Merge master into haskell-updates

2023-06-06 00:13:43 +00:00 · 2023-06-06 00:13:43 +00:00 · 989a2b93b7
parent dd2d950a06 49e06b9347
commit 989a2b93b7
243 changed files with 17210 additions and 3138 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -11464,6 +11464,12 @@
      fingerprint = "E576 BFB2 CF6E B13D F571  33B9 E315 A758 4613 1564";
    }];
  };
+  nielsegberts = {
+    email = "nix@nielsegberts.nl";
+    github = "nielsegberts";
+    githubId = 368712;
+    name = "Niels Egberts";
+  };
  nigelgbanks = {
    name = "Nigel Banks";
    email = "nigel.g.banks@gmail.com";
@ -16133,6 +16139,12 @@
    githubId = 3159881;
    name = "Tobias Markus";
  };
+  tm-drtina = {
+    email = "tm.drtina@gmail.com";
+    github = "tm-drtina";
+    githubId = 26902865;
+    name = "Tomas Drtina";
+  };
  tmountain = {
    email = "tinymountain@gmail.com";
    github = "tmountain";
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -28,6 +28,10 @@

 - `util-linux` is now supported on Darwin and is no longer an alias to `unixtools`. Use the `unixtools.util-linux` package for access to the Apple variants of the utilities.

+- `fileSystems.<name>.autoFormat` now uses `systemd-makefs`, which does not accept formatting options. Therefore, `fileSystems.<name>.formatOptions` has been removed.
+
+- `fileSystems.<name>.autoResize` now uses `systemd-growfs` to resize the file system online in stage 2. This means that `f2fs` and `ext2` can no longer be auto resized, while `xfs` and `btrfs` now can be.
+
 ## Other Notable Changes {#sec-release-23.11-notable-changes}

 - The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration.
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@ -38,6 +38,7 @@ with lib;
      gpsd = super.gpsd.override { guiSupport = false; };
      graphviz = super.graphviz-nox;
      gst_all_1 = super.gst_all_1 // {
+        gst-plugins-bad = super.gst_all_1.gst-plugins-bad.override { guiSupport = false; };
        gst-plugins-base = super.gst_all_1.gst-plugins-base.override { enableX11 = false; };
      };
      imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; };
--- a/nixos/modules/services/system/self-deploy.nix
+++ b/nixos/modules/services/system/self-deploy.nix
@ -125,13 +125,15 @@ in
  };

  config = lib.mkIf cfg.enable {
-    systemd.services.self-deploy = {
+    systemd.services.self-deploy = rec {
      inherit (cfg) startAt;

-      wantedBy = [ "multi-user.target" ];
+      serviceConfig.Type = "oneshot";

      requires = lib.mkIf (!(isPathType cfg.repository)) [ "network-online.target" ];

+      after = requires;
+
      environment.GIT_SSH_COMMAND = lib.mkIf (cfg.sshKeyFile != null)
        "${pkgs.openssh}/bin/ssh -i ${lib.escapeShellArg cfg.sshKeyFile}";

--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@ -624,7 +624,8 @@ in
              '';
            };
            clientSecret = mkOption {
-              type = types.str;
+              type = with types; nullOr str;
+              default = null;
              description = lib.mdDoc ''
                Specify the OAuth client secret.
              '';
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -374,22 +374,6 @@ mountFS() {

    checkFS "$device" "$fsType"

-    # Optionally resize the filesystem.
-    case $options in
-        *x-nixos.autoresize*)
-            if [ "$fsType" = ext2 -o "$fsType" = ext3 -o "$fsType" = ext4 ]; then
-                modprobe "$fsType"
-                echo "resizing $device..."
-                e2fsck -fp "$device"
-                resize2fs "$device"
-            elif [ "$fsType" = f2fs ]; then
-                echo "resizing $device..."
-                fsck.f2fs -fp "$device"
-                resize.f2fs "$device"
-            fi
-            ;;
-    esac
-
    # Create backing directories for overlayfs
    if [ "$fsType" = overlay ]; then
        for i in upper work; do
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -150,12 +150,6 @@ let
      copy_bin_and_libs ${pkgs.kmod}/bin/kmod
      ln -sf kmod $out/bin/modprobe

-      # Copy resize2fs if any ext* filesystems are to be resized
-      ${optionalString (any (fs: fs.autoResize && (lib.hasPrefix "ext" fs.fsType)) fileSystems) ''
-        # We need mke2fs in the initrd.
-        copy_bin_and_libs ${pkgs.e2fsprogs}/sbin/resize2fs
-      ''}
-
      # Copy multipath.
      ${optionalString config.services.multipath.enable ''
        copy_bin_and_libs ${config.services.multipath.package}/bin/multipath
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -588,6 +588,15 @@ in
    systemd.services."systemd-backlight@".restartIfChanged = false;
    systemd.services."systemd-fsck@".restartIfChanged = false;
    systemd.services."systemd-fsck@".path = [ config.system.path ];
+    systemd.services."systemd-makefs@" = {
+      restartIfChanged = false;
+      path = [ pkgs.util-linux ] ++ config.system.fsPackages;
+      # Since there is no /etc/systemd/system/systemd-makefs@.service
+      # file, the units generated in /run/systemd/generator would
+      # override anything we put here. But by forcing the use of a
+      # drop-in in /etc, it does apply.
+      overrideStrategy = "asDropin";
+    };
    systemd.services.systemd-random-seed.restartIfChanged = false;
    systemd.services.systemd-remount-fs.restartIfChanged = false;
    systemd.services.systemd-update-utmp.restartIfChanged = false;
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -56,7 +56,6 @@ let
    "systemd-ask-password-console.path"
    "systemd-ask-password-console.service"
    "systemd-fsck@.service"
-    "systemd-growfs@.service"
    "systemd-halt.service"
    "systemd-hibernate-resume@.service"
    "systemd-journald-audit.socket"
@ -93,7 +92,6 @@ let
  fileSystems = filter utils.fsNeededForBoot config.system.build.fileSystems;

  needMakefs = lib.any (fs: fs.autoFormat) fileSystems;
-  needGrowfs = lib.any (fs: fs.autoResize) fileSystems;

  kernel-name = config.boot.kernelPackages.kernel.name or "kernel";
  modulesTree = config.system.modulesTree.override { name = kernel-name + "-modules"; };
@ -400,7 +398,6 @@ in {
      storePaths = [
        # systemd tooling
        "${cfg.package}/lib/systemd/systemd-fsck"
-        (lib.mkIf needGrowfs "${cfg.package}/lib/systemd/systemd-growfs")
        "${cfg.package}/lib/systemd/systemd-hibernate-resume"
        "${cfg.package}/lib/systemd/systemd-journald"
        (lib.mkIf needMakefs "${cfg.package}/lib/systemd/systemd-makefs")
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@ -112,12 +112,9 @@ let
      };

      formatOptions = mkOption {
-        default = "";
-        type = types.str;
-        description = lib.mdDoc ''
-          If {option}`autoFormat` option is set specifies
-          extra options passed to mkfs.
-        '';
+        visible = false;
+        type = types.unspecified;
+        default = null;
      };

      autoResize = mkOption {
@ -139,22 +136,11 @@ let

    };

-    config = let
-      defaultFormatOptions =
-        # -F needed to allow bare block device without partitions
-        if (builtins.substring 0 3 config.fsType) == "ext" then "-F"
-        # -q needed for non-interactive operations
-        else if config.fsType == "jfs" then "-q"
-        # (same here)
-        else if config.fsType == "reiserfs" then "-q"
-        else null;
-    in {
-      options = mkMerge [
-        (mkIf config.autoResize [ "x-nixos.autoresize" ])
-        (mkIf (utils.fsNeededForBoot config) [ "x-initrd.mount" ])
-      ];
-      formatOptions = mkIf (defaultFormatOptions != null) (mkDefault defaultFormatOptions);
-    };
+    config.options = mkMerge [
+      (mkIf config.autoResize [ "x-systemd.growfs" ])
+      (mkIf config.autoFormat [ "x-systemd.makefs" ])
+      (mkIf (utils.fsNeededForBoot config) [ "x-initrd.mount" ])
+    ];

  };

@ -201,23 +187,20 @@ let
      skipCheck = fs: fs.noCheck || fs.device == "none" || builtins.elem fs.fsType fsToSkipCheck || isBindMount fs;
      # https://wiki.archlinux.org/index.php/fstab#Filepath_spaces
      escape = string: builtins.replaceStrings [ " " "\t" ] [ "\\040" "\\011" ] string;
-    in fstabFileSystems: { rootPrefix ? "", extraOpts ? (fs: []) }: concatMapStrings (fs:
+    in fstabFileSystems: { rootPrefix ? "" }: concatMapStrings (fs:
      (optionalString (isBindMount fs) (escape rootPrefix))
      + (if fs.device != null then escape fs.device
         else if fs.label != null then "/dev/disk/by-label/${escape fs.label}"
         else throw "No device specified for mount point ‘${fs.mountPoint}’.")
      + " " + escape fs.mountPoint
      + " " + fs.fsType
-      + " " + escape (builtins.concatStringsSep "," (fs.options ++ (extraOpts fs)))
+      + " " + escape (builtins.concatStringsSep "," fs.options)
      + " 0 " + (if skipCheck fs then "0" else if fs.mountPoint == "/" then "1" else "2")
      + "\n"
    ) fstabFileSystems;

    initrdFstab = pkgs.writeText "initrd-fstab" (makeFstabEntries (filter utils.fsNeededForBoot fileSystems) {
      rootPrefix = "/sysroot";
-      extraOpts = fs:
-        (optional fs.autoResize "x-systemd.growfs")
-        ++ (optional fs.autoFormat "x-systemd.makefs");
    });

 in
@ -319,7 +302,13 @@ in

    assertions = let
      ls = sep: concatMapStringsSep sep (x: x.mountPoint);
-      notAutoResizable = fs: fs.autoResize && !(hasPrefix "ext" fs.fsType || fs.fsType == "f2fs");
+      resizableFSes = [
+        "ext3"
+        "ext4"
+        "btrfs"
+        "xfs"
+      ];
+      notAutoResizable = fs: fs.autoResize && !(builtins.elem fs.fsType resizableFSes);
    in [
      { assertion = ! (fileSystems' ? cycle);
        message = "The ‘fileSystems’ option can't be topologically sorted: mountpoint dependency path ${ls " -> " fileSystems'.cycle} loops to ${ls ", " fileSystems'.loops}";
@ -327,8 +316,21 @@ in
      { assertion = ! (any notAutoResizable fileSystems);
        message = let
          fs = head (filter notAutoResizable fileSystems);
-        in
-          "Mountpoint '${fs.mountPoint}': 'autoResize = true' is not supported for 'fsType = \"${fs.fsType}\"':${optionalString (fs.fsType == "auto") " fsType has to be explicitly set and"} only the ext filesystems and f2fs support it.";
+        in ''
+          Mountpoint '${fs.mountPoint}': 'autoResize = true' is not supported for 'fsType = "${fs.fsType}"'
+          ${optionalString (fs.fsType == "auto") "fsType has to be explicitly set and"}
+          only the following support it: ${lib.concatStringsSep ", " resizableFSes}.
+        '';
+      }
+      {
+        assertion = ! (any (fs: fs.formatOptions != null) fileSystems);
+        message = let
+          fs = head (filter (fs: fs.formatOptions != null) fileSystems);
+        in ''
+          'fileSystems.<name>.formatOptions' has been removed, since
+          systemd-makefs does not support any way to provide formatting
+          options.
+        '';
      }
    ];

@ -377,37 +379,7 @@ in
        wants = [ "local-fs.target" "remote-fs.target" ];
      };

-    systemd.services =
-
-    # Emit systemd services to format requested filesystems.
-      let
-        formatDevice = fs:
-          let
-            mountPoint' = "${escapeSystemdPath fs.mountPoint}.mount";
-            device'  = escapeSystemdPath fs.device;
-            device'' = "${device'}.device";
-          in nameValuePair "mkfs-${device'}"
-          { description = "Initialisation of Filesystem ${fs.device}";
-            wantedBy = [ mountPoint' ];
-            before = [ mountPoint' "systemd-fsck@${device'}.service" ];
-            requires = [ device'' ];
-            after = [ device'' ];
-            path = [ pkgs.util-linux ] ++ config.system.fsPackages;
-            script =
-              ''
-                if ! [ -e "${fs.device}" ]; then exit 1; fi
-                # FIXME: this is scary.  The test could be more robust.
-                type=$(blkid -p -s TYPE -o value "${fs.device}" || true)
-                if [ -z "$type" ]; then
-                  echo "creating ${fs.fsType} filesystem on ${fs.device}..."
-                  mkfs.${fs.fsType} ${fs.formatOptions} "${fs.device}"
-                fi
-              '';
-            unitConfig.RequiresMountsFor = [ "${dirOf fs.device}" ];
-            unitConfig.DefaultDependencies = false; # needed to prevent a cycle
-            serviceConfig.Type = "oneshot";
-          };
-      in listToAttrs (map formatDevice (filter (fs: fs.autoFormat && !(utils.fsNeededForBoot fs)) fileSystems)) // {
+    systemd.services = {
    # Mount /sys/fs/pstore for evacuating panic logs and crashdumps from persistent storage onto the disk using systemd-pstore.
    # This cannot be done with the other special filesystems because the pstore module (which creates the mount point) is not loaded then.
        "mount-pstore" = {
--- a/nixos/modules/tasks/filesystems/f2fs.nix
+++ b/nixos/modules/tasks/filesystems/f2fs.nix
@ -15,11 +15,6 @@ in

    boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable) ''
      copy_bin_and_libs ${pkgs.f2fs-tools}/sbin/fsck.f2fs
-      ${optionalString (any (fs: fs.autoResize) fileSystems) ''
-        # We need f2fs-tools' tools to resize filesystems
-        copy_bin_and_libs ${pkgs.f2fs-tools}/sbin/resize.f2fs
-      ''}
-
    '';
  };
 }
--- a/nixos/tests/apparmor.nix
+++ b/nixos/tests/apparmor.nix
@ -1,4 +1,4 @@
-import ./make-test-python.nix ({ pkgs, ... } : {
+import ./make-test-python.nix ({ pkgs, lib, ... } : {
  name = "apparmor";
  meta.maintainers = with lib.maintainers; [ julm ];

@ -27,7 +27,7 @@ import ./make-test-python.nix ({ pkgs, ... } : {
      # 4. Using `diff` against the expected output.
      with subtest("apparmorRulesFromClosure"):
          machine.succeed(
-              "${pkgs.diffutils}/bin/diff ${pkgs.writeText "expected.rules" ''
+              "${pkgs.diffutils}/bin/diff -u ${pkgs.writeText "expected.rules" ''
                  mr ${pkgs.bash}/lib/**.so*,
                  r ${pkgs.bash},
                  r ${pkgs.bash}/etc/**,
@ -64,6 +64,12 @@ import ./make-test-python.nix ({ pkgs, ... } : {
                  r ${pkgs.libunistring}/lib/**,
                  r ${pkgs.libunistring}/share/**,
                  x ${pkgs.libunistring}/foo/**,
+                  mr ${pkgs.glibc.libgcc}/lib/**.so*,
+                  r ${pkgs.glibc.libgcc},
+                  r ${pkgs.glibc.libgcc}/etc/**,
+                  r ${pkgs.glibc.libgcc}/lib/**,
+                  r ${pkgs.glibc.libgcc}/share/**,
+                  x ${pkgs.glibc.libgcc}/foo/**,
              ''} ${pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
                  ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
                      pkgs.apparmorRulesFromClosure {
--- a/nixos/tests/fsck.nix
+++ b/nixos/tests/fsck.nix
@ -30,7 +30,7 @@ import ./make-test-python.nix {
          else "fsck.ext4.*/dev/vda"}'")

    with subtest("mnt fs is fsckd"):
-        machine.succeed("journalctl -b | grep 'fsck.*/dev/vdb.*clean'")
+        machine.succeed("journalctl -b | grep 'fsck.*vdb.*clean'")
        machine.succeed(
            "grep 'Requires=systemd-fsck@dev-vdb.service' /run/systemd/generator/mnt.mount"
        )
--- a/nixos/tests/systemd-boot-ovmf-broken-fat-driver.patch
+++ b/nixos/tests/systemd-boot-ovmf-broken-fat-driver.patch
@ -0,0 +1,25 @@
+From d87a7513c6f2f2824203032ef27caeb84892ed7e Mon Sep 17 00:00:00 2001
+From: Will Fancher <elvishjerricco@gmail.com>
+Date: Tue, 30 May 2023 16:53:20 -0400
+Subject: [PATCH] Intentionally break the fat driver
+
+---
+ FatPkg/EnhancedFatDxe/ReadWrite.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/FatPkg/EnhancedFatDxe/ReadWrite.c b/FatPkg/EnhancedFatDxe/ReadWrite.c
+index 8f525044d1f1..32c62ff7817b 100644
+--- a/FatPkg/EnhancedFatDxe/ReadWrite.c
+++ b/FatPkg/EnhancedFatDxe/ReadWrite.c
+@@ -216,6 +216,11 @@ FatIFileAccess (
+   Volume = OFile->Volume;
+   Task   = NULL;
+ 
+  if (*BufferSize > (10U * 1024U * 1024U)) {
+    IFile->Position += 10U * 1024U * 1024U;
+    return EFI_BAD_BUFFER_SIZE;
+  }
+
+   //
+   // Write to a directory is unsupported
+   //
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@ -251,4 +251,29 @@ in
          machine.succeed("test -e /boot/efi/nixos/.extra-files/efi/netbootxyz/netboot.xyz.efi")
    '';
  };
+
+  # See: [Firmware file size bug] in systemd/default.nix
+  uefiLargeFileWorkaround = makeTest {
+    name = "uefi-large-file-workaround";
+
+    nodes.machine = { pkgs, ... }: {
+      imports = [common];
+      virtualisation.efi.OVMF = pkgs.OVMF.overrideAttrs (old: {
+        # This patch deliberately breaks the FAT driver in EDK2 to
+        # exhibit (part of) the firmware bug that we are testing
+        # for. Files greater than 10MiB will fail to be read in a
+        # single Read() call, so systemd-boot will fail to load the
+        # initrd without a workaround. The number 10MiB was chosen
+        # because if it were smaller than the kernel size, even the
+        # LoadImage call would fail, which is not the failure mode
+        # we're testing for. It needs to be between the kernel size
+        # and the initrd size.
+        patches = old.patches or [] ++ [ ./systemd-boot-ovmf-broken-fat-driver.patch ];
+      });
+    };
+
+    testScript = ''
+      machine.wait_for_unit("multi-user.target")
+    '';
+  };
 }
--- a/pkgs/applications/audio/sonic-pi/default.nix
+++ b/pkgs/applications/audio/sonic-pi/default.nix
@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
    pname = "mix-deps-${pname}";
    mixEnv = "test";
    src = "${src}/app/server/beam/tau";
-    sha256 = "sha256-MvwUyVTS23vQKLpGxz46tEVCs/OyYk5dDaBlv+kYg1M=";
+    hash = "sha256-MvwUyVTS23vQKLpGxz46tEVCs/OyYk5dDaBlv+kYg1M=";
  };

  strictDeps = true;
--- a/pkgs/applications/audio/subtitlr/default.nix
+++ b/pkgs/applications/audio/subtitlr/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "Subtitlr";
-  version = "0.1.0";
+  version = "0.1.1";

  src = fetchFromGitHub {
    owner = "yoanbernabeu";
    repo = pname;
    rev = version;
-    hash = "sha256-fwDIE8DFVd7NRhi8bBmFxrmGdT2ZtSFWBaynV+xz3ms=";
+    hash = "sha256-1EjOpWVTp7CqwqSJAhqicvY2crzw1n7Id+TIwYrSQAs=";
  };

-  vendorHash = "sha256-t92nz42sv8bE0JIkSFB2+WBz1Um8kcRSotpXcPIy3eQ=";
+  vendorHash = "sha256-ZgJCk9vbbQ0dcYSdKm0Cbw2AmwjpMvGb5zJkgbD+xig=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/applications/audio/tetraproc/default.nix
+++ b/pkgs/applications/audio/tetraproc/default.nix
@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
  '';

  postInstall = ''
-    # Make sure Jack is avalable in $PATH for tetraproc
+    # Make sure Jack is available in $PATH for tetraproc
    wrapProgram $out/bin/tetraproc --prefix PATH : "${jack2}/bin"
  '';

--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-devel-generated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-devel-generated.nix
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-devel-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-devel-packages.nix
@ -0,0 +1,62 @@
+/*
+
+# Updating
+
+To update the list of packages from ELPA,
+
+1. Run `./update-elpa-devel`.
+2. Check for evaluation errors:
+     # "../../../../../" points to the default.nix from root of Nixpkgs tree
+     env NIXPKGS_ALLOW_BROKEN=1 nix-instantiate ../../../../../ -A emacs.pkgs.elpaDevelPackages
+3. Run `git commit -m "elpa-devel-packages $(date -Idate)" -- elpa-devel-generated.nix`
+
+## Update from overlay
+
+Alternatively, run the following command:
+
+./update-from-overlay
+
+It will update both melpa and elpa packages using
+https://github.com/nix-community/emacs-overlay. It's almost instantenous and
+formats commits for you.
+
+*/
+
+{ lib, stdenv, texinfo, writeText, gcc, pkgs, buildPackages }:
+
+self: let
+
+  markBroken = pkg: pkg.override {
+    elpaBuild = args: self.elpaBuild (args // {
+      meta = (args.meta or {}) // { broken = true; };
+    });
+  };
+
+  elpaBuild = import ../../../../build-support/emacs/elpa.nix {
+    inherit lib stdenv texinfo writeText gcc;
+    inherit (self) emacs;
+  };
+
+  # Use custom elpa url fetcher with fallback/uncompress
+  fetchurl = buildPackages.callPackage ./fetchelpa.nix { };
+
+  generateElpa = lib.makeOverridable ({
+    generated ? ./elpa-devel-generated.nix
+  }: let
+
+    imported = import generated {
+      callPackage = pkgs: args: self.callPackage pkgs (args // {
+        inherit fetchurl;
+      });
+    };
+
+    super = removeAttrs imported [ "dash" ];
+
+    overrides = {
+    };
+
+    elpaDevelPackages = super // overrides;
+
+  in elpaDevelPackages // { inherit elpaBuild; });
+
+in generateElpa { }
--- a/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix
@ -4,8 +4,8 @@ let
  src = pkgs.fetchFromGitHub {
    owner = "nix-community";
    repo = "emacs2nix";
-    rev = "2e8d2c644397be57455ad32c2849f692eeac7797";
-    sha256 = "sha256-qnOYDYHAQ+r5eegKP9GqHz5R2ig96B2W7M+uYa1ti9M=";
+    rev = "7f07ac3c3f175630de68153d98a93b9fa24d1eb3";
+    sha256 = "sha256-Mh9G8LH3n1ccg+shBoWQRk67yAA+GEYGkk8tjM7W02Y=";
    fetchSubmodules = true;
  };
 in
--- a/pkgs/applications/editors/emacs/elisp-packages/update-elpa-devel
+++ b/pkgs/applications/editors/emacs/elisp-packages/update-elpa-devel
@ -0,0 +1,4 @@
+#! /usr/bin/env nix-shell
+#! nix-shell --show-trace ./emacs2nix.nix -i bash
+
+exec elpa-devel-packages.sh --names $EMACS2NIX/names.nix -o elpa-devel-generated.nix
--- a/pkgs/applications/editors/thonny/default.nix
+++ b/pkgs/applications/editors/thonny/default.nix
@ -42,7 +42,6 @@ buildPythonApplication rec {

  preFixup = ''
    wrapProgram "$out/bin/thonny" \
-       --set TK_LIBRARY "${tk}/lib/${tk.libPrefix}" \
       --prefix PYTHONPATH : $PYTHONPATH:$(toPythonPath ${python3.pkgs.jedi})
  '';

@ -64,6 +63,6 @@ buildPythonApplication rec {
    homepage = "https://www.thonny.org/";
    license = licenses.mit;
    maintainers = with maintainers; [ leenaars ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -192,23 +192,23 @@
  };
  comment = buildGrammar {
    language = "comment";
-    version = "0.0.0+rev=f08e7d4";
+    version = "0.0.0+rev=94c99a6";
    src = fetchFromGitHub {
      owner = "stsewd";
      repo = "tree-sitter-comment";
-      rev = "f08e7d44b2923e9da2bf487a2f365d08677d368e";
-      hash = "sha256-v3h4x3R+9xbCEFezZlWPPM2Hb4575mbRkkyw7oz7K+U=";
+      rev = "94c99a66bb5051d8321b5900aee92b76450c50ce";
+      hash = "sha256-ma1LIiNuccXNftijehRzABVv7R3Jw9Wcjz0X2vGqaIc=";
    };
    meta.homepage = "https://github.com/stsewd/tree-sitter-comment";
  };
  commonlisp = buildGrammar {
    language = "commonlisp";
-    version = "0.0.0+rev=c7e8149";
+    version = "0.0.0+rev=5b83fc6";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-commonlisp";
-      rev = "c7e814975ab0d0d04333d1f32391c41180c58919";
-      hash = "sha256-63B9d5feHzwY7WDoeoPAwsuLYgVvoGQf0wkUdDO/A8M=";
+      rev = "5b83fc6c2e45df43333db605e87615cdf00eb164";
+      hash = "sha256-jEUQe0YkQ/HTF6Ld1/7bkBvpRR4nDYgNNkoKe3xQeMc=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-commonlisp";
  };
@ -269,12 +269,12 @@
  };
  cuda = buildGrammar {
    language = "cuda";
-    version = "0.0.0+rev=867c97e";
+    version = "0.0.0+rev=32efc63";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-cuda";
-      rev = "867c97ed7769e56bff99f7122cf63effadb812cc";
-      hash = "sha256-eSWY1z4kRD07YYeDTxGmiuI8FFClFsOfyaCDRtkEX1M=";
+      rev = "32efc637d841d3adcebb182e4420bc1dd48dab9f";
+      hash = "sha256-iD/cfP2pkHAZ207VEcronrbaBgHF13lyQjpkGOrmyEY=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-cuda";
  };
@ -392,12 +392,12 @@
  };
  elixir = buildGrammar {
    language = "elixir";
-    version = "0.0.0+rev=869dff3";
+    version = "0.0.0+rev=4ba9dab";
    src = fetchFromGitHub {
      owner = "elixir-lang";
      repo = "tree-sitter-elixir";
-      rev = "869dff3ceb8823ca4b17ca33b663667c8e41e8ba";
-      hash = "sha256-wEGW4+O8ATlsrzC+qwhTtd39L5gbQM7B7N4MqabfIFQ=";
+      rev = "4ba9dab6e2602960d95b2b625f3386c27e08084e";
+      hash = "sha256-V/7aS+H4X8YzoJOIU9xpJBVvBjbcvwvTxeCsb9X39/I=";
    };
    meta.homepage = "https://github.com/elixir-lang/tree-sitter-elixir";
  };
@ -1096,24 +1096,24 @@
  };
  markdown = buildGrammar {
    language = "markdown";
-    version = "0.0.0+rev=fa6bfd5";
+    version = "0.0.0+rev=231f316";
    src = fetchFromGitHub {
      owner = "MDeiml";
      repo = "tree-sitter-markdown";
-      rev = "fa6bfd51727e4bef99f7eec5f43947f73d64ea7d";
-      hash = "sha256-P31TiBW5JqDfYJhWH6pGqD2aWan0Bo1Tl0ONEg7ePnM=";
+      rev = "231f3163cd27d48f91a4517cfdf72d167a9ef164";
+      hash = "sha256-Fcq99HcTOcZwXs0V2zpTiDDQVcGocZQ0we5On9p+Uck=";
    };
    location = "tree-sitter-markdown";
    meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
  };
  markdown_inline = buildGrammar {
    language = "markdown_inline";
-    version = "0.0.0+rev=fa6bfd5";
+    version = "0.0.0+rev=231f316";
    src = fetchFromGitHub {
      owner = "MDeiml";
      repo = "tree-sitter-markdown";
-      rev = "fa6bfd51727e4bef99f7eec5f43947f73d64ea7d";
-      hash = "sha256-P31TiBW5JqDfYJhWH6pGqD2aWan0Bo1Tl0ONEg7ePnM=";
+      rev = "231f3163cd27d48f91a4517cfdf72d167a9ef164";
+      hash = "sha256-Fcq99HcTOcZwXs0V2zpTiDDQVcGocZQ0we5On9p+Uck=";
    };
    location = "tree-sitter-markdown-inline";
    meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
@ -1509,12 +1509,12 @@
  };
  racket = buildGrammar {
    language = "racket";
-    version = "0.0.0+rev=ed5369a";
+    version = "0.0.0+rev=e196cd4";
    src = fetchFromGitHub {
      owner = "6cdh";
      repo = "tree-sitter-racket";
-      rev = "ed5369ad17166c0749ab7241d826c438bd69338d";
-      hash = "sha256-/vvmVirIXH6uAtqEGvG//3XobLFzWCYXIGe4e0N1DsU=";
+      rev = "e196cd417c425c2c3dc54f3b7b7666fe968ba50b";
+      hash = "sha256-BSHa+CnxMflSCwmxrtMGLS9/wqBfi7NFwmG2LyXKm6c=";
    };
    meta.homepage = "https://github.com/6cdh/tree-sitter-racket";
  };
@ -1575,12 +1575,12 @@
  };
  rst = buildGrammar {
    language = "rst";
-    version = "0.0.0+rev=25e6328";
+    version = "0.0.0+rev=c7c2b24";
    src = fetchFromGitHub {
      owner = "stsewd";
      repo = "tree-sitter-rst";
-      rev = "25e6328872ac3a764ba8b926aea12719741103f1";
-      hash = "sha256-g3CovnXY15SkxAdVk15M4hAxizqLc551omwKKG+Vozg=";
+      rev = "c7c2b24918e231072af2d10c03b4893818de9d5d";
+      hash = "sha256-qLnP6OCWJv/CbRCsgKKwLY+QVulQdpqgVO3EjuPwypE=";
    };
    meta.homepage = "https://github.com/stsewd/tree-sitter-rst";
  };
@ -1619,12 +1619,12 @@
  };
  scheme = buildGrammar {
    language = "scheme";
-    version = "0.0.0+rev=dd9a73d";
+    version = "0.0.0+rev=0c763bd";
    src = fetchFromGitHub {
      owner = "6cdh";
      repo = "tree-sitter-scheme";
-      rev = "dd9a73d851238881a3a9426298d69742d24b7842";
-      hash = "sha256-KyR7MuZBMkQ3fWRaP1nQqo/ih2v3XM2v5tdu0SGuDOA=";
+      rev = "0c763bd5f85b18e354bc338d17cf1daa23b478b1";
+      hash = "sha256-MHQdWH7nNBAJGLb6DN0NmpwQIIyO0+JznVPkTvryupU=";
    };
    meta.homepage = "https://github.com/6cdh/tree-sitter-scheme";
  };
@ -1944,12 +1944,12 @@
  };
  usd = buildGrammar {
    language = "usd";
-    version = "0.0.0+rev=04816b1";
+    version = "0.0.0+rev=718a6b3";
    src = fetchFromGitHub {
      owner = "ColinKennedy";
      repo = "tree-sitter-usd";
-      rev = "04816b1fbfe548e1446a9efe8b069f3f6e095504";
-      hash = "sha256-n9sK02luVOv88P8SDCKIaBlEYtYYT0fQ+fjlYuP9AJY=";
+      rev = "718a6b3e939904e0b4fe7cff6742e96af4781f4b";
+      hash = "sha256-6U4TreAeAGB7WRUtTXdxQvNa6Sl6E+f329/SZ6DOQ+0=";
    };
    meta.homepage = "https://github.com/ColinKennedy/tree-sitter-usd";
  };
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -571,6 +571,7 @@ https://github.com/bfredl/nvim-luadev/,HEAD,
 https://github.com/rafcamlet/nvim-luapad/,,
 https://github.com/scalameta/nvim-metals/,,
 https://github.com/gpanders/nvim-moonwalk/,,
+https://github.com/SmiteshP/nvim-navbuddy/,,
 https://github.com/smiteshp/nvim-navic/,HEAD,
 https://github.com/AckslD/nvim-neoclip.lua/,,
 https://github.com/yamatsum/nvim-nonicons/,,
--- a/pkgs/applications/emulators/blink/default.nix
+++ b/pkgs/applications/emulators/blink/default.nix
@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, lib }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "blink";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "jart";
+    repo = "blink";
+    rev = finalAttrs.version;
+    hash = "sha256-W7yL7Ut3MRygJhFGr+GIj/CK57MkuDTcenft8IvH7jU=";
+  };
+
+  # 'make check' requires internet connection
+  doCheck = true;
+  checkTarget = "test";
+
+  meta = {
+    description = "Tiniest x86-64-linux emulator";
+    longDescription = ''
+      blink is a virtual machine that runs x86-64-linux programs on different operating systems and hardware architectures. It's designed to do the same thing as the qemu-x86_64 command, except that
+      - blink is much smaller in size than qemu-x86_64
+      - blink will run your Linux binaries on any POSIX platform, whereas qemu-x86_64 only supports Linux
+      - blink goes 2x faster than qemu-x86_64 on some benchmarks, such as SSE integer / floating point math. Blink is also faster at running ephemeral programs such as compilers
+    '';
+
+    homepage = "https://github.com/jart/blink";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ t4ccer ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@ -9,25 +9,25 @@
 let

  pname = "1password";
-  version = if channel == "stable" then "8.10.6" else "8.10.7-11.BETA";
+  version = if channel == "stable" then "8.10.7" else "8.10.7-11.BETA";

  sources = {
    stable = {
      x86_64-linux = {
        url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-wCY94x67z+X8l3wr79+BXuu6/UXJldbVIA67AAD9mj0=";
+        sha256 = "sha256-5KMAzstoPmNgFejp21R8PcdrmUtkX3qxHYX3rV5JqyE=";
      };
      aarch64-linux = {
        url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-iLjuudWmkLMuoZSZZo9pRpx0MZludUrGTpTHCTNk4Vo=";
+        sha256 = "sha256-Tmof+ma1SJMQRSV1T5flLeXfe6W1a2U2mYzi+MrxvJM=";
      };
      x86_64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-FVj5x1RVBxPsgWhG6R4ykarZdLdJcj6gO5mQy3hHB4M=";
+        sha256 = "sha256-jtqgJJy1ZhyaEUEafT1ywD529aKGDqc0J3mgYSGVTWU=";
      };
      aarch64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-ilQP1OF4gydzlLZq3aZzqNbzvacRbruzWS7pVt6DP9g=";
+        sha256 = "sha256-qLqK6CZcqDfIGX0FzEnAZP3Rkxw8CNtT6sFy8u0IqwM=";
      };
    };
    beta = {
--- a/pkgs/applications/misc/audio/soxr/default.nix
+++ b/pkgs/applications/misc/audio/soxr/default.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
    ./arm64-check.patch
  ];

-  outputs = [ "out" "doc" ]; # headers are just two and very small
+  outputs = [ "out" "dev" "doc" ];

  nativeBuildInputs = [ cmake ];

--- a/pkgs/applications/misc/comodoro/default.nix
+++ b/pkgs/applications/misc/comodoro/default.nix
@ -0,0 +1,47 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, installShellFiles
+, installShellCompletions ? stdenv.hostPlatform == stdenv.buildPlatform
+, installManPages ? stdenv.hostPlatform == stdenv.buildPlatform
+, withTcp ? true
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "comodoro";
+  version = "0.0.8";
+
+  src = fetchFromGitHub {
+    owner = "soywod";
+    repo = "comodoro";
+    rev = "v${version}";
+    sha256 = "rGnVXyfWJkPHfpf1gRGbDJ6Y1ycKOOcCZ+Jx35fUo6M=";
+  };
+
+  cargoSha256 = "jpshuavywCLN03xD/gFgQeGbKtmHq5pULbxd+RUbaDk=";
+
+  nativeBuildInputs = lib.optional (installManPages || installShellCompletions) installShellFiles;
+
+  buildNoDefaultFeatures = true;
+  buildFeatures = lib.optional withTcp "tcp";
+
+  postInstall = lib.optionalString installManPages ''
+    mkdir -p $out/man
+    $out/bin/comodoro man $out/man
+    installManPage $out/man/*
+  '' + lib.optionalString installShellCompletions ''
+    installShellCompletion --cmd comodoro \
+      --bash <($out/bin/comodoro completion bash) \
+      --fish <($out/bin/comodoro completion fish) \
+      --zsh <($out/bin/comodoro completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "CLI to manage your time.";
+    homepage = "https://pimalaya.org/comodoro/";
+    changelog = "https://github.com/soywod/comodoro/blob/v${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ soywod ];
+  };
+}
--- a/pkgs/applications/misc/far2l/default.nix
+++ b/pkgs/applications/misc/far2l/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper, cmake, ninja, pkg-config, m4, bash
 , xdg-utils, zip, unzip, gzip, bzip2, gnutar, p7zip, xz
-, IOKit, Carbon, Cocoa, AudioToolbox, OpenGL
+, IOKit, Carbon, Cocoa, AudioToolbox, OpenGL, System
 , withTTYX ? true, libX11
 , withGUI ? true, wxGTK32
 , withUCD ? true, libuchardet
@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
    ++ lib.optionals withNetRocks [ openssl libssh libnfs neon ]
    ++ lib.optional (withNetRocks && !stdenv.isDarwin) samba # broken on darwin
    ++ lib.optionals withPython (with python3Packages; [ python cffi debugpy pcpp ])
-    ++ lib.optionals stdenv.isDarwin [ IOKit Carbon Cocoa AudioToolbox OpenGL ];
+    ++ lib.optionals stdenv.isDarwin [ IOKit Carbon Cocoa AudioToolbox OpenGL System ];

  postPatch = ''
    patchShebangs python/src/prebuild.sh
@ -43,9 +43,6 @@ stdenv.mkDerivation rec {
      --replace '"/bin/bash"' '"${bash}/bin/bash"'
    substituteInPlace far2l/src/cfg/config.cpp \
      --replace '"/bin/bash"' '"${bash}/bin/bash"'
-  '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace WinPort/src/Backend/WX/CMakeLists.txt \
-      --replace "-framework System" -lSystem
  '';

  cmakeFlags = lib.mapAttrsToList (k: v: "-D${k}=${if v then "yes" else "no"}") {
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@ -47,12 +47,12 @@ let

 in
 stdenv.mkDerivation rec {
-  version = "1.21.1";
+  version = "1.22.1";
  pname = "mupdf";

  src = fetchurl {
    url = "https://mupdf.com/downloads/archive/${pname}-${version}-source.tar.gz";
-    sha256 = "sha256-sk3b4SUGzILeCNXNSUYUugg0b4F12x2YvPk4/5SSWlQ=";
+    sha256 = "sha256-1i88DkVuu8QucfWkfw+M0SzsK/Co1yt541+jWmU4slo=";
  };

  patches = [ ./0001-Use-command-v-in-favor-of-which.patch
--- a/pkgs/applications/misc/streamdeck-ui/default.nix
+++ b/pkgs/applications/misc/streamdeck-ui/default.nix
@ -7,6 +7,7 @@
 , writeText
 , makeDesktopItem
 , xvfb-run
+, qt5
 }:

 python3Packages.buildPythonApplication rec {
@ -77,6 +78,8 @@ python3Packages.buildPythonApplication rec {
    pyside2
    streamdeck
    xlib
+  ] ++ lib.optionals stdenv.isLinux [
+    qt5.qtwayland
  ];

  nativeCheckInputs = [
--- a/pkgs/applications/misc/tandoor-recipes/common.nix
+++ b/pkgs/applications/misc/tandoor-recipes/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "1.4.9";
+  version = "1.4.12";

  src = fetchFromGitHub {
    owner = "TandoorRecipes";
    repo = "recipes";
    rev = version;
-    sha256 = "sha256-h424lUm/wmCHXkMW2XejogvH3wL/+J67cG4m8rIWM1U=";
+    sha256 = "sha256-ZGPXcpicDYCE+J9mC2Dk/Ds2NYfUETuKXqHxpAGH86w=";
  };

  yarnSha256 = "sha256-LJ0uL66tcK6zL8Mkd2UB8dHsslMTtf8wQmgbZdvOT6s=";
--- a/pkgs/applications/misc/tandoor-recipes/default.nix
+++ b/pkgs/applications/misc/tandoor-recipes/default.nix
@ -42,12 +42,6 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
  patches = [
    # Allow setting MEDIA_ROOT through environment variable
    ./media-root.patch
-    # Address CVE-2023-31047 on Django 4.2.1+
-    (fetchpatch {
-      name = "fix-multiple-file-field";
-      url = "https://github.com/TandoorRecipes/recipes/pull/2458/commits/6b04c922977317354a367487427b15a8ed619be9.patch";
-      hash = "sha256-KmfjJSrB/4tOWtU7zrDJ/AOG4XlmWy/halw8IEEXdZ0=";
-    })
  ];

  propagatedBuildInputs = with python.pkgs; [
--- a/pkgs/applications/misc/ttyper/default.nix
+++ b/pkgs/applications/misc/ttyper/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ttyper";
-  version = "1.2.0";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "max-niederman";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-puChbaLjpm5FmpYIrb+3eKO9BSFu99R5j4ymKH5359Y=";
+    sha256 = "sha256-1frm41Vbo4t1BELq0rNGb1hY7RQLt8IJaEhtyNfNNdU=";
  };

-  cargoSha256 = "sha256-DKpZQZgMR+gbcxxAD8ru5O4o7vr6n4seBVqor3HrYtY=";
+  cargoSha256 = "sha256-UyO8oX54qVQA7nFx6Y/cSgb33Cz3M0kFeiYqUrSbCe0=";

  meta = with lib; {
    description = "Terminal-based typing test";
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -3,10 +3,10 @@
 {
  firefox = buildMozillaMach rec {
    pname = "firefox";
-    version = "113.0.2";
+    version = "114.0";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "7b1ff7d547fda02901f54a2593e03598a830698192003d833e27b85db0e00571ff66e03ebd4089e76fa65b09df000cbb2542450beeabb0b310875910603e6743";
+      sha512 = "c6929d34583f25119738d1c817a24fd358fcada1f0ba5c14bab07c2acd35f18a012f23d054bfe8c6b12c0dda7bd3abdc7a305a36c7a4d36542885abeea3aafec";
    };

    meta = {
@ -85,11 +85,11 @@

  firefox-esr-102 = buildMozillaMach rec {
    pname = "firefox-esr-102";
-    version = "102.11.0esr";
+    version = "102.12.0esr";
    applicationName = "Mozilla Firefox ESR";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "fdfed404c87f33001c0ab50f9899fa80c897fac645be8ed832e426f412aafbf1468b1c8301bad463b3f5535b6d6f2005a96a748b6e2d6bf5afbc3b5bc10983d6";
+      sha512 = "2a85cf1e1c83a862c2886a63dcf3e3e8bca9dd3ed72c5d0223db52387fff3796bc0dcbb508adb8c10a30729f20554c5aac37f8ad045b0088a593d28e39d77fe5";
    };

    meta = {
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@ -3,6 +3,7 @@
 , buildGo120Module
 , fetchFromGitHub
 , nixosTests
+, installShellFiles
 }:

 let
@ -23,11 +24,18 @@ let
        inherit sha256;
      };

+      nativeBuildInputs = [ installShellFiles ];
+
      # ui:
      #  Nomad release commits include the compiled version of the UI, but the file
      #  is only included if we build with the ui tag.
      tags = [ "ui" ];

+      postInstall = ''
+        echo "complete -C $out/bin/nomad nomad" > nomad.bash
+        installShellCompletion nomad.bash
+      '';
+
      meta = with lib; {
        homepage = "https://www.nomadproject.io/";
        description = "A Distributed, Highly Available, Datacenter-Aware Scheduler";
--- a/pkgs/applications/networking/filebrowser/default.nix
+++ b/pkgs/applications/networking/filebrowser/default.nix
@ -0,0 +1,60 @@
+{ buildGoModule, buildNpmPackage, fetchFromGitHub, lib }:
+
+let
+  frontend = buildNpmPackage rec {
+    pname = "filebrowser-frontend";
+    version = "2.23.0";
+
+    src = fetchFromGitHub {
+      owner = "filebrowser";
+      repo = "filebrowser";
+      rev = "v${version}";
+      hash = "sha256-xhBIJcEtxDdMXSgQtLAV0UWzPtrvKEil0WV76K5ycBc=";
+    };
+
+    sourceRoot = "source/frontend";
+
+    npmDepsHash = "sha256-acNIMKHc4q7eiFLPBtKZBNweEsrt+//0VR6dqwXHTvA=";
+
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir $out
+      mv dist $out
+
+      runHook postInstall
+    '';
+  };
+in
+buildGoModule rec {
+  pname = "filebrowser";
+  version = "2.23.0";
+
+  src = fetchFromGitHub {
+    owner = "filebrowser";
+    repo = "filebrowser";
+    rev = "v${version}";
+    hash = "sha256-xhBIJcEtxDdMXSgQtLAV0UWzPtrvKEil0WV76K5ycBc=";
+  };
+
+  vendorHash = "sha256-MR0ju2Nomb3j78Z+1YcJY+jPd40MZpuOTuQJM94AM8A=";
+
+  excludedPackages = [ "tools" ];
+
+  preBuild = ''
+    cp -r ${frontend}/dist frontend/
+  '';
+
+  passthru = {
+    inherit frontend;
+  };
+
+  meta = with lib; {
+    description = "Filebrowser is a web application for managing files and directories";
+    homepage = "https://filebrowser.org";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ nielsegberts ];
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 (if stdenv.isDarwin then darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv).mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20230531";
+  version = "20230603-2";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-VK2/LaWO/zXMqSpeEjUM/PBd4MG76HaXY6kENwADN1k=";
+    hash = "sha256-BcvC50K5yt2aoStyoJ2XZYs3hb2YnVDL3kRpU/Y23Z4=";
  };

  postPatch = ''
--- a/pkgs/applications/office/bookletimposer/default.nix
+++ b/pkgs/applications/office/bookletimposer/default.nix
@ -25,9 +25,7 @@ python3.pkgs.buildPythonApplication rec {
    ./configdir.patch
  ];

-  nativeBuildInputs = [ intltool pandoc wrapGAppsHook ];
-
-  buildInputs = [ gobject-introspection ];
+  nativeBuildInputs = [ intltool pandoc wrapGAppsHook gobject-introspection ];

  propagatedBuildInputs = [
     gtk3
--- a/pkgs/applications/radio/flrig/default.nix
+++ b/pkgs/applications/radio/flrig/default.nix
@ -8,12 +8,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "2.0.0";
+  version = "2.0.01";
  pname = "flrig";

  src = fetchurl {
    url = "mirror://sourceforge/fldigi/${pname}-${version}.tar.gz";
-    sha256 = "sha256-DTqheZhCSrupokhVqGrOwBcXwQRgoMv16fMjEFRqbCA=";
+    sha256 = "sha256-TFZZaTtU7TLBPA7jpBTu2JtkZpxjG57Rin8OVFedHwA=";
  };

  buildInputs = [
--- a/pkgs/applications/science/logic/egglog/Cargo.lock
+++ b/pkgs/applications/science/logic/egglog/Cargo.lock
--- a/pkgs/applications/science/logic/egglog/default.nix
+++ b/pkgs/applications/science/logic/egglog/default.nix
@ -0,0 +1,32 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "egglog";
+  version = "unstable-2023-05-22";
+
+  src = fetchFromGitHub {
+    owner = "egraphs-good";
+    repo = "egglog";
+    rev = "5242b50051c339d55009860d4dff80125fdcedfd";
+    hash = "sha256-N04CfITLEr4D4s6bUi0eRQdAVy6Ztq3Ml0365of7i0U=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "symbol_table-0.2.0" = "sha256-f9UclMOUig+N5L3ibBXou0pJ4S/CQqtaji7tnebVbis=";
+      "symbolic_expressions-5.0.3" = "sha256-mSxnhveAItlTktQC4hM8o6TYjgtCUgkdZj7i6MR4Oeo=";
+    };
+  };
+
+  meta = with lib; {
+    description = "A fixpoint reasoning system that unifies Datalog and equality saturation";
+    homepage = "https://github.com/egraphs-good/egglog";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "egg-smol";
+  };
+}
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@ -35,6 +35,7 @@ let
    expat
    fontconfig
    freetype
+  ] ++ lib.optionals stdenv.isLinux [
    libGL
    xorg.libX11
    xorg.libXcursor
@ -42,7 +43,6 @@ let
    xorg.libXrandr
    xorg.libXxf86vm
    xorg.libxcb
-  ] ++ lib.optionals stdenv.isLinux [
    libxkbcommon
    wayland
  ];
--- a/pkgs/applications/version-management/git-credential-keepassxc/default.nix
+++ b/pkgs/applications/version-management/git-credential-keepassxc/default.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-credential-keepassxc";
-  version = "0.12.0";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "Frederick888";
    repo = "git-credential-keepassxc";
    rev = "v${version}";
-    hash = "sha256-siVSZke+anVTaLiJVyDEKvgX+VmS0axa+4721nlgmiw=";
+    hash = "sha256-eu4Ff+7670gCO+j3WSRnvQ1aFXIx0nw1jAZXNuni2bU=";
  };

-  cargoHash = "sha256-QMAAKkjWgM/UiOfkNMLQxyGEYYmiSvE0Pd8fZXYyN48=";
+  cargoHash = "sha256-DVMQLsiiaxMZtDqzqnMJQl91NCuMRSPEb8B6AttB4lE=";

  buildInputs = lib.optionals stdenv.isDarwin [ DiskArbitration Foundation ];

--- a/pkgs/applications/version-management/monotone/default.nix
+++ b/pkgs/applications/version-management/monotone/default.nix
@ -44,6 +44,11 @@ stdenv.mkDerivation rec {

  postPatch = ''
    sed -e 's@/usr/bin/less@${less}/bin/less@' -i src/unix/terminal.cc
+  '' + lib.optionalString (lib.versionAtLeast boost.version "1.73") ''
+    find . -type f -exec sed -i \
+      -e 's/ E(/ internal_E(/g' \
+      -e 's/{E(/{internal_E(/g' \
+      {} +
  '';

  CXXFLAGS=" --std=c++11 ";
--- a/pkgs/applications/version-management/tig/default.nix
+++ b/pkgs/applications/version-management/tig/default.nix
@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
    cp contrib/vim.tigrc $out/etc/

    # Note: Until https://github.com/jonas/tig/issues/940 is resolved it is best
-    # not to install the ZSH completion so that the fallback implemenation from
+    # not to install the ZSH completion so that the fallback implementation from
    # ZSH can be used (Completion/Unix/Command/_git: "_tig () { _git-log }"):
    #install -D contrib/tig-completion.zsh $out/share/zsh/site-functions/_tig

--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@ -97,12 +97,12 @@ let
  # Handbrake maintains a set of ffmpeg patches. In particular, these
  # patches are required for subtitle timing to work correctly. See:
  # https://github.com/HandBrake/HandBrake/issues/4029
-  ffmpeg-version = "5.1.1";
+  ffmpeg-version = "5.1.2";
  ffmpeg-hb = ffmpeg_5-full.overrideAttrs (old: {
    version = ffmpeg-version;
    src = fetchurl {
      url = "https://www.ffmpeg.org/releases/ffmpeg-${ffmpeg-version}.tar.bz2";
-      hash = "sha256-zQ4W+QNCEmbVzN3t97g7nldUrvS596fwbOnkyALwVFs=";
+      hash = "sha256-OaC8yNmFSfFsVwYkZ4JGpqxzbAZs69tAn5UC6RWyLys=";
    };
    patches = old.patches or [ ] ++ [
      "${src}/contrib/ffmpeg/A01-qsv-libavfilter-qsvvpp-change-the-output-frame-s-width-a.patch"
@ -133,7 +133,8 @@ let
      "${src}/contrib/ffmpeg/A26-Update-the-min-version-to-1.4.23.0-for-AMF-SDK.patch"
      "${src}/contrib/ffmpeg/A27-avcodec-amfenc-Fixes-the-color-information-in-the-ou.patch"
      "${src}/contrib/ffmpeg/A28-avcodec-amfenc-HDR-metadata.patch"
-      "${src}/contrib/ffmpeg/A30-svt-av1-backports.patch"
+      # This patch is not applying since ffmpeg 5.1.1, probably it was backported by upstream
+      # "${src}/contrib/ffmpeg/A30-svt-av1-backports.patch"
    ];
  });

--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mkvtoolnix";
-  version = "76.0";
+  version = "77.0";

  src = fetchFromGitLab {
    owner = "mbunkus";
    repo = "mkvtoolnix";
    rev = "release-${version}";
-    sha256 = "sha256-jeuok3sspLQRnLCYvsmIbjhuf00eSS/4FjmzlRyzYzc=";
+    sha256 = "t+kfFS5c8w+c9wxNh59nceFesfdMy8qvHlUqDbZAxkk=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@ -54,6 +54,7 @@
 , lua5
 , mpeg2dec
 , ncurses
+, openssl
 , perl
 , pkg-config
 , removeReferencesTo
@ -158,6 +159,7 @@ stdenv.mkDerivation rec {
    libXvMC
    xcbutilkeysyms
  ])
+  ++ optional onlyLibVLC openssl # not sure why
  ++ optional (!stdenv.hostPlatform.isAarch && !onlyLibVLC) live555
  ++ optional jackSupport libjack2
  ++ optionals chromecastSupport [ libmicrodns protobuf ]
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "containerd";
-  version = "1.7.1";
+  version = "1.7.2";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = "containerd";
    rev = "v${version}";
-    hash = "sha256-WwedtcsrDQwMQcKFO5nnPiHyGJpl5hXZlmpbBe1/ftY=";
+    hash = "sha256-L4zaA+kMBz2tRMbitZUxb9/wdimSO2njx6ozvyKKlkk=";
  };

  vendorHash = null;
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@ -116,7 +116,7 @@ stdenv.mkDerivation (rec {
    # Remove in-tree qemu stuff in case we build from a tar-ball
    rm -rf tools/qemu-xen tools/qemu-xen-traditional

-    # Fix shebangs, mainly for build-scipts
+    # Fix shebangs, mainly for build-scripts
    # We want to do this before getting prefetched stuff to speed things up
    # (prefetched stuff has lots of files)
    find . -type f | xargs sed -i 's@/usr/bin/\(python\|perl\)@/usr/bin/env \1@g'
--- a/pkgs/applications/window-managers/cardboard/default.nix
+++ b/pkgs/applications/window-managers/cardboard/default.nix
@ -57,11 +57,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cardboard";
-  version = "0.pre+unstable=2021-05-10";
+  version = "unstable=2021-05-10";

  src = fetchFromGitLab {
    owner = "cardboardwm";
-    repo = pname;
+    repo = "cardboard";
    rev = "b54758d85164fb19468f5ca52588ebea576cd027";
    hash = "sha256-Kn5NyQSDyX7/nn2bKZPnsuepkoppi5XIkdu7IDy5r4w=";
  };
@ -73,6 +73,7 @@ stdenv.mkDerivation rec {
    pkg-config
    unzip
  ];
+
  buildInputs = [
    ffmpeg
    libGL
@ -93,12 +94,12 @@ stdenv.mkDerivation rec {
  ];

  postPatch = ''
-    (cd subprojects
-     tar xvf ${cereal-wrap}
-     unzip ${cereal-wrapdb}
-     cp -r ${expected-wrap} ${expected-wrap.name}
-     cp -r ${wlroots-wrap} ${wlroots-wrap.name}
-    )
+    pushd subprojects
+    tar xvf ${cereal-wrap}
+    unzip ${cereal-wrapdb}
+    cp -r ${expected-wrap} ${expected-wrap.name}
+    cp -r ${wlroots-wrap} ${wlroots-wrap.name}
+    popd

    sed '1i#include <functional>' -i cardboard/ViewAnimation.h # gcc12
  '';
@ -112,11 +113,15 @@ stdenv.mkDerivation rec {

  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=array-bounds" ]; # gcc12

-  meta = with lib; {
+  meta = {
    homepage = "https://gitlab.com/cardboardwm/cardboard";
    description = "A scrollable, tiling Wayland compositor inspired on PaperWM";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = with platforms; unix;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (wayland.meta) platforms;
+    knownVulnerabilities = [
+      "CVE-2020-11104 (inherited from cereal 1.3.0)"
+      "CVE-2020-11105 (inherited from cereal 1.3.0)"
+    ];
  };
 }
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@ -54,16 +54,16 @@ lib.makeOverridable (
 */

 assert deepClone -> leaveDotGit;
-assert nonConeMode -> !(sparseCheckout == "" || sparseCheckout == []);
+assert nonConeMode -> (sparseCheckout != []);

 if md5 != "" then
  throw "fetchgit does not support md5 anymore, please use sha256"
 else if hash != "" && sha256 != "" then
  throw "Only one of sha256 or hash can be set"
+else if builtins.isString sparseCheckout then
+  # Changed to throw on 2023-06-04
+  throw "Please provide directories/patterns for sparse checkout as a list of strings. Passing a (multi-line) string is not supported any more."
 else
-# Added 2022-11-12
-lib.warnIf (builtins.isString sparseCheckout)
-  "Please provide directories/patterns for sparse checkout as a list of strings. Support for passing a (multi-line) string is deprecated and will be removed in the next release."
 stdenvNoCC.mkDerivation {
  inherit name;
  builder = ./builder.sh;
@ -84,7 +84,7 @@ stdenvNoCC.mkDerivation {
  # git-sparse-checkout(1) says:
  # > When the --stdin option is provided, the directories or patterns are read
  # > from standard in as a newline-delimited list instead of from the arguments.
-  sparseCheckout = if builtins.isString sparseCheckout then sparseCheckout else builtins.concatStringsSep "\n" sparseCheckout;
+  sparseCheckout = builtins.concatStringsSep "\n" sparseCheckout;

  inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName nonConeMode postFetch;

--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@ -17,8 +17,8 @@ branchName=$NIX_PREFETCH_GIT_BRANCH_NAME
 out=${out:-}
 http_proxy=${http_proxy:-}

-# allow overwritting cacert's ca-bundle.crt with a custom one
-# this can be done by setting NIX_GIT_SSL_CAINFO and NIX_SSL_CERT_FILE enviroment variables for the nix-daemon
+# allow overwriting cacert's ca-bundle.crt with a custom one
+# this can be done by setting NIX_GIT_SSL_CAINFO and NIX_SSL_CERT_FILE environment variables for the nix-daemon
 GIT_SSL_CAINFO=${NIX_GIT_SSL_CAINFO:-$GIT_SSL_CAINFO}

 # populated by clone_user_rev()
--- a/pkgs/build-support/fetchgithub/default.nix
+++ b/pkgs/build-support/fetchgithub/default.nix
@ -25,7 +25,7 @@ let
  };
  passthruAttrs = removeAttrs args [ "owner" "repo" "rev" "fetchSubmodules" "forceFetchGit" "private" "githubBase" "varPrefix" ];
  varBase = "NIX${if varPrefix == null then "" else "_${varPrefix}"}_GITHUB_PRIVATE_";
-  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit || !(sparseCheckout == "" || sparseCheckout == []);
+  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit || (sparseCheckout != []);
  # We prefer fetchzip in cases we don't need submodules as the hash
  # is more stable in that case.
  fetcher = if useFetchGit then fetchgit else fetchzip;
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@ -57,8 +57,8 @@

  # GCC
  gcc = [
-    "https://bigsearcher.com/mirrors/gcc/"
    "https://mirror.koddos.net/gcc/"
+    "https://bigsearcher.com/mirrors/gcc/"
    "ftp://ftp.nluug.nl/mirror/languages/gcc/"
    "ftp://ftp.fu-berlin.de/unix/languages/gcc/"
    "ftp://ftp.irisa.fr/pub/mirrors/gcc.gnu.org/gcc/"
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@ -6,9 +6,6 @@
 , passthru ? { }
 , patches ? [ ]

-  # Go tags, passed to go via -tag
-, tags ? [ ]
-
  # A function to override the go-modules derivation
 , overrideModAttrs ? (_oldAttrs: { })

@ -201,7 +198,7 @@ let

        declare -a flags
        flags+=($buildFlags "''${buildFlagsArray[@]}")
-        flags+=(''${tags:+-tags=${lib.concatStringsSep "," tags}})
+        flags+=(''${tags:+-tags=''${tags// /,}})
        flags+=(''${ldflags:+-ldflags="$ldflags"})
        flags+=("-p" "$NIX_BUILD_CORES")

--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@ -7,12 +7,6 @@
 , preFixup ? ""
 , shellHook ? ""

-# Go linker flags, passed to go via -ldflags
-, ldflags ? []
-
-# Go tags, passed to go via -tag
-, tags ? []
-
 # We want parallel builds by default
 , enableParallelBuilding ? true

@ -49,9 +43,6 @@

 , meta ? {}, ... } @ args:

-
-with builtins;
-
 let
  dep2src = goDep:
    {
@ -172,7 +163,7 @@ let

        declare -a flags
        flags+=($buildFlags "''${buildFlagsArray[@]}")
-        flags+=(''${tags:+-tags=${lib.concatStringsSep "," tags}})
+        flags+=(''${tags:+-tags=''${tags// /,}})
        flags+=(''${ldflags:+-ldflags="$ldflags"})
        flags+=("-p" "$NIX_BUILD_CORES")

--- a/pkgs/build-support/setup-hooks/auto-patchelf.py
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.py
@ -109,7 +109,14 @@ def osabi_are_compatible(wanted: str, got: str) -> bool:


 def glob(path: Path, pattern: str, recursive: bool) -> Iterator[Path]:
-    return path.rglob(pattern) if recursive else path.glob(pattern)
+    if path.is_dir():
+        return path.rglob(pattern) if recursive else path.glob(pattern)
+    else:
+        # path.glob won't return anything if the path is not a directory.
+        # We extend that behavior by matching the file name against the pattern.
+        # This allows to pass single files instead of dirs to auto_patchelf,
+        # for greater control on the files to consider.
+        return [path] if path.match(pattern) else []


 cached_paths: Set[Path] = set()
@ -305,16 +312,21 @@ def main() -> None:
        "--no-recurse",
        dest="recursive",
        action="store_false",
-        help="Patch only the provided paths, and ignore their children")
+        help="Disable the recursive traversal of paths to patch.")
    parser.add_argument(
        "--paths", nargs="*", type=Path,
-        help="Paths whose content needs to be patched.")
+        help="Paths whose content needs to be patched."
+             " Single files and directories are accepted."
+             " Directories are traversed recursively by default.")
    parser.add_argument(
        "--libs", nargs="*", type=Path,
-        help="Paths where libraries are searched for.")
+        help="Paths where libraries are searched for."
+             " Single files and directories are accepted."
+             " Directories are not searched recursively.")
    parser.add_argument(
        "--runtime-dependencies", nargs="*", type=Path,
-        help="Paths to prepend to the runtime path of executable binaries.")
+        help="Paths to prepend to the runtime path of executable binaries."
+             " Subject to deduplication, which may imply some reordering.")
    parser.add_argument(
        "--append-rpaths",
        nargs="*",
--- a/pkgs/build-support/setup-hooks/role.bash
+++ b/pkgs/build-support/setup-hooks/role.bash
@ -1,8 +1,8 @@
-# Since the same derivation can be depend on in multiple ways, we need to
+# Since the same derivation can be depended on in multiple ways, we need to
 # accumulate *each* role (i.e. host and target platforms relative the depending
 # derivation) in which the derivation is used.
 #
-# The role is intened to be use as part of other variables names like
+# The role is intended to be used as part of other variables names like
 #  - $NIX_SOMETHING${role_post}

 function getRole() {
@ -49,7 +49,7 @@ function getTargetRoleEnvHook() {
    getRole "$depTargetOffset"
 }

-# This variant is inteneded specifically for code-prodocing tool wrapper scripts
+# This variant is intended specifically for code-producing tool wrapper scripts
 # `NIX_@wrapperName@_TARGET_*_@suffixSalt@` tracks this (needs to be an exported
 # env var so can't use fancier data structures).
 function getTargetRoleWrapper() {
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;

 buildNpmPackage rec {
  pname = if set != null then "iosevka-${set}" else "iosevka";
-  version = "24.1.0";
+  version = "24.1.1";

  src = fetchFromGitHub {
    owner = "be5invis";
    repo = "iosevka";
    rev = "v${version}";
-    hash = "sha256-Th4+SUP1gqusGA680Ddh1YHUYJFJIe9zUSNE+NIDl40=";
+    hash = "sha256-kzf/DFks/Ovhl6uMw5Bqhq+j+alrUd4E49jgSmp2E2k=";
  };

-  npmDepsHash = "sha256-ChK3fUqPX1F8CljJGNiquS+5ZTlpeBEuYRPGoxSsyuI=";
+  npmDepsHash = "sha256-FKA3D05E5A0Z3wdCYLzoTyYKLay25sc3O61rOzkIN2E=";

  nativeBuildInputs = [
    remarshal
--- a/pkgs/data/fonts/nerdfonts/shas.nix
+++ b/pkgs/data/fonts/nerdfonts/shas.nix
@ -1,56 +1,56 @@
 {
-  "3270" = "12a9zi38mi0ba581p42h0kdwrjh7jacq2z85ghn318a20m0sgh5l";
-  "Agave" = "17phx041dnn4bpmcqzwkmklh34kxafzjd0vfzkw5p6yblibnwzx8";
-  "AnonymousPro" = "1jpl6id8472bx74m90rry2gmxm365mcqrka6c1kk6nc87k38rz80";
-  "Arimo" = "14s3g3dl835bbzj52g7n4pm3c3hfhssm7rsqrprms2yknbffmbpc";
-  "AurulentSansMono" = "0v49zig6f16a0g0pp4qng9scn452569lrlvr5svz2zx44yz8aji2";
-  "BigBlueTerminal" = "10n1pg20brwprl6qxvcg20zwyvp7jaazxaz0n9724zxs9sjjkk7h";
-  "BitstreamVeraSansMono" = "1sc959pw6vlp9qklria6iq36bakmh51p5z98qh6p926sd0ila656";
-  "CascadiaCode" = "04jwlxzp2r82nhmhfav14wxygshr2gkl0s7lijc97p8z32fkygbq";
-  "CodeNewRoman" = "0c5cn71mayabaiz3rnpszvg1p3i067a6f71kqjm38136livpq8ig";
-  "ComicShannsMono" = "09a50xcac4asik7mb3mcpkf5sjaa6yssq2ky999pjkccpp0sk2hq";
-  "Cousine" = "0azc7jfv8dkxz5874d9w7wx1033w8d6agzic6inp6gd3vxfpn949";
-  "DaddyTimeMono" = "1pnx92g4wc6a9xs3qkckig24v5g897xz520hpprzbqxdqbdamg8w";
-  "DejaVuSansMono" = "0abm1lprkr396dqg7hi54mdb5mgaqb0ld9k0a9v93h2gi7n6jd2l";
-  "DroidSansMono" = "0hpqa3zcp3qygvm24zrhcp0rv28lgpqra72l15il9391c4rday7j";
-  "FantasqueSansMono" = "0cwbwlmlw9ijh6nb2nip918qfwf2h7h4ra6z1xi6sfp3mkbrdm0j";
-  "FiraCode" = "13n9xi7jsd2zn7nmgf7hz1d4blqxb0d0z6q36zscc6w1140m3a59";
-  "FiraMono" = "1zlqxmdfy2pamfwz8n46jksxws19jlv6a1jyjg27cmcm6g2phlwr";
-  "Go-Mono" = "1qyna6720s7ljijqw28dsc3xixpc1c603h7avaqraj7xbhx2bch0";
-  "Gohu" = "08dsi6hwahc0d2f40p976anm2c07x2i7wbpcf27sm53f8q4yc07q";
-  "Hack" = "18f196963sw6y9kpyixij6wxkzzay2pgz11xyy63k6wc54z2zmvp";
-  "Hasklig" = "12yl427kbvj3s9nhzgn0q6pmj8jr0vh58xm7h2q3v0qfw51vdwih";
-  "HeavyData" = "1752rbgawhwx5hbqwf1v3njl1n2fgbylkr45wrz3jxb4089nsmn8";
-  "Hermit" = "05vi0dfg77a54z5m0nqcyzyz646r7r7nbxm76mwv4n4w9dr319h3";
-  "iA-Writer" = "1v3zs49s5712z7mq7v06r325lk6q7syd6mqd45520ik35nskpyh3";
-  "IBMPlexMono" = "0q6g551n1n6hihbaybydsks6v0hzw0izpmr5ncmiamcibdjw7nn8";
-  "Inconsolata" = "1fpyasnsb7zq6k7kdhwz4jcnslz5fsmcn53gfspvznlnassm5fl4";
-  "InconsolataGo" = "0kr2piwvfvplniq8sp64sw4p05mfycykc8i8pmb7vbs8ybgkgka1";
-  "InconsolataLGC" = "025f1ixbvl7r0lk74ppmpfh2agq1hqjrn3vrzfh3skamwhy9dmsx";
-  "Iosevka" = "1n699bs61zld312d0kgyp07c4ac7cgixwlfg9c30fyf33jibw8wh";
-  "IosevkaTerm" = "06k8dcvqkah9bzlagmyl2lnwl0lm51f15f3v78l51p2rnlqmi0n6";
-  "JetBrainsMono" = "0sj6ssdznxabxrvc7ar2rbf2fwadixjirk07xdk2vwyavgpyajf0";
-  "Lekton" = "0j2jaz2w7nbs0c6awxqj79mqi6k058b58629r9ir8qhk7m5qmq7b";
-  "LiberationMono" = "18mc7rjvzlcblf0is83ds9sjvyglc5gjf0nbqa6xgm0hcp0lbmzv";
-  "Lilex" = "1kq56iws0cg6ayfmy21cs8l8496ryjsk3ayanbcyz962j913a7qh";
-  "Meslo" = "04g6najk9ar19pkq4v033h2xhv2rr6yrbp2gw29kpwzigjfjrzsw";
-  "Monofur" = "051ipzjngq2083xj3r99f5jfyshpsgw399rxspnzj4xz9n9803vl";
-  "Monoid" = "17gqr74cc5b3dz09z974ig4w8blwkiyky43gpw7ak1l073w9v3vm";
-  "Mononoki" = "0b91kncc6b14zigci05gv3hf4p88vd1xdis8x42zcjc6bjh8q64k";
-  "MPlus" = "0l4ydmspdj2hfmmc686isnmjqhka3vpy9clljpmx9l7cqygqifxk";
-  "NerdFontsSymbolsOnly" = "1rlv9kdakabkpjw12ji26xb42daj33zljfx3hhnffp8ky4vpxccd";
-  "Noto" = "0slrz3f975bzkah4g446rlb1ai85c91i3g8ciqlifq48pp51jm9m";
-  "OpenDyslexic" = "076ylnbbbwrxs8dm9w6bzs26jdc13s00l4qvyp699z4rgdzb9rgi";
-  "Overpass" = "0nf67kizh11amj72yjqv6wm1zgfkvfvrknss56b1ljifp5sgyc6h";
-  "ProFont" = "0bw3srnikbcyr7gkvr9pqx1i11z5wlr9bmfg2hia1wmbic73cbl4";
-  "ProggyClean" = "1m6m4gyb9iz3dwr5lmn18ciwib92015i0mqdw5kb2wmfrz5s9kks";
-  "RobotoMono" = "1qlss2xs8asg3cpdm2gxwzpaik8jhn1md8faficncphf9x9rdvzv";
-  "ShareTechMono" = "1sadgp9zw31rk71xa56l4fqbr7iv4j2l7mp1bdykrzv4r94swdl2";
-  "SourceCodePro" = "096wh4pq1s24i7xya0lqbr5z6ba9k4wr1229p9n7xkcf2hykgc9j";
-  "SpaceMono" = "0fk54ijh0x43vhk46inwhn7rcn2jgkx836461cqn1xfp5vc9y1hb";
-  "Terminus" = "0bxmvhzxd8vllwv2kjgp1j0iz5jhwwp9x1sjxwdsjv3pff3qm41j";
-  "Tinos" = "08pk46z03x4nnkrbp96i16fhmvp0gvk87s2w8dj51863ay0k80yb";
-  "Ubuntu" = "1gwndxsrp2289jgl1wkqyh5q236ax1835314igi0m3iq22vc07b5";
-  "UbuntuMono" = "0qikbhm3qv745kwa4mbkjp17rp10pbvld2xmfn20x4lb33xpny16";
-  "VictorMono" = "1hgqbyrqmjjbzdfxc38rf5mn7m424mchgqp9qs1cccc2qm6js05r";
+  "3270" = "00cmrlx30jz3gd9c1cjw3ddhr82ngzwn1brwcr8l7fahxb7gvq7z";
+  "Agave" = "0gnr12b5ah1xadm53fj5x0532kx8g6v5wc82c391d18h2azbllbm";
+  "AnonymousPro" = "0lqmghnj33jfv8rn1cyvq50j27kc19n5lfjr2adwsy2qixk499p9";
+  "Arimo" = "07v7m5m9vijdwwm0d63j67ciy2nlpkfy18s6q2d555n6yfs2yyb4";
+  "AurulentSansMono" = "1ndrs7bl0lxfahnrv91y0vsbvs0p3ah56drsvz5r3qw7sr4ffr09";
+  "BigBlueTerminal" = "0mms77748yc9qlzank48qqdc4as41zfkhbspv2scklz0n76v1f74";
+  "BitstreamVeraSansMono" = "0wkg8r6bryv4q320hrc3x2c78n1jp44s99hmbwjjplzh1g0j5x49";
+  "CascadiaCode" = "0bmzji880wbc3c4krw47kzf8mzb9abvv6wjybhynd1rjf31i27fj";
+  "CodeNewRoman" = "0w5plvvwxxzmlz0ylah5an4j0mlbj292nqvfgj5v9p5kbw68qgrl";
+  "ComicShannsMono" = "1ybxyn85ygm4ipg371b204mi6x7303yqriysiggb5bsfas2ymq6m";
+  "Cousine" = "0bkwf3h6wy9n3ii9ii4s16951w65vz54yyrdwxngcmrwapcii9y5";
+  "DaddyTimeMono" = "1w5n170l63hfxh1xclw3jpf8amj60br6py4yx12yhqanp2zg0shj";
+  "DejaVuSansMono" = "1j22f5jnpmyli686r67c4c07g07ac78aq9wg8hy1vwblxfzdvq9f";
+  "DroidSansMono" = "13r1sglgwf05swnbn0mha2gpdqammzlg0p6h7c33af1vr7n8cnca";
+  "FantasqueSansMono" = "1k0p6gvas6mgwq0bbvpwbn3mm6yaaapgjqgk30fvpq9zvn4a26bf";
+  "FiraCode" = "14vbb3w6il32kd8my75vvv786azm7sxmdpba9np0qjx4rs8xdhbn";
+  "FiraMono" = "1iiz5cnhrb67793ww6pj5y5x9s1a5nlk9kqwbv92kxmbqakarlcb";
+  "Go-Mono" = "0zdxyid1kw2prszhj69pqyrba6ywsxwb0ynnmwvqnc99bp0lx7pw";
+  "Gohu" = "0bx4mayqm5rqgd5p3xqpwrqn7338yjcsa9a1vi2qx4gycbp94qh5";
+  "Hack" = "1p8l53k6fzjbx7sjl05bq7xxnxmn7026sdgmyxqx4crmy18qxywk";
+  "Hasklig" = "1fvzhfjd0xqmkc4wl3dpdigdq5ni2gz2x9ip7fmfz5y9ipnbyf36";
+  "HeavyData" = "0w3zxdr9dmfk4k1m9n0fzn18kfgzq97bxf7i9xqfqikh3r1bpzjw";
+  "Hermit" = "1cmhf1xinspa3fqx95h2z3qlbv2p90zba4chg9mpv46vz3dmmkki";
+  "iA-Writer" = "10spld7a70phczw60chg7y21m8afz8vdrc9jklkrh045fhskqbh6";
+  "IBMPlexMono" = "050a44156320yjb14l6ycfg2z7isk0qb57ds5s6ixla6hr0z4g4h";
+  "Inconsolata" = "02rar6g3zbbpxxxz37v7d5qzafn59bhp04iv3wk16kqxy0havgx5";
+  "InconsolataGo" = "0nx6j3v2fvhdw3ygmz65zwlj6zwrkpmf59wfxirpzkcqqsdh4zwl";
+  "InconsolataLGC" = "00s2051fz3k6jnsfmnlqnd2cghr9sj2pddi5gpid1i5x006rig7a";
+  "Iosevka" = "1byrmfbsqi06fsy958364jy694dnm7a7pcjsv64w6mwfsi5vjn1r";
+  "IosevkaTerm" = "1k65jfa0c7c6pvns7vfcxcfc3i1qcr6wg16qafbp9zggabbvl7aa";
+  "JetBrainsMono" = "0mbzvfl36a6mgb2dnjf8n3kkm28sz0xhv7s5lww141wpgj5jb4a9";
+  "Lekton" = "0xnqdjr8hawcn1na07f06bxqlvrxbv0n4mmgnivl0clib0nna566";
+  "LiberationMono" = "1mh0h85nqlh78xngy6wz354a33nk0gghic18pf0a38h3ryssb44c";
+  "Lilex" = "032gymxaijinbsbbyr0jhqdyr5vhvs83208cirdwx4yjgir32bj9";
+  "Meslo" = "0awd09634biwjxxzzh4r3a5w2n0y0bybc2yh98yplw096n5k4nyv";
+  "Monofur" = "1z49di4zn8yxpwgs876n30mjisjir9gax08vs1i8sll4kdms5znw";
+  "Monoid" = "09ynmda4chlv69aipp33h3h5c3imbqqmh1iwnggvim36ga1h49lm";
+  "Mononoki" = "15pkg8s18xxwkp7qhvnd473f854n4m9340kvgs2r7y5xgzagcmrf";
+  "MPlus" = "0kj3kjhi4v9w2izsgx6sfn0g8xi6p5qmsgbpip9nff7n2qlfg02s";
+  "NerdFontsSymbolsOnly" = "1yschcw29kbddin7cvbc19wchwyarg0p8sy4265j306kafcakzgd";
+  "Noto" = "0sdzd1r8wjl980vq19q6067m54fnrhkdj46q9zi27s9nnffcxwdr";
+  "OpenDyslexic" = "19fsq8z06iz89a12kks3j51vn9r0fzq51wl14284g0ffbf4ylzk8";
+  "Overpass" = "0qc66qqjshlxb9i28j48ii3wcaiy8dq8zdx9zvp6a3wbj13r9wa4";
+  "ProFont" = "18743axd1rcpyk92a4hq3ymxz143601h8zi466d2j1x1vxhk852f";
+  "ProggyClean" = "17l9c02zfh8ilgyrd91jzibmmpw44qagbvzr9s1dacllkg0d4sbj";
+  "RobotoMono" = "05z6ccnrhrn51yip6d37jjyilp8i2mr1afnxl4kam21kgkcmz3bv";
+  "ShareTechMono" = "15j2dfnikq5jfcvfgmrpnycbb3mfj6mq8q3dqnimba5hpdlrd95a";
+  "SourceCodePro" = "0qzqwaiig2988159byirz5wnn2qj9qprmlbjrr4ybckis12ipkp2";
+  "SpaceMono" = "08ys3zl33fnlclcai9d8w3iadvrdnp2z14rz0bjk78syzy4nqj3p";
+  "Terminus" = "1jj5xbf9mr772wn5l1qbal5hn6cixwin5qhswa8f9zr36vlh86ss";
+  "Tinos" = "0w9w3f4vrvcm59nhzvj0wchx6cdqk8akb77ghwc70pwd35s2xd3j";
+  "Ubuntu" = "02k4x2gvbbqsmxmjrf9x9pwwja7xhxs9bi4ryp6w8x2mml82yf2h";
+  "UbuntuMono" = "0vw41mkiqy6yv929zabs6nhms9x0nzrkvmpirvvmnzj7f70gy73p";
+  "VictorMono" = "006a8p809w6337395lkghlz26qslhcglhg383ic2gxgvng2vcyp0";
 }
--- a/pkgs/data/fonts/nerdfonts/version.nix
+++ b/pkgs/data/fonts/nerdfonts/version.nix
@ -1 +1 @@
-"3.0.1"
+"3.0.2"
--- a/pkgs/data/icons/kora-icon-theme/default.nix
+++ b/pkgs/data/icons/kora-icon-theme/default.nix
@ -10,13 +10,13 @@

 stdenvNoCC.mkDerivation rec  {
  pname = "kora-icon-theme";
-  version = "1.5.6";
+  version = "1.5.7";

  src = fetchFromGitHub  {
    owner = "bikass";
    repo = "kora";
    rev = "v${version}";
-    sha256 = "sha256-vAeml+upESUVlJ95Rm0+vlZ+NQZWEZl00scDkb3W7Yo=";
+    sha256 = "sha256-VAlfrUWgxcG17ZTlA357gengXTilwuZOBscIzadAsaU=";
  };

  nativeBuildInputs = [
--- a/pkgs/data/misc/sing-geoip/default.nix
+++ b/pkgs/data/misc/sing-geoip/default.nix
@ -8,21 +8,16 @@
 let
  generator = buildGoModule rec {
    pname = "sing-geoip";
-    version = "unstable-2022-07-05";
+    version = "20230512";

    src = fetchFromGitHub {
      owner = "SagerNet";
      repo = pname;
-      rev = "2ced72c94da4c9259c40353c375319d9d28a78f3";
-      hash = "sha256-z8aP+OfTuzQNwOT3EEnI9uze/vbHTJLEiCPqIrnNUHw=";
+      rev = "refs/tags/${version}";
+      hash = "sha256-Zm+5N/37hoHpH/TLNJrHeaBXI8G1jEpM1jz6Um8edNE=";
    };

-    vendorHash = "sha256-lr0XMLFxJmLqIqCuGgmsFh324jmZVj71blmStMn41Rs=";
-
-    postPatch = ''
-      # The codes args should start from the third args
-      substituteInPlace main.go --replace "os.Args[2:]" "os.Args[3:]"
-    '';
+    vendorHash = "sha256-ejXAdsJwXhqet+Ca+pDLWwu0gex79VcIxW6rmhRnbTQ=";

    meta = with lib; {
      description = "GeoIP data for sing-box";
--- a/pkgs/desktops/gnome/core/mutter/43/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/43/default.nix
@ -51,13 +51,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mutter";
-  version = "43.5";
+  version = "43.6";

  outputs = [ "out" "dev" "man" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
-    sha256 = "/JAP4ahA2aeTyOLSDUTJCqCH1fv9x5Su5wluHYoJZxo=";
+    sha256 = "F1oiDSFv8Z8YLWeqc89eUaJVIL6bruaCAA4QRECkciU=";
  };

  patches = [
--- a/pkgs/development/beam-modules/elixir-ls/default.nix
+++ b/pkgs/development/beam-modules/elixir-ls/default.nix
@ -21,7 +21,7 @@ mixRelease  {
  mixFodDeps = fetchMixDeps {
    pname = "mix-deps-${pname}";
    inherit src version elixir;
-    sha256 = "sha256-jF1Plkz1D85aWkiNgeBlJmHndhr7us+8+m/gMkXHvDw=";
+    hash = "sha256-jF1Plkz1D85aWkiNgeBlJmHndhr7us+8+m/gMkXHvDw=";
  };

  # elixir-ls is an umbrella app
--- a/pkgs/development/beam-modules/fetch-mix-deps.nix
+++ b/pkgs/development/beam-modules/fetch-mix-deps.nix
@ -2,7 +2,8 @@

 { pname
 , version
-, sha256
+, hash ? ""
+, sha256 ? ""
 , src
 , mixEnv ? "prod"
 , debug ? false
@ -13,6 +14,12 @@
 , ...
 }@attrs:

+let
+  hash_ =
+    if hash != "" then { outputHashAlgo = null; outputHash = hash; }
+    else if sha256 != "" then { outputHashAlgo = "sha256"; outputHash = sha256; }
+    else { outputHashAlgo = "sha256"; outputHash = lib.fakeSha256; };
+in
 stdenvNoCC.mkDerivation (attrs // {
  nativeBuildInputs = [ elixir hex cacert git ];

@ -51,10 +58,8 @@ stdenvNoCC.mkDerivation (attrs // {
    runHook postInstall
  '';

-  outputHashAlgo = "sha256";
  outputHashMode = "recursive";
-  outputHash = sha256;

  impureEnvVars = lib.fetchers.proxyImpureEnvVars;
  inherit meta;
-})
+} // hash_)
--- a/pkgs/development/compilers/cudatoolkit/common.nix
+++ b/pkgs/development/compilers/cudatoolkit/common.nix
@ -158,6 +158,10 @@ backendStdenv.mkDerivation rec {
    "libcom_err.so.2"
  ];

+  preFixup = ''
+    patchelf $out/lib64/libnvrtc.so --add-needed libnvrtc-builtins.so
+  '';
+
  unpackPhase = ''
    sh $src --keep --noexec

@ -342,4 +346,3 @@ backendStdenv.mkDerivation rec {
    maintainers = teams.cuda.members;
  };
 }
-
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@ -31,23 +31,23 @@ stdenv.mkDerivation rec {
      sha256 = "sha256-C7OzwY0zq+2CV3SB5unI7Ill2M3deF7FXeQE3B/Kx2s=";
    })

-    # meson.build: bump version to 1.7.0
-    (fetchpatch {
-      url = "https://github.com/dgibson/dtc/commit/64a907f08b9bedd89833c1eee674148cff2343c6.patch";
-      sha256 = "sha256-p2KGS5GW+3uIPgXfuIx6aDC54csM+5FZDkK03t58AL8=";
-    })
-
-    # Fix version in libfdt/meson.build
-    (fetchpatch {
-      url = "https://github.com/dgibson/dtc/commit/723545ebe9933b90ea58dc125e4987c6bcb04ade.patch";
-      sha256 = "sha256-5Oq7q+62ZObj3e7rguN9jhSpYoQkwjSfo/N893229dQ=";
-    })
-
    # Use #ifdef NO_VALGRIND
    (fetchpatch {
      url = "https://github.com/dgibson/dtc/commit/41821821101ad8a9f83746b96b163e5bcbdbe804.patch";
      sha256 = "sha256-7QEFDtap2DWbUGqtyT/RgJZJFldKB8oSubKiCtLZ0w4=";
    })
+
+    # dtc: Fix linker options so it also works in Darwin
+    (fetchpatch {
+      url = "https://github.com/dgibson/dtc/commit/3acde70714df3623e112cf3ec99fc9b5524220b8.patch";
+      sha256 = "sha256-uLXL0Sjcn+bnMuF+A6PjUW1Rq6uNg1dQl58zbeYpP/U=";
+    })
+
+    # meson: allow disabling tests
+    (fetchpatch {
+      url = "https://github.com/dgibson/dtc/commit/35f26d2921b68d97fefbd5a2b6e821a2f02ff65d.patch";
+      sha256 = "sha256-cO4f/jJX/pQL7kk4jpKUhsCVESW2ZuWaTr7z3BuvVkw=";
+    })
  ];

  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
@ -69,6 +69,12 @@ stdenv.mkDerivation rec {

  postPatch = ''
    patchShebangs setup.py
+
+    # meson.build: bump version to 1.7.0
+    substituteInPlace libfdt/meson.build \
+      --replace "version: '1.6.0'," "version: '${version}',"
+    substituteInPlace meson.build \
+      --replace "version: '1.6.0'," "version: '${version}',"
  '';

  # Required for installation of Python library and is innocuous otherwise.
@ -77,12 +83,9 @@ stdenv.mkDerivation rec {
  mesonAutoFeatures = "auto";
  mesonFlags = [
    (lib.mesonBool "static-build" stdenv.hostPlatform.isStatic)
+    (lib.mesonBool "tests" doCheck)
  ];

-  postFixup = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -id $out/lib/libfdt.dylib $out/lib/libfdt-${version}.dylib
-  '';
-
  # Checks are broken on aarch64 darwin
  # https://github.com/NixOS/nixpkgs/pull/118700#issuecomment-885892436
  doCheck = !stdenv.isDarwin;
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@ -55,7 +55,7 @@ with lib;
 with builtins;

 let majorVersion = "12";
-    version = "${majorVersion}.2.0";
+    version = "${majorVersion}.3.0";
    disableBootstrap = !stdenv.hostPlatform.isDarwin && !profiledCompiler;

    inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@ -69,15 +69,19 @@ let majorVersion = "12";
        ../gcc-12-gfortran-driving.patch
        ../ppc-musl.patch
        ../install-info-files-serially.patch
+
+        # backport ICE fix on ccache code
+        ./lambda-ICE-PR109241.patch
      ]
      # We only apply this patch when building a native toolchain for aarch64-darwin, as it breaks building
      # a foreign one: https://github.com/iains/gcc-12-branch/issues/18
-      ++ optional (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) (fetchpatch {
-        name = "gcc-12-darwin-aarch64-support.patch";
-        url = "https://github.com/Homebrew/formula-patches/raw/1d184289/gcc/gcc-12.2.0-arm.diff";
-        sha256 = "sha256-omclLslGi/2yCV4pNBMaIpPDMW3tcz/RXdupbNbeOHA=";
-      })
-      ++ optional langD ../libphobos.patch
+      ++ optionals (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) [
+        (fetchurl {
+          name = "gcc-12-darwin-aarch64-support.patch";
+          url = "https://raw.githubusercontent.com/Homebrew/formula-patches/f1188b90d610e2ed170b22512ff7435ba5c891e2/gcc/gcc-12.3.0.diff";
+          sha256 = "sha256-naL5ZNiurqfDBiPSU8PTbTmLqj25B+vjjiqc4fAFgYs=";
+        })
+      ] ++ optional langD ../libphobos.patch

      # backport fixes to build gccgo with musl libc
      ++ optionals (langGo && stdenv.hostPlatform.isMusl) [
@ -206,7 +210,7 @@ lib.pipe (stdenv.mkDerivation ({

  src = fetchurl {
    url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "sha256-5UnPnPNZSgDie2WJ1DItcOByDN0hPzm+tBgeBpJiMP8=";
+    sha256 = "sha256-lJpdT5nnhkIak7Uysi/6tVeN5zITaZdbka7Jet/ajDs=";
  };

  inherit patches;
--- a/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch
+++ b/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch
@ -0,0 +1,77 @@
+https://gcc.gnu.org/PR109241
+
+Fix ICE on ccache.
+
+From 396a4e76afec30d2461638f569cae18955eb4ad2 Mon Sep 17 00:00:00 2001
+From: Jason Merrill <jason@redhat.com>
+Date: Wed, 22 Mar 2023 16:11:47 -0400
+Subject: [PATCH] c++: local class in nested generic lambda [PR109241]
+
+In this testcase, the tree walk to look for bare parameter packs was
+confused by finding a type with no TREE_BINFO.  But it should be fine that
+it's unset; we already checked for unexpanded packs at parse time.
+
+I also tried doing the partial instantiation of the local class, which is
+probably the long-term direction we want to go, but for stage 4 let's go
+with this safer change.
+
+	PR c++/109241
+
+gcc/cp/ChangeLog:
+
+	* pt.cc (find_parameter_packs_r): Handle null TREE_BINFO.
+
+gcc/testsuite/ChangeLog:
+
+	* g++.dg/cpp1y/lambda-generic-local-class2.C: New test.
+---
+ gcc/cp/pt.cc                                        | 12 ++++++++----
+ .../g++.dg/cpp1y/lambda-generic-local-class2.C      | 13 +++++++++++++
+ 2 files changed, 21 insertions(+), 4 deletions(-)
+ create mode 100644 gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+
+diff --git a/gcc/cp/pt.cc b/gcc/cp/pt.cc
+index c7f4a95a723..79bc9c014c8 100644
+--- a/gcc/cp/pt.cc
+++ b/gcc/cp/pt.cc
+@@ -4106,10 +4106,14 @@ find_parameter_packs_r (tree *tp, int *walk_subtrees, void* data)
+     case TAG_DEFN:
+       t = TREE_TYPE (t);
+       if (CLASS_TYPE_P (t))
+-	/* Local class, need to look through the whole definition.  */
+-	for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
+-	  cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
+-			ppd, ppd->visited);
+	{
+	  /* Local class, need to look through the whole definition.
+	     TYPE_BINFO might be unset for a partial instantiation.  */
+	  if (TYPE_BINFO (t))
+	    for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
+	      cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
+			    ppd, ppd->visited);
+	}
+       else
+ 	/* Enum, look at the values.  */
+ 	for (tree l = TYPE_VALUES (t); l; l = TREE_CHAIN (l))
+diff --git a/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+new file mode 100644
+index 00000000000..83856de1f41
+--- /dev/null
+++ b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+@@ -0,0 +1,13 @@
+// PR c++/109241
+// { dg-do compile { target c++14 } }
+// { dg-options "" } no pedantic
+
+void g() {
+  [](auto) {
+    [](auto) {
+      ({
+        struct A {};
+      });
+    };
+  }(1);
+}
+-- 
+2.40.1
+
--- a/pkgs/development/compilers/vyper/default.nix
+++ b/pkgs/development/compilers/vyper/default.nix
@ -28,14 +28,14 @@ let
 in
 buildPythonPackage rec {
  pname = "vyper";
-  version = "0.3.8";
+  version = "0.3.9";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-x3MTKxXZgAT35o8pekGxSXhcr5MrrRPr86+3Lab4qn8=";
+    sha256 = "sha256-4UBSH4qRBgsy+VO9XzosWedM65R1lTo9ml2C95T9OAA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@ -77,29 +77,12 @@ in
 rec {
  lua5_4 = callPackage ./interpreter.nix {
    self = lua5_4;
-    version = "5.4.4";
-    hash = "sha256-Fkx4SWU7gK5nvsS3RzuIS/XMjS3KBWU0dewu0nuev2E=";
+    version = "5.4.6";
+    hash = "sha256-fV6huctqoLWco93hxq3LV++DobqOVDLA7NBr9DmzrYg=";
    makeWrapper = makeBinaryWrapper;
    inherit passthruFun;

-    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch
-      ++ [
-        (fetchpatch {
-          name = "CVE-2022-28805.patch";
-          url = "https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa.patch";
-          sha256 = "sha256-YTwoolSnRNJIHFPVijSO6ZDw35BG5oWYralZ8qOb9y8=";
-          stripLen = 1;
-          extraPrefix = "src/";
-          excludes = [ "src/testes/*" ];
-        })
-        (fetchpatch {
-          name = "CVE-2022-33099.patch";
-          url = "https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf.patch";
-          sha256 = "sha256-qj1Dq1ojVoknALSa67jhgH3G3Kk4GtJP6ROFElVF+D0=";
-          stripLen = 1;
-          extraPrefix = "src/";
-        })
-      ];
+    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch;
  };

  lua5_4_compat = lua5_4.override({
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -53,6 +53,7 @@
 , enableLTO ? stdenv.is64bit && stdenv.isLinux
 , reproducibleBuild ? false
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
+, noldconfigPatch ? ./. + "/${sourceVersion.major}.${sourceVersion.minor}/no-ldconfig.patch"
 } @ inputs:

 # Note: this package is used for bootstrapping fetchurl, and thus
@ -252,7 +253,7 @@ in with passthru; stdenv.mkDerivation {
    # ctypes.util.find_library during the loading of the uuid module
    # (since it will do a futile invocation of gcc (!) to find
    # libuuid, slowing down program startup a lot).
-    (./. + "/${sourceVersion.major}.${sourceVersion.minor}/no-ldconfig.patch")
+    noldconfigPatch
    # Make sure that the virtualenv activation scripts are
    # owner-writable, so venvs can be recreated without permission
    # errors.
@ -284,7 +285,7 @@ in with passthru; stdenv.mkDerivation {
          sha256 = "1h18lnpx539h5lfxyk379dxwr8m2raigcjixkf133l4xy3f4bzi2";
        }
    )
-  ] ++ optionals (pythonOlder "3.12") [
+  ] ++ optionals (pythonAtLeast "3.7" && pythonOlder "3.12") [
    # LDSHARED now uses $CC instead of gcc. Fixes cross-compilation of extension modules.
    ./3.8/0001-On-all-posix-systems-not-just-Darwin-set-LDSHARED-if.patch
    # Use sysconfigdata to find headers. Fixes cross-compilation of extension modules.
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -8,113 +8,12 @@
 , makeScopeWithSplicing
 , pythonPackagesExtensions
 , stdenv
-}:
+}@args:

 (let

  # Common passthru for all Python interpreters.
-  passthruFun =
-    { implementation
-    , libPrefix
-    , executable
-    , sourceVersion
-    , pythonVersion
-    , packageOverrides
-    , sitePackages
-    , hasDistutilsCxxPatch
-    , pythonOnBuildForBuild
-    , pythonOnBuildForHost
-    , pythonOnBuildForTarget
-    , pythonOnHostForHost
-    , pythonOnTargetForTarget
-    , pythonAttr ? null
-    , self # is pythonOnHostForTarget
-    }: let
-      pythonPackages = let
-        ensurePythonModules = items: let
-          exceptions = [
-            stdenv
-          ];
-          providesSetupHook = lib.attrByPath [ "provides" "setupHook"] false;
-          valid = value: pythonPackages.hasPythonModule value || providesSetupHook value || lib.elem value exceptions;
-          func = name: value:
-            if lib.isDerivation value then
-              lib.extendDerivation (valid value || throw "${name} should use `buildPythonPackage` or `toPythonModule` if it is to be part of the Python packages set.") {} value
-            else
-              value;
-        in lib.mapAttrs func items;
-      in ensurePythonModules (callPackage
-        # Function that when called
-        # - imports python-packages.nix
-        # - adds spliced package sets to the package set
-        # - applies overrides from `packageOverrides` and `pythonPackagesOverlays`.
-        ({ pkgs, stdenv, python, overrides }: let
-          pythonPackagesFun = import ./python-packages-base.nix {
-            inherit stdenv pkgs lib;
-            python = self;
-          };
-          otherSplices = {
-            selfBuildBuild = pythonOnBuildForBuild.pkgs;
-            selfBuildHost = pythonOnBuildForHost.pkgs;
-            selfBuildTarget = pythonOnBuildForTarget.pkgs;
-            selfHostHost = pythonOnHostForHost.pkgs;
-            selfTargetTarget = pythonOnTargetForTarget.pkgs or {}; # There is no Python TargetTarget.
-          };
-          hooks = import ./hooks/default.nix;
-          keep = lib.extends hooks pythonPackagesFun;
-          extra = _: {};
-          optionalExtensions = cond: as: lib.optionals cond as;
-          pythonExtension = import ../../../top-level/python-packages.nix;
-          python2Extension = import ../../../top-level/python2-packages.nix;
-          extensions = lib.composeManyExtensions ([
-            pythonExtension
-          ] ++ (optionalExtensions (!self.isPy3k) [
-            python2Extension
-          ]) ++ pythonPackagesExtensions ++ [
-            overrides
-          ]);
-          aliases = self: super: lib.optionalAttrs config.allowAliases (import ../../../top-level/python-aliases.nix lib self super);
-        in makeScopeWithSplicing
-          otherSplices
-          keep
-          extra
-          (lib.extends (lib.composeExtensions aliases extensions) keep))
-        {
-          overrides = packageOverrides;
-          python = self;
-        });
-    in rec {
-        isPy27 = pythonVersion == "2.7";
-        isPy37 = pythonVersion == "3.7";
-        isPy38 = pythonVersion == "3.8";
-        isPy39 = pythonVersion == "3.9";
-        isPy310 = pythonVersion == "3.10";
-        isPy311 = pythonVersion == "3.11";
-        isPy312 = pythonVersion == "3.12";
-        isPy2 = lib.strings.substring 0 1 pythonVersion == "2";
-        isPy3 = lib.strings.substring 0 1 pythonVersion == "3";
-        isPy3k = isPy3;
-        isPyPy = lib.hasInfix "pypy" interpreter;
-
-        buildEnv = callPackage ./wrapper.nix { python = self; inherit (pythonPackages) requiredPythonModules; };
-        withPackages = import ./with-packages.nix { inherit buildEnv pythonPackages;};
-        pkgs = pythonPackages;
-        interpreter = "${self}/bin/${executable}";
-        inherit executable implementation libPrefix pythonVersion sitePackages;
-        inherit sourceVersion;
-        pythonAtLeast = lib.versionAtLeast pythonVersion;
-        pythonOlder = lib.versionOlder pythonVersion;
-        inherit hasDistutilsCxxPatch;
-        # TODO: rename to pythonOnBuild
-        # Not done immediately because its likely used outside Nixpkgs.
-        pythonForBuild = pythonOnBuildForHost.override { inherit packageOverrides; self = pythonForBuild; };
-
-        tests = callPackage ./tests.nix {
-          python = self;
-        };
-
-        inherit pythonAttr;
-  };
+  passthruFun = import ./passthrufun.nix args;

  sources = {
    python310 = {
--- a/pkgs/development/interpreters/python/passthrufun.nix
+++ b/pkgs/development/interpreters/python/passthrufun.nix
@ -0,0 +1,103 @@
+{ lib, stdenv, callPackage, pythonPackagesExtensions, config, makeScopeWithSplicing, ... }:
+
+{ implementation
+, libPrefix
+, executable
+, sourceVersion
+, pythonVersion
+, packageOverrides
+, sitePackages
+, hasDistutilsCxxPatch
+, pythonOnBuildForBuild
+, pythonOnBuildForHost
+, pythonOnBuildForTarget
+, pythonOnHostForHost
+, pythonOnTargetForTarget
+, pythonAttr ? null
+, self # is pythonOnHostForTarget
+}: let
+  pythonPackages = let
+    ensurePythonModules = items: let
+      exceptions = [
+        stdenv
+      ];
+      providesSetupHook = lib.attrByPath [ "provides" "setupHook"] false;
+      valid = value: pythonPackages.hasPythonModule value || providesSetupHook value || lib.elem value exceptions;
+      func = name: value:
+        if lib.isDerivation value then
+          lib.extendDerivation (valid value || throw "${name} should use `buildPythonPackage` or `toPythonModule` if it is to be part of the Python packages set.") {} value
+        else
+          value;
+    in lib.mapAttrs func items;
+  in ensurePythonModules (callPackage
+    # Function that when called
+    # - imports python-packages.nix
+    # - adds spliced package sets to the package set
+    # - applies overrides from `packageOverrides` and `pythonPackagesOverlays`.
+    ({ pkgs, stdenv, python, overrides }: let
+      pythonPackagesFun = import ./python-packages-base.nix {
+        inherit stdenv pkgs lib;
+        python = self;
+      };
+      otherSplices = {
+        selfBuildBuild = pythonOnBuildForBuild.pkgs;
+        selfBuildHost = pythonOnBuildForHost.pkgs;
+        selfBuildTarget = pythonOnBuildForTarget.pkgs;
+        selfHostHost = pythonOnHostForHost.pkgs;
+        selfTargetTarget = pythonOnTargetForTarget.pkgs or {}; # There is no Python TargetTarget.
+      };
+      hooks = import ./hooks/default.nix;
+      keep = lib.extends hooks pythonPackagesFun;
+      extra = _: {};
+      optionalExtensions = cond: as: lib.optionals cond as;
+      pythonExtension = import ../../../top-level/python-packages.nix;
+      python2Extension = import ../../../top-level/python2-packages.nix;
+      extensions = lib.composeManyExtensions ([
+        pythonExtension
+      ] ++ (optionalExtensions (!self.isPy3k) [
+        python2Extension
+      ]) ++ pythonPackagesExtensions ++ [
+        overrides
+      ]);
+      aliases = self: super: lib.optionalAttrs config.allowAliases (import ../../../top-level/python-aliases.nix lib self super);
+    in makeScopeWithSplicing
+      otherSplices
+      keep
+      extra
+      (lib.extends (lib.composeExtensions aliases extensions) keep))
+    {
+      overrides = packageOverrides;
+      python = self;
+    });
+in rec {
+    isPy27 = pythonVersion == "2.7";
+    isPy37 = pythonVersion == "3.7";
+    isPy38 = pythonVersion == "3.8";
+    isPy39 = pythonVersion == "3.9";
+    isPy310 = pythonVersion == "3.10";
+    isPy311 = pythonVersion == "3.11";
+    isPy312 = pythonVersion == "3.12";
+    isPy2 = lib.strings.substring 0 1 pythonVersion == "2";
+    isPy3 = lib.strings.substring 0 1 pythonVersion == "3";
+    isPy3k = isPy3;
+    isPyPy = lib.hasInfix "pypy" interpreter;
+
+    buildEnv = callPackage ./wrapper.nix { python = self; inherit (pythonPackages) requiredPythonModules; };
+    withPackages = import ./with-packages.nix { inherit buildEnv pythonPackages;};
+    pkgs = pythonPackages;
+    interpreter = "${self}/bin/${executable}";
+    inherit executable implementation libPrefix pythonVersion sitePackages;
+    inherit sourceVersion;
+    pythonAtLeast = lib.versionAtLeast pythonVersion;
+    pythonOlder = lib.versionOlder pythonVersion;
+    inherit hasDistutilsCxxPatch;
+    # TODO: rename to pythonOnBuild
+    # Not done immediately because its likely used outside Nixpkgs.
+    pythonForBuild = pythonOnBuildForHost.override { inherit packageOverrides; self = pythonForBuild; };
+
+    tests = callPackage ./tests.nix {
+      python = self;
+    };
+
+    inherit pythonAttr;
+}
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@ -2,17 +2,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "wasmtime";
-  version = "9.0.2";
+  version = "9.0.3";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Fnc3iepxHr7WjorFoabHE6ZM/zK1T5W/gkxL+AEcVgU=";
+    hash = "sha256-b/GioFixPpbCUiYfOLwJ1NCsLGqIm+v9ODuq6kD8JeE=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-7Q5aJU0sYzRLgjiSNLIrydYRJ3ozABjDo4VtmexS3po=";
+  cargoHash = "sha256-AYb6dbmvoFYbvgik9rdyOnxdHdnhR8thnrQShGxRLFA=";

  cargoBuildFlags = [ "--package" "wasmtime-cli" "--package" "wasmtime-c-api" ];

--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@ -88,7 +88,7 @@ stdenv.mkDerivation rec {

  dlopenPropagatedBuildInputs = [ ]
    # Propagated for #include <GLES/gl.h> in SDL_opengles.h.
-    ++ lib.optional openglSupport libGL
+    ++ lib.optional (openglSupport && !stdenv.isDarwin) libGL
    # Propagated for #include <X11/Xlib.h> and <X11/Xatom.h> in SDL_syswm.h.
    ++ lib.optionals x11Support [ libX11 ];

--- a/pkgs/development/libraries/SDL2_ttf/default.nix
+++ b/pkgs/development/libraries/SDL2_ttf/default.nix
@ -13,7 +13,8 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkg-config ];

-  buildInputs = [ SDL2 freetype libGL ]
+  buildInputs = [ SDL2 freetype ]
+    ++ lib.optional (!stdenv.isDarwin) libGL
    ++ lib.optional stdenv.isDarwin darwin.libobjc;

  meta = with lib; {
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "libopenmpt";
-  version = "0.6.10";
+  version = "0.7.1";

  outputs = [ "out" "dev" "bin" ];

  src = fetchurl {
    url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "wlvo3A2sI87AJUh+WPGV5NFPfZSu3dX+RrIcBPHOJ3Q=";
+    hash = "sha256-vxddJkSLsTP3RxTzqIWecAC5NSL7NXdVnf/ANxYZEPk=";
  };

  enableParallelBuilding = true;
@ -39,9 +39,13 @@ stdenv.mkDerivation rec {
    portaudio
    libsndfile
    flac
-  ] ++ lib.optional usePulseAudio libpulseaudio;
+  ] ++ lib.optionals usePulseAudio [
+    libpulseaudio
+  ];

-  configureFlags = lib.optional (!usePulseAudio) "--without-pulseaudio";
+  configureFlags = [
+    (lib.strings.withFeature usePulseAudio "pulseaudio")
+  ];

  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

--- a/pkgs/development/libraries/c-ares/default.nix
+++ b/pkgs/development/libraries/c-ares/default.nix
@ -13,14 +13,15 @@

 stdenv.mkDerivation rec {
  pname = "c-ares";
-  version = "1.19.0";
-  outputs = [ "out" "dev" ];
+  version = "1.19.1";

  src = fetchurl {
    url = "https://c-ares.haxx.se/download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-v866N+I/1TEpOCkALKwEAe9JptxVkj9/kiNlhbetHdM=";
+    sha256 = "sha256-MhcAOZty7Q4DfQB0xinndB9rLsLdqSlWq+PpZx0+Jo4=";
  };

+  outputs = [ "out" "dev" "man" ];
+
  nativeBuildInputs = lib.optionals withCMake [ cmake ];

  cmakeFlags = [] ++ lib.optionals stdenv.hostPlatform.isStatic [
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@ -63,6 +63,14 @@ in {
      sha256 = "sha256-8G98nsPz3MLEWPDX9F0jKgXC4hC4NNdFQLSpmW3ay2s=";
    })

+    # Fix clang build failures on newer LLVM versions
+    # Upstream PR: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/119
+    (fetchpatch {
+      name = "fix-types.patch";
+      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/38e486b34d435130f2fb38c429e6016c3c82cd53.patch";
+      sha256 = "sha256-vmluOJSuTRiQHmbBBVCxOIkZ0O0ZEo0J4mgrUPn0SIo=";
+    })
+
    # Fix unexpected color addition on grayscale images (usually text).
    # Upstream fix: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114
    # Can be removed after 1.18 release
@ -71,6 +79,7 @@ in {
      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/4f4d89506f58a64b4829b1bb239bab9e46d63727.diff";
      sha256 = "sha256-mbTg67e7APfdELsuMAgXdY3xokWbGtHF7VDD5UyYqKM=";
    })
+
  ];

  outputs = [ "out" "dev" "devdoc" ];
--- a/pkgs/development/libraries/cpp-netlib/default.nix
+++ b/pkgs/development/libraries/cpp-netlib/default.nix
@ -17,6 +17,9 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DCPP-NETLIB_BUILD_SHARED_LIBS=ON"
+    # fatal error: 'boost/asio/stream_socket_service.hpp' file not found
+    "-DCPP-NETLIB_BUILD_EXAMPLES=OFF"
+    "-DCPP-NETLIB_BUILD_TESTS=OFF"
  ];

  # Most tests make network GET requests to various websites
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@ -67,6 +67,8 @@ stdenv.mkDerivation rec {
    ++ lib.optionals stdenv.isLinux [ audit libapparmor ];
  # ToDo: optional selinux?

+  __darwinAllowLocalNetworking = true;
+
  configureFlags = [
    "--enable-user-session"
    "--enable-xml-docs"
--- a/pkgs/development/libraries/faudio/default.nix
+++ b/pkgs/development/libraries/faudio/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "faudio";
-  version = "23.05";
+  version = "23.06";

  src = fetchFromGitHub {
    owner = "FNA-XNA";
    repo = "FAudio";
    rev = version;
-    sha256 = "sha256-uZSKbLQ36Kw6useAKyDoxLKD1xtKbigq/ejWErxvkcE=";
+    sha256 = "sha256-V5t9YliyXxoWNnKwp3TTOCyCIzpcyg1X4DaI0WFlfeQ=";
  };

  nativeBuildInputs = [cmake];
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@ -1,6 +1,6 @@
 import ./generic.nix rec {
-  version = "4.4.3";
-  sha256 = "sha256-zZDzG1hD+0AHqElzeGR6OVm+H5wqtdktloSPmEUzT/c=";
+  version = "4.4.4";
+  sha256 = "sha256-Q8bkuF/1uJfqttJJoObnnLX3BEduv+qxsvOrVhMvRjA=";
  extraPatches = [
    {
      name = "libsvtav1-1.5.0-compat-compressed_ten_bit_format.patch";
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@ -126,7 +126,6 @@
 , withMultithread ? true # Multithreading via pthreads/win32 threads
 , withNetwork ? withHeadlessDeps # Network support
 , withPixelutils ? withHeadlessDeps # Pixel utils in libavutil
-, withLTO ? false # build with link-time optimization
 /*
 *  Program options
 */
@ -384,7 +383,6 @@ stdenv.mkDerivation (finalAttrs: {

    (enableFeature withSmallBuild "small")
    (enableFeature withRuntimeCPUDetection "runtime-cpudetect")
-    (enableFeature withLTO "lto")
    (enableFeature withGrayscale "gray")
    (enableFeature withSwscaleAlpha "swscale-alpha")
    (enableFeature withHardcodedTables "hardcoded-tables")
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "gettext";
-  version = "0.21";
+  version = "0.21.1";

  src = fetchurl {
    url = "mirror://gnu/gettext/${pname}-${version}.tar.gz";
-    sha256 = "04kbg1sx0ncfrsbr85ggjslqkzzb243fcw9nyh3rrv1a22ihszf7";
+    sha256 = "sha256-6MNlDh2M7odcTzVWQjgsHfgwWL1aEe6FVcDPJ21kbUU=";
  };
  patches = [
    ./absolute-paths.diff
@ -47,14 +47,6 @@ stdenv.mkDerivation rec {
  '' + lib.optionalString stdenv.hostPlatform.isCygwin ''
    sed -i -e "s/\(cldr_plurals_LDADD = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
    sed -i -e "s/\(libgettextsrc_la_LDFLAGS = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
-  '' +
-  # This change to gettext's vendored copy of gnulib is already
-  # merged upstream; we can drop this patch on the next version
-  # bump.  It must be applied twice because gettext vendors gnulib
-  # not once, but twice!
-  ''
-    patch -p2 -d gettext-tools/gnulib-lib/ < ${gnulib.passthru.longdouble-redirect-patch}
-    patch -p2 -d gettext-tools/libgrep/    < ${gnulib.passthru.longdouble-redirect-patch}
  '';

  strictDeps = true;
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "gnu-efi";
-  version = "3.0.17";
+  version = "3.0.15";

  src = fetchurl {
    url = "mirror://sourceforge/gnu-efi/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-eAfpAzSTQ6ehQuu5NHA6KHIjXolojPWGwDKwoQh7yvQ=";
+    sha256 = "sha256-kxole5xcG6Zf9Rnxg3PEOKJoJfLbeGaxY+ltGxaPIOo=";
  };

  buildInputs = [ pciutils ];
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@ -68,6 +68,9 @@ stdenv.mkDerivation rec {
    protobuf
  ];

+  # https://hydra.nixos.org/build/222679737/nixlog/3/tail
+  NIX_CFLAGS_COMPILE = if stdenv.isAarch64 then "-Wno-error=maybe-uninitialized" else null;
+
  doInstallCheck = true;

  preInstallCheck =
@ -126,6 +129,7 @@ stdenv.mkDerivation rec {
    license = with licenses; [ asl20 ];
    homepage = "https://github.com/googleapis/google-cloud-cpp";
    description = "C++ Idiomatic Clients for Google Cloud Platform services";
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
    maintainers = with maintainers; [ cpcloud ];
  };
 }
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@ -38,7 +38,6 @@
 , bluez
 , chromaprint
 , curl
-, directfb
 , fdk_aac
 , flite
 , gsm
@ -104,6 +103,7 @@
 , microdnsSupport ? false
 # Checks meson.is_cross_build(), so even canExecute isn't enough.
 , enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform, hotdoc
+, guiSupport ? true, directfb
 }:

 stdenv.mkDerivation rec {
@ -183,9 +183,6 @@ stdenv.mkDerivation rec {
    libwebp
    xvidcore
    gnutls
-    libGL
-    libGLU
-    gtk3
    game-music-emu
    openssl
    libxml2
@ -220,7 +217,6 @@ stdenv.mkDerivation rec {
    mjpegtools

    chromaprint
-    directfb
    flite
    libdrm
    libgudev
@ -237,6 +233,13 @@ stdenv.mkDerivation rec {
    serd
    sord
    sratom
+
+    libGL
+    libGLU
+  ] ++ lib.optionals guiSupport [
+    gtk3
+  ] ++ lib.optionals (stdenv.isLinux && guiSupport) [
+    directfb
  ] ++ lib.optionals stdenv.isDarwin [
    # For unknown reasons the order is important, e.g. if
    # VideoToolbox is last, we get:
@ -297,10 +300,11 @@ stdenv.mkDerivation rec {
    "-Ddoc=disabled" # needs gstcuda to be enabled which is Linux-only
    "-Dnvcodec=disabled" # Linux-only
    "-Dva=disabled" # see comment on `libva` in `buildInputs`
+  ] ++ lib.optionals (!stdenv.isLinux || !guiSupport) [
+    "-Ddirectfb=disabled"
  ]
  ++ lib.optionals stdenv.isDarwin [
    "-Dchromaprint=disabled"
-    "-Ddirectfb=disabled"
    "-Dflite=disabled"
    "-Dkms=disabled" # renders to libdrm output
    "-Dlv2=disabled"
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@ -87,9 +87,9 @@ stdenv.mkDerivation (finalAttrs: {
    libpng
    libjpeg
    tremor
-    libGL
    pango
  ] ++ lib.optionals (!stdenv.isDarwin) [
+    libGL
    libvisual
  ] ++ lib.optionals stdenv.isDarwin [
    OpenGL
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@ -102,7 +102,7 @@ let
      "reqwest" # tests hang on darwin
      "threadshare" # tests cannot bind to localhost on darwin
      "webp" # not supported on darwin (upstream crate issue)
-    ] ++ lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
+    ] ++ lib.optionals (!gst-plugins-base.glEnabled) [
      # these require gstreamer-gl which requires darwin sdk bump
      "gtk4"
      "livesync"
@ -206,7 +206,7 @@ stdenv.mkDerivation rec {
    export CSOUND_LIB_DIR=${lib.getLib csound}/lib
  '' + lib.optionalString (lib.mutuallyExclusive [ "webrtc" "webrtchttp" ] selectedPlugins) ''
    sed -i "/\['gstreamer-webrtc-1\.0', 'gst-plugins-bad', 'gstwebrtc_dep', 'gstwebrtc'\]/d" meson.build
-  '' + lib.optionalString (stdenv.isDarwin && !stdenv.isAarch64) ''
+  '' + lib.optionalString (!gst-plugins-base.glEnabled) ''
    sed -i "/\['gstreamer-gl-1\.0', 'gst-plugins-base', 'gst_gl_dep', 'gstgl'\]/d" meson.build
  '';

--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@ -62,10 +62,11 @@ stdenv.mkDerivation rec {
    xorg.libXrandr
    xorg.libSM
    xorg.libICE
-    libGL
-    libGLU
    nasm
    libvpx
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    libGL
+    libGLU
  ];

  strictDeps = true;
--- a/pkgs/development/libraries/http-parser/default.nix
+++ b/pkgs/development/libraries/http-parser/default.nix
@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
  doCheck = true;
  checkTarget = "test";

+  enableParallelBuilding = true;
+
  meta = with lib; {
    description = "An HTTP message parser written in C";
    homepage = "https://github.com/nodejs/http-parser";
--- a/pkgs/development/libraries/json-c/default.nix
+++ b/pkgs/development/libraries/json-c/default.nix
@ -1,14 +1,24 @@
-{ lib, stdenv, fetchurl, cmake }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:

 stdenv.mkDerivation rec {
  pname = "json-c";
  version = "0.16";

-  src = fetchurl {
-    url    = "https://s3.amazonaws.com/json-c_releases/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-jkWsj5bsd5Hq87t+5Q6cIQC7vIe40PHQMMW6igKI2Ws=";
+  src = fetchFromGitHub {
+    owner = "json-c";
+    repo = "json-c";
+    rev = "json-c-0.16-20220414";
+    sha256 = "sha256-KbnUWLgpg6/1wvXhUoYswyqDcgiwEcvgaWCPjNcX20o=";
  };

+  patches = [
+    # needed for emscripten, which uses LLVM 15+
+    (fetchpatch {
+      url = "https://github.com/json-c/json-c/commit/6eca65617aacd19f4928acd5766b8dd20eda0b34.patch";
+      sha256 = "sha256-fyugX+HgYlt/4AVtfNDaKS+blyUt8JYTNqkmhURb9dk=";
+    })
+  ];
+
  outputs = [ "out" "dev" ];

  nativeBuildInputs = [ cmake ];
--- a/Show more
+++ b/Show more