From 7fa1ba2ca088969906c31e351e29c676bc909239 Mon Sep 17 00:00:00 2001
From: DavHau <hsngrmpf+github@gmail.com>
Date: Thu, 24 Sep 2020 16:22:47 +0700
Subject: [PATCH 01/65] profiles: add 'hpsa' scsi driver to all-hardware.nix

---
 nixos/modules/profiles/all-hardware.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/profiles/all-hardware.nix b/nixos/modules/profiles/all-hardware.nix
index 19f821ae17f..b9e240a2dfa 100644
--- a/nixos/modules/profiles/all-hardware.nix
+++ b/nixos/modules/profiles/all-hardware.nix
@@ -29,7 +29,7 @@
       "pata_winbond"
 
       # SCSI support (incomplete).
-      "3w-9xxx" "3w-xxxx" "aic79xx" "aic7xxx" "arcmsr"
+      "3w-9xxx" "3w-xxxx" "aic79xx" "aic7xxx" "arcmsr" "hpsa"
 
       # USB support, especially for booting from USB CD-ROM
       # drives.

From 857c6490832fb5dccbac6ca7a679496e85a85e21 Mon Sep 17 00:00:00 2001
From: Graham Christensen <graham@grahamc.com>
Date: Tue, 23 Mar 2021 11:40:54 -0400
Subject: [PATCH 02/65] network-interfaces: set hostname from sysctl if defined

The `networking.hostname` option was changed to not permit periods
in names, due to a strict reading of RFC 1123. For users who need
the hostname to be fully qualified, the networking.hostName option
suggests using boot.kernel.sysctl."kernel.hostname" as a workaround.

This option works correctly at boot time, but every "nixos-rebuild
switch" will change the hostname back to the unqualified version.

This commit brings the activation script in line with the
documentation's recommendation.
---
 nixos/modules/tasks/network-interfaces.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index f730ec82bdf..a3929428f69 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1115,9 +1115,10 @@ in
     # Set the host and domain names in the activation script.  Don't
     # clear it if it's not configured in the NixOS configuration,
     # since it may have been set by dhcpcd in the meantime.
-    system.activationScripts.hostname =
-      optionalString (cfg.hostName != "") ''
-        hostname "${cfg.hostName}"
+    system.activationScripts.hostname = let
+        effectiveHostname = config.boot.kernel.sysctl."kernel.hostname" or cfg.hostName;
+      in optionalString (effectiveHostname != "") ''
+        hostname "${effectiveHostname}"
       '';
     system.activationScripts.domain =
       optionalString (cfg.domain != null) ''

From 1c659c9958d1f8c278eeccf8f71bc72798b51fbe Mon Sep 17 00:00:00 2001
From: Alexandre Iooss <erdnaxe@crans.org>
Date: Thu, 7 Oct 2021 09:53:31 +0200
Subject: [PATCH 03/65] nixos/isso: systemd unit hardening

---
 nixos/modules/services/web-apps/isso.nix | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/nixos/modules/services/web-apps/isso.nix b/nixos/modules/services/web-apps/isso.nix
index 4c01781a6a2..53b66b5a9c1 100644
--- a/nixos/modules/services/web-apps/isso.nix
+++ b/nixos/modules/services/web-apps/isso.nix
@@ -63,6 +63,28 @@ in {
 
         Restart = "on-failure";
         RestartSec = 1;
+
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        UMask = "0077";
       };
     };
   };

From 3be58b2afc2369c777f987359c0843e219e78590 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Sat, 14 May 2022 22:48:52 +0200
Subject: [PATCH 04/65] nixos/redmine: Drop darcs integration

darcs support was dropped with Redmine 4.0.0. Thus, drop the darcs
integration.

For more information, see https://www.redmine.org/issues/26391.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/misc/redmine.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index 696b8d1a25d..45443b5f9f5 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -234,7 +234,6 @@ in
         scm_git_command = "${pkgs.git}/bin/git";
         scm_cvs_command = "${pkgs.cvs}/bin/cvs";
         scm_bazaar_command = "${pkgs.breezy}/bin/bzr";
-        scm_darcs_command = "${pkgs.darcs}/bin/darcs";
       };
     };
 
@@ -299,7 +298,6 @@ in
         imagemagick
         breezy
         cvs
-        darcs
         git
         mercurial
         subversion

From 92b1cf8b4ccc16e42b04d518f9d23de42cc97c07 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Sat, 7 May 2022 07:48:08 +0200
Subject: [PATCH 05/65] nixos/redmine: Make optional components configurable

Currently, optional components and integrations of Redmine are enforced
to install in NixOS. Thus, add the following options allowing the users
to enable or disable the components. They are disabled by default.
Enabling these options will add their package to the Redmine environment
and will configure their specific setting in the Redmine configuration
file.

  * services.redmine.components.subversion
  * services.redmine.components.mercurial
  * services.redmine.components.git
  * services.redmine.components.cvs
  * services.redmine.components.breezy
  * services.redmine.components.imagemagick

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/misc/redmine.nix | 63 ++++++++++++++++++++-----
 1 file changed, 51 insertions(+), 12 deletions(-)

diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index 45443b5f9f5..0cf8acbbf79 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -206,6 +206,44 @@ in
           description = "Create the database and database user locally.";
         };
       };
+
+      components = {
+        subversion = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Subversion integration.";
+        };
+
+        mercurial = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Mercurial integration.";
+        };
+
+        git = mkOption {
+          type = types.bool;
+          default = false;
+          description = "git integration.";
+        };
+
+        cvs = mkOption {
+          type = types.bool;
+          default = false;
+          description = "cvs integration.";
+        };
+
+        breezy = mkOption {
+          type = types.bool;
+          default = false;
+          description = "bazaar integration.";
+        };
+
+        imagemagick = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Allows exporting Gant diagrams as PNG.";
+        };
+      };
     };
   };
 
@@ -229,11 +267,11 @@ in
 
     services.redmine.settings = {
       production = {
-        scm_subversion_command = "${pkgs.subversion}/bin/svn";
-        scm_mercurial_command = "${pkgs.mercurial}/bin/hg";
-        scm_git_command = "${pkgs.git}/bin/git";
-        scm_cvs_command = "${pkgs.cvs}/bin/cvs";
-        scm_bazaar_command = "${pkgs.breezy}/bin/bzr";
+        scm_subversion_command = if cfg.components.subversion then "${pkgs.subversion}/bin/svn" else "";
+        scm_mercurial_command = if cfg.components.mercurial then "${pkgs.mercurial}/bin/hg" else "";
+        scm_git_command = if cfg.components.git then "${pkgs.git}/bin/git" else "";
+        scm_cvs_command = if cfg.components.cvs then "${pkgs.cvs}/bin/cvs" else "";
+        scm_bazaar_command = if cfg.components.breezy then "${pkgs.breezy}/bin/bzr" else "";
       };
     };
 
@@ -295,13 +333,14 @@ in
       environment.REDMINE_LANG = "en";
       environment.SCHEMA = "${cfg.stateDir}/cache/schema.db";
       path = with pkgs; [
-        imagemagick
-        breezy
-        cvs
-        git
-        mercurial
-        subversion
-      ];
+      ]
+      ++ optional cfg.components.subversion subversion
+      ++ optional cfg.components.mercurial mercurial
+      ++ optional cfg.components.git git
+      ++ optional cfg.components.cvs cvs
+      ++ optional cfg.components.breezy breezy
+      ++ optional cfg.components.imagemagick imagemagick;
+
       preStart = ''
         rm -rf "${cfg.stateDir}/plugins/"*
         rm -rf "${cfg.stateDir}/public/themes/"*

From 4d23eae938b33fd9cf5ad046d18fb0266b3ca8de Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Wed, 11 May 2022 00:09:09 +0200
Subject: [PATCH 06/65] nixos/redmine: Add PDF export support for gant

Ghostscript is needed to export Gant diagrams as PDF. Thus, add the
option `services.redmine.components.ghostscript` allowing to enable or
disable the component. The component is disabled by default. Enabling
the option will add Ghostscript to the Redmine environment and configure
the setting `gs_command` in the Redmine configuration file.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/misc/redmine.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index 0cf8acbbf79..0dcc5097843 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -243,6 +243,12 @@ in
           default = false;
           description = "Allows exporting Gant diagrams as PNG.";
         };
+
+        ghostscript = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Allows exporting Gant diagrams as PDF.";
+        };
       };
     };
   };
@@ -272,6 +278,7 @@ in
         scm_git_command = if cfg.components.git then "${pkgs.git}/bin/git" else "";
         scm_cvs_command = if cfg.components.cvs then "${pkgs.cvs}/bin/cvs" else "";
         scm_bazaar_command = if cfg.components.breezy then "${pkgs.breezy}/bin/bzr" else "";
+        gs_command = if cfg.components.ghostscript then "${pkgs.ghostscript}/bin/gs" else "";
       };
     };
 
@@ -339,7 +346,8 @@ in
       ++ optional cfg.components.git git
       ++ optional cfg.components.cvs cvs
       ++ optional cfg.components.breezy breezy
-      ++ optional cfg.components.imagemagick imagemagick;
+      ++ optional cfg.components.imagemagick imagemagick
+      ++ optional cfg.components.ghostscript ghostscript;
 
       preStart = ''
         rm -rf "${cfg.stateDir}/plugins/"*

From 66ef66fc6215fa22f1f216d00ae258db93fe9441 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Wed, 11 May 2022 01:03:48 +0200
Subject: [PATCH 07/65] nixos/redmine: Configure imagemagick_convert_command

For completeness, configure the setting `imagemagick_convert_command` in
the Redmine configuration file.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/misc/redmine.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index 0dcc5097843..3c9391f4ee9 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -278,6 +278,7 @@ in
         scm_git_command = if cfg.components.git then "${pkgs.git}/bin/git" else "";
         scm_cvs_command = if cfg.components.cvs then "${pkgs.cvs}/bin/cvs" else "";
         scm_bazaar_command = if cfg.components.breezy then "${pkgs.breezy}/bin/bzr" else "";
+        imagemagick_convert_command = if cfg.components.imagemagick then "${pkgs.imagemagick}/bin/convert" else "";
         gs_command = if cfg.components.ghostscript then "${pkgs.ghostscript}/bin/gs" else "";
       };
     };

From 562bc5c2a9c4479b11e454d2ac75fccd13e043b9 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Sun, 15 May 2022 00:02:45 +0200
Subject: [PATCH 08/65] nixos/redmine: Fix PNG generation of Gant diagrams

The Ruby gem `minimagick` is used to export Gant diagrams as PNG.
However, minimagick can't find a font and Redmine throws an error. The
setting `minimagick_font_path` allows configuring a path to a font file
in the Redmine configuration. Thus, add the option
`services.redmine.components.minimagick_font_path` allowing to do that.

Also, add an assertion to check if
`services.redmine.components.minimagick_font_path` is set when
imagemagick is enabled.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/misc/redmine.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index 3c9391f4ee9..68a4b03991e 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -249,6 +249,13 @@ in
           default = false;
           description = "Allows exporting Gant diagrams as PDF.";
         };
+
+        minimagick_font_path = mkOption {
+          type = types.str;
+          default = "";
+          description = "";
+          example = "/run/current-system/sw/share/X11/fonts/LiberationSans-Regular.ttf";
+        };
       };
     };
   };
@@ -269,6 +276,9 @@ in
       { assertion = cfg.database.createLocally -> cfg.database.host == "localhost";
         message = "services.redmine.database.host must be set to localhost if services.redmine.database.createLocally is set to true";
       }
+      { assertion = cfg.components.imagemagick -> cfg.components.minimagick_font_path != "";
+        message = "services.redmine.components.minimagick_font_path must be configured with a path to a font file if services.redmine.components.imagemagick is set to true.";
+      }
     ];
 
     services.redmine.settings = {
@@ -280,6 +290,7 @@ in
         scm_bazaar_command = if cfg.components.breezy then "${pkgs.breezy}/bin/bzr" else "";
         imagemagick_convert_command = if cfg.components.imagemagick then "${pkgs.imagemagick}/bin/convert" else "";
         gs_command = if cfg.components.ghostscript then "${pkgs.ghostscript}/bin/gs" else "";
+        minimagick_font_path = "${cfg.components.minimagick_font_path}";
       };
     };
 

From 7f026cc6d02746d553e5e3701d44fc89869bc7af Mon Sep 17 00:00:00 2001
From: Arthur Gautier <arthur.gautier@arista.com>
Date: Mon, 5 Sep 2022 17:10:59 -0700
Subject: [PATCH 09/65] qemu-vm: ensure we do not overwrite the partition table
 when EFI is in use

---
 nixos/modules/virtualisation/qemu-vm.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 0207bfba82a..b2e10da6891 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -858,7 +858,8 @@ in
         # If the disk image appears to be empty, run mke2fs to
         # initialise.
         FSTYPE=$(blkid -o value -s TYPE ${cfg.bootDevice} || true)
-        if test -z "$FSTYPE"; then
+        PARTTYPE=$(blkid -o value -s PTTYPE ${cfg.bootDevice} || true)
+        if test -z "$FSTYPE" -a -z "$PARTTYPE"; then
             mke2fs -t ext4 ${cfg.bootDevice}
         fi
       '';

From 5b520df32f3da8b2df9e7cb055e6115586955534 Mon Sep 17 00:00:00 2001
From: Jaakko Luttinen <jaakko.luttinen@iki.fi>
Date: Tue, 30 Mar 2021 12:31:59 +0300
Subject: [PATCH 10/65] nixos/jupyter: add env kernel option

---
 .../services/development/jupyter/kernel-options.nix   | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/development/jupyter/kernel-options.nix b/nixos/modules/services/development/jupyter/kernel-options.nix
index 42af47aeb3c..3c91d531b0e 100644
--- a/nixos/modules/services/development/jupyter/kernel-options.nix
+++ b/nixos/modules/services/development/jupyter/kernel-options.nix
@@ -1,5 +1,5 @@
 # Options that can be used for creating a jupyter kernel.
-{lib }:
+{ lib }:
 
 with lib;
 
@@ -40,6 +40,15 @@ with lib;
       '';
     };
 
+    env = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      example = { OMP_NUM_THREADS = "1"; };
+      description = lib.mdDoc ''
+        Environment variables to set for the kernel.
+      '';
+    };
+
     logo32 = mkOption {
       type = types.nullOr types.path;
       default = null;

From 8eafc61e238d53da35dad025f2925e50d485606d Mon Sep 17 00:00:00 2001
From: Jaakko Luttinen <jaakko.luttinen@iki.fi>
Date: Fri, 14 Oct 2022 20:19:09 +0300
Subject: [PATCH 11/65] nixos/jupyter: make kernel options freeform JSON

---
 nixos/modules/services/development/jupyter/default.nix        | 2 +-
 nixos/modules/services/development/jupyter/kernel-options.nix | 4 +++-
 nixos/modules/services/development/jupyterhub/default.nix     | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/development/jupyter/default.nix b/nixos/modules/services/development/jupyter/default.nix
index 9b0178d3ea6..c3ef040ebe6 100644
--- a/nixos/modules/services/development/jupyter/default.nix
+++ b/nixos/modules/services/development/jupyter/default.nix
@@ -119,7 +119,7 @@ in {
 
     kernels = mkOption {
       type = types.nullOr (types.attrsOf(types.submodule (import ./kernel-options.nix {
-        inherit lib;
+        inherit lib pkgs;
       })));
 
       default = null;
diff --git a/nixos/modules/services/development/jupyter/kernel-options.nix b/nixos/modules/services/development/jupyter/kernel-options.nix
index 3c91d531b0e..6e406152de4 100644
--- a/nixos/modules/services/development/jupyter/kernel-options.nix
+++ b/nixos/modules/services/development/jupyter/kernel-options.nix
@@ -1,9 +1,11 @@
 # Options that can be used for creating a jupyter kernel.
-{ lib }:
+{ lib, pkgs }:
 
 with lib;
 
 {
+  freeformType = (pkgs.formats.json { }).type;
+
   options = {
 
     displayName = mkOption {
diff --git a/nixos/modules/services/development/jupyterhub/default.nix b/nixos/modules/services/development/jupyterhub/default.nix
index c0c0734cac0..cebc35a5047 100644
--- a/nixos/modules/services/development/jupyterhub/default.nix
+++ b/nixos/modules/services/development/jupyterhub/default.nix
@@ -119,7 +119,7 @@ in {
 
     kernels = mkOption {
       type = types.nullOr (types.attrsOf(types.submodule (import ../jupyter/kernel-options.nix {
-        inherit lib;
+        inherit lib pkgs;
       })));
 
       default = null;

From 8538873dab56a6f2237f36f9541188642c8e5987 Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Sat, 29 Oct 2022 23:11:21 -0400
Subject: [PATCH 12/65] sourcehut.dispatchsrht: remove

dispatch has been deprecated since August (see https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/).
---
 .../from_md/release-notes/rl-2211.section.xml | 10 +++++
 .../manual/release-notes/rl-2211.section.md   |  2 +
 .../services/misc/sourcehut/default.nix       | 42 ++++---------------
 .../version-management/sourcehut/default.nix  |  4 +-
 .../version-management/sourcehut/dispatch.nix | 40 ------------------
 .../version-management/sourcehut/update.sh    |  2 +-
 6 files changed, 22 insertions(+), 78 deletions(-)
 delete mode 100644 pkgs/applications/version-management/sourcehut/dispatch.nix

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index e9f4f707f52..1fb51112885 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -573,6 +573,16 @@
           instead.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>services.sourcehut.dispatch</literal> and the
+          corresponding package
+          (<literal>sourcehut.dispatchsrht</literal>) have been removed
+          due to
+          <link xlink:href="https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/">upstream
+          deprecation</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>p4</literal> package now only includes the
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index 9b5257ca8e1..0ba088c6cf9 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -186,6 +186,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 - `services.hbase` has been renamed to `services.hbase-standalone`.
   For production HBase clusters, use `services.hadoop.hbase` instead.
 
+- `services.sourcehut.dispatch` and the corresponding package (`sourcehut.dispatchsrht`) have been removed due to [upstream deprecation](https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/).
+
 - The `p4` package now only includes the open-source Perforce Helix Core command-line client and APIs. It no longer installs the unfree Helix Core Server binaries `p4d`, `p4broker`, and `p4p`. To install the Helix Core Server binaries, use the `p4d` package instead.
 
 - The `coq` package and versioned variants starting at `coq_8_14` no
diff --git a/nixos/modules/services/misc/sourcehut/default.nix b/nixos/modules/services/misc/sourcehut/default.nix
index a79149c8f58..aaa7bb05754 100644
--- a/nixos/modules/services/misc/sourcehut/default.nix
+++ b/nixos/modules/services/misc/sourcehut/default.nix
@@ -88,7 +88,6 @@ let
     # Sourcehut services
     srht
     buildsrht
-    dispatchsrht
     gitsrht
     hgsrht
     hubsrht
@@ -109,13 +108,13 @@ in
 {
   options.services.sourcehut = {
     enable = mkEnableOption (lib.mdDoc ''
-      sourcehut - git hosting, continuous integration, mailing list, ticket tracking,
-      task dispatching, wiki and account management services
+      sourcehut - git hosting, continuous integration, mailing list, ticket tracking, wiki
+      and account management services
     '');
 
     services = mkOption {
       type = with types; listOf (enum
-        [ "builds" "dispatch" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]);
+        [ "builds" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]);
       defaultText = "locally enabled services";
       description = lib.mdDoc ''
         Services that may be displayed as links in the title bar of the Web interface.
@@ -301,32 +300,6 @@ in
           };
         };
 
-        options."dispatch.sr.ht" = commonServiceSettings "dispatch" // {
-        };
-        options."dispatch.sr.ht::github" = {
-          oauth-client-id = mkOptionNullOrStr "OAuth client id.";
-          oauth-client-secret = mkOptionNullOrStr "OAuth client secret.";
-        };
-        options."dispatch.sr.ht::gitlab" = {
-          enabled = mkEnableOption (lib.mdDoc "GitLab integration");
-          canonical-upstream = mkOption {
-            type = types.str;
-            description = lib.mdDoc "Canonical upstream.";
-            default = "gitlab.com";
-          };
-          repo-cache = mkOption {
-            type = types.str;
-            description = lib.mdDoc "Repository cache directory.";
-            default = "./repo-cache";
-          };
-          "gitlab.com" = mkOption {
-            type = with types; nullOr str;
-            description = lib.mdDoc "GitLab id and secret.";
-            default = null;
-            example = "GitLab:application id:secret";
-          };
-        };
-
         options."builds.sr.ht" = commonServiceSettings "builds" // {
           allow-free = mkEnableOption (lib.mdDoc "nonpaying users to submit builds");
           redis = mkOption {
@@ -1021,11 +994,6 @@ in
       ];
     })
 
-    (import ./service.nix "dispatch" {
-      inherit configIniOfService;
-      port = 5005;
-    })
-
     (import ./service.nix "git" (let
       baseService = {
         path = [ cfg.git.package ];
@@ -1416,6 +1384,10 @@ in
     (mkRenamedOptionModule [ "services" "sourcehut" "address" ]
                            [ "services" "sourcehut" "listenAddress" ])
 
+    (mkRemovedOptionModule [ "services" "sourcehut" "dispatch" ] ''
+        dispatch is deprecated. See https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/
+        for more information.
+    '')
   ];
 
   meta.doc = ./sourcehut.xml;
diff --git a/pkgs/applications/version-management/sourcehut/default.nix b/pkgs/applications/version-management/sourcehut/default.nix
index 2189e54ce3c..7faca39e2fe 100644
--- a/pkgs/applications/version-management/sourcehut/default.nix
+++ b/pkgs/applications/version-management/sourcehut/default.nix
@@ -15,7 +15,6 @@ let
       srht = self.callPackage ./core.nix { inherit fetchNodeModules; };
 
       buildsrht = self.callPackage ./builds.nix { };
-      dispatchsrht = self.callPackage ./dispatch.nix { };
       gitsrht = self.callPackage ./git.nix { };
       hgsrht = self.callPackage ./hg.nix { };
       hubsrht = self.callPackage ./hub.nix { };
@@ -33,7 +32,8 @@ with python.pkgs; recurseIntoAttrs {
   inherit python;
   coresrht = toPythonApplication srht;
   buildsrht = toPythonApplication buildsrht;
-  dispatchsrht = toPythonApplication dispatchsrht;
+  # Added 2022-10-29
+  dispatchsrht = throw "dispatch is deprecated. See https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/ for more information.";
   gitsrht = toPythonApplication gitsrht;
   hgsrht = toPythonApplication hgsrht;
   hubsrht = toPythonApplication hubsrht;
diff --git a/pkgs/applications/version-management/sourcehut/dispatch.nix b/pkgs/applications/version-management/sourcehut/dispatch.nix
deleted file mode 100644
index 05ed0450e00..00000000000
--- a/pkgs/applications/version-management/sourcehut/dispatch.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ lib
-, fetchFromSourcehut
-, buildPythonPackage
-, srht
-, pyyaml
-, PyGithub
-, python
-}:
-
-buildPythonPackage rec {
-  pname = "dispatchsrht";
-  version = "0.15.34";
-
-  src = fetchFromSourcehut {
-    owner = "~sircmpwn";
-    repo = "dispatch.sr.ht";
-    rev = version;
-    sha256 = "sha256-bZ4ZKohMozZIyP0TUgxETOECib4XGUv29+Mg8ZsoMf8=";
-  };
-
-  propagatedBuildInputs = [
-    srht
-    pyyaml
-    PyGithub
-  ];
-
-  preBuild = ''
-    export PKGVER=${version}
-    export SRHT_PATH=${srht}/${python.sitePackages}/srht
-  '';
-
-  pythonImportsCheck = [ "dispatchsrht" ];
-
-  meta = with lib; {
-    homepage = "https://git.sr.ht/~sircmpwn/dispatch.sr.ht";
-    description = "Task dispatcher and service integration tool for the sr.ht network";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ eadwu ];
-  };
-}
diff --git a/pkgs/applications/version-management/sourcehut/update.sh b/pkgs/applications/version-management/sourcehut/update.sh
index e13ce09da4c..239d767ed9b 100755
--- a/pkgs/applications/version-management/sourcehut/update.sh
+++ b/pkgs/applications/version-management/sourcehut/update.sh
@@ -67,7 +67,7 @@ else
   # because the reported $oldHash to be changed
   # may not actually be in $default_nix
   # but in the file of one of its dependencies.
-  services=( "srht" "scmsrht" "buildsrht" "dispatchsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht"
+  services=( "srht" "scmsrht" "buildsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht"
              "metasrht" "pagessrht" "pastesrht" "todosrht" )
 fi
 

From ee090cd8081d99a82ec12191df5fff9e93d5fd2c Mon Sep 17 00:00:00 2001
From: Owen McGrath <mail@owm111.me>
Date: Thu, 3 Nov 2022 14:04:43 -0500
Subject: [PATCH 13/65] nixos/physlock: add muteKernelMessages options

Add an option for physlock's -m flag, which mutes kernel messages on the
console. This ensures that the password prompt is the only thing on the
screen and isn't lost in a flood of kernel messages.
---
 nixos/modules/services/security/physlock.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/security/physlock.nix b/nixos/modules/services/security/physlock.nix
index 3db9e0ac445..cd774765915 100644
--- a/nixos/modules/services/security/physlock.nix
+++ b/nixos/modules/services/security/physlock.nix
@@ -57,6 +57,14 @@ in
         '';
       };
 
+      muteKernelMessages = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Disable kernel messages on console while physlock is running.
+        '';
+      };
+
       lockOn = {
 
         suspend = mkOption {
@@ -116,7 +124,7 @@ in
                 ++ cfg.lockOn.extraTargets;
         serviceConfig = {
           Type = "forking";
-          ExecStart = "${pkgs.physlock}/bin/physlock -d${optionalString cfg.disableSysRq "s"}${optionalString (cfg.lockMessage != "") " -p \"${cfg.lockMessage}\""}";
+          ExecStart = "${pkgs.physlock}/bin/physlock -d${optionalString cfg.muteKernelMessages "m"}${optionalString cfg.disableSysRq "s"}${optionalString (cfg.lockMessage != "") " -p \"${cfg.lockMessage}\""}";
         };
       };
 

From c3cff074f8dc3aaa4739ae0f60d0b3c907aba164 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
Date: Fri, 4 Nov 2022 14:05:43 +0100
Subject: [PATCH 14/65] nixos/sane: add openFirewall option

Open ports needed for discovery of scanners on the local network, e.g.
needed for Canon scanners (BJNP protocol).

Ref. https://github.com/NixOS/nixpkgs/issues/28406.
---
 nixos/modules/services/hardware/sane.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/nixos/modules/services/hardware/sane.nix b/nixos/modules/services/hardware/sane.nix
index 5455cf56e8a..ab36e204e1a 100644
--- a/nixos/modules/services/hardware/sane.nix
+++ b/nixos/modules/services/hardware/sane.nix
@@ -124,6 +124,15 @@ in
       '';
     };
 
+    hardware.sane.openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Open ports needed for discovery of scanners on the local network, e.g.
+        needed for Canon scanners (BJNP protocol).
+      '';
+    };
+
     services.saned.enable = mkOption {
       type = types.bool;
       default = false;
@@ -159,6 +168,7 @@ in
       services.udev.packages = backends;
 
       users.groups.scanner.gid = config.ids.gids.scanner;
+      networking.firewall.allowedUDPPorts = mkIf config.hardware.sane.openFirewall [ 8612 ];
     })
 
     (mkIf config.services.saned.enable {

From a42f7a08755a3d14db770c833133fca32633f212 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 20 Nov 2022 19:38:20 +0100
Subject: [PATCH 15/65] nixos/mandb: fix cross compiling

---
 nixos/modules/misc/man-db.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/misc/man-db.nix b/nixos/modules/misc/man-db.nix
index 08fb91b3994..df903259fa4 100644
--- a/nixos/modules/misc/man-db.nix
+++ b/nixos/modules/misc/man-db.nix
@@ -52,9 +52,13 @@ in
     environment.systemPackages = [ cfg.package ];
     environment.etc."man_db.conf".text =
       let
+        mandbForBuild = if pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform then
+                          cfg.package
+                        else
+                          pkgs.buildPackages.man-db;
         manualCache = pkgs.runCommand "man-cache" { } ''
           echo "MANDB_MAP ${cfg.manualPages}/share/man $out" > man.conf
-          ${cfg.package}/bin/mandb -C man.conf -psc >/dev/null 2>&1
+          ${mandbForBuild}/bin/mandb -C man.conf -psc >/dev/null 2>&1
         '';
       in
       ''

From 6033e4e5ed285759726050faaf6f75fbdbb33b20 Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Sun, 27 Nov 2022 04:21:00 +0100
Subject: [PATCH 16/65] gitea: needs gnupg in its path to sign commits

See: https://docs.gitea.io/en-us/signing/#installing-and-generating-a-gpg-key-for-gitea
---
 nixos/modules/services/misc/gitea.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index ac598108a01..f8bfda165eb 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -483,7 +483,7 @@ in
       description = "gitea";
       after = [ "network.target" ] ++ lib.optional usePostgresql "postgresql.service" ++ lib.optional useMysql "mysql.service";
       wantedBy = [ "multi-user.target" ];
-      path = [ gitea pkgs.git ];
+      path = [ gitea pkgs.git pkgs.gnupg ];
 
       # In older versions the secret naming for JWT was kind of confusing.
       # The file jwt_secret hold the value for LFS_JWT_SECRET and JWT_SECRET

From 0811f83e3cf5a6a6d1d457556fd62fd01750524a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 27 Nov 2022 22:27:21 +0100
Subject: [PATCH 17/65] libdbi-drivers: remove global with lib, add TODO

---
 .../libraries/libdbi-drivers/default.nix          | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/libdbi-drivers/default.nix b/pkgs/development/libraries/libdbi-drivers/default.nix
index 79e063826f8..321c50b61c9 100644
--- a/pkgs/development/libraries/libdbi-drivers/default.nix
+++ b/pkgs/development/libraries/libdbi-drivers/default.nix
@@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl, libdbi
+# TODO: migrate away from overriding packages to null
 , libmysqlclient ? null
 , sqlite ? null
 , postgresql ? null
 }:
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "libdbi-drivers";
   version = "0.9.0";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "0m680h8cc4428xin4p733azysamzgzcmv4psjvraykrsaz6ymlj3";
   };
 
-  buildInputs = [ libdbi sqlite postgresql ] ++ optional (libmysqlclient != null) libmysqlclient;
+  buildInputs = [ libdbi sqlite postgresql ] ++ lib.optional (libmysqlclient != null) libmysqlclient;
 
   postPatch = ''
     sed -i '/SQLITE3_LIBS/ s/-lsqlite/-lsqlite3/' configure;
@@ -27,15 +27,15 @@ stdenv.mkDerivation rec {
     "--enable-libdbi"
     "--with-dbi-incdir=${libdbi}/include"
     "--with-dbi-libdir=${libdbi}/lib"
-  ] ++ optionals (libmysqlclient != null) [
+  ] ++ lib.optionals (libmysqlclient != null) [
     "--with-mysql"
-    "--with-mysql-incdir=${getDev libmysqlclient}/include/mysql"
+    "--with-mysql-incdir=${lib.getDev libmysqlclient}/include/mysql"
     "--with-mysql-libdir=${libmysqlclient}/lib/mysql"
-  ] ++ optionals (sqlite != null) [
+  ] ++ lib.optionals (sqlite != null) [
     "--with-sqlite3"
     "--with-sqlite3-incdir=${sqlite.dev}/include/sqlite"
     "--with-sqlite3-libdir=${sqlite.out}/lib/sqlite"
-  ] ++ optionals (postgresql != null) [
+  ] ++ lib.optionals (postgresql != null) [
     "--with-pgsql"
     "--with-pgsql_incdir=${postgresql}/include"
     "--with-pgsql_libdir=${postgresql.lib}/lib"
@@ -54,10 +54,11 @@ stdenv.mkDerivation rec {
     rm -rf $out/var
   '';
 
-  meta = {
+  meta = with lib; {
     homepage = "http://libdbi-drivers.sourceforge.net/";
     description = "Database drivers for libdbi";
     platforms = platforms.all;
     license = licenses.lgpl21;
+    maintainers = with maintainers; [ ];
   };
 }

From 98d14710200ad518738a3c9b4d27f702c6183c77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 28 Nov 2022 00:28:13 +0100
Subject: [PATCH 18/65] hqplayer-desktop: mark broken because src link is 403

---
 pkgs/applications/audio/hqplayer-desktop/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/audio/hqplayer-desktop/default.nix b/pkgs/applications/audio/hqplayer-desktop/default.nix
index 17c8f936efd..bacb67806eb 100644
--- a/pkgs/applications/audio/hqplayer-desktop/default.nix
+++ b/pkgs/applications/audio/hqplayer-desktop/default.nix
@@ -89,5 +89,7 @@ mkDerivation rec {
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ lovesegfault ];
+    # src link returns 403
+    broken = true;
   };
 }

From 7d5132376eddab09884ffbffdf65521e94fc2614 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 28 Nov 2022 00:37:46 +0100
Subject: [PATCH 19/65] zoneminder: fix linking against mariadb

---
 pkgs/servers/zoneminder/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/zoneminder/default.nix b/pkgs/servers/zoneminder/default.nix
index e790108327e..cfdde9ab2d8 100644
--- a/pkgs/servers/zoneminder/default.nix
+++ b/pkgs/servers/zoneminder/default.nix
@@ -122,7 +122,7 @@ in stdenv.mkDerivation rec {
   '';
 
   buildInputs = [
-    curl ffmpeg glib libjpeg libselinux libsepol mp4v2 libmysqlclient mariadb.client pcre perl polkit x264 zlib
+    curl ffmpeg glib libjpeg libselinux libsepol mp4v2 libmysqlclient mariadb pcre perl polkit x264 zlib
     util-linuxMinimal # for libmount
   ] ++ (with perlPackages; [
     # build-time dependencies

From 80f99bc8f6cd9e81af942fea7b25b47a5b0b35d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 28 Nov 2022 01:55:12 +0100
Subject: [PATCH 20/65] mono: cleanup

---
 pkgs/development/compilers/mono/generic.nix | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/compilers/mono/generic.nix b/pkgs/development/compilers/mono/generic.nix
index 8336f76b525..ddd77509c76 100644
--- a/pkgs/development/compilers/mono/generic.nix
+++ b/pkgs/development/compilers/mono/generic.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv, fetchurl, bison, pkg-config, glib, gettext, perl, libgdiplus, libX11, callPackage, ncurses, zlib, withLLVM ? false, cacert, Foundation, libobjc, python3, version, sha256, autoconf, libtool, automake, cmake, which
+{ lib, stdenv, fetchurl, bison, pkg-config, glib, gettext, perl, libgdiplus, libX11, callPackage, ncurses, zlib
+, withLLVM ? false, cacert, Foundation, libobjc, python3, version, sha256, autoconf, libtool, automake, cmake, which
 , gnumake42
 , enableParallelBuilding ? true
 , srcArchiveSuffix ? "tar.bz2"
@@ -6,7 +7,7 @@
 }:
 
 let
-  llvm     = callPackage ./llvm.nix { };
+  llvm = callPackage ./llvm.nix { };
 in
 stdenv.mkDerivation rec {
   pname = "mono";
@@ -18,23 +19,21 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ automake bison cmake pkg-config which gnumake42 ];
-  buildInputs =
-    [ glib gettext perl libgdiplus libX11 ncurses zlib python3 autoconf libtool
-    ]
-    ++ (lib.optionals stdenv.isDarwin [ Foundation libobjc ]);
+  buildInputs = [
+    glib gettext perl libgdiplus libX11 ncurses zlib python3 autoconf libtool
+  ] ++ lib.optionals stdenv.isDarwin [ Foundation libobjc ];
 
   configureFlags = [
     "--x-includes=${libX11.dev}/include"
     "--x-libraries=${libX11.out}/lib"
     "--with-libgdiplus=${libgdiplus}/lib/libgdiplus.so"
-  ]
-  ++ lib.optionals withLLVM [
+  ] ++ lib.optionals withLLVM [
     "--enable-llvm"
     "--with-llvm=${llvm}"
   ];
 
   configurePhase = ''
-    patchShebangs ./
+    patchShebangs autogen.sh mcs/build/start-compiler-server.sh
     ./autogen.sh --prefix $out $configureFlags
   '';
 

From 25dfb66d5442d5b519c914de87423aed44e70870 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 28 Nov 2022 05:37:49 +0100
Subject: [PATCH 21/65] spirv-headers: use clickable homepage

---
 pkgs/development/libraries/spirv-headers/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index d1c854f0cfb..8abdea5249b 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    inherit (src.meta) homepage;
     description = "Machine-readable components of the Khronos SPIR-V Registry";
+    homepage = "https://github.com/KhronosGroup/SPIRV-Headers";
     license = licenses.mit;
     maintainers = [ maintainers.ralith ];
   };

From df509993c857c428bfbf672b506b50ca4fe44453 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 28 Nov 2022 05:37:56 +0100
Subject: [PATCH 22/65] spirv-tools: use clickable homepage

---
 pkgs/development/tools/spirv-tools/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 3a64646ded6..7edba948586 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -38,8 +38,8 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    inherit (src.meta) homepage;
     description = "The SPIR-V Tools project provides an API and commands for processing SPIR-V modules";
+    homepage = "https://github.com/KhronosGroup/SPIRV-Tools";
     license = licenses.asl20;
     platforms = platforms.unix;
     maintainers = [ maintainers.ralith ];

From a6415e6158f7cef321c695ddfa774ce0e2c9737a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 27 Nov 2022 22:00:49 +0000
Subject: [PATCH 23/65] python310Packages.openstacksdk: 0.102.0 -> 0.103.0

---
 pkgs/development/python-modules/openstacksdk/default.nix | 4 ++--
 pkgs/development/python-modules/openstacksdk/tests.nix   | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/openstacksdk/default.nix b/pkgs/development/python-modules/openstacksdk/default.nix
index 75833f8a868..986fa493bf9 100644
--- a/pkgs/development/python-modules/openstacksdk/default.nix
+++ b/pkgs/development/python-modules/openstacksdk/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "openstacksdk";
-  version = "0.102.0";
+  version = "0.103.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sqGP66eerCrDRpyNr+AdQAjIrDC+OkxrUydbTxxroq0=";
+    hash = "sha256-T58RiYZgOWdDXzl2s+BZlQpxvY5BqDFsyK+y2WaKB0E=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/openstacksdk/tests.nix b/pkgs/development/python-modules/openstacksdk/tests.nix
index 9a2d6e37ab5..31a42990874 100644
--- a/pkgs/development/python-modules/openstacksdk/tests.nix
+++ b/pkgs/development/python-modules/openstacksdk/tests.nix
@@ -13,9 +13,10 @@
 , testscenarios
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "openstacksdk-tests";
   inherit (openstacksdk) version;
+  format = "other";
 
   src = openstacksdk.src;
 

From ee36d118681581690579293b11953b18507dd488 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Tue, 29 Nov 2022 22:32:01 +0100
Subject: [PATCH 24/65] postgresql_jdbc: 42.5.0 -> 42.5.1

Fixes CVE-2022-41946.

https://github.com/pgjdbc/pgjdbc/blob/REL42.5.1/CHANGELOG.md
---
 pkgs/development/java-modules/postgresql_jdbc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/java-modules/postgresql_jdbc/default.nix b/pkgs/development/java-modules/postgresql_jdbc/default.nix
index 7c20e42d4cc..cb1cc3e95f3 100644
--- a/pkgs/development/java-modules/postgresql_jdbc/default.nix
+++ b/pkgs/development/java-modules/postgresql_jdbc/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "postgresql-jdbc";
-  version = "42.5.0";
+  version = "42.5.1";
 
   src = fetchMavenArtifact {
     artifactId = "postgresql";
     groupId = "org.postgresql";
-    sha256 = "sha256-pNGLWrGuuShaixezZfQk8mhEUinKv45BIRXbYVK33uM=";
+    sha256 = "sha256-iei/+os3uUh5RgEsaQzwTzEDlTBRwcGT2I7ja2jTZa4=";
     inherit version;
   };
 

From fe75709cbf85eb44dce82ad97a56d3073a2401bc Mon Sep 17 00:00:00 2001
From: Keshav Kini <keshav.kini@gmail.com>
Date: Tue, 29 Nov 2022 13:50:56 -0800
Subject: [PATCH 25/65] zoom-us: 5.12.{3.11845,2.4816} -> 5.12.9.{13190,367}

---
 .../instant-messengers/zoom-us/default.nix           | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 8f78f0d9add..10f06393bfc 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -47,23 +47,23 @@ let
   # and often with different versions.  We write them on three lines
   # like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "5.12.3.11845";
-  versions.x86_64-darwin = "5.12.3.11845";
-  versions.x86_64-linux = "5.12.2.4816";
+  versions.aarch64-darwin = "5.12.9.13190";
+  versions.x86_64-darwin = "5.12.9.13190";
+  versions.x86_64-linux = "5.12.9.367";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-iDLxqG7/cdo60V0mFE3tX/Msi0rRUjoM8X9yq2rlvf0=";
+      hash = "sha256-Htug/hmp0OjysUY4q8RO1oqjSsa2sgpqiAERr6ahBuw=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-+YOtdoh8S50+GHRLb6TPYCqDtry7SnnNqo7USzkDc7c=";
+      hash = "sha256-nl+hrAZECaC5uceK8OZ/em3rY9pK4VrtezT6qCNmbCA=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-kgjooMqeZurzqIn3ADcgFjlqaC58dQNuIAHLx4M0S9I=";
+      hash = "sha256-7B9wS0myf6QkDq4ooqWen03s/36BeF7cSsOzjDdIw8g=";
     };
   };
 

From a2251e2225bceec4928bdb9fff90daa365695b58 Mon Sep 17 00:00:00 2001
From: Roman Volosatovs <rvolosatovs@riseup.net>
Date: Wed, 30 Nov 2022 09:11:50 +0100
Subject: [PATCH 26/65] module-list: include AMD SEV module

Signed-off-by: Roman Volosatovs <rvolosatovs@riseup.net>
---
 nixos/modules/module-list.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 215e001c2ec..d5550cd878e 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -46,6 +46,7 @@
   ./hardware/brillo.nix
   ./hardware/ckb-next.nix
   ./hardware/cpu/amd-microcode.nix
+  ./hardware/cpu/amd-sev.nix
   ./hardware/cpu/intel-microcode.nix
   ./hardware/cpu/intel-sgx.nix
   ./hardware/corectrl.nix

From fb8aaadfd7d9e7b6fe6d8e57bb632deedbb9f2e0 Mon Sep 17 00:00:00 2001
From: Daniel Nagy <danielnagy@posteo.de>
Date: Mon, 28 Nov 2022 23:32:15 +0100
Subject: [PATCH 27/65] visidata: 2.9.1 -> 2.10.2

Changelog: https://github.com/saulpw/visidata/blob/v2.10.2/CHANGELOG.md
---
 pkgs/applications/misc/visidata/default.nix | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/visidata/default.nix b/pkgs/applications/misc/visidata/default.nix
index 336a0821df1..36a7285b3d2 100644
--- a/pkgs/applications/misc/visidata/default.nix
+++ b/pkgs/applications/misc/visidata/default.nix
@@ -20,19 +20,22 @@
 , wcwidth
 , zstandard
 , setuptools
+, importlib-metadata
 , git
 , withPcap ? true, dpkt, dnslib
 , withXclip ? stdenv.isLinux, xclip
+, testers
+, visidata
 }:
 buildPythonApplication rec {
   pname = "visidata";
-  version = "2.9.1";
+  version = "2.10.2";
 
   src = fetchFromGitHub {
     owner = "saulpw";
     repo = "visidata";
     rev = "v${version}";
-    hash = "sha256-PKj+imTSAGMpF1tkN0WmE3l/4FmWkm/ktIDzF2ku48s=";
+    hash = "sha256-OKCrlUWHgbaLZJPVvs9lnw4cD27pRoO7F9oel1NzT6A=";
   };
 
   propagatedBuildInputs = [
@@ -64,6 +67,7 @@ buildPythonApplication rec {
     zstandard
     odfpy
     setuptools
+    importlib-metadata
   ] ++ lib.optionals withPcap [ dpkt dnslib ]
   ++ lib.optional withXclip xclip;
 
@@ -75,6 +79,7 @@ buildPythonApplication rec {
   doCheck = stdenv.buildPlatform == stdenv.hostPlatform;
 
   checkPhase = ''
+    runHook preCheck
     # disable some tests which require access to the network
     rm tests/load-http.vd            # http
     rm tests/graph-cursor-nosave.vd  # http
@@ -87,13 +92,21 @@ buildPythonApplication rec {
 
     substituteInPlace dev/test.sh --replace "bin/vd" "$out/bin/vd"
     bash dev/test.sh
+    runHook postCheck
   '';
 
+  pythonImportsCheck = ["visidata"];
+
+  passthru.tests.version = testers.testVersion {
+    package = visidata;
+    version = "v${version}";
+  };
+
   meta = {
     description = "Interactive terminal multitool for tabular data";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ raskin markus1189 ];
-    homepage = "http://visidata.org/";
+    homepage = "https://visidata.org/";
     changelog = "https://github.com/saulpw/visidata/blob/v${version}/CHANGELOG.md";
   };
 }

From b232557c458e09161f5e3d0b97e6a3452715374b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Deniz=20Kolua=C3=A7=C4=B1k?= <koluacik@disroot.org>
Date: Wed, 30 Nov 2022 14:33:04 +0300
Subject: [PATCH 28/65] zathura: 0.4.9 -> 0.5.2

https://pwmt.org/projects/zathura/changelog/0.5.2/index.html
Zathura plugins are updated to the latest versions as well.
---
 pkgs/applications/misc/zathura/cb/default.nix |  4 ++--
 .../misc/zathura/core/default.nix             |  5 ++--
 .../misc/zathura/pdf-mupdf/default.nix        |  6 ++---
 .../zathura/pdf-mupdf/fix-mupdf-1.20.patch    | 24 -------------------
 .../misc/zathura/pdf-poppler/default.nix      |  4 ++--
 pkgs/applications/misc/zathura/ps/default.nix |  4 ++--
 6 files changed, 10 insertions(+), 37 deletions(-)
 delete mode 100644 pkgs/applications/misc/zathura/pdf-mupdf/fix-mupdf-1.20.patch

diff --git a/pkgs/applications/misc/zathura/cb/default.nix b/pkgs/applications/misc/zathura/cb/default.nix
index 69ecb1cfd1b..ea2c74fda37 100644
--- a/pkgs/applications/misc/zathura/cb/default.nix
+++ b/pkgs/applications/misc/zathura/cb/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "zathura-cb";
-  version = "0.1.8";
+  version = "0.1.10";
 
   src = fetchurl {
     url = "https://pwmt.org/projects/${pname}/download/${pname}-${version}.tar.xz";
-    sha256 = "1i6cf0vks501cggwvfsl6qb7mdaf3sszdymphimfvnspw810faj5";
+    sha256 = "1j5v32f9ki35v1jc7a067anhlgqplzrp4fqvznlixfhcm0bwmc49";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config gettext ];
diff --git a/pkgs/applications/misc/zathura/core/default.nix b/pkgs/applications/misc/zathura/core/default.nix
index 6398b88ffcc..29140b04dd9 100644
--- a/pkgs/applications/misc/zathura/core/default.nix
+++ b/pkgs/applications/misc/zathura/core/default.nix
@@ -10,11 +10,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "zathura";
-  version = "0.4.9";
+  version = "0.5.2";
 
   src = fetchurl {
     url = "https://pwmt.org/projects/${pname}/download/${pname}-${version}.tar.xz";
-    sha256 = "0msy7s57mlx0wya99qpia4fpcy40pbj253kmx2y97nb0sqnc8c7w";
+    sha256 = "15314m9chmh5jkrd9vk2h2gwcwkcffv2kjcxkd4v3wmckz5sfjy6";
   };
 
   outputs = [ "bin" "man" "dev" "out" ];
@@ -23,7 +23,6 @@ stdenv.mkDerivation rec {
   # https://github.com/pwmt/zathura/blob/master/meson_options.txt
   mesonFlags = [
     "-Dsqlite=enabled"
-    "-Dmagic=enabled"
     "-Dmanpages=enabled"
     "-Dconvert-icon=enabled"
     "-Dsynctex=enabled"
diff --git a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
index 3584d24f149..25856f0e58d 100644
--- a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
@@ -14,16 +14,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.3.8";
+  version = "0.4.0";
   pname = "zathura-pdf-mupdf";
 
   src = fetchurl {
     url = "https://pwmt.org/projects/${pname}/download/${pname}-${version}.tar.xz";
-    sha256 = "sha256-wgW0z1ANjP6ezqreVOX6jUzRKYzYXxem9QxkclkRYhc=";
+    sha256 = "0pcjxvlh4hls8mjhjghhhihyy2kza8l27wdx0yq4bkd1g1b5f74c";
   };
 
-  patches = [ ./fix-mupdf-1.20.patch ];
-
   nativeBuildInputs = [ meson ninja pkg-config ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/zathura/pdf-mupdf/fix-mupdf-1.20.patch b/pkgs/applications/misc/zathura/pdf-mupdf/fix-mupdf-1.20.patch
deleted file mode 100644
index 6790721a76c..00000000000
--- a/pkgs/applications/misc/zathura/pdf-mupdf/fix-mupdf-1.20.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 5a5bb2634812f4c0530f5688a06269aaa4cd11dd Mon Sep 17 00:00:00 2001
-From: Osama Rebach <osamarebach@gmail.com>
-Date: Fri, 19 Aug 2022 13:39:49 +0100
-Subject: [PATCH] fix fz_search_stext_page
-
----
- zathura-pdf-mupdf/search.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/zathura-pdf-mupdf/search.c b/zathura-pdf-mupdf/search.c
-index f84dea0..419e5f4 100644
---- a/zathura-pdf-mupdf/search.c
-+++ b/zathura-pdf-mupdf/search.c
-@@ -41,7 +41,7 @@ pdf_page_search_text(zathura_page_t* page, void* data, const char* text, zathura
- 
-   fz_quad* hit_bbox = fz_malloc_array(mupdf_page->ctx, N_SEARCH_RESULTS, fz_quad);
-   int num_results = fz_search_stext_page(mupdf_page->ctx, mupdf_page->text,
--      text, hit_bbox, N_SEARCH_RESULTS);
-+      text, NULL, hit_bbox, N_SEARCH_RESULTS);
- 
-   fz_rect r;
-   for (int i = 0; i < num_results; i++) {
--- 
-2.37.1
diff --git a/pkgs/applications/misc/zathura/pdf-poppler/default.nix b/pkgs/applications/misc/zathura/pdf-poppler/default.nix
index b76e72a6970..57f33559c66 100644
--- a/pkgs/applications/misc/zathura/pdf-poppler/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-poppler/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "zathura-pdf-poppler";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchurl {
     url = "https://pwmt.org/projects/${pname}/download/${pname}-${version}.tar.xz";
-    sha256 = "1vfl4vkyy3rf39r1sqaa7y8113bgkh2bkfq3nn2inis9mrykmk6m";
+    sha256 = "12qhkshpp1wjfpjmjccsyi6wscqyqvaa19j85prjpyf65i9jg0gf";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config zathura_core ];
diff --git a/pkgs/applications/misc/zathura/ps/default.nix b/pkgs/applications/misc/zathura/ps/default.nix
index ee63a9df53b..151a63af33e 100644
--- a/pkgs/applications/misc/zathura/ps/default.nix
+++ b/pkgs/applications/misc/zathura/ps/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "zathura-ps";
-  version = "0.2.6";
+  version = "0.2.7";
 
   src = fetchurl {
     url = "https://pwmt.org/projects/${pname}/download/${pname}-${version}.tar.xz";
-    sha256 = "0wygq89nyjrjnsq7vbpidqdsirjm6iq4w2rijzwpk2f83ys8bc3y";
+    sha256 = "0ilf63wxn1yzis9m3qs8mxbk316yxdzwxrrv86wpiygm9hhgk5sq";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config gettext ];

From a7e188a80f0f9d2e928120ee88773a40548225da Mon Sep 17 00:00:00 2001
From: Colin Arnott <colin@urandom.co.uk>
Date: Wed, 30 Nov 2022 15:56:34 +0000
Subject: [PATCH 29/65] gnostic: init at 0.6.8

Fixes #142070
---
 .../development/compilers/gnostic/default.nix | 26 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 28 insertions(+)
 create mode 100644 pkgs/development/compilers/gnostic/default.nix

diff --git a/pkgs/development/compilers/gnostic/default.nix b/pkgs/development/compilers/gnostic/default.nix
new file mode 100644
index 00000000000..f0d1b53ca23
--- /dev/null
+++ b/pkgs/development/compilers/gnostic/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "gnostic";
+  version = "0.6.8";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-+/KZmwVV3pnbv3JNwNk9Q2gcTyDxV1tgsDzW5IYnnds=";
+  };
+
+  vendorHash = "sha256-OoI1/OPBgAy4AysPPSCXGmf0S4opzxO7ZrwBsQYImwU=";
+
+  # some tests are broken and others require network access
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/google/gnostic";
+    description = "A compiler for APIs described by the OpenAPI Specification with plugins for code generation and other API support tasks";
+    changelog = "https://github.com/google/gnostic/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ urandom ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index be2fefff86c..050b34486af 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -14426,6 +14426,8 @@ with pkgs;
 
   glslang = callPackage ../development/compilers/glslang { };
 
+  gnostic = callPackage ../development/compilers/gnostic {};
+
   go-junit-report = callPackage ../development/tools/go-junit-report { };
 
   gobang = callPackage ../development/tools/database/gobang {

From 3f20add24fe6bcc0ae230819bb83ee7683ce5e2c Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Wed, 16 Mar 2022 15:01:51 +0000
Subject: [PATCH 30/65] crowdsec: init at 1.4.2

Fixes #155822
Closes #162633
---
 pkgs/tools/security/crowdsec/default.nix | 60 ++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix          |  2 +
 2 files changed, 62 insertions(+)
 create mode 100644 pkgs/tools/security/crowdsec/default.nix

diff --git a/pkgs/tools/security/crowdsec/default.nix b/pkgs/tools/security/crowdsec/default.nix
new file mode 100644
index 00000000000..ce76c5d9b45
--- /dev/null
+++ b/pkgs/tools/security/crowdsec/default.nix
@@ -0,0 +1,60 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "crowdsec";
+  version = "1.4.2";
+
+  src = fetchFromGitHub {
+    owner = "crowdsecurity";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-hL3+hTOuwcbxiVZeq9oZjfKI1TJJt64g+74NolA3Drc=";
+  };
+
+  vendorHash = "sha256-FPsoufB9UDgBDIE3yUq4doBse3qgjP19ussYnMAxntk=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  subPackages = [
+    "cmd/crowdsec"
+    "cmd/crowdsec-cli"
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/crowdsecurity/crowdsec/pkg/cwversion.Version=v${version}"
+    "-X github.com/crowdsecurity/crowdsec/pkg/cwversion.BuildDate=1970-01-01_00:00:00"
+  ];
+
+  postBuild = "mv $GOPATH/bin/{crowdsec-cli,cscli}";
+
+  postInstall = ''
+    mkdir -p $out/share/crowdsec
+    cp -r ./config $out/share/crowdsec/
+
+    installShellCompletion --cmd cscli \
+      --bash <($out/bin/cscli completion bash) \
+      --fish <($out/bin/cscli completion fish) \
+      --zsh <($out/bin/cscli completion zsh)
+  '';
+
+  meta = with lib; {
+    homepage = "https://crowdsec.net/";
+    changelog = "https://github.com/crowdsecurity/crowdsec/releases/tag/v${version}";
+    description = "CrowdSec is a free, open-source and collaborative IPS";
+    longDescription = ''
+      CrowdSec is a free, modern & collaborative behavior detection engine,
+      coupled with a global IP reputation network. It stacks on fail2ban's
+      philosophy but is IPV6 compatible and 60x faster (Go vs Python), uses Grok
+      patterns to parse logs and YAML scenario to identify behaviors. CrowdSec
+      is engineered for modern Cloud/Containers/VM based infrastructures (by
+      decoupling detection and remediation). Once detected you can remedy
+      threats with various bouncers (firewall block, nginx http 403, Captchas,
+      etc.) while the aggressive IP can be sent to CrowdSec for curation before
+      being shared among all users to further improve everyone's security.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ jk urandom ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 86313b938df..68b58e86355 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3681,6 +3681,8 @@ with pkgs;
 
   crossplane = with python3Packages; toPythonApplication crossplane;
 
+  crowdsec = callPackage ../tools/security/crowdsec { };
+
   crunch = callPackage ../tools/security/crunch { };
 
   crudini = callPackage ../tools/misc/crudini { };

From ca6c2c211148bf090ad954f361cac97fa453c901 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 17:24:39 -0500
Subject: [PATCH 31/65] nixos/docker-image: clean up let-in binding

---
 nixos/modules/profiles/docker-container.nix | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/profiles/docker-container.nix b/nixos/modules/profiles/docker-container.nix
index 183645de36f..5365e49711d 100644
--- a/nixos/modules/profiles/docker-container.nix
+++ b/nixos/modules/profiles/docker-container.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
-let inherit (pkgs) writeScript; in
-
 let
- pkgs2storeContents = l : map (x: { object = x; symlink = "none"; }) l;
+  inherit (pkgs) writeScript;
 
-in {
+  pkgs2storeContents = map (x: { object = x; symlink = "none"; });
+in
+
+{
   # Docker image config.
   imports = [
     ../installer/cd-dvd/channel.nix

From fd4f865645cfba121f2ac6d052786cdf9638b318 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 17:26:31 -0500
Subject: [PATCH 32/65] nixos/nixpkgs: remove unused binding

---
 nixos/modules/misc/nixpkgs.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/misc/nixpkgs.nix b/nixos/modules/misc/nixpkgs.nix
index 7f7417226d1..7f44c3f6f3f 100644
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@@ -23,12 +23,12 @@ let
     optionalAttrs (lhs ? packageOverrides) {
       packageOverrides = pkgs:
         optCall lhs.packageOverrides pkgs //
-        optCall (attrByPath ["packageOverrides"] ({}) rhs) pkgs;
+        optCall (attrByPath [ "packageOverrides" ] { } rhs) pkgs;
     } //
     optionalAttrs (lhs ? perlPackageOverrides) {
       perlPackageOverrides = pkgs:
         optCall lhs.perlPackageOverrides pkgs //
-        optCall (attrByPath ["perlPackageOverrides"] ({}) rhs) pkgs;
+        optCall (attrByPath [ "perlPackageOverrides" ] { } rhs) pkgs;
     };
 
   configType = mkOptionType {
@@ -67,11 +67,6 @@ let
   # Context for messages
   hostPlatformLine = optionalString hasHostPlatform "${showOptionWithDefLocs opt.hostPlatform}";
   buildPlatformLine = optionalString hasBuildPlatform "${showOptionWithDefLocs opt.buildPlatform}";
-  platformLines = optionalString hasPlatform ''
-    Your system configuration configures nixpkgs with platform parameters:
-    ${hostPlatformLine
-    }${buildPlatformLine
-    }'';
 
   legacyOptionsDefined =
     optional (opt.localSystem.highestPrio < (mkDefault {}).priority) opt.system

From a356511f1ade96ba4c7b1adae371693db8ea026b Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 17:29:36 -0500
Subject: [PATCH 33/65] nixos/crossfire-server: remove unnecessary parentheses

---
 nixos/modules/services/games/crossfire-server.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/games/crossfire-server.nix b/nixos/modules/services/games/crossfire-server.nix
index 7820a08be40..0849667e61c 100644
--- a/nixos/modules/services/games/crossfire-server.nix
+++ b/nixos/modules/services/games/crossfire-server.nix
@@ -131,9 +131,9 @@ in {
         exp_table = "";
         forbid = "";
         metaserver2 = "";
-        motd = (fileContents "${cfg.package}/etc/crossfire/motd");
-        news = (fileContents "${cfg.package}/etc/crossfire/news");
-        rules = (fileContents "${cfg.package}/etc/crossfire/rules");
+        motd = fileContents "${cfg.package}/etc/crossfire/motd";
+        news = fileContents "${cfg.package}/etc/crossfire/news";
+        rules = fileContents "${cfg.package}/etc/crossfire/rules";
         settings = "";
         stat_bonus = "";
       } // cfg.configFiles);

From 1b9b057d9248539e20c25609edc690d457d42b4e Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 17:31:28 -0500
Subject: [PATCH 34/65] nixos/buildbot: syntax clean up

---
 .../services/continuous-integration/buildbot/master.nix     | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix
index d9055149b77..d00e0ba3956 100644
--- a/nixos/modules/services/continuous-integration/buildbot/master.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/master.nix
@@ -10,7 +10,7 @@ let
 
   python = cfg.package.pythonModule;
 
-  escapeStr = s: escape ["'"] s;
+  escapeStr = escape [ "'" ];
 
   defaultMasterCfg = pkgs.writeText "master.cfg" ''
     from buildbot.plugins import *
@@ -245,9 +245,7 @@ in {
         description = "Buildbot User.";
         isNormalUser = true;
         createHome = true;
-        home = cfg.home;
-        group = cfg.group;
-        extraGroups = cfg.extraGroups;
+        inherit (cfg) home group extraGroups;
         useDefaultShell = true;
       };
     };

From 025142b808b4511f1ef31a2b553b733b8444ddb7 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 17:32:53 -0500
Subject: [PATCH 35/65] nixos/hbase: remove unnecessary parenthesis

---
 nixos/modules/services/cluster/hadoop/hbase.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/cluster/hadoop/hbase.nix b/nixos/modules/services/cluster/hadoop/hbase.nix
index 237a1d428fe..97951ebfe33 100644
--- a/nixos/modules/services/cluster/hadoop/hbase.nix
+++ b/nixos/modules/services/cluster/hadoop/hbase.nix
@@ -141,9 +141,9 @@ in
 
       services.hadoop.hbaseSiteInternal."hbase.rootdir" = cfg.hbase.rootdir;
 
-      networking.firewall.allowedTCPPorts = (mkIf cfg.hbase.master.openFirewall [
+      networking.firewall.allowedTCPPorts = mkIf cfg.hbase.master.openFirewall [
         16000 16010
-      ]);
+      ];
 
     })
 
@@ -168,9 +168,9 @@ in
       services.hadoop.hbaseSiteInternal."hbase.rootdir" = cfg.hbase.rootdir;
 
       networking = {
-        firewall.allowedTCPPorts = (mkIf cfg.hbase.regionServer.openFirewall [
+        firewall.allowedTCPPorts = mkIf cfg.hbase.regionServer.openFirewall [
           16020 16030
-        ]);
+        ];
         hosts = mkIf cfg.hbase.regionServer.overrideHosts {
           "127.0.0.2" = mkForce [ ];
           "::1" = mkForce [ ];

From dfff1a2b83d3cd795a3178a3142544eac7026153 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 17:36:07 -0500
Subject: [PATCH 36/65] nixos/prosody: simplify logic

---
 nixos/modules/services/networking/prosody.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/prosody.nix b/nixos/modules/services/networking/prosody.nix
index 6cd4678ae4a..2d122bcf655 100644
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@@ -263,7 +263,7 @@ let
     if builtins.isString x then ''"${x}"''
     else if builtins.isBool x then boolToString x
     else if builtins.isInt x then toString x
-    else if builtins.isList x then ''{ ${lib.concatStringsSep ", " (map (n: toLua n) x) } }''
+    else if builtins.isList x then "{ ${lib.concatMapStringsSep ", " toLua x} }"
     else throw "Invalid Lua value";
 
   createSSLOptsStr = o: ''

From d65639ce40d4f26c362732d81e1f27fb88d6c9e5 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 17:38:52 -0500
Subject: [PATCH 37/65] nixos/redis: simplify

---
 nixos/modules/services/databases/redis.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index 95c0afb8f83..1464f4487e3 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -67,7 +67,7 @@ in {
       '');
 
       servers = mkOption {
-        type = with types; attrsOf (submodule ({config, name, ...}@args: {
+        type = with types; attrsOf (submodule ({ config, name, ... }: {
           options = {
             enable = mkEnableOption (lib.mdDoc ''
               Redis server.
@@ -271,14 +271,11 @@ in {
           };
           config.settings = mkMerge [
             {
-              port = config.port;
+              inherit (config) port logfile databases maxclients appendOnly;
               daemonize = false;
               supervised = "systemd";
               loglevel = config.logLevel;
-              logfile = config.logfile;
               syslog-enabled = config.syslog;
-              databases = config.databases;
-              maxclients = config.maxclients;
               save = if config.save == []
                 then ''""'' # Disable saving with `save = ""`
                 else map
@@ -286,12 +283,11 @@ in {
                   config.save;
               dbfilename = "dump.rdb";
               dir = "/var/lib/${redisName name}";
-              appendOnly = config.appendOnly;
               appendfsync = config.appendFsync;
               slowlog-log-slower-than = config.slowLogLogSlowerThan;
               slowlog-max-len = config.slowLogMaxLen;
             }
-            (mkIf (config.bind != null) { bind = config.bind; })
+            (mkIf (config.bind != null) { inherit (config) bind; })
             (mkIf (config.unixSocket != null) {
               unixsocket = config.unixSocket;
               unixsocketperm = toString config.unixSocketPerm;

From 55acad5c357c3f49808dc8c01982ec3ed4e2d27d Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 17:56:56 -0500
Subject: [PATCH 38/65] nixos/softether: apply statix suggestions

---
 nixos/modules/services/networking/softether.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/networking/softether.nix b/nixos/modules/services/networking/softether.nix
index 8d69b5304c8..c8e888eafcc 100644
--- a/nixos/modules/services/networking/softether.nix
+++ b/nixos/modules/services/networking/softether.nix
@@ -5,7 +5,7 @@ with lib;
 let
   cfg = config.services.softether;
 
-  package = cfg.package.override { dataDir = cfg.dataDir; };
+  package = cfg.package.override { inherit (cfg) dataDir; };
 
 in
 {
@@ -88,7 +88,7 @@ in
       };
     }
 
-    (mkIf (cfg.vpnserver.enable) {
+    (mkIf cfg.vpnserver.enable {
       systemd.services.vpnserver = {
         description = "SoftEther VPN Server";
         after = [ "softether-init.service" ];
@@ -109,7 +109,7 @@ in
       };
     })
 
-    (mkIf (cfg.vpnbridge.enable) {
+    (mkIf cfg.vpnbridge.enable {
       systemd.services.vpnbridge = {
         description = "SoftEther VPN Bridge";
         after = [ "softether-init.service" ];
@@ -130,7 +130,7 @@ in
       };
     })
 
-    (mkIf (cfg.vpnclient.enable) {
+    (mkIf cfg.vpnclient.enable {
       systemd.services.vpnclient = {
         description = "SoftEther VPN Client";
         after = [ "softether-init.service" ];

From 7dfc2a1369e115e565dc7fa1e18d847bd6c286f9 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 17:58:55 -0500
Subject: [PATCH 39/65] nixos/user-groups: remove unnecessary parentheses

---
 nixos/modules/config/users-groups.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 2660b0e6c93..61d70ccc19b 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -618,7 +618,7 @@ in {
     # Install all the user shells
     environment.systemPackages = systemShells;
 
-    environment.etc = (mapAttrs' (_: { packages, name, ... }: {
+    environment.etc = mapAttrs' (_: { packages, name, ... }: {
       name = "profiles/per-user/${name}";
       value.source = pkgs.buildEnv {
         name = "user-environment";
@@ -626,7 +626,7 @@ in {
         inherit (config.environment) pathsToLink extraOutputsToInstall;
         inherit (config.system.path) ignoreCollisions postBuild;
       };
-    }) (filterAttrs (_: u: u.packages != []) cfg.users));
+    }) (filterAttrs (_: u: u.packages != []) cfg.users);
 
     environment.profiles = [
       "$HOME/.nix-profile"

From d1c73c25435d17a2221968ff138b63cda50b2eb3 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 17:59:52 -0500
Subject: [PATCH 40/65] nixos/keepalived: remove unnecessary parentheses

---
 nixos/modules/services/networking/keepalived/default.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/networking/keepalived/default.nix b/nixos/modules/services/networking/keepalived/default.nix
index e9df08f00c3..29fbea5545c 100644
--- a/nixos/modules/services/networking/keepalived/default.nix
+++ b/nixos/modules/services/networking/keepalived/default.nix
@@ -84,13 +84,11 @@ let
     ''
   ) vrrpInstances);
 
-  virtualIpLine = (ip:
-    ip.addr
+  virtualIpLine = ip: ip.addr
     + optionalString (notNullOrEmpty ip.brd) " brd ${ip.brd}"
     + optionalString (notNullOrEmpty ip.dev) " dev ${ip.dev}"
     + optionalString (notNullOrEmpty ip.scope) " scope ${ip.scope}"
-    + optionalString (notNullOrEmpty ip.label) " label ${ip.label}"
-  );
+    + optionalString (notNullOrEmpty ip.label) " label ${ip.label}";
 
   notNullOrEmpty = s: !(s == null || s == "");
 

From 1ecbafd0a2853a3aac0e5a483c8cc7cfd87f3ac2 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 18:01:29 -0500
Subject: [PATCH 41/65] nixos/discourse: remove unnecessary parentheses

---
 nixos/modules/services/web-apps/discourse.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/discourse.nix b/nixos/modules/services/web-apps/discourse.nix
index 6500b8cad21..1ab0e679a54 100644
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@@ -19,9 +19,9 @@ let
   # We only want to create a database if we're actually going to connect to it.
   databaseActuallyCreateLocally = cfg.database.createLocally && cfg.database.host == null;
 
-  tlsEnabled = (cfg.enableACME
+  tlsEnabled = cfg.enableACME
                 || cfg.sslCertificate != null
-                || cfg.sslCertificateKey != null);
+                || cfg.sslCertificateKey != null;
 in
 {
   options = {

From f97daa68bc8c77be68c24fd8c51175c7237c61f8 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 18:12:53 -0500
Subject: [PATCH 42/65] nixos/gammu-smsd: remove unnecessary parentheses

---
 nixos/modules/services/misc/gammu-smsd.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/misc/gammu-smsd.nix b/nixos/modules/services/misc/gammu-smsd.nix
index 72e83a249c8..2c7d90b28de 100644
--- a/nixos/modules/services/misc/gammu-smsd.nix
+++ b/nixos/modules/services/misc/gammu-smsd.nix
@@ -45,8 +45,8 @@ let
   initDBDir = "share/doc/gammu/examples/sql";
 
   gammuPackage = with cfg.backend; (pkgs.gammu.override {
-    dbiSupport = (service == "sql" && sql.driver == "sqlite");
-    postgresSupport = (service == "sql" && sql.driver == "native_pgsql");
+    dbiSupport = service == "sql" && sql.driver == "sqlite";
+    postgresSupport = service == "sql" && sql.driver == "native_pgsql";
   });
 
 in {

From b865b96b9734658add24b41bf002fd8053ec8f73 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 18:13:58 -0500
Subject: [PATCH 43/65] nixos/invoiceplane: remove unnecessary parentheses

---
 nixos/modules/services/web-apps/invoiceplane.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/invoiceplane.nix b/nixos/modules/services/web-apps/invoiceplane.nix
index cccf70295e8..99e7b1f96ea 100644
--- a/nixos/modules/services/web-apps/invoiceplane.nix
+++ b/nixos/modules/services/web-apps/invoiceplane.nix
@@ -327,7 +327,7 @@ in
     )) eachSite;
 
     systemd.services =
-      (mapAttrs' (hostName: cfg: (
+      mapAttrs' (hostName: cfg: (
         nameValuePair "invoiceplane-cron-${hostName}" (mkIf cfg.cron.enable {
           serviceConfig = {
             Type = "oneshot";
@@ -335,7 +335,7 @@ in
             ExecStart = "${pkgs.curl}/bin/curl --header 'Host: ${hostName}' http://localhost/invoices/cron/recur/${cfg.cron.key}";
           };
         })
-    )) eachSite);
+    )) eachSite;
 
   }
 

From 0561211b14e8fe3acb72e09dfa701678e2aa5d29 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Wed, 30 Nov 2022 20:43:52 -0500
Subject: [PATCH 44/65] nil: 2022-11-15 -> 2022-12-01

Diff: https://github.com/oxalica/nil/compare/2022-11-15...2022-12-01
---
 pkgs/development/tools/nil/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/nil/default.nix b/pkgs/development/tools/nil/default.nix
index 60232a41e90..de87838105b 100644
--- a/pkgs/development/tools/nil/default.nix
+++ b/pkgs/development/tools/nil/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nil";
-  version = "2022-11-15";
+  version = "2022-12-01";
 
   src = fetchFromGitHub {
     owner = "oxalica";
     repo = pname;
     rev = version;
-    hash = "sha256-KzQmGCEaOACOqaE1LsVZsqn18XpjlUbGWztDEI+o++w=";
+    hash = "sha256-E/QGmoL7Q3GDR2/I5o2CAMHMcmPQEJAySke1s+nOaho=";
   };
 
-  cargoHash = "sha256-t5HfL7DKMcWJGod6x30NoHYYlAza++fEdEVvfvFWems=";
+  cargoHash = "sha256-T3i86L6cF6uFbSs7xtKHGzB6XrE9jn2RZghxFzDleXU=";
 
   CFG_DATE = version;
   CFG_REV = "release";

From c88944f025429430a58dff13b9b4c653ce955535 Mon Sep 17 00:00:00 2001
From: Andrew Marshall <andrew@johnandrewmarshall.com>
Date: Wed, 12 Oct 2022 08:27:21 -0400
Subject: [PATCH 45/65] nixos: nix.readOnlyStore -> boot.readOnlyNixStore

The placement of this option under `nix` was misleading, as it is not
configuration of the Nix daemon, but rather configuration of the NixOS
boot process and how it mounts the Nix store. As such, make it an option
of `boot` to clarify what it actually affects, and imply that it will
only take effect on a reboot.

Since it no longer has the context of nix, adjust the name to include
it.
---
 .../from_md/release-notes/rl-2305.section.xml      |  7 +++++++
 nixos/doc/manual/release-notes/rl-2305.section.md  |  2 ++
 nixos/modules/services/misc/nix-daemon.nix         | 12 +-----------
 nixos/modules/system/boot/stage-2-init.sh          |  2 +-
 nixos/modules/system/boot/stage-2.nix              | 14 ++++++++++++--
 5 files changed, 23 insertions(+), 14 deletions(-)

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index c8bd237dbb0..757a719bfef 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -78,6 +78,13 @@
           relying on this should provide their own implementation.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>nix.readOnlyStore</literal> option has been
+          renamed to <literal>boot.readOnlyNixStore</literal> to clarify
+          that it configures the NixOS boot process, not the Nix daemon.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-23.05-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index c438fdc1aaa..1b105fdd1f3 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -29,6 +29,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The EC2 image module previously detected and activated swap-formatted instance store devices and partitions in stage-1 (initramfs). This behaviour has been removed. Users relying on this should provide their own implementation.
 
+- The `nix.readOnlyStore` option has been renamed to `boot.readOnlyNixStore` to clarify that it configures the NixOS boot process, not the Nix daemon.
+
 ## Other Notable Changes {#sec-release-23.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index 8eb1ed53d0c..c88fceb9a92 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -115,6 +115,7 @@ in
     (mkRenamedOptionModuleWith { sinceRelease = 2003; from = [ "nix" "useChroot" ]; to = [ "nix" "useSandbox" ]; })
     (mkRenamedOptionModuleWith { sinceRelease = 2003; from = [ "nix" "chrootDirs" ]; to = [ "nix" "sandboxPaths" ]; })
     (mkRenamedOptionModuleWith { sinceRelease = 2205; from = [ "nix" "daemonIONiceLevel" ]; to = [ "nix" "daemonIOSchedPriority" ]; })
+    (mkRenamedOptionModuleWith { sinceRelease = 2211; from = [ "nix" "readOnlyStore" ]; to = [ "boot" "readOnlyNixStore" ]; })
     (mkRemovedOptionModule [ "nix" "daemonNiceLevel" ] "Consider nix.daemonCPUSchedPolicy instead.")
   ] ++ mapAttrsToList (oldConf: newConf: mkRenamedOptionModuleWith { sinceRelease = 2205; from = [ "nix" oldConf ]; to = [ "nix" "settings" newConf ]; }) legacyConfMappings;
 
@@ -366,17 +367,6 @@ in
         '';
       };
 
-      readOnlyStore = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          If set, NixOS will enforce the immutability of the Nix store
-          by making {file}`/nix/store` a read-only bind
-          mount.  Nix will automatically make the store writable when
-          needed.
-        '';
-      };
-
       nixPath = mkOption {
         type = types.listOf types.str;
         default = [
diff --git a/nixos/modules/system/boot/stage-2-init.sh b/nixos/modules/system/boot/stage-2-init.sh
index f2a839d0786..78cc8e8d45a 100755
--- a/nixos/modules/system/boot/stage-2-init.sh
+++ b/nixos/modules/system/boot/stage-2-init.sh
@@ -68,7 +68,7 @@ fi
 # like squashfs.
 chown -f 0:30000 /nix/store
 chmod -f 1775 /nix/store
-if [ -n "@readOnlyStore@" ]; then
+if [ -n "@readOnlyNixStore@" ]; then
     if ! [[ "$(findmnt --noheadings --output OPTIONS /nix/store)" =~ ro(,|$) ]]; then
         if [ -z "$container" ]; then
             mount --bind /nix/store /nix/store
diff --git a/nixos/modules/system/boot/stage-2.nix b/nixos/modules/system/boot/stage-2.nix
index 6b4193ea296..6ed915c339e 100644
--- a/nixos/modules/system/boot/stage-2.nix
+++ b/nixos/modules/system/boot/stage-2.nix
@@ -10,9 +10,8 @@ let
     src = ./stage-2-init.sh;
     shellDebug = "${pkgs.bashInteractive}/bin/bash";
     shell = "${pkgs.bash}/bin/bash";
-    inherit (config.boot) systemdExecutable extraSystemdUnitPaths;
+    inherit (config.boot) readOnlyNixStore systemdExecutable extraSystemdUnitPaths;
     isExecutable = true;
-    inherit (config.nix) readOnlyStore;
     inherit useHostResolvConf;
     inherit (config.system.build) earlyMountScript;
     path = lib.makeBinPath ([
@@ -42,6 +41,17 @@ in
         '';
       };
 
+      readOnlyNixStore = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc ''
+          If set, NixOS will enforce the immutability of the Nix store
+          by making {file}`/nix/store` a read-only bind
+          mount.  Nix will automatically make the store writable when
+          needed.
+        '';
+      };
+
       systemdExecutable = mkOption {
         default = "/run/current-system/systemd/lib/systemd/systemd";
         type = types.str;

From 722cfb65078aa13fb665d3394fddef889c11cd22 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 1 Dec 2022 05:43:59 +0000
Subject: [PATCH 46/65] dolibarr: 16.0.1 -> 16.0.3

---
 pkgs/servers/web-apps/dolibarr/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/web-apps/dolibarr/default.nix b/pkgs/servers/web-apps/dolibarr/default.nix
index 0d6de0c6199..7176161d2de 100644
--- a/pkgs/servers/web-apps/dolibarr/default.nix
+++ b/pkgs/servers/web-apps/dolibarr/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dolibarr";
-  version = "16.0.1";
+  version = "16.0.3";
 
   src = fetchFromGitHub {
     owner = "Dolibarr";
     repo = "dolibarr";
     rev = version;
-    sha256 = "sha256-67Ox0DP4vfiz8GgD3nfa4FyB6Qrqkc2zt1iMS584CWs=";
+    sha256 = "sha256-Zkjmm2DAaAGQc1IigMYDpE5b+YaYU8oFMHZSqBEBsRw=";
   };
 
   dontBuild = true;

From 10b0af8f45c6cafbd8e87c5baa5be87accbb2db3 Mon Sep 17 00:00:00 2001
From: Johannes Schleifenbaum <johannes@js-webcoding.de>
Date: Thu, 1 Dec 2022 10:49:44 +0100
Subject: [PATCH 47/65] libreddit: 0.24.1 -> 0.24.2

---
 pkgs/servers/libreddit/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/libreddit/default.nix b/pkgs/servers/libreddit/default.nix
index 61978936d78..32b58e19f58 100644
--- a/pkgs/servers/libreddit/default.nix
+++ b/pkgs/servers/libreddit/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "libreddit";
-  version = "0.24.1";
+  version = "0.24.2";
 
   src = fetchFromGitHub {
     owner = "libreddit";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-LS9yUjKv0GxK6wGo0f5jHAn7vyo+tvgHd3NWLYpAQOs=";
+    hash = "sha256-TT0DTD/X4cHIZGrwxyqOOFevAHwqYfmIJ13+oscQpws=";
   };
 
-  cargoSha256 = "sha256-14tJLhWITCz/e+XuCww2GVZ+sXy08LQe+DpL4tkLUzE=";
+  cargoSha256 = "sha256-RAToJZTaWVnxGdWSJdLSJ7JUPT+l5VfPzvNOhXgdneY=";
 
   buildInputs = lib.optional stdenv.isDarwin [
     Security

From d6e589c0235eb681d0b9626467b7d0a28f31bcf6 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Thu, 1 Dec 2022 17:51:04 +0800
Subject: [PATCH 48/65] cargo-apk: init at 0.9.6

---
 .../tools/rust/cargo-apk/default.nix          | 24 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  1 +
 2 files changed, 25 insertions(+)
 create mode 100644 pkgs/development/tools/rust/cargo-apk/default.nix

diff --git a/pkgs/development/tools/rust/cargo-apk/default.nix b/pkgs/development/tools/rust/cargo-apk/default.nix
new file mode 100644
index 00000000000..6bb05552e07
--- /dev/null
+++ b/pkgs/development/tools/rust/cargo-apk/default.nix
@@ -0,0 +1,24 @@
+{ lib
+, stdenv
+, rustPlatform
+, fetchCrate
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-apk";
+  version = "0.9.6";
+
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-1vCrM+0SNefd7FrRXnSjLhM3/MSVJfcL4k1qAstX+/A=";
+  };
+
+  cargoSha256 = "sha256-rGn3MKbqIRWayarsgedIOhuTTl8lyRsRxn7BN5Id97w=";
+
+  meta = with lib; {
+    description = "Tool for creating Android packages";
+    homepage = "https://github.com/rust-windowing/android-ndk-rs";
+    license = with licenses;[ mit asl20 ];
+    maintainers = with maintainers; [ nickcao ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index be3c2791aaf..3e7a37f0ff3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15181,6 +15181,7 @@ with pkgs;
 
   cargo-about = callPackage ../development/tools/rust/cargo-about { };
   cargo-all-features = callPackage ../development/tools/rust/cargo-all-features { };
+  cargo-apk = callPackage ../development/tools/rust/cargo-apk { };
   cargo-audit = callPackage ../development/tools/rust/cargo-audit {
     inherit (darwin.apple_sdk.frameworks) Security;
   };

From 6bbe5e0dc25cb37820baf672b9fb5175fd246983 Mon Sep 17 00:00:00 2001
From: "\"Andrey Kuznetsov\"" <"fear@loathing.in">
Date: Thu, 1 Dec 2022 10:23:39 +0000
Subject: [PATCH 49/65] vimPlugins: update

---
 .../editors/vim/plugins/generated.nix         | 246 +++++++++---------
 1 file changed, 123 insertions(+), 123 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 103b79d1839..36aae894897 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -57,8 +57,8 @@ final: prev:
     src = fetchFromGitHub {
       owner = "whonore";
       repo = "Coqtail";
-      rev = "157c43397c2dca382f7560c7f00ed930de5be186";
-      sha256 = "0pfv07j5ryr4i654w015ly73hzg4mb9xrnxnbm8l6s7dcd3zvdkp";
+      rev = "1704623395dbd6b42d999d378f14887aa6a8e704";
+      sha256 = "0bkvrhpbisrn5bvpy7aknzr0b8c4hppszv82iiqmag9y380gkxqp";
     };
     meta.homepage = "https://github.com/whonore/Coqtail/";
   };
@@ -281,12 +281,12 @@ final: prev:
 
   SchemaStore-nvim = buildVimPluginFrom2Nix {
     pname = "SchemaStore.nvim";
-    version = "2022-11-25";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "c9824c37bef4ded4fea68ac5735aac69e02e393a";
-      sha256 = "02wzb31mixa2lvii9f7kq045yrksrjmdrk42kqh4n9cfalyhydsm";
+      rev = "39260e77f7471da2a14182f83ac58e1d2b1ff5be";
+      sha256 = "07jqpm7vhm10pjni0i4q0bjzf5mahi9rvz698cj66idzkmz2i89k";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
   };
@@ -490,8 +490,8 @@ final: prev:
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "aerial.nvim";
-      rev = "e0f744c9c3c2b230a717ad9036a03a776c492be6";
-      sha256 = "0i5nsyb224cqifqpyd063z4ls6jni3jz7sm3hw5mlgsvf0wmpg7a";
+      rev = "38c6fe1c199b8f35918f7efc09cae3f8af56fd68";
+      sha256 = "0p5b05psbhm5aig4106vc6cd795zqwnc0blnngi3jb1snvzb22a5";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/aerial.nvim/";
@@ -811,12 +811,12 @@ final: prev:
 
   barbecue-nvim = buildVimPluginFrom2Nix {
     pname = "barbecue.nvim";
-    version = "2022-11-27";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "utilyre";
       repo = "barbecue.nvim";
-      rev = "8249ba25471384b74b1eacbfdfb735c73a7fe077";
-      sha256 = "0bf88bgpf5wcq2dddf2ppihf832fpk0a8zpsvrnzx3rmmxarzchm";
+      rev = "2a8bff5c47ae7ef3ee2d362634be2d143948dc38";
+      sha256 = "0ncqyb5a5mxhzj3mpsn11342mbl0m54jfqga90ds5430d02mm6fb";
     };
     meta.homepage = "https://github.com/utilyre/barbecue.nvim/";
   };
@@ -1075,12 +1075,12 @@ final: prev:
 
   clang_complete = buildVimPluginFrom2Nix {
     pname = "clang_complete";
-    version = "2022-09-01";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "xavierd";
       repo = "clang_complete";
-      rev = "e25b6a54e5cf648eb36d5be5b82c1bbb22260fde";
-      sha256 = "0ik55akiyivq70a0jds35f8jqvs78mzxq3b302vhyq07w44mk7vx";
+      rev = "d866f31a6b1cfc725dd015293e0a275a6ae9beb0";
+      sha256 = "1fz1mjk049b2f31ymk4ph287km8q3yan9xm5ipj41mjwaavdmzi3";
     };
     meta.homepage = "https://github.com/xavierd/clang_complete/";
   };
@@ -1687,12 +1687,12 @@ final: prev:
 
   coc-lua = buildVimPluginFrom2Nix {
     pname = "coc-lua";
-    version = "2022-11-08";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "josa42";
       repo = "coc-lua";
-      rev = "cdb82f176b13d4be5bed05c586ac1f141306a09a";
-      sha256 = "1cfxzrir827wa3mnbg3gjv4n0afk220r0v55ajqqy8r5aycd68w7";
+      rev = "13da36309878d1f3199877a33badeca0fdf7543e";
+      sha256 = "12p7qbqvqm3pj2pbvm3vg1q84kd15n1qhw720gd1nfxm0ybfxgfc";
     };
     meta.homepage = "https://github.com/josa42/coc-lua/";
   };
@@ -1735,12 +1735,12 @@ final: prev:
 
   coc-nvim = buildVimPluginFrom2Nix {
     pname = "coc.nvim";
-    version = "2022-11-28";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "d436220bd70346221b590419fbe2f2564c4bbb7f";
-      sha256 = "18v3z2vrgn09jwyaffcigx7g4bzx2ff8j6lwkvzyxqxbfrdzv0vq";
+      rev = "2c4d06e9fc712b259ae2320020818fbf4c533273";
+      sha256 = "0b5fq7p5ddydxk1zy1s2b93x019n5mxn7vma3ij4ry9lhc1sqxi3";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
   };
@@ -2023,24 +2023,24 @@ final: prev:
 
   coq-artifacts = buildVimPluginFrom2Nix {
     pname = "coq.artifacts";
-    version = "2022-11-29";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq.artifacts";
-      rev = "4a002ca2e61ef58f70677c661ecbf461cda79b71";
-      sha256 = "0wj5vgkf5yyl5qp5029m9xl5pwldllb1r40mpgk9wkqip4pnlckm";
+      rev = "eea760e43c5800bbcb8d6053f5502ada3774b860";
+      sha256 = "0n853wbpg02lw41lzs3c8yyq7ag363li0sslgrmli5h3fsd8d3j4";
     };
     meta.homepage = "https://github.com/ms-jpq/coq.artifacts/";
   };
 
   coq-thirdparty = buildVimPluginFrom2Nix {
     pname = "coq.thirdparty";
-    version = "2022-11-29";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq.thirdparty";
-      rev = "f204bc46f7db08e66a156d8c36799dd64aa69855";
-      sha256 = "0mlc546hy3fx45f2llgf4qh94gl7n9c123kg1xzgdrl3p9ch5hn9";
+      rev = "ed621364ec22289e912f680b9e5adc17be5af817";
+      sha256 = "1xwnv4agszdqj7izspgzy8qsyhdzg8ydamrpn51611aafxzz74vm";
     };
     meta.homepage = "https://github.com/ms-jpq/coq.thirdparty/";
   };
@@ -2059,12 +2059,12 @@ final: prev:
 
   coq_nvim = buildVimPluginFrom2Nix {
     pname = "coq_nvim";
-    version = "2022-11-29";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "980daf72ee0c9999e88973733c5152d03dcf5171";
-      sha256 = "04z11xsi7jnji3psdznxrscmygf5f4wms3p4ps2n6zj65b4j6czb";
+      rev = "61ba300a71bf274af5c7a5069ab102729af79297";
+      sha256 = "0718b7fpl10hpsaw09c4ylkxw8dflb0s2b449q8b8dcwqpgssm51";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
   };
@@ -2976,12 +2976,12 @@ final: prev:
 
   friendly-snippets = buildVimPluginFrom2Nix {
     pname = "friendly-snippets";
-    version = "2022-11-29";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "rafamadriz";
       repo = "friendly-snippets";
-      rev = "3e2a7d7f29b18d2bb29eedea3663856db55e752e";
-      sha256 = "04yn59c7f5553cvh04ybh5m2jk26aj1jwavk65jlkmbslw3wbcih";
+      rev = "b4f857a1d94d05e747951b1e8cb1a6c567396898";
+      sha256 = "1z4nkk846dh3c8rj7dliw42vz6fwhj7rf1gwjwa4s7nk8f6xq545";
     };
     meta.homepage = "https://github.com/rafamadriz/friendly-snippets/";
   };
@@ -3084,12 +3084,12 @@ final: prev:
 
   fzf-lua = buildVimPluginFrom2Nix {
     pname = "fzf-lua";
-    version = "2022-11-29";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "ibhagwan";
       repo = "fzf-lua";
-      rev = "ff4abbf783875b64dd20aaaab1912ac917d23aa5";
-      sha256 = "0j9l7jvf4v24ygf3s6rnnb1d8qrjn465pfq4fb0j2kwx1nfq0zvk";
+      rev = "0c8b3389ec433089ebbe9d138c2ec20a6a542ce0";
+      sha256 = "1x70d6k7z9q1dnif67359xm86k9fhb8lbycm5rywh1a39c5skbg8";
     };
     meta.homepage = "https://github.com/ibhagwan/fzf-lua/";
   };
@@ -3240,12 +3240,12 @@ final: prev:
 
   gitsigns-nvim = buildNeovimPluginFrom2Nix {
     pname = "gitsigns.nvim";
-    version = "2022-11-09";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "gitsigns.nvim";
-      rev = "9ff7dfb051e5104088ff80556203634fc8f8546d";
-      sha256 = "0cfssyyhcjndwr2xlk91rxzyir4ng5hk1f4fgij5hgrhhh3wgjdv";
+      rev = "d076301a634198e0ae3efee3b298fc63c055a871";
+      sha256 = "12990v2zcsas8575nf6ln1byw3zg473s5jpizk4g3v9ikfdvjbfr";
     };
     meta.homepage = "https://github.com/lewis6991/gitsigns.nvim/";
   };
@@ -3276,12 +3276,12 @@ final: prev:
 
   glow-nvim = buildVimPluginFrom2Nix {
     pname = "glow.nvim";
-    version = "2022-10-07";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "ellisonleao";
       repo = "glow.nvim";
-      rev = "9038d7cdd76a930973b6158d800c8dbc02236a4b";
-      sha256 = "0x49l7g84m1328fqad501f4iqqy3imbl8r8rh4rxsi1zam46f2ba";
+      rev = "20d1cd087f8728f21a048a3b6259f6177237b39e";
+      sha256 = "0zklzx2k85zyxn866xbhd6rnifc885rn68bnv1x945z34pj4m3xc";
     };
     meta.homepage = "https://github.com/ellisonleao/glow.nvim/";
   };
@@ -4007,12 +4007,12 @@ final: prev:
 
   lean-nvim = buildVimPluginFrom2Nix {
     pname = "lean.nvim";
-    version = "2022-11-29";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "Julian";
       repo = "lean.nvim";
-      rev = "ae598191de9fa8ff90b897893590234b84702cab";
-      sha256 = "17n108ipnajj9fvm3l15rndhxi3529w0g7pjrjpb6ljn0d73akvc";
+      rev = "9fad72569b54f067b6ad0bdafd47ce7b23578b79";
+      sha256 = "1cvj59v267av6lh2wzpmqd05pa7fjvfprbs2r7gql6gr992x2s59";
     };
     meta.homepage = "https://github.com/Julian/lean.nvim/";
   };
@@ -4235,12 +4235,12 @@ final: prev:
 
   lir-nvim = buildVimPluginFrom2Nix {
     pname = "lir.nvim";
-    version = "2022-09-14";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "tamago324";
       repo = "lir.nvim";
-      rev = "c1aeb96fae55bb6cac3d01ce5123a843d7235396";
-      sha256 = "03fia0m7w2q20m9jvm4wdm6w5bfh976fm0d7h4n055hbqgy73qf9";
+      rev = "806651bc22cc1aa0053fba4385a18800f576cc6b";
+      sha256 = "1xi2l412637vkp79338p65xb4zm0licyzrp188s2rijjqf3g2mzb";
     };
     meta.homepage = "https://github.com/tamago324/lir.nvim/";
   };
@@ -4414,12 +4414,12 @@ final: prev:
 
   lsp_signature-nvim = buildVimPluginFrom2Nix {
     pname = "lsp_signature.nvim";
-    version = "2022-11-28";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "lsp_signature.nvim";
-      rev = "136d0eb5956c5a874c506007606f3ad022df64e2";
-      sha256 = "0hgf78gj252jxsrwpsc5gxy943k65x6l397win1jrcpkrmpmmq51";
+      rev = "2f3e5745ee7a0610ffde2b4331460151d4707724";
+      sha256 = "0c0ap6xkncbsvy08897ah4sw4f6s99q9m5jp0i3a0akvw3zpn21n";
     };
     meta.homepage = "https://github.com/ray-x/lsp_signature.nvim/";
   };
@@ -4967,12 +4967,12 @@ final: prev:
 
   neoconf-nvim = buildVimPluginFrom2Nix {
     pname = "neoconf.nvim";
-    version = "2022-11-29";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "875a412b17aa69ccf26a4c774b0300c06fc4c742";
-      sha256 = "14i5vwqk8azxwjzijpv6kapzbh4hwpc8rcs71k32w8azkgj6g61r";
+      rev = "681e89d58d46a7c63ee091fee32220373dda1072";
+      sha256 = "000inylrbyyfc1lg1ajmi1rb2jrcisglgc44gk3cf9iv7v1515dd";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
   };
@@ -5079,8 +5079,8 @@ final: prev:
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "neorg";
-      rev = "5613ff3f471d148c9824daeb359dfdc61ddaf992";
-      sha256 = "0b0mrnvbmims22a4178vyj51s5m2qlgnf6z91389prjalzcnrhsc";
+      rev = "5a536bc033d2ac1ef49ec4c875fd9811cceccb68";
+      sha256 = "08gx5y34abpfmcmhhlmb44hi380cfyapbki32pv9xspq56ng8xpn";
     };
     meta.homepage = "https://github.com/nvim-neorg/neorg/";
   };
@@ -5135,12 +5135,12 @@ final: prev:
 
   neotest = buildVimPluginFrom2Nix {
     pname = "neotest";
-    version = "2022-11-26";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest";
-      rev = "b449394aa36b05eef6719162356c2ae531460bd9";
-      sha256 = "12qmbkjivpf3yd3j8wsiw2s8rmdg9q8zqp4pdybgdqfywivf00km";
+      rev = "a2559f07be901638d555c0d29d8ea22c81553653";
+      sha256 = "177pf0ywxqmxr7472yvrmk579k5vgh5770d1j00r1d3k8yjsnqp4";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest/";
   };
@@ -5327,12 +5327,12 @@ final: prev:
 
   noice-nvim = buildVimPluginFrom2Nix {
     pname = "noice.nvim";
-    version = "2022-11-24";
+    version = "2022-11-29";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "noice.nvim";
-      rev = "fa21685e23cbb72bb573eecf48dd3644bc1513ba";
-      sha256 = "1vbm54fykn6xzndrrrb1bcymbwbmanifnsr693v5647k5hmsjc64";
+      rev = "5ca31af06078d6188de7db1369c2b40d1b606d58";
+      sha256 = "1a3n5341fcvjlkp3lv5x50a81z30zaxxw427dvkpjb7bp93rb8h4";
     };
     meta.homepage = "https://github.com/folke/noice.nvim/";
   };
@@ -5399,12 +5399,12 @@ final: prev:
 
   null-ls-nvim = buildVimPluginFrom2Nix {
     pname = "null-ls.nvim";
-    version = "2022-11-23";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "jose-elias-alvarez";
       repo = "null-ls.nvim";
-      rev = "c51978f546a86a653f4a492b86313f4616412cec";
-      sha256 = "0wkk5dxdmcgmgh7rak85x99n11w1pygryv66vki13f46wwnbm3m6";
+      rev = "d4254b19e914e6278582d4555c57eb3d2abd9590";
+      sha256 = "03f7m0v5mgpwwvy1qgijiiyvrfzk5n75a1nj5snl0vl8ivancmcs";
     };
     meta.homepage = "https://github.com/jose-elias-alvarez/null-ls.nvim/";
   };
@@ -5771,12 +5771,12 @@ final: prev:
 
   nvim-hlslens = buildVimPluginFrom2Nix {
     pname = "nvim-hlslens";
-    version = "2022-11-19";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "kevinhwang91";
       repo = "nvim-hlslens";
-      rev = "a48ddd710c6daf9a2e90646978c99e5db500dfd3";
-      sha256 = "0lk3gc8kicrz6xs57mpy1znxwi6wlc7zm44cg8q0yz7ka0f4520v";
+      rev = "cad6ce2e0d4f9c26467712791a70fae9d0b0b6cf";
+      sha256 = "122dkvvs7cgmba8l09vhnc6laabyv4qakm3931f4kscn6lb4kyzm";
     };
     meta.homepage = "https://github.com/kevinhwang91/nvim-hlslens/";
   };
@@ -5795,12 +5795,12 @@ final: prev:
 
   nvim-jdtls = buildVimPluginFrom2Nix {
     pname = "nvim-jdtls";
-    version = "2022-11-01";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-jdtls";
-      rev = "7bc572fc357d7dec8d3ca620b53e763776472582";
-      sha256 = "10rm01cxc1xnw7m886ssnmb5ihlsfjhp6sqm9dhmrkg4ywkbhj9m";
+      rev = "4ea8e66d61c9a7e40c40f4cc6051ebfbf4ce0d38";
+      sha256 = "0wbfy0p7n7s8zp154p06n3nmqc5vxrmzz6abasvlisd8s2khk3g1";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-jdtls/";
   };
@@ -5855,12 +5855,12 @@ final: prev:
 
   nvim-lint = buildVimPluginFrom2Nix {
     pname = "nvim-lint";
-    version = "2022-11-22";
+    version = "2022-11-29";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-lint";
-      rev = "ea8cae4a97b2127702d4b891c40c48d8230670e5";
-      sha256 = "05qm8zgmh5q98hwmp0zc27wwmxnyady6v04kqd4b72cx00xnx0dw";
+      rev = "2ef3b269546d751e4fc8c673ffddd6216421f4a1";
+      sha256 = "03vdbxqa6z8471l0s65xa55n5hf1c1s59zvx1rn1kgy4h070022w";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-lint/";
   };
@@ -5879,12 +5879,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPluginFrom2Nix {
     pname = "nvim-lspconfig";
-    version = "2022-11-29";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "faa011a24a6911332eeac6c253a0881c2e578628";
-      sha256 = "0p95s77w41p2a4k2j6nqjjfn2kfjw23pa047lwj4byfdxmdykbj6";
+      rev = "5e0bd39476d4e224dfe5ea6a6624ea3bb467a8bb";
+      sha256 = "11lsa35v6qb1mvnac94i3acc428r6s2zk88i6qp3xz25slmd5773";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -6119,12 +6119,12 @@ final: prev:
 
   nvim-treesitter = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter";
-    version = "2022-11-29";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "d05be3742e04601ac1219f575d7c44a21f671622";
-      sha256 = "1ibr8g762v6qp44b068qd44sq9axnr0pmj73dadqhf3smma2g5l1";
+      rev = "768532453ac30cbf792b492248a6c3be19b80af1";
+      sha256 = "18lamsy039c90ycxh2gz1qi2ba4npkm1j4q2ibyzljml8kznhzg6";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
@@ -6419,12 +6419,12 @@ final: prev:
 
   orgmode = buildVimPluginFrom2Nix {
     pname = "orgmode";
-    version = "2022-11-29";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "nvim-orgmode";
       repo = "orgmode";
-      rev = "bc1c96a00a931044b776dfba73710725231ab616";
-      sha256 = "0lsanm40bwnn0va8ssl7jdjxx5s0g16dnq3r3mp660hwqdqlzv7w";
+      rev = "fc9bb0f5823d01e4008e4b86663772d4148aa9ce";
+      sha256 = "1vb0x89qr2kk5ma8syw4l56c6j2b7y2advyjykdli8psn6i7gsyf";
     };
     meta.homepage = "https://github.com/nvim-orgmode/orgmode/";
   };
@@ -6877,12 +6877,12 @@ final: prev:
 
   rest-nvim = buildNeovimPluginFrom2Nix {
     pname = "rest.nvim";
-    version = "2022-11-25";
+    version = "2022-11-29";
     src = fetchFromGitHub {
       owner = "rest-nvim";
       repo = "rest.nvim";
-      rev = "ce7aed035f0b82b72b00d33cff6ab3e445a06db8";
-      sha256 = "1vcf9pf64gwinhqgha5vka939bigpa94vvghp5wx989lhs7l71gw";
+      rev = "966b4a32f47475908b0fe88ea7b99042da7e2d86";
+      sha256 = "1sv4zlmbrqxy04dm3v8x4xncz6kkgr51apcgv4lb16wj000bqvgp";
     };
     meta.homepage = "https://github.com/rest-nvim/rest.nvim/";
   };
@@ -7009,12 +7009,12 @@ final: prev:
 
   satellite-nvim = buildVimPluginFrom2Nix {
     pname = "satellite.nvim";
-    version = "2022-11-27";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "satellite.nvim";
-      rev = "48cf0094018c0eb71c9a03c6b0a2bc46712f0526";
-      sha256 = "0ql022slljcjhcly2zpfsxs33hv9ha0gmpij7zm8sqw6wchzigbm";
+      rev = "3bcd90d5cf5e61b6f4a000aaad5b6aa79b9a8bc5";
+      sha256 = "1s22ciz284za50yll9avghdfvnfmf7kgv4vrfpzh28qqy11vyj1s";
     };
     meta.homepage = "https://github.com/lewis6991/satellite.nvim/";
   };
@@ -7564,12 +7564,12 @@ final: prev:
 
   tabby-nvim = buildVimPluginFrom2Nix {
     pname = "tabby.nvim";
-    version = "2022-11-22";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "nanozuki";
       repo = "tabby.nvim";
-      rev = "a7710f38ded0cda5b07e38f10c55ed1940b35b19";
-      sha256 = "0vkh7v24j6fxc7v1fgk0xh3jlrcm8ps3zxms5lbsd2bgfbcm6p3n";
+      rev = "ad80d32ba42b0c7f3a06b5754b7f669bf71eadf0";
+      sha256 = "1pbbb8w164pzrlsglmc5pls8x1jp3zv97m74hxljpwkiqjzfzfjn";
     };
     meta.homepage = "https://github.com/nanozuki/tabby.nvim/";
   };
@@ -7661,12 +7661,12 @@ final: prev:
 
   tagbar = buildVimPluginFrom2Nix {
     pname = "tagbar";
-    version = "2022-11-04";
+    version = "2022-11-29";
     src = fetchFromGitHub {
       owner = "preservim";
       repo = "tagbar";
-      rev = "6c3e15ea4a1ef9619c248c2b1eced56a47b61a9e";
-      sha256 = "1x47bxvxhw7c4g7ij86xs1zwmb61yr5wcrn3xm606x74c11ff650";
+      rev = "af3ce7c3cec81f2852bdb0a0651d2485fcd01214";
+      sha256 = "1r0vn0v74g8bgyz4ycc9z8clpkn6fdy5v65y7igizcrjzxd3nlpb";
     };
     meta.homepage = "https://github.com/preservim/tagbar/";
   };
@@ -7769,12 +7769,12 @@ final: prev:
 
   telescope-file-browser-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-file-browser.nvim";
-    version = "2022-10-16";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-file-browser.nvim";
-      rev = "2429ecfd2d76e3eb6c9f8d8ba2c6ce328975a95a";
-      sha256 = "1rmxz31rbb4xiisnmgsmcmrx3r1cjhdrj82l99sdjp09cqavd2bw";
+      rev = "8646e46b8545b9234e87083d124c0a4e4ed47735";
+      sha256 = "01q34wrk00yxy4jcr666qmkdkpfib80rjbn921dkqqv2d1nalx9b";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-file-browser.nvim/";
   };
@@ -7793,12 +7793,12 @@ final: prev:
 
   telescope-fzf-native-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-fzf-native.nvim";
-    version = "2022-09-06";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-fzf-native.nvim";
-      rev = "65c0ee3d4bb9cb696e262bca1ea5e9af3938fc90";
-      sha256 = "0nyvhlalrgg6n793lp3yrxgszv5j0ln9sjbh45pxxg0wn15jxm45";
+      rev = "7447fe780fed23402a3e0c3a227b549d7506ed38";
+      sha256 = "101zcy6fjrpv19cghg464wrizh82b0ny7pc1mmqsfqw48hl37hwn";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-fzf-native.nvim/";
   };
@@ -10111,12 +10111,12 @@ final: prev:
 
   vim-go = buildVimPluginFrom2Nix {
     pname = "vim-go";
-    version = "2022-11-01";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "fatih";
       repo = "vim-go";
-      rev = "0550762a69a2ef13d9f723c9478155dbc6ad7ddb";
-      sha256 = "185ysbbipqf6fivryi4pxjmdm4vfn319w1mgm3xpg2920scybwbq";
+      rev = "8d7677947e0be1eecfa1bcf2c1148804963ec4f6";
+      sha256 = "1f2xklijsxbc7f2y26ps6bwyhn5sxbmv8gwy66l7yhfbc0zvic0w";
     };
     meta.homepage = "https://github.com/fatih/vim-go/";
   };
@@ -12166,12 +12166,12 @@ final: prev:
 
   vim-snippets = buildVimPluginFrom2Nix {
     pname = "vim-snippets";
-    version = "2022-11-22";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "honza";
       repo = "vim-snippets";
-      rev = "b904e5a68aeda29a0b6e09a6f61305a462ae2627";
-      sha256 = "1dmfysd9vr2b6hf8nm95caw1fv16l1hvh0gb6a7nxnvvary1czs7";
+      rev = "6173350127d56dcc5664f50320b3f522951f56e9";
+      sha256 = "1a002y2pw76bh35q9z0rba3wnfcwgfmnii4gn3107wwfmfy50z55";
     };
     meta.homepage = "https://github.com/honza/vim-snippets/";
   };
@@ -12611,12 +12611,12 @@ final: prev:
 
   vim-tridactyl = buildVimPluginFrom2Nix {
     pname = "vim-tridactyl";
-    version = "2022-02-10";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "tridactyl";
       repo = "vim-tridactyl";
-      rev = "f2eaa5d32614f6c35dad268dd4ed7ff33cae5070";
-      sha256 = "139kl89k5alh8bpa4wywsmvjnxlxzsdbhxn2w8rvclhwgrhkzvgd";
+      rev = "fdd069bde3a34c786abed4601b6d59a065590ad9";
+      sha256 = "07km8yp0vsipw2amkxd0rjp9qz18g0b7bvsb2vj9vgkr8wc0d780";
     };
     meta.homepage = "https://github.com/tridactyl/vim-tridactyl/";
   };
@@ -12767,12 +12767,12 @@ final: prev:
 
   vim-vsnip = buildVimPluginFrom2Nix {
     pname = "vim-vsnip";
-    version = "2022-11-14";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "hrsh7th";
       repo = "vim-vsnip";
-      rev = "6f873418c4dc601d8ad019a5906eddff5088de9b";
-      sha256 = "0jw8580w0x515772gnyw6y922yp0hmxk84r67iw1mv50zbkmafgz";
+      rev = "e44026b5394fd79aa0f2118aaf41627ef9c354ee";
+      sha256 = "1a14msxri37xs29xq80fw9mh6g9ipmc9g4ik2p0x9r5h2pz2nsbq";
     };
     meta.homepage = "https://github.com/hrsh7th/vim-vsnip/";
   };
@@ -13176,12 +13176,12 @@ final: prev:
 
   vista-vim = buildVimPluginFrom2Nix {
     pname = "vista.vim";
-    version = "2022-10-25";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "vista.vim";
-      rev = "9ddb3707b066cb288aa1ac9c33477280e0ef95d3";
-      sha256 = "03qls1ggnjqv38xg8sk2ssl02pibd2r2k36g0hxanx7zqq3nvgn0";
+      rev = "33774aff5d8b224f24c2e4c6015c613c1a17bf74";
+      sha256 = "0c3255id5wzgb1v5zsga7ig1b8mqmrbklmz40x98av4j5dqghfw7";
     };
     meta.homepage = "https://github.com/liuchengxu/vista.vim/";
   };
@@ -13477,12 +13477,12 @@ final: prev:
 
   catppuccin-nvim = buildVimPluginFrom2Nix {
     pname = "catppuccin-nvim";
-    version = "2022-11-29";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "nvim";
-      rev = "0a166e60c41649596cc9831d31fcfc09b15f145a";
-      sha256 = "1m5v6jbzgsj88mzsj5krmdjdz9s8xhpxxk7fr2lslb4g905bv9x3";
+      rev = "4d2ed20bda0c07e9473c374826721ac16154698b";
+      sha256 = "0xdxfpqlm68s6629h8j3pmpw4p7kfnsxlvbk5k3ii6f2yw0b8fd4";
     };
     meta.homepage = "https://github.com/catppuccin/nvim/";
   };
@@ -13501,24 +13501,24 @@ final: prev:
 
   chad = buildVimPluginFrom2Nix {
     pname = "chad";
-    version = "2022-11-29";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "c31f74ac908a07db943c683abaddbb01e4686ab3";
-      sha256 = "0vmj02wyy8y1fsrql1zgj0c0csmqr4zwl4paa2zygzxc7mz6nncf";
+      rev = "4c95882b5e3d67bf31f2b7ea996e0251966e43eb";
+      sha256 = "002r53w9rq13lca4sw34631b526h2wvaf5x9l87kqq0ddm2nwslh";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
 
   dracula-vim = buildVimPluginFrom2Nix {
     pname = "dracula-vim";
-    version = "2022-11-07";
+    version = "2022-11-30";
     src = fetchFromGitHub {
       owner = "dracula";
       repo = "vim";
-      rev = "b9f4f3a169266031d3744335595eee02a6e396c6";
-      sha256 = "1a9vxpdh6ry9760m69762s5annq4k52k5bk9gy3v0lr4zyvfcfgf";
+      rev = "947e5298766f30bdb813749bf867913b29a06eac";
+      sha256 = "0yvahswdzqphay5wak2rlaqjaf44kylsvmx697slwp8h1846xchw";
     };
     meta.homepage = "https://github.com/dracula/vim/";
   };

From b1b680584e382a27f62a5227d2a26dff80ab84cf Mon Sep 17 00:00:00 2001
From: "\"Andrey Kuznetsov\"" <"fear@loathing.in">
Date: Thu, 1 Dec 2022 10:24:54 +0000
Subject: [PATCH 50/65] vimPlugins.treesj: init at 2022-12-01

---
 pkgs/applications/editors/vim/plugins/generated.nix  | 12 ++++++++++++
 .../editors/vim/plugins/vim-plugin-names             |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 36aae894897..65b8cd46dbe 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -8237,6 +8237,18 @@ final: prev:
     meta.homepage = "https://github.com/tjdevries/train.nvim/";
   };
 
+  treesj = buildVimPluginFrom2Nix {
+    pname = "treesj";
+    version = "2022-12-01";
+    src = fetchFromGitHub {
+      owner = "Wansmer";
+      repo = "treesj";
+      rev = "da296173b61330aebfd16129a5bf1263700014f1";
+      sha256 = "1wbbxdf2k1vfrnfllms0g5mnsf5bhsipacfwa546sfnc41j360v9";
+    };
+    meta.homepage = "https://github.com/Wansmer/treesj/";
+  };
+
   tremor-vim = buildVimPluginFrom2Nix {
     pname = "tremor-vim";
     version = "2021-09-07";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 92b519a5d27..a6b5e4eae94 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -690,6 +690,7 @@ https://github.com/akinsho/toggleterm.nvim/,,
 https://github.com/folke/tokyonight.nvim/,,
 https://github.com/markonm/traces.vim/,,
 https://github.com/tjdevries/train.nvim/,,
+https://github.com/Wansmer/treesj/,main,
 https://github.com/tremor-rs/tremor-vim/,,
 https://github.com/cappyzawa/trim.nvim/,,
 https://github.com/folke/trouble.nvim/,,

From c5a092710299c3ccfb3fce0877bf3d5fd46bd9c7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 1 Dec 2022 11:37:07 +0000
Subject: [PATCH 51/65] python310Packages.pycfdns: 2.0.0 -> 2.0.1

---
 pkgs/development/python-modules/pycfdns/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pycfdns/default.nix b/pkgs/development/python-modules/pycfdns/default.nix
index 4f7a4d282bd..23b7c157eaf 100644
--- a/pkgs/development/python-modules/pycfdns/default.nix
+++ b/pkgs/development/python-modules/pycfdns/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pycfdns";
-  version = "2.0.0";
+  version = "2.0.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "ludeeus";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-2vjeoI+IqvCIHb51BLkuTISbG0PxFGHlmpSiCaV+E0w=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-f6kxYX/dg16OWYpw29dH4Z26ncLZCYyHKGc4fzoCld0=";
   };
 
   propagatedBuildInputs = [

From 6060f1268ca7b44d62304564eadb0b0667ea8b84 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 1 Dec 2022 22:10:30 +1000
Subject: [PATCH 52/65] clusterctl: 1.2.7 -> 1.3.0

https://github.com/kubernetes-sigs/cluster-api/releases/tag/v1.3.0
---
 pkgs/applications/networking/cluster/clusterctl/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/clusterctl/default.nix b/pkgs/applications/networking/cluster/clusterctl/default.nix
index 2866c298c24..fef3619fa2a 100644
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "clusterctl";
-  version = "1.2.7";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "cluster-api";
     rev = "v${version}";
-    sha256 = "sha256-h8VZCCl28Vd2VB+enLY28t8rNbzdZo3Y4ybElNAkvKU=";
+    sha256 = "sha256-lqHHZtEtedU0Qtm6o6iy6JrQ1UiB9nSTZVyfq0cj0vI=";
   };
 
-  vendorSha256 = "sha256-hhs/q0x5Qd7S18jX4SPVFPo+fsDE9snJVkiqKD+Qp74=";
+  vendorSha256 = "sha256-7e2ZJa6MfzznOoaBq0xQIXrdmDAzPzKh9QFlRfbxYMM=";
 
   subPackages = [ "cmd/clusterctl" ];
 

From bcb6dbbe30ce7631e5a0865dff1ab9b63d92977d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 28 Nov 2022 16:09:52 +0100
Subject: [PATCH 53/65] manylinux: use libxcrypt for libcrypt.so.1

---
 pkgs/development/interpreters/python/manylinux/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/manylinux/default.nix b/pkgs/development/interpreters/python/manylinux/default.nix
index a44ead23752..04f07796180 100644
--- a/pkgs/development/interpreters/python/manylinux/default.nix
+++ b/pkgs/development/interpreters/python/manylinux/default.nix
@@ -65,7 +65,7 @@ let
   manylinux1Libs = getLibOutputs(manylinux2010Libs // (with pkgs; {
     "libpanelw.so.5" = ncurses5;
     "libncursesw.so.5" = ncurses5;
-    "libcrypt.so.1" = glibc;
+    "libcrypt.so.1" = libxcrypt;
     }));
 
 in {

From b00e6f2a137ff6929ee5100f6d1fdfb260e1a9db Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 1 Dec 2022 14:29:40 +0100
Subject: [PATCH 54/65] python310Packages.pycfdns: add changelog to meta

---
 pkgs/development/python-modules/pycfdns/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pycfdns/default.nix b/pkgs/development/python-modules/pycfdns/default.nix
index 23b7c157eaf..df7979be388 100644
--- a/pkgs/development/python-modules/pycfdns/default.nix
+++ b/pkgs/development/python-modules/pycfdns/default.nix
@@ -14,7 +14,7 @@ buildPythonPackage rec {
     owner = "ludeeus";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-f6kxYX/dg16OWYpw29dH4Z26ncLZCYyHKGc4fzoCld0=";
+    hash = "sha256-f6kxYX/dg16OWYpw29dH4Z26ncLZCYyHKGc4fzoCld0=";
   };
 
   propagatedBuildInputs = [
@@ -32,6 +32,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for updating Cloudflare DNS A records";
     homepage = "https://github.com/ludeeus/pycfdns";
+    changelog = "https://github.com/ludeeus/pycfdns/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };

From 554648019bf3bf69b1027c33f56d8df3aac7c63e Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Thu, 1 Dec 2022 13:40:06 +0000
Subject: [PATCH 55/65] deno: 1.28.2 -> 1.28.3

---
 pkgs/development/web/deno/default.nix     |  6 +++---
 pkgs/development/web/deno/librusty_v8.nix | 10 +++++-----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index c27b3b645e3..ef7f7a6dc69 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -17,15 +17,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.28.2";
+  version = "1.28.3";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gmDR8KNpx+M66Rv8fooTQOY42ekYl+KwIQ/5jDvYQho=";
+    sha256 = "sha256-Rkzr5Y50Z2A+TeWCrrC6GUvu8/x6IgDxvd8D6mKbIGE=";
   };
-  cargoSha256 = "sha256-emf6Q3WQM8W0yPvuNXPeuRC7FOt8QJ/+b5kMzyd3ZCU=";
+  cargoSha256 = "sha256-n2K0CghobLri69oMrs8nCNSwq/5eH3YlzLtC9JRriQ8=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds
diff --git a/pkgs/development/web/deno/librusty_v8.nix b/pkgs/development/web/deno/librusty_v8.nix
index 32e2edccce1..1de5bc0b541 100644
--- a/pkgs/development/web/deno/librusty_v8.nix
+++ b/pkgs/development/web/deno/librusty_v8.nix
@@ -11,11 +11,11 @@ let
   };
 in
 fetch_librusty_v8 {
-  version = "0.55.0";
+  version = "0.58.0";
   shas = {
-    x86_64-linux = "sha256-HztOb1r/9tWh0w4zQveBLOh3d6OfnSwQZkIx6drXJ7M=";
-    aarch64-linux = "sha256-rP0K875V4f4yHe7unUCpMCQbi7Fips6474gFZph73Ys=";
-    x86_64-darwin = "sha256-iiYttjs9h84YqZG8prxudTTi588BuoqA3zc2LkEks5E=";
-    aarch64-darwin = "sha256-RBA3fl3YdCqxb00xgl6KTYdbvl75U5Kgrux5N+dZg/g=";
+    x86_64-linux = "sha256-x4KLjexiLobbrLBvrE99XsVIw2LcUuu2Huk7nRBLRM4=";
+    aarch64-linux = "sha256-HSRLRF86nriU5ZkuZhQcqLFFMO4bstP8bR2tgF2XvbU=";
+    x86_64-darwin = "sha256-dHrotM/my1DQYGvHHQm726JgaLbC64IvwJGKgw9kZMM=";
+    aarch64-darwin = "sha256-QDBF/ssxXMIWEZHSv7e/E75XZVPx/MvGvGI/C45q2bE=";
   };
 }

From c54ab98eb0eb22b5eb302614ffecf7d9ed34a7b5 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Thu, 1 Dec 2022 09:40:47 -0500
Subject: [PATCH 56/65] vimPlugins.nvim-treesitter: update grammars

---
 .../vim/plugins/nvim-treesitter/generated.nix | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index e8fd2a79dd7..56c9bf21300 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -670,12 +670,12 @@
   };
   javascript = buildGrammar {
     language = "javascript";
-    version = "cefdcea";
+    version = "7a29d06";
     source = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-javascript";
-      rev = "cefdcea72a8cf86c1f10ca55e837397da07afdab";
-      hash = "sha256-o+th1Va11YtsHaA5IR9IAYRk3SDxTop0gxfSjR2u/o8=";
+      rev = "7a29d06274b7cf87d643212a433d970b73969016";
+      hash = "sha256-fMPCHdfHHyg7yNi9LDA35z+WFfPRbctrh38dZV5qZt4=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-javascript";
   };
@@ -1291,12 +1291,12 @@
   };
   sql = buildGrammar {
     language = "sql";
-    version = "4f1b912";
+    version = "41f1de2";
     source = fetchFromGitHub {
       owner = "derekstride";
       repo = "tree-sitter-sql";
-      rev = "4f1b91246b43190e34957d9de9a0f3625879ba33";
-      hash = "sha256-g1dQ897JQwthConYMlGY25hsypr4weDsDCOWyafriw8=";
+      rev = "41f1de238b7b4a8cc9e118759881aad8585d36ad";
+      hash = "sha256-LORSWO5Ui/Nq1SReERSWZ+BEtxKEJ545LPpA6HbY8Z4=";
     };
     meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
   };
@@ -1494,12 +1494,12 @@
   };
   vhs = buildGrammar {
     language = "vhs";
-    version = "2f87b9d";
+    version = "8a0df32";
     source = fetchFromGitHub {
       owner = "charmbracelet";
       repo = "tree-sitter-vhs";
-      rev = "2f87b9d973597e69552ecf6a4fe16470fbd8c44e";
-      hash = "sha256-G1ytXVBeGN1606aFrPdNFp3Khlg/BTFq2VS176Knb7k=";
+      rev = "8a0df32b72a8cf8d3e3e84f16c19e9ba46d3dba5";
+      hash = "sha256-bWI/MW7U5ht7jmL3BSm5HwD1BMDNGwkBShJIpRlhonI=";
     };
     meta.homepage = "https://github.com/charmbracelet/tree-sitter-vhs";
   };
@@ -1527,12 +1527,12 @@
   };
   wgsl = buildGrammar {
     language = "wgsl";
-    version = "af16e7d";
+    version = "61d2604";
     source = fetchFromGitHub {
       owner = "szebniok";
       repo = "tree-sitter-wgsl";
-      rev = "af16e7d9e230004888fb52d33599ad38b4cf6052";
-      hash = "sha256-rp6SqiGVAxlAbrYhNLhwqawjpFXZd2R4A4cNQx6qFZs=";
+      rev = "61d2604525d47238ecbce8aa38f10cb81ba68fd3";
+      hash = "sha256-dSWQAJN9+EyqPbGZv9wTR8upsK56ZWu9jOpJkJtkabs=";
     };
     meta.homepage = "https://github.com/szebniok/tree-sitter-wgsl";
   };

From bd2f80eaf97b34c880ec934f2597cfd757e08c6f Mon Sep 17 00:00:00 2001
From: Gustavo Porto <gustavo@portosanti.com>
Date: Thu, 1 Dec 2022 15:35:00 +0000
Subject: [PATCH 57/65] mantainers: update portothree email

---
 maintainers/maintainer-list.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 9b59838336a..368ee25b9b4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -15802,7 +15802,7 @@
   };
   portothree = {
     name = "Gustavo Porto";
-    email = "gustavoporto@ya.ru";
+    email = "gus@p8s.co";
     github = "portothree";
     githubId = 3718120;
   };

From b2996de2a7af35ed8e263acc3f5ef4f3e48f75a7 Mon Sep 17 00:00:00 2001
From: Daniel Nagy <danielnagy@posteo.de>
Date: Thu, 6 Oct 2022 23:26:24 +0200
Subject: [PATCH 58/65] blobby: repair

---
 pkgs/games/blobby/blobby.sh   | 2 +-
 pkgs/games/blobby/default.nix | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/games/blobby/blobby.sh b/pkgs/games/blobby/blobby.sh
index 4c4b32b1243..3171c5a80b1 100644
--- a/pkgs/games/blobby/blobby.sh
+++ b/pkgs/games/blobby/blobby.sh
@@ -7,4 +7,4 @@ test -d ~/.blobby || {
   ( cd ~/.blobby; for i in *.zip; do @unzip@/bin/unzip "$i"; done )
 }
 
-@out@/bin/blobby.bin
+exec @out@/bin/blobby.bin "$@"
diff --git a/pkgs/games/blobby/default.nix b/pkgs/games/blobby/default.nix
index 9dad0b84d1e..68e18dfe26d 100644
--- a/pkgs/games/blobby/default.nix
+++ b/pkgs/games/blobby/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, SDL2, SDL2_image, libGLU, libGL, cmake, physfs, boost, zip, zlib, pkg-config }:
+{ lib, stdenv, fetchurl, SDL2, SDL2_image, libGLU, libGL, cmake, physfs, boost, zip, zlib, unzip, pkg-config }:
 
 stdenv.mkDerivation rec {
   pname = "blobby-volley";
@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
     sed -e '1i#include <iostream>' -i src/NetworkMessage.cpp
   '';
 
+  inherit unzip;
+
   postInstall = ''
     cp ../data/Icon.bmp "$out/share/blobby/"
     mv "$out/bin"/blobby{,.bin}
@@ -28,7 +30,8 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ raskin ];
-    homepage = "http://blobby.sourceforge.net/";
+    homepage = "https://blobbyvolley.de/";
     downloadPage = "https://sourceforge.net/projects/blobby/files/Blobby%20Volley%202%20%28Linux%29/";
+    mainProgram = "blobby";
   };
 }

From a4952c81d73d1561e463be1876cf38b87547facb Mon Sep 17 00:00:00 2001
From: Adam Simpson <adam@adamsimpson.net>
Date: Thu, 1 Dec 2022 10:43:25 -0500
Subject: [PATCH 59/65] mpd: 0.23.9 -> 0.23.11

---
 pkgs/servers/mpd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/mpd/default.nix b/pkgs/servers/mpd/default.nix
index 82bdc7a31f8..d5258f8121f 100644
--- a/pkgs/servers/mpd/default.nix
+++ b/pkgs/servers/mpd/default.nix
@@ -116,13 +116,13 @@ let
 
     in stdenv.mkDerivation rec {
       pname = "mpd";
-      version = "0.23.9";
+      version = "0.23.11";
 
       src = fetchFromGitHub {
         owner  = "MusicPlayerDaemon";
         repo   = "MPD";
         rev    = "v${version}";
-        sha256 = "sha256-eYP4+WDYwAw7TboS9V8ncdQoAC0vbjSaZxmru1Unejw=";
+        sha256 = "sha256-vgLH4kOluK9cOmTrvpBfR87Iunn0EzH9GmiUvsjsG4I=";
       };
 
       buildInputs = [

From 7f4559c57c83b538d0853b11e6f7e9368a86ade6 Mon Sep 17 00:00:00 2001
From: AtilaSaraiva <atilasaraiva@gmail.com>
Date: Thu, 1 Dec 2022 08:49:24 -0700
Subject: [PATCH 60/65] obs-vkcapture: 1.2.1 -> 1.2.2

---
 pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix b/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
index a1abc952fc7..3b97644bf25 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-vkcapture";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "nowrep";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FOyUgsHQlsjVGCct+ky189alVImoG+paqDKmGvnHoXo=";
+    hash = "sha256-Ya4p0eXOTID1qmxokgSXdmBOd3nqzcOHM+pLqJi8LGg=";
   };
 
   cmakeFlags = lib.optionals stdenv.isi686 [

From 6065d768e145ca5782e961774b5f06f0a0520729 Mon Sep 17 00:00:00 2001
From: Jade Lovelace <jadel@mercury.com>
Date: Thu, 24 Nov 2022 16:14:43 -0800
Subject: [PATCH 61/65] sapling: fix on macOS

There were two factors here: our cargo hook was messing up the cargo
config, which broke the build, and also an upstream bug where Sapling
didn't work on Python 3.10.

The upstream issue was filed as https://github.com/facebook/sapling/issues/279

We can get rid of the python 3.8 override as soon as this patch gets
into a released version.
---
 .../version-management/sapling/default.nix    | 56 +++++++++++++++++--
 pkgs/top-level/all-packages.nix               |  4 +-
 2 files changed, 53 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/version-management/sapling/default.nix b/pkgs/applications/version-management/sapling/default.nix
index 93c67d10bcb..4598c86fb75 100644
--- a/pkgs/applications/version-management/sapling/default.nix
+++ b/pkgs/applications/version-management/sapling/default.nix
@@ -1,7 +1,41 @@
-{ lib, stdenv, python3Packages, fetchFromGitHub, fetchurl, sd, curl, pkg-config, openssl, rustPlatform, fetchYarnDeps, yarn, nodejs, fixup_yarn_lock, glibcLocales }:
+{ lib
+, stdenv
+, python38Packages
+, fetchFromGitHub
+, fetchurl
+, sd
+, curl
+, pkg-config
+, openssl
+, rustPlatform
+, fetchYarnDeps
+, yarn
+, nodejs
+, fixup_yarn_lock
+, glibcLocales
+, libiconv
+, CoreFoundation
+, CoreServices
+, Security
+}:
 
 let
   inherit (lib.importJSON ./deps.json) links version versionHash;
+  # Sapling sets a Cargo config containing lines like so:
+  # [target.aarch64-apple-darwin]
+  # rustflags = ["-C", "link-args=-Wl,-undefined,dynamic_lookup"]
+  #
+  # The default cargo config that's set by the build hook will set
+  # unstable.host-config and unstable.target-applies-to-host which seems to
+  # result in the link arguments above being ignored and thus link failures.
+  # All it is there to do anyway is just to do stuff with musl and cross
+  # compilation, which doesn't work on macOS anyway so we can just stub it
+  # on macOS.
+  #
+  # See https://github.com/NixOS/nixpkgs/pull/198311#issuecomment-1326894295
+  myCargoSetupHook = rustPlatform.cargoSetupHook.overrideAttrs (old: {
+    cargoConfig = if stdenv.isDarwin then "" else old.cargoConfig;
+  });
 
   src = fetchFromGitHub {
     owner = "facebook";
@@ -54,7 +88,11 @@ let
   };
 
   # Builds the main `sl` binary and its Python extensions
-  sapling = python3Packages.buildPythonPackage {
+  #
+  # FIXME(lf-): when next updating this package, delete the python 3.8 override
+  # here, since the fix for https://github.com/facebook/sapling/issues/279 that
+  # required it will be in the next release.
+  sapling = python38Packages.buildPythonPackage {
     pname = "sapling-main";
     inherit src version;
 
@@ -85,7 +123,7 @@ let
       sed -i "s|https://files.pythonhosted.org/packages/[[:alnum:]]*/[[:alnum:]]*/[[:alnum:]]*/|file://$NIX_BUILD_TOP/$sourceRoot/hack_pydeps/|g" $sourceRoot/setup.py
     '';
 
-    postFixup = ''
+    postFixup = lib.optionalString stdenv.isLinux ''
       wrapProgram $out/bin/sl \
         --set LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive"
     '';
@@ -94,13 +132,19 @@ let
       curl
       pkg-config
     ] ++ (with rustPlatform; [
-      cargoSetupHook
+      myCargoSetupHook
       rust.cargo
       rust.rustc
     ]);
 
     buildInputs = [
+      curl
       openssl
+    ] ++ lib.optionals stdenv.isDarwin [
+      libiconv
+      CoreFoundation
+      CoreServices
+      Security
     ];
 
     doCheck = false;
@@ -124,7 +168,7 @@ stdenv.mkDerivation {
 
     cp -r ${sapling}/* $out
 
-    sitepackages=$out/lib/${python3Packages.python.libPrefix}/site-packages
+    sitepackages=$out/lib/${python38Packages.python.libPrefix}/site-packages
     chmod +w $sitepackages
     cp -r ${isl} $sitepackages/edenscm-isl
 
@@ -145,7 +189,7 @@ stdenv.mkDerivation {
     homepage = "https://sapling-scm.com";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ pbar thoughtpolice ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     mainProgram = "sl";
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6338c5b0a5e..dd2356a8147 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30435,7 +30435,9 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;
   };
 
-  sapling = callPackage ../applications/version-management/sapling { };
+  sapling = callPackage ../applications/version-management/sapling {
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Security;
+  };
 
   mercurialFull = mercurial.override { fullBuild = true; };
 

From 1f244f1625b32436e7076c2b823a481af2792074 Mon Sep 17 00:00:00 2001
From: Jeff Slight <jslight90@gmail.com>
Date: Thu, 1 Dec 2022 08:31:25 -0800
Subject: [PATCH 62/65] gitlab: 15.6.0 -> 15.6.1 (#203868)

* gitlab: 15.6.0 -> 15.6.1

* remove attr_encrypted gem
---
 pkgs/applications/version-management/gitlab/data.json  | 10 +++++-----
 .../version-management/gitlab/gitaly/default.nix       |  4 ++--
 .../gitlab/gitlab-workhorse/default.nix                |  2 +-
 .../version-management/gitlab/rubyEnv/Gemfile          |  2 +-
 .../version-management/gitlab/rubyEnv/Gemfile.lock     |  4 ++--
 .../version-management/gitlab/rubyEnv/gemset.nix       |  4 ++--
 6 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index dafea4640cb..fe0bed84b50 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "15.6.0",
-  "repo_hash": "sha256-7Pjksu1l2QfhpYieEGB9coypSt/0iMfptCa69Iaoe3s=",
+  "version": "15.6.1",
+  "repo_hash": "sha256-cdwfljmJvApU2q0pmWSmcMnHkQH4hfN7+cld5oP880g=",
   "yarn_hash": "0lgl8rs9mlrwpzq75rywdbjbiib17wxvzlv1jibnx66iw1ym2rvh",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v15.6.0-ee",
+  "rev": "v15.6.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "15.6.0",
+    "GITALY_SERVER_VERSION": "15.6.1",
     "GITLAB_PAGES_VERSION": "1.63.0",
     "GITLAB_SHELL_VERSION": "14.13.0",
-    "GITLAB_WORKHORSE_VERSION": "15.6.0"
+    "GITLAB_WORKHORSE_VERSION": "15.6.1"
   },
   "vendored_gems": [
     "bundler-checksum",
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index fcd50548221..14e9344b185 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -11,7 +11,7 @@ let
     gemdir = ./.;
   };
 
-  version = "15.6.0";
+  version = "15.6.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -22,7 +22,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      sha256 = "sha256-MQFvDSQhmlCz+ox9TFFEd+q2beDUXYVhIyEWWnxn7r0=";
+      sha256 = "sha256-mzX+6kMXqdrxqMaUwN2tG5kJgKSRv0/tNN8ibHqBbzU=";
     };
 
     vendorSha256 = "sha256-SEPfso27PHHpvnQwdeMQYECw/CZIa/NdpMBSTRJEwIo=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 1dedab8cb07..be226c94f43 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "15.6.0";
+  version = "15.6.1";
 
   src = fetchFromGitLab {
     owner = data.owner;
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index 57d7e83750f..cf08454a649 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -500,7 +500,7 @@ gem 'ssh_data', '~> 1.3'
 gem 'spamcheck', '~> 1.0.0'
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 15.5.0'
+gem 'gitaly', '~> 15.5.2'
 
 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.0.2'
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index d75df6327bb..2174cec05f8 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -554,7 +554,7 @@ GEM
       rails (>= 3.2.0)
     git (1.11.0)
       rchardet (~> 1.8)
-    gitaly (15.5.0)
+    gitaly (15.5.2)
       grpc (~> 1.0)
     gitlab (4.16.1)
       httparty (~> 0.14, >= 0.14.0)
@@ -1663,7 +1663,7 @@ DEPENDENCIES
   gettext (~> 3.3)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 15.5.0)
+  gitaly (~> 15.5.2)
   gitlab-chronic (~> 0.10.5)
   gitlab-dangerfiles (~> 3.6.2)
   gitlab-experiment (~> 0.7.1)
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index edeb6eeb4d1..54d4cfb85aa 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -2018,10 +2018,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hpgljz05rhik15z081ghxw9pw83vz78p12wjdgxj3qz1a4x8pfq";
+      sha256 = "10bq1l9445b9ff921kyayrn5w1b0f7qm1sjia3wmnl54jq2vxfk2";
       type = "gem";
     };
-    version = "15.5.0";
+    version = "15.5.2";
   };
   gitlab = {
     dependencies = ["httparty" "terminal-table"];

From 40b71c3e937620ae8dcfad69d5dfa343a8918d6d Mon Sep 17 00:00:00 2001
From: Ryan Lahfa <masterancpp@gmail.com>
Date: Thu, 1 Dec 2022 17:37:16 +0100
Subject: [PATCH 63/65] nixos/redmine: add missing lib.mdDoc (#203952)

---
 nixos/modules/services/misc/redmine.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index 2fe6a1788f5..58a595b5c76 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -211,49 +211,49 @@ in
         subversion = mkOption {
           type = types.bool;
           default = false;
-          description = "Subversion integration.";
+          description = lib.mdDoc "Subversion integration.";
         };
 
         mercurial = mkOption {
           type = types.bool;
           default = false;
-          description = "Mercurial integration.";
+          description = lib.mdDoc "Mercurial integration.";
         };
 
         git = mkOption {
           type = types.bool;
           default = false;
-          description = "git integration.";
+          description = lib.mdDoc "git integration.";
         };
 
         cvs = mkOption {
           type = types.bool;
           default = false;
-          description = "cvs integration.";
+          description = lib.mdDoc "cvs integration.";
         };
 
         breezy = mkOption {
           type = types.bool;
           default = false;
-          description = "bazaar integration.";
+          description = lib.mdDoc "bazaar integration.";
         };
 
         imagemagick = mkOption {
           type = types.bool;
           default = false;
-          description = "Allows exporting Gant diagrams as PNG.";
+          description = lib.mdDoc "Allows exporting Gant diagrams as PNG.";
         };
 
         ghostscript = mkOption {
           type = types.bool;
           default = false;
-          description = "Allows exporting Gant diagrams as PDF.";
+          description = lib.mdDoc "Allows exporting Gant diagrams as PDF.";
         };
 
         minimagick_font_path = mkOption {
           type = types.str;
           default = "";
-          description = "";
+          description = lib.mdDoc "MiniMagick font path";
           example = "/run/current-system/sw/share/X11/fonts/LiberationSans-Regular.ttf";
         };
       };

From 094532b6194179364e6f5d1493ddcaa910e79eaa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 1 Dec 2022 17:43:08 +0000
Subject: [PATCH 64/65] python310Packages.pyoctoprintapi: 0.1.9 -> 0.1.10

---
 pkgs/development/python-modules/pyoctoprintapi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyoctoprintapi/default.nix b/pkgs/development/python-modules/pyoctoprintapi/default.nix
index da3ebac2c1e..87a5627bb9e 100644
--- a/pkgs/development/python-modules/pyoctoprintapi/default.nix
+++ b/pkgs/development/python-modules/pyoctoprintapi/default.nix
@@ -12,7 +12,7 @@
 
 let
   pname = "pyoctoprintapi";
-  version = "0.1.9";
+  version = "0.1.10";
 in
 buildPythonPackage {
   inherit pname version;
@@ -22,7 +22,7 @@ buildPythonPackage {
     owner = "rfleming71";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-kZMTHw0S12aUn/DYQuyjQa48QtiwLGYyY4gYKA5063A=";
+    hash = "sha256-aXT8BY7D7Tx3UG7Brfpk8yQv1opXQUsgJteNkBwHeYY=";
   };
 
   propagatedBuildInputs = [

From abc0cf6076f6da364b7a0cbd7e578cee72384608 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 1 Dec 2022 18:50:30 +0100
Subject: [PATCH 65/65] python310Packages.pyoctoprintapi: add changelog to meta

---
 pkgs/development/python-modules/pyoctoprintapi/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/pyoctoprintapi/default.nix b/pkgs/development/python-modules/pyoctoprintapi/default.nix
index 87a5627bb9e..af9a437e4c2 100644
--- a/pkgs/development/python-modules/pyoctoprintapi/default.nix
+++ b/pkgs/development/python-modules/pyoctoprintapi/default.nix
@@ -41,6 +41,7 @@ buildPythonPackage {
   meta = with lib; {
     description = "Simple async wrapper around the Octoprint API";
     homepage = "https://github.com/rfleming71/pyoctoprintapi";
+    changelog = "https://github.com/rfleming71/pyoctoprintapi/releases/tag/v${version}";
     license = licenses.mit;
     maintainers= with maintainers; [ hexa ];
   };