Merge staging-next into staging

2023-05-22 00:03:15 +00:00 · 2023-05-22 00:03:15 +00:00 · d35b735d92
commit d35b735d92
parent b09cbe8558 b658a928d2
109 changed files with 7015 additions and 1413 deletions
--- a/.gitattributes
+++ b/.gitattributes
@ -1,6 +1,6 @@
 **/deps.nix linguist-generated
 **/deps.json linguist-generated
-**/deps.toml lingust-generated
+**/deps.toml linguist-generated
 **/node-packages.nix linguist-generated

 pkgs/applications/editors/emacs-modes/*-generated.nix linguist-generated
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -14830,6 +14830,12 @@
    githubId = 2825204;
    name = "Steven Pease";
  };
+  spectre256 = {
+    name = "Ellis Gibbons";
+    email = "egibbons256@gmail.com";
+    github = "spectre256";
+    githubId = 72505298;
+  };
  spencerjanssen = {
    email = "spencerjanssen@gmail.com";
    matrix = "@sjanssen:matrix.org";
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -343,6 +343,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The `pict-rs` package was updated from an 0.3 alpha release to 0.3 stable, and related environment variables now require two underscores instead of one.

+- `espanso` has been updated to major version 2. Therefore, migration steps may need to be performed. See [the official migration instructions](https://espanso.org/docs/migration/overview/) for how to perform these migrations. Further, `espanso-wayland` can now be used for Wayland support.
+
 ## Other Notable Changes {#sec-release-23.05-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@ -419,7 +419,7 @@ in
        Group = cfg.group;
        TimeoutSec = "300";
        WorkingDirectory = "${cfg.package}/share/redmine";
-        ExecStart="${bundle} exec rails server webrick -e production -p ${toString cfg.port} -P '${cfg.stateDir}/redmine.pid'";
+        ExecStart="${bundle} exec rails server -u webrick -e production -p ${toString cfg.port} -P '${cfg.stateDir}/redmine.pid'";
      };

    };
--- a/nixos/tests/headscale.nix
+++ b/nixos/tests/headscale.nix
@ -1,17 +1,82 @@
-import ./make-test-python.nix ({ pkgs, lib, ... }: {
-  name = "headscale";
-  meta.maintainers = with lib.maintainers; [ misterio77 ];
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+  let
+    tls-cert =
+      pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+        openssl req \
+          -x509 -newkey rsa:4096 -sha256 -days 365 \
+          -nodes -out cert.pem -keyout key.pem \
+          -subj '/CN=headscale' -addext "subjectAltName=DNS:headscale"

-  nodes.machine = { ... }: {
-    services.headscale.enable = true;
-    environment.systemPackages = [ pkgs.headscale ];
-  };
+        mkdir -p $out
+        cp key.pem cert.pem $out
+      '';
+  in {
+    name = "headscale";
+    meta.maintainers = with lib.maintainers; [ misterio77 ];

-  testScript = ''
-    machine.wait_for_unit("headscale")
-    machine.wait_for_open_port(8080)
-    # Test basic functionality
-    machine.succeed("headscale namespaces create test")
-    machine.succeed("headscale preauthkeys -u test create")
-  '';
-})
+    nodes = let
+      headscalePort = 8080;
+      stunPort = 3478;
+      peer = {
+        services.tailscale.enable = true;
+        security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
+      };
+    in {
+      peer1 = peer;
+      peer2 = peer;
+
+      headscale = {
+        services = {
+          headscale = {
+            enable = true;
+            port = headscalePort;
+            settings = {
+              server_url = "https://headscale";
+              ip_prefixes = [ "100.64.0.0/10" ];
+              derp.server = {
+                enabled = true;
+                region_id = 999;
+                stun_listen_addr = "0.0.0.0:${toString stunPort}";
+              };
+            };
+          };
+          nginx = {
+            enable = true;
+            virtualHosts.headscale = {
+              addSSL = true;
+              sslCertificate = "${tls-cert}/cert.pem";
+              sslCertificateKey = "${tls-cert}/key.pem";
+              locations."/" = {
+                proxyPass = "http://127.0.0.1:${toString headscalePort}";
+                proxyWebsockets = true;
+              };
+            };
+          };
+        };
+        networking.firewall = {
+          allowedTCPPorts = [ 80 443 ];
+          allowedUDPPorts = [ stunPort ];
+        };
+        environment.systemPackages = [ pkgs.headscale ];
+      };
+    };
+
+    testScript = ''
+      start_all()
+      headscale.wait_for_unit("headscale")
+      headscale.wait_for_open_port(443)
+
+      # Create headscale user and preauth-key
+      headscale.succeed("headscale users create test")
+      authkey = headscale.succeed("headscale preauthkeys -u test create --reusable")
+
+      # Connect peers
+      up_cmd = f"tailscale up --login-server 'https://headscale' --auth-key {authkey}"
+      peer1.execute(up_cmd)
+      peer2.execute(up_cmd)
+
+      # Check that they are reachable from the tailnet
+      peer1.wait_until_succeeds("tailscale ping peer2")
+      peer2.wait_until_succeeds("tailscale ping peer1")
+    '';
+  })
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -234,9 +234,7 @@ let
      exporterTest = ''
        wait_for_unit("prometheus-domain-exporter.service")
        wait_for_open_port(9222)
-        succeed(
-            "curl -sSf 'http://localhost:9222/probe?target=nixos.org' | grep 'domain_probe_success 0'"
-        )
+        succeed("curl -sSf 'http://localhost:9222/probe?target=nixos.org'")
      '';
    };

--- a/pkgs/applications/accessibility/contrast/default.nix
+++ b/pkgs/applications/accessibility/contrast/default.nix
@ -19,7 +19,7 @@

 stdenv.mkDerivation rec {
  pname = "contrast";
-  version = "0.0.7";
+  version = "0.0.8";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
@ -27,13 +27,13 @@ stdenv.mkDerivation rec {
    owner = "design";
    repo = "contrast";
    rev = version;
-    hash = "sha256-waoXv8dzqynkpfEPZSgZnS6fyo9+9+3Q2oy2fMtEsoE=";
+    hash = "sha256-5OFmLsP+Xk3sKJcUG/s8KwedvfS8ri+JoinliyJSmrY=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-94QwPSiGjjPuskg5w6QfM5FuChFno7f9dh0Xr2wWKCI=";
+    hash = "sha256-8WukhoKMyApkwqPQ6KeWMsL40sMUcD4I4l7UqXf2Ld0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/backup/deja-dup/default.nix
+++ b/pkgs/applications/backup/deja-dup/default.nix
@ -22,14 +22,14 @@

 stdenv.mkDerivation rec {
  pname = "deja-dup";
-  version = "44.0";
+  version = "44.1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = pname;
    rev = version;
-    sha256 = "sha256-dIH6VPgzJxvXEUtPAYQzpQ8I9R9MwsfeylV25ASfW/k=";
+    sha256 = "sha256-+Z8o45ZJOmYN+G4viGJW+9BPL6gNitfFBu76qx+sOF0=";
  };

  patches = [
--- a/pkgs/applications/graphics/jpegoptim/default.nix
+++ b/pkgs/applications/graphics/jpegoptim/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, libjpeg }:

 stdenv.mkDerivation rec {
-  version = "1.5.3";
+  version = "1.5.4";
  pname = "jpegoptim";

  src = fetchFromGitHub {
    owner = "tjko";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-vNjXY/Qz6IT7rV+as2EBkSWd4O98slcXLNgAO9Dkc9E=";
+    sha256 = "sha256-cfPQTSINEdii/A2czAIxKDUw6RZOH4xZI7HnUmKuR9k=";
  };

  # There are no checks, it seems.
--- a/pkgs/applications/misc/livecaptions/default.nix
+++ b/pkgs/applications/misc/livecaptions/default.nix
@ -19,13 +19,13 @@
    owner = "abb128";
    repo = "april-asr";
    rev = "c2f138c674cad58e2708ecaddc95cc72e7f85549";
-    sha256 = "hZe2iss3BGdzeTM5FCp9wp6LaDOjtGJrZS5vB5F6uLg=";
+    hash = "sha256-hZe2iss3BGdzeTM5FCp9wp6LaDOjtGJrZS5vB5F6uLg=";
  };

  aprilModel = fetchurl {
-    name = "aprilv0_en-us.april";
-    url = "https://april.sapples.net/aprilv0_en-us.april";
-    sha256 = "9aMPiI55d2mxt94UPAXSySoXAsJjtbcdYv0gKM7eVic=";
+    name = "april-english-dev-01110_en.april";
+    url = "https://april.sapples.net/april-english-dev-01110_en.april";
+    hash = "sha256-d+uV0PpPdwijfoaMImUwHubELcsl5jymPuo9nLrbwfM=";
  };
 in
  stdenv.mkDerivation rec {
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -29,11 +29,11 @@

  firefox-beta = buildMozillaMach rec {
    pname = "firefox-beta";
-    version = "113.0b9";
+    version = "114.0b6";
    applicationName = "Mozilla Firefox Beta";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "de052b3df75a0d0e00ff6548dc5a47ca543855e819187a5d630d7352548ae5082ddc29c68c36f8effc421fae13fdb7e67c9b0fb63470af4e31fc360bc319b7df";
+      sha512 = "50127c640e0cb617ca031df022a09df8bba7dd44e9b88b034d9c9276d1adcec17a937d80ab3e540433290e8f78982a405b7281724713f43c36e5e266df721854";
    };

    meta = {
@ -56,12 +56,12 @@

  firefox-devedition = buildMozillaMach rec {
    pname = "firefox-devedition";
-    version = "113.0b9";
+    version = "114.0b6";
    applicationName = "Mozilla Firefox Developer Edition";
    branding = "browser/branding/aurora";
    src = fetchurl {
      url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "193b4b96dd3dfe9d95dc11ddc089a433a6fa4aff5d55d8294ff638dccacdd141b0977f9d87b7cb6c4f4f64af22166a517f2e751fee7059cd7e77ddb8ea977466";
+      sha512 = "cf5a6ab9b950af602c91d2c6ffc9c5efd96d83f580f3de16e03cbcf3ef5fa04e4d86536a82c1e2503ca09ae744991bc360e35a2e1c03c8b8408fa3f4c956823e";
    };

    meta = {
--- a/pkgs/applications/networking/cluster/civo/default.nix
+++ b/pkgs/applications/networking/cluster/civo/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "civo";
-  version = "1.0.53";
+  version = "1.0.54";

  src = fetchFromGitHub {
    owner  = "civo";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "sha256-UE83fnP2cJuRWwyAkZhaF9N64q2Cw4oR/TTnvPbDSxc=";
+    sha256 = "sha256-oMVTHFTLYa984X/QOMYCXHYMqYQmmL4UgjexbbbAmVo=";
  };

  vendorHash = "sha256-c6Bx/+zyhvV9B1nZ7dJdIsNRSoWeHc2eE81V7Mbkwds=";
--- a/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubectl-gadget";
-  version = "0.16.0";
+  version = "0.16.1";

  src = fetchFromGitHub {
    owner = "inspektor-gadget";
    repo = "inspektor-gadget";
    rev = "v${version}";
-    hash = "sha256:0ijqnlh234pqkx6yzz2kxdnj8hnqarp2scq7gfsp8wpq7s42ivg8";
+    hash = "sha256-+eD+EHTZ0hCw4TzeZodXIsHg8dLUf7BFyw2Y0aEuSlA=";
  };

  vendorHash = "sha256-IbqE0aI7utYuu1XpQijEFVu/IpUDK6CQLu7g8GUR4e8=";
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dnscontrol";
-  version = "4.0.0";
+  version = "4.0.1";

  src = fetchFromGitHub {
    owner = "StackExchange";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-fAfbnz8HK/CzA9VcWyXcTxIll1w70P9wVtG73fqn1Fc=";
+    sha256 = "sha256-1JSFhuH/YdWFckFxaky11R8eXl2xzYe5VCk0XGXwCp8=";
  };

-  vendorHash = "sha256-N7KS48Kr9SipliZ9JhMo2u9pRoE8+pxhC8B/YcZlNyg=";
+  vendorHash = "sha256-oO/EMaVkcc054C6VOPjh6r4UhHifq2rQKtrYSg5frFQ=";

  subPackages = [ "." ];

--- a/pkgs/applications/networking/ids/zeek/default.nix
+++ b/pkgs/applications/networking/ids/zeek/default.nix
@ -26,11 +26,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "zeek";
-  version = "5.2.0";
+  version = "5.2.2";

  src = fetchurl {
    url = "https://download.zeek.org/zeek-${version}.tar.gz";
-    sha256 = "sha256-URBHQA3UU5F3VCyEpegNfpetc9KpmG/81s2FtMxxH78=";
+    sha256 = "sha256-4MJBV8yWpy5LvkyyipOZdDjU6FV7F8INc/zWddRGFcY=";
  };

  strictDeps = true;
@ -54,13 +54,14 @@ stdenv.mkDerivation rec {
    spicy-parser-generator
    curl
    gperftools
-    libkqueue
    libmaxminddb
    libpcap
    ncurses
    openssl
    swig
    zlib
+  ] ++ lib.optionals stdenv.isLinux [
+    libkqueue
  ] ++ lib.optionals stdenv.isDarwin [
    gettext
  ];
@ -75,13 +76,14 @@ stdenv.mkDerivation rec {
  cmakeFlags = [
    "-DBroker_ROOT=${broker}"
    "-DSPICY_ROOT_DIR=${spicy-parser-generator}"
-    "-DLIBKQUEUE_ROOT_DIR=${libkqueue}"
    "-DENABLE_PERFTOOLS=true"
    "-DINSTALL_AUX_TOOLS=true"
    "-DZEEK_ETC_INSTALL_DIR=/etc/zeek"
    "-DZEEK_LOG_DIR=/var/log/zeek"
    "-DZEEK_STATE_DIR=/var/lib/zeek"
    "-DZEEK_SPOOL_DIR=/var/spool/zeek"
+  ] ++ lib.optionals stdenv.isLinux [
+    "-DLIBKQUEUE_ROOT_DIR=${libkqueue}"
  ];

  postInstall = ''
--- a/pkgs/applications/networking/mullvad-vpn/default.nix
+++ b/pkgs/applications/networking/mullvad-vpn/default.nix
@ -1,11 +1,36 @@
-{ stdenv, lib, fetchurl, dpkg
-, alsa-lib, atk, cairo, cups, dbus, expat, fontconfig, freetype
-, gdk-pixbuf, glib, pango, nspr, nss, gtk3, mesa
-, libGL, wayland, xorg, autoPatchelfHook, systemd, libnotify, libappindicator
+{ stdenv
+, lib
+, fetchurl
+, dpkg
+, alsa-lib
+, atk
+, cairo
+, cups
+, dbus
+, expat
+, fontconfig
+, freetype
+, gdk-pixbuf
+, glib
+, pango
+, nspr
+, nss
+, gtk3
+, mesa
+, libGL
+, wayland
+, xorg
+, autoPatchelfHook
+, systemd
+, libnotify
+, libappindicator
 , makeWrapper
+, coreutils
+, gnugrep
 }:

-let deps = [
+let
+  deps = [
    alsa-lib
    atk
    cairo
@ -77,7 +102,9 @@ stdenv.mkDerivation rec {
    ln -s $out/share/mullvad/mullvad-{gui,vpn} $out/bin/
    ln -sf $out/share/mullvad/resources/mullvad-problem-report $out/bin/mullvad-problem-report

-    wrapProgram $out/bin/mullvad-vpn --set MULLVAD_DISABLE_UPDATE_NOTIFICATION 1
+    wrapProgram $out/bin/mullvad-vpn \
+      --set MULLVAD_DISABLE_UPDATE_NOTIFICATION 1 \
+      --prefix PATH : ${lib.makeBinPath [ coreutils gnugrep ]}

    wrapProgram $out/bin/mullvad-daemon \
        --set-default MULLVAD_RESOURCE_DIR "$out/share/mullvad/resources"
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@ -22,6 +22,12 @@ let

    patches = [
      ./0001-BUILD-crypto-Migrate-to-OpenSSL-3.0-compatible-API.patch
+      # fix crash caused by openssl3 thread unsafe evp implementation
+      # see https://github.com/mumble-voip/mumble/issues/5361#issuecomment-1173001440
+      (fetchpatch {
+        url = "https://github.com/mumble-voip/mumble/commit/f8d47db318f302f5a7d343f15c9936c7030c49c4.patch";
+        hash = "sha256-xk8vBrPwvQxHCY8I6WQJAyaBGHmlH9NCixweP6FyakU=";
+      })
      ./0002-FIX-positional-audio-Force-8-bytes-alignment-for-CCa.patch
    ];

--- a/pkgs/applications/networking/p2p/retroshare/cpp-filesystem.patch
+++ b/pkgs/applications/networking/p2p/retroshare/cpp-filesystem.patch
@ -0,0 +1,12 @@
+diff --git a/libretroshare/src/util/rsdir.cc b/libretroshare/src/util/rsdir.cc
+index 8556b8198..d63699216 100644
+--- a/libretroshare/src/util/rsdir.cc
+++ b/libretroshare/src/util/rsdir.cc
+@@ -47,6 +47,7 @@
+ 
+ #include <fstream>
+ #include <stdexcept>
+#include <filesystem>
+ 
+ #if defined(WIN32) || defined(__CYGWIN__)
+ #include "util/rsstring.h"
--- a/pkgs/applications/networking/p2p/retroshare/default.nix
+++ b/pkgs/applications/networking/p2p/retroshare/default.nix
@ -19,6 +19,7 @@ mkDerivation rec {
    # The build normally tries to get git sub-modules during build
    # but we already have them checked out
    ./no-submodules.patch
+    ./cpp-filesystem.patch
  ];

  nativeBuildInputs = [ pkg-config qmake cmake ];
--- a/pkgs/applications/office/espanso/Cargo.lock
+++ b/pkgs/applications/office/espanso/Cargo.lock
--- a/pkgs/applications/office/espanso/default.nix
+++ b/pkgs/applications/office/espanso/default.nix
@ -3,52 +3,106 @@
 , rustPlatform
 , pkg-config
 , extra-cmake-modules
+, dbus
 , libX11
 , libXi
 , libXtst
 , libnotify
+, libxkbcommon
 , openssl
 , xclip
 , xdotool
+, setxkbmap
+, wl-clipboard
+, wxGTK32
 , makeWrapper
 , stdenv
 , AppKit
 , Cocoa
 , Foundation
+, IOKit
+, Kernel
+, AVFoundation
+, Carbon
+, QTKit
+, AVKit
+, WebKit
+, waylandSupport ? false
+, x11Support ? stdenv.isLinux
+, testers
+, espanso
 }:
-
+# espanso does not support building with both X11 and Wayland support at the same time
+assert stdenv.isLinux -> x11Support != waylandSupport;
+assert stdenv.isDarwin -> !x11Support;
+assert stdenv.isDarwin -> !waylandSupport;
 rustPlatform.buildRustPackage rec {
  pname = "espanso";
-  version = "0.7.3";
+  version = "2.1.8";

  src = fetchFromGitHub {
-    owner = "federico-terzi";
-    repo = pname;
+    owner = "espanso";
+    repo = "espanso";
    rev = "v${version}";
-    sha256 = "1q47r43midkq9574gl8gdv3ylvrnbhdc39rrw4y4yk6jbdf5wwkm";
+    hash = "sha256-5TUo5B1UZZARgTHbK2+520e3mGZkZ5tTez1qvZvMnxs=";
  };

-  cargoSha256 = "0ba5skn5s6qh0blf6bvivzvqc2l8v488l9n3x98pmf6nygrikfdb";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "yaml-rust-0.4.6" = "sha256-wXFy0/s4y6wB3UO19jsLwBdzMy7CGX4JoUt5V6cU7LU=";
+    };
+  };
+
+  cargoPatches = lib.optionals stdenv.isDarwin [
+    ./inject-wx-on-darwin.patch
+  ];

  nativeBuildInputs = [
    extra-cmake-modules
    pkg-config
    makeWrapper
+    wxGTK32
+  ];
+
+  # Ref: https://github.com/espanso/espanso/blob/78df1b704fe2cc5ea26f88fdc443b6ae1df8a989/scripts/build_binary.rs#LL49C3-L62C4
+  buildNoDefaultFeatures = true;
+  buildFeatures = [
+    "modulo"
+  ] ++ lib.optionals waylandSupport[
+    "wayland"
+  ] ++ lib.optionals stdenv.isLinux [
+    "vendored-tls"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "native-tls"
  ];

  buildInputs = [
-    libX11
-    libXtst
-    libXi
-    libnotify
-    xclip
-    openssl
+    wxGTK32
  ] ++ lib.optionals stdenv.isLinux [
-    xdotool
+    openssl
+    dbus
+    libnotify
+    libxkbcommon
  ] ++ lib.optionals stdenv.isDarwin [
    AppKit
    Cocoa
    Foundation
+    IOKit
+    Kernel
+    AVFoundation
+    Carbon
+    QTKit
+    AVKit
+    WebKit
+  ] ++ lib.optionals waylandSupport [
+    wl-clipboard
+  ] ++ lib.optionals x11Support [
+    libXi
+    libXtst
+    libX11
+    xclip
+    xdotool
  ];

  # Some tests require networking
@ -56,14 +110,27 @@ rustPlatform.buildRustPackage rec {

  postInstall = ''
    wrapProgram $out/bin/espanso \
-      --prefix PATH : ${lib.makeBinPath [ libnotify xclip ]}
+      --prefix PATH : ${lib.makeBinPath (
+        lib.optionals stdenv.isLinux [
+          libnotify
+          setxkbmap
+        ] ++ lib.optionals waylandSupport [
+          wl-clipboard
+        ] ++ lib.optionals x11Support [
+          xclip
+        ]
+      )}
  '';

+  passthru.tests.version = testers.testVersion {
+    package = espanso;
+  };
+
  meta = with lib; {
    description = "Cross-platform Text Expander written in Rust";
    homepage = "https://espanso.org";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ kimat ];
+    maintainers = with maintainers; [ kimat thehedgeh0g ];
    platforms = platforms.unix;

    longDescription = ''
--- a/pkgs/applications/office/espanso/inject-wx-on-darwin.patch
+++ b/pkgs/applications/office/espanso/inject-wx-on-darwin.patch
@ -0,0 +1,223 @@
+From 6a7400c20831c5ff502c7336d6db2be743f156be Mon Sep 17 00:00:00 2001
+From: Nikola Knezevic <nikola.knezevic@imc.com>
+Date: Tue, 16 Aug 2022 22:28:46 +0200
+Subject: [PATCH] Build using system wx on darwin
+
+---
+ espanso-modulo/build.rs | 174 ++++------------------------------------
+ 1 file changed, 17 insertions(+), 157 deletions(-)
+
+diff --git a/espanso-modulo/build.rs b/espanso-modulo/build.rs
+index b8b889a..5d972ec 100644
+--- a/espanso-modulo/build.rs
+++ b/espanso-modulo/build.rs
+@@ -156,161 +156,6 @@ fn build_native() {
+   );
+ }
+ 
+-#[cfg(target_os = "macos")]
+-fn build_native() {
+-  use std::process::Command;
+-
+-  let project_dir =
+-    PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").expect("missing CARGO_MANIFEST_DIR"));
+-  let wx_archive = project_dir.join("vendor").join(WX_WIDGETS_ARCHIVE_NAME);
+-  if !wx_archive.is_file() {
+-    panic!("could not find wxWidgets archive!");
+-  }
+-
+-  let out_dir = if let Ok(out_path) = std::env::var(WX_WIDGETS_BUILD_OUT_DIR_ENV_NAME) {
+-    println!(
+-      "detected wxWidgets build output directory override: {}",
+-      out_path
+-    );
+-    let path = PathBuf::from(out_path);
+-    std::fs::create_dir_all(&path).expect("unable to create wxWidgets out dir");
+-    path
+-  } else {
+-    PathBuf::from(std::env::var("OUT_DIR").expect("missing OUT_DIR"))
+-  };
+-  let out_wx_dir = out_dir.join("wx");
+-  println!("wxWidgets will be compiled into: {}", out_wx_dir.display());
+-
+-  let target_arch = match std::env::var("CARGO_CFG_TARGET_ARCH")
+-    .expect("unable to read target arch")
+-    .as_str()
+-  {
+-    "x86_64" => "x86_64",
+-    "aarch64" => "arm64",
+-    arch => panic!("unsupported arch {}", arch),
+-  };
+-
+-  let should_use_ci_m1_workaround =
+-    std::env::var("CI").unwrap_or_default() == "true" && target_arch == "arm64";
+-
+-  if !out_wx_dir.is_dir() {
+-    // Extract the wxWidgets archive
+-    let wx_archive =
+-      std::fs::File::open(&wx_archive).expect("unable to open wxWidgets source archive");
+-    let mut archive = zip::ZipArchive::new(wx_archive).expect("unable to read wxWidgets archive");
+-    archive
+-      .extract(&out_wx_dir)
+-      .expect("unable to extract wxWidgets source dir");
+-
+-    // Compile wxWidgets
+-    let build_dir = out_wx_dir.join("build-cocoa");
+-    std::fs::create_dir_all(&build_dir).expect("unable to create build-cocoa directory");
+-
+-    let mut handle = if should_use_ci_m1_workaround {
+-      // Because of a configuration problem on the GitHub CI pipeline,
+-      // we need to use a series of workarounds to build for M1 machines.
+-      // See: https://github.com/actions/virtual-environments/issues/3288#issuecomment-830207746
+-      Command::new(out_wx_dir.join("configure"))
+-        .current_dir(build_dir.to_string_lossy().to_string())
+-        .args(&[
+-          "--disable-shared",
+-          "--without-libtiff",
+-          "--without-liblzma",
+-          "--with-libjpeg=builtin",
+-          "--with-libpng=builtin",
+-          "--enable-universal-binary=arm64,x86_64",
+-        ])
+-        .spawn()
+-        .expect("failed to execute configure")
+-    } else {
+-      Command::new(out_wx_dir.join("configure"))
+-        .current_dir(build_dir.to_string_lossy().to_string())
+-        .args(&[
+-          "--disable-shared",
+-          "--without-libtiff",
+-          "--without-liblzma",
+-          "--with-libjpeg=builtin",
+-          "--with-libpng=builtin",
+-          &format!("--enable-macosx_arch={}", target_arch),
+-        ])
+-        .spawn()
+-        .expect("failed to execute configure")
+-    };
+-
+-    if !handle
+-      .wait()
+-      .expect("unable to wait for configure command")
+-      .success()
+-    {
+-      panic!("configure returned non-zero exit code!");
+-    }
+-
+-    let mut handle = Command::new("make")
+-      .current_dir(build_dir.to_string_lossy().to_string())
+-      .args(&["-j8"])
+-      .spawn()
+-      .expect("failed to execute make");
+-    if !handle
+-      .wait()
+-      .expect("unable to wait for make command")
+-      .success()
+-    {
+-      panic!("make returned non-zero exit code!");
+-    }
+-  }
+-
+-  // Make sure wxWidgets is compiled
+-  if !out_wx_dir.join("build-cocoa").is_dir() {
+-    panic!("wxWidgets is not compiled correctly, missing 'build-cocoa/' directory")
+-  }
+-
+-  // If using the M1 CI workaround, convert all the universal libraries to arm64 ones
+-  // This is needed until https://github.com/rust-lang/rust/issues/55235 is fixed
+-  if should_use_ci_m1_workaround {
+-    convert_fat_libraries_to_arm(&out_wx_dir.join("build-cocoa").join("lib"));
+-    convert_fat_libraries_to_arm(&out_wx_dir.join("build-cocoa"));
+-  }
+-
+-  let config_path = out_wx_dir.join("build-cocoa").join("wx-config");
+-  let cpp_flags = get_cpp_flags(&config_path);
+-
+-  let mut build = cc::Build::new();
+-  build
+-    .cpp(true)
+-    .file("src/sys/form/form.cpp")
+-    .file("src/sys/common/common.cpp")
+-    .file("src/sys/search/search.cpp")
+-    .file("src/sys/wizard/wizard.cpp")
+-    .file("src/sys/wizard/wizard_gui.cpp")
+-    .file("src/sys/welcome/welcome.cpp")
+-    .file("src/sys/welcome/welcome_gui.cpp")
+-    .file("src/sys/textview/textview.cpp")
+-    .file("src/sys/textview/textview_gui.cpp")
+-    .file("src/sys/troubleshooting/troubleshooting.cpp")
+-    .file("src/sys/troubleshooting/troubleshooting_gui.cpp")
+-    .file("src/sys/common/mac.mm");
+-  build.flag("-std=c++17");
+-
+-  for flag in cpp_flags {
+-    build.flag(&flag);
+-  }
+-
+-  build.compile("espansomodulosys");
+-
+-  // Render linker flags
+-
+-  generate_linker_flags(&config_path);
+-
+-  // On (older) OSX we need to link against the clang runtime,
+-  // which is hidden in some non-default path.
+-  //
+-  // More details at https://github.com/alexcrichton/curl-rust/issues/279.
+-  if let Some(path) = macos_link_search_path() {
+-    println!("cargo:rustc-link-lib=clang_rt.osx");
+-    println!("cargo:rustc-link-search={}", path);
+-  }
+-}
+-
+ #[cfg(target_os = "macos")]
+ fn convert_fat_libraries_to_arm(lib_dir: &Path) {
+   for entry in
+@@ -440,12 +285,17 @@ fn macos_link_search_path() -> Option<String> {
+   None
+ }
+ 
+#[cfg(not(target_os = "macos"))]
+fn macos_link_search_path() -> Option<String> {
+    return None
+}
+
+ // TODO: add documentation for linux
+ // Install wxWidgets:
+ // sudo apt install libwxgtk3.0-0v5 libwxgtk3.0-dev
+ //
+ // cargo run
+-#[cfg(target_os = "linux")]
+#[cfg(not(target_os = "windows"))]
+ fn build_native() {
+   // Make sure wxWidgets is installed
+   // Depending on the installation package, the 'wx-config' command might also be available as 'wx-config-gtk3',
+@@ -483,7 +333,8 @@ fn build_native() {
+     .file("src/sys/textview/textview.cpp")
+     .file("src/sys/textview/textview_gui.cpp")
+     .file("src/sys/troubleshooting/troubleshooting.cpp")
+-    .file("src/sys/troubleshooting/troubleshooting_gui.cpp");
+    .file("src/sys/troubleshooting/troubleshooting_gui.cpp")
+    .file("src/sys/common/mac.mm");
+   build.flag("-std=c++17");
+ 
+   for flag in cpp_flags {
+@@ -495,6 +346,15 @@ fn build_native() {
+   // Render linker flags
+ 
+   generate_linker_flags(&config_path);
+
+  // On (older) OSX we need to link against the clang runtime,
+  // which is hidden in some non-default path.
+  //
+  // More details at https://github.com/alexcrichton/curl-rust/issues/279.
+  if let Some(path) = macos_link_search_path() {
+    println!("cargo:rustc-link-lib=clang_rt.osx");
+    println!("cargo:rustc-link-search={}", path);
+  }
+ }
+ 
+ fn main() {
+-- 
+2.37.1
+
--- a/pkgs/applications/version-management/redmine/Gemfile
+++ b/pkgs/applications/version-management/redmine/Gemfile
@ -1,31 +1,27 @@
 source 'https://rubygems.org'

-ruby '>= 2.4.0', '< 2.8.0'
-gem 'bundler', '>= 1.12.0'
+ruby '>= 2.7.0', '< 3.3.0'

-gem 'rails', '5.2.8.1'
-gem 'sprockets', '~> 3.7.2' if RUBY_VERSION < '2.5'
-gem 'globalid', '~> 0.4.2' if Gem.ruby_version < Gem::Version.new('2.6.0')
-gem 'rouge', '~> 3.26.0'
+gem 'rails', '6.1.7.3'
+gem 'rouge', '~> 4.1.0'
 gem 'request_store', '~> 1.5.0'
-gem "mini_mime", "~> 1.0.1"
+gem 'mini_mime', '~> 1.1.0'
 gem "actionpack-xml_parser"
-gem 'roadie-rails', (RUBY_VERSION < '2.5' ? '~> 1.3.0' : '~> 2.2.0')
+gem 'roadie-rails', '~> 3.0.0'
 gem 'marcel'
-gem "mail", "~> 2.7.1"
-gem 'csv', (RUBY_VERSION < '2.5' ? ['>= 3.1.1', '<= 3.1.5'] : '~> 3.1.1')
-gem 'nokogiri', (if Gem.ruby_version < Gem::Version.new('2.5.0')
-                   '~> 1.10.10'
-                 elsif Gem.ruby_version < Gem::Version.new('2.6.0')
-                   '~> 1.12.5'
-                 else
-                   '~> 1.13.10'
-                 end)
-gem 'i18n', '~> 1.8.2'
-gem 'rbpdf', '~> 1.21.0'
+gem 'mail', '~> 2.8.1'
+gem 'nokogiri', '~> 1.14.0'
+gem 'i18n', '~> 1.13.0'
+gem 'rbpdf', '~> 1.21.1'
 gem 'addressable'
 gem 'rubyzip', '~> 2.3.0'
-gem 'psych', '~> 3.1' if Gem.ruby_version < Gem::Version.new('2.6.0')
+
+#  Ruby Standard Gems
+gem 'csv', '~> 3.2.6'
+gem 'net-imap', '~> 0.3.4'
+gem 'net-pop', '~> 0.1.2'
+gem 'net-smtp', '~> 0.3.3'
+gem 'rexml', require: false if Gem.ruby_version >= Gem::Version.new('3.0')

 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
 gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin]
@ -34,54 +30,63 @@ gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin]
 gem 'rotp', '>= 5.0.0'
 gem 'rqrcode'

+# HTML pipeline and sanitization
+gem "html-pipeline", "~> 2.13.2"
+gem "sanitize", "~> 6.0"
+
 # Optional gem for LDAP authentication
 group :ldap do
  gem 'net-ldap', '~> 0.17.0'
 end

-# Optional gem for OpenID authentication
-group :openid do
-  gem "ruby-openid", "~> 2.9.2", :require => "openid"
-  gem "rack-openid"
-end
-
 # Optional gem for exporting the gantt to a PNG file
 group :minimagick do
-  gem 'mini_magick', '~> 4.11.0'
+  gem 'mini_magick', '~> 4.12.0'
 end

-# Optional Markdown support, not for JRuby
+# Optional Markdown support
 group :markdown do
-  gem 'redcarpet', '~> 3.5.1'
+  gem 'redcarpet', '~> 3.6.0'
 end

+# Optional CommonMark support, not for JRuby
+group :common_mark do
+  gem "commonmarker", '~> 0.23.8'
+  gem 'deckar01-task_list', '2.3.2'
+end
+
+# webrick
+gem 'webrick'
+
 # Include database gems for the database adapters NixOS supports
+require 'erb'
+require 'yaml'
 gem "mysql2", "~> 0.5.0", :platforms => [:mri, :mingw, :x64_mingw]
-gem "pg", "~> 1.2.2", :platforms => [:mri, :mingw, :x64_mingw]
+gem "pg", "~> 1.4.2", :platforms => [:mri, :mingw, :x64_mingw]

 group :development do
+  gem 'listen', '~> 3.3'
  gem "yard"
 end

 group :test do
  gem "rails-dom-testing"
-  gem 'mocha', (Gem.ruby_version < Gem::Version.new('2.7.0') ? ['>= 1.4.0', '< 2.0.0'] : '>= 1.4.0')
-  gem 'simplecov', '~> 0.18.5', :require => false
-  gem "ffi", platforms: [:mingw, :x64_mingw, :mswin]
+  gem 'mocha', '>= 1.4.0'
+  gem 'simplecov', '~> 0.22.0', :require => false
+  gem "ffi", platforms: [:mri, :mingw, :x64_mingw, :mswin]
  # For running system tests
-  # TODO: Remove version specification once Capybara supports Puma 6
-  gem 'puma', '< 6.0.0'
-  gem 'capybara', '~> 3.31.0'
+  gem 'puma'
+  gem 'capybara', '~> 3.38.0'
  gem "selenium-webdriver", "~> 3.142.7"
-  gem 'webdrivers', '~> 4.4', require: false
+  gem 'webdrivers', '4.6.1', require: false
  # RuboCop
-  gem 'rubocop', '~> 1.12.0'
-  gem 'rubocop-performance', '~> 1.10.1'
-  gem 'rubocop-rails', '~> 2.9.0'
+  gem 'rubocop', '~> 1.51.0', require: false
+  gem 'rubocop-performance', '~> 1.17.1', require: false
+  gem 'rubocop-rails', '~> 2.19.1', require: false
 end

 local_gemfile = File.join(File.dirname(__FILE__), "Gemfile.local")
-if File.exists?(local_gemfile)
+if File.exist?(local_gemfile)
  eval_gemfile local_gemfile
 end

--- a/pkgs/applications/version-management/redmine/Gemfile.lock
+++ b/pkgs/applications/version-management/redmine/Gemfile.lock
@ -1,188 +1,238 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    actioncable (5.2.8.1)
-      actionpack (= 5.2.8.1)
+    actioncable (6.1.7.3)
+      actionpack (= 6.1.7.3)
+      activesupport (= 6.1.7.3)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
-    actionmailer (5.2.8.1)
-      actionpack (= 5.2.8.1)
-      actionview (= 5.2.8.1)
-      activejob (= 5.2.8.1)
+    actionmailbox (6.1.7.3)
+      actionpack (= 6.1.7.3)
+      activejob (= 6.1.7.3)
+      activerecord (= 6.1.7.3)
+      activestorage (= 6.1.7.3)
+      activesupport (= 6.1.7.3)
+      mail (>= 2.7.1)
+    actionmailer (6.1.7.3)
+      actionpack (= 6.1.7.3)
+      actionview (= 6.1.7.3)
+      activejob (= 6.1.7.3)
+      activesupport (= 6.1.7.3)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 2.0)
-    actionpack (5.2.8.1)
-      actionview (= 5.2.8.1)
-      activesupport (= 5.2.8.1)
-      rack (~> 2.0, >= 2.0.8)
+    actionpack (6.1.7.3)
+      actionview (= 6.1.7.3)
+      activesupport (= 6.1.7.3)
+      rack (~> 2.0, >= 2.0.9)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+      rails-html-sanitizer (~> 1.0, >= 1.2.0)
    actionpack-xml_parser (2.0.1)
      actionpack (>= 5.0)
      railties (>= 5.0)
-    actionview (5.2.8.1)
-      activesupport (= 5.2.8.1)
+    actiontext (6.1.7.3)
+      actionpack (= 6.1.7.3)
+      activerecord (= 6.1.7.3)
+      activestorage (= 6.1.7.3)
+      activesupport (= 6.1.7.3)
+      nokogiri (>= 1.8.5)
+    actionview (6.1.7.3)
+      activesupport (= 6.1.7.3)
      builder (~> 3.1)
      erubi (~> 1.4)
      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.2.8.1)
-      activesupport (= 5.2.8.1)
+      rails-html-sanitizer (~> 1.1, >= 1.2.0)
+    activejob (6.1.7.3)
+      activesupport (= 6.1.7.3)
      globalid (>= 0.3.6)
-    activemodel (5.2.8.1)
-      activesupport (= 5.2.8.1)
-    activerecord (5.2.8.1)
-      activemodel (= 5.2.8.1)
-      activesupport (= 5.2.8.1)
-      arel (>= 9.0)
-    activestorage (5.2.8.1)
-      actionpack (= 5.2.8.1)
-      activerecord (= 5.2.8.1)
-      marcel (~> 1.0.0)
-    activesupport (5.2.8.1)
+    activemodel (6.1.7.3)
+      activesupport (= 6.1.7.3)
+    activerecord (6.1.7.3)
+      activemodel (= 6.1.7.3)
+      activesupport (= 6.1.7.3)
+    activestorage (6.1.7.3)
+      actionpack (= 6.1.7.3)
+      activejob (= 6.1.7.3)
+      activerecord (= 6.1.7.3)
+      activesupport (= 6.1.7.3)
+      marcel (~> 1.0)
+      mini_mime (>= 1.1.0)
+    activesupport (6.1.7.3)
      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-    addressable (2.8.1)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+      zeitwerk (~> 2.3)
+    addressable (2.8.4)
      public_suffix (>= 2.0.2, < 6.0)
-    arel (9.0.0)
    ast (2.4.2)
    builder (3.2.4)
-    capybara (3.31.0)
+    capybara (3.38.0)
      addressable
+      matrix
      mini_mime (>= 0.1.3)
      nokogiri (~> 1.8)
      rack (>= 1.6.0)
      rack-test (>= 0.6.3)
-      regexp_parser (~> 1.5)
+      regexp_parser (>= 1.5, < 3.0)
      xpath (~> 3.2)
    childprocess (3.0.0)
    chunky_png (1.4.0)
+    commonmarker (0.23.9)
    concurrent-ruby (1.2.2)
    crass (1.0.6)
    css_parser (1.14.0)
      addressable
-    csv (3.1.9)
+    csv (3.2.6)
+    date (3.3.3)
+    deckar01-task_list (2.3.2)
+      html-pipeline
    docile (1.4.0)
    erubi (1.12.0)
+    ffi (1.15.5)
    globalid (1.1.0)
      activesupport (>= 5.0)
+    html-pipeline (2.13.2)
+      activesupport (>= 2)
+      nokogiri (>= 1.4)
    htmlentities (4.3.4)
-    i18n (1.8.11)
+    i18n (1.13.0)
      concurrent-ruby (~> 1.0)
-    loofah (2.19.1)
+    json (2.6.3)
+    listen (3.8.0)
+      rb-fsevent (~> 0.10, >= 0.10.3)
+      rb-inotify (~> 0.9, >= 0.9.10)
+    loofah (2.21.3)
      crass (~> 1.0.2)
-      nokogiri (>= 1.5.9)
-    mail (2.7.1)
+      nokogiri (>= 1.12.0)
+    mail (2.8.1)
      mini_mime (>= 0.1.1)
+      net-imap
+      net-pop
+      net-smtp
    marcel (1.0.2)
+    matrix (0.4.2)
    method_source (1.0.0)
-    mini_magick (4.11.0)
-    mini_mime (1.0.3)
-    mini_portile2 (2.8.1)
+    mini_magick (4.12.0)
+    mini_mime (1.1.2)
+    mini_portile2 (2.8.2)
    minitest (5.18.0)
    mocha (2.0.2)
      ruby2_keywords (>= 0.0.5)
    mysql2 (0.5.5)
+    net-imap (0.3.4)
+      date
+      net-protocol
    net-ldap (0.17.1)
-    nio4r (2.5.8)
-    nokogiri (1.13.10)
+    net-pop (0.1.2)
+      net-protocol
+    net-protocol (0.2.1)
+      timeout
+    net-smtp (0.3.3)
+      net-protocol
+    nio4r (2.5.9)
+    nokogiri (1.14.4)
      mini_portile2 (~> 2.8.0)
      racc (~> 1.4)
-    nokogiri (1.13.10-x86_64-linux)
+    nokogiri (1.14.4-x86_64-linux)
      racc (~> 1.4)
-    parallel (1.22.1)
-    parser (3.2.1.1)
+    parallel (1.23.0)
+    parser (3.2.2.1)
      ast (~> 2.4.1)
-    pg (1.2.3)
+    pg (1.4.6)
    public_suffix (5.0.1)
-    puma (5.6.5)
+    puma (6.2.2)
      nio4r (~> 2.0)
    racc (1.6.2)
-    rack (2.2.6.4)
-    rack-openid (1.4.2)
-      rack (>= 1.1.0)
-      ruby-openid (>= 2.1.8)
+    rack (2.2.7)
    rack-test (2.1.0)
      rack (>= 1.3)
-    rails (5.2.8.1)
-      actioncable (= 5.2.8.1)
-      actionmailer (= 5.2.8.1)
-      actionpack (= 5.2.8.1)
-      actionview (= 5.2.8.1)
-      activejob (= 5.2.8.1)
-      activemodel (= 5.2.8.1)
-      activerecord (= 5.2.8.1)
-      activestorage (= 5.2.8.1)
-      activesupport (= 5.2.8.1)
-      bundler (>= 1.3.0)
-      railties (= 5.2.8.1)
+    rails (6.1.7.3)
+      actioncable (= 6.1.7.3)
+      actionmailbox (= 6.1.7.3)
+      actionmailer (= 6.1.7.3)
+      actionpack (= 6.1.7.3)
+      actiontext (= 6.1.7.3)
+      actionview (= 6.1.7.3)
+      activejob (= 6.1.7.3)
+      activemodel (= 6.1.7.3)
+      activerecord (= 6.1.7.3)
+      activestorage (= 6.1.7.3)
+      activesupport (= 6.1.7.3)
+      bundler (>= 1.15.0)
+      railties (= 6.1.7.3)
      sprockets-rails (>= 2.0.0)
    rails-dom-testing (2.0.3)
      activesupport (>= 4.2.0)
      nokogiri (>= 1.6)
    rails-html-sanitizer (1.5.0)
      loofah (~> 2.19, >= 2.19.1)
-    railties (5.2.8.1)
-      actionpack (= 5.2.8.1)
-      activesupport (= 5.2.8.1)
+    railties (6.1.7.3)
+      actionpack (= 6.1.7.3)
+      activesupport (= 6.1.7.3)
      method_source
-      rake (>= 0.8.7)
-      thor (>= 0.19.0, < 2.0)
+      rake (>= 12.2)
+      thor (~> 1.0)
    rainbow (3.1.1)
    rake (13.0.6)
+    rb-fsevent (0.11.2)
+    rb-inotify (0.10.1)
+      ffi (~> 1.0)
    rbpdf (1.21.1)
      htmlentities
      rbpdf-font (~> 1.19.0)
    rbpdf-font (1.19.1)
-    redcarpet (3.5.1)
-    regexp_parser (1.8.2)
+    redcarpet (3.6.0)
+    regexp_parser (2.8.0)
    request_store (1.5.1)
      rack (>= 1.4)
    rexml (3.2.5)
-    roadie (4.0.0)
+    roadie (5.1.0)
      css_parser (~> 1.4)
      nokogiri (~> 1.8)
-    roadie-rails (2.2.0)
-      railties (>= 5.1, < 6.2)
-      roadie (>= 3.1, < 5.0)
+    roadie-rails (3.0.0)
+      railties (>= 5.1, < 7.1)
+      roadie (~> 5.0)
    rotp (6.2.2)
-    rouge (3.26.1)
-    rqrcode (2.1.2)
+    rouge (4.1.1)
+    rqrcode (2.2.0)
      chunky_png (~> 1.0)
      rqrcode_core (~> 1.0)
    rqrcode_core (1.2.0)
-    rubocop (1.12.1)
+    rubocop (1.51.0)
+      json (~> 2.3)
      parallel (~> 1.10)
-      parser (>= 3.0.0.0)
+      parser (>= 3.2.0.0)
      rainbow (>= 2.2.2, < 4.0)
      regexp_parser (>= 1.8, < 3.0)
-      rexml
-      rubocop-ast (>= 1.2.0, < 2.0)
+      rexml (>= 3.2.5, < 4.0)
+      rubocop-ast (>= 1.28.0, < 2.0)
      ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.28.0)
+      unicode-display_width (>= 2.4.0, < 3.0)
+    rubocop-ast (1.28.1)
      parser (>= 3.2.1.0)
-    rubocop-performance (1.10.2)
-      rubocop (>= 0.90.0, < 2.0)
+    rubocop-performance (1.17.1)
+      rubocop (>= 1.7.0, < 2.0)
      rubocop-ast (>= 0.4.0)
-    rubocop-rails (2.9.1)
+    rubocop-rails (2.19.1)
      activesupport (>= 4.2.0)
      rack (>= 1.1)
-      rubocop (>= 0.90.0, < 2.0)
-    ruby-openid (2.9.2)
+      rubocop (>= 1.33.0, < 2.0)
    ruby-progressbar (1.13.0)
    ruby2_keywords (0.0.5)
    rubyzip (2.3.2)
+    sanitize (6.0.1)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.12.0)
    selenium-webdriver (3.142.7)
      childprocess (>= 0.5, < 4.0)
      rubyzip (>= 1.2.2)
-    simplecov (0.18.5)
+    simplecov (0.22.0)
      docile (~> 1.1)
      simplecov-html (~> 0.11)
+      simplecov_json_formatter (~> 0.1)
    simplecov-html (0.12.3)
+    simplecov_json_formatter (0.1.4)
    sprockets (4.2.0)
      concurrent-ruby (~> 1.0)
      rack (>= 2.2.4, < 4)
@ -190,23 +240,23 @@ GEM
      actionpack (>= 5.2)
      activesupport (>= 5.2)
      sprockets (>= 3.0.0)
-    thor (1.2.1)
-    thread_safe (0.3.6)
-    tzinfo (1.2.11)
-      thread_safe (~> 0.1)
+    thor (1.2.2)
+    timeout (0.3.2)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
    unicode-display_width (2.4.2)
-    webdrivers (4.7.0)
+    webdrivers (4.6.1)
      nokogiri (~> 1.6)
      rubyzip (>= 1.3.0)
-      selenium-webdriver (> 3.141, < 5.0)
-    webrick (1.7.0)
+      selenium-webdriver (>= 3.0, < 4.0)
+    webrick (1.8.1)
    websocket-driver (0.7.5)
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
    xpath (3.2.0)
      nokogiri (~> 1.8)
-    yard (0.9.28)
-      webrick (~> 1.7.0)
+    yard (0.9.34)
+    zeitwerk (2.6.8)

 PLATFORMS
  ruby
@ -214,40 +264,46 @@ PLATFORMS
 DEPENDENCIES
  actionpack-xml_parser
  addressable
-  bundler (>= 1.12.0)
-  capybara (~> 3.31.0)
-  csv (~> 3.1.1)
+  capybara (~> 3.38.0)
+  commonmarker (~> 0.23.8)
+  csv (~> 3.2.6)
+  deckar01-task_list (= 2.3.2)
  ffi
-  i18n (~> 1.8.2)
-  mail (~> 2.7.1)
+  html-pipeline (~> 2.13.2)
+  i18n (~> 1.13.0)
+  listen (~> 3.3)
+  mail (~> 2.8.1)
  marcel
-  mini_magick (~> 4.11.0)
-  mini_mime (~> 1.0.1)
+  mini_magick (~> 4.12.0)
+  mini_mime (~> 1.1.0)
  mocha (>= 1.4.0)
  mysql2 (~> 0.5.0)
+  net-imap (~> 0.3.4)
  net-ldap (~> 0.17.0)
-  nokogiri (~> 1.13.10)
-  pg (~> 1.2.2)
-  puma (< 6.0.0)
-  rack-openid
-  rails (= 5.2.8.1)
+  net-pop (~> 0.1.2)
+  net-smtp (~> 0.3.3)
+  nokogiri (~> 1.14.0)
+  pg (~> 1.4.2)
+  puma
+  rails (= 6.1.7.3)
  rails-dom-testing
-  rbpdf (~> 1.21.0)
-  redcarpet (~> 3.5.1)
+  rbpdf (~> 1.21.1)
+  redcarpet (~> 3.6.0)
  request_store (~> 1.5.0)
-  roadie-rails (~> 2.2.0)
+  roadie-rails (~> 3.0.0)
  rotp (>= 5.0.0)
-  rouge (~> 3.26.0)
+  rouge (~> 4.1.0)
  rqrcode
-  rubocop (~> 1.12.0)
-  rubocop-performance (~> 1.10.1)
-  rubocop-rails (~> 2.9.0)
-  ruby-openid (~> 2.9.2)
+  rubocop (~> 1.51.0)
+  rubocop-performance (~> 1.17.1)
+  rubocop-rails (~> 2.19.1)
  rubyzip (~> 2.3.0)
+  sanitize (~> 6.0)
  selenium-webdriver (~> 3.142.7)
-  simplecov (~> 0.18.5)
+  simplecov (~> 0.22.0)
  tzinfo-data
-  webdrivers (~> 4.4)
+  webdrivers (= 4.6.1)
+  webrick
  yard

 RUBY VERSION
--- a/pkgs/applications/version-management/redmine/default.nix
+++ b/pkgs/applications/version-management/redmine/default.nix
@ -1,13 +1,13 @@
-{ lib, stdenv, fetchurl, bundlerEnv, ruby, makeWrapper, nixosTests }:
+{ lib, stdenv, fetchurl, bundlerEnv, ruby, defaultGemConfig, makeWrapper, nixosTests }:

 let
-  version = "4.2.10";
+  version = "5.0.5";
  rubyEnv = bundlerEnv {
    name = "redmine-env-${version}";

    inherit ruby;
    gemdir = ./.;
-    groups = [ "development" "ldap" "markdown" "minimagick" "openid" "test" ];
+    groups = [ "development" "ldap" "markdown" "common_mark" "minimagick" "test" ];
  };
 in
  stdenv.mkDerivation rec {
@ -16,7 +16,7 @@ in

    src = fetchurl {
      url = "https://www.redmine.org/releases/${pname}-${version}.tar.gz";
-      sha256 = "sha256-byY4jCOJKWJVLKSR1e/tq9QtrIiGHdnYC8M0WPZb4ek=";
+      sha256 = "sha256-qJrRxLub8CXmUnx3qxjI+vd0nJSpdcryz9u6AOsSpIE=";
    };

    nativeBuildInputs = [ makeWrapper ];
@ -47,7 +47,7 @@ in
    meta = with lib; {
      homepage = "https://www.redmine.org/";
      platforms = platforms.linux;
-      maintainers = with maintainers; [ aanderse felixsinger ];
+      maintainers = with maintainers; [ aanderse felixsinger megheaiulian ];
      license = licenses.gpl2;
    };
  }
--- a/pkgs/applications/version-management/redmine/gemset.nix
+++ b/pkgs/applications/version-management/redmine/gemset.nix
@ -1,25 +1,36 @@
 {
  actioncable = {
-    dependencies = ["actionpack" "nio4r" "websocket-driver"];
+    dependencies = ["actionpack" "activesupport" "nio4r" "websocket-driver"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1v5bihkn3cdf7s1cv04wqpk3l5snjgyav0jz9x5vhzzdqyknvndr";
+      sha256 = "0bndmmby5qxq8rs42fbb2ax3hhbjj2ds8wja08s0iadkbrn7shvf";
      type = "gem";
    };
-    version = "5.2.8.1";
+    version = "6.1.7.3";
+  };
+  actionmailbox = {
+    dependencies = ["actionpack" "activejob" "activerecord" "activestorage" "activesupport" "mail"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0cx00kf0syq5gdhlrmw0q9v92ki55drbsk4gzy86ls2q8xkd792s";
+      type = "gem";
+    };
+    version = "6.1.7.3";
  };
  actionmailer = {
-    dependencies = ["actionpack" "actionview" "activejob" "mail" "rails-dom-testing"];
+    dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "rails-dom-testing"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1x0qjs8v5z5wzk7vlg7pdr71hsm154d8d0gwhya573xpxfjzmjpx";
+      sha256 = "0vbif021cyndq3v3m61dkmgdbbirqk9zcsszb9nisq24m3gx1aai";
      type = "gem";
    };
-    version = "5.2.8.1";
+    version = "6.1.7.3";
  };
  actionpack = {
    dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@ -27,10 +38,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0mqvz5dsg9zis34y8m4d2ackr3zs7h27mv6zx5yx00a58fifhyv3";
+      sha256 = "0k6hc7klvn8m88b88vykl83jrpqhn4zz67l2zx9v266xga6fhala";
      type = "gem";
    };
-    version = "5.2.8.1";
+    version = "6.1.7.3";
  };
  actionpack-xml_parser = {
    dependencies = ["actionpack" "railties"];
@ -43,16 +54,27 @@
    };
    version = "2.0.1";
  };
+  actiontext = {
+    dependencies = ["actionpack" "activerecord" "activestorage" "activesupport" "nokogiri"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "16ldxyxlxl9scggpmkww2fxzim7sl2b4js610pvddcsr74z9fjs7";
+      type = "gem";
+    };
+    version = "6.1.7.3";
+  };
  actionview = {
    dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06bk0hyv2sq386qc7r96qbhskg91apdj3mrdpzhry6p6nby2afml";
+      sha256 = "0ck02cfc17s6g05qn0k7khwvvazwbf2rxbjcma8px2nw2j1ngvcn";
      type = "gem";
    };
-    version = "5.2.8.1";
+    version = "6.1.7.3";
  };
  activejob = {
    dependencies = ["activesupport" "globalid"];
@ -60,10 +82,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "12y07kvq9y30ycl4i45g9c2c9jv5a9vlxvrjaqfl79iim6gk1klz";
+      sha256 = "05bkw9qgjgj2nxzjj2fh6jp1fcvgff0aa4r77k0gcfmnzc1g8wdl";
      type = "gem";
    };
-    version = "5.2.8.1";
+    version = "6.1.7.3";
  };
  activemodel = {
    dependencies = ["activesupport"];
@ -71,43 +93,43 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0vsyxbjpl47grlkzgh2rm0i9yksfwk11lsdi11jmqszc6lkj1b9g";
+      sha256 = "03hy5bwghdklcxbdylmsq70y0qzslck5slb2zkvp7g6mmvk86kwd";
      type = "gem";
    };
-    version = "5.2.8.1";
+    version = "6.1.7.3";
  };
  activerecord = {
-    dependencies = ["activemodel" "activesupport" "arel"];
+    dependencies = ["activemodel" "activesupport"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0jk8qwdvq465nklxr7z0qzpiacxcqd72y6frimlalchhigl8ya0a";
+      sha256 = "1alshkgbcxp9s4vqb2b0yrrnyg15kxhlp1slsb03a61w7h42pspw";
      type = "gem";
    };
-    version = "5.2.8.1";
+    version = "6.1.7.3";
  };
  activestorage = {
-    dependencies = ["actionpack" "activerecord" "marcel"];
+    dependencies = ["actionpack" "activejob" "activerecord" "activesupport" "marcel" "mini_mime"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0qklddvw3v13dh79c7vljad8m25frlhnwcnw9xk510d676j3lr8a";
+      sha256 = "06w4wlabqqr9bwdig44r5vdwkcbbivwgwn2fl775w7h05vrccgp8";
      type = "gem";
    };
-    version = "5.2.8.1";
+    version = "6.1.7.3";
  };
  activesupport = {
-    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
-    groups = ["default" "test"];
+    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
+    groups = ["common_mark" "default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0r15sbhl4nrkh2g5ccbhmn3c2ngri71j0yfnarxkq90vdrhqqjgh";
+      sha256 = "06mihpy83a5xmavvn7l8vbix472dsi0vh30xj6g594k0679m0ir6";
      type = "gem";
    };
-    version = "5.2.8.1";
+    version = "6.1.7.3";
  };
  addressable = {
    dependencies = ["public_suffix"];
@ -115,20 +137,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ypdmpdn20hxp5vwxz3zc04r5xcwqc25qszdlg41h8ghdqbllwmw";
+      sha256 = "15s8van7r2ad3dq6i03l3z4hqnvxcq75a3h72kxvf9an53sqma20";
      type = "gem";
    };
-    version = "2.8.1";
-  };
-  arel = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1jk7wlmkr61f6g36w9s2sn46nmdg6wn2jfssrhbhirv5x9n95nk0";
-      type = "gem";
-    };
-    version = "9.0.0";
+    version = "2.8.4";
  };
  ast = {
    groups = ["default" "test"];
@ -151,15 +163,15 @@
    version = "3.2.4";
  };
  capybara = {
-    dependencies = ["addressable" "mini_mime" "nokogiri" "rack" "rack-test" "regexp_parser" "xpath"];
+    dependencies = ["addressable" "matrix" "mini_mime" "nokogiri" "rack" "rack-test" "regexp_parser" "xpath"];
    groups = ["test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0fhgnw6xgnphaka50b995mcmc2pjifmlr8ypz6dw2a6jkz3qqlcl";
+      sha256 = "123198zk2ak8mziwa5jc3ckgpmsg08zn064n3aywnqm9s1bwjv3v";
      type = "gem";
    };
-    version = "3.31.0";
+    version = "3.38.0";
  };
  childprocess = {
    groups = ["default" "test"];
@ -181,8 +193,18 @@
    };
    version = "1.4.0";
  };
+  commonmarker = {
+    groups = ["common_mark"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "074162raa8pc92q6833hgqdlfr3z5jgid9avdz5k25cnls2rqwrf";
+      type = "gem";
+    };
+    version = "0.23.9";
+  };
  concurrent-ruby = {
-    groups = ["default" "test"];
+    groups = ["common_mark" "default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
@ -217,10 +239,31 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07mgyalwdxaxnff86j5p6n5szmhqz7nrlkb40826mzggrmva8v1m";
+      sha256 = "0l5f5cq8ki3h4djh7pb8yqdkywqd08vjy3vd64yqh7qd6pdwky6w";
      type = "gem";
    };
-    version = "3.1.9";
+    version = "3.2.6";
+  };
+  date = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03skfikihpx37rc27vr3hwrb057gxnmdzxhmzd4bf4jpkl0r55w1";
+      type = "gem";
+    };
+    version = "3.3.3";
+  };
+  deckar01-task_list = {
+    dependencies = ["html-pipeline"];
+    groups = ["common_mark"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01c8vv0xwbhlyhiagj93b1hlm2n0rmj4sw62nbc0jhyj90jhj6as";
+      type = "gem";
+    };
+    version = "2.3.2";
  };
  docile = {
    groups = ["default" "test"];
@ -242,6 +285,26 @@
    };
    version = "1.12.0";
  };
+  ffi = {
+    groups = ["default" "development" "test"];
+    platforms = [{
+      engine = "maglev";
+    } {
+      engine = "mingw";
+    } {
+      engine = "mingw";
+    } {
+      engine = "mswin";
+    } {
+      engine = "ruby";
+    }];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1862ydmclzy1a0cjbvm8dz7847d9rch495ib0zb64y84d3xd4bkg";
+      type = "gem";
+    };
+    version = "1.15.5";
+  };
  globalid = {
    dependencies = ["activesupport"];
    groups = ["default"];
@ -253,6 +316,17 @@
    };
    version = "1.1.0";
  };
+  html-pipeline = {
+    dependencies = ["activesupport" "nokogiri"];
+    groups = ["common_mark" "default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00xqmlny1b4ixff8sk0rkl4wcgwqc6v93qv8l3rn8d1dppvq7pm1";
+      type = "gem";
+    };
+    version = "2.13.2";
+  };
  htmlentities = {
    groups = ["default"];
    platforms = [];
@ -265,14 +339,35 @@
  };
  i18n = {
    dependencies = ["concurrent-ruby"];
+    groups = ["common_mark" "default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1yk33slipi3i1kydzrrchbi7cgisaxym6pgwlzx7ir8vjk6wl90x";
+      type = "gem";
+    };
+    version = "1.13.0";
+  };
+  json = {
    groups = ["default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0vdd1kii40qhbr9n8qx71k2gskq6rkl8ygy8hw5hfj8bb5a364xf";
+      sha256 = "0nalhin1gda4v8ybk6lq8f407cgfrj6qzn234yra4ipkmlbfmal6";
      type = "gem";
    };
-    version = "1.8.11";
+    version = "2.6.3";
+  };
+  listen = {
+    dependencies = ["rb-fsevent" "rb-inotify"];
+    groups = ["development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13rgkfar8pp31z1aamxf5y7cfq88wv6rxxcwy7cmm177qq508ycn";
+      type = "gem";
+    };
+    version = "3.8.0";
  };
  loofah = {
    dependencies = ["crass" "nokogiri"];
@ -280,21 +375,21 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "08qhzck271anrx9y6qa6mh8hwwdzsgwld8q0000rcd7yvvpnjr3c";
+      sha256 = "1p744kjpb5zk2ihklbykzii77alycjc04vpnm2ch2f3cp65imlj3";
      type = "gem";
    };
-    version = "2.19.1";
+    version = "2.21.3";
  };
  mail = {
-    dependencies = ["mini_mime"];
+    dependencies = ["mini_mime" "net-imap" "net-pop" "net-smtp"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "00wwz6ys0502dpk8xprwcqfwyf3hmnx6lgxaiq6vj43mkx43sapc";
+      sha256 = "1bf9pysw1jfgynv692hhaycfxa8ckay1gjw5hz3madrbrynryfzc";
      type = "gem";
    };
-    version = "2.7.1";
+    version = "2.8.1";
  };
  marcel = {
    groups = ["default"];
@ -306,6 +401,16 @@
    };
    version = "1.0.2";
  };
+  matrix = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1h2cgkpzkh3dd0flnnwfq6f3nl2b1zff9lvqz8xs853ssv5kq23i";
+      type = "gem";
+    };
+    version = "0.4.2";
+  };
  method_source = {
    groups = ["default"];
    platforms = [];
@ -321,33 +426,33 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1aj604x11d9pksbljh0l38f70b558rhdgji1s9i763hiagvvx2hs";
+      sha256 = "0slh78f9z6n0l1i2km7m48yz7l4fjrk88sj1f4mh1wb39sl2yc37";
      type = "gem";
    };
-    version = "4.11.0";
+    version = "4.12.0";
  };
  mini_mime = {
    groups = ["default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1np6srnyagghhh2w4nyv09sz47v0i6ri3q6blicj94vgxqp12c94";
+      sha256 = "0lbim375gw2dk6383qirz13hgdmxlan0vc5da2l072j3qw6fqjm5";
      type = "gem";
    };
-    version = "1.0.3";
+    version = "1.1.2";
  };
  mini_portile2 = {
-    groups = ["default" "test"];
+    groups = ["common_mark" "default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1af4yarhbbx62f7qsmgg5fynrik0s36wjy3difkawy536xg343mp";
+      sha256 = "0z7f38iq37h376n9xbl4gajdrnwzq284c9v1py4imw3gri2d5cj6";
      type = "gem";
    };
-    version = "2.8.1";
+    version = "2.8.2";
  };
  minitest = {
-    groups = ["default" "test"];
+    groups = ["common_mark" "default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
@ -385,6 +490,17 @@
    };
    version = "0.5.5";
  };
+  net-imap = {
+    dependencies = ["date" "net-protocol"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1d996zf3g8xz244791b0qsl9vr7zg4lqnnmf9k2kshr9lki5jam8";
+      type = "gem";
+    };
+    version = "0.3.4";
+  };
  net-ldap = {
    groups = ["ldap"];
    platforms = [];
@ -395,36 +511,69 @@
    };
    version = "0.17.1";
  };
+  net-pop = {
+    dependencies = ["net-protocol"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1wyz41jd4zpjn0v1xsf9j778qx1vfrl24yc20cpmph8k42c4x2w4";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
+  net-protocol = {
+    dependencies = ["timeout"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dxckrlw4q1lcn3qg4mimmjazmg9bma5gllv72f8js3p36fb3b91";
+      type = "gem";
+    };
+    version = "0.2.1";
+  };
+  net-smtp = {
+    dependencies = ["net-protocol"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1c6md06hm5bf6rv53sk54dl2vg038pg8kglwv3rayx0vk2mdql9x";
+      type = "gem";
+    };
+    version = "0.3.3";
+  };
  nio4r = {
    groups = ["default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0xk64wghkscs6bv2n22853k2nh39d131c6rfpnlw12mbjnnv9v1v";
+      sha256 = "0w9978zwjf1qhy3amkivab0f9syz6a7k0xgydjidaf7xc831d78f";
      type = "gem";
    };
-    version = "2.5.8";
+    version = "2.5.9";
  };
  nokogiri = {
    dependencies = ["mini_portile2" "racc"];
-    groups = ["default" "test"];
+    groups = ["common_mark" "default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0n79k78c5vdcyl0m3y3l5x9kxl6xf5lgriwi2vd665qmdkr01vnk";
+      sha256 = "03g0hwp3z8m442nq8ag4lrbcgwcc7hhi8d1s0y7ipic0m50szl9b";
      type = "gem";
    };
-    version = "1.13.10";
+    version = "1.14.4";
  };
  parallel = {
    groups = ["default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07vnk6bb54k4yc06xnwck7php50l09vvlw1ga8wdz0pia461zpzb";
+      sha256 = "0jcc512l38c0c163ni3jgskvq1vc3mr8ly5pvjijzwvfml9lf597";
      type = "gem";
    };
-    version = "1.22.1";
+    version = "1.23.0";
  };
  parser = {
    dependencies = ["ast"];
@ -432,10 +581,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1a2v5f8fw7nxm41xp422p1pbr41hafy62bp95m7vg42cqp5y4grc";
+      sha256 = "08f89nssj7ws7sjfvc2fcjpfm83sjgmniyh0npnmpqf5sfv44r8x";
      type = "gem";
    };
-    version = "3.2.1.1";
+    version = "3.2.2.1";
  };
  pg = {
    groups = ["default"];
@ -450,10 +599,10 @@
    }];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "13mfrysrdrh8cka1d96zm0lnfs59i5x2g6ps49r2kz5p3q81xrzj";
+      sha256 = "07m6lxljabw9kyww5k5lgsxsznsm1v5l14r1la09gqka9b5kv3yr";
      type = "gem";
    };
-    version = "1.2.3";
+    version = "1.4.6";
  };
  public_suffix = {
    groups = ["default" "test"];
@ -471,13 +620,13 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0qzq0c791kacv68hgk9zqsd1p7zx1y1rr9j10rn9yphibb8jj436";
+      sha256 = "0yf4jmkyy8das7pj1xzwllfvzkhq2p6p534j61d9h4wz3nfyf0s5";
      type = "gem";
    };
-    version = "5.6.5";
+    version = "6.2.2";
  };
  racc = {
-    groups = ["default" "test"];
+    groups = ["common_mark" "default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
@ -487,25 +636,14 @@
    version = "1.6.2";
  };
  rack = {
-    groups = ["default" "openid" "test"];
+    groups = ["default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1qgwkcb8kxns8d5187cxjaxf18b7dmg9gh6cr9c1125m0bj2pnfk";
+      sha256 = "16w217k9z02c4hqizym8dkj6bqmmzx4qdvqpnskgzf174a5pwdxk";
      type = "gem";
    };
-    version = "2.2.6.4";
-  };
-  rack-openid = {
-    dependencies = ["rack" "ruby-openid"];
-    groups = ["openid"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0sg85yn981j3a0iri3ch4znzdwscvz29l7vrk3dafqw4fdg31llc";
-      type = "gem";
-    };
-    version = "1.4.2";
+    version = "2.2.7";
  };
  rack-test = {
    dependencies = ["rack"];
@ -519,15 +657,15 @@
    version = "2.1.0";
  };
  rails = {
-    dependencies = ["actioncable" "actionmailer" "actionpack" "actionview" "activejob" "activemodel" "activerecord" "activestorage" "activesupport" "railties" "sprockets-rails"];
+    dependencies = ["actioncable" "actionmailbox" "actionmailer" "actionpack" "actiontext" "actionview" "activejob" "activemodel" "activerecord" "activestorage" "activesupport" "railties" "sprockets-rails"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1jy4jfkq0xpqp0d3ii9xhj69kacx8l4q3pincncw2g30bqd7a66g";
+      sha256 = "07cs7qdkx6vwp66diwdy9g6mx52rsd8rxhbnsqf9bqam58g2aynj";
      type = "gem";
    };
-    version = "5.2.8.1";
+    version = "6.1.7.3";
  };
  rails-dom-testing = {
    dependencies = ["activesupport" "nokogiri"];
@ -557,10 +695,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0w9hm85jgbyar748z9nppsz8mgwywa2v9qqlbkzhpgirxhblifv2";
+      sha256 = "1d2snjnx1j848axppj2napy3zjgbka3fnw2528rcamhm6dp694nd";
      type = "gem";
    };
-    version = "5.2.8.1";
+    version = "6.1.7.3";
  };
  rainbow = {
    groups = ["default" "test"];
@ -582,6 +720,27 @@
    };
    version = "13.0.6";
  };
+  rb-fsevent = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1zmf31rnpm8553lqwibvv3kkx0v7majm1f341xbxc0bk5sbhp423";
+      type = "gem";
+    };
+    version = "0.11.2";
+  };
+  rb-inotify = {
+    dependencies = ["ffi"];
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1jm76h8f8hji38z3ggf4bzi8vps6p7sagxn3ab57qc0xyga64005";
+      type = "gem";
+    };
+    version = "0.10.1";
+  };
  rbpdf = {
    dependencies = ["htmlentities" "rbpdf-font"];
    groups = ["default"];
@ -608,20 +767,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0bvk8yyns5s1ls437z719y5sdv9fr8kfs8dmr6g8s761dv5n8zvi";
+      sha256 = "1sg9sbf9pm91l7lac7fs4silabyn0vflxwaa2x3lrzsm0ff8ilca";
      type = "gem";
    };
-    version = "3.5.1";
+    version = "3.6.0";
  };
  regexp_parser = {
    groups = ["default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0x4s82lgf0l71y3xc9gp4qxkrgx1kv8f6avdqd68l46ijbyvicdm";
+      sha256 = "17xizkw5ryw8hhq64iqxmzdrrdxpc5lhkqc1fgm1aj0zsk1r2950";
      type = "gem";
    };
-    version = "1.8.2";
+    version = "2.8.0";
  };
  request_store = {
    dependencies = ["rack"];
@ -650,10 +809,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "01kld3drqfiih5x8c13cvr6dpvdl7jml0v9bcw4fsy322lax3kn0";
+      sha256 = "0728slgr2rxx6v1mrh1416k1waj29szfa1jqpbiw3xrvgfpzvcm7";
      type = "gem";
    };
-    version = "4.0.0";
+    version = "5.1.0";
  };
  roadie-rails = {
    dependencies = ["railties" "roadie"];
@ -661,10 +820,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0jjcqnp37z65dksykzwjiz149kx65nw70lyx8dkw1fm5x7yraqvh";
+      sha256 = "16j1cjhq8xqr77vyf7m7ip2132619wdnpvlbig4cnn96yyi0cnan";
      type = "gem";
    };
-    version = "2.2.0";
+    version = "3.0.0";
  };
  rotp = {
    groups = ["default"];
@ -681,10 +840,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "197k0vskf72wxx0gzwld2jzg27bb7982xlvnzy9adlvkzp7nh8vf";
+      sha256 = "0jzx6ni3bjdajc9y4w6mclq165jwiypbxkav2k0gbag7ip93xk21";
      type = "gem";
    };
-    version = "3.26.1";
+    version = "4.1.1";
  };
  rqrcode = {
    dependencies = ["chunky_png" "rqrcode_core"];
@ -692,10 +851,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0s97q1rqmw7rzsdr500hr4f2k6s24n8qk1klciz5q94zvdrygx3p";
+      sha256 = "1hggzz8i1l62pkkiybhiqv6ypxw7q844sddrrbbfczjcnj5sivi3";
      type = "gem";
    };
-    version = "2.1.2";
+    version = "2.2.0";
  };
  rqrcode_core = {
    groups = ["default"];
@ -708,15 +867,15 @@
    version = "1.2.0";
  };
  rubocop = {
-    dependencies = ["parallel" "parser" "rainbow" "regexp_parser" "rexml" "rubocop-ast" "ruby-progressbar" "unicode-display_width"];
+    dependencies = ["json" "parallel" "parser" "rainbow" "regexp_parser" "rexml" "rubocop-ast" "ruby-progressbar" "unicode-display_width"];
    groups = ["test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0hi2c3a6alya9yx07nirnjzlc0mvmidnx67874njp6wf7d5xqqr9";
+      sha256 = "0013mnzj6ql3v8nif7fm8n2832jnwa46azync6azsg9d4iblrfmy";
      type = "gem";
    };
-    version = "1.12.1";
+    version = "1.51.0";
  };
  rubocop-ast = {
    dependencies = ["parser"];
@ -724,10 +883,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0n2gsafg6p7nr1z8i1hkvp2qqkkbg842ba183dnl0h08xd9ms6q5";
+      sha256 = "0gs8zjigzdqj0kcmmrhvd4zavwr6kz6h9qvrh9m7bhy56f4aqljs";
      type = "gem";
    };
-    version = "1.28.0";
+    version = "1.28.1";
  };
  rubocop-performance = {
    dependencies = ["rubocop" "rubocop-ast"];
@ -735,10 +894,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07c3kymvsid9aajwmmwr3n6apxgyjcbzbl2n6r5lpzkyz28jqn15";
+      sha256 = "1z6i24r0485fxa5n4g3rhp88w589fifszhd1khbzya2iiknkjxkr";
      type = "gem";
    };
-    version = "1.10.2";
+    version = "1.17.1";
  };
  rubocop-rails = {
    dependencies = ["activesupport" "rack" "rubocop"];
@ -746,20 +905,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0h656la1g644g54g3gidz45p6v8i1156nw6bi66cfx7078y1339d";
+      sha256 = "0j6dn8pz70bngx6van8yzsimpdd93gm7c8lr93wz1j4ahm6q4hn9";
      type = "gem";
    };
-    version = "2.9.1";
-  };
-  ruby-openid = {
-    groups = ["openid"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "190p1m0bxd9xkfk1j6cpcv3x5c367g36nsglg4m1fcwqdd13k3kz";
-      type = "gem";
-    };
-    version = "2.9.2";
+    version = "2.19.1";
  };
  ruby-progressbar = {
    groups = ["default" "test"];
@ -791,6 +940,17 @@
    };
    version = "2.3.2";
  };
+  sanitize = {
+    dependencies = ["crass" "nokogiri"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ga8yzc9zj45m92ycwnzhzahkwvc3dp3lym5m3f3880hs4jhh7l3";
+      type = "gem";
+    };
+    version = "6.0.1";
+  };
  selenium-webdriver = {
    dependencies = ["childprocess" "rubyzip"];
    groups = ["test"];
@ -803,15 +963,15 @@
    version = "3.142.7";
  };
  simplecov = {
-    dependencies = ["docile" "simplecov-html"];
+    dependencies = ["docile" "simplecov-html" "simplecov_json_formatter"];
    groups = ["test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ycx5q699ycbjhp28sjbkrd62vwxlrb7fh4v2m7sjsp2qhi6cf6r";
+      sha256 = "198kcbrjxhhzca19yrdcd6jjj9sb51aaic3b0sc3pwjghg3j49py";
      type = "gem";
    };
-    version = "0.18.5";
+    version = "0.22.0";
  };
  simplecov-html = {
    groups = ["default" "test"];
@ -823,6 +983,16 @@
    };
    version = "0.12.3";
  };
+  simplecov_json_formatter = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0a5l0733hj7sk51j81ykfmlk2vd5vaijlq9d5fn165yyx3xii52j";
+      type = "gem";
+    };
+    version = "0.1.4";
+  };
  sprockets = {
    dependencies = ["concurrent-ruby" "rack"];
    groups = ["default"];
@ -850,31 +1020,31 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0inl77jh4ia03jw3iqm5ipr76ghal3hyjrd6r8zqsswwvi9j2xdi";
+      sha256 = "0k7j2wn14h1pl4smibasw0bp66kg626drxb59z7rzflch99cd4rg";
      type = "gem";
    };
-    version = "1.2.1";
+    version = "1.2.2";
  };
-  thread_safe = {
-    groups = ["default" "test"];
+  timeout = {
+    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0nmhcgq6cgz44srylra07bmaw99f5271l0dpsvl5f75m44l0gmwy";
+      sha256 = "1pfddf51n5fnj4f9ggwj3wbf23ynj0nbxlxqpz12y1gvl9g7d6r6";
      type = "gem";
    };
-    version = "0.3.6";
+    version = "0.3.2";
  };
  tzinfo = {
-    dependencies = ["thread_safe"];
-    groups = ["default" "test"];
+    dependencies = ["concurrent-ruby"];
+    groups = ["common_mark" "default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1dk1cfnhgl14l580b650qyp8m5xpqb3zg0wb251h5jkm46hzc0b5";
+      sha256 = "16w2g84dzaf3z13gxyzlzbf748kylk5bdgg3n1ipvkvvqy685bwd";
      type = "gem";
    };
-    version = "1.2.11";
+    version = "2.0.6";
  };
  unicode-display_width = {
    groups = ["default" "test"];
@ -892,20 +1062,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "05fdb6z8541p912xanjbl9y15cyj6g44530y0nib6qhv6i90rkzp";
+      sha256 = "1naymcfmm9pkf0f67xd99d9f6dpv477ggyvc1c04gxifirynfydp";
      type = "gem";
    };
-    version = "4.7.0";
+    version = "4.6.1";
  };
  webrick = {
-    groups = ["default" "development"];
+    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1d4cvgmxhfczxiq5fr534lmizkhigd15bsx5719r5ds7k7ivisc7";
+      sha256 = "13qm7s0gr2pmfcl7dxrmq38asaza4w0i2n9my4yzs499j731wh8r";
      type = "gem";
    };
-    version = "1.7.0";
+    version = "1.8.1";
  };
  websocket-driver = {
    dependencies = ["websocket-extensions"];
@ -940,14 +1110,23 @@
    version = "3.2.0";
  };
  yard = {
-    dependencies = ["webrick"];
    groups = ["development"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0p1if8g9ww6hlpfkphqv3y1z0rbqnnrvb38c5qhnala0f8qpw6yk";
+      sha256 = "013yrnwx1zhzhn1fnc19zck22a1qgimsaglp2iwgf5bz9l8h93js";
      type = "gem";
    };
-    version = "0.9.28";
+    version = "0.9.34";
+  };
+  zeitwerk = {
+    groups = ["common_mark" "default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ck6bj7wa73dkdh13735jl06k6cfny98glxjkas82aivlmyzqqbk";
+      type = "gem";
+    };
+    version = "2.6.8";
  };
 }
--- a/pkgs/applications/video/kodi/addons/visualization-fishbmc/default.nix
+++ b/pkgs/applications/video/kodi/addons/visualization-fishbmc/default.nix
@ -0,0 +1,25 @@
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL }:
+
+buildKodiBinaryAddon rec {
+  pname = "visualization-fishbmc";
+  namespace = "visualization.fishbmc";
+  version = "20.2.0";
+
+  src = fetchFromGitHub {
+    owner = "xbmc";
+    repo = namespace;
+    rev = "${version}-${rel}";
+    hash = "sha256-MgeSIKAy0N2NMGsU/15tKtDb34CROjcMaKjGyySl9Z0=";
+  };
+
+  extraBuildInputs = [ pkg-config libGL ];
+
+  propagatedBuildInputs = [ glm ];
+  meta = with lib; {
+    homepage = "https://github.com/xbmc/visualization.fishbmc";
+    description = "FishBMC visualization for kodi";
+    platforms = platforms.all;
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/applications/video/kodi/addons/visualization-goom/default.nix
+++ b/pkgs/applications/video/kodi/addons/visualization-goom/default.nix
@ -0,0 +1,25 @@
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL }:
+
+buildKodiBinaryAddon rec {
+  pname = "visualization-goom";
+  namespace = "visualization.goom";
+  version = "20.1.1";
+
+  src = fetchFromGitHub {
+    owner = "xbmc";
+    repo = namespace;
+    rev = "${version}-${rel}";
+    hash = "sha256-TxXqJQdPT1+3DwAJv0F2Hfksh+ZV4QjfOnp4/k53GpQ=";
+  };
+
+  extraBuildInputs = [ pkg-config libGL ];
+
+  propagatedBuildInputs = [ glm ];
+  meta = with lib; {
+    homepage = "https://github.com/xbmc/visualization.goom";
+    description = "Goom visualization for kodi";
+    platforms = platforms.all;
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/applications/video/kodi/addons/visualization-matrix/default.nix
+++ b/pkgs/applications/video/kodi/addons/visualization-matrix/default.nix
@ -0,0 +1,25 @@
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL }:
+
+buildKodiBinaryAddon rec {
+  pname = "visualization-matrix";
+  namespace = "visualization.matrix";
+  version = "20.2.0";
+
+  src = fetchFromGitHub {
+    owner = "xbmc";
+    repo = namespace;
+    rev = "${version}-${rel}";
+    hash = "sha256-tojzPqt6VMccveqnhkl0yXS+/fLdxotmQO3jdtYlkFk=";
+  };
+
+  extraBuildInputs = [ pkg-config libGL ];
+
+  propagatedBuildInputs = [ glm ];
+  meta = with lib; {
+    homepage = "https://github.com/xbmc/visualization.matrix";
+    description = "Matrix visualization for kodi";
+    platforms = platforms.all;
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/applications/video/kodi/addons/visualization-pictureit/default.nix
+++ b/pkgs/applications/video/kodi/addons/visualization-pictureit/default.nix
@ -0,0 +1,25 @@
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL }:
+
+buildKodiBinaryAddon rec {
+  pname = "visualization-pictureit";
+  namespace = "visualization.pictureit";
+  version = "20.2.0";
+
+  src = fetchFromGitHub {
+    owner = "xbmc";
+    repo = namespace;
+    rev = "${version}-${rel}";
+    hash = "sha256-mQDPjpsxStU01H2XJKnX183KAHG+O1CH8JOmApMmwMc=";
+  };
+
+  extraBuildInputs = [ pkg-config libGL ];
+
+  propagatedBuildInputs = [ glm ];
+  meta = with lib; {
+    homepage = "https://github.com/xbmc/visualization.pictureit";
+    description = "PictureIt visualization for kodi";
+    platforms = platforms.all;
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix
+++ b/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix
@ -0,0 +1,25 @@
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL, projectm }:
+
+buildKodiBinaryAddon rec {
+  pname = "visualization-projectm";
+  namespace = "visualization.projectm";
+  version = "20.2.0";
+
+  src = fetchFromGitHub {
+    owner = "xbmc";
+    repo = namespace;
+    rev = "${version}-${rel}";
+    hash = "sha256-Kcl1ep+RJlofFmxkrGT3T+XXdwiCofq1hggwU0PAd0E=";
+  };
+
+  extraBuildInputs = [ pkg-config libGL projectm ];
+
+  propagatedBuildInputs = [ glm ];
+  meta = with lib; {
+    homepage = "https://github.com/xbmc/visualization.projectm";
+    description = "Projectm visualization for kodi";
+    platforms = platforms.all;
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/applications/video/kodi/addons/visualization-shadertoy/default.nix
+++ b/pkgs/applications/video/kodi/addons/visualization-shadertoy/default.nix
@ -0,0 +1,25 @@
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL, jsoncpp }:
+
+buildKodiBinaryAddon rec {
+  pname = "visualization-shadertoy";
+  namespace = "visualization.shadertoy";
+  version = "20.3.0";
+
+  src = fetchFromGitHub {
+    owner = "xbmc";
+    repo = namespace;
+    rev = "${version}-${rel}";
+    hash = "sha256-PaHbEcB4gCC8gUzc7T49msI8f0xa2iXqSaYW/eqD8yw=";
+  };
+
+  extraBuildInputs = [ pkg-config libGL jsoncpp ];
+
+  propagatedBuildInputs = [ glm ];
+  meta = with lib; {
+    homepage = "https://github.com/xbmc/visualization.shadertoy";
+    description = "Shadertoy visualization for kodi";
+    platforms = platforms.all;
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/applications/video/kodi/addons/visualization-spectrum/default.nix
+++ b/pkgs/applications/video/kodi/addons/visualization-spectrum/default.nix
@ -0,0 +1,25 @@
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL }:
+
+buildKodiBinaryAddon rec {
+  pname = "visualization-spectrum";
+  namespace = "visualization.spectrum";
+  version = "20.2.0";
+
+  src = fetchFromGitHub {
+    owner = "xbmc";
+    repo = namespace;
+    rev = "${version}-${rel}";
+    hash = "sha256-rl6eydHv0g646H7478UQboVp/OrKExQYJOiaVDeDRhE=";
+  };
+
+  extraBuildInputs = [ pkg-config libGL ];
+
+  propagatedBuildInputs = [ glm ];
+  meta = with lib; {
+    homepage = "https://github.com/xbmc/visualization.spectrum";
+    description = "Spectrum visualization for kodi";
+    platforms = platforms.all;
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/applications/video/kodi/addons/visualization-starburst/default.nix
+++ b/pkgs/applications/video/kodi/addons/visualization-starburst/default.nix
@ -0,0 +1,25 @@
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL }:
+
+buildKodiBinaryAddon rec {
+  pname = "visualization-starburst";
+  namespace = "visualization.starburst";
+  version = "20.2.0";
+
+  src = fetchFromGitHub {
+    owner = "xbmc";
+    repo = namespace;
+    rev = "${version}-${rel}";
+    hash = "sha256-FTGyQqzRywKjywtckkP56Fc8KwF07A8WUAe0LackxSM=";
+  };
+
+  extraBuildInputs = [ pkg-config libGL ];
+
+  propagatedBuildInputs = [ glm ];
+  meta = with lib; {
+    homepage = "https://github.com/xbmc/visualization.starburst";
+    description = "Starburst visualization for kodi";
+    platforms = platforms.all;
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;

 buildNpmPackage rec {
  pname = if set != null then "iosevka-${set}" else "iosevka";
-  version = "22.1.0";
+  version = "23.0.0";

  src = fetchFromGitHub {
    owner = "be5invis";
    repo = "iosevka";
    rev = "v${version}";
-    hash = "sha256-aq8IKWGOOYf83ed5Z10/B+42SsI7JY5ED3AwAlk/24k=";
+    hash = "sha256-j7JE9UHG4xho0a4TqG5rpCJkYyVxgoLxBuRtNMGfkrw=";
  };

-  npmDepsHash = "sha256-6zt7q5aGb6jaa6YBr4HqawZjf2jqNnR9xQM/abKpT04=";
+  npmDepsHash = "sha256-/zutJ4kwGqBe3snMxyvReJdvlcsm+02ZZyFMdNN6gmc=";

  nativeBuildInputs = [
    remarshal
--- a/pkgs/data/themes/catppuccin-plymouth/default.nix
+++ b/pkgs/data/themes/catppuccin-plymouth/default.nix
@ -0,0 +1,43 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+, variant ? "macchiato"
+}:
+
+let
+  pname = "catppuccin-plymouth";
+  validVariants = [ "latte" "frappe" "macchiato" "mocha" ];
+in
+lib.checkListOfEnum "${pname}: color variant" validVariants [ variant ]
+
+stdenvNoCC.mkDerivation rec {
+  inherit pname;
+  version = "unstable-2022-12-10";
+
+  src = fetchFromGitHub {
+    owner = "catppuccin";
+    repo = "plymouth";
+    rev = "d4105cf336599653783c34c4a2d6ca8c93f9281c";
+    hash = "sha256-quBSH8hx3gD7y1JNWAKQdTk3CmO4t1kVo4cOGbeWlNE=";
+  };
+
+  sourceRoot = "source/themes/catppuccin-${variant}";
+
+  installPhase = ''
+    runHook preInstall
+
+    sed -i 's:\(^ImageDir=\)/usr:\1'"$out"':' catppuccin-${variant}.plymouth
+    mkdir -p $out/share/plymouth/themes/catppuccin-${variant}
+    cp * $out/share/plymouth/themes/catppuccin-${variant}
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Soothing pastel theme for Plymouth";
+    homepage = "https://github.com/catppuccin/plymouth";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.spectre256 ];
+  };
+}
--- a/pkgs/desktops/gnome/extensions/paperwm/default.nix
+++ b/pkgs/desktops/gnome/extensions/paperwm/default.nix
@ -3,15 +3,15 @@
 , fetchFromGitHub
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-shell-extension-paperwm";
-  version = "unstable-2023-04-20";
+  version = "44.0.0-beta.1";

  src = fetchFromGitHub {
    owner = "paperwm";
    repo = "PaperWM";
-    rev = "1130b663806d6daba1c8355c4b99c287d237e918";
-    hash = "sha256-JlamW5DznVZ8G0REqXcxEt/IlHa3GMN184WFpeclhd4=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-YRIaSD22bvzXo/wla178GeXIhvIwW6xLacjAQDC2P40=";
  };

  dontConfigure = true;
@ -19,18 +19,21 @@ stdenv.mkDerivation {

  installPhase = ''
    runHook preInstall
+
    mkdir -p "$out/share/gnome-shell/extensions/paperwm@hedning:matrix.org"
    cp -r . "$out/share/gnome-shell/extensions/paperwm@hedning:matrix.org"
+
    runHook postInstall
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/paperwm/PaperWM";
    description = "Tiled scrollable window management for Gnome Shell";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ hedning AndersonTorres ];
-    platforms = platforms.all;
+    changelog = "https://github.com/paperwm/PaperWM/releases/tag/${finalAttrs.src.rev}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ hedning AndersonTorres ];
+    platforms = lib.platforms.all;
  };

  passthru.extensionUuid = "paperwm@hedning:matrix.org";
-}
+})
--- a/pkgs/development/compilers/chicken/5/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/5/eggDerivation.nix
@ -22,25 +22,30 @@ in

  CSC_OPTIONS = lib.concatStringsSep " " cscOptions;

+  buildPhase = ''
+    runHook preBuild
+    chicken-install -cached -no-install ${lib.escapeShellArgs chickenInstallFlags}
+    runHook postBuild
+  '';
+
  installPhase = ''
    runHook preInstall

    export CHICKEN_INSTALL_PREFIX=$out
    export CHICKEN_INSTALL_REPOSITORY=$out/lib/chicken/${toString chicken.binaryVersion}
-    chicken-install -cached ${lib.concatStringsSep " " chickenInstallFlags}
+    chicken-install -cached ${lib.escapeShellArgs chickenInstallFlags}

    for f in $out/bin/*
    do
      wrapProgram $f \
-        --prefix CHICKEN_REPOSITORY_PATH : "$out/lib/chicken/${toString chicken.binaryVersion}" \
-        --suffix CHICKEN_INCLUDE_PATH : "$out/share" \
+        --prefix CHICKEN_REPOSITORY_PATH : "$out/lib/chicken/${toString chicken.binaryVersion}:$CHICKEN_REPOSITORY_PATH" \
+        --prefix CHICKEN_INCLUDE_PATH : "$CHICKEN_INCLUDE_PATH:$out/share" \
        --prefix PATH : "$out/bin:${chicken}/bin:$CHICKEN_REPOSITORY_PATH"
    done

    runHook postInstall
  '';

-  dontBuild = true;
  dontConfigure = true;

  meta = {
--- a/pkgs/development/compilers/chicken/5/overrides.nix
+++ b/pkgs/development/compilers/chicken/5/overrides.nix
@ -1,5 +1,6 @@
 { stdenv, pkgs, lib, chickenEggs }:
 let
+  inherit (lib) addMetaAttrs;
  addToBuildInputs = pkg: old: {
    buildInputs = (old.buildInputs or [ ]) ++ lib.toList pkg;
  };
@ -14,8 +15,8 @@ let
    (addPkgConfig old) // (addToBuildInputs pkg old);
  addToPropagatedBuildInputsWithPkgConfig = pkg: old:
    (addPkgConfig old) // (addToPropagatedBuildInputs pkg old);
-  broken = old: { meta = old.meta // { broken = true; }; };
-  brokenOnDarwin = old: { meta = old.meta // { broken = stdenv.isDarwin; }; };
+  broken = addMetaAttrs { broken = true; };
+  brokenOnDarwin = addMetaAttrs { broken = stdenv.isDarwin; };
 in {
  allegro = addToBuildInputsWithPkgConfig ([ pkgs.allegro5 pkgs.libglvnd ]
    ++ lib.optionals stdenv.isDarwin [ pkgs.darwin.apple_sdk.frameworks.OpenGL ]);
@ -85,8 +86,8 @@ in {
  zstd = addToBuildInputs pkgs.zstd;

  # platform changes
-  pledge = old: { meta = old.meta // { platforms = lib.platforms.openbsd; }; };
-  unveil = old: { meta = old.meta // { platforms = lib.platforms.openbsd; }; };
+  pledge = addMetaAttrs { platforms = lib.platforms.openbsd; };
+  unveil = addMetaAttrs { platforms = lib.platforms.openbsd; };

  # mark broken
  "ephem-v1.1" = broken;
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@ -1,10 +1,10 @@
-{ pkgs, lib, makeWrapper }:
+{ pkgs
+, lib
+, makeWrapper
+, nodejs ? pkgs.nodejs_18
+}:

 let
-
-  # To control nodejs version we pass down
-  nodejs = pkgs.nodejs_18;
-
  fetchElmDeps = pkgs.callPackage ./fetchElmDeps.nix { };

  # Haskell packages that require ghc 8.10
@ -115,8 +115,7 @@ let
  };

  nodePkgs = pkgs.callPackage ./packages/node-composition.nix {
-    inherit pkgs;
-    nodejs = pkgs.nodejs_14;
+    inherit pkgs nodejs;
    inherit (pkgs.stdenv.hostPlatform) system;
  };

@ -152,7 +151,8 @@ in lib.makeScope pkgs.newScope (self: with self; {
    };
  };
 } // (hs810Pkgs self).elmPkgs // (hs92Pkgs self).elmPkgs // (with elmLib; with (hs810Pkgs self).elmPkgs; {
-  elm-verify-examples = patchBinwrap [elmi-to-json] nodePkgs.elm-verify-examples // {
+  elm-verify-examples = let
+    patched = patchBinwrap [elmi-to-json] nodePkgs.elm-verify-examples // {
    meta = with lib; nodePkgs.elm-verify-examples.meta // {
      description = "Verify examples in your docs";
      homepage = "https://github.com/stoeffel/elm-verify-examples";
@ -160,6 +160,14 @@ in lib.makeScope pkgs.newScope (self: with self; {
      maintainers = [ maintainers.turbomack ];
    };
  };
+  in patched.override (old: {
+    preRebuild = (old.preRebuild or "") + ''
+      # This should not be needed (thanks to binwrap* being nooped) but for some reason it still needs to be done
+      # in case of just this package
+      # TODO: investigate, same as for elm-coverage below
+      sed 's/\"install\".*/\"install\":\"echo no-op\",/g' --in-place node_modules/elmi-to-json/package.json
+    '';
+  });

  elm-coverage = let
      patched = patchNpmElm (patchBinwrap [elmi-to-json] nodePkgs.elm-coverage);
--- a/pkgs/development/libraries/basu/default.nix
+++ b/pkgs/development/libraries/basu/default.nix
@ -0,0 +1,53 @@
+{ lib
+, stdenv
+, fetchFromSourcehut
+, audit
+, pkg-config
+, libcap
+, gperf
+, meson
+, ninja
+, python3
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "basu";
+  version = "0.2.1";
+
+  src = fetchFromSourcehut {
+    owner = "~emersion";
+    repo = "basu";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-zIaEIIo8lJeas2gVjMezO2hr8RnMIT7iiCBilZx5lRQ=";
+  };
+
+  outputs = [ "out" "dev" "lib" ];
+
+  buildInputs = [
+    audit
+    gperf
+    libcap
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+    python3
+  ];
+
+  preConfigure = ''
+    pushd src/basic
+    patchShebangs \
+      generate-cap-list.sh generate-errno-list.sh generate-gperfs.py
+    popd
+  '';
+
+  meta = {
+    homepage = "https://sr.ht/~emersion/basu";
+    description = "The sd-bus library, extracted from systemd";
+    license = lib.licenses.lgpl21Only;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/development/libraries/charls/default.nix
+++ b/pkgs/development/libraries/charls/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "charls";
-  version = "2.4.1";
+  version = "2.4.2";

  src = fetchFromGitHub {
    owner = "team-charls";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-l0qcJeQfRqpwR7vNmYZx00kGlPkK7nEYuslydjxj7ss=";
+    hash = "sha256-c1wrk6JLcAH7TFPwjARlggaKXrAsLWyUQF/3WHlqoqg=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/cxxopts/default.nix
+++ b/pkgs/development/libraries/cxxopts/default.nix
@ -9,18 +9,15 @@

 stdenv.mkDerivation rec {
  pname = "cxxopts";
-  version = "3.0.0";
+  version = "3.1.1";

  src = fetchFromGitHub {
    owner = "jarro2783";
    repo = "cxxopts";
    rev = "v${version}";
-    sha256 = "08x7j168l1xwj0r3rv89cgghmfhsx98lpq35r3vkh504m1pd55a6";
+    sha256 = "sha256-lJPMaXBfrCeUhhXha5f7zmOGtyEDzU3oPTMirPTFZzQ=";
  };

-  # CMake does not set CMAKE_LIBRARY_ARCHITECTURE variable in Nix, which breaks architecture-independent library path generation
-  patches = [ ./fix-install-path.patch ];
-
  buildInputs = lib.optionals enableUnicodeHelp [ icu.dev ];
  cmakeFlags = [ "-DCXXOPTS_BUILD_EXAMPLES=OFF" ]
    ++ lib.optional enableUnicodeHelp "-DCXXOPTS_USE_UNICODE_HELP=TRUE";
--- a/pkgs/development/libraries/cxxopts/fix-install-path.patch
+++ b/pkgs/development/libraries/cxxopts/fix-install-path.patch
@ -1,18 +0,0 @@
-diff --git a/cmake/cxxopts.cmake b/cmake/cxxopts.cmake
-index 46e87ba..0ead543 100644
--- a/cmake/cxxopts.cmake
-+++ b/cmake/cxxopts.cmake
-@@ -87,7 +87,12 @@ endfunction()
- 
- # Helper function to ecapsulate install logic
- function(cxxopts_install_logic)
-    string(REPLACE "/${CMAKE_LIBRARY_ARCHITECTURE}" "" CMAKE_INSTALL_LIBDIR_ARCHIND "${CMAKE_INSTALL_LIBDIR}")
-+    if(CMAKE_LIBRARY_ARCHITECTURE)
-+        string(REPLACE "/${CMAKE_LIBRARY_ARCHITECTURE}" "" CMAKE_INSTALL_LIBDIR_ARCHIND "${CMAKE_INSTALL_LIBDIR}")
-+    else()
-+        # On some systems (e.g. NixOS), `CMAKE_LIBRARY_ARCHITECTURE` can be empty
-+        set(CMAKE_INSTALL_LIBDIR_ARCHIND "${CMAKE_INSTALL_LIBDIR}")
-+    endif()
-     set(CXXOPTS_CMAKE_DIR "${CMAKE_INSTALL_LIBDIR_ARCHIND}/cmake/cxxopts" CACHE STRING "Installation directory for cmake files, relative to ${CMAKE_INSTALL_PREFIX}.")
-     set(version_config "${PROJECT_BINARY_DIR}/cxxopts-config-version.cmake")
-     set(project_config "${PROJECT_BINARY_DIR}/cxxopts-config.cmake")
--- a/pkgs/development/python-modules/archspec/default.nix
+++ b/pkgs/development/python-modules/archspec/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "archspec";
-  version = "0.2.0";
+  version = "0.2.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    repo = pname;
    rev = "refs/tags/v${version}";
    fetchSubmodules = true;
-    hash = "sha256-Zu7/zx3FTVJVGpAdRDdnLBokeodspZg6ou/GBaqz4XY=";
+    hash = "sha256-2rMsxSAnPIVqvsbAUtBbHLb3AvrZFjGzxYO6A/1qXnY=";
  };

  nativeBuildInputs = [
@ -43,7 +43,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Library for detecting, labeling, and reasoning about microarchitectures";
    homepage = "https://archspec.readthedocs.io/";
-    changelog = "https://github.com/archspec/archspec/releases/tag/v0.2.0";
+    changelog = "https://github.com/archspec/archspec/releases/tag/v0.2.1";
    license = with licenses; [ mit asl20 ];
    maintainers = with maintainers; [ atila ];
  };
--- a/pkgs/development/python-modules/boiboite-opener-framework/default.nix
+++ b/pkgs/development/python-modules/boiboite-opener-framework/default.nix
@ -0,0 +1,79 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, packaging
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+, scapy
+}:
+
+buildPythonPackage rec {
+  pname = "boiboite-opener-framework";
+  version = "1.2.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "Orange-Cyberdefense";
+    repo = "bof";
+    rev = "refs/tags/${version}";
+    hash = "sha256-atKqHRX24UjF/9Dy0aYXAN+80nBJKCd07FmaR5Vl1q4=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "scapy==2.5.0rc1" "scapy"
+  '';
+
+  propagatedBuildInputs = [
+    packaging
+    scapy
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "bof"
+  ];
+
+  disabledTests = [
+    # Tests are using netcat and cat to do UDP connections
+    "test_0101_knxnet_instantiate"
+    "test_0101_modbusnet_instantiate"
+    "test_0102_knxnet_connect"
+    "test_0102_modbusnet_connect"
+    "test_0201_knxnet_send_knxpacket"
+    "test_0201_modbus_send_modbuspacket"
+    "test_0201_udp_send_str_bytes"
+    "test_0202_knxnet_send_knxpacket"
+    "test_0202_modbus_send_modbuspacket"
+    "test_0202_udp_send_receive"
+    "test_0203_knxnet_send_raw"
+    "test_0203_modbus_send_raw"
+    "test_0203_send_receive_timeout"
+    "test_0204_knxnet_receive"
+    "test_0204_modbus_receive"
+    "test_0204_multicast_error_handling"
+    "test_0205_broadcast_error_handling"
+    "test_0301_pndcp_device_raise"
+    "test_0301_tcp_instantiate"
+    "test_0302_tcp_connect"
+    "test_0303_tcp_connect_bad_addr"
+    "test_0304_tcp_connect_bad_port"
+    "test_0401_tcp_send_str_bytes"
+    "test_0402_tcp_send_receive"
+    "test_0802_search_valid"
+  ];
+
+  meta = with lib; {
+    description = "Testing framework for industrial protocols implementations and devices";
+    homepage = "https://github.com/Orange-Cyberdefense/bof";
+    changelog = "https://github.com/Orange-Cyberdefense/bof/releases/tag/${version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/bqplot/default.nix
+++ b/pkgs/development/python-modules/bqplot/default.nix
@ -0,0 +1,53 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, jupyter-packaging
+, bqscales
+, ipywidgets
+, numpy
+, pandas
+, traitlets
+, traittypes
+}:
+
+buildPythonPackage rec {
+  pname = "bqplot";
+  version = "0.12.36";
+
+  format = "pyproject";
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-alU+Vf28xPYuBWeb10slSdHvvkPhIK07C8sDplx5Ia8=";
+  };
+
+  nativeBuildInputs = [
+    jupyter-packaging
+  ];
+
+  propagatedBuildInputs = [
+    bqscales
+    ipywidgets
+    numpy
+    pandas
+    traitlets
+    traittypes
+  ];
+
+  # no tests in PyPI dist, and not obvious to me how to build the js files from GitHub
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "bqplot"
+    "bqplot.pyplot"
+  ];
+
+  meta = {
+    description = "2D plotting library for Jupyter based on Grammar of Graphics";
+    homepage = "https://bqplot.github.io/bqplot";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bcdarwin ];
+  };
+}
--- a/pkgs/development/python-modules/bqscales/default.nix
+++ b/pkgs/development/python-modules/bqscales/default.nix
@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, hatchling
+, jupyter-packaging
+, ipywidgets
+, numpy
+, traitlets
+, traittypes
+}:
+
+buildPythonPackage rec {
+  pname = "bqscales";
+  version = "0.3.1";
+
+  format = "pyproject";
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-C+/GLpqYpePngbn5W0MwvpdmVgFZF7aGHyKMgO5XM90=";
+  };
+
+  nativeBuildInputs = [
+    hatchling
+    jupyter-packaging
+  ];
+
+  propagatedBuildInputs = [
+    ipywidgets
+    numpy
+    traitlets
+    traittypes
+  ];
+
+  # no tests in PyPI dist
+  doCheck = false;
+
+  pythonImportsCheck = [ "bqscales" ];
+
+  meta = {
+    description = "Grammar of Graphics scales for bqplot and other Jupyter widgets libraries";
+    homepage = "https://github.com/bqplot/bqscales";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bcdarwin ];
+  };
+}
--- a/pkgs/development/python-modules/chiapos/default.nix
+++ b/pkgs/development/python-modules/chiapos/default.nix
@ -43,6 +43,11 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+  # A fix for cxxopts >=3.1
+  postPatch = ''
+    substituteInPlace src/cli.cpp \
+      --replace "cxxopts::OptionException" "cxxopts::exceptions::exception"
+  '';

  # CMake needs to be run by setuptools rather than by its hook
  dontConfigure = true;
--- a/pkgs/development/python-modules/dsnap/default.nix
+++ b/pkgs/development/python-modules/dsnap/default.nix
@ -0,0 +1,69 @@
+{ lib
+, aws-sam-cli
+, boto3
+, buildPythonPackage
+, cfn-lint
+, fetchFromGitHub
+, mock
+, moto
+, mypy-boto3-ebs
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, typer
+, urllib3
+}:
+
+buildPythonPackage rec {
+  pname = "dsnap";
+  version = "1.0.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "RhinoSecurityLabs";
+    repo = "dsnap";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-yKch+tKjFhvZfzloazMH378dkERF8gnZEX1Som+d670=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    boto3
+    urllib3
+  ];
+
+  passthru.optional-dependencies = {
+    cli = [
+      typer
+    ];
+    scannerd = [
+      aws-sam-cli
+      cfn-lint
+    ];
+  };
+
+  nativeCheckInputs = [
+    mock
+    moto
+    mypy-boto3-ebs
+    pytestCheckHook
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+
+  pythonImportsCheck = [
+    "dsnap"
+  ];
+
+  meta = with lib; {
+    description = "Utility for downloading and mounting EBS snapshots using the EBS Direct API's";
+    homepage = "https://github.com/RhinoSecurityLabs/dsnap";
+    changelog = "https://github.com/RhinoSecurityLabs/dsnap/releases/tag/v${version}";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fab ];
+  };
+}
+
--- a/pkgs/development/python-modules/energyzero/default.nix
+++ b/pkgs/development/python-modules/energyzero/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "energyzero";
-  version = "0.4.1";
+  version = "0.4.2";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "klaasnicolaas";
    repo = "python-energyzero";
    rev = "refs/tags/v${version}";
-    hash = "sha256-qBtsNqmGLCUGTYJ8iPL/Ie3yGX7Ocs4e+yp0tRAhK8g=";
+    hash = "sha256-sqkpbvsMd/8y6QSrMZHJeHl9GTes8TUoZ7RKePJsREs=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/gitignore-parser/default.nix
+++ b/pkgs/development/python-modules/gitignore-parser/default.nix
@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, unittestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "gitignore-parser";
+  version = "0.1.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "mherrmann";
+    repo = "gitignore_parser";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-F1ZQQ33naOO7KNuSdlo0JN8i50lLty+eGSJAzVJL730=";
+  };
+
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "gitignore_parser"
+  ];
+
+  meta = with lib; {
+    description = "A spec-compliant gitignore parser";
+    homepage = "https://github.com/mherrmann/gitignore_parser";
+    changelog = "https://github.com/mherrmann/gitignore_parser/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/google-cloud-bigtable/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-bigtable";
-  version = "2.17.0";
+  version = "2.18.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-wysLs0seCRDadYj9aRowebq6+kMi7RZp/DITC4lqsVY=";
+    hash = "sha256-Qdb3AnwHS2nho3ld0oehVkORAy+F3xzEqHuSJQb18OI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/ipyxact/default.nix
+++ b/pkgs/development/python-modules/ipyxact/default.nix
@ -0,0 +1,31 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, pyyaml
+, six
+, lxml
+}:
+
+buildPythonPackage rec {
+  pname = "ipyxact";
+  version = "0.3.2";
+
+  propagatedBuildInputs = [ pyyaml ];
+  checkInputs = [ six lxml ];
+
+  src = fetchFromGitHub {
+    owner = "olofk";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-myD+NnqcxxaSAV7qZa8xqeciaiFqFePqIzd7sb/2GXA=";
+  };
+
+  pythonImportsCheck = [ "ipyxact" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/olofk/ipyxact";
+    description = "IP-XACT parser";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/mypy-boto3-ebs/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-ebs/default.nix
@ -0,0 +1,39 @@
+{ lib
+, boto3
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "mypy-boto3-ebs";
+  version = "1.26.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-w15SM5F1IFtX4qDrMv5B7PItaTnXOOABg0aUU24onBk=";
+  };
+
+  propagatedBuildInputs = [
+    boto3
+    typing-extensions
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "mypy_boto3_ebs"
+  ];
+
+  meta = with lib; {
+    description = "Type annotations for boto3.s3";
+    homepage = "https://github.com/youtype/mypy_boto3_builder";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/okonomiyaki/default.nix
+++ b/pkgs/development/python-modules/okonomiyaki/default.nix
@ -0,0 +1,47 @@
+{ buildPythonPackage
+, stdenv
+, fetchFromGitHub
+, lib
+, attrs
+, distro
+, jsonschema
+, six
+, zipfile2
+, hypothesis
+, mock
+, packaging
+, testfixtures
+}:
+
+buildPythonPackage rec {
+  pname = "okonomiyaki";
+  version = "1.3.2";
+
+  src = fetchFromGitHub {
+    owner = "enthought";
+    repo = pname;
+    rev = version;
+    hash = "sha256-eWCOuGtdjBGThAyu15aerclkSWC593VGDPHJ98l30iY=";
+  };
+
+  propagatedBuildInputs = [ distro attrs jsonschema six zipfile2 ];
+
+  preCheck = ''
+    substituteInPlace okonomiyaki/runtimes/tests/test_runtime.py \
+      --replace 'runtime_info = PythonRuntime.from_running_python()' 'raise unittest.SkipTest() #'
+   '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace okonomiyaki/platforms/tests/test_pep425.py \
+      --replace 'self.assertEqual(platform_tag, self.tag.platform)' 'raise unittest.SkipTest()'
+  '';
+
+  checkInputs = [ hypothesis mock packaging testfixtures ];
+
+  pythonImportsCheck = [ "okonomiyaki" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/enthought/okonomiyaki";
+    description = "An experimental library aimed at consolidating a lot of low-level code used for Enthought's eggs";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.bsd3;
+  };
+}
--- a/pkgs/development/python-modules/pwntools/default.nix
+++ b/pkgs/development/python-modules/pwntools/default.nix
@ -28,20 +28,15 @@ let
  debuggerName = lib.strings.getName debugger;
 in
 buildPythonPackage rec {
-  version = "4.9.0";
  pname = "pwntools";
+  version = "4.10.0";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-7qZ9GC+RcEiDkpmNmy8d67dYiTgFBVAfB3B2RfrH5xI=";
+    hash = "sha256-WI6J6meFJ8C1tsru7n524xNS544vHPPdp7yaz1JuRG0=";
  };

  postPatch = ''
-    # Upstream has set an upper bound on unicorn because of https://github.com/Gallopsled/pwntools/issues/1538,
-    # but since that is a niche use case and it requires extra work to get unicorn 1.0.2rc3 to work we relax
-    # the bound here. Check if this is still necessary when updating!
-    sed -i 's/unicorn>=1.0.2rc1,<1.0.2rc4/unicorn>=1.0.2rc1/' setup.py
-
    # Upstream hardcoded the check for the command `gdb-multiarch`;
    # Forcefully use the provided debugger, as `gdb` (hence `pwndbg`) is built with multiarch in `nixpkgs`.
    sed -i 's/gdb-multiarch/${debuggerName}/' pwnlib/gdb.py
@ -84,8 +79,9 @@ buildPythonPackage rec {
  '';

  meta = with lib; {
-    homepage = "https://pwntools.com";
    description = "CTF framework and exploit development library";
+    homepage = "https://pwntools.com";
+    changelog = "https://github.com/Gallopsled/pwntools/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ bennofs kristoff3r pamplemousse ];
  };
--- a/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
+++ b/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "pytelegrambotapi";
-  version = "4.11.0";
+  version = "4.12.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "eternnoir";
    repo = "pyTelegramBotAPI";
    rev = "refs/tags/${version}";
-    hash = "sha256-K81B8cNQ5Vvu8nH8kiroeffwRaUIKpwnpX2Jq7xPjB0=";
+    hash = "sha256-cW9IQy4D2iaoQ6oHQ07f27YQR7q9DBv2JkoukUtPBRQ=";
  };

  passthru.optional-dependencies = {
--- a/pkgs/development/python-modules/pyglet/default.nix
+++ b/pkgs/development/python-modules/pyglet/default.nix
@ -18,13 +18,13 @@
 }:

 buildPythonPackage rec {
-  version = "2.0.6";
+  version = "2.0.7";
  pname = "pyglet";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-b5PyvebfgYCH4bXZEDMIbLL7aJwSILYyxG0fxKZoWgA=";
+    hash = "sha256-koL5SXwcDNyyzDnYwFCQz2ht7bnrvvSo3kmvIqCuDo8=";
    extension = "zip";
  };

--- a/pkgs/development/python-modules/python-libnmap/default.nix
+++ b/pkgs/development/python-modules/python-libnmap/default.nix
@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, defusedxml
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "python-libnmap";
+  version = "0.7.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "savon-noir";
+    repo = "python-libnmap";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-cI8wdOvTmRy2cxLBkJn7vXRBRvewDMNl/tkIiRGhZJ8=";
+  };
+
+  passthru.optional-dependencies = {
+    defusedxml = [
+      defusedxml
+    ];
+  };
+
+  # We don't want the nmap binary being present
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "libnmap"
+  ];
+
+  meta = with lib; {
+    description = "Library to run nmap scans, parse and diff scan results";
+    homepage = "https://github.com/savon-noir/python-libnmap";
+    changelog = "https://github.com/savon-noir/python-libnmap/blob/${version}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/python-mystrom/default.nix
+++ b/pkgs/development/python-modules/python-mystrom/default.nix
@ -9,11 +9,11 @@

 buildPythonPackage rec {
  pname = "python-mystrom";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Kqv5rUdwkynOzssID77gVYyzs0CDR/bUWh6zpt5zOP8=";
+    hash = "sha256-VFsTA/isBw0H7qXQhOX6K2p1QcVxO7q5TIzf8YivVgc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/scancode-toolkit/default.nix
+++ b/pkgs/development/python-modules/scancode-toolkit/default.nix
@ -61,13 +61,13 @@

 buildPythonPackage rec {
  pname = "scancode-toolkit";
-  version = "31.2.4";
+  version = "31.2.6";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-08C3T4CoQm/6s8ERbq/m1t513zYuzVJoexlRkCvv3UY=";
+    hash = "sha256-VvhgXZpV58DHeY5+7nPbrbTTVuHkawFw5akbm4hPnBY=";
  };

  dontConfigure = true;
@ -169,7 +169,8 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Tool to scan code for license, copyright, package and their documented dependencies and other interesting facts";
    homepage = "https://github.com/nexB/scancode-toolkit";
+    changelog = "https://github.com/nexB/scancode-toolkit/blob/v${version}/CHANGELOG.rst";
    license = with licenses; [ asl20 cc-by-40 ];
-    maintainers = [ ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/simplesat/default.nix
+++ b/pkgs/development/python-modules/simplesat/default.nix
@ -0,0 +1,48 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, writeText
+, lib
+, attrs
+, six
+, okonomiyaki
+}:
+
+let
+  version = "0.8.2";
+
+  versionFile = writeText "simplesat_ver" ''
+    version = '${version}'
+    full_version = '${version}'
+    git_revision = '0000000000000000000000000000000000000000'
+    is_released = True
+    msi_version = '${version}.000'
+    version_info = (${lib.versions.major version}, ${lib.versions.minor version}, ${lib.versions.patch version}, 'final', 0)
+  '';
+
+in buildPythonPackage rec {
+  pname = "simplesat";
+  inherit version;
+
+  propagatedBuildInputs = [ attrs six okonomiyaki ];
+
+  src = fetchFromGitHub {
+    owner = "enthought";
+    repo = "sat-solver";
+    rev = "v${version}";
+    hash = "sha256-6BQn1W2JGrMmNqgxi+sXx06XzNMcvwqYGMkpD0SSpT8=";
+  };
+
+  preConfigure = ''
+    cp ${versionFile} simplesat/_version.py
+  '';
+  dontUseSetuptoolsCheck = true;
+
+  pythonImportsCheck = [ "simplesat" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/enthought/sat-solver";
+    description = "Prototype for SAT-based dependency handling";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.bsd3;
+  };
+}
--- a/pkgs/development/python-modules/single-source/default.nix
+++ b/pkgs/development/python-modules/single-source/default.nix
@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, importlib-metadata
+, poetry-core
+, pytest-mock
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "single-source";
+  version = "0.3.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "rabbit72";
+    repo = "single-source";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-bhfMRIeJUd5JhN2tPww7fdbmHQ7ypcsZrYSa55v0+W8=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    importlib-metadata
+  ];
+
+  nativeCheckInputs = [
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "single_source"
+  ];
+
+  meta = with lib; {
+    description = "Access to the project version in Python code for PEP 621-style projects";
+    homepage = "https://github.com/rabbit72/single-source";
+    changelog = "https://github.com/rabbit72/single-source/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+}
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "xiaomi-ble";
-  version = "0.17.0";
+  version = "0.17.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-sXmwLXbFNckw9lCZ4V5hyZyDnStTp2x4InmoBz3c++w=";
+    hash = "sha256-CioXmv5VJBiJx97k69Sp5kaeD59p+OSL14RVse/gYUA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/zipfile2/default.nix
+++ b/pkgs/development/python-modules/zipfile2/default.nix
@ -0,0 +1,27 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+}:
+
+buildPythonPackage rec {
+  pname = "zipfile2";
+  version = "0.0.12";
+
+  src = fetchFromGitHub {
+    owner = "cournape";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-BwcEgW4XrQqz0Jmtbyxf8q0mWTJXv2dL3Tk7N/IYuMI=";
+  };
+
+  patches = [ ./no-setuid.patch ];
+
+  pythonImportsCheck = [ "zipfile2" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/cournape/zipfile2";
+    description = "A backwards-compatible improved zipfile class";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.psfl;
+  };
+}
--- a/pkgs/development/python-modules/zipfile2/no-setuid.patch
+++ b/pkgs/development/python-modules/zipfile2/no-setuid.patch
@ -0,0 +1,15 @@
+diff --git a/zipfile2/tests/test__zipfile.py b/zipfile2/tests/test__zipfile.py
+index 60f2ed2..db6e5bc 100644
+--- a/zipfile2/tests/test__zipfile.py
+++ b/zipfile2/tests/test__zipfile.py
+@@ -585,8 +585,8 @@ class TestsPermissionExtraction(unittest.TestCase):
+                         if index & 1 << order:
+                             mode |= permissions[permgroup][order]
+                     for order in range(3):
+-                        if specialindex & 1 << order:
+-                            mode |= permissions['special'][order]
+                        if specialindex & 1 << order and order == 0:
+                            raise unittest.SkipTest("The nix build process doesn't allow you to use the setuid bit")
+                     os.chmod(path, mode)
+                     real_permission = os.stat(path).st_mode & 0xFFF
+                     self.files.append((path, real_permission))
--- a/pkgs/development/tools/argc/default.nix
+++ b/pkgs/development/tools/argc/default.nix
@ -1,20 +1,30 @@
-{ lib, rustPlatform, fetchFromGitHub, installShellFiles }:
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, installShellFiles
+, rust
+, stdenv
+}:

 rustPlatform.buildRustPackage rec {
  pname = "argc";
-  version = "1.0.0";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "sigoden";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-lZtAhsEfMzj8Irl7LQPzjBNiKKy8091p2XoB5wSPhKM=";
+    hash = "sha256-db75OoFmsR03lK99vGg8+fHJENOyoDFo+uqQJNYmI9M=";
  };

-  cargoHash = "sha256-L0FX4RuJ5n76CCWVpGQryX7usXGBN55W9+y83s9JJug=";
+  cargoHash = "sha256-6TC4RWDcg4el+jkq8Jal0k+2sdNsjMkMYqP/b9wP5mU=";

  nativeBuildInputs = [ installShellFiles ];

+  preCheck = ''
+    export PATH=target/${rust.toRustTarget stdenv.hostPlatform}/release:$PATH
+  '';
+
  postInstall = ''
    installShellCompletion --cmd argc \
      --bash <($out/bin/argc --argc-completions bash) \
@ -23,7 +33,7 @@ rustPlatform.buildRustPackage rec {
  '';

  meta = with lib; {
-    description = "A tool to handle sh/bash cli parameters";
+    description = "A command-line options, arguments and sub-commands parser for bash";
    homepage = "https://github.com/sigoden/argc";
    changelog = "https://github.com/sigoden/argc/releases/tag/v${version}";
    license = with licenses; [ mit /* or */ asl20 ];
--- a/pkgs/development/tools/bearer/default.nix
+++ b/pkgs/development/tools/bearer/default.nix
@ -0,0 +1,37 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "bearer";
+  version = "1.7.0";
+
+  src = fetchFromGitHub {
+    owner = "bearer";
+    repo = "bearer";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ecLJvV2gUY6uUeCUsVtDSVOQnZnsThGtguWWzb4vsoE=";
+  };
+
+  vendorHash = "sha256-EHj7tpQoiwu9pocFg5chNpuekxM3bHE2+V2srD4bInQ=";
+
+  subPackages = [
+    "cmd/bearer"
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+#  doCheck = false;
+
+  meta = with lib; {
+    description = "Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks";
+    homepage = "https://github.com/bearer/bearer";
+    changelog = "https://github.com/Bearer/bearer/releases/tag/v${version}";
+    license = with licenses; [ elastic ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/tools/database/trino-cli/default.nix
+++ b/pkgs/development/tools/database/trino-cli/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "trino-cli";
-  version = "416";
+  version = "418";

  jarfilename = "${pname}-${version}-executable.jar";

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://maven/io/trino/${pname}/${version}/${jarfilename}";
-    sha256 = "sha256-0jIOGFPlWgF/vaXTff0hiOWDA7ayiMmzo54eUZp4rsU=";
+    sha256 = "sha256-IVLQG+y2Uvph+0WE+BE2beDSCGzfgkOdclESi+szcZM=";
  };

  dontUnpack = true;
--- a/pkgs/development/tools/jbang/default.nix
+++ b/pkgs/development/tools/jbang/default.nix
@ -1,12 +1,12 @@
 { stdenv, lib, fetchzip, jdk, makeWrapper, coreutils, curl }:

 stdenv.mkDerivation rec {
-  version = "0.106.3";
+  version = "0.107.0";
  pname = "jbang";

  src = fetchzip {
    url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-54yXQ3E10dlU/UqHyl3fxzQsawBTgNpIaq6XPmwXmD8=";
+    sha256 = "sha256-ca5/pgp2io4TYA8DtUUJZe/9d1KPgX3DV5pTyTKBe5M=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/tools/protoc-gen-validate/default.nix
+++ b/pkgs/development/tools/protoc-gen-validate/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "protoc-gen-validate";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "bufbuild";
    repo = "protoc-gen-validate";
    rev = "v${version}";
-    sha256 = "sha256-tYdWXioiPF1S5lpAipm3UN9NUjXo1/8nx22q28UQFDY=";
+    sha256 = "sha256-VXGsSlqVScqyScOsYoXcVfXFvH73GFc+4qPRETqbre0=";
  };

  vendorHash = "sha256-OOjVlRHaOLIJVg3r97qZ3lPv8ANYY2HSn7hUJhg3Cfs=";
--- a/pkgs/development/tools/rust/cargo-flamegraph/default.nix
+++ b/pkgs/development/tools/rust/cargo-flamegraph/default.nix
@ -4,16 +4,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-flamegraph";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "flamegraph-rs";
    repo = "flamegraph";
    rev = "v${version}";
-    sha256 = "sha256-LYoyMEALxeUQQI2pBL1u0Q9rrwyy6N6Dg5bNxhJiVrM=";
+    sha256 = "sha256-npPE9dB7yxIfCxq3NGgI1J6OkDI7qfsusY/dD9w3bp4=";
  };

-  cargoSha256 = "sha256-t8+bjTRQMuXTYhgW1NuC3MXsRh2SMeycyyq4x1nb9MU=";
+  cargoSha256 = "sha256-m92PT89uTuJWlGAAL/wopHYv7vXaRd3woEW70S7kVUI=";

  nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
  buildInputs = lib.optionals stdenv.isDarwin [
--- a/pkgs/development/tools/supabase-cli/default.nix
+++ b/pkgs/development/tools/supabase-cli/default.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "supabase-cli";
-  version = "1.55.1";
+  version = "1.62.3";

  src = fetchFromGitHub {
    owner = "supabase";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-bgbQw59AxroHMJJI8YQq38tyv/uvv513ekXzG7MVEP0=";
+    sha256 = "sha256-5MORYOBEyKcSdiZQI+xbi8GVQr8/e2dJCA9AiS1tm8U=";
  };

-  vendorSha256 = "sha256-FYQbMnBtHlW0jdIyVkmbf+b3VETfcwGhGM0yYkNMGH4=";
+  vendorSha256 = "sha256-4ig9tkXNMiZa2HbwRPXlIsTiaYo8Tb3zxXUEfU8mFUA=";

  ldflags = [
    "-s"
--- a/pkgs/development/tools/viceroy/default.nix
+++ b/pkgs/development/tools/viceroy/default.nix
@ -2,18 +2,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "viceroy";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "fastly";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-V4eNHs+g4uumdRTSMMAKFVcJGHUF/WdT0SScyfUPnC8=";
+    hash = "sha256-OWvWi3mIgcWTnRMsnKgYqB9qzICBOmCcWenTfqhaz+k=";
  };

  buildInputs = lib.optional stdenv.isDarwin Security;

-  cargoHash = "sha256-MxsYJPt7/4UmC5qSbGHyhK1pEDC6yKw189pHnP9BaXM=";
+  cargoHash = "sha256-WwhoKHWZSOcocpqPqmSFYzNKxxXtpKpRreaPHqc+/40=";

  cargoTestFlags = [
    "--package viceroy-lib"
--- a/pkgs/servers/headscale/default.nix
+++ b/pkgs/servers/headscale/default.nix
@ -3,6 +3,7 @@
  buildGoModule,
  fetchFromGitHub,
  installShellFiles,
+  nixosTests,
 }:
 buildGoModule rec {
  pname = "headscale";
@ -31,6 +32,8 @@ buildGoModule rec {
      --zsh <($out/bin/headscale completion zsh)
  '';

+  passthru.tests = { inherit (nixosTests) headscale; };
+
  meta = with lib; {
    homepage = "https://github.com/juanfont/headscale";
    description = "An open source, self-hosted implementation of the Tailscale control server";
--- a/pkgs/servers/sql/postgresql/ext/repmgr.nix
+++ b/pkgs/servers/sql/postgresql/ext/repmgr.nix
@ -1,25 +1,29 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib
+, stdenv
+, fetchFromGitHub
 , postgresql
 , openssl
 , zlib
 , readline
 , flex
+, curl
+, json_c
 }:

 stdenv.mkDerivation rec {
  pname = "repmgr";
-  version = "5.3.2";
+  version = "5.4.0";

  src = fetchFromGitHub {
-    owner = "2ndQuadrant";
+    owner = "EnterpriseDB";
    repo = "repmgr";
    rev = "v${version}";
-    sha256 = "sha256-M8FMin9y6nAiPYeT5pUUy0KyZ1dkuH708GshZ6GoXXw=";
+    sha256 = "sha256-QUxLqCZIopvqDncpaA8bxm9MHvO6R6jPrcd8hF8lqQs=";
  };

  nativeBuildInputs = [ flex ];

-  buildInputs = [ postgresql openssl zlib readline ];
+  buildInputs = [ postgresql openssl zlib readline curl json_c ];

  installPhase = ''
    mkdir -p $out/{bin,lib,share/postgresql/extension}
@ -38,3 +42,4 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ zimbatm ];
  };
 }
+
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@ -66,6 +66,12 @@ in
       --run '. ${./set-gdfontpath-from-fontconfig.sh}'
  '';

+  # When cross-compiling, don't build docs and demos.
+  # Inspiration taken from https://sourceforge.net/p/gnuplot/gnuplot-main/merge-requests/10/
+  makeFlags = lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    "-C src"
+  ];
+
  enableParallelBuilding = true;

  meta = with lib; {
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@ -16,16 +16,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "broot";
-  version = "1.21.3";
+  version = "1.22.0";

  src = fetchFromGitHub {
    owner = "Canop";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-YveMIGrcWW52rnTkX9gCUdOaq9+CFS9ByrJv78IeAJA=";
+    hash = "sha256-bgro1YPhV4pDPDekDCc4PhYzgXyAidv50HqBFxSHmPU=";
  };

-  cargoHash = "sha256-WEqa2NQ49QrKf572mChha/0u8+kov6GnArsZtu8Igio=";
+  cargoHash = "sha256-U3nCAvINzzBGllYPmgiyzO0Wr+9JzGzqRYI4kotkBzA=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/tools/misc/clipboard-jh/default.nix
+++ b/pkgs/tools/misc/clipboard-jh/default.nix
@ -4,6 +4,7 @@
 , cmake
 , libffi
 , pkg-config
+, patchelf
 , wayland-protocols
 , wayland
 , xorg
@ -45,6 +46,10 @@ stdenv.mkDerivation rec {
    "-DINSTALL_PREFIX=${placeholder "out"}"
  ];

+  postFixup = lib.optionalString stdenv.isLinux ''
+    patchelf $out/bin/cb --add-rpath $out/lib
+  '';
+
  meta = with lib; {
    description = "Cut, copy, and paste anything, anywhere, all from the terminal";
    homepage = "https://github.com/Slackadays/clipboard";
--- a/pkgs/tools/misc/lemmeknow/default.nix
+++ b/pkgs/tools/misc/lemmeknow/default.nix
@ -2,18 +2,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "lemmeknow";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-rSuHFVUYpL1v5ba0q15mNEuAHzFF9tWxFs3zTJt5zcc=";
+    hash = "sha256-Q82tP4xNWAooFjHeJCFmuULnWlFbgca/9Y2lm8rVXKs=";
  };

-  cargoSha256 = "sha256-x//spFPlmJJAIyI5RgnYlMORi4eCXc8p7iEJQ7Ayptw=";
+  cargoHash = "sha256-slV9RxdFCEx1El7hngWGv+5CqDSQsU2ACF2nWQLOTU0=";

  meta = with lib; {
    description = "A tool to identify anything";
    homepage = "https://github.com/swanandx/lemmeknow";
+    changelog = "https://github.com/swanandx/lemmeknow/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ figsoda Br1ght0ne ];
  };
--- a/pkgs/tools/misc/rmw/default.nix
+++ b/pkgs/tools/misc/rmw/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "rmw";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "theimpossibleastronaut";
    repo = "rmw";
    rev = "v${version}";
-    hash = "sha256-KOYj63j/vCG7I63bgep03HzufOj/p/EHaY8lyRMHCkY=";
+    hash = "sha256-rfJdJHSkusZj/PN74KgV5i36YC0YRZmIfRdvkUNoKEM=";
    fetchSubmodules = true;
  };

--- a/pkgs/tools/misc/tio/default.nix
+++ b/pkgs/tools/misc/tio/default.nix
@ -11,7 +11,11 @@ stdenv.mkDerivation rec {
    hash = "sha256-7mVLfzguQ7eNIFTJMLJyoM+/pveGO88j2JUEOqvnqvk=";
  };

-  nativeBuildInputs = [ meson ninja pkg-config inih bash-completion ];
+  strictDeps = true;
+
+  buildInputs = [ inih ];
+
+  nativeBuildInputs = [ meson ninja pkg-config bash-completion ];

  meta = with lib; {
    description = "Serial console TTY";
--- a/pkgs/tools/misc/woof/default.nix
+++ b/pkgs/tools/misc/woof/default.nix
@ -1,24 +1,22 @@
 { lib, stdenv, fetchFromGitHub, python3 }:

-stdenv.mkDerivation rec {
-  version = "2020-12-17";
+stdenv.mkDerivation {
  pname = "woof";
+  version = "2022-01-13";

  src = fetchFromGitHub {
    owner = "simon-budig";
    repo = "woof";
-    rev = "4aab9bca5b80379522ab0bdc5a07e4d652c375c5";
-    sha256 = "0ypd2fs8isv6bqmlrdl2djgs5lnk91y1c3rn4ar6sfkpsqp9krjn";
+    rev = "f51e9db264118d4cbcd839348c4a6223fda49813";
+    sha256 = "sha256-tk55q2Ew2mZkQtkxjWCuNgt9t+UbjH4llIJ42IruqGY=";
  };

  propagatedBuildInputs = [ python3 ];

-  dontUnpack = true;
-
  installPhase = ''
-    mkdir -p $out/bin
-    cp $src/woof $out/bin/woof
-    chmod +x $out/bin/woof
+    runHook preInstall
+    install -Dm555 -t $out/bin woof
+    runHook postInstall
  '';

  meta = with lib; {
@ -29,4 +27,3 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ matthiasbeyer ];
  };
 }
-
--- a/pkgs/tools/misc/yai/default.nix
+++ b/pkgs/tools/misc/yai/default.nix
@ -0,0 +1,38 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+buildGoModule rec {
+  pname = "yai";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "ekkinox";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-MoblXLfptlIYJbXQTpbc8GBo2a3Zgxdvwra8IUEGiZs==";
+  };
+
+  vendorSha256 = "sha256-+NhYK8FXd5B3GsGUPJOMM7Tt3GS1ZJ7LeApz38Xkwx8=";
+
+  ldflags = [
+    "-w -s"
+    "-X main.buildVersion=${version}"
+  ];
+
+  preCheck = ''
+    # analyzer_test.go needs a user
+    export USER=test
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/ekkinox/yai";
+    description = "Your AI powered terminal assistant";
+    longDescription = ''
+      Yai (your AI) is an assistant for your terminal, using OpenAI ChatGPT to build and run commands for you.
+      You just need to describe them in your everyday language, it will take care or the rest.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ georgesalkhouri ];
+  };
+}
--- a/pkgs/tools/package-management/fusesoc/default.nix
+++ b/pkgs/tools/package-management/fusesoc/default.nix
@ -0,0 +1,39 @@
+{ buildPythonPackage
+, fetchPypi
+, lib
+, verilog
+, verilator
+, gnumake
+, gcc
+, edalize
+, fastjsonschema
+, pyparsing
+, pyyaml
+, simplesat
+, ipyxact
+, setuptools-scm
+}:
+buildPythonPackage rec {
+  pname = "fusesoc";
+  version = "2.2.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-M36bXBgY8hR33AVDlHoH8PZJG2Bi0KOEI07IMns7R4w=";
+  };
+
+  nativeBuildInputs = [ setuptools-scm ];
+
+  propagatedBuildInputs = [ edalize fastjsonschema pyparsing pyyaml simplesat ipyxact ];
+
+  pythonImportsCheck = [ "fusesoc" ];
+
+  makeWrapperArgs = [ "--suffix PATH : ${lib.makeBinPath [ verilog verilator gnumake ]}"];
+
+  meta = with lib; {
+    homepage = "https://github.com/olofk/fusesoc";
+    description = "A package manager and build tools for HDL code";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.bsd3;
+  };
+}
--- a/pkgs/tools/security/acltoolkit/default.nix
+++ b/pkgs/tools/security/acltoolkit/default.nix
@ -0,0 +1,45 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonPackage rec {
+  pname = "acltoolkit";
+  version = "unstable-2023-02-03";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "zblurx";
+    repo = "acltoolkit";
+    rev = "a5219946aa445c0a3b4a406baea67b33f78bca7c";
+    hash = "sha256-97cbkGyIkq2Pk1hydMcViXWoh+Ipi3m0YvEYiaV4zcM=";
+  };
+
+  postPatch = ''
+    # Ignore pinned versions
+    sed -i -e "s/==[0-9.]*//" setup.py
+  '';
+
+  propagatedBuildInputs = with python3.pkgs; [
+    asn1crypto
+    dnspython
+    impacket
+    ldap3
+    pyasn1
+    pycryptodome
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "acltoolkit"
+  ];
+
+  meta = with lib; {
+    description = "ACL abuse swiss-knife";
+    homepage = "https://github.com/zblurx/acltoolkit";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/tools/security/baboossh/default.nix
+++ b/pkgs/tools/security/baboossh/default.nix
@ -0,0 +1,39 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "baboossh";
+  version = "1.2.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "cybiere";
+    repo = "baboossh";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-dorIqnJuAS/y9W6gyt65QjwGwx4bJHKLmdqRPzY25yA=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    cmd2
+    tabulate
+    paramiko
+    python-libnmap
+  ];
+
+  # No tests available
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "baboossh"
+  ];
+
+  meta = with lib; {
+    description = "Tool to do SSH spreading";
+    homepage = "https://github.com/cybiere/baboossh";
+    changelog = "https://github.com/cybiere/baboossh/releases/tag/v${version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/tools/security/ec2stepshell/default.nix
+++ b/pkgs/tools/security/ec2stepshell/default.nix
@ -0,0 +1,46 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "ec2stepshell";
+  version = "unstable-2023-04-07";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "saw-your-packet";
+    repo = "EC2StepShell";
+    rev = "ab1298fa7f2650de711e86e870a693dcce0e1935";
+    hash = "sha256-zy33CgGwa2pBYouqaJ1LM6uRIh3Q1uxi2zNXpDNPsuQ=";
+  };
+
+  postPatch = ''
+    # https://github.com/saw-your-packet/EC2StepShell/pull/1
+    substituteInPlace pyproject.toml \
+      --replace "realpython" "ec2stepshell"
+  '';
+
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    boto3
+    colorama
+    pyfiglet
+    termcolor
+  ];
+
+  pythonImportsCheck = [
+    "ec2stepshell"
+  ];
+
+  meta = with lib; {
+    description = "AWS post-exploitation tool";
+    homepage = "https://github.com/saw-your-packet/EC2StepShell";
+    changelog = "https://github.com/saw-your-packet/EC2StepShell/blob/${version}/CHANGELOG.txt";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/tools/security/ghidra/0001-Use-protobuf-gradle-plugin.patch
+++ b/pkgs/tools/security/ghidra/0001-Use-protobuf-gradle-plugin.patch
@ -1,79 +1,60 @@
-From 913e74b8682f77da94ed7b7d459482b9b23a5d88 Mon Sep 17 00:00:00 2001
-From: roblabla <unfiltered@roblab.la>
-Date: Tue, 28 Dec 2021 14:20:30 +0100
-Subject: [PATCH] Use protobuf gradle plugin
-
---
- Ghidra/Debug/Debugger-gadp/build.gradle | 76 +++----------------------
- build.gradle                            |  6 ++
- 2 files changed, 15 insertions(+), 67 deletions(-)
-
 diff --git a/Ghidra/Debug/Debugger-gadp/build.gradle b/Ghidra/Debug/Debugger-gadp/build.gradle
-index 1b4922f66..3d2ef8856 100644
+index f4dbd3cd0..6108e8534 100644
 --- a/Ghidra/Debug/Debugger-gadp/build.gradle
 +++ b/Ghidra/Debug/Debugger-gadp/build.gradle
-@@ -23,42 +23,19 @@ apply from: "${rootProject.projectDir}/gradle/javaTestProject.gradle"
+@@ -23,42 +23,18 @@ apply from: "${rootProject.projectDir}/gradle/javaTestProject.gradle"
 apply from: "${rootProject.projectDir}/gradle/distributableGhidraModule.gradle"
 
 apply plugin: 'eclipse'
-eclipse.project.name = 'Debug Debugger-gadp'
 +apply plugin: 'com.google.protobuf'
+ eclipse.project.name = 'Debug Debugger-gadp'
 
 -configurations {
 -	allProtocArtifacts
 -	protocArtifact
 -}
-+eclipse.project.name = 'Debug Debugger-gadp'
- 
+-
 def platform = getCurrentPlatformName()
 
 -dependencies {
-	allProtocArtifacts 'com.google.protobuf:protoc:3.17.3:windows-x86_64@exe'
-	allProtocArtifacts 'com.google.protobuf:protoc:3.17.3:linux-x86_64@exe'
-	allProtocArtifacts 'com.google.protobuf:protoc:3.17.3:linux-aarch_64@exe'
-	allProtocArtifacts 'com.google.protobuf:protoc:3.17.3:osx-x86_64@exe'
-	allProtocArtifacts 'com.google.protobuf:protoc:3.17.3:osx-aarch_64@exe'
+-	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:windows-x86_64@exe'
+-	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:linux-x86_64@exe'
+-	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:linux-aarch_64@exe'
+-	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:osx-x86_64@exe'
+-	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:osx-aarch_64@exe'
 -
 -	if (isCurrentWindows()) {
-		protocArtifact 'com.google.protobuf:protoc:3.17.3:windows-x86_64@exe'
+-		protocArtifact 'com.google.protobuf:protoc:3.21.8:windows-x86_64@exe'
 -	}
 -	if (isCurrentLinux()) {
 -		if (platform.endsWith("x86_64")) {
-			protocArtifact 'com.google.protobuf:protoc:3.17.3:linux-x86_64@exe'
+-			protocArtifact 'com.google.protobuf:protoc:3.21.8:linux-x86_64@exe'
 -		}
 -		else {
-			protocArtifact 'com.google.protobuf:protoc:3.17.3:linux-aarch_64@exe'
+-			protocArtifact 'com.google.protobuf:protoc:3.21.8:linux-aarch_64@exe'
 -		}
 -	}
 -	if (isCurrentMac()) {
 -		if (platform.endsWith("x86_64")) {
-			protocArtifact 'com.google.protobuf:protoc:3.17.3:osx-x86_64@exe'
+-			protocArtifact 'com.google.protobuf:protoc:3.21.8:osx-x86_64@exe'
 -		}
 -		else {
-			protocArtifact 'com.google.protobuf:protoc:3.17.3:osx-aarch_64@exe'
+-			protocArtifact 'com.google.protobuf:protoc:3.21.8:osx-aarch_64@exe'
 -		}
-	}
 +buildscript {
-+  dependencies {
-+    classpath 'com.google.protobuf:protobuf-gradle-plugin:0.8.18'
-+  }
+	dependencies {
+		classpath 'com.google.protobuf:protobuf-gradle-plugin:0.8.18'
+ 	}
 +}
 
 +dependencies {
- 	api 'com.google.protobuf:protobuf-java:3.17.3'
 	api project(':Framework-AsyncComm')
 	api project(':Framework-Debugging')
-@@ -68,43 +45,8 @@ dependencies {
- 	testImplementation project(path: ':Framework-Debugging', configuration: 'testArtifacts')
- }
- 
-/*protobuf {
-+protobuf {
- 	protoc {
- 		artifact = 'com.google.protobuf:protoc:3.17.3'
+ 	api project(':ProposedUtils')
+@@ -73,37 +49,3 @@ dependencies {
 	}
-}*/
-
+ }*/
+ 
 -task generateProto {
 -	ext.srcdir = file("src/main/proto")
 -	ext.src = fileTree(srcdir) {
@ -93,7 +74,7 @@ index 1b4922f66..3d2ef8856 100644
 -			args src
 -		}
 -	}
- }
+-}
 -
 -tasks.compileJava.dependsOn(tasks.generateProto)
 -tasks.eclipse.dependsOn(tasks.generateProto)
@ -108,11 +89,105 @@ index 1b4922f66..3d2ef8856 100644
 -}
 -zipSourceSubproject.dependsOn generateProto
 -
+diff --git a/Ghidra/Debug/Debugger-isf/build.gradle b/Ghidra/Debug/Debugger-isf/build.gradle
+index 6bf945c2e..3225d095d 100644
+--- a/Ghidra/Debug/Debugger-isf/build.gradle
+++ b/Ghidra/Debug/Debugger-isf/build.gradle
+@@ -20,42 +20,18 @@ apply from: "${rootProject.projectDir}/gradle/javaTestProject.gradle"
+ apply from: "${rootProject.projectDir}/gradle/distributableGhidraModule.gradle"
+ 
+ apply plugin: 'eclipse'
+apply plugin: 'com.google.protobuf'
+ eclipse.project.name = 'Debug Debugger-isf'
+ 
+-configurations {
+-	allProtocArtifacts
+-	protocArtifact
+-}
+-
+ def platform = getCurrentPlatformName()
+ 
+-dependencies {
+-	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:windows-x86_64@exe'
+-	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:linux-x86_64@exe'
+-	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:linux-aarch_64@exe'
+-	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:osx-x86_64@exe'
+-	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:osx-aarch_64@exe'
+-
+-	if (isCurrentWindows()) {
+-		protocArtifact 'com.google.protobuf:protoc:3.21.8:windows-x86_64@exe'
+-	}
+-	if (isCurrentLinux()) {
+-		if (platform.endsWith("x86_64")) {
+-			protocArtifact 'com.google.protobuf:protoc:3.21.8:linux-x86_64@exe'
+-		}
+-		else {
+-			protocArtifact 'com.google.protobuf:protoc:3.21.8:linux-aarch_64@exe'
+-		}
+-	}
+-	if (isCurrentMac()) {
+-		if (platform.endsWith("x86_64")) {
+-			protocArtifact 'com.google.protobuf:protoc:3.21.8:osx-x86_64@exe'
+-		}
+-		else {
+-			protocArtifact 'com.google.protobuf:protoc:3.21.8:osx-aarch_64@exe'
+-		}
+buildscript {
+	dependencies {
+		classpath 'com.google.protobuf:protobuf-gradle-plugin:0.8.18'
+ 	}
+}
+ 
+dependencies {
+ 	api project(':Framework-AsyncComm')
+ 	api project(':Framework-Debugging')
+ 	api project(':ProposedUtils')
+@@ -64,40 +40,6 @@ dependencies {
+ 	testImplementation project(path: ':Framework-Debugging', configuration: 'testArtifacts')
+ }
+ 
+-task generateProto {
+-	ext.srcdir = file("src/main/proto")
+-	ext.src = fileTree(srcdir) {
+-		include "**/*.proto"
+-	}
+-	ext.outdir = file("build/generated/source/proto/main/java")
+-	outputs.dir(outdir)
+-	inputs.files(src)
+-	dependsOn(configurations.protocArtifact)
+-	doLast {
+-		def exe = configurations.protocArtifact.first()
+-		if (!isCurrentWindows()) {
+-			exe.setExecutable(true)
+-		}
+-		exec {
+-			commandLine exe, "--java_out=$outdir", "-I$srcdir"
+-			args src
+-		}
+-	}
+-}
+-
+-tasks.compileJava.dependsOn(tasks.generateProto)
+-tasks.eclipse.dependsOn(tasks.generateProto)
+-rootProject.tasks.prepDev.dependsOn(tasks.generateProto)
+-
+-sourceSets {
+-	main {
+-		java {
+-			srcDir tasks.generateProto.outdir
+-		}
+-	}
+-}
+-zipSourceSubproject.dependsOn generateProto
+-
+ // Include buildable native source in distribution
+ rootProject.assembleDistribution {
+     from (this.project.projectDir.toString()) {
 diff --git a/build.gradle b/build.gradle
-index dce3a5149..7a2e637ce 100644
+index b0c717fb1..5f56506a5 100644
 --- a/build.gradle
 +++ b/build.gradle
-@@ -76,6 +76,12 @@ if (flatRepo.isDirectory()) {
+@@ -74,6 +74,12 @@ if (flatRepo.isDirectory()) {
 			jcenter()
 			flatDir name: "flat", dirs:["$flatRepo"]
 		}
@ -125,6 +200,3 @@ index dce3a5149..7a2e637ce 100644
 	}
 }
 else {	
-- 
-2.33.1
-
--- a/pkgs/tools/security/ghidra/build.nix
+++ b/pkgs/tools/security/ghidra/build.nix
@ -12,20 +12,20 @@
 , autoPatchelfHook
 , icoutils
 , xcbuild
-, protobuf3_17
+, protobuf
 , libredirect
 }:

 let
  pkg_path = "$out/lib/ghidra";
  pname = "ghidra";
-  version = "10.2.3";
+  version = "10.3";

  src = fetchFromGitHub {
    owner = "NationalSecurityAgency";
    repo = "Ghidra";
    rev = "Ghidra_${version}_build";
-    sha256 = "sha256-YhjKRlFlF89H05NsTS69SB108rNiiWijvZZY9fR+Ebc=";
+    hash = "sha256-v3XP+4fwjPzt/OOxX27L0twXw8T1Y94hgP4A5Ukol5I=";
  };

  gradle = gradle_7;
@ -45,7 +45,14 @@ let
    cat >>Ghidra/Debug/Debugger-gadp/build.gradle <<HERE
 protobuf {
  protoc {
-    path = '${protobuf3_17}/bin/protoc'
+    path = '${protobuf}/bin/protoc'
+  }
+}
+HERE
+    cat >>Ghidra/Debug/Debugger-isf/build.gradle <<HERE
+protobuf {
+  protoc {
+    path = '${protobuf}/bin/protoc'
  }
 }
 HERE
@ -106,7 +113,7 @@ HERE
    '';
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
-    outputHash = "sha256-Z4RS3IzDP8V3SrrwOuX/hTlX7fs3woIhR8GPK/tFAzs=";
+    outputHash = "sha256-HveS3f8XHpJqefc4djYmnYfd01H2OBFK5PLNOsHAqlc=";
  };

 in stdenv.mkDerivation rec {
@ -171,6 +178,7 @@ in stdenv.mkDerivation rec {
    ];
    license = licenses.asl20;
    maintainers = with maintainers; [ roblabla ];
+    broken = stdenv.isDarwin;
  };

 }
--- a/pkgs/tools/security/ghidra/default.nix
+++ b/pkgs/tools/security/ghidra/default.nix
@ -24,12 +24,12 @@ let

 in stdenv.mkDerivation rec {
  pname = "ghidra";
-  version = "10.2.3";
-  versiondate = "20230208";
+  version = "10.3";
+  versiondate = "20230510";

  src = fetchzip {
    url = "https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_${version}_build/ghidra_${version}_PUBLIC_${versiondate}.zip";
-    hash = "sha256-0uDLS+fnUqLw+oqoR/Vs56vhzNmA54k0WBvhvDmlGKs=";
+    hash = "sha256-uFyTMWhj3yMVIPxEwkLtTqpJUi2S8A2GFjjY3rNTC2c=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/security/keepwn/default.nix
+++ b/pkgs/tools/security/keepwn/default.nix
@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "keepwn";
+  version = "0.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "Orange-Cyberdefense";
+    repo = "KeePwn";
+    rev = "refs/tags/${version}";
+    hash = "sha256-s+r6QEUzkzCbs5j1G+PVgDx8cvnmQzEQ1MHAakG+skA=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    chardet
+    impacket
+    lxml
+    termcolor
+  ];
+
+  postInstall = lib.optionalString (!stdenv.isDarwin) ''
+    mv $out/bin/KeePwn $out/bin/$pname
+  '';
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "keepwn"
+  ];
+
+  meta = with lib; {
+    description = "Tool to automate KeePass discovery and secret extraction";
+    homepage = "https://github.com/Orange-Cyberdefense/KeePwn";
+    changelog = "https://github.com/Orange-Cyberdefense/KeePwn/releases/tag/${version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"

-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.16"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.17"
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@ -1,9 +1,9 @@
 GIT
  remote: https://github.com/rapid7/metasploit-framework
-  revision: 5ecb6ef3199a6a130e62639ab460fb29215f84ee
-  ref: refs/tags/6.3.16
+  revision: 3c284b7c96b88e71001fbff4c94a24ee553a8e78
+  ref: refs/tags/6.3.17
  specs:
-    metasploit-framework (6.3.16)
+    metasploit-framework (6.3.17)
      actionpack (~> 7.0)
      activerecord (~> 7.0)
      activesupport (~> 7.0)
@ -130,13 +130,13 @@ GEM
    arel-helpers (2.14.0)
      activerecord (>= 3.1.0, < 8)
    aws-eventstream (1.2.0)
-    aws-partitions (1.764.0)
-    aws-sdk-core (3.172.0)
+    aws-partitions (1.767.0)
+    aws-sdk-core (3.173.0)
      aws-eventstream (~> 1, >= 1.0.2)
      aws-partitions (~> 1, >= 1.651.0)
      aws-sigv4 (~> 1.5)
      jmespath (~> 1, >= 1.6.1)
-    aws-sdk-ec2 (1.379.0)
+    aws-sdk-ec2 (1.380.0)
      aws-sdk-core (~> 3, >= 3.165.0)
      aws-sigv4 (~> 1.1)
    aws-sdk-iam (1.77.0)
@ -227,7 +227,7 @@ GEM
      activesupport (~> 7.0)
      railties (~> 7.0)
      zeitwerk
-    metasploit-credential (6.0.4)
+    metasploit-credential (6.0.5)
      metasploit-concern
      metasploit-model
      metasploit_data_models (>= 5.0.0)
@ -271,7 +271,7 @@ GEM
    network_interface (0.0.2)
    nexpose (7.3.0)
    nio4r (2.5.9)
-    nokogiri (1.15.0)
+    nokogiri (1.15.1)
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
    nori (2.6.0)
@ -320,7 +320,7 @@ GEM
    recog (3.1.1)
      nokogiri
    redcarpet (3.6.0)
-    reline (0.3.3)
+    reline (0.3.4)
      io-console (~> 0.5)
    rex-arch (0.1.14)
      rex-text
@ -360,7 +360,7 @@ GEM
      metasm
      rex-core
      rex-text
-    rex-socket (0.1.50)
+    rex-socket (0.1.51)
      rex-core
    rex-sslscan (0.1.9)
      rex-core
@ -393,7 +393,7 @@ GEM
      rack (~> 2.2, >= 2.2.4)
      rack-protection (= 3.0.6)
      tilt (~> 2.0)
-    sqlite3 (1.6.2)
+    sqlite3 (1.6.3)
      mini_portile2 (~> 2.8.0)
    sshkey (2.0.0)
    strptime (0.2.5)
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@ -15,13 +15,13 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "metasploit-framework";
-  version = "6.3.16";
+  version = "6.3.17";

  src = fetchFromGitHub {
    owner = "rapid7";
    repo = "metasploit-framework";
    rev = version;
-    sha256 = "sha256-IM+NdLfFeRUKO7OBUPQXhREbdtiyYTmu0waERnNJ0Cw=";
+    sha256 = "sha256-IXEsmLgvd0FQ5Bgs68LHWM0Vk/yIYlkR1m/olSC5CNA=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@ -104,30 +104,30 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0lj3ay8p40m92lml8qwfg3yck82pzbgn9z5c6nxxjzjsz2zwa5mz";
+      sha256 = "01pqjxjqc4p2bws67sbvff4kfggzfq0vwgyf9pf6pfmw4z2518m9";
      type = "gem";
    };
-    version = "1.764.0";
+    version = "1.767.0";
  };
  aws-sdk-core = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06scfn1qjfqvgr05ddrcbihlnfi7bffk8r0m5z536w4mm1s3gh6x";
+      sha256 = "10djgbz4k9w3axka8xrhf97h9yh9svi5g5xvncfwnkg6h22w2177";
      type = "gem";
    };
-    version = "3.172.0";
+    version = "3.173.0";
  };
  aws-sdk-ec2 = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0sdjlc95q5x8cfs4j6l2fz23q4i35hnn0g9lsq7kxzlw21sfawwh";
+      sha256 = "0r4b0rcbbzrl8acmzy276y9amcv9yqpr9s3k0xqxkp8l5zdrwz9w";
      type = "gem";
    };
-    version = "1.379.0";
+    version = "1.380.0";
  };
  aws-sdk-iam = {
    groups = ["default"];
@ -614,22 +614,22 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "00ij97jn1vbh66jcl1dbva1lf7a5gc4sdcg46jphgm1zghgsi5hp";
+      sha256 = "0pdfrbw8442aspvf4h691p542sgm6rj2xfl3bfc6rplmz82j1ay5";
      type = "gem";
    };
-    version = "6.0.4";
+    version = "6.0.5";
  };
  metasploit-framework = {
    groups = ["default"];
    platforms = [];
    source = {
      fetchSubmodules = false;
-      rev = "5ecb6ef3199a6a130e62639ab460fb29215f84ee";
-      sha256 = "0b6h95rld106sfp3jqdjv1v1n4c52zs510dk7c51ayf5nxs8vkr0";
+      rev = "3c284b7c96b88e71001fbff4c94a24ee553a8e78";
+      sha256 = "1l08p4h9bs3gsq8mjql8zj9ibkaqqz1fnb0qwi842xrgp2c2qw91";
      type = "git";
      url = "https://github.com/rapid7/metasploit-framework";
    };
-    version = "6.3.16";
+    version = "6.3.17";
  };
  metasploit-model = {
    groups = ["default"];
@ -821,16 +821,16 @@
    };
    version = "2.5.9";
  };
-nokogiri = {
+  nokogiri = {
    dependencies = ["mini_portile2" "racc"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0zz9vzhl9v4qshcwawlbqlz950vcz0d9f4cznf6sxamx94hyma0c";
+      sha256 = "10zmnzk0b6v48s9nyrgnidcinn06m52ph3mzzcjh5q7xrzii3mb8";
      type = "gem";
    };
-    version = "1.15.0";
+    version = "1.15.1";
  };
  nori = {
    groups = ["default"];
@ -1077,10 +1077,10 @@ nokogiri = {
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0zpz436h6gxyh000bdsm1m53kb5zgl97cfb45rxk2w5z2fgl30f3";
+      sha256 = "1c0vm2qd6yqya75zymh3szlq7k7wb1a53cidk3h5yr4g3wvhfija";
      type = "gem";
    };
-    version = "0.3.3";
+    version = "0.3.4";
  };
  rex-arch = {
    groups = ["default"];
@ -1217,10 +1217,10 @@ nokogiri = {
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0wvq9miaqncyjmdphkn87ab5pk3yciplbcgzsp5q322pwmssqb1i";
+      sha256 = "0gydzz8x0gpkp6mm9giz6lqw7nfl1lsclcjbwzj3g26nxfi597bg";
      type = "gem";
    };
-    version = "0.1.50";
+    version = "0.1.51";
  };
  rex-sslscan = {
    groups = ["default"];
@ -1378,10 +1378,10 @@ nokogiri = {
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1i47n6nkyigkyag00yqf9f3nj11bm1lb0ds5nkvkdvm7lxbna5jq";
+      sha256 = "0h95kr5529qv786mfk8r2jjdsdi6v7v3k3dpz69mrcc9i0vpdd37";
      type = "gem";
    };
-    version = "1.6.2";
+    version = "1.6.3";
  };
  sshkey = {
    groups = ["default"];
--- a/pkgs/tools/security/osv-scanner/default.nix
+++ b/pkgs/tools/security/osv-scanner/default.nix
@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
  pname = "osv-scanner";
-  version = "1.3.2";
+  version = "1.3.3";

  src = fetchFromGitHub {
    owner = "google";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-xgSRaGS09a1d1qepzvkTuMtaUHh8QsKxF7RWD+0Sepg=";
+    hash = "sha256-J1oOkHh1xHwY8CUq5X+bAfhIbE3/fss5tiZA5/90nhw=";
  };

-  vendorHash = "sha256-9tNEPgJJ4mp4DPNgIzezS9Axed3XoJV9cyTYCOGMvgA=";
+  vendorHash = "sha256-xarDkQNYa/xl8f0MRdsb+/29B8bY5Ts+MbYHGb5yP10=";

  subPackages = [
    "cmd/osv-scanner"
--- a/Show More
+++ b/Show More