Merge master into haskell-updates

2023-05-12 00:11:50 +00:00 · 2023-05-12 00:11:50 +00:00 · c5b5347225
parent 2239f5664b 53875c54da
commit c5b5347225
177 changed files with 6589 additions and 1222 deletions
--- a/doc/languages-frameworks/dart.section.md
+++ b/doc/languages-frameworks/dart.section.md
@ -0,0 +1,65 @@
+# Dart {#sec-language-dart}
+
+## Dart applications {#ssec-dart-applications}
+
+The function `buildDartApplication` builds Dart applications managed with pub.
+
+It fetches its Dart dependencies automatically through `fetchDartDeps`, and (through a series of hooks) builds and installs the executables specified in the pubspec file. The hooks can be used in other derivations, if needed. The phases can also be overridden to do something different from installing binaries.
+
+If you are packaging a Flutter desktop application, use [`buildFlutterApplication`](#ssec-dart-flutter) instead.
+
+`vendorHash`: is the hash of the output of the dependency fetcher derivation. To obtain it, simply set it to `lib.fakeHash` (or omit it) and run the build ([more details here](#sec-source-hashes)).
+
+If the upstream source is missing a `pubspec.lock` file, you'll have to vendor one and specify it using `pubspecLockFile`. If it is needed, one will be generated for you and printed when attempting to build the derivation.
+
+The `dart` commands run can be overridden through `pubGetScript` and `dartCompileCommand`, you can also add flags using `dartCompileFlags` or `dartJitFlags`.
+
+Dart supports multiple [outputs types](https://dart.dev/tools/dart-compile#types-of-output), you can choose between them using `dartOutputType` (defaults to `exe`). If you want to override the binaries path or the source path they come from, you can use `dartEntryPoints`. Outputs that require a runtime will automatically be wrapped with the relevant runtime (`dartaotruntime` for `aot-snapshot`, `dart run` for `jit-snapshot` and `kernel`, `node` for `js`), this can be overridden through `dartRuntimeCommand`.
+
+```nix
+{ buildDartApplication, fetchFromGitHub }:
+
+buildDartApplication rec {
+  pname = "dart-sass";
+  version = "1.62.1";
+
+  src = fetchFromGitHub {
+    owner = "sass";
+    repo = pname;
+    rev = version;
+    hash = "sha256-U6enz8yJcc4Wf8m54eYIAnVg/jsGi247Wy8lp1r1wg4=";
+  };
+
+  pubspecLockFile = ./pubspec.lock;
+  vendorHash = "sha256-Atm7zfnDambN/BmmUf4BG0yUz/y6xWzf0reDw3Ad41s=";
+}
+```
+
+## Flutter applications {#ssec-dart-flutter}
+
+The function `buildFlutterApplication` builds Flutter applications.
+
+The deps.json file must always be provided when packaging in Nixpkgs. It will be generated and printed if the derivation is attempted to be built without one. Alternatively, `autoDepsList` may be set to `true` when outside of Nixpkgs, as it relies on import-from-derivation.
+
+A `pubspec.lock` file must be available. See the [Dart documentation](#ssec-dart-applications) for more details.
+
+```nix
+{  flutter, fetchFromGitHub }:
+
+flutter.buildFlutterApplication {
+  pname = "firmware-updater";
+  version = "unstable-2023-04-30";
+
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "firmware-updater";
+    rev = "6e7dbdb64e344633ea62874b54ff3990bd3b8440";
+    sha256 = "sha256-s5mwtr5MSPqLMN+k851+pFIFFPa0N1hqz97ys050tFA=";
+    fetchSubmodules = true;
+  };
+
+  pubspecLockFile = ./pubspec.lock;
+  depsListFile = ./deps.json;
+  vendorHash = "sha256-cdMO+tr6kYiN5xKXa+uTMAcFf2C75F3wVPrn21G4QPQ=";
+}
+```
--- a/doc/languages-frameworks/index.xml
+++ b/doc/languages-frameworks/index.xml
@ -14,6 +14,7 @@
 <xi:include href="crystal.section.xml" />
 <xi:include href="cuda.section.xml" />
 <xi:include href="cuelang.section.xml" />
+ <xi:include href="dart.section.xml" />
 <xi:include href="dhall.section.xml" />
 <xi:include href="dotnet.section.xml" />
 <xi:include href="emscripten.section.xml" />
--- a/flake.nix
+++ b/flake.nix
@ -57,6 +57,19 @@

      nixosModules = {
        notDetected = ./nixos/modules/installer/scan/not-detected.nix;
+
+        /*
+          Make the `nixpkgs.*` configuration read-only. Guarantees that `pkgs`
+          is the way you initialize it.
+
+          Example:
+
+              {
+                imports = [ nixpkgs.nixosModules.readOnlyPkgs ];
+                nixpkgs.pkgs = nixpkgs.legacyPackages.x86_64-linux;
+              }
+        */
+        readOnlyPkgs = ./nixos/modules/misc/nixpkgs/read-only.nix;
      };
    };
 }
--- a/lib/types.nix
+++ b/lib/types.nix
@ -476,6 +476,14 @@ rec {
      check = x: isDerivation x && hasAttr "shellPath" x;
    };

+    pkgs = addCheck
+      (unique { message = "A Nixpkgs pkgs set can not be merged with another pkgs set."; } attrs // {
+        name = "pkgs";
+        descriptionClass = "noun";
+        description = "Nixpkgs package set";
+      })
+      (x: (x._type or null) == "pkgs");
+
    path = mkOptionType {
      name = "path";
      descriptionClass = "noun";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -6291,6 +6291,14 @@
    github = "higebu";
    githubId = 733288;
  };
+
+  hikari = {
+    email = "HikariNee@protonmail.com";
+    github = "HikariNee";
+    githubId = 72349937;
+    name = "Hikari";
+  };
+
  hiljusti = {
    name = "J.R. Hill";
    email = "hiljusti@so.dang.cool";
@ -6303,6 +6311,7 @@
    githubId = 19825977;
    name = "Hiren Shah";
  };
+
  hiro98 = {
    email = "hiro@protagon.space";
    github = "vale981";
@ -7439,6 +7448,12 @@
      fingerprint = "B768 6CD7 451A 650D 9C54  4204 6710 CF0C 1CBD 7762";
    }];
  };
+  jleightcap = {
+    email = "jack@leightcap.com";
+    github = "jleightcap";
+    githubId = 30168080;
+    name = "Jack Leightcap";
+  };
  jlesquembre = {
    email = "jl@lafuente.me";
    github = "jlesquembre";
@ -15935,6 +15950,12 @@
    githubId = 8577941;
    name = "Kevin Rauscher";
  };
+  tomaskala = {
+    email = "public+nixpkgs@tomaskala.com";
+    github = "tomaskala";
+    githubId = 7727887;
+    name = "Tomas Kala";
+  };
  tomberek = {
    email = "tomberek@gmail.com";
    matrix = "@tomberek:matrix.org";
--- a/maintainers/scripts/copy-tarballs.pl
+++ b/maintainers/scripts/copy-tarballs.pl
@ -162,13 +162,18 @@ elsif (defined $expr) {
    # Check every fetchurl call discovered by find-tarballs.nix.
    my $mirrored = 0;
    my $have = 0;
-    foreach my $fetch (sort { $a->{url} cmp $b->{url} } @{$fetches}) {
-        my $url = $fetch->{url};
+    foreach my $fetch (sort { $a->{urls}->[0] cmp $b->{urls}->[0] } @{$fetches}) {
+        my $urls = $fetch->{urls};
        my $algo = $fetch->{type};
        my $hash = $fetch->{hash};
        my $name = $fetch->{name};
        my $isPatch = $fetch->{isPatch};

+        if ($isPatch) {
+            print STDERR "skipping $urls->[0] (support for patches is missing)\n";
+            next;
+        }
+
        if ($hash =~ /^([a-z0-9]+)-([A-Za-z0-9+\/=]+)$/) {
            $algo = $1;
            $hash = `nix hash to-base16 $hash` or die;
@ -183,62 +188,60 @@ elsif (defined $expr) {
            chomp $hash;
        }

-        if (defined $ENV{DEBUG}) {
-            print "$url $algo $hash\n";
-            next;
-        }
-
-        if ($url !~ /^http:/ && $url !~ /^https:/ && $url !~ /^ftp:/ && $url !~ /^mirror:/) {
-            print STDERR "skipping $url (unsupported scheme)\n";
-            next;
-        }
-
-        if ($isPatch) {
-            print STDERR "skipping $url (support for patches is missing)\n";
-            next;
-        }
-
-        next if defined $exclude && $url =~ /$exclude/;
-
-        if (alreadyMirrored($algo, $hash)) {
-            $have++;
-            next;
-        }
-
        my $storePath = makeFixedOutputPath(0, $algo, $hash, $name);

-        print STDERR "mirroring $url ($storePath, $algo, $hash)...\n";
+        for my $url (@$urls) {
+            if (defined $ENV{DEBUG}) {
+                print "$url $algo $hash\n";
+                next;
+            }

-        if ($dryRun) {
+            if ($url !~ /^http:/ && $url !~ /^https:/ && $url !~ /^ftp:/ && $url !~ /^mirror:/) {
+                print STDERR "skipping $url (unsupported scheme)\n";
+                next;
+            }
+
+            next if defined $exclude && $url =~ /$exclude/;
+
+            if (alreadyMirrored($algo, $hash)) {
+                $have++;
+                last;
+            }
+
+            print STDERR "mirroring $url ($storePath, $algo, $hash)...\n";
+
+            if ($dryRun) {
+                $mirrored++;
+                last;
+            }
+
+            # Substitute the output.
+            if (!isValidPath($storePath)) {
+                system("nix-store", "-r", $storePath);
+            }
+
+            # Otherwise download the file using nix-prefetch-url.
+            if (!isValidPath($storePath)) {
+                $ENV{QUIET} = 1;
+                $ENV{PRINT_PATH} = 1;
+                my $fh;
+                my $pid = open($fh, "-|", "nix-prefetch-url", "--type", $algo, $url, $hash) or die;
+                waitpid($pid, 0) or die;
+                if ($? != 0) {
+                    print STDERR "failed to fetch $url: $?\n";
+                    next;
+                }
+                <$fh>; my $storePath2 = <$fh>; chomp $storePath2;
+                if ($storePath ne $storePath2) {
+                    warn "strange: $storePath != $storePath2\n";
+                    next;
+                }
+            }
+
+            uploadFile($storePath, $url);
            $mirrored++;
-            next;
+            last;
        }
-
-        # Substitute the output.
-        if (!isValidPath($storePath)) {
-            system("nix-store", "-r", $storePath);
-        }
-
-        # Otherwise download the file using nix-prefetch-url.
-        if (!isValidPath($storePath)) {
-            $ENV{QUIET} = 1;
-            $ENV{PRINT_PATH} = 1;
-            my $fh;
-            my $pid = open($fh, "-|", "nix-prefetch-url", "--type", $algo, $url, $hash) or die;
-            waitpid($pid, 0) or die;
-            if ($? != 0) {
-                print STDERR "failed to fetch $url: $?\n";
-                next;
-            }
-            <$fh>; my $storePath2 = <$fh>; chomp $storePath2;
-            if ($storePath ne $storePath2) {
-                warn "strange: $storePath != $storePath2\n";
-                next;
-            }
-        }
-
-        uploadFile($storePath, $url);
-        $mirrored++;
    }

    print STDERR "mirrored $mirrored files, already have $have files\n";
--- a/maintainers/scripts/find-tarballs.nix
+++ b/maintainers/scripts/find-tarballs.nix
@ -9,12 +9,12 @@ let

  root = expr;

-  uniqueUrls = map (x: x.file) (genericClosure {
-    startSet = map (file: { key = file.url; inherit file; }) urls;
+  uniqueFiles = map (x: x.file) (genericClosure {
+    startSet = map (file: { key = with file; (if type == null then "" else type + "+") + hash; inherit file; }) files;
    operator = const [ ];
  });

-  urls = map (drv: { url = head (drv.urls or [ drv.url ]); hash = drv.outputHash; isPatch = (drv?postFetch && drv.postFetch != ""); type = drv.outputHashAlgo; name = drv.name; }) fetchurlDependencies;
+  files = map (drv: { urls = drv.urls or [ drv.url ]; hash = drv.outputHash; isPatch = (drv?postFetch && drv.postFetch != ""); type = drv.outputHashAlgo; name = drv.name; }) fetchurlDependencies;

  fetchurlDependencies =
    filter
@ -47,4 +47,4 @@ let

  canEval = val: (builtins.tryEval val).success;

-in uniqueUrls
+in uniqueFiles
--- a/nixos/doc/manual/development/option-types.section.md
+++ b/nixos/doc/manual/development/option-types.section.md
@ -99,6 +99,10 @@ merging is handled.
    problems.
    :::

+`types.pkgs`
+
+:   A type for the top level Nixpkgs package set.
+
 ### Numeric types {#sec-option-types-numeric}

 `types.int`
--- a/nixos/lib/eval-config.nix
+++ b/nixos/lib/eval-config.nix
@ -38,6 +38,8 @@ let pkgs_ = pkgs;
 in

 let
+  inherit (lib) optional;
+
  evalModulesMinimal = (import ./default.nix {
    inherit lib;
    # Implicit use of feature is noted in implementation.
@ -47,15 +49,19 @@ let
  pkgsModule = rec {
    _file = ./eval-config.nix;
    key = _file;
-    config = {
-      # Explicit `nixpkgs.system` or `nixpkgs.localSystem` should override
-      # this.  Since the latter defaults to the former, the former should
-      # default to the argument. That way this new default could propagate all
-      # they way through, but has the last priority behind everything else.
-      nixpkgs.system = lib.mkIf (system != null) (lib.mkDefault system);
-
-      _module.args.pkgs = lib.mkIf (pkgs_ != null) (lib.mkForce pkgs_);
-    };
+    config = lib.mkMerge (
+      (optional (system != null) {
+        # Explicit `nixpkgs.system` or `nixpkgs.localSystem` should override
+        # this.  Since the latter defaults to the former, the former should
+        # default to the argument. That way this new default could propagate all
+        # they way through, but has the last priority behind everything else.
+        nixpkgs.system = lib.mkDefault system;
+      })
+      ++
+      (optional (pkgs_ != null) {
+        _module.args.pkgs = lib.mkForce pkgs_;
+      })
+    );
  };

  withWarnings = x:
--- a/nixos/lib/testing/nodes.nix
+++ b/nixos/lib/testing/nodes.nix
@ -1,13 +1,22 @@
 testModuleArgs@{ config, lib, hostPkgs, nodes, ... }:

 let
-  inherit (lib) mkOption mkForce optional types mapAttrs mkDefault mdDoc;
-
-  system = hostPkgs.stdenv.hostPlatform.system;
+  inherit (lib)
+    literalExpression
+    literalMD
+    mapAttrs
+    mdDoc
+    mkDefault
+    mkIf
+    mkOption mkForce
+    optional
+    optionalAttrs
+    types
+    ;

  baseOS =
    import ../eval-config.nix {
-      inherit system;
+      system = null; # use modularly defined system
      inherit (config.node) specialArgs;
      modules = [ config.defaults ];
      baseModules = (import ../../modules/module-list.nix) ++
@ -17,11 +26,17 @@ let
          ({ config, ... }:
            {
              virtualisation.qemu.package = testModuleArgs.config.qemu.package;
-
+            })
+          (optionalAttrs (!config.node.pkgsReadOnly) {
+            key = "nodes.nix-pkgs";
+            config = {
              # Ensure we do not use aliases. Ideally this is only set
              # when the test framework is used by Nixpkgs NixOS tests.
              nixpkgs.config.allowAliases = false;
-            })
+              # TODO: switch to nixpkgs.hostPlatform and make sure containers-imperative test still evaluates.
+              nixpkgs.system = hostPkgs.stdenv.hostPlatform.system;
+            };
+          })
          testModuleArgs.config.extraBaseModules
        ];
    };
@ -68,6 +83,30 @@ in
      default = { };
    };

+    node.pkgs = mkOption {
+      description = mdDoc ''
+        The Nixpkgs to use for the nodes.
+
+        Setting this will make the `nixpkgs.*` options read-only, to avoid mistakenly testing with a Nixpkgs configuration that diverges from regular use.
+      '';
+      type = types.nullOr types.pkgs;
+      default = null;
+      defaultText = literalMD ''
+        `null`, so construct `pkgs` according to the `nixpkgs.*` options as usual.
+      '';
+    };
+
+    node.pkgsReadOnly = mkOption {
+      description = mdDoc ''
+        Whether to make the `nixpkgs.*` options read-only. This is only relevant when [`node.pkgs`](#test-opt-node.pkgs) is set.
+
+        Set this to `false` when any of the [`nodes`](#test-opt-nodes) needs to configure any of the `nixpkgs.*` options. This will slow down evaluation of your test a bit.
+      '';
+      type = types.bool;
+      default = config.node.pkgs != null;
+      defaultText = literalExpression ''node.pkgs != null'';
+    };
+
    node.specialArgs = mkOption {
      type = types.lazyAttrsOf types.raw;
      default = { };
@ -100,5 +139,11 @@ in
        config.nodes;

    passthru.nodes = config.nodesCompat;
+
+    defaults = mkIf config.node.pkgsReadOnly {
+      nixpkgs.pkgs = config.node.pkgs;
+      imports = [ ../../modules/misc/nixpkgs/read-only.nix ];
+    };
+
  };
 }
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@ -49,10 +49,10 @@ let
    merge = lib.mergeOneOption;
  };

-  pkgsType = mkOptionType {
-    name = "nixpkgs";
+  pkgsType = types.pkgs // {
+    # This type is only used by itself, so let's elaborate the description a bit
+    # for the purpose of documentation.
    description = "An evaluation of Nixpkgs; the top level attribute set of packages";
-    check = builtins.isAttrs;
  };

  # Whether `pkgs` was constructed by this module - not if nixpkgs.pkgs or
--- a/nixos/modules/misc/nixpkgs/read-only.nix
+++ b/nixos/modules/misc/nixpkgs/read-only.nix
@ -0,0 +1,74 @@
+# A replacement for the traditional nixpkgs module, such that none of the modules
+# can add their own configuration. This ensures that the Nixpkgs configuration is
+# exactly as the user intends.
+# This may also be used as a performance optimization when evaluating multiple
+# configurations at once, with a shared `pkgs`.
+
+# This is a separate module, because merging this logic into the nixpkgs module
+# is too burdensome, considering that it is already burdened with legacy.
+# Moving this logic into a module does not lose any composition benefits, because
+# its purpose is not something that composes anyway.
+
+{ lib, config, ... }:
+
+let
+  cfg = config.nixpkgs;
+  inherit (lib) mkOption types;
+
+in
+{
+  disabledModules = [
+    ../nixpkgs.nix
+  ];
+  options = {
+    nixpkgs = {
+      pkgs = mkOption {
+        type = lib.types.pkgs;
+        description = lib.mdDoc ''The pkgs module argument.'';
+      };
+      config = mkOption {
+        internal = true;
+        type = types.unique { message = "nixpkgs.config is set to read-only"; } types.anything;
+        description = lib.mdDoc ''
+          The Nixpkgs `config` that `pkgs` was initialized with.
+        '';
+      };
+      overlays = mkOption {
+        internal = true;
+        type = types.unique { message = "nixpkgs.overlays is set to read-only"; } types.anything;
+        description = lib.mdDoc ''
+          The Nixpkgs overlays that `pkgs` was initialized with.
+        '';
+      };
+      hostPlatform = mkOption {
+        internal = true;
+        readOnly = true;
+        description = lib.mdDoc ''
+          The platform of the machine that is running the NixOS configuration.
+        '';
+      };
+      buildPlatform = mkOption {
+        internal = true;
+        readOnly = true;
+        description = lib.mdDoc ''
+          The platform of the machine that built the NixOS configuration.
+        '';
+      };
+      # NOTE: do not add the legacy options such as localSystem here. Let's keep
+      #       this module simple and let module authors upgrade their code instead.
+    };
+  };
+  config = {
+    _module.args.pkgs =
+      # find mistaken definitions
+      builtins.seq cfg.config
+      builtins.seq cfg.overlays
+      builtins.seq cfg.hostPlatform
+      builtins.seq cfg.buildPlatform
+      cfg.pkgs;
+    nixpkgs.config = cfg.pkgs.config;
+    nixpkgs.overlays = cfg.pkgs.overlays;
+    nixpkgs.hostPlatform = cfg.pkgs.stdenv.hostPlatform;
+    nixpkgs.buildPlatform = cfg.pkgs.stdenv.buildPlatform;
+  };
+}
--- a/nixos/modules/misc/nixpkgs/test.nix
+++ b/nixos/modules/misc/nixpkgs/test.nix
@ -1,3 +1,5 @@
+# [nixpkgs]$ nix-build -A nixosTests.nixpkgs --show-trace
+
 { evalMinimalConfig, pkgs, lib, stdenv }:
 let
  eval = mod: evalMinimalConfig {
@ -27,6 +29,47 @@ let
    let
      uncheckedEval = lib.evalModules { modules = [ ../nixpkgs.nix module ]; };
    in map (ass: ass.message) (lib.filter (ass: !ass.assertion) uncheckedEval.config.assertions);
+
+  readOnlyUndefined = evalMinimalConfig {
+    imports = [ ./read-only.nix ];
+  };
+
+  readOnlyBad = evalMinimalConfig {
+    imports = [ ./read-only.nix ];
+    nixpkgs.pkgs = { };
+  };
+
+  readOnly = evalMinimalConfig {
+    imports = [ ./read-only.nix ];
+    nixpkgs.pkgs = pkgs;
+  };
+
+  readOnlyBadConfig = evalMinimalConfig {
+    imports = [ ./read-only.nix ];
+    nixpkgs.pkgs = pkgs;
+    nixpkgs.config.allowUnfree = true; # do in pkgs instead!
+  };
+
+  readOnlyBadOverlays = evalMinimalConfig {
+    imports = [ ./read-only.nix ];
+    nixpkgs.pkgs = pkgs;
+    nixpkgs.overlays = [ (_: _: {}) ]; # do in pkgs instead!
+  };
+
+  readOnlyBadHostPlatform = evalMinimalConfig {
+    imports = [ ./read-only.nix ];
+    nixpkgs.pkgs = pkgs;
+    nixpkgs.hostPlatform = "foo-linux"; # do in pkgs instead!
+  };
+
+  readOnlyBadBuildPlatform = evalMinimalConfig {
+    imports = [ ./read-only.nix ];
+    nixpkgs.pkgs = pkgs;
+    nixpkgs.buildPlatform = "foo-linux"; # do in pkgs instead!
+  };
+
+  throws = x: ! (builtins.tryEval x).success;
+
 in
 lib.recurseIntoAttrs {
  invokeNixpkgsSimple =
@ -65,5 +108,21 @@ lib.recurseIntoAttrs {
        nixpkgs.pkgs = pkgs;
      } == [];

+
+    # Tests for the read-only.nix module
+    assert readOnly._module.args.pkgs.stdenv.hostPlatform.system == pkgs.stdenv.hostPlatform.system;
+    assert throws readOnlyBad._module.args.pkgs.stdenv;
+    assert throws readOnlyUndefined._module.args.pkgs.stdenv;
+    assert throws readOnlyBadConfig._module.args.pkgs.stdenv;
+    assert throws readOnlyBadOverlays._module.args.pkgs.stdenv;
+    assert throws readOnlyBadHostPlatform._module.args.pkgs.stdenv;
+    assert throws readOnlyBadBuildPlatform._module.args.pkgs.stdenv;
+    # read-only.nix does not provide legacy options, for the sake of simplicity
+    # If you're bothered by this, upgrade your configs to use the new *Platform
+    # options.
+    assert !readOnly.options.nixpkgs?system;
+    assert !readOnly.options.nixpkgs?localSystem;
+    assert !readOnly.options.nixpkgs?crossSystem;
+
    pkgs.emptyFile;
 }
--- a/nixos/modules/services/backup/automysqlbackup.nix
+++ b/nixos/modules/services/backup/automysqlbackup.nix
@ -3,7 +3,7 @@
 let

  inherit (lib) concatMapStringsSep concatStringsSep isInt isList literalExpression;
-  inherit (lib) mapAttrs mapAttrsToList mkDefault mkEnableOption mkIf mkOption optional types;
+  inherit (lib) mapAttrs mapAttrsToList mkDefault mkEnableOption mkIf mkOption mkRenamedOptionModule optional types;

  cfg = config.services.automysqlbackup;
  pkg = pkgs.automysqlbackup;
@ -26,6 +26,10 @@ let

 in
 {
+  imports = [
+    (mkRenamedOptionModule [ "services" "automysqlbackup" "config" ] [ "services" "automysqlbackup" "settings" ])
+  ];
+
  # interface
  options = {
    services.automysqlbackup = {
@ -40,7 +44,7 @@ in
        '';
      };

-      config = mkOption {
+      settings = mkOption {
        type = with types; attrsOf (oneOf [ str int bool (listOf str) ]);
        default = {};
        description = lib.mdDoc ''
@ -112,7 +116,18 @@ in

    services.mysql.ensureUsers = optional (config.services.mysql.enable && cfg.config.mysql_dump_host == "localhost") {
      name = user;
-      ensurePermissions = { "*.*" = "SELECT, SHOW VIEW, TRIGGER, LOCK TABLES, EVENT"; };
+      ensurePermissions = {
+        "*.*" = "SELECT, SHOW VIEW, TRIGGER, LOCK TABLES, EVENT";
+
+        # https://forums.mysql.com/read.php?10,668311,668315#msg-668315
+        "function sys.extract_table_from_file_name" = "execute";
+        "function sys.format_path" = "execute";
+        "function sys.format_statement" = "execute";
+        "function sys.extract_schema_from_file_name" = "execute";
+        "function sys.ps_thread_account" = "execute";
+        "function sys.format_time" = "execute";
+        "function sys.format_bytes" = "execute";
+      };
    };

  };
--- a/nixos/modules/services/logging/vector.nix
+++ b/nixos/modules/services/logging/vector.nix
@ -8,6 +8,8 @@ in
  options.services.vector = {
    enable = mkEnableOption (lib.mdDoc "Vector");

+    package = mkPackageOptionMD pkgs "vector" { };
+
    journaldAccess = mkOption {
      type = types.bool;
      default = false;
@ -47,7 +49,7 @@ in
            '';
        in
        {
-          ExecStart = "${pkgs.vector}/bin/vector --config ${validateConfig conf}";
+          ExecStart = "${getExe cfg.package} --config ${validateConfig conf}";
          DynamicUser = true;
          Restart = "no";
          StateDirectory = "vector";
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@ -365,9 +365,6 @@ in
                "hmac-sha2-512-etm@openssh.com"
                "hmac-sha2-256-etm@openssh.com"
                "umac-128-etm@openssh.com"
-                "hmac-sha2-512"
-                "hmac-sha2-256"
-                "umac-128@openssh.com"
              ];
              description = lib.mdDoc ''
                Allowed MACs
--- a/nixos/modules/virtualisation/rosetta.nix
+++ b/nixos/modules/virtualisation/rosetta.nix
@ -50,11 +50,19 @@ in
      }
    ];

-    fileSystems."${cfg.mountPoint}" =  {
+    fileSystems."${cfg.mountPoint}" = {
      device = cfg.mountTag;
      fsType = "virtiofs";
    };

+
+    nix.settings = {
+      extra-platforms = [ "x86_64-linux" ];
+      extra-sandbox-paths =  [
+        "/run/binfmt"
+        cfg.mountPoint
+      ];
+    };
    boot.binfmt.registrations.rosetta = {
      interpreter = "${cfg.mountPoint}/rosetta";

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -46,7 +46,7 @@ let
  inherit
    (rec {
      doRunTest = arg: ((import ../lib/testing-python.nix { inherit system pkgs; }).evalTest {
-        imports = [ arg ];
+        imports = [ arg readOnlyPkgs ];
      }).config.result;
      findTests = tree:
        if tree?recurseForDerivations && tree.recurseForDerivations
@ -65,6 +65,23 @@ let
    runTestOn
    ;

+  # Using a single instance of nixpkgs makes test evaluation faster.
+  # To make sure we don't accidentally depend on a modified pkgs, we make the
+  # related options read-only. We need to test the right configuration.
+  #
+  # If your service depends on a nixpkgs setting, first try to avoid that, but
+  # otherwise, you can remove the readOnlyPkgs import and test your service as
+  # usual.
+  readOnlyPkgs =
+    # TODO: We currently accept this for nixosTests, so that the `pkgs` argument
+    #       is consistent with `pkgs` in `pkgs.nixosTests`. Can we reinitialize
+    #       it with `allowAliases = false`?
+    # warnIf pkgs.config.allowAliases "nixosTests: pkgs includes aliases."
+    {
+      _class = "nixosTest";
+      node.pkgs = pkgs;
+    };
+
 in {

  # Testing the test driver
@ -267,7 +284,7 @@ in {
  gitdaemon = handleTest ./gitdaemon.nix {};
  gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; };
  github-runner = handleTest ./github-runner.nix {};
-  gitlab = handleTest ./gitlab.nix {};
+  gitlab = runTest ./gitlab.nix;
  gitolite = handleTest ./gitolite.nix {};
  gitolite-fcgiwrap = handleTest ./gitolite-fcgiwrap.nix {};
  glusterfs = handleTest ./glusterfs.nix {};
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@ -6,7 +6,10 @@
 # - Creating Merge Requests and merging them
 # - Opening and closing issues.
 # - Downloading repository archives as tar.gz and tar.bz2
-import ./make-test-python.nix ({ pkgs, lib, ... }:
+# Run with
+# [nixpkgs]$ nix-build -A nixosTests.gitlab
+
+{ pkgs, lib, ... }:

 with lib;

@ -174,7 +177,7 @@ in {
        gitlab.wait_for_unit("gitlab.service")
        gitlab.wait_for_unit("gitlab-pages.service")
        gitlab.wait_for_unit("gitlab-sidekiq.service")
-        gitlab.wait_for_file("${nodes.gitlab.config.services.gitlab.statePath}/tmp/sockets/gitlab.socket")
+        gitlab.wait_for_file("${nodes.gitlab.services.gitlab.statePath}/tmp/sockets/gitlab.socket")
        gitlab.wait_until_succeeds("curl -sSf http://gitlab/users/sign_in")
      '';

@ -419,15 +422,15 @@ in {
    + ''
      gitlab.systemctl("start gitlab-backup.service")
      gitlab.wait_for_unit("gitlab-backup.service")
-      gitlab.wait_for_file("${nodes.gitlab.config.services.gitlab.statePath}/backup/dump_gitlab_backup.tar")
+      gitlab.wait_for_file("${nodes.gitlab.services.gitlab.statePath}/backup/dump_gitlab_backup.tar")
      gitlab.systemctl("stop postgresql.service gitlab.target")
      gitlab.succeed(
-          "find ${nodes.gitlab.config.services.gitlab.statePath} -mindepth 1 -maxdepth 1 -not -name backup -execdir rm -r {} +"
+          "find ${nodes.gitlab.services.gitlab.statePath} -mindepth 1 -maxdepth 1 -not -name backup -execdir rm -r {} +"
      )
      gitlab.succeed("systemd-tmpfiles --create")
-      gitlab.succeed("rm -rf ${nodes.gitlab.config.services.postgresql.dataDir}")
+      gitlab.succeed("rm -rf ${nodes.gitlab.services.postgresql.dataDir}")
      gitlab.systemctl("start gitlab-config.service gitaly.service gitlab-postgresql.service")
-      gitlab.wait_for_file("${nodes.gitlab.config.services.gitlab.statePath}/tmp/sockets/gitaly.socket")
+      gitlab.wait_for_file("${nodes.gitlab.services.gitlab.statePath}/tmp/sockets/gitaly.socket")
      gitlab.succeed(
          "sudo -u gitlab -H gitlab-rake gitlab:backup:restore RAILS_ENV=production BACKUP=dump force=yes"
      )
@ -435,4 +438,4 @@ in {
    ''
    + waitForServices
    + test false;
-})
+}
--- a/nixos/tests/harmonia.nix
+++ b/nixos/tests/harmonia.nix
@ -8,6 +8,7 @@
      services.harmonia = {
        enable = true;
        signKeyPath = pkgs.writeText "cache-key" "cache.example.com-1:9FhO0w+7HjZrhvmzT1VlAZw4OSAlFGTgC24Seg3tmPl4gZBdwZClzTTHr9cVzJpwsRSYLTu7hEAQe3ljy92CWg==";
+        settings.priority = 35;
      };

      networking.firewall.allowedTCPPorts = [ 5000 ];
@ -26,7 +27,8 @@
    start_all()

    harmonia.wait_for_unit("harmonia.service")
-    client01.wait_until_succeeds("curl -f http://harmonia:5000/nix-cache-info")
+
+    client01.wait_until_succeeds("curl -f http://harmonia:5000/nix-cache-info | grep '${toString nodes.harmonia.services.harmonia.settings.priority}' >&2")
    client01.succeed("curl -f http://harmonia:5000/version | grep '${nodes.harmonia.services.harmonia.package.version}' >&2")

    client01.succeed("cat /etc/nix/nix.conf >&2")
--- a/nixos/tests/mysql/mysql-replication.nix
+++ b/nixos/tests/mysql/mysql-replication.nix
@ -42,7 +42,7 @@ let
          enable = true;
          replication.role = "slave";
          replication.serverId = 2;
-          replication.masterHost = nodes.primary.config.networking.hostName;
+          replication.masterHost = nodes.primary.networking.hostName;
          replication.masterUser = replicateUser;
          replication.masterPassword = replicatePassword;
        };
@ -54,7 +54,7 @@ let
          enable = true;
          replication.role = "slave";
          replication.serverId = 3;
-          replication.masterHost = nodes.primary.config.networking.hostName;
+          replication.masterHost = nodes.primary.networking.hostName;
          replication.masterUser = replicateUser;
          replication.masterPassword = replicatePassword;
        };
--- a/nixos/tests/vector.nix
+++ b/nixos/tests/vector.nix
@ -31,7 +31,7 @@ with pkgs.lib;
    # ensure vector is forwarding the messages appropriately
    testScript = ''
      machine.wait_for_unit("vector.service")
-      machine.succeed("test -f /var/lib/vector/logs.log")
+      machine.wait_for_file("/var/lib/vector/logs.log")
    '';
  };
 }
--- a/pkgs/applications/audio/audacious/plugins.nix
+++ b/pkgs/applications/audio/audacious/plugins.nix
@ -46,11 +46,11 @@

 stdenv.mkDerivation rec {
  pname = "audacious-plugins";
-  version = "4.3";
+  version = "4.3.1";

  src = fetchurl {
    url = "http://distfiles.audacious-media-player.org/audacious-plugins-${version}.tar.bz2";
-    sha256 = "sha256-Zi72yMS9cNDzX9HF8IuRVJuUNmOLZfihozlWsJ34n8Y=";
+    sha256 = "sha256-Leom469YOi1oTfJAsnsrKTK81lPfTbUAqF9P5dX9yKY=";
  };

  patches = [ ./0001-Set-plugindir-to-PREFIX-lib-audacious.patch ];
--- a/pkgs/applications/audio/cyanrip/default.nix
+++ b/pkgs/applications/audio/cyanrip/default.nix
@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "cyanrip";
-  version = "0.8.1";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "cyanreg";
    repo = pname;
    rev = "v${version}";
-    sha256 = "17bi2xhjv3f3i870whkyqckvjlg32wqkspash87zi0jw7m7jm229";
+    sha256 = "sha256-gH/rWTRYX10Q2Y9oSaMu0bOy3SMbcSNmH3dkXHFAw90";
  };

  nativeBuildInputs = [ meson ninja pkg-config ];
--- a/pkgs/applications/maui/mauikit-imagetools.nix
+++ b/pkgs/applications/maui/mauikit-imagetools.nix
@ -1,5 +1,6 @@
 { lib
 , mkDerivation
+, fetchpatch
 , cmake
 , extra-cmake-modules
 , kconfig
@ -16,6 +17,14 @@
 mkDerivation {
  pname = "mauikit-imagetools";

+  patches = [
+    (fetchpatch {
+      name = "remove-unused-method.patch";
+      url = "https://invent.kde.org/maui/mauikit-imagetools/-/commit/344852044d407b144bca01c41a409ceaa548bec0.patch";
+      hash = "sha256-Cpq/XzDgrKD8YVex2z9VxGTA+iDI5703+fHwkn0cIWA=";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    extra-cmake-modules
--- a/pkgs/applications/misc/blender/wrapper.nix
+++ b/pkgs/applications/misc/blender/wrapper.nix
@ -2,7 +2,7 @@
 , lib
 , blender
 , makeWrapper
-, python39Packages
+, python3Packages
 }:
 { name ? "wrapped"
 , packages ? []
@ -12,7 +12,7 @@ stdenv.mkDerivation {
  inherit (blender) version;
  src = blender;

-  nativeBuildInputs = [ python39Packages.wrapPython makeWrapper ];
+  nativeBuildInputs = [ python3Packages.wrapPython makeWrapper ];
  installPhase = ''
    mkdir $out/{share/applications,bin} -p
    sed 's/Exec=blender/Exec=blender-${name}/g' $src/share/applications/blender.desktop > $out/share/applications/blender-${name}.desktop
@ -22,15 +22,9 @@ stdenv.mkDerivation {

    buildPythonPath "$pythonPath"

-    echo '#!/usr/bin/env bash ' >> $out/bin/blender-${name}
-    for p in $program_PATH; do
-      echo "export PATH=\$PATH:$p " >> $out/bin/blender-${name}
-    done
-    for p in $program_PYTHONPATH; do
-      echo "export PYTHONPATH=\$PYTHONPATH:$p " >> $out/bin/blender-${name}
-    done
-    echo 'exec ${blender}/bin/blender "$@"' >> $out/bin/blender-${name}
-    chmod +x $out/bin/blender-${name}
+    makeWrapper ${blender}/bin/blender $out/bin/blender-${name} \
+      --prefix PATH : $program_PATH \
+      --prefix PYTHONPATH : $program_PYTHONPATH
  '';

  pythonPath = packages;
--- a/pkgs/applications/misc/houdini/default.nix
+++ b/pkgs/applications/misc/houdini/default.nix
@ -3,12 +3,59 @@
 buildFHSEnv rec {
  name = "houdini-${unwrapped.version}";

+  # houdini spawns hserver (and other license tools) that is supposed to live beyond the lifespan of houdini process
+  dieWithParent = false;
+
+  # houdini needs to communicate with hserver process that it seem to be checking to be present in running processes
+  unsharePid = false;
+
  targetPkgs = pkgs: with pkgs; [
-    libGLU libGL alsa-lib fontconfig zlib libpng dbus nss nspr expat pciutils
-    libxkbcommon libudev0-shim tbb
+    libGLU
+    libGL
+    alsa-lib
+    fontconfig
+    zlib
+    libpng
+    dbus
+    nss
+    nspr
+    expat
+    pciutils
+    libxkbcommon
+    libudev0-shim
+    tbb
+    xwayland
+    qt5.qtwayland
+    nettools  # needed by licensing tools
+    bintools  # needed for ld and other tools, so ctypes can find/load sos from python
+    ocl-icd  # needed for opencl
+    numactl  # needed by hfs ocl backend
+    ncurses5  # needed by hfs ocl backend
  ] ++ (with xorg; [
-    libICE libSM libXmu libXi libXext libX11 libXrender libXcursor libXfixes
-    libXrender libXcomposite libXdamage libXtst libxcb libXScrnSaver
+    libICE
+    libSM
+    libXmu
+    libXi
+    libXt
+    libXext
+    libX11
+    libXrender
+    libXcursor
+    libXfixes
+    libXrender
+    libXcomposite
+    libXdamage
+    libXtst
+    libxcb
+    libXScrnSaver
+    libXrandr
+    libxcb
+    xcbutil
+    xcbutilimage
+    xcbutilrenderutil
+    xcbutilcursor
+    xcbutilkeysyms
+    xcbutilwm
  ]);

  passthru = {
@ -16,7 +63,16 @@ buildFHSEnv rec {
  };

  extraInstallCommands = let
-    executables = [ "bin/houdini" "bin/hkey" "houdini/sbin/sesinetd" ];
+    executables = [
+      "bin/houdini"  # houdini flavours
+      "bin/houdinicore"
+      "bin/houdinifx"
+      "bin/hgpuinfo"  # houdini ocl config tool
+      "bin/hotl"  # hda/otl manipulation tool
+      "bin/hython"  # hython
+      "bin/hkey"  # license administration
+      "houdini/sbin/sesinetd"
+    ];
  in ''
    WRAPPER=$out/bin/${name}
    EXECUTABLES="${lib.concatStringsSep " " executables}"
@ -31,6 +87,11 @@ buildFHSEnv rec {
    chmod +x $EXECUTABLES
  '';

+  extraBwrapArgs = [
+    "--ro-bind-try /run/opengl-driver/etc/OpenCL/vendors /etc/OpenCL/vendors"  # this is the case of NixOS
+    "--ro-bind-try /etc/OpenCL/vendors /etc/OpenCL/vendors"  # this is the case of not NixOS
+  ];
+
  runScript = writeScript "${name}-wrapper" ''
    exec $@
  '';
--- a/pkgs/applications/misc/houdini/runtime.nix
+++ b/pkgs/applications/misc/houdini/runtime.nix
@ -4,11 +4,11 @@ let
  license_dir = "~/.config/houdini";
 in
 stdenv.mkDerivation rec {
-  version = "18.5.596";
+  version = "19.5.569";
  pname = "houdini-runtime";
  src = requireFile rec {
-    name = "houdini-py3-${version}-linux_x86_64_gcc6.3.tar.gz";
-    sha256 = "1b1k7rkn7svmciijqdwvi9p00srsf81vkb55grjg6xa7fgyidjx1";
+    name = "houdini-${version}-linux_x86_64_gcc9.3.tar.gz";
+    sha256 = "0c2d6a31c24f5e7229498af6c3a7cdf81242501d7a0792e4c33b53a898d4999e";
    url = meta.homepage;
  };

@ -22,9 +22,9 @@ stdenv.mkDerivation rec {
                      --no-install-bin-symlink \
                      --auto-install \
                      --no-root-check \
-                      --accept-EULA 2020-05-05 \
+                      --accept-EULA 2021-10-13 \
                      $out
-    echo "licensingMode = localValidator" >> $out/houdini/Licensing.opt
+    echo "licensingMode = localValidator" >> $out/houdini/Licensing.opt  # does not seem to do anything any more. not sure, official docs do not say anything about it
  '';

  dontFixup = true;
--- a/pkgs/applications/misc/megacmd/default.nix
+++ b/pkgs/applications/misc/megacmd/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "megacmd";
-  version = "1.6.1";
+  version = "1.6.3";

  src = fetchFromGitHub {
    owner = "meganz";
    repo = "MEGAcmd";
    rev = "${version}_Linux";
-    sha256 = "sha256-X8ysTVr4oZS3VHuCyq96J6TL9nvtAT/HVnMyz5iXSXo=";
+    sha256 = "sha256-JnxfFbM+NyeUrEMok62zlsQIxjrUvLLg4tUTiKPDZFc=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@ -3,7 +3,7 @@
 }:

 let
-  dropDevOutput = { outputs, ... }: {
+  dropDocOutput = { outputs, ... }: {
    outputs = lib.filter (x: x != "doc") outputs;
  };

@ -119,7 +119,7 @@ let
      flask-babel = (super.flask-babel.override {
        sphinxHook = null;
        furo = null;
-      }).overridePythonAttrs (old: (dropDevOutput old) // rec {
+      }).overridePythonAttrs (old: (dropDocOutput old) // rec {
        pname = "Flask-Babel";
        version = "2.0.0";
        format = "setuptools";
@ -128,21 +128,29 @@ let
          inherit version;
          hash = "sha256:f9faf45cdb2e1a32ea2ec14403587d4295108f35017a7821a2b1acb8cfd9257d";
        };
+        disabledTests = [
+          # AssertionError: assert 'Apr 12, 2010...46:00\u202fPM' == 'Apr 12, 2010, 1:46:00 PM'
+          # Note the `\u202f` (narrow, no-break space) vs space.
+          "test_basics"
+          "test_init_app"
+          "test_custom_locale_selector"
+          "test_refreshing"
+        ];
      });
      psycopg2 = (super.psycopg2.override {
        sphinxHook = null;
        sphinx-better-theme = null;
-      }).overridePythonAttrs dropDevOutput;
+      }).overridePythonAttrs dropDocOutput;
      hypothesis = super.hypothesis.override {
        enableDocumentation = false;
      };
      pyjwt = (super.pyjwt.override {
        sphinxHook = null;
        sphinx-rtd-theme = null;
-      }).overridePythonAttrs (old: (dropDevOutput old) // { format = "setuptools"; });
+      }).overridePythonAttrs (old: (dropDocOutput old) // { format = "setuptools"; });
      beautifulsoup4 = (super.beautifulsoup4.override {
        sphinxHook = null;
-      }).overridePythonAttrs dropDevOutput;
+      }).overridePythonAttrs dropDocOutput;
      pydash = (super.pydash.override {
        sphinx-rtd-theme = null;
      }).overridePythonAttrs (old: rec {
@ -155,6 +163,10 @@ let
        format = "setuptools";
        doCheck = false;
      });
+      pyopenssl = (super.pyopenssl.override {
+        sphinxHook = null;
+        sphinx-rtd-theme = null;
+      }).overridePythonAttrs dropDocOutput;
    };
  };
 in
@ -170,6 +182,14 @@ python3'.pkgs.buildPythonPackage rec {
    fetchSubmodules = true;
  };

+  patches = [
+    # https://github.com/privacyidea/privacyidea/pull/3611
+    (fetchpatch {
+      url = "https://github.com/privacyidea/privacyidea/commit/7db6509721726a34e8528437ddbd4210019b11ef.patch";
+      sha256 = "sha256-ZvtauCs1vWyxzGbA0B2+gG8q5JyUO8DF8nm/3/vcYmE=";
+    })
+  ];
+
  propagatedBuildInputs = with python3'.pkgs; [
    cryptography pyrad pymysql python-dateutil flask-versioned flask_script
    defusedxml croniter flask_migrate pyjwt configobj sqlsoup pillow
--- a/pkgs/applications/misc/swaynotificationcenter/default.nix
+++ b/pkgs/applications/misc/swaynotificationcenter/default.nix
@ -83,6 +83,7 @@ stdenv.mkDerivation (finalAttrs: rec {
    changelog = "https://github.com/ErikReider/SwayNotificationCenter/releases/tag/v${version}";
    license = licenses.gpl3;
    platforms = platforms.linux;
+    mainProgram = "swaync";
    maintainers = with maintainers; [ berbiche pedrohlc ];
  };
 })
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -36,6 +36,7 @@
 , curl
 , libffi
 , libepoxy
+, libevdev
 # postPatch:
 , glibc # gconv + locale
 # postFixup:
@ -154,6 +155,8 @@ let
      curl
      libepoxy
      libffi
+    ] ++ lib.optionals (chromiumVersionAtLeast "114") [
+      libevdev
    ] ++ lib.optional systemdSupport systemd
      ++ lib.optionals cupsSupport [ libgcrypt cups ]
      ++ lib.optional pulseSupport libpulseaudio;
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -19,22 +19,22 @@
    }
  },
  "beta": {
-    "version": "113.0.5672.63",
-    "sha256": "07pf28yy5c4xw1xkycgzq53zbj14zvhh00sv601nggisq4fw3kkn",
-    "sha256bin64": "1n1bcim5wfafa3bl9grp3ckmnbi1mzhdxz8pim408wz892da34zl",
+    "version": "114.0.5735.16",
+    "sha256": "1pynbzbc8wwc6g8ikx0hr95ylncpdx97y27c6wmfygwgvp91a6wa",
+    "sha256bin64": "098aclrhifz6cpxcjdaqvi76j3g8r84p3b6cs4fbsj4cmczj4frw",
    "deps": {
      "gn": {
-        "version": "2023-03-18",
+        "version": "2023-04-19",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "41fef642de70ecdcaaa26be96d56a0398f95abd4",
-        "sha256": "12w4g2dl58283allclpi1c4i6ih9v2xvdb9hpbmfda12v8lizmlq"
+        "rev": "5a004f9427a050c6c393c07ddb85cba8ff3849fa",
+        "sha256": "01xrh9m9m6x8lz0vxwdw2mrhrvnw93zpg09hwdhqakj06agf4jjk"
      }
    }
  },
  "dev": {
-    "version": "114.0.5735.6",
-    "sha256": "0wxlfqxrawk77yzm00hb1fbssrycl4mha53wm4y5mlb8warqs5jk",
-    "sha256bin64": "0vlb6zr50kn7i0rfvy3yvwzcffpg5ki7is8i3ck43b1gr1bsmgmb",
+    "version": "115.0.5750.0",
+    "sha256": "1y0yq7k5rcv4lfxdlr4psap4hxcnrwjps6vl42hwvpw6zxscw1lv",
+    "sha256bin64": "0h2d4csrznavalfnzvn59pc2jmj6ci1paslp7y2rlpv1jqjrpgq9",
    "deps": {
      "gn": {
        "version": "2023-04-19",
@ -45,8 +45,8 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "113.0.5672.64",
-    "sha256": "0knw3i37hh874ycjlc8bl68wdhyqhma5pn7alwa6254qr5dkci9h",
+    "version": "113.0.5672.93",
+    "sha256": "1cy33mvhws59d358s30xqs2p9hdb28n37wmv5ihx0d07x30y3azb",
    "sha256bin64": null,
    "deps": {
      "gn": {
@ -56,8 +56,8 @@
        "sha256": "12w4g2dl58283allclpi1c4i6ih9v2xvdb9hpbmfda12v8lizmlq"
      },
      "ungoogled-patches": {
-        "rev": "113.0.5672.64-1",
-        "sha256": "0xvgq6971qvvn0cf4z5wkfabhm7dsx2f68npfl4y2nix7hwfs6lq"
+        "rev": "113.0.5672.93-1",
+        "sha256": "0ffb33k2kgnpswq1f61gzcblvgsw7qazh8yq2kcdwc4k9bd9gr93"
      }
    }
  }
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@ -1,11 +1,11 @@
 {
-  "packageVersion": "112.0.1-2",
+  "packageVersion": "113.0-1",
  "source": {
-    "rev": "112.0.1-2",
-    "sha256": "1pm4ilc2zx6qx3qqjl7ypl51mcfwq22abi850kq7l3pznb2z0ljw"
+    "rev": "113.0-1",
+    "sha256": "0cqb9lphaqvmf443ha6fhd8q7qyy09bsg923rq8jy8cjmhkq2n6i"
  },
  "firefox": {
-    "version": "112.0.1",
-    "sha512": "23a5cd9c1f165275d8ca7465bebce86018441c72292421f4ed56d7ad8ada9402dc8d22a08467d9d0ef3ef8c62338006dfa3bcbddf12cb8a59eafa0bd7d0cda50"
+    "version": "113.0",
+    "sha512": "96b0f0774083270f4fcce06085b177ced25ba05da7291d777f1da1d5bbad30721bc6363b76e06ccb64fc092778c8326a426a8bfdfa3cbaafd4f1169b924744a5"
  }
 }
--- a/pkgs/applications/networking/cluster/cmctl/default.nix
+++ b/pkgs/applications/networking/cluster/cmctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "cmctl";
-  version = "1.11.1";
+  version = "1.11.2";

  src = fetchFromGitHub {
    owner = "cert-manager";
    repo = "cert-manager";
-    rev = "e3a2a803e8ed7f8a88d5f535d6e9a061c1571194";
-    sha256 = "0484dh520plgmrv39lbih44z1dz0r3sf115kqvcpfmg13b0328d0";
+    rev = "4767427a40e0e193c976fd6bc228f50de8950572";
+    sha256 = "128s5vd4hp5mr0rnb21grzmijzx0ibpv71as36dcgw7z4v3gq7lx";
  };

-  vendorSha256 = "sha256-tKvvqYGwLEoSfGzBRLx8xC/0Kz1uLmHYQ+gcHOW+550=";
+  vendorSha256 = "sha256-+r0QpD97r6dokUr07Qjb9kvoK+oz2rvml0cIebtYuHg=";

  subPackages = [ "cmd/ctl" ];

--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@ -0,0 +1,26 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubefirst";
+  version = "2.0.8";
+
+  src = fetchFromGitHub {
+    owner = "kubefirst";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-JGseXRUehRuH1kuTfmkAJcfRN3vM0zN7K8pnOfJ0LAs=";
+  };
+
+  vendorHash = "sha256-Sc6HXJXkZ9vW6sxEKCTo6LDHeOGLTz0oN9JH11iUA/k=";
+
+  ldflags = [ "-s" "-w" "-X github.com/kubefirst/runtime/configs.K1Version=v${version}"];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "The Kubefirst CLI creates instant GitOps platforms that integrate some of the best tools in cloud native from scratch.";
+    homepage = "https://github.com/kubefirst/kubefirst/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ qjoly ];
+  };
+}
--- a/pkgs/applications/networking/cluster/temporal-cli/default.nix
+++ b/pkgs/applications/networking/cluster/temporal-cli/default.nix
@ -1,35 +1,85 @@
-{ lib, fetchFromGitHub, buildGoModule, testers, temporal-cli }:
+{ lib, fetchFromGitHub, buildGoModule, installShellFiles, symlinkJoin }:

-buildGoModule rec {
+let
+  tctl-next = buildGoModule rec {
+    pname = "tctl-next";
+    version = "0.8.0";
+
+    src = fetchFromGitHub {
+      owner = "temporalio";
+      repo = "cli";
+      rev = "v${version}";
+      hash = "sha256-yQnFw3uYGKrTevGFVZNgkWwKCCWiGy0qwJJOmnMpTJQ=";
+    };
+
+    vendorHash = "sha256-ld59ADHnlgsCA2mzVhdq6Vb2aa9rApvFxs3NpHiCKxo=";
+
+    nativeBuildInputs = [ installShellFiles ];
+
+    excludedPackages = [ "./cmd/docgen" ];
+
+    ldflags = [
+      "-s"
+      "-w"
+      "-X github.com/temporalio/cli/headers.Version=${version}"
+    ];
+
+    preCheck = ''
+      export HOME=$(mktemp -d)
+    '';
+
+    postInstall = ''
+      installShellCompletion --cmd temporal \
+        --bash <($out/bin/temporal completion bash) \
+        --zsh <($out/bin/temporal completion zsh)
+    '';
+  };
+
+  tctl = buildGoModule rec {
+    pname = "tctl";
+    version = "1.18.0";
+
+    src = fetchFromGitHub {
+      owner = "temporalio";
+      repo = "tctl";
+      rev = "v${version}";
+      hash = "sha256-LcBKkx3mcDOrGT6yJx98CSgxbwskqGPWqOzHWOu6cig=";
+    };
+
+    vendorHash = "sha256-BUYEeC5zli++OxVFgECJGqJkbDwglLppSxgo+4AqOb0=";
+
+    nativeBuildInputs = [ installShellFiles ];
+
+    excludedPackages = [ "./cmd/copyright" ];
+
+    ldflags = [ "-s" "-w" ];
+
+    preCheck = ''
+      export HOME=$(mktemp -d)
+    '';
+
+    postInstall = ''
+      installShellCompletion --cmd tctl \
+        --bash <($out/bin/tctl completion bash) \
+        --zsh <($out/bin/tctl completion zsh)
+    '';
+  };
+in
+symlinkJoin rec {
  pname = "temporal-cli";
-  version = "1.18.0";
+  inherit (tctl) version;
+  name = "${pname}-${version}";

-  src = fetchFromGitHub {
-    owner = "temporalio";
-    repo = "tctl";
-    rev = "v${version}";
-    hash = "sha256-LcBKkx3mcDOrGT6yJx98CSgxbwskqGPWqOzHWOu6cig=";
-  };
-
-  vendorHash = "sha256-BUYEeC5zli++OxVFgECJGqJkbDwglLppSxgo+4AqOb0=";
-
-  ldflags = [ "-s" "-w" ];
-
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
-  passthru.tests.version = testers.testVersion {
-    package = temporal-cli;
-    # the app writes a default config file at startup
-    command = "HOME=$(mktemp -d) ${meta.mainProgram} --version";
-  };
+  paths = [
+    tctl-next
+    tctl
+  ];

  meta = with lib; {
    description = "Temporal CLI";
    homepage = "https://temporal.io";
    license = licenses.mit;
    maintainers = with maintainers; [ aaronjheng ];
-    mainProgram = "tctl";
+    mainProgram = "temporal";
  };
 }
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -28,13 +28,13 @@
    "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
  },
  "aiven": {
-    "hash": "sha256-I8w8hnts3bELUm2e0fRfRcfK9uoS0ZbymZZPEVcizEI=",
+    "hash": "sha256-WBjtrjhv3DBusE64Gu/XXOwaH4ByHoyS6tGcY6VE2iU=",
    "homepage": "https://registry.terraform.io/providers/aiven/aiven",
    "owner": "aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v4.2.1",
+    "rev": "v4.3.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-nF/efMhmrXfBlF9w9tC4npHxjX2/299OfqTpvPapfMo="
+    "vendorHash": "sha256-NnWYUVziSWuedgXG1jXrdYF7il8KmA5MQVlK5AEhc+U="
  },
  "akamai": {
    "hash": "sha256-P/5tLtcPqhf48DqqMKKNCOrvT+I60N9rC1W/4RdFXqY=",
@ -665,13 +665,13 @@
    "vendorHash": "sha256-4jAJf2FC83NdH4t1l7EA26yQ0pqteWmTIyrZDJdi7fg="
  },
  "linode": {
-    "hash": "sha256-Z8mllx/TO0EUQNSOGcUhMRAsV7jiUhybzYDPg2ZtUec=",
+    "hash": "sha256-G6+xplMymxziIVof67ONtVMLAaQc33A0pLscchNi8kc=",
    "homepage": "https://registry.terraform.io/providers/linode/linode",
    "owner": "linode",
    "repo": "terraform-provider-linode",
-    "rev": "v2.0.0",
+    "rev": "v2.1.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Xbnf8ejyojd3JD7h580hlM0PC4nD+sjpodV9hr0/F+c="
+    "vendorHash": "sha256-om6Onp+Go74YfA8J2DALhJy1c+s5GbXYMpUM9a28bdI="
  },
  "linuxbox": {
    "hash": "sha256-MzasMVtXO7ZeZ+qEx2Z+7881fOIA0SFzSvXVHeEROtg=",
@ -810,11 +810,11 @@
    "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
  },
  "oci": {
-    "hash": "sha256-/p/NBw8dPzStLs9LTvvqDUSNJ9oMCG0e4bT+gIsPEGA=",
+    "hash": "sha256-XHHZpl936xZ4jjk71bmlxm1xilqFamdgL3AdkyRBT5Y=",
    "homepage": "https://registry.terraform.io/providers/oracle/oci",
    "owner": "oracle",
    "repo": "terraform-provider-oci",
-    "rev": "v4.119.0",
+    "rev": "v4.120.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1008,11 +1008,11 @@
    "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
  },
  "signalfx": {
-    "hash": "sha256-VvL5lGPNtcjrtpB/p//7UXuUQxjV/+Deb+R3p+V8GtM=",
+    "hash": "sha256-H3+2lyn17FwF/zskVAzz0mYnyPkL2/otqoCkgcVFWf4=",
    "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
    "owner": "splunk-terraform",
    "repo": "terraform-provider-signalfx",
-    "rev": "v6.23.0",
+    "rev": "v6.24.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-0fqIaIINBvTAHVHZP/AcS4hNyjXHM+wfHp/0I7xqRhg="
  },
@ -1235,11 +1235,11 @@
    "vendorHash": "sha256-wKKrBSJkbdqqnDLoS+jhvI26rOzvMWjjsN8wh67Le5U="
  },
  "vultr": {
-    "hash": "sha256-4Um4UyDjtamy2s15K3Idm5edZj5BOy13+kr39wl9e0Q=",
+    "hash": "sha256-h9MQv4BTv9y4A6HSDE3dIV7aKwaIWRYy5EyE2T0mpG4=",
    "homepage": "https://registry.terraform.io/providers/vultr/vultr",
    "owner": "vultr",
    "repo": "terraform-provider-vultr",
-    "rev": "v2.15.0",
+    "rev": "v2.15.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/applications/networking/cluster/tfautomv/default.nix
+++ b/pkgs/applications/networking/cluster/tfautomv/default.nix
@ -0,0 +1,27 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "tfautomv";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "padok-team";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-shpoi/N/gfzisjj1tvZGSEuorqaoOJMhYOjx+Y8F/Ds=";
+  };
+
+  vendorHash = "sha256-BjmtUamecTSwT7gHM/6uz1r/P8O0TWzp9Dk43rdmxXU=";
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/padok-team/tfautomv";
+    description = "When refactoring a Terraform codebase, you often need to write moved blocks. This can be tedious. Let tfautomv do it for you";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ qjoly ];
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@ -1,9 +1,9 @@
 {
-  "version" = "1.11.30";
+  "version" = "1.11.31";
  "hashes" = {
-    "desktopSrcHash" = "WICzS+KARX+Z4vfBqBd13wtNB7m18rsXJsFey/MnST0=";
-    "desktopYarnHash" = "0rm0rghd2piaxhf7jvxs6rd6yykgdm8d2a7rxqc9m9xjklxdf6nj";
-    "webSrcHash" = "5o1DEVtkx4PYYRXYdyjVOlkvbQSc9/an5DshARTJTR4=";
-    "webYarnHash" = "0bg5vc7q8afqfpsaqqkczf9whbzici5d2bxj5cadhrlmlb27f8nx";
+    "desktopSrcHash" = "urCMClvyJx6e0UXDAcZysZvw3Qb6cnPjiy/aR4Uqtzs=";
+    "desktopYarnHash" = "1yrdg7fn533qg6wzg99s2si68nlzgvp9wiyallq0s2b665bznqxj";
+    "webSrcHash" = "eVZ3SaUqM2YQehQNIS5kVQ98HrNwovYsZwHCndCcFa4=";
+    "webYarnHash" = "0xzwvhpvxzslvcybyn3si91fyi6a7xnrgib5dj6v5lcha1xd32w7";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 (if stdenv.isDarwin then darwin.apple_sdk_11_0.clang14Stdenv else stdenv).mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20230508-1";
+  version = "20230510";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-0kkbJGZEnB6bL+aNhHpSI2oHpsVmju3OEFG7mitKBsc=";
+    hash = "sha256-EsFF9fPpHfVmbLm2hRpcJBmwfovfK4CV3LukrG9nP3U=";
  };

  postPatch = ''
--- a/pkgs/applications/office/activitywatch/Cargo.lock
+++ b/pkgs/applications/office/activitywatch/Cargo.lock
--- a/pkgs/applications/office/activitywatch/commit-hash.patch
+++ b/pkgs/applications/office/activitywatch/commit-hash.patch
@ -0,0 +1,16 @@
+diff --git a/vue.config.js b/vue.config.js
+index 02c0699..0c4a014 100644
+--- a/vue.config.js
+++ b/vue.config.js
+@@ -4,10 +4,7 @@ const CopyWebpackPlugin = require('copy-webpack-plugin');
+ const { argv } = require('yargs');
+ 
+ // get git info from command line
+-const _COMMIT_HASH = require('child_process')
+-  .execSync('git rev-parse --short HEAD')
+-  .toString()
+-  .trim();
+const _COMMIT_HASH = "@commit_hash@";
+ console.info('Commit hash:', _COMMIT_HASH);
+ 
+ module.exports = {
--- a/pkgs/applications/office/activitywatch/default.nix
+++ b/pkgs/applications/office/activitywatch/default.nix
@ -0,0 +1,238 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, makeWrapper
+, pkg-config
+, perl
+, openssl
+, python3
+, wrapQtAppsHook
+, qtbase
+, qtsvg
+, xdg-utils
+, substituteAll
+, buildNpmPackage
+}:
+
+let
+  version = "0.12.2";
+  sources = fetchFromGitHub {
+    owner = "ActivityWatch";
+    repo = "activitywatch";
+    rev = "v${version}";
+    sha256 = "sha256-IvRXfxTOSgBVlxy4SVij+POr7KgvXTEjGN3lSozhHkY=";
+    fetchSubmodules = true;
+  };
+in
+rec {
+  aw-watcher-afk = python3.pkgs.buildPythonApplication {
+    pname = "aw-watcher-afk";
+    inherit version;
+
+    format = "pyproject";
+
+    src = "${sources}/aw-watcher-afk";
+
+    nativeBuildInputs = [
+      python3.pkgs.poetry-core
+    ];
+
+    propagatedBuildInputs = with python3.pkgs; [
+      aw-client
+      xlib
+      pynput
+    ];
+
+    pythonImportsCheck = [ "aw_watcher_afk" ];
+
+    meta = with lib; {
+      description = "Watches keyboard and mouse activity to determine if you are AFK or not (for use with ActivityWatch)";
+      homepage = "https://github.com/ActivityWatch/aw-watcher-afk";
+      maintainers = with maintainers; [ huantian ];
+      license = licenses.mpl20;
+    };
+  };
+
+  aw-watcher-window = python3.pkgs.buildPythonApplication {
+    pname = "aw-watcher-window";
+    inherit version;
+
+    format = "pyproject";
+
+    src = "${sources}/aw-watcher-window";
+
+    nativeBuildInputs = [
+      python3.pkgs.poetry-core
+    ];
+
+    propagatedBuildInputs = with python3.pkgs; [
+      aw-client
+      xlib
+    ];
+
+    pythonImportsCheck = [ "aw_watcher_window" ];
+
+    meta = with lib; {
+      description = "Cross-platform window watcher (for use with ActivityWatch)";
+      homepage = "https://github.com/ActivityWatch/aw-watcher-window";
+      maintainers = with maintainers; [ huantian ];
+      license = licenses.mpl20;
+    };
+  };
+
+  aw-qt = python3.pkgs.buildPythonApplication {
+    pname = "aw-qt";
+    inherit version;
+
+    format = "pyproject";
+
+    src = "${sources}/aw-qt";
+
+    nativeBuildInputs = [
+      python3.pkgs.poetry-core
+      wrapQtAppsHook
+    ];
+
+    propagatedBuildInputs = with python3.pkgs; [
+      aw-core
+      qtbase
+      qtsvg # Rendering icons in the trayicon menu
+      pyqt6
+      click
+    ];
+
+    # Prevent double wrapping
+    dontWrapQtApps = true;
+
+    makeWrapperArgs = [
+      "--suffix PATH : ${lib.makeBinPath [ xdg-utils ]}"
+    ];
+
+    postPatch = ''
+      sed -E 's#PyQt6 = "6.3.1"#PyQt6 = "^6.4.0"#g' -i pyproject.toml
+    '';
+
+    postInstall = ''
+      install -D resources/aw-qt.desktop $out/share/applications/aw-qt.desktop
+
+      # For the actual tray icon, see
+      # https://github.com/ActivityWatch/aw-qt/blob/8ec5db941ede0923bfe26631acf241a4a5353108/aw_qt/trayicon.py#L211-L218
+      install -D media/logo/logo.png $out/${python3.sitePackages}/media/logo/logo.png
+
+      # For .desktop file and your desktop environment
+      install -D media/logo/logo.svg $out/share/icons/hicolor/scalable/apps/activitywatch.svg
+      install -D media/logo/logo.png $out/share/icons/hicolor/512x512/apps/activitywatch.png
+      install -D media/logo/logo-128.png $out/share/icons/hicolor/128x128/apps/activitywatch.png
+    '';
+
+    preFixup = ''
+      makeWrapperArgs+=(
+        "''${qtWrapperArgs[@]}"
+      )
+    '';
+
+    pythonImportsCheck = [ "aw_qt" ];
+
+    meta = with lib; {
+      description = "Tray icon that manages ActivityWatch processes, built with Qt";
+      homepage = "https://github.com/ActivityWatch/aw-qt";
+      maintainers = with maintainers; [ huantian ];
+      license = licenses.mpl20;
+    };
+  };
+
+  aw-server-rust = rustPlatform.buildRustPackage {
+    pname = "aw-server-rust";
+    inherit version;
+
+    src = "${sources}/aw-server-rust";
+
+    cargoLock = {
+      lockFile = ./Cargo.lock;
+      outputHashes = {
+        "rocket_cors-0.6.0-alpha1" = "sha256-GuMekgnsyuOg6lMiVvi4TwMba4sAFJ/zkgrdzSeBrv0=";
+      };
+    };
+
+    # Bypass rust nightly features not being available on rust stable
+    RUSTC_BOOTSTRAP = 1;
+
+    patches = [
+      # Override version string with hardcoded value as it may be outdated upstream.
+      (substituteAll {
+        src = ./override-version.patch;
+        version = sources.rev;
+      })
+    ];
+
+    nativeBuildInputs = [
+      makeWrapper
+      pkg-config
+      perl
+    ];
+
+    buildInputs = [
+      openssl
+    ];
+
+    postFixup = ''
+      wrapProgram "$out/bin/aw-server" \
+        --prefix XDG_DATA_DIRS : "$out/share"
+
+      mkdir -p "$out/share/aw-server"
+      ln -s "${aw-webui}" "$out/share/aw-server/static"
+    '';
+
+    preCheck = ''
+      # Fake home folder for tests that use ~/.cache and ~/.local/share
+      export HOME="$TMPDIR"
+    '';
+
+    meta = with lib; {
+      description = "High-performance implementation of the ActivityWatch server, written in Rust";
+      homepage = "https://github.com/ActivityWatch/aw-server-rust";
+      maintainers = with maintainers; [ huantian ];
+      mainProgram = "aw-server";
+      platforms = platforms.linux;
+      license = licenses.mpl20;
+    };
+  };
+
+  aw-webui = buildNpmPackage {
+    pname = "aw-webui";
+    inherit version;
+
+    src = "${sources}/aw-server-rust/aw-webui";
+
+    npmDepsHash = "sha256-yds2P2PKfTB6yUGnc+P73InV5+MZP9kmz2ZS4CRqlmA=";
+
+    patches = [
+      # Hardcode version to avoid the need to have the Git repo available at build time.
+      (substituteAll {
+        src = ./commit-hash.patch;
+        commit_hash = sources.rev;
+      })
+    ];
+
+    installPhase = ''
+      runHook preInstall
+      mv dist $out
+      cp media/logo/logo.{png,svg} $out/static/
+      runHook postInstall
+    '';
+
+    doCheck = true;
+    checkPhase = ''
+      runHook preCheck
+      npm test
+      runHook postCheck
+    '';
+
+    meta = with lib; {
+      description = "A web-based UI for ActivityWatch, built with Vue.js";
+      homepage = "https://github.com/ActivityWatch/aw-webui/";
+      maintainers = with maintainers; [ huantian ];
+      license = licenses.mpl20;
+    };
+  };
+}
--- a/pkgs/applications/office/activitywatch/override-version.patch
+++ b/pkgs/applications/office/activitywatch/override-version.patch
@ -0,0 +1,17 @@
+diff --git a/aw-server/src/endpoints/mod.rs b/aw-server/src/endpoints/mod.rs
+index a080d2a..0411d1e 100644
+--- a/aw-server/src/endpoints/mod.rs
+++ b/aw-server/src/endpoints/mod.rs
+@@ -76,11 +76,10 @@ async fn root_favicon(state: &State<ServerState>) -> Option<NamedFile> {
+ fn server_info(config: &State<AWConfig>, state: &State<ServerState>) -> Json<Info> {
+     #[allow(clippy::or_fun_call)]
+     let hostname = gethostname().into_string().unwrap_or("unknown".to_string());
+-    const VERSION: Option<&'static str> = option_env!("CARGO_PKG_VERSION");
+
+     Json(Info {
+         hostname,
+-        version: format!("v{} (rust)", VERSION.unwrap_or("(unknown)")),
+        version: String::from("@version@ (rust)"),
+         testing: config.testing,
+         device_id: state.device_id.clone(),
+     })
--- a/pkgs/applications/office/activitywatch/wrapper.nix
+++ b/pkgs/applications/office/activitywatch/wrapper.nix
@ -0,0 +1,18 @@
+{ lib
+, symlinkJoin
+, aw-server-rust
+, aw-qt
+, aw-watcher-afk
+, aw-watcher-window
+, extraWatchers ? [ ]
+}:
+
+symlinkJoin {
+  name = "activitywatch-${aw-server-rust.version}";
+  paths = [
+    aw-server-rust.out
+    aw-qt.out
+    aw-watcher-afk.out
+    aw-watcher-window.out
+  ] ++ (lib.forEach extraWatchers (p: p.out));
+}
--- a/pkgs/applications/office/gnote/default.nix
+++ b/pkgs/applications/office/gnote/default.nix
@ -0,0 +1,61 @@
+{ lib
+, stdenv
+, fetchurl
+, desktop-file-utils
+, gettext
+, gspell
+, gtkmm3
+, itstool
+, libsecret
+, libuuid
+, libxml2
+, libxslt
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook
+, gnome
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gnote";
+  version = "44.0";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
+    hash = "sha256-3DvXkmj+mdTtVmeawHbMnZqq9ieWE403HPCIFffmSS0=";
+  };
+
+  buildInputs = [
+    gspell
+    gtkmm3
+    libsecret
+    libuuid
+    libxml2
+    libxslt
+  ];
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    gettext
+    itstool
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  passthru = {
+    updateScript = gnome.updateScript {
+      packageName = pname;
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://wiki.gnome.org/Apps/Gnote";
+    description = "A note taking application";
+    maintainers = with maintainers; [ jfvillablanca ];
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,14 +1,14 @@
 {
-  "version": "15.11.2",
-  "repo_hash": "sha256-4wdbe/DkZdfmOuKHlmBEKQYYduIaB1SD5ZYICHqADeE=",
+  "version": "15.11.3",
+  "repo_hash": "sha256-fOIh1x1ci2J1J8bXANOQObn8gqELeu0nisb+EdjyJzw=",
  "yarn_hash": "02ipm7agjy3c75df76c00k3qq5gpw3d876f6x91xnwizswsv9agb",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v15.11.2-ee",
+  "rev": "v15.11.3-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "15.11.2",
-    "GITLAB_PAGES_VERSION": "15.11.2",
+    "GITALY_SERVER_VERSION": "15.11.3",
+    "GITLAB_PAGES_VERSION": "15.11.3",
    "GITLAB_SHELL_VERSION": "14.18.0",
-    "GITLAB_WORKHORSE_VERSION": "15.11.2"
+    "GITLAB_WORKHORSE_VERSION": "15.11.3"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -11,7 +11,7 @@ let
    gemdir = ./.;
  };

-  version = "15.11.2";
+  version = "15.11.3";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@ -22,7 +22,7 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      sha256 = "sha256-yX93YHHajXqAQq93mM/bRCQciDfJ0GR3kLSO4MQsWPY=";
+      sha256 = "sha256-3bbk9LDqo6hm8eG17+a7udM/yHjvXi3f32gNwXhrMrI=";
    };

    vendorSha256 = "sha256-gJelagGPogeCdJtRpj4RaYlqzZRhtU0EIhmj1aK4ZOk=";
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "15.11.2";
+  version = "15.11.3";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    sha256 = "sha256-c5brpl9OEW4N8vmphdCRYl5TGkMN3FmXmINPpyEajUs=";
+    sha256 = "sha256-1qf/ZXOQBMT1aH0f6IyItTBUuhwVuE76sU8llRapZ0Q=";
  };

  vendorHash = "sha256-s3HHoz9URACuVVhePQQFviTqlQU7vCLOjTJPBlus1Vo=";
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "15.11.2";
+  version = "15.11.3";

  src = fetchFromGitLab {
    owner = data.owner;
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -435,7 +435,7 @@ group :development, :test do
 end

 group :development, :test, :danger do
-  gem 'gitlab-dangerfiles', '~> 3.8.0', require: false
+  gem 'gitlab-dangerfiles', '~> 3.9.0', require: false
 end

 group :development, :test, :coverage do
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -485,7 +485,7 @@ GEM
    faraday-em_http (1.0.0)
    faraday-em_synchrony (1.0.0)
    faraday-excon (1.1.0)
-    faraday-http-cache (2.4.1)
+    faraday-http-cache (2.5.0)
      faraday (>= 0.8)
    faraday-httpclient (1.0.1)
    faraday-multipart (1.0.4)
@ -595,7 +595,7 @@ GEM
      terminal-table (>= 1.5.1)
    gitlab-chronic (0.10.5)
      numerizer (~> 0.2)
-    gitlab-dangerfiles (3.8.0)
+    gitlab-dangerfiles (3.9.0)
      danger (>= 8.4.5)
      danger-gitlab (>= 8.0.0)
      rake
@ -1746,7 +1746,7 @@ DEPENDENCIES
  gettext_i18n_rails_js (~> 1.3)
  gitaly (~> 15.9.0.pre.rc3)
  gitlab-chronic (~> 0.10.5)
-  gitlab-dangerfiles (~> 3.8.0)
+  gitlab-dangerfiles (~> 3.9.0)
  gitlab-experiment (~> 0.7.1)
  gitlab-fog-azure-rm (~> 1.7.0)
  gitlab-labkit (~> 0.31.1)
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@ -1700,10 +1700,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1qsycf92z2797m9v6calp4yhz565vdsfazi7rj0rxy3jxvlv4lgv";
+      sha256 = "0qvl49xpl2mwxgcj6aj11qrjk94xrqhbnpl5vp1y2275crnkddv4";
      type = "gem";
    };
-    version = "2.4.1";
+    version = "2.5.0";
  };
  faraday-httpclient = {
    groups = ["danger" "default" "development" "test"];
@ -2157,10 +2157,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0zhsdnr3zbsym6j689d039hrd9if07jbircyl6ns4f5abwhc7w3y";
+      sha256 = "13npl2yqcapsxwzm3b84537sa5s1cplcvba43nlwdcb1d22skfip";
      type = "gem";
    };
-    version = "3.8.0";
+    version = "3.9.0";
  };
  gitlab-experiment = {
    dependencies = ["activesupport" "request_store"];
--- a/pkgs/applications/version-management/gittyup/default.nix
+++ b/pkgs/applications/version-management/gittyup/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "gittyup";
-  version = "1.2.2";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "Murmele";
    repo = "Gittyup";
    rev = "gittyup_v${version}";
-    hash = "sha256-JJ20vls/NGkm0xV+vDguvuW5yqhOQf83TMvnn5Kx4IE=";
+    hash = "sha256-/8Uipz2R/LuA3KUcFsROOmldIKnCVLfIpIQ9YLpPA+k=";
    fetchSubmodules = true;
  };

@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
    "-DUSE_SYSTEM_LIBSSH2=ON"
    "-DUSE_SYSTEM_LUA=ON"
    "-DUSE_SYSTEM_OPENSSL=ON"
+    "-DENABLE_UPDATE_OVER_GUI=OFF"
  ];

  nativeBuildInputs = [
@ -62,28 +63,8 @@ stdenv.mkDerivation rec {
  ]);

  postInstall = ''
-    mkdir -p $out/bin
-
-    # Move binaries to the proper place
-    # TODO: Tweak in the next release: https://github.com/Murmele/Gittyup/commit/5b93e7e514b887fafb00a8158be5986e6c12b2e3
-    mv $out/Gittyup $out/bin/gittyup
-    mv $out/{indexer,relauncher} $out/bin
-
    # Those are not program libs, just some Qt5 libs that the build system leaks for some reason
-    rm -f $out/*.so.*
-    rm -rf $out/{include,lib,Plugins,Resources}
- '' + lib.optionalString stdenv.isLinux ''
-    # Install icons
-    install -Dm0644 ${src}/rsrc/Gittyup.iconset/gittyup_logo.svg $out/share/icons/hicolor/scalable/apps/gittyup.svg
-    for res in 16x16 32x32 64x64 128x128 256x256 512x512; do
-      install -Dm0644 ${src}/rsrc/Gittyup.iconset/icon_$res.png $out/share/icons/hicolor/$res/apps/gittyup.png
-    done
-
-    # Install desktop file
-    install -Dm0644 ${src}/rsrc/linux/com.github.Murmele.Gittyup.desktop $out/share/applications/gittyup.desktop
-    # TODO: Remove in the next release: https://github.com/Murmele/Gittyup/commit/5b93e7e514b887fafb00a8158be5986e6c12b2e3
-    substituteInPlace $out/share/applications/gittyup.desktop \
-      --replace "Exec=Gittyup" "Exec=gittyup"
+    rm -rf $out/{include,lib}
  '';

  meta = with lib; {
--- a/pkgs/applications/video/popcorntime/default.nix
+++ b/pkgs/applications/video/popcorntime/default.nix
@ -49,6 +49,17 @@ stdenv.mkDerivation rec {
    "--prefix PATH : ${lib.makeBinPath [ stdenv.cc ]}"
  ];

+  desktopItem = makeDesktopItem {
+      name = pname;
+      exec = pname;
+      icon = pname;
+      comment = meta.description;
+      genericName = meta.description;
+      type = "Application";
+      desktopName = "Popcorn-Time";
+      categories = [ "Video" "AudioVideo" ];
+    };
+
  # Extract and copy executable in $out/bin
  installPhase = ''
    mkdir -p $out/share/applications $out/bin $out/opt/bin $out/share/icons/hicolor/scalable/apps/
@ -60,6 +71,8 @@ stdenv.mkDerivation rec {
    ln -s $out/opt/popcorntime/Popcorn-Time $out/bin/popcorntime

    ln -s $out/opt/popcorntime/src/app/images/icon.png $out/share/icons/hicolor/scalable/apps/popcorntime.png
+
+    ln -s ${desktopItem}/share/applications/popcorntime.desktop $out/share/applications/popcorntime.desktop
  '';

  # GSETTINGS_SCHEMAS_PATH is not set in installPhase
--- a/pkgs/applications/virtualization/pods/Cargo.lock
+++ b/pkgs/applications/virtualization/pods/Cargo.lock
@ -120,9 +120,9 @@ dependencies = [

 [[package]]
 name = "bumpalo"
-version = "3.12.1"
+version = "3.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b1ce199063694f33ffb7dd4e0ee620741495c32833cde5aa08f02a0bf96f0c8"
+checksum = "3c6ed94e98ecff0c12dd1b04c15ec0d7d9458ca8fe806cea6f12954efe74c63b"

 [[package]]
 name = "byteorder"
@ -1092,9 +1092,9 @@ checksum = "453ad9f582a441959e5f0d088b02ce04cfe8d51a8eaf077f12ac6d3e94164ca6"

 [[package]]
 name = "js-sys"
-version = "0.3.61"
+version = "0.3.62"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "445dde2150c55e483f3d8416706b97ec8e8237c307e5b7b4b8dd15e6af2a0730"
+checksum = "68c16e1bfd491478ab155fd8b4896b86f9ede344949b641e61501e07c2b8b4d5"
 dependencies = [
 "wasm-bindgen",
 ]
@ -1142,9 +1142,9 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.142"
+version = "0.2.144"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a987beff54b60ffa6d51982e1aa1146bc42f19bd26be28b0586f252fccf5317"
+checksum = "2b00cc1c228a6782d0f076e7b232802e0c5689d41bb5df366f2a6b6621cfdfe1"

 [[package]]
 name = "libpanel"
@ -1188,9 +1188,9 @@ dependencies = [

 [[package]]
 name = "linux-raw-sys"
-version = "0.3.6"
+version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b64f40e5e03e0d54f03845c8197d0291253cdbedfb1cb46b13c2c117554a9f4c"
+checksum = "ece97ea872ece730aed82664c424eb4c8291e1ff2480247ccf7409044bc6479f"

 [[package]]
 name = "locale_config"
@ -1477,9 +1477,9 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"

 [[package]]
 name = "pkg-config"
-version = "0.3.26"
+version = "0.3.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
+checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"

 [[package]]
 name = "podman-api"
@ -1518,7 +1518,7 @@ dependencies = [

 [[package]]
 name = "pods"
-version = "1.1.1"
+version = "1.1.2"
 dependencies = [
 "anyhow",
 "ashpd",
@ -1594,9 +1594,9 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4424af4bf778aae2051a77b60283332f386554255d722233d09fbfc7e30da2fc"
+checksum = "8f4f29d145265ec1c483c7c654450edde0bfe043d3938d6972630663356d9500"
 dependencies = [
 "proc-macro2",
 ]
@ -1677,9 +1677,9 @@ dependencies = [

 [[package]]
 name = "rustix"
-version = "0.37.18"
+version = "0.37.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bbfc1d1c7c40c01715f47d71444744a81669ca84e8b63e25a55e169b1f86433"
+checksum = "acf8729d8542766f1b2cf77eb034d52f40d375bb8b615d0b147089946e16613d"
 dependencies = [
 "bitflags",
 "errno",
@ -1709,18 +1709,18 @@ checksum = "bebd363326d05ec3e2f532ab7660680f3b02130d780c299bca73469d521bc0ed"

 [[package]]
 name = "serde"
-version = "1.0.160"
+version = "1.0.162"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2f3770c8bce3bcda7e149193a069a0f4365bda1fa5cd88e03bca26afc1216c"
+checksum = "71b2f6e1ab5c2b98c05f0f35b236b22e8df7ead6ffbf51d7808da7f8817e7ab6"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.160"
+version = "1.0.162"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291a097c63d8497e00160b166a967a4a79c64f3facdd01cbd7502231688d77df"
+checksum = "a2a0814352fd64b58489904a44ea8d90cb1a91dcb6b4f5ebabc32c8318e93cb6"
 dependencies = [
 "proc-macro2",
 "quote",
@ -1868,14 +1868,14 @@ dependencies = [
 "hostname",
 "libc",
 "log",
- "time 0.3.20",
+ "time 0.3.21",
 ]

 [[package]]
 name = "system-deps"
-version = "6.0.5"
+version = "6.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0fe581ad25d11420b873cf9aedaca0419c2b411487b134d4d21065f3d092055"
+checksum = "e5fa6fb9ee296c0dc2df41a656ca7948546d061958115ddb0bcaae43ad0d17d2"
 dependencies = [
 "cfg-expr",
 "heck",
@ -1962,9 +1962,9 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.20"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd0cbfecb4d19b5ea75bb31ad904eb5b9fa13f21079c3b92017ebdf4999a5890"
+checksum = "8f3403384eaacbca9923fa06940178ac13e4edb725486d70e8e15881d0c836cc"
 dependencies = [
 "itoa",
 "libc",
@ -1976,15 +1976,15 @@ dependencies = [

 [[package]]
 name = "time-core"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e153e1f1acaef8acc537e68b44906d2db6436e2b35ac2c6b42640fff91f00fd"
+checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb"

 [[package]]
 name = "time-macros"
-version = "0.2.8"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd80a657e71da814b8e5d60d3374fc6d35045062245d80224748ae522dd76f36"
+checksum = "372950940a5f07bf38dbe211d7283c9e6d7327df53794992d293e534c733d09b"
 dependencies = [
 "time-core",
 ]
@ -2006,9 +2006,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"

 [[package]]
 name = "tokio"
-version = "1.28.0"
+version = "1.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3c786bf8134e5a3a166db9b29ab8f48134739014a3eca7bc6bfa95d673b136f"
+checksum = "0aa32867d44e6f2ce3385e89dceb990188b8bb0fb25b0cf576647a6f98ac5105"
 dependencies = [
 "autocfg",
 "bytes 1.4.0",
@ -2274,9 +2274,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"

 [[package]]
 name = "wasm-bindgen"
-version = "0.2.84"
+version = "0.2.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31f8dcbc21f30d9b8f2ea926ecb58f6b91192c17e9d33594b3df58b2007ca53b"
+checksum = "5b6cb788c4e39112fbe1822277ef6fb3c55cd86b95cb3d3c4c1c9597e4ac74b4"
 dependencies = [
 "cfg-if",
 "wasm-bindgen-macro",
@ -2284,24 +2284,24 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.84"
+version = "0.2.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95ce90fd5bcc06af55a641a86428ee4229e44e07033963a2290a8e241607ccb9"
+checksum = "35e522ed4105a9d626d885b35d62501b30d9666283a5c8be12c14a8bdafe7822"
 dependencies = [
 "bumpalo",
 "log",
 "once_cell",
 "proc-macro2",
 "quote",
- "syn 1.0.109",
+ "syn 2.0.15",
 "wasm-bindgen-shared",
 ]

 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.84"
+version = "0.2.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c21f77c0bedc37fd5dc21f897894a5ca01e7bb159884559461862ae90c0b4c5"
+checksum = "358a79a0cb89d21db8120cbfb91392335913e4890665b1a7981d9e956903b434"
 dependencies = [
 "quote",
 "wasm-bindgen-macro-support",
@ -2309,22 +2309,22 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.84"
+version = "0.2.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2aff81306fcac3c7515ad4e177f521b5c9a15f2b08f4e32d823066102f35a5f6"
+checksum = "4783ce29f09b9d93134d41297aded3a712b7b979e9c6f28c32cb88c973a94869"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 1.0.109",
+ "syn 2.0.15",
 "wasm-bindgen-backend",
 "wasm-bindgen-shared",
 ]

 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.84"
+version = "0.2.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0046fef7e28c3804e5e38bfa31ea2a0f73905319b677e57ebe37e49358989b5d"
+checksum = "a901d592cafaa4d711bc324edfaff879ac700b19c3dfd60058d2b445be2691eb"

 [[package]]
 name = "winapi"
--- a/pkgs/applications/virtualization/pods/default.nix
+++ b/pkgs/applications/virtualization/pods/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "pods";
-  version = "1.1.1";
+  version = "1.1.2";

  src = fetchFromGitHub {
    owner = "marhkb";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-GTRHysG1zPr6MorGoSKYq8TgAdTH/bU/AxVrP2Ghqec=";
+    sha256 = "sha256-5euSMmyumZbUFsZuP7fa3wCm4n0Hx+F8bPlv4Xw/Hvw=";
  };

  cargoDeps = rustPlatform.importCargoLock {
--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@ -67,7 +67,6 @@ let
        --output_user_root="$bazelUserRoot" \
        ${cmd} \
        --curses=no \
-        -j $NIX_BUILD_CORES \
        "''${copts[@]}" \
        "''${host_copts[@]}" \
        "''${linkopts[@]}" \
@ -131,7 +130,7 @@ stdenv.mkDerivation (fBuildAttrs // {
            # https://github.com/bazelbuild/bazel/issues/6502
            "--loading_phase_threads=1"
            "$bazelFetchFlags"
-          ];
+          ] ++ (if fetchConfigured then ["--jobs" "$NIX_BUILD_CORES"] else []);
          targets = fFetchAttrs.bazelTargets ++ fFetchAttrs.bazelTestTargets;
        }
      }
@ -252,14 +251,14 @@ stdenv.mkDerivation (fBuildAttrs // {
      bazelCmd {
        cmd = "test";
        additionalFlags =
-          ["--test_output=errors"] ++ fBuildAttrs.bazelTestFlags;
+          ["--test_output=errors"] ++ fBuildAttrs.bazelTestFlags ++ ["--jobs" "$NIX_BUILD_CORES"];
        targets = fBuildAttrs.bazelTestTargets;
      }
    }
    ${
      bazelCmd {
        cmd = "build";
-        additionalFlags = fBuildAttrs.bazelBuildFlags;
+        additionalFlags = fBuildAttrs.bazelBuildFlags ++ ["--jobs" "$NIX_BUILD_CORES"];
        targets = fBuildAttrs.bazelTargets;
      }
    }
--- a/pkgs/build-support/dart/build-dart-application/default.nix
+++ b/pkgs/build-support/dart/build-dart-application/default.nix
@ -0,0 +1,66 @@
+{ lib, stdenv, fetchDartDeps, writeText, dartHooks, makeWrapper, dart, nodejs }:
+
+{ pubGetScript ? "dart pub get"
+
+  # Output type to produce. Can be any kind supported by dart
+  # https://dart.dev/tools/dart-compile#types-of-output
+  # If using jit, you might want to pass some arguments to `dartJitFlags`
+, dartOutputType ? "exe"
+, dartCompileCommand ? "dart compile"
+, dartCompileFlags ? [ ]
+  # These come at the end of the command, useful to pass flags to the jit run
+, dartJitFlags ? [ ]
+
+  # Attrset of entry point files to build and install.
+  # Where key is the final binary path and value is the source file path
+  # e.g. { "bin/foo" = "bin/main.dart";  }
+  # Set to null to read executables from pubspec.yaml
+, dartEntryPoints ? null
+  # Used when wrapping aot, jit, kernel, and js builds.
+  # Set to null to disable wrapping.
+, dartRuntimeCommand ?
+    if dartOutputType == "aot-snapshot" then "${dart}/bin/dartaotruntime"
+    else if (dartOutputType == "jit-snapshot" || dartOutputType == "kernel") then "${dart}/bin/dart"
+    else if dartOutputType == "js" then "${nodejs}/bin/node"
+    else null
+
+, pubspecLockFile ? null
+, vendorHash ? ""
+, ...
+}@args:
+
+let
+  dartDeps = fetchDartDeps {
+    buildDrvArgs = args;
+    inherit pubGetScript vendorHash pubspecLockFile;
+  };
+  inherit (dartHooks.override { inherit dart; }) dartConfigHook dartBuildHook dartInstallHook;
+in
+assert !(builtins.isString dartOutputType && dartOutputType != "") ->
+  throw "dartOutputType must be a non-empty string";
+stdenv.mkDerivation (args // {
+  inherit pubGetScript dartCompileCommand dartOutputType dartRuntimeCommand
+    dartCompileFlags dartJitFlags;
+
+    dartEntryPoints =
+      if (dartEntryPoints != null)
+      then writeText "entrypoints.json" (builtins.toJSON dartEntryPoints)
+      else null;
+
+  nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [
+    dart
+    dartDeps
+    dartConfigHook
+    dartBuildHook
+    dartInstallHook
+    makeWrapper
+  ];
+
+  # When stripping, it seems some ELF information is lost and the dart VM cli
+  # runs instead of the expected program. Don't strip if it's an exe output.
+  dontStrip = args.dontStrip or (dartOutputType == "exe");
+
+  passthru = { inherit dartDeps; } // (args.passthru or { });
+
+  meta = (args.meta or { }) // { platforms = args.meta.platforms or dart.meta.platforms; };
+})
--- a/pkgs/build-support/dart/build-dart-application/hooks/dart-build-hook.sh
+++ b/pkgs/build-support/dart/build-dart-application/hooks/dart-build-hook.sh
@ -0,0 +1,34 @@
+# shellcheck shell=bash
+
+# Outputs line-separated "${dest}\t${source}"
+_getDartEntryPoints() {
+    if [ -n "$dartEntryPoints" ]; then
+        @jq@ -r '(to_entries | map(.key + "\t" + .value) | join("\n"))' "$dartEntryPoints"
+    else
+        # The pubspec executables section follows the pattern:
+        # <output-bin-name>: [source-file-name]
+        # Where source-file-name defaults to output-bin-name if omited
+        @yq@ -r '(.executables | to_entries | map("bin/" + .key + "\t" + "bin/" + (.value // .key) + ".dart") | join("\n"))' pubspec.yaml
+    fi
+}
+
+dartBuildHook() {
+    echo "Executing dartBuildHook"
+
+    runHook preBuild
+
+    while IFS=$'\t' read -ra target; do
+        dest="${target[0]}"
+        src="${target[1]}"
+        eval "$dartCompileCommand" "$dartOutputType" \
+            -o "$dest" "${dartCompileFlags[@]}" "$src" "${dartJitFlags[@]}"
+    done < <(_getDartEntryPoints)
+
+    runHook postBuild
+
+    echo "Finished dartBuildHook"
+}
+
+if [ -z "${dontDartBuild-}" ] && [ -z "${buildPhase-}" ]; then
+    buildPhase=dartBuildHook
+fi
--- a/pkgs/build-support/dart/build-dart-application/hooks/dart-config-hook.sh
+++ b/pkgs/build-support/dart/build-dart-application/hooks/dart-config-hook.sh
@ -0,0 +1,12 @@
+# shellcheck shell=bash
+
+dartConfigHook() {
+    echo "Executing dartConfigHook"
+
+    echo "Installing dependencies"
+    eval "$pubGetScript" --offline
+
+    echo "Finished dartConfigHook"
+}
+
+postConfigureHooks+=(dartConfigHook)
--- a/pkgs/build-support/dart/build-dart-application/hooks/dart-install-hook.sh
+++ b/pkgs/build-support/dart/build-dart-application/hooks/dart-install-hook.sh
@ -0,0 +1,29 @@
+# shellcheck shell=bash
+
+dartInstallHook() {
+    echo "Executing dartInstallHook"
+
+    runHook preInstall
+
+    mkdir -p "$out"
+
+    while IFS=$'\t' read -ra target; do
+        dest="${target[0]}"
+        # Wrap with runtime command, if it's defined
+        if [ -n "$dartRuntimeCommand" ]; then
+            install -D "$dest" "$out/share/$dest"
+            makeWrapper "$dartRuntimeCommand" "$out/$dest" \
+                --add-flags "$out/share/$dest"
+        else
+            install -Dm755 "$dest" "$out/$dest"
+        fi
+    done < <(_getDartEntryPoints)
+
+    runHook postInstall
+
+    echo "Finished dartInstallHook"
+}
+
+if [ -z "${dontDartInstall-}" ] && [ -z "${installPhase-}" ]; then
+    installPhase=dartInstallHook
+fi
--- a/pkgs/build-support/dart/build-dart-application/hooks/default.nix
+++ b/pkgs/build-support/dart/build-dart-application/hooks/default.nix
@ -0,0 +1,15 @@
+{ lib, makeSetupHook, dart, yq, jq }:
+
+{
+  dartConfigHook = makeSetupHook {
+    name = "dart-config-hook";
+  } ./dart-config-hook.sh;
+  dartBuildHook = makeSetupHook {
+    name = "dart-build-hook";
+    substitutions.yq = "${yq}/bin/yq";
+    substitutions.jq = "${jq}/bin/jq";
+  } ./dart-build-hook.sh;
+  dartInstallHook = makeSetupHook {
+    name = "dart-install-hook";
+  } ./dart-install-hook.sh;
+}
--- a/pkgs/build-support/flutter/default.nix
+++ b/pkgs/build-support/flutter/default.nix
@ -16,7 +16,7 @@
 , customPackageOverrides ? { }
 , autoDepsList ? false
 , depsListFile ? null
-, vendorHash
+, vendorHash ? ""
 , pubspecLockFile ? null
 , nativeBuildInputs ? [ ]
 , preUnpack ? ""
--- a/pkgs/data/themes/lightly-boehs/default.nix
+++ b/pkgs/data/themes/lightly-boehs/default.nix
@ -0,0 +1,42 @@
+{ mkDerivation
+, lib
+, kdecoration
+, fetchFromGitHub
+, cmake
+, extra-cmake-modules
+, plasma-workspace
+, qtbase
+, qt5
+}:
+
+mkDerivation rec {
+  pname = "lightly-boehs";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "boehs";
+    repo = "Lightly";
+    rev = "1a831f7ff19ce93c04489faec74e389a216fdf11";
+    sha256 = "Icw+xVmuCB59ltyZJKyIeHI/yGfM2SbPrVzTVLqHWd4=";
+  };
+
+  buildInputs = [
+    kdecoration
+    plasma-workspace
+    qtbase
+    qt5.qtx11extras
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+  ];
+
+  meta = with lib; {
+    description = "A fork of the Lightly breeze theme style that aims to be visually modern and minimalistic";
+    homepage = "https://github.com/boehs/Lightly";
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.hikari ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/compilers/flutter/engine-artifacts/default.nix
+++ b/pkgs/development/compilers/flutter/engine-artifacts/default.nix
@ -30,7 +30,7 @@ let
                variants = lib.genAttrs [ "profile" "release" ]
                  (variant: [
                    { archive = "artifacts.zip"; }
-                    { archive = "${lib.toLower hostPlatform.uname.system}-x64.zip"; }
+                    { subdirectory = true; archive = "${lib.toLower hostPlatform.uname.system}-x64.zip"; }
                  ]);
              })) //
          {
@ -80,7 +80,7 @@ let
      };
    };

-  mkArtifactDerivation = { platform ? null, variant ? null, archive, ... }@args:
+  mkArtifactDerivation = { platform ? null, variant ? null, subdirectory ? null, archive, ... }@args:
    let
      artifactDirectory = if platform == null then null else "${platform}${lib.optionalString (variant != null) "-${variant}"}";
      archiveBasename = lib.removeSuffix ".${(lib.last (lib.splitString "." archive))}" archive;
@ -97,7 +97,14 @@ let

      nativeBuildInputs = [ autoPatchelfHook ];

-      installPhase = "cp -r . $out";
+      installPhase =
+        let
+          destination = "$out/${if subdirectory == true then archiveBasename else if subdirectory != null then subdirectory else "."}";
+        in
+        ''
+          mkdir -p "${destination}"
+          cp -r . "${destination}"
+        '';
    } // args);

  artifactDerivations = {
--- a/pkgs/development/coq-modules/mathcomp-infotheo/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-infotheo/default.nix
@ -0,0 +1,19 @@
+{ coq, mkCoqDerivation, mathcomp-analysis, lib, version ? null }:
+
+mkCoqDerivation {
+  namePrefix = [ "coq" "mathcomp" ];
+  pname = "infotheo";
+  owner = "affeldt-aist";
+  inherit version;
+  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp-analysis.version] [
+    { cases = [ (range "8.15" "8.16") (range "0.5.4" "0.6.2") ]; out = "0.5.1"; }
+  ] null;
+  release."0.5.1".sha256 = "sha256-yBBl5l+V+dggsg5KM59Yo9CULKog/xxE8vrW+ZRnX7Y=";
+
+  propagatedBuildInputs = [ mathcomp-analysis ];
+
+  meta = with lib; {
+    description = "A Coq formalization of information theory and linear error-correcting codes";
+    license = licenses.lgpl21Plus;
+  };
+}
--- a/pkgs/development/embedded/wch-isp/default.nix
+++ b/pkgs/development/embedded/wch-isp/default.nix
@ -0,0 +1,27 @@
+{ lib, stdenv, fetchFromGitHub, pkg-config, libusb1 }:
+
+stdenv.mkDerivation rec {
+  pname = "wch-isp";
+  version = "0.2.4";
+
+  src = fetchFromGitHub {
+    owner = "jmaselbas";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-YjxzfDSZRMa7B+hNqtj87nRlRuQyr51VidZqHLddgwI=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libusb1 ];
+
+  installFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
+  installTargets = [ "install" "install-rules" ];
+
+  meta = {
+    description = "Firmware programmer for WCH microcontrollers over USB";
+    license = lib.licenses.gpl2Only;
+    homepage = "https://github.com/jmaselbas/wch-isp";
+    maintainers = with lib.maintainers; [ lesuisse ];
+    platforms = lib.platforms.unix;
+  };
+}
--- a/pkgs/development/interpreters/bqn/cbqn/default.nix
+++ b/pkgs/development/interpreters/bqn/cbqn/default.nix
@ -50,12 +50,12 @@ stdenv.mkDerivation rec {

  makeFlags = [
    "CC=${stdenv.cc.targetPrefix}cc"
-  ]
-  ++ lib.optional enableReplxx "REPLXX=1";
+  ];

  buildFlags = [
    # interpreter binary
    (lib.flatten (if enableSingeli then ["o3n-singeli" "f='-mavx2'"] else ["o3"]))
+    "REPLXX=${if enableReplxx then "1" else "0"}"
  ] ++ lib.optionals enableLibcbqn [
    # embeddable interpreter as a shared lib
    "shared-o3"
--- a/pkgs/development/interpreters/bqn/cbqn/replxx.nix
+++ b/pkgs/development/interpreters/bqn/cbqn/replxx.nix
@ -5,13 +5,13 @@

 stdenvNoCC.mkDerivation {
  pname = "replxx";
-  version = "unstable-2023-01-21";
+  version = "unstable-2023-02-26";

  src = fetchFromGitHub {
    owner = "dzaima";
    repo = "replxx";
-    rev = "eb6bcecff4ca6051120c99e9dd64c3bd20fcc42f";
-    hash = "sha256-cb486FGF+4sUxgBbRfnbTTnZn2WQ3p93fSwDRCEtFJg=";
+    rev = "1da4681a8814366ec51e7630b76558e53be0997d";
+    hash = "sha256-Zs7ItuK31n0VSxwOsPUdZZLr68PypitZqcydACrx90Q=";
  };

  dontConfigure = true;
--- a/pkgs/development/interpreters/bqn/cbqn/singeli.nix
+++ b/pkgs/development/interpreters/bqn/cbqn/singeli.nix
@ -5,13 +5,13 @@

 stdenvNoCC.mkDerivation {
  pname = "singeli";
-  version = "unstable-2023-01-23";
+  version = "unstable-2023-04-12";

  src = fetchFromGitHub {
    owner = "mlochbaum";
    repo = "Singeli";
-    rev = "0bc519ccbbe4051204d40bfc861a5bed7132e95f";
-    hash = "sha256-zo4yr9t3hp6BOX1ac3md6R/O+hl5MphZdCmI8nNP9Yc=";
+    rev = "3327956fedfdc6aef12954bc12120f20de2226d0";
+    hash = "sha256-k25hk5zTn0m+2Nh9buTJYhtM98/VRlQ0guoRw9el3VE=";
  };

  dontConfigure = true;
--- a/pkgs/development/interpreters/bqn/mlochbaum-bqn/default.nix
+++ b/pkgs/development/interpreters/bqn/mlochbaum-bqn/default.nix
@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "bqn";
-  version = "0.pre+date=2022-11-24";
+  version = "0.pre+date=2023-05-09";

  src = fetchFromGitHub {
    owner = "mlochbaum";
    repo = "BQN";
-    rev = "976bd82fb0e830876cca117c302c8a19048033a4";
-    hash = "sha256:1nhn30ypc2zvq58b3zi66ypc9wv3v8cryn43cqihazc1lq8qxqdw";
+    rev = "656b176c5dc783b038b018f0ed17a5414ea62b4d";
+    hash = "sha256-6r+N0eCvwvaoB84cw+Vtoqa6MXuI0NXLbOPblemY4M8=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/libraries/libcpr/default.nix
+++ b/pkgs/development/libraries/libcpr/default.nix
@ -0,0 +1,43 @@
+{ lib, stdenv, fetchFromGitHub, cmake, curl }:
+
+let version = "1.10.2"; in
+stdenv.mkDerivation {
+  pname = "libcpr";
+  inherit version;
+
+  outputs = [ "out" "dev" ];
+
+  src = fetchFromGitHub {
+    owner = "libcpr";
+    repo = "cpr";
+    rev = "1.10.2";
+    hash = "sha256-F+ZIyFwWHn2AcVnKOaRlB7DjZzfmn8Iat/m3uknC8uA=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ curl ];
+
+  cmakeFlags = [
+    "-DCPR_USE_SYSTEM_CURL=ON"
+  ];
+
+  postPatch = ''
+    # Linking with stdc++fs is no longer necessary.
+    sed -i '/stdc++fs/d' include/CMakeLists.txt
+  '';
+
+  postInstall = ''
+    substituteInPlace "$out/lib/cmake/cpr/cprTargets.cmake" \
+      --replace "_IMPORT_PREFIX \"$out\"" \
+                "_IMPORT_PREFIX \"$dev\""
+  '';
+
+  meta = with lib; {
+    description = "C++ wrapper around libcurl";
+    homepage = "https://docs.libcpr.org/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ rycee ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/libraries/openvino/default.nix
+++ b/pkgs/development/libraries/openvino/default.nix
@ -140,6 +140,8 @@ stdenv.mkDerivation rec {
    "-DENABLE_SAMPLES:BOOL=OFF"
  ];

+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isAarch64 "-Wno-narrowing";
+
  autoPatchelfIgnoreMissingDeps = [
    "libngraph_backend.so"
  ];
--- a/pkgs/development/ocaml-modules/charInfo_width/default.nix
+++ b/pkgs/development/ocaml-modules/charInfo_width/default.nix
@ -3,7 +3,7 @@
 buildDunePackage rec {
  pname = "charInfo_width";
  version = "1.1.0";
-  useDune2 = true;
+  duneVersion = "3";
  src = fetchzip {
    url = "https://bitbucket.org/zandoye/charinfo_width/get/${version}.tar.bz2";
    sha256 = "19mnq9a1yr16srqs8n6hddahr4f9d2gbpmld62pvlw1ps7nfrp9w";
--- a/pkgs/development/ocaml-modules/yojson/default.nix
+++ b/pkgs/development/ocaml-modules/yojson/default.nix
@ -2,11 +2,11 @@

 buildDunePackage rec {
  pname = "yojson";
-  version = "2.0.2";
+  version = "2.1.0";

  src = fetchurl {
    url = "https://github.com/ocaml-community/yojson/releases/download/${version}/yojson-${version}.tbz";
-    sha256 = "sha256-h2u284r3OoSilDij2jXkhXxgoUVWpgZSWxSMb9vlRhs=";
+    sha256 = "sha256-n8sf8ttYqyWfkih5awraR5Tq6XF3sYMzcTgMTk+QsV0=";
  };

  nativeBuildInputs = [ cppo ];
--- a/pkgs/development/ocaml-modules/zed/default.nix
+++ b/pkgs/development/ocaml-modules/zed/default.nix
@ -7,14 +7,12 @@ let
      {
        version = "3.2.0";
        sha256 = "sha256-6yKHE30nVFXo8hGdCx+GO4VYYGbi802aMdN2XuYMJ7w=";
-        duneVersion = "3";
        propagatedBuildInputs = [ react result uchar uutf uucp uuseg ];
      }
    else
      {
        version = "3.1.0";
        sha256 = "04vr1a94imsghm98iigc35rhifsz0rh3qz2qm0wam2wvp6vmrx0p";
-        duneVersion = "2";
        propagatedBuildInputs = [ charInfo_width react ];
      };
 in
@ -22,7 +20,9 @@ in
 buildDunePackage rec {
  pname = "zed";

-  inherit (switch) version duneVersion propagatedBuildInputs;
+  inherit (switch) version propagatedBuildInputs;
+
+  duneVersion = "3";

  src = fetchFromGitHub {
    owner = "ocaml-community";
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@ -2,14 +2,14 @@

 let
  pname = "phpstan";
-  version = "1.9.4";
+  version = "1.10.15";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-    sha256 = "sha256-A+F/ZoL6dLYx4MWN0eWXtQnmWJPYBqEcSgY4A1oR3mo=";
+    sha256 = "sha256-zGrAgQttAvGdRpuOB3V/GprMzc2NMya4d3MY1SIfYOQ=";
  };

  dontUnpack = true;
--- a/pkgs/development/python-modules/assay/default.nix
+++ b/pkgs/development/python-modules/assay/default.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub }:
+{ lib, buildPythonPackage, fetchFromGitHub, pythonAtLeast }:

 buildPythonPackage rec {
  pname = "assay";
@ -18,5 +18,6 @@ buildPythonPackage rec {
    description = "Attempt to write a Python testing framework I can actually stand";
    license = licenses.mit;
    maintainers = with maintainers; [ zane ];
+    broken = pythonAtLeast "3.11";
  };
 }
--- a/pkgs/development/python-modules/aw-client/default.nix
+++ b/pkgs/development/python-modules/aw-client/default.nix
@ -0,0 +1,65 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, poetry-core
+, aw-core
+, requests
+, persist-queue
+, click
+, tabulate
+, typing-extensions
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "aw-client";
+  version = "0.5.11";
+
+  format = "pyproject";
+
+  # pypi distribution doesn't include tests, so build from source instead
+  src = fetchFromGitHub {
+    owner = "ActivityWatch";
+    repo = "aw-client";
+    rev = "v${version}";
+    sha256 = "sha256-5WKGRoZGY+QnnB1Jzlju5OmCJreYMD8am2kW3Wcjhlw=";
+  };
+
+  disabled = pythonOlder "3.8";
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aw-core
+    requests
+    persist-queue
+    click
+    tabulate
+    typing-extensions
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  # Only run this test, the others are integration tests that require
+  # an instance of aw-server running in order to function.
+  pytestFlagsArray = [ "tests/test_requestqueue.py" ];
+
+  preCheck = ''
+    # Fake home folder for tests that write to $HOME
+    export HOME="$TMPDIR"
+  '';
+
+  pythonImportsCheck = [ "aw_client" ];
+
+  meta = with lib; {
+    description = "Client library for ActivityWatch";
+    homepage = "https://github.com/ActivityWatch/aw-client";
+    maintainers = with maintainers; [ huantian ];
+    license = licenses.mpl20;
+  };
+}
--- a/pkgs/development/python-modules/aw-core/default.nix
+++ b/pkgs/development/python-modules/aw-core/default.nix
@ -0,0 +1,69 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, poetry-core
+, jsonschema
+, peewee
+, appdirs
+, iso8601
+, rfc3339-validator
+, takethetime
+, strict-rfc3339
+, tomlkit
+, deprecation
+, timeslot
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "aw-core";
+  version = "0.5.12";
+
+  format = "pyproject";
+
+  # pypi distribution doesn't include tests, so build from source instead
+  src = fetchFromGitHub {
+    owner = "ActivityWatch";
+    repo = "aw-core";
+    rev = "v${version}";
+    sha256 = "sha256-DbugVMaQHlHpfbFEsM6kfpDL2VzRs0TDn9klWjAwz64=";
+  };
+
+  disabled = pythonOlder "3.8";
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    jsonschema
+    peewee
+    appdirs
+    iso8601
+    rfc3339-validator
+    takethetime
+    strict-rfc3339
+    tomlkit
+    deprecation
+    timeslot
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    # Fake home folder for tests that write to $HOME
+    export HOME="$TMPDIR"
+  '';
+
+  pythonImportsCheck = [ "aw_core" ];
+
+  meta = with lib; {
+    description = "Core library for ActivityWatch";
+    homepage = "https://github.com/ActivityWatch/aw-core";
+    maintainers = with maintainers; [ huantian ];
+    license = licenses.mpl20;
+  };
+}
--- a/pkgs/development/python-modules/aws-secretsmanager-caching/default.nix
+++ b/pkgs/development/python-modules/aws-secretsmanager-caching/default.nix
@ -0,0 +1,63 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, setuptools-scm
+, botocore
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "aws_secretsmanager_caching";
+  version = "1.1.1.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "5cee2762bb89b72f3e5123feee8e45fbe44ffe163bfca08b28f27b2e2b7772e1";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    botocore
+  ];
+
+  patches = [
+    # Remove coverage tests from the pytest invocation in setup.cfg.
+    ./remove-coverage-tests.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "'pytest-runner'," ""
+  '';
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # Integration tests require networking.
+    "test/integ"
+  ];
+
+  pythonImportsCheck = [
+    "aws_secretsmanager_caching"
+  ];
+
+  meta = with lib; {
+    description = "Client-side AWS secrets manager caching library";
+    homepage = "https://github.com/aws/aws-secretsmanager-caching-python";
+    changelog = "https://github.com/aws/aws-secretsmanager-caching-python/releases/tag/v${version}";
+    longDescription = ''
+      The AWS Secrets Manager Python caching client enables in-process caching of secrets for Python applications.
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ tomaskala ];
+  };
+}
--- a/pkgs/development/python-modules/aws-secretsmanager-caching/remove-coverage-tests.patch
+++ b/pkgs/development/python-modules/aws-secretsmanager-caching/remove-coverage-tests.patch
@ -0,0 +1,14 @@
+diff --git a/setup.cfg b/setup.cfg
+index 5aa81b2..0c02ded 100644
+--- a/setup.cfg
+++ b/setup.cfg
+@@ -3,9 +3,6 @@ xfail_strict = true
+ addopts = 
+ 	--verbose
+ 	--doctest-modules
+-	--cov aws_secretsmanager_caching
+-	--cov-fail-under 90
+-	--cov-report term-missing
+ 	--ignore doc/
+ 
+ [aliases]
--- a/pkgs/development/python-modules/azure-mgmt-containerinstance/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerinstance/default.nix
@ -6,17 +6,20 @@
 , azure-common
 , azure-mgmt-core
 , azure-mgmt-nspkg
-, isPy3k
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "azure-mgmt-containerinstance";
-  version = "10.0.0";
+  version = "10.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    hash = "sha256-TDGrC7YO05Ywa8uEINqqw4Wxag65aklIUwS+2aVMHwA=";
+    hash = "sha256-eNQ3rbKFdPRIyDjtXwH5ztN4GWCYBh3rWdn3AxcEwX4=";
  };

  propagatedBuildInputs = [
@ -24,14 +27,14 @@ buildPythonPackage rec {
    msrestazure
    azure-common
    azure-mgmt-core
-  ] ++ lib.optionals (!isPy3k) [
-    azure-mgmt-nspkg
  ];

  # has no tests
  doCheck = false;

-  pythonImportsCheck = [ "azure.mgmt.containerinstance" ];
+  pythonImportsCheck = [
+    "azure.mgmt.containerinstance"
+  ];

  meta = with lib; {
    description = "This is the Microsoft Azure Container Instance Client Library";
--- a/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-datafactory";
-  version = "3.0.0";
+  version = "3.1.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    hash = "sha256-aVfH65fJnsTSr0MR0Fr5yamxIOv2+aST953uCr7QXOk=";
+    hash = "sha256-lsOUxDoXocf1fUIcY4q74/vd86LO7yumJg7rJ6i3zcg=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/azure-mgmt-security/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-security/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-security";
-  version = "3.0.0";
+  version = "5.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-vLp874V/awKi2Yr+sH+YcbFij6M9iGGrE4fnMufbP4Q=";
+    hash = "sha256-OLA+/oLCNEzqID/alebQC3rCJ4L6HAtYXNDqLI/z5wI=";
    extension = "zip";
  };

--- a/pkgs/development/python-modules/bc-detect-secrets/default.nix
+++ b/pkgs/development/python-modules/bc-detect-secrets/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "bc-detect-secrets";
-  version = "1.4.26";
+  version = "1.4.27";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "bridgecrewio";
    repo = "detect-secrets";
    rev = "refs/tags/${version}";
-    hash = "sha256-rkyeG0xZZVO7SkfFyxq07c373YElblIUqJpwWc1nF58=";
+    hash = "sha256-iQNMU77nTv6KY9LJb1fiBUVs5LkpX732UpJAYdUWNyc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/beartype/default.nix
+++ b/pkgs/development/python-modules/beartype/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "beartype";
-  version = "0.13.1";
+  version = "0.14.0";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-KQOUeooetgMCZOMBCKpyyxqAXPyQUMD0AUxK7ToXoAs=";
+    hash = "sha256-VG5ujc3aHW2fkG6k6xUYqgHJxfWkQOSVkXstr1PL1Zg=";
  };

  nativeCheckInputs = [
@ -28,6 +28,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Fast runtime type checking for Python";
    homepage = "https://github.com/beartype/beartype";
+    changelog = "https://github.com/beartype/beartype/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ bcdarwin ];
  };
--- a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
+++ b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "bluetooth-auto-recovery";
-  version = "1.1.2";
+  version = "1.2.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-lOtdrNXY9IYMGFdqhX4rM228OAZ2bUEBZKP+gcDGfuM=";
+    hash = "sha256-uPa8iXG++doRMAK83NSnqiqnZSIjdL7zMTkjdRrSjtA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/bpycv/bpycv-test.py
+++ b/pkgs/development/python-modules/bpycv/bpycv-test.py
@ -5,8 +5,11 @@ import bpycv
 import os
 import glob
 import random
+from pathlib import Path

 example_data_dir = os.environ['BPY_EXAMPLE_DATA']
+out_dir = Path(os.environ['out'])
+out_dir.mkdir(parents=True, exist_ok=True)

 models = sorted(glob.glob(os.path.join(example_data_dir, "model", "*", "*.obj")))
 cat_id_to_model_path = dict(enumerate(sorted(models), 1))
@ -19,6 +22,7 @@ bpy.context.scene.render.engine = "CYCLES"
 bpy.context.scene.cycles.samples = 32
 bpy.context.scene.render.resolution_y = 1024
 bpy.context.scene.render.resolution_x = 1024
+bpy.context.view_layer.cycles.denoising_store_passes = False

 # A transparency stage for holding rigid body
 stage = bpycv.add_stage(transparency=True)
@ -69,8 +73,8 @@ for i in range(20):
 # render image, instance annoatation and depth in one line code
 result = bpycv.render_data()

-dataset_dir = "./dataset"
-result.save(dataset_dir=dataset_dir, fname="0", save_blend=True)
-print(f'Save to "{dataset_dir}"')
-print(f'Open "{dataset_dir}/vis/" to see visualize result.')
+
+result.save(dataset_dir=str(out_dir.resolve()), fname="0", save_blend=True)
+print(f'Save to "{out_dir}"')
+print(f'Open "{out_dir}/vis/" to see visualize result.')

--- a/pkgs/development/python-modules/bpycv/default.nix
+++ b/pkgs/development/python-modules/bpycv/default.nix
@ -1,16 +1,21 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, fetchFromGitHub
-, fetchurl
-, writeText
-, blender
-, minexr
+{ stdenv
+, lib
 , beautifulsoup4
-, zcs
-, requests
-, opencv3
+, blender
+, blender-with-packages
 , boxx
+, bpycv
+, buildPythonPackage
+, fetchFromGitHub
+, fetchPypi
+, fetchurl
+, minexr
+, opencv3
+, python3Packages
+, requests
+, runCommand
+, writeText
+, zcs
 }:

 buildPythonPackage rec {
@ -37,27 +42,32 @@ buildPythonPackage rec {
  '';

  # pythonImportsCheck = [ "bpycv" ]; # this import depends on bpy that is only available inside blender
-  nativeCheckInputs = [ blender ];
-  checkPhase = let
-    bpycv_example_data = fetchFromGitHub {
-      owner = "DIYer22";
-      repo = "bpycv_example_data";
-      hash = "sha256-dGb6KvbXTGTu5f4AqhA+i4AwTqBoR5SdXk0vsMEcD3Q=";
-      rev = "6ce0e65c107d572011394da16ffdf851e988dbb4";
-    };
-  in ''
-    TEMPDIR=$(mktemp -d)
-    pushd $TEMPDIR
-      cp -r ${bpycv_example_data} example_data
-      chmod +w -R example_data
-      BPY_EXAMPLE_DATA=${bpycv_example_data} blender -b -P ${./bpycv-test.py}
-    popd
-  '';
+  doCheck = false;
+
+  passthru.tests = {
+    render = runCommand "bpycv-render-test" {
+      BPY_EXAMPLE_DATA = fetchFromGitHub {
+        owner = "DIYer22";
+        repo = "bpycv_example_data";
+        hash = "sha256-dGb6KvbXTGTu5f4AqhA+i4AwTqBoR5SdXk0vsMEcD3Q=";
+        rev = "6ce0e65c107d572011394da16ffdf851e988dbb4";
+      };
+      nativeBuildInputs = [
+        ((blender-with-packages.override {inherit blender python3Packages;}) {
+          packages = [ bpycv ];
+        })
+      ];
+    } ''
+      blender-wrapped -b -P ${./bpycv-test.py}
+    '';
+  };

  meta = with lib; {
    description = "Computer vision utils for Blender";
    homepage = "https://github.com/DIYer22/bpycv";
    license = licenses.mit;
-    maintainers = with maintainers; [ lucasew ];
+    maintainers = [ maintainers.lucasew ];
+    broken = stdenv.isAarch64;
+    inherit (blender.meta) platforms;
  };
 }
--- a/pkgs/development/python-modules/cexprtk/default.nix
+++ b/pkgs/development/python-modules/cexprtk/default.nix
@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "cexprtk";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-c7QXB+oXzkRveiPpNrW/HY8pMtpZx/RtDpJMVE7fY/A=";
+    hash = "sha256-QhftIybufVPO/YbLFycR4qYEAtQMcRPP5jKS6o6dFZg=";
  };

  nativeCheckInputs = [ pytestCheckHook ];
--- a/pkgs/development/python-modules/crc/default.nix
+++ b/pkgs/development/python-modules/crc/default.nix
@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "crc";
+  version = "4.2.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "Nicoretti";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-h/RVMIJX+Lyted0FHNBcKY54EiirSclkBXCpAQSATq8=";
+  };
+
+  nativeBuildInputs = [ poetry-core ];
+
+  pythonImportsCheck = [ "crc" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  disabledTestPaths = [ "test/bench" ];
+
+  meta = with lib; {
+    changelog = "https://github.com/Nicoretti/crc/releases/tag/${version}";
+    description = "Python module for calculating and verifying predefined & custom CRC's";
+    homepage = "https://nicoretti.github.io/crc/";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ jleightcap ];
+  };
+}
--- a/pkgs/development/python-modules/eternalegypt/default.nix
+++ b/pkgs/development/python-modules/eternalegypt/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "eternalegypt";
-  version = "0.0.15";
+  version = "0.0.16";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "amelchio";
    repo = pname;
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-CKiv5gVHaEyO9P5x2FKgpSIm2pUiFptaEQVPZHALASk=";
+    hash = "sha256-ubKepd3yBaoYrIUe5WCt1zd4CjvU7SeftOR+2cBaEf0=";
  };

  propagatedBuildInputs = [
@ -28,11 +28,14 @@ buildPythonPackage rec {
  # Project has no tests
  doCheck = false;

-  pythonImportsCheck = [ "eternalegypt" ];
+  pythonImportsCheck = [
+    "eternalegypt"
+  ];

  meta = with lib; {
    description = "Python API for Netgear LTE modems";
    homepage = "https://github.com/amelchio/eternalegypt";
+    changelog = "https://github.com/amelchio/eternalegypt/releases/tag/v${version}";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/flake8-future-import/default.nix
+++ b/pkgs/development/python-modules/flake8-future-import/default.nix
@ -33,12 +33,21 @@ buildPythonPackage rec {
    ./skip-test.patch
  ];

+  postPatch = ''
+    substituteInPlace "test_flake8_future_import.py" \
+      --replace "'flake8'" "'${lib.getExe flake8}'"
+  '';
+
  propagatedBuildInputs = [ flake8 ];

  nativeCheckInputs = [ six ];

  checkPhase = ''
+    runHook preCheck
+
    ${python.interpreter} -m test_flake8_future_import
+
+    runHook postCheck
  '';

  meta = with lib; {
--- a/pkgs/development/python-modules/fx2/default.nix
+++ b/pkgs/development/python-modules/fx2/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "fx2";
-  version = "0.9";
+  version = "0.11";

  src = fetchFromGitHub {
    owner = "whitequark";
    repo = "libfx2";
    rev = "v${version}";
-    hash = "sha256-Uk+K7ym92JX4fC3PyTNxd0UvBzoNZmtbscBYjSWChuk=";
+    hash = "sha256-uJpXsUMFqJY7mjj1rtfc0XWEfNDxO1xXobgBDGFHnp4=";
  };

  nativeBuildInputs = [ sdcc ];
@ -23,8 +23,8 @@ buildPythonPackage rec {
  propagatedBuildInputs = [ libusb1 crcmod ];

  preBuild = ''
+    make -C firmware
    cd software
-    ${python.pythonForBuild.interpreter} setup.py build_ext
  '';

  preInstall = ''
--- a/pkgs/development/python-modules/globus-sdk/default.nix
+++ b/pkgs/development/python-modules/globus-sdk/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "globus-sdk";
-  version = "3.16.0";
+  version = "3.19.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "globus";
    repo = "globus-sdk-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-zl5+22r0KMqdBKIlBe+8xxgh6h9am34USc1dLy+VGyY=";
+    hash = "sha256-xdzDKzlqQRBrKT/j6PWSgDu33XlVHKsHfv5AgrT6SB8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/invocations/default.nix
+++ b/pkgs/development/python-modules/invocations/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "invocations";
-  version = "3.0.2";
+  version = "3.1.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "pyinvoke";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-sXMxTOi0iCz7Zq0lXkpproUtkId5p/GCqP1TvgqYlME=";
+    hash = "sha256-NlYoikv43oD5+Iz2CeeCGG3Fm648UgA3YZQFOfWSy58=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@ -243,9 +243,9 @@ let

      sha256 =
        if cudaSupport then
-          "sha256-cgsiloW77p4+TKRrYequZ/UwKwfO2jsHKtZ+aA30H7E="
+          "sha256-O6bM7Lc8eaFyO4Xzl5/hvBrbPioI+Yeqx9yNC97fvKk="
        else
-          "sha256-D7WYG3YUaWq+4APYx8WpA191VVtoHG0fth3uEHXOeos=";
+          "sha256-gLMJfJSQIdGGY2Ivx4IgDWg0hc+mxzlqY11CUkSWcjI=";
    };

    buildAttrs = {
--- a/Show more
+++ b/Show more