Merge staging-next into staging

2023-09-09 12:01:22 +00:00 · 2023-09-09 12:01:22 +00:00 · 6d1f33a3ed
parent 02057fdfa6 9364f16bf2
commit 6d1f33a3ed
49 changed files with 5650 additions and 167 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4651,6 +4651,16 @@
      fingerprint = "5DD7 C6F6 0630 F08E DAE7  4711 1525 585D 1B43 C62A";
    }];
  };
+  dunxen = {
+    email = "git@dunxen.dev";
+    matrix = "@dunxen:x0f.org";
+    github = "dunxen";
+    githubId = 3072149;
+    name = "Duncan Dean";
+    keys = [{
+      fingerprint = "9484 44FC E03B 05BA 5AB0  591E C37B 1C1D 44C7 86EE";
+    }];
+  };
  dwarfmaster = {
    email = "nixpkgs@dwarfmaster.net";
    github = "dwarfmaster";
@ -10826,7 +10836,7 @@
    }];
  };
  max-amb = {
-    email = "maxpeterambaum@gmail.com";
+    email = "max_a@e.email";
    github = "max-amb";
    githubId = 137820334;
    name = "Max Ambaum";
--- a/nixos/tests/sudo.nix
+++ b/nixos/tests/sudo.nix
@ -5,7 +5,7 @@ let
 in
  import ./make-test-python.nix ({ lib, pkgs, ...} : {
    name = "sudo";
-    meta.maintainers = with lib.maintainers; [ lschuermann ];
+    meta.maintainers = pkgs.sudo.meta.maintainers;

    nodes.machine =
      { lib, ... }:
--- a/pkgs/applications/audio/tageditor/default.nix
+++ b/pkgs/applications/audio/tageditor/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "tageditor";
-  version = "3.8.1";
+  version = "3.9.0";

  src = fetchFromGitHub {
    owner = "martchus";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-7YmjrVh8P3XfnNs2I8PoLigfVvzS0UnuAC67ZQp7WdA=";
+    hash = "sha256-caki8WVnu8ELE2mXwRvT9TTTXCtMZEa0E3KVpHl05jg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/nwg-look/default.nix
+++ b/pkgs/applications/misc/nwg-look/default.nix
@ -0,0 +1,72 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, substituteAll
+, buildGoModule
+, go
+, glib
+, pkg-config
+, cairo
+, gtk3
+, xcur2png
+, libX11
+, zlib
+}:
+
+buildGoModule rec {
+  pname = "nwg-look";
+  version = "0.2.4";
+
+  src = fetchFromGitHub {
+    owner = "nwg-piotr";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-wUI58qYkVYgES87HQ4octciDlOJ10oJldbUkFgxRUd4=";
+  };
+
+  vendorHash = "sha256-dev+TV6FITd29EfknwHDNI0gLao7gsC95Mg+3qQs93E=";
+
+  # Replace /usr/ directories with the packages output location
+  # This means it references the correct path
+  patches = [ ./fix-paths.patch ];
+
+  postPatch = ''
+    substituteInPlace main.go tools.go --replace '@out@' $out
+  '';
+
+  ldflags = [ "-s" "-w" ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    cairo
+    xcur2png
+    libX11.dev
+    zlib
+    gtk3
+  ];
+
+  CGO_ENABLED = 1;
+
+  postInstall = ''
+    mkdir -p $out/share
+    mkdir -p $out/share/nwg-look/langs
+    mkdir -p $out/share/applications
+    mkdir -p $out/share/pixmaps
+    cp stuff/main.glade $out/share/nwg-look/
+    cp langs/* $out/share/nwg-look/langs
+    cp stuff/nwg-look.desktop $out/share/applications
+    cp stuff/nwg-look.svg $out/share/pixmaps
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/nwg-piotr/nwg-look";
+    description = "Nwg-look is a GTK3 settings editor, designed to work properly in wlroots-based Wayland environment.";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ max-amb ];
+    mainProgram = "nwg-look";
+  };
+}
--- a/pkgs/applications/misc/nwg-look/fix-paths.patch
+++ b/pkgs/applications/misc/nwg-look/fix-paths.patch
@ -0,0 +1,35 @@
+diff --git a/main.go b/main.go
+index 23c4756..c52e9c3 100644
+--- a/main.go
+++ b/main.go
+@@ -335,7 +335,7 @@ func main() {
+
+ 	gtkSettings, _ = gtk.SettingsGetDefault()
+
+-	builder, _ := gtk.BuilderNewFromFile("/usr/share/nwg-look/main.glade")
+	builder, _ := gtk.BuilderNewFromFile("@out@/share/nwg-look/main.glade")
+ 	win, _ := getWindow(builder, "window")
+
+ 	win.Connect("destroy", func() {
+diff --git a/tools.go b/tools.go
+index e6e7665..59d6f35 100644
+--- a/tools.go
+++ b/tools.go
+@@ -1034,7 +1034,7 @@ func getDataDirs() []string {
+ 	if os.Getenv("XDG_DATA_DIRS") != "" {
+ 		xdgDataDirs = os.Getenv("XDG_DATA_DIRS")
+ 	} else {
+-		xdgDataDirs = "/usr/local/share/:/usr/share/"
+		xdgDataDirs = "@out@/local/share/:@out@/share/"
+ 	}
+
+ 	for _, d := range strings.Split(xdgDataDirs, ":") {
+@@ -1280,7 +1280,7 @@ func detectLang() string {
+ }
+
+ func loadVocabulary(lang string) map[string]string {
+-	langsDir := "/usr/share/nwg-look/langs/"
+	langsDir := "@out@/share/nwg-look/langs/"
+ 	enUSFile := filepath.Join(langsDir, "en_US.json")
+ 	if pathExists(enUSFile) {
+ 		log.Infof(">>> Loading basic lang from '%s'", enUSFile)
--- a/pkgs/applications/misc/nwg-look/go.mod
+++ b/pkgs/applications/misc/nwg-look/go.mod
@ -0,0 +1,10 @@
+module github.com/nwg-piotr/nwg-look
+
+go 1.20
+
+require (
+	github.com/gotk3/gotk3 v0.6.2
+	github.com/sirupsen/logrus v1.9.3
+)
+
+require golang.org/x/sys v0.6.0 // indirect
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.50.13";
+  version = "0.50.14";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-d3fWHkuJdijN5/EsG6nhdf6G8AG2nZVFN8MUN8X+qf0=";
+    hash = "sha256-jPRSwq7pLFG56NB+HaP2GP2GdK1wsOeM+y396o70Q3A=";
  };

  vendorHash = "sha256-wQ5jxOTuYkiW5zHcduByKZ+vHPKn/1ELL3DskKze+UI=";
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -6,7 +6,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.9.5";
+  version = "3.9.7";
  format = "pyproject";

  # Fetch from GitHub in order to use `requirements.in`
@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "Flexget";
    repo = "Flexget";
    rev = "refs/tags/v${version}";
-    hash = "sha256-L3AQCc5ErWjMATKMSZf9r+4rfFA8SjCCcT0rW9oMmbA=";
+    hash = "sha256-UDh5rEcnuoiXjxYZqh0KJXi02M3xjwXGNKhrEBrLtCs=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "protonmail-bridge";
-  version = "3.4.1";
+  version = "3.4.2";

  src = fetchFromGitHub {
    owner = "ProtonMail";
    repo = "proton-bridge";
    rev = "v${version}";
-    hash = "sha256-EDUjKHqaHZA/jvPBeAAqIJHEt8eTHmg9D5lE5JGAAAU=";
+    hash = "sha256-i+RD0f3WxdW0PgMNynsIXnOfEdh3vS3NufJyXpw0EU0=";
  };

-  vendorHash = "sha256-gwRyr4zQLgZqyqxsh0wGABbuGKvZhG/yTfy/CqOiaBA=";
+  vendorHash = "sha256-lrK4L7oTR5qP34Df0UJnTJATmKUmHVZeGrD9kD+sZFw=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/science/biology/igv/default.nix
+++ b/pkgs/applications/science/biology/igv/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "igv";
-  version = "2.16.1";
+  version = "2.16.2";
  src = fetchzip {
    url = "https://data.broadinstitute.org/igv/projects/downloads/${lib.versions.majorMinor version}/IGV_${version}.zip";
-    sha256 = "sha256-/3ielakIRdm9/iGBKSk+fTyzYRnsMTdCdsKghnziVwA=";
+    sha256 = "sha256-/X9loW8rOevf/GA/Wk3bVsES9ZceF79Bkwby75SJgTQ=";
  };

  installPhase = ''
--- a/pkgs/applications/version-management/ghorg/default.nix
+++ b/pkgs/applications/version-management/ghorg/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "ghorg";
-  version = "1.9.7";
+  version = "1.9.9";

  src = fetchFromGitHub {
    owner = "gabrie30";
    repo = "ghorg";
    rev = "v${version}";
-    sha256 = "sha256-uIhYk79ZXcJ/ttexgjtxskI2nEwlq+E4jgIZzwz8hmI=";
+    sha256 = "sha256-yq95+MHMbzVg8i/55EZBVCVkE3uwD964fAaXWP5aWYw=";
  };

  doCheck = false;
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@ -26,13 +26,13 @@

 mkDerivation rec {
  pname = "haruna";
-  version = "0.12.0";
+  version = "0.12.1";

  src = fetchFromGitLab {
    owner = "multimedia";
    repo = "haruna";
    rev = "v${version}";
-    hash = "sha256-NWV3DSQkgH4cqNnHipg4S3Nf5aEVdRzD0oT8a2OyCu4=";
+    hash = "sha256-x3tgH2eoLVELQKbgNLvJPGQsay8iOfMY/BGLOEov3OM=";
    domain = "invent.kde.org";
  };

@ -73,6 +73,6 @@ mkDerivation rec {
    homepage = "https://invent.kde.org/multimedia/haruna";
    description = "Open source video player built with Qt/QML and libmpv";
    license = with licenses; [ bsd3 cc-by-40 cc-by-sa-40 cc0 gpl2Plus gpl3Plus wtfpl ];
-    maintainers = with maintainers; [ jojosch ];
+    maintainers = with maintainers; [ jojosch kashw2 ];
  };
 }
--- a/pkgs/by-name/cd/cdwe/package.nix
+++ b/pkgs/by-name/cd/cdwe/package.nix
@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cdwe";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "synoet";
+    repo = "cdwe";
+    rev = version;
+    hash = "sha256-6NWhx82BXhWhbI18k5gE3vEkw9v5gstE8ICJhtq68rM=";
+  };
+
+  cargoHash = "sha256-V2eWVoRtfjHLe2AypYekUFzMnuV8RYU9Pb7Q1U3fwp4=";
+
+  meta = with lib; {
+    description = "A configurable cd wrapper that lets you define your environment per directory";
+    homepage = "https://github.com/synoet/cdwe";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "cdwe";
+  };
+}
--- a/pkgs/by-name/li/liana/Cargo.lock
+++ b/pkgs/by-name/li/liana/Cargo.lock
--- a/pkgs/by-name/li/liana/package.nix
+++ b/pkgs/by-name/li/liana/package.nix
@ -0,0 +1,91 @@
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, cmake
+, copyDesktopItems
+, makeDesktopItem
+, makeWrapper
+, expat
+, fontconfig
+, freetype
+, libGL
+, systemd
+, vulkan-loader
+, xorg
+}:
+
+let
+  runtimeLibs = [
+    expat
+    fontconfig
+    freetype
+    freetype.dev
+    libGL
+    vulkan-loader
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXrandr
+  ];
+in
+rustPlatform.buildRustPackage rec {
+  pname = "liana";
+  version = "2.0";
+
+  src = fetchFromGitHub {
+    owner = "wizardsardine";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-GQNPKlqOBoh684x57gVV3CImgO7HBqt3UFp6CHC13do=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "liana-2.0.0" = "sha256-Dv/Ad8Kv7Mit8yhewzANbUbngQjtQaap/NQy9jqnbfA=";
+      "iced_futures-0.6.0" = "sha256-ejkAxU6DwiX1/119eA0GRapSmz7dqwx9M0uMwyDHATQ=";
+    };
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    copyDesktopItems
+    makeWrapper
+  ];
+
+  buildInputs = [
+    fontconfig
+    systemd
+  ];
+
+  sourceRoot = "source/gui";
+
+  postInstall = ''
+    install -Dm0644 ./ui/static/logos/liana-app-icon.svg $out/share/icons/hicolor/scalable/apps/liana.svg
+    wrapProgram $out/bin/liana-gui --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}"
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Liana";
+      exec = "liana-gui";
+      icon = "liana";
+      desktopName = "Liana";
+      comment = meta.description;
+    })
+  ];
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "A Bitcoin wallet leveraging on-chain timelocks for safety and recovery";
+    homepage = "https://wizardsardine.com/liana";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ dunxen ];
+    platforms = platforms.linux;
+    broken = stdenv.isAarch64;
+  };
+}
--- a/pkgs/by-name/ri/ripsecrets/package.nix
+++ b/pkgs/by-name/ri/ripsecrets/package.nix
@ -0,0 +1,27 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ripsecrets";
+  version = "0.1.6";
+
+  src = fetchFromGitHub {
+    owner = "sirwart";
+    repo = "ripsecrets";
+    rev = "v${version}";
+    hash = "sha256-p3421sQko/WulSNUxXpjsHPAtRoHHg61angfxJpoyFg=";
+  };
+
+  cargoHash = "sha256-DJkEhqW5DZOmoNiS4nw+i2G0+KN2d7FbBuKp7fdAwMk=";
+
+  meta = with lib; {
+    description = "A command-line tool to prevent committing secret keys into your source code";
+    homepage = "https://github.com/sirwart/ripsecrets";
+    changelog = "https://github.com/sirwart/ripsecrets/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "ripsecrets";
+  };
+}
--- a/pkgs/development/compilers/fasm/bin.nix
+++ b/pkgs/development/compilers/fasm/bin.nix
@ -3,11 +3,11 @@
 stdenvNoCC.mkDerivation rec {
  pname = "fasm-bin";

-  version = "1.73.30";
+  version = "1.73.31";

  src = fetchurl {
    url = "https://flatassembler.net/fasm-${version}.tgz";
-    sha256 = "sha256-dRlQUaWIHbu+DwQBFh6Tf4o2u0LTRw/Ehp2hT9LC8QE=";
+    sha256 = "sha256-jzjLIayR+xulSGKhvQ9VxWhZC6qRZ/4IHSe3lD8LD+M=";
  };

  installPhase = ''
--- a/pkgs/development/libraries/libzip/default.nix
+++ b/pkgs/development/libraries/libzip/default.nix
@ -17,11 +17,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libzip";
-  version = "1.10.0";
+  version = "1.10.1";

  src = fetchurl {
    url = "https://libzip.org/download/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-UqYLRhglh+CDtx4rgvyqumTdXrAcWx8bxxBpo4WOQP4=";
+    sha256 = "sha256-lmmuXf46xbOJdTbchGaodMjPLA47H90I11snOIQpk2M=";
  };

  outputs = [ "out" "dev" "man" ];
@ -50,6 +50,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = licenses.bsd3;
    pkgConfigModules = [ "libzip" ];
    platforms = platforms.unix;
-    changelog = "https://github.com/nih-at/libzip/blob/v${version}/NEWS.md";
+    changelog = "https://github.com/nih-at/libzip/blob/v${finalAttrs.version}/NEWS.md";
  };
 })
--- a/pkgs/development/libraries/openimageio/default.nix
+++ b/pkgs/development/libraries/openimageio/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "openimageio";
-  version = "2.4.14.0";
+  version = "2.4.15.0";

  src = fetchFromGitHub {
    owner = "OpenImageIO";
    repo = "oiio";
    rev = "v${version}";
-    hash = "sha256-iHXU3Zr32XNn2Q2Pn/sgF6E1q/FXbdmVrOKC4lhGx3k=";
+    hash = "sha256-I2/JPmUBDb0bw7qbSZcAkYHB2q2Uo7En7ZurMwWhg/M=";
  };

  outputs = [ "bin" "out" "dev" "doc" ];
--- a/pkgs/development/libraries/openssl/1.1/CVE-2023-4807.patch
+++ b/pkgs/development/libraries/openssl/1.1/CVE-2023-4807.patch
@ -0,0 +1,44 @@
+From 4bfac4471f53c4f74c8d81020beb938f92d84ca5 Mon Sep 17 00:00:00 2001
+From: Bernd Edlinger <bernd.edlinger@hotmail.de>
+Date: Tue, 22 Aug 2023 16:07:30 +0200
+Subject: [PATCH] Avoid clobbering non-volatile XMM registers
+
+This affects some Poly1305 assembler functions
+which are only used for certain CPU types.
+
+Remove those functions for Windows targets,
+as a simple interim solution.
+
+Fixes #21522
+
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+Reviewed-by: Paul Dale <pauli@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/21808)
+
+(cherry picked from commit 7b8e27bc2e02238986d89ef0ece067ec1b48e165)
+---
+ crypto/poly1305/asm/poly1305-x86_64.pl | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/crypto/poly1305/asm/poly1305-x86_64.pl b/crypto/poly1305/asm/poly1305-x86_64.pl
+index fa9bfb7a7b81..24bab9d0bcf9 100755
+--- a/crypto/poly1305/asm/poly1305-x86_64.pl
+++ b/crypto/poly1305/asm/poly1305-x86_64.pl
+@@ -195,7 +195,7 @@ sub poly1305_iteration {
+ 	bt	\$`5+32`,%r9		# AVX2?
+ 	cmovc	%rax,%r10
+ ___
+-$code.=<<___	if ($avx>3);
+$code.=<<___	if ($avx>3 && !$win64);
+ 	mov	\$`(1<<31|1<<21|1<<16)`,%rax
+ 	shr	\$32,%r9
+ 	and	%rax,%r9
+@@ -2724,7 +2724,7 @@ sub poly1305_iteration {
+ .cfi_endproc
+ .size	poly1305_blocks_avx512,.-poly1305_blocks_avx512
+ ___
+-if ($avx>3) {
+if ($avx>3 && !$win64) {
+ ########################################################################
+ # VPMADD52 version using 2^44 radix.
+ #
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@ -241,6 +241,9 @@ in {
    patches = [
      ./1.1/nix-ssl-cert-file.patch

+      # https://www.openssl.org/news/secadv/20230908.txt
+      ./1.1/CVE-2023-4807.patch
+
      (if stdenv.hostPlatform.isDarwin
       then ./use-etc-ssl-certs-darwin.patch
       else ./use-etc-ssl-certs.patch)
--- a/pkgs/development/misc/juce/default.nix
+++ b/pkgs/development/misc/juce/default.nix
@ -0,0 +1,69 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+
+# Native build inputs
+, cmake
+, pkg-config
+, makeWrapper
+
+# Dependencies
+, alsa-lib
+, freetype
+, curl
+, libglvnd
+, webkitgtk
+, pcre
+, darwin
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "juce";
+  version = "7.0.7";
+
+  src = fetchFromGitHub {
+    owner = "juce-framework";
+    repo = "juce";
+    rev = finalAttrs.version;
+    hash = "sha256-r+Wf/skPDexm3rsrVBoWrygKvV9HGlCQd7r0iHr9avM=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "juce-6.1.2-cmake_install.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/juce/-/raw/4e6d34034b102af3cd762a983cff5dfc09e44e91/juce-6.1.2-cmake_install.patch";
+      hash = "sha256-fr2K/dH0Zam5QKS63zos7eq9QLwdr+bvQL5ZxScagVU=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    freetype # libfreetype.so
+    curl # libcurl.so
+    stdenv.cc.cc.lib # libstdc++.so libgcc_s.so
+    pcre # libpcre2.pc
+  ] ++ lib.optionals stdenv.isLinux [
+    alsa-lib # libasound.so
+    libglvnd # libGL.so
+    webkitgtk # webkit2gtk-4.0
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk_11_0.frameworks.Cocoa
+    darwin.apple_sdk_11_0.frameworks.MetalKit
+    darwin.apple_sdk_11_0.frameworks.WebKit
+  ];
+
+  meta = with lib; {
+    description = "Cross-platform C++ application framework";
+    longDescription = "JUCE is an open-source cross-platform C++ application framework for desktop and mobile applications, including VST, VST3, AU, AUv3, RTAS and AAX audio plug-ins";
+    homepage = "https://github.com/juce-framework/JUCE";
+    license = with licenses; [ isc gpl3Plus ];
+    maintainers = with maintainers; [ kashw2 ];
+    platforms = platforms.all;
+  };
+})
--- a/pkgs/development/misc/resholve/README.md
+++ b/pkgs/development/misc/resholve/README.md
@ -44,7 +44,6 @@ Here's a simple example of how `resholve.mkDerivation` is already used in nixpkg
 { lib
 , fetchFromGitHub
 , resholve
-, substituteAll
 , bash
 , coreutils
 , goss
@ -154,7 +153,7 @@ that the `resholve` CLI expects. Here's an overview:
 |--------|------|------------|
 | scripts | `<list>` | scripts to resolve (`$out`-relative paths) |
 | interpreter | `"none"` `<path>` | The absolute interpreter `<path>` for the script's shebang. The special value `none` ensures there is no shebang. |
-| inputs | `<packages>` | Packages to resolve external dependencies from. |
+| inputs | `<packages>` `<paths>` | A list of packages and string paths to directories/files to resolve external dependencies from. |
 | fake | `<directives>` | pretend some commands exist |
 | fix | `<directives>` | fix things we can't auto-fix/ignore |
 | keep | `<directives>` | keep things we can't auto-fix/ignore |
--- a/pkgs/development/python-modules/aiomqtt/default.nix
+++ b/pkgs/development/python-modules/aiomqtt/default.nix
@ -12,16 +12,16 @@

 buildPythonPackage rec {
  pname = "aiomqtt";
-  version = "1.1.0";
+  version = "1.2.0";
  format = "pyproject";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "sbtinstruments";
    repo = "aiomqtt";
    rev = "refs/tags/v${version}";
-    hash = "sha256-8f3opbvN/hmT6AEMD7Co5n5IqdhP0higbaDGUBWJRzU=";
+    hash = "sha256-WfHyCjNowtgTBADKeGyBBbO2JQ6YXJFvAtSq0iLzSbw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@ -17,6 +17,7 @@
 , six
 , zope-component
 , zope_interface
+, setuptools
 , dialog
 , gnureadline
 , pytest-xdist
@ -26,13 +27,13 @@

 buildPythonPackage rec {
  pname = "certbot";
-  version = "2.4.0";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-BQsdhlYABZtz5+SORiCVnWMZdMmiWGM9W1YLqObyFo8=";
+    hash = "sha256-CbYamk1+NvcyS6w7pOjpD5lqWHCk+VJqF9R3xYxzpQk=";
  };

  sourceRoot = "${src.name}/${pname}";
@ -52,6 +53,7 @@ buildPythonPackage rec {
    six
    zope-component
    zope_interface
+    setuptools # for pkg_resources
  ];

  buildInputs = [ dialog gnureadline ];
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@ -0,0 +1,109 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pythonRelaxDepsHook
+# pyproject
+, hatchling
+, hatch-requirements-txt
+, hatch-fancy-pypi-readme
+# runtime
+, setuptools
+, fsspec
+, httpx
+, huggingface-hub
+, packaging
+, requests
+, typing-extensions
+, websockets
+# checkInputs
+, pytestCheckHook
+, pytest-asyncio
+, pydub
+, gradio
+}:
+
+let
+
+  # Cyclic dependencies are fun!
+  # This is gradio without gradio-client, only needed for checkPhase
+  gradio' = (gradio.override (old: {
+    gradio-client = null;
+  })).overridePythonAttrs (old: {
+    nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pythonRelaxDepsHook ];
+    pythonRemoveDeps = (old.pythonRemoveDeps or []) ++ [ "gradio_client" ];
+    doInstallCheck = false;
+    doCheck = false;
+    pythonImportsCheck = null;
+  });
+
+in
+
+buildPythonPackage rec {
+  pname = "gradio_client";
+  version = "0.5.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
+
+  # no tests on pypi
+  src = fetchFromGitHub {
+    owner = "gradio-app";
+    repo = "gradio";
+    #rev = "refs/tags/v${gradio.version}";
+    rev = "ba4c6d9e65138c97062d1757d2a588c4fc449daa"; # v3.43.1 is not tagged...
+    sparseCheckout = [ "client/python" ];
+    hash = "sha256-savka4opyZKSWPeBqc2LZqvwVXLYIZz5dS1OWJSwvHo=";
+  };
+  prePatch = ''
+    cd client/python
+  '';
+
+  nativeBuildInputs = [
+    hatchling
+    hatch-requirements-txt
+    hatch-fancy-pypi-readme
+  ];
+
+  propagatedBuildInputs = [
+    setuptools # needed for 'pkg_resources'
+    fsspec
+    httpx
+    huggingface-hub
+    packaging
+    requests
+    typing-extensions
+    websockets
+  ];
+
+  nativeCheckInputs =[
+    pytestCheckHook
+    pytest-asyncio
+    pydub
+    gradio'
+  ];
+  disallowedReferences = [
+    gradio' # ensuring we don't propagate this intermediate build
+  ];
+
+  # Add a pytest hook skipping tests that access network, marking them as "Expected fail" (xfail).
+  preCheck = ''
+    export HOME=$TMPDIR
+    cat ${./conftest-skip-network-errors.py} >> test/conftest.py
+  '';
+
+  pytestFlagsArray = [
+    "test/"
+    #"-m" "not flaky" # doesn't work, even when advertised
+    #"-x" "-W" "ignore" # uncomment for debugging help
+  ];
+
+  pythonImportsCheck = [ "gradio_client" ];
+
+  meta = with lib; {
+    homepage = "https://www.gradio.app/";
+    description = "Lightweight library to use any Gradio app as an API";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@ -3,7 +3,6 @@
 , fetchPypi
 , pythonOlder
 , pythonRelaxDepsHook
-, writeText

 # pyproject
 , hatchling
@ -13,49 +12,48 @@
 # runtime
 , setuptools
 , aiofiles
-, aiohttp
 , altair
 , fastapi
 , ffmpy
-, markdown-it-py
-, mdit-py-plugins
+, gradio-client
+, httpx
+, huggingface-hub
+, importlib-resources
+, jinja2
 , markupsafe
 , matplotlib
 , numpy
 , orjson
+, packaging
 , pandas
 , pillow
-, pycryptodome
+, pydantic
 , python-multipart
 , pydub
 , pyyaml
 , requests
-, uvicorn
-, jinja2
-, fsspec
-, httpx
-, pydantic
-, websockets
+, semantic-version
 , typing-extensions
+, uvicorn
+, websockets

 # check
 , pytestCheckHook
+, boto3
+, ffmpeg
+, ipython
 , pytest-asyncio
-, mlflow
-, huggingface-hub
-, transformers
-, wandb
 , respx
 , scikit-image
-, ipython
-, ffmpeg
+, torch
+, tqdm
+, transformers
 , vega_datasets
-, boto3
 }:

 buildPythonPackage rec {
  pname = "gradio";
-  version = "3.20.1";
+  version = "3.43.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -64,12 +62,13 @@ buildPythonPackage rec {
  # and has more frequent releases compared to github tags
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-oG97GwehyBWjWXzDqyfj+x2mAfM6OQhYKdA3j0Rv8Vs=";
+    hash = "sha256-a8eHw8jedrse1dpgup9BL60oXx4wvOk8X5z5DP1DWOs=";
  };

-  pythonRelaxDeps = [
-    "mdit-py-plugins"
-  ];
+  # fix packaging.ParserSyntaxError, which can't handle comments
+  postPatch = ''
+    sed -ie "s/ #.*$//g" requirements*.txt
+  '';

  nativeBuildInputs = [
    pythonRelaxDepsHook
@ -79,55 +78,52 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
-    setuptools # needs pkg_resources
+    setuptools # needed for 'pkg_resources'
    aiofiles
-    aiohttp
    altair
    fastapi
    ffmpy
-    markdown-it-py
-    mdit-py-plugins
+    gradio-client
+    httpx
+    huggingface-hub
+    importlib-resources
+    jinja2
    markupsafe
    matplotlib
    numpy
    orjson
+    packaging
    pandas
    pillow
-    pycryptodome
+    pydantic
    python-multipart
    pydub
    pyyaml
    requests
-    uvicorn
-    jinja2
-    fsspec
-    httpx
-    pydantic
-    websockets
+    semantic-version
    typing-extensions
-  ] ++ markdown-it-py.optional-dependencies.linkify;
+    uvicorn
+    websockets
+  ];

  nativeCheckInputs = [
    pytestCheckHook
+    boto3
+    ffmpeg
+    ipython
    pytest-asyncio
-    mlflow
-    #comet-ml # FIXME: enable once packaged
-    huggingface-hub
-    transformers
-    wandb
    respx
    scikit-image
-    ipython
-    ffmpeg
-    vega_datasets
-    boto3
    # shap is needed as well, but breaks too often
+    torch
+    tqdm
+    transformers
+    vega_datasets
  ];

  # Add a pytest hook skipping tests that access network, marking them as "Expected fail" (xfail).
  # We additionally xfail FileNotFoundError, since the gradio devs often fail to upload test assets to pypi.
-  preCheck = let
-  in ''
+  preCheck = ''
    export HOME=$TMPDIR
    cat ${./conftest-skip-network-errors.py} >> test/conftest.py
  '';
@ -136,9 +132,8 @@ buildPythonPackage rec {
    # Actually broken
    "test_mount_gradio_app"

-    # FIXME: enable once comet-ml is packaged
-    "test_inline_display"
-    "test_integration_comet"
+    # requires network, it caught our xfail exception
+    "test_error_analytics_successful"

    # Flaky, tries to pin dependency behaviour. Sensitive to dep versions
    # These error only affect downstream use of the check dependencies.
@ -156,12 +151,16 @@ buildPythonPackage rec {
    # makes pytest freeze 50% of the time
    "test/test_interfaces.py"
  ];
-  #pytestFlagsArray = [ "-x" "-W" "ignore" ]; # uncomment for debugging help
+  pytestFlagsArray = [
+    "-x"  # abort on first failure
+    #"-m" "not flaky" # doesn't work, even when advertised
+    #"-W" "ignore" # uncomment for debugging help
+  ];

  # check the binary works outside the build env
  doInstallCheck = true;
  postInstallCheck = ''
-    env --ignore-environment $out/bin/gradio --help >/dev/null
+    env --ignore-environment $out/bin/gradio environment >/dev/null
  '';

  pythonImportsCheck = [ "gradio" ];
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@ -8,12 +8,12 @@

 buildPythonPackage rec {
  pname = "grpcio-reflection";
-  version = "1.56.2";
+  version = "1.58.0";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-dKgXZq9jmrjxt/WVMdyBRkD0obzwEtwGzmviBbUKOUw=";
+    hash = "sha256-5gSKdY0XtsoXBSWOfuXZJtKWCpWuCLoJKd0jPlBazT0=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/ipyvue/default.nix
+++ b/pkgs/development/python-modules/ipyvue/default.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "ipyvue";
-  version = "1.10.0";
+  version = "1.10.1";

  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-XPmrGg0SCTiZKMeTCeJywuKaa5ByY9FQTBy+THSJSiQ=";
+    hash = "sha256-IGFc6GulFs8Leq2EzGB+TiyRBCMulUzQ7MvzNTCl4dQ=";
  };

  propagatedBuildInputs = [ ipywidgets ];
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "phonenumbers";
-  version = "8.13.19";
+  version = "8.13.20";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-OBgCR2lyQMzt103sS/vbwiuxCLnF+ZHycMo+QTleb5Y=";
+    hash = "sha256-vys1qAbTeXnlNhEJQp2kbZoEflnZr5hjnXM8g059qyI=";
  };

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/pydiscourse/default.nix
+++ b/pkgs/development/python-modules/pydiscourse/default.nix
@ -1,14 +1,16 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pytest-mock
+, pytestCheckHook
 , pythonOlder
 , requests
-, unittestCheckHook
+, requests-mock
 }:

 buildPythonPackage rec {
  pname = "pydiscourse";
-  version = "1.4.0";
+  version = "1.6.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +19,7 @@ buildPythonPackage rec {
    owner = "pydiscourse";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-peDkXRcD/ieWYWXqv8hPxTSNRXBHcb/3sj/JJSF2RYg=";
+    hash = "sha256-BvVKOfc/PiAnkEnH5jsd8/0owr+ZvJIz/tpZx6K0fP0=";
  };

  propagatedBuildInputs = [
@ -25,7 +27,9 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
-    unittestCheckHook
+    pytest-mock
+    pytestCheckHook
+    requests-mock
  ];

  pythonImportsCheck = [
--- a/pkgs/development/tools/apko/default.nix
+++ b/pkgs/development/tools/apko/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "apko";
-  version = "0.8.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "chainguard-dev";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-02W9YOnV/zXopH3C9UNKu5gepNVS2gzoGa10uaKYu94=";
+    hash = "sha256-Dyu/cPoYI8dm/p/91oL5g8ilz9ksw4i0opsPT6rGztc=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -24,7 +24,7 @@ buildGoModule rec {
      find "$out" -name .git -print0 | xargs -0 rm -rf
    '';
  };
-  vendorHash = "sha256-h1uAAL3FBskx6Qv9E5WY+UPeXK49WW/hFoNN4QyKevU=";
+  vendorHash = "sha256-Jsp4rGIltszpQe05S3W+UFzPxhb6N5lCzUaZWBkXNWY=";

  nativeBuildInputs = [ installShellFiles ];

@ -45,6 +45,8 @@ buildGoModule rec {
    # networking required to fetch alpine-keys
    # pulled out into a separate library next release
    "-skip=TestInitDB"
+    # fails to build image on read-only filesystem
+    "-skip=TestPublish"
  ];

  postInstall = ''
--- a/pkgs/development/tools/build-managers/moon/default.nix
+++ b/pkgs/development/tools/build-managers/moon/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "moon";
-  version = "1.13.0";
+  version = "1.13.3";

  src = fetchFromGitHub {
    owner = "moonrepo";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-iCopvHLbOepgsMFn//kfIdNZtAN7kqzZ1lVXcIGAAso=";
+    hash = "sha256-br3MRV2QTDHkRUdmv9s09aiPNfQtpwGBpS4Uk5tNbg8=";
  };

-  cargoHash = "sha256-pEx7dszYfFxCGokkEbpNjoE1KsXo2r6t6FGLBXMZGwo=";
+  cargoHash = "sha256-2YsAVgBL3QUKCa5BN9KOWgBwITigDmifI+GhLj5j2W4=";

  env = {
    RUSTFLAGS = "-C strip=symbols";
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "clj-kondo";
-  version = "2023.07.13";
+  version = "2023.09.07";

  src = fetchurl {
    url = "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-QldjFSUDZAafIzJCQGm9EKq8sVDGiyDsWpGVTYtWNTk=";
+    sha256 = "sha256-F7ePdITYKkGB6nsR3EFJ7zLDCUoT0g3i+AAjXzBd624=";
  };

  extraNativeImageBuildArgs = [
--- a/pkgs/development/tools/redisinsight/default.nix
+++ b/pkgs/development/tools/redisinsight/default.nix
@ -22,28 +22,28 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "redisinsight-electron";
-  version = "2.30.0";
+  version = "2.32";

  src = fetchFromGitHub {
    owner = "RedisInsight";
    repo = "RedisInsight";
    rev = "${finalAttrs.version}";
-    hash = "sha256-TzqbMycKcOlUSKvfghip/KdMRiwstkFP+iJG5/9JVlA=";
+    hash = "sha256-esaH10AyEooym/62F5LJL7oP5UmD6T2UX8g/9QniL9s=";
  };

  offlineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
-    sha256 = "sha256-aDr5wxM/Rp3Tj09nPpLPJHSG5A73+4rAfrMCcxCr7so=";
+    sha256 = "NHKttywAaWAYkciGzYCnm1speHrWsv1t+dxL1DZgM7o=";
  };

  feOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/redisinsight/yarn.lock";
-    sha256 = "sha256-O+8lNDrqPdxE+tgjpKbgm9Q66VlJaJgZRHlNyaFkumM=";
+    sha256 = "1S1KNUOtmywQ0eyqVS2oRlhpjcL9eps8CR7AtC9ujSU=";
  };

  apiOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/redisinsight/api/yarn.lock";
-    sha256 = "sha256-2Tvck+9MDj6s+7jehUEyPfJiFFxbMOYDFD/Qgt2En6c=";
+    sha256 = "P99+1Dhdg/vznC2KepPrVGNlrofJFydXkZVxgwprIx4=";
  };

  nativeBuildInputs = [ yarn fixup_yarn_lock nodejs makeWrapper python3 nest-cli libsass pkg-config ]
--- a/pkgs/development/tools/rust/cargo-run-bin/default.nix
+++ b/pkgs/development/tools/rust/cargo-run-bin/default.nix
@ -5,14 +5,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-run-bin";
-  version = "1.1.5";
+  version = "1.2.0";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-YCWjdY8feiqU4/bOn19qbY8YiKa3SvFImvH0wDKXOhI=";
+    hash = "sha256-roeim5enxqklJOW7Qqr+Gci5lUIOW9kn3tlCm8qrEJk=";
  };

-  cargoSha256 = "sha256-mNJZjEkuUwo/aqyotqjNj+P50dFFGaJnLQ2CyCYg/1Y=";
+  cargoHash = "sha256-A/HlFse2wWOH85oZQvlRaePdF/4YfSL3qroDYGwwi9U=";

  # multiple impurities in tests
  doCheck = false;
--- a/pkgs/development/tools/rust/cargo-xbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-xbuild/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-xbuild";
-  version = "0.6.5";
+  version = "0.6.6";

  src = fetchFromGitHub {
    owner = "rust-osdev";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-bnceN47OFGlxs3ibcKoZFjoTgXRQxA2ZqxnthJ/fsqE=";
+    hash = "sha256-29rCjmzxxIjR5nBN2J3xxP+r8NnPIJV90FkSQQEBbo4=";
  };

-  cargoSha256 = "sha256-qMPJC61ZVW9olMgNnGrvcQ/je4se4J5gOVoaOpNMUo8=";
+  cargoHash = "sha256-tyPhKWDSDNxQy+vpWNS5VP5D8TkUR7MJSAlG8wZsDy4=";

  meta = with lib; {
    description = "Automatically cross-compiles the sysroot crates core, compiler_builtins, and alloc";
--- a/pkgs/servers/audiobookshelf/default.nix
+++ b/pkgs/servers/audiobookshelf/default.nix
@ -1,4 +1,17 @@
-{ lib, stdenv, pkgs, fetchFromGitHub, runCommand, buildNpmPackage, nodejs_18, tone, ffmpeg-full, util-linux, python3 }:
+{
+  lib,
+  stdenv,
+  pkgs,
+  fetchFromGitHub,
+  runCommand,
+  buildNpmPackage,
+  nodejs_18,
+  tone,
+  ffmpeg-full,
+  util-linux,
+  python3,
+  getopt
+}:

 let
  nodejs = nodejs_18;
@ -28,7 +41,7 @@ let
  };

  wrapper = import ./wrapper.nix {
-    inherit stdenv ffmpeg-full tone pname nodejs;
+    inherit stdenv ffmpeg-full tone pname nodejs getopt;
  };

 in buildNpmPackage {
--- a/pkgs/servers/audiobookshelf/wrapper.nix
+++ b/pkgs/servers/audiobookshelf/wrapper.nix
@ -1,4 +1,4 @@
-{ stdenv, ffmpeg-full, tone, pname, nodejs }: ''
+{ stdenv, ffmpeg-full, tone, pname, nodejs, getopt }: ''
    #!${stdenv.shell}

    port=8000
@ -7,7 +7,7 @@
    metadata=$(pwd)/metadata

    LONGOPTS=host:,port:,config:,metadata:,help
-    args=$(getopt -l "$LONGOPTS" -o h -- "$@")
+    args=$(${getopt}/bin/getopt -l "$LONGOPTS" -o h -- "$@")

    eval set -- "$args"

@ -44,7 +44,7 @@
          ;;
        --help|-h)
          echo "Usage: audiobookshelf [--host <host>] [--port <port>] [--metadata <dir>] [--config <dir>]"
-          shift
+          exit 0
          ;;
      esac
      shift
--- a/pkgs/servers/monitoring/alertmanager-bot/default.nix
+++ b/pkgs/servers/monitoring/alertmanager-bot/default.nix
@ -1,35 +0,0 @@
-{ lib, buildGoModule, fetchFromGitHub }:
-
-buildGoModule rec {
-  pname = "alertmanager-bot";
-  version = "0.4.3";
-
-  src = fetchFromGitHub {
-    owner = "metalmatze";
-    repo = pname;
-    rev = version;
-    sha256 = "1hjfkksqb675gabzjc221b33h2m4s6qsanmkm382d3fyzqj71dh9";
-  };
-
-  vendorSha256 = null; #vendorSha256 = "";
-
-  postPatch = ''
-    sed "s;/templates/default.tmpl;$out/share&;" -i cmd/alertmanager-bot/main.go
-  '';
-
-  ldflags = [
-    "-s" "-w" "-X main.Version=v${version}" "-X main.Revision=${src.rev}"
-  ];
-
-  postInstall = ''
-    install -Dm644 -t $out/share/templates $src/default.tmpl
-  '';
-
-  meta = with lib; {
-    description = "Bot for Prometheus' Alertmanager";
-    homepage = "https://github.com/metalmatze/alertmanager-bot";
-    license = licenses.mit;
-    maintainers = with maintainers; [ mmahut ];
-    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.goModules --check
-  };
-}
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  pname = "redis";
-  version = "7.2.0";
+  version = "7.2.1";

  src = fetchurl {
    url = "https://download.redis.io/releases/${pname}-${version}.tar.gz";
-    hash = "sha256-ixLiQmR2NbQZoOGDPtoCtlv2TjnrnlCdnbSIj7MSSUM=";
+    hash = "sha256-XHbZkKGxxflJvNHu2Q0Mik9wNpvb3LQCiMVh3fiJZ6Q=";
  };

  patches = lib.optionals useSystemJemalloc [
--- a/pkgs/tools/admin/okta-aws-cli/default.nix
+++ b/pkgs/tools/admin/okta-aws-cli/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "okta-aws-cli";
-  version = "1.2.1";
+  version = "1.2.2";

  subPackages = [ "cmd/okta-aws-cli" ];

@ -10,7 +10,7 @@ buildGoModule rec {
    owner  = "okta";
    repo   = "okta-aws-cli";
    rev    = "v${version}";
-    sha256 = "1d148zf9warwg8kvkqpw79dwmlrab61hpird58wlh6jyqfxa5729";
+    sha256 = "sha256-GF+2xPoc9dztB7w6pOLwiZ6D9b4P1YEJrZxL33j4aew=";
  };

  vendorHash = "sha256-AJmQxMRj602yodzIdhZV+R22KxnEIbT9iSz/5G5T6r8=";
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@ -9,14 +9,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "2.85";
+  version = "2.86";
  pname = "asymptote";

  src = fetchFromGitHub {
    owner = "vectorgraphics";
    repo = pname;
    rev = version;
-    hash = "sha256-GyW9OEolV97WtrSdIxp4MCP3JIyA1c/DQSqg8jLC0WQ=";
+    hash = "sha256-Bk8/WIQTfrbOo9b2hw580vJwiK6P1OBV5HMqMH+LkuE=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/misc/coreboot-utils/default.nix
+++ b/pkgs/tools/misc/coreboot-utils/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchgit, pkg-config, zlib, pciutils, openssl, coreutils, acpica-tools, makeWrapper, gnugrep, gnused, file, buildEnv }:

 let
-  version = "4.20";
+  version = "4.21";

  commonMeta = with lib; {
    description = "Various coreboot-related tools";
@ -16,8 +16,8 @@ let

    src = fetchgit {
      url = "https://review.coreboot.org/coreboot";
-      rev = "465fbbe93ee01b4576689a90b7ddbeec23cdace2";
-      sha256 = "sha256-DPaudCeK9SKu2eN1fad6a52ICs5d/GXCUFMdqAl65BE=";
+      rev = "c1386ef6128922f49f93de5690ccd130a26eecf2";
+      sha256 = "sha256-n/bo3hoY7DEP103ftWu3uCLFXEsz+F9rWS22kcF7Ah8=";
    };

    enableParallelBuilding = true;
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@ -102,7 +102,7 @@ stdenv.mkDerivation rec {

    license = "https://www.sudo.ws/sudo/license.html";

-    maintainers = with lib.maintainers; [ eelco delroth ];
+    maintainers = with lib.maintainers; [ delroth ];

    platforms = lib.platforms.linux;
  };
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "vale";
-  version = "2.28.2";
+  version = "2.28.3";

  subPackages = [ "cmd/vale" ];
  outputs = [ "out" "data" ];
@ -11,10 +11,10 @@ buildGoModule rec {
    owner = "errata-ai";
    repo = "vale";
    rev = "v${version}";
-    hash = "sha256-T5CV7IlyZUfl3qUIUaLaisnFJ5fQ0de0KGQvuINx7TY=";
+    hash = "sha256-uRQGTVEueIe7tk0jd25V2MIBBxbWmXLYDu2lCofq/uY=";
  };

-  vendorHash = "sha256-KB1mRWDYejc38tUv316MiGfmq2riNnpEMIUpjgfSasU=";
+  vendorHash = "sha256-YUazrbTeioRV+L6Ku+oJRJzp16WCLPzlAH6F25TT6Dg=";

  postInstall = ''
    mkdir -p $data/share/vale
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -68,6 +68,7 @@ mapAliases ({
  aircrackng = throw "'aircrackng' has been renamed to/replaced by 'aircrack-ng'"; # Converted to throw 2022-02-22
  airfield = throw "airfield has been removed due to being unmaintained"; # Added 2023-05-19
  airtame = throw "airtame has been removed due to being unmaintained"; # Added 2022-01-19
+  alertmanager-bot = throw "alertmanager-bot is broken and has been archived by upstream" ; # Added 2023-07-28
  aleth = throw "aleth (previously packaged as cpp_ethereum) has been removed; abandoned upstream"; # Added 2020-11-30
  aliza = throw "aliza has been removed, because it depended on qt4 and was unmaintained in nixpkgs"; # Added 2022-05-12
  alsaLib = alsa-lib; # Added 2021-06-09
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -5762,6 +5762,8 @@ with pkgs;

  joystickwake = callPackage ../tools/games/joystickwake { };

+  juce = darwin.apple_sdk_11_0.callPackage ../development/misc/juce { };
+
  jumppad = callPackage ../tools/virtualization/jumppad { };

  jwt-cli = callPackage ../tools/security/jwt-cli {
@ -27786,8 +27788,6 @@ with pkgs;

  alfred = callPackage ../os-specific/linux/batman-adv/alfred.nix { };

-  alertmanager-bot = callPackage ../servers/monitoring/alertmanager-bot { };
-
  alertmanager-irc-relay = callPackage ../servers/monitoring/alertmanager-irc-relay { };

  tinyalsa = callPackage ../os-specific/linux/tinyalsa { };
@ -34287,6 +34287,8 @@ with pkgs;

  nwg-launchers = callPackage ../applications/misc/nwg-launchers { };

+  nwg-look = callPackage ../applications/misc/nwg-look { };
+
  nwg-menu = callPackage ../applications/misc/nwg-menu { };

  nwg-panel = callPackage ../applications/misc/nwg-panel { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -4581,6 +4581,8 @@ self: super: with self; {

  gradio = callPackage ../development/python-modules/gradio { };

+  gradio-client = callPackage ../development/python-modules/gradio/client.nix { };
+
  grammalecte = callPackage ../development/python-modules/grammalecte { };

  grandalf = callPackage ../development/python-modules/grandalf { };