Merge master into staging-next

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -65,6 +65,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [QDMR](https://dm3mat.darc.de/qdmr/), a GUI application and command line tool for programming DMR radios [programs.qdmr](#opt-programs.qdmr.enable)
 
+- [keyd](https://github.com/rvaiya/keyd), a key remapping daemon for linux. Available as [services.keyd](#opt-services.keyd.enable).
+
 - [v2rayA](https://v2raya.org), a Linux web GUI client of Project V which supports V2Ray, Xray, SS, SSR, Trojan and Pingtunnel. Available as [services.v2raya](options.html#opt-services.v2raya.enable).
 
 - [ulogd](https://www.netfilter.org/projects/ulogd/index.html), a userspace logging daemon for netfilter/iptables related logging. Available as [services.ulogd](options.html#opt-services.ulogd.enable).

nixos/modules/module-list.nix

@@ -510,6 +510,7 @@
   ./services/hardware/usbmuxd.nix
   ./services/hardware/usbrelayd.nix
   ./services/hardware/vdr.nix
+  ./services/hardware/keyd.nix
   ./services/home-automation/evcc.nix
   ./services/home-automation/home-assistant.nix
   ./services/home-automation/zigbee2mqtt.nix

nixos/modules/programs/ccache.nix

@@ -17,7 +17,7 @@ in {
       type = types.listOf types.str;
       description = lib.mdDoc "Nix top-level packages to be compiled using CCache";
       default = [];
-      example = [ "wxGTK30" "ffmpeg" "libav_all" ];
+      example = [ "wxGTK32" "ffmpeg" "libav_all" ];
     };
   };
 

nixos/modules/services/hardware/keyd.nix

@@ -0,0 +1,112 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.services.keyd;
+  settingsFormat = pkgs.formats.ini { };
+in
+{
+  options = {
+    services.keyd = {
+      enable = mkEnableOption (lib.mdDoc "keyd, a key remapping daemon");
+
+      ids = mkOption {
+        type = types.listOf types.string;
+        default = [ "*" ];
+        example = [ "*" "-0123:0456" ];
+        description = lib.mdDoc ''
+          Device identifiers, as shown by {manpage}`keyd(1)`.
+        '';
+      };
+
+      settings = mkOption {
+        type = settingsFormat.type;
+        default = { };
+        example = {
+          main = {
+            capslock = "overload(control, esc)";
+            rightalt = "layer(rightalt)";
+          };
+
+          rightalt = {
+            j = "down";
+            k = "up";
+            h = "left";
+            l = "right";
+          };
+        };
+        description = lib.mdDoc ''
+          Configuration, except `ids` section, that is written to {file}`/etc/keyd/default.conf`.
+          See <https://github.com/rvaiya/keyd> how to configure.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.etc."keyd/default.conf".source = pkgs.runCommand "default.conf"
+      {
+        ids = ''
+          [ids]
+          ${concatStringsSep "\n" cfg.ids}
+        '';
+        passAsFile = [ "ids" ];
+      } ''
+      cat $idsPath <(echo) ${settingsFormat.generate "keyd-main.conf" cfg.settings} >$out
+    '';
+
+    hardware.uinput.enable = lib.mkDefault true;
+
+    systemd.services.keyd = {
+      description = "Keyd remapping daemon";
+      documentation = [ "man:keyd(1)" ];
+
+      wantedBy = [ "multi-user.target" ];
+
+      restartTriggers = [
+        config.environment.etc."keyd/default.conf".source
+      ];
+
+      # this is configurable in 2.4.2, later versions seem to remove this option.
+      # post-2.4.2 may need to set makeFlags in the derivation:
+      #
+      #     makeFlags = [ "SOCKET_PATH/run/keyd/keyd.socket" ];
+      environment.KEYD_SOCKET = "/run/keyd/keyd.sock";
+
+      serviceConfig = {
+        ExecStart = "${pkgs.keyd}/bin/keyd";
+        Restart = "always";
+
+        DynamicUser = true;
+        SupplementaryGroups = [
+          config.users.groups.input.name
+          config.users.groups.uinput.name
+        ];
+
+        RuntimeDirectory = "keyd";
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        DeviceAllow = [
+          "char-input rw"
+          "/dev/uinput rw"
+        ];
+        ProtectClock = true;
+        PrivateNetwork = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        PrivateUsers = true;
+        PrivateMounts = true;
+        RestrictNamespaces = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        LockPersonality = true;
+        ProtectProc = "noaccess";
+        UMask = "0077";
+      };
+    };
+  };
+}

nixos/modules/services/networking/firewall-nftables.nix

@@ -94,7 +94,13 @@ in
           ${optionalString (ifaceSet != "") ''iifname { ${ifaceSet} } accept comment "trusted interfaces"''}
 
           # Some ICMPv6 types like NDP is untracked
-          ct state vmap { invalid : drop, established : accept, related : accept, * : jump input-allow } comment "*: new and untracked"
+          ct state vmap {
+            invalid : drop,
+            established : accept,
+            related : accept,
+            new : jump input-allow,
+            untracked: jump input-allow,
+          }
 
           ${optionalString cfg.logRefusedConnections ''
             tcp flags syn / fin,syn,rst,ack log level info prefix "refused connection: "
@@ -143,7 +149,13 @@ in
           chain forward {
             type filter hook forward priority filter; policy drop;
 
-            ct state vmap { invalid : drop, established : accept, related : accept, * : jump forward-allow } comment "*: new and untracked"
+            ct state vmap {
+              invalid : drop,
+              established : accept,
+              related : accept,
+              new : jump forward-allow,
+              untracked : jump forward-allow,
+            }
 
           }
 

nixos/tests/all-tests.nix

@@ -346,6 +346,7 @@ in {
   keter = handleTest ./keter.nix {};
   kexec = handleTest ./kexec.nix {};
   keycloak = discoverTests (import ./keycloak.nix);
+  keyd = handleTest ./keyd.nix {};
   keymap = handleTest ./keymap.nix {};
   knot = handleTest ./knot.nix {};
   komga = handleTest ./komga.nix {};

nixos/tests/keyd.nix

@@ -0,0 +1,82 @@
+# The test template is taken from the `./keymap.nix`
+{ system ? builtins.currentSystem
+, config ? { }
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+
+let
+  readyFile = "/tmp/readerReady";
+  resultFile = "/tmp/readerResult";
+
+  testReader = pkgs.writeScript "test-input-reader" ''
+    rm -f ${resultFile} ${resultFile}.tmp
+    logger "testReader: START: Waiting for $1 characters, expecting '$2'."
+    touch ${readyFile}
+    read -r -N $1 chars
+    rm -f ${readyFile}
+    if [ "$chars" == "$2" ]; then
+      logger -s "testReader: PASS: Got '$2' as expected." 2>${resultFile}.tmp
+    else
+      logger -s "testReader: FAIL: Expected '$2' but got '$chars'." 2>${resultFile}.tmp
+    fi
+    # rename after the file is written to prevent a race condition
+    mv  ${resultFile}.tmp ${resultFile}
+  '';
+
+
+  mkKeyboardTest = name: { settings, test }: with pkgs.lib; makeTest {
+    inherit name;
+
+    nodes.machine = {
+      services.keyd = {
+        enable = true;
+        inherit settings;
+      };
+    };
+
+    testScript = ''
+      import shlex
+
+      machine.wait_for_unit("keyd.service")
+
+      def run_test_case(cmd, test_case_name, inputs, expected):
+          with subtest(test_case_name):
+              assert len(inputs) == len(expected)
+              machine.execute("rm -f ${readyFile} ${resultFile}")
+              # set up process that expects all the keys to be entered
+              machine.succeed(
+                  "{} {} {} {} >&2 &".format(
+                      cmd,
+                      "${testReader}",
+                      len(inputs),
+                      shlex.quote("".join(expected)),
+                  )
+              )
+              # wait for reader to be ready
+              machine.wait_for_file("${readyFile}")
+              # send all keys
+              for key in inputs:
+                  machine.send_key(key)
+              # wait for result and check
+              machine.wait_for_file("${resultFile}")
+              machine.succeed("grep -q 'PASS:' ${resultFile}")
+      test = ${builtins.toJSON test}
+      run_test_case("openvt -sw --", "${name}", test["press"], test["expect"])
+    '';
+  };
+
+in
+pkgs.lib.mapAttrs mkKeyboardTest {
+  swap-ab_and_ctrl-as-shift = {
+    test.press = [ "a" "ctrl-b" "c" ];
+    test.expect = [ "b" "A" "c" ];
+
+    settings.main = {
+      "a" = "b";
+      "b" = "a";
+      "control" = "oneshot(shift)";
+    };
+  };
+}

pkgs/applications/networking/cluster/k3s/1_23/default.nix

@@ -22,6 +22,7 @@
 , fetchgit
 , zstd
 , yq-go
+, sqlite
 , nixosTests
 , k3s
 , pkgsBuildBuild
@@ -174,11 +175,13 @@ let
     vendorSha256 = k3sVendorSha256;
 
     nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ libseccomp ];
+    buildInputs = [ libseccomp sqlite.dev ];
 
     subPackages = [ "cmd/server" ];
     ldflags = versionldflags;
 
+    tags = [ "libsqlite3" "linux" ];
+
     # create the multicall symlinks for k3s
     postInstall = ''
       mv $out/bin/server $out/bin/k3s

pkgs/applications/networking/cluster/k3s/1_24/default.nix

@@ -22,6 +22,7 @@
 , fetchgit
 , zstd
 , yq-go
+, sqlite
 , nixosTests
 , k3s
 , pkgsBuildBuild
@@ -172,11 +173,13 @@ let
     vendorSha256 = k3sVendorSha256;
 
     nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ libseccomp ];
+    buildInputs = [ libseccomp sqlite.dev ];
 
     subPackages = [ "cmd/server" ];
     ldflags = versionldflags;
 
+    tags = [ "libsqlite3" "linux" ];
+
     # create the multicall symlinks for k3s
     postInstall = ''
       mv $out/bin/server $out/bin/k3s

pkgs/applications/networking/cluster/k3s/1_25/default.nix

@@ -22,6 +22,7 @@
 , fetchgit
 , zstd
 , yq-go
+, sqlite
 , nixosTests
 , pkgsBuildBuild
 , k3s
@@ -171,11 +172,13 @@ let
     vendorSha256 = k3sVendorSha256;
 
     nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ libseccomp ];
+    buildInputs = [ libseccomp sqlite.dev ];
 
     subPackages = [ "cmd/server" ];
     ldflags = versionldflags;
 
+    tags = [ "libsqlite3" "linux" ];
+
     # create the multicall symlinks for k3s
     postInstall = ''
       mv $out/bin/server $out/bin/k3s

pkgs/applications/networking/cluster/k3s/1_26/default.nix

@@ -22,6 +22,7 @@
 , fetchgit
 , zstd
 , yq-go
+, sqlite
 , nixosTests
 , pkgsBuildBuild
 }:
@@ -175,11 +176,13 @@ let
     vendorSha256 = k3sVendorSha256;
 
     nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ libseccomp ];
+    buildInputs = [ libseccomp sqlite.dev ];
 
     subPackages = [ "cmd/server" ];
     ldflags = versionldflags;
 
+    tags = [ "libsqlite3" "linux" ];
+
     # create the multicall symlinks for k3s
     postInstall = ''
       mv $out/bin/server $out/bin/k3s

pkgs/applications/science/logic/isabelle/default.nix

@@ -58,10 +58,16 @@ in stdenv.mkDerivation (finalAttrs: rec {
           url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_macos.tar.gz";
           sha256 = "0b84rx9b7b5y8m1sg7xdp17j6yngd2dkx6v5bkd8h7ly102lai18";
         }
-    else
+    else if stdenv.hostPlatform.isx86
+    then
       fetchurl {
         url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_linux.tar.gz";
         sha256 = "1ih4gykkp1an43qdgc5xzyvf30fhs0dah3y0a5ksbmvmjsfnxyp7";
+      }
+    else
+      fetchurl {
+        url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_linux_arm.tar.gz";
+        hash = "sha256-qI/BR/KZwLjnkO5q/yYeW4lN4xyUe78VOM2INC/Z/io=";
       };
 
   nativeBuildInputs = [ java ];
@@ -71,7 +77,7 @@ in stdenv.mkDerivation (finalAttrs: rec {
 
   sourceRoot = "${dirname}${lib.optionalString stdenv.isDarwin ".app"}";
 
-  doCheck = true;
+  doCheck = stdenv.hostPlatform.system != "aarch64-linux";
   checkPhase = "bin/isabelle build -v HOL-SMT_Examples";
 
   postUnpack = lib.optionalString stdenv.isDarwin ''
@@ -112,13 +118,15 @@ in stdenv.mkDerivation (finalAttrs: rec {
       ISABELLE_JDK_HOME=${java}
     EOF
 
+  '' + lib.optionalString stdenv.hostPlatform.isx86 ''
     rm contrib/naproche-*/x86*/Naproche-SAD
     ln -s ${naproche}/bin/Naproche-SAD contrib/naproche-*/x86*/
+  '' + ''
 
     echo ISABELLE_LINE_EDITOR=${rlwrap}/bin/rlwrap >>etc/settings
 
     for comp in contrib/jdk* contrib/polyml-* contrib/verit-* contrib/vampire-* contrib/e-*; do
-      rm -rf $comp/x86*
+      rm -rf $comp/${if stdenv.hostPlatform.isx86 then "x86" else "arm"}*
     done
 
     substituteInPlace lib/Tools/env \
@@ -137,9 +145,11 @@ in stdenv.mkDerivation (finalAttrs: rec {
     substituteInPlace lib/scripts/isabelle-platform \
       --replace 'ISABELLE_APPLE_PLATFORM64=arm64-darwin' ""
   '' + lib.optionalString stdenv.isLinux ''
-    arch=${if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux" else "x86-linux"}
+    arch=${if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux"
+           else if stdenv.hostPlatform.isx86 then "x86-linux"
+           else "arm64-linux"}
     for f in contrib/*/$arch/{z3,epclextract,nunchaku,SPASS,zipperposition}; do
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f"
+      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f"${lib.optionalString stdenv.isAarch64 " || true"}
     done
     patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) contrib/bash_process-*/platform_$arch/bash_process
     for d in contrib/kodkodi-*/jni/$arch; do

pkgs/applications/science/logic/yices/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    # musl las no ldconfig, create symlinks explicitly
+    # musl has no ldconfig, create symlinks explicitly
     ./linux-no-ldconfig.patch
   ];
   postPatch = "patchShebangs tests/regress/check.sh";

pkgs/applications/version-management/git-trim/default.nix

@@ -7,6 +7,7 @@
 , libgit2
 , IOKit
 , CoreFoundation
+, Security
 , fetchpatch
 }:
 
@@ -36,7 +37,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl libgit2 ]
-    ++ lib.optionals stdenv.isDarwin [ IOKit CoreFoundation ];
+    ++ lib.optionals stdenv.isDarwin [ IOKit CoreFoundation Security ];
 
   postInstall = ''
     install -Dm644 -t $out/share/man/man1/ docs/git-trim.1

pkgs/development/haskell-modules/configuration-nix.nix

@@ -230,8 +230,8 @@ self: super: builtins.intersectAttrs super {
 
   # wxc supports wxGTX >= 3.0, but our current default version points to 2.8.
   # http://hydra.cryp.to/build/1331287/log/raw
-  wxc = (addBuildDepend self.split super.wxc).override { wxGTK = pkgs.wxGTK30; };
+  wxc = (addBuildDepend self.split super.wxc).override { wxGTK = pkgs.wxGTK32; };
-  wxcore = super.wxcore.override { wxGTK = pkgs.wxGTK30; };
+  wxcore = super.wxcore.override { wxGTK = pkgs.wxGTK32; };
 
   # Test suite wants to connect to $DISPLAY.
   bindings-GLFW = dontCheck super.bindings-GLFW;

pkgs/development/libraries/wxwidgets/wxGTK30.nix

@@ -1,146 +0,0 @@
-{ lib
-, stdenv
-, expat
-, fetchFromGitHub
-, gst_all_1
-, gtk3
-, libGL
-, libGLU
-, libSM
-, libXinerama
-, libXxf86vm
-, libpng
-, libtiff
-, libjpeg_turbo
-, zlib
-, pkg-config
-, xorgproto
-, compat26 ? false
-, compat28 ? true
-, unicode ? true
-, withMesa ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
-, withWebKit ? false
-, webkitgtk
-, setfile
-, AGL
-, Carbon
-, Cocoa
-, Kernel
-, QTKit
-, AVFoundation
-, AVKit
-, WebKit
-}:
-
-stdenv.mkDerivation rec {
-  pname = "wxwidgets";
-  version = "3.0.5.1";
-
-  src = fetchFromGitHub {
-    owner = "wxWidgets";
-    repo = "wxWidgets";
-    rev = "v${version}";
-    hash = "sha256-I91douzXDAfDgm4Pplf17iepv4vIRhXZDRFl9keJJq0=";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [
-    gst_all_1.gst-plugins-base
-    gst_all_1.gstreamer
-    libpng
-    libtiff
-    libjpeg_turbo
-    zlib
-  ] ++ lib.optionals stdenv.isLinux [
-    gtk3
-    libSM
-    libXinerama
-    libXxf86vm
-    xorgproto
-  ]
-  ++ lib.optional withMesa libGLU
-  ++ lib.optional (withWebKit && stdenv.isLinux) webkitgtk
-  ++ lib.optional (withWebKit && stdenv.isDarwin) WebKit
-  ++ lib.optionals stdenv.isDarwin [
-    expat
-    setfile
-    Carbon
-    Cocoa
-    Kernel
-    QTKit
-    AVFoundation
-    AVKit
-  ];
-
-  propagatedBuildInputs = lib.optional stdenv.isDarwin AGL;
-
-  patches = [
-    # https://github.com/wxWidgets/wxWidgets/issues/17942
-    ./patches/0001-fix-assertion-using-hide-in-destroy.patch
-  ];
-
-  configureFlags = [
-    "--disable-precomp-headers"
-    "--enable-mediactrl"
-    (if compat26 then "--enable-compat26" else "--disable-compat26")
-    (if compat28 then "--enable-compat28" else "--disable-compat28")
-  ] ++ lib.optional unicode "--enable-unicode"
-  ++ lib.optional withMesa "--with-opengl"
-  ++ lib.optionals stdenv.isDarwin [
-    # allow building on 64-bit
-    "--enable-universal-binaries"
-    "--with-macosx-version-min=10.7"
-    "--with-osx_cocoa"
-    "--with-libiconv"
-  ] ++ lib.optionals withWebKit [
-    "--enable-webview"
-    "--enable-webviewwebkit"
-  ];
-
-  SEARCH_LIB = "${libGLU.out}/lib ${libGL.out}/lib";
-
-  preConfigure = ''
-    substituteInPlace configure --replace \
-      'SEARCH_INCLUDE=' 'DUMMY_SEARCH_INCLUDE='
-    substituteInPlace configure --replace \
-      'SEARCH_LIB=' 'DUMMY_SEARCH_LIB='
-    substituteInPlace configure --replace \
-      /usr /no-such-path
-  '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace configure \
-      --replace 'ac_cv_prog_SETFILE="/Developer/Tools/SetFile"' 'ac_cv_prog_SETFILE="${setfile}/bin/SetFile"'
-    substituteInPlace configure \
-      --replace "-framework System" "-lSystem"
-  '';
-
-  postInstall = ''
-    pushd $out/include
-    ln -s wx-*/* .
-    popd
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    homepage = "https://www.wxwidgets.org/";
-    description = "A Cross-Platform C++ GUI Library";
-    longDescription = ''
-      wxWidgets gives you a single, easy-to-use API for writing GUI applications
-      on multiple platforms that still utilize the native platform's controls
-      and utilities. Link with the appropriate library for your platform and
-      compiler, and your application will adopt the look and feel appropriate to
-      that platform. On top of great GUI functionality, wxWidgets gives you:
-      online help, network programming, streams, clipboard and drag and drop,
-      multithreading, image loading and saving in a variety of popular formats,
-      database support, HTML viewing and printing, and much more.
-    '';
-    license = licenses.wxWindows;
-    maintainers = with maintainers; [ wegank ];
-    platforms = platforms.unix;
-  };
-
-  passthru = {
-    inherit compat26 compat28 unicode;
-  };
-}

pkgs/development/libraries/wxwidgets/wxmac30.nix

@@ -1,101 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, expat
-, libiconv
-, libjpeg
-, libpng
-, libtiff
-, zlib
-, AGL
-, Cocoa
-, Kernel
-, WebKit
-, derez
-, rez
-, setfile
-}:
-
-stdenv.mkDerivation rec {
-  pname = "wxmac";
-  version = "3.0.5.1";
-
-  src = fetchFromGitHub {
-    owner = "wxWidgets";
-    repo = "wxWidgets";
-    rev = "v${version}";
-    hash = "sha256-I91douzXDAfDgm4Pplf17iepv4vIRhXZDRFl9keJJq0=";
-  };
-
-  buildInputs = [
-    expat
-    libiconv
-    libjpeg
-    libpng
-    libtiff
-    zlib
-    AGL
-    Cocoa
-    Kernel
-    WebKit
-    derez
-    rez
-    setfile
-  ];
-
-  postPatch = ''
-    substituteInPlace configure --replace "-framework System" "-lSystem"
-  '';
-
-  configureFlags = [
-    "--disable-mediactrl"
-    "--disable-precomp-headers"
-    "--enable-clipboard"
-    "--enable-controls"
-    "--enable-dataviewctrl"
-    "--enable-display"
-    "--enable-dnd"
-    "--enable-graphics_ctx"
-    "--enable-std_string"
-    "--enable-svg"
-    "--enable-unicode"
-    "--enable-webkit"
-    "--with-expat"
-    "--with-libjpeg"
-    "--with-libpng"
-    "--with-libtiff"
-    "--with-macosx-version-min=10.7"
-    "--with-opengl"
-    "--with-osx_cocoa"
-    "--with-zlib"
-    "--without-liblzma"
-    "wx_cv_std_libfullpath=/var/empty"
-  ];
-
-  doCheck = true;
-  checkPhase = ''
-    ./wx-config --libs
-  '';
-
-  env.NIX_CFLAGS_COMPILE = "-Wno-undef";
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    homepage = "https://www.wxwidgets.org/";
-    description = "A Cross-Platform C++ GUI Library - MacOS-only build";
-    longDescription = ''
-      wxWidgets gives you a single, easy-to-use API for writing GUI applications
-      on multiple platforms that still utilize the native platform's controls
-      and utilities. Link with the appropriate library for your platform and
-      compiler, and your application will adopt the look and feel appropriate to
-      that platform. On top of great GUI functionality, wxWidgets gives you:
-      online help, network programming, streams, clipboard and drag and drop,
-      multithreading, image loading and saving in a variety of popular formats,
-      database support, HTML viewing and printing, and much more.
-    '';
-    license = licenses.wxWindows;
-    maintainers = with maintainers; [ lnl7 ];
-    platforms = platforms.darwin;
-  };
-}

pkgs/development/ocaml-modules/cooltt/default.nix

@@ -6,6 +6,7 @@
 , cmdliner
 , containers
 , ezjsonm
+, findlib
 , menhir
 , menhirLib
 , ppx_deriving
@@ -28,7 +29,9 @@ let
       sha256 = "sha256:15v1cggm7awp11iwl3lzpaar91jzivhdxggp5mr48gd28kfipzk2";
     };
 
-    propagatedBuildInputs = [ ezjsonm ];
+    duneVersion = "3";
+
+    propagatedBuildInputs = [ ezjsonm findlib ];
 
     meta = {
       description = "Extensible Library Management and Path Resolution";
@@ -63,6 +66,7 @@ buildDunePackage {
   version = "unstable-2022-04-28";
 
   minimalOCamlVersion = "4.13";
+  duneVersion = "3";
 
   src = fetchFromGitHub {
     owner = "RedPRL";

pkgs/development/ocaml-modules/cow/default.nix

@@ -1,10 +1,10 @@
-{ lib, fetchurl, buildDunePackage, ocaml, alcotest
+{ lib, fetchurl, buildDunePackage, alcotest
 , uri, xmlm, omd, ezjsonm
 }:
 
 buildDunePackage rec {
-  useDune2 = true;
+  duneVersion = "3";
-  minimumOCamlVersion = "4.02.3";
+  minimalOCamlVersion = "4.08";
 
   version = "2.4.0";
   pname = "cow";
@@ -16,7 +16,7 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ xmlm uri ezjsonm omd ];
   checkInputs = [ alcotest ];
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
 
   meta = with lib; {
     description = "Caml on the Web";

pkgs/development/ocaml-modules/ezjsonm/default.nix

@@ -2,13 +2,13 @@
 
 buildDunePackage rec {
   pname = "ezjsonm";
-  version = "1.2.0";
+  version = "1.3.0";
 
-  useDune2 = true;
+  duneVersion = "3";
 
   src = fetchurl {
-    url = "https://github.com/mirage/ezjsonm/releases/download/v${version}/ezjsonm-v${version}.tbz";
+    url = "https://github.com/mirage/ezjsonm/releases/download/v${version}/ezjsonm-${version}.tbz";
-    sha256 = "1q6cf63cc614lr141rzhm2w4rhi1snfqai6fmkhvfjs84hfbw2w7";
+    hash = "sha256-CGM+Dw52eoroGTXKfnTxaTuFp5xFAtVo7t/1Fw8M13s=";
   };
 
   propagatedBuildInputs = [ jsonm hex sexplib0 ];

pkgs/development/ocaml-modules/lustre-v6/default.nix

@@ -5,6 +5,7 @@ buildDunePackage rec {
   version = "6.107.3";
 
   minimalOCamlVersion = "4.12";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://www-verimag.imag.fr/DIST-TOOLS/SYNCHRONE/pool/lustre-v6.v${version}.tgz";

pkgs/development/ocaml-modules/mustache/default.nix

@@ -3,7 +3,7 @@
 buildDunePackage rec {
   pname = "mustache";
   version = "3.1.0";
-  useDune2 = true;
+  duneVersion = "3";
   src = fetchFromGitHub {
     owner = "rgrinberg";
     repo = "ocaml-mustache";

pkgs/development/ocaml-modules/ppx_deriving_yaml/default.nix

@@ -7,6 +7,7 @@ buildDunePackage rec {
   version = "0.1.1";
 
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/patricoferris/ppx_deriving_yaml/releases/download/v${version}/ppx_deriving_yaml-${version}.tbz";

pkgs/development/ocaml-modules/yaml/default.nix

@@ -10,10 +10,11 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/avsm/ocaml-yaml/releases/download/v${version}/yaml-${version}.tbz";
-    sha256 = "sha256-0KngriGEpp5tcgK/43B9EEOdMacSQYYCNLGfAgRS7Mc=";
+    hash = "sha256-0KngriGEpp5tcgK/43B9EEOdMacSQYYCNLGfAgRS7Mc=";
   };
 
   minimalOCamlVersion = "4.13";
+  duneVersion = "3";
 
   buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [ bos ctypes ];

pkgs/development/ocaml-modules/yaml/yaml-sexp.nix

@@ -5,6 +5,8 @@ buildDunePackage rec {
 
   inherit (yaml) version src;
 
+  duneVersion = "3";
+
   propagatedBuildInputs = [ yaml ppx_sexp_conv sexplib ];
 
   meta = yaml.meta // {

pkgs/development/tools/language-servers/vhdl-ls/default.nix

@@ -0,0 +1,43 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "vhdl-ls";
+  version = "0.64.0";
+
+  src = fetchFromGitHub {
+    owner = "VHDL-LS";
+    repo = "rust_hdl";
+    rev = "v${version}";
+    hash = "sha256-j5WRJJBUPKW3W+kY5hdqdZxxGkIAoEcW+A2pp23MX6Q=";
+  };
+
+  # No Cargo.lock upstream, see:
+  # https://github.com/VHDL-LS/rust_hdl/issues/166
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+  };
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  ''
+  # Also make it look up vhdl_libraries in an expected location
+  + ''
+    substituteInPlace vhdl_lang/src/config.rs \
+      --replace /usr/lib $out/lib
+  '';
+
+  postInstall = ''
+    mkdir -p $out/lib/rust_hdl
+    cp -r vhdl_libraries $out/lib/rust_hdl
+  '';
+
+  meta = {
+    description = "A fast VHDL language server";
+    homepage = "https://github.com/VHDL-LS/rust_hdl";
+    license = lib.licenses.mpl20;
+    mainProgram = "vhdl_ls";
+    maintainers = with lib.maintainers; [ doronbehar ];
+  };
+}

pkgs/development/tools/misc/sccache/default.nix

@@ -1,24 +1,21 @@
 { lib, fetchFromGitHub, rustPlatform, pkg-config, openssl, stdenv, Security }:
 
 rustPlatform.buildRustPackage rec {
-  version = "0.3.3";
+  version = "0.4.0";
   pname = "sccache";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "sccache";
     rev = "v${version}";
-    sha256 = "sha256-XzAU8Rs0/Q1KvE2tF0zzv9d2/a07BzZQbVzOdrPlbSk=";
+    sha256 = "sha256-6ok8N5y/Wtz4t0414GHT7qc5D2ysw97oKASbKHPLXN8=";
   };
 
-  cargoSha256 = "sha256-r5rIuulcPB5Y4AkbUPswf3W4DZ9Pc8auzmDDvSOOZEA=";
+  cargoSha256 = "sha256-dxjVlbnewFdnO294L+9kQE8owlgyPaxepxtmC7V9nGk=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;
 
-  # sccache-dist is only supported on x86_64 Linux machines.
-  buildFeatures = lib.optionals (stdenv.system == "x86_64-linux") [ "dist-client" "dist-server" ];
-
   # Tests fail because of client server setup which is not possible inside the pure environment,
   # see https://github.com/mozilla/sccache/issues/460
   doCheck = false;

pkgs/development/tools/profiling/systemtap/default.nix

@@ -22,22 +22,10 @@ let
     env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=deprecated-declarations" ]; # Needed with GCC 12
   };
 
-  ## a kernel build dir as expected by systemtap
-  kernelBuildDir = runCommand "kbuild-${kernel.version}-merged" { } ''
-    mkdir -p $out
-    for f in \
-        ${kernel}/System.map \
-        ${kernel.dev}/vmlinux \
-        ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build/{*,.*}
-    do
-      ln -s $(readlink -f $f) $out
-    done
-  '';
-
   pypkgs = with python3.pkgs; makePythonPath [ pyparsing ];
 
 in runCommand "systemtap-${kernel.version}-${version}" {
-  inherit stapBuild kernelBuildDir;
+  inherit stapBuild;
   nativeBuildInputs = [ makeWrapper ];
   meta = {
     homepage = "https://sourceware.org/systemtap/";
@@ -52,7 +40,7 @@ in runCommand "systemtap-${kernel.version}-${version}" {
   done
   rm $out/bin/stap $out/bin/dtrace
   makeWrapper $stapBuild/bin/stap $out/bin/stap \
-    --add-flags "-r $kernelBuildDir" \
+    --add-flags "-r ${kernel.dev}" \
     --prefix PATH : ${lib.makeBinPath [ stdenv.cc.cc stdenv.cc.bintools elfutils gnumake ]}
   makeWrapper $stapBuild/bin/dtrace $out/bin/dtrace \
     --prefix PYTHONPATH : ${pypkgs}

pkgs/games/stuntrally/default.nix

@@ -14,34 +14,50 @@
 , libXcursor
 , bullet
 , openal
+, tinyxml
+, tinyxml-2
 }:
 
+let
+  stuntrally_ogre = ogre.overrideAttrs (old: {
+    cmakeFlags = old.cmakeFlags ++ [
+      "-DOGRE_NODELESS_POSITIONING=ON"
+      "-DOGRE_RESOURCEMANAGER_STRICT=0"
+    ];
+  });
+  stuntrally_mygui = mygui.override {
+    withOgre = true;
+    inherit ogre;
+  };
+in
+
 stdenv.mkDerivation rec {
-  pname = "stunt-rally";
+  pname = "stuntrally";
-  version = "2.6.2";
+  version = "2.7";
 
   src = fetchFromGitHub {
     owner = "stuntrally";
     repo = "stuntrally";
     rev = version;
-    hash = "sha256-9I6hXsosqx+yYiEOEnPXQJHZkGtSU+JqThorwjemlc0=";
+    hash = "sha256-0Eh9ilIHSh/Uz8TuPnXxLQfy7KF7qqNXUgBXQUCz9ys=";
   };
   tracks = fetchFromGitHub {
     owner = "stuntrally";
     repo = "tracks";
     rev = version;
-    hash = "sha256-eZJAvkKe3PrXDzxTa5WFBHfltB3jhQh8puzOFDO9lso=";
+    hash = "sha256-fglm1FetFGHM/qGTtpxDb8+k2iAREn5DQR5GPujuLms=";
   };
 
   preConfigure = ''
-    ln -s ${tracks} data/tracks
+    rmdir data/tracks
+    ln -s ${tracks}/ data/tracks
   '';
 
   nativeBuildInputs = [ cmake pkg-config makeWrapper ];
   buildInputs = [
     boost
-    ogre
+    stuntrally_ogre
-    mygui
+    stuntrally_mygui
     ois
     SDL2
     libvorbis
@@ -49,6 +65,8 @@ stdenv.mkDerivation rec {
     libXcursor
     bullet
     openal
+    tinyxml
+    tinyxml-2
   ];
 
   meta = with lib; {

pkgs/os-specific/linux/sysdig/default.nix

@@ -1,12 +1,12 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, cmake, kernel, installShellFiles, pkg-config
 , luajit, ncurses, perl, jsoncpp, libb64, openssl, curl, jq, gcc, elfutils, tbb, protobuf, grpc
-, yaml-cpp, nlohmann_json, re2
+, yaml-cpp, nlohmann_json, re2, zstd
 }:
 
 let
   # Compare with https://github.com/draios/sysdig/blob/dev/cmake/modules/falcosecurity-libs.cmake
-  libsRev = "0.9.1";
+  libsRev = "0.10.5";
-  libsSha256 = "sha256-X+zLEnage8AuGdGn9sl1RN9b1CKTA1ErrdPNbYKY0s0=";
+  libsSha256 = "sha256-5a5ePcMHAlniJ8sU/5kKdRp5YkJ6tcr4h5Ru4Oc2kQY=";
 
   # Compare with https://github.com/falcosecurity/libs/blob/master/cmake/modules/valijson.cmake#L17
   valijson = fetchFromGitHub {
@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "sysdig";
-  version = "0.30.2";
+  version = "0.31.3";
 
   src = fetchFromGitHub {
     owner = "draios";
     repo = "sysdig";
     rev = version;
-    sha256 = "sha256-bDlrnTfm43zpYBIiP2MGB+LM5jtalmeUNtWHgxe81HM=";
+    sha256 = "sha256-TMh2gw/vw6DbhKGwbqU2+c0DTpRaMZqUM83KE18NDmI=";
   };
 
   nativeBuildInputs = [ cmake perl installShellFiles pkg-config ];
@@ -58,6 +58,7 @@ stdenv.mkDerivation rec {
     yaml-cpp
     jsoncpp
     nlohmann_json
+    zstd
   ] ++ lib.optionals (kernel != null) kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
@@ -97,7 +98,7 @@ stdenv.mkDerivation rec {
       echo "falcosecurity-libs checksum needs to be updated!"
       exit 1
     fi
-    cmakeFlagsArray+=(-DCMAKE_EXE_LINKER_FLAGS="-ltbb -lcurl -labsl_synchronization")
+    cmakeFlagsArray+=(-DCMAKE_EXE_LINKER_FLAGS="-ltbb -lcurl -lzstd -labsl_synchronization")
   '' + lib.optionalString (kernel != null) ''
     export INSTALL_MOD_PATH="$out"
     export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"

pkgs/tools/X11/skippy-xd/default.nix

@@ -14,12 +14,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "skippy-xd";
-  version = "unstable-2015-03-01";
+  version = "0.6.0";
   src = fetchFromGitHub {
-    owner = "richardgv";
+    owner = "dreamcat4";
     repo = "skippy-xd";
-    rev = "397216ca67074c71314f5e9a6e3f1710ccabc29e";
+    rev = "d0557c3144fc67568a49d7207efef89c1d5777a0";
-    sha256 = "sha256-iP6g3iS1aPPkauBLHbgZH/l+TXbWyIJ2TmbrSiNTkn0=";
+    sha256 = "sha256-dnoPUPCvuR/HhqIz1WAsmWL/CkfTf11YEkbrkVWM4dc=";
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [

pkgs/tools/inputmethods/keyd/default.nix

@@ -6,6 +6,7 @@
 , systemd
 , runtimeShell
 , python3
+, nixosTests
 }:
 
 let
@@ -59,11 +60,16 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  # post-2.4.2 may need this to unbreak the test
+  # makeFlags = [ "SOCKET_PATH/run/keyd/keyd.socket" ];
+
   postInstall = ''
     ln -sf ${lib.getExe appMap} $out/bin/${appMap.pname}
     rm -rf $out/etc
   '';
 
+  passthru.tests.keyd = nixosTests.keyd;
+
   meta = with lib; {
     description = "A key remapping daemon for linux.";
     license = licenses.mit;

pkgs/tools/package-management/nix-update/default.nix

@@ -1,25 +1,26 @@
 { lib
-, buildPythonApplication
+, python3
 , fetchFromGitHub
 , nix
+, nix-prefetch-git
 , nixpkgs-fmt
 , nixpkgs-review
 }:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "nix-update";
-  version = "0.15.1";
+  version = "0.16.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = pname;
     rev = version;
-    sha256 = "sha256-AYw2czg8HwA/ATQZO0snfb5GRsz77J6cPGDQ8b4W6AI=";
+    hash = "sha256-4Hrumb4c0861Aorzfk0eM3++XiWkGopnMuIdb+MTKlo=";
   };
 
   makeWrapperArgs = [
-    "--prefix" "PATH" ":" (lib.makeBinPath [ nix nixpkgs-fmt nixpkgs-review ])
+    "--prefix" "PATH" ":" (lib.makeBinPath [ nix nix-prefetch-git nixpkgs-fmt nixpkgs-review ])
   ];
 
   checkPhase = ''

pkgs/tools/system/gptfdisk/default.nix

@@ -30,10 +30,14 @@ stdenv.mkDerivation rec {
       "-mmacosx-version-min=10.4" "-mmacosx-version-min=10.6"
     substituteInPlace Makefile.mac --replace \
       " -arch i386" ""
+    substituteInPlace Makefile.mac --replace \
+      "-arch x86_64" ""
+    substituteInPlace Makefile.mac --replace \
+      "-arch arm64" ""
     substituteInPlace Makefile.mac --replace \
       " -I/opt/local/include -I /usr/local/include -I/opt/local/include" ""
     substituteInPlace Makefile.mac --replace \
-      "/opt/local/lib/libncurses.a" "${ncurses.out}/lib/libncurses.dylib"
+      "/usr/local/Cellar/ncurses/6.2/lib/libncurses.dylib" "${ncurses.out}/lib/libncurses.dylib"
   '';
 
   buildPhase = lib.optionalString stdenv.isDarwin "make -f Makefile.mac";
@@ -54,7 +58,6 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "Set of text-mode partitioning tools for Globally Unique Identifier (GUID) Partition Table (GPT) disks";
     license = licenses.gpl2;
     homepage = "https://www.rodsbooks.com/gdisk/";

pkgs/top-level/aliases.nix

@@ -1107,6 +1107,7 @@ mapAliases ({
   ocz-ssd-guru = throw "ocz-ssd-guru has been removed due to there being no source available"; # Added 2021-07-12
   odpdown = throw "odpdown has been removed because it lacks python3 support"; # Added 2022-04-25
   ofp = throw "ofp is not compatible with odp-dpdk";
+  ogre1_9 = throw "ogre1_9 has been removed, use ogre instead"; # Added 2023-03-22
   olifant = throw "olifant has been removed from nixpkgs, as it was unmaintained"; # Added 2021-08-05
   opa = throw "opa has been removed from nixpkgs as upstream has abandoned the project"; # Added 2023-03-21
   opam_1_2 = throw "'opam_1_2' has been renamed to/replaced by 'opam'"; # Added 2023-03-08
@@ -1680,10 +1681,12 @@ mapAliases ({
   wxGTK = throw "wxGTK28 has been removed from nixpkgs as it has reached end of life"; # Added 2022-11-04
   wxGTK28 = throw "wxGTK28 has been removed from nixpkgs as it has reached end of life"; # Added 2022-11-04
   wxGTK29 = throw "wxGTK29 has been removed from nixpkgs as it has reached end of life"; # Added 2022-11-04
-  wxGTK30-gtk2 = throw "'wxGTK30-gtk2' has been removed from nixpkgs as it depends on deprecated GTK2"; # Added 2022-12-03
+  wxGTK30 = throw "wxGTK30 has been removed from nixpkgs as it has reached end of life"; # Added 2023-03-22
-  wxGTK30-gtk3 = throw "'wxGTK30-gtk3' has been renamed to/replaced by 'wxGTK30'"; # Added 2022-12-03
+  wxGTK30-gtk2 = wxGTK30; # Added 2022-12-03
+  wxGTK30-gtk3 = wxGTK30; # Added 2022-12-03
   wxGTK31-gtk2 = throw "'wxGTK31-gtk2' has been removed from nixpkgs as it depends on deprecated GTK2"; # Added 2022-10-27
   wxGTK31-gtk3 = throw "'wxGTK31-gtk3' has been renamed to/replaced by 'wxGTK31'"; # Added 2022-10-27
+  wxmac = wxGTK30; # Added 2023-03-22
   wxmupen64plus = throw "wxmupen64plus was removed because the upstream disappeared"; # Added 2022-01-31
   wxcam = throw "'wxcam' has seen no updates in ten years, crashes (SIGABRT) on startup and depends on deprecated wxGTK28/GNOME2/GTK2, use 'gnome.cheese'"; # Added 2022-06-15
 

pkgs/top-level/all-packages.nix

@@ -1963,8 +1963,8 @@ with pkgs;
 
   git-town = callPackage ../applications/version-management/git-town { };
 
-  git-trim = callPackage ../applications/version-management/git-trim {
+  git-trim = darwin.apple_sdk_11_0.callPackage ../applications/version-management/git-trim {
-    inherit (darwin.apple_sdk_11_0.frameworks) IOKit CoreFoundation;
+    inherit (darwin.apple_sdk_11_0.frameworks) IOKit CoreFoundation Security;
   };
 
   git-up = callPackage ../applications/version-management/git-up {
@@ -13227,6 +13227,8 @@ with pkgs;
 
   vhd2vl = callPackage ../applications/science/electronics/vhd2vl { };
 
+  vhdl-ls = callPackage ../development/tools/language-servers/vhdl-ls { };
+
   video2midi = callPackage ../tools/audio/video2midi {
     pythonPackages = python3Packages;
   };
@@ -22610,7 +22612,6 @@ with pkgs;
 
   mygui = callPackage ../development/libraries/mygui {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
-    ogre = ogre1_9;
   };
 
   mythes = callPackage ../development/libraries/mythes { };
@@ -22764,7 +22765,6 @@ with pkgs;
   ogre = callPackage ../development/libraries/ogre {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
-  ogre1_9 = callPackage ../development/libraries/ogre/1.9.x.nix { };
   ogre1_10 = callPackage ../development/libraries/ogre/1.10.x.nix { };
 
   olm = callPackage ../development/libraries/olm { };
@@ -24084,16 +24084,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
-  wxGTK30 = callPackage ../development/libraries/wxwidgets/wxGTK30.nix {
-    inherit (darwin.stubs) setfile;
-    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit AVFoundation AVKit WebKit;
-  };
-
-  wxmac = callPackage ../development/libraries/wxwidgets/wxmac30.nix {
-    inherit (darwin.stubs) derez rez setfile;
-    inherit (darwin.apple_sdk.frameworks) AGL Cocoa Kernel WebKit;
-  };
-
   wxGTK31 = callPackage ../development/libraries/wxwidgets/wxGTK31.nix {
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit AVFoundation AVKit WebKit;
@@ -36206,7 +36196,7 @@ with pkgs;
   stt = callPackage ../tools/audio/stt { };
 
   stuntrally = callPackage ../games/stuntrally
-    { ogre = ogre1_9; mygui = mygui.override { withOgre = true; }; };
+    { };
 
   superTux = callPackage ../games/supertux { };
 
@@ -38432,7 +38422,9 @@ with pkgs;
 
   nix-query-tree-viewer = callPackage ../tools/nix/nix-query-tree-viewer { };
 
-  nix-update = python3Packages.callPackage ../tools/package-management/nix-update { };
+  nix-update = callPackage ../tools/package-management/nix-update {
+    python3 = python311;
+  };
 
   nix-update-source = callPackage ../tools/package-management/nix-update-source { };