Merge master into staging-next

maintainers/scripts/update-octave-packages

@@ -0,0 +1,468 @@
+#!/usr/bin/env nix-shell
+#!nix-shell update-octave-shell.nix -i python3
+
+"""
+Update a Octave package expression by passing in the `.nix` file, or the directory containing it.
+You can pass in multiple files or paths.
+
+You'll likely want to use
+``
+  $ ./update-octave-libraries ../../pkgs/development/octave-modules/**/default.nix
+``
+to update all non-pinned libraries in that folder.
+"""
+
+import argparse
+import os
+import pathlib
+import re
+import requests
+import yaml
+from concurrent.futures import ThreadPoolExecutor as Pool
+from packaging.version import Version as _Version
+from packaging.version import InvalidVersion
+from packaging.specifiers import SpecifierSet
+import collections
+import subprocess
+import tempfile
+
+INDEX = "https://raw.githubusercontent.com/gnu-octave/packages/main/packages"
+"""url of Octave packages' source on GitHub"""
+
+EXTENSIONS = ['tar.gz', 'tar.bz2', 'tar', 'zip']
+"""Permitted file extensions. These are evaluated from left to right and the first occurance is returned."""
+
+PRERELEASES = False
+
+GIT = "git"
+
+NIXPGKS_ROOT = subprocess.check_output(["git", "rev-parse", "--show-toplevel"]).decode('utf-8').strip()
+
+import logging
+logging.basicConfig(level=logging.INFO)
+
+
+class Version(_Version, collections.abc.Sequence):
+
+    def __init__(self, version):
+        super().__init__(version)
+        # We cannot use `str(Version(0.04.21))` because that becomes `0.4.21`
+        # https://github.com/avian2/unidecode/issues/13#issuecomment-354538882
+        self.raw_version = version
+
+    def __getitem__(self, i):
+        return self._version.release[i]
+
+    def __len__(self):
+        return len(self._version.release)
+
+    def __iter__(self):
+        yield from self._version.release
+
+
+def _get_values(attribute, text):
+    """Match attribute in text and return all matches.
+
+    :returns: List of matches.
+    """
+    regex = '{}\s+=\s+"(.*)";'.format(attribute)
+    regex = re.compile(regex)
+    values = regex.findall(text)
+    return values
+
+def _get_unique_value(attribute, text):
+    """Match attribute in text and return unique match.
+
+    :returns: Single match.
+    """
+    values = _get_values(attribute, text)
+    n = len(values)
+    if n > 1:
+        raise ValueError("found too many values for {}".format(attribute))
+    elif n == 1:
+        return values[0]
+    else:
+        raise ValueError("no value found for {}".format(attribute))
+
+def _get_line_and_value(attribute, text):
+    """Match attribute in text. Return the line and the value of the attribute."""
+    regex = '({}\s+=\s+"(.*)";)'.format(attribute)
+    regex = re.compile(regex)
+    value = regex.findall(text)
+    n = len(value)
+    if n > 1:
+        raise ValueError("found too many values for {}".format(attribute))
+    elif n == 1:
+        return value[0]
+    else:
+        raise ValueError("no value found for {}".format(attribute))
+
+
+def _replace_value(attribute, value, text):
+    """Search and replace value of attribute in text."""
+    old_line, old_value = _get_line_and_value(attribute, text)
+    new_line = old_line.replace(old_value, value)
+    new_text = text.replace(old_line, new_line)
+    return new_text
+
+
+def _fetch_page(url):
+    r = requests.get(url)
+    if r.status_code == requests.codes.ok:
+        return list(yaml.safe_load_all(r.content))[0]
+    else:
+        raise ValueError("request for {} failed".format(url))
+
+
+def _fetch_github(url):
+    headers = {}
+    token = os.environ.get('GITHUB_API_TOKEN')
+    if token:
+        headers["Authorization"] = f"token {token}"
+    r = requests.get(url, headers=headers)
+
+    if r.status_code == requests.codes.ok:
+        return r.json()
+    else:
+        raise ValueError("request for {} failed".format(url))
+
+
+SEMVER = {
+    'major' : 0,
+    'minor' : 1,
+    'patch' : 2,
+}
+
+
+def _determine_latest_version(current_version, target, versions):
+    """Determine latest version, given `target`, returning the more recent version.
+    """
+    current_version = Version(current_version)
+
+    def _parse_versions(versions):
+        for v in versions:
+            try:
+                yield Version(v)
+            except InvalidVersion:
+                pass
+
+    versions = _parse_versions(versions)
+
+    index = SEMVER[target]
+
+    ceiling = list(current_version[0:index])
+    if len(ceiling) == 0:
+        ceiling = None
+    else:
+        ceiling[-1]+=1
+        ceiling = Version(".".join(map(str, ceiling)))
+
+    # We do not want prereleases
+    versions = SpecifierSet(prereleases=PRERELEASES).filter(versions)
+
+    if ceiling is not None:
+        versions = SpecifierSet(f"<{ceiling}").filter(versions)
+
+    return (max(sorted(versions))).raw_version
+
+
+def _get_latest_version_octave_packages(package, extension, current_version, target):
+    """Get latest version and hash from Octave Packages."""
+    url = "{}/{}.yaml".format(INDEX, package)
+    yaml = _fetch_page(url)
+
+    versions = list(map(lambda pv: pv['id'], yaml['versions']))
+    version = _determine_latest_version(current_version, target, versions)
+
+    try:
+        releases = [v if v['id'] == version else None for v in yaml['versions']]
+    except KeyError as e:
+        raise KeyError('Could not find version {} for {}'.format(version, package)) from e
+    for release in releases:
+        if release['url'].endswith(extension):
+            sha256 = release['sha256']
+            break
+    else:
+        sha256 = None
+    return version, sha256, None
+
+
+def _get_latest_version_github(package, extension, current_version, target):
+    def strip_prefix(tag):
+        return re.sub("^[^0-9]*", "", tag)
+
+    def get_prefix(string):
+        matches = re.findall(r"^([^0-9]*)", string)
+        return next(iter(matches), "")
+
+    # when invoked as an updateScript, UPDATE_NIX_ATTR_PATH will be set
+    # this allows us to work with packages which live outside of octave-modules
+    attr_path = os.environ.get("UPDATE_NIX_ATTR_PATH", f"octavePackages.{package}")
+    try:
+        homepage = subprocess.check_output(
+            ["nix", "eval", "-f", f"{NIXPGKS_ROOT}/default.nix", "--raw", f"{attr_path}.src.meta.homepage"])\
+            .decode('utf-8')
+    except Exception as e:
+        raise ValueError(f"Unable to determine homepage: {e}")
+    owner_repo = homepage[len("https://github.com/"):]  # remove prefix
+    owner, repo = owner_repo.split("/")
+
+    url = f"https://api.github.com/repos/{owner}/{repo}/releases"
+    all_releases = _fetch_github(url)
+    releases = list(filter(lambda x: not x['prerelease'], all_releases))
+
+    if len(releases) == 0:
+        raise ValueError(f"{homepage} does not contain any stable releases")
+
+    versions = map(lambda x: strip_prefix(x['tag_name']), releases)
+    version = _determine_latest_version(current_version, target, versions)
+
+    release = next(filter(lambda x: strip_prefix(x['tag_name']) == version, releases))
+    prefix = get_prefix(release['tag_name'])
+    try:
+        sha256 = subprocess.check_output(["nix-prefetch-url", "--type", "sha256", "--unpack", f"{release['tarball_url']}"], stderr=subprocess.DEVNULL)\
+            .decode('utf-8').strip()
+    except:
+        # this may fail if they have both a branch and a tag of the same name, attempt tag name
+        tag_url = str(release['tarball_url']).replace("tarball","tarball/refs/tags")
+        sha256 = subprocess.check_output(["nix-prefetch-url", "--type", "sha256", "--unpack", tag_url], stderr=subprocess.DEVNULL)\
+            .decode('utf-8').strip()
+
+
+    return version, sha256, prefix
+
+def _get_latest_version_git(package, extension, current_version, target):
+    """NOTE: Unimplemented!"""
+    # attr_path = os.environ.get("UPDATE_NIX_ATTR_PATH", f"octavePackages.{package}")
+    # try:
+    #     download_url = subprocess.check_output(
+    #         ["nix", "--extra-experimental-features", "nix-command", "eval", "-f", f"{NIXPGKS_ROOT}/default.nix", "--raw", f"{attr_path}.src.url"])\
+    #         .decode('utf-8')
+    # except Exception as e:
+    #     raise ValueError(f"Unable to determine download link: {e}")
+
+    # with tempfile.TemporaryDirectory(prefix=attr_path) as new_clone_location:
+    #     subprocess.run(["git", "clone", download_url, new_clone_location])
+    #     newest_commit = subprocess.check_output(
+    #         ["git" "rev-parse" "$(git branch -r)" "|" "tail" "-n" "1"]).decode('utf-8')
+    pass
+
+
+FETCHERS = {
+    'fetchFromGitHub'   :   _get_latest_version_github,
+    'fetchurl'          :   _get_latest_version_octave_packages,
+    'fetchgit'          :   _get_latest_version_git,
+}
+
+
+DEFAULT_SETUPTOOLS_EXTENSION = 'tar.gz'
+
+
+FORMATS = {
+    'setuptools'        :   DEFAULT_SETUPTOOLS_EXTENSION,
+}
+
+def _determine_fetcher(text):
+    # Count occurrences of fetchers.
+    nfetchers = sum(text.count('src = {}'.format(fetcher)) for fetcher in FETCHERS.keys())
+    if nfetchers == 0:
+        raise ValueError("no fetcher.")
+    elif nfetchers > 1:
+        raise ValueError("multiple fetchers.")
+    else:
+        # Then we check which fetcher to use.
+        for fetcher in FETCHERS.keys():
+            if 'src = {}'.format(fetcher) in text:
+                return fetcher
+
+
+def _determine_extension(text, fetcher):
+    """Determine what extension is used in the expression.
+
+    If we use:
+    - fetchPypi, we check if format is specified.
+    - fetchurl, we determine the extension from the url.
+    - fetchFromGitHub we simply use `.tar.gz`.
+    """
+    if fetcher == 'fetchurl':
+        url = _get_unique_value('url', text)
+        extension = os.path.splitext(url)[1]
+
+    elif fetcher == 'fetchFromGitHub' or fetcher == 'fetchgit':
+        if "fetchSubmodules" in text:
+            raise ValueError("fetchFromGitHub fetcher doesn't support submodules")
+        extension = "tar.gz"
+
+    return extension
+
+
+def _update_package(path, target):
+
+    # Read the expression
+    with open(path, 'r') as f:
+        text = f.read()
+
+    # Determine pname. Many files have more than one pname
+    pnames = _get_values('pname', text)
+
+    # Determine version.
+    version = _get_unique_value('version', text)
+
+    # First we check how many fetchers are mentioned.
+    fetcher = _determine_fetcher(text)
+
+    extension = _determine_extension(text, fetcher)
+
+    # Attempt a fetch using each pname, e.g. backports-zoneinfo vs backports.zoneinfo
+    successful_fetch = False
+    for pname in pnames:
+        if fetcher == "fetchgit":
+            logging.warning(f"You must update {pname} MANUALLY!")
+            return { 'path': path, 'target': target, 'pname': pname,
+                     'old_version': version, 'new_version': version }
+        try:
+            new_version, new_sha256, prefix = FETCHERS[fetcher](pname, extension, version, target)
+            successful_fetch = True
+            break
+        except ValueError:
+            continue
+
+    if not successful_fetch:
+        raise ValueError(f"Unable to find correct package using these pnames: {pnames}")
+
+    if new_version == version:
+        logging.info("Path {}: no update available for {}.".format(path, pname))
+        return False
+    elif Version(new_version) <= Version(version):
+        raise ValueError("downgrade for {}.".format(pname))
+    if not new_sha256:
+        raise ValueError("no file available for {}.".format(pname))
+
+    text = _replace_value('version', new_version, text)
+    # hashes from pypi are 16-bit encoded sha256's, normalize it to sri to avoid merge conflicts
+    # sri hashes have been the default format since nix 2.4+
+    sri_hash = subprocess.check_output(["nix", "--extra-experimental-features", "nix-command", "hash", "to-sri", "--type", "sha256", new_sha256]).decode('utf-8').strip()
+
+
+    # fetchers can specify a sha256, or a sri hash
+    try:
+        text = _replace_value('sha256', sri_hash, text)
+    except ValueError:
+        text = _replace_value('hash', sri_hash, text)
+
+    if fetcher == 'fetchFromGitHub':
+        # in the case of fetchFromGitHub, it's common to see `rev = version;` or `rev = "v${version}";`
+        # in which no string value is meant to be substituted. However, we can just overwrite the previous value.
+        regex = '(rev\s+=\s+[^;]*;)'
+        regex = re.compile(regex)
+        matches = regex.findall(text)
+        n = len(matches)
+
+        if n == 0:
+            raise ValueError("Unable to find rev value for {}.".format(pname))
+        else:
+            # forcefully rewrite rev, incase tagging conventions changed for a release
+            match = matches[0]
+            text = text.replace(match, f'rev = "refs/tags/{prefix}${{version}}";')
+            # incase there's no prefix, just rewrite without interpolation
+            text = text.replace('"${version}";', 'version;')
+
+    with open(path, 'w') as f:
+        f.write(text)
+
+        logging.info("Path {}: updated {} from {} to {}".format(path, pname, version, new_version))
+
+    result = {
+        'path'  : path,
+        'target': target,
+        'pname': pname,
+        'old_version'   : version,
+        'new_version'   : new_version,
+        #'fetcher'       : fetcher,
+        }
+
+    return result
+
+
+def _update(path, target):
+
+    # We need to read and modify a Nix expression.
+    if os.path.isdir(path):
+        path = os.path.join(path, 'default.nix')
+
+    # If a default.nix does not exist, we quit.
+    if not os.path.isfile(path):
+        logging.info("Path {}: does not exist.".format(path))
+        return False
+
+    # If file is not a Nix expression, we quit.
+    if not path.endswith(".nix"):
+        logging.info("Path {}: does not end with `.nix`.".format(path))
+        return False
+
+    try:
+        return _update_package(path, target)
+    except ValueError as e:
+        logging.warning("Path {}: {}".format(path, e))
+        return False
+
+
+def _commit(path, pname, old_version, new_version, pkgs_prefix="octave: ", **kwargs):
+    """Commit result.
+    """
+
+    msg = f'{pkgs_prefix}{pname}: {old_version} -> {new_version}'
+
+    try:
+        subprocess.check_call([GIT, 'add', path])
+        subprocess.check_call([GIT, 'commit', '-m', msg])
+    except subprocess.CalledProcessError as e:
+        subprocess.check_call([GIT, 'checkout', path])
+        raise subprocess.CalledProcessError(f'Could not commit {path}') from e
+
+    return True
+
+
+def main():
+
+    epilog = """
+environment variables:
+  GITHUB_API_TOKEN\tGitHub API token used when updating github packages
+    """
+    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter, epilog=epilog)
+    parser.add_argument('package', type=str, nargs='+')
+    parser.add_argument('--target', type=str, choices=SEMVER.keys(), default='major')
+    parser.add_argument('--commit', action='store_true', help='Create a commit for each package update')
+    parser.add_argument('--use-pkgs-prefix', action='store_true', help='Use octavePackages.${pname}: instead of octave: ${pname}: when making commits')
+
+    args = parser.parse_args()
+    target = args.target
+
+    packages = list(map(os.path.abspath, args.package))
+
+    logging.info("Updating packages...")
+
+    # Use threads to update packages concurrently
+    with Pool() as p:
+        results = list(filter(bool, p.map(lambda pkg: _update(pkg, target), packages)))
+
+    logging.info("Finished updating packages.")
+
+    commit_options = {}
+    if args.use_pkgs_prefix:
+        logging.info("Using octavePackages. prefix for commits")
+        commit_options["pkgs_prefix"] = "octavePackages."
+
+    # Commits are created sequentially.
+    if args.commit:
+        logging.info("Committing updates...")
+        # list forces evaluation
+        list(map(lambda x: _commit(**x, **commit_options), results))
+        logging.info("Finished committing updates")
+
+    count = len(results)
+    logging.info("{} package(s) updated".format(count))
+
+
+if __name__ == '__main__':
+    main()

maintainers/scripts/update-octave-shell.nix

@@ -0,0 +1,12 @@
+{ nixpkgs ? import ../.. { }
+}:
+with nixpkgs;
+let
+  pyEnv = python3.withPackages(ps: with ps; [ packaging requests toolz pyyaml ]);
+in
+mkShell {
+  packages = [
+    pyEnv
+    nix-prefetch-scripts
+  ];
+}

nixos/modules/config/zram.nix

@@ -82,12 +82,30 @@ in
           {command}`cat /sys/class/block/zram*/comp_algorithm`
         '';
       };
+
+      writebackDevice = lib.mkOption {
+        default = null;
+        example = "/dev/zvol/tarta-zoot/swap-writeback";
+        type = lib.types.nullOr lib.types.path;
+        description = lib.mdDoc ''
+          Write incompressible pages to this device,
+          as there's no gain from keeping them in RAM.
+        '';
+      };
     };
 
   };
 
   config = lib.mkIf cfg.enable {
 
+    assertions = [
+      {
+        assertion = cfg.writebackDevice == null || cfg.swapDevices <= 1;
+        message = "A single writeback device cannot be shared among multiple zram devices";
+      }
+    ];
+
+
     system.requiredKernelConfig = with config.lib.kernelConfig; [
       (isModule "ZRAM")
     ];
@@ -112,6 +130,8 @@ in
                 zram-size = if cfg.memoryMax != null then "min(${size}, ${toString cfg.memoryMax} / 1024 / 1024)" else size;
                 compression-algorithm = cfg.algorithm;
                 swap-priority = cfg.priority;
+              } // lib.optionalAttrs (cfg.writebackDevice != null) {
+                writeback-device = cfg.writebackDevice;
               };
           })
           devices));

nixos/tests/all-tests.nix

@@ -488,6 +488,7 @@ in {
   nomad = handleTest ./nomad.nix {};
   non-default-filesystems = handleTest ./non-default-filesystems.nix {};
   noto-fonts = handleTest ./noto-fonts.nix {};
+  noto-fonts-cjk-qt-default-weight = handleTest ./noto-fonts-cjk-qt-default-weight.nix {};
   novacomd = handleTestOn ["x86_64-linux"] ./novacomd.nix {};
   nscd = handleTest ./nscd.nix {};
   nsd = handleTest ./nsd.nix {};

nixos/tests/noto-fonts-cjk-qt-default-weight.nix

@@ -0,0 +1,30 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "noto-fonts-cjk-qt";
+  meta.maintainers = with lib.maintainers; [ oxalica ];
+
+  nodes.machine = {
+    imports = [ ./common/x11.nix ];
+    fonts = {
+      enableDefaultFonts = false;
+      fonts = [ pkgs.noto-fonts-cjk-sans ];
+    };
+  };
+
+  testScript =
+    let
+      script = pkgs.writers.writePython3 "qt-default-weight" {
+        libraries = [ pkgs.python3Packages.pyqt6 ];
+      } ''
+        from PyQt6.QtWidgets import QApplication
+        from PyQt6.QtGui import QFont, QRawFont
+
+        app = QApplication([])
+        f = QRawFont.fromFont(QFont("Noto Sans CJK SC", 20))
+
+        assert f.styleName() == "Regular", f.styleName()
+      '';
+    in ''
+      machine.wait_for_x()
+      machine.succeed("${script}")
+    '';
+})

nixos/tests/zram-generator.nix

@@ -1,18 +1,36 @@
 import ./make-test-python.nix {
   name = "zram-generator";
 
-  nodes.machine = { ... }: {
-    zramSwap = {
-      enable = true;
-      priority = 10;
-      algorithm = "lz4";
-      swapDevices = 2;
-      memoryPercent = 30;
-      memoryMax = 10 * 1024 * 1024;
+  nodes = {
+    single = { ... }: {
+      virtualisation = {
+        emptyDiskImages = [ 512 ];
+      };
+      zramSwap = {
+        enable = true;
+        priority = 10;
+        algorithm = "lz4";
+        swapDevices = 1;
+        memoryPercent = 30;
+        memoryMax = 10 * 1024 * 1024;
+        writebackDevice = "/dev/vdb";
+      };
+    };
+    machine = { ... }: {
+      zramSwap = {
+        enable = true;
+        priority = 10;
+        algorithm = "lz4";
+        swapDevices = 2;
+        memoryPercent = 30;
+        memoryMax = 10 * 1024 * 1024;
+      };
     };
   };
 
   testScript = ''
+    single.wait_for_unit("systemd-zram-setup@zram0.service")
+
     machine.wait_for_unit("systemd-zram-setup@zram0.service")
     machine.wait_for_unit("systemd-zram-setup@zram1.service")
     zram = machine.succeed("zramctl --noheadings --raw")

pkgs/applications/editors/emacs/elisp-packages/manual-packages/mind-wave/default.nix

@@ -0,0 +1,89 @@
+{ lib
+, pkgs
+, melpaBuild
+, substituteAll
+}:
+# To use this package with emacs-overlay:
+# nixpkgs.overlays = [
+#   inputs.emacs-overlay.overlay
+#   (final: prev: {
+#     emacs30 = prev.emacsGit.overrideAttrs (old: {
+#       name = "emacs30";
+#       version = inputs.emacs-upstream.shortRev;
+#       src = inputs.emacs-upstream;
+#     });
+#     emacsWithConfig = prev.emacsWithPackagesFromUsePackage {
+#       config = let
+#         readRecursively = dir:
+#           builtins.concatStringsSep "\n"
+#           (lib.mapAttrsToList (name: value:
+#             if value == "regular"
+#             then builtins.readFile (dir + "/${name}")
+#             else
+#               (
+#                 if value == "directory"
+#                 then readRecursively (dir + "/${name}")
+#                 else []
+#               ))
+#           (builtins.readDir dir));
+#       in
+#         # your home-manager config
+#         readRecursively ./home/modules/emacs;
+#       alwaysEnsure = true;
+#       package = final.emacs30;
+#       extraEmacsPackages = epkgs: [
+#         epkgs.use-package
+#         (epkgs.melpaBuild rec {
+#           # ...
+#         })
+#       ];
+#       override = epkgs:
+#         epkgs
+#         // {
+#           # ...
+#         };
+#     };
+#   })
+# ];
+melpaBuild rec {
+  pname = "mind-wave";
+  version = "20230322.1348"; # 13:48 UTC
+  src = pkgs.fetchFromGitHub {
+    owner = "manateelazycat";
+    repo = "mind-wave";
+    rev = "2d94f553a394ce73bcb91490b81e0fc042baa8d3";
+    sha256 = "sha256-6tmcPYAEch5bX5hEHMiQGDNYEMUOvnxF1Vq0VVpBsYo=";
+  };
+  commit = "2d94f553a394ce73bcb91490b81e0fc042baa8d3";
+  # elisp dependencies
+  packageRequires = [
+    pkgs.emacsPackages.markdown-mode
+  ];
+  buildInputs = [
+    (pkgs.python3.withPackages (ps:
+      with ps; [
+        openai
+        epc
+        sexpdata
+        six
+      ]))
+  ];
+  recipe = pkgs.writeText "recipe" ''
+    (mind-wave
+    :repo "manateelazycat/mind-wave"
+    :fetcher github
+    :files
+    ("mind-wave.el"
+    "mind-wave-epc.el"
+    "mind_wave.py"
+    "utils.py"))
+  '';
+  doCheck = true;
+  passthru.updateScript = pkgs.unstableGitUpdater {};
+  meta = with lib; {
+    description = " Emacs AI plugin based on ChatGPT API ";
+    homepage = "https://github.com/manateelazycat/mind-wave";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [yuzukicat];
+  };
+}

pkgs/applications/graphics/focus-stack/default.nix

@@ -0,0 +1,32 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, which
+, ronn
+, opencv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "focus-stack";
+  version = "1.4";
+
+  src = fetchFromGitHub {
+    owner = "PetteriAimonen";
+    repo = "focus-stack";
+    rev = version;
+    hash = "sha256-SoECgBMjWI+n7H6p3hf8J5E9UCLHGiiz5WAsEEioJsU=";
+  };
+
+  nativeBuildInputs = [ pkg-config which ronn ];
+  buildInputs = [ opencv ];
+
+  makeFlags = [ "prefix=$(out)" ];
+
+  meta = with lib; {
+    description = "Fast and easy focus stacking";
+    homepage = "https://github.com/PetteriAimonen/focus-stack";
+    license = licenses.mit;
+    maintainers = with maintainers; [ paperdigits ];
+  };
+}

pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix

@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , callPackage
 , pkg-config
 , cmake
@@ -84,6 +85,16 @@ stdenv.mkDerivation rec {
     sha256 = "0c65ry82ffmh1qzc2lnsyjs78r9jllv62p9vglpz0ikg86zf36sk";
   };
 
+  patches = [
+    # the generated .desktop files contains references to unwrapped tdesktop, breaking scheme handling
+    # and the scheme handler is already registered in the packaged .desktop file, rendering this unnecessary
+    # see https://github.com/NixOS/nixpkgs/issues/218370
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/telegram-desktop/-/raw/09b363ed5a4fcd8ecc3282b9bfede5fbb83f97ef/debian/patches/Disable-register-custom-scheme.patch";
+      hash = "sha256-B8X5lnSpwwdp1HlvyXJWQPybEN+plOwimdV5gW6aY2Y=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioInputALSA.cpp \
       --replace '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'

pkgs/applications/office/appflowy/default.nix

@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "appflowy";
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchzip {
     url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${version}/AppFlowy_x86_64-unknown-linux-gnu_ubuntu-20.04.tar.gz";
-    sha256 = "sha256-WuEwhJ1YhbldFfisfUsp3GCV2vQy9oTam6BkL/7QEgI=";
+    sha256 = "sha256-H4xVUXC7cRCgC1fHMXPucGRTBlGRcyzskhNBaNVGAns=";
     stripRoot = false;
   };
 
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    mv AppFlowy/* ./
+    cd AppFlowy/
 
     mkdir -p $out/opt/
     mkdir -p $out/bin/
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     # Add missing libraries to appflowy using the ones it comes with
-    makeWrapper $out/opt/app_flowy $out/bin/appflowy \
+    makeWrapper $out/opt/AppFlowy $out/bin/appflowy \
       --set LD_LIBRARY_PATH "$out/opt/lib/" \
       --prefix PATH : "${lib.makeBinPath [ xdg-user-dirs ]}"
   '';

pkgs/applications/virtualization/podman/default.nix

@@ -145,6 +145,11 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "https://podman.io/";
     description = "A program for managing pods, containers and container images";
+    longDescription = ''
+      Podman (the POD MANager) is a tool for managing containers and images, volumes mounted into those containers, and pods made from groups of containers. Podman runs containers on Linux, but can also be used on Mac and Windows systems using a Podman-managed virtual machine. Podman is based on libpod, a library for container lifecycle management that is also contained in this repository. The libpod library provides APIs for managing containers, pods, container images, and volumes.
+
+      To install on NixOS, please use the option `virtualisation.podman.enable = true`.
+    '';
     changelog = "https://github.com/containers/podman/blob/v${version}/RELEASE_NOTES.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ marsam ] ++ teams.podman.members;

pkgs/development/interpreters/octave/build-octave-package.nix

@@ -62,13 +62,21 @@ let
   ]
   ++ nativeBuildInputs;
 
+  passthru' = {
+    updateScript = [
+      ../../../../maintainers/scripts/update-octave-packages
+      (builtins.unsafeGetAttrPos "pname" octave.pkgs.${attrs.pname}).file
+    ];
+  }
+  // passthru;
+
   # This step is required because when
   # a = { test = [ "a" "b" ]; }; b = { test = [ "c" "d" ]; };
   # (a // b).test = [ "c" "d" ];
   # This used to mean that if a package defined extra nativeBuildInputs, it
   # would override the ones for building an Octave package (the hook and Octave
   # itself, causing everything to fail.
-  attrs' = builtins.removeAttrs attrs [ "nativeBuildInputs" ];
+  attrs' = builtins.removeAttrs attrs [ "nativeBuildInputs" "passthru" ];
 
 in stdenv.mkDerivation ({
   packageName = "${fullLibName}";
@@ -121,5 +129,7 @@ in stdenv.mkDerivation ({
   # together with Octave.
   dontInstall = true;
 
+  passthru = passthru';
+
   inherit meta;
 } // attrs')

pkgs/development/libraries/qt-6/default.nix

@@ -59,6 +59,7 @@ let
           ./patches/qtbase-qmake-mkspecs-mac.patch
           ./patches/qtbase-qmake-pkg-config.patch
           ./patches/qtbase-tzdir.patch
+          ./patches/qtbase-variable-fonts.patch
           # Remove symlink check causing build to bail out and fail.
           # https://gitlab.kitware.com/cmake/cmake/-/issues/23251
           (fetchpatch {

pkgs/development/libraries/qt-6/patches/qtbase-variable-fonts.patch

@@ -0,0 +1,26 @@
+From 9ba9c690fb16188ff524b53def104e68e45cf5c3 Mon Sep 17 00:00:00 2001
+From: Nick Cao <nickcao@nichi.co>
+Date: Tue, 21 Mar 2023 15:48:49 +0800
+Subject: [PATCH] Deal with a font face at index 0 as Regular for Variable
+ fonts
+
+Reference: https://bugreports.qt.io/browse/QTBUG-111994
+---
+ src/gui/text/unix/qfontconfigdatabase.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/gui/text/unix/qfontconfigdatabase.cpp b/src/gui/text/unix/qfontconfigdatabase.cpp
+index 9b60cf2963..5a42ef6a68 100644
+--- a/src/gui/text/unix/qfontconfigdatabase.cpp
++++ b/src/gui/text/unix/qfontconfigdatabase.cpp
+@@ -554,6 +554,7 @@ void QFontconfigDatabase::populateFontDatabase()
+             FcObjectSetAdd(os, *p);
+             ++p;
+         }
++        FcPatternAddBool(pattern, FC_VARIABLE, FcFalse);
+         fonts = FcFontList(nullptr, pattern, os);
+         FcObjectSetDestroy(os);
+         FcPatternDestroy(pattern);
+-- 
+2.39.2
+

pkgs/development/libraries/wayland/default.nix

@@ -9,6 +9,7 @@
 , expat
 , libxml2
 , withLibraries ? stdenv.isLinux
+, withTests ? stdenv.isLinux
 , libffi
 , withDocumentation ? withLibraries && stdenv.hostPlatform == stdenv.buildPlatform
 , graphviz-nox
@@ -24,6 +25,9 @@
 # Documentation is only built when building libraries.
 assert withDocumentation -> withLibraries;
 
+# Tests are only built when building libraries.
+assert withTests -> withLibraries;
+
 let
   isCross = stdenv.buildPlatform != stdenv.hostPlatform;
 in
@@ -50,7 +54,7 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "-Ddocumentation=${lib.boolToString withDocumentation}"
     "-Dlibraries=${lib.boolToString withLibraries}"
-    "-Dtests=${lib.boolToString withLibraries}"
+    "-Dtests=${lib.boolToString withTests}"
   ];
 
   depsBuildBuild = [

pkgs/development/libraries/wayland/protocols.nix

@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
   pname = "wayland-protocols";
   version = "1.31";
 
-  doCheck = stdenv.hostPlatform == stdenv.buildPlatform && wayland.withLibraries;
+  # https://gitlab.freedesktop.org/wayland/wayland-protocols/-/issues/48
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform && stdenv.targetPlatform.linker == "bfd" && wayland.withLibraries;
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/${pname}/-/releases/${version}/downloads/${pname}-${version}.tar.xz";

pkgs/development/octave-modules/arduino/default.nix

@@ -7,11 +7,11 @@
 
 buildOctavePackage rec {
   pname = "arduino";
-  version = "0.7.0";
+  version = "0.10.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0r0bcq2zkwba6ab6yi6czbhrj4adm9m9ggxmzzcd9h40ckqg6wjv";
+    sha256 = "sha256-p9SDTXkIwnrkNXeVhzAHks7EL4NdwBokrH2j9hqAJqQ=";
   };
 
   requiredOctavePackages = [

pkgs/development/octave-modules/audio/default.nix

@@ -9,11 +9,11 @@
 
 buildOctavePackage rec {
   pname = "audio";
-  version = "2.0.3";
+  version = "2.0.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1431pf7mhxsrnzrx8r3hsy537kha7jhaligmp2rghwyxhq25hs0r";
+    sha256 = "sha256-/4akeeOQnvTlk9ah+e8RJfwJG2Eq2HAGOCejhiIUjF4=";
   };
 
   nativeBuildInputs = [

pkgs/development/octave-modules/bim/default.nix

@@ -1,17 +1,19 @@
 { buildOctavePackage
 , lib
-, fetchurl
+, fetchFromGitHub
 , fpl
 , msh
 }:
 
 buildOctavePackage rec {
   pname = "bim";
-  version = "1.1.5";
+  version = "1.1.6";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0y70w8mj80c5yns1j7nwngwwrxp1pa87kyz2n2yvmc3zdigcd6g8";
+  src = fetchFromGitHub {
+    owner = "carlodefalco";
+    repo = "bim";
+    rev = "v${version}";
+    sha256 = "sha256-hgFb1KFE1KJC8skIaeT/7h/fg1aqRpedGnEPY24zZSI=";
   };
 
   requiredOctavePackages = [

pkgs/development/octave-modules/communications/default.nix

@@ -7,11 +7,11 @@
 
 buildOctavePackage rec {
   pname = "communications";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1r4r0cia5l5fann1n78c1qdc6q8nizgb09n2fdwb76xnwjan23g3";
+    sha256 = "sha256-SfA81UP0c7VgroxSA/RZVVKZ4arl8Uhpf324F7yGFTo=";
   };
 
   buildInputs = [

pkgs/development/octave-modules/control/default.nix

@@ -7,11 +7,11 @@
 
 buildOctavePackage rec {
   pname = "control";
-  version = "3.3.1";
+  version = "3.4.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0vndbzix34vfzdlsz57bgkyg31as4kv6hfg9pwrcqn75bzzjsivw";
+    sha256 = "sha256-bsagbhOtKIr62GMcxB9yR+RwlvoejQQkDU7QHvvkp3o=";
   };
 
   nativeBuildInputs = [

pkgs/development/octave-modules/dicom/default.nix

@@ -7,11 +7,11 @@
 
 buildOctavePackage rec {
   pname = "dicom";
-  version = "0.4.0";
+  version = "0.5.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "131wn6mrv20np10plirvqia8dlpz3g0aqi3mmn2wyl7r95p3dnza";
+    sha256 = "sha256-0qNqjpJWWBA0N5IgjV0e0SPQlCvbzIwnIgaWo+2wKw0=";
   };
 
   nativeBuildInputs = [

pkgs/development/octave-modules/ga/default.nix

@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "ga";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0s5azn4n174avlmh5gw21zfqfkyxkzn4v09q4l9swv7ldmg3mirv";
+    sha256 = "sha256-cbP7ucua7DdxLL422INxjZxz/x1pHoIq+jkjrtfaabE=";
   };
 
   meta = with lib; {

pkgs/development/octave-modules/general/default.nix

@@ -7,11 +7,11 @@
 
 buildOctavePackage rec {
   pname = "general";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0jmvczssqz1aa665v9h8k9cchb7mg3n9af6b5kh9b2qcjl4r9l7v";
+    sha256 = "sha256-owzRp5dDxiUo2uRuvUqD+EiuRqHB2sPqq8NmYtQilM8=";
   };
 
   nativeBuildInputs = [

pkgs/development/octave-modules/generate_html/default.nix

@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "generate_html";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1ai4h7jf9fqi7w565iprzylsh94pg4rhyf51hfj9kfdgdpb1abfs";
+    sha256 = "sha256-CHJ0+90+SNXmslLrQc+8aetSnHK0m9PqEBipFuFjwHw=";
   };
 
   meta = with lib; {

pkgs/development/octave-modules/geometry/default.nix

@@ -1,16 +1,17 @@
 { buildOctavePackage
 , lib
-, fetchurl
+, fetchhg
 , matgeom
 }:
 
 buildOctavePackage rec {
   pname = "geometry";
-  version = "4.0.0";
+  version = "unstable-2021-07-07";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1zmd97xir62fr5v57xifh2cvna5fg67h9yb7bp2vm3ll04y41lhs";
+  src = fetchhg {
+    url = "http://hg.code.sf.net/p/octave/${pname}";
+    rev = "04965cda30b5f9e51774194c67879e7336df1710";
+    sha256 = "sha256-ECysYOJMF4gPiCFung9hFSlyyO60X3MGirQ9FlYDix8=";
   };
 
   requiredOctavePackages = [

pkgs/development/octave-modules/instrument-control/default.nix

@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "instrument-control";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0cdnnbxihz7chdkhkcgy46pvkij43z9alwr88627z7jaiaah6xby";
+    sha256 = "sha256-g3Pyz2b8hvg0MkFGA7cduYozcAd2UnqorBHzNs+Uuro=";
   };
 
   meta = with lib; {

pkgs/development/octave-modules/interval/default.nix

@@ -6,11 +6,11 @@
 
 buildOctavePackage rec {
   pname = "interval";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0a0sz7b4y53qgk1xr4pannn4w7xiin2pf74x7r54hrr1wf4abp20";
+    sha256 = "sha256-OOUmQnN1cTIpqz2Gpf4/WghVB0fYQgVBcG/eqQk/3Og=";
   };
 
   propagatedBuildInputs = [

pkgs/development/octave-modules/io/default.nix

@@ -8,11 +8,11 @@
 
 buildOctavePackage rec {
   pname = "io";
-  version = "2.6.3";
+  version = "2.6.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "044y8lfp93fx0592mv6x2ss0nvjkjgvlci3c3ahav76pk1j3rikb";
+    sha256 = "sha256-p0pAC70ZIn9sB8WFiS3oec165S2CDaH2nxo+PolFL1o=";
   };
 
   buildInputs = [

pkgs/development/octave-modules/mapping/default.nix

@@ -3,17 +3,22 @@
 , fetchurl
 , io # >= 2.2.7
 , geometry # >= 4.0.0
+, gdal
 }:
 
 buildOctavePackage rec {
   pname = "mapping";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0wj0q1rkrqs4qgpjh4vn9kcpdh94pzr6v4jc1vcrjwkp87yjv8c0";
+    sha256 = "sha256-mrUQWqC15Ul5AHDvhMlNStqIMG2Zxa+hB2vDyeizLaI=";
   };
 
+  buildInputs = [
+    gdal
+  ];
+
   requiredOctavePackages = [
     io
     geometry

pkgs/development/octave-modules/msh/default.nix

@@ -1,6 +1,6 @@
 { buildOctavePackage
 , lib
-, fetchurl
+, fetchFromGitHub
 # Octave Dependencies
 , splines
 # Other Dependencies
@@ -13,11 +13,13 @@
 
 buildOctavePackage rec {
   pname = "msh";
-  version = "1.0.10";
+  version = "1.0.12";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1mb5qrp9y1w1cbzrd9v84430ldy57ca843yspnrgbcqpxyyxbgfz";
+  src = fetchFromGitHub {
+    owner = "carlodefalco";
+    repo = "msh";
+    rev = "v${version}";
+    sha256 = "sha256-UnMrIruzm3ARoTgUlMMxfjTOMZw/znZUQJmj3VEOw8I=";
   };
 
   nativeBuildInputs = [

pkgs/development/octave-modules/nan/default.nix

@@ -6,11 +6,11 @@
 
 buildOctavePackage rec {
   pname = "nan";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1zxdg0yg5jnwq6ppnikd13zprazia6w6zpgw99f62mc03iqk5c4q";
+    sha256 = "sha256-d9J6BfNFeM5LtMqth0boSPd9giYU42KBnxrsUCmKK1s=";
   };
 
   buildInputs = [

pkgs/development/octave-modules/ncarray/default.nix

@@ -7,11 +7,11 @@
 
 buildOctavePackage rec {
   pname = "ncarray";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0v96iziikvq2v7hczhbfs9zmk49v99kn6z3lgibqqpwam175yqgd";
+    sha256 = "sha256-HhQWLUA/6wqYi6TP3PC+N2zgi4UojDxbG9pgQzFaQ8c=";
   };
 
   buildInputs = [

pkgs/development/octave-modules/netcdf/default.nix

@@ -6,11 +6,11 @@
 
 buildOctavePackage rec {
   pname = "netcdf";
-  version = "1.0.14";
+  version = "1.0.16";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1wdwl76zgcg7kkdxjfjgf23ylzb0x4dyfliffylyl40g6cjym9lf";
+    sha256 = "sha256-1Lr+6xLRXxSeUhM9+WdCUPFRZSWdxtAQlxpiv4CHJrs=";
   };
 
   buildInputs = [

pkgs/development/octave-modules/ocl/default.nix

@@ -6,11 +6,11 @@
 
 buildOctavePackage rec {
   pname = "ocl";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0ayi5x9zk9p4zm0qsr3i94lyp5468c9d1a7mqrqjqpdvkhrw0xnm";
+    sha256 = "sha256-jQdwZwQNU3PZZFa3lp0hIr0GDt/XFHLJoq4waLI4gS8=";
   };
 
   meta = with lib; {

pkgs/development/octave-modules/octclip/default.nix

@@ -1,15 +1,17 @@
 { buildOctavePackage
 , lib
-, fetchurl
+, fetchFromBitbucket
 }:
 
 buildOctavePackage rec {
   pname = "octclip";
-  version = "2.0.1";
+  version = "2.0.3";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "05ijh3izgfaan84n6zp690nap9vnz0zicjd0cgvd1c6askm7vxql";
+  src = fetchFromBitbucket {
+    owner = "jgpallero";
+    repo = pname;
+    rev = "OctCLIP-${version}";
+    sha256 = "sha256-gG2b8Ix6bzO6O7GRACE81JCVxfXW/+ZdfoniigAEq3g=";
   };
 
   # The only compilation problem is that no formatting specifier was provided

pkgs/development/octave-modules/octproj/default.nix

@@ -1,16 +1,18 @@
 { buildOctavePackage
 , lib
-, fetchurl
+, fetchFromBitbucket
 , proj # >= 6.3.0
 }:
 
 buildOctavePackage rec {
   pname = "octproj";
-  version = "2.0.1";
+  version = "3.0.2";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1mb8gb0r8kky47ap85h9qqdvs40mjp3ya0nkh45gqhy67ml06paq";
+  src = fetchFromBitbucket {
+    owner = "jgpallero";
+    repo = pname;
+    rev = "OctPROJ-${version}";
+    sha256 = "sha256-d/Zf172Etj+GA0cnGsQaKMjOmirE7Hwyj4UECpg7QFM=";
   };
 
   # The sed changes below allow for the package to be compiled.
@@ -28,6 +30,5 @@ buildOctavePackage rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ KarlJoad ];
     description = "GNU Octave bindings to PROJ library for cartographic projections and CRS transformations";
-    broken = true; # error: unlink: operation failed: No such file or directory
   };
 }

pkgs/development/octave-modules/optim/default.nix

@@ -9,11 +9,11 @@
 
 buildOctavePackage rec {
   pname = "optim";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1175bckiryz0i6zm8zvq7y5rq3lwkmhyiky1gbn33np9qzxcsl3i";
+    sha256 = "sha256-VUqOGLtxla6GH1BZwU8aVXhEJlwa3bW/vzq5iFUkeH4=";
   };
 
   buildInputs = [

pkgs/development/octave-modules/optiminterp/default.nix

@@ -6,11 +6,11 @@
 
 buildOctavePackage rec {
   pname = "optiminterp";
-  version = "0.3.6";
+  version = "0.3.7";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "05nzj2jmrczbnsr64w2a7kww19s6yialdqnsbg797v11ii7aiylc";
+    sha256 = "sha256-ubh/iOZlWTOYsTA6hJfPOituNBKTn2LbBnx+tmmSEug=";
   };
 
   nativeBuildInputs = [

pkgs/development/octave-modules/signal/default.nix

@@ -6,11 +6,11 @@
 
 buildOctavePackage rec {
   pname = "signal";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "YqTgYRfcxDw2FpkF+CVdAVSBypgq6ukBOw2d8+SOcGI=";
+    sha256 = "sha256-VFuXVA6+ujtCDwiQb905d/wpOzvI/Db2uosJTOqI8zk=";
   };
 
   requiredOctavePackages = [

pkgs/development/octave-modules/sockets/default.nix

@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "sockets";
-  version = "1.2.1";
+  version = "1.4.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "18f1zpqcf6h9b4fb0x2c5nvc3mvgj1141f1s8d9gnlhlrjlq8vqg";
+    sha256 = "sha256-GNwFLNV1u3UKJp9lhLtCclD2VSKC9Mko1hBoSn5dTpI=";
   };
 
   meta = with lib; {

pkgs/development/octave-modules/statistics/default.nix

@@ -1,16 +1,18 @@
 { buildOctavePackage
 , lib
-, fetchurl
+, fetchFromGitHub
 , io
 }:
 
 buildOctavePackage rec {
   pname = "statistics";
-  version = "1.4.2";
+  version = "1.5.4";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0iv2hw3zp7h69n8ncfjfgm29xaihdl5gp2slcw1yf23mhd7q2xkr";
+  src = fetchFromGitHub {
+    owner = "gnu-octave";
+    repo = "statistics";
+    rev = "refs/tags/release-${version}";
+    sha256 = "sha256-gFauFIaXKzcPeNvpWHv5FAxYQvZNh7ELrSUIvn43IfQ=";
   };
 
   requiredOctavePackages = [

pkgs/development/octave-modules/stk/default.nix

@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "stk";
-  version = "2.6.1";
+  version = "2.7.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1rqndfankwlwm4igw3xqpnrrl749zz1d5pjzh1qbfns7ixwrm19a";
+    sha256 = "sha256-vIf+XDLvLNOMwptFCgiqfl+o3PIQ+KLpsJhOArd7gMM=";
   };
 
   meta = with lib; {

pkgs/development/octave-modules/strings/default.nix

@@ -2,20 +2,25 @@
 , stdenv
 , lib
 , fetchurl
-, pcre
+, pkg-config
+, pcre2
 }:
 
 buildOctavePackage rec {
   pname = "strings";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1b0ravfvq3bxd0w3axjfsx13mmmkifmqz6pfdgyf2s8vkqnp1qng";
+    sha256 = "sha256-agpTD9FN1qdp+BYdW5f+GZV0zqZMNzeOdymdo27mTOI=";
   };
 
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
   buildInputs = [
-    pcre
+    pcre2
   ];
 
   # The gripes library no longer exists.

pkgs/development/octave-modules/struct/default.nix

@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "struct";
-  version = "1.0.17";
+  version = "1.0.18";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0cw4cspkm553v019zsj2bsmal0i378pm0hv29w82j3v5vysvndq1";
+    sha256 = "sha256-/M6n3YTBEE7TurtHoo8F4AEqicKE85qwlAkEUJFSlM4=";
   };
 
   meta = with lib; {

pkgs/development/octave-modules/video/default.nix

@@ -8,11 +8,11 @@
 
 buildOctavePackage rec {
   pname = "video";
-  version = "2.0.0";
+  version = "2.0.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0s6j3c4dh5nsbh84s7vnd2ajcayy1gn07b4fcyrcynch3wl28mrv";
+    sha256 = "sha256-bZNaRnmJl5UF0bQMNoEWvoIXJaB0E6/V9eChE725OHY=";
   };
 
   nativeBuildInputs = [

pkgs/development/octave-modules/windows/default.nix

@@ -5,11 +5,11 @@
 
 buildOctavePackage rec {
   pname = "windows";
-  version = "1.6.1";
+  version = "1.6.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "110dh6jz088c4fxp9gw79kfib0dl7r3rkcavxx4xpk7bjl2l3xb6";
+    sha256 = "sha256-U5Fe5mTn/ms8w9j6NdEtiRFZkKeyV0I3aR+zYQw4yIs=";
   };
 
   meta = with lib; {

pkgs/development/octave-modules/zeromq/default.nix

@@ -8,11 +8,11 @@
 
 buildOctavePackage rec {
   pname = "zeromq";
-  version = "1.5.3";
+  version = "1.5.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1h0pb2pqbnyiavf7r05j8bqxqd8syz16ab48hc74nlnx727anfwl";
+    sha256 = "sha256-MAZEpbVuragVuXrMJ8q5/jU5cTchosAtrAR6ElLwfss=";
   };
 
   preAutoreconf = ''

pkgs/development/python-modules/fakeredis/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "fakeredis";
-  version = "2.10.1";
+  version = "2.10.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "dsoftwareinc";
     repo = "fakeredis-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5jtI7EemKi0w/ezr/jLFQFndvqOjVE0SUm1urluKusY=";
+    hash = "sha256-ZQC8KNHM6Nnytkr6frZMl5mBVPkpduWZwwooCPymbFY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/oralb-ble/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "oralb-ble";
-  version = "0.17.5";
+  version = "0.17.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Lwrr5XzU2pbx3cYkvYtHgXFhGnz3cMBnNFWCpuY3ltg=";
+    hash = "sha256-6LnZ+Y68sl0uA5i764n4fFJnPeo+bAi/xgEvTK6LkXY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pymupdf/default.nix

@@ -1,15 +1,18 @@
 { lib
+, stdenv
 , buildPythonPackage
+, pythonOlder
 , fetchPypi
-, mupdf
 , swig
+, xcbuild
+, mupdf
 , freetype
 , harfbuzz
 , openjpeg
 , jbig2dec
 , libjpeg_turbo
 , gumbo
-, pythonOlder
+, memstreamHook
 }:
 
 buildPythonPackage rec {
@@ -31,6 +34,8 @@ buildPythonPackage rec {
   '';
   nativeBuildInputs = [
     swig
+  ] ++ lib.optionals stdenv.isDarwin [
+    xcbuild
   ];
 
   buildInputs = [
@@ -41,6 +46,8 @@ buildPythonPackage rec {
     jbig2dec
     libjpeg_turbo
     gumbo
+  ] ++ lib.optionals (stdenv.system == "x86_64-darwin") [
+    memstreamHook
   ];
 
   doCheck = false;
@@ -55,6 +62,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/pymupdf/PyMuPDF/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ teto ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }

pkgs/development/python-modules/skodaconnect/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "skodaconnect";
-  version = "1.3.4";
+  version = "1.3.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "lendy007";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-bjFXrhwIGB50upL++VnrrfzFhxFOrxgYhoNZqkbvZ9w=";
+    hash = "sha256-gLk+Dj2x2OHa6VIIoA7FesDKtg180MuCud2nYk9mYpM=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/teslajsonpy/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "teslajsonpy";
-  version = "3.7.4";
+  version = "3.7.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "zabuldon";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-A/UliJWJ1gSDNG1IMcJup33elyxTxuGK/y/001WJnV8=";
+    hash = "sha256-MOFC8jMJsBernY1/aFobgBNsnt7MYjSUPVoum0e4hUg=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/ulid-transform/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "ulid-transform";
-  version = "0.4.2";
+  version = "0.5.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-eRLmA/8fKfG0qEl0QbX6FziEviU34uU7SP0iyZmbku8=";
+    hash = "sha256-tgCNjvI9e7GpZKG8Q6tykU+WKBPGm0FTsw3gwUU3+so=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/yalexs-ble/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs-ble";
-  version = "2.1.0";
+  version = "2.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-BF2jGEFtUYckFNJwddLGjwQYIhYKhM7q6Q2mCil6Z3Y=";
+    hash = "sha256-tYdm6XrjltQtN9m23GB9WDWLbXb4pMNiLQWpxxeqsLY=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/ruff/Cargo.lock

@@ -780,7 +780,7 @@ checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
 
 [[package]]
 name = "flake8-to-ruff"
-version = "0.0.257"
+version = "0.0.258"
 dependencies = [
  "anyhow",
  "clap 4.1.8",
@@ -1982,7 +1982,7 @@ dependencies = [
 
 [[package]]
 name = "ruff"
-version = "0.0.257"
+version = "0.0.258"
 dependencies = [
  "anyhow",
  "bisection",
@@ -1990,7 +1990,6 @@ dependencies = [
  "chrono",
  "clap 4.1.8",
  "colored",
- "criterion",
  "dirs",
  "fern",
  "glob",
@@ -2025,6 +2024,7 @@ dependencies = [
  "schemars",
  "semver",
  "serde",
+ "serde_json",
  "shellexpand",
  "smallvec",
  "strum",
@@ -2063,7 +2063,7 @@ dependencies = [
 
 [[package]]
 name = "ruff_cli"
-version = "0.0.257"
+version = "0.0.258"
 dependencies = [
  "annotate-snippets 0.9.1",
  "anyhow",
@@ -2091,6 +2091,7 @@ dependencies = [
  "ruff",
  "ruff_cache",
  "ruff_diagnostics",
+ "ruff_python_stdlib",
  "rustc-hash",
  "serde",
  "serde_json",
@@ -2210,7 +2211,6 @@ name = "ruff_python_stdlib"
 version = "0.0.0"
 dependencies = [
  "once_cell",
- "regex",
  "rustc-hash",
 ]
 
@@ -2505,6 +2505,7 @@ version = "1.0.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cad406b69c91885b5107daf2c29572f6c8cdb3c66826821e286c533490c0bc76"
 dependencies = [
+ "indexmap",
  "itoa",
  "ryu",
  "serde",

pkgs/development/tools/ruff/default.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.257";
+  version = "0.0.258";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-PkKUQPkZtwqvWhWsO4Pej/T1haJvMP7HpF6XjZSoqQg=";
+    hash = "sha256-rlMghh6NmyIJTdjf6xmzVuevXh/OrBqhx+CkvvQwlng=";
   };
 
   # We have to use importCargoLock here because `cargo vendor` currently doesn't support workspace
@@ -23,12 +23,8 @@ rustPlatform.buildRustPackage rec {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "libcst-0.1.0" = "sha256-jG9jYJP4reACkFLrQBWOYH6nbKniNyFVItD0cTZ+nW0=";
-      "libcst_derive-0.1.0" = "sha256-jG9jYJP4reACkFLrQBWOYH6nbKniNyFVItD0cTZ+nW0=";
       "pep440_rs-0.2.0" = "sha256-wDJGz7SbHItYsg0+EgIoH48WFdV6MEg+HkeE07JE6AU=";
       "rustpython-ast-0.2.0" = "sha256-0SHtycgDVOtiz7JZwd1v9lv2exxemcntm9lciih+pgc=";
-      "rustpython-common-0.2.0" = "sha256-0SHtycgDVOtiz7JZwd1v9lv2exxemcntm9lciih+pgc=";
-      "rustpython-compiler-core-0.2.0" = "sha256-0SHtycgDVOtiz7JZwd1v9lv2exxemcntm9lciih+pgc=";
-      "rustpython-parser-0.2.0" = "sha256-0SHtycgDVOtiz7JZwd1v9lv2exxemcntm9lciih+pgc=";
       "unicode_names2-0.6.0" = "sha256-eWg9+ISm/vztB0KIdjhq5il2ZnwGJQCleCYfznCI3Wg=";
     };
   };

pkgs/development/tools/rust/cargo-bundle/default.nix

@@ -0,0 +1,42 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, stdenv
+, darwin
+, libxkbcommon
+, wayland
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "cargo-bundle";
+  # the latest stable release fails to build on darwin
+  version = "unstable-2023-03-17";
+
+  src = fetchFromGitHub {
+    owner = "burtonageo";
+    repo = "cargo-bundle";
+    rev = "eb9fe1b0880c7c0e929a93edaddcb0a61cd3f0d4";
+    hash = "sha256-alO+Q9IK5Hz09+TqHWsbjuokxISKQfQTM6QnLlUNydw=";
+  };
+
+  cargoHash = "sha256-h+QPbwYTJk6dieta/Q+VAhYe8/YH/Nik6gslzUn0YxI=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.AppKit
+  ] ++ lib.optionals stdenv.isLinux [
+    libxkbcommon
+    wayland
+  ];
+
+  meta = with lib; {
+    description = "Wrap rust executables in OS-specific app bundles";
+    homepage = "https://github.com/burtonageo/cargo-bundle";
+    license = with licenses; [ asl20 mit ];
+    maintainers = with maintainers; [ figsoda ];
+  };
+}

pkgs/servers/consul/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.15.0";
+  version = "1.15.1";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "sha256-WJQHBSwmcJiUGt69DMMZxs+xEk3z+fadSHoHvxb48ZU=";
+    sha256 = "sha256-U7/et05WOBP7TT8iSXD447dBzRDzrmoeOYFofp/Cwh0=";
   };
 
   passthru.tests.consul = nixosTests.consul;
@@ -26,7 +26,7 @@ buildGoModule rec {
   # has a split module structure in one repo
   subPackages = ["." "connect/certgen"];
 
-  vendorHash = "sha256-XwoZ/iwsZ/zXgPRGfBit5TO2NDS2pTEO0FT4KSUhJtA=";
+  vendorHash = "sha256-6lYIwOpQjpw7cmeEhDtTs5FzagcAagD+NbfHCO9D/6M=";
 
   doCheck = false;
 

pkgs/servers/headscale/default.nix

@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "headscale";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "juanfont";
     repo = "headscale";
     rev = "v${version}";
-    hash = "sha256-RqJrqY1Eh5/TY+vMAO5fABmeV5aSzcLD4fX7j1QDN6w=";
+    hash = "sha256-Y4fTCEKK7iRbfijQAvYgXWVa/6TlPikXnqyBI8b990s=";
   };
 
-  vendorHash = "sha256-8p5NFxXKaZPsW4B6NMzfi0pqfVroIahSgA0fukvB3JI=";
+  vendorHash = "sha256-R183PDeAUnNwNV8iE3b22S5hGPJG8aZQGdENGqcPCw8=";
 
   ldflags = ["-s" "-w" "-X github.com/juanfont/headscale/cmd/headscale/cli.Version=v${version}"];
 

pkgs/shells/nushell/default.nix

@@ -26,7 +26,7 @@
 
 rustPlatform.buildRustPackage (
   let
-    version =  "0.77.0";
+    version =  "0.77.1";
     pname = "nushell";
   in {
   inherit version pname;
@@ -35,10 +35,10 @@ rustPlatform.buildRustPackage (
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-cffAxuM12wdd7IeLbKSpL6dpvpZVscA8nMOh3jFqY3E=";
+    sha256 = "sha256-MheKGfm72cxFtMIDj8VxEN4VFB1+tLoj+ujzL/7n8YI=";
   };
 
-  cargoSha256 = "sha256-OcYE9d3hO3JtxF3REWev0Rz97Kr9l7P7nUxhIb5fhi0=";
+  cargoSha256 = "sha256-oUeoCAeVP2MBAhJfMptK+Z3n050cqpIIgnUroRVBYjg=";
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optionals (withDefaultFeatures && stdenv.isLinux) [ python3 ]

pkgs/tools/admin/aws-vault/default.nix

@@ -7,13 +7,13 @@
 }:
 buildGoModule rec {
   pname = "aws-vault";
-  version = "7.1.1";
+  version = "7.1.2";
 
   src = fetchFromGitHub {
     owner = "99designs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ydg//2t+B02eXwnwsmECx+I8oluPf6dKntz7L6gWV88=";
+    sha256 = "sha256-MlzK9ENCm1P3Nir/bwo9slWwiuaIqF4icV1Sm0WvUS8=";
   };
 
   vendorHash = "sha256-4bJKDEZlO0DzEzTQ7m+SQuzhe+wKmL6wLueqgSz/46s=";

pkgs/tools/cd-dvd/cdrkit/default.nix

@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, cmake, libcap, zlib, bzip2, perl}:
+{lib, stdenv, fetchurl, cmake, libcap, zlib, bzip2, perl, iconv, darwin}:
 
 stdenv.mkDerivation rec {
   pname = "cdrkit";
@@ -10,7 +10,9 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ libcap zlib bzip2 perl ];
+  buildInputs = [ zlib bzip2 perl ] ++
+    lib.optionals stdenv.isLinux [ libcap ] ++
+    lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Carbon IOKit iconv ]);
 
   hardeningDisable = [ "format" ];
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isMusl "-D__THROW=";
@@ -18,11 +20,31 @@ stdenv.mkDerivation rec {
   # efi-boot-patch extracted from http://arm.koji.fedoraproject.org/koji/rpminfo?rpmID=174244
   patches = [ ./include-path.patch ./cdrkit-1.1.9-efi-boot.patch ./cdrkit-1.1.11-fno-common.patch ];
 
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace libusal/scsi-mac-iokit.c \
+      --replace "IOKit/scsi-commands/SCSITaskLib.h" "IOKit/scsi/SCSITaskLib.h"
+    substituteInPlace genisoimage/sha256.c \
+      --replace "<endian.h>" "<machine/endian.h>"
+    substituteInPlace genisoimage/sha512.c \
+      --replace "<endian.h>" "<machine/endian.h>"
+    substituteInPlace genisoimage/sha256.h \
+      --replace "__THROW" ""
+    substituteInPlace genisoimage/sha512.h \
+      --replace "__THROW" ""
+  '';
+
   preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
     substituteInPlace include/xconfig.h.in \
         --replace "#define HAVE_RCMD 1" "#undef HAVE_RCMD"
   '';
 
+  postConfigure = lib.optionalString stdenv.isDarwin ''
+    for f in */CMakeFiles/*.dir/link.txt ; do
+      substituteInPlace "$f" \
+        --replace "-lrt" "-framework IOKit"
+    done
+  '';
+
   postInstall = ''
     # file name compatibility with the old cdrecord (growisofs wants this name)
     ln -s $out/bin/genisoimage $out/bin/mkisofs
@@ -49,6 +71,6 @@ stdenv.mkDerivation rec {
 
     homepage = "http://cdrkit.org/";
     license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 }

pkgs/tools/misc/topgrade/default.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "10.3.2";
+  version = "10.3.3";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     rev = "v${version}";
-    hash = "sha256-yYRKNiX8JvCP44+mdLIOSjpxaVDz1YUNrj/IZ0bC72Y=";
+    hash = "sha256-LhTUzY2WrauWHYZU5jA6fn3DDheUgfxCPvjVTwUvF4w=";
   };
 
-  cargoHash = "sha256-2b6TOkjoycPA8rwca3nT212Yxl6q2Hmvv0f4Ic9hnWM=";
+  cargoHash = "sha256-ONLZrZjhNcli7ul6fDgVEKm2MS3YYIfPnHS+dmpJHu0=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/tools/misc/wit-bindgen/default.nix

@@ -0,0 +1,32 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "wit-bindgen";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "bytecodealliance";
+    repo = "wit-bindgen";
+    rev = "wit-bindgen-cli-${version}";
+    hash = "sha256-OLBuzYAeUaJrn9cUqw6nStE468TqTUXeUnfkdMO0D3w=";
+  };
+
+  cargoHash = "sha256-blaSgQZweDmkiU0Tck9qmIgpQGDZhgxb1+hs6a4D6Qg=";
+
+  # Some tests fail because they need network access to install the `wasm32-unknown-unknown` target.
+  # However, GitHub Actions ensures a proper build.
+  # See also:
+  #   https://github.com/bytecodealliance/wit-bindgen/actions
+  #   https://github.com/bytecodealliance/wit-bindgen/blob/main/.github/workflows/main.yml
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A language binding generator for WebAssembly interface types";
+    homepage = "https://github.com/bytecodealliance/wit-bindgen";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ xrelkd ];
+  };
+}

pkgs/tools/networking/dnsperf/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dnsperf";
-  version = "2.11.1";
+  version = "2.11.2";
 
   src = fetchFromGitHub {
     owner = "DNS-OARC";
     repo = "dnsperf";
     rev = "v${version}";
-    sha256 = "sha256-dgPpuX8Geo20BV8g0uhjSdsZUOoC+Dnz4Y2vdMW6KjY=";
+    sha256 = "sha256-vZ2GPrlMHMe2vStjktbyLtXS5SoNzHbNwFi+CL1Z4VQ=";
   };
 
   nativeBuildInputs = [

pkgs/tools/package-management/ciel/default.nix

@@ -0,0 +1,66 @@
+{ lib
+, bash
+, dbus
+, fetchFromGitHub
+, fetchpatch
+, installShellFiles
+, libgit2
+, libssh2
+, openssl
+, pkg-config
+, rustPlatform
+, systemd
+, xz
+, zlib
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ciel";
+  version = "3.1.4";
+
+  src = fetchFromGitHub {
+    owner = "AOSC-Dev";
+    repo = "ciel-rs";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-b8oTVtDcxrV41OtfuthIxjbgZTANCfYHQLRJnnEc93c=";
+  };
+
+  cargoHash = "sha256-11/Yf1hTKYRsQKzvwYXgyPuhIZwshwSJ8sNykUQRdoo=";
+
+  nativeBuildInputs = [ pkg-config installShellFiles ];
+
+  # ciel has plugins which is actually bash scripts.
+  # Therefore, bash is required for plugins to work.
+  buildInputs = [ bash systemd dbus openssl libssh2 libgit2 xz zlib ];
+
+  patches = [
+    # cli,completions: use canonicalize path to find libexec location
+    # FIXME: remove this patch after https://github.com/AOSC-Dev/ciel-rs/pull/16 is merged
+    (fetchpatch {
+      name = "use-canonicalize-path-to-find-libexec.patch";
+      url = "https://github.com/AOSC-Dev/ciel-rs/pull/16.patch";
+      sha256 = "sha256-ELK2KpOuoBS774apomUIo8q1eXYs/FX895G7eBdgOQg=";
+    })
+  ];
+
+  postInstall = ''
+    mv -v "$out/bin/ciel-rs" "$out/bin/ciel"
+
+    # From install-assets.sh
+    install -Dm555 -t "$out/libexec/ciel-plugin" plugins/*
+
+    # Install completions
+    installShellCompletion --cmd ciel \
+      --bash completions/ciel.bash \
+      --fish completions/ciel.fish \
+      --zsh completions/_ciel
+  '';
+
+  meta = with lib; {
+    description = "A tool for controlling AOSC OS packaging environments using multi-layer filesystems and containers.";
+    homepage = "https://github.com/AOSC-Dev/ciel-rs";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ yisuidenghua ];
+  };
+}

pkgs/tools/system/automatic-timezoned/default.nix

@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "1.0.72";
+  version = "1.0.75";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JOf10wGpOwJTvBvaeoBPKWm6f3B6K9ZsJaKkkzwkM7Y=";
+    sha256 = "sha256-soEVET3aVK77UJjhXq/cwK9QWAJWQu5TEjyHEKfqKeY=";
   };
 
-  cargoHash = "sha256-4vzu77BLxJeVQgpI+g16XrqWt94r93v6Wz9wwFcbKlQ=";
+  cargoHash = "sha256-xux+8hix2FzZqxOmos1g0SAcVVajJUCO9qGl0LNtOlk=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";

pkgs/tools/system/goreman/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "goreman";
-  version = "0.3.14";
+  version = "0.3.15";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "goreman";
     rev = "v${version}";
-    sha256 = "sha256-FskP0/mqmPTkI0Pj22aweOcr9SqlcFfFaZYgot2wY90=";
+    sha256 = "sha256-Z6b245tC6UsTaHTTlKEFH0egb5z8HTmv/554nkileng=";
   };
 
   vendorHash = "sha256-Qbi2GfBrVLFbH9SMZOd1JqvD/afkrVOjU4ECkFK+dFA=";

pkgs/tools/text/frawk/default.nix

@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "frawk";
-  version = "0.4.7";
+  version = "0.4.8";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-fqOFFkw+mV9QLTH3K6Drk3kDqU4wrQTj7OQrtgYuD7M=";
+    sha256 = "sha256-wPnMJDx3aF1Slx5pjLfii366pgNU3FJBdznQLuUboYA=";
   };
 
-  cargoSha256 = "sha256-G39/CESjMouwPQJBdsmd+MBusGNQmyNjw3PJSFBCdSk=";
+  cargoSha256 = "sha256-Xk+iH90Nb2koCdGmVSiRl8Nq26LlFdJBuKmvcbgnkgs=";
 
   buildInputs = [ libxml2 ncurses zlib ];
 

pkgs/tools/virtualization/govc/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "govc";
-  version = "0.30.2";
+  version = "0.30.4";
 
   subPackages = [ "govc" ];
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "sha256-Jt71nrviElNj5UjWzdP51x3My59KAT+EtrQfodR3GfA=";
+    sha256 = "sha256-lYiyZ2sY58bzUtqcM6WIsooLldQAxibASM7xXKAeqJM=";
   };
 
   vendorHash = "sha256-jbGqQITAhyBLoDa3cKU5gK+4WGgoGSCyFtzeoXx8e7k=";

pkgs/top-level/all-packages.nix

@@ -408,6 +408,8 @@ with pkgs;
 
   chrysalis = callPackage ../applications/misc/chrysalis { };
 
+  ciel = callPackage ../tools/package-management/ciel { };
+
   circt = callPackage ../development/compilers/circt { };
 
   classicube = callPackage ../games/classicube { };
@@ -13396,6 +13398,8 @@ with pkgs;
 
   wimboot = callPackage ../tools/misc/wimboot { };
 
+  wit-bindgen = callPackage ../tools/misc/wit-bindgen { };
+
   wire = callPackage ../development/tools/wire { };
 
   wireguard-tools = callPackage ../tools/networking/wireguard-tools { };
@@ -16019,6 +16023,7 @@ with pkgs;
   cargo-binutils = callPackage ../development/tools/rust/cargo-binutils { };
   cargo-bloat = callPackage ../development/tools/rust/cargo-bloat { };
   cargo-bolero = callPackage ../development/tools/rust/cargo-bolero { };
+  cargo-bundle = callPackage ../development/tools/rust/cargo-bundle { };
   cargo-cache = callPackage ../development/tools/rust/cargo-cache {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -29744,6 +29749,8 @@ with pkgs;
 
   focus = callPackage ../tools/X11/focus { };
 
+  focus-stack = callPackage ../applications/graphics/focus-stack { };
+
   focuswriter = libsForQt5.callPackage ../applications/editors/focuswriter { };
 
   foliate = callPackage ../applications/office/foliate { };