Merge master into haskell-updates

2023-05-17 00:13:32 +00:00 · 2023-05-17 00:13:32 +00:00 · a6602dd647
commit a6602dd647
parent a5387f5bec 541397177b
211 changed files with 10770 additions and 1338 deletions
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -152,6 +152,7 @@ with lib.maintainers; {
  cuda = {
    members = [
      connorbaker
+      samuela
      SomeoneSerge
    ];
    scope = "Maintain CUDA-enabled packages";
@ -522,6 +523,7 @@ with lib.maintainers; {

  mate = {
    members = [
+      bobby285271
      j03
      romildo
    ];
@ -828,6 +830,7 @@ with lib.maintainers; {

  xfce = {
    members = [
+      bobby285271
      romildo
      muscaln
    ];
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -158,6 +158,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [ivpn](https://www.ivpn.net/), a secure, private VPN with fast WireGuard connections. Available as [services.ivpn](#opt-services.ivpn.enable).

+- [openvscode-server](https://github.com/gitpod-io/openvscode-server), run VS Code on a remote machine with access through a modern web browser from any device, anywhere. Available as [services.openvscode-server](#opt-services.openvscode-server.enable).
+
 ## Backward Incompatibilities {#sec-release-23.05-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1214,6 +1214,7 @@
  ./services/web-apps/nifi.nix
  ./services/web-apps/node-red.nix
  ./services/web-apps/onlyoffice.nix
+  ./services/web-apps/openvscode-server.nix
  ./services/web-apps/openwebrx.nix
  ./services/web-apps/outline.nix
  ./services/web-apps/peering-manager.nix
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@ -7,25 +7,20 @@ let
  opt = options.services.syncthing;
  defaultUser = "syncthing";
  defaultGroup = defaultUser;
+  settingsFormat = pkgs.formats.json { };

-  devices = mapAttrsToList (name: device: {
+  devices = mapAttrsToList (_: device: device // {
    deviceID = device.id;
-    inherit (device) name addresses introducer autoAcceptFolders;
-  }) cfg.devices;
+  }) cfg.settings.devices;

-  folders = mapAttrsToList ( _: folder: {
-    inherit (folder) path id label type;
-    devices = map (device: { deviceId = cfg.devices.${device}.id; }) folder.devices;
-    rescanIntervalS = folder.rescanInterval;
-    fsWatcherEnabled = folder.watch;
-    fsWatcherDelayS = folder.watchDelay;
-    ignorePerms = folder.ignorePerms;
-    ignoreDelete = folder.ignoreDelete;
-    versioning = folder.versioning;
-  }) (filterAttrs (
-    _: folder:
-    folder.enable
-  ) cfg.folders);
+  folders = mapAttrsToList (_: folder: folder // {
+    devices = map (device:
+      if builtins.isString device then
+        { deviceId = cfg.settings.devices.${device}.id; }
+      else
+        device
+    ) folder.devices;
+  }) cfg.settings.folders;

  updateConfig = pkgs.writers.writeDash "merge-syncthing-config" ''
    set -efu
@ -54,10 +49,10 @@ let
    old_cfg=$(curl ${cfg.guiAddress}/rest/config)

    # generate the new config by merging with the NixOS config options
-    new_cfg=$(printf '%s\n' "$old_cfg" | ${pkgs.jq}/bin/jq -c '. * {
-        "devices": (${builtins.toJSON devices}${optionalString (cfg.devices == {} || ! cfg.overrideDevices) " + .devices"}),
-        "folders": (${builtins.toJSON folders}${optionalString (cfg.folders == {} || ! cfg.overrideFolders) " + .folders"})
-    } * ${builtins.toJSON cfg.extraOptions}')
+    new_cfg=$(printf '%s\n' "$old_cfg" | ${pkgs.jq}/bin/jq -c ${escapeShellArg ''. * ${builtins.toJSON cfg.settings} * {
+        "devices": (${builtins.toJSON devices}${optionalString (cfg.settings.devices == {} || ! cfg.overrideDevices) " + .devices"}),
+        "folders": (${builtins.toJSON folders}${optionalString (cfg.settings.folders == {} || ! cfg.overrideFolders) " + .folders"})
+    }''})

    # send the new config
    curl -X PUT -d "$new_cfg" ${cfg.guiAddress}/rest/config
@ -99,287 +94,282 @@ in {
        default = true;
        description = mdDoc ''
          Whether to delete the devices which are not configured via the
-          [devices](#opt-services.syncthing.devices) option.
+          [devices](#opt-services.syncthing.settings.devices) option.
          If set to `false`, devices added via the web
          interface will persist and will have to be deleted manually.
        '';
      };

-      devices = mkOption {
-        default = {};
-        description = mdDoc ''
-          Peers/devices which Syncthing should communicate with.
-
-          Note that you can still add devices manually, but those changes
-          will be reverted on restart if [overrideDevices](#opt-services.syncthing.overrideDevices)
-          is enabled.
-        '';
-        example = {
-          bigbox = {
-            id = "7CFNTQM-IMTJBHJ-3UWRDIU-ZGQJFR6-VCXZ3NB-XUH3KZO-N52ITXR-LAIYUAU";
-            addresses = [ "tcp://192.168.0.10:51820" ];
-          };
-        };
-        type = types.attrsOf (types.submodule ({ name, ... }: {
-          options = {
-
-            name = mkOption {
-              type = types.str;
-              default = name;
-              description = lib.mdDoc ''
-                The name of the device.
-              '';
-            };
-
-            addresses = mkOption {
-              type = types.listOf types.str;
-              default = [];
-              description = lib.mdDoc ''
-                The addresses used to connect to the device.
-                If this is left empty, dynamic configuration is attempted.
-              '';
-            };
-
-            id = mkOption {
-              type = types.str;
-              description = mdDoc ''
-                The device ID. See <https://docs.syncthing.net/dev/device-ids.html>.
-              '';
-            };
-
-            introducer = mkOption {
-              type = types.bool;
-              default = false;
-              description = mdDoc ''
-                Whether the device should act as an introducer and be allowed
-                to add folders on this computer.
-                See <https://docs.syncthing.net/users/introducer.html>.
-              '';
-            };
-
-            autoAcceptFolders = mkOption {
-              type = types.bool;
-              default = false;
-              description = mdDoc ''
-                Automatically create or share folders that this device advertises at the default path.
-                See <https://docs.syncthing.net/users/config.html?highlight=autoaccept#config-file-format>.
-              '';
-            };
-
-          };
-        }));
-      };
-
      overrideFolders = mkOption {
        type = types.bool;
        default = true;
        description = mdDoc ''
          Whether to delete the folders which are not configured via the
-          [folders](#opt-services.syncthing.folders) option.
+          [folders](#opt-services.syncthing.settings.folders) option.
          If set to `false`, folders added via the web
          interface will persist and will have to be deleted manually.
        '';
      };

-      folders = mkOption {
-        default = {};
-        description = mdDoc ''
-          Folders which should be shared by Syncthing.
-
-          Note that you can still add folders manually, but those changes
-          will be reverted on restart if [overrideFolders](#opt-services.syncthing.overrideFolders)
-          is enabled.
-        '';
-        example = literalExpression ''
-          {
-            "/home/user/sync" = {
-              id = "syncme";
-              devices = [ "bigbox" ];
-            };
-          }
-        '';
-        type = types.attrsOf (types.submodule ({ name, ... }: {
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = settingsFormat.type;
          options = {
-
-            enable = mkOption {
-              type = types.bool;
-              default = true;
-              description = lib.mdDoc ''
-                Whether to share this folder.
-                This option is useful when you want to define all folders
-                in one place, but not every machine should share all folders.
-              '';
-            };
-
-            path = mkOption {
-              # TODO for release 23.05: allow relative paths again and set
-              # working directory to cfg.dataDir
-              type = types.str // {
-                check = x: types.str.check x && (substring 0 1 x == "/" || substring 0 2 x == "~/");
-                description = types.str.description + " starting with / or ~/";
-              };
-              default = name;
-              description = lib.mdDoc ''
-                The path to the folder which should be shared.
-                Only absolute paths (starting with `/`) and paths relative to
-                the [user](#opt-services.syncthing.user)'s home directory
-                (starting with `~/`) are allowed.
-              '';
-            };
-
-            id = mkOption {
-              type = types.str;
-              default = name;
-              description = lib.mdDoc ''
-                The ID of the folder. Must be the same on all devices.
-              '';
-            };
-
-            label = mkOption {
-              type = types.str;
-              default = name;
-              description = lib.mdDoc ''
-                The label of the folder.
-              '';
-            };
-
-            devices = mkOption {
-              type = types.listOf types.str;
-              default = [];
+            # global options
+            options = mkOption {
+              default = {};
              description = mdDoc ''
-                The devices this folder should be shared with. Each device must
-                be defined in the [devices](#opt-services.syncthing.devices) option.
+                The options element contains all other global configuration options
              '';
-            };
-
-            versioning = mkOption {
-              default = null;
-              description = mdDoc ''
-                How to keep changed/deleted files with Syncthing.
-                There are 4 different types of versioning with different parameters.
-                See <https://docs.syncthing.net/users/versioning.html>.
-              '';
-              example = literalExpression ''
-                [
-                  {
-                    versioning = {
-                      type = "simple";
-                      params.keep = "10";
-                    };
-                  }
-                  {
-                    versioning = {
-                      type = "trashcan";
-                      params.cleanoutDays = "1000";
-                    };
-                  }
-                  {
-                    versioning = {
-                      type = "staggered";
-                      fsPath = "/syncthing/backup";
-                      params = {
-                        cleanInterval = "3600";
-                        maxAge = "31536000";
-                      };
-                    };
-                  }
-                  {
-                    versioning = {
-                      type = "external";
-                      params.versionsPath = pkgs.writers.writeBash "backup" '''
-                        folderpath="$1"
-                        filepath="$2"
-                        rm -rf "$folderpath/$filepath"
-                      ''';
-                    };
-                  }
-                ]
-              '';
-              type = with types; nullOr (submodule {
+              type = types.attrsOf (types.submodule ({ name, ... }: {
+                freeformType = settingsFormat.type;
                options = {
-                  type = mkOption {
-                    type = enum [ "external" "simple" "staggered" "trashcan" ];
-                    description = mdDoc ''
-                      The type of versioning.
-                      See <https://docs.syncthing.net/users/versioning.html>.
+
+                  localAnnounceEnabled = mkOption {
+                    type = types.bool;
+                    default = true;
+                    description = lib.mdDoc ''
+                      Whether to send announcements to the local LAN, also use such announcements to find other devices.
                    '';
                  };
-                  fsPath = mkOption {
-                    default = "";
-                    type = either str path;
-                    description = mdDoc ''
-                      Path to the versioning folder.
-                      See <https://docs.syncthing.net/users/versioning.html>.
+
+                  localAnnouncePort = mkOption {
+                    type = types.int;
+                    default = 21027;
+                    description = lib.mdDoc ''
+                      The port on which to listen and send IPv4 broadcast announcements to.
                    '';
                  };
-                  params = mkOption {
-                    type = attrsOf (either str path);
-                    description = mdDoc ''
-                      The parameters for versioning. Structure depends on
-                      [versioning.type](#opt-services.syncthing.folders._name_.versioning.type).
-                      See <https://docs.syncthing.net/users/versioning.html>.
+
+                  relaysEnabled = mkOption {
+                    type = types.bool;
+                    default = true;
+                    description = lib.mdDoc ''
+                      When true, relays will be connected to and potentially used for device to device connections.
+                    '';
+                  };
+
+                  urAccepted = mkOption {
+                    type = types.int;
+                    default = 0;
+                    description = lib.mdDoc ''
+                      Whether the user has accepted to submit anonymous usage data.
+                      The default, 0, mean the user has not made a choice, and Syncthing will ask at some point in the future.
+                      "-1" means no, a number above zero means that that version of usage reporting has been accepted.
+                    '';
+                  };
+
+                  limitBandwidthInLan = mkOption {
+                    type = types.bool;
+                    default = false;
+                    description = lib.mdDoc ''
+                      Whether to apply bandwidth limits to devices in the same broadcast domain as the local device.
+                    '';
+                  };
+
+                  maxFolderConcurrency = mkOption {
+                    type = types.int;
+                    default = 0;
+                    description = lib.mdDoc ''
+                      This option controls how many folders may concurrently be in I/O-intensive operations such as syncing or scanning.
+                      The mechanism is described in detail in a [separate chapter](https://docs.syncthing.net/advanced/option-max-concurrency.html).
                    '';
                  };
                };
-              });
+              }));
            };

-            rescanInterval = mkOption {
-              type = types.int;
-              default = 3600;
-              description = lib.mdDoc ''
-                How often the folder should be rescanned for changes.
-              '';
-            };
-
-            type = mkOption {
-              type = types.enum [ "sendreceive" "sendonly" "receiveonly" "receiveencrypted" ];
-              default = "sendreceive";
-              description = lib.mdDoc ''
-                Whether to only send changes for this folder, only receive them
-                or both. `receiveencrypted` can be used for untrusted devices. See
-                <https://docs.syncthing.net/users/untrusted.html> for reference.
-              '';
-            };
-
-            watch = mkOption {
-              type = types.bool;
-              default = true;
-              description = lib.mdDoc ''
-                Whether the folder should be watched for changes by inotify.
-              '';
-            };
-
-            watchDelay = mkOption {
-              type = types.int;
-              default = 10;
-              description = lib.mdDoc ''
-                The delay after an inotify event is triggered.
-              '';
-            };
-
-            ignorePerms = mkOption {
-              type = types.bool;
-              default = true;
-              description = lib.mdDoc ''
-                Whether to ignore permission changes.
-              '';
-            };
-
-            ignoreDelete = mkOption {
-              type = types.bool;
-              default = false;
+            # device settings
+            devices = mkOption {
+              default = {};
              description = mdDoc ''
-                Whether to skip deleting files that are deleted by peers.
-                See <https://docs.syncthing.net/advanced/folder-ignoredelete.html>.
-              '';
-            };
-          };
-        }));
-      };
+                Peers/devices which Syncthing should communicate with.

-      extraOptions = mkOption {
-        type = types.addCheck (pkgs.formats.json {}).type isAttrs;
+                Note that you can still add devices manually, but those changes
+                will be reverted on restart if [overrideDevices](#opt-services.syncthing.overrideDevices)
+                is enabled.
+              '';
+              example = {
+                bigbox = {
+                  id = "7CFNTQM-IMTJBHJ-3UWRDIU-ZGQJFR6-VCXZ3NB-XUH3KZO-N52ITXR-LAIYUAU";
+                  addresses = [ "tcp://192.168.0.10:51820" ];
+                };
+              };
+              type = types.attrsOf (types.submodule ({ name, ... }: {
+                freeformType = settingsFormat.type;
+                options = {
+
+                  name = mkOption {
+                    type = types.str;
+                    default = name;
+                    description = lib.mdDoc ''
+                      The name of the device.
+                    '';
+                  };
+
+                  id = mkOption {
+                    type = types.str;
+                    description = mdDoc ''
+                      The device ID. See <https://docs.syncthing.net/dev/device-ids.html>.
+                    '';
+                  };
+
+                  autoAcceptFolders = mkOption {
+                    type = types.bool;
+                    default = false;
+                    description = mdDoc ''
+                      Automatically create or share folders that this device advertises at the default path.
+                      See <https://docs.syncthing.net/users/config.html?highlight=autoaccept#config-file-format>.
+                    '';
+                  };
+
+                };
+              }));
+            };
+
+            # folder settings
+            folders = mkOption {
+              default = {};
+              description = mdDoc ''
+                Folders which should be shared by Syncthing.
+
+                Note that you can still add folders manually, but those changes
+                will be reverted on restart if [overrideFolders](#opt-services.syncthing.overrideFolders)
+                is enabled.
+              '';
+              example = literalExpression ''
+                {
+                  "/home/user/sync" = {
+                    id = "syncme";
+                    devices = [ "bigbox" ];
+                  };
+                }
+              '';
+              type = types.attrsOf (types.submodule ({ name, ... }: {
+                freeformType = settingsFormat.type;
+                options = {
+
+                  enable = mkOption {
+                    type = types.bool;
+                    default = true;
+                    description = lib.mdDoc ''
+                      Whether to share this folder.
+                      This option is useful when you want to define all folders
+                      in one place, but not every machine should share all folders.
+                    '';
+                  };
+
+                  path = mkOption {
+                    # TODO for release 23.05: allow relative paths again and set
+                    # working directory to cfg.dataDir
+                    type = types.str // {
+                      check = x: types.str.check x && (substring 0 1 x == "/" || substring 0 2 x == "~/");
+                      description = types.str.description + " starting with / or ~/";
+                    };
+                    default = name;
+                    description = lib.mdDoc ''
+                      The path to the folder which should be shared.
+                      Only absolute paths (starting with `/`) and paths relative to
+                      the [user](#opt-services.syncthing.user)'s home directory
+                      (starting with `~/`) are allowed.
+                    '';
+                  };
+
+                  id = mkOption {
+                    type = types.str;
+                    default = name;
+                    description = lib.mdDoc ''
+                      The ID of the folder. Must be the same on all devices.
+                    '';
+                  };
+
+                  label = mkOption {
+                    type = types.str;
+                    default = name;
+                    description = lib.mdDoc ''
+                      The label of the folder.
+                    '';
+                  };
+
+                  devices = mkOption {
+                    type = types.listOf types.str;
+                    default = [];
+                    description = mdDoc ''
+                      The devices this folder should be shared with. Each device must
+                      be defined in the [devices](#opt-services.syncthing.settings.devices) option.
+                    '';
+                  };
+
+                  versioning = mkOption {
+                    default = null;
+                    description = mdDoc ''
+                      How to keep changed/deleted files with Syncthing.
+                      There are 4 different types of versioning with different parameters.
+                      See <https://docs.syncthing.net/users/versioning.html>.
+                    '';
+                    example = literalExpression ''
+                      [
+                        {
+                          versioning = {
+                            type = "simple";
+                            params.keep = "10";
+                          };
+                        }
+                        {
+                          versioning = {
+                            type = "trashcan";
+                            params.cleanoutDays = "1000";
+                          };
+                        }
+                        {
+                          versioning = {
+                            type = "staggered";
+                            fsPath = "/syncthing/backup";
+                            params = {
+                              cleanInterval = "3600";
+                              maxAge = "31536000";
+                            };
+                          };
+                        }
+                        {
+                          versioning = {
+                            type = "external";
+                            params.versionsPath = pkgs.writers.writeBash "backup" '''
+                              folderpath="$1"
+                              filepath="$2"
+                              rm -rf "$folderpath/$filepath"
+                            ''';
+                          };
+                        }
+                      ]
+                    '';
+                    type = with types; nullOr (submodule {
+                      options = {
+                        type = mkOption {
+                          type = enum [ "external" "simple" "staggered" "trashcan" ];
+                          description = mdDoc ''
+                            The type of versioning.
+                            See <https://docs.syncthing.net/users/versioning.html>.
+                          '';
+                        };
+                      };
+                    });
+                  };
+
+                  copyOwnershipFromParent = mkOption {
+                    type = types.bool;
+                    default = false;
+                    description = mdDoc ''
+                      On Unix systems, tries to copy file/folder ownership from the parent directory (the directory it’s located in).
+                      Requires running Syncthing as a privileged user, or granting it additional capabilities (e.g. CAP_CHOWN on Linux).
+                    '';
+                  };
+                };
+              }));
+            };
+
+          };
+        };
        default = {};
        description = mdDoc ''
          Extra configuration options for Syncthing.
@ -530,6 +520,10 @@ in {
      This option was removed because Syncthing now has the inotify functionality included under the name "fswatcher".
      It can be enabled on a per-folder basis through the web interface.
    '')
+    (mkRenamedOptionModule [ "services" "syncthing" "extraOptions" ] [ "services" "syncthing" "settings" ])
+    (mkRenamedOptionModule [ "services" "syncthing" "folders" ] [ "services" "syncthing" "settings" "folders" ])
+    (mkRenamedOptionModule [ "services" "syncthing" "devices" ] [ "services" "syncthing" "settings" "devices" ])
+    (mkRenamedOptionModule [ "services" "syncthing" "options" ] [ "services" "syncthing" "settings" "options" ])
  ] ++ map (o:
    mkRenamedOptionModule [ "services" "syncthing" "declarative" o ] [ "services" "syncthing" o ]
  ) [ "cert" "key" "devices" "folders" "overrideDevices" "overrideFolders" "extraOptions"];
@ -616,7 +610,7 @@ in {
        };
      };
      syncthing-init = mkIf (
-        cfg.devices != {} || cfg.folders != {} || cfg.extraOptions != {}
+        cfg.settings.devices != {} || cfg.folders != {} || cfg.extraOptions != {}
      ) {
        description = "Syncthing configuration updater";
        requisite = [ "syncthing.service" ];
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@ -170,10 +170,22 @@ let

  # peer options

-  peerOpts = {
+  peerOpts = self: {

    options = {

+      name = mkOption {
+        default =
+          replaceStrings
+            [ "/" "-"     " "     "+"     "="     ]
+            [ "-" "\\x2d" "\\x20" "\\x2b" "\\x3d" ]
+            self.config.publicKey;
+        defaultText = literalExpression "publicKey";
+        example = "bernd";
+        type = types.str;
+        description = lib.mdDoc "Name used to derive peer unit name.";
+      };
+
      publicKey = mkOption {
        example = "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=";
        type = types.singleLineStr;
@ -313,15 +325,11 @@ let
        '';
      };

-  peerUnitServiceName = interfaceName: publicKey: dynamicRefreshEnabled:
+  peerUnitServiceName = interfaceName: peerName: dynamicRefreshEnabled:
    let
-      keyToUnitName = replaceStrings
-        [ "/" "-"    " "     "+"     "="      ]
-        [ "-" "\\x2d" "\\x20" "\\x2b" "\\x3d" ];
-      unitName = keyToUnitName publicKey;
      refreshSuffix = optionalString dynamicRefreshEnabled "-refresh";
    in
-      "wireguard-${interfaceName}-peer-${unitName}${refreshSuffix}";
+      "wireguard-${interfaceName}-peer-${peerName}${refreshSuffix}";

  generatePeerUnit = { interfaceName, interfaceCfg, peer }:
    let
@ -337,10 +345,11 @@ let
      # We generate a different name (a `-refresh` suffix) when `dynamicEndpointRefreshSeconds`
      # to avoid that the same service switches `Type` (`oneshot` vs `simple`),
      # with the intent to make scripting more obvious.
-      serviceName = peerUnitServiceName interfaceName peer.publicKey dynamicRefreshEnabled;
+      serviceName = peerUnitServiceName interfaceName peer.name dynamicRefreshEnabled;
    in nameValuePair serviceName
      {
-        description = "WireGuard Peer - ${interfaceName} - ${peer.publicKey}";
+        description = "WireGuard Peer - ${interfaceName} - ${peer.name}"
+          + optionalString (peer.name != peer.publicKey) " (${peer.publicKey})";
        requires = [ "wireguard-${interfaceName}.service" ];
        wants = [ "network-online.target" ];
        after = [ "wireguard-${interfaceName}.service" "network-online.target" ];
@ -418,7 +427,7 @@ let
  # the target is required to start new peer units when they are added
  generateInterfaceTarget = name: values:
    let
-      mkPeerUnit = peer: (peerUnitServiceName name peer.publicKey (peer.dynamicEndpointRefreshSeconds != 0)) + ".service";
+      mkPeerUnit = peer: (peerUnitServiceName name peer.name (peer.dynamicEndpointRefreshSeconds != 0)) + ".service";
    in
    nameValuePair "wireguard-${name}"
      rec {
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@ -588,11 +588,12 @@ in {
        '';
      }
      {
-        assertion = 1 == builtins.length
-          (lib.mapAttrsToList
-            (_: v: builtins.elem "scheduler" v.jobClasses || v.jobClasses == [ ])
-            cfg.sidekiqProcesses);
-        message = "There must be one and only one Sidekiq queue in services.mastodon.sidekiqProcesses with jobClass \"scheduler\".";
+        assertion = 1 ==
+          (lib.count (x: x)
+            (lib.mapAttrsToList
+              (_: v: builtins.elem "scheduler" v.jobClasses || v.jobClasses == [ ])
+              cfg.sidekiqProcesses));
+        message = "There must be exactly one Sidekiq queue in services.mastodon.sidekiqProcesses with jobClass \"scheduler\".";
      }
    ];

--- a/nixos/modules/services/web-apps/openvscode-server.nix
+++ b/nixos/modules/services/web-apps/openvscode-server.nix
@ -0,0 +1,211 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.openvscode-server;
+  defaultUser = "openvscode-server";
+  defaultGroup = defaultUser;
+in {
+  options = {
+    services.openvscode-server = {
+      enable = lib.mkEnableOption (lib.mdDoc "openvscode-server");
+
+      package = lib.mkPackageOptionMD pkgs "openvscode-server" { };
+
+      extraPackages = lib.mkOption {
+        default = [ ];
+        description = lib.mdDoc ''
+          Additional packages to add to the openvscode-server {env}`PATH`.
+        '';
+        example = lib.literalExpression "[ pkgs.go ]";
+        type = lib.types.listOf lib.types.package;
+      };
+
+      extraEnvironment = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        description = lib.mdDoc ''
+          Additional environment variables to pass to openvscode-server.
+        '';
+        default = { };
+        example = { PKG_CONFIG_PATH = "/run/current-system/sw/lib/pkgconfig"; };
+      };
+
+      extraArguments = lib.mkOption {
+        default = [ ];
+        description = lib.mdDoc ''
+          Additional arguments to pass to openvscode-server.
+        '';
+        example = lib.literalExpression ''[ "--log=info" ]'';
+        type = lib.types.listOf lib.types.str;
+      };
+
+      host = lib.mkOption {
+        default = "localhost";
+        description = lib.mdDoc ''
+          The host name or IP address the server should listen to.
+        '';
+        type = lib.types.str;
+      };
+
+      port = lib.mkOption {
+        default = 3000;
+        description = lib.mdDoc ''
+          The port the server should listen to. If 0 is passed a random free port is picked. If a range in the format num-num is passed, a free port from the range (end inclusive) is selected.
+        '';
+        type = lib.types.port;
+      };
+
+      user = lib.mkOption {
+        default = defaultUser;
+        example = "yourUser";
+        description = lib.mdDoc ''
+          The user to run openvscode-server as.
+          By default, a user named `${defaultUser}` will be created.
+        '';
+        type = lib.types.str;
+      };
+
+      group = lib.mkOption {
+        default = defaultGroup;
+        example = "yourGroup";
+        description = lib.mdDoc ''
+          The group to run openvscode-server under.
+          By default, a group named `${defaultGroup}` will be created.
+        '';
+        type = lib.types.str;
+      };
+
+      extraGroups = lib.mkOption {
+        default = [ ];
+        description = lib.mdDoc ''
+          An array of additional groups for the `${defaultUser}` user.
+        '';
+        example = [ "docker" ];
+        type = lib.types.listOf lib.types.str;
+      };
+
+      withoutConnectionToken = lib.mkOption {
+        default = false;
+        description = lib.mdDoc ''
+          Run without a connection token. Only use this if the connection is secured by other means.
+        '';
+        example = true;
+        type = lib.types.bool;
+      };
+
+      socketPath = lib.mkOption {
+        default = null;
+        example = "/run/openvscode/socket";
+        description = lib.mdDoc ''
+          The path to a socket file for the server to listen to.
+        '';
+        type = lib.types.nullOr lib.types.str;
+      };
+
+      userDataDir = lib.mkOption {
+        default = null;
+        description = lib.mdDoc ''
+          Specifies the directory that user data is kept in. Can be used to open multiple distinct instances of Code.
+        '';
+        type = lib.types.nullOr lib.types.str;
+      };
+
+      serverDataDir = lib.mkOption {
+        default = null;
+        description = lib.mdDoc ''
+          Specifies the directory that server data is kept in.
+        '';
+        type = lib.types.nullOr lib.types.str;
+      };
+
+      extensionsDir = lib.mkOption {
+        default = null;
+        description = lib.mdDoc ''
+          Set the root path for extensions.
+        '';
+        type = lib.types.nullOr lib.types.str;
+      };
+
+      telemetryLevel = lib.mkOption {
+        default = "off";
+        example = "crash";
+        description = lib.mdDoc ''
+          Sets the initial telemetry level. Valid levels are: 'off', 'crash', 'error' and 'all'.
+        '';
+        type = lib.types.str;
+      };
+
+      connectionToken = lib.mkOption {
+        default = null;
+        example = "secret-token";
+        description = lib.mdDoc ''
+          A secret that must be included with all requests.
+        '';
+        type = lib.types.nullOr lib.types.str;
+      };
+
+      connectionTokenFile = lib.mkOption {
+        default = null;
+        description = lib.mdDoc ''
+          Path to a file that contains the connection token.
+        '';
+        type = lib.types.nullOr lib.types.str;
+      };
+
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.openvscode-server = {
+      description = "OpenVSCode server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      path = cfg.extraPackages;
+      environment = cfg.extraEnvironment;
+      serviceConfig = {
+        ExecStart = ''
+          ${lib.getExe cfg.package} \
+            --accept-server-license-terms \
+            --host=${cfg.host} \
+            --port=${toString cfg.port} \
+          '' + lib.optionalString (cfg.telemetryLevel == true) ''
+            --telemetry-level=${cfg.telemetryLevel} \
+          '' + lib.optionalString (cfg.withoutConnectionToken == true) ''
+            --without-connection-token \
+          '' + lib.optionalString (cfg.socketPath != null) ''
+            --socket-path=${cfg.socketPath} \
+          '' + lib.optionalString (cfg.userDataDir != null) ''
+            --user-data-dir=${cfg.userDataDir} \
+          '' + lib.optionalString (cfg.serverDataDir != null) ''
+            --server-data-dir=${cfg.serverDataDir} \
+          '' + lib.optionalString (cfg.extensionsDir != null) ''
+            --extensions-dir=${cfg.extensionsDir} \
+          '' + lib.optionalString (cfg.connectionToken != null) ''
+            --connection-token=${cfg.connectionToken} \
+          '' + lib.optionalString (cfg.connectionTokenFile != null) ''
+            --connection-token-file=${cfg.connectionTokenFile} \
+          '' + lib.escapeShellArgs cfg.extraArguments;
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        RuntimeDirectory = cfg.user;
+        User = cfg.user;
+        Group = cfg.group;
+        Restart = "on-failure";
+      };
+    };
+
+    users.users."${cfg.user}" = lib.mkMerge [
+      (lib.mkIf (cfg.user == defaultUser) {
+        isNormalUser = true;
+        description = "openvscode-server user";
+        inherit (cfg) group;
+      })
+      {
+        packages = cfg.extraPackages;
+        inherit (cfg) extraGroups;
+      }
+    ];
+
+    users.groups."${defaultGroup}" = lib.mkIf (cfg.group == defaultGroup) { };
+  };
+
+  meta.maintainers = [ lib.maintainers.drupol ];
+}
--- a/nixos/modules/virtualisation/lxc-container.nix
+++ b/nixos/modules/virtualisation/lxc-container.nix
@ -161,6 +161,11 @@ in
      extraCommands = "mkdir -p proc sys dev";
    };

+    system.build.installBootLoader = pkgs.writeScript "install-lxd-sbin-init.sh" ''
+      #!${pkgs.runtimeShell}
+      ln -fs "$1/init" /sbin/init
+    '';
+
    # Add the overrides from lxd distrobuilder
    # https://github.com/lxc/distrobuilder/blob/05978d0d5a72718154f1525c7d043e090ba7c3e0/distrobuilder/main.go#L630
    systemd.packages = [
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -554,6 +554,7 @@ in {
  opentabletdriver = handleTest ./opentabletdriver.nix {};
  owncast = handleTest ./owncast.nix {};
  image-contents = handleTest ./image-contents.nix {};
+  openvscode-server = handleTest ./openvscode-server.nix {};
  orangefs = handleTest ./orangefs.nix {};
  os-prober = handleTestOn ["x86_64-linux"] ./os-prober.nix {};
  osrm-backend = handleTest ./osrm-backend.nix {};
--- a/nixos/tests/openvscode-server.nix
+++ b/nixos/tests/openvscode-server.nix
@ -0,0 +1,22 @@
+import ./make-test-python.nix ({pkgs, lib, ...}:
+{
+  name = "openvscode-server";
+
+  nodes = {
+    machine = {pkgs, ...}: {
+      services.openvscode-server = {
+        enable = true;
+        withoutConnectionToken = true;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("openvscode-server.service")
+    machine.wait_for_open_port(3000)
+    machine.succeed("curl -k --fail http://localhost:3000", timeout=10)
+  '';
+
+  meta.maintainers = [ lib.maintainers.drupol ];
+})
--- a/nixos/tests/syncthing-init.nix
+++ b/nixos/tests/syncthing-init.nix
@ -9,14 +9,16 @@ in {
  nodes.machine = {
    services.syncthing = {
      enable = true;
-      devices.testDevice = {
-        id = testId;
+      settings = {
+        devices.testDevice = {
+          id = testId;
+        };
+        folders.testFolder = {
+          path = "/tmp/test";
+          devices = [ "testDevice" ];
+        };
+        gui.user = "guiUser";
      };
-      folders.testFolder = {
-        path = "/tmp/test";
-        devices = [ "testDevice" ];
-      };
-      extraOptions.gui.user = "guiUser";
    };
  };

--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@ -52,13 +52,13 @@

 mkDerivation rec {
  pname = "mixxx";
-  version = "2.3.4";
+  version = "2.3.5";

  src = fetchFromGitHub {
    owner = "mixxxdj";
    repo = "mixxx";
    rev = version;
-    sha256 = "sha256-1hOMU/Mdk1vT0GQipn/WX2fm9ddN0mPIq7kf2i2w3xQ=";
+    sha256 = "sha256-NAp7RoYSI6BRw7C0ejW4pCJJYx9BG8D+BGVCVTDrggQ=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
@ -116,7 +116,7 @@ mkDerivation rec {

  # mixxx installs udev rules to DATADIR instead of SYSCONFDIR
  # let's disable this and install udev rules manually via postInstall
-  # see https://github.com/mixxxdj/mixxx/blob/2.3.4/CMakeLists.txt#L1381-L1392
+  # see https://github.com/mixxxdj/mixxx/blob/2.3.5/CMakeLists.txt#L1381-L1392
  cmakeFlags = [
    "-DINSTALL_USER_UDEV_RULES=OFF"
  ];
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "pt2-clone";
-  version = "1.57";
+  version = "1.58";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${version}";
-    sha256 = "sha256-YUGTcL/k+MbAnB/kcWPEmrGxGF/kSHdIgdBVUqCsDWM=";
+    sha256 = "sha256-5i892C5aJWgouIgD3FkojJfEhN08Jf1d7HDMvdT82aU=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/audio/snd/default.nix
+++ b/pkgs/applications/audio/snd/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "snd";
-  version = "23.2";
+  version = "23.3";

  src = fetchurl {
    url = "mirror://sourceforge/snd/snd-${version}.tar.gz";
-    sha256 = "sha256-MLBFK34RgpEoK2reA+Ik35pY5YuzetDU1Wz9yAPQhEc=";
+    sha256 = "sha256-YuvTgpa006n+WlQHEtVRfoJl7IBoyevzURz0Suis5sE=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/audio/wolf-shaper/default.nix
+++ b/pkgs/applications/audio/wolf-shaper/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "wolf-shaper";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "pdesaulniers";
    repo = "wolf-shaper";
    rev = "v${version}";
-    sha256 = "sha256-xy6ZebabTRLo/Xk2OMoR4xtxmZsqYXaUHUebuDrHOvA=";
+    sha256 = "sha256-4oi1wnex6eNRHUWXZHnvrmqp4veFuPJqD0YuOhDepg4=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
@ -73,6 +73,8 @@ in

  tree-sitter-langs = callPackage ./manual-packages/tree-sitter-langs { final = self; };

+  treesit-grammars = callPackage ./manual-packages/treesit-grammars { };
+
  tsc = callPackage ./manual-packages/tsc { };

  urweb-mode = callPackage ./manual-packages/urweb-mode { };
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/treesit-grammars/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/treesit-grammars/default.nix
@ -0,0 +1,19 @@
+{ pkgs, lib, tree-sitter, ... }:
+
+let
+  libExt = pkgs.stdenv.targetPlatform.extensions.sharedLibrary;
+  grammarToAttrSet = drv:
+      {
+        name = "lib/lib${lib.strings.removeSuffix "-grammar" (lib.strings.getName drv)}${libExt}";
+        path = "${drv}/parser";
+      };
+in
+{
+  with-all-grammars = pkgs.linkFarm "emacs-treesit-grammars"
+    (map grammarToAttrSet pkgs.tree-sitter.allGrammars);
+
+  # Use this one like this:
+  # treesit-grammars.with-grammars (grammars: with grammars; [tree-sitter-bash])
+  with-grammars = fn: pkgs.linkFarm "emacs-treesit-grammars"
+    (map grammarToAttrSet (fn pkgs.tree-sitter.builtGrammars));
+}
--- a/pkgs/applications/editors/leo-editor/default.nix
+++ b/pkgs/applications/editors/leo-editor/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "leo-editor";
-  version = "6.7.2";
+  version = "6.7.3";

  src = fetchFromGitHub {
    owner = "leo-editor";
    repo = "leo-editor";
    rev = version;
-    sha256 = "sha256-n9Ze02Dvoci3QS5slJNpb3CI3zlTq6FsdVbxvZHCJ2A=";
+    sha256 = "sha256-yzYcdKFhpvxmqzxXMpsdySMk3pLd+ve87W0y2epZoqQ=";
  };

  dontBuild = true;
--- a/pkgs/applications/editors/thonny/default.nix
+++ b/pkgs/applications/editors/thonny/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, python3, makeDesktopItem, copyDesktopItems }:
+{ lib, fetchFromGitHub, python3, tk, makeDesktopItem, copyDesktopItems }:

 with python3.pkgs;

@ -42,6 +42,7 @@ buildPythonApplication rec {

  preFixup = ''
    wrapProgram "$out/bin/thonny" \
+       --set TK_LIBRARY "${tk}/lib/${tk.libPrefix}" \
       --prefix PYTHONPATH : $PYTHONPATH:$(toPythonPath ${python3.pkgs.jedi})
  '';

--- a/pkgs/applications/emulators/mgba/default.nix
+++ b/pkgs/applications/emulators/mgba/default.nix
@ -12,6 +12,7 @@
 , minizip
 , pkg-config
 , libsForQt5
+, wrapGAppsHook
 }:

 let
@ -36,9 +37,15 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    cmake
    pkg-config
+    wrapGAppsHook
    wrapQtAppsHook
  ];

+  dontWrapGApps = true;
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
  buildInputs = [
    SDL2
    ffmpeg
--- a/pkgs/applications/graphics/icon-library/default.nix
+++ b/pkgs/applications/graphics/icon-library/default.nix
@ -5,23 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "icon-library";
-  version = "0.0.11";
+  version = "0.0.16";

  src = fetchurl {
-    url = "https://gitlab.gnome.org/World/design/icon-library/uploads/93d183b17d216bbed7b03b2f3698059c/icon-library-${version}.tar.xz";
-    sha256 = "1zrcnc5dn5fgcl3vklfpbp3m0qzi2n2viw59vw5fhwkysvp670y7";
+    url = "https://gitlab.gnome.org/World/design/icon-library/uploads/5dd3d97acfdbaf69c7dc6b2f7bbf4cae/icon-library-${version}.tar.xz";
+    hash = "sha256-EO67foD/uRoeF+zmJyEia5Nr3eW+Se9bVjDxipMw75E=";
  };

-  patches = [
-    # Fix build with meson 0.61
-    # data/meson.build:85:0: ERROR: gnome.compile_resources takes exactly 2 arguments, but got 3.
-    # https://gitlab.gnome.org/World/design/icon-library/-/merge_requests/54
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/World/design/icon-library/-/commit/c629dbf6670f9bb0b98ff21c17110489b58f5c85.patch";
-      sha256 = "UKC1CPaM58/z0zINN794luWZdoFx1zGxETPb8VtbO3E=";
-    })
-  ];
-
  nativeBuildInputs = [
    cargo desktop-file-utils meson ninja pkg-config rustc wrapGAppsHook4
  ];
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -11,6 +11,7 @@
 , spaceNavSupport ? stdenv.isLinux, libspnav
 , makeWrapper
 , pugixml, llvmPackages, SDL, Cocoa, CoreGraphics, ForceFeedback, OpenAL, OpenGL
+, waylandSupport ? stdenv.isLinux, pkg-config, wayland, wayland-protocols, libffi, libdecor, libxkbcommon, dbus
 , potrace
 , openxr-loader
 , embree, gmp, libharu
@ -36,8 +37,11 @@ stdenv.mkDerivation rec {

  patches = lib.optional stdenv.isDarwin ./darwin.patch;

-  nativeBuildInputs = [ cmake makeWrapper python310Packages.wrapPython llvmPackages.llvm.dev ]
-    ++ lib.optionals cudaSupport [ addOpenGLRunpath ];
+  nativeBuildInputs =
+    [ cmake makeWrapper python310Packages.wrapPython llvmPackages.llvm.dev
+    ]
+    ++ lib.optionals cudaSupport [ addOpenGLRunpath ]
+    ++ lib.optionals waylandSupport [ pkg-config ];
  buildInputs =
    [ boost ffmpeg gettext glew ilmbase
      freetype libjpeg libpng libsamplerate libsndfile libtiff libwebp
@ -51,6 +55,9 @@ stdenv.mkDerivation rec {
      libharu
      libepoxy
    ]
+    ++ lib.optionals waylandSupport [
+      wayland wayland-protocols libffi libdecor libxkbcommon dbus
+    ]
    ++ lib.optionals (!stdenv.isAarch64) [
      openimagedenoise
      embree
@ -124,6 +131,12 @@ stdenv.mkDerivation rec {
      "-DWITH_IMAGE_OPENJPEG=ON"
      "-DWITH_OPENCOLLADA=${if colladaSupport then "ON" else "OFF"}"
    ]
+    ++ lib.optionals waylandSupport [
+      "-DWITH_GHOST_WAYLAND=ON"
+      "-DWITH_GHOST_WAYLAND_DBUS=ON"
+      "-DWITH_GHOST_WAYLAND_DYNLOAD=OFF"
+      "-DWITH_GHOST_WAYLAND_LIBDECOR=ON"
+    ]
    ++ lib.optionals stdenv.hostPlatform.isAarch64 [
      "-DWITH_CYCLES_EMBREE=OFF"
    ]
--- a/pkgs/applications/misc/cotp/default.nix
+++ b/pkgs/applications/misc/cotp/default.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cotp";
-  version = "1.2.3";
+  version = "1.2.4";

  src = fetchFromGitHub {
    owner = "replydev";
    repo = "cotp";
    rev = "v${version}";
-    hash = "sha256-Pg07iq2jj8cUA4iQsY52cujmUZLYrbTG5Zj+lITxpls=";
+    hash = "sha256-OrtVUQikEmrLBrP8ZLbi/+dDi/6FXYC5MOYt3WWU77Y=";
  };

-  cargoHash = "sha256-9jOrDFLnzjxqN2h6e1/qKRn5RQKlfyeKKmjZthQX3jM=";
+  cargoHash = "sha256-TFX5Q9wI5w38wlDSP+peNTbp+cdL6oCOUZ2FFPCOUnM=";

  buildInputs = lib.optionals stdenv.isLinux [ libxcb ]
    ++ lib.optionals stdenv.isDarwin [ AppKit ];
--- a/pkgs/applications/misc/coursera-dl/default.nix
+++ b/pkgs/applications/misc/coursera-dl/default.nix
@ -1,41 +1,23 @@
-{ lib, fetchFromGitHub, fetchpatch, glibcLocales, pandoc, python3 }:
+{ lib
+, fetchFromGitHub
+, fetchpatch
+, glibcLocales
+, pandoc
+, python3
+}:

-let
-  pythonPackages = python3.pkgs;
-
-in pythonPackages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "coursera-dl";
  version = "0.11.5";
+  format = "setuptools";

  src = fetchFromGitHub {
    owner = "coursera-dl";
    repo = "coursera-dl";
-    rev = version;
+    rev = "refs/tags/${version}";
    sha256 = "0akgwzrsx094jj30n4bd2ilwgva4qxx38v3bgm69iqfxi8c2bqbk";
  };

-  nativeBuildInputs = with pythonPackages; [ pandoc ];
-
-  buildInputs = with pythonPackages; [ glibcLocales ];
-
-  propagatedBuildInputs = with pythonPackages; [ attrs beautifulsoup4 configargparse keyring pyasn1 requests six urllib3 ];
-
-  nativeCheckInputs = with pythonPackages; [ pytest mock ];
-
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace '==' '>='
-  '';
-
-  preConfigure = ''
-    export LC_ALL=en_US.utf-8
-  '';
-
-  checkPhase = ''
-    # requires dbus service
-    py.test -k 'not test_get_credentials_with_keyring' .
-  '';
-
  patches = [
    (fetchpatch {
      url = "https://github.com/coursera-dl/coursera-dl/commit/c8796e567698be166cb15f54e095140c1a9b567e.patch";
@ -47,9 +29,48 @@ in pythonPackages.buildPythonApplication rec {
    })
  ];

+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace '==' '>='
+  '';
+
+  preConfigure = ''
+    export LC_ALL=en_US.utf-8
+  '';
+
+  nativeBuildInputs = with python3.pkgs; [
+    pandoc
+  ];
+
+  buildInputs = with python3.pkgs; [
+    glibcLocales
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    attrs
+    beautifulsoup4
+    configargparse
+    keyring
+    pyasn1
+    requests
+    six
+    urllib3
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
+    mock
+  ];
+
+  disabledTests = [
+    "test_get_credentials_with_keyring"
+    "test_quiz_exam_to_markup_converter"
+  ];
+
  meta = with lib; {
    description = "CLI for downloading Coursera.org videos and naming them";
    homepage = "https://github.com/coursera-dl/coursera-dl";
+    changelog = "https://github.com/coursera-dl/coursera-dl/blob/0.11.5/CHANGELOG.md";
    license = licenses.lgpl3Plus;
    maintainers = with maintainers; [ alexfmpe ];
    platforms = platforms.darwin ++ platforms.linux;
--- a/pkgs/applications/misc/geoipupdate/default.nix
+++ b/pkgs/applications/misc/geoipupdate/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "geoipupdate";
-  version = "5.1.0";
+  version = "5.1.1";

  src = fetchFromGitHub {
    owner = "maxmind";
    repo = "geoipupdate";
    rev = "v${version}";
-    sha256 = "sha256-DYZqvLuPcoek07YJLur/By9Wi2VxDz6C7jAOVmdKt4Y=";
+    sha256 = "sha256-n32HxXNk/mHYL6Dn3c8jmTIwrwOfyyd/dui1Uw/xf90=";
  };

  vendorHash = "sha256-t6uhFvuR54Q4nYur/3oBzAbBTaIjzHfx7GeEk6X/0os=";
--- a/pkgs/applications/misc/kiwix/tools.nix
+++ b/pkgs/applications/misc/kiwix/tools.nix
@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, gitUpdater
 , icu
 , libkiwix
 , meson
@ -10,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "kiwix-tools";
-  version = "3.4.0";
+  version = "3.5.0";

  src = fetchFromGitHub {
    owner = "kiwix";
    repo = "kiwix-tools";
    rev = version;
-    sha256 = "sha256-r3/aTH/YoDuYpKLPakP4toS3OtiRueTUjmR34rdmr+w=";
+    sha256 = "sha256-bOxi51H28LhA+5caX6kllIY5B3Q1FoGVFadFIhYRkG0=";
  };

  nativeBuildInputs = [
@ -30,6 +31,8 @@ stdenv.mkDerivation rec {
    libkiwix
  ];

+  passthru.updateScript = gitUpdater { };
+
  meta = with lib; {
    description = "Command line Kiwix tools: kiwix-serve, kiwix-manage, ...";
    homepage = "https://kiwix.org";
--- a/pkgs/applications/misc/nerd-font-patcher/default.nix
+++ b/pkgs/applications/misc/nerd-font-patcher/default.nix
@ -1,19 +1,13 @@
-{ python3Packages, lib, fetchFromGitHub }:
+{ python3Packages, lib, fetchzip }:

 python3Packages.buildPythonApplication rec {
  pname = "nerd-font-patcher";
-  version = "2.2.2";
+  version = "3.0.1";

-  # This uses a sparse checkout because the repo is >2GB without it
-  src = fetchFromGitHub {
-    owner = "ryanoasis";
-    repo = "nerd-fonts";
-    rev = "v${version}";
-    sparseCheckout = [
-      "font-patcher"
-      "/src/glyphs"
-    ];
-    sha256 = "sha256-boZUd1PM8puc9BTgOwCJpkfk6VMdXLsIyp+fQmW/ZqI=";
+  src = fetchzip {
+    url = "https://github.com/ryanoasis/nerd-fonts/releases/download/v${version}/FontPatcher.zip";
+    sha256 = "sha256-kh3zQ0lXCmiO72ZXwvLm7LGUZu0hg8G8TG+pknkK1yo=";
+    stripRoot = false;
  };

  propagatedBuildInputs = with python3Packages; [ fontforge ];
@ -22,15 +16,19 @@ python3Packages.buildPythonApplication rec {

  postPatch = ''
    sed -i font-patcher \
-      -e 's,__dir__ + "/src,"'$out'/share/nerd-font-patcher,'
+      -e 's,__dir__ + "/src,"'$out'/share/,'
+    sed -i font-patcher \
+      -e  's,/bin/scripts/name_parser,/../lib/name_parser,'
  '';
+  # Note: we cannot use $out for second substitution

  dontBuild = true;

  installPhase = ''
-    mkdir -p $out/bin $out/share/nerd-font-patcher
+    mkdir -p $out/bin $out/share $out/lib
    install -Dm755 font-patcher $out/bin/nerd-font-patcher
-    cp -ra src/glyphs $out/share/nerd-font-patcher
+    cp -ra src/glyphs $out/share/
+    cp -ra bin/scripts/name_parser $out/lib/
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.18.0";
+  version = "2.18.1";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-k9fbChpHy997Mj+U9n/iiSGDdsHZ22AoYUkCHUMGfbo=";
+    sha256 = "sha256-BZuvuvbFCZ6VaztlZhlUZhJ7vf4W49mVHiORhH8oH2Y=";
  };

-  vendorHash = "sha256-mAtwbYuzkHUqG4fr2JffcM8PmBsBrnHWyl4DvVzfJCw=";
+  vendorHash = "sha256-g0SuXDzYjg0mGzeDuB2tQnVnDmTiL5vw0r9QWSgIs3Q=";

  ldflags = [
    "-s -w"
--- a/pkgs/applications/misc/usql/default.nix
+++ b/pkgs/applications/misc/usql/default.nix
@ -10,18 +10,18 @@

 buildGoModule rec {
  pname = "usql";
-  version = "0.14.5";
+  version = "0.14.6";

  src = fetchFromGitHub {
    owner = "xo";
    repo = "usql";
    rev = "v${version}";
-    hash = "sha256-WjQdRSucp9iwjUisaz4V/d4JVuFOmYwQA6f3DK5GskU=";
+    hash = "sha256-RxnxF+KzRNPQ5w5zsk9g1tr557vGe7bi32pSiGL2rK8=";
  };

  buildInputs = [ unixODBC icu ];

-  vendorHash = "sha256-kGq+IrdhyFEoaqUeXTKRXziQnFfzG49GIMAsljnWQPA=";
+  vendorHash = "sha256-66HQNh8GNPGYsA4PXIij2PMUnj/SxLSQ/+5junR22UE=";
  proxyVendor = true;

  # Exclude broken impala & hive driver
--- a/pkgs/applications/networking/cluster/linkerd/default.nix
+++ b/pkgs/applications/networking/cluster/linkerd/default.nix
@ -2,7 +2,7 @@

 (callPackage ./generic.nix { }) {
  channel = "stable";
-  version = "2.13.2";
-  sha256 = "0pcb4f8s8l156y0zd9g9f0pyydvp52n02krjy2giajp00gaqx3s3";
-  vendorSha256 = "sha256-6KuXEKuQJvRNUM+6Uo+J9D3eHI+1tt62C5XZsEDwkTc=";
+  version = "2.13.3";
+  sha256 = "080ay0qqb98m208rzj3jnv4jprcfg60b46dbv594i9ps6vhb4ndc";
+  vendorSha256 = "sha256-5T3YrYr7xeRkAADeE24BPu4PYU4mHFspqAiBpS8n4Y0=";
 }
--- a/pkgs/applications/networking/cluster/nova/default.nix
+++ b/pkgs/applications/networking/cluster/nova/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "nova";
-  version = "3.6.3";
+  version = "3.6.4";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = pname;
    rev = version;
-    hash = "sha256-bu0iIhoRRi2dzBGGjWy9YJVSHtdO3T1NkLpGMseyK/E=";
+    hash = "sha256-6gTrBogMvM7X6PFthG+c8N9wXoNHwp0wHjGVKjiHJJY=";
  };

  vendorHash = "sha256-YvYfSb2ZC86S2osFRG7Ep9nrgYJV0tB8fBgZQZ07t2U=";
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "talosctl";
-  version = "1.4.1";
+  version = "1.4.4";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "talos";
    rev = "v${version}";
-    hash = "sha256-ZnVqpJ62X6JlL/yAjpdh8e3U6Lvs/GncCkKU42GRI/Q=";
+    hash = "sha256-BjNJIHPFAytiZIrHPcEuxYCXlp35kMR3OA3KXOdBj8w=";
  };

-  vendorHash = "sha256-1YHYDC22yvtADOIuYxzonV7yaLsQOFELwEEXvu77JdE=";
+  vendorHash = "sha256-btZHQ0sqgbMm0WWswY9ChNNtXX/xedv/d0BrO03MBns=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -437,24 +437,24 @@
    "vendorHash": "sha256-SLFpH7isx4OM2X9bzWYYD4VlejlgckBovOxthg47OOQ="
  },
  "google": {
-    "hash": "sha256-0spzfAsinmWsdarpoxIfrQFIPGEV47H50IVw5Kfyqxs=",
+    "hash": "sha256-LJyKBoFkw93okFrLLBAW8bBuXtOf6/g310ZhJNXQpks=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.64.0",
+    "rev": "v4.65.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rjLvmKymUiuAIwiZRpgivbYbP88MLVSBlrirlJxZpcw="
+    "vendorHash": "sha256-O7lg3O54PedUEwWL34H49SvSBXuGH1l5joqEXgkew5Q="
  },
  "google-beta": {
-    "hash": "sha256-VMJdTj9LUhoj0Qvmt9lUYh00sOJQctgEggem4ZRVsVw=",
+    "hash": "sha256-JI0GyEeCjKvoXlA+BzODQ9XArLVvf8Z6ajK5voIQ7IA=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.64.0",
+    "rev": "v4.65.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rjLvmKymUiuAIwiZRpgivbYbP88MLVSBlrirlJxZpcw="
+    "vendorHash": "sha256-O7lg3O54PedUEwWL34H49SvSBXuGH1l5joqEXgkew5Q="
  },
  "googleworkspace": {
    "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@ -484,13 +484,13 @@
    "vendorHash": null
  },
  "hcloud": {
-    "hash": "sha256-B6XL9izArnbkI7TWbuB/m/UgGK+YlrpaQEJ+etWQBJk=",
+    "hash": "sha256-aqx6oMIqMUgpVMInZPxGFPT9i+pBdU3ufjM6YUSiOss=",
    "homepage": "https://registry.terraform.io/providers/hetznercloud/hcloud",
    "owner": "hetznercloud",
    "repo": "terraform-provider-hcloud",
-    "rev": "v1.38.2",
+    "rev": "v1.39.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-gz96b+GOE7AgXzEL4odneYA01wZv4oXwz//Yyu9rg3E="
+    "vendorHash": "sha256-qa6DUmzL+JB/WTJM+a5VDvBCsrbt8gq/LeqzdAHLm0Q="
  },
  "helm": {
    "hash": "sha256-X9keFjAmV86F/8ktxiv/VrnkHOazP9e/aOC9aRw1A48=",
@ -665,13 +665,13 @@
    "vendorHash": "sha256-4jAJf2FC83NdH4t1l7EA26yQ0pqteWmTIyrZDJdi7fg="
  },
  "linode": {
-    "hash": "sha256-G6+xplMymxziIVof67ONtVMLAaQc33A0pLscchNi8kc=",
+    "hash": "sha256-4cUmKscy0KrhG3CbQo/Uz0BI3tq/MUyDtzNqeXwUtxg=",
    "homepage": "https://registry.terraform.io/providers/linode/linode",
    "owner": "linode",
    "repo": "terraform-provider-linode",
-    "rev": "v2.1.1",
+    "rev": "v2.2.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-om6Onp+Go74YfA8J2DALhJy1c+s5GbXYMpUM9a28bdI="
+    "vendorHash": "sha256-MsVYFt8u9czVs1vGCqBrw3BZ5C4OFNrEuZZ57GEVBqE="
  },
  "linuxbox": {
    "hash": "sha256-MzasMVtXO7ZeZ+qEx2Z+7881fOIA0SFzSvXVHeEROtg=",
@ -882,11 +882,11 @@
    "vendorHash": null
  },
  "pagerduty": {
-    "hash": "sha256-ff8zit1Lo5ipz2P4i8Nmv4Up6Td2gRi6y6BDhBKK4yg=",
+    "hash": "sha256-Vp4kNvG+37MR/0Es0sFxkWfl0dNc8ZIbm0VpSX416Pk=",
    "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
    "owner": "PagerDuty",
    "repo": "terraform-provider-pagerduty",
-    "rev": "v2.14.4",
+    "rev": "v2.14.5",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -963,13 +963,13 @@
    "vendorHash": null
  },
  "scaleway": {
-    "hash": "sha256-cC3On9bqSchxibUWxkqBHHQlN6ZqrOmtBvSEk9J4Uuc=",
+    "hash": "sha256-ZZu8rePMIuQArXI3P/S9rGxw7LU8g3qbJYFpSJ32KJQ=",
    "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
    "owner": "scaleway",
    "repo": "terraform-provider-scaleway",
-    "rev": "v2.18.0",
+    "rev": "v2.19.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-iFZIhQhC5IWAmUqohvBzq4VIheWKqEahwSKM712lUCg="
+    "vendorHash": "sha256-TTQXAX8M9w0RUDVevt4OpPB32R2GFjsvCn1j+SJgZZs="
  },
  "secret": {
    "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@ -1071,11 +1071,11 @@
    "vendorHash": "sha256-fgvNdBwkz+YHOrLRQSe1D+3/VUhttKkJGzV6cg57g8s="
  },
  "sumologic": {
-    "hash": "sha256-sJo3dGGtKT+hPo9qVA+2BYkJhNY9N9FrgKpHqdTYrUQ=",
+    "hash": "sha256-iFN4dP9erg1NoYxyu6U4DTRvGUWTo63ZmxMu7Wxr0UI=",
    "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
    "owner": "SumoLogic",
    "repo": "terraform-provider-sumologic",
-    "rev": "v2.22.0",
+    "rev": "v2.22.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-iNBM4Y24vDGPKyb5cppSogk145F0/pAFmOzEeiWgfLI="
  },
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@ -2,14 +2,14 @@

 buildGoModule rec {
  pname = "velero";
-  version = "1.10.3";
+  version = "1.11.0";


  src = fetchFromGitHub {
    owner = "vmware-tanzu";
    repo = "velero";
    rev = "v${version}";
-    sha256 = "sha256-tNWFZrvq9bDV00TSM+q9D05Tc25judNzRxn0nU/RnCc=";
+    sha256 = "sha256-vrRVNVcNahTC+HSHr7Bw3WedNhe+SSX03P65C5xiUnw=";
  };

  ldflags = [
@ -20,7 +20,7 @@ buildGoModule rec {
    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
  ];

-  vendorHash = "sha256-8yyZ6qIQqpl9PSvaCwhU/i2ZwRe171oMVGqFWeOZExo=";
+  vendorHash = "sha256-WkJk+46+9U4TegDnGtQ+EoqqV/D7githz2pJvxCbV4c=";

  excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];

--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@ -29,7 +29,7 @@

 stdenv.mkDerivation rec {
  pname = "chatty";
-  version = "0.7.0";
+  version = "0.7.2";

  src = fetchFromGitLab {
    domain = "source.puri.sm";
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
    repo = "chatty";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-e3lYzQjQx1ndomq4mJ8TmwXoUG3Bjl9JrLuTmjXmRCs=";
+    hash = "sha256-H9cW19Eoz8cSv26Cyw5BIZSEWsWJktsEw92CHeecFsM=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/poezio/default.nix
+++ b/pkgs/applications/networking/instant-messengers/poezio/default.nix
@ -1,59 +1,52 @@
 { lib
-, aiodns
-, buildPythonApplication
-, cffi
-, fetchFromGitHub
-, mpd2
+, fetchFromGitLab
 , pkg-config
-, potr
-, pyasn1
-, pyasn1-modules
-, pyinotify
-, pytestCheckHook
-, pythonOlder
-, setuptools
-, slixmpp
-, typing-extensions
+, python3
 }:

-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "poezio";
  version = "0.13.1";
-  disabled = pythonOlder "3.4";
+  format = "setuptools";

-  src = fetchFromGitHub {
+  src = fetchFromGitLab {
+    domain = "lab.louiz.org";
    owner = pname;
    repo = pname;
-    rev = "v${version}";
-    sha256 = "041y61pcbdb86s04qwp8s1g6bp84yskc7vdizwpi2hz18y01x5fy";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-3pUegEfhQxEv/7Htw6b2BN1lXtDockyANmi1xW4wPhA=";
  };

  nativeBuildInputs = [
    pkg-config
  ];

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3.pkgs; [
    aiodns
    cffi
    mpd2
    potr
    pyasn1
    pyasn1-modules
+    pycares
    pyinotify
-    setuptools
    slixmpp
-  ] ++ lib.optionals (pythonOlder "3.7") [
    typing-extensions
  ];

-  nativeCheckInputs = [
+  nativeCheckInputs = with python3.pkgs; [
    pytestCheckHook
  ];

+  pythonImportsCheck = [
+    "poezio"
+  ];
+
  meta = with lib; {
    description = "Free console XMPP client";
    homepage = "https://poez.io";
+    changelog = "https://lab.louiz.org/poezio/poezio/-/blob/v${version}/CHANGELOG";
    license = licenses.zlib;
-    maintainers = [ maintainers.lsix ];
+    maintainers = with maintainers; [ lsix ];
  };
 }
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "teams-for-linux";
-  version = "1.0.83";
+  version = "1.0.88";

  src = fetchFromGitHub {
    owner = "IsmaelMartinez";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-2tCBFc4CEgaYJq5fMbHi+M/Cz5Eeo2Slqgu9xUUkUjA=";
+    sha256 = "sha256-eaXW52e+YJbL+0d2Cqrpp6M11rGsyNfIhgjHLzLDbWQ=";
  };

  offlineCache = fetchYarnDeps {
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/screensharing-wayland-hack-fix.patch
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/screensharing-wayland-hack-fix.patch
@ -1,14 +1,14 @@
 diff --git a/app/index.js b/app/index.js
-index 20ccf43..b251f62 100644
+index ea89608..98f4a90 100644
 --- a/app/index.js
 +++ b/app/index.js
@@ -1,4 +1,4 @@
 -const { app, ipcMain, desktopCapturer, systemPreferences, powerMonitor } = require('electron');
 +const { app, ipcMain, desktopCapturer, nativeImage, systemPreferences, powerMonitor } = require('electron');
 const path = require('path');
+ const fs = require('fs');
 const { LucidLog } = require('lucid-log');
- const isDev = require('electron-is-dev');
-@@ -93,7 +93,16 @@ if (!gotTheLock) {
+@@ -97,7 +97,16 @@ if (!gotTheLock) {
 	ipcMain.handle('getSystemIdleState', handleGetSystemIdleState);
 	ipcMain.handle('getZoomLevel', handleGetZoomLevel);
 	ipcMain.handle('saveZoomLevel', handleSaveZoomLevel);
@ -23,6 +23,6 @@ index 20ccf43..b251f62 100644
 +			thumbnail: nativeImage.createEmpty()
 +		}])
 +		: desktopCapturer.getSources(opts));
+ 	ipcMain.handle('getCustomBGList', handleGetCustomBGList);
 	ipcMain.on('play-notification-sound', playNotificationSound);
- }
- 
+ 	ipcMain.on('user-status-changed', userStatusChangedHandler);
--- a/pkgs/applications/networking/instant-messengers/webex/default.nix
+++ b/pkgs/applications/networking/instant-messengers/webex/default.nix
@ -25,7 +25,7 @@
 , udev
 , libxcb
 , libxkbcommon
-, libxcrypt
+, libxcrypt-legacy
 , lshw
 , mesa
 , nspr
@ -49,6 +49,7 @@
 , xcbutilrenderutil
 , xcbutilwm
 , p7zip
+, tbb
 , wayland
 , libXScrnSaver
 }:
@ -62,6 +63,10 @@ stdenv.mkDerivation rec {
    sha256 = "c58a0da26c8f64302cc612c60980dbd68c074d6d8a567b3d870d7d6d06b420ad";
  };

+  nativeBuildInputs = [
+    p7zip
+  ];
+
  buildInputs = [
    alsa-lib
    at-spi2-atk
@ -92,7 +97,7 @@ stdenv.mkDerivation rec {
    udev
    libxcb
    libxkbcommon
-    libxcrypt
+    libxcrypt-legacy
    libX11
    libXcomposite
    libXcursor
@ -110,7 +115,7 @@ stdenv.mkDerivation rec {
    xcbutilkeysyms
    xcbutilrenderutil
    xcbutilwm
-    p7zip
+    tbb
    wayland
  ];

--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "seaweedfs";
-  version = "3.49";
+  version = "3.50";

  src = fetchFromGitHub {
    owner = "seaweedfs";
    repo = "seaweedfs";
-    rev = version;
-    hash = "sha256-KmgElp+vnVWLFG+ZuxRmULg2VmbpKbgciCYA2pEQDRE=";
+    rev = "9204ee2d2dfd421753dad9fcc80c2b5ce3ea5326";
+    hash = "sha256-ahCe2tutRhhbGQyytgR+0i+Tdh/2mU6L8e7G9DNIII4=";
  };

-  vendorHash = "sha256-bOBKtsZIVAwTmvjld2SccfqLQaLTW2vV0AXVGYLamFQ=";
+  vendorHash = "sha256-JkKJ0WFtaKSoBukE0XhN6dhE9+5Ny1kSIoh0GpALAKk=";

  subPackages = [ "weed" ];

--- a/pkgs/applications/radio/cloudlog/default.nix
+++ b/pkgs/applications/radio/cloudlog/default.nix
@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cloudlog";
-  version = "2.4.1";
+  version = "2.4.2";

  src = fetchFromGitHub {
    owner = "magicbug";
    repo = "Cloudlog";
    rev = version;
-    sha256 = "sha256-tFerQJhe/FemtOaP56b2XhLtXH2a8CRT2E69v/77Qz0=";
+    sha256 = "sha256-btfHHrb7m6ITWe/18u2pmZiZKpKebKMThqcXFIvO/P8=";
  };

  postPath = ''
--- a/pkgs/applications/science/math/primesieve/default.nix
+++ b/pkgs/applications/science/math/primesieve/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "primesieve";
-  version = "11.0";
+  version = "11.1";

  src = fetchFromGitHub {
    owner = "kimwalisch";
    repo = "primesieve";
    rev = "v${version}";
-    hash = "sha256-mYekOfjeGwQzWi3pBXnmRMTV7nghEvHsD+tR7vrTFRY=";
+    hash = "sha256-b6X3zhoJsO3UiWfeW4zbKsaoofIWArJi5usof3efQ0k=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/science/robotics/betaflight-configurator/default.nix
+++ b/pkgs/applications/science/robotics/betaflight-configurator/default.nix
@ -19,11 +19,17 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-9FzMyBIR2u1zXHtTWJABM6RF1+OyjYdEPlRwtig9blI=";
  };

+  # remove large unneeded files
+  postUnpack = ''
+    find -name "lib*.so" -delete
+  '';
+
  nativeBuildInputs = [ wrapGAppsHook unzip ];

  buildInputs = [ gsettings-desktop-schemas gtk3 ];

  installPhase = ''
+    runHook preInstall
    mkdir -p $out/bin \
             $out/opt/${pname}

@ -32,6 +38,7 @@ stdenv.mkDerivation rec {
    cp -r ${desktopItem}/share/applications $out/share/

    makeWrapper ${nwjs}/bin/nw $out/bin/${pname} --add-flags $out/opt/${pname}
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/applications/video/bilibili/default.nix
+++ b/pkgs/applications/video/bilibili/default.nix
@ -7,10 +7,10 @@

 stdenv.mkDerivation rec {
  pname = "bilibili";
-  version = "1.9.2-1";
+  version = "1.10.1-1";
  src = fetchurl {
    url = "https://github.com/msojocs/bilibili-linux/releases/download/v${version}/io.github.msojocs.bilibili_${version}_amd64.deb";
-    hash = "sha256-y3dUBImvcIG89m82RaIOa0cxJXIAIGa+n3FJkASacaY=";
+    hash = "sha256-Kx45erpxS66/CWmo4Csw0jhp23u03fn7r+vkq5CtJg0=";
  };

  unpackPhase = ''
--- a/pkgs/applications/video/mpv/scripts/thumbfast.nix
+++ b/pkgs/applications/video/mpv/scripts/thumbfast.nix
@ -0,0 +1,38 @@
+{ lib, stdenvNoCC, fetchFromGitHub, mpv-unwrapped }:
+
+stdenvNoCC.mkDerivation {
+  name = "mpv-thumbfast";
+  version = "unstable-2023-05-12";
+
+  src = fetchFromGitHub {
+    owner = "po5";
+    repo = "thumbfast";
+    rev = "10e9f6133d4ea88e3e5d154969abfaee17173570";
+    hash = "sha256-3fzkAR/itgheXQHTr30XPQR3NpYpIVeZfkcBxEoAnGg=";
+  };
+
+  postPatch = ''
+    substituteInPlace thumbfast.lua \
+      --replace 'mpv_path = "mpv"' 'mpv_path = "${lib.getBin mpv-unwrapped}/bin/mpv"'
+  '';
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/mpv/scripts
+    cp -r thumbfast.lua $out/share/mpv/scripts/thumbfast.lua
+
+    runHook postInstall
+  '';
+
+  passthru.scriptName = "thumbfast.lua";
+
+  meta = {
+    description = "High-performance on-the-fly thumbnailer for mpv";
+    homepage = "https://github.com/po5/thumbfast";
+    license = lib.licenses.unfree; # no explicit licensing information available at this time
+    maintainers = with lib.maintainers; [ apfelkuchen6 ];
+  };
+}
--- a/pkgs/applications/virtualization/docker/distribution.nix
+++ b/pkgs/applications/virtualization/docker/distribution.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  pname = "distribution";
-  version = "2.8.1";
+  version = "2.8.2";
  rev = "v${version}";

  goPackagePath = "github.com/docker/distribution";
@ -11,7 +11,7 @@ buildGoPackage rec {
    owner = "docker";
    repo = "distribution";
    inherit rev;
-    sha256 = "sha256-M8XVeIvD7LtWa9l+6ovwWu5IwFGYt0xDfcIwcU/KH/E=";
+    sha256 = "sha256-aBAUyM+MtRZAA6Jxu4cFyRIo5OU+7IdLKdQqgm0AFPI=";
  };

  meta = with lib; {
--- a/pkgs/data/fonts/nerdfonts/default.nix
+++ b/pkgs/data/fonts/nerdfonts/default.nix
@ -1,7 +1,6 @@
 { stdenv
 , fetchurl
 , lib
-, unzip
 # To select only certain fonts, put a list of strings to `fonts`: every key in
 # ./shas.nix is an optional font
 , fonts ? []
@ -32,7 +31,7 @@ let
    fName:
    fSha:
    (fetchurl {
-      url = "https://github.com/ryanoasis/nerd-fonts/releases/download/v${version}/${fName}.zip";
+      url = "https://github.com/ryanoasis/nerd-fonts/releases/download/v${version}/${fName}.tar.xz";
      sha256 = fSha;
    })
  ) selectedFontsShas;
@ -42,11 +41,7 @@ stdenv.mkDerivation rec {
  inherit version;
  inherit srcs;
  pname = "nerdfonts";
-  nativeBuildInputs = [
-    unzip
-  ];
  sourceRoot = ".";
-  unpackCmd = "unzip -o $curSrc";
  buildPhase = ''
    echo "selected fonts are ${toString selectedFonts}"
    ls *.otf *.ttf
--- a/pkgs/data/fonts/nerdfonts/shas.nix
+++ b/pkgs/data/fonts/nerdfonts/shas.nix
@ -1,57 +1,56 @@
 {
-  "3270" = "1lv95hvdgm7cpqfy1p6j88yvs7s55y1zn79qrgjbfn6ydsd99k6j";
-  "Agave" = "1g932cdffxswm7ca32vi985i9gz10igsg91b7qlmp3w489yxj6pk";
-  "AnonymousPro" = "18ckaq7qbbjwqis74m67vnqmw64sdka1cbscsbh48p6gif7r5z65";
-  "Arimo" = "1akkryjqgq4syyrih2yqfp6rzvg1vrss8x49gglj1dgrav5lx80l";
-  "AurulentSansMono" = "1skkczg398kilkwniy24skhs8f6x4k2gi3723dr0sbs7xxvm7x2x";
-  "BigBlueTerminal" = "0i738nmybrp6glhz7jijhnhxhvxfcr64k7m7qzlw4y8s3jmxn5yh";
-  "BitstreamVeraSansMono" = "12v3wbslcmj3pkldv4hrwhdgzk5v9zipn23pfcfrx5b850fgdsqa";
-  "CascadiaCode" = "1z1xfl3j2wr77x97cka6239kjmarw84y9ly1f7ybk742yz32ys8q";
-  "CodeNewRoman" = "1x2x5bm8fq30rxhxd6wpzc94j70dk8f0244y7j5gn4a5aq19slh1";
-  "ComicShannsMono" = "09609068c4ivk78lkii9brxk67wzn8hf178n3chll2djjryqznrm";
-  "Cousine" = "0cjgf002vhvvs84mb842rj8qvl3dgy8b86y82bjbzq5wrk9mgymk";
-  "DaddyTimeMono" = "086sjbjpam8a71jjyvwf3y7g3dljfgxj40zlh5fbcm2lw3izap9d";
-  "DejaVuSansMono" = "0w369n056pzwi62f8bpa2w8d75vas68f1awn3hjv4b65ss26sh5g";
-  "DroidSansMono" = "15xicnfgzqrzgpj9xbfwb7pmbip48fqxb194krxwdrvcb9pk71ni";
-  "FantasqueSansMono" = "1nr0ngqbdxya0igzq7zf74h6skcpsnrpx09l7mz7i9qbd46qk274";
-  "FiraCode" = "0z7kc51hdj75iddaxrkimjyhrgjh88qn3ab51v68fyb8bfm7wnvh";
-  "FiraMono" = "1nz4hps7hzxjihskksqy88ynnclpawsx0fibxjsnblqwfcjfhp4y";
-  "FontPatcher" = "135kgqhzh87z31n2qazcrd07p08i0g8bgs0wh90plf11xg3dffa2";
-  "Go-Mono" = "13kc5vxd5jqbvydr9xymya6p4n9b1lb78lg8yp73h9s0f8ar4scr";
-  "Gohu" = "0rbr5rhb6w7biqkwwwk0pv57g8gffrvjmasdbzfghc8qrgszniav";
-  "Hack" = "13h572s5yn8knabavm89b9r9pzpzlqyy9ri96sji30ld564ls7fs";
-  "Hasklig" = "1qjfbysx97grrb45zaa80i56lqap0gj0vqjs40bl6s3qcv81knf1";
-  "HeavyData" = "1d0b37gq47sy2q1vvfd9ymw5y77qbs22qckhy4rayvhj64rlq5h0";
-  "Hermit" = "1ds2hrg2zxs9zla97xwvvks0ln78dxc9cln7rfcqr5r0ncw10a79";
-  "iA-Writer" = "156imrbkwkf0plg4rlvn0gxf02ys3kkmf8hpv4nk70ihz14pzr88";
-  "IBMPlexMono" = "08ynxnrynxc1gsi7jc3219jqzp93g5ic4j08mml7ih4xc9c4646a";
-  "Inconsolata" = "0gp19rmw3bn1r0a9lgsq76mpxdpm5qvizcwns5rckk4gk5xrbfj2";
-  "InconsolataGo" = "13lwsq9bay3qn56hik68j69hsw0w9fvd6s833r8pkqlz5vz735z3";
-  "InconsolataLGC" = "02zkjp596p5lcrc0j4s9pmf5w1qh6pargmm2qbigc9ilmhxcacrd";
-  "Iosevka" = "06s8kd7mk67i2d0xqdk0za6xm1pqbcr9y1h5riaqzvc2i6cyakqh";
-  "IosevkaTerm" = "14ljgnswddvbdj3ir9irdvjm8fg0m3r00kp9j3xrmv13jm1p9win";
-  "JetBrainsMono" = "1szfx4v4sdlpq599nnrdjblcw9pplrcivk9w4ny4f2x24lk9ranc";
-  "Lekton" = "0c19xqxgxp3pfcxqcmbsnarl696amy0wapcjkb2wxzwzf8bl9jvc";
-  "LiberationMono" = "1gahjf0ysg887fq072sk6m35s494ah3b96341xfinrq0n20a2spn";
-  "Lilex" = "0db9fjkkm6ckgmgw8f3d1rax47iskhl19d6l09mz2n4fis02jxin";
-  "Meslo" = "1lzwdryb8sj3ap892qzf837v49zccrncr7ds7vmxfd7lpksr0zz8";
-  "Monofur" = "0j9gm70n0qnyd3aghjs800rbvdc7w07d9qhpdqa9dp6p0vgp1ywd";
-  "Monoid" = "0080707jxqd8lwnnasrkgfpr8150606cdxp97njv7z1ph8wiblmr";
-  "Mononoki" = "1v60wk7jbxdgjf4n21himqva3vvhsg369iq6x0vkf7s71mz6j55w";
-  "MPlus" = "18s2lv84mxi8xbjxp21ji4814ykkbxm3q44nvk1328hvrb3a76xm";
-  "NerdFontsSymbolsOnly" = "0jr3ar6ysgw5zpbmzw77478gdlhqvzjb2fk9pnmqr5qdd6wbph4i";
-  "Noto" = "1vkb3vvzim15pqbca1hmznf9j13x7maycqwlfjmc41jrwa7z3px6";
-  "OpenDyslexic" = "013lfsm5jrgkwjf038ixx7z0qm0qgw3fclk3wzp778lw8152fl05";
-  "Overpass" = "01261xhfjlw2x5vbz5gy80z7r8q5rn74g52fi6cwicd42fl2p0f9";
-  "ProFont" = "0iclvxhprz355yf2q8m2prbmxjp6wywa3c9sj6q2kyzbwknpyh3c";
-  "ProggyClean" = "07k263bckwfa8q8bqwb654hccf054rmb52lsgvxiw69mmk335z40";
-  "RobotoMono" = "188cp7nhgh0xw6qbfly7cfgk977vfpjb6hzbq4191wfi2rngn1km";
-  "ShareTechMono" = "1zyz1jpidg72h559yjb0c1n83zwg5y7c9jlc1vjkv4vh1gj04q4h";
-  "SourceCodePro" = "0gpjr9khk5fia6qh0h3rdlkgf78l3zjqphsf93yb1542l71dyf99";
-  "SpaceMono" = "08lx2l9fq6z62gx2lbk0iyyywpwnm0dyih1qz537qjx0hzccn966";
-  "Terminus" = "11mbml586nzymlbr5xmjrpy30mkpfavwgm9pr9mn7ywd3g0f2cy1";
-  "Tinos" = "0a9gkzzv7wsaczcs4n24zychc5qxh2gkjxgr2psv98aglm442wcz";
-  "Ubuntu" = "1fnz5w50728hfs8jmqm0m7m2pcp9hmxl78avw4xlcr3d070nyx58";
-  "UbuntuMono" = "11zmiscxqrcwwldyqm79cnm52lazgz3d5svf2jqpmqz8ia893wbs";
-  "VictorMono" = "10dhjdyykj5rwgji5l771sy5zbcdmf1b4xjzz95dwz6qap2qvq1h";
+  "3270" = "12a9zi38mi0ba581p42h0kdwrjh7jacq2z85ghn318a20m0sgh5l";
+  "Agave" = "17phx041dnn4bpmcqzwkmklh34kxafzjd0vfzkw5p6yblibnwzx8";
+  "AnonymousPro" = "1jpl6id8472bx74m90rry2gmxm365mcqrka6c1kk6nc87k38rz80";
+  "Arimo" = "14s3g3dl835bbzj52g7n4pm3c3hfhssm7rsqrprms2yknbffmbpc";
+  "AurulentSansMono" = "0v49zig6f16a0g0pp4qng9scn452569lrlvr5svz2zx44yz8aji2";
+  "BigBlueTerminal" = "10n1pg20brwprl6qxvcg20zwyvp7jaazxaz0n9724zxs9sjjkk7h";
+  "BitstreamVeraSansMono" = "1sc959pw6vlp9qklria6iq36bakmh51p5z98qh6p926sd0ila656";
+  "CascadiaCode" = "04jwlxzp2r82nhmhfav14wxygshr2gkl0s7lijc97p8z32fkygbq";
+  "CodeNewRoman" = "0c5cn71mayabaiz3rnpszvg1p3i067a6f71kqjm38136livpq8ig";
+  "ComicShannsMono" = "09a50xcac4asik7mb3mcpkf5sjaa6yssq2ky999pjkccpp0sk2hq";
+  "Cousine" = "0azc7jfv8dkxz5874d9w7wx1033w8d6agzic6inp6gd3vxfpn949";
+  "DaddyTimeMono" = "1pnx92g4wc6a9xs3qkckig24v5g897xz520hpprzbqxdqbdamg8w";
+  "DejaVuSansMono" = "0abm1lprkr396dqg7hi54mdb5mgaqb0ld9k0a9v93h2gi7n6jd2l";
+  "DroidSansMono" = "0hpqa3zcp3qygvm24zrhcp0rv28lgpqra72l15il9391c4rday7j";
+  "FantasqueSansMono" = "0cwbwlmlw9ijh6nb2nip918qfwf2h7h4ra6z1xi6sfp3mkbrdm0j";
+  "FiraCode" = "13n9xi7jsd2zn7nmgf7hz1d4blqxb0d0z6q36zscc6w1140m3a59";
+  "FiraMono" = "1zlqxmdfy2pamfwz8n46jksxws19jlv6a1jyjg27cmcm6g2phlwr";
+  "Go-Mono" = "1qyna6720s7ljijqw28dsc3xixpc1c603h7avaqraj7xbhx2bch0";
+  "Gohu" = "08dsi6hwahc0d2f40p976anm2c07x2i7wbpcf27sm53f8q4yc07q";
+  "Hack" = "18f196963sw6y9kpyixij6wxkzzay2pgz11xyy63k6wc54z2zmvp";
+  "Hasklig" = "12yl427kbvj3s9nhzgn0q6pmj8jr0vh58xm7h2q3v0qfw51vdwih";
+  "HeavyData" = "1752rbgawhwx5hbqwf1v3njl1n2fgbylkr45wrz3jxb4089nsmn8";
+  "Hermit" = "05vi0dfg77a54z5m0nqcyzyz646r7r7nbxm76mwv4n4w9dr319h3";
+  "iA-Writer" = "1v3zs49s5712z7mq7v06r325lk6q7syd6mqd45520ik35nskpyh3";
+  "IBMPlexMono" = "0q6g551n1n6hihbaybydsks6v0hzw0izpmr5ncmiamcibdjw7nn8";
+  "Inconsolata" = "1fpyasnsb7zq6k7kdhwz4jcnslz5fsmcn53gfspvznlnassm5fl4";
+  "InconsolataGo" = "0kr2piwvfvplniq8sp64sw4p05mfycykc8i8pmb7vbs8ybgkgka1";
+  "InconsolataLGC" = "025f1ixbvl7r0lk74ppmpfh2agq1hqjrn3vrzfh3skamwhy9dmsx";
+  "Iosevka" = "1n699bs61zld312d0kgyp07c4ac7cgixwlfg9c30fyf33jibw8wh";
+  "IosevkaTerm" = "06k8dcvqkah9bzlagmyl2lnwl0lm51f15f3v78l51p2rnlqmi0n6";
+  "JetBrainsMono" = "0sj6ssdznxabxrvc7ar2rbf2fwadixjirk07xdk2vwyavgpyajf0";
+  "Lekton" = "0j2jaz2w7nbs0c6awxqj79mqi6k058b58629r9ir8qhk7m5qmq7b";
+  "LiberationMono" = "18mc7rjvzlcblf0is83ds9sjvyglc5gjf0nbqa6xgm0hcp0lbmzv";
+  "Lilex" = "1kq56iws0cg6ayfmy21cs8l8496ryjsk3ayanbcyz962j913a7qh";
+  "Meslo" = "04g6najk9ar19pkq4v033h2xhv2rr6yrbp2gw29kpwzigjfjrzsw";
+  "Monofur" = "051ipzjngq2083xj3r99f5jfyshpsgw399rxspnzj4xz9n9803vl";
+  "Monoid" = "17gqr74cc5b3dz09z974ig4w8blwkiyky43gpw7ak1l073w9v3vm";
+  "Mononoki" = "0b91kncc6b14zigci05gv3hf4p88vd1xdis8x42zcjc6bjh8q64k";
+  "MPlus" = "0l4ydmspdj2hfmmc686isnmjqhka3vpy9clljpmx9l7cqygqifxk";
+  "NerdFontsSymbolsOnly" = "1rlv9kdakabkpjw12ji26xb42daj33zljfx3hhnffp8ky4vpxccd";
+  "Noto" = "0slrz3f975bzkah4g446rlb1ai85c91i3g8ciqlifq48pp51jm9m";
+  "OpenDyslexic" = "076ylnbbbwrxs8dm9w6bzs26jdc13s00l4qvyp699z4rgdzb9rgi";
+  "Overpass" = "0nf67kizh11amj72yjqv6wm1zgfkvfvrknss56b1ljifp5sgyc6h";
+  "ProFont" = "0bw3srnikbcyr7gkvr9pqx1i11z5wlr9bmfg2hia1wmbic73cbl4";
+  "ProggyClean" = "1m6m4gyb9iz3dwr5lmn18ciwib92015i0mqdw5kb2wmfrz5s9kks";
+  "RobotoMono" = "1qlss2xs8asg3cpdm2gxwzpaik8jhn1md8faficncphf9x9rdvzv";
+  "ShareTechMono" = "1sadgp9zw31rk71xa56l4fqbr7iv4j2l7mp1bdykrzv4r94swdl2";
+  "SourceCodePro" = "096wh4pq1s24i7xya0lqbr5z6ba9k4wr1229p9n7xkcf2hykgc9j";
+  "SpaceMono" = "0fk54ijh0x43vhk46inwhn7rcn2jgkx836461cqn1xfp5vc9y1hb";
+  "Terminus" = "0bxmvhzxd8vllwv2kjgp1j0iz5jhwwp9x1sjxwdsjv3pff3qm41j";
+  "Tinos" = "08pk46z03x4nnkrbp96i16fhmvp0gvk87s2w8dj51863ay0k80yb";
+  "Ubuntu" = "1gwndxsrp2289jgl1wkqyh5q236ax1835314igi0m3iq22vc07b5";
+  "UbuntuMono" = "0qikbhm3qv745kwa4mbkjp17rp10pbvld2xmfn20x4lb33xpny16";
+  "VictorMono" = "1hgqbyrqmjjbzdfxc38rf5mn7m424mchgqp9qs1cccc2qm6js05r";
 }
--- a/pkgs/data/fonts/nerdfonts/update.sh
+++ b/pkgs/data/fonts/nerdfonts/update.sh
@ -20,7 +20,7 @@ while
  read -r name
  read -r url
 do
-    printf '  "%s" = "%s";\n' "${name%.*}" "$(nix-prefetch-url "$url")" >>"$dirname/shas.nix"
-done < <(jq -r '.assets[] | .name, .browser_download_url' <<<"$latest_release")
+    printf '  "%s" = "%s";\n' "${name%%.*}" "$(nix-prefetch-url "$url")" >>"$dirname/shas.nix"
+done < <(jq -r '.assets[] | select(.name | test("xz")) | .name, .browser_download_url' <<<"$latest_release")

 printf '}\n' >> "$dirname/shas.nix"
--- a/pkgs/data/fonts/nerdfonts/version.nix
+++ b/pkgs/data/fonts/nerdfonts/version.nix
@ -1 +1 @@
-"3.0.0"
+"3.0.1"
--- a/pkgs/desktops/cdesktopenv/default.nix
+++ b/pkgs/desktops/cdesktopenv/default.nix
@ -3,7 +3,7 @@
 , xorgproto, libX11, bison, ksh, perl, gnum4
 , libXinerama, libXt, libXext, libtirpc, motif, libXft, xbitmaps
 , libjpeg, libXmu, libXdmcp, libXScrnSaver, symlinkJoin, bdftopcf
-, ncompress, mkfontdir, tcl, libXaw, libxcrypt, gcc, glibcLocales
+, ncompress, mkfontdir, tcl-8_5, libXaw, libxcrypt, gcc, glibcLocales
 , autoPatchelfHook, libredirect, makeWrapper, xset, xrdb, fakeroot
 , rpcsvc-proto }:

@ -40,7 +40,7 @@ in stdenv.mkDerivation rec {

  buildInputs = [
    libX11 libXinerama libXt libXext libtirpc motif libXft xbitmaps
-    libjpeg libXmu libXdmcp libXScrnSaver tcl libXaw ksh libxcrypt
+    libjpeg libXmu libXdmcp libXScrnSaver tcl-8_5 libXaw ksh libxcrypt
  ];
  nativeBuildInputs = [
    bison ncompress autoPatchelfHook makeWrapper fakeroot
@ -59,6 +59,9 @@ in stdenv.mkDerivation rec {
    "BOOTSTRAPCFLAGS=-I${xorgproto}/include/X11"
    "IMAKECPP=cpp"
    "LOCALE_ARCHIVE=${glibcLocales}/lib/locale/locale-archive"
+    # Workaround for dtdocbook issue with tcl 8.6.13.
+    # TODO: this might be possible to remove when updating CDE
+    "TCLLIB=-ltcl8.5"
  ];

  preConfigure = ''
--- a/pkgs/desktops/mate/mate-media/default.nix
+++ b/pkgs/desktops/mate/mate-media/default.nix
@ -14,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-media";
-  version = "1.26.0";
+  version = "1.26.1";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0fiwzsir8i1bqz7g7b20g5zs28qq63j41v9c5z69q8fq7wh1nwwb";
+    sha256 = "KLKiGiltkVx8BtnSFvSahUHNPOyJWzJZvKBoqF4m6ws=";
  };

  buildInputs = [
--- a/pkgs/desktops/mate/mate-screensaver/default.nix
+++ b/pkgs/desktops/mate/mate-screensaver/default.nix
@ -17,11 +17,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-screensaver";
-  version = "1.26.1";
+  version = "1.26.2";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "T72yHqSlnqjeM+qb93bYaXU+SSlWBGZMMOIg4JZZuLw=";
+    sha256 = "2pcAziQUW9VdJJJ+7P5tMdClLq6G5WOyxlBUs1al/34=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-themes/default.nix
+++ b/pkgs/desktops/mate/mate-themes/default.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-themes";
-  version = "3.22.23";
+  version = "3.22.24";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/themes/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1avgzccdmr7y18rnp3xrhwk82alv2dlig3wh7ivgahcqdiiavrb1";
+    sha256 = "PYs6KihTMd4kxM9djJ3YRtqhFpXyBnZdjxaT68rPbko=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/xfce/applications/mousepad/default.nix
+++ b/pkgs/desktops/xfce/applications/mousepad/default.nix
@ -1,16 +1,30 @@
-{ lib, mkXfceDerivation, gobject-introspection, gtk3, gtksourceview4, gspell }:
+{ lib
+, mkXfceDerivation
+, gobject-introspection
+, glib
+, gtk3
+, gtksourceview4
+, gspell
+, polkit
+}:

 mkXfceDerivation {
  category = "apps";
  pname = "mousepad";
-  version = "0.6.0";
+  version = "0.6.1";
  odd-unstable = false;

-  sha256 = "sha256-VmpCjR8/3rsCGkVGhT+IdC6kaQkGz8G2ktFhJk32DeQ=";
+  sha256 = "sha256-MLdexhIsQa4XuVaLgtQ2aVJ00+pwkhAP3qMj0XXPqh0=";

  nativeBuildInputs = [ gobject-introspection ];

-  buildInputs = [ gtk3 gtksourceview4 gspell ];
+  buildInputs = [
+    glib
+    gtk3
+    gtksourceview4
+    gspell
+    polkit # optional polkit support
+  ];

  # Use the GSettings keyfile backend rather than DConf
  configureFlags = [ "--enable-keyfile-settings" ];
--- a/pkgs/desktops/xfce/applications/ristretto/default.nix
+++ b/pkgs/desktops/xfce/applications/ristretto/default.nix
@ -11,10 +11,10 @@
 mkXfceDerivation {
  category = "apps";
  pname = "ristretto";
-  version = "0.13.0";
+  version = "0.13.1";
  odd-unstable = false;

-  sha256 = "sha256-K1cC5NnRv/C5ZiwMAmaQ8qxvlxHRsJ4F1TgR9CN8Qgc=";
+  sha256 = "sha256-Tor4mA0uSpVCdK6mla1L0JswgURnGPOfkYBR2N1AbL0=";

  buildInputs = [
    glib
--- a/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
@ -12,10 +12,10 @@
 mkXfceDerivation {
  category = "apps";
  pname = "xfce4-screenshooter";
-  version = "1.10.3";
+  version = "1.10.4";
  odd-unstable = false;

-  sha256 = "sha256-L+qlxzNgjsoMi+VsbOFG7L/IITbF1iqMWqujhk0rAcA=";
+  sha256 = "sha256-jikvMHpmBLTqwDjTxx4AMU8CnfrtSExFauq+gcTX2E8=";

  buildInputs = [
    exo
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-i3-workspaces-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-i3-workspaces-plugin/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "xfce4-i3-workspaces-plugin";
-  version = "1.4.0";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = "denesb";
    repo = "xfce4-i3-workspaces-plugin";
    rev = version;
-    sha256 = "sha256-+tjxMr0UbE3BLdxBwNr2mZqKSQOOtw69FmN4rk4loyA=";
+    sha256 = "sha256-Ss3uUmNvBqiu7hUaSy98+YYrWs64LFGbV4DMAV+xkvA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/beam-modules/elixir-ls/default.nix
+++ b/pkgs/development/beam-modules/elixir-ls/default.nix
@ -16,6 +16,8 @@ in
 mixRelease  {
  inherit pname version src elixir;

+  stripDebug = true;
+
  mixFodDeps = fetchMixDeps {
    pname = "mix-deps-${pname}";
    inherit src version elixir;
--- a/pkgs/development/beam-modules/mix-release.nix
+++ b/pkgs/development/beam-modules/mix-release.nix
@ -9,16 +9,25 @@
 , enableDebugInfo ? false
 , mixEnv ? "prod"
 , compileFlags ? [ ]
+
  # mix fixed output derivation dependencies
 , mixFodDeps ? null
+
  # mix dependencies generated by mix2nix
  # this assumes each dependency is built by buildMix or buildRebar3
  # each dependency needs to have a setup hook to add the lib path to $ERL_LIBS
  # this is how mix will find dependencies
 , mixNixDeps ? { }
+
 , elixir ? inputs.elixir
 , hex ? inputs.hex.override { inherit elixir; }
-, stripDebug ? true
+
+# This reduces closure size, but can lead to some hard to understand runtime
+# errors, so use with caution. See e.g.
+# https://github.com/whitfin/cachex/issues/205
+# https://framagit.org/framasoft/mobilizon/-/issues/1169
+, stripDebug ? false
+
 , ...
 }@attrs:
 let
--- a/pkgs/development/compilers/llvm/rocm/default.nix
+++ b/pkgs/development/compilers/llvm/rocm/default.nix
@ -29,6 +29,7 @@ let
  # Stage 1
  # Base
  llvm = callPackage ./llvm.nix {
+    requiredSystemFeatures = [ "big-parallel" ];
    isBroken = stdenv.isAarch64; # https://github.com/RadeonOpenCompute/ROCm/issues/1831#issuecomment-1278205344
  };

--- a/pkgs/development/compilers/llvm/rocm/llvm.nix
+++ b/pkgs/development/compilers/llvm/rocm/llvm.nix
@ -39,6 +39,7 @@
  )
 )]
 , extraPostInstall ? ""
+, requiredSystemFeatures ? [ ]
 , extraLicenses ? [ ]
 , isBroken ? false
 }:
@ -158,6 +159,8 @@ in stdenv.mkDerivation (finalAttrs: {
    };
  };

+  inherit requiredSystemFeatures;
+
  meta = with lib; {
    description = "ROCm fork of the LLVM compiler infrastructure";
    homepage = "https://github.com/RadeonOpenCompute/llvm-project";
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@ -75,7 +75,9 @@ stdenv.mkDerivation rec {

  outputs = [ "out" "info" "man" ];

-  doCheck = true;
+  # Test segfault for static build
+  doCheck = !stdenv.hostPlatform.isStatic;
+
  checkTarget = "test";
  # https://www.mail-archive.com/tinycc-devel@nongnu.org/msg10142.html
  preCheck = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
--- a/pkgs/development/compilers/vlang/default.nix
+++ b/pkgs/development/compilers/vlang/default.nix
@ -1,30 +1,51 @@
-{ lib, stdenv, fetchFromGitHub, glfw, freetype, openssl, makeWrapper, upx }:
+{ lib, stdenv, fetchFromGitHub, glfw, freetype, openssl, makeWrapper, upx, boehmgc, xorg, binaryen, darwin }:

-stdenv.mkDerivation rec {
+let
+  version = "weekly.2023.19";
+  ptraceSubstitution = ''
+    #include <sys/types.h>
+    #include <sys/ptrace.h>
+  '';
+  # Required for bootstrap.
+  vc = stdenv.mkDerivation {
+    pname = "v.c";
+    version = "unstable-2023-05-14";
+    src = fetchFromGitHub {
+      owner = "vlang";
+      repo = "vc";
+      rev = "f7c2b5f2a0738d0d236161c9de9f31dd0280ac86";
+      sha256 = "sha256-xU3TvyNgc0o4RCsHtoC6cZTNaue2yuAiolEOvP37TKA=";
+    };
+
+    # patch the ptrace reference for darwin
+    installPhase = lib.optionalString stdenv.isDarwin ''
+      substituteInPlace v.c \
+        --replace "#include <sys/ptrace.h>" "${ptraceSubstitution}"
+    '' + ''
+      mkdir -p $out
+      cp v.c $out/
+    '';
+  };
+  # Required for vdoc.
+  markdown = fetchFromGitHub {
+    owner = "vlang";
+    repo = "markdown";
+    rev = "6e970bd0a7459ad7798588f1ace4aa46c5e789a2";
+    hash = "sha256-hFf7c8ZNMU1j7fgmDakuO7tBVr12Wq0dgQddJnkMajE=";
+  };
+  boehmgcStatic = boehmgc.override {
+    enableStatic = true;
+  };
+in
+stdenv.mkDerivation {
  pname = "vlang";
-  version = "weekly.2022.20";
+  inherit version;

  src = fetchFromGitHub {
    owner = "vlang";
    repo = "v";
    rev = version;
-    sha256 = "1isbyfs98bdbm2qjf7q4bqbpsmdiqlavn3gznwr12bkvhnsf4j3x";
-  };
-
-  # Required for bootstrap.
-  vc = fetchFromGitHub {
-    owner = "vlang";
-    repo = "vc";
-    rev = "167f262866090493650f58832d62d910999dd5a4";
-    sha256 = "1xax8355qkrccjcmx24gcab88xnrqj15mhqy0bgp3v2rb1hw1n3a";
-  };
-
-  # Required for vdoc.
-  markdown = fetchFromGitHub {
-    owner = "vlang";
-    repo = "markdown";
-    rev = "bbbd324a361e404ce0682fc00666df3a7877b398";
-    sha256 = "0cawzizr3rjz81blpvxvxrcvcdai1adj66885ss390444qq1fnv7";
+    sha256 = "sha256-fHn1z2q3LmSycCOa1ii4DoHvbEW4uJt3Psq3/VuZNVQ=";
  };

  propagatedBuildInputs = [ glfw freetype openssl ]
@ -32,21 +53,32 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ makeWrapper ];

+  buildInputs = [
+    binaryen
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Cocoa
+  ] ++ lib.optionals stdenv.isLinux [
+    xorg.libX11
+    xorg.libXau
+    xorg.libXdmcp
+    xorg.xorgproto
+  ];
+
  makeFlags = [
    "local=1"
-    "VC=${vc}"
  ];

+  env.VC = vc;
+
  preBuild = ''
    export HOME=$(mktemp -d)
+    mkdir -p ./thirdparty/tcc/lib
+    cp -r ${boehmgcStatic}/lib/* ./thirdparty/tcc/lib
  '';

  # vcreate_test.v requires git, so we must remove it when building the tools.
-  # vtest.v fails on Darwin, so let's just disable it for now.
  preInstall = ''
-    mv cmd/tools/vcreate_test.v $HOME/vcreate_test.v
-  '' + lib.optionalString stdenv.isDarwin ''
-    mv cmd/tools/vtest.v $HOME/vtest.v
+    mv cmd/tools/vcreate/vcreate_test.v $HOME/vcreate_test.v
  '';

  installPhase = ''
@ -72,8 +104,6 @@ stdenv.mkDerivation rec {
  # Return vcreate_test.v and vtest.v, so the user can use it.
  postInstall = ''
    cp $HOME/vcreate_test.v $out/lib/cmd/tools/vcreate_test.v
-  '' + lib.optionalString stdenv.isDarwin ''
-    cp $HOME/vtest.v $out/lib/cmd/tools/vtest.v
  '';

  meta = with lib; {
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {

  inherit libsigsegv gettext coreutils;

-  ffcallAvailable = libffcall != null;
+  ffcallAvailable = stdenv.isLinux && (libffcall != null);

  buildInputs = [libsigsegv]
  ++ lib.optional (gettext != null) gettext
@ -101,7 +101,8 @@ stdenv.mkDerivation rec {
    homepage = "http://clisp.cons.org";
    maintainers = lib.teams.lisp.members;
    platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isAarch64;
+    # problems on Darwin: https://github.com/NixOS/nixpkgs/issues/20062
+    broken = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAarch64;
    license = lib.licenses.gpl2;
  };
 }
--- a/pkgs/development/interpreters/clisp/hg.nix
+++ b/pkgs/development/interpreters/clisp/hg.nix
@ -93,7 +93,6 @@ stdenv.mkDerivation rec {
    homepage = "http://clisp.cons.org";
    maintainers = lib.teams.lisp.members;
    # problems on Darwin: https://github.com/NixOS/nixpkgs/issues/20062
-    platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin;
+    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/development/libraries/boehm-gc/default.nix
+++ b/pkgs/development/libraries/boehm-gc/default.nix
@ -4,6 +4,7 @@
 # doc: https://github.com/ivmai/bdwgc/blob/v8.2.2/doc/README.macros (LARGE_CONFIG)
 , enableLargeConfig ? false
 , enableMmap ? true
+, enableStatic ? false
 , nixVersions
 }:

@ -26,6 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
    "--enable-cplusplus"
    "--with-libatomic-ops=none"
  ]
+  ++ lib.optional enableStatic "--enable-static"
  ++ lib.optional enableMmap "--enable-mmap"
  ++ lib.optional enableLargeConfig "--enable-large-config";

--- a/pkgs/development/libraries/example-robot-data/default.nix
+++ b/pkgs/development/libraries/example-robot-data/default.nix
@ -8,14 +8,14 @@

 stdenv.mkDerivation rec {
  pname = "example-robot-data";
-  version = "4.0.5";
+  version = "4.0.6";

  src = fetchFromGitHub {
    owner = "Gepetto";
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-KE+wmYlgETt6RtyN/BMApgS075/WtuhY+rM7YFkBH0E=";
+    hash = "sha256-X1BQGM7MMe753RMb/rVYv7kNnjk/q30u/VJARAXiTAI=";
  };

  strictDeps = true;
--- a/pkgs/development/libraries/libcouchbase/default.nix
+++ b/pkgs/development/libraries/libcouchbase/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libcouchbase";
-  version = "3.3.6";
+  version = "3.3.7";

  src = fetchFromGitHub {
    owner = "couchbase";
    repo = "libcouchbase";
    rev = version;
-    sha256 = "sha256-sq/sPEZO6/9WYukOQ1w47ZTW0G8uLCJqnBS6mTD6P+M=";
+    sha256 = "sha256-EPVz9+qEuJe4VGXNuUnbH61EDxdyohZhxoxleO5j/Uk=";
  };

  cmakeFlags = [ "-DLCB_NO_MOCK=ON" ];
--- a/pkgs/development/libraries/libmysqlconnectorcpp/default.nix
+++ b/pkgs/development/libraries/libmysqlconnectorcpp/default.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "libmysqlconnectorcpp";
-  version = "8.0.32";
+  version = "8.0.33";

  src = fetchurl {
    url = "https://cdn.mysql.com/Downloads/Connector-C++/mysql-connector-c++-${version}-src.tar.gz";
-    hash = "sha256-+9t/IUQnYy9CPoS6dZS+H5IF6sgSjGsYVyA7L1RVzvM=";
+    hash = "sha256-Fgz2iB+96b1GzRGq8Skwtna8bidYmsXHuknBlrl+BTs=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libphonenumber/build-reproducibility.patch
+++ b/pkgs/development/libraries/libphonenumber/build-reproducibility.patch
@ -0,0 +1,24 @@
+diff --git a/tools/cpp/src/cpp-build/generate_geocoding_data.cc b/tools/cpp/src/cpp-build/generate_geocoding_data.cc
+index 205947e831..1e628e2cd2 100644
+--- a/tools/cpp/src/cpp-build/generate_geocoding_data.cc
+++ b/tools/cpp/src/cpp-build/generate_geocoding_data.cc
+@@ -97,7 +97,8 @@ class DirEntry {
+   DirEntryKinds kind_;
+ };
+ 
+-// Lists directory entries in path. "." and ".." are excluded. Returns true on
+// Lists directory entries in path. "." and ".." are excluded. Entries are
+// returned in a consistent order to ensure reproducibility. Returns true on
+ // success.
+ bool ListDirectory(const string& path, vector<DirEntry>* entries) {
+   entries->clear();
+@@ -135,6 +136,9 @@ bool ListDirectory(const string& path, vector<DirEntry>* entries) {
+     }
+     entries->push_back(DirEntry(entry->d_name, kind));
+   }
+  std::sort(
+      entries->begin(), entries->end(),
+      [](const DirEntry& a, const DirEntry& b) { return a.name() < b.name(); });
+ }
+ 
+ // Returns true if s ends with suffix.
--- a/pkgs/development/libraries/libphonenumber/default.nix
+++ b/pkgs/development/libraries/libphonenumber/default.nix
@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-xLxadSxVY3DjFDQrqj3BuOvdMaKdFSLjocfzovJCBB0=";
  };

+  patches = [
+    # Submitted upstream: https://github.com/google/libphonenumber/pull/2921
+    ./build-reproducibility.patch
+  ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
--- a/pkgs/development/libraries/libspng/default.nix
+++ b/pkgs/development/libraries/libspng/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "libspng";
-  version = "0.7.3";
+  version = "0.7.4";

  src = fetchFromGitHub {
    owner = "randy408";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-t5qVhRxepl1rOQk/F5GhcvU1nk9oGb+kWXmybP+iAfY=";
+    sha256 = "sha256-BiRuPQEKVJYYgfUsglIuxrBoJBFiQ0ygQmAFrVvCz4Q=";
  };

  doCheck = true;
--- a/pkgs/development/libraries/miniaudio/default.nix
+++ b/pkgs/development/libraries/miniaudio/default.nix
@ -4,15 +4,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "miniaudio";
-  version = "0.11.14";
+  version = "0.11.16";

  src = fetchFromGitHub {
    owner = "mackron";
    repo = "miniaudio";
-    rev = "9a7663496fc06f7a9439c752fd7666ca93328c20";
-    # upstream does not maintain tags:
-    # https://github.com/mackron/miniaudio/issues/273#issuecomment-783861269
-    hash = "sha256-v/Eo4/CYcpB4tbOoy1gPqk6PUvkQIZNWrweG3l5EcMk=";
+    rev = version;
+    hash = "sha256-POe/dYPJ25RKNGIhaLoqxm9JJ08MrTyHVN4NmaGOdwM=";
  };

  installPhase = ''
--- a/pkgs/development/libraries/mongoc/default.nix
+++ b/pkgs/development/libraries/mongoc/default.nix
@ -17,11 +17,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mongoc";
-  version = "1.23.3";
+  version = "1.23.4";

  src = fetchzip {
    url = "https://github.com/mongodb/mongo-c-driver/releases/download/${version}/mongo-c-driver-${version}.tar.gz";
-    sha256 = "sha256-wxcBnJENL3hMzf7GKLucjw7K08tK35+0sMNWZb2mWIo=";
+    sha256 = "sha256-mJBaRaX0hphvMdTII79DVn1g2uBmpRlObMiJ673Ijpw=";
  };

  # https://github.com/NixOS/nixpkgs/issues/25585
--- a/pkgs/development/libraries/nco/default.nix
+++ b/pkgs/development/libraries/nco/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "nco";
-  version = "5.1.5";
+  version = "5.1.6";

  src = fetchFromGitHub {
    owner = "nco";
    repo = "nco";
    rev = version;
-    sha256 = "sha256-L1aAACWDVrPdl8IHSpch3l8EhdjAxOcUAZchKMYKWqY=";
+    sha256 = "sha256-h5HL3fe3pdj48UeL5TKunSr7PvKf26AOOOcQh77W9sk=";
  };

  nativeBuildInputs = [ flex which antlr2 ];
--- a/pkgs/development/libraries/sharness/default.nix
+++ b/pkgs/development/libraries/sharness/default.nix
@ -6,15 +6,15 @@
 , perlPackages
 , sharnessExtensions ? {} }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "sharness";
-  version = "1.1.0-dev";
+  version = "1.2.0";

  src = fetchFromGitHub {
-    owner = "chriscool";
-    repo = pname;
-    rev = "3f238a740156dd2082f4bd60ced205e05894d367"; # 2020-12-09
-    sha256 = "FCYskpIqkrpNaWCi2LkhEkiow4/rXLe+lfEWNUthLUg=";
+    owner = "felipec";
+    repo = "sharness";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-C0HVWgTm9iXDSFyXcUVRfT0ip31YGaaZ6ZvxggK/x7o=";
  };

  # Used for testing
@ -41,6 +41,8 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  passthru.SHARNESS_TEST_SRCDIR = finalAttrs.finalPackage + "/share/sharness";
+
  meta = with lib; {
    description = "Portable shell library to write, run and analyze automated tests adhering to Test Anything Protocol (TAP)";
    homepage = "https://github.com/chriscool/sharness";
@ -48,4 +50,4 @@ stdenv.mkDerivation rec {
    maintainers = [ maintainers.spacefrogg ];
    platforms = platforms.unix;
  };
-}
+})
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@ -217,8 +217,8 @@ let
    pname = "facts";
    version = "0.1-632217602";
    src = pkgs.fetchzip {
-      url = "https://github.com/facts-db/cl-lessp/archive/632217602b85b679e8d420654a0aa39e798ca3b5.tar.gz";
-      sha256 = "09z1vwzjm7hlb529jl3hcjnfd11gh128lmdg51im7ar4jv4746iw";
+      url = "https://beta.quicklisp.org/archive/cl-facts/2022-11-06/cl-facts-20221106-git.tgz";
+      sha256 = "sha256-PBpyyJYkq1NjKK9VikSAL4TmrGRwUJlEWRSeKj/f4Sc=";
    };
    lispLibs = [ self.lessp self.rollback ] ++ [ super.local-time ];
  };
--- a/pkgs/development/ocaml-modules/ounit2/default.nix
+++ b/pkgs/development/ocaml-modules/ounit2/default.nix
@ -4,11 +4,11 @@ buildDunePackage rec {
  minimalOCamlVersion = "4.08";

  pname = "ounit2";
-  version = "2.2.6";
+  version = "2.2.7";

  src = fetchurl {
    url = "https://github.com/gildor478/ounit/releases/download/v${version}/ounit-${version}.tbz";
-    hash = "sha256-BpD7Hg6QoY7tXDVms8wYJdmLDox9UbtrhGyVxFphWRM=";
+    hash = "sha256-kPbmO9EkClHYubL3IgWb15zgC1J2vdYji49cYTwOc4g=";
  };

  propagatedBuildInputs = [ seq stdlib-shims ];
--- a/pkgs/development/ocaml-modules/uring/default.nix
+++ b/pkgs/development/ocaml-modules/uring/default.nix
@ -10,14 +10,14 @@

 buildDunePackage rec {
  pname = "uring";
-  version = "0.5";
+  version = "0.6";

  minimalOCamlVersion = "4.12";
  duneVersion = "3";

  src = fetchurl {
-    url = "https://github.com/ocaml-multicore/ocaml-uring/releases/download/v${version}/${pname}-${version}.tbz";
-    sha256 = "106w7mabqihdhj4csk9jfqag220rwhqdp5lapn0xmw2035scvxvk";
+    url = "https://github.com/ocaml-multicore/ocaml-${pname}/releases/download/v${version}/${pname}-${version}.tbz";
+    sha256 = "ZltD9JnF1lJs0xjWwFXBfWMP8e5XRhCaB2P4iqHFreo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/ansible-compat/default.nix
+++ b/pkgs/development/python-modules/ansible-compat/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "ansible-compat";
-  version = "4.0.2";
+  version = "4.0.4";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-JbDcWro8Q+DP3JFATlcErphX5mTCEPf4SlVm4A111/M=";
+    hash = "sha256-rXzr++4EVt+/7g6AJRWxEeABYCVSUFF0+jo1/wi6Izk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/ansible/core.nix
+++ b/pkgs/development/python-modules/ansible/core.nix
@ -24,11 +24,11 @@

 buildPythonPackage rec {
  pname = "ansible-core";
-  version = "2.14.2";
+  version = "2.15.0";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-R/DUtBJbWO26ZDWkfzfL5qGNpUWU0Y+BKVi7DLWNTmU=";
+    hash = "sha256-z2kP1Ou0BZDgDFrNwGJHWMpMWNHksrAuwCagNAcOv00=";
  };

  # ansible_connection is already wrapped, so don't pass it through
--- a/pkgs/development/python-modules/authcaptureproxy/default.nix
+++ b/pkgs/development/python-modules/authcaptureproxy/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "authcaptureproxy";
-  version = "1.1.5";
+  version = "1.2.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "alandtse";
    repo = "auth_capture_proxy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-HYqbOyJlP1rd8jpqbN9I4JuVpBKxR9/Nvoh544t40uo=";
+    hash = "sha256-OY6wT0xi7f6Bn8VOL9+6kyv5cENYbrGGTWWKc6o36cw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/azure-mgmt-monitor/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-monitor/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-monitor";
-  version = "6.0.0";
+  version = "6.0.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    hash = "sha256-Uhs+wz3sB5mOt1LGJCqzhMT5YWwwMnpmVi4WvXHBfZY=";
+    hash = "sha256-j+LrnLsfvRNlolKYf72ZUXxg5lb33R7PfxveBSyxHDI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/azure-mgmt-network/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-network/default.nix
@ -9,7 +9,7 @@
 }:

 buildPythonPackage rec {
-  version = "22.2.0";
+  version = "23.0.1";
  pname = "azure-mgmt-network";
  format = "setuptools";

@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    hash = "sha256-491E1Q59dYFkH5QniR+S5eoiiL/ACwLe+fgYob8/jG4=";
+    hash = "sha256-VRkaaCNvuzOS/vR9iCum+WaIqBG9Y+3sRquNY2OniTA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/azure-mgmt-signalr/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-signalr/default.nix
@ -10,15 +10,15 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-signalr";
-  version = "1.1.0";
+  version = "1.2.0";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    hash = "sha256-lUNIDyP5W+8aIX7manfMqaO2IJJm/+2O+Buv+Bh4EZE=";
+    hash = "sha256-jbFhVoJbObpvcVJr2VoUzY5CmSblJ6OK7Q3l17SARfg=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/bangla/default.nix
+++ b/pkgs/development/python-modules/bangla/default.nix
@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "bangla";
+  version = "0.0.2";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-F8j9UBMhZgB31atqebdGu6cfnkk573isDZp1171xXag=";
+  };
+
+  pythonImportsCheck = [ "bangla" ];
+
+  # https://github.com/arsho/bangla/issues/5
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Bangla is a package for Bangla language users with various functionalities including Bangla date and Bangla numeric conversation";
+    homepage = "https://github.com/arsho/bangla";
+    license = licenses.mit;
+    maintainers = teams.tts.members;
+  };
+}
--- a/pkgs/development/python-modules/bnnumerizer/default.nix
+++ b/pkgs/development/python-modules/bnnumerizer/default.nix
@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "bnnumerizer";
+  version = "0.0.2";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-Qd9v0Le1GqTsR3a2ZDzt6+5f0R4zXX1W1KIMCFFeXw0=";
+  };
+
+  pythonImportsCheck = [ "bnnumerizer" ];
+
+  # https://github.com/mnansary/bnUnicodeNormalizer/issues/10
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Bangla Number text to String Converter";
+    homepage = "https://github.com/banglakit/number-to-bengali-word";
+    license = licenses.mit;
+    maintainers = teams.tts.members;
+  };
+}
--- a/pkgs/development/python-modules/bnunicodenormalizer/default.nix
+++ b/pkgs/development/python-modules/bnunicodenormalizer/default.nix
@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "bnunicodenormalizer";
+  version = "0.1.6";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-qVC6+0SnAs25DFzKPHFUOoYPlrRvkGWFptjIVom8wJM=";
+  };
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "bnunicodenormalizer" ];
+
+  meta = with lib; {
+    description = "Bangla Unicode Normalization Toolkit";
+    homepage = "https://github.com/mnansary/bnUnicodeNormalizer";
+    license = licenses.mit;
+    maintainers = teams.tts.members;
+  };
+}
--- a/pkgs/development/python-modules/boto/0005-Don-t-mock-list-subclass.patch
+++ b/pkgs/development/python-modules/boto/0005-Don-t-mock-list-subclass.patch
@ -0,0 +1,21 @@
+From: Jochen Sprickerhof <jspricke@debian.org>
+Date: Thu, 15 Dec 2022 07:44:54 +0100
+Subject: Don't mock list subclass
+
+---
+ tests/unit/ec2/test_volume.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/unit/ec2/test_volume.py b/tests/unit/ec2/test_volume.py
+index 81d7f55..d4d8e4f 100644
+--- a/tests/unit/ec2/test_volume.py
+++ b/tests/unit/ec2/test_volume.py
+@@ -55,7 +55,7 @@ class VolumeTests(unittest.TestCase):
+     @mock.patch("boto.resultset.ResultSet")
+     def test_startElement_with_name_tagSet_calls_ResultSet(self, ResultSet, startElement):
+         startElement.return_value = None
+-        result_set = mock.Mock(ResultSet([("item", Tag)]))
+        result_set = ResultSet([("item", Tag)])
+         volume = Volume()
+         volume.tags = result_set
+         retval = volume.startElement("tagSet", None, None)
--- a/pkgs/development/python-modules/boto/default.nix
+++ b/pkgs/development/python-modules/boto/default.nix
@ -22,6 +22,9 @@ buildPythonPackage rec {
    # fixes hmac tests
    # https://sources.debian.org/src/python-boto/2.49.0-4/debian/patches/bug-953970_python3.8-compat.patch/
    ./bug-953970_python3.8-compat.patch
+    # fixes test_startElement_with_name_tagSet_calls_ResultSet
+    # https://sources.debian.org/src/python-boto/2.49.0-4.1/debian/patches/0005-Don-t-mock-list-subclass.patch/
+    ./0005-Don-t-mock-list-subclass.patch
  ];

  # boto is deprecated by upstream as of 2021-05-27 (https://github.com/boto/boto/commit/4980ac58764c3d401cb0b9552101f9c61c18f445)
--- a/pkgs/development/python-modules/cinemagoer/default.nix
+++ b/pkgs/development/python-modules/cinemagoer/default.nix
@ -7,11 +7,11 @@

 buildPythonPackage rec {
  pname = "cinemagoer";
-  version = "2022.12.27";
+  version = "2023.5.1";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-uUq/6Uijv6krBNCa5ftBWG/uYLs/5pLyDONLvBoxjYo=";
+    hash = "sha256-XOHXeuZUZwFhjxHlsVVqGdGO3srRttfZaXPsNJQbGPI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/cloudsmith-api/default.nix
+++ b/pkgs/development/python-modules/cloudsmith-api/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "cloudsmith-api";
-  version = "2.0.1";
+  version = "2.0.2";
  format = "wheel";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "cloudsmith_api";
    inherit format version;
-    hash = "sha256-wFSHlUdZTARsAV3igVXThrXoGsPUaZyzXBJCSJFZYYQ=";
+    hash = "sha256-6y63xo3ftZPT7GX/oN8bHZIEJRdKnUFar3eThjyKN6w=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/coqpit/default.nix
+++ b/pkgs/development/python-modules/coqpit/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , pytestCheckHook
 }:

@ -25,6 +26,15 @@ buildPythonPackage rec {
    "coqpit.coqpit"
  ];

+  # https://github.com/coqui-ai/coqpit/issues/40
+  disabledTests = lib.optionals (pythonAtLeast "3.11")[
+    "test_init_argparse_list_and_nested"
+  ];
+
+  disabledTestPaths = lib.optionals (pythonAtLeast "3.11")[
+    "tests/test_nested_configs.py"
+  ];
+
  meta = with lib; {
    description = "Simple but maybe too simple config management through python data classes";
    longDescription = ''
--- a/pkgs/development/python-modules/croniter/default.nix
+++ b/pkgs/development/python-modules/croniter/default.nix
@ -9,12 +9,12 @@

 buildPythonPackage rec {
  pname = "croniter";
-  version = "1.3.8";
+  version = "1.3.14";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-MqXsBOl+wIN7zfATdnq9LnHM7u/TwuFMgECYzlGtbNk=";
+    hash = "sha256-0Gex+VtVPG6C2VqYPEZWlZE9zRL0eouaqTigRQ2U3V4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/dkimpy/default.nix
+++ b/pkgs/development/python-modules/dkimpy/default.nix
@ -3,11 +3,11 @@

 buildPythonPackage rec {
  pname = "dkimpy";
-  version = "1.1.3";
+  version = "1.1.4";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-8zIhlR9jOBEXb9D1qGH0S8I721/cKn+jWXUxlUAbEwg=";
+    hash = "sha256-7bbng4OzpUx3K8n/eG5+7X12pXupRiCdmVG0P1BzqwI=";
 };

  nativeCheckInputs = [ pytest ];
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "dvc-data";
-  version = "0.50.0";
+  version = "0.51.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-TWn+9u+m9CwRoJRcFvRT45TXq7U08nc/3NLDKshNcJc=";
+    hash = "sha256-kLxwBFDoGEZ8w3PHEh8IVDEbmlbwazhZBAoBAUQFDEo=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/glean-parser/default.nix
+++ b/pkgs/development/python-modules/glean-parser/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "glean-parser";
-  version = "7.1.0";
+  version = "7.2.1";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -23,7 +23,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "glean_parser";
    inherit version;
-    hash = "sha256-IgBaLVTVF4pGkC5EKZvLaa7U6Lwy2r/xit3E26kWEas=";
+    hash = "sha256-EUlqwAT+QhuRTH+9yaHWIOSCHVbh2fZVI9OFjNuQe70=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/gplaycli/default.nix
+++ b/pkgs/development/python-modules/gplaycli/default.nix
@ -1,25 +1,76 @@
-{ buildPythonPackage, lib, libffi, isPy3k, pyasn1, clint, ndg-httpsclient
-, protobuf, requests, args, matlink-gpapi, pyaxmlparser, setuptools, fetchFromGitHub
+{ lib
+, args
+, buildPythonPackage
+, clint
+, fetchFromGitHub
+, libffi
+, matlink-gpapi
+, ndg-httpsclient
+, protobuf
+, pyasn1
+, pyaxmlparser
+, pytestCheckHook
+, pythonOlder
+, requests
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "gplaycli";
  version = "3.29";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "matlink";
    repo = "gplaycli";
-    rev = version;
-    sha256 = "10gc1wr259z5hxyk834wyyggvyh82agfq0zp711s4jf334inp45r";
+    rev = "refs/tags/${version}";
+    hash = "sha256-uZBrIxnDSaJDOPcD7J4SCPr9nvecDDR9h+WnIjIP7IE=";
  };

-  disabled = !isPy3k;
+  propagatedBuildInputs = [
+    libffi
+    pyasn1
+    clint
+    ndg-httpsclient
+    protobuf
+    requests
+    args
+    matlink-gpapi
+    pyaxmlparser
+    setuptools
+  ];

-  propagatedBuildInputs = [ libffi pyasn1 clint ndg-httpsclient protobuf requests args matlink-gpapi pyaxmlparser setuptools ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "gplaycli"
+  ];
+
+  preCheck = ''
+    export PATH="$PATH:$out/bin";
+  '';
+
+  disabledTests = [
+    "test_alter_token"
+    "test_another_device"
+    "test_connection_credentials"
+    "test_connection_token"
+    "test_download_additional_files"
+    "test_download_focus"
+    "test_download_version"
+    "test_download"
+    "test_search"
+    "test_update"
+  ];

  meta = with lib; {
-    homepage = "https://github.com/matlink/gplaycli";
    description = "Google Play Downloader via Command line";
+    homepage = "https://github.com/matlink/gplaycli";
+    changelog = "https://github.com/matlink/gplaycli/releases/tag/${version}";
    license = licenses.agpl3Plus;
    maintainers = with maintainers; [ ];
  };
--- a/pkgs/development/python-modules/gspread/default.nix
+++ b/pkgs/development/python-modules/gspread/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "gspread";
-  version = "5.8.0";
+  version = "5.9.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-+XOeK4Odf6H4pfDPDU7mjHduL79L/jFnrS6RC9WI+0Q=";
+    hash = "sha256-NLl4NLvvrM9ySXcCuuJtEvltBoXkmkGK/mqSqbvLnJw=";
  };

  propagatedBuildInputs = [
--- a/Show More
+++ b/Show More