Merge master into staging-next

2023-04-19 00:01:56 +00:00 · 2023-04-19 00:01:56 +00:00 · 93e4495c3e
commit 93e4495c3e
parent bcef81037b 8d9f42c3a2
72 changed files with 7897 additions and 6219 deletions
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -117,6 +117,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [hardware.ipu6](#opt-hardware.ipu6.enable) adds support for ipu6 based webcams on intel tiger lake and alder lake.

+- [ivpn](https://www.ivpn.net/), a secure, private VPN with fast WireGuard connections. Available as [services.ivpn](#opt-services.ivpn.enable).
+
 ## Backward Incompatibilities {#sec-release-23.05-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -885,6 +885,7 @@
  ./services/networking/iscsi/initiator.nix
  ./services/networking/iscsi/root-initiator.nix
  ./services/networking/iscsi/target.nix
+  ./services/networking/ivpn.nix
  ./services/networking/iwd.nix
  ./services/networking/jibri/default.nix
  ./services/networking/jicofo.nix
--- a/nixos/modules/programs/neovim.nix
+++ b/nixos/modules/programs/neovim.nix
@ -4,12 +4,8 @@ with lib;

 let
  cfg = config.programs.neovim;
-
-  runtime' = filter (f: f.enable) (attrValues cfg.runtime);
-
-  runtime = pkgs.linkFarm "neovim-runtime" (map (x: { name = "etc/${x.target}"; path = x.source; }) runtime');
-
-in {
+in
+{
  options.programs.neovim = {
    enable = mkOption {
      type = types.bool;
@ -70,7 +66,7 @@ in {

    configure = mkOption {
      type = types.attrs;
-      default = {};
+      default = { };
      example = literalExpression ''
        {
          customRC = '''
@ -105,7 +101,7 @@ in {
    };

    runtime = mkOption {
-      default = {};
+      default = { };
      example = literalExpression ''
        { "ftplugin/c.vim".text = "setlocal omnifunc=v:lua.vim.lsp.omnifunc"; }
      '';
@ -115,14 +111,15 @@ in {

      type = with types; attrsOf (submodule (
        { name, config, ... }:
-        { options = {
+        {
+          options = {

            enable = mkOption {
              type = types.bool;
              default = true;
              description = lib.mdDoc ''
-                Whether this /etc file should be generated.  This
-                option allows specific /etc files to be disabled.
+                Whether this runtime directory should be generated.  This
+                option allows specific runtime files to be disabled.
              '';
            };

@ -147,14 +144,9 @@ in {

          };

-          config = {
-            target = mkDefault name;
-            source = mkIf (config.text != null) (
-              let name' = "neovim-runtime" + baseNameOf name;
-              in mkDefault (pkgs.writeText name' config.text));
-          };
-
-        }));
+          config.target = mkDefault name;
+        }
+      ));

    };
  };
@ -165,14 +157,17 @@ in {
    ];
    environment.variables.EDITOR = mkIf cfg.defaultEditor (mkOverride 900 "nvim");

-    programs.neovim.finalPackage = pkgs.wrapNeovim cfg.package {
-      inherit (cfg) viAlias vimAlias withPython3 withNodeJs withRuby;
-      configure = cfg.configure // {
+    environment.etc = listToAttrs (attrValues (mapAttrs
+      (name: value: {
+        name = "xdg/nvim/${name}";
+        value = value // {
+          target = "xdg/nvim/${value.target}";
+        };
+      })
+      cfg.runtime));

-        customRC = (cfg.configure.customRC or "") + ''
-          set runtimepath^=${runtime}/etc
-        '';
-      };
+    programs.neovim.finalPackage = pkgs.wrapNeovim cfg.package {
+      inherit (cfg) viAlias vimAlias withPython3 withNodeJs withRuby configure;
    };
  };
 }
--- a/nixos/modules/services/networking/ivpn.nix
+++ b/nixos/modules/services/networking/ivpn.nix
@ -0,0 +1,51 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.ivpn;
+in
+with lib;
+{
+  options.services.ivpn = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        This option enables iVPN daemon.
+        This sets {option}`networking.firewall.checkReversePath` to "loose", which might be undesirable for security.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    boot.kernelModules = [ "tun" ];
+
+    environment.systemPackages = with pkgs; [ ivpn ivpn-service ];
+
+    # iVPN writes to /etc/iproute2/rt_tables
+    networking.iproute2.enable = true;
+    networking.firewall.checkReversePath = "loose";
+
+    systemd.services.ivpn-service = {
+      description = "iVPN daemon";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network.target" ];
+      after = [
+        "network-online.target"
+        "NetworkManager.service"
+        "systemd-resolved.service"
+      ];
+      path = [
+        # Needed for mount
+        "/run/wrappers"
+      ];
+      startLimitBurst = 5;
+      startLimitIntervalSec = 20;
+      serviceConfig = {
+        ExecStart = "${pkgs.ivpn-service}/bin/ivpn-service --logging";
+        Restart = "always";
+        RestartSec = 1;
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ ataraxiasjel ];
+}
--- a/nixos/modules/services/networking/wstunnel.nix
+++ b/nixos/modules/services/networking/wstunnel.nix
@ -294,7 +294,7 @@ let
        DynamicUser = true;
        SupplementaryGroups = optional (serverCfg.useACMEHost != null) certConfig.group;
        PrivateTmp = true;
-        AmbientCapabilities = optional (serverCfg.listen.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+        AmbientCapabilities = optionals (serverCfg.listen.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
        NoNewPrivileges = true;
        RestrictNamespaces = "uts ipc pid user cgroup";
        ProtectSystem = "strict";
@ -340,7 +340,7 @@ let
        EnvironmentFile = optional (clientCfg.environmentFile != null) clientCfg.environmentFile;
        DynamicUser = true;
        PrivateTmp = true;
-        AmbientCapabilities = (optional (clientCfg.soMark != null) [ "CAP_NET_ADMIN" ]) ++ (optional ((clientCfg.dynamicToRemote.port or 1024) < 1024 || (any (x: x.local.port < 1024) clientCfg.localToRemote)) [ "CAP_NET_BIND_SERVICE" ]);
+        AmbientCapabilities = (optionals (clientCfg.soMark != null) [ "CAP_NET_ADMIN" ]) ++ (optionals ((clientCfg.dynamicToRemote.port or 1024) < 1024 || (any (x: x.local.port < 1024) clientCfg.localToRemote)) [ "CAP_NET_BIND_SERVICE" ]);
        NoNewPrivileges = true;
        RestrictNamespaces = "uts ipc pid user cgroup";
        ProtectSystem = "strict";
--- a/nixos/modules/services/web-apps/plausible.nix
+++ b/nixos/modules/services/web-apps/plausible.nix
@ -9,6 +9,8 @@ in {
  options.services.plausible = {
    enable = mkEnableOption (lib.mdDoc "plausible");

+    package = mkPackageOptionMD pkgs "plausible" { };
+
    releaseCookiePath = mkOption {
      type = with types; either str path;
      description = lib.mdDoc ''
@ -180,12 +182,12 @@ in {

    services.epmd.enable = true;

-    environment.systemPackages = [ pkgs.plausible ];
+    environment.systemPackages = [ cfg.package ];

    systemd.services = mkMerge [
      {
        plausible = {
-          inherit (pkgs.plausible.meta) description;
+          inherit (cfg.package.meta) description;
          documentation = [ "https://plausible.io/docs/self-hosting" ];
          wantedBy = [ "multi-user.target" ];
          after = optional cfg.database.clickhouse.setup "clickhouse.service"
@ -233,7 +235,7 @@ in {
            SMTP_USER_NAME = cfg.mail.smtp.user;
          });

-          path = [ pkgs.plausible ]
+          path = [ cfg.package ]
            ++ optional cfg.database.postgres.setup config.services.postgresql.package;
          script = ''
            export CONFIG_DIR=$CREDENTIALS_DIRECTORY
@ -241,10 +243,10 @@ in {
            export RELEASE_COOKIE="$(< $CREDENTIALS_DIRECTORY/RELEASE_COOKIE )"

            # setup
-            ${pkgs.plausible}/createdb.sh
-            ${pkgs.plausible}/migrate.sh
+            ${cfg.package}/createdb.sh
+            ${cfg.package}/migrate.sh
            ${optionalString cfg.adminUser.activate ''
-              if ! ${pkgs.plausible}/init-admin.sh | grep 'already exists'; then
+              if ! ${cfg.package}/init-admin.sh | grep 'already exists'; then
                psql -d plausible <<< "UPDATE users SET email_verified=true;"
              fi
            ''}
--- a/pkgs/applications/backup/pika-backup/default.nix
+++ b/pkgs/applications/backup/pika-backup/default.nix
@ -19,20 +19,20 @@

 stdenv.mkDerivation rec {
  pname = "pika-backup";
-  version = "0.5.2";
+  version = "0.6.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "pika-backup";
    rev = "v${version}";
-    hash = "sha256-d+VkKY14o1wwINSlVBsvWux8YhyXg77N9i2R61QLGqM=";
+    hash = "sha256-eI2MRrW6MID4dMHR1OjDT83xd/9CgDuhAWpEHmhnMVw=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-3MNwX8kB+bjP9Dz+k+HYmCOI1Naa9tDBe0+GKsEmqnc=";
+    hash = "sha256-hbh4kfQcym0n2cCp2ebljQpizolsxyfZk7ctKOlDybA=";
  };

  patches = [
--- a/pkgs/applications/editors/pulsar/default.nix
+++ b/pkgs/applications/editors/pulsar/default.nix
@ -17,23 +17,26 @@
 , makeDesktopItem
 , copyDesktopItems
 , makeWrapper
+, nodePackages
+, python3
 }:

 let
-  pname = "Pulsar";
-  version = "1.103.0";
+  pname = "pulsar";
+  version = "1.104.0";

  sourcesPath = {
    x86_64-linux.tarname = "Linux.${pname}-${version}.tar.gz";
-    x86_64-linux.hash = "sha256-C9La+rMpxyFthNPwPBZfV1goP/F1TiNYYYwmPCSkKdw=";
+    x86_64-linux.hash = "sha256-HEMUQVNPb6qWIXX25N79HwHo7j11MyFiBRsq9otdAL8=";
    aarch64-linux.tarname = "ARM.Linux.${pname}-${version}-arm64.tar.gz";
-    aarch64-linux.hash = "sha256-uVGxDLqFgm5USZT6i7pLYJZq8jFxZviVXXYTL3RVhpw=";
+    aarch64-linux.hash = "sha256-f+s54XtLLdhTFY9caKTKngJF6zLai0F7ur9v37bwuNE=";
  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

  additionalLibs = lib.makeLibraryPath [
    xorg.libxshmfence
    libxkbcommon
    xorg.libxkbfile
+    stdenv.cc.cc.lib
  ];
  newLibpath = "${atomEnv.libPath}:${additionalLibs}";

@ -57,6 +60,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    wrapGAppsHook
    copyDesktopItems
+    nodePackages.asar
  ];

  buildInputs = [
@ -110,12 +114,26 @@ stdenv.mkDerivation rec {
    ln -s ${git}/bin/git $dugite/git/bin/git
    rm -f $dugite/git/libexec/git-core/git
    ln -s ${git}/bin/git $dugite/git/libexec/git-core/git
+
+    # We have to patch a prebuilt binary in the asar archive
+    # But asar complains because the node_gyp unpacked dependency uses a prebuilt Python3 itself
+
+    rm $opt/resources/app.asar.unpacked/node_modules/tree-sitter-bash/build/node_gyp_bins/python3
+    ln -s ${python3}/bin/python3 $opt/resources/app.asar.unpacked/node_modules/tree-sitter-bash/build/node_gyp_bins/python3
  '' + ''
    # Patch the bundled node executables
    find $opt -name "*.node" -exec patchelf --set-rpath "${newLibpath}:$opt" {} \;
    # Also patch the node executable for apm
    patchelf --set-rpath "${newLibpath}:$opt" $opt/resources/app/ppm/bin/node

+    # The pre-packaged ASAR bundle comes with prebuild binaries, expecting libstdc++.so.6
+    asarBundle=$TMPDIR/asarbundle
+    asar e $opt/resources/app.asar $asarBundle
+    find $asarBundle -name "*.node" -exec patchelf --set-rpath "${newLibpath}:$opt" --add-needed libstdc++.so.6 {} \;
+    unlink $asarBundle/node_modules/document-register-element/dre # Self referencing symlink, breaking asar rebundling
+    asar p $asarBundle $opt/resources/app.asar
+    rm -rf $asarBundle
+
    # We have patched the original wrapper, but now it needs the "PULSAR_PATH" env var
    mkdir -p $out/bin
    wrapProgram $opt/resources/pulsar.sh \
--- a/pkgs/applications/editors/pulsar/update.mjs
+++ b/pkgs/applications/editors/pulsar/update.mjs
@ -4,15 +4,13 @@
 */

 import { promises as fs } from 'node:fs';
-import { promisify } from 'node:util';
-import { exec as _exec } from 'node:child_process';
-const exec = promisify(_exec);

 const constants = {
    githubUrl: "https://api.github.com/repos/pulsar-edit/pulsar/releases",
    sha256FileURL: (newVersion) => `https://github.com/pulsar-edit/pulsar/releases/download/v${newVersion}/SHA256SUMS.txt`,
    x86_64FileName: (newVersion) => `Linux.pulsar-${newVersion}.tar.gz`,
    aarch64FileName: (newVersion) => `ARM.Linux.pulsar-${newVersion}-arm64.tar.gz`,
+    targetFile: new URL("default.nix", import.meta.url).pathname,
 };

 async function getLatestVersion() {
@ -69,10 +67,10 @@ async function updateFile(newVersion, sha256Sums, currentFile) {
    newFile = newFile.replace(/x86_64-linux\.hash = "(.*)";/, `x86_64-linux.hash = "${sha256Sums.x86_64}";`);
    newFile = newFile.replace(/aarch64-linux\.hash = "(.*)";/, `aarch64-linux.hash = "${sha256Sums.aarch64}";`);

-    await fs.writeFile('default.nix', newFile);
+    await fs.writeFile(constants.targetFile, newFile);
 };

-let currentFile = await fs.readFile('default.nix', 'utf8');
+let currentFile = await fs.readFile(constants.targetFile, 'utf8');
 let currentVersion = currentFile.match(/version = "(.*)";/)[1];
 const newVersion = await getLatestVersion();
 if (currentVersion === newVersion) {
--- a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
@ -29,7 +29,7 @@ let
    sha256 = "sha256-Njlus+vY3N++qWE0JXrGjwcXY2QDFuOV/7NruBBMETY=";
  };

-  build-deps = nodePackages."rust-analyzer-build-deps-../../applications/editors/vscode/extensions/rust-analyzer/build-deps";
+  build-deps = nodePackages."rust-analyzer-build-deps-../../applications/editors/vscode/extensions/rust-lang.rust-analyzer/build-deps";
  # FIXME: Making a new derivation to link `node_modules` and run `npm run package`
  # will cause a build failure.
  vsix = build-deps.override {
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
      libharu
      libepoxy
    ]
-    ++ lib.optional (!stdenv.isAarch64) [
+    ++ lib.optionals (!stdenv.isAarch64) [
      openimagedenoise
      embree
    ]
--- a/pkgs/applications/misc/klipper-estimator/default.nix
+++ b/pkgs/applications/misc/klipper-estimator/default.nix
@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {

  buildInputs =
    [ openssl ]
-    ++ lib.optional stdenv.isDarwin [ libgit2 Security ];
+    ++ lib.optionals stdenv.isDarwin [ libgit2 Security ];

  nativeBuildInputs = [ pkg-config ];

@ -36,4 +36,3 @@ rustPlatform.buildRustPackage rec {
    maintainers = with maintainers; [ tmarkus ];
  };
 }
-
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@ -1,5 +1,6 @@
 { pkgs
 , stdenv
+, callPackage
 , lib
 , fetchFromGitHub
 , python3
@ -242,9 +243,10 @@ let
              ];

              passthru = {
-                python = self.python;
+                inherit (self) python;
                updateScript = nix-update-script { };
                tests = {
+                  plugins = (callPackage ./plugins.nix { }) super self;
                  inherit (nixosTests) octoprint;
                };
              };
@ -258,7 +260,7 @@ let
            };
          }
        )
-        (import ./plugins.nix { inherit pkgs; })
+        (callPackage ./plugins.nix { })
        packageOverrides
      ]
    );
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@ -1,11 +1,15 @@
-{ pkgs }:
-
-with pkgs;
+{ lib
+, config
+, fetchFromGitHub
+, fetchFromGitLab
+, fetchpatch
+, marlin-calc
+}:

 self: super:
 let
  buildPlugin = args: self.buildPythonPackage (args // {
-    pname = "OctoPrintPlugin-${args.pname}";
+    pname = "octoprint-plugin-${args.pname}";
    inherit (args) version;
    propagatedBuildInputs = (args.propagatedBuildInputs or [ ]) ++ [ super.octoprint ];
    # none of the following have tests
@ -16,7 +20,7 @@ in
  inherit buildPlugin;

  m86motorsoff = buildPlugin rec {
-    pname = "M84MotorsOff";
+    pname = "m84motorsoff";
    version = "0.1.0";

    src = fetchFromGitHub {
@ -35,11 +39,13 @@ in
  };

  abl-expert = buildPlugin rec {
-    pname = "ABL_Expert";
+    pname = "abl-expert";
    version = "0.6";

-    src = fetchgit {
-      url = "https://framagit.org/razer/Octoprint_ABL_Expert/";
+    src = fetchFromGitLab {
+      domain = "framagit.org";
+      owner = "razer";
+      repo = "Octoprint_ABL_Expert";
      rev = version;
      sha256 = "0ij3rvdwya1sbymwm5swlh2j4jagb6fal945g88zrzh5xf26hzjh";
    };
@ -53,12 +59,12 @@ in
  };

  bedlevelvisualizer = buildPlugin rec {
-    pname = "BedLevelVisualizer";
+    pname = "bedlevelvisualizer";
    version = "1.1.0";

    src = fetchFromGitHub {
      owner = "jneilliii";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-BedLevelVisualizer";
      rev = version;
      sha256 = "sha256-SKrhtTGyDuvbDmUCXSx83Y+C83ZzVHA78TwMYwE6tcc=";
    };
@ -74,12 +80,12 @@ in
  };

  costestimation = buildPlugin rec {
-    pname = "CostEstimation";
+    pname = "costestimation";
    version = "3.4.0";

    src = fetchFromGitHub {
      owner = "OllisGit";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-CostEstimation";
      rev = version;
      sha256 = "sha256-04OPa/RpM8WehUmOp195ocsAjAvKdVY7iD5ybzQO7Dg=";
    };
@ -93,12 +99,12 @@ in
  };

  curaenginelegacy = buildPlugin rec {
-    pname = "CuraEngineLegacy";
+    pname = "curaenginelegacy";
    version = "1.1.2";

    src = fetchFromGitHub {
      owner = "OctoPrint";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-CuraEngineLegacy";
      rev = version;
      sha256 = "sha256-54siSmzgPlnCRpkpZhXU9theNQ3hqL3j+Ip4Ie2w2vA=";
    };
@ -112,12 +118,12 @@ in
  };

  displayprogress = buildPlugin rec {
-    pname = "DisplayProgress";
+    pname = "displayprogress";
    version = "0.1.3";

    src = fetchFromGitHub {
      owner = "OctoPrint";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-DisplayProgress";
      rev = version;
      sha256 = "080prvfwggl4vkzyi369vxh1n8231hrl8a44f399laqah3dn5qw4";
    };
@ -131,12 +137,12 @@ in
  };

  displaylayerprogress = buildPlugin rec {
-    pname = "OctoPrint-DisplayLayerProgress";
+    pname = "displaylayerprogress";
    version = "1.26.0";

    src = fetchFromGitHub {
      owner = "OllisGit";
-      repo = pname;
+      repo = "OctoPrint-DisplayLayerProgress";
      rev = version;
      sha256 = "sha256-hhHc2SPixZCPJzCP8enMMWNYaYbNZAU0lNSx1B0d++4=";
    };
@ -149,8 +155,8 @@ in
    };
  };

-  ender3v2tempfix = buildPlugin rec {
-    pname = "OctoPrintPlugin-ender3v2tempfix";
+  ender3v2tempfix = buildPlugin {
+    pname = "ender3v2tempfix";
    version = "unstable-2021-04-27";

    src = fetchFromGitHub {
@ -169,12 +175,12 @@ in
  };

  gcodeeditor = buildPlugin rec {
-    pname = "GcodeEditor";
+    pname = "gcodeeditor";
    version = "0.2.12";

    src = fetchFromGitHub {
      owner = "ieatacid";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-GcodeEditor";
      rev = version;
      sha256 = "sha256-1Sk2ri3DKW8q8VJ/scFjpRsz65Pwt8OEURP1k70aydE=";
    };
@ -188,12 +194,12 @@ in
  };

  marlingcodedocumentation = buildPlugin rec {
-    pname = "MarlinGcodeDocumentation";
+    pname = "marlingcodedocumentation";
    version = "0.13.0";

    src = fetchFromGitHub {
      owner = "costas-basdekis";
-      repo = pname;
+      repo = "MarlinGcodeDocumentation";
      rev = "v${version}";
      sha256 = "sha256-3ay6iCxZk8QkFM/2Y14VTpPoxr6NXq14BFSHofn3q7I=";
    };
@ -207,7 +213,7 @@ in
  };

  mqtt = buildPlugin rec {
-    pname = "MQTT";
+    pname = "mqtt";
    version = "0.8.10";

    src = fetchFromGitHub {
@ -228,12 +234,12 @@ in
  };

  printtimegenius = buildPlugin rec {
-    pname = "PrintTimeGenius";
+    pname = "printtimegenius";
    version = "2.2.8";

    src = fetchFromGitHub {
      owner = "eyal0";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-PrintTimeGenius";
      rev = version;
      sha256 = "sha256-Bbpm7y4flzEbUb6Sgkp6hIIHs455A0IsbmzvZwlkbh0=";
    };
@ -246,7 +252,7 @@ in
    preConfigure = ''
      # PrintTimeGenius ships with marlin-calc binaries for multiple architectures
      rm */analyzers/marlin-calc*
-      sed 's@"{}.{}".format(binary_base_name, machine)@"${pkgs.marlin-calc}/bin/marlin-calc"@' -i */analyzers/analyze_progress.py
+      sed 's@"{}.{}".format(binary_base_name, machine)@"${marlin-calc}/bin/marlin-calc"@' -i */analyzers/analyze_progress.py
    '';

    meta = with lib; {
@ -258,12 +264,12 @@ in
  };

  psucontrol = buildPlugin rec {
-    pname = "PSUControl";
+    pname = "psucontrol";
    version = "1.0.6";

    src = fetchFromGitHub {
      owner = "kantlivelong";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-PSUControl";
      rev = version;
      sha256 = "sha256-S+lPm85+ZEO/3BXYsrxE4FU29EGWzWrSw3y1DLdByrM=";
    };
@ -286,12 +292,12 @@ in
  };

  simpleemergencystop = buildPlugin rec {
-    pname = "SimpleEmergencyStop";
+    pname = "simpleemergencystop";
    version = "1.0.5";

    src = fetchFromGitHub {
      owner = "Sebclem";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-SimpleEmergencyStop";
      rev = version;
      sha256 = "sha256-MbP3cKa9FPElQ/M8ykYh9kVXl8hNvmGiCHDvjgWvm9k=";
    };
@ -305,7 +311,7 @@ in
  };

  stlviewer = buildPlugin rec {
-    pname = "STLViewer";
+    pname = "stlviewer";
    version = "0.4.2";

    src = fetchFromGitHub {
@ -324,12 +330,12 @@ in
  };

  telegram = buildPlugin rec {
-    pname = "Telegram";
+    pname = "telegram";
    version = "1.6.5";

    src = fetchFromGitHub {
      owner = "fabianonline";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-Telegram";
      rev = version;
      sha256 = "sha256-SckJCbPNCflgGYLHFiXy0juCtpvo8YS1BQsFpc1f5rg=";
    };
@ -345,14 +351,14 @@ in
  };

  themeify = buildPlugin rec {
-    pname = "Themeify";
+    pname = "themeify";
    version = "1.2.2";

    src = fetchFromGitHub {
      owner = "Birkbjo";
-      repo = "Octoprint-${pname}";
+      repo = "Octoprint-Themeify";
      rev = "v${version}";
-      sha256 = "0j1qs6kyh947npdy7pqda25fjkqinpas3sy0qyscqlxi558lhvx2";
+      sha256 = "sha256-om9IUSmxU8y0x8DrodW1EU/pilAN3+PbtYck6KfROEg=";
    };

    meta = with lib; {
@ -364,7 +370,7 @@ in
  };

  titlestatus = buildPlugin rec {
-    pname = "TitleStatus";
+    pname = "titlestatus";
    version = "0.0.5";

    src = fetchFromGitHub {
@ -383,12 +389,12 @@ in
  };

  touchui = buildPlugin rec {
-    pname = "TouchUI";
+    pname = "touchui";
    version = "0.3.18";

    src = fetchFromGitHub {
      owner = "BillyBlaze";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-TouchUI";
      rev = version;
      sha256 = "sha256-PNDCjY7FhfnwK7Nd86el9ZQ00G4uMANH2Sk080iMYXw=";
    };
@ -402,7 +408,7 @@ in
  };

  octoklipper = buildPlugin rec {
-    pname = "OctoKlipper";
+    pname = "octoklipper";
    version = "0.3.8.3";

    src = fetchFromGitHub {
@ -421,36 +427,47 @@ in
  };

  octolapse = buildPlugin rec {
-    pname = "Octolapse";
-    version = "0.4.1";
+    pname = "octolapse";
+    version = "0.4.2";

    src = fetchFromGitHub {
      owner = "FormerLurker";
-      repo = pname;
+      repo = "Octolapse";
      rev = "v${version}";
-      sha256 = "13q20g7brabplc198jh67lk65rn140r8217iak9b2jy3in8fggv4";
+      sha256 = "sha256-QP6PkKWKUv4uIaYdqTAsZmK7DVes94Q9K/DrBYrWxzY=";
    };

+    patches = [
+      # fix version constraint
+      # https://github.com/FormerLurker/Octolapse/pull/894
+      (fetchpatch {
+        url = "https://github.com/FormerLurker/Octolapse/commit/0bd7db2430aef370f2665c6c7011fc3bb559122e.patch";
+        hash = "sha256-z2aEq5sJGarGtIDbTRCvXdSj+kq8HIVvLRWpKutmJNY=";
+      })
+    ];
+
    # Test fails due to code executed on import, see #136513
    #pythonImportsCheck = [ "octoprint_octolapse" ];

-    propagatedBuildInputs = with super; [ awesome-slugify setuptools pillow sarge six psutil file-read-backwards ];
+    propagatedBuildInputs = with super; [ awesome-slugify setuptools pillow sarge six pillow psutil file-read-backwards ];

    meta = with lib; {
      description = "Stabilized timelapses for Octoprint";
      homepage = "https://github.com/FormerLurker/OctoLapse";
      license = licenses.agpl3Plus;
      maintainers = with maintainers; [ illustris j0hax ];
+      # requires pillow >=6.2.0,<7.0.0
+      broken = true;
    };
  };

-  octoprint-dashboard = buildPlugin rec {
-    pname = "OctoPrint-Dashboard";
+  dashboard = buildPlugin rec {
+    pname = "dashboard";
    version = "1.18.3";

    src = fetchFromGitHub {
      owner = "StefanCohen";
-      repo = pname;
+      repo = "OctoPrint-Dashboard";
      rev = version;
      sha256 = "sha256-hLHT3Uze/6PlOCEICVZ2ieFTyXgcqCvgHOlIIEquujg=";
    };
@ -462,4 +479,6 @@ in
      maintainers = with maintainers; [ j0hax ];
    };
  };
+} // lib.optionalAttrs config.allowAliases {
+  octoprint-dashboard = self.dashboard;
 }
--- a/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
@ -31,7 +31,7 @@ buildGo120Package rec {
  '';

  doCheck = true;
-  checkFlags = "-skip TestSetSessionHandlers";
+  checkFlags = [ "-skip=TestSetSessionHandlers" ];

  preCheck = ''
    if ! [[ $(go/bin/sessionmanagerplugin-main --version) = ${lib.escapeShellArg version} ]]; then
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@ -12,6 +12,7 @@
 , libpulseaudio
 , pipewire
 , alsa-utils
+, which
 }:

 stdenv.mkDerivation rec {
@ -76,7 +77,7 @@ stdenv.mkDerivation rec {
    # Linux needs 'aplay' for notification sounds, 'libpulse' for meeting sound, and 'libpipewire' for screen sharing
    makeWrapper '${electron}/bin/electron' "$out/bin/teams-for-linux" \
      ${lib.optionalString stdenv.isLinux ''
-        --prefix PATH : ${lib.makeBinPath [ alsa-utils ]} \
+        --prefix PATH : ${lib.makeBinPath [ alsa-utils which ]} \
        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio pipewire ]} \
      ''} \
      --add-flags "$out/share/teams-for-linux/app.asar" \
--- a/pkgs/applications/office/PageEdit/default.nix
+++ b/pkgs/applications/office/PageEdit/default.nix
@ -1,7 +1,7 @@
-{ lib, mkDerivation, fetchFromGitHub, cmake, qtsvg, qtwebengine, qttranslations }:
+{ lib, stdenv, mkDerivation, fetchFromGitHub, cmake, qtsvg, qtwebengine, qttranslations, wrapQtAppsHook }:

-mkDerivation rec {
-  pname = "PageEdit";
+stdenv.mkDerivation rec {
+  pname = "pageedit";
  version = "1.9.20";

  src = fetchFromGitHub {
@ -11,10 +11,21 @@ mkDerivation rec {
    hash = "sha256-naoflFANeMwabbdrNL3+ndvEXYT4Yqf+Mo77HcCexHE=";
  };

-  nativeBuildInputs = [ cmake qttranslations ];
+  nativeBuildInputs = [ cmake qttranslations wrapQtAppsHook ];
  propagatedBuildInputs = [ qtsvg qtwebengine ];
  cmakeFlags = [ "-DINSTALL_BUNDLED_DICTS=0" ];

+  installPhase =
+    if stdenv.isDarwin then ''
+      runHook preInstall
+
+      mkdir -p $out/Applications
+      cp -r bin/PageEdit.app $out/Applications
+      makeWrapper $out/Applications/PageEdit.app/Contents/MacOS/PageEdit $out/bin/pageedit
+
+      runHook postInstall
+    '' else null;
+
  meta = with lib; {
    description = "ePub XHTML Visual Editor";
    homepage = "https://sigil-ebook.com/pageedit/";
--- a/pkgs/applications/science/biology/blast/bin.nix
+++ b/pkgs/applications/science/biology/blast/bin.nix
@ -35,7 +35,7 @@ in
 stdenv.mkDerivation {
  inherit pname version src;

-  nativeBuildInputs = lib.optional stdenv.isLinux [ autoPatchelfHook ];
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];

  buildInputs = [ python3 perl ] ++ lib.optionals stdenv.isLinux [ zlib bzip2 glib libxml2 ];

--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@ -48,6 +48,8 @@ edk2.mkDerivation projectDscPath (finalAttrs: {

  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Qunused-arguments";

+  env.PYTHON_COMMAND = "python3";
+
  postPatch = lib.optionalString csmSupport ''
    cp ${seabios}/Csm16.bin OvmfPkg/Csm/Csm16/Csm16.bin
  '';
--- a/pkgs/applications/virtualization/sail-riscv/default.nix
+++ b/pkgs/applications/virtualization/sail-riscv/default.nix
@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitHub
+, fetchpatch
 , lib
 , arch
 , ocamlPackages
@ -24,14 +25,24 @@ stdenv.mkDerivation rec {
  buildInputs = with ocamlPackages; [ zlib linksem ];
  strictDeps = true;

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/riscv/sail-riscv/pull/250/commits/8bd37c484b83a8ce89c8bb7a001b8ae34dc4d77f.patch";
+      hash = "sha256-tDgkGhcbT6phoCAvilxMI56YUuUqQFgvh+2QduOjdMg=";
+    })
+  ];
+
  postPatch = ''
    rm -r prover_snapshots
+  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace Makefile --replace "-flto" ""
  '';

  makeFlags = [
    "SAIL=sail"
    "ARCH=${arch}"
    "SAIL_DIR=${ocamlPackages.sail}/share/sail"
+    "LEM_DIR=${ocamlPackages.sail}/share/lem"
  ];

  installPhase = ''
@ -50,6 +61,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/riscv/sail-riscv";
    description = "A formal specification of the RISC-V architecture, written in Sail";
    maintainers = with maintainers; [ genericnerdyusername ];
+    broken = stdenv.isDarwin && stdenv.isAarch64;
    license = licenses.bsd2;
  };
 }
--- a/pkgs/development/compilers/crystal/build-package.nix
+++ b/pkgs/development/compilers/crystal/build-package.nix
@ -150,6 +150,9 @@ stdenv.mkDerivation (mkDerivationArgs // {

  installCheckPhase = args.installCheckPhase or ''
    for f in $out/bin/*; do
+      if [ $f == $out/bin/*.dwarf ]; then
+        continue
+      fi
      $f --help > /dev/null
    done
  '';
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@ -20,6 +20,7 @@
 , llvmPackages
 , makeWrapper
 , openssl
+, pcre2
 , pcre
 , pkg-config
 , readline
@ -74,6 +75,7 @@ let
  commonBuildInputs = extraBuildInputs: [
    boehmgc
    pcre
+    pcre2
    libevent
    libyaml
    zlib
@ -274,5 +276,11 @@ rec {
    binary = binaryCrystal_1_2;
  };

-  crystal = crystal_1_7;
+  crystal_1_8 = generic {
+    version = "1.8.0";
+    sha256 = "sha256-oTvBKrfDkrpJg4gaOVrrKWfsqZC+Z9Lp/jt4ye+Iw/M=";
+    binary = binaryCrystal_1_2;
+  };
+
+  crystal = crystal_1_8;
 }
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@ -1,264 +1,84 @@
-{ config, lib, stdenv, fetchurl, fetchFromGitHub, pkgs, buildPackages
-, callPackage
-, enableThreading ? true, coreutils, makeWrapper
-, enableCrypt ? true, libxcrypt ? null
-, zlib
-}:
-
-assert (enableCrypt -> (libxcrypt != null));
-
-# Note: this package is used for bootstrapping fetchurl, and thus
-# cannot use fetchpatch! All mutable patches (generated by GitHub or
-# cgit) that are needed here should be included directly in Nixpkgs as
-# files.
+{ callPackage }:

 let
+  # Common passthru for all perl interpreters.
+  # copied from lua
+  passthruFun =
+    { overrides
+    , perlOnBuildForBuild
+    , perlOnBuildForHost
+    , perlOnBuildForTarget
+    , perlOnHostForHost
+    , perlOnTargetForTarget
+    , perlAttr ? null
+    , self # is perlOnHostForTarget
+    }: let
+      perlPackages = callPackage
+        # Function that when called
+        # - imports perl-packages.nix
+        # - adds spliced package sets to the package set
+        ({ stdenv, pkgs, perl, callPackage, makeScopeWithSplicing }: let
+          perlPackagesFun = callPackage ../../../top-level/perl-packages.nix {
+            # allow 'perlPackages.override { pkgs = pkgs // { imagemagick = imagemagickBig; }; }' like in python3Packages
+            # most perl packages aren't called with callPackage so it's not possible to override their arguments individually
+            # the conditional is because the // above won't be applied to __splicedPackages and hopefully no one is doing that when cross-compiling
+            pkgs = if stdenv.buildPlatform != stdenv.hostPlatform then pkgs.__splicedPackages else pkgs;
+            inherit stdenv;
+            perl = self;
+          };

-  libc = if stdenv.cc.libc or null != null then stdenv.cc.libc else "/usr";
-  libcInc = lib.getDev libc;
-  libcLib = lib.getLib libc;
-  crossCompiling = stdenv.buildPlatform != stdenv.hostPlatform;
+          otherSplices = {
+            selfBuildBuild = perlOnBuildForBuild.pkgs;
+            selfBuildHost = perlOnBuildForHost.pkgs;
+            selfBuildTarget = perlOnBuildForTarget.pkgs;
+            selfHostHost = perlOnHostForHost.pkgs;
+            selfTargetTarget = perlOnTargetForTarget.pkgs or {};
+          };
+          keep = self: { };
+          extra = spliced0: {};
+        in makeScopeWithSplicing
+          otherSplices
+          keep
+          extra
+          perlPackagesFun)
+        {
+          perl = self;
+        };
+    in rec {
+        buildEnv = callPackage ./wrapper.nix {
+          perl = self;
+          inherit (pkgs) requiredPerlModules;
+        };
+        withPackages = f: buildEnv.override { extraLibs = f pkgs; };
+        pkgs = perlPackages // (overrides pkgs);
+        interpreter = "${self}/bin/perl";
+        libPrefix = "lib/perl5/site_perl";
+        perlOnBuild = perlOnBuildForHost.override { inherit overrides; self = perlOnBuild; };
+  };

-  common = { perl, buildPerl, version, sha256 }: stdenv.mkDerivation (rec {
-    inherit version;
-    pname = "perl";
-
-    src = fetchurl {
-      url = "mirror://cpan/src/5.0/perl-${version}.tar.gz";
-      inherit sha256;
-    };
-
-    strictDeps = true;
-    # TODO: Add a "dev" output containing the header files.
-    outputs = [ "out" "man" "devdoc" ] ++
-      lib.optional crossCompiling "mini";
-    setOutputFlags = false;
-
-    # On FreeBSD, if Perl is built with threads support, having
-    # libxcrypt available will result in a build failure, because
-    # perl.h will get conflicting definitions of struct crypt_data
-    # from libc's unistd.h and libxcrypt's crypt.h.
-    #
-    # FreeBSD Ports has the same issue building the perl port if
-    # the libxcrypt port has been installed.
-    #
-    # Without libxcrypt, Perl will still find FreeBSD's crypt functions.
-    propagatedBuildInputs = lib.optional (enableCrypt && !stdenv.isFreeBSD) libxcrypt;
-
-    disallowedReferences = [ stdenv.cc ];
-
-    patches =
-      [
-        # Do not look in /usr etc. for dependencies.
-        ./no-sys-dirs-5.31.patch
-
-        # Enable TLS/SSL verification in HTTP::Tiny by default
-        ./http-tiny-verify-ssl-by-default.patch
-      ]
-      ++ lib.optional stdenv.isSunOS ./ld-shared.patch
-      ++ lib.optionals stdenv.isDarwin [ ./cpp-precomp.patch ./sw_vers.patch ]
-      ++ lib.optional crossCompiling ./MakeMaker-cross.patch;
-
-    # This is not done for native builds because pwd may need to come from
-    # bootstrap tools when building bootstrap perl.
-    postPatch = (if crossCompiling then ''
-      substituteInPlace dist/PathTools/Cwd.pm \
-        --replace "/bin/pwd" '${coreutils}/bin/pwd'
-      substituteInPlace cnf/configure_tool.sh --replace "cc -E -P" "cc -E"
-    '' else ''
-      substituteInPlace dist/PathTools/Cwd.pm \
-        --replace "/bin/pwd" "$(type -P pwd)"
-    '') +
-    # Perl's build system uses the src variable, and its value may end up in
-    # the output in some cases (when cross-compiling)
-    ''
-      unset src
-    '';
-
-    # Build a thread-safe Perl with a dynamic libperl.so.  We need the
-    # "installstyle" option to ensure that modules are put under
-    # $out/lib/perl5 - this is the general default, but because $out
-    # contains the string "perl", Configure would select $out/lib.
-    # Miniperl needs -lm. perl needs -lrt.
-    configureFlags =
-      (if crossCompiling
-       then [ "-Dlibpth=\"\"" "-Dglibpth=\"\"" "-Ddefault_inc_excludes_dot" ]
-       else [ "-de" "-Dcc=cc" ])
-      ++ [
-        "-Uinstallusrbinperl"
-        "-Dinstallstyle=lib/perl5"
-      ] ++ lib.optional (!crossCompiling) "-Duseshrplib" ++ [
-        "-Dlocincpth=${libcInc}/include"
-        "-Dloclibpth=${libcLib}/lib"
-      ]
-      ++ lib.optionals ((builtins.match ''5\.[0-9]*[13579]\..+'' version) != null) [ "-Dusedevel" "-Uversiononly" ]
-      ++ lib.optional stdenv.isSunOS "-Dcc=gcc"
-      ++ lib.optional enableThreading "-Dusethreads"
-      ++ lib.optional (!enableCrypt) "-A clear:d_crypt_r"
-      ++ lib.optional stdenv.hostPlatform.isStatic "--all-static"
-      ++ lib.optionals (!crossCompiling) [
-        "-Dprefix=${placeholder "out"}"
-        "-Dman1dir=${placeholder "out"}/share/man/man1"
-        "-Dman3dir=${placeholder "out"}/share/man/man3"
-      ];
-
-    configureScript = lib.optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
-
-    dontAddStaticConfigureFlags = true;
-
-    dontAddPrefix = !crossCompiling;
-
-    enableParallelBuilding = !crossCompiling;
-
-    # perl includes the build date, the uname of the build system and the
-    # username of the build user in some files.
-    # We override these to make it build deterministically.
-    # other distro solutions
-    # https://github.com/bmwiedemann/openSUSE/blob/master/packages/p/perl/perl-reproducible.patch
-    # https://github.com/archlinux/svntogit-packages/blob/packages/perl/trunk/config.over
-    # https://salsa.debian.org/perl-team/interpreter/perl/blob/debian-5.26/debian/config.over
-    # A ticket has been opened upstream to possibly clean some of this up: https://rt.perl.org/Public/Bug/Display.html?id=133452
-    preConfigure = ''
-        cat > config.over <<EOF
-        ${lib.optionalString (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) ''osvers="gnulinux"''}
-        myuname="nixpkgs"
-        myhostname="nixpkgs"
-        cf_by="nixpkgs"
-        cf_time="$(date -d "@$SOURCE_DATE_EPOCH")"
-        EOF
-
-        # Compress::Raw::Zlib should use our zlib package instead of the one
-        # included with the distribution
-        cat > ./cpan/Compress-Raw-Zlib/config.in <<EOF
-        BUILD_ZLIB   = False
-        INCLUDE      = ${zlib.dev}/include
-        LIB          = ${zlib.out}/lib
-        OLD_ZLIB     = False
-        GZIP_OS_CODE = AUTO_DETECT
-        EOF
-      '' + lib.optionalString stdenv.isDarwin ''
-        substituteInPlace hints/darwin.sh --replace "env MACOSX_DEPLOYMENT_TARGET=10.3" ""
-      '' + lib.optionalString (!enableThreading) ''
-        # We need to do this because the bootstrap doesn't have a static libpthread
-        sed -i 's,\(libswanted.*\)pthread,\1,g' Configure
-      '';
-
-    # Default perl does not support --host= & co.
-    configurePlatforms = [];
-
-    setupHook = ./setup-hook.sh;
-
-    passthru = rec {
-      interpreter = "${perl}/bin/perl";
-      libPrefix = "lib/perl5/site_perl";
-      pkgs = callPackage ../../../top-level/perl-packages.nix {
-        inherit perl buildPerl;
-        overrides = config.perlPackageOverrides or (p: {}); # TODO: (self: super: {}) like in python
-      };
-      buildEnv = callPackage ./wrapper.nix {
-        inherit perl;
-        inherit (pkgs) requiredPerlModules;
-      };
-      withPackages = f: buildEnv.override { extraLibs = f pkgs; };
-    };
-
-    doCheck = false; # some tests fail, expensive
-
-    # TODO: it seems like absolute paths to some coreutils is required.
-    postInstall =
-      ''
-        # Remove dependency between "out" and "man" outputs.
-        rm "$out"/lib/perl5/*/*/.packlist
-
-        # Remove dependencies on glibc and gcc
-        sed "/ *libpth =>/c    libpth => ' '," \
-          -i "$out"/lib/perl5/*/*/Config.pm
-        # TODO: removing those paths would be cleaner than overwriting with nonsense.
-        substituteInPlace "$out"/lib/perl5/*/*/Config_heavy.pl \
-          --replace "${libcInc}" /no-such-path \
-          --replace "${
-              if stdenv.hasCC then stdenv.cc.cc else "/no-such-path"
-            }" /no-such-path \
-          --replace "${stdenv.cc}" /no-such-path \
-          --replace "$man" /no-such-path
-      '' + lib.optionalString crossCompiling
-      ''
-        mkdir -p $mini/lib/perl5/cross_perl/${version}
-        for dir in cnf/{stub,cpan}; do
-          cp -r $dir/* $mini/lib/perl5/cross_perl/${version}
-        done
-
-        mkdir -p $mini/bin
-        install -m755 miniperl $mini/bin/perl
-
-        export runtimeArch="$(ls $out/lib/perl5/site_perl/${version})"
-        # wrapProgram should use a runtime-native SHELL by default, but
-        # it actually uses a buildtime-native one. If we ever fix that,
-        # we'll need to fix this to use a buildtime-native one.
-        #
-        # Adding the arch-specific directory is morally incorrect, as
-        # miniperl can't load the native modules there. However, it can
-        # (and sometimes needs to) load and run some of the pure perl
-        # code there, so we add it anyway. When needed, stubs can be put
-        # into $mini/lib/perl5/cross_perl/${version}.
-        wrapProgram $mini/bin/perl --prefix PERL5LIB : \
-          "$mini/lib/perl5/cross_perl/${version}:$out/lib/perl5/${version}:$out/lib/perl5/${version}/$runtimeArch"
-      ''; # */
-
-    meta = with lib; {
-      homepage = "https://www.perl.org/";
-      description = "The standard implementation of the Perl 5 programmming language";
-      license = licenses.artistic1;
-      maintainers = [ maintainers.eelco ];
-      platforms = platforms.all;
-      priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
-    };
-  } // lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "c876045741f5159318085d2737b0090f35a842ca"; # June 5, 2022
-
-    perl-cross-src = fetchFromGitHub {
-      name = "perl-cross-unstable-${crossVersion}";
-      owner = "arsv";
-      repo = "perl-cross";
-      rev = crossVersion;
-      sha256 = "sha256-m9UCoTQgXBxSgk9Q1Zv6wl3Qnd0aZm/jEPXkcMKti8U=";
-    };
-
-    depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
-
-    postUnpack = ''
-      unpackFile ${perl-cross-src}
-      chmod -R u+w ${perl-cross-src.name}
-      cp -R ${perl-cross-src.name}/* perl-${version}/
-    '';
-
-    configurePlatforms = [ "build" "host" "target" ];
-
-    # TODO merge setup hooks
-    setupHook = ./setup-hook-cross.sh;
-  });
-in {
+in rec {
  # Maint version
-  perl534 = common {
-    perl = pkgs.perl534;
-    buildPerl = buildPackages.perl534;
+  perl534 = callPackage ./intepreter.nix {
+    self = perl534;
    version = "5.34.1";
    sha256 = "sha256-NXlRpJGwuhzjYRJjki/ux4zNWB3dwkpEawM+JazyQqE=";
+    inherit passthruFun;
  };

  # Maint version
-  perl536 = common {
-    perl = pkgs.perl536;
-    buildPerl = buildPackages.perl536;
+  perl536 = callPackage ./intepreter.nix {
+    self = perl536;
    version = "5.36.0";
    sha256 = "sha256-4mCFr4rDlvYq3YpTPDoOqMhJfYNvBok0esWr17ek4Ao=";
+    inherit passthruFun;
  };

  # the latest Devel version
-  perldevel = common {
-    perl = pkgs.perldevel;
-    buildPerl = buildPackages.perldevel;
+  perldevel = callPackage ./intepreter.nix {
+    self = perldevel;
+    perlAttr = "perldevel";
    version = "5.37.0";
    sha256 = "sha256-8RQO6gtH+WmghqzRafbqAH1MhKv/vJCcvysi7/+T9XI=";
+    inherit passthruFun;
  };
 }
--- a/pkgs/development/interpreters/perl/intepreter.nix
+++ b/pkgs/development/interpreters/perl/intepreter.nix
@ -0,0 +1,257 @@
+{ stdenv
+, fetchurl
+, fetchFromGitHub
+, buildPackages
+, lib
+, self
+, version
+, sha256
+, pkgsBuildBuild
+, pkgsBuildHost
+, pkgsBuildTarget
+, pkgsHostHost
+, pkgsTargetTarget
+, zlib
+, config
+, passthruFun
+, perlAttr ? "perl${lib.versions.major version}${lib.versions.minor version}"
+, enableThreading ? true, coreutils, makeWrapper
+, enableCrypt ? true, libxcrypt ? null
+, overrides ? config.perlPackageOverrides or (p: {}) # TODO: (self: super: {}) like in python
+} @ inputs:
+
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
+assert (enableCrypt -> (libxcrypt != null));
+
+let
+  crossCompiling = stdenv.buildPlatform != stdenv.hostPlatform;
+  libc = if stdenv.cc.libc or null != null then stdenv.cc.libc else "/usr";
+  libcInc = lib.getDev libc;
+  libcLib = lib.getLib libc;
+in
+
+stdenv.mkDerivation (rec {
+  inherit version;
+  pname = "perl";
+
+  src = fetchurl {
+    url = "mirror://cpan/src/5.0/perl-${version}.tar.gz";
+    inherit sha256;
+  };
+
+  strictDeps = true;
+  # TODO: Add a "dev" output containing the header files.
+  outputs = [ "out" "man" "devdoc" ] ++
+    lib.optional crossCompiling "mini";
+  setOutputFlags = false;
+
+  # On FreeBSD, if Perl is built with threads support, having
+  # libxcrypt available will result in a build failure, because
+  # perl.h will get conflicting definitions of struct crypt_data
+  # from libc's unistd.h and libxcrypt's crypt.h.
+  #
+  # FreeBSD Ports has the same issue building the perl port if
+  # the libxcrypt port has been installed.
+  #
+  # Without libxcrypt, Perl will still find FreeBSD's crypt functions.
+  propagatedBuildInputs = lib.optional (enableCrypt && !stdenv.isFreeBSD) libxcrypt;
+
+  disallowedReferences = [ stdenv.cc ];
+
+  patches =
+    [
+      # Do not look in /usr etc. for dependencies.
+      ./no-sys-dirs-5.31.patch
+
+      # Enable TLS/SSL verification in HTTP::Tiny by default
+      ./http-tiny-verify-ssl-by-default.patch
+    ]
+    ++ lib.optional stdenv.isSunOS ./ld-shared.patch
+    ++ lib.optionals stdenv.isDarwin [ ./cpp-precomp.patch ./sw_vers.patch ]
+    ++ lib.optional crossCompiling ./MakeMaker-cross.patch;
+
+  # This is not done for native builds because pwd may need to come from
+  # bootstrap tools when building bootstrap perl.
+  postPatch = (if crossCompiling then ''
+    substituteInPlace dist/PathTools/Cwd.pm \
+      --replace "/bin/pwd" '${coreutils}/bin/pwd'
+    substituteInPlace cnf/configure_tool.sh --replace "cc -E -P" "cc -E"
+  '' else ''
+    substituteInPlace dist/PathTools/Cwd.pm \
+      --replace "/bin/pwd" "$(type -P pwd)"
+  '') +
+  # Perl's build system uses the src variable, and its value may end up in
+  # the output in some cases (when cross-compiling)
+  ''
+    unset src
+  '';
+
+  # Build a thread-safe Perl with a dynamic libperl.so.  We need the
+  # "installstyle" option to ensure that modules are put under
+  # $out/lib/perl5 - this is the general default, but because $out
+  # contains the string "perl", Configure would select $out/lib.
+  # Miniperl needs -lm. perl needs -lrt.
+  configureFlags =
+    (if crossCompiling
+    then [ "-Dlibpth=\"\"" "-Dglibpth=\"\"" "-Ddefault_inc_excludes_dot" ]
+    else [ "-de" "-Dcc=cc" ])
+    ++ [
+      "-Uinstallusrbinperl"
+      "-Dinstallstyle=lib/perl5"
+    ] ++ lib.optional (!crossCompiling) "-Duseshrplib" ++ [
+      "-Dlocincpth=${libcInc}/include"
+      "-Dloclibpth=${libcLib}/lib"
+    ]
+    ++ lib.optionals ((builtins.match ''5\.[0-9]*[13579]\..+'' version) != null) [ "-Dusedevel" "-Uversiononly" ]
+    ++ lib.optional stdenv.isSunOS "-Dcc=gcc"
+    ++ lib.optional enableThreading "-Dusethreads"
+    ++ lib.optional (!enableCrypt) "-A clear:d_crypt_r"
+    ++ lib.optional stdenv.hostPlatform.isStatic "--all-static"
+    ++ lib.optionals (!crossCompiling) [
+      "-Dprefix=${placeholder "out"}"
+      "-Dman1dir=${placeholder "out"}/share/man/man1"
+      "-Dman3dir=${placeholder "out"}/share/man/man3"
+    ];
+
+  configureScript = lib.optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
+
+  dontAddStaticConfigureFlags = true;
+
+  dontAddPrefix = !crossCompiling;
+
+  enableParallelBuilding = !crossCompiling;
+
+  # perl includes the build date, the uname of the build system and the
+  # username of the build user in some files.
+  # We override these to make it build deterministically.
+  # other distro solutions
+  # https://github.com/bmwiedemann/openSUSE/blob/master/packages/p/perl/perl-reproducible.patch
+  # https://github.com/archlinux/svntogit-packages/blob/packages/perl/trunk/config.over
+  # https://salsa.debian.org/perl-team/interpreter/perl/blob/debian-5.26/debian/config.over
+  # A ticket has been opened upstream to possibly clean some of this up: https://rt.perl.org/Public/Bug/Display.html?id=133452
+  preConfigure = ''
+    cat > config.over <<EOF
+    ${lib.optionalString (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) ''osvers="gnulinux"''}
+    myuname="nixpkgs"
+    myhostname="nixpkgs"
+    cf_by="nixpkgs"
+    cf_time="$(date -d "@$SOURCE_DATE_EPOCH")"
+    EOF
+
+    # Compress::Raw::Zlib should use our zlib package instead of the one
+    # included with the distribution
+    cat > ./cpan/Compress-Raw-Zlib/config.in <<EOF
+    BUILD_ZLIB   = False
+    INCLUDE      = ${zlib.dev}/include
+    LIB          = ${zlib.out}/lib
+    OLD_ZLIB     = False
+    GZIP_OS_CODE = AUTO_DETECT
+    EOF
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace hints/darwin.sh --replace "env MACOSX_DEPLOYMENT_TARGET=10.3" ""
+  '' + lib.optionalString (!enableThreading) ''
+    # We need to do this because the bootstrap doesn't have a static libpthread
+    sed -i 's,\(libswanted.*\)pthread,\1,g' Configure
+  '';
+
+  # Default perl does not support --host= & co.
+  configurePlatforms = [ ];
+
+  setupHook = ./setup-hook.sh;
+
+  # copied from python
+  passthru =
+    let
+      # When we override the interpreter we also need to override the spliced versions of the interpreter
+      inputs' = lib.filterAttrs (n: v: ! lib.isDerivation v && n != "passthruFun") inputs;
+      override = attr: let perl = attr.override (inputs' // { self = perl; }); in perl;
+    in
+    passthruFun rec {
+      inherit self perlAttr;
+      inherit overrides;
+      perlOnBuildForBuild = override pkgsBuildBuild.${perlAttr};
+      perlOnBuildForHost = override pkgsBuildHost.${perlAttr};
+      perlOnBuildForTarget = override pkgsBuildTarget.${perlAttr};
+      perlOnHostForHost = override pkgsHostHost.${perlAttr};
+      perlOnTargetForTarget = if lib.hasAttr perlAttr pkgsTargetTarget then (override pkgsTargetTarget.${perlAttr}) else { };
+    };
+
+  doCheck = false; # some tests fail, expensive
+
+  # TODO: it seems like absolute paths to some coreutils is required.
+  postInstall =
+    ''
+      # Remove dependency between "out" and "man" outputs.
+      rm "$out"/lib/perl5/*/*/.packlist
+
+      # Remove dependencies on glibc and gcc
+      sed "/ *libpth =>/c    libpth => ' '," \
+        -i "$out"/lib/perl5/*/*/Config.pm
+      # TODO: removing those paths would be cleaner than overwriting with nonsense.
+      substituteInPlace "$out"/lib/perl5/*/*/Config_heavy.pl \
+        --replace "${libcInc}" /no-such-path \
+        --replace "${
+            if stdenv.hasCC then stdenv.cc.cc else "/no-such-path"
+          }" /no-such-path \
+        --replace "${stdenv.cc}" /no-such-path \
+        --replace "$man" /no-such-path
+    '' + lib.optionalString crossCompiling
+      ''
+        mkdir -p $mini/lib/perl5/cross_perl/${version}
+        for dir in cnf/{stub,cpan}; do
+          cp -r $dir/* $mini/lib/perl5/cross_perl/${version}
+        done
+
+        mkdir -p $mini/bin
+        install -m755 miniperl $mini/bin/perl
+
+        export runtimeArch="$(ls $out/lib/perl5/site_perl/${version})"
+        # wrapProgram should use a runtime-native SHELL by default, but
+        # it actually uses a buildtime-native one. If we ever fix that,
+        # we'll need to fix this to use a buildtime-native one.
+        #
+        # Adding the arch-specific directory is morally incorrect, as
+        # miniperl can't load the native modules there. However, it can
+        # (and sometimes needs to) load and run some of the pure perl
+        # code there, so we add it anyway. When needed, stubs can be put
+        # into $mini/lib/perl5/cross_perl/${version}.
+        wrapProgram $mini/bin/perl --prefix PERL5LIB : \
+          "$mini/lib/perl5/cross_perl/${version}:$out/lib/perl5/${version}:$out/lib/perl5/${version}/$runtimeArch"
+      ''; # */
+
+  meta = with lib; {
+    homepage = "https://www.perl.org/";
+    description = "The standard implementation of the Perl 5 programmming language";
+    license = licenses.artistic1;
+    maintainers = [ maintainers.eelco ];
+    platforms = platforms.all;
+    priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
+  };
+} // lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
+  crossVersion = "c876045741f5159318085d2737b0090f35a842ca"; # June 5, 2022
+
+  perl-cross-src = fetchFromGitHub {
+    name = "perl-cross-unstable-${crossVersion}";
+    owner = "arsv";
+    repo = "perl-cross";
+    rev = crossVersion;
+    sha256 = "sha256-m9UCoTQgXBxSgk9Q1Zv6wl3Qnd0aZm/jEPXkcMKti8U=";
+  };
+
+  depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
+
+  postUnpack = ''
+    unpackFile ${perl-cross-src}
+    chmod -R u+w ${perl-cross-src.name}
+    cp -R ${perl-cross-src.name}/* perl-${version}/
+  '';
+
+  configurePlatforms = [ "build" "host" "target" ];
+
+  # TODO merge setup hooks
+  setupHook = ./setup-hook-cross.sh;
+})
--- a/pkgs/development/libraries/appstream/default.nix
+++ b/pkgs/development/libraries/appstream/default.nix
@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
    itstool
    vala
    gperf
-  ] ++ lib.optional (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
    mesonEmulatorHook
  ];

--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@ -137,6 +137,9 @@ let
          GameController ImageCaptureCore LocalAuthentication
          MediaAccessibility MediaPlayer MetalKit Network OpenDirectory Quartz
          ReplayKit SecurityInterface Vision;
+        xcbuild = buildPackages.xcbuild.override {
+          productBuildVer = "20A2408";
+        };
      };
      qtwebsockets = callPackage ./modules/qtwebsockets.nix { };
      qtwebview = callPackage ./modules/qtwebview.nix {
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
@ -127,6 +127,12 @@ qtModule {
  # which cannot be set at the same time as -Wformat-security
  hardeningDisable = [ "format" ];

+  # removes macOS 12+ dependencies
+  patches = [
+    ../patches/qtwebengine-darwin-no-low-latency-flag.patch
+    ../patches/qtwebengine-darwin-no-copy-certificate-chain.patch
+  ];
+
  postPatch = ''
    # Patch Chromium build tools
    (
@ -301,7 +307,8 @@ qtModule {

  meta = with lib; {
    description = "A web engine based on the Chromium web browser";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin && stdenv.isx86_64;
    # This build takes a long time; particularly on slow architectures
    # 1 hour on 32x3.6GHz -> maybe 12 hours on 4x2.4GHz
    timeout = 24 * 3600;
--- a/pkgs/development/libraries/qt-6/patches/qtwebengine-darwin-no-copy-certificate-chain.patch
+++ b/pkgs/development/libraries/qt-6/patches/qtwebengine-darwin-no-copy-certificate-chain.patch
@ -0,0 +1,16 @@
+diff --git a/src/3rdparty/chromium/net/cert/x509_util_apple.cc b/src/3rdparty/chromium/net/cert/x509_util_apple.cc
+index ae69948dfca..7062a9a9b97 100644
+--- a/src/3rdparty/chromium/net/cert/x509_util_apple.cc
+++ b/src/3rdparty/chromium/net/cert/x509_util_apple.cc
+@@ -139,11 +139,6 @@ SHA256HashValue CalculateFingerprint256(SecCertificateRef cert) {
+ 
+ base::ScopedCFTypeRef<CFArrayRef> CertificateChainFromSecTrust(
+     SecTrustRef trust) {
+-  if (__builtin_available(macOS 12.0, iOS 15.0, *)) {
+-    return base::ScopedCFTypeRef<CFArrayRef>(
+-        SecTrustCopyCertificateChain(trust));
+-  }
+-
+   base::ScopedCFTypeRef<CFMutableArrayRef> chain(
+       CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks));
+   const CFIndex chain_length = SecTrustGetCertificateCount(trust);
--- a/pkgs/development/libraries/qt-6/patches/qtwebengine-darwin-no-low-latency-flag.patch
+++ b/pkgs/development/libraries/qt-6/patches/qtwebengine-darwin-no-low-latency-flag.patch
@ -0,0 +1,60 @@
+diff --git a/src/3rdparty/chromium/media/gpu/mac/vt_video_encode_accelerator_mac.cc b/src/3rdparty/chromium/media/gpu/mac/vt_video_encode_accelerator_mac.cc
+index 6a3a777..249d4cc 100644
+--- a/src/3rdparty/chromium/media/gpu/mac/vt_video_encode_accelerator_mac.cc
+++ b/src/3rdparty/chromium/media/gpu/mac/vt_video_encode_accelerator_mac.cc
+@@ -20,12 +20,6 @@
+ #include "media/base/media_log.h"
+ #include "media/base/video_frame.h"
+ 
+-// This is a min version of macOS where we want to support SVC encoding via
+-// EnableLowLatencyRateControl flag. The flag is actually supported since 11.3,
+-// but there we see frame drops even with ample bitrate budget. Excessive frame
+-// drops were fixed in 12.0.1.
+-#define LOW_LATENCY_FLAG_AVAILABLE_VER 12.0.1
+-
+ namespace media {
+ 
+ namespace {
+@@ -150,8 +144,6 @@ VTVideoEncodeAccelerator::GetSupportedProfiles() {
+   profile.max_framerate_numerator = kMaxFrameRateNumerator;
+   profile.max_framerate_denominator = kMaxFrameRateDenominator;
+   profile.max_resolution = gfx::Size(kMaxResolutionWidth, kMaxResolutionHeight);
+-  if (__builtin_available(macOS LOW_LATENCY_FLAG_AVAILABLE_VER, *))
+-    profile.scalability_modes.push_back(SVCScalabilityMode::kL1T2);
+   for (const auto& supported_profile : kSupportedProfiles) {
+     profile.profile = supported_profile;
+     profiles.push_back(profile);
+@@ -595,13 +587,6 @@ bool VTVideoEncodeAccelerator::CreateCompressionSession(
+       kVTVideoEncoderSpecification_RequireHardwareAcceleratedVideoEncoder};
+   std::vector<CFTypeRef> encoder_values{kCFBooleanTrue};
+ 
+-  if (__builtin_available(macOS LOW_LATENCY_FLAG_AVAILABLE_VER, *)) {
+-    if (require_low_delay_) {
+-      encoder_keys.push_back(
+-          kVTVideoEncoderSpecification_EnableLowLatencyRateControl);
+-      encoder_values.push_back(kCFBooleanTrue);
+-    }
+-  }
+   base::ScopedCFTypeRef<CFDictionaryRef> encoder_spec =
+       video_toolbox::DictionaryWithKeysAndValues(
+           encoder_keys.data(), encoder_values.data(), encoder_keys.size());
+@@ -669,19 +654,8 @@ bool VTVideoEncodeAccelerator::ConfigureCompressionSession() {
+   }
+ 
+   if (num_temporal_layers_ == 2) {
+-    if (__builtin_available(macOS LOW_LATENCY_FLAG_AVAILABLE_VER, *)) {
+-      if (!session_property_setter.IsSupported(
+-              kVTCompressionPropertyKey_BaseLayerFrameRateFraction)) {
+-        DLOG(ERROR) << "BaseLayerFrameRateFraction is not supported";
+-        return false;
+-      }
+-      rv &= session_property_setter.Set(
+-          kVTCompressionPropertyKey_BaseLayerFrameRateFraction, 0.5);
+-      DLOG_IF(ERROR, !rv) << " Setting BaseLayerFrameRate property failed.";
+-    } else {
+       DLOG(ERROR) << "SVC encoding is not supported on this OS version.";
+       rv = false;
+-    }
+   }
+ 
+   return rv;
--- a/pkgs/development/libraries/ucx/default.nix
+++ b/pkgs/development/libraries/ucx/default.nix
@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
    rdma-core
    zlib
  ] ++ lib.optional enableCuda cudatoolkit
-  ++ lib.optional enableRocm [ rocm-core rocm-runtime rocm-device-libs hip ];
+  ++ lib.optionals enableRocm [ rocm-core rocm-runtime rocm-device-libs hip ];

  configureFlags = [
    "--with-rdmacm=${rdma-core}"
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@ -274,9 +274,9 @@ let
      sha256 = "12l7ir3q29v06jx0zng5cvlbmap7p709ka3ik6x29lw334qshm9b";
    };

-    buildInputs = [
-      pkgs.makeWrapper
+    nativeBuildInputs = [ pkgs.makeWrapper ];

+    buildInputs = [
      # needed for GSETTINGS_SCHEMAS_PATH
      pkgs.gsettings-desktop-schemas pkgs.glib pkgs.gtk3

--- a/pkgs/development/mobile/androidenv/tools.nix
+++ b/pkgs/development/mobile/androidenv/tools.nix
@ -6,7 +6,9 @@ deployAndroidPackage {
  nativeBuildInputs = [ makeWrapper ]
    ++ lib.optionals (os == "linux") [ autoPatchelfHook ];
  buildInputs = lib.optional (os == "linux") (
-      (with pkgs; [ glibc freetype fontconfig fontconfig.lib])
+      (with pkgs; [ glibc freetype fontconfig fontconfig.lib
+        stdenv.cc.cc.libgcc or null # fix for https://github.com/NixOS/nixpkgs/issues/226357
+      ])
      ++ (with pkgs.xorg; [ libX11 libXrender libXext ])
      ++ (with pkgsi686Linux; [ glibc xorg.libX11 xorg.libXrender xorg.libXext fontconfig.lib freetype zlib ])
    );
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@ -44,6 +44,7 @@
  clubhouse-cli = "club";
  conventional-changelog-cli = "conventional-changelog";
  cpy-cli = "cpy";
+  diff2html-cli = "diff2html";
  dockerfile-language-server-nodejs = "docker-langserver";
  fast-cli = "fast";
  fauna-shell = "fauna";
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -120,6 +120,7 @@
 , "degit"
 , "dhcp"
 , "diagnostic-languageserver"
+, "diff2html-cli"
 , "dockerfile-language-server-nodejs"
 , "elasticdump"
 , "@electron-forge/cli"
@ -281,7 +282,7 @@
 , "reveal-md"
 , "rimraf"
 , "rollup"
-, { "rust-analyzer-build-deps": "../../applications/editors/vscode/extensions/rust-analyzer/build-deps" }
+, { "rust-analyzer-build-deps": "../../applications/editors/vscode/extensions/rust-lang.rust-analyzer/build-deps" }
 , "rtlcss"
 , "s3http"
 , "sass"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@ -176,6 +176,10 @@ final: prev: {
    '';
  };

+  firebase-tools = prev.firebase-tools.override {
+    nativeBuildInputs = lib.optionals stdenv.isDarwin  [ pkgs.xcbuild ];
+  };
+
  flood = prev.flood.override {
    buildInputs = [ final.node-pre-gyp ];
  };
@ -263,6 +267,8 @@ final: prev: {
      pixman
      cairo
      pango
+    ] ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.CoreText
    ];
  };

--- a/pkgs/development/ocaml-modules/class_group_vdf/default.nix
+++ b/pkgs/development/ocaml-modules/class_group_vdf/default.nix
@ -4,7 +4,7 @@
 , alcotest, bisect_ppx
 }:

-buildDunePackage rec {
+buildDunePackage (rec {
  pname = "class_group_vdf";
  version = "0.0.4";
  duneVersion = "3";
@ -43,8 +43,13 @@ buildDunePackage rec {
  meta = {
    description = "Verifiable Delay Functions bindings to Chia's VDF";
    homepage = "https://gitlab.com/nomadic-labs/tezos";
-    broken = stdenv.isDarwin && stdenv.isx86_64;
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.ulrikstrid ];
  };
 }
+# Darwin sdk on intel target 10.12 (2016) at the time of writing. It is likely that host will be at least 10.14 (2018). This fix allow it to build and run on 10.14 and build on 10.12 (but don't run).
+// lib.optionalAttrs (lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.14" && stdenv.hostPlatform.isMacOS && stdenv.hostPlatform.isx86_64) {
+  preHook = ''
+    export MACOSX_DEPLOYMENT_TARGET=10.14
+  '';
+})
--- a/pkgs/development/ocaml-modules/conduit/async.nix
+++ b/pkgs/development/ocaml-modules/conduit/async.nix
@ -1,4 +1,4 @@
-{ lib, buildDunePackage, async, async_ssl, ppx_sexp_conv, ppx_here, uri, conduit
+{ lib, buildDunePackage, async, async_ssl ? null, ppx_sexp_conv, ppx_here, uri, conduit
 , core, ipaddr, ipaddr-sexp, sexplib
 }:

--- a/pkgs/development/ocaml-modules/janestreet/0.12.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.12.nix
@ -377,18 +377,6 @@ with self;
    propagatedBuildInputs = [ async_extra textutils ];
  };

-  async_ssl = janePackage {
-    pname = "async_ssl";
-    hash = "02ard8x5q5c42d9jdqmyzfx624yjq8cxxmvq3zb82hf6p8cc57ml";
-    meta = {
-      description = "An Async-pipe-based interface with OpenSSL";
-      # ctypes no longer works with dune 1
-      # dune 2 no longer supports jbuild
-      broken = true;
-    };
-    propagatedBuildInputs = [ async ctypes openssl ];
-  };
-
  async_find = janePackage {
    pname = "async_find";
    hash = "0qsz9f15s5rlk6za10s810v6nlkdxg2g9p1827lcpa7nhjcpi673";
--- a/pkgs/development/ocaml-modules/janestreet/default.nix
+++ b/pkgs/development/ocaml-modules/janestreet/default.nix
@ -413,18 +413,6 @@ with self;
    meta.description = "Shell helpers for Async";
  };

-  async_ssl = janePackage {
-    pname = "async_ssl";
-    hash = "1p83fzfla4rb820irdrz3f2hp8kq5zrhw47rqmfv6qydlca1bq64";
-    propagatedBuildInputs = [ async ctypes openssl ];
-    meta = {
-      description = "Async wrappers for SSL";
-      # ctypes no longer works with dune 1
-      # dune 2 no longer supports jbuild
-      broken = true;
-    };
-  };
-
  sexp_pretty = janePackage {
    pname = "sexp_pretty";
    hash = "0xskahjggbwvvb82fn0jp1didxbgpmgks76xhwp9s3vqkhgz6918";
--- a/pkgs/development/ocaml-modules/janestreet/janePackage.nix
+++ b/pkgs/development/ocaml-modules/janestreet/janePackage.nix
@ -5,7 +5,7 @@
 buildDunePackage (args // {
  inherit version buildInputs;

-  useDune2 = false;
+  duneVersion = "1";

  minimalOCamlVersion = "4.04";

--- a/pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix
+++ b/pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix
@ -5,7 +5,7 @@
 buildDunePackage (args // {
  inherit version;

-  useDune2 = false;
+  duneVersion = "1";

  minimalOCamlVersion = "4.07";

--- a/pkgs/development/perl-modules/generic/default.nix
+++ b/pkgs/development/perl-modules/generic/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, perl, buildPerl, toPerlModule }:
+{ lib, stdenv, perl, toPerlModule }:

 { buildInputs ? []
 , nativeBuildInputs ? []
@ -43,12 +43,12 @@ lib.throwIf (attrs ? name) "buildPerlPackage: `name` (\"${attrs.name}\") is depr
    builder = ./builder.sh;

    buildInputs = buildInputs ++ [ perl ];
-    nativeBuildInputs = nativeBuildInputs ++ [ (perl.mini or perl) ];
+    nativeBuildInputs = nativeBuildInputs ++ (if stdenv.buildPlatform != stdenv.hostPlatform then [ perl.mini ] else [ perl ]);

    inherit outputs src doCheck checkTarget enableParallelBuilding;
    env = {
      inherit PERL_AUTOINSTALL AUTOMATED_TESTING PERL_USE_UNSAFE_INC;
-      fullperl = buildPerl;
+      fullperl = perl.__spliced.buildHost or perl;
    } // env;

    meta = defaultMeta // (attrs.meta or { });
--- a/pkgs/development/python-modules/invocations/default.nix
+++ b/pkgs/development/python-modules/invocations/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "invocations";
-  version = "2.6.0";
+  version = "3.0.1";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "pyinvoke";
    repo = pname;
    rev = version;
-    hash = "sha256-eyOJKVRfn7elyEkERl7hvRTNFmq7O9Pr03lBS6xp0wE=";
+    hash = "sha256-G0sl2DCROxlTnW3lWKeGw4qDmnaeRC4xYf27d6YePjE=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@ -1,131 +1,21 @@
 { lib
-, stdenv
 , buildPythonPackage
-, chromium
-, ffmpeg
 , git
 , greenlet
-, jq
-, nodejs
 , fetchFromGitHub
-, fetchurl
-, makeFontsConf
-, makeWrapper
 , pyee
 , python
 , pythonOlder
-, runCommand
 , setuptools-scm
-, unzip
+, playwright-driver
 }:

 let
-  inherit (stdenv.hostPlatform) system;
-  throwSystem = throw "Unsupported system: ${system}";
-
-  driverVersion = "1.31.1";
-
-  driver = let
-    suffix = {
-      x86_64-linux = "linux";
-      aarch64-linux = "linux-arm64";
-      x86_64-darwin = "mac";
-      aarch64-darwin = "mac-arm64";
-    }.${system} or throwSystem;
-    filename = "playwright-${driverVersion}-${suffix}.zip";
-  in stdenv.mkDerivation {
-    pname = "playwright-driver";
-    version = driverVersion;
-
-    src = fetchurl {
-      url = "https://playwright.azureedge.net/builds/driver/${filename}";
-      sha256 = {
-        x86_64-linux = "1wg49kfs8fflmx8g01bkckbjkghhwy7c44akckjf7dp4lbh1z8fd";
-        aarch64-linux = "0f09a0cxqxihy8lmbjzii80jkpf3n5xlvhjpgdkwmrr3wh0nnixj";
-        x86_64-darwin = "1zd0dz8jazymcpa1im5yzxb7rwl6wn4xz19lpz83bnpd1njq01b3";
-        aarch64-darwin = "0hcn80zm9aki8hzsf1cljzcmi4iaw7fascs8ajj0qcwqkkm4jnw0";
-      }.${system} or throwSystem;
-    };
-
-    sourceRoot = ".";
-
-    nativeBuildInputs = [ unzip ];
-
-    postPatch = ''
-      # Use Nix's NodeJS instead of the bundled one.
-      substituteInPlace playwright.sh --replace '"$SCRIPT_PATH/node"' '"${nodejs}/bin/node"'
-      rm node
-
-      # Hard-code the script path to $out directory to avoid a dependency on coreutils
-      substituteInPlace playwright.sh \
-        --replace 'SCRIPT_PATH="$(cd "$(dirname "$0")" ; pwd -P)"' "SCRIPT_PATH=$out"
-
-      patchShebangs playwright.sh package/bin/*.sh
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/bin
-      mv playwright.sh $out/bin/playwright
-      mv package $out/
-
-      runHook postInstall
-    '';
-
-    passthru = {
-      inherit filename;
-    };
-  };
-
-  browsers-mac = stdenv.mkDerivation {
-    pname = "playwright-browsers";
-    version = driverVersion;
-
-    dontUnpack = true;
-
-    installPhase = ''
-      runHook preInstall
-
-      export PLAYWRIGHT_BROWSERS_PATH=$out
-      ${driver}/bin/playwright install
-      rm -r $out/.links
-
-      runHook postInstall
-    '';
-
-    meta.platforms = lib.platforms.darwin;
-  };
-
-  browsers-linux = {}: let
-    fontconfig = makeFontsConf {
-      fontDirectories = [];
-    };
-  in runCommand "playwright-browsers"
-  {
-    nativeBuildInputs = [
-      makeWrapper
-      jq
-    ];
-  } (''
-    BROWSERS_JSON=${driver}/package/browsers.json
-    CHROMIUM_REVISION=$(jq -r '.browsers[] | select(.name == "chromium").revision' $BROWSERS_JSON)
-    mkdir -p $out/chromium-$CHROMIUM_REVISION/chrome-linux
-
-    # See here for the Chrome options:
-    # https://github.com/NixOS/nixpkgs/issues/136207#issuecomment-908637738
-    makeWrapper ${chromium}/bin/chromium $out/chromium-$CHROMIUM_REVISION/chrome-linux/chrome \
-      --set SSL_CERT_FILE /etc/ssl/certs/ca-bundle.crt \
-      --set FONTCONFIG_FILE ${fontconfig}
-
-    FFMPEG_REVISION=$(jq -r '.browsers[] | select(.name == "ffmpeg").revision' $BROWSERS_JSON)
-    mkdir -p $out/ffmpeg-$FFMPEG_REVISION
-    ln -s ${ffmpeg}/bin/ffmpeg $out/ffmpeg-$FFMPEG_REVISION/ffmpeg-linux
-  '');
+  driver = playwright-driver;
 in
 buildPythonPackage rec {
  pname = "playwright";
-  version = "1.31.1";
+  version =  "1.31.1";
  format = "setuptools";
  disabled = pythonOlder "3.7";

@ -191,18 +81,11 @@ buildPythonPackage rec {
    "playwright"
  ];

-  passthru = rec {
+  passthru = {
    inherit driver;
-    browsers = {
-      x86_64-linux = browsers-linux { };
-      aarch64-linux = browsers-linux { };
-      x86_64-darwin = browsers-mac;
-      aarch64-darwin = browsers-mac;
-    }.${system} or throwSystem;
-    browsers-chromium = browsers-linux { };
-
    tests = {
-      inherit driver browsers;
+      driver = playwright-driver;
+      browsers = playwright-driver.browsers;
    };
  };

--- a/pkgs/development/python-modules/pytest-playwright/default.nix
+++ b/pkgs/development/python-modules/pytest-playwright/default.nix
@ -2,6 +2,7 @@
 , fetchFromGitHub
 , buildPythonPackage
 , playwright
+, playwright-driver
 , pytest
 , pytest-base-url
 , pytestCheckHook
@ -46,7 +47,7 @@ buildPythonPackage rec {
  doCheck = false;

  preCheck = ''
-    export PLAYWRIGHT_BROWSERS_PATH=${playwright.browsers}
+    export PLAYWRIGHT_BROWSERS_PATH=${playwright-driver.browsers}
  '';

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/snitun/default.nix
+++ b/pkgs/development/python-modules/snitun/default.nix
@ -43,7 +43,7 @@ buildPythonPackage rec {
    "test_snitun_single_runner_throttling"
    # ConnectionResetError: [Errno 54] Connection reset by peer
    "test_peer_listener_timeout"
-  ] ++ lib.optional (pythonAtLeast "3.11") [
+  ] ++ lib.optionals (pythonAtLeast "3.11") [
    # TypeError: Passing coroutines is forbidden, use tasks explicitly.
    "test_snitun_runner_updown"
  ];
--- a/pkgs/development/python-modules/traittypes/default.nix
+++ b/pkgs/development/python-modules/traittypes/default.nix
@ -36,7 +36,7 @@ buildPythonPackage rec {

  nativeCheckInputs = [ numpy pandas xarray nose pytestCheckHook ];

-  disabledTestPaths = lib.optional (lib.versionAtLeast numpy.version "1.17") [
+  disabledTestPaths = lib.optionals (lib.versionAtLeast numpy.version "1.17") [
    # https://github.com/jupyter-widgets/traittypes/blob/master/setup.py#L86-L87
    "traittypes/tests/test_traittypes.py"
  ];
--- a/pkgs/development/tools/ameba/default.nix
+++ b/pkgs/development/tools/ameba/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, crystal }:
+{ lib, fetchFromGitHub, fetchpatch, crystal }:

 crystal.buildCrystalPackage rec {
  pname = "ameba";
@ -11,6 +11,13 @@ crystal.buildCrystalPackage rec {
    hash = "sha256-pc9mtVR/PBhM5l1PnDkm+y+McxbrfAmQzxmLi761VF4=";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/crystal-ameba/ameba/commit/c7f2cba409787a1928fbb54494b4645ec11005cc.patch";
+      hash = "sha256-tYEPke6omMdCGG2llJGXDZ3jTO4YAqpknzTPi2576UI=";
+    })
+  ];
+
  format = "make";

  meta = with lib; {
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "clj-kondo";
-  version = "2023.03.17";
+  version = "2023.04.14";

  src = fetchurl {
    url = "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-hI/0kYAQtkDSu8LE8CO6+2zDA6OOK/MdybsLQEPMkCk=";
+    sha256 = "sha256-SuhLt0FNZNRX803Doa2xT9a8n35WxDtOwxXj+dZ7YXc=";
  };

  extraNativeImageBuildArgs = [
--- a/pkgs/development/tools/continuous-integration/gitea-actions-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitea-actions-runner/default.nix
@ -1,29 +1,33 @@
-{ lib, fetchFromGitea, buildGoModule }:
+{ lib
+, fetchFromGitea
+, buildGoModule
+}:

 buildGoModule rec {
  pname = "gitea-actions-runner";
-  version = "unstable-2023-03-18";
+  version = "0.1.2";

  src = fetchFromGitea {
    domain = "gitea.com";
    owner = "gitea";
    repo = "act_runner";
-    rev = "9eb8b08a69e8b1c699c9c07a06c1ff8e5f6ad0fe";
-    sha256 = "sha256-B8vD+86X8cqZhPmDmEjHgSsq3TdJuCf9h3XgdXC7hQY=";
+    rev = "v${version}";
+    hash = "sha256-0wLBFZdFaGTselRZIJ809wHQFhAjt4sdmZp12LQOB9I=";
  };

-  vendorSha256 = "sha256-K/d/ip8icc+rjTmajsGxw5aij1VMW6wJJu4LCkKqaVQ=";
+  vendorHash = "sha256-GBqt5qSM2mDAS7klWdJiC6t5HaVKaP0PjecYnHZBzrc=";

  ldflags = [
    "-s"
    "-w"
-    "-X gitea.com/gitea/act_runner/cmd.version=${version}"
+    "-X gitea.com/gitea/act_runner/internal/pkg/ver.version=${version}"
  ];

  meta = with lib; {
    mainProgram = "act_runner";
    maintainers = with maintainers; [ techknowlogick ];
    license = licenses.mit;
+    changelog = "https://gitea.com/gitea/act_runner/releases/tag/v${version}";
    homepage = "https://gitea.com/gitea/act_runner";
    description = "A runner for Gitea based on act";
  };
--- a/pkgs/development/tools/deadnix/default.nix
+++ b/pkgs/development/tools/deadnix/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "deadnix";
-  version = "1.0.0";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "astro";
    repo = "deadnix";
    rev = "v${version}";
-    sha256 = "sha256-T8VwxHdy5KI2Kob5wYWGQOGYYJeSfWVPygIOe0PYUMY=";
+    sha256 = "sha256-vP+NGqZfGbdk/BE5OVYDQQ9ZtwuJitnBHaPmg1X6el8=";
  };

-  cargoSha256 = "sha256-0pe1zOHoNoAhCb0t8BnL7XewyoqOzVL5w3MTY8pUkUY=";
+  cargoSha256 = "sha256-jmxaowzbejimpRdwuX3q3HDbZsv5qWpQ3gApAGdR8o0=";

  meta = with lib; {
    description = "Find and remove unused code in .nix source files";
--- a/pkgs/development/tools/marksman/default.nix
+++ b/pkgs/development/tools/marksman/default.nix
@ -18,7 +18,7 @@ buildDotnetModule rec {
  };

  projectFile = "Marksman/Marksman.fsproj";
-  dotnetBuildFlags = "-p:VersionString=${version}";
+  dotnetBuildFlags = [ "-p:VersionString=${version}" ];

  doCheck = true;
  testProjectFile = "Tests/Tests.fsproj";
--- a/pkgs/development/tools/misc/pahole/default.nix
+++ b/pkgs/development/tools/misc/pahole/default.nix
@ -1,12 +1,22 @@
-{ lib, stdenv, fetchzip, pkg-config, libbpf, cmake, elfutils, zlib, argp-standalone, musl-obstack }:
+{ lib
+, stdenv
+, fetchzip
+, pkg-config
+, libbpf
+, cmake
+, elfutils
+, zlib
+, argp-standalone
+, musl-obstack
+, nixosTests
+}:

 stdenv.mkDerivation rec {
  pname = "pahole";
-  # Can switch back to release tags if they can build linux_testing.
-  version = "1.24-unstable-2023-03-02";
+  version = "1.25";
  src = fetchzip {
-    url = "https://git.kernel.org/pub/scm/devel/pahole/pahole.git/snapshot/pahole-a9498899109d3be14f17abbc322a8f55a1067bee.tar.gz";
-    sha256 = "xEKA6Fz6NaxNqSggvgswCU+7LlezGSNrK7cmt2JYv1Y=";
+    url = "https://git.kernel.org/pub/scm/devel/pahole/pahole.git/snapshot/pahole-${version}.tar.gz";
+    hash = "sha256-s0YVT2UnMSO8jS/4XCt06wNPV4czHH6bmZRy/snO3jg=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
@ -19,6 +29,10 @@ stdenv.mkDerivation rec {
  # Put libraries in "lib" subdirectory, not top level of $out
  cmakeFlags = [ "-D__LIB=lib" "-DLIBBPF_EMBEDDED=OFF" ];

+  passthru.tests = {
+    inherit (nixosTests) bpf;
+  };
+
  meta = with lib; {
    homepage = "https://git.kernel.org/pub/scm/devel/pahole/pahole.git/";
    description = "Shows, manipulates, and pretty-prints debugging information in DWARF, CTF, and BTF formats";
--- a/pkgs/development/tools/railway/default.nix
+++ b/pkgs/development/tools/railway/default.nix
@ -3,16 +3,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "railway";
-  version = "3.0.19";
+  version = "3.0.22";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-a7xrDd92/4ZRT768hOCcVzlevluGyQVTLdTfdLNQ8WI=";
+    hash = "sha256-DRmG85lf6bBRtMfZ6AZSN4NuiOEe4NgUb+6u1tToZS4=";
  };

-  cargoHash = "sha256-PuJzy0vw7yC4GctqTeAAB8Vhs8hJYXAptLr7rw69DZE=";
+  cargoHash = "sha256-IBzTeJy2tO5hw4IVuVkirf5jkEXWNn0vgMKZZCvCwBI=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.0.509";
+  version = "0.0.522";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    hash = "sha256-GVYmjRtpC9Sz1r3wLgWB7OKAc+307uXKHfD6Cek+8gE=";
+    hash = "sha256-8t5NZ8YLVA8eT/e7DKyTl1XKYq/Ve/Xih54H4jNH0/g=";
  };

-  vendorHash = "sha256-KE5dFkc4ZXmZMiWKAH3c6oLE3rtgtWDbRq5EZr3RSXE=";
+  vendorHash = "sha256-aAmhEzUbX00MarPPoz6jM2kaDUK5H8snFeCeIVt2wns=";

  subPackages = [ "." ];

--- a/pkgs/development/web/playwright/driver.nix
+++ b/pkgs/development/web/playwright/driver.nix
@ -0,0 +1,130 @@
+{ lib
+, stdenv
+, chromium
+, ffmpeg
+, git
+, jq
+, nodejs
+, fetchFromGitHub
+, fetchurl
+, makeFontsConf
+, makeWrapper
+, runCommand
+, unzip
+}:
+let
+  inherit (stdenv.hostPlatform) system;
+
+  throwSystem = throw "Unsupported system: ${system}";
+
+  driver = stdenv.mkDerivation (finalAttrs:
+    let
+      suffix = {
+        x86_64-linux = "linux";
+        aarch64-linux = "linux-arm64";
+        x86_64-darwin = "mac";
+        aarch64-darwin = "mac-arm64";
+      }.${system} or throwSystem;
+      filename = "playwright-${finalAttrs.version}-${suffix}.zip";
+    in
+    {
+    pname = "playwright-driver";
+    version =  "1.31.1";
+
+    src = fetchurl {
+      url = "https://playwright.azureedge.net/builds/driver/${filename}";
+      sha256 = {
+        x86_64-linux = "1wg49kfs8fflmx8g01bkckbjkghhwy7c44akckjf7dp4lbh1z8fd";
+        aarch64-linux = "0f09a0cxqxihy8lmbjzii80jkpf3n5xlvhjpgdkwmrr3wh0nnixj";
+        x86_64-darwin = "1zd0dz8jazymcpa1im5yzxb7rwl6wn4xz19lpz83bnpd1njq01b3";
+        aarch64-darwin = "0hcn80zm9aki8hzsf1cljzcmi4iaw7fascs8ajj0qcwqkkm4jnw0";
+      }.${system} or throwSystem;
+    };
+
+    sourceRoot = ".";
+
+    nativeBuildInputs = [ unzip ];
+
+    postPatch = ''
+      # Use Nix's NodeJS instead of the bundled one.
+      substituteInPlace playwright.sh --replace '"$SCRIPT_PATH/node"' '"${nodejs}/bin/node"'
+      rm node
+
+      # Hard-code the script path to $out directory to avoid a dependency on coreutils
+      substituteInPlace playwright.sh \
+        --replace 'SCRIPT_PATH="$(cd "$(dirname "$0")" ; pwd -P)"' "SCRIPT_PATH=$out"
+
+      patchShebangs playwright.sh package/bin/*.sh
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin
+      mv playwright.sh $out/bin/playwright
+      mv package $out/
+
+      runHook postInstall
+    '';
+
+    passthru = {
+      inherit filename;
+      browsers = {
+        x86_64-linux = browsers-linux { };
+        aarch64-linux = browsers-linux { };
+        x86_64-darwin = browsers-mac;
+        aarch64-darwin = browsers-mac;
+      }.${system} or throwSystem;
+      browsers-chromium = browsers-linux {};
+    };
+  });
+
+  browsers-mac = stdenv.mkDerivation {
+    pname = "playwright-browsers";
+    inherit (driver) version;
+
+    dontUnpack = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      export PLAYWRIGHT_BROWSERS_PATH=$out
+      ${driver}/bin/playwright install
+      rm -r $out/.links
+
+      runHook postInstall
+    '';
+
+    meta.platforms = lib.platforms.darwin;
+  };
+
+  browsers-linux = { withChromium ? true }: let
+    fontconfig = makeFontsConf {
+      fontDirectories = [];
+    };
+  in
+    runCommand ("playwright-browsers"
+    + lib.optionalString withChromium "-chromium")
+  {
+    nativeBuildInputs = [
+      makeWrapper
+      jq
+    ];
+  } (''
+    BROWSERS_JSON=${driver}/package/browsers.json
+  '' + lib.optionalString withChromium ''
+    CHROMIUM_REVISION=$(jq -r '.browsers[] | select(.name == "chromium").revision' $BROWSERS_JSON)
+    mkdir -p $out/chromium-$CHROMIUM_REVISION/chrome-linux
+
+    # See here for the Chrome options:
+    # https://github.com/NixOS/nixpkgs/issues/136207#issuecomment-908637738
+    makeWrapper ${chromium}/bin/chromium $out/chromium-$CHROMIUM_REVISION/chrome-linux/chrome \
+      --set SSL_CERT_FILE /etc/ssl/certs/ca-bundle.crt \
+      --set FONTCONFIG_FILE ${fontconfig}
+  '' + ''
+    FFMPEG_REVISION=$(jq -r '.browsers[] | select(.name == "ffmpeg").revision' $BROWSERS_JSON)
+    mkdir -p $out/ffmpeg-$FFMPEG_REVISION
+    ln -s ${ffmpeg}/bin/ffmpeg $out/ffmpeg-$FFMPEG_REVISION/ffmpeg-linux
+  '');
+in
+  driver
--- a/pkgs/development/web/postman/darwin.nix
+++ b/pkgs/development/web/postman/darwin.nix
@ -33,6 +33,11 @@ stdenvNoCC.mkDerivation {

  nativeBuildInputs = [ unzip ];

+  # Postman is notarized on macOS. Running the fixup phase will change the shell scripts embedded
+  # in the bundle, which causes the notarization check to fail on macOS 13+.
+  # See https://eclecticlight.co/2022/06/17/app-security-changes-coming-in-ventura/ for more information.
+  dontFixup = true;
+
  sourceRoot = appName;

  installPhase = ''
--- a/pkgs/os-specific/linux/ethq/default.nix
+++ b/pkgs/os-specific/linux/ethq/default.nix
@ -0,0 +1,32 @@
+{ stdenv, lib, fetchFromGitHub, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "ethq";
+  version = "0.6.2";
+
+  src = fetchFromGitHub {
+    owner = "isc-projects";
+    repo = "ethq";
+    rev = "refs/tags/v${builtins.replaceStrings ["."] ["_"] version}";
+    hash = "sha256-luvvNdH4kERAMy242kLCqlnGmfPjSjvoHa6J2J7BFi4=";
+  };
+
+  buildInputs = [ ncurses ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install -m0755 ethq $out/bin/ethq
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Ethernet NIC Queue stats viewer";
+    homepage = "https://github.com/isc-projects/ethq";
+    license = licenses.mpl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ delroth ];
+  };
+}
--- a/pkgs/os-specific/linux/freeipa/default.nix
+++ b/pkgs/os-specific/linux/freeipa/default.nix
@ -79,6 +79,7 @@ stdenv.mkDerivation rec {
    automake
    autoconf
    gettext
+    pkg-config
  ];

  buildInputs = [
@ -88,7 +89,6 @@ stdenv.mkDerivation rec {
    sasl
    curl
    xmlrpc_c
-    pkg-config
    ding-libs
    p11-kit
    python3
--- a/pkgs/servers/audiobookshelf/default.nix
+++ b/pkgs/servers/audiobookshelf/default.nix
@ -37,7 +37,7 @@ in buildNpmPackage {
  buildInputs = [ util-linux ];

  dontNpmBuild = true;
-  npmInstallFlags = "--only-production";
+  npmInstallFlags = [ "--only-production" ];
  npmDepsHash = "sha256-0PFeXiS8RSffhrocrHODNpb6d9+nbpulCW5qYIrytDI=";

  installPhase = ''
--- a/pkgs/servers/nextcloud/packages/24.json
+++ b/pkgs/servers/nextcloud/packages/24.json
@ -110,9 +110,9 @@
    ]
  },
  "news": {
-    "sha256": "0l8ps13y00hq3xh1w874f3zx73gpmi4jxd3gzwhggx1r495gxqbh",
-    "url": "https://github.com/nextcloud/news/releases/download/21.2.0-beta2/news.tar.gz",
-    "version": "21.2.0-beta2",
+    "sha256": "1zyn6rs24f5dsb4z65dzx2mdkw8gy8n3adk9dgyyd4cjjhhixhsm",
+    "url": "https://github.com/nextcloud/news/releases/download/21.2.0-beta3/news.tar.gz",
+    "version": "21.2.0-beta3",
    "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
    "homepage": "https://github.com/nextcloud/news",
    "licenses": [
--- a/pkgs/servers/nextcloud/packages/25.json
+++ b/pkgs/servers/nextcloud/packages/25.json
@ -10,9 +10,9 @@
    ]
  },
  "calendar": {
-    "sha256": "0hda62j3n2rs59d1rlnd20y20dahhkcs3zlhly7nw3s8csyd1whl",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.3.2/calendar-v4.3.2.tar.gz",
-    "version": "4.3.2",
+    "sha256": "0xhrpadzz73rdjyk4y1xm5hwc6k104rlpp9nmw08pq8phpfs12qa",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.3.3/calendar-v4.3.3.tar.gz",
+    "version": "4.3.3",
    "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 Search! Find your events at ease\n* ☑️ Tasks! See tasks with a due date directly in the calendar\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
    "homepage": "https://github.com/nextcloud/calendar/",
    "licenses": [
@ -60,9 +60,9 @@
    ]
  },
  "groupfolders": {
-    "sha256": "1khzwqlzndkcpmwcv841l0fl3bg469ify0kcdgz9i5x2l2m5b5l9",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v13.1.1/groupfolders-v13.1.1.tar.gz",
-    "version": "13.1.1",
+    "sha256": "1qvzlqislzzpz6knhdd8xnpd3psrq6xf61j25rnpsn7jd5qg5za7",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v13.1.2/groupfolders-v13.1.2.tar.gz",
+    "version": "13.1.2",
    "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.",
    "homepage": "https://github.com/nextcloud/groupfolders",
    "licenses": [
@ -100,9 +100,9 @@
    ]
  },
  "news": {
-    "sha256": "0l8ps13y00hq3xh1w874f3zx73gpmi4jxd3gzwhggx1r495gxqbh",
-    "url": "https://github.com/nextcloud/news/releases/download/21.2.0-beta2/news.tar.gz",
-    "version": "21.2.0-beta2",
+    "sha256": "1zyn6rs24f5dsb4z65dzx2mdkw8gy8n3adk9dgyyd4cjjhhixhsm",
+    "url": "https://github.com/nextcloud/news/releases/download/21.2.0-beta3/news.tar.gz",
+    "version": "21.2.0-beta3",
    "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
    "homepage": "https://github.com/nextcloud/news",
    "licenses": [
@ -140,9 +140,9 @@
    ]
  },
  "polls": {
-    "sha256": "0g5fq9ls7fvcgh0nhpsc8b6ca5vnsisqzpnyq5bcw8bmhnznzj7g",
-    "url": "https://github.com/nextcloud/polls/releases/download/v5.0.0-rc2/polls.tar.gz",
-    "version": "5.0.0-rc2",
+    "sha256": "0aqm4wq10py8s6l36yqaa5zsqk7n3wr663zw521ckir5877md86w",
+    "url": "https://github.com/nextcloud/polls/releases/download/v5.0.0/polls.tar.gz",
+    "version": "5.0.0",
    "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
    "homepage": "https://github.com/nextcloud/polls",
    "licenses": [
--- a/pkgs/servers/nextcloud/packages/26.json
+++ b/pkgs/servers/nextcloud/packages/26.json
@ -10,9 +10,9 @@
    ]
  },
  "calendar": {
-    "sha256": "0hda62j3n2rs59d1rlnd20y20dahhkcs3zlhly7nw3s8csyd1whl",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.3.2/calendar-v4.3.2.tar.gz",
-    "version": "4.3.2",
+    "sha256": "0xhrpadzz73rdjyk4y1xm5hwc6k104rlpp9nmw08pq8phpfs12qa",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.3.3/calendar-v4.3.3.tar.gz",
+    "version": "4.3.3",
    "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 Search! Find your events at ease\n* ☑️ Tasks! See tasks with a due date directly in the calendar\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
    "homepage": "https://github.com/nextcloud/calendar/",
    "licenses": [
@ -60,9 +60,9 @@
    ]
  },
  "groupfolders": {
-    "sha256": "0v54642rqlgmcncjrwf5bizj0a816l70k8ndfa68hkypbyp4yxm0",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v14.0.0/groupfolders-v14.0.0.tar.gz",
-    "version": "14.0.0",
+    "sha256": "1x471a1fsrg8n9bcmrbwjw7b6zylxick105mcd66s0fshrkyn0b5",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v14.0.1/groupfolders-v14.0.1.tar.gz",
+    "version": "14.0.1",
    "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.",
    "homepage": "https://github.com/nextcloud/groupfolders",
    "licenses": [
@ -100,9 +100,9 @@
    ]
  },
  "news": {
-    "sha256": "0l8ps13y00hq3xh1w874f3zx73gpmi4jxd3gzwhggx1r495gxqbh",
-    "url": "https://github.com/nextcloud/news/releases/download/21.2.0-beta2/news.tar.gz",
-    "version": "21.2.0-beta2",
+    "sha256": "1zyn6rs24f5dsb4z65dzx2mdkw8gy8n3adk9dgyyd4cjjhhixhsm",
+    "url": "https://github.com/nextcloud/news/releases/download/21.2.0-beta3/news.tar.gz",
+    "version": "21.2.0-beta3",
    "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
    "homepage": "https://github.com/nextcloud/news",
    "licenses": [
@ -140,9 +140,9 @@
    ]
  },
  "polls": {
-    "sha256": "0g5fq9ls7fvcgh0nhpsc8b6ca5vnsisqzpnyq5bcw8bmhnznzj7g",
-    "url": "https://github.com/nextcloud/polls/releases/download/v5.0.0-rc2/polls.tar.gz",
-    "version": "5.0.0-rc2",
+    "sha256": "0aqm4wq10py8s6l36yqaa5zsqk7n3wr663zw521ckir5877md86w",
+    "url": "https://github.com/nextcloud/polls/releases/download/v5.0.0/polls.tar.gz",
+    "version": "5.0.0",
    "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
    "homepage": "https://github.com/nextcloud/polls",
    "licenses": [
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.32.0.6918-6f393eda1";
+  version = "1.32.0.6950-8521b7d99";
  pname = "plexmediaserver";

  # Fetch the source
  src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
    url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "sha256-q8PZkPGSFnEaeudWLFBq3tL+dMe6a8YW+SyM+JwNpgA=";
+    sha256 = "sha256-bsq/8c67FlMzkoxL1cy4kg26Ue/6YPZnIm/lwXM9XpU=";
  } else fetchurl {
    url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "sha256-9rGmUk0m7tBLSo5LeQ1fv2rnmK7WQ9AVDUPU0aqXLrM=";
+    sha256 = "sha256-Yuq710mDr0aTaiaE91HDJNLCFr2Qabneux6WN8VXZ7Q=";
  };

  outputs = [ "out" "basedb" ];
--- a/pkgs/tools/networking/ivpn/default.nix
+++ b/pkgs/tools/networking/ivpn/default.nix
@ -2,17 +2,26 @@
 , fetchFromGitHub
 , lib
 , wirelesstools
+, makeWrapper
+, wireguard-tools
+, openvpn
+, obfs4
+, iproute2
+, dnscrypt-proxy2
+, iptables
+, gawk
+, util-linux
 }:

 builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
  inherit pname;
-  version = "3.10.0";
+  version = "3.10.15";

  src = fetchFromGitHub {
    owner = "ivpn";
    repo = "desktop-app";
    rev = "v${version}";
-    hash = "sha256-oX1PWIBPDcvBTxstEiN2WosiVUNXJoloppkpcABSi7Y=";
+    hash = "sha256-3yVRVM98tVjot3gIkUb/CDwmwKdOOBjBjzGL6htDtpk=";
  };

  ldflags = [
@ -31,16 +40,52 @@ builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
    homepage = "https://www.ivpn.net/apps";
    changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ urandom ];
+    maintainers = with maintainers; [ urandom ataraxiasjel ];
  };
 })) {
  ivpn = {
    modRoot = "cli";
-    vendorHash = "sha256-5FvKR1Kz91Yi/uILVFyJRnwFZSmZ5qnotXqOI4fKLbY=";
+    vendorHash = "sha256-T49AE3SUmdP3Tu9Sp5C/QryKDto/NzEqRuUQ3+aJFL0=";
  };
  ivpn-service = {
    modRoot = "daemon";
    vendorHash = "sha256-9Rk6ruMpyWtQe+90kw4F8OLq7/JcDSrG6ufkfcrS4W8=";
+    nativeBuildInputs = [ makeWrapper ];
    buildInputs = [ wirelesstools ];
+
+    patches = [ ./permissions.patch ];
+    postPatch = ''
+      substituteInPlace daemon/service/platform/platform_linux.go \
+        --replace 'openVpnBinaryPath = "/usr/sbin/openvpn"' \
+        'openVpnBinaryPath = "${openvpn}/bin/openvpn"' \
+        --replace 'routeCommand = "/sbin/ip route"' \
+        'routeCommand = "${iproute2}/bin/ip route"'
+
+      substituteInPlace daemon/netinfo/netinfo_linux.go \
+        --replace 'retErr := shell.ExecAndProcessOutput(log, outParse, "", "/sbin/ip", "route")' \
+        'retErr := shell.ExecAndProcessOutput(log, outParse, "", "${iproute2}/bin/ip", "route")'
+
+      substituteInPlace daemon/service/platform/platform_linux_release.go \
+        --replace 'installDir := "/opt/ivpn"' "installDir := \"$out\"" \
+        --replace 'obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy")' \
+        'obfsproxyStartScript = "${obfs4}/bin/obfs4proxy"' \
+        --replace 'wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick")' \
+        'wgBinaryPath = "${wireguard-tools}/bin/wg-quick"' \
+        --replace 'wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")' \
+        'wgToolBinaryPath = "${wireguard-tools}/bin/wg"' \
+        --replace 'dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")' \
+        'dnscryptproxyBinPath = "${dnscrypt-proxy2}/bin/dnscrypt-proxy"'
+    '';
+
+    postFixup = ''
+      mkdir -p $out/etc
+      cp -r $src/daemon/References/Linux/etc/* $out/etc/
+      cp -r $src/daemon/References/common/etc/* $out/etc/
+
+      patchShebangs --build $out/etc/firewall.sh $out/etc/splittun.sh $out/etc/client.down $out/etc/client.up
+
+      wrapProgram "$out/bin/ivpn-service" \
+        --suffix PATH : ${lib.makeBinPath [ iptables gawk util-linux ]}
+    '';
  };
 }
--- a/pkgs/tools/networking/ivpn/permissions.patch
+++ b/pkgs/tools/networking/ivpn/permissions.patch
@ -0,0 +1,27 @@
+diff --git a/daemon/service/platform/platform.go b/daemon/service/platform/platform.go
+index 941a99a7..df821c4d 100644
+--- a/daemon/service/platform/platform.go
+++ b/daemon/service/platform/platform.go
+@@ -111,12 +111,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
+ 	}
+
+ 	// checking file permissions
+-	if err := checkFileAccessRightsStaticConfig("openvpnCaKeyFile", openvpnCaKeyFile); err != nil {
+-		errors = append(errors, err)
+-	}
+-	if err := checkFileAccessRightsStaticConfig("openvpnTaKeyFile", openvpnTaKeyFile); err != nil {
+-		errors = append(errors, err)
+-	}
+
+ 	if len(openvpnUpScript) > 0 {
+ 		if err := checkFileAccessRightsExecutable("openvpnUpScript", openvpnUpScript); err != nil {
+@@ -149,9 +143,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
+ 	if err := checkFileAccessRightsExecutable("dnscryptproxyBinPath", dnscryptproxyBinPath); err != nil {
+ 		errors = append(errors, err)
+ 	}
+-	if err := checkFileAccessRightsStaticConfig("dnscryptproxyConfigTemplate", dnscryptproxyConfigTemplate); err != nil {
+-		errors = append(errors, err)
+-	}
+
+ 	if len(routeCommand) > 0 {
+ 		routeBinary := strings.Split(routeCommand, " ")[0]
--- a/pkgs/tools/networking/openapi-generator-cli/default.nix
+++ b/pkgs/tools/networking/openapi-generator-cli/default.nix
@ -1,7 +1,7 @@
 { callPackage, lib, stdenv, fetchurl, jre, makeWrapper }:

 let this = stdenv.mkDerivation rec {
-  version = "6.4.0";
+  version = "6.5.0";
  pname = "openapi-generator-cli";

  jarfilename = "${pname}-${version}.jar";
@ -12,7 +12,7 @@ let this = stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://maven/org/openapitools/${pname}/${version}/${jarfilename}";
-    sha256 = "sha256-Na6tMA4MlGn72dMM9G9BU4l9yygpEgkcpOySEtzp0VE=";
+    sha256 = "sha256-8Y13HpjyxbsWnR0ZYd5PlIZtKQGrweFhd91+kpmDRyE=";
  };

  dontUnpack = true;
--- a/pkgs/tools/system/monit/default.nix
+++ b/pkgs/tools/system/monit/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ bison flex ] ++
-    lib.optional stdenv.hostPlatform.isDarwin [
+    lib.optionals stdenv.hostPlatform.isDarwin [
      darwin.apple_sdk.frameworks.DiskArbitration
    ];

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1502,6 +1502,8 @@ with pkgs;

  elkhound = callPackage ../development/tools/elkhound { };

+  ethq = callPackage ../os-specific/linux/ethq { };
+
  weidu = callPackage ../tools/games/weidu { };

  weylus = callPackage ../applications/graphics/weylus  {
@ -11149,6 +11151,8 @@ with pkgs;

  playwright = with python3Packages; toPythonApplication playwright;

+  playwright-driver = callPackage ../development/web/playwright/driver.nix { };
+
  please = callPackage ../tools/security/please { };

  plecost = callPackage ../tools/security/plecost { };
@ -14553,7 +14557,13 @@ with pkgs;
    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
  })
    crystal_1_2
-    crystal_1_7
+    crystal_1_7;
+
+  inherit (callPackages ../development/compilers/crystal {
+    llvmPackages = llvmPackages_15;
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
+  })
+    crystal_1_8
    crystal;

  crystal2nix = callPackage ../development/compilers/crystal2nix { };
@ -24635,7 +24645,7 @@ with pkgs;

  ### DEVELOPMENT / PERL MODULES

-  perlInterpreters = callPackages ../development/interpreters/perl { };
+  perlInterpreters = import ../development/interpreters/perl { inherit callPackage; };
  inherit (perlInterpreters) perl534 perl536 perldevel;

  perl534Packages = recurseIntoAttrs perl534.pkgs;
@ -32689,7 +32699,7 @@ with pkgs;
  wrapOBS = callPackage ../applications/video/obs-studio/wrapper.nix { };

  obsidian = callPackage ../applications/misc/obsidian {
-    electron = electron_21;
+    electron = electron_24;
  };

  octoprint = callPackage ../applications/misc/octoprint { };
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -8,22 +8,23 @@
 { config
 , stdenv, lib, buildPackages, pkgs, darwin
 , fetchurl, fetchpatch, fetchFromGitHub, fetchFromGitLab
-, perl, overrides, buildPerl, shortenPerlShebang
+, perl, shortenPerlShebang
 , nixosTests
 }:

+self:
+
 # cpan2nix assumes that perl-packages.nix will be used only with perl 5.30.3 or above
 assert lib.versionAtLeast perl.version "5.30.3";
 let
  inherit (lib) maintainers teams;
-  self = _self // (overrides pkgs);
-  _self = with self; {
+
+in
+with self; {

  inherit perl;
  perlPackages = self;

-  callPackage = pkgs.newScope self;
-
  # Check whether a derivation provides a perl module.
  hasPerlModule = drv: drv ? perlModule ;

@ -41,9 +42,7 @@ let
      };
    });

-  buildPerlPackage = callPackage ../development/perl-modules/generic {
-    inherit buildPerl;
-  };
+  buildPerlPackage = callPackage ../development/perl-modules/generic { };

  # Helper functions for packages that use Module::Build to build.
  buildPerlModule = args:
@ -23069,8 +23068,8 @@ let

    # use native libraries from the host when running build commands
    postConfigure = lib.optionalString cross (let
-      host_perl = buildPerl;
-      host_self = buildPerl.pkgs.TermReadKey;
+      host_perl = perl.perlOnBuild;
+      host_self = perl.perlOnBuild.pkgs.TermReadKey;
      perl_lib = "${host_perl}/lib/perl5/${host_perl.version}";
      self_lib = "${host_self}/lib/perl5/site_perl/${host_perl.version}";
    in ''
@ -23079,7 +23078,7 @@ let

    # TermReadKey uses itself in the build process
    nativeBuildInputs = lib.optionals cross [
-      buildPerl.pkgs.TermReadKey
+      perl.perlOnBuild.pkgs.TermReadKey
    ];
    meta = {
      description = "A perl module for simple terminal control";
@ -28025,4 +28024,4 @@ let
  version = self.Version;

  Gtk2GladeXML = throw "Gtk2GladeXML has been removed"; # 2022-01-15
-}; in self
+}
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -7408,9 +7408,7 @@ self: super: with self; {

  pkuseg = callPackage ../development/python-modules/pkuseg { };

-  playwright = callPackage ../development/python-modules/playwright {
-    inherit (pkgs) jq;
-  };
+  playwright = callPackage ../development/python-modules/playwright { };

  pmsensor = callPackage ../development/python-modules/pmsensor { };