Merge staging-next into staging

doc/builders/special/fhs-environments.section.md

@@ -11,6 +11,8 @@ Accepted arguments are:
         Packages to be installed for the main host's architecture (i.e. x86_64 on x86_64 installations). Along with libraries binaries are also installed.
 - `multiPkgs`
         Packages to be installed for all architectures supported by a host (i.e. i686 and x86_64 on x86_64 installations). Only libraries are installed by default.
+- `multiArch`
+        Whether to install 32bit multiPkgs into the FHSEnv in 64bit environments
 - `extraBuildCommands`
         Additional commands to be executed for finalizing the directory structure.
 - `extraBuildCommandsMulti`

doc/languages-frameworks/javascript.section.md

@@ -196,12 +196,14 @@ buildNpmPackage rec {
 * `npmDepsHash`: The output hash of the dependencies for this project. Can be calculated in advance with [`prefetch-npm-deps`](#javascript-buildNpmPackage-prefetch-npm-deps).
 * `makeCacheWritable`: Whether to make the cache writable prior to installing dependencies. Don't set this unless npm tries to write to the cache directory, as it can slow down the build.
 * `npmBuildScript`: The script to run to build the project. Defaults to `"build"`.
+* `npmWorkspace`: The workspace directory within the project to build and install.
 * `dontNpmBuild`: Option to disable running the build script. Set to `true` if the package does not have a build script. Defaults to `false`. Alternatively, setting `buildPhase` explicitly also disables this.
 * `dontNpmInstall`: Option to disable running `npm install`. Defaults to `false`. Alternatively, setting `installPhase` explicitly also disables this.
 * `npmFlags`: Flags to pass to all npm commands.
-* `npmInstallFlags`: Flags to pass to `npm ci` and `npm prune`.
+* `npmInstallFlags`: Flags to pass to `npm ci`.
 * `npmBuildFlags`: Flags to pass to `npm run ${npmBuildScript}`.
 * `npmPackFlags`: Flags to pass to `npm pack`.
+* `npmPruneFlags`: Flags to pass to `npm prune`. Defaults to the value of `npmInstallFlags`.
 
 #### prefetch-npm-deps {#javascript-buildNpmPackage-prefetch-npm-deps}
 

nixos/modules/services/x11/display-managers/sddm.nix

@@ -268,6 +268,17 @@ in
     environment.systemPackages = [ sddm ];
     services.dbus.packages = [ sddm ];
 
+    # We're not using the upstream unit, so copy these: https://github.com/sddm/sddm/blob/develop/services/sddm.service.in
+    systemd.services.display-manager.after = [
+      "systemd-user-sessions.service"
+      "getty@tty7.service"
+      "plymouth-quit.service"
+      "systemd-logind.service"
+    ];
+    systemd.services.display-manager.conflicts = [
+      "getty@tty7.service"
+    ];
+
     # To enable user switching, allow sddm to allocate TTYs/displays dynamically.
     services.xserver.tty = null;
     services.xserver.display = null;

nixos/modules/virtualisation/lxd.nix

@@ -85,6 +85,14 @@ in {
           considered failed and systemd will attempt to restart it.
         '';
       };
+
+      ui = {
+        enable = lib.mkEnableOption (lib.mdDoc ''
+          Enables the (experimental) LXD UI.
+        '');
+
+        package = mkPackageOption pkgs.lxd "ui" { };
+      };
     };
   };
 
@@ -143,6 +151,10 @@ in {
       path = [ pkgs.util-linux ]
         ++ optional cfg.zfsSupport config.boot.zfs.package;
 
+      environment = mkIf (cfg.ui.enable) {
+        "LXD_UI" = cfg.ui.package;
+      };
+
       serviceConfig = {
         ExecStart = "@${cfg.package}/bin/lxd lxd --group lxd";
         ExecStartPost = "${cfg.package}/bin/lxd waitready --timeout=${cfg.startTimeout}";

nixos/tests/all-tests.nix

@@ -436,6 +436,7 @@ in {
   lxd = handleTest ./lxd.nix {};
   lxd-nftables = handleTest ./lxd-nftables.nix {};
   lxd-image-server = handleTest ./lxd-image-server.nix {};
+  lxd-ui = handleTest ./lxd-ui.nix {};
   #logstash = handleTest ./logstash.nix {};
   lorri = handleTest ./lorri/default.nix {};
   maddy = discoverTests (import ./maddy { inherit handleTest; });

nixos/tests/lxd-ui.nix

@@ -0,0 +1,35 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "lxd-ui";
+
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jnsgruk ];
+  };
+
+  nodes.machine = { lib, ... }: {
+    virtualisation = {
+      lxd.enable = true;
+      lxd.ui.enable = true;
+    };
+
+    environment.systemPackages = [ pkgs.curl ];
+  };
+
+  testScript = ''
+    machine.wait_for_unit("sockets.target")
+    machine.wait_for_unit("lxd.service")
+    machine.wait_for_file("/var/lib/lxd/unix.socket")
+
+    # Wait for lxd to settle
+    machine.succeed("lxd waitready")
+
+    # Configure LXC listen address
+    machine.succeed("lxc config set core.https_address :8443")
+    machine.succeed("systemctl restart lxd")
+
+    # Check that the LXD_UI environment variable is populated in the systemd unit
+    machine.succeed("cat /etc/systemd/system/lxd.service | grep 'LXD_UI'")
+
+    # Ensure the endpoint returns an HTML page with 'LXD UI' in the title
+    machine.succeed("curl -kLs https://localhost:8443/ui | grep '<title>LXD UI</title>'")
+  '';
+})

nixos/tests/sddm.nix

@@ -23,14 +23,14 @@ let
       enableOCR = true;
 
       testScript = { nodes, ... }: let
-        user = nodes.machine.config.users.users.alice;
+        user = nodes.machine.users.users.alice;
       in ''
         start_all()
         machine.wait_for_text("(?i)select your user")
         machine.screenshot("sddm")
         machine.send_chars("${user.password}\n")
-        machine.wait_for_file("${user.home}/.Xauthority")
+        machine.wait_for_file("/tmp/xauth_*")
-        machine.succeed("xauth merge ${user.home}/.Xauthority")
+        machine.succeed("xauth merge /tmp/xauth_*")
         machine.wait_for_window("^IceWM ")
       '';
     };
@@ -55,12 +55,10 @@ let
         services.xserver.windowManager.icewm.enable = true;
       };
 
-      testScript = { nodes, ... }: let
+      testScript = { nodes, ... }: ''
-        user = nodes.machine.config.users.users.alice;
-      in ''
         start_all()
-        machine.wait_for_file("${user.home}/.Xauthority")
+        machine.wait_for_file("/tmp/xauth_*")
-        machine.succeed("xauth merge ${user.home}/.Xauthority")
+        machine.succeed("xauth merge /tmp/xauth_*")
         machine.wait_for_window("^IceWM ")
       '';
     };

pkgs/applications/audio/plexamp/default.nix

@@ -16,7 +16,7 @@ let
 in appimageTools.wrapType2 {
   inherit pname version src;
 
-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
   extraPkgs = pkgs: appimageTools.defaultFhsEnvArgs.multiPkgs pkgs ++ [ pkgs.bash ];
 
   extraInstallCommands = ''

pkgs/applications/audio/ptcollab/default.nix

@@ -14,13 +14,13 @@
 
 mkDerivation rec {
   pname = "ptcollab";
-  version = "0.6.4.6";
+  version = "0.6.4.7";
 
   src = fetchFromGitHub {
     owner = "yuxshao";
     repo = "ptcollab";
     rev = "v${version}";
-    hash = "sha256-G0QQV0mvrrBAC2LSy45/NnEbHHA8/E0SZKJXvuVidRE=";
+    hash = "sha256-KYNov/HbKM2d8VVO8iyWA3XWFDE9iWeKkRCNC1xlPNw=";
   };
 
   nativeBuildInputs = [

pkgs/applications/blockchains/mycrypto/default.nix

@@ -28,7 +28,7 @@ let
 in appimageTools.wrapType2 rec {
   inherit name src;
 
-  multiPkgs = null; # no p32bit needed
+  multiArch = false; # no p32bit needed
   extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
 
   extraInstallCommands = ''

pkgs/applications/display-managers/sddm/default.nix

@@ -1,59 +1,44 @@
-{ mkDerivation, lib, fetchFromGitHub, fetchpatch
+{ mkDerivation, lib, fetchFromGitHub
-, cmake, extra-cmake-modules, pkg-config, libxcb, libpthreadstubs
+, cmake, extra-cmake-modules, pkg-config, qttools
-, libXdmcp, libXau, qtbase, qtdeclarative, qtquickcontrols2, qttools, pam, systemd
+, libxcb, libXau, pam, qtbase, qtdeclarative, qtquickcontrols2, systemd, xkeyboardconfig
 }:
-
+mkDerivation rec {
-let
-  version = "0.19.0";
-
-in mkDerivation {
   pname = "sddm";
-  inherit version;
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "sddm";
     repo = "sddm";
     rev = "v${version}";
-    sha256 = "1s6icb5r1n6grfs137gdzfrcvwsb3hvlhib2zh6931x8pkl1qvxa";
+    hash = "sha256-ctZln1yQov+p/outkQhcWZp46IKITC04e22RfePwEM4=";
   };
 
   patches = [
     ./sddm-ignore-config-mtime.patch
     ./sddm-default-session.patch
-    # Load `/etc/profile` for `environment.variables` with zsh default shell.
-    # See: https://github.com/sddm/sddm/pull/1382
-    (fetchpatch {
-      url = "https://github.com/sddm/sddm/commit/e1dedeeab6de565e043f26ac16033e613c222ef9.patch";
-      sha256 = "sha256-OPyrUI3bbH+PGDBfoL4Ohb4wIvmy9TeYZhE0JxR/D58=";
-    })
-    # Fix build with Qt 5.15.3
-    # See: https://github.com/sddm/sddm/pull/1325
-    (fetchpatch {
-      url = "https://github.com/sddm/sddm/commit/e93bf95c54ad8c2a1604f8d7be05339164b19308.patch";
-      sha256 = "sha256:1rh6sdvzivjcl5b05fczarvxhgpjhi7019hvf2gadnwgwdg104r4";
-    })
-    # Fix fails to start while starting X server
-    # See: https://github.com/sddm/sddm/pull/1324
-    (fetchpatch {
-      url = "https://github.com/sddm/sddm/commit/adfaa222fdfa6115ea2b320b0bbc2126db9270a5.patch";
-      sha256 = "sha256-q/YLlAjxluzHMKUUQglLo3RyyhERQGPHXGr56+4R9VU=";
-    })
   ];
 
-  postPatch =
+  postPatch = ''
-    # Fix missing include for gettimeofday()
+    substituteInPlace src/greeter/waylandkeyboardbackend.cpp \
-    ''
+      --replace "/usr/share/X11/xkb/rules/evdev.xml" "${xkeyboardconfig}/share/X11/xkb/rules/evdev.xml"
-      sed -e '1i#include <sys/time.h>' -i src/helper/HelperApp.cpp
+  '';
-    '';
 
   nativeBuildInputs = [ cmake extra-cmake-modules pkg-config qttools ];
 
   buildInputs = [
-    libxcb libpthreadstubs libXdmcp libXau pam qtbase qtdeclarative qtquickcontrols2 systemd
+    libxcb
+    libXau
+    pam
+    qtbase
+    qtdeclarative
+    qtquickcontrols2
+    systemd
   ];
 
   cmakeFlags = [
     "-DCONFIG_FILE=/etc/sddm.conf"
+    "-DCONFIG_DIR=/etc/sddm.conf.d"
+
     # Set UID_MIN and UID_MAX so that the build script won't try
     # to read them from /etc/login.defs (fails in chroot).
     # The values come from NixOS; they may not be appropriate
@@ -62,9 +47,15 @@ in mkDerivation {
     "-DUID_MIN=1000"
     "-DUID_MAX=29999"
 
+    # we still want to run the DM on VT 7 for the time being, as 1-6 are
+    # occupied by getties by default
+    "-DSDDM_INITIAL_VT=7"
+
     "-DQT_IMPORTS_DIR=${placeholder "out"}/${qtbase.qtQmlPrefix}"
     "-DCMAKE_INSTALL_SYSCONFDIR=${placeholder "out"}/etc"
     "-DSYSTEMD_SYSTEM_UNIT_DIR=${placeholder "out"}/lib/systemd/system"
+    "-DSYSTEMD_SYSUSERS_DIR=${placeholder "out"}/lib/sysusers.d"
+    "-DSYSTEMD_TMPFILES_DIR=${placeholder "out"}/lib/tmpfiles.d"
     "-DDBUS_CONFIG_DIR=${placeholder "out"}/share/dbus-1/system.d"
   ];
 

pkgs/applications/display-managers/sddm/sddm-default-session.patch

@@ -1,38 +1,39 @@
 diff --git a/src/common/Configuration.h b/src/common/Configuration.h
-index cf44a62..7bb9c03 100644
+index 54bcace..49cf5cb 100644
 --- a/src/common/Configuration.h
 +++ b/src/common/Configuration.h
-@@ -44,6 +44,7 @@ namespace SDDM {
+@@ -48,6 +48,8 @@ namespace SDDM {
-                                                                                                    "NOTE: Currently ignored if autologin is enabled."));
          Entry(InputMethod,         QString,     QStringLiteral("qtvirtualkeyboard"),                   _S("Input method module"));
          Entry(Namespaces,          QStringList, QStringList(),                                  _S("Comma-separated list of Linux namespaces for user session to enter"));
+         Entry(GreeterEnvironment,  QStringList, QStringList(),                                  _S("Comma-separated list of environment variables to be set"));
 +        Entry(DefaultSession,      QString,     QString(),                                      _S("System-wide default session"));
++
          //  Name   Entries (but it's a regular class again)
          Section(Theme,
              Entry(ThemeDir,            QString,     _S(DATA_INSTALL_DIR "/themes"),             _S("Theme directory path"));
 diff --git a/src/greeter/SessionModel.cpp b/src/greeter/SessionModel.cpp
-index 1953c76..54fe2f2 100644
+index d8698b7..df3e3c4 100644
 --- a/src/greeter/SessionModel.cpp
 +++ b/src/greeter/SessionModel.cpp
-@@ -43,6 +43,7 @@ namespace SDDM {
+@@ -49,6 +49,7 @@ namespace SDDM {
-         beginResetModel();
+         if (dri_active)
-         populate(Session::WaylandSession, mainConfig.Wayland.SessionDir.get());
+             populate(Session::WaylandSession, mainConfig.Wayland.SessionDir.get());
          populate(Session::X11Session, mainConfig.X11.SessionDir.get());
 +        selectDefaultSession();
          endResetModel();
- 
+
          // refresh everytime a file is changed, added or removed
-@@ -52,6 +53,7 @@ namespace SDDM {
+@@ -62,6 +63,7 @@ namespace SDDM {
-             d->sessions.clear();
+             if (dri_active)
-             populate(Session::WaylandSession, mainConfig.Wayland.SessionDir.get());
+                 populate(Session::WaylandSession, mainConfig.Wayland.SessionDir.get());
              populate(Session::X11Session, mainConfig.X11.SessionDir.get());
 +            selectDefaultSession();
              endResetModel();
          });
-         watcher->addPath(mainConfig.Wayland.SessionDir.get());
+         watcher->addPaths(mainConfig.Wayland.SessionDir.get());
-@@ -149,11 +151,25 @@ namespace SDDM {
+@@ -164,11 +166,25 @@ namespace SDDM {
-             else
                  delete si;
+             }
          }
 +    }
 +
@@ -58,14 +59,13 @@ index 1953c76..54fe2f2 100644
          }
      }
 diff --git a/src/greeter/SessionModel.h b/src/greeter/SessionModel.h
-index 2e2efa9..a93315c 100644
+index 8f4d539..02f77ce 100644
 --- a/src/greeter/SessionModel.h
 +++ b/src/greeter/SessionModel.h
-@@ -58,6 +58,7 @@ namespace SDDM {
+@@ -59,6 +59,7 @@ namespace SDDM {
          SessionModelPrivate *d { nullptr };
- 
+
-         void populate(Session::Type type, const QString &path);
+         void populate(Session::Type type, const QStringList &dirPaths);
 +        void selectDefaultSession();
      };
  }
- 

pkgs/applications/editors/standardnotes/default.nix

@@ -1,38 +1,45 @@
-{ callPackage, lib, stdenv, appimageTools, autoPatchelfHook, desktop-file-utils
+{ lib, stdenv, fetchurl, dpkg, makeWrapper, electron, libsecret
-, fetchurl, libsecret  }:
+, desktop-file-utils , callPackage }:
 
 let
+
   srcjson = builtins.fromJSON (builtins.readFile ./src.json);
-  version = srcjson.version;
+
-  pname = "standardnotes";
-  name = "${pname}-${version}";
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
-  src = fetchurl (srcjson.appimage.${stdenv.hostPlatform.system} or throwSystem);
+in
 
-  appimageContents = appimageTools.extract {
+stdenv.mkDerivation rec {
-    inherit name src;
-  };
 
-  nativeBuildInputs = [ autoPatchelfHook desktop-file-utils ];
+  pname = "standardnotes";
 
-in appimageTools.wrapType2 rec {
+  src = fetchurl (srcjson.deb.${stdenv.hostPlatform.system} or throwSystem);
-  inherit name src;
 
-  extraPkgs = pkgs: with pkgs; [
+  inherit (srcjson) version;
-    libsecret
-  ];
 
-  extraInstallCommands = ''
+  dontConfigure = true;
-    # directory in /nix/store so readonly
+
-    cd $out
+  dontBuild = true;
-    chmod -R +w $out
+
-    mv $out/bin/${name} $out/bin/${pname}
+  nativeBuildInputs = [ makeWrapper dpkg desktop-file-utils ];
+
+  unpackPhase = "dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/standardnotes
+    cp -R usr/share/{applications,icons} $out/share
+    cp -R opt/Standard\ Notes/resources/app.asar $out/share/standardnotes/
+
+    makeWrapper ${electron}/bin/electron $out/bin/standardnotes \
+      --add-flags $out/share/standardnotes/app.asar \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libsecret stdenv.cc.cc.lib ]}
 
-    # fixup and install desktop file
     ${desktop-file-utils}/bin/desktop-file-install --dir $out/share/applications \
-      --set-key Exec --set-value ${pname} ${appimageContents}/standard-notes.desktop
+      --set-key Exec --set-value standardnotes usr/share/applications/standard-notes.desktop
-    ln -s ${appimageContents}/usr/share/icons share
+
+    runHook postInstall
   '';
 
   passthru.updateScript = callPackage ./update.nix {};
@@ -47,6 +54,6 @@ in appimageTools.wrapType2 rec {
     license = licenses.agpl3;
     maintainers = with maintainers; [ mgregoire chuangzhu squalus ];
     sourceProvenance = [ sourceTypes.binaryNativeCode ];
-    platforms = builtins.attrNames srcjson.appimage;
+    platforms = builtins.attrNames srcjson.deb;
   };
 }

pkgs/applications/editors/standardnotes/src.json

@@ -1,13 +1,13 @@
 {
   "version": "3.162.8",
-  "appimage": {
+  "deb": {
     "x86_64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.162.8/standard-notes-3.162.8-linux-x86_64.AppImage",
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.162.8/standard-notes-3.162.8-linux-amd64.deb",
-      "hash": "sha512-+JoY/x99RDLLjERaFhye0Bsg5FWFAgTPr6tqjXOYjHYuztYhmOZnieIGF8hS0iZsSPoQG9mm2mUVOTEHhXvm8A=="
+      "hash": "sha512-XxSz1ZXCVzNBqX5BQ4nytFla1igEttV/pQ40r3HW6BQfy6yprQqmQ94OMJSx7kpfeQpxnwBMOUsA58QM3W7y1w=="
     },
     "aarch64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.162.8/standard-notes-3.162.8-linux-arm64.AppImage",
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.162.8/standard-notes-3.162.8-linux-arm64.deb",
-      "hash": "sha512-7/oHUJQBlTr4mL8ETESW6PC9rWewAUGHLtdCwNmnhh9zTBWxc0jO8fLikDDql5vrlCCGhZqmnmmlvMGNFFLBdw=="
+      "hash": "sha512-Y1+89UaPfB+UKiVg3JWo3zwH1rFnjdKuU1CBwIjMblzf1775gEMXicU0n+6FpWTphcVmEeah9VISoq0oBHNHtg=="
     }
   }
 }

pkgs/applications/editors/standardnotes/update.nix

@@ -31,7 +31,7 @@ writeScript "update-standardnotes" ''
   fi
 
   function getDownloadUrl() {
-    jq -r ".assets[] | select(.name==\"standard-notes-$newVersion-$1.AppImage\") | .browser_download_url" < "$jsonPath"
+    jq -r ".assets[] | select(.name==\"standard-notes-$newVersion-$1.deb\") | .browser_download_url" < "$jsonPath"
   }
 
   function setJsonKey() {
@@ -44,11 +44,11 @@ writeScript "update-standardnotes" ''
     url=$(getDownloadUrl "$upstreamPlatform")
     hash=$(nix-prefetch-url "$url" --type sha512)
     sriHash=$(nix hash to-sri --type sha512 $hash)
-    setJsonKey .appimage[\""$nixPlatform"\"].url "$url"
+    setJsonKey .deb[\""$nixPlatform"\"].url "$url"
-    setJsonKey .appimage[\""$nixPlatform"\"].hash "$sriHash"
+    setJsonKey .deb[\""$nixPlatform"\"].hash "$sriHash"
   }
 
-  updatePlatform x86_64-linux linux-x86_64
+  updatePlatform x86_64-linux linux-amd64
   updatePlatform aarch64-linux linux-arm64
   setJsonKey .version "$newVersion"
 ''

pkgs/applications/graphics/oculante/Cargo.lock

@@ -316,9 +316,9 @@ dependencies = [
 
 [[package]]
 name = "bitstream-io"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d28070975aaf4ef1fd0bd1f29b739c06c2cdd9972e090617fb6dca3b2cb564e"
+checksum = "82704769cb85a22df2c54d6bdd6a158b7931d256cf3248a07d6ecbe9d58b31d7"
 
 [[package]]
 name = "block"
@@ -2021,9 +2021,9 @@ checksum = "28b29a3cd74f0f4598934efe3aeba42bae0eb4680554128851ebbecb02af14e6"
 
 [[package]]
 name = "is-terminal"
-version = "0.4.8"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24fddda5af7e54bf7da53067d6e802dbcc381d0a8eef629df528e3ebf68755cb"
+checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
 dependencies = [
  "hermit-abi 0.3.2",
  "rustix 0.38.3",
@@ -3016,6 +3016,17 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "num-derive"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e6a0fd4f737c707bd9086cc16c925f294943eb62eb71499e9fd4cf71f8b9f4e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.23",
+]
+
 [[package]]
 name = "num-integer"
 version = "0.1.45"
@@ -3181,7 +3192,7 @@ dependencies = [
 
 [[package]]
 name = "oculante"
-version = "0.6.67"
+version = "0.6.68"
 dependencies = [
  "anyhow",
  "arboard",
@@ -3710,7 +3721,7 @@ dependencies = [
  "nasm-rs",
  "new_debug_unreachable",
  "noop_proc_macro",
- "num-derive",
+ "num-derive 0.3.3",
  "num-traits 0.2.15",
  "once_cell",
  "paste",
@@ -4032,9 +4043,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.21.2"
+version = "0.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e32ca28af694bc1bbf399c33a516dbdf1c90090b8ab23c2bc24f834aa2247f5f"
+checksum = "b19faa85ecb5197342b54f987b142fb3e30d0c90da40f80ef4fa9a726e6676ed"
 dependencies = [
  "log",
  "ring",
@@ -4053,9 +4064,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.100.1"
+version = "0.101.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6207cd5ed3d8dca7816f8f3725513a34609c0c765bf652b8c3cb4cfd87db46b"
+checksum = "15f36a6828982f422756984e47912a7a51dcbc2a197aa791158f8ca61cd8204e"
 dependencies = [
  "ring",
  "untrusted",
@@ -4185,18 +4196,18 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.166"
+version = "1.0.167"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d01b7404f9d441d3ad40e6a636a7782c377d2abdbe4fa2440e2edcc2f4f10db8"
+checksum = "7daf513456463b42aa1d94cff7e0c24d682b429f020b9afa4f5ba5c40a22b237"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.166"
+version = "1.0.167"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dd83d6dde2b6b2d466e14d9d1acce8816dedee94f735eac6395808b3483c6d6"
+checksum = "b69b106b68bc8054f0e974e70d19984040f8a5cf9215ca82626ea4853f82c4b9"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4331,9 +4342,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0"
+checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
 
 [[package]]
 name = "smithay-client-toolkit"
@@ -4509,7 +4520,7 @@ dependencies = [
  "cfg-expr",
  "heck",
  "pkg-config",
- "toml 0.7.5",
+ "toml 0.7.6",
  "version-compare",
 ]
 
@@ -4550,18 +4561,18 @@ checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
 
 [[package]]
 name = "thiserror"
-version = "1.0.41"
+version = "1.0.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c16a64ba9387ef3fdae4f9c1a7f07a0997fce91985c0336f1ddc1822b3b37802"
+checksum = "a35fc5b8971143ca348fa6df4f024d4d55264f3468c71ad1c2f365b0a4d58c42"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.41"
+version = "1.0.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d14928354b01c4d6a4f0e549069adef399a284e7995c7ccca94e8a07a5346c59"
+checksum = "463fe12d7993d3b327787537ce8dd4dfa058de32fc2b195ef3cde03dc4771e8f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4719,9 +4730,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.7.5"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ebafdf5ad1220cb59e7d17cf4d2c72015297b75b19a10472f99b89225089240"
+checksum = "c17e963a819c331dcacd7ab957d80bc2b9a9c1e71c804826d2f283dd65306542"
 dependencies = [
  "serde",
  "serde_spanned",
@@ -4740,9 +4751,9 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.19.11"
+version = "0.19.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "266f016b7f039eec8a1a80dfe6156b633d208b9fccca5e4db1d6775b0c4e34a7"
+checksum = "c500344a19072298cd05a7224b3c0c629348b78692bf48466c5238656e315a78"
 dependencies = [
  "indexmap 2.0.0",
  "serde",
@@ -4987,13 +4998,13 @@ dependencies = [
 
 [[package]]
 name = "v_frame"
-version = "0.3.4"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3753f70d50a77f5d381103ba2693a889fed0d84273dd5cbdf4eb8bda720f0c6"
+checksum = "bec8189c996a12ac77c50065f9c9f64961e56eb940d0ae1a4ccc7bea238bb4bc"
 dependencies = [
  "cfg-if 1.0.0",
  "noop_proc_macro",
- "num-derive",
+ "num-derive 0.4.0",
  "num-traits 0.2.15",
  "rust_hawktracer",
 ]
@@ -5535,9 +5546,9 @@ dependencies = [
 
 [[package]]
 name = "winnow"
-version = "0.4.7"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca0ace3845f0d96209f0375e6d367e3eb87eb65d27d445bdc9f1843a26f39448"
+checksum = "a9482fe6ceabdf32f3966bfdd350ba69256a97c30253dc616fe0005af24f164e"
 dependencies = [
  "memchr",
 ]

pkgs/applications/graphics/oculante/default.nix

@@ -21,13 +21,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oculante";
-  version = "0.6.67";
+  version = "0.6.68";
 
   src = fetchFromGitHub {
     owner = "woelper";
     repo = pname;
     rev = version;
-    hash = "sha256-SpHv6bZff3Z5SnOjamOFf8SRuUlovsLXSFOrqYtNwEs=";
+    hash = "sha256-afkRId4PuRKnnloFLh2rD+npcCCUqDngKcnWbEf+6vk=";
   };
 
   cargoLock = {

pkgs/applications/misc/bottles/fhsenv.nix

@@ -7,6 +7,9 @@
 }:
 
 let fhsEnv = {
+  # Many WINE games need 32bit
+  multiArch = true;
+
   targetPkgs = pkgs: with pkgs; [
     bottles-unwrapped
     # This only allows to enable the toggle, vkBasalt won't work if not installed with environment.systemPackages (or nix-env)

pkgs/applications/misc/chrysalis/default.nix

@@ -14,7 +14,7 @@ in appimageTools.wrapAppImage rec {
     };
   };
 
-  multiPkgs = null;
+  multiArch = false;
   extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [
     p.glib
   ];

pkgs/applications/misc/joplin-desktop/default.nix

@@ -47,7 +47,7 @@ let
       export LC_ALL=C.UTF-8
     '';
 
-    multiPkgs = null; # no 32bit needed
+    multiArch = false; # no 32bit needed
     extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
     extraInstallCommands = ''
       mv $out/bin/{${name},${pname}}

pkgs/applications/misc/lutris/fhsenv.nix

@@ -18,6 +18,9 @@ in buildFHSEnv {
 
   runScript = "lutris";
 
+  # Many native and WINE games need 32bit
+  multiArch = true;
+
   targetPkgs = pkgs: with pkgs; [
     lutris-unwrapped
 

pkgs/applications/misc/marktext/default.nix

@@ -20,7 +20,7 @@ appimageTools.wrapType2 rec {
     export LC_ALL=C.UTF-8
   '';
 
-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
   extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [
     p.libsecret
     p.xorg.libxkbfile

pkgs/applications/misc/notable/default.nix

@@ -26,7 +26,7 @@ appimageTools.wrapType2 rec {
     export LC_ALL=C.UTF-8
   '';
 
-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
   extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [ p.at-spi2-atk p.at-spi2-core ];
   extraInstallCommands = ''
     mv $out/bin/{${name},${pname}}

pkgs/applications/misc/zettlr/default.nix

@@ -21,7 +21,7 @@ in
 appimageTools.wrapType2 rec {
   inherit name src;
 
-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
   extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ texlive pandoc ];
   extraInstallCommands = ''
     mv $out/bin/{${name},${pname}}

pkgs/applications/networking/Sylk/default.nix

@@ -17,7 +17,7 @@ appimageTools.wrapType2 rec {
     export LC_ALL=C.UTF-8
   '';
 
-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
   extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
   extraInstallCommands = "mv $out/bin/{${name},${pname}}";
 

pkgs/applications/networking/browsers/polypane/default.nix

@@ -16,7 +16,7 @@ let
 in appimageTools.wrapType2 {
   inherit pname src version;
 
-  multiPkgs = null;
+  multiArch = false;
   extraPkgs = pkgs: appimageTools.defaultFhsEnvArgs.multiPkgs pkgs ++ [ pkgs.bash ];
 
   extraInstallCommands = ''

pkgs/applications/networking/cluster/glooctl/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.14.9";
+  version = "1.14.10";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-PJvr62slTW3IoauLtRH88BDMpf3qGOWADjj4L4wQBLo=";
+    hash = "sha256-eBfguD4vugGdLj6Qs1VkJVyhXYMrpcqsdTdYEDM86cc=";
   };
 
   subPackages = [ "projects/gloo/cli/cmd" ];

pkgs/applications/networking/cluster/kubebuilder/default.nix

@@ -12,13 +12,13 @@
 
 buildGoModule rec {
   pname = "kubebuilder";
-  version = "3.11.0";
+  version = "3.11.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "kubebuilder";
     rev = "v${version}";
-    hash = "sha256-R4piek1mhMy5QPB6weR3F7PiIq0LvwkRAnIndbar9tg=";
+    hash = "sha256-VT9S8Ijf684rowfoU1kvgPSTzR8ZGr3GwxWiYHWLANc=";
   };
 
   vendorHash = "sha256-5XUYmAfFH6UlLF09PqcSLUxkgZ5iHZGj0Vurab+Jl1g=";

pkgs/applications/networking/cluster/octant/desktop.nix

@@ -27,7 +27,7 @@ let
       export LC_ALL=C.UTF-8
     '';
 
-    multiPkgs = null; # no 32bit needed
+    multiArch = false; # no 32bit needed
     extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
     extraInstallCommands =
       let appimageContents = appimageTools.extractType2 { inherit name src; }; in

pkgs/applications/networking/cluster/openlens/default.nix

@@ -2,11 +2,11 @@
 
 let
   pname = "openlens";
-  version = "6.5.2-356";
+  version = "6.5.2-366";
 
   src = fetchurl {
     url = "https://github.com/MuhammedKalkan/OpenLens/releases/download/v${version}/OpenLens-${version}.x86_64.AppImage";
-    sha256 = "sha256-ZOLfnAKZMqO/MkpjX2SQhtBIeWRGTkPBWdAw67a3l9Q=";
+    sha256 = "sha256-ZAltAS/U/xh4kCT7vQ+NHAzWV7z0uE5GMQICHKSdj8k=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -46,11 +46,11 @@
     "vendorHash": "sha256-xZ0pS7XxfYGbG2kEw5FAjABDQZmektaI7OhToiFMXKk="
   },
   "alicloud": {
-    "hash": "sha256-SYzc8mvLdSHWR75+Fy4Egn2BO8t89aowYHhZ6MlyEIU=",
+    "hash": "sha256-F69Otml1zH5TtD6dRPIXc2pOq2aM8NEsTsnmJDQEdxk=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.207.1",
+    "rev": "v1.207.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -390,13 +390,13 @@
     "vendorHash": null
   },
   "flexibleengine": {
-    "hash": "sha256-WO99FOJ6zZ0GPxoYwH55Ul0HTktH2UZ3yWRrwjk3qA4=",
+    "hash": "sha256-Y7rplfN7acrDWNO9Q4K3WaM5reFxi5ms012+wTm+EF0=",
     "homepage": "https://registry.terraform.io/providers/FlexibleEngineCloud/flexibleengine",
     "owner": "FlexibleEngineCloud",
     "repo": "terraform-provider-flexibleengine",
-    "rev": "v1.38.0",
+    "rev": "v1.39.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DSdE0CkAIJje71/S64no9fMJMUhAnFiK3lWewvcyE14="
+    "vendorHash": "sha256-RqYzqKPzb5GcrzHnEDZC7GaBt1zP8g28Wo3WNAe07Ck="
   },
   "fly": {
     "hash": "sha256-9QB2fbggCKcJz8tkSYgq/X8r+MB2M76VCWXgsHARTkU=",
@@ -1034,11 +1034,11 @@
     "vendorHash": null
   },
   "snowflake": {
-    "hash": "sha256-QxqzIaDzVxvxnf10rLWl4CUUIvzWLsSyWHXBg5S1608=",
+    "hash": "sha256-Cou96AjZDi6GTz6i7+x/nJfwHkHrHB9E9g8RzX4/QKo=",
     "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
     "owner": "Snowflake-Labs",
     "repo": "terraform-provider-snowflake",
-    "rev": "v0.67.0",
+    "rev": "v0.68.1",
     "spdx": "MIT",
     "vendorHash": "sha256-ZNkZ2GMSBZHz+L626VqT7pTeb8fSYkaCi84O5ggd1FM="
   },
@@ -1106,11 +1106,11 @@
     "vendorHash": "sha256-GNSKSlaFBj2P+z40U+0uwPSOuQBy+9vOVFfPe8p0A24="
   },
   "tencentcloud": {
-    "hash": "sha256-evdKIbPPaHMFOYb77vogr3h8n34fcJf0sJVw5GjaHc8=",
+    "hash": "sha256-BflyXfxfth9wjPCd8aW9maemjjHTzuL8KvxQsvRUKLw=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.81.11",
+    "rev": "v1.81.12",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/station/default.nix

@@ -20,7 +20,7 @@ in appimageTools.wrapType2 rec {
     export LC_ALL=C.UTF-8
   '';
 
-  multiPkgs = null;
+  multiArch = false;
   extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
   extraInstallCommands = ''
     mv $out/bin/{${name},${pname}}

pkgs/applications/office/tusk/default.nix

@@ -31,7 +31,7 @@ in appimageTools.wrapType2 rec {
     export LC_ALL=C.UTF-8
   '';
 
-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
   extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
   extraInstallCommands = ''
     mv $out/bin/{${pname}-${version},${pname}}

pkgs/applications/video/kodi/addons/urllib3/default.nix

@@ -3,11 +3,11 @@
 buildKodiAddon rec {
   pname = "urllib3";
   namespace = "script.module.urllib3";
-  version = "1.26.13+matrix.1";
+  version = "1.26.16+matrix.1";
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/nexus/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-pymhHS1TqRv9o/3zBtmP8QSLMXSgFYno0VaR+YqhJqY=";
+    sha256 = "sha256-HI99Cle/SpwulbDCVoDNy/0EfHVt4q7+LR60YRMaSFY=";
   };
 
   passthru = {

pkgs/applications/window-managers/sway/fx.nix

@@ -2,13 +2,13 @@
 
 sway-unwrapped.overrideAttrs (oldAttrs: rec {
   pname = "swayfx";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "WillPower3309";
     repo = "swayfx";
     rev = version;
-    sha256 = "sha256-Ox+ror8sCc4mFOqZ1H9782hWbkTSUs5IVYEubHuyoJQ=";
+    sha256 = "sha256-Gwewb0yDVhEBrefSSGDf1hLtpWcntzifPCPJQhqLqI0=";
   };
 
   # This patch was backported into SwayFX

pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix

@@ -12,6 +12,7 @@
 , profile ? ""
 , targetPkgs ? pkgs: []
 , multiPkgs ? pkgs: []
+, multiArch ? false # Whether to include 32bit packages
 , extraBuildCommands ? ""
 , extraBuildCommandsMulti ? ""
 , extraOutputsToInstall ? []
@@ -35,8 +36,8 @@
 let
   inherit (stdenv) is64bit;
 
-  # use of glibc_multi is only supported on x86_64-linux
+  # "use of glibc_multi is only supported on x86_64-linux"
-  isMultiBuild  = multiPkgs != null && stdenv.isx86_64 && stdenv.isLinux;
+  isMultiBuild = multiArch && stdenv.system == "x86_64-linux";
   isTargetBuild = !isMultiBuild;
 
   # list of packages (usually programs) which are only be installed for the
@@ -51,21 +52,34 @@ let
   # these match the host's architecture, glibc_multi is used for multilib
   # builds. glibcLocales must be before glibc or glibc_multi as otherwiese
   # the wrong LOCALE_ARCHIVE will be used where only C.UTF-8 is available.
-  basePkgs = with pkgs;
+  basePkgs = with pkgs; [
-    [ glibcLocales
+    glibcLocales
-      (if isMultiBuild then glibc_multi else glibc)
+    (if isMultiBuild then glibc_multi else glibc)
-      (toString gcc.cc.lib) bashInteractiveFHS coreutils less shadow su
+    (toString gcc.cc.lib)
-      gawk diffutils findutils gnused gnugrep
+    bashInteractiveFHS
-      gnutar gzip bzip2 xz
+    coreutils
-    ];
+    less
-  baseMultiPkgs = with pkgsi686Linux;
+    shadow
-    [ (toString gcc.cc.lib)
+    su
-    ];
+    gawk
+    diffutils
+    findutils
+    gnused
+    gnugrep
+    gnutar
+    gzip
+    bzip2
+    xz
+  ];
+  baseMultiPkgs = with pkgsi686Linux; [
+    (toString gcc.cc.lib)
+  ];
 
   ldconfig = writeShellScriptBin "ldconfig" ''
     # due to a glibc bug, 64-bit ldconfig complains about patchelf'd 32-bit libraries, so we're using 32-bit ldconfig
-    exec ${if stdenv.isx86_64 && stdenv.isLinux then pkgsi686Linux.glibc.bin else pkgs.glibc.bin}/bin/ldconfig -f /etc/ld.so.conf -C /etc/ld.so.cache "$@"
+    exec ${if stdenv.system == "x86_64-linux" then pkgsi686Linux.glibc.bin else pkgs.glibc.bin}/bin/ldconfig -f /etc/ld.so.conf -C /etc/ld.so.cache "$@"
   '';
+
   etcProfile = writeText "profile" ''
     export PS1='${name}-chrootenv:\u@\h:\w\$ '
     export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
@@ -104,7 +118,7 @@ let
   # Compose /etc for the chroot environment
   etcPkg = runCommandLocal "${name}-chrootenv-etc" { } ''
     mkdir -p $out/etc
-    cd $out/etc
+    pushd $out/etc
 
     # environment variables
     ln -s ${etcProfile} profile
@@ -172,13 +186,18 @@ let
     ln -s lib64 lib
 
     # copy glibc stuff
-    cp -rsHf ${staticUsrProfileTarget}/lib/32/* lib32/ && chmod u+w -R lib32/
+    cp -rsHf ${staticUsrProfileTarget}/lib/32/* lib32/
+    chmod u+w -R lib32/
 
     # copy content of multiPaths (32bit libs)
-    [ -d ${staticUsrProfileMulti}/lib ] && cp -rsHf ${staticUsrProfileMulti}/lib/* lib32/ && chmod u+w -R lib32/
+    if [ -d ${staticUsrProfileMulti}/lib ]; then
+      cp -rsHf ${staticUsrProfileMulti}/lib/* lib32/
+      chmod u+w -R lib32/
+    fi
 
     # copy content of targetPaths (64bit libs)
-    cp -rsHf ${staticUsrProfileTarget}/lib/* lib64/ && chmod u+w -R lib64/
+    cp -rsHf ${staticUsrProfileTarget}/lib/* lib64/
+    chmod u+w -R lib64/
 
     # symlink 32-bit ld-linux.so
     ln -Ls ${staticUsrProfileTarget}/lib/32/ld-linux.so.2 lib/
@@ -191,13 +210,15 @@ let
   # the target profile is the actual profile that will be used for the chroot
   setupTargetProfile = ''
     mkdir -m0755 usr
-    cd usr
+    pushd usr
+
     ${setupLibDirs}
-    ${lib.optionalString isMultiBuild ''
+
+    '' + lib.optionalString isMultiBuild ''
     if [ -d "${staticUsrProfileMulti}/share" ]; then
       cp -rLf ${staticUsrProfileMulti}/share share
     fi
-    ''}
+    '' + ''
     if [ -d "${staticUsrProfileTarget}/share" ]; then
       if [ -d share ]; then
         chmod -R 755 share
@@ -223,18 +244,19 @@ let
         ln -s "$i"
       fi
     done
+
+    popd
   '';
 
 in runCommandLocal "${name}-fhs" {
   passthru = {
-    inherit args multiPaths targetPaths;
+    inherit args multiPaths targetPaths ldconfig;
   };
 } ''
   mkdir -p $out
-  cd $out
+  pushd $out
+
   ${setupTargetProfile}
-  cd $out
   ${extraBuildCommands}
-  cd $out
   ${lib.optionalString isMultiBuild extraBuildCommandsMulti}
 ''

pkgs/build-support/node/build-npm-package/default.nix

@@ -22,7 +22,7 @@
 , npmBuildScript ? "build"
   # Flags to pass to all npm commands.
 , npmFlags ? [ ]
-  # Flags to pass to `npm ci` and `npm prune`.
+  # Flags to pass to `npm ci`.
 , npmInstallFlags ? [ ]
   # Flags to pass to `npm rebuild`.
 , npmRebuildFlags ? [ ]
@@ -30,6 +30,10 @@
 , npmBuildFlags ? [ ]
   # Flags to pass to `npm pack`.
 , npmPackFlags ? [ ]
+  # Flags to pass to `npm prune`.
+, npmPruneFlags ? npmInstallFlags
+  # Value for npm `--workspace` flag and directory in which the files to be installed are found.
+, npmWorkspace ? null
 , ...
 } @ args:
 

pkgs/build-support/node/build-npm-package/hooks/npm-build-hook.sh

@@ -14,7 +14,7 @@ npmBuildHook() {
         exit 1
     fi
 
-    if ! npm run "$npmBuildScript" $npmBuildFlags "${npmBuildFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"; then
+    if ! npm run ${npmWorkspace+--workspace=$npmWorkspace} "$npmBuildScript" $npmBuildFlags "${npmBuildFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"; then
         echo
         echo 'ERROR: `npm build` failed'
         echo

pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh

@@ -13,8 +13,8 @@ npmInstallHook() {
     while IFS= read -r file; do
         local dest="$packageOut/$(dirname "$file")"
         mkdir -p "$dest"
-        cp "$file" "$dest"
+        cp "${npmWorkspace-.}/$file" "$dest"
-    done < <(@jq@ --raw-output '.[0].files | map(.path) | join("\n")' <<< "$(npm pack --json --dry-run $npmPackFlags "${npmPackFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}")")
+    done < <(@jq@ --raw-output '.[0].files | map(.path) | join("\n")' <<< "$(npm pack --json --dry-run ${npmWorkspace+--workspace=$npmWorkspace} $npmPackFlags "${npmPackFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}")")
 
     while IFS=" " read -ra bin; do
         mkdir -p "$out/bin"
@@ -22,13 +22,13 @@ npmInstallHook() {
     done < <(@jq@ --raw-output '(.bin | type) as $typ | if $typ == "string" then
         .name + " " + .bin
         elif $typ == "object" then .bin | to_entries | map(.key + " " + .value) | join("\n")
-        else "invalid type " + $typ | halt_error end' package.json)
+        else "invalid type " + $typ | halt_error end' "${npmWorkspace-.}/package.json")
 
     local -r nodeModulesPath="$packageOut/node_modules"
 
     if [ ! -d "$nodeModulesPath" ]; then
         if [ -z "${dontNpmPrune-}" ]; then
-            npm prune --omit dev --no-save $npmInstallFlags "${npmInstallFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"
+            npm prune --omit=dev --no-save ${npmWorkspace+--workspace=$npmWorkspace} $npmPruneFlags "${npmPruneFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"
         fi
 
         find node_modules -maxdepth 1 -type d -empty -delete

pkgs/development/embedded/arduino/arduino-core/chrootenv.nix

@@ -14,7 +14,7 @@ buildFHSEnv {
         pyserial
       ]))
     ]);
-  multiPkgs = null;
+  multiArch = false;
 
   extraInstallCommands = ''
     ${lib.optionalString withGui ''

pkgs/development/libraries/libamqpcpp/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libamqpcpp";
-  version = "4.3.25";
+  version = "4.3.26";
 
   src = fetchFromGitHub {
     owner = "CopernicaMarketingSoftware";
     repo = "AMQP-CPP";
     rev = "v${version}";
-    sha256 = "sha256-9nqp7VM5korICwzZF0XTlC4uKwjSY5MoILVJBzKulPk=";
+    sha256 = "sha256-lHkYoppJ/wo6RRE6V4iN6JXz5OoErJUl4IyrwiCB9FM=";
   };
 
   buildInputs = [ openssl ];

pkgs/development/php-packages/inotify/default.nix

@@ -1,6 +1,5 @@
 { buildPecl
 , lib
-, stdenv
 }:
 
 buildPecl {
@@ -11,11 +10,11 @@ buildPecl {
 
   doCheck = true;
 
-  meta = with lib; {
+  meta = {
-    broken = stdenv.isDarwin; # no inotify support
     description = "Inotify bindings for PHP";
-    license = licenses.php301;
     homepage = "https://github.com/arnaud-lb/php-inotify";
-    maintainers = teams.php.members;
+    license = lib.licenses.php301;
+    maintainers = lib.teams.php.members;
+    platforms = lib.platforms.linux;
   };
 }

pkgs/development/python-modules/apprise/default.nix

@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "apprise";
-  version = "1.4.0";
+  version = "1.4.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4xUFNIVNrFPU8Hg42Mv7Is4NRdQuugX5bWbE9IQ81Vo=";
+    hash = "sha256-t8ZlE8VFZpCimO2IfJAW3tQvFeNl0WFC5yi3T3z/7oI=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/bids-validator/default.nix

@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "bids-validator";
-  version = "1.11.0";
+  version = "1.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QIxWdIt8+Yz3wxgi8zqNicXm59tSVMNFEH6NUnV2/1M=";
+    hash = "sha256-X569N5zfbTg+mDwQU5iGv16kiOTr8rwhKTEl9RCJMRY=";
   };
 
   # needs packages which are not available in nixpkgs

pkgs/development/python-modules/casbin/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "casbin";
-  version = "1.19.0";
+  version = "1.20.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "pycasbin";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lIVZhWtGWJutmHgReT4k4G5hJZuD52AaJhwmwTmqHIY=";
+    hash = "sha256-hvnOVyXaC74pMlERZQQlrk5keyWAvE/UONwErJ7RA5c=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/faraday-plugins/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "faraday-plugins";
-  version = "1.12.0";
+  version = "1.12.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "infobyte";
     repo = "faraday_plugins";
     rev = "refs/tags/${version}";
-    hash = "sha256-dtSGNLQUG4Co+p/sPBgKxMhB7drZAMxUas+eH6g/cS8=";
+    hash = "sha256-sDHqBGRJQuAj2zB7hcIy3u5iNCxBHO1ub0eHxfgd7kI=";
   };
 
   postPatch = ''

pkgs/development/python-modules/hahomematic/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2023.6.1";
+  version = "2023.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-67zl530tvA7h4bpC9qasVsvjzoN9fxtPO9TZmxvABlc=";
+    hash = "sha256-5J/arrr8ymODSqtATJZuKsuOsCDKV9P2v8vN6D22FuE=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pontos/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pontos";
-  version = "23.7.2";
+  version = "23.7.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-wdnYHpIrSGEOBC1mw8aHXCcSney0IDc1MKSFsbGNjq0=";
+    hash = "sha256-DYlJ/xI/V+T/Am4SASVg/L7/uTAeUVM63aqxyMG6o+4=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/python-barcode/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "python-barcode";
-  version = "0.14.0";
+  version = "0.15.1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JBs0qlxctqmImIL5QJsBgpA6LF0ZtCGL42Cc271f/fk=";
+    hash = "sha256-Oxgl+9sR5ZdGbf9ChrTqmx6GpXcXtZ5WOuZ5cm/IVN4=";
   };
 
   propagatedBuildInputs = [
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Create standard barcodes with Python";
     homepage = "https://github.com/WhyNotHugo/python-barcode";
+    changelog = "https://github.com/WhyNotHugo/python-barcode/blob/v${version}/docs/changelog.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ wolfangaukang ];
   };

pkgs/development/python-modules/rpds-py/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "rpds-py";
-  version = "0.7.1";
+  version = "0.8.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,13 +18,13 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "rpds_py";
     inherit version;
-    hash = "sha256-2UC1ZE8U5JscbnkCueyKDHWEEJ+/OA+hgRWDGmQZJ8g=";
+    hash = "sha256-MAuFeXQLBuJGI4tzDmNvMUp9jcR1vhhoZQ9dPdwpoNg=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-BAoE0oRQGf5ze/8uAH6gsFP77lPvOvYy8W9iDrqUn3Q=";
+    hash = "sha256-jg9oos4wqewIHe31c3DixIp6fssk742kqt4taWyOq4U=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/sensor-state-data/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "sensor-state-data";
-  version = "2.16.0";
+  version = "2.16.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-GJmeAhakNCocSR/HtUsSiNsrFdFmUK6eI5U2mHXD/5c=";
+    hash = "sha256-J3QX4utnr64xNMt81kwGX6VJlDz6qe5oz+sjH5JATZQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/sunweg/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "sunweg";
-  version = "1.0.0";
+  version = "2.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "rokam";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-fGaPn4pp1nDL4MX7K8zP2Vq2R/uRtd8rHSaWEG5Ye7s=";
+    hash = "sha256-S92PybN+pReI9WtJr9as95uceicsSMadMQfh9JxsE8U=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/database/beekeeper-studio/default.nix

@@ -18,7 +18,7 @@ in
 appimageTools.wrapType2 {
   inherit name src;
 
-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
   extraPkgs = pkgs: appimageTools.defaultFhsEnvArgs.multiPkgs pkgs ++ [ pkgs.bash ];
 
   extraInstallCommands = ''

pkgs/development/tools/faas-cli/default.nix

@@ -18,13 +18,13 @@ let
 in
 buildGoModule rec {
   pname = "faas-cli";
-  version = "0.16.7";
+  version = "0.16.11";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = version;
-    sha256 = "sha256-VI7whlEekFalORlRTX/CEelm2zNi/QTqVgU/XkF3K48=";
+    sha256 = "sha256-B418oQpwB1yhsWRo58TGc2PonTlx3Lrcx1pJrbdJ2KM=";
   };
 
   vendorHash = null;

pkgs/development/tools/fastgron/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastgron";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "adamritter";
     repo = "fastgron";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SqJdJnepfX/qHiACjpaTNM+/lApcADCCbcX+BNgXswg=";
+    hash = "sha256-614edimiz+n8Gwr4vYq7PvQmceItfQL2Gt4cYgsxISc=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/tools/jet/default.nix

@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "jet";
-  version = "0.5.25";
+  version = "0.6.26";
 
   src = fetchurl {
     url = "https://github.com/borkdude/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-4uXK9MRBXLjfHDNl6KJY1n9b02uXg+BlIr/q1DGeRKU=";
+    sha256 = "sha256-zlSIIZ0YV6ussgAylz8QGmKBi8MwIIMzmloIf4bHvHU=";
   };
 
   extraNativeImageBuildArgs = [

pkgs/development/tools/language-servers/lua-language-server/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lua-language-server";
-  version = "3.6.22";
+  version = "3.6.23";
 
   src = fetchFromGitHub {
     owner = "luals";
     repo = "lua-language-server";
     rev = version;
-    sha256 = "sha256-0A5bbWoZtfL6NLG9nr8u4k1pLP1Fj/+A4ep2uN7x41o=";
+    sha256 = "sha256-tax4Pb99khAMDE6KH288Gihr8McpKg3DHBNVJnPnXbs=";
     fetchSubmodules = true;
   };
 

pkgs/development/tools/misc/spruce/default.nix

@@ -2,17 +2,16 @@
 
 buildGoModule rec {
   pname = "spruce";
-  version = "unstable-2022-02-10";
+  version = "1.30.2";
 
   src = fetchFromGitHub {
     owner = "geofffranks";
     repo = pname;
-    rev = "473931f33fceae90b3f5cfb7616c296343a9559b";
+    rev = "v${version}";
-    sha256 = "sha256-TFyWkoAKmj3KH2pqhVKMtP6QKTtu0s7H5gNP+fotUzg=";
+    hash = "sha256-flY81xiUfOyfdavhF0AyIwrB2G8N6BWltdGMT2uf9Co=";
   };
 
-  deleteVendor = true;
+  vendorHash = null;
-  vendorSha256 = "sha256-VeC5c/BgcxK3Qawb2QOhqtfTIgbQbrQj546zX6yPD+s=";
 
   meta = with lib; {
     description = "A BOSH template merge tool";

pkgs/development/tools/skopeo/default.nix

@@ -18,13 +18,13 @@
 
 buildGoModule rec {
   pname = "skopeo";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "containers";
     repo = "skopeo";
-    hash = "sha256-a4uM2WjDhjz4zTiM2HWoDHQQ9aT38HV9GNUJAJmZR+w=";
+    hash = "sha256-PSBwwF6tIQ6EZD/nWj5Lw0ifk1aLLJl/qaj5EsksBBo=";
   };
 
   outputs = [ "out" "man" ];

pkgs/development/web/bloomrpc/default.nix

@@ -21,7 +21,7 @@ appimageTools.wrapType2 {
     export LC_ALL=C.UTF-8
   '';
 
-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
   extraPkgs = pkgs: appimageTools.defaultFhsEnvArgs.multiPkgs pkgs ++ [ pkgs.bash ];
 
   extraInstallCommands = ''

pkgs/development/web/flyctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.1.43";
+  version = "0.1.51";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-mvB5TCPkRWDAkDd4PV50EKjtlaZSFqTl6IDMTnPDrng=";
+    hash = "sha256-5wokG37aP15VGRbH14kyVVH1VfKbbvMZrZl7gP0WbSE=";
   };
 
-  vendorHash = "sha256-2us72JBzLXaxJ6X6T/Hc2y4YVoAJ6YvJVJdO3KzsbkE=";
+  vendorHash = "sha256-7cwe0POozQeeabQQxtnJNWRmM5bWqmzVx/2TDPeoCx8=";
 
   subPackages = [ "." ];
 

pkgs/games/heroic/fhsenv.nix

@@ -9,6 +9,9 @@ buildFHSEnv {
 
   runScript = "heroic";
 
+  # Many Wine and native games need 32-bit libraries.
+  multiArch = true;
+
   targetPkgs = pkgs: with pkgs; [
     heroic-unwrapped
     gamemode

pkgs/games/steam/fhsenv.nix

@@ -61,6 +61,9 @@ let
 in buildFHSEnv rec {
   name = "steam";
 
+  # Steam still needs 32bit and various native games do too
+  multiArch = true;
+
   targetPkgs = pkgs: with pkgs; [
     steam
     # License agreement

pkgs/os-specific/linux/kernel/hardened/patches.json

@@ -2,71 +2,71 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.319-hardened1.patch",
+            "name": "linux-hardened-4.14.320-hardened1.patch",
-            "sha256": "1dz59az2k1lg5csx70p4nb634cv57b7ij554hkvln7bp6m9cm1ga",
+            "sha256": "1j457mfkxqzv996brwzxaib43s8fdpd5ngrnj61vs3vf8xcwk186",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.319-hardened1/linux-hardened-4.14.319-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.320-hardened1/linux-hardened-4.14.320-hardened1.patch"
         },
-        "sha256": "1y8zp9jkyid4g857nfm7xhsya3d9vx2dni8l7ishn2gl087pb95c",
+        "sha256": "09bn18jvazkc55bqdjbxy8fbca7vjhi9xl2h02w0sq3f1jf6g0pd",
-        "version": "4.14.319"
+        "version": "4.14.320"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.287-hardened1.patch",
+            "name": "linux-hardened-4.19.288-hardened1.patch",
-            "sha256": "1my4j6i549xw2zzbxnbaarby7584ysy4l1xgw3x8cc848l2m1iqp",
+            "sha256": "0iw70vp9m7ldq85jfycfaihq2974giwi1d9fdd1yrhljlwzf9y6p",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.287-hardened1/linux-hardened-4.19.287-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.288-hardened1/linux-hardened-4.19.288-hardened1.patch"
         },
-        "sha256": "0wracrahi4qm6klsd9bnlwwdcaqbclx2mqc5d7vbvxxzfn69nsi8",
+        "sha256": "1sz3jp6kx0axdwp0wsq903q1090rbav9d12m5128335m8p2d1srk",
-        "version": "4.19.287"
+        "version": "4.19.288"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.185-hardened1.patch",
+            "name": "linux-hardened-5.10.186-hardened1.patch",
-            "sha256": "05abqsbsr6mjj0yxwwwf2hwsxd3z3jj2wkj0frd1ygb06njkvpjz",
+            "sha256": "0k6f2sxk2gy601w0132i5glznhi35wbdpxkqsfgxlr2gi2w021wr",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.185-hardened1/linux-hardened-5.10.185-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.186-hardened1/linux-hardened-5.10.186-hardened1.patch"
         },
-        "sha256": "143hghmj4lxiyavndvdmwg5mig8s2i4ffrmd8zwqqwy8ipn641i8",
+        "sha256": "1qqv91r13akgik1q4jybf8czskxxizk6lpv4rsvjn9sx2dm2jq0y",
-        "version": "5.10.185"
+        "version": "5.10.186"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.118-hardened1.patch",
+            "name": "linux-hardened-5.15.120-hardened1.patch",
-            "sha256": "07knyxmb0j2bf117md2glyyqj892n4p4jq2ahd8s90fp0x8g6z9a",
+            "sha256": "0wqnwjww062ykh1y2yrbsy75b0fz8xlkazijgvj3rl14wvccf39x",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.118-hardened1/linux-hardened-5.15.118-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.120-hardened1/linux-hardened-5.15.120-hardened1.patch"
         },
-        "sha256": "1cxm7s19l2f38chxrlvx7crvqcygmc77rhsc3lfx3m84vgdg8ssf",
+        "sha256": "1xl3nrykbxdwv5a9rk0xnb7l61dsyjvkm1ryrdii09vbmsg0i6b4",
-        "version": "5.15.118"
+        "version": "5.15.120"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.248-hardened1.patch",
+            "name": "linux-hardened-5.4.249-hardened1.patch",
-            "sha256": "0zd1s6xxpv6j2hmm56x4pg9dxakrmkf29x3vv6pjq3hmcp8ihs4s",
+            "sha256": "11rwyr68wrhjl0cdkvbgcpxwz4bwx3hii9k6xmai7hpds6rb3nsx",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.248-hardened1/linux-hardened-5.4.248-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.249-hardened1/linux-hardened-5.4.249-hardened1.patch"
         },
-        "sha256": "0d9yn51rg59k39h0w6wmvjqz9n7najm9x8yb79rparbcwwrd3gis",
+        "sha256": "079mylc5j7hk5xn59q3z2xydyh88pq7yipn67x3y7nvf5i35hm6w",
-        "version": "5.4.248"
+        "version": "5.4.249"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.35-hardened1.patch",
+            "name": "linux-hardened-6.1.38-hardened1.patch",
-            "sha256": "0s9ld5dnzxyizm8bdv4dc8lh3yfqv45hd65k0sc4swlnb1k96dxb",
+            "sha256": "0sv8i26xwgw3a36yga79n36a5xbrs3ajn8wdkqn40ydbzp24i0qc",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.35-hardened1/linux-hardened-6.1.35-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.38-hardened1/linux-hardened-6.1.38-hardened1.patch"
         },
-        "sha256": "1b16pk0b45k1q53nzbwv6wh0aqn160b1kip8scywf3axpi1q2dmy",
+        "sha256": "0hrdh1w9z8bgy4cxqsxfkwa01yincfw1mq1bbwm36zczc0dzk97r",
-        "version": "6.1.35"
+        "version": "6.1.38"
     },
     "6.3": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.3.1-hardened1.patch",
+            "name": "linux-hardened-6.3.12-hardened1.patch",
-            "sha256": "0wlp6azlkj9xbkwxyari28ixini0jvw2dl653i7ns4l27p0gmayx",
+            "sha256": "12dqdn2prr0mczwcy48907wpp235n87pl22gwyfilsxcj94x2wrx",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.3.1-hardened1/linux-hardened-6.3.1-hardened1.patch"
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.3.12-hardened1/linux-hardened-6.3.12-hardened1.patch"
         },
-        "sha256": "0aizkgwdmdjrgab67yjfaqcmvfh7wb3b3mdq9qfxpq6mlys0yqkq",
+        "sha256": "1mvcirkhqnf03cci3jiq077fs9b42a3xdk3zjkpyim3x43ydwzyb",
-        "version": "6.3.1"
+        "version": "6.3.12"
     }
 }

pkgs/os-specific/linux/kernel/linux-5.15.nix

@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.119";
+  version = "5.15.120";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1kygpqf6sgkrwg77sv01di23c3n3rn5d44g8k5apx5106pys19bs";
+    sha256 = "1xl3nrykbxdwv5a9rk0xnb7l61dsyjvkm1ryrdii09vbmsg0i6b4";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-6.1.nix

@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.37";
+  version = "6.1.38";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    hash = "sha256-RsrXEtJhojyOSDo7ebaoS5pfcxqJIckSffNa41zvHoA=";
+    sha256 = "0hrdh1w9z8bgy4cxqsxfkwa01yincfw1mq1bbwm36zczc0dzk97r";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-6.3.nix

@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.3.11";
+  version = "6.3.12";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "sha256-HVo/vU1CZbbJYF1cYF2UdnPnZDryiQ5K1clGlA8SPhY=";
+    sha256 = "1mvcirkhqnf03cci3jiq077fs9b42a3xdk3zjkpyim3x43ydwzyb";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-6.4.nix

@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4.1";
+  version = "6.4.2";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "sha256-DZ2qnxwXb7E7lEf249gOgrSQQ/DTRMJHu/CbTmJb7vM=";
+    sha256 = "0b0623pvf9spb5biv1k4wzjbcj9fyf2svk69fdyb3ibn84ian9m3";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-rt-5.10.nix

@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.184-rt90"; # updated by ./update-rt.sh
+  version = "5.10.186-rt91"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0219qv9rxg4fi7w2s0s9y7ggral40wm2riis58hmg80z3nybxabp";
+    sha256 = "1qqv91r13akgik1q4jybf8czskxxizk6lpv4rsvjn9sx2dm2jq0y";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1cyxlc229j23yqgl65h3hgv51x76h1pppcn6ihicvc50vv7h5mjk";
+      sha256 = "1h5p0p3clq0gmaszvddmfll17adv02wfp2bfrd5x3aigvigwfmjb";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 

pkgs/os-specific/linux/kernel/linux-rt-5.15.nix

@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.15.113-rt64"; # updated by ./update-rt.sh
+  version = "5.15.119-rt65"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1jmrnd0ri75gl0k80g93zqyg00lbf1gqai3dga383ms92799hkja";
+    sha256 = "1kygpqf6sgkrwg77sv01di23c3n3rn5d44g8k5apx5106pys19bs";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0nxnviivsshs20zh8px657mr31wfsjdy70z793f56bf9s2m4kl31";
+      sha256 = "1lkr3l0gad30brdq7kdgvqr3zz4xrd7ai8jh94di6l5krhi7s1w0";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 

pkgs/os-specific/linux/kernel/linux-rt-5.4.nix

@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.4.242-rt81"; # updated by ./update-rt.sh
+  version = "5.4.248-rt83"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -14,14 +14,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0a7wfi84p74qsnbj1vamz4qxzp94v054jp1csyfl0blz3knrlbql";
+    sha256 = "0d9yn51rg59k39h0w6wmvjqz9n7najm9x8yb79rparbcwwrd3gis";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1wszhzw9ic018x3jiz8x1ffxxg30wpy4db7hja44b661p9fjm1dc";
+      sha256 = "1rr4vnynxwmlgnm5xq1m0xhykh72lkv2lsginbh5nk60k3qwizh2";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 

pkgs/os-specific/linux/kernel/patches.nix

@@ -66,12 +66,4 @@
       hash = "sha256-DYPWgraXPNeFkjtuDYkFXHnCJ4yDewrukM2CCAqC2BE=";
     };
   };
-
-  fix-amdgpu-5_15 = {
-    name = "fix-amdgpu-crash";
-    patch = fetchpatch {
-      url = "https://lore.kernel.org/stable/20230628111636.23300-1-mario.limonciello@amd.com/raw";
-      sha256 = "sha256-eAzy+bMiOJwzssOuvrMu7gmmV3PZezaDuVwwx7zNt6M=";
-    };
-  };
 }

pkgs/os-specific/linux/sd-switch/default.nix

@@ -1,17 +1,18 @@
-{ lib, fetchFromGitLab, rustPlatform, pkg-config, dbus }:
+{ lib, fetchFromSourcehut, rustPlatform, pkg-config, dbus }:
 
-rustPlatform.buildRustPackage rec {
+let version = "0.3.0";
+in rustPlatform.buildRustPackage {
   pname = "sd-switch";
-  version = "0.2.3";
+  inherit version;
 
-  src = fetchFromGitLab {
+  src = fetchFromSourcehut {
-    owner = "rycee";
+    owner = "~rycee";
-    repo = pname;
+    repo = "sd-switch";
     rev = version;
-    sha256 = "12h2d7v7pdz7b0hrna64561kf35nbpwb2kzxa791xk8raxc2b72k";
+    hash = "sha256-mWrLbCUnoJ3hVtpSU/7dw91U5TLyw5kNchX5nmP9asA=";
   };
 
-  cargoSha256 = "12ny3cir2nxzrmf4vwq6sgc35dbpq88hav53xqdp44rigdf4vzbs";
+  cargoHash = "sha256-VK+kPX1pGhowbWKkUs1PL0DXIhDXJOFVoIHTtWQcWEs=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus ];

pkgs/servers/mastodon/gemset.nix

@@ -2637,10 +2637,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ga8yzc9zj45m92ycwnzhzahkwvc3dp3lym5m3f3880hs4jhh7l3";
+      sha256 = "1kymrjdpbmn4yaml3aaqyj1dzj8gqmm9h030dc2rj5mvja7fpi28";
       type = "gem";
     };
-    version = "6.0.1";
+    version = "6.0.2";
   };
   scenic = {
     dependencies = ["activerecord" "railties"];

pkgs/servers/mastodon/source.nix

@@ -3,8 +3,8 @@
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
-    rev = "v4.1.3";
+    rev = "v4.1.4";
-    sha256 = "F+cpL+ZFfe52f82qtJxuxRCILW3zr6K5OMrvaOgWe58=";
+    sha256 = "8ULBO8IdwBzC5dgX3netTHbbRrODX4CropWZWtqWHZw=";
   };
 in applyPatches {
   inherit src;

pkgs/servers/mastodon/version.nix

@@ -1 +1 @@
-"4.1.3"
+"4.1.4"

pkgs/tools/admin/lxd/default.nix

@@ -29,6 +29,7 @@
 , installShellFiles
 , nixosTests
 , gitUpdater
+, callPackage
 }:
 
 buildGoModule rec {
@@ -99,6 +100,8 @@ buildGoModule rec {
 
   passthru.tests.lxd = nixosTests.lxd;
   passthru.tests.lxd-nftables = nixosTests.lxd-nftables;
+  passthru.tests.lxd-ui = nixosTests.lxd-ui;
+  passthru.ui = callPackage ./ui.nix { };
   passthru.updateScript = gitUpdater {
     url = "https://github.com/lxc/lxd.git";
     rev-prefix = "lxd-";

pkgs/tools/admin/lxd/package.json

@@ -0,0 +1,103 @@
+{
+  "name": "lxd-ui",
+  "version": "0.0.1",
+  "author": "Canonical Webteam",
+  "license": "LGPL-3.0-only",
+  "scripts": {
+    "clean": "rm -rf node_modules yarn-error.log *.log build/ .jekyll-metadata .bundle",
+    "build-html": "cp build/ui/index.html build/index.html",
+    "build": "npx vite build && yarn build-html",
+    "format-js-eslint": "eslint 'src/**/*.{json,jsx,tsx,ts}' 'tests/**/*.ts' --fix",
+    "format-js-prettier": "prettier 'src/**/*.{json,jsx,tsx,ts}' 'tests/**/*.ts' --write",
+    "format-js": "yarn format-js-eslint && yarn format-js-prettier",
+    "lint-scss": "stylelint 'src/**/*.scss'",
+    "lint-js-eslint": "eslint 'src/**/*.{json,tsx,ts}' 'tests/**/*.ts' .eslintrc.js babel.config.js",
+    "lint-js-prettier": "prettier 'src/**/*.{json,tsx,ts}' 'tests/**/*.ts' .eslintrc.js babel.config.js --check",
+    "lint-js": "yarn lint-js-eslint && yarn lint-js-prettier",
+    "hooks-add": "husky install",
+    "hooks-remove": "husky uninstall",
+    "start": "concurrently --kill-others --raw 'vite | grep -v localhost' 'yarn serve'",
+    "serve": "./entrypoint"
+  },
+  "dependencies": {
+    "@canonical/react-components": "0.42.0",
+    "@monaco-editor/react": "^4.4.6",
+    "@tanstack/react-query": "^4.14.5",
+    "@use-it/event-listener": "^0.1.7",
+    "cytoscape": "3.23.0",
+    "cytoscape-popper": "2.0.0",
+    "formik": "2.2.9",
+    "js-yaml": "4.1.0",
+    "lodash.isequal": "4.5.0",
+    "node-forge": "1.3.1",
+    "parse-prometheus-text-format": "1.1.1",
+    "react": "18.2.0",
+    "react-cytoscapejs": "2.0.0",
+    "react-dom": "18.2.0",
+    "react-router-dom": "6.6.1",
+    "react-scripts": "5.0.1",
+    "react-useportal": "^1.0.17",
+    "serve": "14.1.2",
+    "vanilla-framework": "3.15.1",
+    "xterm-addon-fit": "0.6.0",
+    "xterm-for-react": "1.0.4",
+    "yup": "0.32.11"
+  },
+  "devDependencies": {
+    "@babel/core": "7.20.7",
+    "@babel/eslint-parser": "7.19.1",
+    "@babel/preset-env": "7.20.2",
+    "@babel/preset-react": "7.18.6",
+    "@babel/preset-typescript": "7.18.6",
+    "@playwright/test": "^1.29.1",
+    "@types/cytoscape-popper": "2.0.0",
+    "@types/node-forge": "1.3.1",
+    "@types/react": "18.0.26",
+    "@types/react-cytoscapejs": "1.2.2",
+    "@types/react-dom": "18.0.10",
+    "@types/react-router-dom": "5.3.3",
+    "@types/websocket": "1.0.5",
+    "@typescript-eslint/eslint-plugin": "5.48.0",
+    "@typescript-eslint/parser": "5.48.0",
+    "@vitejs/plugin-react": "^3.1.0",
+    "autoprefixer": "10.4.13",
+    "babel-loader": "9.1.0",
+    "babel-plugin-transform-es2015-modules-commonjs": "6.26.2",
+    "concurrently": "7.6.0",
+    "css-loader": "6.7.3",
+    "eslint": "8.31.0",
+    "eslint-config-prettier": "8.6.0",
+    "eslint-plugin-prettier": "4.2.1",
+    "eslint-plugin-react": "7.31.11",
+    "husky": "8.0.0",
+    "lint-staged": "13.1.1",
+    "monaco-editor": "0.36.1",
+    "postcss": "8.4.20",
+    "postcss-cli": "10.1.0",
+    "prettier": "2.8.1",
+    "sass": "1.57.1",
+    "sass-loader": "13.2.0",
+    "style-loader": "3.3.1",
+    "stylelint": "14.16.1",
+    "stylelint-config-prettier": "9.0.4",
+    "stylelint-config-standard-scss": "6.1.0",
+    "stylelint-order": "5.0.0",
+    "stylelint-prettier": "2.0.0",
+    "stylelint-scss": "4.3.0",
+    "ts-loader": "9.4.2",
+    "typescript": "4.9.4",
+    "vite": "^4.1.0",
+    "vite-tsconfig-paths": "4.0.5"
+  },
+  "lint-staged": {
+    "src/**/*.{json,jsx,ts,tsx}": [
+      "eslint",
+      "prettier --check"
+    ],
+    "tests/**/*.{json,jsx,ts,tsx}": [
+      "eslint",
+      "prettier --check"
+    ],
+    "src/**/*.scss": "stylelint"
+  }
+}

pkgs/tools/admin/lxd/ui.nix

@@ -0,0 +1,42 @@
+{ mkYarnPackage
+, fetchFromGitHub
+, fetchYarnDeps
+, lib
+}:
+
+mkYarnPackage rec {
+  pname = "lxd-ui";
+  version = "unstable-2023-07-03";
+
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "lxd-ui";
+    rev = "c2e819a027d440cbb1cb9d450aad280dde68e231";
+    sha256 = "sha256-lEzGACSv6CpxnfkOcsdPrH6KRKDkoKv63m8Gsodk8uc=";
+  };
+
+  packageJSON = ./package.json;
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${src}/yarn.lock";
+    sha256 = "sha256-SLkgJDb9lwz/ShZh+H4YKAFRc1BdANWI5ndM2O6NzXE=";
+  };
+
+  buildPhase = ''
+    yarn --offline build
+  '';
+
+  installPhase = ''
+    cp -rv deps/lxd-ui/build/ui/ $out
+  '';
+
+  doDist = false;
+
+  meta = {
+    description = "Web user interface for LXD.";
+    homepage = "https://linuxcontainers.org/lxd/";
+    changelog = "https://github.com/canonical/lxd-ui";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/tools/misc/flexoptix-app/default.nix

@@ -28,7 +28,7 @@ in appimageTools.wrapAppImage {
   inherit pname version;
   src = appimageContents;
 
-  multiPkgs = null; # no 32bit needed
+  multiArch = false; # no 32bit needed
   extraPkgs = { pkgs, ... }@args: [
     pkgs.hidapi
   ] ++ appimageTools.defaultFhsEnvArgs.multiPkgs args;

pkgs/tools/misc/goreleaser/default.nix

@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "goreleaser";
-  version = "1.19.0";
+  version = "1.19.2";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vK/rvI7RTT4gb80G8wG1lA+WlKLWEBG74OetsHBUIhM=";
+    sha256 = "sha256-T8mLbEJ0fGm+rxwFVHziQyq+JcXC0OrThwyDPxcPHB0=";
   };
 
-  vendorHash = "sha256-56aE/Rd5l0kgEJ79EQbF/6xoKbNvEcp/l67gikhff4Y=";
+  vendorHash = "sha256-2m81ELHWbF9WKEMXmr5E8QReClWdVhPRJ+ZstrM6qY0=";
 
   ldflags =
     [ "-s" "-w" "-X main.version=${version}" "-X main.builtBy=nixpkgs" ];

pkgs/tools/misc/grub/add-hidden-menu-entries.patch

@@ -0,0 +1,204 @@
+diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c
+index e9e9d94ef..54e08a1b4 100644
+--- a/grub-core/commands/legacycfg.c
++++ b/grub-core/commands/legacycfg.c
+@@ -143,7 +143,7 @@ legacy_file (const char *filename)
+ 	    args[0] = oldname;
+ 	    grub_normal_add_menu_entry (1, args, NULL, NULL, "legacy",
+ 					NULL, NULL,
+-					entrysrc, 0);
++					entrysrc, 0, 0);
+ 	    grub_free (args);
+ 	    entrysrc[0] = 0;
+ 	    grub_free (oldname);
+@@ -205,7 +205,7 @@ legacy_file (const char *filename)
+ 	}
+       args[0] = entryname;
+       grub_normal_add_menu_entry (1, args, NULL, NULL, NULL,
+-				  NULL, NULL, entrysrc, 0);
++				  NULL, NULL, entrysrc, 0, 0);
+       grub_free (args);
+     }
+ 
+diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
+index 720e6d8ea..50632ccce 100644
+--- a/grub-core/commands/menuentry.c
++++ b/grub-core/commands/menuentry.c
+@@ -78,7 +78,7 @@ grub_normal_add_menu_entry (int argc, const char **args,
+ 			    char **classes, const char *id,
+ 			    const char *users, const char *hotkey,
+ 			    const char *prefix, const char *sourcecode,
+-			    int submenu)
++			    int submenu, int hidden)
+ {
+   int menu_hotkey = 0;
+   char **menu_args = NULL;
+@@ -188,8 +188,11 @@ grub_normal_add_menu_entry (int argc, const char **args,
+   (*last)->args = menu_args;
+   (*last)->sourcecode = menu_sourcecode;
+   (*last)->submenu = submenu;
++  (*last)->hidden = hidden;
++
++  if (!hidden)
++    menu->size++;
+ 
+-  menu->size++;
+   return GRUB_ERR_NONE;
+ 
+  fail:
+@@ -286,7 +289,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+ 				       users,
+ 				       ctxt->state[2].arg, 0,
+ 				       ctxt->state[3].arg,
+-				       ctxt->extcmd->cmd->name[0] == 's');
++				       ctxt->extcmd->cmd->name[0] == 's',
++               ctxt->extcmd->cmd->name[0] == 'h');
+ 
+   src = args[argc - 1];
+   args[argc - 1] = NULL;
+@@ -303,7 +307,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+ 				  ctxt->state[0].args, ctxt->state[4].arg,
+ 				  users,
+ 				  ctxt->state[2].arg, prefix, src + 1,
+-				  ctxt->extcmd->cmd->name[0] == 's');
++				  ctxt->extcmd->cmd->name[0] == 's',
++          ctxt->extcmd->cmd->name[0] == 'h');
+ 
+   src[len - 1] = ch;
+   args[argc - 1] = src;
+@@ -311,7 +316,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+   return r;
+ }
+ 
+-static grub_extcmd_t cmd, cmd_sub;
++static grub_extcmd_t cmd, cmd_sub, cmd_hidden;
+ 
+ void
+ grub_menu_init (void)
+@@ -327,6 +332,12 @@ grub_menu_init (void)
+ 				  | GRUB_COMMAND_FLAG_EXTRACTOR,
+ 				  N_("BLOCK"), N_("Define a submenu."),
+ 				  options);
++  cmd_hidden = grub_register_extcmd ("hiddenentry", grub_cmd_menuentry,
++                  GRUB_COMMAND_FLAG_BLOCKS
++                  | GRUB_COMMAND_ACCEPT_DASH
++                  | GRUB_COMMAND_FLAG_EXTRACTOR,
++                  N_("BLOCK"), N_("Define a hidden menu entry."),
++                  options);
+ }
+ 
+ void
+diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c
+index 6a90e091f..4236f55bc 100644
+--- a/grub-core/normal/menu.c
++++ b/grub-core/normal/menu.c
+@@ -37,6 +37,8 @@
+    entry failing to boot.  */
+ #define DEFAULT_ENTRY_ERROR_DELAY_MS  2500
+ 
++#define MENU_INCLUDE_HIDDEN 0x10000
++
+ grub_err_t (*grub_gfxmenu_try_hook) (int entry, grub_menu_t menu,
+ 				     int nested) = NULL;
+ 
+@@ -80,8 +82,20 @@ grub_menu_get_entry (grub_menu_t menu, int no)
+ {
+   grub_menu_entry_t e;
+ 
+-  for (e = menu->entry_list; e && no > 0; e = e->next, no--)
+-    ;
++  if (no & MENU_INCLUDE_HIDDEN) {
++    no &= ~MENU_INCLUDE_HIDDEN;
++
++    for (e = menu->entry_list; e && no > 0; e = e->next, no--)
++      ;
++  } else {
++    for (e = menu->entry_list; e && no > 0; e = e->next, no--) {
++      /* Skip hidden entries */
++      while (e && e->hidden)
++        e = e->next;
++    }
++    while (e && e->hidden)
++      e = e->next;
++  }
+ 
+   return e;
+ }
+@@ -93,10 +107,10 @@ get_entry_index_by_hotkey (grub_menu_t menu, int hotkey)
+   grub_menu_entry_t entry;
+   int i;
+ 
+-  for (i = 0, entry = menu->entry_list; i < menu->size;
++  for (i = 0, entry = menu->entry_list; entry;
+        i++, entry = entry->next)
+     if (entry->hotkey == hotkey)
+-      return i;
++      return i | MENU_INCLUDE_HIDDEN;
+ 
+   return -1;
+ }
+@@ -509,6 +523,10 @@ get_entry_number (grub_menu_t menu, const char *name)
+       grub_menu_entry_t e = menu->entry_list;
+       int i;
+ 
++       /* Skip hidden entries */
++      while (e && e->hidden)
++        e = e->next;
++
+       grub_errno = GRUB_ERR_NONE;
+ 
+       for (i = 0; e; i++)
+@@ -520,6 +538,10 @@ get_entry_number (grub_menu_t menu, const char *name)
+ 	      break;
+ 	    }
+ 	  e = e->next;
++
++    /* Skip hidden entries */
++    while (e && e->hidden)
++      e = e->next;
+ 	}
+ 
+       if (! e)
+diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
+index b1321eb26..d2e46cac8 100644
+--- a/grub-core/normal/menu_text.c
++++ b/grub-core/normal/menu_text.c
+@@ -289,7 +289,11 @@ print_entries (grub_menu_t menu, const struct menu_viewer_data *data)
+       print_entry (data->geo.first_entry_y + i, data->offset == i,
+ 		   e, data);
+       if (e)
+-	e = e->next;
++	      e = e->next;
++
++      /* Skip hidden entries */
++      while (e && e->hidden)
++        e = e->next;
+     }
+ 
+   grub_term_gotoxy (data->term,
+diff --git a/include/grub/menu.h b/include/grub/menu.h
+index ee2b5e910..eb8a86ba9 100644
+--- a/include/grub/menu.h
++++ b/include/grub/menu.h
+@@ -58,6 +58,8 @@ struct grub_menu_entry
+ 
+   int submenu;
+ 
++  int hidden;
++
+   /* The next element.  */
+   struct grub_menu_entry *next;
+ };
+diff --git a/include/grub/normal.h b/include/grub/normal.h
+index 218cbabcc..bcb412466 100644
+--- a/include/grub/normal.h
++++ b/include/grub/normal.h
+@@ -145,7 +145,7 @@ grub_normal_add_menu_entry (int argc, const char **args, char **classes,
+ 			    const char *id,
+ 			    const char *users, const char *hotkey,
+ 			    const char *prefix, const char *sourcecode,
+-			    int submenu);
++			    int submenu, int hidden);
+ 
+ grub_err_t
+ grub_normal_set_password (const char *user, const char *password);

pkgs/tools/misc/grub/default.nix

@@ -1,8 +1,6 @@
-{ lib, stdenv, fetchurl, flex, bison, python3, autoreconfHook, gnulib, libtool, bash
+{ lib, stdenv, runCommand, fetchFromSavannah, flex, bison, python3, autoconf, automake, libtool, bash
-, gettext, ncurses, libusb-compat-0_1, freetype, qemu, lvm2, unifont, pkg-config
+, rsync, gettext, ncurses, libusb-compat-0_1, freetype, qemu, lvm2, unifont, pkg-config
 , buildPackages
-, fetchpatch
-, pkgsBuildBuild
 , nixosTests
 , fuse # only needed for grub-mount
 , runtimeShell
@@ -42,8 +40,35 @@ let
   canEfi = lib.any (system: stdenv.hostPlatform.system == system) (lib.mapAttrsToList (name: _: name) efiSystemsBuild);
   inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.mapAttrsToList (name: _: name) pcSystems);
 
-  version = "2.06";
+  gnulib = fetchFromSavannah {
+    repo = "gnulib";
+    # NOTE: keep in sync with bootstrap.conf!
+    rev = "9f48fb992a3d7e96610c4ce8be969cff2d61a01b";
+    hash = "sha256-mzbF66SNqcSlI+xmjpKpNMwzi13yEWoc1Fl7p4snTto=";
+  };
 
+  src = fetchFromSavannah {
+    repo = "grub";
+    rev = "6425c12cd77ad51ad24be84c092aefacf0875089";
+    hash = "sha256-PSCa993Reph6w9+leE4a/9E6vIALdOqU3FZEPwasFyk=";
+  };
+
+  # HACK: the translations are stored on a different server,
+  # not versioned and not included in the git repo, so fetch them
+  # and hope they don't change often
+  locales = runCommand "grub-locales" {
+    nativeBuildInputs = [rsync];
+
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    outputHash = "sha256-bQPQ65gAcuUQ8ELB2hKywuXZ0kdC2bBCsUII/b4FkvQ=";
+  }
+  ''
+    mkdir -p po
+    ${src}/linguas.sh
+
+    mv po $out
+  '';
 in (
 
 assert efiSupport -> canEfi;
@@ -52,301 +77,12 @@ assert !(efiSupport && xenSupport);
 
 stdenv.mkDerivation rec {
   pname = "grub";
-  inherit version;
+  version = "unstable-2023-07-03";
-
+  inherit src;
-  src = fetchurl {
-    url = "mirror://gnu/grub/grub-${version}.tar.xz";
-    sha256 = "sha256-t56kSvkbk9F80/6Ava5u1DdwZ4qaWuGSzOqAPrtlfuE=";
-  };
 
   patches = [
     ./fix-bash-completion.patch
-    (fetchpatch {
+    ./add-hidden-menu-entries.patch
-      name = "Add-hidden-menu-entries.patch";
-      # https://lists.gnu.org/archive/html/grub-devel/2016-04/msg00089.html
-      url = "https://marc.info/?l=grub-devel&m=146193404929072&q=mbox";
-      sha256 = "00wa1q5adiass6i0x7p98vynj9vsz1w0gn1g4dgz89v35mpyw2bi";
-    })
-
-    # Pull upstream patch to fix linkage against binutils-2.36.
-    (fetchpatch {
-      name = "binutils-2.36.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b98275138bf4fc250a1c362dfd2c8b1cf2421701";
-      sha256 = "001m058bsl2pcb0ii84jfm5ias8zgzabrfy6k2cc9w6w1y51ii82";
-    })
-    # Properly handle multiple initrd paths in 30_os-prober
-    # Remove this patch once a new release is cut
-    (fetchpatch {
-      name = "Properly-handle-multiple-initrd-paths-in-os-prober.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=000b5cd04fd228f9741f5dca0491636bc0b89eb8";
-      sha256 = "sha256-Mex3qQ0lW7ZCv7ZI7MSSqbylJXZ5RTbR4Pv1+CJ0ciM=";
-    })
-
-    # Upstreamed patches for flicker-free boot
-    # Remove these patches once a new release is cut
-    (fetchpatch {
-      # term/efi/console: Do not set colorstate until the first text output
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9381dbe045b39bd9395c9ab4276d95b4041ec9fb";
-      sha256 = "sha256-ZFq/PdCYo6aRySZRAfZARO8BmXwGgqeXz+9uNgNJEO8=";
-    })
-    (fetchpatch {
-      # term/efi/console: Do not set cursor until the first text output
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7c316e18301e101e4dcd8abe88c0bed0b1b78857";
-      sha256 = "sha256-WJiK7MqmdStzq77vIDsO60Fu7i9LE/jDYzF4E9FXb7c=";
-    })
-    (fetchpatch {
-      # normal/menu: Don't show "Booting `%s'" msg when auto-booting with TIMEOUT_STYLE_HIDDEN
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5bb4f2b7d665c84bde402d1a528b652a61753380";
-      sha256 = "sha256-lwJPPyq6yj7X1C2RuHfxnwKKstFkWGxcMXuSQqd9Z4I=";
-    })
-    (fetchpatch {
-      # kern/main: Suppress the "Welcome to GRUB!" message in EFI builds
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=3e4cbbeca0ef35097301a1086f85fd0d119e64aa";
-      sha256 = "sha256-cQX4x9V5Y7SU9WACn5FzDjukL2/StAUMMoHY/DRHq+g=";
-    })
-
-    (fetchpatch {
-      name = "CVE-2021-3981.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0adec29674561034771c13e446069b41ef41e4d4";
-      sha256 = "sha256-3vkvWjcSv0hyY2EX3ig2EXEe+XLiRsXYlcd5kpY4wXw=";
-    })
-    # June 2022 security patches
-    # https://lists.gnu.org/archive/html/grub-devel/2022-06/msg00035.html
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.1.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1469983ebb9674753ad333d37087fb8cb20e1dce";
-      sha256 = "sha256-oB4S0jvIXsDPcjIz1E2LKm7gwdvZjywuI1j0P6JQdJg=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.2.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=14ceb3b3ff6db664649138442b6562c114dcf56e";
-      sha256 = "sha256-mKe8gzd0U4PbV8z3TWCdvv7UugEgYaVIkB4dyMrSGEE=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.3.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=04c86e0bb7b58fc2f913f798cdb18934933e532d";
-      sha256 = "sha256-sA+PTlk4hwYOVKRZBHkEskabzmsf47Hi4h3mzWOFjwM=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.4.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6fe755c5c07bb386fda58306bfd19e4a1c974c53";
-      sha256 = "sha256-8zmFocUfnjSyhYitUFDHoilHDnm1NJmhcKwO9dueV3k=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.5.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f1ce0e15e70ea1aafcfa26ad93e7585f65783c6f";
-      sha256 = "sha256-Wrlam6CRPUAHbKqe/X1YLcRxJ2LQTtmQ/Y66gxUlqK4=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.6.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5bff31cdb6b93d738f850834e6291df1d0b136fa";
-      sha256 = "sha256-ReLWSePXjRweymsVAL/uoBgYMWt9vRDcY3iXlDNZT0w=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.7.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=347880a13c239b4c2811c94c9a7cf78b607332e3";
-      sha256 = "sha256-07hpHuJFw95xGoJ/6ej7i6HlCFb2QRxP3arvRjKW4uU=";
-    })
-    ## Needed to apply patch 8
-    (fetchpatch {
-      name = "video-remove-trailing-whitespaces.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1f48917d8ddb490dcdc70176e0f58136b7f7811a";
-      sha256 = "sha256-/yf/LGpwYcQ36KITzmiFfg4BvhcApKbrlFzjKK8V2kI=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.8.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e623866d9286410156e8b9d2c82d6253a1b22d08";
-      sha256 = "sha256-zFxP6JY5Q9s3yJHdkbZ2w+dXFKeOCXjFnQKadB5HLCg=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.9.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=210245129c932dc9e1c2748d9d35524fb95b5042";
-      sha256 = "sha256-FyZhdTlcRVmn7X2hv93RhWP7NOoEMb7ib/DWveyz3Ew=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.10.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=690bee69fae6b4bd911293d6b7e56774e29fdf64";
-      sha256 = "sha256-nOAXxebCW/s5M6sjPKdSdx47/PcH1lc0yYT0flVwoC8=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.11.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d5caac8ab79d068ad9a41030c772d03a4d4fbd7b";
-      sha256 = "sha256-9fGJJkgZ6+E01MJqVTR1qFITx9EAx41Hv9QNfdqBgu0=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.12.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=768ef2199e0265cf455b154f1a80a612f02274c8";
-      sha256 = "sha256-2/JJJux5vqXUc77bi3aXRy8NclbvyD/0e6UN8/6Ui3c=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.13.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=166a4d61448f74745afe1dac2f2cfb85d04909bf";
-      sha256 = "sha256-XxTZ8P8qr4qEXELdHwaRACPeIZ/iixlATLB5RvVQsC8=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.14.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=22a3f97d39f6a10b08ad7fd1cc47c4dcd10413f6";
-      sha256 = "sha256-bzB2gmGvWR2ylvMw779KQ/VHBBMsDNbG96eg9qQlljA=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.15.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=830a9628b2c9e1b6388af624aaf4a80818ed6be0";
-      sha256 = "sha256-8fna2VbbUw8zBx77osaOOHlZFgRrHqwQK87RoUtCF6w=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.16.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=3e4817538de828319ba6d59ced2fbb9b5ca13287";
-      sha256 = "sha256-iCZAyRS/a15x5aJCJBYl9nw6Hc3WRCUG7zF5V+OwDKg=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.17.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f407e34f3871a4c402bbd516e7c28ea193cef1b7";
-      sha256 = "sha256-S45cLZNTWapAodKudUz2fMjnPsW6vbtNz0bIvIBGmu4=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.18.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1b7eef9fa4aaefbf7d0507505c3bb2914e1ad6b";
-      sha256 = "sha256-TWPfEAOePwC77yiVdsTSZIjfsMp7+0XabCz9K3FlV7w=";
-    })
-    ## Needed to apply patch 19
-    (fetchpatch {
-      name = "net-remove-trailing-whitespaces.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e453a4a64392a41bc7b37f890aceb358112d1687";
-      sha256 = "sha256-JCbUB77Y6js5u99uJ9StDxNjjahNy4nO3crK8/GvmPY=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.19.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=96abf4fb9d829f4a405d5df39bc74bbccbd0e322";
-      sha256 = "sha256-6E2MKO5kauFA1TA8YkUgIUusniwHS2Sr44A/a7ZqDCo=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.20.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ee9652031491326736714a988fbbaeab8ef9255c";
-      sha256 = "sha256-E21q+Mj+JBQlUW0pe4zbaoL3ErXmCanyizwAsRYYZHk=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.21.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8f287c3e13da2bf82049e2e464eca7ca4fef0a85";
-      sha256 = "sha256-dZ24RwYsHeUrMuiU7PDgPcw+iK9cOd6q+E0xWXbtTkE=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.22.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad94fffe14be476df5f34a8e5a90ea62a41fe12";
-      sha256 = "sha256-06TyTEvSy19dsnXZZoKBGx7ymJVWogr0NorzLflEwY4=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.23.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ec6bfd3237394c1c7dbf2fd73417173318d22f4b";
-      sha256 = "sha256-NryxSekO8oSxsnv5G9mFZExm4Pwfc778mslyUDuDhlM=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.24.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b26b4c08e7119281ff30d0fb4a6169bd2afa8fe4";
-      sha256 = "sha256-fSH3cxl/76DwkE8dHSR9uao9Vf1sJrhz7SmUSgDNodI=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.25.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4bd9877f62166b7e369773ab92fe24a39f6515f8";
-      sha256 = "sha256-VMtR/sF8F1BMKmJ06ZZEPNH/+l0RySy/E6lVWdCyFKE=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.26.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=deae293f399dde3773cf37dfa9b77ca7e04ef772";
-      sha256 = "sha256-sCC3KE9adavw7jHMTVlxtyuwDFCPRDqT24H3AKUYf68=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.27.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e40b83335bb33d9a2d1c06cc269875b3b3d6c539";
-      sha256 = "sha256-cviCfBkzacAtnHGW87RLshhduE4Ym/v2Vq4h/sZDmZg=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.28.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=11e1cffb7e2492ddac4ab8d19ce466783adbb957";
-      sha256 = "sha256-I1feoneVeU3XkscKfVprWWJfLUnrc5oauMXYDyDxo5M=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.29.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13dce204cf6f3f0f49c9949971052a4c9657c0c0";
-      sha256 = "sha256-DzFHxgR9A8FNZ/y9OMeBvTp1K6J5ePyL06dhHQmk7Ik=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.30.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2f4430cc0a44fd8c8aa7aee5c51887667ad3d6c3";
-      sha256 = "sha256-AufP/10/auO4NMjYQ7yPDDbYShwGaktyQtqJx2Jasz8=";
-    })
-    # October 2022 security patches
-    # https://lists.gnu.org/archive/html/grub-devel/2022-11/msg00059.html
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.1.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f6b6236077f059e64ee315f2d7acb8fa4eda87c5";
-      sha256 = "sha256-pk02iVf/u6CdsVjl8HaFBh0Bt473ZQzz5zBp9SoBLtE=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.2.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c76ec09ae08155df27cd237eaea150b4f02f532";
-      sha256 = "sha256-axbEOH5WFkUroGna2XY1f2kq7+B1Cs6LiubIA2EBdiM=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.3.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=768e1ef2fc159f6e14e7246e4be09363708ac39e";
-      sha256 = "sha256-aKDUVS/Yx1c87NCrt4EG8BlSpkHijUyAJIwbmtzNjD8=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.4.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c51292274ded3259eb04c2f1c8d253ffbdb5216a";
-      sha256 = "sha256-OLNOKuAJuHy2MBMnU2xcYM7AaxmDk9fchXhggoDrxJU=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.5.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=23843fe8947e4da955a05ad3d1858725bfcb56c8";
-      sha256 = "sha256-ptn00nqVJlEb1c6HhoMy9nrBuctH077LM4yXKsK47gc=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.6.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b9396daf1c2e3cdc0a1e69b056852e0769fb24de";
-      sha256 = "sha256-K7XNneDZjLpZh/C908+5uYsB/0oIdgQqmk0yJrdQLG4=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.7.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1d2015598cc7a9fca4b39186273e3519a88e80c7";
-      sha256 = "sha256-s4pZtszH4b/0u85rpzVapZmNQdYEq/wW06SQ3PW/1aU=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.8.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=93a786a00163e50c29f0394df198518617e1c9a5";
-      sha256 = "sha256-R8x557RMAxJ0ZV2jb6zDmwOPVlk6875q37fNpqKsPT0=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.9.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1eac01c147b4d85d2ec4a7e5671fa4345f2e8549";
-      sha256 = "sha256-eOnhmU3pT5cCVnNHcY/BzDjldfs7yh/OGsxa15tGv94=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.10.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=992c06191babc1e109caf40d6a07ec6fdef427af";
-      sha256 = "sha256-kezNKPcLmFXwyZbXtJbaPTIbE8tijmHIzdC2jsKwrNk=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.11.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9d81f71c6b8f55cf20cd56f5fe29c759df9b48cc";
-      sha256 = "sha256-jnniVGy4KvFGFmcOP2YLA46k3cK8vwoByo19ismVUzE=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.12.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=22b77b87e10a3a6c9bb9885415bc9a9c678378e6";
-      sha256 = "sha256-iYTEqN5997I7MVIg82jt/bbEAYhcgq8fNRCNPpY9ze0=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-2601.CVE-2022-3775.13.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1514678888595ef41a968a0c69b7ff769edd1e9c";
-      sha256 = "sha256-tgAEoAtaNKJjscjMFkXXiVn59Pa4c+NiQ3iVW6CMrpo=";
-    })
-
-    # fix incompatibility with e2fsprogs 1.47+
-    (fetchpatch {
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7fd5feff97c4b1f446f8fcf6d37aca0c64e7c763";
-      sha256 = "sha256-pejn1bJkC7XnT2ODaxeERHUrMOONoBV6w0wF2Z2ZKWI=";
-    })
   ];
 
   postPatch = if kbdcompSupport then ''
@@ -357,7 +93,7 @@ stdenv.mkDerivation rec {
   '';
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ bison flex python3 pkg-config gettext freetype autoreconfHook ];
+  nativeBuildInputs = [ bison flex python3 pkg-config gettext freetype autoconf automake ];
   buildInputs = [ ncurses libusb-compat-0_1 freetype lvm2 fuse libtool bash ]
     ++ lib.optional doCheck qemu
     ++ lib.optional zfsSupport zfs;
@@ -368,9 +104,6 @@ stdenv.mkDerivation rec {
 
   separateDebugInfo = !xenSupport;
 
-  # Work around a bug in the generated flex lexer (upstream flex bug?)
-  env.NIX_CFLAGS_COMPILE = "-Wno-error";
-
   preConfigure =
     '' for i in "tests/util/"*.in
        do
@@ -393,6 +126,18 @@ stdenv.mkDerivation rec {
 
       patchShebangs .
 
+      GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION)
+      if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then
+        echo "This version of GRUB requires a different gnulib revision!"
+        echo "We have: ${gnulib.rev}"
+        echo "GRUB needs: $GNULIB_REVISION"
+        exit 1
+      fi
+
+      cp -f --no-preserve=mode ${locales}/* po
+
+      ./bootstrap --no-git --gnulib-srcdir=${gnulib}
+
       substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts'
     '';
 

pkgs/tools/misc/pre-commit-hook-ensure-sops/default.nix

@@ -0,0 +1,50 @@
+{ lib
+, python3Packages
+, fetchFromGitHub
+, fetchpatch
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "pre-commit-hook-ensure-sops";
+  version = "1.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "yuvipanda";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-8sMmHNzmYwOmHYSWoZ4rKb/2lKziFmT6ux+s+chd/Do=";
+  };
+
+  patches = [
+    # Add the command-line entrypoint to pyproject.toml
+    # Can be removed after v1.2 release that includes changes
+    (fetchpatch {
+      url =
+        "https://github.com/yuvipanda/pre-commit-hook-ensure-sops/commit/ed88126afa253df6009af7cbe5aa2369f963be1c.patch";
+      hash = "sha256-mMxAoC3WEciO799Rq8gZ2PJ6FT/GbeSpxlr1EPj7r4s=";
+    })
+  ];
+
+  propagatedBuildInputs = [
+    python3Packages.ruamel-yaml
+  ];
+
+  pythonImportsCheck = [
+    "pre_commit_hook_ensure_sops"
+  ];
+
+  # Test entrypoint
+  checkPhase = ''
+    runHook preCheck
+    $out/bin/pre-commit-hook-ensure-sops --help
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "pre-commit hook to ensure that files that should be encrypted with sops are";
+    homepage = "https://github.com/yuvipanda/pre-commit-hook-ensure-sops";
+    maintainers = with maintainers; [ nialov ];
+    license = licenses.bsd3;
+  };
+}

pkgs/tools/misc/twspace-crawler/default.nix

@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "twspace-crawler";
-  version = "1.12.2";
+  version = "1.12.3";
 
   src = fetchFromGitHub {
     owner = "HitomaruKonpaku";
     repo = "twspace-crawler";
-    rev = "8d325a1c8b811c62d971bc3d43cc1553d621f836"; # version not tagged
+    rev = "d78caf0da5eb9c493e3d4d8b4ca47d434f4764bb"; # version not tagged
-    hash = "sha256-iV+M+x81j+djlCsAGDIG1V+Psrl1dYIv/ZL1EHfcXVs=";
+    hash = "sha256-ONgPGlLRi0z2V1hB15w75GUt2Asc3hrRjuEjNSZc7Bc=";
   };
 
-  npmDepsHash = "sha256-vzSjcsxsEXyPjPAjJWckrKS6/wi17ZOZkDk5FDY7ZeI=";
+  npmDepsHash = "sha256-Gq1OWJlIIIOHoP0TMscaPXaVpmfexax2EjdTCDPmeQQ=";
 
   meta = with lib; {
     description = "Script to monitor & download Twitter Spaces 24/7";

pkgs/tools/misc/vector/default.nix

@@ -19,20 +19,21 @@
   # nix has a problem with the `?` in the feature list
   # enabling kafka will produce a vector with no features at all
 , enableKafka ? false
-  # TODO investigate adding "vrl-cli" and various "vendor-*"
+  # TODO investigate adding various "vendor-*"
   # "disk-buffer" is using leveldb TODO: investigate how useful
   # it would be, perhaps only for massive scale?
-, features ? ([ "api" "api-client" "enrichment-tables" "sinks" "sources" "sources-dnstap" "transforms" "vrl-cli" ]
+, features ? ([ "api" "api-client" "enrichment-tables" "sinks" "sources" "sources-dnstap" "transforms" "component-validation-runner" ]
     # the second feature flag is passed to the rdkafka dependency
     # building on linux fails without this feature flag (both x86_64 and AArch64)
     ++ lib.optionals enableKafka [ "rdkafka?/gssapi-vendored" ]
     ++ lib.optional stdenv.targetPlatform.isUnix "unix")
+, nixosTests
 , nix-update-script
 }:
 
 let
   pname = "vector";
-  version = "0.29.1";
+  version = "0.31.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -41,17 +42,18 @@ rustPlatform.buildRustPackage {
     owner = "vectordotdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4WqO7i1xthUU2bTzaS5poTh+wemjvqNAUFIDN73f7kw=";
+    hash = "sha256-+ATOHx+LQLQV4nMdj1FRRvDTqGCTbX9kl290AbY9Vw0=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
+      "aws-config-0.54.1" = "sha256-AVumLhybVbMnEah9/JqiQOQ4R0e2OsbB8WAJ422R6uk=";
       "azure_core-0.5.0" = "sha256-fojO7dhntpymMjV58TtYb7N4UN6rOp30D54x09RDXfQ=";
-      "chrono-0.4.24" = "sha256-SVPRfixSt0m14MmOcmBVseC/moj1DIA3B+m0pvT41K0=";
+      "chrono-0.4.26" = "sha256-4aDDfLK9H0tEyKlZVMIIU4NjvF70spVYFrfM3/05e0k=";
-      "datadog-filter-0.1.0" = "sha256-CNAIoDyJJo+D2Qzt6Fb2FwpQpzX02XurT8j1gHkz1bE=";
       "heim-0.1.0-rc.1" = "sha256-ODKEQ1udt7FlxI5fvoFMG7C2zmM45eeEYDUEaLTsdYo=";
       "nix-0.26.2" = "sha256-uquYvRT56lhupkrESpxwKEimRFhmYvri10n3dj0f2yg=";
+      "ntapi-0.3.7" = "sha256-G6ZCsa3GWiI/FeGKiK9TWkmTxen7nwpXvm5FtjNtjWU=";
       "tokio-util-0.7.4" = "sha256-rAzj44O+GOZhG+o6FVN5qCcG/NWxW8fUpScm+xsRjIs=";
       "tracing-0.2.0" = "sha256-YAxeEofFA43PX2hafh3RY+C81a2v6n1fGzYz2FycC3M=";
     };
@@ -110,6 +112,7 @@ rustPlatform.buildRustPackage {
 
   passthru = {
     inherit features;
+    tests = { inherit (nixosTests) vector; };
     updateScript = nix-update-script { };
   };
 

pkgs/tools/misc/vtm/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vtm";
-  version = "0.9.9q";
+  version = "0.9.9r";
 
   src = fetchFromGitHub {
     owner = "netxs-group";
     repo = "vtm";
     rev = "v${version}";
-    sha256 = "sha256-HuKUt2hXE5kGkOknVngVjCWidia4E4csoODTuGwwx7k=";
+    sha256 = "sha256-HVhRzJReIxO4R9ZhI8vPcV29TRVffT/Eq6Z4u1xMpQo=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/tools/security/cnspec/default.nix

@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "8.16.0";
+  version = "8.17.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aTpE/8nPSnLqcj6KnBi70ZoOlkOXdmsw9INNnoVIjQw=";
+    hash = "sha256-pirU9mJnycr3wlc6lOAVSo0Wpb6q37ewdVcFzFPlr7s=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-pc9m58Sjegr2J+JqcOYu1xo3AZCN+EI2mlXKL14qqRU=";
+  vendorHash = "sha256-y63IWmBJaSUk1A5WRC9sokH+pNDhsc/Es1j50k5or8w=";
 
   subPackages = [
     "apps/cnspec"

pkgs/top-level/all-packages.nix

@@ -8471,17 +8471,7 @@ with pkgs;
 
   grpc-client-cli = callPackage ../development/tools/misc/grpc-client-cli { };
 
-  grub2 = callPackage ../tools/misc/grub/default.nix {
+  grub2 = callPackage ../tools/misc/grub/default.nix { };
-    # update breaks grub2
-    gnulib = pkgs.gnulib.overrideAttrs {
-      version = "20200223";
-      src = fetchgit {
-        url = "https://git.savannah.gnu.org/r/gnulib.git";
-        rev = "292fd5d6ff5ecce81ec3c648f353732a9ece83c0";
-        sha256 = "0hkg3nql8nsll0vrqk4ifda0v4kpi67xz42r8daqsql6c4rciqnw";
-      };
-    };
-  };
 
   grub2_efi = grub2.override {
     efiSupport = true;
@@ -11707,6 +11697,8 @@ with pkgs;
 
   pre-commit = callPackage ../tools/misc/pre-commit { };
 
+  pre-commit-hook-ensure-sops = callPackage ../tools/misc/pre-commit-hook-ensure-sops { };
+
   pretender = callPackage ../tools/security/pretender { };
 
   pretty-simple = callPackage ../development/tools/pretty-simple { };

pkgs/top-level/linux-kernels.nix

@@ -150,7 +150,6 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
-        kernelPatches.fix-amdgpu-5_15
       ];
     };
 

pkgs/top-level/php-packages.nix

@@ -204,16 +204,13 @@ lib.makeScope pkgs.newScope (self: with self; {
   # or php.withExtensions to extend the functionality of the PHP
   # interpreter.
   # The extensions attributes is composed of three sections:
-  # 1. The contrib conditional extensions, which are only available on specific versions or system
+  # 1. The contrib conditional extensions, which are only available on specific PHP versions
   # 2. The contrib extensions available
   # 3. The core extensions
   extensions =
   # Contrib conditional extensions
    lib.optionalAttrs (!(lib.versionAtLeast php.version "8.3")) {
     blackfire = callPackage ../development/tools/misc/blackfire/php-probe.nix { inherit php; };
-  } // lib.optionalAttrs (!stdenv.isDarwin) {
-    # Only available on Linux: https://www.php.net/manual/en/inotify.requirements.php
-    inotify = callPackage ../development/php-packages/inotify { };
   } //
   # Contrib extensions
   {
@@ -239,6 +236,8 @@ lib.makeScope pkgs.newScope (self: with self; {
 
     imagick = callPackage ../development/php-packages/imagick { };
 
+    inotify = callPackage ../development/php-packages/inotify { };
+
     mailparse = callPackage ../development/php-packages/mailparse { };
 
     maxminddb = callPackage ../development/php-packages/maxminddb { };