Merge staging-next into staging

lib/attrsets.nix

@@ -168,7 +168,7 @@ rec {
        ] { a.b.c = 0; }
        => { a = { b = { d = 1; }; }; x = { y = "xy"; }; }
 
-    Type: updateManyAttrsByPath :: [{ path :: [String], update :: (Any -> Any) }] -> AttrSet -> AttrSet
+    Type: updateManyAttrsByPath :: [{ path :: [String]; update :: (Any -> Any); }] -> AttrSet -> AttrSet
   */
   updateManyAttrsByPath = let
     # When recursing into attributes, instead of updating the `path` of each
@@ -414,7 +414,7 @@ rec {
        => { name = "some"; value = 6; }
 
      Type:
-       nameValuePair :: String -> Any -> { name :: String, value :: Any }
+       nameValuePair :: String -> Any -> { name :: String; value :: Any; }
   */
   nameValuePair =
     # Attribute name
@@ -449,7 +449,7 @@ rec {
        => { foo_x = "bar-a"; foo_y = "bar-b"; }
 
      Type:
-       mapAttrs' :: (String -> Any -> { name = String; value = Any }) -> AttrSet -> AttrSet
+       mapAttrs' :: (String -> Any -> { name :: String; value :: Any; }) -> AttrSet -> AttrSet
   */
   mapAttrs' =
     # A function, given an attribute's name and value, returns a new `nameValuePair`.
@@ -649,7 +649,7 @@ rec {
 
      Example:
        zipAttrsWith (name: values: values) [{a = "x";} {a = "y"; b = "z";}]
-       => { a = ["x" "y"]; b = ["z"] }
+       => { a = ["x" "y"]; b = ["z"]; }
 
      Type:
        zipAttrsWith :: (String -> [ Any ] -> Any) -> [ AttrSet ] -> AttrSet
@@ -664,7 +664,7 @@ rec {
 
      Example:
        zipAttrs [{a = "x";} {a = "y"; b = "z";}]
-       => { a = ["x" "y"]; b = ["z"] }
+       => { a = ["x" "y"]; b = ["z"]; }
 
      Type:
        zipAttrs :: [ AttrSet ] -> AttrSet

lib/default.nix

@@ -94,7 +94,7 @@ let
       subtractLists mutuallyExclusive groupBy groupBy';
     inherit (self.strings) concatStrings concatMapStrings concatImapStrings
       intersperse concatStringsSep concatMapStringsSep
-      concatImapStringsSep makeSearchPath makeSearchPathOutput
+      concatImapStringsSep concatLines makeSearchPath makeSearchPathOutput
       makeLibraryPath makeBinPath optionalString
       hasInfix hasPrefix hasSuffix stringToCharacters stringAsChars escape
       escapeShellArg escapeShellArgs

lib/lists.nix

@@ -306,7 +306,7 @@ rec {
   /* Splits the elements of a list in two lists, `right` and
      `wrong`, depending on the evaluation of a predicate.
 
-     Type: (a -> bool) -> [a] -> { right :: [a], wrong :: [a] }
+     Type: (a -> bool) -> [a] -> { right :: [a]; wrong :: [a]; }
 
      Example:
        partition (x: x > 2) [ 5 1 2 3 4 ]
@@ -374,7 +374,7 @@ rec {
   /* Merges two lists of the same size together. If the sizes aren't the same
      the merging stops at the shortest.
 
-     Type: zipLists :: [a] -> [b] -> [{ fst :: a, snd :: b}]
+     Type: zipLists :: [a] -> [b] -> [{ fst :: a; snd :: b; }]
 
      Example:
        zipLists [ 1 2 ] [ "a" "b" ]

lib/options.nix

@@ -114,7 +114,7 @@ rec {
 
      You can omit the default path if the name of the option is also attribute path in nixpkgs.
 
-     Type: mkPackageOption :: pkgs -> string -> { default :: [string], example :: null | string | [string] } -> option
+     Type: mkPackageOption :: pkgs -> string -> { default :: [string]; example :: null | string | [string]; } -> option
 
      Example:
        mkPackageOption pkgs "hello" { }
@@ -201,7 +201,7 @@ rec {
 
   /* Extracts values of all "value" keys of the given list.
 
-     Type: getValues :: [ { value :: a } ] -> [a]
+     Type: getValues :: [ { value :: a; } ] -> [a]
 
      Example:
        getValues [ { value = 1; } { value = 2; } ] // => [ 1 2 ]
@@ -211,7 +211,7 @@ rec {
 
   /* Extracts values of all "file" keys of the given list
 
-     Type: getFiles :: [ { file :: a } ] -> [a]
+     Type: getFiles :: [ { file :: a; } ] -> [a]
 
      Example:
        getFiles [ { file = "file1"; } { file = "file2"; } ] // => [ "file1" "file2" ]

lib/strings.nix

@@ -128,6 +128,17 @@ rec {
     # List of input strings
     list: concatStringsSep sep (lib.imap1 f list);
 
+  /* Concatenate a list of strings, adding a newline at the end of each one.
+     Defined as `concatMapStrings (s: s + "\n")`.
+
+     Type: concatLines :: [string] -> string
+
+     Example:
+       concatLines [ "foo" "bar" ]
+       => "foo\nbar\n"
+  */
+  concatLines = concatMapStrings (s: s + "\n");
+
   /* Construct a Unix-style, colon-separated search path consisting of
      the given `subDir` appended to each of the given paths.
 

lib/tests/misc.nix

@@ -153,6 +153,11 @@ runTests {
     expected = "a,b,c";
   };
 
+  testConcatLines = {
+    expr = concatLines ["a" "b" "c"];
+    expected = "a\nb\nc\n";
+  };
+
   testSplitStringsSimple = {
     expr = strings.splitString "." "a.b.c.d";
     expected = [ "a" "b" "c" "d" ];

maintainers/maintainer-list.nix

@@ -4242,6 +4242,12 @@
     githubId = 103082;
     name = "Ed Brindley";
   };
+  eliandoran = {
+    email = "contact@eliandoran.me";
+    name = "Elian Doran";
+    github = "eliandoran";
+    githubId = 21236836;
+  };
   elizagamedev = {
     email = "eliza@eliza.sh";
     github = "elizagamedev";
@@ -5345,6 +5351,12 @@
     githubId = 60962839;
     name = "Mazen Zahr";
   };
+  gkleen = {
+    name = "Gregor Kleen";
+    email = "xpnfr@bouncy.email";
+    github = "gkleen";
+    githubId = 20089782;
+  };
   gleber = {
     email = "gleber.p@gmail.com";
     github = "gleber";

nixos/modules/services/misc/paperless.nix

@@ -226,9 +226,26 @@ in
 
         # Auto-migrate on first run or if the package has changed
         versionFile="${cfg.dataDir}/src-version"
-        if [[ $(cat "$versionFile" 2>/dev/null) != ${pkg} ]]; then
+        version=$(cat "$versionFile" 2>/dev/null || echo 0)
+
+        if [[ $version != ${pkg.version} ]]; then
           ${pkg}/bin/paperless-ngx migrate
-          echo ${pkg} > "$versionFile"
+
+          # Parse old version string format for backwards compatibility
+          version=$(echo "$version" | grep -ohP '[^-]+$')
+
+          versionLessThan() {
+            target=$1
+            [[ $({ echo "$version"; echo "$target"; } | sort -V | head -1) != "$target" ]]
+          }
+
+          if versionLessThan 1.12.0; then
+            # Reindex documents as mentioned in https://github.com/paperless-ngx/paperless-ngx/releases/tag/v1.12.1
+            echo "Reindexing documents, to allow searching old comments. Required after the 1.12.x upgrade."
+            ${pkg}/bin/paperless-ngx document_index reindex
+          fi
+
+          echo ${pkg.version} > "$versionFile"
         fi
       ''
       + optionalString (cfg.passwordFile != null) ''

nixos/modules/services/networking/multipath.nix

@@ -516,7 +516,6 @@ in {
         ${optionalString (!isNull defaults) ''
           defaults {
           ${indentLines 2 defaults}
-            multipath_dir ${cfg.package}/lib/multipath
           }
         ''}
         ${optionalString (!isNull blacklist) ''

nixos/modules/services/networking/ntp/chrony.nix

@@ -185,7 +185,7 @@ in
           ProtectSystem = "full";
           ProtectHome = true;
           PrivateTmp = true;
-          PrivateDevices = true;
+          PrivateDevices = false;
           PrivateUsers = false;
           ProtectHostname = true;
           ProtectClock = false;
@@ -203,7 +203,7 @@ in
           PrivateMounts = true;
           # System Call Filtering
           SystemCallArchitectures = "native";
-          SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @resources" "@clock" "@setuid" "capset" "chown" ];
+          SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @resources" "@clock" "@setuid" "capset" "chown" ] ++ lib.optional pkgs.stdenv.hostPlatform.isAarch64 "fchownat";
         };
       };
   };

nixos/modules/services/torrent/rtorrent.nix

@@ -19,6 +19,15 @@ in {
       '';
     };
 
+    dataPermissions = mkOption {
+      type = types.str;
+      default = "0750";
+      example = "0755";
+      description = lib.mdDoc ''
+        Unix Permissions in octal on the rtorrent directory.
+      '';
+    };
+
     downloadDir = mkOption {
       type = types.str;
       default = "${cfg.dataDir}/download";
@@ -205,7 +214,7 @@ in {
         };
       };
 
-      tmpfiles.rules = [ "d '${cfg.dataDir}' 0750 ${cfg.user} ${cfg.group} -" ];
+      tmpfiles.rules = [ "d '${cfg.dataDir}' ${cfg.dataPermissions} ${cfg.user} ${cfg.group} -" ];
     };
   };
 }

nixos/modules/system/boot/plymouth.nix

@@ -146,6 +146,9 @@ in
     systemd.services.systemd-ask-password-plymouth.wantedBy = [ "multi-user.target" ];
     systemd.paths.systemd-ask-password-plymouth.wantedBy = [ "multi-user.target" ];
 
+    # Prevent Plymouth taking over the screen during system updates.
+    systemd.services.plymouth-start.restartIfChanged = false;
+
     boot.initrd.systemd = {
       extraBin.plymouth = "${plymouth}/bin/plymouth"; # for the recovery shell
       storePaths = [

nixos/tests/all-tests.nix

@@ -126,6 +126,7 @@ in {
   cfssl = handleTestOn ["aarch64-linux" "x86_64-linux"] ./cfssl.nix {};
   charliecloud = handleTest ./charliecloud.nix {};
   chromium = (handleTestOn ["aarch64-linux" "x86_64-linux"] ./chromium.nix {}).stable or {};
+  chrony-ptp = handleTestOn ["aarch64-linux" "x86_64-linux"] ./chrony-ptp.nix {};
   cinnamon = handleTest ./cinnamon.nix {};
   cjdns = handleTest ./cjdns.nix {};
   clickhouse = handleTest ./clickhouse.nix {};

nixos/tests/chrony-ptp.nix

@@ -0,0 +1,28 @@
+import ./make-test-python.nix ({ lib, ... }:
+{
+  name = "chrony-ptp";
+
+  meta = {
+    maintainers = with lib.maintainers; [ gkleen ];
+  };
+
+  nodes = {
+    qemuGuest = { lib, ... }: {
+      boot.kernelModules = [ "ptp_kvm" ];
+
+      services.chrony = {
+        enable = true;
+        extraConfig = ''
+          refclock PHC /dev/ptp_kvm poll 2 dpoll -2 offset 0 stratum 3
+        '';
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    qemuGuest.wait_for_unit('multi-user.target')
+    qemuGuest.succeed('systemctl is-active chronyd.service')
+  '';
+})

nixos/tests/grafana/provision/default.nix

@@ -22,9 +22,15 @@ let
       };
     };
 
-    systemd.tmpfiles.rules = [
-      "L /var/lib/grafana/dashboards/test.json 0700 grafana grafana - ${pkgs.writeText "test.json" (builtins.readFile ./test_dashboard.json)}"
-    ];
+    system.activationScripts.setup-grafana = {
+      deps = [ "users" ];
+      text = ''
+        mkdir -p /var/lib/grafana/dashboards
+        chown -R grafana:grafana /var/lib/grafana
+        chmod 0700 -R /var/lib/grafana/dashboards
+        cp ${pkgs.writeText "test.json" (builtins.readFile ./test_dashboard.json)} /var/lib/grafana/dashboards/
+      '';
+    };
   };
 
   extraNodeConfs = {

pkgs/applications/audio/cavalier/default.nix

@@ -0,0 +1,68 @@
+{ lib
+, python3
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, gobject-introspection
+, glib
+, gtk4
+, librsvg
+, libadwaita
+, wrapGAppsHook4
+, appstream-glib
+, desktop-file-utils
+, cava
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "cavalier";
+  version = "2023.01.29";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "fsobolev";
+    repo = pname;
+    rev = version;
+    hash = "sha256-6bvi73cFQHtIyD4d4+mqje0qkmG4wkahZ2ohda5RvRQ=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gobject-introspection
+    wrapGAppsHook4
+    appstream-glib
+    desktop-file-utils
+  ];
+
+  buildInputs = [
+    glib
+    gtk4
+    librsvg
+    libadwaita
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pygobject3
+  ];
+
+  # Prevent double wrapping
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      "''${gappsWrapperArgs[@]}"
+      --prefix PATH ":" "${lib.makeBinPath [ cava ]}"
+    )
+  '';
+
+  meta = with lib; {
+    description = "Audio visualizer based on CAVA with customizable LibAdwaita interface";
+    homepage = "https://github.com/fsobolev/cavalier";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ zendo ];
+  };
+}

pkgs/applications/audio/praat/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "praat";
-  version = "6.3.04";
+  version = "6.3.05";
 
   src = fetchFromGitHub {
     owner = "praat";
     repo = "praat";
     rev = "v${version}";
-    sha256 = "sha256-C5wDiqoS6dF8VGTqiQbr1obtjpsiIa2bmtF6qGYc8XQ=";
+    sha256 = "sha256-0e225cmP0CSYjRYNEXi4Oqq9o8XR2N7bNS1X5x+mQKw=";
   };
 
   configurePhase = ''

pkgs/applications/editors/vscode/extensions/default.nix

@@ -546,8 +546,8 @@ let
         mktplcRef = {
           name = "markdown-mermaid";
           publisher = "bierner";
-          version = "1.14.2";
-          sha256 = "RZyAY2d3imnLhm1mLur+wTx/quxrNWYR9PCjC+co1FE=";
+          version = "1.17.4";
+          sha256 = "sha256-jJnALJJc8G4/0L7WMmKSZ7I+7Usmyj+WhufBdSzcEK0=";
         };
         meta = with lib; {
           license = licenses.mit;
@@ -624,8 +624,8 @@ let
         mktplcRef = {
           name = "catppuccin-vsc";
           publisher = "catppuccin";
-          version = "2.2.1";
-          sha256 = "sha256-vS+hz3RxG71F5QoO4LQOgOgFh6GQ8QX/+4mMD0KC1kA=";
+          version = "2.5.0";
+          sha256 = "sha256-+dM6MKIjzPdYoRe1DYJ08A+nHHlkTsm+I6CYmnmSRj4=";
         };
         meta = with lib; {
           description = "Soothing pastel theme for VSCode";
@@ -1351,8 +1351,8 @@ let
         mktplcRef = {
           name = "Go";
           publisher = "golang";
-          version = "0.33.1";
-          sha256 = "0dsjxs04dchw1dbzf45ryhxsb5xhalqwy40xw6cngxkp69lhf91g";
+          version = "0.37.1";
+          sha256 = "sha256-xOiMVUkcgwkMjYfNzFB3Qhfg26jf5nssaTfw0U+sAX0=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -1504,8 +1504,8 @@ let
         mktplcRef = {
           name = "latex-workshop";
           publisher = "James-Yu";
-          version = "9.4.4";
-          sha256 = "sha256-EA3OABn80GciNecXwLcorWP7K3+jI+wgujpmvvFcNOA=";
+          version = "9.5.0";
+          sha256 = "sha256-Av4RYnCh0gXQ+uRByl3Can+hvYD8Pc3x0Ec2jDcP6Fk=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";
@@ -1520,8 +1520,8 @@ let
         mktplcRef = {
           name = "gruvbox";
           publisher = "jdinhlife";
-          version = "1.5.1";
-          sha256 = "sha256-0ghB0E+Wa9W2bNFFiH2Q3pUJ9HV5+JfKohX4cRyevC8=";
+          version = "1.8.0";
+          sha256 = "sha256-P4FbbcRcKWbnC86TSnzQaGn2gHWkDM9I4hj4GiHNPS4=";
         };
         meta = with lib; {
           description = "Gruvbox Theme";
@@ -1790,8 +1790,8 @@ let
         mktplcRef = {
           name = "marp-vscode";
           publisher = "marp-team";
-          version = "1.5.0";
-          sha256 = "0wqsj8rp58vl3nafkjvyw394h5j4jd7d24ra6hkvfpnlzrgv4yhs";
+          version = "2.4.1";
+          sha256 = "sha256-h59OmFreja9IdFzH2zZaXXh+pnODirL2fPkUmvAgDyA=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -2941,8 +2941,8 @@ let
         mktplcRef = {
           name = "vim";
           publisher = "vscodevim";
-          version = "1.24.1";
-          sha256 = "00gq6mqqwqipc6d7di2x9mmi1lya11vhkkww9563avchavczb9sv";
+          version = "1.24.3";
+          sha256 = "sha256-4fPoRBttWVE8Z3e4O6Yrkf04iOu9ElspQFP57HOPVAk=";
         };
         meta = {
           license = lib.licenses.mit;

pkgs/applications/editors/vscode/extensions/python/default.nix

@@ -12,6 +12,7 @@
 , curl
 , coreutils
 , gnused
+, jq
 , nix
 }:
 
@@ -19,8 +20,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "python";
     publisher = "ms-python";
-    version = "2022.19.13351014";
-    sha256 = "1562f4b0v76p1wfbljc5zydq7aq7k5hshxzm2v1whb77cjskiw8s";
+    version = "2023.1.10091012";
+    sha256 = "sha256-JosFv6ngJmw1XRILwTZMVxlGIdWFLFQjj4olfnVwAIM=";
   };
 
   buildInputs = [ icu ];
@@ -29,7 +30,6 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     debugpy
-    isort
     jedi-language-server
   ];
 
@@ -57,14 +57,16 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
       curl
       coreutils
       gnused
+      jq
       nix
     ]}
 
     api=$(curl -s 'https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery' \
       -H 'accept: application/json;api-version=3.0-preview.1' \
       -H 'content-type: application/json' \
-      --data-raw '{"filters":[{"criteria":[{"filterType":7,"value":"${mktplcRef.publisher}.${mktplcRef.name}"}]}],"flags":512}')
-    version=$(echo $api | sed -n -E 's|^.*"version":"([0-9.]+)".*$|\1|p')
+      --data-raw '{"filters":[{"criteria":[{"filterType":7,"value":"${mktplcRef.publisher}.${mktplcRef.name}"}]}],"flags":16}')
+    # Find the latest version compatible with stable vscode version
+    version=$(echo $api | jq -r '.results[0].extensions[0].versions | map(select(has("properties"))) | map(select(.properties | map(select(.key == "Microsoft.VisualStudio.Code.Engine")) | .[0].value | test("\\^[0-9.]+$"))) | .[0].version')
 
     if [[ $version != ${mktplcRef.version} ]]; then
       tmp=$(mktemp)

pkgs/applications/emulators/rpcs3/default.nix

@@ -9,10 +9,10 @@
 
 let
   # Keep these separate so the update script can regex them
-  rpcs3GitVersion = "14599-d3183708e";
-  rpcs3Version = "0.0.26-14599-d3183708e";
-  rpcs3Revision = "d3183708e81ba2707d39829cc1c0cb226dd9e50e";
-  rpcs3Sha256 = "0lx9v614r9afmfknw9qdwawwayg3z0fj6chbhnfghm2j2zgqqbpi";
+  rpcs3GitVersion = "14637-c471120a8";
+  rpcs3Version = "0.0.26-14637-c471120a8";
+  rpcs3Revision = "c471120a80ec6f12cd4489e1a9be073d7d9c96f2";
+  rpcs3Sha256 = "1fl7zarxbjaz6mi3lqv55kdwpvjfz8d02qfl0655zihwm6zzdny5";
 
   ittapi = fetchFromGitHub {
     owner = "intel";

pkgs/applications/misc/logseq/default.nix

@@ -2,8 +2,8 @@
 , stdenv
 , fetchurl
 , appimageTools
+, appimage-run
 , makeWrapper
-, electron
 , git
 }:
 
@@ -30,30 +30,23 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin $out/share/${pname} $out/share/applications
-    cp -a ${appimageContents}/{locales,resources} $out/share/${pname}
+    mkdir -p $out/bin $out/share/${pname} $out/share/applications $out/share/${pname}/resources/app/icons
+    cp -a ${appimageContents}/resources/app/icons/logseq.png $out/share/${pname}/resources/app/icons/logseq.png
     cp -a ${appimageContents}/Logseq.desktop $out/share/applications/${pname}.desktop
 
-    # remove the `git` in `dugite` because we want the `git` in `nixpkgs`
-    chmod +w -R $out/share/${pname}/resources/app/node_modules/dugite/git
-    chmod +w $out/share/${pname}/resources/app/node_modules/dugite
-    rm -rf $out/share/${pname}/resources/app/node_modules/dugite/git
-    chmod -w $out/share/${pname}/resources/app/node_modules/dugite
+    # set the env "LOCAL_GIT_DIRECTORY" for dugite so that we can use the git in nixpkgs
+    makeWrapper ${appimage-run}/bin/appimage-run $out/bin/logseq \
+      --set "LOCAL_GIT_DIRECTORY" ${git} \
+      --add-flags ${src}
 
+    # Make the desktop entry run the app using appimage-run
     substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace Exec=Logseq Exec=${pname} \
+      --replace Exec=Logseq "Exec=$out/bin/logseq" \
       --replace Icon=Logseq Icon=$out/share/${pname}/resources/app/icons/logseq.png
 
     runHook postInstall
   '';
 
-  postFixup = ''
-    # set the env "LOCAL_GIT_DIRECTORY" for dugite so that we can use the git in nixpkgs
-    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --set "LOCAL_GIT_DIRECTORY" ${git} \
-      --add-flags $out/share/${pname}/resources/app
-  '';
-
   passthru.updateScript = ./update.sh;
 
   meta = with lib; {

pkgs/applications/misc/todoist-electron/default.nix

@@ -38,7 +38,8 @@ stdenv.mkDerivation rec {
   postFixup = ''
     makeWrapper ${electron_21}/bin/electron $out/bin/${pname} \
       --add-flags $out/share/${pname}/resources/app.asar \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc libsecret ]}"
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc libsecret ]}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
   '';
 
   meta = with lib; {

pkgs/applications/networking/browsers/opera/default.nix

@@ -41,27 +41,30 @@
 , at-spi2-core
 , autoPatchelfHook
 , wrapGAppsHook
+, qt5
+, proprietaryCodecs ? false
+, vivaldi-ffmpeg-codecs
 }:
 
 let
-
   mirror = "https://get.geo.opera.com/pub/opera/desktop";
-
-in stdenv.mkDerivation rec {
-
+in
+stdenv.mkDerivation rec {
   pname = "opera";
-  version = "90.0.4480.84";
+  version = "94.0.4606.54";
 
   src = fetchurl {
     url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    sha256 = "sha256-GMcBTY3Ab8lYWv1IPdCeKPZwbY19NPHYmK7ATzvq0cg=";
+    hash = "sha256-IMWIkJHKaE7n5Rll4ZExE6PQB9a2fz0hLx4vckbROgk=";
   };
 
-  unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
+  unpackPhase = "dpkg-deb -x $src .";
 
   nativeBuildInputs = [
+    dpkg
     autoPatchelfHook
     wrapGAppsHook
+    qt5.wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -115,16 +118,22 @@ in stdenv.mkDerivation rec {
     # "Illegal instruction (core dumped)"
     gtk3
     gtk4
+  ] ++ lib.optional proprietaryCodecs [
+    vivaldi-ffmpeg-codecs
   ];
 
+  dontWrapQtApps = true;
+
   installPhase = ''
-    mkdir -p $out
-    cp -r . $out/
+    mkdir -p $out/bin
+    cp -r usr $out
+    cp -r usr/share $out/share
+    ln -s $out/usr/bin/opera $out/bin/opera
   '';
 
   meta = with lib; {
     homepage = "https://www.opera.com";
-    description = "Web browser";
+    description = "Faster, safer and smarter web browser";
     platforms = [ "x86_64-linux" ];
     license = licenses.unfree;
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];

pkgs/applications/networking/cluster/glooctl/default.nix

@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.13.3";
+  version = "1.13.4";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-nxClmCY/joLJw87IQx9DvAZLv5LgOLGlp9Unh37OKgg=";
+    hash = "sha256-eyfMWum1fZUq4iF77Q+0FP2Rdq2P+xK0au3ytN8MS+k=";
   };
 
   subPackages = [ "projects/gloo/cli/cmd" ];
-  vendorHash = "sha256-Lpc/fzOJLIyI2O5DP8K/LBYg6ZA1ixristercAM5VUQ=";
+  vendorHash = "sha256-sQv6g0Xgs+6jgxacWJwE3dK3GimfiPHly0Z0rvdKNE4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/office/paperless-ngx/default.nix

@@ -1,6 +1,8 @@
 { lib
-, fetchurl
+, fetchFromGitHub
+, buildNpmPackage
 , nixosTests
+, gettext
 , python3
 , ghostscript
 , imagemagickBig
@@ -12,10 +14,18 @@
 , unpaper
 , poppler_utils
 , liberation_ttf
-, fetchFromGitHub
 }:
 
 let
+  version = "1.12.2";
+
+  src = fetchFromGitHub {
+    owner = "paperless-ngx";
+    repo = "paperless-ngx";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-1QufnRD2Nbc4twRZ4Yrf3ae1BRGves8tJ/M7coWnRPI=";
+  };
+
   # Use specific package versions required by paperless-ngx
   python = python3.override {
     packageOverrides = self: super: {
@@ -78,36 +88,67 @@ let
     unpaper
     poppler_utils
   ];
-in
-python.pkgs.pythonPackages.buildPythonApplication rec {
-  pname = "paperless-ngx";
-  version = "1.11.3";
 
-  # Fetch the release tarball instead of a git ref because it contains the prebuilt frontend
-  src = fetchurl {
-    url = "https://github.com/paperless-ngx/paperless-ngx/releases/download/v${version}/${pname}-v${version}.tar.xz";
-    hash = "sha256-wGNkdczgV+UDd9ZO+BXMSWotpetE/+c/jJAAH+6SXps=";
+  frontend = buildNpmPackage {
+    pname = "paperless-ngx-frontend";
+    inherit version src;
+
+    npmDepsHash = "sha256-fp0Gy3018u2y6jaUM9bmXU0SVjyEJdsvkBqbmb8S10Y=";
+
+    nativeBuildInputs = [
+      python3
+    ];
+
+    postPatch = ''
+      cd src-ui
+    '';
+
+    CYPRESS_INSTALL_BINARY = "0";
+    NG_CLI_ANALYTICS = "false";
+
+    npmBuildFlags = [
+      "--" "--configuration" "production"
+    ];
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/lib/paperless-ui
+      mv ../src/documents/static/frontend $out/lib/paperless-ui/
+      runHook postInstall
+    '';
   };
-
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "paperless-ngx";
   format = "other";
 
-  propagatedBuildInputs = with python.pkgs.pythonPackages; [
+  inherit version src;
+
+  nativeBuildInputs = [
+    gettext
+  ];
+
+  propagatedBuildInputs = with python.pkgs; [
     aioredis
-    arrow
+    amqp
+    anyio
     asgiref
     async-timeout
     attrs
     autobahn
     automat
+    billiard
     bleach
-    blessed
     celery
     certifi
     cffi
     channels-redis
     channels
-    chardet
+    charset-normalizer
     click
+    click-didyoumean
+    click-plugins
+    click-repl
     coloredlogs
     concurrent-log-handler
     constantly
@@ -118,18 +159,16 @@ python.pkgs.pythonPackages.buildPythonApplication rec {
     django-cors-headers
     django-extensions
     django-filter
-    django-picklefield
     django
     djangorestframework
     filelock
-    fuzzywuzzy
     gunicorn
     h11
     hiredis
     httptools
     humanfriendly
+    humanize
     hyperlink
-    imagehash
     idna
     imap-tools
     img2pdf
@@ -140,9 +179,11 @@ python.pkgs.pythonPackages.buildPythonApplication rec {
     langdetect
     lxml
     msgpack
+    mysqlclient
     nltk
     numpy
     ocrmypdf
+    packaging
     pathvalidate
     pdf2image
     pdfminer-six
@@ -150,6 +191,7 @@ python.pkgs.pythonPackages.buildPythonApplication rec {
     pillow
     pluggy
     portalocker
+    prompt-toolkit
     psycopg2
     pyasn1-modules
     pyasn1
@@ -158,7 +200,6 @@ python.pkgs.pythonPackages.buildPythonApplication rec {
     python-dateutil
     python-dotenv
     python-gnupg
-    levenshtein
     python-magic
     pytz
     pyyaml
@@ -171,36 +212,51 @@ python.pkgs.pythonPackages.buildPythonApplication rec {
     scikit-learn
     scipy
     service-identity
-    six
-    sortedcontainers
+    setproctitle
+    sniffio
     sqlparse
     threadpoolctl
     tika
+    tornado
     tqdm
-    twisted.optional-dependencies.tls
+    twisted
     txaio
+    tzdata
     tzlocal
     urllib3
     uvicorn
     uvloop
+    vine
     watchdog
-    watchgod
+    watchfiles
     wcwidth
+    webencodings
     websockets
     whitenoise
     whoosh
+    zipp
     zope_interface
-  ];
+  ]
+  ++ redis.optional-dependencies.hiredis
+  ++ twisted.optional-dependencies.tls
+  ++ uvicorn.optional-dependencies.standard;
 
-  # Compile manually because `pythonRecompileBytecodeHook` only works for
-  # files in `python.sitePackages`
   postBuild = ''
+    # Compile manually because `pythonRecompileBytecodeHook` only works
+    # for files in `python.sitePackages`
     ${python.interpreter} -OO -m compileall src
+
+    # Collect static files
+    ${python.interpreter} src/manage.py collectstatic --clear --no-input
+
+    # Compile string translations using gettext
+    ${python.interpreter} src/manage.py compilemessages
   '';
 
   installPhase = ''
-    mkdir -p $out/lib
-    cp -r . $out/lib/paperless-ngx
+    mkdir -p $out/lib/paperless-ngx
+    cp -r {src,static,LICENSE,gunicorn.conf.py} $out/lib/paperless-ngx
+    ln -s ${frontend}/lib/paperless-ui/frontend $out/lib/paperless-ngx/static/
     chmod +x $out/lib/paperless-ngx/src/manage.py
     makeWrapper $out/lib/paperless-ngx/src/manage.py $out/bin/paperless-ngx \
       --prefix PYTHONPATH : "$PYTHONPATH" \
@@ -210,12 +266,17 @@ python.pkgs.pythonPackages.buildPythonApplication rec {
       --prefix PATH : "${path}"
   '';
 
-  nativeCheckInputs = with python.pkgs.pythonPackages; [
+  postFixup = ''
+    # Remove tests with samples (~14M)
+    find $out/lib/paperless-ngx -type d -name tests -exec rm -rv {} +
+  '';
+
+  nativeCheckInputs = with python.pkgs; [
+    factory_boy
+    imagehash
     pytest-django
     pytest-env
-    pytest-sugar
     pytest-xdist
-    factory_boy
     pytestCheckHook
   ];
 
@@ -250,13 +311,14 @@ python.pkgs.pythonPackages.buildPythonApplication rec {
   ];
 
   passthru = {
-    inherit python path;
+    inherit python path frontend;
     tests = { inherit (nixosTests) paperless; };
   };
 
   meta = with lib; {
     description = "Tool to scan, index, and archive all of your physical documents";
     homepage = "https://paperless-ngx.readthedocs.io/";
+    changelog = "https://github.com/paperless-ngx/paperless-ngx/releases/tag/v${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ lukegb gador erikarvstedt ];
   };

pkgs/applications/office/trilium/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, nixosTests, fetchurl, autoPatchelfHook, atomEnv, makeWrapper, makeDesktopItem, copyDesktopItems, libxshmfence, wrapGAppsHook }:
+{ lib, callPackage, ... }:
 
 let
   metaCommon = with lib; {
@@ -7,117 +7,11 @@ let
     license = licenses.agpl3Plus;
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ fliegendewurst ];
+    maintainers = with maintainers; [ fliegendewurst eliandoran ];
   };
-
-  version = "0.58.7";
-
-  desktopSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-  desktopSource.sha256 = "1xr8fx5m6p9z18al1iigf45acn7b69vhbc6z6q1v933bvkwry16c";
-
-  serverSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-  serverSource.sha256 = "0xr474z7wz0z4rqvk5rhv6xh51mdysr8zw86fs8fk7av0fdqxyka";
-
 in {
 
-  trilium-desktop = stdenv.mkDerivation rec {
-    pname = "trilium-desktop";
-    inherit version;
-    meta = metaCommon // {
-      mainProgram = "trilium";
-    };
+  trilium-desktop = callPackage ./desktop.nix { metaCommon = metaCommon; };
+  trilium-server = callPackage ./server.nix { metaCommon = metaCommon; };
 
-    src = fetchurl desktopSource;
-
-    nativeBuildInputs = [
-      autoPatchelfHook
-      makeWrapper
-      wrapGAppsHook
-      copyDesktopItems
-    ];
-
-    buildInputs = atomEnv.packages ++ [ libxshmfence ];
-
-    desktopItems = [
-      (makeDesktopItem {
-        name = "Trilium";
-        exec = "trilium";
-        icon = "trilium";
-        comment = meta.description;
-        desktopName = "Trilium Notes";
-        categories = [ "Office" ];
-      })
-    ];
-
-    # Remove trilium-portable.sh, so trilium knows it is packaged making it stop auto generating a desktop item on launch
-    postPatch = ''
-      rm ./trilium-portable.sh
-    '';
-
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/bin
-      mkdir -p $out/share/trilium
-      mkdir -p $out/share/icons/hicolor/128x128/apps
-
-      cp -r ./* $out/share/trilium
-      ln -s $out/share/trilium/trilium $out/bin/trilium
-
-      ln -s $out/share/trilium/icon.png $out/share/icons/hicolor/128x128/apps/trilium.png
-      runHook postInstall
-    '';
-
-    # LD_LIBRARY_PATH "shouldn't" be needed, remove when possible :)
-    preFixup = ''
-      gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : ${atomEnv.libPath})
-    '';
-
-    dontStrip = true;
-
-    passthru.updateScript = ./update.sh;
-  };
-
-
-  trilium-server = stdenv.mkDerivation rec {
-    pname = "trilium-server";
-    inherit version;
-    meta = metaCommon;
-
-    src = fetchurl serverSource;
-
-    nativeBuildInputs = [
-      autoPatchelfHook
-    ];
-
-    buildInputs = [
-      stdenv.cc.cc.lib
-    ];
-
-    patches = [
-      # patch logger to use console instead of rolling files
-      ./0001-Use-console-logger-instead-of-rolling-files.patch
-    ];
-
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/bin
-      mkdir -p $out/share/trilium-server
-
-      cp -r ./* $out/share/trilium-server
-      runHook postInstall
-    '';
-
-    postFixup = ''
-      cat > $out/bin/trilium-server <<EOF
-      #!${stdenv.cc.shell}
-      cd $out/share/trilium-server
-      exec ./node/bin/node src/www
-      EOF
-      chmod a+x $out/bin/trilium-server
-    '';
-
-    passthru.tests = {
-      trilium-server = nixosTests.trilium-server;
-    };
-  };
 }

pkgs/applications/office/trilium/desktop.nix

@@ -0,0 +1,89 @@
+{ stdenv, lib, unzip, autoPatchelfHook
+, fetchurl, atomEnv, makeWrapper
+, makeDesktopItem, copyDesktopItems, wrapGAppsHook, libxshmfence
+, metaCommon
+}:
+
+let
+  pname = "trilium-desktop";
+  version = "0.58.7";
+
+  linuxSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
+  linuxSource.sha256 = "1xr8fx5m6p9z18al1iigf45acn7b69vhbc6z6q1v933bvkwry16c";
+
+  darwinSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-mac-x64-${version}.zip";
+  darwinSource.sha256 = "1khywd77j4f745fvxln01li8qxnhlqqsirhm75kbi24bxlcpxfpa";
+
+  meta = metaCommon // {
+    mainProgram = "trilium";
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+  };
+
+  linux = stdenv.mkDerivation rec {
+    pname = "trilium-desktop";
+    inherit version;
+
+    src = fetchurl linuxSource;
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+      makeWrapper
+      wrapGAppsHook
+      copyDesktopItems
+    ];
+
+    buildInputs = atomEnv.packages ++ [ libxshmfence ];
+
+    desktopItems = [
+      (makeDesktopItem {
+        name = "Trilium";
+        exec = "trilium";
+        icon = "trilium";
+        comment = meta.description;
+        desktopName = "Trilium Notes";
+        categories = [ "Office" ];
+      })
+    ];
+
+    # Remove trilium-portable.sh, so trilium knows it is packaged making it stop auto generating a desktop item on launch
+    postPatch = ''
+      rm ./trilium-portable.sh
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/bin
+      mkdir -p $out/share/trilium
+      mkdir -p $out/share/icons/hicolor/128x128/apps
+
+      cp -r ./* $out/share/trilium
+      ln -s $out/share/trilium/trilium $out/bin/trilium
+
+      ln -s $out/share/trilium/icon.png $out/share/icons/hicolor/128x128/apps/trilium.png
+      runHook postInstall
+    '';
+
+    # LD_LIBRARY_PATH "shouldn't" be needed, remove when possible :)
+    preFixup = ''
+      gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : ${atomEnv.libPath})
+    '';
+
+    dontStrip = true;
+
+    passthru.updateScript = ./update.sh;
+  };
+
+  darwin = stdenv.mkDerivation {
+    inherit pname version meta;
+
+    src = fetchurl darwinSource;
+    nativeBuildInputs = [ unzip ];
+
+    installPhase = ''
+      mkdir -p $out/Applications
+      cp -r *.app $out/Applications
+    '';
+  };
+
+in
+  if stdenv.isDarwin then darwin else linux

pkgs/applications/office/trilium/server.nix

@@ -0,0 +1,51 @@
+{ stdenv, lib, autoPatchelfHook, fetchurl, nixosTests
+, metaCommon }:
+
+let
+  serverSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
+  serverSource.sha256 = "0xr474z7wz0z4rqvk5rhv6xh51mdysr8zw86fs8fk7av0fdqxyka";
+  version = "0.58.7";
+in stdenv.mkDerivation rec {
+  pname = "trilium-server";
+  inherit version;
+  meta = metaCommon // {
+    platforms = [ "x86_64-linux" ];
+  };
+
+  src = fetchurl serverSource;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    stdenv.cc.cc.lib
+  ];
+
+  patches = [
+    # patch logger to use console instead of rolling files
+    ./0001-Use-console-logger-instead-of-rolling-files.patch
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    mkdir -p $out/share/trilium-server
+
+    cp -r ./* $out/share/trilium-server
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    cat > $out/bin/trilium-server <<EOF
+    #!${stdenv.cc.shell}
+    cd $out/share/trilium-server
+    exec ./node/bin/node src/www
+    EOF
+    chmod a+x $out/bin/trilium-server
+  '';
+
+  passthru.tests = {
+    trilium-server = nixosTests.trilium-server;
+  };
+}

pkgs/applications/office/trilium/update.sh

@@ -4,15 +4,20 @@ set -euo pipefail
 
 cd $(dirname "${BASH_SOURCE[0]}")
 
-version=$(curl -s --show-error "https://api.github.com/repos/zadam/trilium/releases/latest" | jq -r '.tag_name' | tail -c +2)
-
-sha256_linux64=$(nix-prefetch-url --quiet https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz)
-sha256_linux64_server=$(nix-prefetch-url --quiet https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz)
-
 setKV () {
-    sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" ./default.nix
+    sed -i "s|$2 = \".*\"|$2 = \"${3:-}\"|" $1
 }
 
-setKV version $version
-setKV desktopSource.sha256 $sha256_linux64
-setKV serverSource.sha256 $sha256_linux64_server
+version=$(curl -s --show-error "https://api.github.com/repos/zadam/trilium/releases/latest" | jq -r '.tag_name' | tail -c +2)
+
+# Update desktop application
+sha256_linux64=$(nix-prefetch-url --quiet https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz)
+sha256_darwin64=$(nix-prefetch-url --quiet https://github.com/zadam/trilium/releases/download/v${version}/trilium-mac-x64-${version}.zip)
+setKV ./desktop.nix version $version
+setKV ./desktop.nix linuxSource.sha256 $sha256_linux64
+setKV ./desktop.nix darwinSource.sha256 $sha256_darwin64
+
+# Update server
+sha256_linux64_server=$(nix-prefetch-url --quiet https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz)
+setKV ./server.nix version $version
+setKV ./server.nix serverSource.sha256 $sha256_linux64_server

pkgs/build-support/deterministic-uname/deterministic-uname.sh

@@ -133,7 +133,7 @@ fi
 # NixOS:
 #  Linux *nodename* 6.0.13 #1-NixOS SMP PREEMPT_DYNAMIC Wed Dec 14 10:41:06 UTC 2022 x86_64 GNU/Linux
 if [[ "$all" = "1" ]]; then
-    echo -n "$KERNEL_NAME_VAL $NODENAME_VAL $KERNEL_RELEASE_VAL $KERNEL_VERSION_VAL $MACHINE_VAL"
+    echo -n "$KERNEL_NAME_VAL $NODENAME_VAL $KERNEL_RELEASE_VAL $KERNEL_VERSION_VAL $MACHINE_VAL "
     # in help:  except omit -p and -i if unknown.
     #echo -n "$PROCESSOR_VAL $HARDWARE_PLATFORM_VAL\n"
     echo -n "$OPERATING_SYSTEM_VAL"

pkgs/data/fonts/iosevka/default.nix

@@ -1,4 +1,10 @@
-{ stdenv, lib, pkgs, fetchFromGitHub, nodejs, remarshal
+{ stdenv
+, lib
+, pkgs
+, buildNpmPackage
+, fetchFromGitHub
+, nodejs
+, remarshal
 , ttfautohint-nox
   # Custom font set options.
   # See https://typeof.net/Iosevka/customizer
@@ -42,70 +48,57 @@
   # '';
 , extraParameters ? null
   # Custom font set name. Required if any custom settings above.
-, set ? null }:
+, set ? null
+}:
 
 assert (privateBuildPlan != null) -> set != null;
 assert (extraParameters != null) -> set != null;
 
-let
-  # We don't know the attribute name for the Iosevka package as it
-  # changes not when our update script is run (which in turn updates
-  # node-packages.json, but when node-packages/generate.sh is run
-  # (which updates node-packages.nix).
-  #
-  # Doing it this way ensures that the package can always be built,
-  # although possibly an older version than ioseva-bin.
-  nodeIosevka = (import ./node-composition.nix {
-    inherit pkgs nodejs;
-    inherit (stdenv.hostPlatform) system;
-  }).package.override {
-    src = fetchFromGitHub {
-      owner = "be5invis";
-      repo = "Iosevka";
-      rev = "v15.6.3";
-      hash = "sha256-wsFx5sD1CjQTcmwpLSt97OYFI8GtVH54uvKQLU1fWTg=";
-    };
+buildNpmPackage rec {
+  pname = if set != null then "iosevka-${set}" else "iosevka";
+  version = "17.1.0";
+
+  src = fetchFromGitHub {
+    owner = "be5invis";
+    repo = "iosevka";
+    rev = "v${version}";
+    hash = "sha256-xGRymDhkNP9b2JYTEu4M/CrRINmMGY2S5ZuM3Ot1wGg=";
   };
 
-in
-stdenv.mkDerivation rec {
-  pname = if set != null then "iosevka-${set}" else "iosevka";
-  inherit (nodeIosevka) version src;
+  npmDepsHash = "sha256-Ncf07ggyOnz/2SpgdmaYS2X/8Bad+J2sz8Yyx9Iri3E=";
 
-  nativeBuildInputs = [
-    nodejs
-    remarshal
-    ttfautohint-nox
-  ];
+  nativeBuildInputs = [ nodejs remarshal ttfautohint-nox ];
 
   buildPlan =
-    if builtins.isAttrs privateBuildPlan
-      then builtins.toJSON { buildPlans.${pname} = privateBuildPlan; }
-    else privateBuildPlan;
+    if builtins.isAttrs privateBuildPlan then
+      builtins.toJSON { buildPlans.${pname} = privateBuildPlan; }
+    else
+      privateBuildPlan;
 
   inherit extraParameters;
-  passAsFile = [
-    "extraParameters"
-  ] ++ lib.optionals (! (builtins.isString privateBuildPlan && lib.hasPrefix builtins.storeDir privateBuildPlan)) [
-    "buildPlan"
-  ];
+  passAsFile = [ "extraParameters" ] ++ lib.optionals
+    (
+      !(builtins.isString privateBuildPlan
+        && lib.hasPrefix builtins.storeDir privateBuildPlan)
+    ) [ "buildPlan" ];
 
   configurePhase = ''
     runHook preConfigure
     ${lib.optionalString (builtins.isAttrs privateBuildPlan) ''
       remarshal -i "$buildPlanPath" -o private-build-plans.toml -if json -of toml
     ''}
-    ${lib.optionalString (builtins.isString privateBuildPlan && (!lib.hasPrefix builtins.storeDir privateBuildPlan)) ''
-      cp "$buildPlanPath" private-build-plans.toml
-    ''}
-    ${lib.optionalString (builtins.isString privateBuildPlan && (lib.hasPrefix builtins.storeDir privateBuildPlan)) ''
-      cp "$buildPlan" private-build-plans.toml
-    ''}
+    ${lib.optionalString (builtins.isString privateBuildPlan
+      && (!lib.hasPrefix builtins.storeDir privateBuildPlan)) ''
+        cp "$buildPlanPath" private-build-plans.toml
+      ''}
+    ${lib.optionalString (builtins.isString privateBuildPlan
+      && (lib.hasPrefix builtins.storeDir privateBuildPlan)) ''
+        cp "$buildPlan" private-build-plans.toml
+      ''}
     ${lib.optionalString (extraParameters != null) ''
       echo -e "\n" >> params/parameters.toml
       cat "$extraParametersPath" >> params/parameters.toml
     ''}
-    ln -s ${nodeIosevka}/lib/node_modules/iosevka/node_modules .
     runHook postConfigure
   '';
 
@@ -126,16 +119,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  passthru = {
-    updateScript = ./update-default.sh;
-  };
-
   meta = with lib; {
-    homepage = "https://be5invis.github.io/Iosevka";
+    homepage = "https://typeof.net/Iosevka/";
     downloadPage = "https://github.com/be5invis/Iosevka/releases";
     description = ''
-      Slender monospace sans-serif and slab-serif typeface inspired by Pragmata
-      Pro, M+ and PF DIN Mono, designed to be the ideal font for programming.
+      Iosevka is an open-source, sans-serif + slab-serif, monospace +
+      quasi‑proportional typeface family, designed for writing code, using in
+      terminals, and preparing technical documents.
     '';
     license = licenses.ofl;
     platforms = platforms.all;
@@ -146,6 +136,7 @@ stdenv.mkDerivation rec {
       babariviere
       rileyinman
       AluisioASG
+      lunik1
     ];
   };
 }

pkgs/data/fonts/iosevka/node-composition.nix

@@ -1,17 +0,0 @@
-# This file has been generated by node2nix 1.11.1. Do not edit!
-
-{pkgs ? import <nixpkgs> {
-    inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-16_x"}:
-
-let
-  nodeEnv = import ../../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript;
-    inherit pkgs nodejs;
-    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
-  };
-in
-import ./node-packages.nix {
-  inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit;
-  inherit nodeEnv;
-}

pkgs/data/fonts/iosevka/update-default.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p common-updater-scripts coreutils gawk replace
-set -euo pipefail
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-nixpkgs=../../../..
-repo=https://github.com/be5invis/Iosevka
-
-# Discover the latest version.
-current_version=$(nix-instantiate "$nixpkgs" --eval --strict -A iosevka.version | tr -d '"')
-new_version=$(list-git-tags --url="$repo" | sort --reverse --version-sort | awk 'match($0, /^v([0-9.]+)$/, m) { print m[1]; exit; }')
-if [[ "$new_version" == "$current_version" ]]; then
-    echo "iosevka: no update found"
-    exit
-fi
-
-# Update the source package in nodePackages.
-current_source="$repo/archive/v$current_version.tar.gz"
-new_source="$repo/archive/v$new_version.tar.gz"
-replace-literal -ef "$current_source" "$new_source" ../../../development/node-packages/node-packages.json
-echo "iosevka: $current_version -> $new_version (after nodePackages update)"

pkgs/development/node-packages/node-packages.json

@@ -183,7 +183,6 @@
 , "insect"
 , "intelephense"
 , "ionic"
-, {"iosevka": "https://github.com/be5invis/Iosevka/archive/v17.1.0.tar.gz"}
 , "jake"
 , "javascript-typescript-langserver"
 , "joplin"

pkgs/development/python-modules/redis/default.nix

@@ -41,7 +41,7 @@ buildPythonPackage rec {
   ];
 
   passthru.optional-dependencies = {
-    hidredis = [
+    hiredis = [
       hiredis
     ];
     ocsp = [

pkgs/development/python-modules/remote-pdb/default.nix

@@ -0,0 +1,18 @@
+{ buildPythonPackage, fetchFromGitHub, lib }:
+buildPythonPackage rec {
+  pname = "remote-pdb";
+  version = "2.1.0";
+  src = fetchFromGitHub {
+    owner = "ionelmc";
+    repo = "python-remote-pdb";
+    rev = "v${version}";
+    sha256 = "sha256-/7RysJOJigU4coC6d/Ob2lrtw8u8nLZI8wBk4oEEY3g=";
+  };
+  meta = with lib; {
+    description = "Remote vanilla PDB (over TCP sockets).";
+    homepage = "https://github.com/ionelmc/python-remote-pdb";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ mic92 ];
+    platforms = platforms.all;
+  };
+}

pkgs/misc/t-rec/default.nix

@@ -9,13 +9,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "t-rec";
-  version = "0.7.5";
+  version = "0.7.6";
 
   src = fetchFromGitHub {
     owner = "sassman";
     repo = "t-rec-rs";
     rev = "v${version}";
-    sha256 = "sha256-tkt0XAofBhHytbA24g0+jU13aNjmgQ5RspbLTPclnrI=";
+    sha256 = "sha256-o1fO0N65L6Z6W6aBNhS5JqDHIc1MRQx0yECGzVSCsbo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
     wrapProgram "$out/bin/t-rec" --prefix PATH : "${binPath}"
   '';
 
-  cargoSha256 = "sha256-bb0fwz0fI6DJWgnW0rX63qH2niCLtPeVKex7m6BhVWs=";
+  cargoHash = "sha256-3NExPlHNcoYVkpOzWCyd66chJpeDzQLRJUruSLAwGNw=";
 
   meta = with lib; {
     description = "Blazingly fast terminal recorder that generates animated gif images for the web written in rust";

pkgs/os-specific/linux/criu/default.nix

@@ -1,6 +1,8 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, protobuf, protobufc, asciidoc, iptables
 , xmlto, docbook_xsl, libpaper, libnl, libcap, libnet, pkg-config, iproute2
-, which, python3, makeWrapper, docbook_xml_dtd_45, perl, nftables, libbsd }:
+, which, python3, makeWrapper, docbook_xml_dtd_45, perl, nftables, libbsd
+, buildPackages
+}:
 
 stdenv.mkDerivation rec {
   pname = "criu";
@@ -22,9 +24,34 @@ stdenv.mkDerivation rec {
   ];
 
   enableParallelBuilding = true;
-  nativeBuildInputs = [ pkg-config docbook_xsl which makeWrapper docbook_xml_dtd_45 python3 python3.pkgs.wrapPython perl ];
-  buildInputs = [ protobuf asciidoc xmlto libpaper libnl libcap libnet nftables libbsd ];
-  propagatedBuildInputs = [ protobufc ] ++ (with python3.pkgs; [ python python3.pkgs.protobuf ]);
+  depsBuildBuild = [ protobufc buildPackages.stdenv.cc ];
+  nativeBuildInputs = [
+    pkg-config
+    asciidoc
+    xmlto
+    libpaper
+    docbook_xsl
+    which
+    makeWrapper
+    docbook_xml_dtd_45
+    python3
+    python3.pkgs.wrapPython
+    perl
+  ];
+  buildInputs = [
+    protobuf
+    libnl
+    libcap
+    libnet
+    nftables
+    libbsd
+  ];
+  propagatedBuildInputs = [
+    protobufc
+  ] ++ (with python3.pkgs; [
+    python
+    python3.pkgs.protobuf
+  ]);
 
   postPatch = ''
     substituteInPlace ./Documentation/Makefile \
@@ -34,7 +61,27 @@ stdenv.mkDerivation rec {
     ln -sf ${protobuf}/include/google/protobuf/descriptor.proto ./images/google/protobuf/descriptor.proto
   '';
 
-  makeFlags = [ "PREFIX=$(out)" "ASCIIDOC=${asciidoc}/bin/asciidoc" "XMLTO=${xmlto}/bin/xmlto" ];
+  makeFlags = let
+    # criu's Makefile infrastructure expects to be passed a target architecture
+    # which neither matches the config-tuple's first part, nor the
+    # targetPlatform.linuxArch attribute. Thus we take the latter and map it
+    # onto the expected string:
+    linuxArchMapping = {
+      "x86_64" = "x86";
+      "arm" = "arm";
+      "arm64" = "aarch64";
+      "powerpc" = "ppc64";
+      "s390" = "s390";
+      "mips" = "mips";
+    };
+  in [
+    "PREFIX=$(out)"
+    "ASCIIDOC=${buildPackages.asciidoc}/bin/asciidoc"
+    "XMLTO=${buildPackages.xmlto}/bin/xmlto"
+  ] ++ (lib.optionals (stdenv.buildPlatform != stdenv.targetPlatform) [
+    "ARCH=${linuxArchMapping."${stdenv.targetPlatform.linuxArch}"}"
+    "CROSS_COMPILE=${stdenv.targetPlatform.config}-"
+  ]);
 
   outputs = [ "out" "dev" "man" ];
 
@@ -58,7 +105,7 @@ stdenv.mkDerivation rec {
     description = "Userspace checkpoint/restore for Linux";
     homepage    = "https://criu.org";
     license     = licenses.gpl2;
-    platforms   = [ "x86_64-linux" "aarch64-linux" ];
+    platforms   = [ "x86_64-linux" "aarch64-linux" "armv7l-linux" ];
     maintainers = [ maintainers.thoughtpolice ];
   };
 }

pkgs/os-specific/linux/multipath-tools/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, coreutils
 , pkg-config
 , perl
 , lvm2
@@ -9,31 +10,28 @@
 , systemd
 , liburcu
 , json_c
-, kmod
+, linuxHeaders
 , cmocka
 , nixosTests
 }:
 
 stdenv.mkDerivation rec {
   pname = "multipath-tools";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "opensvc";
     repo = "multipath-tools";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-pIGeZ+jB+6GqkfVN83axHIuY/BobQ+zs+tH+MkLIln0=";
+    sha256 = "sha256-CPvtnjzkyxKXrT8+YXaIgDA548h8X61+jCxMHKFfEyg=";
   };
 
   postPatch = ''
-    substituteInPlace libmultipath/Makefile \
-      --replace /usr/include/libdevmapper.h ${lib.getDev lvm2}/include/libdevmapper.h
+    substituteInPlace create-config.mk \
+      --replace /bin/echo ${coreutils}/bin/echo
 
-    # systemd-udev-settle.service is deprecated.
     substituteInPlace multipathd/multipathd.service \
-      --replace /sbin/modprobe ${lib.getBin kmod}/sbin/modprobe \
-      --replace /sbin/multipathd "$out/bin/multipathd" \
-      --replace " systemd-udev-settle.service" ""
+      --replace /sbin/multipathd "$out/bin/multipathd"
 
     sed -i -re '
       s,^( *#define +DEFAULT_MULTIPATHDIR\>).*,\1 "'"$out/lib/multipath"'",
@@ -45,15 +43,16 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ pkg-config perl ];
-  buildInputs = [ systemd lvm2 libaio readline liburcu json_c ];
+  buildInputs = [ systemd lvm2 libaio readline liburcu json_c linuxHeaders ];
 
   makeFlags = [
     "LIB=lib"
     "prefix=$(out)"
+    "systemd_prefix=$(out)"
+    "kernel_incdir=${linuxHeaders}/include/"
     "man8dir=$(out)/share/man/man8"
     "man5dir=$(out)/share/man/man5"
     "man3dir=$(out)/share/man/man3"
-    "SYSTEMDPATH=lib"
   ];
 
   doCheck = true;

pkgs/servers/matterbridge/default.nix

@@ -11,6 +11,8 @@ buildGoModule rec {
     sha256 = "sha256-VqVrAmbKTfDhcvgayEE1wUeFBSTGczBrntIJQ5/uWzM=";
   };
 
+  subPackages = [ "." ];
+
   vendorSha256 = null;
 
   meta = with lib; {

pkgs/servers/sql/postgresql/ext/plpgsql_check.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "plpgsql_check";
-  version = "2.2.6";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-8HFyIzJ1iF3K2vTlibFallvkMKjFTJ2DO64fORToD8E=";
+    hash = "sha256-zl7AF+1hj6UFnf9sKO40ZTzm7edKguUYFqaT5/qf8Ic=";
   };
 
   buildInputs = [ postgresql ];

pkgs/tools/audio/tts/default.nix

@@ -65,7 +65,6 @@ python.pkgs.buildPythonApplication rec {
       "mecab-python3"
       "numba"
       "numpy"
-      "umap-learn"
       "unidic-lite"
     ];
   in ''
@@ -74,6 +73,8 @@ python.pkgs.buildPythonApplication rec {
         ''-e 's/${package}.*[<>=]+.*/${package}/g' \''
       ) relaxedConstraints)}
     requirements.txt
+    # only used for notebooks and visualization
+    sed -r -i -e '/umap-learn/d' requirements.txt
   '';
 
   nativeBuildInputs = with python.pkgs; [
@@ -108,7 +109,6 @@ python.pkgs.buildPythonApplication rec {
     torchaudio-bin
     tqdm
     trainer
-    umap-learn
     unidic-lite
     webrtcvad
   ];

pkgs/tools/misc/completely/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'completely'

pkgs/tools/misc/completely/Gemfile.lock

@@ -0,0 +1,20 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    colsole (0.8.2)
+    completely (0.5.2)
+      colsole (~> 0.6)
+      mister_bin (~> 0.7.2)
+    docopt (0.6.1)
+    mister_bin (0.7.3)
+      colsole (~> 0.7)
+      docopt (~> 0.6)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  completely
+
+BUNDLED WITH
+   2.4.5

pkgs/tools/misc/completely/default.nix

@@ -0,0 +1,21 @@
+{ lib
+, bundlerApp
+, bundlerUpdateScript
+}:
+
+bundlerApp {
+  pname = "completely";
+
+  gemdir = ./.;
+  exes = [ "completely" ];
+
+  passthru.updateScript = bundlerUpdateScript "completely";
+
+  meta = with lib; {
+    description = "Generate bash completion scripts using a simple configuration file";
+    homepage = "https://github.com/DannyBen/completely";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ zendo ];
+  };
+}

pkgs/tools/misc/completely/gemset.nix

@@ -0,0 +1,44 @@
+{
+  colsole = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1l29sxy4p9jbvcihckxfsyqx98b8xwzd3hjqvdh1zxw8nv5walnp";
+      type = "gem";
+    };
+    version = "0.8.2";
+  };
+  completely = {
+    dependencies = ["colsole" "mister_bin"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0w7cmmsp9m42c8w4j03kr98zy7x7yszw3qsm3ww600dmc0d0xd2b";
+      type = "gem";
+    };
+    version = "0.5.2";
+  };
+  docopt = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rvlfbb7kzyagncm4zdpcjwrh682zamgf5rcf5qmj0bd6znkgy3k";
+      type = "gem";
+    };
+    version = "0.6.1";
+  };
+  mister_bin = {
+    dependencies = ["colsole" "docopt"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1f51zs9wjpslhdadp8yfx4ij0jj1ya92cbzqlfd2wfr19wdr2jgd";
+      type = "gem";
+    };
+    version = "0.7.3";
+  };
+}

pkgs/tools/misc/goreleaser/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "goreleaser";
-  version = "1.14.1";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kA+7kAFAAZngbub2gHoiqEcSkcbxv0DPqbAT3MDBHtI=";
+    sha256 = "sha256-JVvkASYNp6GSCEIWfZwZ1rtOkUCutccOWCkt47rmgyE=";
   };
 
-  vendorSha256 = "sha256-v3ZF2WDp4EmHA8RnP39o21cy9+n4cKkKZ0gSowv4nvk=";
+  vendorSha256 = "sha256-jFItDgmjjKbmTpOn32V1K3AmYyYCrc5RqMAH/X+VWTM=";
 
   ldflags = [
     "-s"

pkgs/tools/package-management/nix-eval-jobs/default.nix

@@ -11,12 +11,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nix-eval-jobs";
-  version = "2.12.0";
+  version = "2.12.1";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-HSgW9qKXIWu+nzlWjR7HoIrjO1yn48a0U/E76VwrpQ0=";
+    hash = "sha256-8nFseSTAIGJdB4P/K/cXAehvdrSLcTTBZLQNs/ZC+I8=";
   };
   buildInputs = [
     boost

pkgs/tools/system/wslu/default.nix

@@ -14,6 +14,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-yhugh836BoSISbTu19ubLOrz5X31Opu5QtCR0DXrbWc=";
   };
 
+  patches = [
+    ./fallback-conf-nix-store.diff
+  ];
+
+  postPatch = ''
+    substituteInPlace src/wslu-header \
+      --subst-var out
+  '';
+
   makeFlags = [
     "DESTDIR=$(out)"
     "PREFIX="

pkgs/tools/system/wslu/fallback-conf-nix-store.diff

@@ -0,0 +1,22 @@
+diff --git a/src/wslu-header b/src/wslu-header
+index 5f33925..159c6af 100644
+--- a/src/wslu-header
++++ b/src/wslu-header
+@@ -169,11 +169,17 @@ if [ -f "$HOME/.config/wslu/conf" ]; then
+ 	debug_echo "$HOME/.config/wslu/conf found, sourcing"
+ 	source "$HOME/.config/wslu/conf"
+ fi
++
+ if [ -f "$HOME/.wslurc" ]; then
+ 	debug_echo "$HOME/.wslurc found, sourcing"
+ 	source "$HOME/.wslurc"
+ fi
+ 
++if [ -f "@out@/share/wslu/conf" ]; then
++	debug_echo "@out@/share/wslu/conf found, sourcing"
++	source "@out@/share/wslu/conf"
++fi
++
+ # functions
+ 
+ function help {

pkgs/top-level/all-packages.nix

@@ -2525,9 +2525,7 @@ with pkgs;
 
   lilo = callPackage ../tools/misc/lilo { };
 
-  logseq = callPackage ../applications/misc/logseq {
-    electron = electron_20;
-  };
+  logseq = callPackage ../applications/misc/logseq { };
 
   natls = callPackage ../tools/misc/natls { };
 
@@ -28444,6 +28442,8 @@ with pkgs;
 
   cava = callPackage ../applications/audio/cava { };
 
+  cavalier = callPackage ../applications/audio/cavalier { };
+
   cb2bib = libsForQt5.callPackage ../applications/office/cb2bib { };
 
   cbatticon = callPackage ../applications/misc/cbatticon { };
@@ -28560,6 +28560,8 @@ with pkgs;
 
   complete-alias = callPackage ../tools/misc/complete-alias { };
 
+  completely = callPackage ../tools/misc/completely { };
+
   confclerk = libsForQt5.callPackage ../applications/misc/confclerk { };
 
   copyq = qt6Packages.callPackage ../applications/misc/copyq { };

pkgs/top-level/python-packages.nix

@@ -9884,6 +9884,8 @@ self: super: with self; {
 
   remi = callPackage ../development/python-modules/remi { };
 
+  remote-pdb = callPackage ../development/python-modules/remote-pdb { };
+
   renault-api = callPackage ../development/python-modules/renault-api { };
 
   rencode = callPackage ../development/python-modules/rencode { };

pkgs/top-level/release-cross.nix

@@ -34,6 +34,8 @@ let
     nix = nativePlatforms;
     nixUnstable = nativePlatforms;
     mesa = nativePlatforms;
+    rustc = nativePlatforms;
+    cargo = nativePlatforms;
   };
 
   gnuCommon = lib.recursiveUpdate common {