Merge master into staging-next

2022-12-16 00:02:17 +00:00 · 2022-12-16 00:02:17 +00:00 · b9ac6ee4d9
commit b9ac6ee4d9
parent c2a66b3c22 bf012373ca
82 changed files with 480 additions and 342 deletions
--- a/lib/strings.nix
+++ b/lib/strings.nix
@ -328,7 +328,7 @@ rec {
       escape ["(" ")"] "(foo)"
       => "\\(foo\\)"
  */
-  escape = list: replaceChars list (map (c: "\\${c}") list);
+  escape = list: replaceStrings list (map (c: "\\${c}") list);

  /* Escape occurence of the element of `list` in `string` by
     converting to its ASCII value and prefixing it with \\x.
@ -341,7 +341,7 @@ rec {
       => "foo\\x20bar"

  */
-  escapeC = list: replaceChars list (map (c: "\\x${ toLower (lib.toHexString (charToInt c))}") list);
+  escapeC = list: replaceStrings list (map (c: "\\x${ toLower (lib.toHexString (charToInt c))}") list);

  /* Quote string to be used safely within the Bourne shell.

@ -471,19 +471,8 @@ rec {
    ["\"" "'" "<" ">" "&"]
    ["&quot;" "&apos;" "&lt;" "&gt;" "&amp;"];

-  # Obsolete - use replaceStrings instead.
-  replaceChars = builtins.replaceStrings or (
-    del: new: s:
-    let
-      substList = lib.zipLists del new;
-      subst = c:
-        let found = lib.findFirst (sub: sub.fst == c) null substList; in
-        if found == null then
-          c
-        else
-          found.snd;
-    in
-      stringAsChars subst s);
+  # warning added 12-12-2022
+  replaceChars = lib.warn "replaceChars is a deprecated alias of replaceStrings, replace usages of it with replaceStrings." builtins.replaceStrings;

  # Case conversion utilities.
  lowerChars = stringToCharacters "abcdefghijklmnopqrstuvwxyz";
@ -497,7 +486,7 @@ rec {
       toLower "HOME"
       => "home"
  */
-  toLower = replaceChars upperChars lowerChars;
+  toLower = replaceStrings upperChars lowerChars;

  /* Converts an ASCII string to upper-case.

@ -507,7 +496,7 @@ rec {
       toUpper "home"
       => "HOME"
  */
-  toUpper = replaceChars lowerChars upperChars;
+  toUpper = replaceStrings lowerChars upperChars;

  /* Appends string context from another string.  This is an implementation
     detail of Nix and should be used carefully.
--- a/nixos/lib/systemd-lib.nix
+++ b/nixos/lib/systemd-lib.nix
@ -8,9 +8,9 @@ let
  systemd = cfg.package;
 in rec {

-  shellEscape = s: (replaceChars [ "\\" ] [ "\\\\" ] s);
+  shellEscape = s: (replaceStrings [ "\\" ] [ "\\\\" ] s);

-  mkPathSafeName = lib.replaceChars ["@" ":" "\\" "[" "]"] ["-" "-" "-" "" ""];
+  mkPathSafeName = lib.replaceStrings ["@" ":" "\\" "[" "]"] ["-" "-" "-" "" ""];

  # a type for options that take a unit name
  unitNameType = types.strMatching "[a-zA-Z0-9@%:_.\\-]+[.](service|socket|device|mount|automount|swap|target|path|timer|scope|slice)";
@ -258,7 +258,7 @@ in rec {

  makeJobScript = name: text:
    let
-      scriptName = replaceChars [ "\\" "@" ] [ "-" "_" ] (shellEscape name);
+      scriptName = replaceStrings [ "\\" "@" ] [ "-" "_" ] (shellEscape name);
      out = (pkgs.writeShellScriptBin scriptName ''
        set -e
        ${text}
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@ -48,7 +48,7 @@ rec {
    trim = s: removeSuffix "/" (removePrefix "/" s);
    normalizedPath = strings.normalizePath s;
  in
-    replaceChars ["/"] ["-"]
+    replaceStrings ["/"] ["-"]
    (replacePrefix "." (strings.escapeC ["."] ".")
    (strings.escapeC (stringToCharacters " !\"#$%&'()*+,;<=>=@[\\]^`{|}~-")
    (if normalizedPath == "/" then normalizedPath else trim normalizedPath)));
@ -67,7 +67,7 @@ rec {
        else if builtins.isInt arg || builtins.isFloat arg then toString arg
        else throw "escapeSystemdExecArg only allows strings, paths and numbers";
    in
-      replaceChars [ "%" "$" ] [ "%%" "$$" ] (builtins.toJSON s);
+      replaceStrings [ "%" "$" ] [ "%%" "$$" ] (builtins.toJSON s);

  # Quotes a list of arguments into a single string for use in a Exec*
  # line.
@ -112,7 +112,7 @@ rec {
        else if isAttrs item then
          map (name:
            let
-              escapedName = ''"${replaceChars [''"'' "\\"] [''\"'' "\\\\"] name}"'';
+              escapedName = ''"${replaceStrings [''"'' "\\"] [''\"'' "\\\\"] name}"'';
            in
              recurse (prefix + "." + escapedName) item.${name}) (attrNames item)
        else if isList item then
--- a/nixos/modules/config/swap.nix
+++ b/nixos/modules/config/swap.nix
@ -160,7 +160,7 @@ let
    config = rec {
      device = mkIf options.label.isDefined
        "/dev/disk/by-label/${config.label}";
-      deviceName = lib.replaceChars ["\\"] [""] (escapeSystemdPath config.device);
+      deviceName = lib.replaceStrings ["\\"] [""] (escapeSystemdPath config.device);
      realDevice = if config.randomEncryption.enable then "/dev/mapper/${deviceName}" else config.device;
    };

--- a/nixos/modules/programs/xfs_quota.nix
+++ b/nixos/modules/programs/xfs_quota.nix
@ -94,7 +94,7 @@ in
        '';

        wantedBy = [ "multi-user.target" ];
-        after = [ ((replaceChars [ "/" ] [ "-" ] opts.fileSystem) + ".mount") ];
+        after = [ ((replaceStrings [ "/" ] [ "-" ] opts.fileSystem) + ".mount") ];

        restartTriggers = [ config.environment.etc.projects.source ];

--- a/nixos/modules/services/mail/listmonk.nix
+++ b/nixos/modules/services/mail/listmonk.nix
@ -8,7 +8,7 @@ let
  # Escaping is done according to https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-CONSTANTS
  setDatabaseOption = key: value:
    "UPDATE settings SET value = '${
-      lib.replaceChars [ "'" ] [ "''" ] (builtins.toJSON value)
+      lib.replaceStrings [ "'" ] [ "''" ] (builtins.toJSON value)
    }' WHERE key = '${key}';";
  updateDatabaseConfigSQL = pkgs.writeText "update-database-config.sql"
    (concatStringsSep "\n" (mapAttrsToList setDatabaseOption
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@ -3,7 +3,7 @@
 with lib;

 let
-  json = pkgs.formats.json { };
+  yaml = pkgs.formats.yaml { };
  cfg = config.services.prometheus;
  checkConfigEnabled =
    (lib.isBool cfg.checkConfig && cfg.checkConfig)
@ -11,8 +11,6 @@ let

  workingDir = "/var/lib/" + cfg.stateDir;

-  prometheusYmlOut = "${workingDir}/prometheus-substituted.yaml";
-
  triggerReload = pkgs.writeShellScriptBin "trigger-reload-prometheus" ''
    PATH="${makeBinPath (with pkgs; [ systemd ])}"
    if systemctl -q is-active prometheus.service; then
@ -38,7 +36,7 @@ let
        promtool ${what} $out
      '' else file;

-  generatedPrometheusYml = json.generate "prometheus.yml" promConfig;
+  generatedPrometheusYml = yaml.generate "prometheus.yml" promConfig;

  # This becomes the main config file for Prometheus
  promConfig = {
@ -73,7 +71,8 @@ let
    "--web.listen-address=${cfg.listenAddress}:${builtins.toString cfg.port}"
    "--alertmanager.notification-queue-capacity=${toString cfg.alertmanagerNotificationQueueCapacity}"
  ] ++ optional (cfg.webExternalUrl != null) "--web.external-url=${cfg.webExternalUrl}"
-    ++ optional (cfg.retentionTime != null) "--storage.tsdb.retention.time=${cfg.retentionTime}";
+    ++ optional (cfg.retentionTime != null) "--storage.tsdb.retention.time=${cfg.retentionTime}"
+    ++ optional (cfg.webConfigFile != null) "--web.config.file=${cfg.webConfigFile}";

  filterValidPrometheus = filterAttrsListRecursive (n: v: !(n == "_module" || v == null));
  filterAttrsListRecursive = pred: x:
@ -1719,6 +1718,15 @@ in
      '';
    };

+    webConfigFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = lib.mdDoc ''
+        Specifies which file should be used as web.config.file and be passed on startup.
+        See https://prometheus.io/docs/prometheus/latest/configuration/https/ for valid options.
+      '';
+    };
+
    checkConfig = mkOption {
      type = with types; either bool (enum [ "syntax-only" ]);
      default = true;
--- a/nixos/modules/services/networking/supplicant.nix
+++ b/nixos/modules/services/networking/supplicant.nix
@ -13,7 +13,7 @@ let
  serviceName = iface: "supplicant-${if (iface=="WLAN") then "wlan@" else (
                                     if (iface=="LAN") then "lan@" else (
                                     if (iface=="DBUS") then "dbus"
-                                     else (replaceChars [" "] ["-"] iface)))}";
+                                     else (replaceStrings [" "] ["-"] iface)))}";

  # TODO: Use proper privilege separation for wpa_supplicant
  supplicantService = iface: suppl:
@ -27,7 +27,7 @@ let
      driverArg = optionalString (suppl.driver != null) "-D${suppl.driver}";
      bridgeArg = optionalString (suppl.bridge!="") "-b${suppl.bridge}";
      confFileArg = optionalString (suppl.configFile.path!=null) "-c${suppl.configFile.path}";
-      extraConfFile = pkgs.writeText "supplicant-extra-conf-${replaceChars [" "] ["-"] iface}" ''
+      extraConfFile = pkgs.writeText "supplicant-extra-conf-${replaceStrings [" "] ["-"] iface}" ''
        ${optionalString suppl.userControlled.enable "ctrl_interface=DIR=${suppl.userControlled.socketDir} GROUP=${suppl.userControlled.group}"}
        ${optionalString suppl.configFile.writable "update_config=1"}
        ${suppl.extraConf}
@ -223,7 +223,7 @@ in
        text = ''
          ${flip (concatMapStringsSep "\n") (filter (n: n!="WLAN" && n!="LAN" && n!="DBUS") (attrNames cfg)) (iface:
            flip (concatMapStringsSep "\n") (splitString " " iface) (i: ''
-              ACTION=="add", SUBSYSTEM=="net", ENV{INTERFACE}=="${i}", TAG+="systemd", ENV{SYSTEMD_WANTS}+="supplicant-${replaceChars [" "] ["-"] iface}.service", TAG+="SUPPLICANT_ASSIGNED"''))}
+              ACTION=="add", SUBSYSTEM=="net", ENV{INTERFACE}=="${i}", TAG+="systemd", ENV{SYSTEMD_WANTS}+="supplicant-${replaceStrings [" "] ["-"] iface}.service", TAG+="SUPPLICANT_ASSIGNED"''))}

          ${optionalString (hasAttr "WLAN" cfg) ''
            ACTION=="add", SUBSYSTEM=="net", ENV{DEVTYPE}=="wlan", TAG!="SUPPLICANT_ASSIGNED", TAG+="systemd", PROGRAM="/run/current-system/systemd/bin/systemd-escape -p %E{INTERFACE}", ENV{SYSTEMD_WANTS}+="supplicant-wlan@$result.service"
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@ -315,7 +315,7 @@ let

  peerUnitServiceName = interfaceName: publicKey: dynamicRefreshEnabled:
    let
-      keyToUnitName = replaceChars
+      keyToUnitName = replaceStrings
        [ "/" "-"    " "     "+"     "="      ]
        [ "-" "\\x2d" "\\x20" "\\x2b" "\\x3d" ];
      unitName = keyToUnitName publicKey;
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@ -38,7 +38,7 @@ let
  grubConfig = args:
    let
      efiSysMountPoint = if args.efiSysMountPoint == null then args.path else args.efiSysMountPoint;
-      efiSysMountPoint' = replaceChars [ "/" ] [ "-" ] efiSysMountPoint;
+      efiSysMountPoint' = replaceStrings [ "/" ] [ "-" ] efiSysMountPoint;
    in
    pkgs.writeText "grub-config.xml" (builtins.toXML
    { splashImage = f cfg.splashImage;
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -1377,12 +1377,12 @@ in
      # networkmanager falls back to "/proc/sys/net/ipv6/conf/default/use_tempaddr"
      "net.ipv6.conf.default.use_tempaddr" = tempaddrValues.${cfg.tempAddresses}.sysctl;
    } // listToAttrs (forEach interfaces
-        (i: nameValuePair "net.ipv4.conf.${replaceChars ["."] ["/"] i.name}.proxy_arp" i.proxyARP))
+        (i: nameValuePair "net.ipv4.conf.${replaceStrings ["."] ["/"] i.name}.proxy_arp" i.proxyARP))
      // listToAttrs (forEach interfaces
        (i: let
          opt = i.tempAddress;
          val = tempaddrValues.${opt}.sysctl;
-         in nameValuePair "net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr" val));
+         in nameValuePair "net.ipv6.conf.${replaceStrings ["."] ["/"] i.name}.use_tempaddr" val));

    security.wrappers = {
      ping = {
@ -1495,7 +1495,7 @@ in
          in
          ''
            # override to ${msg} for ${i.name}
-            ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr=${val}"
+            ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceStrings ["."] ["/"] i.name}.use_tempaddr=${val}"
          '') (filter (i: i.tempAddress != cfg.tempAddresses) interfaces);
      })
    ] ++ lib.optional (cfg.wlanInterfaces != {})
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@ -57,7 +57,7 @@ let

        hardware.enableAllFirmware = lib.mkForce false;

-        ${replaceChars ["\n"] ["\n  "] extraConfig}
+        ${replaceStrings ["\n"] ["\n  "] extraConfig}
      }
    '';

--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -6,7 +6,7 @@
 let
  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
  inherit (pkgs.lib) concatStringsSep maintainers mapAttrs mkMerge
-    removeSuffix replaceChars singleton splitString;
+    removeSuffix replaceStrings singleton splitString;

  /*
    * The attrset `exporterTests` contains one attribute
@ -182,7 +182,7 @@ let
        enable = true;
        extraFlags = [ "--web.collectd-push-path /collectd" ];
      };
-      exporterTest = let postData = replaceChars [ "\n" ] [ "" ] ''
+      exporterTest = let postData = replaceStrings [ "\n" ] [ "" ] ''
        [{
          "values":[23],
          "dstypes":["gauge"],
--- a/pkgs/applications/audio/munt/libmt32emu.nix
+++ b/pkgs/applications/audio/munt/libmt32emu.nix
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "munt";
    repo = "munt";
-    rev = "${pname}_${lib.replaceChars [ "." ] [ "_" ] version}";
+    rev = "${pname}_${lib.replaceStrings [ "." ] [ "_" ] version}";
    sha256 = "sha256-XGds9lDfSiY0D8RhYG4TGyjYEVvVYuAfNSv9+VxiJEs=";
  };

--- a/pkgs/applications/audio/munt/mt32emu-qt.nix
+++ b/pkgs/applications/audio/munt/mt32emu-qt.nix
@ -14,7 +14,7 @@
 }:

 let
-  char2underscore = char: str: lib.replaceChars [ char ] [ "_" ] str;
+  char2underscore = char: str: lib.replaceStrings [ char ] [ "_" ] str;
 in
 mkDerivation rec {
  pname = "mt32emu-qt";
--- a/pkgs/applications/audio/munt/mt32emu-smf2wav.nix
+++ b/pkgs/applications/audio/munt/mt32emu-smf2wav.nix
@ -8,7 +8,7 @@
 }:

 let
-  char2underscore = char: str: lib.replaceChars [ char ] [ "_" ] str;
+  char2underscore = char: str: lib.replaceStrings [ char ] [ "_" ] str;
 in
 stdenv.mkDerivation rec {
  pname = "mt32emu-smf2wav";
--- a/pkgs/applications/audio/qjackctl/default.nix
+++ b/pkgs/applications/audio/qjackctl/default.nix
@ -13,7 +13,7 @@ mkDerivation rec {
  src = fetchFromGitHub {
    owner = "rncbc";
    repo = "qjackctl";
-    rev = "${pname}_${lib.replaceChars ["."] ["_"] version}";
+    rev = "${pname}_${lib.replaceStrings ["."] ["_"] version}";
    sha256 = "sha256-PchW9cM5qEP51G9RXUZ3j/AvKqTkgNiw3esqSQqsy0M=";
  };

--- a/pkgs/applications/audio/roomeqwizard/default.nix
+++ b/pkgs/applications/audio/roomeqwizard/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
  version = "5.20.5";

  src = fetchurl {
-    url = "https://www.roomeqwizard.com/installers/REW_linux_${lib.replaceChars [ "." ] [ "_" ] version}.sh";
+    url = "https://www.roomeqwizard.com/installers/REW_linux_${lib.replaceStrings [ "." ] [ "_" ] version}.sh";
    sha256 = "NYTRiOZmwkni4k+jI2SV84z5umO7+l+eKpwPCdlDD3U=";
  };

--- a/pkgs/applications/editors/jetbrains/linux.nix
+++ b/pkgs/applications/editors/jetbrains/linux.nix
@ -21,7 +21,7 @@ with stdenv; lib.makeOverridable mkDerivation (rec {
  desktopItem = makeDesktopItem {
    name = pname;
    exec = pname;
-    comment = lib.replaceChars ["\n"] [" "] meta.longDescription;
+    comment = lib.replaceStrings ["\n"] [" "] meta.longDescription;
    desktopName = product;
    genericName = meta.description;
    categories = [ "Development" ];
--- a/pkgs/applications/emulators/atari800/default.nix
+++ b/pkgs/applications/emulators/atari800/default.nix
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "atari800";
    repo = "atari800";
-    rev = "ATARI800_${replaceChars ["."] ["_"] version}";
+    rev = "ATARI800_${replaceStrings ["."] ["_"] version}";
    sha256 = "sha256-+eJXhqPyU0GhmzF7DbteTXzEnn5klCor9Io/UgXQfQg=";
  };

--- a/pkgs/applications/emulators/desmume/default.nix
+++ b/pkgs/applications/emulators/desmume/default.nix
@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "TASVideos";
    repo = "desmume";
-    rev = "release_${lib.replaceChars ["."] ["_"] finalAttrs.version}";
+    rev = "release_${lib.replaceStrings ["."] ["_"] finalAttrs.version}";
    hash = "sha256-vmjKXa/iXLTwtqnG+ZUvOnOQPZROeMpfM5J3Jh/Ynfo=";
  };

--- a/pkgs/applications/emulators/retroarch/mkLibretroCore.nix
+++ b/pkgs/applications/emulators/retroarch/mkLibretroCore.nix
@ -16,7 +16,7 @@
 }@args:

 let
-  d2u = if normalizeCore then (lib.replaceChars [ "-" ] [ "_" ]) else (x: x);
+  d2u = if normalizeCore then (lib.replaceStrings [ "-" ] [ "_" ]) else (x: x);
  coreDir = placeholder "out" + libretroCore;
  coreFilename = "${d2u core}_libretro${stdenv.hostPlatform.extensions.sharedLibrary}";
  mainProgram = "retroarch-${core}";
--- a/pkgs/applications/maui/default.nix
+++ b/pkgs/applications/maui/default.nix
@ -78,6 +78,7 @@ let
      nota = callPackage ./nota.nix { };
      pix = callPackage ./pix.nix { };
      shelf = callPackage ./shelf.nix { };
+      station = callPackage ./station.nix { };
      vvave = callPackage ./vvave.nix { };
    };

--- a/pkgs/applications/maui/station.nix
+++ b/pkgs/applications/maui/station.nix
@ -0,0 +1,36 @@
+{ lib
+, mkDerivation
+, cmake
+, extra-cmake-modules
+, kcoreaddons
+, ki18n
+, kirigami2
+, mauikit
+, mauikit-filebrowsing
+, qmltermwidget
+}:
+
+mkDerivation {
+  pname = "station";
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+  ];
+
+  buildInputs = [
+    kcoreaddons
+    ki18n
+    kirigami2
+    mauikit
+    mauikit-filebrowsing
+    qmltermwidget
+  ];
+
+  meta = with lib; {
+    description = "Convergent terminal emulator";
+    homepage = "https://invent.kde.org/maui/station";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ onny ];
+  };
+}
--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@ -105,7 +105,7 @@ let
    };
  };

-  d2u = lib.replaceChars ["."] ["_"];
+  d2u = lib.replaceStrings ["."] ["_"];

 in {

--- a/pkgs/applications/misc/sweethome3d/editors.nix
+++ b/pkgs/applications/misc/sweethome3d/editors.nix
@ -81,7 +81,7 @@ let

  };

-  d2u = lib.replaceChars ["."] ["_"];
+  d2u = lib.replaceStrings ["."] ["_"];

 in {

--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -19,9 +19,9 @@
    }
  },
  "beta": {
-    "version": "109.0.5414.36",
-    "sha256": "14kicgbadb83401dpfqnz3hb3dxi55nfydj5wpmg29dyw0bdndpm",
-    "sha256bin64": "11lpv9432xqkdj4q89sfyd0261444s9amncnzdmij93ni1wac8b4",
+    "version": "109.0.5414.46",
+    "sha256": "17wzll9024c80fhgxi33ix1rpmqh9sbpx6qvw9cvhdlmhn0b5017",
+    "sha256bin64": "199n8a7pjnhbgkm2dwh9hq7pzf39x932bh6b056jqp032d5c00ns",
    "deps": {
      "gn": {
        "version": "2022-11-10",
@ -32,9 +32,9 @@
    }
  },
  "dev": {
-    "version": "110.0.5449.0",
-    "sha256": "1zims8jw7k53qpv4kml3n15hy587jgg0sai7j4zrv3i3lk8jr6g7",
-    "sha256bin64": "1ykgxr3jxbqdgrq6g6vzbxnig05vljzdx800j6hn3kxwr9cdqwxn",
+    "version": "110.0.5464.2",
+    "sha256": "18k4rrwszk4xz416xi6li9b5pdajlscfgg4cyv67y10z7f28qwby",
+    "sha256bin64": "0hzv55bba4041400zjysgzz1n8svzvi156xyrayfr5ynapf7g2rd",
    "deps": {
      "gn": {
        "version": "2022-11-29",
@ -45,8 +45,8 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "108.0.5359.99",
-    "sha256": "0v5ynal3s28s4f9s4s95hblnjxiy6498qmk04s0vf2ixqwi7rivn",
+    "version": "108.0.5359.125",
+    "sha256": "0n8aigw7qv6dzd8898xz435kj79z73v916amfaxyz69g57pnpqhn",
    "sha256bin64": null,
    "deps": {
      "gn": {
@ -56,8 +56,8 @@
        "sha256": "1rhadb6qk867jafr85x2m3asis3jv7x06blhmad2d296p26d5w6x"
      },
      "ungoogled-patches": {
-        "rev": "108.0.5359.99-1",
-        "sha256": "0qibibgi54mdwmmcmz613qk9mgjczspvq09bz5m0wpkxbx7hla0i"
+        "rev": "108.0.5359.125-1",
+        "sha256": "1dacvzi6j4xyjjnrsb79mhhj7jc992z1di9acl4appfydlqadgv3"
      }
    }
  }
--- a/pkgs/applications/science/math/weka/default.nix
+++ b/pkgs/applications/science/math/weka/default.nix
@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
  version = "3.9.6";

  src = fetchurl {
-    url = "mirror://sourceforge/weka/${lib.replaceChars ["."]["-"] "${pname}-${version}"}.zip";
+    url = "mirror://sourceforge/weka/${lib.replaceStrings ["."]["-"] "${pname}-${version}"}.zip";
    sha256 = "sha256-8fVN4MXYqXNEmyVtXh1IrauHTBZWgWG8AvsGI5Y9Aj0=";
  };

--- a/pkgs/applications/science/misc/openmodelica/omlibrary/fakegit.nix
+++ b/pkgs/applications/science/misc/openmodelica/omlibrary/fakegit.nix
@ -13,7 +13,7 @@ let

  hashname = r:
    let
-      rpl = lib.replaceChars [ ":" "/" ] [ "_" "_" ];
+      rpl = lib.replaceStrings [ ":" "/" ] [ "_" "_" ];
    in
    (rpl r.url) + "-" + (rpl r.rev);

--- a/pkgs/build-support/fetchmavenartifact/default.nix
+++ b/pkgs/build-support/fetchmavenartifact/default.nix
@ -39,14 +39,14 @@ assert (repos != []) || (url != "") || (urls != []);
 let
  name_ =
    lib.concatStrings [
-      (lib.replaceChars ["."] ["_"] groupId) "_"
-      (lib.replaceChars ["."] ["_"] artifactId) "-"
+      (lib.replaceStrings ["."] ["_"] groupId) "_"
+      (lib.replaceStrings ["."] ["_"] artifactId) "-"
      version
    ];
  mkJarUrl = repoUrl:
    lib.concatStringsSep "/" [
      (lib.removeSuffix "/" repoUrl)
-      (lib.replaceChars ["."] ["/"] groupId)
+      (lib.replaceStrings ["."] ["/"] groupId)
      artifactId
      version
      "${artifactId}-${version}${lib.optionalString (!isNull classifier) "-${classifier}"}.jar"
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@ -32,7 +32,7 @@ let version_ = lib.splitString "-" crateVersion;
    completeDepsDir = lib.concatStringsSep " " completeDeps;
    completeBuildDepsDir = lib.concatStringsSep " " completeBuildDeps;
    envFeatures = lib.concatStringsSep " " (
-      map (f: lib.replaceChars ["-"] ["_"] (lib.toUpper f)) crateFeatures
+      map (f: lib.replaceStrings ["-"] ["_"] (lib.toUpper f)) crateFeatures
    );
 in ''
  ${echo_colored colors}
--- a/pkgs/development/compilers/elm/makeDotElm.nix
+++ b/pkgs/development/compilers/elm/makeDotElm.nix
@ -3,7 +3,7 @@
 ver: deps:
  let cmds = lib.mapAttrsToList (name: info: let
               pkg = stdenv.mkDerivation {
-                 name = lib.replaceChars ["/"] ["-"] name + "-${info.version}";
+                 name = lib.replaceStrings ["/"] ["-"] name + "-${info.version}";

                 src = fetchurl {
                   url = "https://github.com/${name}/archive/${info.version}.tar.gz";
--- a/pkgs/development/interpreters/gauche/default.nix
+++ b/pkgs/development/interpreters/gauche/default.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "shirok";
    repo = pname;
-    rev = "release${lib.replaceChars [ "." ] [ "_" ] version}";
+    rev = "release${lib.replaceStrings [ "." ] [ "_" ] version}";
    sha256 = "0ki1w7sa10ivmg51sqjskby0gsznb0d3738nz80x589033km5hmb";
  };

--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@ -9,7 +9,7 @@ let

  baseAttrs = {
    src = fetchurl {
-      url = "https://github.com/unicode-org/icu/releases/download/release-${lib.replaceChars [ "." ] [ "-" ] version}/icu4c-${lib.replaceChars [ "." ] [ "_" ] version}-src.tgz";
+      url = "https://github.com/unicode-org/icu/releases/download/release-${lib.replaceStrings [ "." ] [ "-" ] version}/icu4c-${lib.replaceStrings [ "." ] [ "_" ] version}-src.tgz";
      inherit sha256;
    };

--- a/pkgs/development/libraries/java/hsqldb/default.nix
+++ b/pkgs/development/libraries/java/hsqldb/default.nix
@ -3,7 +3,7 @@
 stdenv.mkDerivation rec {
  pname = "hsqldb";
  version = "2.7.1";
-  underscoreMajMin = lib.strings.replaceChars ["."] ["_"] (lib.versions.majorMinor version);
+  underscoreMajMin = lib.replaceStrings ["."] ["_"] (lib.versions.majorMinor version);

  src = fetchurl {
    url = "mirror://sourceforge/project/hsqldb/hsqldb/hsqldb_${underscoreMajMin}/hsqldb-${version}.zip";
--- a/pkgs/development/libraries/muparser/default.nix
+++ b/pkgs/development/libraries/muparser/default.nix
@ -3,7 +3,7 @@
 stdenv.mkDerivation rec {
  pname = "muparser";
  version = "2.2.3";
-  url-version = lib.replaceChars ["."] ["_"] version;
+  url-version = lib.replaceStrings ["."] ["_"] version;

  src = fetchurl {
    url = "mirror://sourceforge/muparser/muparser_v${url-version}.zip";
--- a/pkgs/development/libraries/opendkim/default.nix
+++ b/pkgs/development/libraries/opendkim/default.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "trusteddomainproject";
    repo = "OpenDKIM";
-    rev = "rel-opendkim-${lib.replaceChars ["."] ["-"] version}";
+    rev = "rel-opendkim-${lib.replaceStrings ["."] ["-"] version}";
    sha256 = "0nx3in8sa6xna4vfacj8g60hfzk61jpj2ldag80xzxip9c3rd2pw";
  };

--- a/pkgs/development/libraries/opensubdiv/default.nix
+++ b/pkgs/development/libraries/opensubdiv/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "PixarAnimationStudios";
    repo = "OpenSubdiv";
-    rev = "v${lib.replaceChars ["."] ["_"] version}";
+    rev = "v${lib.replaceStrings ["."] ["_"] version}";
    sha256 = "sha256-ejxQ5mGIIrEa/rAfkTrRbIRerrAvEPoWn7e0lIqS1JQ=";
  };

--- a/pkgs/development/mobile/androidenv/build-app.nix
+++ b/pkgs/development/mobile/androidenv/build-app.nix
@ -16,7 +16,7 @@ let
  extraArgs = removeAttrs args ([ "name" ] ++ builtins.attrNames androidSdkFormalArgs);
 in
 stdenv.mkDerivation ({
-  name = lib.replaceChars [" "] [""] name; # Android APKs may contain white spaces in their names, but Nix store paths cannot
+  name = lib.replaceStrings [" "] [""] name; # Android APKs may contain white spaces in their names, but Nix store paths cannot
  ANDROID_HOME = "${androidsdk}/libexec/android-sdk";
  buildInputs = [ jdk ant ];
  buildPhase = ''
--- a/pkgs/development/mobile/androidenv/build-tools.nix
+++ b/pkgs/development/mobile/androidenv/build-tools.nix
@ -1,10 +1,10 @@
-{deployAndroidPackage, lib, package, os, autoPatchelfHook, makeWrapper, pkgs, pkgs_i686}:
+{deployAndroidPackage, lib, package, os, autoPatchelfHook, makeWrapper, pkgs, pkgsi686Linux}:

 deployAndroidPackage {
  inherit package os;
  nativeBuildInputs = [ makeWrapper ]
    ++ lib.optionals (os == "linux") [ autoPatchelfHook ];
-  buildInputs = lib.optionals (os == "linux") [ pkgs.glibc pkgs.zlib pkgs.ncurses5 pkgs_i686.glibc pkgs_i686.zlib pkgs_i686.ncurses5 pkgs.libcxx ];
+  buildInputs = lib.optionals (os == "linux") [ pkgs.glibc pkgs.zlib pkgs.ncurses5 pkgsi686Linux.glibc pkgsi686Linux.zlib pkgsi686Linux.ncurses5 pkgs.libcxx ];
  patchInstructions = ''
    ${lib.optionalString (os == "linux") ''
      addAutoPatchelfSearchPath $packageBaseDir/lib
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@ -1,4 +1,4 @@
-{ requireFile, autoPatchelfHook, pkgs, pkgsHostHost, pkgs_i686
+{ callPackage, stdenv, lib, fetchurl, ruby, writeText
 , licenseAccepted ? false
 }:

@ -25,9 +25,6 @@
 }:

 let
-  inherit (pkgs) stdenv lib fetchurl;
-  inherit (pkgs.buildPackages) makeWrapper unzip;
-
  # Determine the Android os identifier from Nix's system identifier
  os = if stdenv.system == "x86_64-linux" then "linux"
    else if stdenv.system == "x86_64-darwin" then "macosx"
@ -35,7 +32,7 @@ let

  # Uses mkrepo.rb to create a repo spec.
  mkRepoJson = { packages ? [], images ? [], addons ? [] }: let
-    mkRepoRuby = (pkgs.ruby.withPackages (pkgs: with pkgs; [ slop nokogiri ]));
+    mkRepoRuby = (ruby.withPackages (pkgs: with pkgs; [ slop nokogiri ]));
    mkRepoRubyArguments = lib.lists.flatten [
      (builtins.map (package: ["--packages" "${package}"]) packages)
      (builtins.map (image: ["--images" "${image}"]) images)
@ -115,25 +112,24 @@ let
  ] ++ extraLicenses);
 in
 rec {
-  deployAndroidPackage = import ./deploy-androidpackage.nix {
-    inherit stdenv unzip;
+  deployAndroidPackage = callPackage ./deploy-androidpackage.nix {
  };

-  platform-tools = import ./platform-tools.nix {
-    inherit deployAndroidPackage autoPatchelfHook pkgs lib;
+  platform-tools = callPackage ./platform-tools.nix {
+    inherit deployAndroidPackage;
    os = if stdenv.system == "aarch64-darwin" then "macosx" else os; # "macosx" is a universal binary here
    package = packages.platform-tools.${platformToolsVersion};
  };

  build-tools = map (version:
-    import ./build-tools.nix {
-      inherit deployAndroidPackage os autoPatchelfHook makeWrapper pkgs pkgs_i686 lib;
+    callPackage ./build-tools.nix {
+      inherit deployAndroidPackage;
      package = packages.build-tools.${version};
    }
  ) buildToolsVersions;

-  emulator = import ./emulator.nix {
-    inherit deployAndroidPackage os autoPatchelfHook makeWrapper pkgs pkgs_i686 lib;
+  emulator = callPackage ./emulator.nix {
+    inherit deployAndroidPackage os;
    package = packages.emulator.${emulatorVersion};
  };

@ -171,16 +167,16 @@ rec {
  ) platformVersions);

  cmake = map (version:
-    import ./cmake.nix {
-      inherit deployAndroidPackage os autoPatchelfHook pkgs lib stdenv;
+    callPackage ./cmake.nix {
+      inherit deployAndroidPackage os;
      package = packages.cmake.${version};
    }
  ) cmakeVersions;

  # Creates a NDK bundle.
  makeNdkBundle = ndkVersion:
-    import ./ndk-bundle {
-      inherit deployAndroidPackage os autoPatchelfHook makeWrapper pkgs pkgsHostHost lib platform-tools stdenv;
+    callPackage ./ndk-bundle {
+      inherit deployAndroidPackage os platform-tools;
      package = packages.ndk-bundle.${ndkVersion} or packages.ndk.${ndkVersion};
    };

@ -253,8 +249,8 @@ rec {
    ${lib.concatMapStringsSep "\n" (str: "  - ${str}") licenseNames}

    by setting nixpkgs config option 'android_sdk.accept_license = true;'.
-  '' else import ./tools.nix {
-    inherit deployAndroidPackage requireFile packages toolsVersion autoPatchelfHook makeWrapper os pkgs pkgs_i686 lib;
+  '' else callPackage ./tools.nix {
+    inherit deployAndroidPackage packages toolsVersion;

    postInstall = ''
      # Symlink all requested plugins
@ -323,7 +319,7 @@ rec {
      ${lib.concatMapStrings (licenseName:
        let
          licenseHashes = builtins.concatStringsSep "\n" (mkLicenseHashes licenseName);
-          licenseHashFile = pkgs.writeText "androidenv-${licenseName}" licenseHashes;
+          licenseHashFile = writeText "androidenv-${licenseName}" licenseHashes;
        in
        ''
          ln -s ${licenseHashFile} licenses/${licenseName}
--- a/pkgs/development/mobile/androidenv/default.nix
+++ b/pkgs/development/mobile/androidenv/default.nix
@ -1,21 +1,17 @@
-{ config, pkgs ? import <nixpkgs> {}, pkgsHostHost ? pkgs.pkgsHostHost
-, pkgs_i686 ? import <nixpkgs> { system = "i686-linux"; }
+{ config, pkgs ? import <nixpkgs> {}
 , licenseAccepted ? config.android_sdk.accept_license or false
 }:

 rec {
-  composeAndroidPackages = import ./compose-android-packages.nix {
-    inherit (pkgs) requireFile autoPatchelfHook;
-    inherit pkgs pkgsHostHost pkgs_i686 licenseAccepted;
+  composeAndroidPackages = pkgs.callPackage ./compose-android-packages.nix {
+    inherit licenseAccepted;
  };

-  buildApp = import ./build-app.nix {
-    inherit (pkgs) stdenv lib jdk ant gnumake gawk;
+  buildApp = pkgs.callPackage ./build-app.nix {
    inherit composeAndroidPackages;
  };

-  emulateApp = import ./emulate-app.nix {
-    inherit (pkgs) stdenv lib runtimeShell;
+  emulateApp = pkgs.callPackage ./emulate-app.nix {
    inherit composeAndroidPackages;
  };

--- a/pkgs/development/mobile/androidenv/emulator.nix
+++ b/pkgs/development/mobile/androidenv/emulator.nix
@ -1,4 +1,4 @@
-{ deployAndroidPackage, lib, package, os, autoPatchelfHook, makeWrapper, pkgs, pkgs_i686 }:
+{ deployAndroidPackage, lib, package, os, autoPatchelfHook, makeWrapper, pkgs, pkgsi686Linux }:

 deployAndroidPackage {
  inherit package os;
@ -13,7 +13,7 @@ deployAndroidPackage {
      zlib
      ncurses5
      stdenv.cc.cc
-      pkgs_i686.glibc
+      pkgsi686Linux.glibc
      expat
      freetype
      nss
--- a/pkgs/development/mobile/androidenv/examples/shell.nix
+++ b/pkgs/development/mobile/androidenv/examples/shell.nix
@ -7,11 +7,11 @@
    sha256 = "1wg61h4gndm3vcprdcg7rc4s1v3jkm5xd7lw8r2f67w502y94gcy";
  }),
  pkgs ? import nixpkgsSource {},
-  pkgs_i686 ? import nixpkgsSource { system = "i686-linux"; },*/
+  pkgsi686Linux ? import nixpkgsSource { system = "i686-linux"; },*/

  # If you want to use the in-tree version of nixpkgs:
  pkgs ? import ../../../../.. {},
-  pkgs_i686 ? import ../../../../.. { system = "i686-linux"; },
+  pkgsi686Linux ? import ../../../../.. { system = "i686-linux"; },

  config ? pkgs.config
 }:
@ -46,13 +46,13 @@ let
  };

  androidEnv = pkgs.callPackage "${androidEnvNixpkgs}/pkgs/development/mobile/androidenv" {
-    inherit config pkgs pkgs_i686;
+    inherit config pkgs pkgsi686Linux;
    licenseAccepted = true;
  };*/

  # Otherwise, just use the in-tree androidenv:
  androidEnv = pkgs.callPackage ./.. {
-    inherit config pkgs pkgs_i686;
+    inherit config pkgs pkgsi686Linux;
    licenseAccepted = true;
  };

--- a/pkgs/development/mobile/androidenv/platform-tools.nix
+++ b/pkgs/development/mobile/androidenv/platform-tools.nix
@ -2,7 +2,8 @@

 deployAndroidPackage {
  inherit package os;
-  buildInputs = lib.optionals (os == "linux") [ autoPatchelfHook pkgs.glibc pkgs.zlib pkgs.ncurses5 ];
+  nativeBuildInputs = lib.optionals (os == "linux") [ autoPatchelfHook ];
+  buildInputs = lib.optionals (os == "linux") [ pkgs.glibc pkgs.zlib pkgs.ncurses5 ];
  patchInstructions = lib.optionalString (os == "linux") ''
    addAutoPatchelfSearchPath $packageBaseDir/lib64
    autoPatchelf --no-recurse $packageBaseDir/lib64
--- a/pkgs/development/mobile/androidenv/tools.nix
+++ b/pkgs/development/mobile/androidenv/tools.nix
@ -1,7 +1,7 @@
-{deployAndroidPackage, requireFile, lib, packages, toolsVersion, autoPatchelfHook, makeWrapper, os, pkgs, pkgs_i686, postInstall ? ""}:
+{deployAndroidPackage, requireFile, lib, packages, toolsVersion, os, callPackage, postInstall ? ""}:

-if toolsVersion == "26.0.1" then import ./tools/26.nix {
-  inherit deployAndroidPackage lib autoPatchelfHook makeWrapper os pkgs pkgs_i686 postInstall;
+if toolsVersion == "26.0.1" then callPackage ./tools/26.nix {
+  inherit deployAndroidPackage lib os postInstall;
  package = {
    name = "tools";
    path = "tools";
@ -17,10 +17,10 @@ if toolsVersion == "26.0.1" then import ./tools/26.nix {
      };
    };
  };
-} else if toolsVersion == "26.1.1" then import ./tools/26.nix {
-  inherit deployAndroidPackage lib autoPatchelfHook makeWrapper os pkgs pkgs_i686 postInstall;
+} else if toolsVersion == "26.1.1" then callPackage ./tools/26.nix {
+  inherit deployAndroidPackage lib os postInstall;
  package = packages.tools.${toolsVersion};
-} else import ./tools/25.nix {
-  inherit deployAndroidPackage lib autoPatchelfHook makeWrapper os pkgs pkgs_i686 postInstall;
+} else callPackage ./tools/25.nix {
+  inherit deployAndroidPackage lib os postInstall;
  package = packages.tools.${toolsVersion};
 }
--- a/pkgs/development/mobile/androidenv/tools/25.nix
+++ b/pkgs/development/mobile/androidenv/tools/25.nix
@ -1,9 +1,9 @@
-{deployAndroidPackage, lib, package, autoPatchelfHook, makeWrapper, os, pkgs, pkgs_i686, postInstall ? ""}:
+{deployAndroidPackage, lib, package, autoPatchelfHook, makeWrapper, os, pkgs, pkgsi686Linux, postInstall ? ""}:

 deployAndroidPackage {
  name = "androidsdk";
  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
-  buildInputs = lib.optionals (os == "linux") [ pkgs.glibc pkgs.xorg.libX11 pkgs.xorg.libXext pkgs.xorg.libXdamage pkgs.xorg.libxcb pkgs.xorg.libXfixes pkgs.xorg.libXrender pkgs.fontconfig.lib pkgs.freetype pkgs.libGL pkgs.zlib pkgs.ncurses5 pkgs.libpulseaudio pkgs_i686.glibc pkgs_i686.xorg.libX11 pkgs_i686.xorg.libXrender pkgs_i686.fontconfig pkgs_i686.freetype pkgs_i686.zlib ];
+  buildInputs = lib.optionals (os == "linux") [ pkgs.glibc pkgs.xorg.libX11 pkgs.xorg.libXext pkgs.xorg.libXdamage pkgs.xorg.libxcb pkgs.xorg.libXfixes pkgs.xorg.libXrender pkgs.fontconfig.lib pkgs.freetype pkgs.libGL pkgs.zlib pkgs.ncurses5 pkgs.libpulseaudio pkgsi686Linux.glibc pkgsi686Linux.xorg.libX11 pkgsi686Linux.xorg.libXrender pkgsi686Linux.fontconfig pkgsi686Linux.freetype pkgsi686Linux.zlib ];
  inherit package os;

  patchInstructions = ''
--- a/pkgs/development/mobile/androidenv/tools/26.nix
+++ b/pkgs/development/mobile/androidenv/tools/26.nix
@ -1,4 +1,4 @@
-{deployAndroidPackage, lib, package, autoPatchelfHook, makeWrapper, os, pkgs, pkgs_i686, postInstall ? ""}:
+{deployAndroidPackage, lib, package, autoPatchelfHook, makeWrapper, os, pkgs, pkgsi686Linux, postInstall ? ""}:

 deployAndroidPackage {
  name = "androidsdk";
@ -8,7 +8,7 @@ deployAndroidPackage {
  buildInputs = lib.optional (os == "linux") (
      (with pkgs; [ glibc freetype fontconfig fontconfig.lib])
      ++ (with pkgs.xorg; [ libX11 libXrender libXext ])
-      ++ (with pkgs_i686; [ glibc xorg.libX11 xorg.libXrender xorg.libXext fontconfig.lib freetype zlib ])
+      ++ (with pkgsi686Linux; [ glibc xorg.libX11 xorg.libXrender xorg.libXext fontconfig.lib freetype zlib ])
    );

  patchInstructions = ''
--- a/pkgs/development/mobile/titaniumenv/build-app.nix
+++ b/pkgs/development/mobile/titaniumenv/build-app.nix
@ -34,7 +34,7 @@ let
  extraArgs = removeAttrs args [ "name" "preRebuild" "androidsdkArgs" "xcodewrapperArgs" ];
 in
 stdenv.mkDerivation ({
-  name = lib.replaceChars [" "] [""] name;
+  name = lib.replaceStrings [" "] [""] name;

  buildInputs = [ nodejs titanium alloy python which file jdk ];

--- a/pkgs/development/mobile/xcodeenv/build-app.nix
+++ b/pkgs/development/mobile/xcodeenv/build-app.nix
@ -53,7 +53,7 @@ let
  extraArgs = removeAttrs args ([ "name" "scheme" "xcodeFlags" "release" "certificateFile" "certificatePassword" "provisioningProfile" "signMethod" "generateIPA" "generateXCArchive" "enableWirelessDistribution" "installURL" "bundleId" "version" ] ++ builtins.attrNames xcodewrapperFormalArgs);
 in
 stdenv.mkDerivation ({
-  name = lib.replaceChars [" "] [""] name; # iOS app names can contain spaces, but in the Nix store this is not allowed
+  name = lib.replaceStrings [" "] [""] name; # iOS app names can contain spaces, but in the Nix store this is not allowed
  buildPhase = ''
    # Be sure that the Xcode wrapper has priority over everything else.
    # When using buildInputs this does not seem to be the case.
--- a/pkgs/development/mobile/xcodeenv/simulate-app.nix
+++ b/pkgs/development/mobile/xcodeenv/simulate-app.nix
@ -9,7 +9,7 @@ let
  xcodewrapper = composeXcodeWrapper xcodewrapperArgs;
 in
 stdenv.mkDerivation {
-  name = lib.replaceChars [" "] [""] name;
+  name = lib.replaceStrings [" "] [""] name;
  buildCommand = ''
    mkdir -p $out/bin
    cat > $out/bin/run-test-simulator << "EOF"
--- a/pkgs/development/python-modules/black/default.nix
+++ b/pkgs/development/python-modules/black/default.nix
@ -23,14 +23,14 @@

 buildPythonPackage rec {
  pname = "black";
-  version = "22.10.0";
+  version = "22.12.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-9RNYjaWZlD4M3k4yzJh56CXVhyDWVXBi0QmMWtgAgOE=";
+    hash = "sha256-IpNR5aGMow9Ee/ck0Af4kPl+E68HC7atTApEHNdZai8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/eth-keys/default.nix
+++ b/pkgs/development/python-modules/eth-keys/default.nix
@ -50,6 +50,8 @@ buildPythonPackage rec {
    "test_public_key_compression_is_equal"
    "test_public_key_decompression_is_equal"
    "test_signatures_with_high_s"
+    # timing sensitive
+    "test_encode_decode_pairings"
  ];

  pythonImportsCheck = [ "eth_keys" ];
--- a/pkgs/development/python-modules/isort/default.nix
+++ b/pkgs/development/python-modules/isort/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "isort";
-  version = "5.10.1";
+  version = "5.11.2";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "PyCQA";
    repo = "isort";
    rev = version;
-    sha256 = "09spgl2k9xrprr5gbpfc91a8p7mx7a0c64ydgc91b3jhrmnd9jg1";
+    sha256 = "sha256-4Du9vYI1srStWCTfZr4Rq3uH5c9cRtR8ZqihI36G6hA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/python-telegram-bot/default.nix
+++ b/pkgs/development/python-modules/python-telegram-bot/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "python-telegram-bot";
-  version = "13.14";
+  version = "13.15";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-6TkdQ+sRI94md6nSTqh4qdUyfWWyQZr7plP0dtJq7MM=";
+    hash = "sha256-tAR2BrgIG2K71qo2H3yh7+h/qPGIHsnZMtNYRL9XoVQ=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
+++ b/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
@ -12,13 +12,13 @@

 buildPythonPackage rec {
  pname = "pytorch-pfn-extras";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "pfnet";
    repo = pname;
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-J1+y5hHMKC31rIYeWI3Ca8Hdx0FF+MnCOAp0ejHzX/Y=";
+    sha256 = "sha256-B8B5zULIuqiojP7bmj3sABC9dqYLqOX5CfEN6slOFZ8=";
  };

  propagatedBuildInputs = [ numpy packaging torch typing-extensions ];
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "rapidfuzz";
-  version = "2.13.4";
+  version = "2.13.6";

  disabled = pythonOlder "3.7";

@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "maxbachmann";
    repo = "RapidFuzz";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ztGeWQTEilKzL93fruBpMvQY1W6OiMGvWUK/bgMhYd8=";
+    hash = "sha256-TvauQ5U3+xF01HuYsnmuPn3uqoDSg42vYk2qR9AdBIg=";
  };

  nativeBuildInputs = [
@ -80,7 +80,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Rapid fuzzy string matching";
    homepage = "https://github.com/maxbachmann/RapidFuzz";
-    changelog = "https://github.com/maxbachmann/RapidFuzz/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/maxbachmann/RapidFuzz/blob/${src.rev}/CHANGELOG.rst";
    license = licenses.mit;
    maintainers = with maintainers; [ dotlambda ];
  };
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@ -95,7 +95,7 @@ buildPythonPackage rec {
    changelog = let
      major = versions.major version;
      minor = versions.minor version;
-      dashVer = replaceChars ["."] ["-"] version;
+      dashVer = replaceStrings ["."] ["-"] version;
    in
      "https://scikit-learn.org/stable/whats_new/v${major}.${minor}.html#version-${dashVer}";
    homepage = "https://scikit-learn.org";
--- a/pkgs/development/python-modules/ujson/default.nix
+++ b/pkgs/development/python-modules/ujson/default.nix
@ -8,12 +8,12 @@

 buildPythonPackage rec {
  pname = "ujson";
-  version = "5.5.0";
+  version = "5.6.0";
  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-slB3qXHH2ke9aEapEqdH9pY3dtkHIMiGA7G1XYF5B4A=";
+    sha256 = "sha256-+IHi2KAi6Shaouq2uoZ0NY28srV/poYY2I1ik3rD/wQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/haskell/lambdabot/default.nix
+++ b/pkgs/development/tools/haskell/lambdabot/default.nix
@ -20,8 +20,8 @@ let allPkgs = pkgs: mueval.defaultPkgs pkgs ++ [ pkgs.lambdabot-trusted ] ++ pac
                            ++ lib.optional withDjinn haskellPackages.djinn
                            ++ lib.optional (aspell != null) aspell
                           );
-    modulesStr = lib.replaceChars ["\n"] [" "] modules;
-    configStr = lib.replaceChars ["\n"] [" "] configuration;
+    modulesStr = lib.replaceStrings ["\n"] [" "] modules;
+    configStr = lib.replaceStrings ["\n"] [" "] configuration;

 in haskellLib.overrideCabal (self: {
  patches = (self.patches or []) ++ [ ./custom-config.patch ];
--- a/pkgs/development/tools/misc/segger-ozone/default.nix
+++ b/pkgs/development/tools/misc/segger-ozone/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
  version = "3.22a";

  src = fetchurl {
-    url = "https://www.segger.com/downloads/jlink/Ozone_Linux_V${(lib.replaceChars ["."] [""] version)}_x86_64.tgz";
+    url = "https://www.segger.com/downloads/jlink/Ozone_Linux_V${(lib.replaceStrings ["."] [""] version)}_x86_64.tgz";
    sha256 = "0v1r8qvp1w2f3yip9fys004pa0smlmq69p7w77lfvghs1rmg1649";
  };

--- a/pkgs/development/web/kcgi/default.nix
+++ b/pkgs/development/web/kcgi/default.nix
@ -3,7 +3,7 @@
 stdenv.mkDerivation rec {
  pname = "kcgi";
  version = "0.10.8";
-  underscoreVersion = lib.replaceChars ["."] ["_"] version;
+  underscoreVersion = lib.replaceStrings ["."] ["_"] version;

  src = fetchFromGitHub {
    owner = "kristapsdz";
--- a/pkgs/games/jumpy/default.nix
+++ b/pkgs/games/jumpy/default.nix
@ -2,57 +2,72 @@
 , rustPlatform
 , fetchFromGitHub
 , stdenv
+, makeWrapper
 , pkg-config
 , alsa-lib
-, libGL
-, xorg
+, libxkbcommon
 , udev
-, Cocoa
-, OpenGL
+, vulkan-loader
+, wayland
+, xorg
+, darwin
 }:

 rustPlatform.buildRustPackage rec {
  pname = "jumpy";
-  version = "0.4.3";
+  version = "0.5.1";

  src = fetchFromGitHub {
-    owner = "fishfolks";
+    owner = "fishfolk";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-01zhiQi6v/8ZajsdBU+4hKUCj+PRJ/vUHluOIzy/Gi8=";
+    sha256 = "sha256-5hgd4t9ZKHmv8wzED7Tn+ykzUM0EbQqRX15HBHzXtJY=";
  };

-  cargoSha256 = "sha256-AXaGuRqSFiq+Uiy+UaqPdPVyDhCogC64KZZ0Ah1Yo7A=";
+  cargoSha256 = "sha256-cK5n75T+Kkd6F4q4MFZNn0R6W6Nk2/H23AGhIe2FCig=";

-  nativeBuildInputs = lib.optionals stdenv.isLinux [
+  nativeBuildInputs = [
+    makeWrapper
+  ] ++ lib.optionals stdenv.isLinux [
    pkg-config
  ];

  buildInputs = lib.optionals stdenv.isLinux [
    alsa-lib
-    libGL
-    xorg.libX11
-    xorg.libXi
+    libxkbcommon
    udev
+    vulkan-loader
+    wayland
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXi
+    xorg.libXrandr
  ] ++ lib.optionals stdenv.isDarwin [
-    Cocoa
-    OpenGL
+    darwin.apple_sdk.frameworks.Cocoa
+    rustPlatform.bindgenHook
  ];

  postPatch = ''
-    substituteInPlace src/main.rs \
-      --replace ./assets $out/share/assets \
-      --replace ./mods $out/share/mods
+    touch ../$(stripHash $cargoDeps)/taffy/README.md
  '';

  postInstall = ''
    mkdir $out/share
-    cp -r assets mods $out/share
+    cp -r assets $out/share
+    wrapProgram $out/bin/jumpy \
+      --set-default JUMPY_ASSET_DIR $out/share/assets
+  '';
+
+  postFixup = lib.optionalString stdenv.isLinux ''
+    patchelf $out/bin/.jumpy-wrapped \
+      --add-rpath ${lib.makeLibraryPath [ vulkan-loader ]}
  '';

  meta = with lib; {
    description = "A tactical 2D shooter played by up to 4 players online or on a shared screen";
    homepage = "https://fishfight.org/";
+    changelog = "https://github.com/fishfolk/jumpy/releases/tag/v${version}";
    license = with licenses; [ mit /* or */ asl20 ];
    maintainers = with maintainers; [ figsoda ];
  };
--- a/pkgs/games/nexuiz/default.nix
+++ b/pkgs/games/nexuiz/default.nix
@ -11,7 +11,7 @@
 let
  version = "2.5.2";

-  version_short = lib.replaceChars [ "." ] [ "" ] version;
+  version_short = lib.replaceStrings [ "." ] [ "" ] version;
 in stdenv.mkDerivation {
  pname = "nexuiz";
  inherit version;
--- a/pkgs/games/terraria-server/default.nix
+++ b/pkgs/games/terraria-server/default.nix
@ -3,7 +3,7 @@
 stdenv.mkDerivation rec {
  pname = "terraria-server";
  version = "1.4.4.9";
-  urlVersion = lib.replaceChars [ "." ] [ "" ] version;
+  urlVersion = lib.replaceStrings [ "." ] [ "" ] version;

  src = fetchurl {
    url = "https://terraria.org/api/download/pc-dedicated-server/terraria-server-${urlVersion}.zip";
--- a/pkgs/os-specific/linux/apfs/default.nix
+++ b/pkgs/os-specific/linux/apfs/default.nix
@ -2,17 +2,18 @@
 , stdenv
 , fetchFromGitHub
 , kernel
+, nixosTests
 }:

 stdenv.mkDerivation {
  pname = "apfs";
-  version = "unstable-2022-08-15-${kernel.version}";
+  version = "unstable-2022-10-20-${kernel.version}";

  src = fetchFromGitHub {
    owner = "linux-apfs";
    repo = "linux-apfs-rw";
-    rev = "e4bf2d51d3fe8485ad2b28a89c157ada32ee3d77";
-    sha256 = "sha256-zvl1H9AIExgt6t2A2w7zDwXmRsmLY8y3P6EfbBuFdh8=";
+    rev = "e6eb67c92d425d395eac1c4403629391bdd5064d";
+    sha256 = "sha256-6rv5qZCjOqt0FaNFhA3tYg6/SdssvoT8kPVhalajgOo=";
  };

  hardeningDisable = [ "pic" ];
@ -24,6 +25,8 @@ stdenv.mkDerivation {
    "INSTALL_MOD_PATH=$(out)"
  ];

+  passthru.tests.test = nixosTests.apfs;
+
  meta = with lib; {
    description = "APFS module for linux";
    homepage = "https://github.com/linux-apfs/linux-apfs-rw";
--- a/pkgs/servers/invidious/default.nix
+++ b/pkgs/servers/invidious/default.nix
@ -44,7 +44,7 @@ crystal.buildCrystalPackage rec {
      substituteInPlace src/invidious.cr \
          --replace ${lib.escapeShellArg branchTemplate} '"master"' \
          --replace ${lib.escapeShellArg commitTemplate} '"${lib.substring 0 7 versions.invidious.rev}"' \
-          --replace ${lib.escapeShellArg versionTemplate} '"${lib.replaceChars ["-"] ["."] (lib.substring 9 10 version)}"' \
+          --replace ${lib.escapeShellArg versionTemplate} '"${lib.replaceStrings ["-"] ["."] (lib.substring 9 10 version)}"' \
          --replace ${lib.escapeShellArg assetCommitTemplate} '"${lib.substring 0 7 versions.invidious.rev}"'

      # Patch the assets and locales paths to be absolute
--- a/pkgs/servers/mqtt/nanomq/default.nix
+++ b/pkgs/servers/mqtt/nanomq/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nanomq";
-  version = "0.14.1";
+  version = "0.14.5";

  src = fetchFromGitHub {
    owner = "emqx";
    repo = "nanomq";
    rev = finalAttrs.version;
-    hash = "sha256-seSnY09WIBiVDn/wbTe/y/61wY6mDF1cYneKHX3SOag=";
+    hash = "sha256-VbVeePacHrE79qV74rGv70G4Hj6O8nK4XCZ3xKbxuQU=";
    fetchSubmodules = true;
  };

--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.29.2.6364-6d72b0cf6";
+  version = "1.30.0.6486-629d58034";
  pname = "plexmediaserver";

  # Fetch the source
  src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
    url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "sha256-rd8xnCRniDt6BoOo40g95EwgAT+lFpAOlYHlLAGn9Yc=";
+    sha256 = "sha256-7blNvNx18sazfff6yIlRXp9vKWiRVISccx/8wjxWz34=";
  } else fetchurl {
    url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "sha256-6wLfhA1kPVWgREFJnhByewe4u4HCHbj8LY94+piewzE=";
+    sha256 = "sha256-ol0WSYwk0Cmz6xJYe3mqaPDjgi4VPiH+vHnP0BIwVBU=";
  };

  outputs = [ "out" "basedb" ];
--- a/pkgs/servers/web-apps/morty/default.nix
+++ b/pkgs/servers/web-apps/morty/default.nix
@ -1,43 +1,28 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:

-buildGoPackage rec {
+buildGoModule {
  pname = "morty";
-  version = "0.2.0";
-
-  goPackagePath = "github.com/asciimoo/morty";
+  version = "unstable-2021-04-22";

  src = fetchFromGitHub {
    owner = "asciimoo";
    repo = "morty";
-    rev = "v${version}";
-    sha256 = "sha256-NWfsqJKJcRPKR8gWQbgal1JsenDesczPcz/+uzhtefM=";
+    rev = "f5bff1e285d3f973cacf73318e55175edafd633f";
+    sha256 = "sha256-ik2VAPdxllt76UVFt77c1ltxIwFNahAKjn3FuErNFYo=";
  };

-  goDeps = ./deps.nix;
+  vendorSha256 = "sha256-3sllcoTDYQBAyAT7e9KeKNrlTEbgnoZc0Vt0ksQByvo=";

  meta = with lib; {
-    homepage = "https://github.com/asciimoo/morty";
-    maintainers = with maintainers; [ leenaars ];
-    license = licenses.agpl3;
    description = "Privacy aware web content sanitizer proxy as a service";
    longDescription = ''
-      Morty is a web content sanitizer proxy as a service. It rewrites web
-      pages to exclude malicious HTML tags and attributes. It also replaces
-      external resource references to prevent third party information leaks.
+      Morty rewrites web pages to exclude malicious HTML tags and attributes.
+      It also replaces external resource references to prevent third party information leaks.

-      The main goal of morty is to provide a result proxy for searx, but it
-      can be used as a standalone sanitizer service too.
-
-      Features:
-
-      * HTML sanitization
-      * Rewrites HTML/CSS external references to locals
-      * JavaScript blocking
-      * No Cookies forwarded
-      * No Referrers
-      * No Caching/Etag
-      * Supports GET/POST forms and IFrames
-      * Optional HMAC URL verifier key to prevent service abuse
+      The main goal of morty is to provide a result proxy for searx, but it can be used as a standalone sanitizer service too.
    '';
+    homepage = "https://github.com/asciimoo/morty";
+    maintainers = with maintainers; [ leenaars SuperSandro2000 ];
+    license = licenses.agpl3;
  };
 }
--- a/pkgs/servers/web-apps/morty/deps.nix
+++ b/pkgs/servers/web-apps/morty/deps.nix
@ -1,57 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/klauspost/compress";
-    fetch = {
-      type = "git";
-      url = "https://github.com/klauspost/compress";
-      rev = "5698df94daded084fa836b7df2ffbf6cbd3dd63a";
-      sha256 = "1jligmzsyv08dysdaih3r95ki0dqnay9wlzganl4r0mamwhq22wz";
-    };
-  }
-  {
-    goPackagePath = "github.com/klauspost/cpuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/klauspost/cpuid";
-      rev = "ae832f27941af41db13bd6d8efd2493e3b22415a";
-      sha256 = "1h46y0lbzx0zjdnwbh0znf2ghgbvpzk1p269kkn7v8645xk3apk9";
-    };
-  }
-  {
-    goPackagePath = "github.com/valyala/bytebufferpool";
-    fetch = {
-      type = "git";
-      url = "https://github.com/valyala/bytebufferpool";
-      rev = "e746df99fe4a3986f4d4f79e13c1e0117ce9c2f7";
-      sha256 = "01lqzjddq6kz9v41nkky7wbgk7f1cw036sa7ldz10d82g5klzl93";
-    };
-  }
-  {
-    goPackagePath = "github.com/valyala/fasthttp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/valyala/fasthttp";
-      rev = "e5f51c11919d4f66400334047b897ef0a94c6f3c";
-      sha256 = "0g24gys7xk449jd9ja89vr33i3amcb12jnmhsrmd5r2q8byv3l09";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "f5dfe339be1d06f81b22525fe34671ee7d2c8904";
-      sha256 = "01y9j7pjnnld4ipmzjvs0hls0hh698f2sga8cxaw5y6r5j7igaah";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev = "4e4a3210bb54bb31f6ab2cdca2edcc0b50c420c1";
-      sha256 = "10505r4xw1njnr2ns1s5r62s4pwif0kfaa30xxpgpz6qxrrmw15s";
-    };
-  }
-]
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@ -2,7 +2,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "dua";
-  version = "2.18.0";
+  version = "2.19.0";

  buildInputs = lib.optionals stdenv.isDarwin [ libiconv Foundation ];

@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
    owner = "Byron";
    repo = "dua-cli";
    rev = "v${version}";
-    sha256 = "sha256-8WXby+b5bZEylAmgONTHsKCDl9W9KCCk76utZUd9CuA=";
+    sha256 = "sha256-cb2WW0FpY5GMzll7sgbDRcgiKYSVZjJ8e8BabywF9wg=";
    # Remove unicode file names which leads to different checksums on HFS+
    # vs. other filesystems because of unicode normalisation.
    postFetch = ''
@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
    '';
  };

-  cargoSha256 = "sha256-NHPlBZhZoZHASQ3BaYfH+sLyWKYmCsAwwd7ENI0bIFo=";
+  cargoSha256 = "sha256-79dUeQOf6hiSRzz5mLWcSP5bLXMOU5YcE9ecd/t9VaI=";

  doCheck = false;

--- a/pkgs/tools/misc/esphome/dashboard.nix
+++ b/pkgs/tools/misc/esphome/dashboard.nix
@ -5,12 +5,12 @@

 buildPythonPackage rec {
  pname = "esphome-dashboard";
-  version = "20221109.0";
+  version = "20221213.0";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-9LL/tO40Mr4PGojj50m4UIPoqImnDRNoVPqr8xXs6KU=";
+    hash = "sha256-LwP+LBHzEWjPUih6aaZnI7Yh85vsa1Md1YgBWkLOUIs=";
  };

  # no tests
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@ -15,14 +15,14 @@ let
 in
 with python.pkgs; buildPythonApplication rec {
  pname = "esphome";
-  version = "2022.11.4";
+  version = "2022.12.0";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-sQ6uKAsXNQ1mZYvrJpUcS4bYAGg1pzqp0KB2ceePbqY=";
+    hash = "sha256-ZFu9txZTdCOhDpsjz7cjmWkY+Fdd07masd0YA/tRS80=";
  };

  postPatch = ''
--- a/pkgs/tools/security/semgrep/common.nix
+++ b/pkgs/tools/security/semgrep/common.nix
@ -1,41 +1,55 @@
 { lib, fetchFromGitHub, fetchzip, stdenv }:

 rec {
-  version = "0.112.1";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "returntocorp";
    repo = "semgrep";
    rev = "v${version}";
-    sha256 = "sha256-SZtxZz4x6YUKw1uO5HQTU4lRY989SoCNsPQphJr+L0Y=";
+    sha256 = "sha256-4fNBpokHKCtMB3P0ot1TzcuzOs5hlyH8nIw+bCGqThA=";
  };

  # submodule dependencies
  # these are fetched so we:
  #   1. don't fetch the many submodules we don't need
  #   2. avoid fetchSubmodules since it's prone to impurities
-  langsSrc = fetchFromGitHub {
-    owner = "returntocorp";
-    repo = "semgrep-langs";
-    rev = "91e288062eb794e8a5e6967d1009624237793491";
-    sha256 = "sha256-z2t2bTRyj5zu9h/GBg2YeRFimpJsd3dA7dK8VBaKzHo=";
-  };
-
-  interfacesSrc = fetchFromGitHub {
-    owner = "returntocorp";
-    repo = "semgrep-interfaces";
-    rev = "7bc457a32e088ef21adf1529fa0ddeea634b9131";
-    sha256 = "sha256-xN8Qm1/YLa49k9fZKDoPPmHASI2ipI3mkKlwEK2ajO4=";
+  submodules = {
+    "cli/src/semgrep/lang" = fetchFromGitHub {
+      owner = "returntocorp";
+      repo = "semgrep-langs";
+      rev = "65cb2ed80e31e01b122f893fef8428d14432da75";
+      sha256 = "sha256-HdPJdOlMM1l7vNSATkEu5KrCkpt2feEAH8LFDU84KUM=";
+    };
+    "cli/src/semgrep/semgrep_interfaces" = fetchFromGitHub {
+      owner = "returntocorp";
+      repo = "semgrep-interfaces";
+      rev = "c69e30a4cf39f11cab5378700f5e193e8282079e";
+      sha256 = "sha256-Wr3/TWx/LHiTFCoGY4sqdsn3dHvMsEIVYA3RGiv88xQ=";
+    };
  };

  # fetch pre-built semgrep-core since the ocaml build is complex and relies on
  # the opam package manager at some point
-  coreRelease = if stdenv.isDarwin then fetchzip {
-      url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}-osx.zip";
-      sha256 = "sha256-JiOH39vMDL6r9WKuPO0CDkRwGZtzl/GIFoSegVddFpw=";
-  } else fetchzip {
-      url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}-ubuntu-16.04.tgz";
-      sha256 = "sha256-V6r+VQrgz8uVSbRa2AmW4lnLxovk63FL7LqVKD46RBw=";
+  core = rec {
+    data = {
+      x86_64-linux = {
+        suffix = "-ubuntu-16.04.tgz";
+        sha256 = "sha256-SsaAuhcDyO3nr6H2xOtdxzOoEQd6aIe0mlpehvDWzU0=";
+      };
+      x86_64-darwin = {
+        suffix = "-osx.zip";
+        sha256 = "sha256-DAcAB/q6XeljCp4mVljIJB4AUjUuzMSRMFzIuyjWMew=";
+      };
+    };
+    src = let
+      inherit (stdenv.hostPlatform) system;
+      selectSystemData = data: data.${system} or (throw "Unsupported system: ${system}");
+      inherit (selectSystemData data) suffix sha256;
+    in fetchzip {
+      url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}${suffix}";
+      inherit sha256;
+    };
  };

  meta = with lib; {
--- a/pkgs/tools/security/semgrep/default.nix
+++ b/pkgs/tools/security/semgrep/default.nix
@ -15,12 +15,26 @@ let
 in
 buildPythonApplication rec {
  pname = "semgrep";
-  inherit (common) version;
-  src = "${common.src}/cli";
+  inherit (common) src version;

-  SEMGREP_CORE_BIN = "${semgrep-core}/bin/semgrep-core";
+  postPatch = (lib.concatStringsSep "\n" (lib.mapAttrsToList (
+    path: submodule: ''
+      # substitute ${path}
+      # remove git submodule placeholder
+      rm -r ${path}
+      # link submodule
+      ln -s ${submodule}/ ${path}
+    ''
+  ) common.submodules)) + ''
+    cd cli
+  '';

  nativeBuildInputs = [ pythonRelaxDepsHook ];
+  # tell cli/setup.py to not copy semgrep-core into the result
+  # this means we can share a copy of semgrep-core and avoid an issue where it
+  # copies the binary but doesn't retain the executable bit
+  SEMGREP_SKIP_BIN = true;
+
  pythonRelaxDeps = [
    "attrs"
    "boltons"
@ -28,37 +42,6 @@ buildPythonApplication rec {
    "typing-extensions"
  ];

-  postPatch = ''
-    # remove git submodule placeholders
-    rm -r ./src/semgrep/{lang,semgrep_interfaces}
-    # link submodule dependencies
-    ln -s ${common.langsSrc}/ ./src/semgrep/lang
-    ln -s ${common.interfacesSrc}/ ./src/semgrep/semgrep_interfaces
-  '';
-
-  doCheck = true;
-  checkInputs = [ git pytestCheckHook ] ++ (with pythonPackages; [
-    pytest-snapshot
-    pytest-mock
-    pytest-freezegun
-    types-freezegun
-  ]);
-  disabledTests = [
-    # requires networking
-    "tests/unit/test_metric_manager.py"
-  ];
-  preCheck = ''
-    # tests need a home directory
-    export HOME="$(mktemp -d)"
-
-    # disabledTestPaths doesn't manage to avoid the e2e tests
-    # remove them from pyproject.toml
-    # and remove need for pytest-split
-    substituteInPlace pyproject.toml \
-      --replace '"tests/e2e",' "" \
-      --replace 'addopts = "--splitting-algorithm=least_duration"' ""
-  '';
-
  propagatedBuildInputs = with pythonPackages; [
    attrs
    boltons
@ -77,8 +60,45 @@ buildPythonApplication rec {
    urllib3
    typing-extensions
    python-lsp-jsonrpc
+    tomli
  ];

+  doCheck = true;
+  checkInputs = [ git pytestCheckHook ] ++ (with pythonPackages; [
+    pytest-snapshot
+    pytest-mock
+    pytest-freezegun
+    types-freezegun
+  ]);
+  disabledTests = [
+    # requires networking
+    "test_send"
+    # requires networking
+    "test_parse_exclude_rules_auto"
+  ];
+  preCheck = ''
+    # tests need a home directory
+    export HOME="$(mktemp -d)"
+
+    # disabledTestPaths doesn't manage to avoid the e2e tests
+    # remove them from pyproject.toml
+    # and remove need for pytest-split
+    substituteInPlace pyproject.toml \
+      --replace '"tests/e2e",' "" \
+      --replace 'addopts = "--splitting-algorithm=least_duration"' ""
+  '';
+
+  # since we stop cli/setup.py from finding semgrep-core and copying it into
+  # the result we need to provide it on the PATH
+  preFixup = ''
+    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ semgrep-core ]})
+  '';
+
+  passthru = {
+    inherit common;
+    updateScript = ./update.sh;
+  };
+
  meta = common.meta // {
    description = common.meta.description + " - cli";
  };
--- a/pkgs/tools/security/semgrep/semgrep-core.nix
+++ b/pkgs/tools/security/semgrep/semgrep-core.nix
@ -6,8 +6,7 @@ in
 stdenvNoCC.mkDerivation rec {
  pname = "semgrep-core";
  inherit (common) version;
-
-  src = common.coreRelease;
+  inherit (common.core) src;

  installPhase = ''
    runHook preInstall
--- a/pkgs/tools/security/semgrep/update.sh
+++ b/pkgs/tools/security/semgrep/update.sh
@ -0,0 +1,139 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused jq
+
+set -euxo pipefail
+
+# provide a github token so you don't get rate limited
+# if you use gh cli you can use:
+#     `export GITHUB_TOKEN="$(cat ~/.config/gh/config.yml | yq '.hosts."github.com".oauth_token' -r)"`
+# or just set your token by hand:
+#     `read -s -p "Enter your token: " GITHUB_TOKEN; export GITHUB_TOKEN`
+#     (we use read so it doesn't show in our shell history and in secret mode so the token you paste isn't visible)
+if [ -z "${GITHUB_TOKEN:-}" ]; then
+    echo "no GITHUB_TOKEN provided - you could meet API request limiting" >&2
+fi
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+NIXPKGS_ROOT="$ROOT/../../../.."
+NIX_DRV="$ROOT/default.nix"
+
+COMMON_FILE="$ROOT/common.nix"
+
+instantiateClean() {
+    nix-instantiate -A "$1" --eval --strict | cut -d\" -f2
+}
+
+# get latest version
+NEW_VERSION=$(
+  curl -s -H
+    "Accept: application/vnd.github.v3+json" \
+    ${GITHUB_TOKEN:+ -H "Authorization: bearer $GITHUB_TOKEN"} \
+    https://api.github.com/repos/returntocorp/semgrep/releases/latest \
+  | jq -r '.tag_name'
+)
+# trim v prefix
+NEW_VERSION="${NEW_VERSION:1}"
+OLD_VERSION="$(instantiateClean semgrep.common.version)"
+
+if [[ "$OLD_VERSION" == "$NEW_VERSION" ]]; then
+    echo "Already up to date"
+    exit
+fi
+
+replace() {
+    sed -i "s@$1@$2@g" "$3"
+}
+
+fetchgithub() {
+    set +eo pipefail
+    nix-build -A "$1" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g'
+    set -eo pipefail
+}
+
+fetchzip() {
+    set +eo pipefail
+    nix-build -E "with import $NIXPKGS_ROOT {}; fetchzip {url = \"$1\"; sha256 = lib.fakeSha256; }" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g'
+    set -eo pipefail
+}
+
+replace "$OLD_VERSION" "$NEW_VERSION" "$COMMON_FILE"
+
+echo "Updating src"
+
+OLD_HASH="$(instantiateClean semgrep.common.src.outputHash)"
+echo "Old hash $OLD_HASH"
+TMP_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+replace "$OLD_HASH" "$TMP_HASH" "$COMMON_FILE"
+NEW_HASH="$(fetchgithub semgrep.common.src)"
+echo "New hash $NEW_HASH"
+replace "$TMP_HASH" "$NEW_HASH" "$COMMON_FILE"
+
+echo "Updated src"
+
+# loop through platforms for core
+nix-instantiate -E "with import $NIXPKGS_ROOT {}; builtins.attrNames semgrep.common.core.data" --eval --strict --json \
+| jq '.[]' -r \
+| while read -r PLATFORM; do
+    echo "Updating core for $PLATFORM"
+    SUFFIX=$(instantiateClean semgrep.common.core.data."$1".suffix "$PLATFORM")
+    OLD_HASH=$(instantiateClean semgrep.common.core.data."$1".sha256 "$PLATFORM")
+    echo "Old hash $OLD_HASH"
+
+    NEW_URL="https://github.com/returntocorp/semgrep/releases/download/v$NEW_VERSION/semgrep-v$NEW_VERSION$SUFFIX"
+    NEW_HASH="$(fetchzip "$NEW_URL")"
+    echo "New hash $NEW_HASH"
+
+    replace "$OLD_HASH" "$NEW_HASH" "$COMMON_FILE"
+
+    echo "Updated core for $PLATFORM"
+done
+
+OLD_PWD=$PWD
+TMPDIR="$(mktemp -d)"
+# shallow clone to check submodule commits, don't actually need the submodules
+git clone https://github.com/returntocorp/semgrep "$TMPDIR/semgrep" --depth 1 --branch "v$NEW_VERSION"
+
+get_submodule_commit() {
+    OLD_PWD=$PWD
+    (
+        cd "$TMPDIR/semgrep"
+        git ls-tree --object-only HEAD "$1"
+        cd "$OLD_PWD"
+    )
+}
+
+# loop through submodules
+nix-instantiate -E "with import $NIXPKGS_ROOT {}; builtins.attrNames semgrep.passthru.common.submodules" --eval --strict --json \
+| jq '.[]' -r \
+| while read -r SUBMODULE; do
+    echo "Updating $SUBMODULE"
+    OLD_REV=$(instantiateClean semgrep.passthru.common.submodules."$SUBMODULE".rev)
+    echo "Old commit $OLD_REV"
+    OLD_HASH=$(instantiateClean semgrep.passthru.common.submodules."$SUBMODULE".outputHash)
+    echo "Old hash $OLD_HASH"
+
+    NEW_REV=$(get_submodule_commit "$SUBMODULE")
+    echo "New commit $NEW_REV"
+
+    if [[ "$OLD_REV" == "$NEW_REV" ]]; then
+      echo "$SUBMODULE already up to date"
+      continue
+    fi
+
+    NEW_URL=$(instantiateClean semgrep.passthru.common.submodules."$SUBMODULE".url | sed "s@$OLD_REV@$NEW_REV@g")
+    NEW_HASH=$(nix --experimental-features nix-command hash to-sri "sha256:$(nix-prefetch-url "$NEW_URL")")
+
+    TMP_HASH="sha256-ABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+    replace "$OLD_REV" "$NEW_REV" "$COMMON_FILE"
+    replace "$OLD_HASH" "$TMP_HASH" "$COMMON_FILE"
+    NEW_HASH="$(fetchgithub semgrep.passthru.common.submodules."$SUBMODULE")"
+    echo "New hash $NEW_HASH"
+    replace "$TMP_HASH" "$NEW_HASH" "$COMMON_FILE"
+
+    echo "Updated $SUBMODULE"
+done
+
+rm -rf "$TMPDIR"
+
+echo "Finished"
+
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@ -2,25 +2,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdbook";
-  version = "0.4.21";
+  version = "0.4.24";

  src = fetchFromGitHub {
    owner = "rust-lang";
    repo = "mdBook";
-    rev = "v${version}";
-    sha256 = "sha256-ggcyOsA4cyo5l87cZmOMI0w1gCzmWy9NRJiWxjBdB1E=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-Y7ZbgRX0ZaYtLA20fD/L9eNMbARI1f7g6O4Yl/UDO5E=";
  };

-  cargoSha256 = "sha256-KVoMC8ypikABVkIj5dCSHzYZ9CV8UMuAFxSEYLaQTSk=";
+  cargoSha256 = "sha256-74LyxlDx9tVjw0KGPml6EZbAIbDiW3tvM/CEj5BW7pI=";

  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];

-  # Tests rely on unset 'RUST_LOG' value to emit INFO messages.
-  # 'RUST_LOG=' nixpkgs default enables warnings only and breaks tests.
-  # Can be removed when https://github.com/rust-lang/mdBook/pull/1777
-  # is released.
-  logLevel = "info";
-
  passthru = {
    tests = {
      inherit nix;
@ -30,7 +24,8 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "Create books from MarkDown";
    homepage = "https://github.com/rust-lang/mdBook";
+    changelog = "https://github.com/rust-lang/mdBook/blob/v${version}/CHANGELOG.md";
    license = [ licenses.mpl20 ];
-    maintainers = [ maintainers.havvy ];
+    maintainers = with maintainers; [ havvy Frostman ];
  };
 }
--- a/pkgs/tools/typesetting/tex/pgf-tikz/pgf-1.x.nix
+++ b/pkgs/tools/typesetting/tex/pgf-tikz/pgf-1.x.nix
@ -10,7 +10,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "pgf-tikz";
    repo = "pgf";
-    rev = "refs/tags/version-${lib.replaceChars ["."] ["-"] finalAttrs.version}";
+    rev = "refs/tags/version-${lib.replaceStrings ["."] ["-"] finalAttrs.version}";
    hash = "sha256-WZ/191iEDd5VK1bnV9JZx2BZfACUeAUhAqrlyx+ZvA4=";
  };

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -3367,9 +3367,7 @@ with pkgs;

  anbox = callPackage ../os-specific/linux/anbox { };

-  androidenv = callPackage ../development/mobile/androidenv {
-    pkgs_i686 = pkgsi686Linux;
-  };
+  androidenv = callPackage ../development/mobile/androidenv { };

  androidndkPkgs = androidndkPkgs_21;
  androidndkPkgs_21 = (callPackage ../development/androidndk-pkgs {})."21";
@ -34283,9 +34281,7 @@ with pkgs;

  fish-fillets-ng = callPackage ../games/fish-fillets-ng { };

-  jumpy = callPackage ../games/jumpy {
-    inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
-  };
+  jumpy = callPackage ../games/jumpy { };

  flightgear = libsForQt5.callPackage ../games/flightgear { };

--- a/pkgs/top-level/haxe-packages.nix
+++ b/pkgs/top-level/haxe-packages.nix
@ -4,7 +4,7 @@ let
  self = haxePackages;
  haxePackages = with self; {

-    withCommas = lib.replaceChars ["."] [","];
+    withCommas = lib.replaceStrings ["."] [","];

    # simulate "haxelib dev $libname ."
    simulateHaxelibDev = libname: ''