Merge master into haskell-updates

2023-05-15 00:12:49 +00:00 · 2023-05-15 00:12:49 +00:00 · 1718cfb047
parent a886796add 641a768829
commit 1718cfb047
175 changed files with 7053 additions and 967 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -22,19 +22,19 @@
 /.editorconfig @Mic92 @zowoq

 # Libraries
-/lib                        @edolstra @nbp @infinisil
-/lib/systems                @alyssais @nbp @ericson2314 @matthewbauer
-/lib/generators.nix         @edolstra @nbp @Profpatsch
-/lib/cli.nix                @edolstra @nbp @Profpatsch
-/lib/debug.nix              @edolstra @nbp @Profpatsch
-/lib/asserts.nix            @edolstra @nbp @Profpatsch
+/lib                        @edolstra @infinisil
+/lib/systems                @alyssais @ericson2314 @matthewbauer
+/lib/generators.nix         @edolstra @Profpatsch
+/lib/cli.nix                @edolstra @Profpatsch
+/lib/debug.nix              @edolstra @Profpatsch
+/lib/asserts.nix            @edolstra @Profpatsch
 /lib/path.*                 @infinisil @fricklerhandwerk

 # Nixpkgs Internals
-/default.nix                                     @nbp
-/pkgs/top-level/default.nix                      @nbp @Ericson2314
-/pkgs/top-level/impure.nix                       @nbp @Ericson2314
-/pkgs/top-level/stage.nix                        @nbp @Ericson2314 @matthewbauer
+/default.nix                                     @Ericson2314
+/pkgs/top-level/default.nix                      @Ericson2314
+/pkgs/top-level/impure.nix                       @Ericson2314
+/pkgs/top-level/stage.nix                        @Ericson2314 @matthewbauer
 /pkgs/top-level/splice.nix                       @Ericson2314 @matthewbauer
 /pkgs/top-level/release-cross.nix                @Ericson2314 @matthewbauer
 /pkgs/stdenv/generic                             @Ericson2314 @matthewbauer
@ -67,22 +67,9 @@
 /doc/using @fricklerhandwerk

 # NixOS Internals
-/nixos/default.nix          @nbp @infinisil
-/nixos/lib/from-env.nix     @nbp @infinisil
-/nixos/lib/eval-config.nix  @nbp @infinisil
-/nixos/doc/manual/configuration/abstractions.xml      @nbp
-/nixos/doc/manual/configuration/config-file.xml       @nbp
-/nixos/doc/manual/configuration/config-syntax.xml     @nbp
-/nixos/doc/manual/configuration/modularity.xml        @nbp
-/nixos/doc/manual/development/assertions.xml          @nbp
-/nixos/doc/manual/development/meta-attributes.xml     @nbp
-/nixos/doc/manual/development/option-declarations.xml @nbp
-/nixos/doc/manual/development/option-def.xml          @nbp
-/nixos/doc/manual/development/option-types.xml        @nbp
-/nixos/doc/manual/development/replace-modules.xml     @nbp
-/nixos/doc/manual/development/writing-modules.xml     @nbp
-/nixos/doc/manual/man-nixos-option.xml                @nbp
-/nixos/modules/installer/tools/nixos-option.sh        @nbp
+/nixos/default.nix                                    @infinisil
+/nixos/lib/from-env.nix                               @infinisil
+/nixos/lib/eval-config.nix                            @infinisil
 /nixos/modules/system                                 @dasJ
 /nixos/modules/system/activation/bootspec.nix         @grahamc @cole-h @raitobezarius
 /nixos/modules/system/activation/bootspec.cue         @grahamc @cole-h @raitobezarius
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -38,6 +38,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [Akkoma](https://akkoma.social), an ActivityPub microblogging server. Available as [services.akkoma](options.html#opt-services.akkoma.enable).

+- [Pixelfed](https://pixelfed.org/), an Instagram-like ActivityPub server. Available as [services.pixelfed](options.html#opt-services.pixelfed.enable).
+
 - [blesh](https://github.com/akinomyoga/ble.sh), a line editor written in pure bash. Available as [programs.bash.blesh](#opt-programs.bash.blesh.enable).

 - [webhook](https://github.com/adnanh/webhook), a lightweight webhook server. Available as [services.webhook](#opt-services.webhook.enable).
@ -383,6 +385,26 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `nextcloud` has an option to enable SSE-C in S3.

+- NixOS swap partitions with random encryption can now control the sector size, cipher, and key size used to setup the plain encryption device over the
+  underlying block device rather than allowing them to be determined by `cryptsetup(8)`. One can use these features like so:
+
+  ```nix
+  {
+    swapDevices = [
+      {
+        device = "/dev/disk/by-partlabel/swapspace";
+
+        randomEncryption = {
+          enable = true;
+          cipher = "aes-xts-plain64";
+          keySize = 512;
+          sectorSize = 4096;
+        };
+      }
+    ];
+  }
+  ```
+
 - `services.peertube` now requires you to specify the secret file `secrets.secretsFile`. It can be generated by running `openssl rand -hex 32`.
  Before upgrading, read the release notes for PeerTube:
    - [Release v5.0.0](https://github.com/Chocobozzz/PeerTube/releases/tag/v5.0.0)
--- a/nixos/modules/config/swap.nix
+++ b/nixos/modules/config/swap.nix
@ -38,6 +38,34 @@ let
        '';
      };

+      keySize = mkOption {
+        default = null;
+        example = "512";
+        type = types.nullOr types.int;
+        description = lib.mdDoc ''
+          Set the encryption key size for the plain device.
+
+          If not specified, the amount of data to read from `source` will be
+          determined by cryptsetup.
+
+          See `cryptsetup-open(8)` for details.
+        '';
+      };
+
+      sectorSize = mkOption {
+        default = null;
+        example = "4096";
+        type = types.nullOr types.int;
+        description = lib.mdDoc ''
+          Set the sector size for the plain encrypted device type.
+
+          If not specified, the default sector size is determined from the
+          underlying block device.
+
+          See `cryptsetup-open(8)` for details.
+        '';
+      };
+
      source = mkOption {
        default = "/dev/urandom";
        example = "/dev/random";
@ -157,11 +185,11 @@ let

    };

-    config = rec {
+    config = {
      device = mkIf options.label.isDefined
        "/dev/disk/by-label/${config.label}";
      deviceName = lib.replaceStrings ["\\"] [""] (escapeSystemdPath config.device);
-      realDevice = if config.randomEncryption.enable then "/dev/mapper/${deviceName}" else config.device;
+      realDevice = if config.randomEncryption.enable then "/dev/mapper/${config.deviceName}" else config.device;
    };

  };
@ -247,7 +275,12 @@ in
                ''}
                ${optionalString sw.randomEncryption.enable ''
                  cryptsetup plainOpen -c ${sw.randomEncryption.cipher} -d ${sw.randomEncryption.source} \
-                    ${optionalString sw.randomEncryption.allowDiscards "--allow-discards"} ${sw.device} ${sw.deviceName}
+                '' + concatMapStrings (arg: arg + " \\\n") (flatten [
+                  (optional (sw.randomEncryption.sectorSize != null) "--sector-size=${toString sw.randomEncryption.sectorSize}")
+                  (optional (sw.randomEncryption.keySize != null) "--key-size=${toString sw.randomEncryption.keySize}")
+                  (optional sw.randomEncryption.allowDiscards "--allow-discards")
+                ]) + ''
+                  ${sw.device} ${sw.deviceName}
                  mkswap ${sw.realDevice}
                ''}
              '';
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1178,6 +1178,7 @@
  ./services/web-apps/gerrit.nix
  ./services/web-apps/gotify-server.nix
  ./services/web-apps/grocy.nix
+  ./services/web-apps/pixelfed.nix
  ./services/web-apps/healthchecks.nix
  ./services/web-apps/hedgedoc.nix
  ./services/web-apps/hledger-web.nix
@ -1373,6 +1374,7 @@
  ./tasks/filesystems/cifs.nix
  ./tasks/filesystems/ecryptfs.nix
  ./tasks/filesystems/envfs.nix
+  ./tasks/filesystems/erofs.nix
  ./tasks/filesystems/exfat.nix
  ./tasks/filesystems/ext.nix
  ./tasks/filesystems/f2fs.nix
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@ -109,7 +109,7 @@ let
      };
      environment = {
        BORG_REPO = cfg.repo;
-        inherit (cfg) extraArgs extraInitArgs extraCreateArgs extraPruneArgs;
+        inherit (cfg) extraArgs extraInitArgs extraCreateArgs extraPruneArgs extraCompactArgs;
      } // (mkPassEnv cfg) // cfg.environment;
    };

--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@ -23,6 +23,16 @@ in
        description = lib.mdDoc "The Klipper package.";
      };

+      logFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/var/lib/klipper/klipper.log";
+        description = lib.mdDoc ''
+          Path of the file Klipper should log to.
+          If `null`, it logs to stdout, which is not recommended by upstream.
+        '';
+      };
+
      inputTTY = mkOption {
        type = types.path;
        default = "/run/klipper/tty";
@ -151,7 +161,9 @@ in
    systemd.services.klipper =
      let
        klippyArgs = "--input-tty=${cfg.inputTTY}"
-          + optionalString (cfg.apiSocket != null) " --api-server=${cfg.apiSocket}";
+          + optionalString (cfg.apiSocket != null) " --api-server=${cfg.apiSocket}"
+          + optionalString (cfg.logFile != null) " --logfile=${cfg.logFile}"
+        ;
        printerConfigPath =
          if cfg.mutableConfig
          then cfg.mutableConfigFolder + "/printer.cfg"
@ -177,7 +189,7 @@ in
        '';

        serviceConfig = {
-          ExecStart = "${cfg.package}/lib/klipper/klippy.py ${klippyArgs} ${printerConfigPath}";
+          ExecStart = "${cfg.package}/bin/klippy ${klippyArgs} ${printerConfigPath}";
          RuntimeDirectory = "klipper";
          StateDirectory = "klipper";
          SupplementaryGroups = [ "dialout" ];
--- a/nixos/modules/services/system/cloud-init.nix
+++ b/nixos/modules/services/system/cloud-init.nix
@ -90,7 +90,7 @@ in

  };

-  config = {
+  config = mkIf cfg.enable {
    services.cloud-init.settings = {
      system_info = mkDefault {
        distro = "nixos";
@ -142,7 +142,6 @@ in
        "power-state-change"
      ];
    };
-  } // (mkIf cfg.enable {

    environment.etc."cloud/cloud.cfg" =
      if cfg.config == "" then
@ -225,5 +224,7 @@ in
      description = "Cloud-config availability";
      requires = [ "cloud-init-local.service" "cloud-init.service" ];
    };
-  });
+  };
+
+  meta.maintainers = [ maintainers.zimbatm ];
 }
--- a/nixos/modules/services/web-apps/nextcloud-notify_push.nix
+++ b/nixos/modules/services/web-apps/nextcloud-notify_push.nix
@ -2,6 +2,7 @@

 let
  cfg = config.services.nextcloud.notify_push;
+  cfgN = config.services.nextcloud;
 in
 {
  options.services.nextcloud.notify_push = {
@ -25,6 +26,16 @@ in
      default = "error";
      description = lib.mdDoc "Log level";
    };
+
+    bendDomainToLocalhost = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Wether to add an entry to `/etc/hosts` for the configured nextcloud domain to point to `localhost` and add `localhost `to nextcloud's `trusted_proxies` config option.
+
+        This is useful when nextcloud's domain is not a static IP address and when the reverse proxy cannot be bypassed because the backend connection is done via unix socket.
+      '';
+    };
  } // (
    lib.genAttrs [
      "dbtype"
@ -44,11 +55,14 @@ in

  config = lib.mkIf cfg.enable {
    systemd.services.nextcloud-notify_push = let
-      nextcloudUrl = "http${lib.optionalString config.services.nextcloud.https "s"}://${config.services.nextcloud.hostName}";
+      nextcloudUrl = "http${lib.optionalString cfgN.https "s"}://${cfgN.hostName}";
    in {
      description = "Push daemon for Nextcloud clients";
      documentation = [ "https://github.com/nextcloud/notify_push" ];
-      after = [ "phpfpm-nextcloud.service" ];
+      after = [
+        "phpfpm-nextcloud.service"
+        "redis-nextcloud.service"
+      ];
      wantedBy = [ "multi-user.target" ];
      environment = {
        NEXTCLOUD_URL = nextcloudUrl;
@ -57,7 +71,7 @@ in
        LOG = cfg.logLevel;
      };
      postStart = ''
-        ${config.services.nextcloud.occ}/bin/nextcloud-occ notify_push:setup ${nextcloudUrl}/push
+        ${cfgN.occ}/bin/nextcloud-occ notify_push:setup ${nextcloudUrl}/push
      '';
      script = let
        dbType = if cfg.dbtype == "pgsql" then "postgresql" else cfg.dbtype;
@ -76,7 +90,7 @@ in
        export DATABASE_PASSWORD="$(<"${cfg.dbpassFile}")"
      '' + ''
        export DATABASE_URL="${dbUrl}"
-        ${cfg.package}/bin/notify_push '${config.services.nextcloud.datadir}/config/config.php'
+        ${cfg.package}/bin/notify_push '${cfgN.datadir}/config/config.php'
      '';
      serviceConfig = {
        User = "nextcloud";
@ -87,10 +101,23 @@ in
      };
    };

-    services.nginx.virtualHosts.${config.services.nextcloud.hostName}.locations."^~ /push/" = {
-      proxyPass = "http://unix:${cfg.socketPath}";
-      proxyWebsockets = true;
-      recommendedProxySettings = true;
+    networking.hosts = lib.mkIf cfg.bendDomainToLocalhost {
+      "127.0.0.1" = [ cfgN.hostName ];
+      "::1" = [ cfgN.hostName ];
    };
+
+    services = lib.mkMerge [
+      {
+        nginx.virtualHosts.${cfgN.hostName}.locations."^~ /push/" = {
+          proxyPass = "http://unix:${cfg.socketPath}";
+          proxyWebsockets = true;
+          recommendedProxySettings = true;
+        };
+      }
+
+      (lib.mkIf cfg.bendDomainToLocalhost {
+        nextcloud.extraOptions.trusted_proxies = [ "127.0.0.1" "::1" ];
+      })
+    ];
  };
 }
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -551,6 +551,19 @@ in {
      default = true;
    };

+    configureRedis = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.nextcloud.notify_push.enable;
+      defaultText = literalExpression "config.services.nextcloud.notify_push.enable";
+      description = lib.mdDoc ''
+        Wether to configure nextcloud to use the recommended redis settings for small instances.
+
+        ::: {.note}
+        The `notify_push` app requires redis to be configured. If this option is turned off, this must be configured manually.
+        :::
+      '';
+    };
+
    caching = {
      apcu = mkOption {
        type = types.bool;
@ -1044,6 +1057,25 @@ in {
        }];
      };

+      services.redis.servers.nextcloud = lib.mkIf cfg.configureRedis {
+        enable = true;
+        user = "nextcloud";
+      };
+
+      services.nextcloud = lib.mkIf cfg.configureRedis {
+        caching.redis = true;
+        extraOptions = {
+          memcache = {
+            distributed = ''\OC\Memcache\Redis'';
+            locking = ''\OC\Memcache\Redis'';
+          };
+          redis = {
+            host = config.services.redis.servers.nextcloud.unixSocket;
+            port = 0;
+          };
+        };
+      };
+
      services.nginx.enable = mkDefault true;

      services.nginx.virtualHosts.${cfg.hostName} = {
--- a/nixos/modules/services/web-apps/pixelfed.nix
+++ b/nixos/modules/services/web-apps/pixelfed.nix
@ -0,0 +1,478 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.pixelfed;
+  user = cfg.user;
+  group = cfg.group;
+  pixelfed = cfg.package.override { inherit (cfg) dataDir runtimeDir; };
+  # https://github.com/pixelfed/pixelfed/blob/dev/app/Console/Commands/Installer.php#L185-L190
+  extraPrograms = with pkgs; [ jpegoptim optipng pngquant gifsicle ffmpeg ];
+  # Ensure PHP extensions: https://github.com/pixelfed/pixelfed/blob/dev/app/Console/Commands/Installer.php#L135-L147
+  phpPackage = cfg.phpPackage.buildEnv {
+    extensions = { enabled, all }:
+      enabled
+      ++ (with all; [ bcmath ctype curl mbstring gd intl zip redis imagick ]);
+  };
+  configFile =
+    pkgs.writeText "pixelfed-env" (lib.generators.toKeyValue { } cfg.settings);
+  # Management script
+  pixelfed-manage = pkgs.writeShellScriptBin "pixelfed-manage" ''
+    cd ${pixelfed}
+    sudo=exec
+    if [[ "$USER" != ${user} ]]; then
+      sudo='exec /run/wrappers/bin/sudo -u ${user}'
+    fi
+    $sudo ${cfg.phpPackage}/bin/php artisan "$@"
+  '';
+  dbSocket = {
+    "pgsql" = "/run/postgresql";
+    "mysql" = "/run/mysqld/mysqld.sock";
+  }.${cfg.database.type};
+  dbService = {
+    "pgsql" = "postgresql.service";
+    "mysql" = "mysql.service";
+  }.${cfg.database.type};
+  redisService = "redis-pixelfed.service";
+in {
+  options.services = {
+    pixelfed = {
+      enable = mkEnableOption (lib.mdDoc "a Pixelfed instance");
+      package = mkPackageOptionMD pkgs "pixelfed" { };
+      phpPackage = mkPackageOptionMD pkgs "php81" { };
+
+      user = mkOption {
+        type = types.str;
+        default = "pixelfed";
+        description = lib.mdDoc ''
+          User account under which pixelfed runs.
+
+          ::: {.note}
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the pixelfed application starts.
+          :::
+        '';
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "pixelfed";
+        description = lib.mdDoc ''
+          Group account under which pixelfed runs.
+
+          ::: {.note}
+          If left as the default value this group will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the group exists before the pixelfed application starts.
+          :::
+        '';
+      };
+
+      domain = mkOption {
+        type = types.str;
+        description = lib.mdDoc ''
+          FQDN for the Pixelfed instance.
+        '';
+      };
+
+      secretFile = mkOption {
+        type = types.path;
+        description = lib.mdDoc ''
+          A secret file to be sourced for the .env settings.
+          Place `APP_KEY` and other settings that should not end up in the Nix store here.
+        '';
+      };
+
+      settings = mkOption {
+        type = with types; (attrsOf (oneOf [ bool int str ]));
+        description = lib.mdDoc ''
+          .env settings for Pixelfed.
+          Secrets should use `secretFile` option instead.
+        '';
+      };
+
+      nginx = mkOption {
+        type = types.nullOr (types.submodule
+          (import ../web-servers/nginx/vhost-options.nix {
+            inherit config lib;
+          }));
+        default = null;
+        example = lib.literalExpression ''
+          {
+            serverAliases = [
+              "pics.''${config.networking.domain}"
+            ];
+            enableACME = true;
+            forceHttps = true;
+          }
+        '';
+        description = lib.mdDoc ''
+          With this option, you can customize an nginx virtual host which already has sensible defaults for Dolibarr.
+          Set to {} if you do not need any customization to the virtual host.
+          If enabled, then by default, the {option}`serverName` is
+          `''${domain}`,
+          If this is set to null (the default), no nginx virtualHost will be configured.
+        '';
+      };
+
+      redis.createLocally = mkEnableOption
+        (lib.mdDoc "a local Redis database using UNIX socket authentication")
+        // {
+          default = true;
+        };
+
+      database = {
+        createLocally = mkEnableOption
+          (lib.mdDoc "a local database using UNIX socket authentication") // {
+            default = true;
+          };
+        automaticMigrations = mkEnableOption
+          (lib.mdDoc "automatic migrations for database schema and data") // {
+            default = true;
+          };
+
+        type = mkOption {
+          type = types.enum [ "mysql" "pgsql" ];
+          example = "pgsql";
+          default = "mysql";
+          description = lib.mdDoc ''
+            Database engine to use.
+            Note that PGSQL is not well supported: https://github.com/pixelfed/pixelfed/issues/2727
+          '';
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "pixelfed";
+          description = lib.mdDoc "Database name.";
+        };
+      };
+
+      maxUploadSize = mkOption {
+        type = types.str;
+        default = "8M";
+        description = lib.mdDoc ''
+          Max upload size with units.
+        '';
+      };
+
+      poolConfig = mkOption {
+        type = with types; attrsOf (oneOf [ int str bool ]);
+        default = { };
+
+        description = lib.mdDoc ''
+          Options for Pixelfed's PHP-FPM pool.
+        '';
+      };
+
+      dataDir = mkOption {
+        type = types.str;
+        default = "/var/lib/pixelfed";
+        description = lib.mdDoc ''
+          State directory of the `pixelfed` user which holds
+          the application's state and data.
+        '';
+      };
+
+      runtimeDir = mkOption {
+        type = types.str;
+        default = "/run/pixelfed";
+        description = lib.mdDoc ''
+          Ruutime directory of the `pixelfed` user which holds
+          the application's caches and temporary files.
+        '';
+      };
+
+      schedulerInterval = mkOption {
+        type = types.str;
+        default = "1d";
+        description = lib.mdDoc "How often the Pixelfed cron task should run";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users.pixelfed = mkIf (cfg.user == "pixelfed") {
+      isSystemUser = true;
+      group = cfg.group;
+      extraGroups = lib.optional cfg.redis.createLocally "redis-pixelfed";
+    };
+    users.groups.pixelfed = mkIf (cfg.group == "pixelfed") { };
+
+    services.redis.servers.pixelfed.enable = lib.mkIf cfg.redis.createLocally true;
+    services.pixelfed.settings = mkMerge [
+      ({
+        APP_ENV = mkDefault "production";
+        APP_DEBUG = mkDefault false;
+        # https://github.com/pixelfed/pixelfed/blob/dev/app/Console/Commands/Installer.php#L312-L316
+        APP_URL = mkDefault "https://${cfg.domain}";
+        ADMIN_DOMAIN = mkDefault cfg.domain;
+        APP_DOMAIN = mkDefault cfg.domain;
+        SESSION_DOMAIN = mkDefault cfg.domain;
+        SESSION_SECURE_COOKIE = mkDefault true;
+        OPEN_REGISTRATION = mkDefault false;
+        # ActivityPub: https://github.com/pixelfed/pixelfed/blob/dev/app/Console/Commands/Installer.php#L360-L364
+        ACTIVITY_PUB = mkDefault true;
+        AP_REMOTE_FOLLOW = mkDefault true;
+        AP_INBOX = mkDefault true;
+        AP_OUTBOX = mkDefault true;
+        AP_SHAREDINBOX = mkDefault true;
+        # Image optimization: https://github.com/pixelfed/pixelfed/blob/dev/app/Console/Commands/Installer.php#L367-L404
+        PF_OPTIMIZE_IMAGES = mkDefault true;
+        IMAGE_DRIVER = mkDefault "imagick";
+        # Mobile APIs
+        OAUTH_ENABLED = mkDefault true;
+        # https://github.com/pixelfed/pixelfed/blob/dev/app/Console/Commands/Installer.php#L351
+        EXP_EMC = mkDefault true;
+        # Defer to systemd
+        LOG_CHANNEL = mkDefault "stderr";
+        # TODO: find out the correct syntax?
+        # TRUST_PROXIES = mkDefault "127.0.0.1/8, ::1/128";
+      })
+      (mkIf (cfg.redis.createLocally) {
+        BROADCAST_DRIVER = mkDefault "redis";
+        CACHE_DRIVER = mkDefault "redis";
+        QUEUE_DRIVER = mkDefault "redis";
+        SESSION_DRIVER = mkDefault "redis";
+        WEBSOCKET_REPLICATION_MODE = mkDefault "redis";
+        # Suppport phpredis and predis configuration-style.
+        REDIS_SCHEME = "unix";
+        REDIS_HOST = config.services.redis.servers.pixelfed.unixSocket;
+        REDIS_PATH = config.services.redis.servers.pixelfed.unixSocket;
+      })
+      (mkIf (cfg.database.createLocally) {
+        DB_CONNECTION = cfg.database.type;
+        DB_SOCKET = dbSocket;
+        DB_DATABASE = cfg.database.name;
+        DB_USERNAME = user;
+        # No TCP/IP connection.
+        DB_PORT = 0;
+      })
+    ];
+
+    environment.systemPackages = [ pixelfed-manage ];
+
+    services.mysql =
+      mkIf (cfg.database.createLocally && cfg.database.type == "mysql") {
+        enable = mkDefault true;
+        package = mkDefault pkgs.mariadb;
+        ensureDatabases = [ cfg.database.name ];
+        ensureUsers = [{
+          name = user;
+          ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+        }];
+      };
+
+    services.postgresql =
+      mkIf (cfg.database.createLocally && cfg.database.type == "pgsql") {
+        enable = mkDefault true;
+        ensureDatabases = [ cfg.database.name ];
+        ensureUsers = [{
+          name = user;
+          ensurePermissions = { };
+        }];
+      };
+
+    # Make each individual option overridable with lib.mkDefault.
+    services.pixelfed.poolConfig = lib.mapAttrs' (n: v: lib.nameValuePair n (lib.mkDefault v)) {
+      "pm" = "dynamic";
+      "php_admin_value[error_log]" = "stderr";
+      "php_admin_flag[log_errors]" = true;
+      "catch_workers_output" = true;
+      "pm.max_children" = "32";
+      "pm.start_servers" = "2";
+      "pm.min_spare_servers" = "2";
+      "pm.max_spare_servers" = "4";
+      "pm.max_requests" = "500";
+    };
+
+    services.phpfpm.pools.pixelfed = {
+      inherit user group;
+      inherit phpPackage;
+
+      phpOptions = ''
+        post_max_size = ${toString cfg.maxUploadSize}
+        upload_max_filesize = ${toString cfg.maxUploadSize}
+        max_execution_time = 600;
+      '';
+
+      settings = {
+        "listen.owner" = user;
+        "listen.group" = group;
+        "listen.mode" = "0660";
+        "catch_workers_output" = "yes";
+      } // cfg.poolConfig;
+    };
+
+    systemd.services.phpfpm-pixelfed.after = [ "pixelfed-data-setup.service" ];
+    systemd.services.phpfpm-pixelfed.requires =
+      [ "pixelfed-horizon.service" "pixelfed-data-setup.service" ]
+      ++ lib.optional cfg.database.createLocally dbService
+      ++ lib.optional cfg.redis.createLocally redisService;
+    # Ensure image optimizations programs are available.
+    systemd.services.phpfpm-pixelfed.path = extraPrograms;
+
+    systemd.services.pixelfed-horizon = {
+      description = "Pixelfed task queueing via Laravel Horizon framework";
+      after = [ "network.target" "pixelfed-data-setup.service" ];
+      requires = [ "pixelfed-data-setup.service" ]
+        ++ (lib.optional cfg.database.createLocally dbService)
+        ++ (lib.optional cfg.redis.createLocally redisService);
+      wantedBy = [ "multi-user.target" ];
+      # Ensure image optimizations programs are available.
+      path = extraPrograms;
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pixelfed-manage}/bin/pixelfed-manage horizon";
+        StateDirectory =
+          lib.mkIf (cfg.dataDir == "/var/lib/pixelfed") "pixelfed";
+        User = user;
+        Group = group;
+        Restart = "on-failure";
+      };
+    };
+
+    systemd.timers.pixelfed-cron = {
+      description = "Pixelfed periodic tasks timer";
+      after = [ "pixelfed-data-setup.service" ];
+      requires = [ "phpfpm-pixelfed.service" ];
+      wantedBy = [ "timers.target" ];
+
+      timerConfig = {
+        OnBootSec = cfg.schedulerInterval;
+        OnUnitActiveSec = cfg.schedulerInterval;
+      };
+    };
+
+    systemd.services.pixelfed-cron = {
+      description = "Pixelfed periodic tasks";
+      # Ensure image optimizations programs are available.
+      path = extraPrograms;
+
+      serviceConfig = {
+        ExecStart = "${pixelfed-manage}/bin/pixelfed-manage schedule:run";
+        User = user;
+        Group = group;
+        StateDirectory = cfg.dataDir;
+      };
+    };
+
+    systemd.services.pixelfed-data-setup = {
+      description =
+        "Pixelfed setup: migrations, environment file update, cache reload, data changes";
+      wantedBy = [ "multi-user.target" ];
+      after = lib.optional cfg.database.createLocally dbService;
+      requires = lib.optional cfg.database.createLocally dbService;
+      path = with pkgs; [ bash pixelfed-manage rsync ] ++ extraPrograms;
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = user;
+        Group = group;
+        StateDirectory =
+          lib.mkIf (cfg.dataDir == "/var/lib/pixelfed") "pixelfed";
+        LoadCredential = "env-secrets:${cfg.secretFile}";
+        UMask = "077";
+      };
+
+      script = ''
+        # Concatenate non-secret .env and secret .env
+        rm -f ${cfg.dataDir}/.env
+        cp --no-preserve=all ${configFile} ${cfg.dataDir}/.env
+        echo -e '\n' >> ${cfg.dataDir}/.env
+        cat "$CREDENTIALS_DIRECTORY/env-secrets" >> ${cfg.dataDir}/.env
+
+        # Link the static storage (package provided) to the runtime storage
+        # Necessary for cities.json and static images.
+        mkdir -p ${cfg.dataDir}/storage
+        rsync -av --no-perms ${pixelfed}/storage-static/ ${cfg.dataDir}/storage
+        chmod -R +w ${cfg.dataDir}/storage
+
+        # Link the app.php in the runtime folder.
+        # We cannot link the cache folder only because bootstrap folder needs to be writeable.
+        ln -sf ${pixelfed}/bootstrap-static/app.php ${cfg.runtimeDir}/app.php
+
+        # https://laravel.com/docs/10.x/filesystem#the-public-disk
+        # Creating the public/storage → storage/app/public link
+        # is unnecessary as it's part of the installPhase of pixelfed.
+
+        # Install Horizon
+        # FIXME: require write access to public/ — should be done as part of install — pixelfed-manage horizon:publish
+
+        # Before running any PHP program, cleanup the bootstrap.
+        # It's necessary if you upgrade the application otherwise you might
+        # try to import non-existent modules.
+        rm -rf ${cfg.runtimeDir}/bootstrap/*
+
+        # Perform the first migration.
+        [[ ! -f ${cfg.dataDir}/.initial-migration ]] && pixelfed-manage migrate --force && touch ${cfg.dataDir}/.initial-migration
+
+        ${lib.optionalString cfg.database.automaticMigrations ''
+          # Force migrate the database.
+          pixelfed-manage migrate --force
+        ''}
+
+        # Import location data
+        pixelfed-manage import:cities
+
+        ${lib.optionalString cfg.settings.ACTIVITY_PUB ''
+          # ActivityPub federation bookkeeping
+          [[ ! -f ${cfg.dataDir}/.instance-actor-created ]] && pixelfed-manage instance:actor && touch ${cfg.dataDir}/.instance-actor-created
+        ''}
+
+        ${lib.optionalString cfg.settings.OAUTH_ENABLED ''
+          # Generate Passport encryption keys
+          [[ ! -f ${cfg.dataDir}/.passport-keys-generated ]] && pixelfed-manage passport:keys && touch ${cfg.dataDir}/.passport-keys-generated
+        ''}
+
+        pixelfed-manage route:cache
+        pixelfed-manage view:cache
+        pixelfed-manage config:cache
+      '';
+    };
+
+    systemd.tmpfiles.rules = [
+      # Cache must live across multiple systemd units runtimes.
+      "d ${cfg.runtimeDir}/                         0700 ${user} ${group} - -"
+      "d ${cfg.runtimeDir}/cache                    0700 ${user} ${group} - -"
+    ];
+
+    # Enable NGINX to access our phpfpm-socket.
+    users.users."${config.services.nginx.group}".extraGroups = [ cfg.group ];
+    services.nginx = mkIf (cfg.nginx != null) {
+      enable = true;
+      virtualHosts."${cfg.domain}" = mkMerge [
+        cfg.nginx
+        {
+          root = lib.mkForce "${pixelfed}/public/";
+          locations."/".tryFiles = "$uri $uri/ /index.php?query_string";
+          locations."/favicon.ico".extraConfig = ''
+            access_log off; log_not_found off;
+          '';
+          locations."/robots.txt".extraConfig = ''
+            access_log off; log_not_found off;
+          '';
+          locations."~ \\.php$".extraConfig = ''
+            fastcgi_split_path_info ^(.+\.php)(/.+)$;
+            fastcgi_pass unix:${config.services.phpfpm.pools.pixelfed.socket};
+            fastcgi_index index.php;
+          '';
+          locations."~ /\\.(?!well-known).*".extraConfig = ''
+            deny all;
+          '';
+          extraConfig = ''
+            add_header X-Frame-Options "SAMEORIGIN";
+            add_header X-XSS-Protection "1; mode=block";
+            add_header X-Content-Type-Options "nosniff";
+            index index.html index.htm index.php;
+            error_page 404 /index.php;
+            client_max_body_size ${toString cfg.maxUploadSize};
+          '';
+        }
+      ];
+    };
+  };
+}
--- a/nixos/modules/services/web-apps/wiki-js.nix
+++ b/nixos/modules/services/web-apps/wiki-js.nix
@ -133,7 +133,7 @@ in {
        WorkingDirectory = "/var/lib/${cfg.stateDirectoryName}";
        DynamicUser = true;
        PrivateTmp = true;
-        ExecStart = "${pkgs.nodejs_16}/bin/node ${pkgs.wiki-js}/server";
+        ExecStart = "${pkgs.nodejs_18}/bin/node ${pkgs.wiki-js}/server";
      };
    };
  };
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -293,6 +293,9 @@ checkFS() {
    # Skip fsck for inherently readonly filesystems.
    if [ "$fsType" = squashfs ]; then return 0; fi

+    # Skip fsck.erofs because it is still experimental.
+    if [ "$fsType" = erofs ]; then return 0; fi
+
    # If we couldn't figure out the FS type, then skip fsck.
    if [ "$fsType" = auto ]; then
        echo 'cannot check filesystem with type "auto"!'
--- a/nixos/modules/tasks/filesystems/erofs.nix
+++ b/nixos/modules/tasks/filesystems/erofs.nix
@ -0,0 +1,21 @@
+{ config, lib, pkgs, ... }:
+
+let
+
+  inInitrd = lib.any (fs: fs == "erofs") config.boot.initrd.supportedFilesystems;
+  inSystem = lib.any (fs: fs == "erofs") config.boot.supportedFilesystems;
+
+in
+
+{
+  config = lib.mkIf (inInitrd || inSystem) {
+
+    system.fsPackages = [ pkgs.erofs-utils ];
+
+    boot.initrd.availableKernelModules = lib.mkIf inInitrd [ "erofs" ];
+
+    # fsck.erofs is currently experimental and should not be run as a
+    # privileged user. Thus, it is not included in the initrd.
+
+  };
+}
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@ -515,6 +515,10 @@ in
                    in [ extraConfig ] ++ (map (x: x.value) defs);
                  prefix = [ "containers" name ];
                  inherit (config) specialArgs;
+
+                  # The system is inherited from the host above.
+                  # Set it to null, to remove the "legacy" entrypoint's non-hermetic default.
+                  system = null;
                }).config;
              };
            };
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -432,6 +432,7 @@ in {
  man = handleTest ./man.nix {};
  mariadb-galera = handleTest ./mysql/mariadb-galera.nix {};
  mastodon = discoverTests (import ./web-apps/mastodon { inherit handleTestOn; });
+  pixelfed = discoverTests (import ./web-apps/pixelfed { inherit handleTestOn; });
  mate = handleTest ./mate.nix {};
  matomo = handleTest ./matomo.nix {};
  matrix-appservice-irc = handleTest ./matrix/appservice-irc.nix {};
@ -688,6 +689,7 @@ in {
  sudo = handleTest ./sudo.nix {};
  swap-file-btrfs = handleTest ./swap-file-btrfs.nix {};
  swap-partition = handleTest ./swap-partition.nix {};
+  swap-random-encryption = handleTest ./swap-random-encryption.nix {};
  sway = handleTest ./sway.nix {};
  switchTest = handleTest ./switch-test.nix {};
  sympa = handleTest ./sympa.nix {};
--- a/nixos/tests/containers-imperative.nix
+++ b/nixos/tests/containers-imperative.nix
@ -25,6 +25,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
              system.stateVersion = "18.03";
            };
          };
+
+          # The system is inherited from the host above.
+          # Set it to null, to remove the "legacy" entrypoint's non-hermetic default.
+          system = null;
        };
      in with pkgs; [
        stdenv stdenvNoCC emptyContainer.config.containers.foo.path
--- a/nixos/tests/nfs/simple.nix
+++ b/nixos/tests/nfs/simple.nix
@ -89,6 +89,7 @@ in
          t1 = time.monotonic()
          client1.shutdown()
          duration = time.monotonic() - t1
-          assert duration < 30, f"shutdown took too long ({duration} seconds)"
+          # FIXME: regressed in kernel 6.1.28, temporarily disabled while investigating
+          # assert duration < 30, f"shutdown took too long ({duration} seconds)"
    '';
 })
--- a/nixos/tests/non-default-filesystems.nix
+++ b/nixos/tests/non-default-filesystems.nix
@ -1,55 +1,106 @@
-import ./make-test-python.nix ({ lib, pkgs, ... }:
+{ system ? builtins.currentSystem
+, config ? { }
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
 {
-  name = "non-default-filesystems";
-
-  nodes.machine =
-    { config, pkgs, lib, ... }:
-    let
-      disk = config.virtualisation.rootDevice;
-    in
+  btrfs = makeTest
    {
-      virtualisation.rootDevice = "/dev/vda";
-      virtualisation.useDefaultFilesystems = false;
+      name = "non-default-filesystems-btrfs";

-      boot.initrd.availableKernelModules = [ "btrfs" ];
-      boot.supportedFilesystems = [ "btrfs" ];
+      nodes.machine =
+        { config, pkgs, lib, ... }:
+        let
+          disk = config.virtualisation.rootDevice;
+        in
+        {
+          virtualisation.rootDevice = "/dev/vda";
+          virtualisation.useDefaultFilesystems = false;

-      boot.initrd.postDeviceCommands = ''
-        FSTYPE=$(blkid -o value -s TYPE ${disk} || true)
-        if test -z "$FSTYPE"; then
-          modprobe btrfs
-          ${pkgs.btrfs-progs}/bin/mkfs.btrfs ${disk}
+          boot.initrd.availableKernelModules = [ "btrfs" ];
+          boot.supportedFilesystems = [ "btrfs" ];

-          mkdir /nixos
-          mount -t btrfs ${disk} /nixos
+          boot.initrd.postDeviceCommands = ''
+            FSTYPE=$(blkid -o value -s TYPE ${disk} || true)
+            if test -z "$FSTYPE"; then
+              modprobe btrfs
+              ${pkgs.btrfs-progs}/bin/mkfs.btrfs ${disk}

-          ${pkgs.btrfs-progs}/bin/btrfs subvolume create /nixos/root
-          ${pkgs.btrfs-progs}/bin/btrfs subvolume create /nixos/home
+              mkdir /nixos
+              mount -t btrfs ${disk} /nixos

-          umount /nixos
-        fi
+              ${pkgs.btrfs-progs}/bin/btrfs subvolume create /nixos/root
+              ${pkgs.btrfs-progs}/bin/btrfs subvolume create /nixos/home
+
+              umount /nixos
+            fi
+          '';
+
+          virtualisation.fileSystems = {
+            "/" = {
+              device = disk;
+              fsType = "btrfs";
+              options = [ "subvol=/root" ];
+            };
+
+            "/home" = {
+              device = disk;
+              fsType = "btrfs";
+              options = [ "subvol=/home" ];
+            };
+          };
+        };
+
+      testScript = ''
+        machine.wait_for_unit("multi-user.target")
+
+        with subtest("BTRFS filesystems are mounted correctly"):
+          machine.succeed("grep -E '/dev/vda / btrfs rw,relatime,space_cache=v2,subvolid=[0-9]+,subvol=/root 0 0' /proc/mounts")
+          machine.succeed("grep -E '/dev/vda /home btrfs rw,relatime,space_cache=v2,subvolid=[0-9]+,subvol=/home 0 0' /proc/mounts")
      '';
-
-      virtualisation.fileSystems = {
-        "/" = {
-          device = disk;
-          fsType = "btrfs";
-          options = [ "subvol=/root" ];
-        };
-
-        "/home" = {
-          device = disk;
-          fsType = "btrfs";
-          options = [ "subvol=/home" ];
-        };
-      };
    };

-  testScript = ''
-    machine.wait_for_unit("multi-user.target")
+  erofs =
+    let
+      fsImage = "/tmp/non-default-filesystem.img";
+    in
+    makeTest {
+      name = "non-default-filesystems-erofs";

-    with subtest("BTRFS filesystems are mounted correctly"):
-      machine.succeed("grep -E '/dev/vda / btrfs rw,relatime,space_cache=v2,subvolid=[0-9]+,subvol=/root 0 0' /proc/mounts")
-      machine.succeed("grep -E '/dev/vda /home btrfs rw,relatime,space_cache=v2,subvolid=[0-9]+,subvol=/home 0 0' /proc/mounts")
-  '';
-})
+      nodes.machine = _: {
+        virtualisation.qemu.drives = [{
+          name = "non-default-filesystem";
+          file = fsImage;
+        }];
+
+        virtualisation.fileSystems."/non-default" = {
+          device = "/dev/vdb";
+          fsType = "erofs";
+          neededForBoot = true;
+        };
+      };
+
+      testScript = ''
+        import subprocess
+        import tempfile
+
+        with tempfile.TemporaryDirectory() as tmp_dir:
+          with open(f"{tmp_dir}/filesystem", "w") as f:
+              f.write("erofs")
+
+          subprocess.run([
+            "${pkgs.erofs-utils}/bin/mkfs.erofs",
+            "${fsImage}",
+            tmp_dir,
+          ])
+
+        machine.start()
+        machine.wait_for_unit("default.target")
+
+        file_contents = machine.succeed("cat /non-default/filesystem")
+        assert "erofs" in file_contents
+      '';
+    };
+}
--- a/nixos/tests/nzbget.nix
+++ b/nixos/tests/nzbget.nix
@ -35,7 +35,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
        "${pkgs.nzbget}/bin/nzbget -n -o Control_iP=127.0.0.1 -o Control_port=6789 -o Control_password=tegbzn6789 -V"
    )

-    config = server.succeed("${nodes.server.config.systemd.services.nzbget.serviceConfig.ExecStart} --printconfig")
+    config = server.succeed("${nodes.server.systemd.services.nzbget.serviceConfig.ExecStart} --printconfig")

    # confirm the test settings are applied
    assert 'MainDir = "/var/lib/nzbget"' in config
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -1396,7 +1396,10 @@ let
      '';
    };

-    wireguard = let snakeoil = import ./wireguard/snakeoil-keys.nix; in
+    wireguard = let
+      snakeoil = import ./wireguard/snakeoil-keys.nix;
+      publicKeyWithoutNewlines = replaceStrings [ "\n" ] [ "" ] snakeoil.peer1.publicKey;
+    in
      {
        exporterConfig.enable = true;
        metricProvider = {
@ -1418,7 +1421,7 @@ let
          wait_for_unit("prometheus-wireguard-exporter.service")
          wait_for_open_port(9586)
          wait_until_succeeds(
-              "curl -sSf http://localhost:9586/metrics | grep '${snakeoil.peer1.publicKey}'"
+              "curl -sSf http://localhost:9586/metrics | grep '${publicKeyWithoutNewlines}'"
          )
        '';
      };
--- a/nixos/tests/swap-random-encryption.nix
+++ b/nixos/tests/swap-random-encryption.nix
@ -0,0 +1,80 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }:
+{
+  name = "swap-random-encryption";
+
+  nodes.machine =
+    { config, pkgs, lib, ... }:
+    {
+      environment.systemPackages = [ pkgs.cryptsetup ];
+
+      virtualisation.useDefaultFilesystems = false;
+
+      virtualisation.rootDevice = "/dev/vda1";
+
+      boot.initrd.postDeviceCommands = ''
+        if ! test -b /dev/vda1; then
+          ${pkgs.parted}/bin/parted --script /dev/vda -- mklabel msdos
+          ${pkgs.parted}/bin/parted --script /dev/vda -- mkpart primary 1MiB -250MiB
+          ${pkgs.parted}/bin/parted --script /dev/vda -- mkpart primary -250MiB 100%
+          sync
+        fi
+
+        FSTYPE=$(blkid -o value -s TYPE /dev/vda1 || true)
+        if test -z "$FSTYPE"; then
+          ${pkgs.e2fsprogs}/bin/mke2fs -t ext4 -L root /dev/vda1
+        fi
+      '';
+
+      virtualisation.fileSystems = {
+        "/" = {
+          device = "/dev/disk/by-label/root";
+          fsType = "ext4";
+        };
+      };
+
+      swapDevices = [
+        {
+          device = "/dev/vda2";
+
+          randomEncryption = {
+            enable = true;
+            cipher = "aes-xts-plain64";
+            keySize = 512;
+            sectorSize = 4096;
+          };
+        }
+      ];
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("Swap is active"):
+      # Doesn't matter if the numbers reported by `free` are slightly off due to unit conversions.
+      machine.succeed("free -h | grep -E 'Swap:\s+2[45][0-9]Mi'")
+
+    with subtest("Swap device has 4k sector size"):
+      import json
+      result = json.loads(machine.succeed("lsblk -Jo PHY-SEC,LOG-SEC /dev/mapper/dev-vda2"))
+      block_devices = result["blockdevices"]
+      if len(block_devices) != 1:
+        raise Exception ("lsblk output did not report exactly one block device")
+
+      swapDevice = block_devices[0];
+      if not (swapDevice["phy-sec"] == 4096 and swapDevice["log-sec"] == 4096):
+        raise Exception ("swap device does not have the sector size specified in the configuration")
+
+    with subtest("Swap encrypt has assigned cipher and keysize"):
+      import re
+
+      results = machine.succeed("cryptsetup status dev-vda2").splitlines()
+
+      cipher_pattern = re.compile(r"\s*cipher:\s+aes-xts-plain64\s*")
+      if not any(cipher_pattern.fullmatch(line) for line in results):
+        raise Exception ("swap device encryption does not use the cipher specified in the configuration")
+
+      key_size_pattern = re.compile(r"\s*keysize:\s+512\s+bits\s*")
+      if not any(key_size_pattern.fullmatch(line) for line in results):
+        raise Exception ("swap device encryption does not use the key size specified in the configuration")
+  '';
+})
--- a/nixos/tests/web-apps/pixelfed/default.nix
+++ b/nixos/tests/web-apps/pixelfed/default.nix
@ -0,0 +1,8 @@
+{ system ? builtins.currentSystem, handleTestOn }:
+let
+  supportedSystems = [ "x86_64-linux" "i686-linux" ];
+
+in
+{
+  standard = handleTestOn supportedSystems ./standard.nix { inherit system; };
+}
--- a/nixos/tests/web-apps/pixelfed/standard.nix
+++ b/nixos/tests/web-apps/pixelfed/standard.nix
@ -0,0 +1,38 @@
+import ../../make-test-python.nix ({pkgs, ...}:
+{
+  name = "pixelfed-standard";
+  meta.maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
+
+  nodes = {
+    server = { pkgs, ... }: {
+      services.pixelfed = {
+        enable = true;
+        domain = "pixelfed.local";
+        # Configure NGINX.
+        nginx = {};
+        secretFile = (pkgs.writeText "secrets.env" ''
+          # Snakeoil secret, can be any random 32-chars secret via CSPRNG.
+          APP_KEY=adKK9EcY8Hcj3PLU7rzG9rJ6KKTOtYfA
+        '');
+        settings."FORCE_HTTPS_URLS" = false;
+      };
+    };
+  };
+
+  testScript = ''
+    # Wait for Pixelfed PHP pool
+    server.wait_for_unit("phpfpm-pixelfed.service")
+    # Wait for NGINX
+    server.wait_for_unit("nginx.service")
+    # Wait for HTTP port
+    server.wait_for_open_port(80)
+    # Access the homepage.
+    server.succeed("curl -H 'Host: pixelfed.local' http://localhost")
+    # Create an account
+    server.succeed("pixelfed-manage user:create --name=test --username=test --email=test@test.com --password=test")
+    # Create a OAuth token.
+    # TODO: figure out how to use it to send a image/toot
+    # server.succeed("pixelfed-manage passport:client --personal")
+    # server.succeed("curl -H 'Host: pixefed.local' -H 'Accept: application/json' -H 'Authorization: Bearer secret' -F'status'='test' http://localhost/api/v1/statuses")
+  '';
+})
--- a/pkgs/applications/audio/giada/default.nix
+++ b/pkgs/applications/audio/giada/default.nix
@ -1,35 +1,49 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , pkg-config
 , fltk
+, fmt
 , rtmidi
 , libsamplerate
+, libmpg123
 , libsndfile
 , jack2
 , alsa-lib
 , libpulseaudio
 , libXpm
+, libXrandr
 , flac
 , libogg
 , libvorbis
 , libopus
+, nlohmann_json
 }:

 stdenv.mkDerivation rec {
  pname = "giada";
-  version = "unstable-2021-09-24";
+  version = "0.24.0";

  src = fetchFromGitHub {
    owner = "monocasual";
    repo = pname;
-    # Using master with https://github.com/monocasual/giada/pull/509 till a new release is done.
-    rev = "f117a8b8eef08d904ef1ab22c45f0e1fad6b8a56";
-    sha256 = "01hb981lrsyk870zs8xph5fm0z7bbffpkxgw04hq487r804mkx9j";
+    rev = "v${version}";
+    sha256 = "sha256-pKzc+RRW3o5vYaiGqW9/VjYZZJvr6cg1kdjP9qRkHwM=";
    fetchSubmodules = true;
  };

+  patches = [
+    # Remove when updating to the next release, this PR is already merged
+    # Fix fmt type error: https://github.com/monocasual/giada/pull/635
+    (fetchpatch {
+      name = "fix-fmt-type-error.patch";
+      url = "https://github.com/monocasual/giada/commit/032af4334f6d2bb7e77a49e7aef5b4c4d696df9a.patch";
+      hash = "sha256-QuxETvBWzA1v2ifyNzlNMGfQ6XhYQF03sGZA9rBx1xU=";
+    })
+  ];
+
  env.NIX_CFLAGS_COMPILE = toString [
    "-w"
    "-Wno-error"
@ -48,8 +62,11 @@ stdenv.mkDerivation rec {
  buildInputs = [
    rtmidi
    fltk
+    fmt
+    libmpg123
    libsndfile
    libsamplerate
+    nlohmann_json
    alsa-lib
    libXpm
    libpulseaudio
@ -58,20 +75,9 @@ stdenv.mkDerivation rec {
    libogg
    libvorbis
    libopus
+    libXrandr
  ];

-  postPatch = ''
-    local fixup_list=(
-      src/core/kernelMidi.cpp
-      src/gui/elems/config/tabMidi.cpp
-      src/utils/ver.cpp
-    )
-    for f in "''${fixup_list[@]}"; do
-      substituteInPlace "$f" \
-        --replace "<RtMidi.h>" "<${rtmidi.src}/RtMidi.h>"
-    done
-  '';
-
  meta = with lib; {
    description = "A free, minimal, hardcore audio tool for DJs, live performers and electronic musicians";
    homepage = "https://giadamusic.com/";
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@ -6,13 +6,13 @@

 buildDotnetModule rec {
  pname = "btcpayserver";
-  version = "1.9.2";
+  version = "1.9.3";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-N/6/a9K8ROSJ+rsip85Av1jmggI12Clr61+9Dh56Lls=";
+    sha256 = "sha256-XcpPdlDpY/RXOK8ykZ/UUVOok2Pz3vObdp4zhy9tt7w=";
  };

  projectFile = "BTCPayServer/BTCPayServer.csproj";
--- a/pkgs/applications/blockchains/clightning/default.nix
+++ b/pkgs/applications/blockchains/clightning/default.nix
@ -22,11 +22,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "clightning";
-  version = "23.02.2";
+  version = "23.05";

  src = fetchurl {
    url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    sha256 = "sha256-fHGBwf79Q0DSLs/b+Lhg9kdIQzDn5rJYEB9yLkLbxlE=";
+    sha256 = "sha256-6QbgK16godxnpIBHpykbblS10JAFZvxSeEpwnmdTrAo=";
  };

  # when building on darwin we need dawin.cctools to provide the correct libtool
--- a/pkgs/applications/blockchains/framesh/default.nix
+++ b/pkgs/applications/blockchains/framesh/default.nix
@ -2,10 +2,10 @@

 let
  pname = "framesh";
-  version = "0.6.2";
+  version = "0.6.6";
  src = fetchurl {
    url = "https://github.com/floating/frame/releases/download/v${version}/Frame-${version}.AppImage";
-    sha256 = "sha256-nN5+6SwfHcwhePlbsXjT3qNd/d6Xqnd85NVC8vw3ehk=";
+    sha256 = "sha256-5LLnITQP9m2lMdnB/rrK/M+p3AA3rYZ9GOrDdCFA/r4=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cudatext";
-  version = "1.193.3";
+  version = "1.194.0";

  src = fetchFromGitHub {
    owner = "Alexey-T";
    repo = "CudaText";
    rev = version;
-    hash = "sha256-zkSdMXIfUT+QfRi7CT3JlVLAvtLGbOGAaQkYNMAIZeI=";
+    hash = "sha256-+zdboXU4Tg6RLRVwjS2FQGLfYZu/A09eoZUrYX4SK0o=";
  };

  postPatch = ''
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@ -16,13 +16,13 @@
  },
  "ATSynEdit": {
    "owner": "Alexey-T",
-    "rev": "2023.05.07",
-    "hash": "sha256-ZdN+dUmM8DQ7nz0LqcCQt8ZoJH1wrhYRa+h0xj5F6PY="
+    "rev": "2023.05.13",
+    "hash": "sha256-GP7qzCfL8KNXF/CvoeJshA3YbNE5+wuZ2VYn8hLEPlo="
  },
  "ATSynEdit_Cmp": {
    "owner": "Alexey-T",
-    "rev": "2023.05.02",
-    "hash": "sha256-bPib2pJqxb+m9eMGerClj1bvAoHcGH2OTmmKon6UQfo="
+    "rev": "2023.05.12",
+    "hash": "sha256-/BAWc5RR7hZCNjyuLqiq9OdJxvRqliMWiC7o0tCtELY="
  },
  "EControl": {
    "owner": "Alexey-T",
@ -31,8 +31,8 @@
  },
  "ATSynEdit_Ex": {
    "owner": "Alexey-T",
-    "rev": "2023.05.02",
-    "hash": "sha256-EKJnkwQ7QTUTVaXOA1pi5YUHxaA/hu4qpgpHHaON61k="
+    "rev": "2023.05.12",
+    "hash": "sha256-Y+F/pdPzmXqqCqB0TCOboA4md/2QMHhzlVxR5NJF3+0="
  },
  "Python-for-Lazarus": {
    "owner": "Alexey-T",
--- a/pkgs/applications/emulators/craftos-pc/default.nix
+++ b/pkgs/applications/emulators/craftos-pc/default.nix
@ -14,18 +14,18 @@
 }:

 let
-  version = "2.7.3";
+  version = "2.7.4";
  craftos2-lua = fetchFromGitHub {
    owner = "MCJack123";
    repo = "craftos2-lua";
    rev = "v${version}";
-    sha256 = "sha256-lMqYfSA3sI7+glRE+eUf03uLfbf7lipmoqgt74FUaJQ=";
+    sha256 = "sha256-JMBsSoO/yTLw7K1Ri3BzKr5bz5UirXiPr/Q0YoMumhY=";
  };
  craftos2-rom = fetchFromGitHub {
    owner = "McJack123";
    repo = "craftos2-rom";
    rev = "v${version}";
-    sha256 = "sha256-t76Yltx7vHNoAAFvNpYLKuwFja4On6M20upmG6w3C1M=";
+    sha256 = "sha256-BXTsBMlsymQHABWQCiv22Ia5jm2xv1jNy7Unwymtyp0=";
  };
 in

@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
    owner = "MCJack123";
    repo = "craftos2";
    rev = "v${version}";
-    sha256 = "sha256-a7oMLfjZUkEWPjxDDywlSW4qLhcQrCXPPY2BEOgiafU=";
+    sha256 = "sha256-Vb6mvim42Kvn7A3Qsp4gvTRBGQ5OJ9pVij96LZwWyuQ=";
  };

  buildInputs = [ patchelf poco openssl SDL2 SDL2_mixer ncurses libpng pngpp libwebp ];
--- a/pkgs/applications/file-managers/nnn/default.nix
+++ b/pkgs/applications/file-managers/nnn/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , installShellFiles
 , makeWrapper
 , pkg-config
@ -9,15 +10,17 @@
 , readline
 , which
 , musl-fts
-# options
+  # options
 , conf ? null
 , withIcons ? false
 , withNerdIcons ? false
+, withEmojis ? false
 }:

 # Mutually exclusive options
-assert withIcons -> withNerdIcons == false;
-assert withNerdIcons -> withIcons == false;
+assert withIcons -> (withNerdIcons == false && withEmojis == false);
+assert withNerdIcons -> (withIcons == false && withEmojis == false);
+assert withEmojis -> (withIcons == false && withNerdIcons == false);

 stdenv.mkDerivation (finalAttrs: {
  pname = "nnn";
@ -30,6 +33,14 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-QbKW2wjhUNej3zoX18LdeUHqjNLYhEKyvPH2MXzp/iQ=";
  };

+  patches = [
+    # FIXME: remove for next release
+    (fetchpatch {
+      url = "https://github.com/jarun/nnn/commit/20e944f5e597239ed491c213a634eef3d5be735e.patch";
+      hash = "sha256-RxG3AU8i3lRPCjRVZPnej4m1No/SKtsHwbghj9JQ7RQ=";
+    })
+  ];
+
  configFile = lib.optionalString (conf != null) (builtins.toFile "nnn.h" conf);
  preBuild = lib.optionalString (conf != null) "cp ${finalAttrs.configFile} src/nnn.h";

@ -41,10 +52,13 @@ stdenv.mkDerivation (finalAttrs: {

  makeFlags = [ "PREFIX=$(out)" ]
    ++ lib.optionals withIcons [ "O_ICONS=1" ]
-    ++ lib.optionals withNerdIcons [ "O_NERD=1" ];
+    ++ lib.optionals withNerdIcons [ "O_NERD=1" ]
+    ++ lib.optionals withEmojis [ "O_EMOJI=1" ];

  binPath = lib.makeBinPath [ file which ];

+  installTargets = [ "install" "install-desktop" ];
+
  postInstall = ''
    installShellCompletion --bash --name nnn.bash misc/auto-completion/bash/nnn-completion.bash
    installShellCompletion --fish misc/auto-completion/fish/nnn.fish
--- a/pkgs/applications/misc/klipperscreen/default.nix
+++ b/pkgs/applications/misc/klipperscreen/default.nix
@ -0,0 +1,28 @@
+{ lib, stdenv, writeText, python3Packages, fetchFromGitHub, gtk3, gobject-introspection, gdk-pixbuf, wrapGAppsHook, librsvg }:
+python3Packages.buildPythonPackage rec {
+  pname = "KlipperScreen";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "jordanruthe";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-LweO5EVWr3OxziHrjtQDdWyUBCVUJ17afkw7RCZWgcg=";
+  };
+  patches = [ ./fix-paths.diff ];
+
+  buildInputs = [ gtk3 librsvg ];
+  nativeBuildInputs = [ wrapGAppsHook gdk-pixbuf gobject-introspection ];
+
+  propagatedBuildInputs = with python3Packages; [ jinja2 netifaces requests websocket-client pycairo pygobject3 mpv six dbus-python numpy pycairo ];
+
+  preBuild = ''
+    ln -s ${./setup.py} setup.py
+  '';
+
+  meta = with lib; {
+    description = "Touchscreen GUI for the Klipper 3D printer firmware";
+    homepage = "https://github.com/jordanruthe/${pname}";
+    license = licenses.agpl3;
+  };
+}
--- a/pkgs/applications/misc/klipperscreen/fix-paths.diff
+++ b/pkgs/applications/misc/klipperscreen/fix-paths.diff
@ -0,0 +1,22 @@
+diff --git a/screen.py b/screen.py
+index 4fd75cd..a10779a 100755
+--- a/screen.py
+++ b/screen.py
+@@ -48,7 +48,7 @@ PRINTER_BASE_STATUS_OBJECTS = [
+     'exclude_object',
+ ]
+ 
+-klipperscreendir = pathlib.Path(__file__).parent.resolve()
+klipperscreendir = pathlib.Path(functions.__file__).parent.parent.resolve()
+ 
+ 
+ def set_text_direction(lang=None):
+@@ -254,7 +254,7 @@ class KlipperScreen(Gtk.Window):
+     def _load_panel(self, panel, *args):
+         if panel not in self.load_panel:
+             logging.debug(f"Loading panel: {panel}")
+-            panel_path = os.path.join(os.path.dirname(__file__), 'panels', f"{panel}.py")
+            panel_path = os.path.join(klipperscreendir, 'panels', f"{panel}.py")
+             logging.info(f"Panel path: {panel_path}")
+             if not os.path.exists(panel_path):
+                 logging.error(f"Panel {panel} does not exist")
--- a/pkgs/applications/misc/klipperscreen/setup.py
+++ b/pkgs/applications/misc/klipperscreen/setup.py
@ -0,0 +1,11 @@
+from setuptools import setup
+
+setup(
+  name='KlipperScreen',
+  install_requires=[],
+  packages=['styles', 'panels', 'ks_includes', 'ks_includes.widgets'],
+  package_data={'ks_includes': ['defaults.conf', 'locales/**', 'emptyCursor.xbm'], 'styles': ['**']},
+  entry_points={
+      'console_scripts': ['KlipperScreen=screen:main']
+  },
+)
--- a/pkgs/applications/misc/koreader/default.nix
+++ b/pkgs/applications/misc/koreader/default.nix
@ -1,24 +1,33 @@
 { lib, stdenv
 , fetchurl
 , makeWrapper
+, fetchFromGitHub
 , dpkg
 , glib
 , gnutar
 , gtk3-x11
 , luajit
 , sdcv
-, SDL2
-, noto-fonts
-, nerdfonts }:
-let font-droid = nerdfonts.override { fonts = [ "DroidSansMono" ]; };
-in stdenv.mkDerivation rec {
+, SDL2 }:
+let
+  luajit_lua52 = luajit.override { enable52Compat = true; };
+in
+stdenv.mkDerivation rec {
  pname = "koreader";
-  version = "2022.08";
+  version = "2023.04";

  src = fetchurl {
    url =
      "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
-    sha256 = "sha256-+JBJNJTAnC5gpuo8cehfe/3YwGIW5iFA8bZ8nfz9qsk=";
+    sha256 = "sha256-tRUeRB1+UcWT49dchN0YDvd0L5n1YRdtMSFc8yy6m5o=";
+  };
+
+  src_repo = fetchFromGitHub {
+    repo = "koreader";
+    owner = "koreader";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-c3j6hs0W0H2jDg6JVfU6ov7r7kucbqrQqf9PAvYBcJ0=";
  };

  sourceRoot = ".";
@ -27,7 +36,7 @@ in stdenv.mkDerivation rec {
    glib
    gnutar
    gtk3-x11
-    luajit
+    luajit_lua52
    sdcv
    SDL2
  ];
@ -39,14 +48,11 @@ in stdenv.mkDerivation rec {
  installPhase = ''
    mkdir -p $out
    cp -R usr/* $out/
-    ln -sf ${luajit}/bin/luajit $out/lib/koreader/luajit
+    ln -sf ${luajit_lua52}/bin/luajit $out/lib/koreader/luajit
    ln -sf ${sdcv}/bin/sdcv $out/lib/koreader/sdcv
    ln -sf ${gnutar}/bin/tar $out/lib/koreader/tar
-    find $out -xtype l -delete
-    for i in ${noto-fonts}/share/fonts/truetype/noto/*; do
-        ln -s "$i" $out/lib/koreader/fonts/noto/
-    done
-    ln -s "${font-droid}/share/fonts/opentype/NerdFonts/Droid Sans Mono Nerd Font Complete Mono.otf" $out/lib/koreader/fonts/droid/DroidSansMono.ttf
+    find ${src_repo}/resources/fonts -type d -execdir cp -r '{}' $out/lib/koreader/fonts \;
+    find $out -xtype l -print -delete
    wrapProgram $out/bin/koreader --prefix LD_LIBRARY_PATH : ${
      lib.makeLibraryPath [ gtk3-x11 SDL2 glib ]
    }
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "logseq";
-  version = "0.9.4";
+  version = "0.9.6";

  src = fetchurl {
    url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    hash = "sha256-K04iIa/WnRtcHwRUHJbKqXO9c4l5xwHPvnwN5WX/Row=";
+    hash = "sha256-YC6oUKD48mKlX/bHWPMKm+0Ub0/5dnXmBFnVIGqzb/g=";
    name = "${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/misc/resumed/default.nix
+++ b/pkgs/applications/misc/resumed/default.nix
@ -0,0 +1,22 @@
+{ lib, buildNpmPackage, fetchFromGitHub }:
+
+buildNpmPackage rec {
+  pname = "resumed";
+  version = "3.0.1";
+
+  src = fetchFromGitHub {
+    owner = "rbardini";
+    repo = "resumed";
+    rev = "v${version}";
+    hash = "sha256-X1efWl0CjbEbhNfDUNvb5SCc2exfI8v95gzqcaKU5eU=";
+  };
+
+  npmDepsHash = "sha256-b8NeO0w2UH1wEifDCkl8L48LoJM0jLStE0fO9G438dU=";
+
+  meta = with lib; {
+    description = "Lightweight JSON Resume builder, no-frills alternative to resume-cli";
+    homepage = "https://github.com/rbardini/resumed";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ambroisie ];
+  };
+}
--- a/pkgs/applications/misc/taizen/Cargo.lock
+++ b/pkgs/applications/misc/taizen/Cargo.lock
--- a/pkgs/applications/misc/taizen/default.nix
+++ b/pkgs/applications/misc/taizen/default.nix
@ -1,25 +1,46 @@
-{ rustPlatform, lib, fetchFromGitHub, ncurses, openssl, pkg-config, Security, stdenv }:
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, ncurses
+, openssl
+, stdenv
+, darwin
+}:

 rustPlatform.buildRustPackage rec {
  pname = "taizen";
-  version = "0.1.0";
+  version = "unstable-2020-05-02";

  src = fetchFromGitHub {
    owner = "NerdyPepper";
    repo = pname;
-    rev = "5c1876429e2da7424e9d31b1e16f5a3147cc58d0";
-    sha256 = "09izgx7icvizskdy9kplk0am61p7550fsd0v42zcihq2vap2j92z";
+    rev = "5e88a55abaa2bf4356aa5bc783c2957e59c63216";
+    sha256 = "sha256-cMykIh5EDGYZMJ5EPTU6G8YDXxfUzzfRfEICWmDUdrA=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
  };

-  buildInputs = [ ncurses openssl ] ++ lib.optional stdenv.isDarwin Security;
  nativeBuildInputs = [ pkg-config ];

-  cargoSha256 = "1yqy5v02a4qshgb7k8rnn408k3n6qx3jc8zziwvv7im61n9sjynf";
+  buildInputs = [
+    ncurses
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  # update Cargo.lock to work with openssl 3
+  postPatch = ''
+    ln -sf ${./Cargo.lock} Cargo.lock
+  '';

  meta = with lib; {
-    homepage = "https://crates.io/crates/taizen";
-    license = licenses.mit;
    description = "curses based mediawiki browser";
-    maintainers = with maintainers; [ ];
+    homepage = "https://github.com/nerdypepper/taizen";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
  };
 }
--- a/pkgs/applications/misc/tickrs/default.nix
+++ b/pkgs/applications/misc/tickrs/default.nix
@ -1,4 +1,12 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, perl, Security }:
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, zlib
+, stdenv
+, darwin
+}:

 rustPlatform.buildRustPackage rec {
  pname = "tickrs";
@ -13,9 +21,20 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-fOYxOiVpgflwIz9Z6ePhQKDa7DX4D/ZCnPOwq9vWOSk=";

-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [
+    pkg-config
+  ];

-  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = [
+    openssl
+    zlib
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  env = {
+    OPENSSL_NO_VENDOR = true;
+  };

  meta = with lib; {
    description = "Realtime ticker data in your terminal";
--- a/pkgs/applications/misc/topydo/default.nix
+++ b/pkgs/applications/misc/topydo/default.nix
@ -1,28 +1,38 @@
-{ lib, python3Packages, fetchFromGitHub, glibcLocales }:
+{ lib, python3, fetchFromGitHub, fetchpatch, glibcLocales }:

-with python3Packages;
-
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "topydo";
  version = "0.14";

  src = fetchFromGitHub {
-    owner = "bram85";
+    owner = "topydo";
    repo = pname;
    rev = version;
    sha256 = "1lpfdai0pf90ffrzgmmkadbd86rb7250i3mglpkc82aj6prjm6yb";
  };

-  propagatedBuildInputs = [
+  patches = [
+    # fixes a failing test
+    (fetchpatch {
+      name = "update-a-test-reference-ics-file.patch";
+      url = "https://github.com/topydo/topydo/commit/9373bb4702b512b10f0357df3576c129901e3ac6.patch";
+      hash = "sha256-JpyQfryWSoJDdyzbrESWY+RmRbDw1myvTlsFK7+39iw=";
+    })
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
    arrow
-    icalendar
    glibcLocales
+    icalendar
    prompt-toolkit
    urwid
    watchdog
  ];

-  nativeCheckInputs = [ unittestCheckHook mock freezegun pylint ];
+  nativeCheckInputs = with python3.pkgs; [
+    freezegun
+    unittestCheckHook
+  ];

  # Skip test that has been reported multiple times upstream without result:
  # bram85/topydo#271, bram85/topydo#274.
@ -34,7 +44,9 @@ buildPythonApplication rec {

  meta = with lib; {
    description = "A cli todo application compatible with the todo.txt format";
-    homepage = "https://github.com/bram85/topydo";
-    license = licenses.gpl3;
+    homepage = "https://github.com/topydo/topydo";
+    changelog = "https://github.com/topydo/topydo/blob/${src.rev}/CHANGES.md";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/misc/wbg/default.nix
+++ b/pkgs/applications/misc/wbg/default.nix
@ -11,21 +11,23 @@
 , wayland-protocols
 , enablePNG ? true
 , enableJPEG ? true
+, enableWebp ? true
 # Optional dependencies
 , libpng
 , libjpeg
+, libwebp
 }:

 stdenv.mkDerivation rec {
  pname = "wbg";
-  version = "1.0.2";
+  version = "1.1.0";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "dnkl";
    repo = "wbg";
    rev = version;
-    sha256 = "sha256-PKEOWRcSAB4Uv5TfameQIEZh6s6xCGdyoZ13etL1TKA=";
+    sha256 = "sha256-JJIIqSc0qHgjtpGKai8p6vihXg16unsO7vW91pioAmc=";
  };

  nativeBuildInputs = [
@ -41,13 +43,15 @@ stdenv.mkDerivation rec {
    wayland
    wayland-protocols
  ] ++ lib.optional enablePNG libpng
-    ++ lib.optional enableJPEG libjpeg;
+    ++ lib.optional enableJPEG libjpeg
+    ++ lib.optional enableWebp libwebp;

  mesonBuildType = "release";

  mesonFlags = [
    (lib.mesonEnable "png" enablePNG)
    (lib.mesonEnable "jpeg" enableJPEG)
+    (lib.mesonEnable "webp" enableWebp)
  ];

  meta = with lib; {
--- a/pkgs/applications/networking/asn/default.nix
+++ b/pkgs/applications/networking/asn/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "asn";
-  version = "0.73.3";
+  version = "0.74";

  src = fetchFromGitHub {
    owner = "nitefood";
    repo = "asn";
    rev = "v${version}";
-    sha256 = "sha256-O0Iu+7UAAf+v0gZdGTdBpdn9BZ/9OqTAA/u0WDiz9s8=";
+    sha256 = "sha256-400I8aWQaPE7qCV/HqyPzuMmKpUyLc+RK7GCVgbt7JQ=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -19,9 +19,9 @@
    }
  },
  "beta": {
-    "version": "114.0.5735.16",
-    "sha256": "1pynbzbc8wwc6g8ikx0hr95ylncpdx97y27c6wmfygwgvp91a6wa",
-    "sha256bin64": "098aclrhifz6cpxcjdaqvi76j3g8r84p3b6cs4fbsj4cmczj4frw",
+    "version": "114.0.5735.26",
+    "sha256": "0v73vzgyg08683my0bc29nvbqqpq3zx9qdnxvdvp72rmyrbc5aiy",
+    "sha256bin64": "0viy4ibzh04vnkv111vcz4y0s7vg3f2470j2s1b4nzwxmqadxi3n",
    "deps": {
      "gn": {
        "version": "2023-04-19",
@ -32,15 +32,15 @@
    }
  },
  "dev": {
-    "version": "115.0.5750.0",
-    "sha256": "1y0yq7k5rcv4lfxdlr4psap4hxcnrwjps6vl42hwvpw6zxscw1lv",
-    "sha256bin64": "0h2d4csrznavalfnzvn59pc2jmj6ci1paslp7y2rlpv1jqjrpgq9",
+    "version": "115.0.5762.4",
+    "sha256": "0jlqnd4cmbm3c4xz6dcgs7p8clraldl7hncm4wc28yxv5bsxhyqi",
+    "sha256bin64": "1zcpzji22fpb04bfhqlp0wy3rnjk3ylfh39r1c2zgqks31n6niz6",
    "deps": {
      "gn": {
-        "version": "2023-04-19",
+        "version": "2023-05-09",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "5a004f9427a050c6c393c07ddb85cba8ff3849fa",
-        "sha256": "01xrh9m9m6x8lz0vxwdw2mrhrvnw93zpg09hwdhqakj06agf4jjk"
+        "rev": "ad1e5ce10f06ef9a1a1d91b2e48231d6b3eecbe2",
+        "sha256": "1m00wqkkvgs52a9bikirnmvsw2d9kfzk59a45mg4n8m4sgpvmxc7"
      }
    }
  },
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -88,7 +88,7 @@ let
  fteLibPath = lib.makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "12.0.5";
+  version = "12.0.6";

  lang = "ALL";

@ -100,7 +100,7 @@ let
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
      ];
-      hash = "sha256-V4BUs30h0+AKNuNsHuRriDXJ0ZzrIsg2SYn4GPZS6Hs=";
+      hash = "sha256-MLy/T8A+udasITWYSzaqXSFhA3PJsG7DnKJG0b9UYvA=";
    };

    i686-linux = fetchurl {
@ -110,7 +110,7 @@ let
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
      ];
-      hash = "sha256-TUfS31EjAi/hgVjCKT/T5Jx8iCYXB/3EXPVm1KSqXLk=";
+      hash = "sha256-njJB5k7rQxRyL7foU8fLCQxy43dJvV26oKvQ+fw6U0o=";
    };
  };

--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "cni-plugins";
-  version = "1.2.0";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "containernetworking";
    repo = "plugins";
    rev = "v${version}";
-    sha256 = "sha256-p6gvXn8v7KZMiCPj2EQlk/2au1nZ6EJlLxcMZHzlEp8=";
+    hash = "sha256-cbmG9wK3yd79jCiNAKcSSx0COyh6CxR1bgIiCO3i++g=";
  };

-  vendorSha256 = null;
+  vendorHash = null;

  doCheck = false;

@ -30,6 +30,7 @@ buildGoModule rec {
    "plugins/main/loopback"
    "plugins/main/macvlan"
    "plugins/main/ptp"
+    "plugins/main/tap"
    "plugins/main/vlan"
    "plugins/meta/bandwidth"
    "plugins/meta/firewall"
@ -42,6 +43,7 @@ buildGoModule rec {
  passthru.tests = { inherit (nixosTests) cri-o; };

  meta = with lib; {
+    changelog = "https://github.com/containernetworking/plugins/releases/tag/${src.rev}";
    description = "Some standard networking plugins, maintained by the CNI team";
    homepage = "https://www.cni.dev/plugins/";
    license = licenses.asl20;
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -164,13 +164,13 @@
    "vendorHash": null
  },
  "bitbucket": {
-    "hash": "sha256-lm/BNxfB5ZosyFYihJ6kh8oro+tCP6pRFNnWrvzeKgk=",
+    "hash": "sha256-T9e3IQHe6uCdllRTctJg/aG1QmPFR6V4ryw79yX2k/o=",
    "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
    "owner": "DrFaust92",
    "repo": "terraform-provider-bitbucket",
-    "rev": "v2.32.0",
+    "rev": "v2.33.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-mnG2CZ/ko4p4CTs0YskJP41sQD9lmEz4dRQLiklim34="
+    "vendorHash": "sha256-ebkUF+Xv9diwUYXYt/WK+0tWheqL1cgA665VbGLmvvo="
  },
  "brightbox": {
    "hash": "sha256-yKoYjrZs6EOX1pdDuF+LOu/jZ3fidZJBU7yhSp6qSFU=",
--- a/pkgs/applications/networking/instant-messengers/feishu/default.nix
+++ b/pkgs/applications/networking/instant-messengers/feishu/default.nix
@ -6,6 +6,7 @@
 , autoPatchelfHook
 , cairo
 , cups
+, curl
 , dbus
 , dpkg
 , expat
@ -37,6 +38,7 @@
 , libgcrypt
 , libglvnd
 , libnotify
+, libpulseaudio
 , libuuid
 , libxcb
 , libxkbcommon
@ -61,13 +63,13 @@
 }:

 stdenv.mkDerivation rec {
-  version = "5.18.11";
+  version = "6.1.11";
  pname = "feishu";
-  packageHash = "9d89b152d581"; # A hash value used in the download url
+  packageHash = "e82bd3ef"; # A hash value used in the download url

  src = fetchurl {
    url = "https://sf3-cn.feishucdn.com/obj/ee-appcenter/${packageHash}/Feishu-linux_x64-${version}.deb";
-    hash = "sha256-93LEybYePIEbmE8mjRL95haMuBuY0xH6/8fhwF7/ctM=";
+    hash = "sha256-IBNMNOcOYIdiTlr4+Ziju7Pbf9XJV0O+w2arHTa1zZ0=";
  };

  nativeBuildInputs = [
@ -82,9 +84,12 @@ stdenv.mkDerivation rec {
    # for autopatchelf
    alsa-lib
    cups
+    curl
    libXdamage
+    libXtst
    libdrm
    libgcrypt
+    libpulseaudio
    libxshmfence
    mesa
    nspr
@ -98,6 +103,7 @@ stdenv.mkDerivation rec {
    atk
    cairo
    cups
+    curl
    dbus
    expat
    fontconfig
@ -125,6 +131,7 @@ stdenv.mkDerivation rec {
    libgcrypt
    libglvnd
    libnotify
+    libpulseaudio
    libuuid
    libxcb
    libxkbcommon
@ -174,6 +181,12 @@ stdenv.mkDerivation rec {

    mkdir -p $out/bin
    ln -s $out/opt/bytedance/feishu/bytedance-feishu $out/bin/bytedance-feishu
+
+    # feishu comes with a bundled libcurl.so
+    # and has many dependencies that are hard to satisfy
+    # e.g. openldap version 2.4
+    # so replace it with our own libcurl.so
+    ln -sf ${curl}/lib/libcurl.so $out/opt/bytedance/feishu/libcurl.so
  '';

  meta = with lib; {
--- a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
@ -3,21 +3,22 @@
 , imagemagick
 , flutter37
 , makeDesktopItem
+, gnome
 }:

 flutter37.buildFlutterApplication rec {
-  version = "1.11.0";
+  version = "1.11.2";
  name = "fluffychat";

  src = fetchFromGitLab {
    owner = "famedly";
    repo = "fluffychat";
    rev = "v${version}";
-    hash = "sha256-Z7BOGsirBVQxRJY4kmskCmPeZloc41/bf4/ExoO8VBk=";
+    hash = "sha256-vHzZDkSgxcZf3y/+A645hxBverm34J5xNnNwyxnSVUA=";
  };

  depsListFile = ./deps.json;
-  vendorHash = "sha256-axByNptbzGR7GQT4Gs2yaEyUCkCbI9RQNNOHN7CYd9A=";
+  vendorHash = "sha256-u8YI4UBnEfPpvjBfhbo4LGolb56w94EiUlnLlYITdXQ=";

  desktopItem = makeDesktopItem {
    name = "Fluffychat";
@ -27,8 +28,9 @@ flutter37.buildFlutterApplication rec {
    genericName = "Chat with your friends (matrix client)";
    categories = [ "Chat" "Network" "InstantMessaging" ];
  };
-  nativeBuildInputs = [ imagemagick ];

+  nativeBuildInputs = [ imagemagick ];
+  extraWrapProgramArgs = "--prefix PATH : ${gnome.zenity}/bin";
  postInstall = ''
    FAV=$out/app/data/flutter_assets/assets/favicon.png
    ICO=$out/share/icons
--- a/pkgs/applications/networking/instant-messengers/fluffychat/deps.json
+++ b/pkgs/applications/networking/instant-messengers/fluffychat/deps.json
@ -1,7 +1,7 @@
 [
  {
    "name": "fluffychat",
-    "version": "1.11.0+3254",
+    "version": "1.11.2+3360",
    "kind": "root",
    "source": "root",
    "dependencies": [
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@ -1,19 +1,19 @@
 { lib, stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which
-, ncurses, perl , cyrus_sasl, gss, gpgme, libkrb5, libidn, libxml2, notmuch, openssl
+, ncurses, perl , cyrus_sasl, gss, gpgme, libkrb5, libidn2, libxml2, notmuch, openssl
 , lua, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, w3m, mailcap, sqlite, zlib, lndir
 , pkg-config, zstd, enableZstd ? true, enableMixmaster ? false, enableLua ? false
 , withContrib ? true
 }:

 stdenv.mkDerivation rec {
-  version = "20230407";
+  version = "20230512";
  pname = "neomutt";

  src = fetchFromGitHub {
    owner  = "neomutt";
    repo   = "neomutt";
    rev    = version;
-    sha256 = "sha256-cTZua1AbLMjkMhlUk2aMttj6HdwpJYnRYPuvukSxfwc=";
+    sha256 = "sha256-/NeY9WrPXg6sSM1jnjgQKL7vSn8dTrAnvj229KcEEro=";
  };

  patches = [
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    cyrus_sasl gss gpgme libkrb5 libidn ncurses
+    cyrus_sasl gss gpgme libkrb5 libidn2 ncurses
    notmuch openssl perl lmdb
    mailcap sqlite
  ]
--- a/pkgs/applications/networking/remote/xrdp/default.nix
+++ b/pkgs/applications/networking/remote/xrdp/default.nix
@ -34,7 +34,7 @@ let
  };

  xrdp = stdenv.mkDerivation rec {
-    version = "0.9.21.1";
+    version = "0.9.22";
    pname = "xrdp";

    src = fetchFromGitHub {
@ -42,7 +42,7 @@ let
      repo = "xrdp";
      rev = "v${version}";
      fetchSubmodules = true;
-      hash = "sha256-/o052ij+Tpcw5/k1UyP6OGOzrtBwh3jRkftStIEhUF0=";
+      hash = "sha256-/i2rLVrN1twKtQH6Qt1OZOPGZzegWBOKpj0Wnin8cR8=";
    };

    nativeBuildInputs = [ pkg-config autoconf automake which libtool nasm perl ];
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "treesheets";
-  version = "unstable-2023-05-04";
+  version = "unstable-2023-05-13";

  src = fetchFromGitHub {
    owner = "aardappel";
    repo = "treesheets";
-    rev = "3694b16809daaa59b9198cd9645662e2a8cf4650";
-    sha256 = "NShLLBTBS88UXWWjsSeMVxj8HnnN4yA8gmz83wdpIzE=";
+    rev = "c48cc033c941fb1898e12189e96188a98df69b96";
+    sha256 = "EzLhsuDY/H3t69nuwWj/3fxJdAX6ze/IB/i5WsVJmOo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/cloudlog/default.nix
+++ b/pkgs/applications/radio/cloudlog/default.nix
@ -3,7 +3,8 @@
 , fetchFromGitHub
 , nix-update-script
 , nixosTests
-, php}:
+, php
+}:

 stdenvNoCC.mkDerivation rec {
  pname = "cloudlog";
@ -34,11 +35,7 @@ stdenvNoCC.mkDerivation rec {
  };

  meta = with lib; {
-    description = ''
-      Web based amateur radio logging application built using PHP & MySQL
-      supports general station logging tasks from HF to Microwave with
-      supporting applications to support CAT control.
-    '';
+    description = "Web based amateur radio logging application built using PHP & MySQL";
    license = licenses.mit;
    homepage = "https://www.magicbug.co.uk/cloudlog";
    platforms = php.meta.platforms;
--- a/pkgs/applications/science/biology/jbrowse/default.nix
+++ b/pkgs/applications/science/biology/jbrowse/default.nix
@ -0,0 +1,39 @@
+{ lib, fetchurl, appimageTools, wrapGAppsHook }:
+
+let
+  pname = "jbrowse";
+  version = "2.5.0";
+
+  src = fetchurl {
+    url = "https://github.com/GMOD/jbrowse-components/releases/download/v${version}/jbrowse-desktop-v${version}-linux.AppImage";
+    sha256 = "sha256-YLsyA+RVoFvjE4MfAtglJYdUgic487SxwdUhvolzBPc=";
+  };
+
+  appimageContents = appimageTools.extractType2 {
+    inherit pname version src;
+  };
+
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+  unshareIpc = false;
+
+  extraInstallCommands = ''
+    mkdir -p $out/bin
+    mv $out/bin/jbrowse-${version} $out/bin/jbrowse-desktop
+
+    install -m 444 -D ${appimageContents}/jbrowse-desktop.desktop $out/share/applications/jbrowse-desktop.desktop
+    install -m 444 -D ${appimageContents}/jbrowse-desktop.png \
+       $out/share/icons/hicolor/512x512/apps/jbrowse-desktop.png
+    substituteInPlace $out/share/applications/jbrowse-desktop.desktop \
+      --replace 'Exec=AppRun --no-sandbox' 'Exec=jbrowse-desktop'
+  '';
+
+  meta = with lib; {
+    description = "The next-generation genome browser";
+    homepage = "https://jbrowse.org/jb2/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ benwbooth ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/video/open-in-mpv/default.nix
+++ b/pkgs/applications/video/open-in-mpv/default.nix
@ -0,0 +1,38 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "open-in-mpv";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Baldomo";
+    repo = "open-in-mpv";
+    rev = "v${version}";
+    hash = "sha256-3Fsa3AwiHsb8VcKa4a/RKyYu+CD5nEX0nIXENhBZCWk=";
+  };
+
+  vendorHash = "sha256-G6GZO2+CfEAYcf7zBcqDa808A0eJjM8dq7+4VGZ+P4c=";
+
+  ldflags = [ "-s" "-w" ];
+
+  postInstall = ''
+    install -Dm444 -t $out/share/applications scripts/open-in-mpv.desktop
+  '';
+
+  meta = with lib; {
+    description = "Simple web extension to open videos in mpv";
+    longDescription = ''
+      To function the browser extension must be installed and open-in-mpv must be set as the default scheme-handler for mpv:// eg.:
+        xdg-mime default open-in-mpv.desktop x-scheme-handler/mpv
+
+      https://addons.mozilla.org/en-US/firefox/addon/iina-open-in-mpv/
+      https://chrome.google.com/webstore/detail/open-in-mpv/ggijpepdpiehgbiknmfpfbhcalffjlbj
+    '';
+    homepage = "https://github.com/Baldomo/open-in-mpv";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@ -4,18 +4,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "crosvm";
-  version = "112.0";
+  version = "113.0";

  src = fetchgit {
    url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "014b853ebdba00c7bad751a37fa4271ff2a50d77";
-    sha256 = "qVfkNN6dHfMeDYMDvccU9PAz78Dh2ylL6UpoApoYKJw=";
+    rev = "f2871094c45bc3a8a2604cbba5b34da27d676af7";
+    sha256 = "seeqr453Qjk1MoYq2ZlPsgUOMaV7PbK4MKze2cl2NvI=";
    fetchSubmodules = true;
  };

  separateDebugInfo = true;

-  cargoSha256 = "ath0x9dfQCWWU9+zKyYLC6Q/QXupifHhdQxrS+N2UWw=";
+  cargoSha256 = "hGhYzynNvsaSQO2lSEh/OGWkeE8bEinwb0QxX87TQU0=";

  nativeBuildInputs = [
    pkg-config protobuf python3 rustPlatform.bindgenHook wayland-scanner
--- a/pkgs/applications/virtualization/docker-slim/default.nix
+++ b/pkgs/applications/virtualization/docker-slim/default.nix
@ -8,7 +8,7 @@ buildGoModule rec {
    owner = "slimtoolkit";
    repo = "slim";
    rev = version;
-    hash = "sha256-pRIfIgEM0olUi0LL8maB7vczcq4p67eDuWssoeOT4Tk=";
+    hash = "sha256-byB7GTw0hHY4dp3CkMCl6ga/Zn82+K6qmyWy6ezCLoE=";
  };

  vendorHash = null;
--- a/pkgs/applications/virtualization/pods/Cargo.lock
+++ b/pkgs/applications/virtualization/pods/Cargo.lock
@ -205,16 +205,6 @@ dependencies = [
 "winapi",
 ]

-[[package]]
-name = "codespan-reporting"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3538270d33cc669650c4b093848450d380def10c331d38c768e34cac80576e6e"
-dependencies = [
- "termcolor",
- "unicode-width",
-]
-
 [[package]]
 name = "containers-api"
 version = "0.8.0"
@ -230,7 +220,7 @@ dependencies = [
 "log",
 "mime",
 "paste",
- "pin-project 1.0.12",
+ "pin-project 1.1.0",
 "serde",
 "serde_json",
 "tar",
@ -273,50 +263,6 @@ dependencies = [
 "typenum",
 ]

-[[package]]
-name = "cxx"
-version = "1.0.94"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f61f1b6389c3fe1c316bf8a4dccc90a38208354b330925bce1f74a6c4756eb93"
-dependencies = [
- "cc",
- "cxxbridge-flags",
- "cxxbridge-macro",
- "link-cplusplus",
-]
-
-[[package]]
-name = "cxx-build"
-version = "1.0.94"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12cee708e8962df2aeb38f594aae5d827c022b6460ac71a7a3e2c3c2aae5a07b"
-dependencies = [
- "cc",
- "codespan-reporting",
- "once_cell",
- "proc-macro2",
- "quote",
- "scratch",
- "syn 2.0.15",
-]
-
-[[package]]
-name = "cxxbridge-flags"
-version = "1.0.94"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7944172ae7e4068c533afbb984114a56c46e9ccddda550499caa222902c7f7bb"
-
-[[package]]
-name = "cxxbridge-macro"
-version = "1.0.94"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2345488264226bf682893e25de0769f3360aac9957980ec49361b083ddaa5bc5"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.15",
-]
-
 [[package]]
 name = "derivative"
 version = "2.2.0"
@ -1015,7 +961,7 @@ dependencies = [
 "futures-util",
 "hex",
 "hyper",
- "pin-project 1.0.12",
+ "pin-project 1.1.0",
 "tokio",
 ]

@ -1035,12 +981,11 @@ dependencies = [

 [[package]]
 name = "iana-time-zone-haiku"
-version = "0.1.1"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0703ae284fc167426161c2e3f1da3ea71d94b21bedbcc9494e92b28e334e3dca"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
 dependencies = [
- "cxx",
- "cxx-build",
+ "cc",
 ]

 [[package]]
@ -1177,15 +1122,6 @@ dependencies = [
 "system-deps",
 ]

-[[package]]
-name = "link-cplusplus"
-version = "1.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecd207c9c713c34f95a097a5b029ac2ce6010530c7b49d7fea24d977dede04f5"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.3.7"
@ -1434,11 +1370,11 @@ dependencies = [

 [[package]]
 name = "pin-project"
-version = "1.0.12"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad29a609b6bcd67fee905812e544992d216af9d755757c05ed2d0e15a74c6ecc"
+checksum = "c95a7476719eab1e366eaf73d0260af3021184f18177925b07f54b30089ceead"
 dependencies = [
- "pin-project-internal 1.0.12",
+ "pin-project-internal 1.1.0",
 ]

 [[package]]
@ -1454,13 +1390,13 @@ dependencies = [

 [[package]]
 name = "pin-project-internal"
-version = "1.0.12"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "069bdb1e05adc7a8990dce9cc75370895fbe4e3d58b9b73bf1aee56359344a55"
+checksum = "39407670928234ebc5e6e580247dd567ad73a3578460c5990f9503df207e8f07"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 1.0.109",
+ "syn 2.0.15",
 ]

 [[package]]
@ -1518,7 +1454,7 @@ dependencies = [

 [[package]]
 name = "pods"
-version = "1.1.2"
+version = "1.1.3"
 dependencies = [
 "anyhow",
 "ashpd",
@ -1695,12 +1631,6 @@ version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f91339c0467de62360649f8d3e185ca8de4224ff281f66000de5eb2a77a79041"

-[[package]]
-name = "scratch"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1792db035ce95be60c3f8853017b3999209281c24e2ba5bc8e59bf97a0c590c1"
-
 [[package]]
 name = "semver"
 version = "1.0.17"
@ -1709,18 +1639,18 @@ checksum = "bebd363326d05ec3e2f532ab7660680f3b02130d780c299bca73469d521bc0ed"

 [[package]]
 name = "serde"
-version = "1.0.162"
+version = "1.0.163"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71b2f6e1ab5c2b98c05f0f35b236b22e8df7ead6ffbf51d7808da7f8817e7ab6"
+checksum = "2113ab51b87a539ae008b5c6c02dc020ffa39afd2d83cffcb3f4eb2722cebec2"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.162"
+version = "1.0.163"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2a0814352fd64b58489904a44ea8d90cb1a91dcb6b4f5ebabc32c8318e93cb6"
+checksum = "8c805777e3930c8883389c602315a24224bcc738b63905ef87cd1420353ea93e"
 dependencies = [
 "proc-macro2",
 "quote",
@ -1920,15 +1850,6 @@ dependencies = [
 "windows-sys 0.45.0",
 ]

-[[package]]
-name = "termcolor"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
-dependencies = [
- "winapi-util",
-]
-
 [[package]]
 name = "thiserror"
 version = "1.0.40"
@ -2112,9 +2033,9 @@ dependencies = [

 [[package]]
 name = "tracing-core"
-version = "0.1.30"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24eb03ba0eab1fd845050058ce5e616558e8f8d8fca633e6b163fe25c797213a"
+checksum = "0955b8137a1df6f1a2e9a37d8a6656291ff0297c1a97c24e0d8425fe2312f79a"
 dependencies = [
 "once_cell",
 ]
@ -2162,12 +2083,6 @@ dependencies = [
 "tinyvec",
 ]

-[[package]]
-name = "unicode-width"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
-
 [[package]]
 name = "url"
 version = "2.3.1"
@ -2342,15 +2257,6 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"

-[[package]]
-name = "winapi-util"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
-dependencies = [
- "winapi",
-]
-
 [[package]]
 name = "winapi-x86_64-pc-windows-gnu"
 version = "0.4.0"
@ -2577,9 +2483,9 @@ dependencies = [

 [[package]]
 name = "zbus_names"
-version = "2.5.0"
+version = "2.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f34f314916bd89bdb9934154627fab152f4f28acdda03e7c4c68181b214fe7e3"
+checksum = "82441e6033be0a741157a72951a3e4957d519698f3a824439cc131c5ba77ac2a"
 dependencies = [
 "serde",
 "static_assertions",
@ -2588,9 +2494,9 @@ dependencies = [

 [[package]]
 name = "zvariant"
-version = "3.12.0"
+version = "3.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46fe4914a985446d6fd287019b5fceccce38303d71407d9e6e711d44954a05d8"
+checksum = "5cb36cd95352132911c9c99fdcc1635de5c2c139bd34cbcf6dfb8350ee8ff6a7"
 dependencies = [
 "byteorder",
 "enumflags2",
@ -2603,9 +2509,9 @@ dependencies = [

 [[package]]
 name = "zvariant_derive"
-version = "3.12.0"
+version = "3.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34c20260af4b28b3275d6676c7e2a6be0d4332e8e0aba4616d34007fd84e462a"
+checksum = "9b34951e1ac64f3a1443fe7181256b9ed6a811a1631917566c3d5ca718d8cf33"
 dependencies = [
 "proc-macro-crate",
 "proc-macro2",
--- a/pkgs/applications/virtualization/pods/default.nix
+++ b/pkgs/applications/virtualization/pods/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "pods";
-  version = "1.1.2";
+  version = "1.1.3";

  src = fetchFromGitHub {
    owner = "marhkb";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-5euSMmyumZbUFsZuP7fa3wCm4n0Hx+F8bPlv4Xw/Hvw=";
+    sha256 = "sha256-wZZBtvSMC83P38jzbZ1fX5f42WTPI68XGB1aG3gMYG0=";
  };

  cargoDeps = rustPlatform.importCargoLock {
--- a/pkgs/build-support/flutter/default.nix
+++ b/pkgs/build-support/flutter/default.nix
@ -21,6 +21,7 @@
 , nativeBuildInputs ? [ ]
 , preUnpack ? ""
 , postFixup ? ""
+, extraWrapProgramArgs ? ""
 , ...
 }@args:
 let
@ -121,7 +122,8 @@ let
      # which is not what application authors expect.
      for f in "$out"/bin/*; do
        wrapProgram "$f" \
-          --suffix LD_LIBRARY_PATH : '${lib.makeLibraryPath finalAttrs.runtimeDependencies}'
+          --suffix LD_LIBRARY_PATH : '${lib.makeLibraryPath finalAttrs.runtimeDependencies}' \
+          ${extraWrapProgramArgs}
      done

      ${postFixup}
--- a/pkgs/data/fonts/terminus-font-ttf/default.nix
+++ b/pkgs/data/fonts/terminus-font-ttf/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "terminus-font-ttf";
-  version = "4.49.1";
+  version = "4.49.3";

  src = fetchzip {
    url = "https://files.ax86.net/terminus-ttf/files/${version}/terminus-ttf-${version}.zip";
-    hash = "sha256-NKswkZR05V21mszT56S2x85k//qhfzRShhepYaAybDc=";
+    hash = "sha256-dK7MH4I1RhsIGzcnRA+7f3P5oi9B63RA+uASVDNtxNI=";
  };

  installPhase = ''
--- a/pkgs/data/icons/catppuccin-papirus-folders/default.nix
+++ b/pkgs/data/icons/catppuccin-papirus-folders/default.nix
@ -16,13 +16,13 @@ in

  stdenvNoCC.mkDerivation {
    inherit pname;
-    version = "unstable-2022-12-04";
+    version = "unstable-2023-08-02";

    src = fetchFromGitHub {
      owner = "catppuccin";
      repo = "papirus-folders";
-      rev = "1a367642df9cf340770bd7097fbe85b9cea65bcb";
-      sha256 = "sha256-mFDfRVDA9WyriyFVzsI7iqmPopN56z54FvLkZDS2Dv8=";
+      rev = "fcf96737fffc343a1bf129732c37d19f2d77fa5c";
+      sha256 = "sha256-3yjIGzN+/moP2OVGDIAy4zPqUroSjx3c2mJjdZGhTsY=";
    };

    nativeBuildInputs = [ gtk3 ];
--- a/pkgs/development/beam-modules/elixir-ls/default.nix
+++ b/pkgs/development/beam-modules/elixir-ls/default.nix
@ -1,16 +1,15 @@
-{ lib, elixir, fetchFromGitHub, fetchMixDeps, mixRelease }:
+{ lib, elixir, fetchFromGitHub, fetchMixDeps, mixRelease, nix-update-script }:
 # Based on the work of Hauleth
 # None of this would have happened without him

 let
  pname = "elixir-ls";
-  pinData = lib.importJSON ./pin.json;
-  version = pinData.version;
+  version = "0.14.6";
  src = fetchFromGitHub {
    owner = "elixir-lsp";
    repo = "elixir-ls";
    rev = "v${version}";
-    sha256 = pinData.sha256;
+    hash = "sha256-O977DZLWPyLafIaOTPZKI4MOtK9E9TDProf2xyk05aI";
    fetchSubmodules = true;
  };
 in
@ -20,7 +19,7 @@ mixRelease  {
  mixFodDeps = fetchMixDeps {
    pname = "mix-deps-${pname}";
    inherit src version elixir;
-    sha256 = pinData.depsSha256;
+    sha256 = "sha256-jF1Plkz1D85aWkiNgeBlJmHndhr7us+8+m/gMkXHvDw=";
  };

  # elixir-ls is an umbrella app
@ -71,5 +70,5 @@ mixRelease  {
    platforms = platforms.unix;
    maintainers = teams.beam.members;
  };
-  passthru.updateScript = ./update.sh;
+  passthru.updateScript = nix-update-script { };
 }
--- a/pkgs/development/beam-modules/elixir-ls/pin.json
+++ b/pkgs/development/beam-modules/elixir-ls/pin.json
@ -1,5 +0,0 @@
-{
-  "version": "0.14.5",
-  "sha256": "sha256-F0c1vyeie8sf11SHfDKb8v1DZ5No3Rr3PPj3jMg0veg=",
-  "depsSha256": "sha256-/lKZ9Ns32A/elJTez72mH2tZ7ujwEX9p4FIKHpfGq78="
-}
--- a/pkgs/development/beam-modules/elixir-ls/update.sh
+++ b/pkgs/development/beam-modules/elixir-ls/update.sh
@ -1,31 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i oil -p jq sd nix-prefetch-github ripgrep
-
-# TODO set to `verbose` or `extdebug` once implemented in oil
-set -x
-
-const directory = $(dirname $0 | xargs realpath)
-const owner = "elixir-lsp"
-const repo = "elixir-ls"
-const latest_rev = $(curl -q https://api.github.com/repos/${owner}/${repo}/releases/latest | \
-  jq -r '.tag_name')
-const latest_version = $(echo $latest_rev | sd 'v' '')
-const current_version = $(jq -r '.version' $directory/pin.json)
-if ("$latest_version" === "$current_version") {
-  echo "elixir-ls is already up-to-date"
-  return 0
-} else {
-  const tarball_meta = $(nix-prefetch-github $owner $repo --rev "$latest_rev")
-  const tarball_hash = "sha256-$(echo $tarball_meta | jq -r '.sha256')"
-  const sha256s = $(rg '"sha256-.+"' $directory/default.nix | sd '.+"(.+)";' '$1' )
-
-  jq ".version = \"$latest_version\" | \
-      .\"sha256\" = \"$tarball_hash\" | \
-      .\"depsSha256\" = \"\"" $directory/pin.json | sponge $directory/pin.json
-
-  const new_mix_hash = $(nix-build -A elixir-ls.mixFodDeps 2>&1 | \
-    tail -n 1 | \
-    sd '\s+got:\s+' '')
-
-  jq ".depsSha256 = \"$new_mix_hash\"" $directory/pin.json | sponge $directory/pin.json
-}
--- a/pkgs/development/compilers/c0/default.nix
+++ b/pkgs/development/compilers/c0/default.nix
@ -0,0 +1,80 @@
+{ lib
+, stdenv
+, fetchFromBitbucket
+, mlton
+, pkg-config
+, getopt
+, boehmgc
+, darwin
+, libbacktrace
+, libpng
+, ncurses
+, readline
+}:
+
+stdenv.mkDerivation rec {
+  pname = "c0";
+  version = "unstable-2022-10-25";
+
+  src = fetchFromBitbucket {
+    owner = "c0-lang";
+    repo = "c0";
+    rev = "7ef3bc9ca232ec41936e93ec8957051e48cacfba";
+    sha256 = "sha256-uahF8fOp2ZJE8EhZke46sbPmN0MNHzsLkU4EXkV710U=";
+  };
+
+  patches = [
+    ./use-system-libraries.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace cc0/Makefile \
+      --replace '$(shell ./get_version.sh)' '${version}'
+    substituteInPlace cc0/compiler/bin/buildid \
+      --replace '`../get_version.sh`' '${version}' \
+      --replace '`date`' '1970-01-01T00:00:00Z' \
+      --replace '`hostname`' 'nixpkgs'
+  '' + lib.optionalString stdenv.isDarwin ''
+    for f in cc0/compiler/bin/coin-o0-support cc0/compiler/bin/cc0-o0-support; do
+      substituteInPlace $f --replace '$(brew --prefix gnu-getopt)' '${getopt}'
+    done
+  '';
+
+  preConfigure = ''
+    cd cc0/
+  '';
+
+  nativeBuildInputs = [
+    getopt
+    mlton
+    pkg-config
+  ] ++ lib.optionals stdenv.isDarwin [ darwin.sigtool ];
+
+  buildInputs = [
+    boehmgc
+    libbacktrace
+    libpng
+    ncurses
+    readline
+  ];
+
+  strictDeps = true;
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  postInstall = ''
+    mkdir -p $out/share/emacs/site-lisp
+    mv $out/c0-mode/ $out/share/emacs/site-lisp/
+  '';
+
+  meta = with lib; {
+    description = "A small safe subset of the C programming language, augmented with contracts";
+    homepage = "https://c0.cs.cmu.edu/";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+    platforms = platforms.unix;
+    # line 1: ../../bin/wrappergen: cannot execute: required file not found
+    # make[2]: *** [../../lib.mk:83:
+    broken = stdenv.isLinux;
+  };
+}
--- a/pkgs/development/compilers/c0/use-system-libraries.patch
+++ b/pkgs/development/compilers/c0/use-system-libraries.patch
@ -0,0 +1,53 @@
+Use system libraries
+
+--- a/cc0/Makefile
+++ b/cc0/Makefile
+@@ -22,12 +22,12 @@ MLTON_BASIC = mlton $(MLTON_FLAGS) -verbose $(MLTON_VERB)  -output
+ MLTON_NATIVE := mlton -default-ann "redundantMatch error" -default-ann "sequenceNonUnit error"
+ MLTON_NATIVE += -link-opt "-lpthread -ldl -rdynamic" -cc-opt "-Iinclude" -default-ann "allowFFI true"
+ MLTON_NATIVE += -cc-opt "-I../externals/"
+-MLTON_NATIVE += -link-opt "../externals/readline/libreadline.a ../externals/readline/libhistory.a"
+MLTON_NATIVE += -link-opt "$(shell pkg-config readline --libs)"
+ MLTON_NATIVE += -link-opt "$(shell pkg-config libpng --libs)"
+ 
+ # libreadline dependencies
+ ifeq ($(PLATFORM),osx)
+-MLTON_NATIVE += -link-opt "-ltermcap"
+MLTON_NATIVE += -link-opt "-lncurses"
+ else
+ # (Assuming Linux)
+ MLTON_NATIVE += -link-opt "-ltinfo"
+@@ -122,9 +122,9 @@ endef
+ 
+ $(foreach rt,$(RUNTIMES),$(eval $(call runtime_template,$(rt))))
+ 
+-c0rt/$(call dllname,c0rt): gc libbacktrace
+c0rt/$(call dllname,c0rt):
+ 
+-unsafe/$(call dllname,unsafe): gc
+unsafe/$(call dllname,unsafe):
+ 
+ 
+ ### cc0 - the C0 compiler
+@@ -222,7 +222,6 @@ NATIVE_COIN    = $(NATIVE_CYMBOL) $(NATIVE_CALLING)
+ NATIVE_COIN += coin/c0readline.c
+ 
+ COIN_DEPS = $(CC0_DEPS) $(NATIVE_COIN) cymbol/cymbol*.cm cymbol/*.sml cymbol/*.mlb coin/coin*.cm coin/*.sml coin/*.sml
+-COIN_DEPS += readline
+ 
+ .PHONY: coin
+ coin: bin/coin
+--- a/cc0/lib.mk
+++ b/cc0/lib.mk
+@@ -15,9 +15,9 @@ TARGET = $(call dllname,$(LIBNAME))
+ endif
+ 
+ # These libs are handled specially by this file
+-NATIVELIBS = gc ncurses backtrace
+NATIVELIBS =
+ C0LIBS = $(filter-out $(NATIVELIBS),$(REQUIRES))
+-LIBS = -L$(abspath $(DEPTH)/lib) $(patsubst %,$(DEPTH)/lib/$(call dllname,%),$(C0LIBS))
+LIBS = -L$(abspath $(DEPTH)/lib)
+ LDFLAGS = 
+ 
+ # -fPIC is not supported on Windows and is not necessary there because we link statically
--- a/pkgs/development/compilers/mruby/default.nix
+++ b/pkgs/development/compilers/mruby/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {

  # Necessary so it uses `gcc` instead of `ld` for linking.
  # https://github.com/mruby/mruby/blob/35be8b252495d92ca811d76996f03c470ee33380/tasks/toolchains/gcc.rake#L25
-  preBuild = if stdenv.isLinux then "unset LD" else null;
+  preBuild = "unset LD";

  installPhase = ''
    mkdir $out
--- a/pkgs/development/libraries/openvr/default.nix
+++ b/pkgs/development/libraries/openvr/default.nix
@ -5,6 +5,8 @@
 , jsoncpp
 , fetchFromGitHub
 , fetchpatch2
+, Foundation
+, AppKit
 }:

 stdenv.mkDerivation rec {
@ -41,11 +43,12 @@ stdenv.mkDerivation rec {
  '';

  nativeBuildInputs = [ cmake ];
-  buildInputs = [ jsoncpp libGL ];
+  buildInputs = [ jsoncpp libGL ] ++ lib.optionals stdenv.isDarwin [ Foundation AppKit ];

  cmakeFlags = [ "-DUSE_SYSTEM_JSONCPP=ON" "-DBUILD_SHARED=1" ];

-  meta = with lib;{
+  meta = with lib; {
+    broken = stdenv.isDarwin;
    homepage = "https://github.com/ValveSoftware/openvr";
    description = "An API and runtime that allows access to VR hardware from multiple vendors without requiring that applications have specific knowledge of the hardware they are targeting";
    license = licenses.bsd3;
--- a/pkgs/development/ocaml-modules/otoml/default.nix
+++ b/pkgs/development/ocaml-modules/otoml/default.nix
@ -8,7 +8,7 @@

 buildDunePackage rec {
  pname = "otoml";
-  version = "1.0.2";
+  version = "1.0.4";

  minimalOCamlVersion = "4.08";

@ -16,7 +16,7 @@ buildDunePackage rec {
    owner = "dmbaturin";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Xd3fHBN1f+tvgRFCxD/Gz8/lIvezknz7Zy3EtdqoTEM=";
+    sha256 = "sha256-3bgeiwa0elisxZaWpwLqoKmeyTBKMW1IWdm6YdSIhSw=";
  };

  nativeBuildInputs = [ menhir ];
--- a/pkgs/development/python-modules/accelerate/default.nix
+++ b/pkgs/development/python-modules/accelerate/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "accelerate";
-  version = "0.18.0";
+  version = "0.19.0";
  format = "pyproject";
  disabled = pythonOlder "3.7";

@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "huggingface";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-fCIvVbMaWAWzRfPc5/1CZq3gZ8kruuk9wBt8mzLHmyw=";
+    hash = "sha256-gW4wCpkyxoWfxXu8UHZfgopSQhOoPhGgqEqFiHJ+Db4=";
  };

  nativeBuildInputs = [ setuptools ];
--- a/pkgs/development/python-modules/aiolifx-themes/default.nix
+++ b/pkgs/development/python-modules/aiolifx-themes/default.nix
@ -1,12 +1,12 @@
 { lib
-, fetchFromGitHub
-, buildPythonPackage
-, pythonOlder
 , aiolifx
+, async-timeout
+, buildPythonPackage
+, fetchFromGitHub
 , poetry-core
 , pytest-asyncio
 , pytestCheckHook
-, async-timeout
+, pythonOlder
 , typer
 }:

@ -31,6 +31,11 @@ buildPythonPackage rec {
      --replace "typer = " "# unused: typer = "
  '';

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'aiolifx = "^0.8.6"' 'aiolifx = "*"'
+  '';
+
  nativeBuildInputs = [
    poetry-core
  ];
--- a/pkgs/development/python-modules/aiolifx/default.nix
+++ b/pkgs/development/python-modules/aiolifx/default.nix
@ -1,31 +1,35 @@
 { lib
 , async-timeout
+, click
 , fetchPypi
 , buildPythonPackage
 , pythonOlder
 , ifaddr
+, inquirerpy
 , bitstring
 }:

 buildPythonPackage rec {
  pname = "aiolifx";
-  version = "0.8.10";
+  version = "0.9.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-NiNKFrWxpGkwbb7tFEDD5jZ6ETW20BBIqrdjCsL/DkY=";
+    hash = "sha256-oK8Ih62EFwu3X5PNVFLH+Uce6ZBs7IMXet5/DHxfd5M=";
  };

  propagatedBuildInputs = [
    async-timeout
    bitstring
+    click
    ifaddr
+    inquirerpy
  ];

-  # tests are not implemented
+  # Module has no tests
  doCheck = false;

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/azure-eventgrid/default.nix
+++ b/pkgs/development/python-modules/azure-eventgrid/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "azure-eventgrid";
-  version = "4.10.0";
+  version = "4.11.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    hash = "sha256-PWl+rA/JAe0rUKU24oQuYlt7U4Cyi14T7cVlA/B60VY=";
+    hash = "sha256-qoUaKbbB2x3eO6IiXwn3kl/C6NA5biZbzRHctoNFdQE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/azure-mgmt-reservations/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-reservations/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-reservations";
-  version = "2.2.0";
+  version = "2.3.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    hash = "sha256-P6GLB5+2p9sS9XSwSykQXHXw5YrJNNSgs5d7sy5jHTk=";
+    hash = "sha256-BHCFEFst5jfyIEo0hm86belpxW7EygZCBJ8PTqzqHKc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/base58/default.nix
+++ b/pkgs/development/python-modules/base58/default.nix
@ -1,9 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, py
 , pyhamcrest
-, pytest-benchmark
 , pytestCheckHook
 , pythonOlder
 }:
@ -20,12 +18,16 @@ buildPythonPackage rec {
  };

  nativeCheckInputs = [
-    py
    pyhamcrest
-    pytest-benchmark
    pytestCheckHook
  ];

+  disabledTests = [
+    # avoid dependency on pytest-benchmark
+    "test_decode_random"
+    "test_encode_random"
+  ];
+
  pythonImportsCheck = [ "base58" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/cpyparsing/default.nix
+++ b/pkgs/development/python-modules/cpyparsing/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "cpyparsing";
-  version = "2.4.7.1.2.0";
+  version = "2.4.7.1.2.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,12 +18,16 @@ buildPythonPackage rec {
    owner = "evhub";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-cb0Lx+S9WnPa9veHJaYEU7pFCtB6pG/GKf4HK/UbmtU=";
+    hash = "sha256-HJ0I5DKZ2WV+1pXZCvJHA7Wih3Gkn7vL/ojXnTssKxw=";
  };

-  nativeBuildInputs = [ cython ];
+  nativeBuildInputs = [
+    cython
+  ];

-  nativeCheckInputs = [ pexpect ];
+  nativeCheckInputs = [
+    pexpect
+  ];

  checkPhase = ''
    ${python.interpreter} tests/cPyparsing_test.py
@ -36,6 +40,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Cython PyParsing implementation";
    homepage = "https://github.com/evhub/cpyparsing";
+    changelog = "https://github.com/evhub/cpyparsing/releases/tag/v${version}";
    license = licenses.asl20;
    maintainers = with maintainers; [ fabianhjr ];
  };
--- a/pkgs/development/python-modules/crc32c/default.nix
+++ b/pkgs/development/python-modules/crc32c/default.nix
@ -1,16 +1,21 @@
-{ lib, buildPythonPackage, fetchFromGitHub }:
+{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder, pytestCheckHook }:

 buildPythonPackage rec {
-  version = "2.2.post0";
+  version = "2.3.post0";
  pname = "crc32c";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.5";

  src = fetchFromGitHub {
    owner = "ICRAR";
    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-0FgNOVpgJTxRALuufZ7Dt1TwuX+zqw35yCq8kmq4RTc=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-lPEojWeAhfWpGR+k+Tuo4n68iZOk7lUDxjWXj5vN4I0=";
  };

+  nativeCheckInputs = [ pytestCheckHook ];
+
  meta = {
    description = "Python software implementation and hardware API of CRC32C checksum algorithm";
    homepage = "https://github.com/ICRAR/crc32c";
--- a/pkgs/development/python-modules/cwl-upgrader/default.nix
+++ b/pkgs/development/python-modules/cwl-upgrader/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "cwl-upgrader";
-  version = "1.2.6";
+  version = "1.2.7";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "common-workflow-language";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-lVIy0aa+hqbi46NfwXCKWDRzszneyuyo6KXxAcr/xIA=";
+    hash = "sha256-/vCvpRpQkdMkqlK5/0jJTY56ROoB4ezvX9ma1AVWYd4=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/cwl-utils/default.nix
+++ b/pkgs/development/python-modules/cwl-utils/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "cwl-utils";
-  version = "0.24";
+  version = "0.26";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "common-workflow-language";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-g8HnY5/UDmujijXStNRwKBGMZ3soUHKPIlpJdIQaAlE=";
+    hash = "sha256-T82zaXILbQFOIE0/HhNjpYutSdA1UeaxXO/M7Z4sSfo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/ffmpeg-progress-yield/default.nix
+++ b/pkgs/development/python-modules/ffmpeg-progress-yield/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "ffmpeg-progress-yield";
-  version = "0.7.1";
+  version = "0.7.4";
  format = "setuptools";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-wK33h+Qg737hSv+2HF4hvfBDDsJpI+7mGbRgUQvrZb0=";
+    hash = "sha256-gBWkoR0cJdcWShX9aIDt6DpK1dkT9bfvgnrgXGgZPSQ=";
  };

  propagatedBuildInputs = [ colorama tqdm ];
--- a/pkgs/development/python-modules/grpcio-testing/default.nix
+++ b/pkgs/development/python-modules/grpcio-testing/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "grpcio-testing";
-  version = "1.54.0";
+  version = "1.54.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-/0LlPGUVhV7lh4RDQH7wImxaynN2wDLoELxoUUG8bpM=";
+    hash = "sha256-qCMOjSfe7eGIWyomTLiLrLrt/GekmLdlMO2VnPihgI0=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "hahomematic";
-  version = "2023.5.0";
+  version = "2023.5.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "danielperna84";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-4isf3U4Wp5FCQ0zVfmDLK+zkq/IXLFZhiaL6AYRXaRY=";
+    hash = "sha256-YsvsT1TKAlMGS9F3zDuruXnC/COFbR5ApPFzh+hzQyE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/inquirerpy/default.nix
+++ b/pkgs/development/python-modules/inquirerpy/default.nix
@ -0,0 +1,62 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, furo
+, myst-parser
+, pfzy
+, poetry-core
+, prompt-toolkit
+, pytestCheckHook
+, pythonOlder
+, sphinx
+, sphinx-autobuild
+, sphinx-copybutton
+}:
+
+buildPythonPackage rec {
+  pname = "inquirerpy";
+  version = "0.3.3";
+  format = "pyproject";
+
+
+  src = fetchFromGitHub {
+    owner = "kazhala";
+    repo = "InquirerPy";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Ktqzxuj4aBHrgjiOyoDLuqbN0FJqwUpoyq3LuqXxt2Y=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    pfzy
+    prompt-toolkit
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "InquirerPy"
+  ];
+
+  disabledTestPaths = [
+    # AttributeError: '_GeneratorContextManager' object has no attribute 'close'
+    "tests/prompts/"
+    "tests/base/test_simple.py"
+    "tests/base/test_complex.py"
+    "tests/base/test_list.py"
+  ];
+
+
+  meta = with lib; {
+    description = "Python port of Inquirer.js";
+    homepage = "https://github.com/kazhala/InquirerPy";
+    changelog = "https://github.com/kazhala/InquirerPy/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/internetarchive/default.nix
+++ b/pkgs/development/python-modules/internetarchive/default.nix
@ -1,30 +1,32 @@
-{ buildPythonPackage
-, fetchPypi
-, pytest
-, tqdm
+{ lib
+, buildPythonPackage
 , docopt
+, fetchFromGitHub
+, pytestCheckHook
 , requests
 , jsonpatch
 , schema
 , responses
-, lib
-, glibcLocales
 , setuptools
+, tqdm
 , urllib3
 , pythonOlder
 }:

 buildPythonPackage rec {
  pname = "internetarchive";
-  version = "3.4.0";
+  version = "3.5.0";

-  format = "setuptools";
+  format = "pyproject";

  disabled = pythonOlder "3.7";

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-vrvktAuijBKo3IsMQzUs5EyfwFCFGmvXZ4kCvlbeGWE=";
+  # no tests data included in PyPI tarball
+  src = fetchFromGitHub {
+    owner = "jjjake";
+    repo = "internetarchive";
+    rev = "v${version}";
+    hash = "sha256-apBzx1qMHEA0wiWh82sS7I+AaiMEoAchhPsrtAgujbQ=";
  };

  propagatedBuildInputs = [
@ -37,16 +39,30 @@ buildPythonPackage rec {
    urllib3
  ];

-  nativeCheckInputs = [ pytest responses glibcLocales ];
+  nativeCheckInputs = [
+    responses
+    pytestCheckHook
+  ];

-  # tests depend on network
-  doCheck = false;
+  disabledTests = [
+    # Tests require network access
+    "test_get_item_with_kwargs"
+    "test_upload"
+    "test_upload_metadata"
+    "test_upload_queue_derive"
+    "test_upload_validate_identifie"
+    "test_upload_validate_identifier"
+  ];

-  checkPhase = ''
-    LC_ALL=en_US.utf-8 pytest tests
-  '';
+  disabledTestPaths = [
+    # Tests require network access
+    "tests/cli/test_ia.py"
+    "tests/cli/test_ia_download.py"
+  ];

-  pythonImportsCheck = [ "internetarchive" ];
+  pythonImportsCheck = [
+    "internetarchive"
+  ];

  meta = with lib; {
    description = "A Python and Command-Line Interface to Archive.org";
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@ -53,6 +53,8 @@
 , lark
 , jq
 , protobuf
+, steamship
+, pdfminer-six
  # test dependencies
 , pytest-vcr
 , pytest-asyncio
@ -67,7 +69,7 @@

 buildPythonPackage rec {
  pname = "langchain";
-  version = "0.0.166";
+  version = "0.0.168";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -76,7 +78,7 @@ buildPythonPackage rec {
    owner = "hwchase17";
    repo = "langchain";
    rev = "refs/tags/v${version}";
-    hash = "sha256-i6CvboYZigky49a7X8RuQH2EfcucJPtEtFEzZxaNJG8=";
+    hash = "sha256-2L5yFkXr6dioEP1QAMXWX6x+IRbGUIW3cxLLxJJjkMI=";
  };

  postPatch = ''
@ -194,6 +196,8 @@ buildPythonPackage rec {
      # docarray
      protobuf
      # hnswlib
+      steamship
+      pdfminer-six
    ];
  };

@ -210,7 +214,7 @@ buildPythonPackage rec {

  pytestFlagsArray = [
    # integration_tests have many network, db access and require `OPENAI_API_KEY`, etc.
-    "--ignore=tests/integration_tests"
+    "tests/unit_tests"
  ];

  disabledTests = [
--- a/pkgs/development/python-modules/ledgerwallet/default.nix
+++ b/pkgs/development/python-modules/ledgerwallet/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , fetchpatch
 , buildPythonPackage
@ -6,38 +7,43 @@
 , click
 , construct
 , ecdsa
+, flit-core
 , hidapi
 , intelhex
 , pillow
-, protobuf
+, protobuf3
 , requests
+, setuptools
 , tabulate
+, toml
 , AppKit
 }:

 buildPythonPackage rec {
  pname = "ledgerwallet";
-  version = "0.1.2";
+  version = "0.2.4";
+  format = "pyproject";

  src = fetchFromGitHub {
    owner = "LedgerHQ";
    repo = "ledgerctl";
    rev = "v${version}";
-    sha256 = "0fb93h2wxm9as9rsywlgz2ng4wrlbjphn6mgbhj6nls2i86rrdxk";
+    hash = "sha256-IcStYYkKEdZxwgJKL8l2Y1BtO/Oncd4aKUAZD8umbHs=";
  };

-  patches = [
-    (fetchpatch {
-      # Fix removed function in construct library
-      url = "https://github.com/LedgerHQ/ledgerctl/commit/fd23d0e14721b93789071e80632e6bd9e47c1256.patch";
-      hash = "sha256-YNlENguPQW5FNFT7mqED+ghF3TJiKao4H+56Eu+j+Eo=";
-      excludes = [ "setup.py" ];
-    })
-  ];
-
-  buildInputs = lib.optionals stdenv.isDarwin [ AppKit ];
+  buildInputs = [ flit-core setuptools ] ++ lib.optionals stdenv.isDarwin [ AppKit ];
  propagatedBuildInputs = [
-    cryptography click construct ecdsa hidapi intelhex pillow protobuf requests tabulate
+    cryptography
+    click
+    construct
+    ecdsa
+    hidapi
+    intelhex
+    pillow
+    protobuf3
+    requests
+    tabulate
+    toml
  ];

  pythonImportsCheck = [ "ledgerwallet" ];
@ -46,6 +52,6 @@ buildPythonPackage rec {
    homepage = "https://github.com/LedgerHQ/ledgerctl";
    description = "A library to control Ledger devices";
    license = licenses.mit;
-    maintainers = with maintainers; [ d-xo ];
+    maintainers = with maintainers; [ d-xo erdnaxe ];
  };
 }
--- a/pkgs/development/python-modules/llfuse/default.nix
+++ b/pkgs/development/python-modules/llfuse/default.nix
@ -8,23 +8,26 @@
 , pkg-config
 , pytestCheckHook
 , python
+, setuptools
 , which
 }:

 buildPythonPackage rec {
  pname = "llfuse";
-  version = "1.4.2";
+  version = "1.4.3";
+
+  format = "pyproject";

  disabled = pythonOlder "3.5";

  src = fetchFromGitHub {
    owner = "python-llfuse";
    repo = "python-llfuse";
-    rev = "release-${version}";
-    hash = "sha256-TnZnv439fLvg0WM96yx0dPSSz8Mrae6GDC9LiLFrgQ8=";
+    rev = "refs/tags/release-${version}";
+    hash = "sha256-37l6HrAKrXtEhlWTIdlw3L6wCGeOA7IW/aaJn3wf4QY=";
  };

-  nativeBuildInputs = [ cython pkg-config ];
+  nativeBuildInputs = [ cython pkg-config setuptools ];

  buildInputs = [ fuse ];

@ -48,6 +51,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python bindings for the low-level FUSE API";
    homepage = "https://github.com/python-llfuse/python-llfuse";
+    changelog = "https://github.com/python-llfuse/python-llfuse/raw/release-${version}/Changes.rst";
    license = licenses.lgpl2Plus;
    platforms = platforms.unix;
    maintainers = with maintainers; [ bjornfor dotlambda ];
--- a/pkgs/development/python-modules/peft/default.nix
+++ b/pkgs/development/python-modules/peft/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "peft";
-  version = "0.2.0";
+  version = "0.3.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "huggingface";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-NPpY29HMQe5KT0JdlLAXY9MVycDslbP2i38NSTirB3I=";
+    hash = "sha256-7j//SDuld2ANxEcG4R0rK5vEaTX7gQwWRH56PO2KqAY=";
  };

  nativeBuildInputs = [ setuptools ];
--- a/pkgs/development/python-modules/pfzy/default.nix
+++ b/pkgs/development/python-modules/pfzy/default.nix
@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pfzy";
+  version = "0.3.4";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "kazhala";
+    repo = "pfzy";
+    rev = "refs/tags/${version}";
+    hash = "sha256-+Ba/yLUfT0SPPAJd+pKyjSvNrVpEwxW3xEKFx4JzpYk=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  pythonImportsCheck = [
+    "pfzy"
+  ];
+
+  meta = with lib; {
+    description = "Python port of the fzy fuzzy string matching algorithm";
+    homepage = "https://github.com/kazhala/pfzy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/pyp/default.nix
+++ b/pkgs/development/python-modules/pyp/default.nix
@ -5,6 +5,7 @@
 , coreutils
 , pythonOlder
 , astunparse
+, flit-core
 , jq
 , bc
 }:
@ -12,7 +13,7 @@
 buildPythonPackage rec {
  pname = "pyp";
  version = "1.1.0";
-  format = "setuptools";
+  format = "pyproject";

  disabled = pythonOlder "3.6";

@ -23,6 +24,10 @@ buildPythonPackage rec {
    hash = "sha256-A1Ip41kxH17BakHEWEuymfa24eBEl5FIHAWL+iZFM4I=";
  };

+  nativeBuildInputs = [
+    flit-core
+  ];
+
  propagatedBuildInputs = lib.optionals (pythonOlder "3.9") [
    astunparse
  ];
--- a/pkgs/development/python-modules/pysml/default.nix
+++ b/pkgs/development/python-modules/pysml/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "pysml";
-  version = "0.0.10";
+  version = "0.0.11";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "mtdcr";
    repo = pname;
    rev = version;
-    hash = "sha256-vC4iff38WCcdUQITPmxC0XlrA83zCNLTDGgyyXivLEY=";
+    hash = "sha256-RPDYh5h885/FiU2vsDpCGd8yWXNNIEpjAu6w8QXTxAA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "pytensor";
-  version = "2.10.1";
+  version = "2.11.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "pymc-devs";
    repo = pname;
    rev = "refs/tags/rel-${version}";
-    hash = "sha256-sk/HGfiiNKrgnf5fPaxoOySvAEpnAXnLFmK0yah51ww=";
+    hash = "sha256-4GDur8S19i8pZkywKHZUelmd2e0jZmC5HzF7o2esDl4=";
  };

  nativeBuildInputs = [
@ -72,8 +72,10 @@ buildPythonPackage rec {
  disabledTests = [
    # benchmarks (require pytest-benchmark):
    "test_elemwise_speed"
+    "test_fused_elemwise_benchmark"
    "test_logsumexp_benchmark"
    "test_scan_multiple_output"
+    "test_vector_taps_benchmark"
  ];

  disabledTestPaths = [
--- a/pkgs/development/python-modules/python-ironicclient/default.nix
+++ b/pkgs/development/python-modules/python-ironicclient/default.nix
@ -20,11 +20,11 @@

 buildPythonPackage rec {
  pname = "python-ironicclient";
-  version = "5.1.0";
+  version = "5.2.0";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-yYmzZuwZSasN6g6Bosivexe5oOy3dP+l/cD5TkXC87g=";
+    hash = "sha256-bnWUfNIx85vSV0P5zcI7syjP0+wTXYDmC8wiuInjGfc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/python-mapnik/default.nix
+++ b/pkgs/development/python-modules/python-mapnik/default.nix
@ -8,7 +8,7 @@
 , pillow
 , pycairo
 , pkg-config
-, boost
+, boost182
 , cairo
 , harfbuzz
 , icu
@ -23,6 +23,7 @@
 , sqlite
 , nose
 , pytestCheckHook
+, stdenv
 }:

 buildPythonPackage rec {
@ -60,7 +61,7 @@ buildPythonPackage rec {

  buildInputs = [
    mapnik
-    boost
+    boost182
    cairo
    harfbuzz
    icu
@ -98,6 +99,9 @@ buildPythonPackage rec {
  preCheck = ''
    # import from $out
    rm -r mapnik
+  '' + lib.optionalString stdenv.isDarwin ''
+    # Replace the hardcoded /tmp references with $TMPDIR
+    sed -i "s,/tmp,$TMPDIR,g" test/python_tests/*.py
  '';

  # https://github.com/mapnik/python-mapnik/issues/255
@ -106,6 +110,7 @@ buildPythonPackage rec {
    "test_compare_map"
    "test_dataraster_coloring"
    "test_dataraster_query_point"
+    "test_geometry_type"
    "test_good_files"
    "test_layer_init"
    "test_load_save_map"
@ -128,6 +133,8 @@ buildPythonPackage rec {
    "test_visual_zoom_all_rendering1"
    "test_visual_zoom_all_rendering2"
    "test_wgs84_inverse_forward"
+  ] ++ lib.optional stdenv.isDarwin [
+    "test_passing_pycairo_context_pdf"
  ];

  pythonImportsCheck = [ "mapnik" ];
--- a/pkgs/development/python-modules/scikit-fuzzy/default.nix
+++ b/pkgs/development/python-modules/scikit-fuzzy/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, isPy27
+, pythonOlder
 , fetchFromGitHub
 , matplotlib
 , networkx
@ -13,7 +13,9 @@
 buildPythonPackage rec {
  pname = "scikit-fuzzy";
  version = "unstable-2022-11-07";
-  disabled = isPy27;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = pname;
@ -25,6 +27,9 @@ buildPythonPackage rec {
  propagatedBuildInputs = [ networkx numpy scipy ];
  nativeCheckInputs = [ matplotlib nose pytestCheckHook ];

+  # numpy API breakage: "AttributeError: module 'numpy' has no attribute 'float'"
+  disabledTests = [ "test_fuzzy_compare" ];
+
  pythonImportsCheck = [ "skfuzzy" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/steamship/default.nix
+++ b/pkgs/development/python-modules/steamship/default.nix
@ -0,0 +1,62 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools-scm
+, pythonRelaxDepsHook
+, requests
+, pydantic
+, aiohttp
+, inflection
+, fluent-logger
+, toml
+, click
+, semver
+, tiktoken
+}:
+
+buildPythonPackage rec {
+  pname = "steamship";
+  version = "2.16.9";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-NHMrReRw8x7N7vy8BqmKx9fDfQYjlOWY7ChdLz+qGxQ=";
+  };
+
+  pythonRelaxDeps = [
+    "requests"
+  ];
+
+  nativeBuildInputs = [
+    setuptools-scm
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = [
+    requests
+    pydantic
+    aiohttp
+    inflection
+    fluent-logger
+    toml
+    click
+    semver
+    tiktoken
+  ];
+
+  # almost all tests require "steamship api key"
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "steamship"
+  ];
+
+  meta = with lib; {
+    description = "The fastest way to add language AI to your product";
+    homepage = "https://www.steamship.com/";
+    changelog = "https://github.com/steamship-core/python-client/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}
--- a/pkgs/development/python-modules/thinc/default.nix
+++ b/pkgs/development/python-modules/thinc/default.nix
@ -29,14 +29,14 @@

 buildPythonPackage rec {
  pname = "thinc";
-  version = "8.1.8";
+  version = "8.1.10";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-NcZXy+2wT8W8JHhl1mWSHOw9Ve81+/zj7hogSGtyBoM=";
+    hash = "sha256-bEpI19oH4EToSmjLubIvMvhJCZWiurC/xg5BLRSvuZE=";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/transmission-rpc/default.nix
+++ b/pkgs/development/python-modules/transmission-rpc/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "transmission-rpc";
-  version = "4.2.1";
+  version = "4.2.2";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "Trim21";
    repo = "transmission-rpc";
    rev = "refs/tags/v${version}";
-    hash = "sha256-+NjJscLRGNSDmyrOMjwUMtJPVz2N32Cy80Q3iu33QJc=";
+    hash = "sha256-8gNGBfU7k2SvpNqRGkT9BXyAyKizUCXY8Unuqw5IICE=";
  };

  nativeBuildInputs = [
--- a/Show more
+++ b/Show more