    logFormat = mkOption {
+      type = types.enum ["logfmt" "json"];
+      default = "logfmt";
+      description = lib.mdDoc ''
+        Output format of log messages. One of: [logfmt, json]
+      '';
+    };
+
+    webConfigFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = lib.mdDoc ''
+        Path to configuration file that can enable TLS or authentication.
+      '';
+    };
+
+    extraFlags = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = lib.mdDoc ''
+        Extra commandline options when launching Prometheus.
+      '';
+    };
+
+  };
+
+  serviceOpts = {
+    after = [ "pgbouncer.service" ];
+      serviceConfig = let
+      startScript = pkgs.writeShellScriptBin "pgbouncer-start" "${concatStringsSep " " ([
+            "${pkgs.prometheus-pgbouncer-exporter}/bin/pgbouncer_exporter"
+            "--web.listen-address ${cfg.listenAddress}:${toString cfg.port}"
+            "--pgBouncer.connectionString ${if cfg.connectionStringFile != null then
+            "$(head -n1 ${cfg.connectionStringFile})" else "${escapeShellArg cfg.connectionString}"}"
+          ]
+            ++ optionals (cfg.telemetryPath != null) [
+            "--web.telemetry-path ${escapeShellArg cfg.telemetryPath}"
+          ]
+            ++ optionals (cfg.pidFile != null) [
+            "--pgBouncer.pid-file= ${escapeShellArg cfg.pidFile}"
+          ]
+            ++ optionals (cfg.logLevel != null) [
+            "--log.level ${escapeShellArg cfg.logLevel}"
+          ]
+            ++ optionals (cfg.logFormat != null) [
+            "--log.format ${escapeShellArg cfg.logFormat}"
+          ]
+            ++ optionals (cfg.webSystemdSocket != false) [
+            "--web.systemd-socket ${escapeShellArg cfg.webSystemdSocket}"
+          ]
+            ++ optionals (cfg.webConfigFile != null) [
+            "--web.config.file ${escapeShellArg cfg.webConfigFile}"
+          ]
+            ++ cfg.extraFlags)}";
+      in
+      {
+        ExecStart = "${startScript}/bin/pgbouncer-start";
+      };
+  };
+}
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@ -28,7 +28,6 @@ let
    # TODO: warn the user that any address configured on those interfaces will be useless
    ++ concatMap (i: attrNames (filterAttrs (_: config: config.type != "internal") i.interfaces)) (attrValues cfg.vswitches);

-  domains = cfg.search ++ (optional (cfg.domain != null) cfg.domain);
  genericNetwork = override:
    let gateway = optional (cfg.defaultGateway != null && (cfg.defaultGateway.address or "") != "") cfg.defaultGateway.address
      ++ optional (cfg.defaultGateway6 != null && (cfg.defaultGateway6.address or "") != "") cfg.defaultGateway6.address;
@ -40,8 +39,6 @@ let
        };
    in optionalAttrs (gateway != [ ]) {
      routes = override (map makeGateway gateway);
-    } // optionalAttrs (domains != [ ]) {
-      domains = override domains;
    };

  genericDhcpNetworks = initrd: mkIf cfg.useDHCP {
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -966,6 +966,36 @@ let
      '';
    };

+    pgbouncer = {
+      exporterConfig = {
+        enable = true;
+        connectionString = "postgres://admin:@localhost:6432/pgbouncer?sslmode=disable";
+      };
+
+      metricProvider = {
+        services.postgresql.enable = true;
+        services.pgbouncer = {
+          # https://github.com/prometheus-community/pgbouncer_exporter#pgbouncer-configuration
+          ignoreStartupParameters = "extra_float_digits";
+          enable = true;
+          listenAddress = "*";
+          databases = { postgres = "host=/run/postgresql/ port=5432 auth_user=postgres dbname=postgres"; };
+          authType = "any";
+          maxClientConn = 99;
+        };
+      };
+      exporterTest = ''
+        wait_for_unit("postgresql.service")
+        wait_for_unit("pgbouncer.service")
+        wait_for_unit("prometheus-pgbouncer-exporter.service")
+        wait_for_open_port(9127)
+        succeed("curl -sSf http://localhost:9127/metrics | grep 'pgbouncer_up 1'")
+        succeed(
+            "curl -sSf http://localhost:9127/metrics | grep 'pgbouncer_config_max_client_connections 99'"
+        )
+      '';
+    };
+
    php-fpm = {
      nodeName = "php_fpm";
      exporterConfig = {
--- a/pkgs/applications/blockchains/lnd/default.nix
+++ b/pkgs/applications/blockchains/lnd/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "lnd";
-  version = "0.16.3-beta";
+  version = "0.17.0-beta";

  src = fetchFromGitHub {
    owner = "lightningnetwork";
    repo = "lnd";
    rev = "v${version}";
-    hash = "sha256-/seSpWnlQmeU4vQtlHMOSedPXP9HJp1GyxcB1LqHayA=";
+    hash = "sha256-HndO7vp/sia352hs23xAgrpyJ/CfbRxYAAhLZ4q94Pc=";
  };

-  vendorHash = "sha256-obrSVMqTwHe7231wa0OuoT6ANBqkQbkHIy93J2f68Zk=";
+  vendorHash = "sha256-4n81AZLKCTEV4+p4kRhZbzYsdRGIztzh6EKPin8W1Z0=";

  subPackages = [ "cmd/lncli" "cmd/lnd" ];

--- a/pkgs/applications/file-managers/doublecmd/default.nix
+++ b/pkgs/applications/file-managers/doublecmd/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "doublecmd";
-  version = "1.1.1";
+  version = "1.1.2";

  src = fetchFromGitHub {
    owner = "doublecmd";
    repo = "doublecmd";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-IccM7AwPiOtGHjAzvjQ99mrLFh8iZu8G7Rf71LJHB/g=";
+    hash = "sha256-hRBF0Xl1SSoW+vbp9c1iCuFBVIzLtueNJaqoFMF8lJ4=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/fig2dev/default.nix
+++ b/pkgs/applications/graphics/fig2dev/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "fig2dev";
-  version = "3.2.8b";
+  version = "3.2.9";

  src = fetchurl {
    url = "mirror://sourceforge/mcj/fig2dev-${version}.tar.xz";
-    sha256 = "1jv8rg71dsy00lpg434r5zqs5qrg8mxqvv2gpcjjvmzsm551d2j1";
+    hash = "sha256-FeJGyNE8xy3iXggxQDitUM59Le+pzxr8Fy/X9ZMgkLE=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/graphics/meme-image-generator/default.nix
+++ b/pkgs/applications/graphics/meme-image-generator/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "meme-image-generator";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "nomad-software";
    repo = "meme";
    rev = "v${version}";
-    hash = "sha256-MzSPJCszVEZkBvSbRzXR7AaDQOOjDQ2stKKJr8oGOSE=";
+    hash = "sha256-L+JpNg9X3RSNXTozv2H1n2JiQx75i9gFGaQmDFaMIf0=";
  };

  vendorHash = null;
--- a/pkgs/applications/graphics/xfig/default.nix
+++ b/pkgs/applications/graphics/xfig/default.nix
@ -9,16 +9,17 @@
 , libXp
 , Xaw3d
 , libXaw
+, libXft
 , fig2dev
 }:

 stdenv.mkDerivation rec {
  pname = "xfig";
-  version = "3.2.8b";
+  version = "3.2.9";

  src = fetchurl {
    url = "mirror://sourceforge/mcj/xfig-${version}.tar.xz";
-    sha256 = "0fndgbm1mkqb1sn2v2kj3nx9mxj70jbp31y2bjvzcmmkry0q3k5j";
+    hash = "sha256-E+2dBNG7wt7AnafvSc7sJ4OC0pD2zZJkdMLy0Bb+wvc=";
  };

  nativeBuildInputs = [ imagemagick makeWrapper ];
@ -30,6 +31,7 @@ stdenv.mkDerivation rec {
    libXp
    Xaw3d
    libXaw
+    libXft
  ];

  postPatch = ''
@ -57,6 +59,7 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  meta = with lib; {
+    changelog = "https://sourceforge.net/p/mcj/xfig/ci/${version}/tree/CHANGES";
    description = "An interactive drawing tool for X11";
    longDescription = ''
      Note that you need to have the <literal>netpbm</literal> tools
--- a/pkgs/applications/misc/snapmaker-luban/default.nix
+++ b/pkgs/applications/misc/snapmaker-luban/default.nix
@ -2,17 +2,17 @@
 , alsa-lib, at-spi2-atk, at-spi2-core, atk, cairo, cups
 , gtk3, nss, glib, dbus, nspr, gdk-pixbuf, libdrm, mesa
 , libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
-, libXfixes, libXi, libXrandr, libXrender, libXtst, libxcb, pango
+, libXfixes, libXi, libXrandr, libXrender, libXtst, libxcb, libxshmfence, pango
 , gcc-unwrapped, udev
 }:

 stdenv.mkDerivation rec {
  pname = "snapmaker-luban";
-  version = "4.8.0";
+  version = "4.9.1";

  src = fetchurl {
    url = "https://github.com/Snapmaker/Luban/releases/download/v${version}/snapmaker-luban-${version}-linux-x64.tar.gz";
-    sha256 = "sha256-uY8MlLIZrbds5/QdYZFTLSSis0BwRU19XfLiBX+2VCY=";
+    sha256 = "sha256-qLeF1trBrp53xkiAhybPTHUKuXYHQYfZ3tsmPPJlvUM=";
  };

  nativeBuildInputs = [
@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
    libXScrnSaver
    libXtst
    libxcb
+    libxshmfence
    mesa # Required for libgbm
    nspr
    nss
@ -42,7 +43,7 @@ stdenv.mkDerivation rec {

  libPath = lib.makeLibraryPath [
    stdenv.cc.cc alsa-lib atk at-spi2-atk at-spi2-core cairo cups
-    gdk-pixbuf glib gtk3 libX11 libXcomposite
+    gdk-pixbuf glib gtk3 libX11 libXcomposite libxshmfence
    libXcursor libXdamage libXext libXfixes libXi libXrandr libXrender
    libXtst nspr nss libxcb pango libXScrnSaver udev
  ];
@ -93,5 +94,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3;
    maintainers = [ maintainers.simonkampe ];
    platforms = [ "x86_64-linux" ];
+    knownVulnerabilities = [ "CVE-2023-5217" ];
  };
 }
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -92,11 +92,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.58.135";
+  version = "1.58.137";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-tJfpBIZvBr0diympUmImXYELPERJIzCSuOB0aovhodI=";
+    sha256 = "sha256-6vsdQU9NbEKFp/1A0bNQvutF4I+vI0zfrx70QvU1KV4=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -84,7 +84,7 @@ let
            ++ lib.optional sndioSupport sndio
            ++ lib.optional jackSupport libjack2
            ++ lib.optional smartcardSupport opensc
-            ++ lib.optional (cfg.speechSynthesisSupport or false) speechd
+            ++ lib.optional (cfg.speechSynthesisSupport or true) speechd
            ++ pkcs11Modules
            ++ gtk_modules;
      gtk_modules = [ libcanberra-gtk3 ];
--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@ -14,12 +14,11 @@
 , makeDesktopItem
 , wrapGAppsHook
 , testers
-, palemoon-bin
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "palemoon-bin";
-  version = "32.4.0.1";
+  version = "32.4.1";

  src = fetchzip {
    urls = [
@ -27,9 +26,9 @@ stdenv.mkDerivation (finalAttrs: {
      "https://rm-us.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
    ];
    hash = if withGTK3 then
-      "sha256-kGt3pIgCjVeSD6UXRvj5w9opWrMx3q3B/Y0S55kKS08="
+      "sha256-c/rfnMpiLWqlNZppqPRNWXsgAQ1FofAdel5EFnK+mrY="
    else
-      "sha256-kNvUC/ir7TKjvKXYFoEDOPAY75CEgeixmEV1tuB/WIM=";
+      "sha256-27njFdqq2DUctlz/UOtH5tlOduQNpoapuCYS+48K9dk=";
  };

  preferLocalBuild = true;
@ -155,7 +154,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  passthru.tests.version = testers.testVersion {
-    package = palemoon-bin;
+    package = finalAttrs.finalPackage;
  };

  meta = with lib; {
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@ -21,7 +21,7 @@
 , dht
 , libnatpmp
 , libiconv
-, darwin
+, Foundation
  # Build options
 , enableGTK3 ? false
 , gtkmm3
@ -37,14 +37,14 @@
 , apparmorRulesFromClosure
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "transmission";
  version = "4.0.4";

  src = fetchFromGitHub {
    owner = "transmission";
    repo = "transmission";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-Sz3+5VvfOgET1aiormEnBOrF+yN79tiSQvjLAoGqTLw=";
    fetchSubmodules = true;
  };
@ -113,7 +113,7 @@ stdenv.mkDerivation rec {
  ++ lib.optionals enableGTK3 [ gtkmm3 xorg.libpthreadstubs ]
  ++ lib.optionals enableSystemd [ systemd ]
  ++ lib.optionals stdenv.isLinux [ inotify-tools ]
-  ++ lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Foundation ];
+  ++ lib.optionals stdenv.isDarwin [ libiconv Foundation ];

  postInstall = ''
    mkdir $apparmor
@ -164,7 +164,5 @@ stdenv.mkDerivation rec {
    license = with lib.licenses; [ gpl2Plus mit ];
    maintainers = with lib.maintainers; [ astsmtl ];
    platforms = lib.platforms.unix;
-    # Needs macOS >= 10.14.6
-    broken = stdenv.isDarwin && stdenv.isx86_64;
  };
-}
+})
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@ -32,17 +32,14 @@
 , apparmorRulesFromClosure
 }:

-let
-  version = "3.00";
-
-in stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "transmission";
-  inherit version;
+  version = "3.00";

  src = fetchFromGitHub {
    owner = "transmission";
    repo = "transmission";
-    rev = version;
+    rev = finalAttrs.version;
    sha256 = "0ccg0km54f700x9p0jsnncnwvfnxfnxf7kcm7pcx1cj0vw78924z";
    fetchSubmodules = true;
  };
@ -147,4 +144,4 @@ in stdenv.mkDerivation {
    platforms = lib.platforms.unix;
  };

-}
+})
--- a/pkgs/development/libraries/science/math/amd-blis/default.nix
+++ b/pkgs/development/libraries/science/math/amd-blis/default.nix
@ -6,10 +6,10 @@
 # Enable BLAS interface with 64-bit integer width.
 , blas64 ? false

-# Target architecture. "amd64" compiles kernels for all Zen
+# Target architecture. "amdzen" compiles kernels for all Zen
 # generations. To build kernels for specific Zen generations,
-# use "zen", "zen2", or "zen3".
-, withArchitecture ? "amd64"
+# use "zen", "zen2", "zen3", or "zen4".
+, withArchitecture ? "amdzen"

 # Enable OpenMP-based threading.
 , withOpenMP ? true
@ -18,15 +18,16 @@
 let
  threadingSuffix = lib.optionalString withOpenMP "-mt";
  blasIntSize = if blas64 then "64" else "32";
+
 in stdenv.mkDerivation rec {
  pname = "amd-blis";
-  version = "3.0";
+  version = "4.1";

  src = fetchFromGitHub {
    owner = "amd";
    repo = "blis";
    rev = version;
-    hash = "sha256-bbbeo1yOKse9pzbsB6lQ7pULKdzu3G7zJzTUgPXiMZY=";
+    hash = "sha256-1vd4uBg/+Vufqsr+MnAWSUW/THkribHNSMeq1/is8K4=";
  };

  inherit blas64;
@ -54,8 +55,9 @@ in stdenv.mkDerivation rec {
  '';

  postInstall = ''
-    ln -s $out/lib/libblis${threadingSuffix}.so.3 $out/lib/libblas.so.3
-    ln -s $out/lib/libblis${threadingSuffix}.so.3 $out/lib/libcblas.so.3
+    ls $out/lib
+    ln -s $out/lib/libblis${threadingSuffix}.so $out/lib/libblas.so.3
+    ln -s $out/lib/libblis${threadingSuffix}.so $out/lib/libcblas.so.3
    ln -s $out/lib/libblas.so.3 $out/lib/libblas.so
    ln -s $out/lib/libcblas.so.3 $out/lib/libcblas.so
  '';
--- a/pkgs/development/libraries/simpleitk/default.nix
+++ b/pkgs/development/libraries/simpleitk/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "simpleitk";
-  version = "2.2.1";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "SimpleITK";
    repo = "SimpleITK";
    rev = "refs/tags/v${version}";
-    hash = "sha256-0YxmixUTXpjegZQv7DDCNTWFTH8QEWqQQszee7aQ5EI=";
+    hash = "sha256-SJSFJEFu1qKowX5/98MslN7GFDS8aF5+EKkQ2983Azg=";
  };

  nativeBuildInputs = [ cmake swig4 ];
--- a/pkgs/development/tools/azure-static-sites-client/versions.json
+++ b/pkgs/development/tools/azure-static-sites-client/versions.json
@ -1,39 +1,39 @@
 [
  {
    "version": "latest",
-    "buildId": "1.0.024471",
-    "publishDate": "2023-09-13T13:29:09.6126059Z",
+    "buildId": "1.0.024671",
+    "publishDate": "2023-10-04T00:20:16.1747762Z",
    "files": {
      "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024471/linux/StaticSitesClient",
-        "sha": "5f96bf5b6d192703f340c76cd664eb12a1f5752ecf7783428bf0b16d6d6f4c84"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024671/linux/StaticSitesClient",
+        "sha": "82b8181bb5ea47e1d449c1c56e622bd350513dd97f27ac4abd25bd139fde92e2"
      },
      "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024471/windows/StaticSitesClient.exe",
-        "sha": "b2f76fd169ca61e82576e88797c5414d5ee308bc368baa60ad2ac731bb157af9"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024671/windows/StaticSitesClient.exe",
+        "sha": "a7660746d9dbed8814259547da7f96122d01ae90de6f8aa5ccf7b07b58f59f19"
      },
      "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024471/macOS/StaticSitesClient",
-        "sha": "3fab8406268e51c3c1060b6c0fcc13a6cfa4d1335624c871719430b50d3fe2aa"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024671/macOS/StaticSitesClient",
+        "sha": "7584bea04c7d9e685216d4248063226d5a230cc955e560885a48737d1abd385e"
      }
    }
  },
  {
    "version": "stable",
-    "buildId": "1.0.023911",
-    "publishDate": "2023-07-19T16:29:13.2087179Z",
+    "buildId": "1.0.024611",
+    "publishDate": "2023-09-27T15:56:00.9865712Z",
    "files": {
      "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.023911/linux/StaticSitesClient",
-        "sha": "b3073cc39bc362b3838512b3b5f3b3af3a6b1c6f768c323592cd88dc5527046f"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024611/linux/StaticSitesClient",
+        "sha": "73354b661a8644d78a3024ef1da856468e0704ab861b5a174ec82303bf389771"
      },
      "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.023911/windows/StaticSitesClient.exe",
-        "sha": "5f9548aa7f0060f9fce6abdaddea23d5e970e76ce54f1213df6a133764e56337"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024611/windows/StaticSitesClient.exe",
+        "sha": "a34fa2e4e37739bf2b38c60c7d7978570e4f624b6feb38cea1d1310f1ab77bed"
      },
      "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.023911/macOS/StaticSitesClient",
-        "sha": "515b60de77132cacc5ef355cc654eaf2a2c3c1ab1ec1d071f6b8ed3062d8ea4e"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.024611/macOS/StaticSitesClient",
+        "sha": "9600ded6fa5208cbb943f0aba4d2ca25f03baeca46f1363cbfc465b10e3bbb90"
      }
    }
  },
--- a/pkgs/development/tools/continuous-integration/hci/default.nix
+++ b/pkgs/development/tools/continuous-integration/hci/default.nix
@ -1,9 +1,25 @@
-{ haskell, haskellPackages, lib, makeWrapper, runc, stdenv }:
+{ haskell, haskellPackages, lib, makeWrapper, runc, stdenv, emptyDirectory }:
 let
-  inherit (haskell.lib.compose) overrideCabal addBuildTools justStaticExecutables;
+  inherit (haskell.lib.compose) overrideCabal addBuildTools justStaticExecutables appendConfigureFlags;
  inherit (lib) makeBinPath;
  bundledBins = lib.optional stdenv.isLinux runc;

+  overrides = old: {
+    hercules-ci-agent =
+      overrideCabal
+        (o: {
+          isLibrary = true;
+          isExecutable = false;
+          postInstall = ""; # ignore completions
+          enableSharedExecutables = false;
+          buildTarget = "lib:hercules-ci-agent hercules-ci-agent-unit-tests";
+          configureFlags = o.configureFlags or [ ] ++ [
+            "--bindir=${emptyDirectory}/hercules-ci-built-without-binaries/no-bin"
+          ];
+        })
+        old.hercules-ci-agent;
+  };
+
  pkg =
    # justStaticExecutables is needed due to https://github.com/NixOS/nix/issues/2990
    overrideCabal
@ -15,7 +31,7 @@ let
          makeWrapper $out/libexec/hci $out/bin/hci --prefix PATH : ${lib.escapeShellArg (makeBinPath bundledBins)}
        '';
      })
-      (addBuildTools [ makeWrapper ] (justStaticExecutables haskellPackages.hercules-ci-cli));
+      (addBuildTools [ makeWrapper ] (justStaticExecutables (haskellPackages.hercules-ci-cli.override overrides)));
 in pkg // {
    meta = pkg.meta // {
      position = toString ./default.nix + ":1";
--- a/pkgs/development/tools/database/sqlc/default.nix
+++ b/pkgs/development/tools/database/sqlc/default.nix
@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitHub }:

 let
-  version = "1.21.0";
+  version = "1.22.0";
 in
 buildGoModule {
  pname = "sqlc";
@ -11,11 +11,11 @@ buildGoModule {
    owner = "sqlc-dev";
    repo = "sqlc";
    rev = "v${version}";
-    hash = "sha256-BJKqVSyMjTedMuao8Bz92+B64B/x3M3MXKbSF+d0kDE=";
+    hash = "sha256-aSu+d3ti/PpR5oQwciq1Cz+vxDPunGsVaUg/o/rfmsY=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-AnPC0x5V8ce9KH0B4Ujz2MrTIJA+P/BZG+fsRJ3LM78=";
+  vendorHash = "sha256-sjGswoIUM+UL6qJORdB3UmPh7T6JmTBI5kksgGcRtY0=";

  subPackages = [ "cmd/sqlc" ];

--- a/pkgs/servers/monitoring/prometheus/pgbouncer-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/pgbouncer-exporter.nix
@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "pgbouncer-exporter";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "prometheus-community";
+    repo = "pgbouncer_exporter";
+    rev = "v${version}";
+    sha256 = "sha256-2N8FaGk6AU39j4q22B2Om5E7BeR7iw9drl3PTOBO2kg=";
+  };
+
+  vendorSha256 = "sha256-2aaUlOokqYkjMpcM12mU+O+N09/mDPlIrJ4Z1iXJAyk=";
+
+  meta = with lib; {
+    description = "Prometheus exporter for PgBouncer";
+    homepage = "https://github.com/prometheus-community/pgbouncer_exporter";
+    license = licenses.mit;
+    maintainers = with maintainers; [ _1000101 ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/servers/nosql/victoriametrics/default.nix
+++ b/pkgs/servers/nosql/victoriametrics/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "VictoriaMetrics";
-  version = "1.93.3";
+  version = "1.93.5";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-FR1EeRg9epVCnYF8QmyXGTdv3dITa3Cj50PAY500bJk=";
+    hash = "sha256-AC3tQAgGHKl86MakfSWnFMX1Lr5r7RwZfomXtp5/oBs=";
  };

  vendorHash = null;
--- a/pkgs/tools/security/vals/default.nix
+++ b/pkgs/tools/security/vals/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "vals";
-  version = "0.27.1";
+  version = "0.28.0";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "variantdev";
    repo = pname;
-    sha256 = "sha256-2Wjp1Q7c4CrhCnPTQUyrzVPL89XYOp2bnySQril/RQc=";
+    sha256 = "sha256-6sKwRYbWaKrnMLU+G4/s3CTjUYeovsWttAvk1MnIFPI=";
  };

-  vendorHash = "sha256-J0fhxfGDJKZfRWPPockIAUENCPffQlQmwjkgls+ocoE=";
+  vendorHash = "sha256-CwRhtC+Ome/oyTSd8rPpQ3TgBkFb9CM3XRc0k2g2lHU=";

  ldflags = [
    "-s"
--- a/pkgs/tools/system/stressapptest/default.nix
+++ b/pkgs/tools/system/stressapptest/default.nix
@ -6,22 +6,25 @@

 stdenv.mkDerivation rec {
  pname = "stressapptest";
-  version = "1.0.9";
+  version = "1.0.11";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
-    rev = "v${version}";
-    sha256 = "1qzj6h6adx042rb9aiz916jna269whibvj5ys4p5nwdp17fqh922";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-lZpF7PdUwKnV0ha6xkLvi7XYFZQ4Avy0ltlXxukuWjM=";
  };

-  buildInputs = [ libaio ];
+  buildInputs = [
+    libaio
+  ];

  meta = with lib; {
    description = "Userspace memory and IO stress test tool";
    homepage = "https://github.com/stressapptest/stressapptest";
+    changelog = "https://github.com/stressapptest/stressapptest/releases/tag/v${version}";
    license = with licenses; [ asl20 ];
-    maintainers = with lib.maintainers; [ fab ];
+    maintainers = with maintainers; [ fab ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -27341,6 +27341,7 @@ with pkgs;
  prometheus-nut-exporter = callPackage ../servers/monitoring/prometheus/nut-exporter.nix { };
  prometheus-openldap-exporter = callPackage ../servers/monitoring/prometheus/openldap-exporter.nix { } ;
  prometheus-openvpn-exporter = callPackage ../servers/monitoring/prometheus/openvpn-exporter.nix { };
+  prometheus-pgbouncer-exporter = callPackage ../servers/monitoring/prometheus/pgbouncer-exporter.nix { };
  prometheus-php-fpm-exporter = callPackage ../servers/monitoring/prometheus/php-fpm-exporter.nix { };
  prometheus-pihole-exporter = callPackage ../servers/monitoring/prometheus/pihole-exporter.nix {  };
  prometheus-postfix-exporter = callPackage ../servers/monitoring/prometheus/postfix-exporter.nix { };
@ -36121,7 +36122,9 @@ with pkgs;
  transmission-gtk = transmission.override { enableGTK3 = true; };
  transmission-qt = transmission.override { enableQt = true; };

-  transmission_4 = callPackage ../applications/networking/p2p/transmission/4.nix {
+  # Needs macOS >= 10.14.6
+  transmission_4 = darwin.apple_sdk_11_0.callPackage ../applications/networking/p2p/transmission/4.nix {
+    inherit (darwin.apple_sdk_11_0.frameworks) Foundation;
    fmt = fmt_9;
    libutp = libutp_3_4;
  };