Merge master into haskell-updates

doc/builders/images/dockertools.section.md

@@ -308,7 +308,44 @@ The parameters relative to the base image have the same synopsis as described in
 
 The `name` argument is the name of the derivation output, which defaults to `fromImage.name`.
 
-## shadowSetup {#ssec-pkgs-dockerTools-shadowSetup}
+## Environment Helpers {#ssec-pkgs-dockerTools-helpers}
+
+Some packages expect certain files to be available globally.
+When building an image from scratch (i.e. without `fromImage`), these files are missing.
+`pkgs.dockerTools` provides some helpers to set up an environment with the necessary files.
+You can include them in `copyToRoot` like this:
+
+```nix
+buildImage {
+  name = "environment-example";
+  copyToRoot = with pkgs.dockerTools; [
+    usrBinEnv
+    binSh
+    caCertificates
+    fakeNss
+  ];
+}
+```
+
+### usrBinEnv {#sssec-pkgs-dockerTools-helpers-usrBinEnv}
+
+This provides the `env` utility at `/usr/bin/env`.
+
+### binSh {#sssec-pkgs-dockerTools-helpers-binSh}
+
+This provides `bashInteractive` at `/bin/sh`.
+
+### caCertificates {#sssec-pkgs-dockerTools-helpers-caCertificates}
+
+This sets up `/etc/ssl/certs/ca-certificates.crt`.
+
+### fakeNss {#sssec-pkgs-dockerTools-helpers-fakeNss}
+
+Provides `/etc/passwd` and `/etc/group` that contain root and nobody.
+Useful when packaging binaries that insist on using nss to look up
+username/groups (like nginx).
+
+### shadowSetup {#ssec-pkgs-dockerTools-shadowSetup}
 
 This constant string is a helper for setting up the base files for managing users and groups, only if such files don't exist already. It is suitable for being used in a [`buildImage` `runAsRoot`](#ex-dockerTools-buildImage-runAsRoot) script for cases like in the example below:
 

lib/modules.nix

@@ -433,7 +433,9 @@ rec {
       # modules recursively. It returns the final list of unique-by-key modules
       filterModules = modulesPath: { disabled, modules }:
         let
-          moduleKey = m: if isString m then toString modulesPath + "/" + m else toString m;
+          moduleKey = m: if isString m && (builtins.substring 0 1 m != "/")
+            then toString modulesPath + "/" + m
+            else toString m;
           disabledKeys = map moduleKey disabled;
           keyFilter = filter (attrs: ! elem attrs.key disabledKeys);
         in map (attrs: attrs.module) (builtins.genericClosure {

lib/tests/modules.sh

@@ -130,6 +130,7 @@ checkConfigOutput '^true$' "$@" ./define-enable.nix ./define-attrsOfSub-foo-enab
 set -- config.enable ./define-enable.nix ./declare-enable.nix
 checkConfigOutput '^true$' "$@"
 checkConfigOutput '^false$' "$@" ./disable-define-enable.nix
+checkConfigOutput '^false$' "$@" ./disable-define-enable-string-path.nix
 checkConfigError "The option .*enable.* does not exist. Definition values:\n\s*- In .*: true" "$@" ./disable-declare-enable.nix
 checkConfigError "attribute .*enable.* in selection path .*config.enable.* not found" "$@" ./disable-define-enable.nix ./disable-declare-enable.nix
 checkConfigError "attribute .*enable.* in selection path .*config.enable.* not found" "$@" ./disable-enable-modules.nix

lib/tests/modules/disable-define-enable-string-path.nix

@@ -0,0 +1,5 @@
+{ lib, ... }:
+
+{
+  disabledModules = [ (toString ./define-enable.nix) ];
+}

maintainers/maintainer-list.nix

@@ -1423,6 +1423,12 @@
     githubId = 35324;
     name = "Badi' Abdul-Wahid";
   };
+  baitinq = {
+    email = "manuelpalenzuelamerino@gmail.com";
+    name = "Baitinq";
+    github = "Baitinq";
+    githubId = 30861839;
+  };
   balodja = {
     email = "balodja@gmail.com";
     github = "balodja";
@@ -8062,11 +8068,11 @@
     name = "Michael Fellinger";
   };
   maralorn = {
-    email = "malte.brandy@maralorn.de";
+    email = "mail@maralorn.de";
     matrix = "@maralorn:maralorn.de";
     github = "maralorn";
     githubId = 1651325;
-    name = "Malte Brandy";
+    name = "maralorn";
   };
   marcweber = {
     email = "marco-oweber@gmx.de";

nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

@@ -436,6 +436,12 @@
           due to upstream dropping support.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>k3s</literal> supports <literal>clusterInit</literal>
+          option, and it is enabled by default, for servers.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.11-notable-changes">

nixos/doc/manual/release-notes/rl-2211.section.md

@@ -152,6 +152,8 @@ Use `configure.packages` instead.
 
 - `k3s` no longer supports docker as runtime due to upstream dropping support.
 
+- `k3s` supports `clusterInit` option, and it is enabled by default, for servers.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Other Notable Changes {#sec-release-22.11-notable-changes}

nixos/modules/services/cluster/k3s/default.nix

@@ -25,7 +25,17 @@ in
     role = mkOption {
       description = lib.mdDoc ''
         Whether k3s should run as a server or agent.
-        Note that the server, by default, also runs as an agent.
+
+        If it's a server:
+
+        - By default it also runs workloads as an agent.
+        - Starts by default as a standalone server using an embedded sqlite datastore.
+        - Configure `clusterInit = true` to switch over to embedded etcd datastore and enable HA mode.
+        - Configure `serverAddr` to join an already-initialized HA cluster.
+
+        If it's an agent:
+
+        - `serverAddr` is required.
       '';
       default = "server";
       type = types.enum [ "server" "agent" ];
@@ -33,15 +43,44 @@ in
 
     serverAddr = mkOption {
       type = types.str;
-      description = lib.mdDoc "The k3s server to connect to. This option only makes sense for an agent.";
+      description = lib.mdDoc ''
+        The k3s server to connect to.
+
+        Servers and agents need to communicate each other. Read
+        [the networking docs](https://rancher.com/docs/k3s/latest/en/installation/installation-requirements/#networking)
+        to know how to configure the firewall.
+      '';
       example = "https://10.0.0.10:6443";
       default = "";
     };
 
+    clusterInit = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Initialize HA cluster using an embedded etcd datastore.
+
+        If this option is `false` and `role` is `server`
+
+        On a server that was using the default embedded sqlite backend,
+        enabling this option will migrate to an embedded etcd DB.
+
+        If an HA cluster using the embedded etcd datastore was already initialized,
+        this option has no effect.
+
+        This option only makes sense in a server that is not connecting to another server.
+
+        If you are configuring an HA cluster with an embedded etcd,
+        the 1st server must have `clusterInit = true`
+        and other servers must connect to it using `serverAddr`.
+      '';
+    };
+
     token = mkOption {
       type = types.str;
       description = lib.mdDoc ''
-        The k3s token to use when connecting to the server. This option only makes sense for an agent.
+        The k3s token to use when connecting to a server.
+
         WARNING: This option will expose store your token unencrypted world-readable in the nix store.
         If this is undesired use the tokenFile option instead.
       '';
@@ -50,7 +89,7 @@ in
 
     tokenFile = mkOption {
       type = types.nullOr types.path;
-      description = lib.mdDoc "File path containing k3s token to use when connecting to the server. This option only makes sense for an agent.";
+      description = lib.mdDoc "File path containing k3s token to use when connecting to the server.";
       default = null;
     };
 
@@ -86,6 +125,14 @@ in
         assertion = cfg.role == "agent" -> cfg.configPath != null || cfg.tokenFile != null || cfg.token != "";
         message = "token or tokenFile or configPath (with 'token' or 'token-file' keys) should be set if role is 'agent'";
       }
+      {
+        assertion = cfg.role == "agent" -> !cfg.disableAgent;
+        message = "disableAgent must be false if role is 'agent'";
+      }
+      {
+        assertion = cfg.role == "agent" -> !cfg.clusterInit;
+        message = "clusterInit must be false if role is 'agent'";
+      }
     ];
 
     environment.systemPackages = [ config.services.k3s.package ];
@@ -111,6 +158,7 @@ in
           [
             "${cfg.package}/bin/k3s ${cfg.role}"
           ]
+          ++ (optional cfg.clusterInit "--cluster-init")
           ++ (optional cfg.disableAgent "--disable-agent")
           ++ (optional (cfg.serverAddr != "") "--server ${cfg.serverAddr}")
           ++ (optional (cfg.token != "") "--token ${cfg.token}")

nixos/modules/services/networking/syncthing.nix

@@ -268,10 +268,10 @@ in {
                   {
                     versioning = {
                       type = "staggered";
+                      fsPath = "/syncthing/backup";
                       params = {
                         cleanInterval = "3600";
                         maxAge = "31536000";
-                        versionsPath = "/syncthing/backup";
                       };
                     };
                   }
@@ -296,6 +296,14 @@ in {
                       See <https://docs.syncthing.net/users/versioning.html>.
                     '';
                   };
+                  fsPath = mkOption {
+                    default = "";
+                    type = either str path;
+                    description = mdDoc ''
+                      Path to the versioning folder.
+                      See <https://docs.syncthing.net/users/versioning.html>.
+                    '';
+                  };
                   params = mkOption {
                     type = attrsOf (either str path);
                     description = mdDoc ''

nixos/modules/services/web-apps/keycloak.nix

@@ -25,6 +25,7 @@ let
     catAttrs
     collect
     splitString
+    hasPrefix
     ;
 
   inherit (builtins)
@@ -312,8 +313,9 @@ in
 
             http-relative-path = mkOption {
               type = str;
-              default = "";
+              default = "/";
               example = "/auth";
+              apply = x: if !(hasPrefix "/") x then "/" + x else x;
               description = ''
                 The path relative to <literal>/</literal> for serving
                 resources.
@@ -658,7 +660,7 @@ in
             '' + ''
               export KEYCLOAK_ADMIN=admin
               export KEYCLOAK_ADMIN_PASSWORD=${cfg.initialAdminPassword}
-              kc.sh start
+              kc.sh start --optimized
             '';
           };
 

nixos/tests/k3s/multi-node.nix

@@ -53,9 +53,10 @@ import ../make-test-python.nix ({ pkgs, ... }:
           enable = true;
           role = "server";
           package = pkgs.k3s;
+          clusterInit = true;
           extraFlags = "--no-deploy coredns,servicelb,traefik,local-storage,metrics-server --pause-image test.local/pause:local --node-ip 192.168.1.1";
         };
-        networking.firewall.allowedTCPPorts = [ 6443 ];
+        networking.firewall.allowedTCPPorts = [ 2379 2380 6443 ];
         networking.firewall.allowedUDPPorts = [ 8472 ];
         networking.firewall.trustedInterfaces = [ "flannel.1" ];
         networking.useDHCP = false;
@@ -65,6 +66,28 @@ import ../make-test-python.nix ({ pkgs, ... }:
         ];
       };
 
+      server2 = { pkgs, ... }: {
+        environment.systemPackages = with pkgs; [ gzip jq ];
+        virtualisation.memorySize = 1536;
+        virtualisation.diskSize = 4096;
+
+        services.k3s = {
+          inherit tokenFile;
+          enable = true;
+          serverAddr = "https://192.168.1.1:6443";
+          clusterInit = false;
+          extraFlags = "--no-deploy coredns,servicelb,traefik,local-storage,metrics-server --pause-image test.local/pause:local --node-ip 192.168.1.3";
+        };
+        networking.firewall.allowedTCPPorts = [ 2379 2380 6443 ];
+        networking.firewall.allowedUDPPorts = [ 8472 ];
+        networking.firewall.trustedInterfaces = [ "flannel.1" ];
+        networking.useDHCP = false;
+        networking.defaultGateway = "192.168.1.3";
+        networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [
+          { address = "192.168.1.3"; prefixLength = 24; }
+        ];
+      };
+
       agent = { pkgs, ... }: {
         virtualisation.memorySize = 1024;
         virtualisation.diskSize = 2048;
@@ -72,7 +95,7 @@ import ../make-test-python.nix ({ pkgs, ... }:
           inherit tokenFile;
           enable = true;
           role = "agent";
-          serverAddr = "https://192.168.1.1:6443";
+          serverAddr = "https://192.168.1.3:6443";
           extraFlags = "--pause-image test.local/pause:local --node-ip 192.168.1.2";
         };
         networking.firewall.allowedTCPPorts = [ 6443 ];
@@ -91,9 +114,9 @@ import ../make-test-python.nix ({ pkgs, ... }:
     };
 
     testScript = ''
-      start_all()
-      machines = [server, agent]
+      machines = [server, server2, agent]
       for m in machines:
+          m.start()
           m.wait_for_unit("k3s")
 
       # wait for the agent to show up

pkgs/applications/audio/amberol/default.nix

@@ -19,20 +19,20 @@
 
 stdenv.mkDerivation rec {
   pname = "amberol";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = pname;
     rev = version;
-    hash = "sha256-/kZYzUzycHKre6/dvZgeqXu6mrkblftV51Z7866fZVY=";
+    hash = "sha256-UZFOQw9eXSyCey4YQ4pWV91BIo+5tFw1N8es5H03+fc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-1+RWL9MD6aX+zI2rtQUQCqemCephLKGEAf5xNCb+jo4=";
+    hash = "sha256-ebo718+HAZFd7Pjy06jAzmaLdjR3o4Hn0xEeO7yiIC0=";
   };
 
   postPatch = ''

pkgs/applications/audio/mympd/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mympd";
-  version = "9.5.2";
+  version = "9.5.3";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${version}";
-    sha256 = "sha256-WmGaZXITvrp7ml7s7FPyp3Q3072KU/P6UombBj99fX0=";
+    sha256 = "sha256-0plbOBTrEOjfVbyfrQ8mNByJb6XygIPTrwGfY6+0DHo=";
   };
 
   nativeBuildInputs = [

pkgs/applications/blockchains/lnd/default.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.15.0-beta";
+  version = "0.15.1-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    sha256 = "sha256-v8nLsnd6dus+og75U9VIO1K5IuyNh+VYdQfbfbYeox0=";
+    sha256 = "sha256-E1RxFy7eRCTnzTg2B0llRt+r41K6V4VQH7Edh1As4cY=";
   };
 
-  vendorSha256 = "sha256-fx3WsyLyES+ezJGDe3SjFTeGlPMmqKEtWlYGkWpxODc=";
+  vendorSha256 = "sha256-e72HIsS1fftJEOvjr1RQMo3+gjlBxXPHq2olGWfurJk=";
 
   subPackages = [ "cmd/lncli" "cmd/lnd" ];
 

pkgs/applications/blockchains/nearcore/default.nix

@@ -4,7 +4,7 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "nearcore";
-  version = "1.28.0";
+  version = "1.28.1";
 
   # https://github.com/near/nearcore/tags
   src = fetchFromGitHub {
@@ -13,10 +13,10 @@ rustPlatform.buildRustPackage rec {
     # there is also a branch for this version number, so we need to be explicit
     rev = "refs/tags/${version}";
 
-    sha256 = "sha256-DRVlD74XTYgy3GeUd/7OIl2aie8nEJLmrmmkwPRkrA8=";
+    sha256 = "sha256-lAbVcmr8StAZAII++21xiBd4tRcdprefvcGzPLIjl74=";
   };
 
-  cargoSha256 = "sha256-hTqje17EdVkgqReuLnizaK3cBJuqXJXC6x5NuoKJLbs=";
+  cargoSha256 = "sha256-1aoL5fbKZ4XZ1ELVDWNDFHDL2FyNuoX/DVb0h8RWBxI=";
   cargoPatches = [ ./0001-make-near-test-contracts-optional.patch ];
 
   postPatch = ''

pkgs/applications/editors/helix/default.nix

@@ -2,17 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "helix";
-  version = "22.05";
+  version = "22.08";
 
   # This release tarball includes source code for the tree-sitter grammars,
   # which is not ordinarily part of the repository.
   src = fetchzip {
     url = "https://github.com/helix-editor/helix/releases/download/${version}/helix-${version}-source.tar.xz";
-    sha256 = "sha256-MVHfj9iVC8rFGFU+kpRcH0qX9kQ+scFsRgSw7suC5RU=";
+    sha256 = "sha256-PSTsPt+OQhYQ/m/hm5PgHWrQXtbooT+tG0767KyiJJw=";
     stripRoot = false;
   };
 
-  cargoSha256 = "sha256-9jkSZ2yW0Pca1ats7Mgv7HprpjoZWLpsbuwMjYOKlmk=";
+  cargoSha256 = "sha256-5Ap/PU8IjAPKKiFxzHqWQMspWkbTYIwTNiSMWIceUPc=";
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/applications/editors/oed/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "oed";
-  version = "6.7";
+  version = "7.1";
 
   src = fetchFromGitHub {
     owner = "ibara";
     repo = "oed";
     rev = "oed-${version}";
-    hash = "sha256-Z8B1RIFve3UPj+9G/WJX0BNc2ynG/qtoGfoesarYGz8=";
+    hash = "sha256-ySfw8Xo/dCBd3K3dxWsdPz8gQ+KeXyReIlUo4q5SFCc=";
   };
 
   postPatch = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''

pkgs/applications/graphics/digikam/default.nix

@@ -56,11 +56,11 @@
 
 mkDerivation rec {
   pname   = "digikam";
-  version = "7.7.0";
+  version = "7.8.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${version}/digiKam-${version}.tar.xz";
-    sha256 = "sha256-wMbdLqigdRSsvyRi86VFGOfoCZszN/iBM2Foz/Y9dxw=";
+    sha256 = "sha256-sIV3sLFe+ZhDaVcIqiwOmNVHMD2Fvio7OZBUhPLKts4=";
   };
 
   nativeBuildInputs = [ cmake doxygen extra-cmake-modules kdoctools wrapGAppsHook ];

pkgs/applications/graphics/epick/default.nix

@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "epick";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "vv9k";
     repo = pname;
     rev = version;
-    sha256 = "sha256-BrJkG1OYpkAfBYUfLn/CNDBc0n1tW5OLnpobkPABQow=";
+    sha256 = "sha256-LJg68YY8PqKF7Thn181XRFsCNJA0DkYKVFbIR1UkxGU=";
   };
 
-  cargoSha256 = "sha256-hFay+XL2oqA7SC+I3wlrzhUmUitO2vbeqfoArU9Jsp4=";
+  cargoSha256 = "sha256-j6tim6dS++ECfBMdyQlS3CqN+Tr5ozHqyZ1bPKhDKV0=";
 
   nativeBuildInputs = lib.optional stdenv.isLinux python3;
 

pkgs/applications/graphics/krita/default.nix

@@ -1,7 +1,7 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix (args // {
-  version = "5.0.8";
+  version = "5.1.0";
   kde-channel = "stable";
-  sha256 = "sha256:7R0fpQc+4MQVDh/enhCTgpgOqU0y5YRShrv/ILa/XkU=";
+  sha256 = "sha256-mjs/WFhIC3CRvUhEmSbmE1OOqKTcBiSchg/+PaWs2II=";
 })

pkgs/applications/graphics/krita/generic.nix

@@ -3,7 +3,7 @@
 , kguiaddons, ki18n, kitemmodels, kitemviews, kwindowsystem
 , kio, kcrash, breeze-icons
 , boost, libraw, fftw, eigen, exiv2, libheif, lcms2, gsl, openexr, giflib
-, openjpeg, opencolorio_1, vc, poppler, curl, ilmbase, libmypaint, libwebp
+, openjpeg, opencolorio_1, xsimd, poppler, curl, ilmbase, libmypaint, libwebp
 , qtmultimedia, qtx11extras, quazip
 , python3Packages
 
@@ -32,7 +32,8 @@ mkDerivation rec {
     openjpeg opencolorio_1 poppler curl ilmbase libmypaint libwebp
     qtmultimedia qtx11extras quazip
     python3Packages.pyqt5
-  ] ++ lib.optional stdenv.hostPlatform.isx86 vc;
+    xsimd
+  ];
 
   NIX_CFLAGS_COMPILE = [ "-I${ilmbase.dev}/include/OpenEXR" ]
     ++ lib.optional stdenv.cc.isGNU "-Wno-deprecated-copy";

pkgs/applications/graphics/openscad/default.nix

@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , qtbase
 , qtmultimedia
 , qscintilla
@@ -42,6 +43,19 @@ mkDerivation rec {
     sha256 = "sha256-2tOLqpFt5klFPxHNONnHVzBKEFWn4+ufx/MU+eYbliA=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-0496.patch";
+      url = "https://github.com/openscad/openscad/commit/00a4692989c4e2f191525f73f24ad8727bacdf41.patch";
+      sha256 = "sha256-q3SLj2b5aM/IQ8vIDj4iVcwCajgyJ5juNV/KN35uxfI=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-0497.patch";
+      url = "https://github.com/openscad/openscad/commit/84addf3c1efbd51d8ff424b7da276400bbfa1a4b.patch";
+      sha256 = "sha256-KNEVu10E2d4G2x+FJcuHo2tjD8ygMRuhUcW9NbN98bM=";
+    })
+  ];
+
   nativeBuildInputs = [ bison flex pkg-config gettext qmake ];
 
   buildInputs = [

pkgs/applications/misc/anytype/default.nix

@@ -2,13 +2,13 @@
 
 let
   pname = "anytype";
-  version = "0.27.0";
+  version = "0.28.0";
   name = "Anytype-${version}";
   nameExecutable = pname;
   src = fetchurl {
     url = "https://at9412003.fra1.digitaloceanspaces.com/Anytype-${version}.AppImage";
     name = "Anytype-${version}.AppImage";
-    sha256 = "sha256-AcnXhilnr5ay45S30eNSDuN+Ed1TDv/Rh523LsUf3iM=";
+    sha256 = "sha256-tYeVz10saTJBf6DDGIVSd4IkSREDJFi/am/kg/An02E=";
   };
   appimageContents = appimageTools.extractType2 { inherit name src; };
 in

pkgs/applications/misc/dbeaver/default.nix

@@ -23,16 +23,16 @@
   inherit maven; # use overridden maven version (see dbeaver's entry in all-packages.nix)
 }) rec {
   pname = "dbeaver";
-  version = "22.1.4"; # When updating also update mvnSha256
+  version = "22.1.5"; # When updating also update mvnSha256
 
   src = fetchFromGitHub {
     owner = "dbeaver";
     repo = "dbeaver";
     rev = version;
-    sha256 = "sha256-5s2SFquB0i5X2deBO0FStudReB4wGhQkhR39PHPBEAM=";
+    sha256 = "sha256-KMrevQ37c84UD46XygKa0Q06qacJianoYqfe4j4MfEI=";
   };
 
-  mvnSha256 = "YIeKSL5scU8NxEIf+jK1g9cdFDOBVh14ruKMqUuz1Ts=";
+  mvnSha256 = "KVE+AYYEWN9bjAWop4mpiPq8yU3GdSGqOTmLG4pdflQ=";
   mvnParameters = "-P desktop,all-platforms";
 
   nativeBuildInputs = [

pkgs/applications/misc/gnome-frog/default.nix

@@ -51,11 +51,11 @@ python3Packages.buildPythonApplication rec {
     pkg-config
     glib
     wrapGAppsHook4
+    gobject-introspection
   ];
 
   buildInputs = [
     librsvg
-    gobject-introspection
     libnotify
     libadwaita
     libportal

pkgs/applications/misc/hugo/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.102.1";
+  version = "0.102.2";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lCdFxUlqGRQ5IMlhPhcJ5Ma35q75LnlcBNW1XUSWb1I=";
+    sha256 = "sha256-mAkdx42JaYSSpNLssBNkX45V3VniVKVbPt2SQ/QaXmY=";
   };
 
-  vendorSha256 = "sha256-y9bZ9EoB/n300oXO+PT4d8vSVMJC3HYyMRNf6eNhVik=";
+  vendorSha256 = "sha256-oWOu8vmxe0a/nIgkjpx7XrB49rjcuqnnpuOMtI9bLfY=";
 
   doCheck = false;
 

pkgs/applications/misc/koreader/default.nix

@@ -13,12 +13,12 @@
 let font-droid = nerdfonts.override { fonts = [ "DroidSansMono" ]; };
 in stdenv.mkDerivation rec {
   pname = "koreader";
-  version = "2022.07";
+  version = "2022.08";
 
   src = fetchurl {
     url =
       "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
-    sha256 = "sha256-8WQFfmKgu6XPqWQsma656RWpNwNkSXmHOHs2cyVVqJU=";
+    sha256 = "sha256-+JBJNJTAnC5gpuo8cehfe/3YwGIW5iFA8bZ8nfz9qsk=";
   };
 
   sourceRoot = ".";

pkgs/applications/misc/sigal/copytree-permissions.patch

@@ -0,0 +1,16 @@
+diff -Nurp sigal-2.3.orig/sigal/writer.py sigal-2.3/sigal/writer.py
+--- sigal-2.3.orig/sigal/writer.py	2022-08-08 19:43:10.934707194 +0200
++++ sigal-2.3/sigal/writer.py	2022-08-08 19:44:57.542382532 +0200
+@@ -103,7 +103,11 @@ class AbstractWriter:
+             os.path.join(THEMES_PATH, 'default', 'static'),
+             os.path.join(self.theme, 'static'),
+         ):
+-            shutil.copytree(static_path, self.theme_path, dirs_exist_ok=True)
++            # https://stackoverflow.com/a/17022146/4935114
++            orig_copystat = shutil.copystat
++            shutil.copystat = lambda x, y: x
++            shutil.copytree(static_path, self.theme_path, dirs_exist_ok=True, copy_function=shutil.copy)
++            shutil.copystat = orig_copystat
+ 
+         if self.settings["user_css"]:
+             if not os.path.exists(self.settings["user_css"]):

pkgs/applications/misc/sigal/default.nix

@@ -14,6 +14,8 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-4Zsb/OBtU/jV0gThEYe8bcrb+6hW+hnzQS19q1H409Q=";
   };
 
+  patches = [ ./copytree-permissions.patch ];
+
   propagatedBuildInputs = with python3.pkgs; [
     # install_requires
     jinja2

pkgs/applications/misc/styx/default.nix

@@ -1,16 +1,16 @@
 { lib, stdenv, fetchFromGitHub, caddy, asciidoctor
 , file, lessc, sass, multimarkdown, linkchecker
-, perlPackages, python27 }:
+, perlPackages, python3Packages }:
 
 stdenv.mkDerivation rec {
   pname = "styx";
-  version = "0.7.2";
+  version = "0.7.5";
 
   src = fetchFromGitHub {
     owner  = "styx-static";
     repo   = "styx";
-    rev    = "0f0a878156eac416620a177cc030fa9f2f69b1b8";
-    sha256 = "0ig456j1s17w4zhhcmkrskpy6n7061v5f2isa3qhipmn0gwb91af";
+    rev    = "v${version}";
+    hash = "sha256-f6iA/nHpKnm3BALoQq8SzdcSzJLCFSferEf69SpgD2Y=";
   };
 
   server = "${caddy}/bin/caddy";
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     asciidoctor
     multimarkdown
     perlPackages.ImageExifTool
-    (python27.withPackages (ps: [ ps.parsimonious ]))
+    python3Packages.parsimonious
   ];
 
   installPhase = ''

pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix

@@ -87,7 +87,7 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "11.5.1";
+  version = "11.5.2";
 
   lang = "en-US";
 
@@ -98,7 +98,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      sha256 = "sha256-LgzvptQoTHGngW4xDZNfm5teSjpAjcUzMKDbBHRInoo=";
+      sha256 = "sha256-kM3OOFTpEU7nIyqqdGcqLZ86QLb6isM5cfWG7jo891o=";
     };
 
     i686-linux = fetchurl {
@@ -107,7 +107,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      sha256 = "sha256-J/ka/Qvu2UC5KTfatkWq0jc6bHTazA20vL9tz1sK/Rg=";
+      sha256 = "sha256-62dGoIqaCrSzsDjvt8c5hEAwOSTFst9PCpvMzveBukY=";
     };
   };
 in

pkgs/applications/networking/cluster/fluxctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fluxctl";
-  version = "1.25.3";
+  version = "1.25.4";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = "flux";
     rev = version;
-    sha256 = "sha256-tV6rPpZW3HWxUBUdDkYOP6gIc/ZD+CMmT7FVYXiLp5A=";
+    sha256 = "sha256-rKZ0fI9UN4oq6gfDMNR2+kCazlDexE1+UVzQ3xgkSA8=";
   };
 
-  vendorSha256 = "sha256-wApm7IXblhQiV7VpBXZndJgFpQmq2WEFjCEG1qd+Nlo=";
+  vendorSha256 = "sha256-6Trk49Vo3oMjSaHRDm2v+elPDHwdn2D3Z6i4UYcx0IQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/cluster/glooctl/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.12.9";
+  version = "1.12.10";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-FSZTonoMojBsp+6K4gID2X92wcOE009hTPNqONxRbps=";
+    hash = "sha256-ez98npQDkRmtE+Bh9O/bAOePwMQCvc0UZRcw5R2hAPY=";
   };
 
   subPackages = [ "projects/gloo/cli/cmd" ];

pkgs/applications/networking/cluster/kubeone/default.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "kubeone";
-  version = "1.4.7";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "kubermatic";
     repo = "kubeone";
     rev = "v${version}";
-    sha256 = "sha256-SgberbjqIf+5bfE+gM7+lxl25aQVs2tJBNrPgkzowJ4=";
+    sha256 = "sha256-GC51gKAwurrsm8/zkYpSs7bnT55kpctsTpN6ZtlYxHk=";
   };
 
-  vendorSha256 = "sha256-kI5i1us3Ooh603HOz9Y+HlfPUy/1J8z89/jvKEenpLw=";
+  vendorSha256 = "sha256-w/uLR7wi28Ub7Nouxxg39NlD1OzyIE2oEP4D88Xbwu0=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/applications/networking/cluster/nomad/1.2.nix

@@ -4,7 +4,7 @@
 
 callPackage ./generic.nix {
   inherit buildGoModule;
-  version = "1.2.11";
-  sha256 = "sha256-mBaqTiPCPNjhdBKv4ydlNuJxGwFCcJTj4khaOJs9LQM=";
-  vendorSha256 = "sha256-2Draoydjsu15GK1QMHiZCB9ldTrAb0FwhO7MUH3s1Q8=";
+  version = "1.2.12";
+  sha256 = "sha256-PdMo96/foN7rSNvMOQ16N3advy+h0GX7LYtfl23xRfs=";
+  vendorSha256 = "sha256-fmqhaM3yK2ThiD+qwQTr+d5FqhZWzkwcGTSPdXNNFTU=";
 }

pkgs/applications/networking/cluster/nomad/1.3.nix

@@ -4,7 +4,7 @@
 
 callPackage ./generic.nix {
   inherit buildGoModule;
-  version = "1.3.4";
-  sha256 = "sha256-NeBZVCpylP16dPi68unk3H3/V6gWO/SvJRmjgwwwVts=";
-  vendorSha256 = "sha256-XIHtAB0js55mbVuTTWdLW5BMhQjd6/GUbcBk8DEYZg8=";
+  version = "1.3.5";
+  sha256 = "sha256-WKS7EfZxysy/oyq1fa8rKvmfgHRiB7adSVhALZNFYgo=";
+  vendorSha256 = "sha256-byc6wAxpqhxlN3kyHyFQeBS9/oIjHeoz6ldYskizgaI=";
 }

pkgs/applications/networking/instant-messengers/alfaview/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alfaview";
-  version = "8.51.0";
+  version = "8.52.0";
 
   src = fetchurl {
     url = "https://production-alfaview-assets.alfaview.com/stable/linux/${pname}_${version}.deb";
-    sha256 = "sha256-rnzYTQpAX1OSBnVfnFsamd9i9Zpab4mZwlxot0CakgY=";
+    sha256 = "sha256-Taw/qMrqgxFWmRTSed8xINDBGTWx7kteN637Fjrzn44=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -3,7 +3,7 @@ let
   versions = if stdenv.isLinux then {
     stable = "0.0.19";
     ptb = "0.0.29";
-    canary = "0.0.136";
+    canary = "0.0.137";
   } else {
     stable = "0.0.264";
     ptb = "0.0.59";
@@ -22,7 +22,7 @@ let
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        sha256 = "sha256-OrGg4jXziesHBhQORxREN/wq776RgNGaTyjJNV4pSAU=";
+        sha256 = "sha256-dreKO2yBDP547VYuJziBhC2sLdpbM2fcK5bxeds0zUQ=";
       };
     };
     aarch64-darwin = {

pkgs/applications/networking/instant-messengers/element/pin.json

@@ -1,7 +1,7 @@
 {
-  "version": "1.11.3",
-  "desktopSrcHash": "DJqnMEN7KlRIGefMcZCp27xLnPEoSR8Ml5sN5JfqNSM=",
-  "desktopYarnHash": "15wa3ggw1zcc17lfhzig5qw1bpiph7qd6h53qc5nahmfan4jv06a",
-  "webSrcHash": "D95eVWTAvpStOZK0cjP2V8k1ZTnkGLsA0/woVGqDKEI=",
-  "webYarnHash": "1i0djpnn545n83nmm0hm752b66ai1kh3irkfpvw98300c6q1m7fx"
+  "version": "1.11.4",
+  "desktopSrcHash": "lIyx1gpPkuOGzHTbkHKNiGsVKEkKUIz/8sj/KZ9XK9o=",
+  "desktopYarnHash": "0m0zzq2wbk7h7anjmj586089j2qgsd5cj99rmi2hmsmssq63fmwk",
+  "webSrcHash": "bZ5SKydrQE+qLQEZ5qS7F1RC33nHZneUd8OwrV1H2T4=",
+  "webYarnHash": "1yji94xcigz54bbhvssj2pgncw9fgal7mzw9h9bfwmny0pjh8c4p"
 }

pkgs/applications/networking/instant-messengers/session-desktop/default.nix

@@ -8,12 +8,12 @@
 }:
 
 let
-  version = "1.8.6";
-  pname = "session-desktop-appimage";
+  version = "1.9.1";
+  pname = "session-desktop";
 
   src = fetchurl {
     url = "https://github.com/oxen-io/session-desktop/releases/download/v${version}/session-desktop-linux-x86_64-${version}.AppImage";
-    sha256 = "h7uEdxBuqPNWGFp5wWWRI9VsK3HYOtLVgj7rIbeO9kY=";
+    sha256 = "sha256-Zc3btkvN4ic47IGigeFJGx4dwbM+b7iuIOxpmcWmrRQ=";
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;
@@ -33,7 +33,7 @@ stdenvNoCC.mkDerivation {
       name = "Session";
       desktopName = "Session";
       comment = "Onion routing based messenger";
-      exec = "${appimage}/bin/session-desktop-appimage-${version}";
+      exec = "${appimage}/bin/session-desktop-${version}";
       icon = "${appimage-contents}/session-desktop.png";
       terminal = false;
       type = "Application";
@@ -44,10 +44,12 @@ stdenvNoCC.mkDerivation {
   installPhase = ''
     runHook preInstall
 
+    mv bin/session-desktop-${version} bin/session-desktop
+
     mkdir -p $out/
     cp -r bin $out/bin
 
-    wrapProgram $out/bin/session-desktop-appimage-${version} \
+    wrapProgram $out/bin/session-desktop \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
 
     runHook postInstall

pkgs/applications/networking/instant-messengers/webex/default.nix

@@ -54,11 +54,11 @@
 
 stdenv.mkDerivation rec {
   pname = "webex";
-  version = "42.8.0.22907";
+  version = "42.10.0.23251";
 
   src = fetchurl {
-    url = "https://binaries.webex.com/WebexDesktop-Ubuntu-Blue/20220712081040/Webex_ubuntu.7z";
-    sha256 = "b83950cdcf978a3beda93de27b25b70554fc82fcf072a5a7ea858d2ce0d176ac";
+    url = "https://binaries.webex.com/WebexDesktop-Ubuntu-Blue/20220815132636/Webex_ubuntu.7z";
+    sha256 = "a30002585194a7cb01985184031ca6250f4f648590715376aa6f164bce8ed898";
   };
 
   buildInputs = [

pkgs/applications/office/trilium/default.nix

@@ -10,13 +10,13 @@ let
     maintainers = with maintainers; [ fliegendewurst ];
   };
 
-  version = "0.54.2";
+  version = "0.54.3";
 
   desktopSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-  desktopSource.sha256 = "15wbag2hk5pa6ds56ikxn9rj405jgbg6w1y896vl60sa02lm20df";
+  desktopSource.sha256 = "1r7gzvcgdy8i5z5l8z4xw6s44mplr6h1pnpp19di953zmywbdi0f";
 
   serverSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-  serverSource.sha256 = "03z7z0jr1s132f10lagj786fr198l2xvpr72x2325brqlny5fzng";
+  serverSource.sha256 = "1c3mcga87ifdlgxdhsgxndmqqkjl2glxilyf702wf1bpscsirc4z";
 
 in {
 

pkgs/applications/science/logic/lean/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lean";
-  version = "3.47.0";
+  version = "3.48.0";
 
   src = fetchFromGitHub {
     owner  = "leanprover-community";
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     # from. this is then used to check whether an olean file should be
     # rebuilt. don't use a tag as rev because this will get replaced into
     # src/githash.h.in in preConfigure.
-    rev    = "4f9b974353ea684c98ec938f91f3a526218503ed";
-    sha256 = "sha256-e/MnyYtkBLVU2MHGHhyAnYRFpVDhrykbKDphhGz48OE=";
+    rev    = "283f6ed8083ab4dd7c36300f31816c5cb793f2f7";
+    sha256 = "sha256-0Ogv/24KNp1ZBDqiYTsGv5vDKD4fJBtoX7LWLu4QZe0=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/version-management/git-and-tools/delta/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "delta";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "dandavison";
     repo = pname;
     rev = version;
-    sha256 = "sha256-5h4epV3RORZiynW1fkFLImqPunC3PZ/YzLiSrzescww=";
+    sha256 = "sha256-hB8qpVXsAVJvtrdTnbPYcL9K4gL2nkZLo6vunjOP/7o=";
   };
 
-  cargoSha256 = "sha256-4dPTcrT8Gx3WfT0sauqnCSmcGE9LrgIqgHrY5l503ZA=";
+  cargoSha256 = "sha256-19ZGWM8vPbIEYaCxrAZ2HWgSqbeLu3hEb8eLL4a7fAI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -29,6 +29,7 @@ rustPlatform.buildRustPackage rec {
   postInstall = ''
     installShellCompletion --bash --name delta.bash etc/completion/completion.bash
     installShellCompletion --zsh --name _delta etc/completion/completion.zsh
+    installShellCompletion --fish --name delta.fish etc/completion/completion.fish
   '';
 
   meta = with lib; {

pkgs/applications/video/mpv/scripts/mpvacious.nix

@@ -8,28 +8,31 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mpvacious";
-  version = "0.15";
+  version = "0.18";
 
   src = fetchFromGitHub {
     owner = "Ajatt-Tools";
     repo = "mpvacious";
     rev = "v${version}";
-    sha256 = "1lxlgbjk4x3skg5s7kkr9llcdlmpmabfrcslwhhz5f4j3bq7498w";
+    sha256 = "sha256-FiYEpZVaeJQVSXa9obFYSKNVASJolOBm5D3faOlCzNY=";
   };
 
   postPatch = ''
-    substituteInPlace subs2srs.lua \
-      --replace "'curl'" "'${curl}/bin/curl'" \
-      --replace "'wl-copy'" "'${wl-clipboard}/bin/wl-copy'" \
-      --replace "xclip" "${xclip}/bin/xclip"
+    substituteInPlace utils/forvo.lua \
+      --replace "'curl" "'${curl}/bin/curl"
+    substituteInPlace platform/nix.lua \
+      --replace "'curl" "'${curl}/bin/curl" \
+      --replace "'wl-copy" "'${wl-clipboard}/bin/wl-copy" \
+      --replace "'xclip" "'${xclip}/bin/xclip"
   '';
 
   dontBuild = true;
 
   installPhase = ''
     runHook preInstall
-    mkdir -p $out/share/mpv/scripts/mpvacious
-    cp *.lua $out/share/mpv/scripts/mpvacious
+    rm -r .github
+    mkdir -p $out/share/mpv/scripts
+    cp -r . $out/share/mpv/scripts/mpvacious
     runHook postInstall
   '';
 

pkgs/applications/virtualization/docker-slim/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-slim";
-  version = "1.37.6";
+  version = "1.38.0";
 
   src = fetchFromGitHub {
     owner = "docker-slim";
     repo = "docker-slim";
     rev = version;
-    sha256 = "sha256-Jzi6JC6DRklZhNqmFx6eHx6qR8/fb/JuSpgwtPThcc4=";
+    sha256 = "sha256-UDEM7KCTkx+9GTkC8LSkcf4u6SozI3yYrdDwAdjeiLg=";
   };
 
   vendorSha256 = null;

pkgs/build-support/docker/default.nix

@@ -792,6 +792,16 @@ rec {
     ln -s ${bashInteractive}/bin/bash $out/bin/sh
   '';
 
+  # This provides the ca bundle in common locations
+  caCertificates = runCommand "ca-certificates" { } ''
+    # Old NixOS compatibility.
+    ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs/ca-bundle.crt
+    # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
+    ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs/ca-certificates.crt
+    # CentOS/Fedora compatibility.
+    ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/etc/pki/tls/certs/ca-bundle.crt
+  '';
+
   # Build an image and populate its nix database with the provided
   # contents. The main purpose is to be able to use nix commands in
   # the container.

pkgs/data/fonts/sarasa-gothic/default.nix

@@ -1,14 +1,14 @@
 { lib, fetchurl, libarchive }:
 
 let
-  version = "0.36.8";
+  version = "0.37.0";
 in fetchurl {
   name = "sarasa-gothic-${version}";
 
   # Use the 'ttc' files here for a smaller closure size.
   # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
   url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
-  sha256 = "sha256-lKrpaTVYmV3wr1Uj5Yqj1p1t0CYF0ApX7j+QFNfpdz0=";
+  sha256 = "sha256-R1vU17PSfOe2w9PutA7zYrNsa4mejbXqWlWQVV5KXqs=";
 
   recursiveHash = true;
   downloadToTemp = true;

pkgs/development/compilers/fennel/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fennel";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromSourcehut {
     owner = "~technomancy";
     repo = pname;
     rev = version;
-    sha256 = "sha256-3Pfl/KNwuGCkZjG/FlF6K2IQHwJQbWsCBmJpLizr1ng=";
+    sha256 = "sha256-TXmqvhT7Ab+S0UdLgl4xWrVvE//eCbu6qNnoxB7smE4=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/development/coq-modules/gaia/default.nix

@@ -7,11 +7,12 @@ with lib; mkCoqDerivation {
   release."1.12".sha256 = "sha256:0c6cim4x6f9944g8v0cp0lxs244lrhb04ms4y2s6y1wh321zj5mi";
   release."1.13".sha256 = "sha256:0i8ix2rbw10v34bi0yrx0z89ng96ydqbxm8rv2rnfgy4d1b27x6q";
   release."1.14".sha256 = "sha256-wgeQC0fIN3PSmRY1K6/KTy+rJmqqxdo3Bhsz1vjVAes=";
+  release."1.15".sha256 = "sha256:04zchnkvaq2mzpcilpspn5l947689gj3m0w20m0nd7w4drvlahnw";
   releaseRev = (v: "v${v}");
 
   inherit version;
   defaultVersion = with versions; switch [ coq.version mathcomp.version ] [
-    { cases = [ (range "8.10" "8.15") (isGe "1.12.0") ]; out = "1.14"; }
+    { cases = [ (range "8.10" "8.16") (isGe "1.12.0") ]; out = "1.15"; }
     { cases = [ (range "8.10" "8.12") "1.11.0" ]; out = "1.11"; }
   ] null;
 

pkgs/development/coq-modules/hierarchy-builder/default.nix

@@ -5,11 +5,12 @@ with lib; let hb = mkCoqDerivation {
   owner = "math-comp";
   inherit version;
   defaultVersion = with versions; switch coq.coq-version [
-    { case = range "8.15" "8.16"; out = "1.2.1"; }
+    { case = range "8.15" "8.16"; out = "1.3.0"; }
     { case = range "8.13" "8.14"; out = "1.2.0"; }
     { case = range "8.12" "8.13"; out = "1.1.0"; }
     { case = isEq "8.11";         out = "0.10.0"; }
   ] null;
+  release."1.3.0".sha256  = "17k7rlxdx43qda6i1yafpgc64na8br285cb0mbxy5wryafcdrkrc";
   release."1.2.1".sha256  = "sha256-pQYZJ34YzvdlRSGLwsrYgPdz3p/l5f+KhJjkYT08Mj0=";
   release."1.2.0".sha256  = "0sk01rvvk652d86aibc8rik2m8iz7jn6mw9hh6xkbxlsvh50719d";
   release."1.1.0".sha256  = "sha256-spno5ty4kU4WWiOfzoqbXF8lWlNSlySWcRReR3zE/4Q=";

pkgs/development/coq-modules/mathcomp-analysis/default.nix

@@ -8,6 +8,9 @@ let mca = mkCoqDerivation {
   pname = "analysis";
   owner = "math-comp";
 
+  release."0.5.3".sha256 = "sha256-1NjFsi5TITF8ZWx1NyppRmi8g6YaoUtTdS9bU/sUe5k=";
+  release."0.5.2".sha256 = "0yx5p9zyl8jv1vg7rgkyq8dqzkdnkqv969mi62whmhkvxbavgzbw";
+  release."0.5.1".sha256 = "1hnzqb1gxf88wgj2n1b0f2xm6sxg9j0735zdsv6j12hlvx5lwk68";
   release."0.3.13".sha256 = "sha256-Yaztew79KWRC933kGFOAUIIoqukaZOdNOdw4XszR1Hg=";
   release."0.3.10".sha256 = "sha256-FBH2c8QRibq5Ycw/ieB8mZl0fDiPrYdIzZ6W/A3pIhI=";
   release."0.3.9".sha256 = "sha256-uUU9diBwUqBrNRLiDc0kz0CGkwTZCUmigPwLbpDOeg4=";
@@ -19,12 +22,15 @@ let mca = mkCoqDerivation {
 
   inherit version;
   defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
-      { cases = [ (isGe "8.13") (isGe "1.12.0") ];      out = "0.3.13"; }
-      { cases = [ (range "8.11" "8.14") (isGe "1.12.0") ];      out = "0.3.10"; }
-      { cases = [ (range "8.11" "8.13") "1.11.0" ];             out = "0.3.4"; }
-      { cases = [ (range "8.10" "8.12") "1.11.0" ];             out = "0.3.3"; }
-      { cases = [ (range "8.10" "8.11") "1.11.0" ];             out = "0.3.1"; }
-      { cases = [ (range "8.8"  "8.11") (range "1.8" "1.10") ]; out = "0.2.3"; }
+      { cases = [ (isGe "8.14") (isGe "1.13.0") ];               out = "0.5.3"; }
+      { cases = [ (isGe "8.14") (range "1.13" "1.15") ];         out = "0.5.2"; }
+      { cases = [ (isGe "8.13") (range "1.13" "1.14") ];         out = "0.5.1"; }
+      { cases = [ (range "8.13" "8.15") (range "1.12" "1.14") ]; out = "0.3.13"; }
+      { cases = [ (range "8.11" "8.14") (isGe "1.12.0") ];       out = "0.3.10"; }
+      { cases = [ (range "8.11" "8.13") "1.11.0" ];              out = "0.3.4"; }
+      { cases = [ (range "8.10" "8.12") "1.11.0" ];              out = "0.3.3"; }
+      { cases = [ (range "8.10" "8.11") "1.11.0" ];              out = "0.3.1"; }
+      { cases = [ (range "8.8"  "8.11") (range "1.8" "1.10") ];  out = "0.2.3"; }
     ] null;
 
   propagatedBuildInputs =

pkgs/development/coq-modules/mathcomp-bigenough/default.nix

@@ -12,7 +12,7 @@ with lib; mkCoqDerivation {
   };
   inherit version;
   defaultVersion = with versions; switch coq.version [
-    { case = range "8.10" "8.15"; out = "1.0.1"; }
+    { case = isGe "8.10"        ; out = "1.0.1"; }
     { case = range "8.5"  "8.14"; out = "1.0.0"; }
   ] null;
 

pkgs/development/coq-modules/mathcomp-finmap/default.nix

@@ -7,7 +7,7 @@ with lib; mkCoqDerivation {
   owner = "math-comp";
   inherit version;
   defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
-      { cases = [ (range "8.13" "8.15")  (isGe "1.12") ];         out = "1.5.2"; }
+      { cases = [ (range "8.13" "8.16")  (isGe "1.12") ];         out = "1.5.2"; }
       { cases = [ (isGe "8.10")          (isGe "1.11") ];         out = "1.5.1"; }
       { cases = [ (range "8.7" "8.11")   "1.11.0" ];              out = "1.5.0"; }
       { cases = [ (isEq "8.11")          (range "1.8" "1.10") ];  out = "1.4.0+coq-8.11"; }

pkgs/development/coq-modules/mathcomp-real-closed/default.nix

@@ -8,6 +8,7 @@ with lib; mkCoqDerivation {
   owner = "math-comp";
   inherit version;
   release = {
+    "1.1.3".sha256 = "1vwmmnzy8i4f203i2s60dn9i0kr27lsmwlqlyyzdpsghvbr8h5b7";
     "1.1.2".sha256 = "0907x4nf7nnvn764q3x9lx41g74rilvq5cki5ziwgpsdgb98pppn";
     "1.1.1".sha256 = "0ksjscrgq1i79vys4zrmgvzy2y4ylxa8wdsf4kih63apw6v5ws6b";
     "1.0.5".sha256 = "0q8nkxr9fba4naylr5xk7hfxsqzq2pvwlg1j0xxlhlgr3fmlavg2";
@@ -17,6 +18,7 @@ with lib; mkCoqDerivation {
   };
 
   defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
+      { cases = [ (isGe "8.13")  (isGe "1.12.0") ]; out = "1.1.3"; }
       { cases = [ (isGe "8.10")  (isGe "1.12.0") ]; out = "1.1.2"; }
       { cases = [ (isGe "8.7")   "1.11.0" ]; out = "1.1.1"; }
       { cases = [ (isGe "8.7")   (range "1.9.0" "1.10.0") ]; out = "1.0.4"; }

pkgs/development/coq-modules/mathcomp/default.nix

@@ -19,6 +19,7 @@ let
   owner = "math-comp";
   withDoc = single && (args.withDoc or false);
   defaultVersion = with versions; switch coq.coq-version [
+      { case = range "8.14" "8.16"; out = "1.15.0"; }
       { case = range "8.11" "8.15"; out = "1.14.0"; }
       { case = range "8.11" "8.15"; out = "1.13.0"; }
       { case = range "8.10" "8.13"; out = "1.12.0"; }
@@ -30,6 +31,7 @@ let
       { case = range "8.5" "8.7";   out = "1.6.4";  }
     ] null;
   release = {
+    "1.15.0".sha256 = "1bp0jxl35ms54s0mdqky15w9af03f3i0n06qk12k4gw1xzvwqv21";
     "1.14.0".sha256 = "07yamlp1c0g5nahkd2gpfhammcca74ga2s6qr7a3wm6y6j5pivk9";
     "1.13.0".sha256 = "0j4cz2y1r1aw79snkcf1pmicgzf8swbaf9ippz0vg99a572zqzri";
     "1.12.0".sha256 = "1ccfny1vwgmdl91kz5xlmhq4wz078xm4z5wpd0jy5rn890dx03wp";

pkgs/development/coq-modules/odd-order/default.nix

@@ -5,13 +5,14 @@ mkCoqDerivation {
   pname = "odd-order";
   owner = "math-comp";
 
-  release."1.13.0".rev    = "mathcomp-odd-order.1.13.0";
+  release."1.14.0".sha256 = "0iln70npkvixqyz469l6nry545a15jlaix532i1l7pzfkqqn6v68";
   release."1.13.0".sha256 = "sha256-EzNKR/JzM8T17sMhPhgZNs14e50X4dY3OwFi133IsT0=";
-  release."1.12.0".rev    = "mathcomp-odd-order.1.12.0";
   release."1.12.0".sha256 = "sha256-omsfdc294CxKAHNMMeqJCcVimvyRCHgxcQ4NJOWSfNM=";
+  releaseRev = v: "mathcomp-odd-order.${v}";
 
   inherit version;
   defaultVersion = with versions; switch mathcomp.character.version [
+    { case = (range "1.13.0" "1.15.0"); out = "1.14.0"; }
     { case = (range "1.12.0" "1.14.0"); out = "1.13.0"; }
     { case = (range "1.10.0" "1.12.0"); out = "1.12.0"; }
   ] null;

pkgs/development/libraries/aws-sdk-cpp/default.nix

@@ -31,17 +31,19 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aws-sdk-cpp";
-  version = if stdenv.system == "i686-linux" then "1.9.150"
-    else "1.9.294";
+  version = "1.9.294";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sdk-cpp";
     rev = version;
-    sha256 = if version == "1.9.150" then "fgLdXWQKHaCwulrw9KV3vpQ71DjnQAL4heIRW7Rk7UY="
-      else "sha256-Z1eRKW+8nVD53GkNyYlZjCcT74MqFqqRMeMc33eIQ9g=";
+    sha256 = "sha256-Z1eRKW+8nVD53GkNyYlZjCcT74MqFqqRMeMc33eIQ9g=";
   };
 
+  patches = [
+    ./cmake-dirs.patch
+  ];
+
   postPatch = ''
     # Missing includes for GCC11
     sed '5i#include <thread>' -i \
@@ -65,6 +67,9 @@ stdenv.mkDerivation rec {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     # TestRandomURLMultiThreaded fails
     rm aws-cpp-sdk-core-tests/http/HttpClientTest.cpp
+  '' + lib.optionalString stdenv.isi686 ''
+    # EPSILON is exceeded
+    rm aws-cpp-sdk-core-tests/aws/client/AdaptiveRetryStrategyTest.cpp
   '';
 
   # FIXME: might be nice to put different APIs in different outputs
@@ -94,9 +99,6 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional (apis != ["*"])
     "-DBUILD_ONLY=${lib.concatStringsSep ";" apis}";
 
-  # fix build with gcc9, can be removed after bumping to current version
-  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
-
   # aws-cpp-sdk-core-tests/aws/client/AWSClientTest.cpp
   # seem to have a datarace
   enableParallelChecking = false;
@@ -109,15 +111,6 @@ stdenv.mkDerivation rec {
 
   __darwinAllowLocalNetworking = true;
 
-  patches = [
-    ./cmake-dirs.patch
-  ]
-    ++ lib.optional (lib.versionOlder version "1.9.163")
-      (fetchpatch {
-        url = "https://github.com/aws/aws-sdk-cpp/commit/b102aaf5693c4165c84b616ab9ffb9edfb705239.diff";
-        sha256 = "sha256-38QBo3MEFpyHPb8jZEURRPkoeu4DqWhVeErJayiHKF0=";
-      });
-
   # Builds in 2+h with 2 cores, and ~10m with a big-parallel builder.
   requiredSystemFeatures = [ "big-parallel" ];
 
@@ -127,5 +120,7 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     platforms = platforms.unix;
     maintainers = with maintainers; [ eelco orivej ];
+    # building ec2 runs out of memory: cc1plus: out of memory allocating 33554372 bytes after a total of 74424320 bytes
+    broken = stdenv.buildPlatform.is32bit && ((builtins.elem "ec2" apis) || (builtins.elem "*" apis));
   };
 }

pkgs/development/libraries/neatvnc/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "neatvnc";
-  version = "0.5.1";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "any1";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hdfiF3CUosOksx+Fze54kPfDqS9hvXWmCBB1VQ4uyiQ=";
+    sha256 = "sha256-Y+qFTSvMX/iop+5UOm+4NqMSAZesFIJeTR+CRnlZTYo=";
   };
 
   nativeBuildInputs = [ meson pkg-config ninja ];

pkgs/development/libraries/ngtcp2/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-REAN5TW0miWXI3HFxtW3znTKTrhsBbNqu1VfjC2w0no=";
+    sha256 = "sha256-ehOIWUGSPyHhNitkkA8voVciuEsCoRWv1s3MVMmOT0c=";
   };
 
   outputs = [ "out" "dev" "doc" ];

pkgs/development/libraries/pipewire/wireplumber.nix

@@ -46,6 +46,12 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.freedesktop.org/pipewire/wireplumber/-/commit/c16e637c329bc9dda8544b18f5bd47a8d63ee253.patch";
       sha256 = "sha256-xhhAlhOovwIjwAxXxvHRTG4GzpIPYvKQE2F4ZP1Udq8=";
     })
+    # fix bluetooth rescan loops
+    # FIXME: drop in next release
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/pipewire/wireplumber/-/merge_requests/398.patch";
+      sha256 = "sha256-rEp/3fjBRbkFuw4rBW6h8O5hcy/oBP3DW7bPu5rVfNY=";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/development/libraries/qpdf/default.nix

@@ -15,6 +15,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib libjpeg ];
 
+  configureFlags = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+                     "--with-random=/dev/urandom";
+
   preCheck = ''
     patchShebangs qtest/bin/qtest-driver
   '';

pkgs/development/ocaml-modules/angstrom/default.nix

@@ -17,7 +17,7 @@ buildDunePackage rec {
   checkInputs = [ alcotest ppx_let ];
   buildInputs = [ ocaml-syntax-shims ];
   propagatedBuildInputs = [ bigstringaf result ];
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     homepage = "https://github.com/inhabitedtype/angstrom";

pkgs/development/ocaml-modules/base64/default.nix

@@ -14,7 +14,7 @@ buildDunePackage rec {
   };
 
   # otherwise fmt breaks evaluation
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
   checkInputs = [ alcotest bos rresult ];
 
   meta = {

pkgs/development/ocaml-modules/bigarray-overlap/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, fetchurl
+{ lib, buildDunePackage, ocaml, fetchurl
 , bigarray-compat, alcotest, astring, fpath, bos, findlib, pkg-config
 }:
 
@@ -20,7 +20,7 @@ buildDunePackage rec {
 
   nativeBuildInputs = [ findlib pkg-config ];
   checkInputs = [ alcotest astring fpath bos ];
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = with lib; {
     homepage = "https://github.com/dinosaure/overlap";

pkgs/development/ocaml-modules/bigstringaf/default.nix

@@ -21,7 +21,7 @@ buildDunePackage rec {
   nativeBuildInputs = [ pkg-config ];
   checkInputs = [ alcotest ];
   propagatedBuildInputs = [ bigarray-compat ];
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     description = "Bigstring intrinsics and fast blits based on memcpy/memmove";

pkgs/development/ocaml-modules/callipyge/default.nix

@@ -23,8 +23,8 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ fmt eqaf ];
 
-  # alcotest isn't available for OCaml < 4.05 due to fmt
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  # alcotest isn't available for OCaml < 4.08 due to fmt
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
   checkInputs = [ alcotest ];
 
   meta = {

pkgs/development/ocaml-modules/caqti/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildDunePackage
+{ lib, fetchFromGitHub, buildDunePackage, ocaml
 , cppo, logs, ptime, uri, bigstringaf
 , re, cmdliner, alcotest }:
 
@@ -20,7 +20,7 @@ buildDunePackage rec {
   propagatedBuildInputs = [ logs ptime uri bigstringaf ];
   checkInputs = [ re cmdliner alcotest ];
 
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     description = "Unified interface to relational database libraries";

pkgs/development/ocaml-modules/checkseum/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchurl, buildDunePackage, dune-configurator, pkg-config
+{ lib, fetchurl, buildDunePackage, ocaml, dune-configurator, pkg-config
 , bigarray-compat, optint
 , fmt, rresult, bos, fpath, astring, alcotest
 , withFreestanding ? false
@@ -36,7 +36,7 @@ buildDunePackage rec {
     rresult
   ];
 
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     description = "ADLER-32 and CRC32C Cyclic Redundancy Check";

pkgs/development/ocaml-modules/cow/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchurl, buildDunePackage, alcotest
+{ lib, fetchurl, buildDunePackage, ocaml, alcotest
 , uri, xmlm, omd, ezjsonm }:
 
 buildDunePackage rec {
@@ -15,7 +15,7 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ xmlm uri ezjsonm omd ];
   checkInputs = [ alcotest ];
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = with lib; {
     description = "Caml on the Web";

pkgs/development/ocaml-modules/cstruct/default.nix

@@ -15,8 +15,8 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ bigarray-compat ];
 
-  # alcotest isn't available for OCaml < 4.05 due to fmt
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  # alcotest isn't available for OCaml < 4.08 due to fmt
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
   checkInputs = [ alcotest ];
 
   meta = {

pkgs/development/ocaml-modules/cstruct/sexp.nix

@@ -10,8 +10,8 @@ buildDunePackage rec {
 
   minimumOCamlVersion = "4.03";
 
-  # alcotest is only available on OCaml >= 4.05 due to fmt
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  # alcotest is only available on OCaml >= 4.08 due to fmt
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
   checkInputs = [ alcotest ];
 
   propagatedBuildInputs = [ cstruct sexplib ];

pkgs/development/ocaml-modules/decompress/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchurl, buildDunePackage
+{ lib, fetchurl, buildDunePackage, ocaml
 , checkseum, bigarray-compat, optint, cmdliner
 , bigstringaf, alcotest, camlzip, base64, ctypes, fmt
 }:
@@ -19,7 +19,7 @@ buildDunePackage rec {
   buildInputs = [ cmdliner ];
   propagatedBuildInputs = [ optint bigarray-compat checkseum ];
   checkInputs = [ alcotest bigstringaf ctypes fmt camlzip base64 ];
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     description = "Pure OCaml implementation of Zlib";

pkgs/development/ocaml-modules/dispatch/default.nix

@@ -17,7 +17,7 @@ buildDunePackage rec {
 
   checkInputs = [ alcotest ];
 
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     inherit (src.meta) homepage;

pkgs/development/ocaml-modules/domain-name/default.nix

@@ -15,7 +15,7 @@ buildDunePackage rec {
 
   checkInputs = [ alcotest ];
 
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     homepage = "https://github.com/hannesm/domain-name";

pkgs/development/ocaml-modules/duration/default.nix

@@ -11,7 +11,7 @@ buildDunePackage rec {
     sha256 = "sha256-rRT7daWm9z//fvFyEXiSXuVVzw8jsj46sykYS8DBzmk=";
   };
 
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
   checkInputs = [ alcotest ];
 
   meta = {

pkgs/development/ocaml-modules/emile/default.nix

@@ -25,9 +25,9 @@ buildDunePackage rec {
   ];
 
   # technically emile is available for ocaml >= 4.03, but alcotest
-  # and angstrom (fmt) are only available for >= 4.05. Disabling
-  # tests for < 4.05 at least improves the error message
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  # and angstrom (fmt) are only available for >= 4.08. Disabling
+  # tests for < 4.08 at least improves the error message
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
   checkInputs = [ alcotest ];
 
   meta = with lib; {

pkgs/development/ocaml-modules/faraday/default.nix

@@ -17,7 +17,7 @@ buildDunePackage rec {
 
   checkInputs = [ alcotest ];
   propagatedBuildInputs = [ bigstringaf ];
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     description = "Serialization library built for speed and memory efficiency";

pkgs/development/ocaml-modules/ff/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitLab, buildDunePackage, zarith, alcotest }:
+{ lib, fetchFromGitLab, buildDunePackage, ocaml, zarith, alcotest }:
 
 buildDunePackage rec {
   pname = "ff";
@@ -21,7 +21,7 @@ buildDunePackage rec {
     alcotest
   ];
 
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     homepage = "https://gitlab.com/dannywillems/ocaml-ff";

pkgs/development/ocaml-modules/fmt/default.nix

@@ -1,21 +1,20 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, cmdliner, seq, stdlib-shims }:
+{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, cmdliner }:
 
-if lib.versionOlder ocaml.version "4.05"
+if lib.versionOlder ocaml.version "4.08"
 then throw "fmt is not available for OCaml ${ocaml.version}"
 else
 
 stdenv.mkDerivation rec {
-  version = "0.8.9";
+  version = "0.9.0";
   pname = "ocaml${ocaml.version}-fmt";
 
   src = fetchurl {
     url = "https://erratique.ch/software/fmt/releases/fmt-${version}.tbz";
-    sha256 = "0gkkkj4x678vxdda4xaw2dd44qjacavsvn5nx8gydfwah6pjbkxk";
+    sha256 = "sha256-8fsggFoi3XWhN9cnBKNw53ic9r32OUjmgX0cImwUEmE=";
   };
 
   nativeBuildInputs = [ ocaml findlib ocamlbuild topkg ];
   buildInputs = [ cmdliner topkg ];
-  propagatedBuildInputs = [ seq stdlib-shims ];
 
   strictDeps = true;
 

pkgs/development/ocaml-modules/git/unix.nix

@@ -26,7 +26,7 @@ buildDunePackage {
     astring cohttp-lwt-unix decompress
     domain-name ipaddr mtime mirage-flow
     cstruct ptime mimic ca-certs-nss
-    tls tls-mirage
+    tls tls-mirage git
   ];
   checkInputs = [
     alcotest alcotest-lwt base64 ke

pkgs/development/ocaml-modules/gmap/default.nix

@@ -15,7 +15,7 @@ buildDunePackage rec {
 
   checkInputs = [ alcotest ];
 
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     description = "Heterogenous maps over a GADT";

pkgs/development/ocaml-modules/graphql/parser.nix

@@ -1,10 +1,10 @@
-{ lib, buildDunePackage, ocaml, fetchurl, alcotest, fmt, menhir, re }:
+{ lib, buildDunePackage, fetchurl, alcotest, fmt, menhir, re }:
 
 buildDunePackage rec {
   pname = "graphql_parser";
   version = "0.14.0";
 
-  minimalOCamlVersion = "4.05";
+  minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/andreas/ocaml-graphql-server/releases/download/${version}/graphql-${version}.tbz";
@@ -16,7 +16,7 @@ buildDunePackage rec {
 
   checkInputs = [ alcotest ];
 
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
 
   meta = {
     homepage = "https://github.com/andreas/ocaml-graphql-server";

pkgs/development/ocaml-modules/h2/default.nix

@@ -43,7 +43,7 @@ buildDunePackage rec {
   ];
 
   # Tests fail with 4.06
-  doCheck = lib.versionAtLeast ocaml.version "4.07";
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
   preCheck = ''
     ln -s "${http2-frame-test-case}" lib_test/http2-frame-test-case
   '';

pkgs/development/ocaml-modules/httpaf/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, fetchpatch, buildDunePackage
+{ lib, fetchFromGitHub, fetchpatch, buildDunePackage, ocaml
 , angstrom, faraday, alcotest
 }:
 
@@ -17,7 +17,7 @@ buildDunePackage rec {
 
   checkInputs = [ alcotest ];
   propagatedBuildInputs = [ angstrom faraday ];
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     description = "A high-performance, memory-efficient, and scalable web server for OCaml";

pkgs/development/ocaml-modules/imagelib/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchurl, buildDunePackage
+{ lib, fetchurl, buildDunePackage, ocaml
 , decompress, stdlib-shims, alcotest
 }:
 
@@ -16,7 +16,7 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ decompress stdlib-shims ];
 
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
   checkInputs = [ alcotest ];
 
   meta = {

pkgs/development/ocaml-modules/kicadsch/default.nix

@@ -0,0 +1,23 @@
+{ lib
+, buildDunePackage
+, fetchurl
+}:
+
+buildDunePackage rec {
+  pname = "kicadsch";
+  version = "0.9.0";
+
+  minimalOCamlVersion = "4.07";
+
+  src = fetchurl {
+    url = "https://github.com/jnavila/plotkicadsch/releases/download/v${version}/plotkicadsch-${version}.tbz";
+    sha256 = "sha256-B+vnEPyd3SUzviTdNoyvYk0p7Hrg/XTJm8KxsY8A4jQ=";
+  };
+
+  meta = with lib; {
+    description = "OCaml library for exporting Kicad Sch files to SVG pictures";
+    homepage = "https://github.com/jnavila/plotkicadsch";
+    license = licenses.isc;
+    maintainers = with maintainers; [ leungbk ];
+  };
+}

pkgs/development/ocaml-modules/logs/default.nix

@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild
 , topkg, result, lwt, cmdliner, fmt
+, fmtSupport ? lib.versionAtLeast ocaml.version "4.08"
 , js_of_ocaml
 , jsooSupport ? true
 }:
@@ -22,13 +23,14 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ ocaml findlib ocamlbuild topkg ];
-  buildInputs = [ fmt cmdliner lwt topkg ]
+  buildInputs = [ cmdliner lwt topkg ]
+    ++ lib.optional fmtSupport fmt
     ++ lib.optional jsooSupport js_of_ocaml;
   propagatedBuildInputs = [ result ];
 
   strictDeps = true;
 
-  buildPhase = "${topkg.run} build --with-js_of_ocaml ${lib.boolToString jsooSupport}";
+  buildPhase = "${topkg.run} build --with-js_of_ocaml ${lib.boolToString jsooSupport} --with-fmt ${lib.boolToString fmtSupport}";
 
   inherit (topkg) installPhase;
 

pkgs/development/ocaml-modules/luv/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, fetchurl
+{ lib, buildDunePackage, ocaml, fetchurl
 , ctypes, result
 , alcotest
 , file
@@ -23,7 +23,7 @@ buildDunePackage rec {
   nativeBuildInputs = [ file ];
   propagatedBuildInputs = [ ctypes result ];
   checkInputs = [ alcotest ];
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = with lib; {
     homepage = "https://github.com/aantron/luv";

pkgs/development/ocaml-modules/plotkicadsch/default.nix

@@ -0,0 +1,50 @@
+{ lib
+, buildDunePackage
+, fetchFromGitHub
+, substituteAll
+, base64
+, cmdliner
+, digestif
+, git-unix
+, kicadsch
+, lwt
+, lwt_ppx
+, sha
+, tyxml
+, coreutils
+, imagemagick
+}:
+
+buildDunePackage rec {
+  pname = "plotkicadsch";
+
+  inherit (kicadsch) src version;
+
+  minimalOCamlVersion = "4.09";
+
+  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      inherit coreutils imagemagick;
+    })
+  ];
+
+  buildInputs = [
+    base64
+    cmdliner
+    digestif
+    git-unix
+    kicadsch
+    lwt
+    lwt_ppx
+    sha
+    tyxml
+  ];
+
+  meta = with lib; {
+    description = "A tool to export Kicad Sch files to SVG pictures";
+    homepage = "https://github.com/jnavila/plotkicadsch";
+    license = licenses.isc;
+    maintainers = with maintainers; [ leungbk ];
+  };
+}

pkgs/development/ocaml-modules/plotkicadsch/fix-paths.patch

@@ -0,0 +1,26 @@
+diff --git a/plotkicadsch/src/git-imgdiff b/plotkicadsch/src/git-imgdiff
+index cbddecb..8d21a8a 100755
+--- a/plotkicadsch/src/git-imgdiff
++++ b/plotkicadsch/src/git-imgdiff
+@@ -1,4 +1,4 @@
+ #!/bin/bash
+ PIPE=$(mktemp -u)
+-(! compare -metric RMSE $2 $1 png:${PIPE} 2> /dev/null) &&  (montage -geometry +4+4 $2 $PIPE $1 png:- | display -title "$1" -)
++(! @imagemagick@/bin/compare -metric RMSE $2 $1 png:${PIPE} 2> /dev/null) &&  (@imagemagick@/bin/montage -geometry +4+4 $2 $PIPE $1 png:- | @imagemagick@/bin/display -title "$1" -)
+ rm $PIPE
+diff --git a/plotkicadsch/src/sysAbst.ml b/plotkicadsch/src/sysAbst.ml
+index c3c7b52..15db6d4 100644
+--- a/plotkicadsch/src/sysAbst.ml
++++ b/plotkicadsch/src/sysAbst.ml
+@@ -30,7 +30,7 @@ let detect_os () : os =
+   if Sys.win32 then Windows
+   else if Sys.cygwin then Cygwin
+   else
+-    let ((in_ch, _, _) as uname) = UnixLabels.open_process_full "uname" ~env:[| |] in
++    let ((in_ch, _, _) as uname) = UnixLabels.open_process_full "@coreutils@/bin/uname" ~env:[| |] in
+     let os = input_line in_ch in
+     ignore (UnixLabels.close_process_full uname) ;
+     match os with
+-- 
+2.37.1
+

pkgs/development/ocaml-modules/ppx_blob/default.nix

@@ -13,7 +13,7 @@ buildDunePackage rec {
 
   checkInputs = [ alcotest ];
   propagatedBuildInputs = [ ppxlib ];
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = with lib; {
     homepage = "https://github.com/johnwhitington/ppx_blob";

pkgs/development/ocaml-modules/resource-pooling/default.nix

@@ -1,18 +1,16 @@
 { lib, fetchFromGitHub, buildDunePackage, lwt_log }:
 
 buildDunePackage rec {
-  version = "1.1";
+  version = "1.2";
   pname = "resource-pooling";
 
-  useDune2 = true;
-
-  minimumOCamlVersion = "4.06";
+  minimalOCamlVersion = "4.06";
 
   src = fetchFromGitHub {
     owner = "ocsigen";
     repo = pname;
     rev = version;
-    sha256 = "0wsbnwszafdv3gsiiaslgf6m6pfx74h7h19i0gp2c4ivdiv3wck9";
+    sha256 = "sha256-GNYPxjMTo7y40y7aQdseuFyeVF/hSCZKXfEaH/WIO9w=";
   };
 
   propagatedBuildInputs = [ lwt_log ];

pkgs/development/ocaml-modules/rpclib/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchurl, buildDunePackage
+{ lib, fetchurl, buildDunePackage, ocaml
 , alcotest
 , base64, cmdliner, rresult, xmlm, yojson
 }:
@@ -18,7 +18,7 @@ buildDunePackage rec {
   propagatedBuildInputs = [ base64 rresult xmlm ];
   checkInputs = [ alcotest ];
 
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = with lib; {
     homepage = "https://github.com/mirage/ocaml-rpc";

pkgs/development/ocaml-modules/ssl/default.nix

@@ -23,7 +23,7 @@ buildDunePackage rec {
   buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [ openssl ];
 
-  doCheck = lib.versionAtLeast ocaml.version "4.06";
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
   checkInputs = [ alcotest ];
   preCheck = ''
     mkdir -p _build/default/tests/

pkgs/development/ocaml-modules/terminal/default.nix

@@ -17,7 +17,7 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ stdlib-shims uutf uucp ];
 
-  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
   checkInputs = [ alcotest fmt ];
 
   meta = with lib; {

pkgs/development/ocaml-modules/terminal_size/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, fetchurl, alcotest }:
+{ lib, buildDunePackage, ocaml, fetchurl, alcotest }:
 
 buildDunePackage rec {
   pname = "terminal_size";
@@ -12,7 +12,7 @@ buildDunePackage rec {
   };
 
   checkInputs = [ alcotest ];
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = with lib; {
     description = "Get the dimensions of the terminal";

pkgs/development/ocaml-modules/uecc/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitLab, buildDunePackage, bigstring, alcotest, cstruct, hex }:
+{ lib, fetchFromGitLab, buildDunePackage, ocaml, bigstring, alcotest, cstruct, hex }:
 
 buildDunePackage rec {
   pname = "uecc";
@@ -23,7 +23,7 @@ buildDunePackage rec {
     hex
   ];
 
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     description = "Bindings for ECDH and ECDSA for 8-bit, 32-bit, and 64-bit processors";

pkgs/development/ocaml-modules/yuscii/default.nix

@@ -1,5 +1,6 @@
 { alcotest
 , buildDunePackage
+, ocaml
 , fetchzip
 , gcc
 , fmt
@@ -11,6 +12,8 @@ buildDunePackage rec {
   pname = "yuscii";
   version = "0.3.0";
 
+  minimalOCamlVersion = "4.03";
+
   src = fetchzip {
     url = "https://github.com/mirage/yuscii/releases/download/v${version}/yuscii-v${version}.tbz";
     sha256 = "0idywlkw0fbakrxv65swnr5bj7f2vns9kpay7q03gzlv82p670hy";
@@ -24,7 +27,7 @@ buildDunePackage rec {
     fmt
     uutf
   ];
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
 
   meta = {
     description = "A simple mapper between UTF-7 to Unicode according RFC2152";

pkgs/development/python-modules/chex/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "chex";
-  version = "0.1.3";
+  version = "0.1.4";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "deepmind";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-oIdRh0WKzdvyCfcamKRDiMsV51b6rdmNYcELjDQKGX4=";
+    hash = "sha256-FiZElESyOVu1VJxUDNiN6HVADiaubDrGdQHYp2CN8f4=";
   };
 
   propagatedBuildInputs = [