Merge master into haskell-updates

nixos/lib/qemu-common.nix

@@ -4,29 +4,61 @@
 let
   zeroPad = n:
     lib.optionalString (n < 16) "0" +
-      (if n > 255
+    (if n > 255
-       then throw "Can't have more than 255 nets or nodes!"
+    then throw "Can't have more than 255 nets or nodes!"
-       else lib.toHexString n);
+    else lib.toHexString n);
 in
 
 rec {
   qemuNicMac = net: machine: "52:54:00:12:${zeroPad net}:${zeroPad machine}";
 
   qemuNICFlags = nic: net: machine:
-    [ "-device virtio-net-pci,netdev=vlan${toString nic},mac=${qemuNicMac net machine}"
+    [
+      "-device virtio-net-pci,netdev=vlan${toString nic},mac=${qemuNicMac net machine}"
       ''-netdev vde,id=vlan${toString nic},sock="$QEMU_VDE_SOCKET_${toString net}"''
     ];
 
-  qemuSerialDevice = if pkgs.stdenv.hostPlatform.isx86 || pkgs.stdenv.hostPlatform.isRiscV then "ttyS0"
+  qemuSerialDevice =
-        else if (with pkgs.stdenv.hostPlatform; isAarch || isPower) then "ttyAMA0"
+    if pkgs.stdenv.hostPlatform.isx86 || pkgs.stdenv.hostPlatform.isRiscV then "ttyS0"
-        else throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'";
+    else if (with pkgs.stdenv.hostPlatform; isAarch || isPower) then "ttyAMA0"
+    else throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'";
 
-  qemuBinary = qemuPkg: {
+  qemuBinary = qemuPkg:
-    x86_64-linux = "${qemuPkg}/bin/qemu-kvm -cpu max";
+    let
-    armv7l-linux = "${qemuPkg}/bin/qemu-system-arm -machine virt,accel=kvm:tcg -cpu max";
+      hostStdenv = qemuPkg.stdenv;
-    aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -machine virt,gic-version=max,accel=kvm:tcg -cpu max";
+      hostSystem = hostStdenv.system;
-    powerpc64le-linux = "${qemuPkg}/bin/qemu-system-ppc64 -machine powernv";
+      guestSystem = pkgs.stdenv.hostPlatform.system;
-    powerpc64-linux = "${qemuPkg}/bin/qemu-system-ppc64 -machine powernv";
+
-    x86_64-darwin = "${qemuPkg}/bin/qemu-kvm -cpu max";
+      linuxHostGuestMatrix = {
-  }.${pkgs.stdenv.hostPlatform.system} or "${qemuPkg}/bin/qemu-kvm";
+        x86_64-linux = "${qemuPkg}/bin/qemu-kvm -cpu max";
+        armv7l-linux = "${qemuPkg}/bin/qemu-system-arm -machine virt,accel=kvm:tcg -cpu max";
+        aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -machine virt,gic-version=max,accel=kvm:tcg -cpu max";
+        powerpc64le-linux = "${qemuPkg}/bin/qemu-system-ppc64 -machine powernv";
+        powerpc64-linux = "${qemuPkg}/bin/qemu-system-ppc64 -machine powernv";
+        x86_64-darwin = "${qemuPkg}/bin/qemu-kvm -cpu max";
+      };
+      otherHostGuestMatrix = {
+        aarch64-darwin = {
+          aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -machine virt,gic-version=2,accel=hvf:tcg -cpu max";
+        };
+        x86_64-darwin = {
+          x86_64-linux = "${qemuPkg}/bin/qemu-system-x86_64 -machine type=q35,accel=hvf:tcg -cpu max";
+        };
+      };
+
+      throwUnsupportedHostSystem =
+        let
+          supportedSystems = [ "linux" ] ++ (lib.attrNames otherHostGuestMatrix);
+        in
+        throw "Unsupported host system ${hostSystem}, supported: ${lib.concatStringsSep ", " supportedSystems}";
+      throwUnsupportedGuestSystem = guestMap:
+        throw "Unsupported guest system ${guestSystem} for host ${hostSystem}, supported: ${lib.concatStringsSep ", " (lib.attrNames guestMap)}";
+    in
+    if hostStdenv.isLinux then
+      linuxHostGuestMatrix.${guestSystem} or "${qemuPkg}/bin/qemu-kvm"
+    else
+      let
+        guestMap = (otherHostGuestMatrix.${hostSystem} or throwUnsupportedHostSystem);
+      in
+      (guestMap.${guestSystem} or (throwUnsupportedGuestSystem guestMap));
 }

nixos/modules/programs/gnupg.nix

@@ -129,12 +129,14 @@ in
     environment.interactiveShellInit = ''
       # Bind gpg-agent to this TTY if gpg commands are used.
       export GPG_TTY=$(tty)
+    '';
 
-    '' + (optionalString cfg.agent.enableSSHSupport ''
+    programs.ssh.extraConfig = optionalString cfg.agent.enableSSHSupport ''
-      # SSH agent protocol doesn't support changing TTYs, so bind the agent
+      # The SSH agent protocol doesn't have support for changing TTYs; however we
-      # to every new TTY.
+      # can simulate this with the `exec` feature of openssh (see ssh_config(5))
-      ${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye > /dev/null
+      # that hooks a command to the shell currently running the ssh program.
-    '');
+      Match host * exec "${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye > /dev/null"
+    '';
 
     environment.extraInit = mkIf cfg.agent.enableSSHSupport ''
       if [ -z "$SSH_AUTH_SOCK" ]; then

nixos/modules/services/networking/kea.nix

@@ -298,7 +298,7 @@ in
       ];
 
       serviceConfig = {
-        ExecStart = "${package}/bin/kea-ctrl-agent -c /etc/kea/ctrl-agent.conf ${lib.escapeShellArgs cfg.dhcp4.extraArgs}";
+        ExecStart = "${package}/bin/kea-ctrl-agent -c /etc/kea/ctrl-agent.conf ${lib.escapeShellArgs cfg.ctrl-agent.extraArgs}";
         KillMode = "process";
         Restart = "on-failure";
       } // commonServiceConfig;

nixos/modules/services/security/vaultwarden/default.nix

@@ -196,6 +196,7 @@ ADMIN_TOKEN=...copy-paste a unique generated secret token here...
         ProtectSystem = "strict";
         AmbientCapabilities = "CAP_NET_BIND_SERVICE";
         StateDirectory = "bitwarden_rs";
+        StateDirectoryMode = "0700";
       };
       wantedBy = [ "multi-user.target" ];
     };

nixos/modules/services/x11/display-managers/lightdm.nix

@@ -311,7 +311,6 @@ in
       home = "/var/lib/lightdm";
       group = "lightdm";
       uid = config.ids.uids.lightdm;
-      shell = pkgs.bash;
     };
 
     systemd.tmpfiles.rules = [

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

@@ -240,11 +240,11 @@ def main() -> None:
         if "@graceful@" == "1":
             flags.append("--graceful")
 
-        subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@"] + flags + ["install"])
+        subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@"] + flags + ["install"])
     else:
         # Update bootloader to latest if needed
         available_out = subprocess.check_output(["@systemd@/bin/bootctl", "--version"], universal_newlines=True).split()[2]
-        installed_out = subprocess.check_output(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "status"], universal_newlines=True)
+        installed_out = subprocess.check_output(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@", "status"], universal_newlines=True)
 
         # See status_binaries() in systemd bootctl.c for code which generates this
         installed_match = re.search(r"^\W+File:.*/EFI/(?:BOOT|systemd)/.*\.efi \(systemd-boot ([\d.]+[^)]*)\)$",
@@ -263,7 +263,7 @@ def main() -> None:
 
         if installed_version < available_version:
             print("updating systemd-boot from %s to %s" % (installed_version, available_version))
-            subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "update"])
+            subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@", "update"])
 
     mkdir_p("@efiSysMountPoint@/efi/nixos")
     mkdir_p("@efiSysMountPoint@/loader/entries")

nixos/modules/system/boot/networkd.nix

@@ -879,6 +879,15 @@ let
         (assertValueOneOf "OnLink" boolValues)
       ];
 
+      sectionIPv6RoutePrefix = checkUnitConfig "IPv6RoutePrefix" [
+        (assertOnlyFields [
+          "Route"
+          "LifetimeSec"
+        ])
+        (assertHasField "Route")
+        (assertInt "LifetimeSec")
+      ];
+
       sectionDHCPServerStaticLease = checkUnitConfig "DHCPServerStaticLease" [
         (assertOnlyFields [
           "MACAddress"
@@ -1242,6 +1251,22 @@ let
     };
   };
 
+  ipv6RoutePrefixOptions = {
+    options = {
+      ipv6RoutePrefixConfig = mkOption {
+        default = {};
+        example = { Route = "fd00::/64"; };
+        type = types.addCheck (types.attrsOf unitOption) check.network.sectionIPv6RoutePrefix;
+        description = ''
+          Each attribute in this set specifies an option in the
+          <literal>[IPv6RoutePrefix]</literal> section of the unit.  See
+          <citerefentry><refentrytitle>systemd.network</refentrytitle>
+          <manvolnum>5</manvolnum></citerefentry> for details.
+        '';
+      };
+    };
+  };
+
   dhcpServerStaticLeaseOptions = {
     options = {
       dhcpServerStaticLeaseConfig = mkOption {
@@ -1384,6 +1409,17 @@ let
       '';
     };
 
+    ipv6RoutePrefixes = mkOption {
+      default = [];
+      example = [ { Route = "fd00::/64"; LifetimeSec = 3600; } ];
+      type = with types; listOf (submodule ipv6RoutePrefixOptions);
+      description = ''
+        A list of ipv6RoutePrefix sections to be added to the unit.  See
+        <citerefentry><refentrytitle>systemd.network</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+      '';
+    };
+
     name = mkOption {
       type = types.nullOr types.str;
       default = null;
@@ -1775,6 +1811,10 @@ let
           [IPv6Prefix]
           ${attrsToSection x.ipv6PrefixConfig}
         '')
+        + flip concatMapStrings def.ipv6RoutePrefixes (x: ''
+          [IPv6RoutePrefix]
+          ${attrsToSection x.ipv6RoutePrefixConfig}
+        '')
         + flip concatMapStrings def.dhcpServerStaticLeases (x: ''
           [DHCPServerStaticLease]
           ${attrsToSection x.dhcpServerStaticLeaseConfig}

nixos/modules/virtualisation/containers.nix

@@ -11,20 +11,6 @@ in
     maintainers = [ ] ++ lib.teams.podman.members;
   };
 
-
-  imports = [
-    (
-      lib.mkRemovedOptionModule
-        [ "virtualisation" "containers" "users" ]
-        "All users with `isNormalUser = true` set now get appropriate subuid/subgid mappings."
-    )
-    (
-      lib.mkRemovedOptionModule
-        [ "virtualisation" "containers" "containersConf" "extraConfig" ]
-        "Use virtualisation.containers.containersConf.settings instead."
-    )
-  ];
-
   options.virtualisation.containers = {
 
     enable =

nixos/modules/virtualisation/cri-o.nix

@@ -11,10 +11,6 @@ let
   cfgFile = format.generate "00-default.conf" cfg.settings;
 in
 {
-  imports = [
-    (mkRenamedOptionModule [ "virtualisation" "cri-o" "registries" ] [ "virtualisation" "containers" "registries" "search" ])
-  ];
-
   meta = {
     maintainers = teams.podman.members;
   };

nixos/modules/virtualisation/podman/default.nix

@@ -46,7 +46,6 @@ in
   imports = [
     ./dnsname.nix
     ./network-socket.nix
-    (lib.mkRenamedOptionModule [ "virtualisation" "podman" "libpod" ] [ "virtualisation" "containers" "containersConf" ])
   ];
 
   meta = {

nixos/modules/virtualisation/qemu-vm.nix

@@ -102,7 +102,9 @@ let
   # Shell script to start the VM.
   startVM =
     ''
-      #! ${pkgs.runtimeShell}
+      #! ${cfg.host.pkgs.runtimeShell}
+
+      export PATH=${makeBinPath [ cfg.host.pkgs.coreutils ]}''${PATH:+:}$PATH
 
       set -e
 
@@ -574,11 +576,24 @@ in
         description = "Primary IP address used in /etc/hosts.";
       };
 
+    virtualisation.host.pkgs = mkOption {
+      type = options.nixpkgs.pkgs.type;
+      default = pkgs;
+      defaultText = "pkgs";
+      example = literalExpression ''
+        import pkgs.path { system = "x86_64-darwin"; }
+      '';
+      description = ''
+        pkgs set to use for the host-specific packages of the vm runner.
+        Changing this to e.g. a Darwin package set allows running NixOS VMs on Darwin.
+      '';
+    };
+
     virtualisation.qemu = {
       package =
         mkOption {
           type = types.package;
-          default = pkgs.qemu_kvm;
+          default = cfg.host.pkgs.qemu_kvm;
           example = "pkgs.qemu_test";
           description = lib.mdDoc "QEMU package to use.";
         };
@@ -1075,14 +1090,14 @@ in
 
     services.qemuGuest.enable = cfg.qemu.guestAgent.enable;
 
-    system.build.vm = pkgs.runCommand "nixos-vm" {
+    system.build.vm = cfg.host.pkgs.runCommand "nixos-vm" {
       preferLocalBuild = true;
       meta.mainProgram = "run-${config.system.name}-vm";
     }
       ''
         mkdir -p $out/bin
         ln -s ${config.system.build.toplevel} $out/system
-        ln -s ${pkgs.writeScript "run-nixos-vm" startVM} $out/bin/run-${config.system.name}-vm
+        ln -s ${cfg.host.pkgs.writeScript "run-nixos-vm" startVM} $out/bin/run-${config.system.name}-vm
       '';
 
     # When building a regular system configuration, override whatever

pkgs/applications/audio/game-music-emu/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake }:
+{ lib, stdenv, fetchurl, cmake, removeReferencesTo }:
 
 stdenv.mkDerivation rec {
   version = "0.6.3";
@@ -9,13 +9,21 @@ stdenv.mkDerivation rec {
     sha256 = "07857vdkak306d9s5g6fhmjyxk7vijzjhkmqb15s7ihfxx9lx8xb";
   };
   cmakeFlags = lib.optionals stdenv.isDarwin [ "-DENABLE_UBSAN=OFF" ];
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake removeReferencesTo ];
+
+  # It used to reference it, in the past, but thanks to the postFixup hook, now
+  # it doesn't.
+  disallowedReferences = [ stdenv.cc.cc ];
+
+  postFixup = lib.optionalString stdenv.isLinux ''
+    remove-references-to -t ${stdenv.cc.cc} "$(readlink -f $out/lib/libgme.so)"
+  '';
 
   meta = with lib; {
     homepage = "https://bitbucket.org/mpyne/game-music-emu/wiki/Home";
     description = "A collection of video game music file emulators";
     license = licenses.lgpl21Plus;
     platforms = platforms.all;
-    maintainers = with maintainers; [ luc65r ];
+    maintainers = with maintainers; [ luc65r lheckemann ];
   };
 }

pkgs/applications/audio/psst/default.nix

@@ -1,5 +1,17 @@
-{ lib, fetchFromGitHub, rustPlatform, alsa-lib, atk, cairo, dbus, gdk-pixbuf, glib, gtk3, pango, pkg-config }:
+{ lib, fetchFromGitHub, rustPlatform, alsa-lib, atk, cairo, dbus, gdk-pixbuf, glib, gtk3, pango, pkg-config, makeDesktopItem }:
 
+let
+  desktopItem = makeDesktopItem {
+    name = "Psst";
+    exec = "psst-gui";
+    comment = "Fast and multi-platform Spotify client with native GUI";
+    desktopName = "Psst";
+    type = "Application";
+    categories = [ "Audio" "AudioVideo" ];
+    icon = "psst";
+    terminal = false;
+  };
+in
 rustPlatform.buildRustPackage rec {
   pname = "psst";
   version = "unstable-2022-05-19";
@@ -29,7 +41,10 @@ rustPlatform.buildRustPackage rec {
   ];
 
   postInstall = ''
-    install -Dm444 psst-gui/assets/logo_512.png $out/share/icons/${pname}.png
+    mkdir -pv $out/share/icons/hicolor/512x512/apps
+    install -Dm444 psst-gui/assets/logo_512.png $out/share/icons/hicolor/512x512/apps/${pname}.png
+    mkdir -pv $out/share/applications
+    ln -s ${desktopItem}/share/applications/* $out/share/applications
   '';
 
   meta = with lib; {

pkgs/applications/audio/strawberry/default.nix

@@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "strawberry";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    hash = "sha256-TAt/P9nykUtOoHmprFiUJnip8mAnJlvkufD0v9ZWrp4=";
+    hash = "sha256-NhouAHr5fKdH62rtCIHlr8ennixIf9YQrf4zRIGjfxs=";
   };
 
   # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead

pkgs/applications/blockchains/btcpayserver/default.nix

@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "1.6.9";
+  version = "1.6.10";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kN+/TQCc35iI8gr9pYlW4B3B6WasGyKQffkJ8rMffVk=";
+    sha256 = "sha256-fy8mIGVij6rjaGEWE6700gbiFnH741hIuvg26W1dBlw=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";

pkgs/applications/blockchains/erigon.nix

@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "erigon";
-  version = "2022.08.02";
+  version = "2022.08.03";
 
   src = fetchFromGitHub {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JXVVfhR7XQKPLpH9F+78+y5hLBGdq/qSA2wniM/sf5s=";
+    sha256 = "sha256-Z+YghJjJfeGO/LuwcLb5A9ghZUcL1OoppMZPsa38ahQ=";
     fetchSubmodules = true;
   };
 
-  vendorSha256 = "sha256-Muksput9s0I9AeQNG+QSbfz0/s14EmSERFg8h0rqaJ8=";
+  vendorSha256 = "sha256-2+9oXLIDYZfWzQfnjwJet4QT01tGzLlQJFjN4ZbG6uw=";
   proxyVendor = true;
 
   # Build errors in mdbx when format hardening is enabled:

pkgs/applications/blockchains/polkadot/default.nix

@@ -10,13 +10,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "0.9.27";
+  version = "0.9.28";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot";
     rev = "v${version}";
-    sha256 = "sha256-abDkDkFXBG4C7lvE9g6cvUYTfQt7ObZ+Ya8V0W7ASBE=";
+    sha256 = "sha256-PYPNbysk9jHGtAUGr8O/Ah0ArTNKQYYToR5djG+XujI=";
 
     # the build process of polkadot requires a .git folder in order to determine
     # the git commit hash that is being built and add it to the version string.
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "sha256-xDjHu6JARIFy2fVQMGhkdU9Qcz/aqumBFe4MjlH0TCY=";
+  cargoSha256 = "sha256-Dqcjt3yvZdaHp6sIQFo9wYH/icIInyXqKHE1Q/JjrwY=";
 
   buildInputs = lib.optional stdenv.isDarwin [ Security ];
 

pkgs/applications/editors/emacs/elisp-packages/ebuild-mode/default.nix

@@ -2,11 +2,11 @@
 
 trivialBuild rec {
   pname = "ebuild-mode";
-  version = "1.55";
+  version = "1.60";
 
   src = fetchurl {
     url = "https://dev.gentoo.org/~ulm/emacs/${pname}-${version}.tar.xz";
-    sha256 = "1bs2s5g79vrbk8544lvp388cdbig0s121kwk0h10hif4kp56ka9w";
+    sha256 = "sha256-XN+RLVff4yvxjaAuNjUgSOzU0KdnVGMt9B78rfW389g=";
   };
 
   meta = with lib; {

pkgs/applications/kde/kleopatra.nix

@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib, kdepimTeam,
+  mkDerivation, fetchpatch, lib, kdepimTeam,
   extra-cmake-modules, kdoctools,
   boost, gpgme, kcmutils, kdbusaddons, kiconthemes, kitemmodels, kmime,
   knotifications, kwindowsystem, kxmlgui, libkleo, kcrash
@@ -7,15 +7,25 @@
 
 mkDerivation {
   pname = "kleopatra";
+
+  patches = [
+    (fetchpatch {
+      url = "https://invent.kde.org/pim/kleopatra/-/commit/87d8b00d4b2286489d5fadc9cfa07f1d721cdfe3.patch";
+      sha256 = "sha256-s1tXB7h0KtFwwZHx8rhpI0nLZmwhWAiraHEF3KzncMc=";
+    })
+  ];
+
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+
+  buildInputs = [
+    boost gpgme kcmutils kdbusaddons kiconthemes kitemmodels kmime
+    knotifications kwindowsystem kxmlgui libkleo kcrash
+  ];
+
   meta = {
     homepage = "https://apps.kde.org/kleopatra/";
     description = "Certificate manager and unified crypto GUI";
     license = with lib.licenses; [ gpl2 lgpl21 fdl12 ];
     maintainers = kdepimTeam;
   };
-  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [
-    boost gpgme kcmutils kdbusaddons kiconthemes kitemmodels kmime
-    knotifications kwindowsystem kxmlgui libkleo kcrash
-  ];
 }

pkgs/applications/misc/gum/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gum";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zFw2Lf+N8jxrw6JYqzsDMXIMchFc2bxAofELrgIMquk=";
+    sha256 = "sha256-S+sbfo7F6+bJeHywxM3jkZN+7MNQh9YRyLPHTC4wZnk=";
   };
 
-  vendorSha256 = "sha256-8MqBGMcYR/kbExfXBeQrO8p7a/uawUk2hLmnQtarWEw=";
+  vendorSha256 = "sha256-vvNoO5eABGVwvAzK33uPelmo3BKxfqiYgEXZI7kgeSo=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/applications/misc/hugo/default.nix

@@ -1,14 +1,14 @@
-{ stdenv, lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.102.0";
+  version = "0.102.1";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OepxYjzTJisBNoZP3IrYMj01Op7jsA2tWHrVDpwP9qE=";
+    sha256 = "sha256-lCdFxUlqGRQ5IMlhPhcJ5Ma35q75LnlcBNW1XUSWb1I=";
   };
 
   vendorSha256 = "sha256-y9bZ9EoB/n300oXO+PT4d8vSVMJC3HYyMRNf6eNhVik=";
@@ -23,6 +23,8 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
+  ldflags = [ "-s" "-w" "-X github.com/gohugoio/hugo/common/hugo.vendorInfo=nixpkgs" ];
+
   postInstall = ''
     $out/bin/hugo gen man
     installManPage man/*

pkgs/applications/misc/limesctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "limesctl";
-  version = "3.0.0";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "sapcc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-52Tq6gKozM/IFUyAy8N+YDqlbcFNQw6b2tc268Zco6g=";
+    sha256 = "sha256-+KOtGf+WgI2PhfFJnNyx5ycekRmfbqjSqvWOEhG65Oo=";
   };
 
-  vendorSha256 = "sha256-7QEb5J5IaxisKjbulyHq5PGVeKAX022Pz+5OV5qD7Uo=";
+  vendorSha256 = "sha256-LzLUz6diWva2HaxlhEGElbwUvUhCR0Tjsk/G/n5N3+k=";
 
   subPackages = [ "." ];
 

pkgs/applications/misc/remarkable/remarkable-mouse/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonApplication rec {
   pname = "remarkable-mouse";
-  version = "7.0.2";
+  version = "7.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-R/sQwVt+YHENkG9U2R205+YADovB8P58eMrUD/WnPic=";
+    sha256 = "sha256-e6xJBZmWXAPOHNNUMOGLjbe3QmvW0SRwfMNJVZsM3gw=";
   };
 
   propagatedBuildInputs = with python3Packages; [ screeninfo paramiko pynput libevdev ];

pkgs/applications/misc/rofi/wayland.nix

@@ -8,14 +8,14 @@
 
 rofi-unwrapped.overrideAttrs (oldAttrs: rec {
   pname = "rofi-wayland-unwrapped";
-  version = "1.7.3+wayland1";
+  version = "1.7.5+wayland1";
 
   src = fetchFromGitHub {
     owner = "lbonn";
     repo = "rofi";
     rev = version;
     fetchSubmodules = true;
-    sha256 = "sha256-qvIxWxiQj42VgScSsrF1Yf6ifgEbZes0flNbbwc3O8I=";
+    sha256 = "sha256-ddKLV7NvqgTQl5YlAEyBK0oalcJsLASK4z3qArQPUDQ=";
   };
 
   nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ wayland-protocols ];

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -32,9 +32,9 @@
     }
   },
   "dev": {
-    "version": "106.0.5245.0",
+    "version": "106.0.5249.12",
-    "sha256": "1hpp5gcajmjf2wvgrnsrfwl879gj8w8b6asn79raqj1qf2pa7wxg",
+    "sha256": "0brqn9rs3z3fdsnzjq2mr4p5c6d5fjllhfjfg39z3zmijcmd7f5y",
-    "sha256bin64": "1d4v2mwpbn3h533lkh8270hmj71ag9ivh7ns03qifsqsl9jv4zdv",
+    "sha256bin64": "1giay4nfcyczzcgrrdxrizd4pkiy7hqqc4ni6jg4rnbalh72p78n",
     "deps": {
       "gn": {
         "version": "2022-08-11",

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -3,10 +3,10 @@
 rec {
   firefox = buildMozillaMach rec {
     pname = "firefox";
-    version = "104.0";
+    version = "104.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "8778650ffa3c2d18802c348e27789f00cff143c7ca0ae01b1bcd050b6942c149db25696b48f3c702fbde901c15fcae976ac731a456f641637cae3eb56d0077d3";
+      sha512 = "ad80fccfde34a201fc4b596c2a0a1d959abc132946dde0865b6da624a07fd9c57381bc268c394a17f295e0e183d122b2cf5c5126e8a0bc99684affaa6212e246";
     };
 
     meta = {

pkgs/applications/networking/cluster/arkade/default.nix

@@ -7,20 +7,20 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.8.36";
+  version = "0.8.38";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    sha256 = "sha256-+666KfOK2yxkADw+EvKlXAAsz2Aw+EmRXGAqNMfBsj8=";
+    sha256 = "sha256-8C7aQCQ6kqHCGSktYS3djTlEuPyRnzb9LrXkqgfzDyY=";
   };
 
   CGO_ENABLED = 0;
 
   nativeBuildInputs = [ installShellFiles ];
 
-  vendorSha256 = "sha256-6EnhO4zYYdsTKvNQApZxXo8x6oFKsmuMvOI3zPHAQLs=";
+  vendorSha256 = "sha256-ok8NuqVFZtzjSLpgxQI03ISojfKdHPHWyikqwtceMlo=";
 
   # Exclude pkg/get: tests downloading of binaries which fail when sandbox=true
   subPackages = [

pkgs/applications/networking/cluster/driftctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "driftctl";
-  version = "0.34.1";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "snyk";
     repo = "driftctl";
     rev = "v${version}";
-    sha256 = "sha256-/tdAmu/BurCFB82i9pT2+PNOsPtHdlL/brUt4B9Q/EA=";
+    sha256 = "sha256-Abp5JetsMqIXZK8BxNa22OBFCxquoLoy3npv6XxCWGo=";
   };
 
-  vendorSha256 = "sha256-KChEDFZj5zsZ/viOVWgC15WI8mp5cUC+SdNwkCjo6bI=";
+  vendorSha256 = "sha256-uWPnBqT6lZSRClw2RyxHEOzue1Azj9VpPaulMA3qlug=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/cluster/kuma/default.nix

@@ -16,15 +16,15 @@
 
 buildGoModule rec {
   inherit pname ;
-  version = "1.7.1";
+  version = "1.8.0";
   tags = lib.optionals enableGateway ["gateway"];
-  vendorSha256 = "sha256-0YmWmGuzyES7BoHKWxzF2K1rDW7PO2DRdNmY3eJkUAM=";
+  vendorSha256 = "sha256-69uXHvpQMeFwQbejMpfQPS8DDXJyVsnn59WUEJpSeng=";
 
   src = fetchFromGitHub {
     owner = "kumahq";
     repo = "kuma";
     rev = version;
-    sha256 = "sha256-U8fWDXJ0ztod6r0qz63jbgYA06ItxA76BjSliniYnIQ=";
+    sha256 = "sha256-5459Fl7AbzuNGIOfDpVYlhvzLzfLT2Ckhr5omxZr76w=";
   };
 
   doCheck = false;

pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.38.8";
+  version = "0.38.9";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-iTKENFFST7nTsMe7KULGc/WnKrHSXRTWPm2DT5LJC00=";
+    sha256 = "sha256-rfAVgnFAxEguFuY+Gfe/T0NcsD6LmPSquxuTR0bRqXQ=";
   };
 
   vendorSha256 = "sha256-CqImT90jFFLi6XR7jfzFKwhnCHK6B+aM+Ba/L+G3bEg=";

pkgs/applications/networking/cluster/werf/default.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.165";
+  version = "1.2.166";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    sha256 = "sha256-YL3hdWUmt6v58ObnVNhILtM/DSqNlFcaODhNxzPyF0o=";
+    sha256 = "sha256-8LBGdjcnZTejH+lRo0im+czJJHOfhpmEB4DXM/qugYs=";
   };
 
   vendorSha256 = "sha256-E5yDk48O7zze8QTeLQ999QmB8XLkpKNZ8JQ2wVRMGCU=";

pkgs/applications/networking/feedreaders/rss2email/default.nix

@@ -4,14 +4,14 @@ with pythonPackages;
 
 buildPythonApplication rec {
   pname = "rss2email";
-  version = "3.13.1";
+  version = "3.14";
 
   propagatedBuildInputs = [ feedparser html2text ];
   checkInputs = [ beautifulsoup4 ];
 
   src = fetchurl {
     url = "mirror://pypi/r/rss2email/${pname}-${version}.tar.gz";
-    sha256 = "3994444766874bb35c9f886da76f3b24be1cb7bbaf40fad12b16f2af80ac1296";
+    sha256 = "sha256-RwORS2PHquxBZLNKqCJtR5XX4SHqPCb/Fn+Y68dfI/g=";
   };
 
   outputs = [ "out" "man" "doc" ];

pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix

@@ -4,11 +4,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "rocketchat-desktop";
-  version = "3.8.7";
+  version = "3.8.8";
 
   src = fetchurl {
     url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat-${version}-linux-amd64.deb";
-    sha256 = "sha256-kSEOjhsSa+5+oNxWY+cQR7RIRzd+BGR4WDL1drybxzU=";
+    sha256 = "sha256-8bbIJNbx3G46YX06I0K74a8VPNCHjn7I4R6Za+s+PRA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/instant-messengers/zoom-us/arm64-darwin-sha.nix

@@ -1 +0,0 @@
-"0cwplzza8vv4nzxf35i2p4gfnna4dpgp0ddqbpdxl8cxrikq5rji"

pkgs/applications/networking/instant-messengers/zoom-us/arm64-darwin-version.nix

@@ -1 +0,0 @@
-"5.11.1.8356"

pkgs/applications/networking/instant-messengers/zoom-us/default.nix

@@ -44,24 +44,26 @@ let
   throwSystem = throw "Unsupported system: ${system}";
 
   # Zoom versions are released at different times for each platform
-  version = {
+  # and often with different versions.  We write them on three lines
-    aarch64-darwin =import ./arm64-darwin-version.nix;
+  # like this (rather than using {}) so that the updater script can
-    x86_64-darwin = import ./x86_64-darwin-version.nix;
+  # find where to edit them.
-    x86_64-linux = import ./x86_64-linux-version.nix;
+  versions.aarch64-darwin = "5.11.9.10046";
-   }.${system} or throwSystem;
+  versions.x86_64-darwin = "5.11.9.10046";
+  versions.x86_64-linux = "5.11.10.4400";
 
   srcs = {
     aarch64-darwin = fetchurl {
-      url = "https://zoom.us/client/${version}/Zoom.pkg?archType=arm64";
+      url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
-      sha256 = import ./arm64-darwin-sha.nix;
+      name = "zoomusInstallerFull.pkg";
+      hash = "sha256-Z+K811azMRnhptZ1UvM+o5IgE0F4p9BrntJC9IgPU7U=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://zoom.us/client/${version}/Zoom.pkg";
+      url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      sha256 = import ./x86_64-darwin-sha.nix;
+      hash = "sha256-7U7qT3xlm5LqcJByMWxhZnqs6XBzylEGhqTNUgiaXJY=";
     };
     x86_64-linux = fetchurl {
-      url = "https://zoom.us/client/${version}/zoom_x86_64.pkg.tar.xz";
+      url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      sha256 = import ./x86_64-linux-sha.nix;
+      hash = "sha256-Pi1MtuCHzkQACamsNOIS6pbM03L1CmyosbpdrYVNCkQ=";
     };
   };
 
@@ -109,7 +111,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "zoom";
-  inherit version;
+  version = versions.${system} or throwSystem;
 
   src = srcs.${system} or throwSystem;
 

pkgs/applications/networking/instant-messengers/zoom-us/update.sh

@@ -1,30 +1,34 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl pup
+#!nix-shell -i bash -p common-updater-scripts curl jq
 
 set -eu -o pipefail
 
-dirname="$(dirname "$0")"
+scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
+nixpkgs=$(realpath "$scriptDir"/../../../../..)
 
-uname="$(uname)"
+echo >&2 "=== Obtaining version data from https://zoom.us/rest/download ..."
+linux_data=$(curl -Ls 'https://zoom.us/rest/download?os=linux' | jq .result.downloadVO)
+mac_data=$(curl -Ls 'https://zoom.us/rest/download?os=mac' | jq .result.downloadVO)
 
-if [[ "$uname" == "Linux" ]]; then
+version_aarch64_darwin=$(jq -r .zoomArm64.version <<<"$mac_data")
-    version="$(curl -Ls https://zoom.us/download\?os\=linux | \
+version_x86_64_darwin=$(jq -r .zoom.version <<<"$mac_data")
-      pup '.linux-ver-text text{}' | \
+version_x86_64_linux=$(jq -r .zoom.version <<<"$linux_data")
-      awk -F'[ ().]' '{printf $2"."$3"."$4"."$6"\n"}')"
+
-    printf '"%s"\n' ${version} > $dirname/x86_64-linux-version.nix
+echo >&2 "=== Downloading packages and computing hashes..."
-    printf '"%s"\n' \
+# We precalculate the hashes before calling update-source-version
-        $(nix-prefetch-url https://zoom.us/client/${version}/zoom_x86_64.pkg.tar.xz) > \
+# because it attempts to calculate each architecture's package's hash
-        $dirname/x86_64-linux-sha.nix
+# by running `nix-build --system <architecture> -A zoom-us.src` which
-elif [[ $uname == "Darwin" ]]; then
+# causes cross compiling headaches; using nix-prefetch-url with
-    # The 1st line might be empty
+# hard-coded URLs is simpler.  Keep these URLs in sync with the ones
-    # 2nd line is the version of the conference room application
+# in default.nix where `srcs` is defined.
-    version="$(curl -Ls https://zoom.us/download\?os\=mac | \
+hash_aarch64_darwin=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_aarch64_darwin}/zoomusInstallerFull.pkg?archType=arm64"))
-      pup '.ver text{}' | \
+hash_x86_64_darwin=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_x86_64_darwin}/zoomusInstallerFull.pkg"))
-      sed '/^$/d' |\
+hash_x86_64_linux=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_x86_64_linux}/zoom_x86_64.pkg.tar.xz"))
-      head -1 | \
+
-      awk -F'[ ().]' '{printf $2"."$3"."$4"."$6"\n"}')"
+echo >&2 "=== Updating default.nix ..."
-    printf '"%s"\n' ${version} > "$dirname/$(uname -m)-darwin-version.nix"
+# update-source-version expects to be at the root of nixpkgs
-    printf '"%s"\n' \
+(cd "$nixpkgs" && update-source-version zoom-us "$version_aarch64_darwin" $hash_aarch64_darwin --system=aarch64-darwin --version-key=versions.aarch64-darwin)
-        $(nix-prefetch-url "https://zoom.us/client/${version}/Zoom.pkg?archType=$(uname -m)") > \
+(cd "$nixpkgs" && update-source-version zoom-us "$version_x86_64_darwin" $hash_x86_64_darwin --system=x86_64-darwin --version-key=versions.x86_64-darwin)
-        "$dirname/$(uname -m)-darwin-sha.nix"
+(cd "$nixpkgs" && update-source-version zoom-us "$version_x86_64_linux" $hash_x86_64_linux --system=x86_64-linux --version-key=versions.x86_64-linux)
-fi
+
+echo >&2 "=== Done!"

pkgs/applications/networking/instant-messengers/zoom-us/x86_64-darwin-sha.nix

@@ -1 +0,0 @@
-"12s4z80n1qk1vcp5vppabj6fxanm4q7pjj7mggalmjbj6984fsza"

pkgs/applications/networking/instant-messengers/zoom-us/x86_64-darwin-version.nix

@@ -1 +0,0 @@
-"5.11.1.8356"

pkgs/applications/networking/instant-messengers/zoom-us/x86_64-linux-sha.nix

@@ -1 +0,0 @@
-"09x0l50frck8v2zhgp84m57q3kj74chk37sc69mpbhwy0s6vg980"

pkgs/applications/networking/instant-messengers/zoom-us/x86_64-linux-version.nix

@@ -1 +0,0 @@
-"5.11.3.3882"

pkgs/applications/networking/ipfs/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "ipfs";
-  version = "0.14.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.15.0"; # When updating, also check if the repo version changed and adjust repoVersion below
   rev = "v${version}";
 
   passthru.repoVersion = "12"; # Also update ipfs-migrator when changing the repo version
@@ -10,7 +10,7 @@ buildGoModule rec {
   # go-ipfs makes changes to it's source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-93jd0r5nWkGrMnaPXoJMf6dHxMrtiWPgkHYaWH109lg=";
+    hash = "sha256-GkOY1G2CKXbMbHXkw5v27HmfkJIl2nZOmjjZbzuaRWs=";
   };
 
   # tarball contains multiple files/directories

pkgs/applications/radio/freedv/default.nix

@@ -13,6 +13,10 @@
 , hamlib
 , wxGTK31-gtk3
 , pulseSupport ? config.pulseaudio or stdenv.isLinux
+, AppKit
+, AVFoundation
+, Cocoa
+, CoreMedia
 }:
 
 stdenv.mkDerivation rec {
@@ -26,7 +30,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-LPCY5gPinxJkfPfumKggI/JQorcW+Qw/ZAP6XQmPkeA=";
   };
 
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace src/CMakeLists.txt \
+      --replace "if(APPLE)" "if(0)" \
+      --replace "\''${FREEDV_LINK_LIBS})" "\''${FREEDV_LINK_LIBS} \''${FREEDV_LINK_LIBS_OSX})" \
+      --replace "\''${RES_FILES})" "\''${RES_FILES} \''${FREEDV_SOURCES_OSX})"
+  '';
+
   nativeBuildInputs = [ cmake ];
+
   buildInputs = [
     codec2
     libsamplerate
@@ -35,7 +47,13 @@ stdenv.mkDerivation rec {
     speexdsp
     hamlib
     wxGTK31-gtk3
-  ] ++ (if pulseSupport then [ libpulseaudio ] else [ portaudio ]);
+  ] ++ (if pulseSupport then [ libpulseaudio ] else [ portaudio ])
+  ++ lib.optionals stdenv.isDarwin [
+    AppKit
+    AVFoundation
+    Cocoa
+    CoreMedia
+  ];
 
   cmakeFlags = [
     "-DUSE_INTERNAL_CODEC2:BOOL=FALSE"
@@ -46,8 +64,7 @@ stdenv.mkDerivation rec {
     homepage = "https://freedv.org/";
     description = "Digital voice for HF radio";
     license = licenses.lgpl21;
-    maintainers = with maintainers; [ mvs ];
+    maintainers = with maintainers; [ mvs wegank ];
     platforms = platforms.unix;
-    broken = stdenv.isDarwin;  # see https://github.com/NixOS/nixpkgs/issues/165422
   };
 }

pkgs/applications/terminal-emulators/hyper/default.nix

@@ -15,11 +15,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "hyper";
-  version = "3.2.3";
+  version = "3.3.0";
 
   src = fetchurl {
     url = "https://github.com/vercel/hyper/releases/download/v${version}/hyper_${version}_amd64.deb";
-    sha256 = "sha256-CHLkHH9u5YWlmRDa4H3ymqg1YMBYjo+kuxpu0OVv4E8=";
+    sha256 = "sha256-VJAFa4I5nHuS/aXhiiXztUh2MjCq5zdwCtK0oSsOrGQ=";
   };
 
   nativeBuildInputs = [ dpkg ];

pkgs/applications/version-management/git-and-tools/git-remote-gcrypt/default.nix

@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "git-remote-gcrypt";
-  version = "1.4";
+  version = "1.5";
   rev = version;
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "spwhitton";
     repo = "git-remote-gcrypt";
-    sha256 = "sha256-uHgz8Aj5w8UOo/XbptCRKON1RAdDfFsLL9ZDEF1QrPQ=";
+    sha256 = "sha256-uy6s3YQwY/aZmQoW/qe1YrSlfNHyDTXBFxB6fPGiPNQ=";
   };
 
   outputs = [ "out" "man" ];

pkgs/applications/version-management/gitlab/data.json

@@ -1,15 +1,15 @@
 {
-  "version": "15.3.1",
+  "version": "15.3.2",
-  "repo_hash": "sha256-WSo1yh/stYzbNWS1XOO4wf4Jg4vvfGn3ugje1kMTtiA=",
+  "repo_hash": "sha256-MZ8sDfJh2sw+Tu5LPcH5JjznTSwfDj/3vmaGC+K8ZeY=",
-  "yarn_hash": "1cmz4815vfrgnh6khnx1hi0nnkz5xcrx8cqd9dxyd66pzwlyllx0",
+  "yarn_hash": "1s2xai0q16xhp3q68hf9mxh1v429h4n5qy1iizdi7a5cmg3p3ldq",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v15.3.1-ee",
+  "rev": "v15.3.2-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "15.3.1",
+    "GITALY_SERVER_VERSION": "15.3.2",
     "GITLAB_PAGES_VERSION": "1.62.0",
     "GITLAB_SHELL_VERSION": "14.10.0",
-    "GITLAB_WORKHORSE_VERSION": "15.3.1"
+    "GITLAB_WORKHORSE_VERSION": "15.3.2"
   },
   "vendored_gems": [
     "devise-pbkdf2-encryptable",

pkgs/applications/version-management/gitlab/gitaly/default.nix

@@ -11,7 +11,7 @@ let
     gemdir = ./.;
   };
 
-  version = "15.3.1";
+  version = "15.3.2";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -22,7 +22,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      sha256 = "sha256-g2w75eTjRUsKc2A0rue4Ei45nXrM0NjQk0LhRuhdUXQ=";
+      sha256 = "sha256-7OAB+oHY7OBCZ4rjiS+qQIPtpYRFS8xqOkUjgWj+Qp8=";
     };
 
     vendorSha256 = "sha256-aPCcTS5zflpjzb2L/oDOQotdL8cFsgKPa8b+lhCpbag=";

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix

@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "15.3.1";
+  version = "15.3.2";
 
   src = fetchFromGitLab {
     owner = data.owner;

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile

@@ -533,7 +533,7 @@ gem 'valid_email', '~> 0.1'
 # JSON
 gem 'json', '~> 2.5.1'
 gem 'json_schemer', '~> 0.2.18'
-gem 'oj', '~> 3.13.20'
+gem 'oj', '~> 3.13.21'
 gem 'multi_json', '~> 1.14.1'
 gem 'yajl-ruby', '~> 1.4.3', require: 'yajl'
 

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock

@@ -887,7 +887,7 @@ GEM
       plist (~> 3.1)
       train-core
       wmi-lite (~> 1.0)
-    oj (3.13.20)
+    oj (3.13.21)
     omniauth (1.9.1)
       hashie (>= 3.4.6)
       rack (>= 1.6.2, < 3)
@@ -1651,7 +1651,7 @@ DEPENDENCIES
   oauth2 (~> 2.0)
   octokit (~> 4.15)
   ohai (~> 16.10)
-  oj (~> 3.13.20)
+  oj (~> 3.13.21)
   omniauth (~> 1.8)
   omniauth-alicloud (~> 1.0.1)
   omniauth-atlassian-oauth2 (~> 0.2.0)

pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix

@@ -3505,10 +3505,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1iiavwlx9k3v9vyj2pswnc88vmn60prrg8dnsrpg4iglh40da64m";
+      sha256 = "0ihfnl0maszdq821h6mivr8xickjab6ccyncnm5rn2vgrj6imwxf";
       type = "gem";
     };
-    version = "3.13.20";
+    version = "3.13.21";
   };
   omniauth = {
     dependencies = ["hashie" "rack"];

pkgs/applications/version-management/gource/default.nix

@@ -1,23 +1,31 @@
-{ lib, stdenv, fetchurl, SDL2, ftgl, pkg-config, libpng, libjpeg, pcre
+{ lib, stdenv, fetchurl, SDL2, ftgl, pkg-config, libpng, libjpeg, pcre2
-, SDL2_image, freetype, glew, libGLU, libGL, boost, glm
+, SDL2_image, freetype, glew, libGLU, libGL, boost, glm, tinyxml
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.51";
   pname = "gource";
+  version = "0.53";
 
   src = fetchurl {
     url = "https://github.com/acaudwell/Gource/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "16p7b1x4r0915w883lp374jcdqqja37fnb7m8vnsfnl2n64gi8qr";
+    hash = "sha256-PV9kwcaBL2RMMgy8mphY35e8YDb8Hl9gPKRrFbjdcjc=";
   };
 
+  postPatch = ''
+    # remove bundled library
+    rm -r src/tinyxml
+  '';
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    glew SDL2 ftgl libpng libjpeg pcre SDL2_image libGLU libGL
+    glew SDL2 ftgl libpng libjpeg pcre2 SDL2_image libGLU libGL
-    boost glm freetype
+    boost glm freetype tinyxml
   ];
 
-  configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ];
+  configureFlags = [
+    "--with-boost-libdir=${boost.out}/lib"
+    "--with-tinyxml"
+  ];
 
   enableParallelBuilding = true;
 

pkgs/applications/virtualization/cri-o/default.nix

@@ -15,13 +15,13 @@
 
 buildGoModule rec {
   pname = "cri-o";
-  version = "1.24.2";
+  version = "1.25.0";
 
   src = fetchFromGitHub {
     owner = "cri-o";
     repo = "cri-o";
     rev = "v${version}";
-    sha256 = "sha256-7nQI6zaWSWML2suPn1A+RJZ0iPJu6JD/4ion5zxlnJ8=";
+    sha256 = "sha256-3J/fiaJL828P0L0vgwcR3DbMASt3fcwnLBu33SFDlx0=";
   };
   vendorSha256 = null;
 

pkgs/applications/virtualization/nixpacks/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "0.3.3";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CnRYMdqQvYvHzYNFa6QNh9yFyHeXrMJFPafEcYZ/sHE=";
+    sha256 = "sha256-Fzj22vGW4qLXSw5lICxVbiVFxYYvkarVLLHT+DdLVRk=";
   };
 
-  cargoSha256 = "sha256-OHG1XMSurmSxtMb/rizgLnyIHIo+SJSlM1Ggl8crHzM=";
+  cargoSha256 = "sha256-v3LNadq3E08Z+LfRSGQxG1HPgYWBQ8K/44LOrjgrsy0=";
 
   # skip test due FHS dependency
   doCheck = false;

pkgs/applications/window-managers/icewm/default.nix

@@ -2,7 +2,6 @@
 , stdenv
 , fetchFromGitHub
 , fetchpatch
-, asciidoc
 , cmake
 , expat
 , fontconfig
@@ -40,17 +39,16 @@
 
 stdenv.mkDerivation rec {
   pname = "icewm";
-  version = "2.9.8";
+  version = "2.9.9";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = pname;
     rev = version;
-    hash = "sha256-SjLXPlwL3tMBD7RCJkL60lqcld/ZXIxgjeNrAn8A6KU=";
+    hash = "sha256-55xi4GsP41FXJ/B/zEnjru72FhZQhXnpEdHcN0WF9Kk=";
   };
 
   nativeBuildInputs = [
-    asciidoc
     cmake
     perl
     pkg-config

pkgs/data/icons/fluent-icon-theme/default.nix

@@ -0,0 +1,73 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gtk3
+, hicolor-icon-theme
+, jdupes
+, roundedIcons ? false
+, blackPanelIcons ? false
+, colorVariants ? []
+,
+}:
+let
+  pname = "Fluent-icon-theme";
+in
+lib.checkListOfEnum "${pname}: available color variants" [
+  "standard"
+  "green"
+  "grey"
+  "orange"
+  "pink"
+  "purple"
+  "red"
+  "yellow"
+  "teal"
+  "all"
+] colorVariants
+
+stdenvNoCC.mkDerivation rec {
+  inherit pname;
+  version = "2022-02-28";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = pname;
+    rev = version;
+    sha256 = "UMj3qF9lhd9kM7J/3RtG3AiWlBontrowfsFOb3yr0tQ=";
+  };
+
+  nativeBuildInputs = [ gtk3 jdupes ];
+
+  buildInputs = [ hicolor-icon-theme ];
+
+  # Unnecessary & slow fixup's
+  dontPatchELF = true;
+  dontRewriteSymlinks = true;
+  dontDropIconThemeCache = true;
+
+  postPatch = ''
+    patchShebangs install.sh
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    ./install.sh --dest $out/share/icons \
+      --name Fluent \
+      ${builtins.toString colorVariants} \
+      ${lib.optionalString roundedIcons "--round"} \
+      ${lib.optionalString blackPanelIcons "--black"}
+
+    jdupes --link-soft --recurse $out/share
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Fluent icon theme for linux desktops";
+    homepage = "https://github.com/vinceliuice/Fluent-icon-theme";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ icy-thought ];
+  };
+}

pkgs/data/icons/whitesur-icon-theme/default.nix

@@ -12,17 +12,28 @@
 let
   pname = "Whitesur-icon-theme";
 in
-lib.checkListOfEnum "${pname}: theme variants" [ "default" "purple" "pink" "red" "orange" "yellow" "green" "grey" "nord" "all" ] themeVariants
+lib.checkListOfEnum "${pname}: theme variants" [
+  "default"
+  "purple"
+  "pink"
+  "red"
+  "orange"
+  "yellow"
+  "green"
+  "grey"
+  "nord"
+  "all"
+] themeVariants
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2022-05-11";
+  version = "2022-08-30";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "sha256-7Bbkjbh6nZdYot0tJMWFuW1Jnl9U4KOLN/n+z92UWh4=";
+    sha256 = "pcvRD4CUwUT46/kmMbnerj5mqPCcHIRreVIh9wz6Kfg=";
   };
 
   nativeBuildInputs = [ gtk3 jdupes ];
@@ -32,7 +43,6 @@ stdenvNoCC.mkDerivation rec {
   # These fixup steps are slow and unnecessary
   dontPatchELF = true;
   dontRewriteSymlinks = true;
-
   dontDropIconThemeCache = true;
 
   postPatch = ''

pkgs/data/themes/whitesur/default.nix

@@ -32,13 +32,13 @@ lib.checkListOfEnum "${pname}: panel size" [ "default" "smaller" "bigger" ] (sin
 
 stdenv.mkDerivation rec {
   pname = "whitesur-gtk-theme";
-  version = "2022-02-21";
+  version = "2022-08-26";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "1bqgbkx7qhpj9vbqcxb69p67m8ix3avxr81pdpdi56g9gqbnkpfc";
+    sha256 = "sha256-kvu6Zv5vmyDasBt6eOBqexv0n5vi6OzpG5We1eSbW0o=";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/elm/default.nix

@@ -238,6 +238,8 @@ in lib.makeScope pkgs.newScope (self: with self; {
         }
       );
 
+      lamdera = callPackage ./packages/lamdera.nix {};
+
       inherit (nodePkgs) elm-doc-preview elm-live elm-upgrade elm-xref elm-analyse elm-git-install;
     })
   )

pkgs/development/compilers/elm/packages/lamdera.nix

@@ -0,0 +1,40 @@
+{ stdenv, lib
+, fetchurl
+, autoPatchelfHook
+, gmp5, ncurses5, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "lamdera";
+  version = "1.0.1";
+
+  src = fetchurl {
+    url = "https://static.lamdera.com/bin/linux/lamdera-v${version}";
+    sha256 = "15dee9df5d4e71b07a65fbd89d0f7dcd8c3e7ba05fe2b0e7a30d29bbd1239d9f";
+  };
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    gmp5
+    ncurses5
+    zlib
+  ];
+
+
+  installPhase = ''
+    install -m755 -D $src $out/bin/lamdera
+  '';
+
+  meta = with lib; {
+    homepage = "https://lamdera.com";
+    license = licenses.unfree;
+    description = "A delightful platform for full-stack web apps";
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ Zimmi48 ];
+  };
+}

pkgs/development/compilers/silice/default.nix

@@ -0,0 +1,87 @@
+{ stdenv, fetchFromGitHub, lib
+, cmake, pkg-config, openjdk
+, libuuid, python3
+, silice, yosys, nextpnr, verilator
+, dfu-util, icestorm, trellis
+}:
+
+stdenv.mkDerivation rec {
+  pname = "silice";
+  version = "unstable-2022-08-05";
+
+  src = fetchFromGitHub {
+    owner = "sylefeb";
+    repo = pname;
+    rev = "e26662ac757151e5dd8c60c45291b44906b1299f";
+    sha256 = "sha256-Q1JdgDlEErutZh0OfxYy5C4aVijFKlf6Hm5Iv+1jsj4=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    openjdk
+  ];
+  buildInputs = [
+    libuuid
+  ];
+  propagatedBuildInputs = [
+    (python3.withPackages (p: with p; [ edalize ]))
+  ];
+
+  postPatch = ''
+    patchShebangs antlr/antlr.sh
+    # use nixpkgs version
+    rm -r python/pybind11
+  '';
+
+  installPhase = ''
+    make install
+    mkdir -p $out
+    cp -ar ../{bin,frameworks,lib} $out/
+  '';
+
+  passthru.tests =
+    let
+      testProject = project: stdenv.mkDerivation {
+        name = "${silice.name}-test-${project}";
+        nativeBuildInputs = [
+          silice
+          yosys
+          nextpnr
+          verilator
+          dfu-util
+          icestorm
+          trellis
+        ];
+        src = "${src}/projects";
+        sourceRoot = "projects/${project}";
+        buildPhase = ''
+          targets=$(cut -d " " -f 2 configs | tr -d '\r')
+          for target in $targets ; do
+            make $target ARGS="--no_program"
+          done
+        '';
+        installPhase = ''
+          mkdir $out
+          for target in $targets ; do
+            cp -r BUILD_$target $out/
+          done
+        '';
+      };
+    in {
+      # a selection of test projects that build with the FPGA tools in
+      # nixpkgs
+      audio_sdcard_streamer = testProject "audio_sdcard_streamer";
+      bram_interface = testProject "bram_interface";
+      blinky = testProject "blinky";
+      pipeline_sort = testProject "pipeline_sort";
+    };
+
+  meta = with lib; {
+    description = "Open source language that simplifies prototyping and writing algorithms on FPGA architectures";
+    homepage = "https://github.com/sylefeb/Silice";
+    license = licenses.bsd2;
+    maintainers = [ maintainers.astro ];
+  };
+}

pkgs/development/libraries/audio/libgme/default.nix

@@ -1,34 +0,0 @@
-{ lib, stdenv, fetchFromBitbucket, cmake, removeReferencesTo }:
-
-stdenv.mkDerivation rec {
-  pname = "libgme";
-  version = "0.6.3";
-
-  meta = with lib; {
-    description = "A collection of video game music chip emulators";
-    homepage = "https://bitbucket.org/mpyne/game-music-emu/overview";
-    license = licenses.lgpl21;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ lheckemann ];
-  };
-
-  src = fetchFromBitbucket {
-    owner = "mpyne";
-    repo = "game-music-emu";
-    rev = version;
-    sha256 = "100ahb4n4pvgcry9xzlf2fr4j57n5h9x7pvyhhxys4dcy8axqqsy";
-  };
-
-  nativeBuildInputs = [ cmake removeReferencesTo ];
-
-  # These checks fail on aarch64-darwin
-  cmakeFlags = [ "-DENABLE_UBSAN=OFF" ];
-
-  # It used to reference it, in the past, but thanks to the postFixup hook, now
-  # it doesn't.
-  disallowedReferences = [ stdenv.cc.cc ];
-
-  postFixup = lib.optionalString stdenv.isLinux ''
-    remove-references-to -t ${stdenv.cc.cc} "$(readlink -f $out/lib/libgme.so)"
-  '';
-}

pkgs/development/libraries/cmark-gfm/default.nix

@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "cmark-gfm";
-  version = "0.29.0.gfm.4";
+  version = "0.29.0.gfm.5";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "cmark-gfm";
     rev = version;
-    sha256 = "sha256-touFLrxVQvX75JXYLADq84yIuQ1kl43fVUvZ4qGYoMM=";
+    sha256 = "sha256-HNFxp62xBNo2GbWiiYXco2NMgoOXsnZNdbXgTK1i1JU=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/gstreamer/bad/default.nix

@@ -78,7 +78,7 @@
 , libGLU
 , libGL
 , libintl
-, libgme
+, game-music-emu
 , openssl
 , x265
 , libxml2
@@ -164,7 +164,7 @@ stdenv.mkDerivation rec {
     gnutls
     libGL
     libGLU
-    libgme
+    game-music-emu
     openssl
     libxml2
     libintl

pkgs/development/libraries/libcouchbase/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcouchbase";
-  version = "3.3.1";
+  version = "3.3.2";
 
   src = fetchFromGitHub {
     owner = "couchbase";
     repo = "libcouchbase";
     rev = version;
-    sha256 = "sha256-Fyx8qGojlWMlDCnuG+Ks2L2/Kf94GC+/0YiV3JjZgS8=";
+    sha256 = "sha256-nGZHAp2ajGHNHjfKTAQrQSlBmyufzP9V8/vRO6S8Ui0=";
   };
 
   cmakeFlags = [ "-DLCB_NO_MOCK=ON" ];

pkgs/development/libraries/medfile/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "medfile";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchurl {
     url = "http://files.salome-platform.org/Salome/other/med-${version}.tar.gz";
-    sha256 = "1khzclkrd1yn9mz3g14ndgpsbj8j50v8dsjarcj6kkn9zgbbazc4";
+    sha256 = "sha256-3CtdVOvwZm4/8ul0BB0qsNqQYGEyNTcCOrFl1XM4ndA=";
   };
 
   patches = [

pkgs/development/libraries/poppler/default.nix

@@ -23,7 +23,7 @@
 , texlive
 , zlib
 , withData ? true, poppler_data
-, qt5Support ? false, qtbase ? null
+, qt5Support ? false, qt6Support ? false, qtbase ? null
 , introspectionSupport ? false, gobject-introspection ? null
 , utils ? false, nss ? null
 , minimal ? false
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     lcms
     curl
     nss
-  ] ++ lib.optionals qt5Support [
+  ] ++ lib.optionals (qt5Support || qt6Support) [
     qtbase
   ] ++ lib.optionals introspectionSupport [
     gobject-introspection
@@ -85,6 +85,7 @@ stdenv.mkDerivation rec {
     (mkFlag (!minimal) "LIBCURL")
     (mkFlag utils "UTILS")
     (mkFlag qt5Support "QT5")
+    (mkFlag qt6Support "QT6")
   ];
 
   dontWrapQtApps = true;

pkgs/development/libraries/seasocks/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "seasocks";
-  version = "1.4.4";
+  version = "1.4.5";
 
   src = fetchFromGitHub {
     owner = "mattgodbolt";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1f9a3mx3yjmr5qry4rc1c7mrx3348iifxm7d8sj8yd41kqnzmfv4";
+    sha256 = "sha256-b1KNHuS5ndkBWItKVTiJ//Y+uKi1PcUk9624IILOusQ=";
   };
 
   postPatch = ''

pkgs/development/libraries/webkitgtk/default.nix

@@ -67,7 +67,7 @@
 
 stdenv.mkDerivation rec {
   pname = "webkitgtk";
-  version = "2.36.6";
+  version = "2.36.7";
 
   outputs = [ "out" "dev" ];
 
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-EZO8ghlGM2d28N+l4NylZR8eVxV+2hLaRyHSRB8kpho=";
+    sha256 = "sha256-DCYM8rMvBIHQF2cN/tG2HlVJZ80GcZVgbJ+etf5zF0M=";
   };
 
   patches = lib.optionals stdenv.isLinux [

pkgs/development/libraries/xsimd/default.nix

@@ -1,35 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake, gtest }:
-let
+stdenv.mkDerivation rec {
-  version = "7.5.0";
+  pname = "xsimd";
-
+  version = "8.1.0";
-  darwin_src = fetchFromGitHub {
-    owner = "xtensor-stack";
-    repo = "xsimd";
-    rev = version;
-    sha256 = "eGAdRSYhf7rbFdm8g1Tz1ZtSVu44yjH/loewblhv9Vs=";
-    # Avoid requiring apple_sdk. We're doing this here instead of in the patchPhase
-    # because this source is directly used in arrow-cpp.
-    # pyconfig.h defines _GNU_SOURCE to 1, so we need to stamp that out too.
-    # Upstream PR with a better fix: https://github.com/xtensor-stack/xsimd/pull/463
-    postFetch = ''
-      mkdir $out
-      tar -xf $downloadedFile --directory=$out --strip-components=1
-      substituteInPlace $out/include/xsimd/types/xsimd_scalar.hpp \
-        --replace 'defined(__APPLE__)' 0 \
-        --replace 'defined(_GNU_SOURCE)' 0
-    '';
-  };
-
   src = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
     rev = version;
-    sha256 = "0c9pq5vz43j99z83w3b9qylfi66mn749k1afpv5cwfxggbxvy63f";
+    sha256 = "sha256-Aqs6XJkGjAjGAp0PprabSM4m+32M/UXpSHppCHdzaZk=";
   };
-in stdenv.mkDerivation {
-  pname = "xsimd";
-  inherit version;
-  src = if stdenv.hostPlatform.isDarwin then darwin_src else src;
 
   nativeBuildInputs = [ cmake ];
 
@@ -38,13 +16,14 @@ in stdenv.mkDerivation {
   doCheck = true;
   checkInputs = [ gtest ];
   checkTarget = "xtest";
-  GTEST_FILTER = let
+  GTEST_FILTER =
+    let
       # Upstream Issue: https://github.com/xtensor-stack/xsimd/issues/456
       filteredTests = lib.optionals stdenv.hostPlatform.isDarwin [
-        "error_gamma_test/sse_double.gamma"
+        "error_gamma_test/*"
-        "error_gamma_test/avx_double.gamma"
       ];
-    in "-${builtins.concatStringsSep ":" filteredTests}";
+    in
+    "-${builtins.concatStringsSep ":" filteredTests}";
 
   meta = with lib; {
     description = "C++ wrappers for SIMD intrinsics";

pkgs/development/ocaml-modules/lwt_log/default.nix

@@ -2,17 +2,15 @@
 
 buildDunePackage rec {
   pname = "lwt_log";
-  version = "1.1.1";
+  version = "1.1.2";
 
-  useDune2 = true;
+  minimalOCamlVersion = "4.03";
-
-  minimumOCamlVersion = "4.02";
 
   src = fetchFromGitHub {
     owner = "aantron";
     repo = pname;
     rev = version;
-    sha256 = "1n12i1rmn9cjn6p8yr6qn5dwbrwvym7ckr7bla04a1xnq8qlcyj7";
+    sha256 = "sha256-ODTD3KceEnrEzD01CeuNg4BNKOtKZEpYaDIB+RIte1U=";
   };
 
   propagatedBuildInputs = [ lwt ];

pkgs/development/ocaml-modules/torch/default.nix

@@ -12,7 +12,7 @@
 , ppx_sexp_conv
 , sexplib
 , stdio
-, pytorch
+, torch
 }:
 
 buildDunePackage rec {
@@ -37,16 +37,16 @@ buildDunePackage rec {
     ctypes
     npy
     ocaml-compiler-libs
-    pytorch
-    pytorch.dev
     ppx_custom_printf
     ppx_expect
     ppx_sexp_conv
     sexplib
     stdio
+    torch
+    torch.dev
   ];
 
-  preBuild = "export LIBTORCH=${pytorch.dev}/";
+  preBuild = "export LIBTORCH=${torch.dev}/";
 
   doCheck = !stdenv.isAarch64;
   checkPhase = "dune runtest";
@@ -56,6 +56,6 @@ buildDunePackage rec {
     description = "Ocaml bindings to Pytorch";
     maintainers = [ maintainers.bcdarwin ];
     license = licenses.asl20;
-    broken = lib.versionAtLeast pytorch.version "1.11";
+    broken = lib.versionAtLeast torch.version "1.11";
   };
 }

pkgs/development/php-packages/pdepend/default.nix

@@ -2,14 +2,14 @@
 
 let
   pname = "pdepend";
-  version = "2.10.3";
+  version = "2.11.0";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pdepend/pdepend/releases/download/${version}/pdepend.phar";
-    sha256 = "I5+n8+a3rHRgW4OM6FbVcf3T1wu9zBrTSb5sGq7ArH4=";
+    sha256 = "sha256-QhNO/yI2oJNhkwSn32gdId5IY0VR69eF/b/yMklhPKs=";
   };
 
   dontUnpack = true;

pkgs/development/python-modules/aioaladdinconnect/default.nix

@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "aioaladdinconnect";
-  version = "0.1.43";
+  version = "0.1.44";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "AIOAladdinConnect";
     inherit version;
-    hash = "sha256-P0o8LhjTzhfJerunTcadvYQOZMd7WbfnKbeAEhXFP1Q=";
+    hash = "sha256-TtqCbU3NYrRy4upBOZNSC3+TrcBg4ol7JXqeOI6+IhA=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/asysocks/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "asysocks";
-  version = "0.1.7";
+  version = "0.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-I9X8+ucadYJsPteHvZsbw7GJ7DdliWG86DyemUVeNUw=";
+    sha256 = "sha256-1mrXgwWI1XGmN3J9HJBktHFowIEU+RPt9L6S4ylHTzw=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/boxx/default.nix

@@ -12,7 +12,7 @@
 , fn
 , pyopengl
 , seaborn
-, pytorch
+, torch
 , pythonOlder
 , torchvision
 }:
@@ -43,7 +43,7 @@ buildPythonPackage rec {
 
   checkInputs = [
     xvfb-run
-    pytorch
+    torch
     torchvision
   ];
 

pkgs/development/python-modules/cloudscraper/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "cloudscraper";
-  version = "1.2.63";
+  version = "1.2.64";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JId7lxdSnU1BQ6AoGj2rB8Z+9QOK5/5IhjluCrDBQHg=";
+    hash = "sha256-FS+p+dtfGfStp+dWI+k/RdBb/T+ynZyuhPKRc6JZFTA=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/coqui-trainer/default.nix

@@ -6,7 +6,7 @@
 
 , coqpit
 , fsspec
-, pytorch-bin
+, torch-bin
 , tensorboardx
 , protobuf
 
@@ -33,7 +33,7 @@ buildPythonPackage {
   propagatedBuildInputs = [
     coqpit
     fsspec
-    pytorch-bin
+    torch-bin
     soundfile
     tensorboardx
     protobuf

pkgs/development/python-modules/deepwave/default.nix

@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pytorch
+, torch
 , ninja
 , scipy
 , which
@@ -48,7 +48,7 @@ buildPythonPackage rec {
     export HOME=$(mktemp -d)
   '';
 
-  propagatedBuildInputs = [ pytorch pybind11 ];
+  propagatedBuildInputs = [ torch pybind11 ];
 
   checkInputs = [
     which

pkgs/development/python-modules/dicom2nifti/default.nix

@@ -1,9 +1,9 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, isPy27
+, pythonOlder
+, pytestCheckHook
 , gdcm
-, nose
 , nibabel
 , numpy
 , pydicom
@@ -13,21 +13,30 @@
 
 buildPythonPackage rec {
   pname = "dicom2nifti";
-  version = "2.3.0";
+  version = "2.4.3";
-  disabled = isPy27;
+  disabled = pythonOlder "3.6";
 
   # no tests in PyPI dist
   src = fetchFromGitHub {
     owner = "icometrix";
     repo = pname;
     rev = version;
-    sha256 = "sha256-QSu9CGXFjDpI25Cy6QSbrwiQ2bwsVezCUxSovRLs6AI=";
+    hash = "sha256-za2+HdnUhPu3+p29JsF4iL1lyPQVmEv3fam0Yf1oeMQ=";
   };
 
-  propagatedBuildInputs = [ nibabel numpy pydicom scipy setuptools ];
+  propagatedBuildInputs = [ gdcm nibabel numpy pydicom scipy setuptools ];
 
-  checkInputs = [ nose gdcm ];
+  # python-gdcm just builds the python interface provided by the "gdcm" package, so
-  checkPhase = "nosetests tests";
+  # we should be able to replace "python-gdcm" with "gdcm" but this doesn't work
+  # (similar to https://github.com/NixOS/nixpkgs/issues/84774)
+  postPatch = ''
+    substituteInPlace setup.py --replace "python-gdcm" ""
+    substituteInPlace tests/test_generic.py --replace "from common" "from dicom2nifti.common"
+  '';
+
+  checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "dicom2nifti" ];
 
   meta = with lib; {
     homepage = "https://github.com/icometrix/dicom2nifti";

pkgs/development/python-modules/edalize/default.nix

@@ -0,0 +1,73 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, coreutils
+, jinja2
+, pandas
+, pytestCheckHook
+, which
+, verilog
+, yosys
+}:
+
+buildPythonPackage rec {
+  pname = "edalize";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "olofk";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-fpUNCxW7+uymodJ/yGME9VNcCEZdBROIdT1+blpgkzA=";
+  };
+
+  postPatch = ''
+    substituteInPlace tests/test_edam.py \
+      --replace /usr/bin/touch ${coreutils}/bin/touch
+    patchShebangs tests/mock_commands/vsim
+  '';
+
+  propagatedBuildInputs = [ jinja2 ];
+
+  checkInputs = [
+    pytestCheckHook
+    pandas
+    which
+    yosys
+    verilog
+  ];
+
+  pythonImportsCheck = [ "edalize" ];
+
+  disabledTestPaths = [
+    "tests/test_apicula.py"
+    "tests/test_ascentlint.py"
+    "tests/test_diamond.py"
+    "tests/test_gatemate.py"
+    "tests/test_ghdl.py"
+    "tests/test_icarus.py"
+    "tests/test_icestorm.py"
+    "tests/test_ise.py"
+    "tests/test_mistral.py"
+    "tests/test_openlane.py"
+    "tests/test_oxide.py"
+    "tests/test_quartus.py"
+    "tests/test_radiant.py"
+    "tests/test_spyglass.py"
+    "tests/test_symbiyosys.py"
+    "tests/test_trellis.py"
+    "tests/test_vcs.py"
+    "tests/test_veribleformat.py"
+    "tests/test_veriblelint.py"
+    "tests/test_vivado.py"
+    "tests/test_xcelium.py"
+    "tests/test_xsim.py"
+  ];
+
+  meta = with lib; {
+    description = "Abstraction library for interfacing EDA tools";
+    homepage = "https://github.com/olofk/edalize";
+    license = licenses.bsd2;
+    maintainers = [ maintainers.astro ];
+  };
+}

pkgs/development/python-modules/elegy/default.nix

@@ -8,7 +8,7 @@
 , lib
 , poetry
 , pytestCheckHook
-, pytorch
+, torch
 , pyyaml
 , sh
 , tables
@@ -66,7 +66,7 @@ buildPythonPackage rec {
 
   checkInputs = [
     pytestCheckHook
-    pytorch
+    torch
     sh
     tensorflow
   ];

pkgs/development/python-modules/ezyrb/default.nix

@@ -8,7 +8,7 @@
 , scipy
 , matplotlib
 , scikit-learn
-, pytorch
+, torch
 , pytestCheckHook
 }:
 
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     scipy
     matplotlib
     scikit-learn
-    pytorch
+    torch
   ];
 
   checkInputs = [

pkgs/development/python-modules/functorch/default.nix

@@ -5,7 +5,7 @@
 , ninja
 , pytestCheckHook
 , python
-, pytorch
+, torch
 , pybind11
 , which
 }:
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   # `setup.py` imports `torch.utils.cpp_extension`.
   nativeBuildInputs = [
     ninja
-    pytorch
+    torch
     which
   ];
 

pkgs/development/python-modules/google-cloud-secret-manager/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.12.3";
+  version = "2.12.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-591Z/JIMwIwjhj4VKJKUztu2FMupdyUuKmxxUfK/TLE=";
+    hash = "sha256-nbM+uZr7a3RXvtLI7n5XZZD9r9ZVoh5iCSoZAnDIuQQ=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/google-cloud-securitycenter/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-securitycenter";
-  version = "1.13.0";
+  version = "1.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Jrd1ySx6n2ilUbObPrvsLOzUIUIGHeFQZTop8xbrAdY=";
+    hash = "sha256-VNvIt3WYMMXOMovJvbSwKU2/Xz8/F+BW0XoKdi0QSo0=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/ignite/default.nix

@@ -8,7 +8,7 @@
 , matplotlib
 , mock
 , packaging
-, pytorch
+, torch
 , scikit-learn
 , tqdm
 }:
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   };
 
   checkInputs = [ pytestCheckHook matplotlib mock pytest-xdist torchvision ];
-  propagatedBuildInputs = [ packaging pytorch scikit-learn tqdm ];
+  propagatedBuildInputs = [ packaging torch scikit-learn tqdm ];
 
   # runs succesfully in 3.9, however, async isn't correctly closed so it will fail after test suite.
   doCheck = pythonOlder "3.9";

pkgs/development/python-modules/ipydatawidgets/default.nix

@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "ipydatawidgets";
-  version = "4.3.1.post1";
+  version = "4.3.2";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-aYGrzNmmupSuf2FuGBqabaPrFUM+VrtfFAQeXBEaJR8=";
+    sha256 = "sha256-LyuZf2Vp0+4fT3412wyx2gjAd7IaiPHAHFn1uYajGqY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/jax/cache-fix.patch

@@ -1,12 +0,0 @@
-diff --git a/jax/experimental/compilation_cache/file_system_cache.py b/jax/experimental/compilation_cache/file_system_cache.py
-index b85969de..92acd523 100644
---- a/jax/experimental/compilation_cache/file_system_cache.py
-+++ b/jax/experimental/compilation_cache/file_system_cache.py
-@@ -33,6 +33,7 @@ class FileSystemCache(CacheInterface):
-     path_to_key = os.path.join(self._path, key)
-     if os.path.exists(path_to_key):
-       with open(path_to_key, "rb") as file:
-+        os.utime(file.fileno())
-         return file.read()
-     else:
-       return None

pkgs/development/python-modules/jax/default.nix

@@ -2,10 +2,11 @@
 , absl-py
 , blas
 , buildPythonPackage
+, etils
 , fetchFromGitHub
-, fetchpatch
 , jaxlib
 , lapack
+, matplotlib
 , numpy
 , opt-einsum
 , pytestCheckHook
@@ -20,7 +21,7 @@ let
 in
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.3.6";
+  version = "0.3.16";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,34 +30,25 @@ buildPythonPackage rec {
     owner = "google";
     repo = pname;
     rev = "jax-v${version}";
-    hash = "sha256-eGdAEZFHadNTHgciP4KMYHdwksz9g6un0Ar+A/KV5TE=";
+    hash = "sha256-4idh7boqBXSO9vEHxEcrzXjBIrKmmXiCf6cXh7En1/I=";
   };
 
-  patches = [
-    # See https://github.com/google/jax/issues/7944
-    ./cache-fix.patch
-
-    # See https://github.com/google/jax/issues/10292
-    (fetchpatch {
-      url = "https://github.com/google/jax/commit/cadc8046d56e0c1433cf48a2f106947d5f4ecbfd.patch";
-      hash = "sha256-jrpIqt4LzWAswt/Cpwtfa5d1Yn31HcXkVH3ETmaigA0=";
-    })
-  ];
-
   # jaxlib is _not_ included in propagatedBuildInputs because there are
   # different versions of jaxlib depending on the desired target hardware. The
   # JAX project ships separate wheels for CPU, GPU, and TPU. Currently only the
   # CPU wheel is packaged.
   propagatedBuildInputs = [
     absl-py
+    etils
     numpy
     opt-einsum
     scipy
     typing-extensions
-  ];
+  ] ++ etils.optional-dependencies.epath;
 
   checkInputs = [
     jaxlib
+    matplotlib
     pytestCheckHook
     pytest-xdist
   ];

pkgs/development/python-modules/jaxlib/default.nix

@@ -9,11 +9,14 @@
 , buildBazelPackage
 , buildPythonPackage
 , cctools
+, curl
 , cython
 , fetchFromGitHub
 , git
 , IOKit
 , jsoncpp
+, nsync
+, openssl
 , pybind11
 , setuptools
 , symlinkJoin
@@ -50,7 +53,7 @@ let
   inherit (cudaPackages) cudatoolkit cudnn nccl;
 
   pname = "jaxlib";
-  version = "0.3.0";
+  version = "0.3.15";
 
   meta = with lib; {
     description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
@@ -93,7 +96,7 @@ let
       owner = "google";
       repo = "jax";
       rev = "${pname}-v${version}";
-      sha256 = "0ndpngx5k6lf6jqjck82bbp0gs943z0wh7vs9gwbyk2bw0da7w72";
+      sha256 = "sha256-pIl7zzl82w5HHnJadH2vtCT4mYFd5YmM9iHC2GoJD6s=";
     };
 
     nativeBuildInputs = [
@@ -103,15 +106,19 @@ let
       setuptools
       wheel
       which
+    ] ++ lib.optionals stdenv.isDarwin [
+      cctools
     ];
 
     buildInputs = [
+      curl
       double-conversion
       giflib
       grpc
       jsoncpp
       libjpeg_turbo
       numpy
+      openssl
       pkgs.flatbuffers
       pkgs.protobuf
       pybind11
@@ -124,6 +131,8 @@ let
       cudnn
     ] ++ lib.optionals stdenv.isDarwin [
       IOKit
+    ] ++ lib.optionals (!stdenv.isDarwin) [
+      nsync
     ];
 
     postPatch = ''
@@ -149,6 +158,7 @@ let
       build --action_env=PYENV_ROOT
       build --python_path="${python}/bin/python"
       build --distinct_host_configuration=false
+      build --define PROTOBUF_INCLUDE_PATH="${pkgs.protobuf}/include"
     '' + lib.optionalString cudaSupport ''
       build --action_env CUDA_TOOLKIT_PATH="${cudatoolkit_joined}"
       build --action_env CUDNN_INSTALL_PATH="${cudnn}"
@@ -163,7 +173,7 @@ let
     # Copy-paste from TF derivation.
     # Most of these are not really used in jaxlib compilation but it's simpler to keep it
     # 'as is' so that it's more compatible with TF derivation.
-    TF_SYSTEM_LIBS = lib.concatStringsSep "," [
+    TF_SYSTEM_LIBS = lib.concatStringsSep "," ([
       "absl_py"
       "astor_archive"
       "astunparse_archive"
@@ -179,7 +189,6 @@ let
       "cython"
       "dill_archive"
       "double_conversion"
-      "enum34_archive"
       "flatbuffers"
       "functools32_archive"
       "gast_archive"
@@ -190,11 +199,9 @@ let
       "libjpeg_turbo"
       "lmdb"
       "nasm"
-      # "nsync" # not packaged in nixpkgs
       "opt_einsum_archive"
       "org_sqlite"
       "pasta"
-      "pcre"
       "png"
       "pybind11"
       "six_archive"
@@ -204,7 +211,9 @@ let
       "typing_extensions_archive"
       "wrapt"
       "zlib"
-    ];
+    ] ++ lib.optionals (!stdenv.isDarwin) [
+      "nsync" # fails to build on darwin
+    ]);
 
     # Make sure Bazel knows about our configuration flags during fetching so that the
     # relevant dependencies can be downloaded.
@@ -226,9 +235,11 @@ let
     fetchAttrs = {
       sha256 =
         if cudaSupport then
-          "sha256-Ald+vplRx/DDG/7TfHAqD4Gktb1BGnf7FSCCJzSI0eo="
+          "sha256-tdO4YjO985zbittb16RFWgxgUBrHYQfv5gRsA4IAkTk="
+        else if stdenv.isDarwin then
+          "sha256-+XYxfXBCASueqDGg0Zqcmpf7zmemYM6xCE+x0rl3j34="
         else
-          "sha256-eK5IjTAncDarkWYKnXrEo7kw7J7iOH7in2L2GabnFYo=";
+          "sha256-La1wC8X5aGK5mXvYy/kO8n4J+zaRZEc/DAX5zaH1D5A=";
     };
 
     buildAttrs = {
@@ -239,15 +250,10 @@ let
       # 2) Link protobuf from nixpkgs (through TF_SYSTEM_LIBS when using gcc) to prevent crashes on
       #    loading multiple extensions in the same python program due to duplicate protobuf DBs.
       # 3) Patch python path in the compiler driver.
-      # 4) Patch tensorflow sources to work with later versions of protobuf. See
-      #    https://github.com/google/jax/issues/9534. Note that this should be
-      #    removed on the next release after 0.3.0.
       preBuild = ''
-        for src in ./jaxlib/*.{cc,h}; do
+        for src in ./jaxlib/*.{cc,h} ./jaxlib/cuda/*.{cc,h}; do
           sed -i 's@include/pybind11@pybind11@g' $src
         done
-        substituteInPlace ../output/external/org_tensorflow/tensorflow/compiler/xla/python/pprof_profile_builder.cc \
-          --replace "status.message()" "std::string{status.message()}"
       '' + lib.optionalString cudaSupport ''
         patchShebangs ../output/external/org_tensorflow/third_party/gpus/crosstool/clang/bin/crosstool_wrapper_driver_is_not_gcc.tpl
       '' + lib.optionalString stdenv.isDarwin ''
@@ -275,7 +281,7 @@ let
   };
   platformTag =
     if stdenv.targetPlatform.isLinux then
-      "manylinux2010_${stdenv.targetPlatform.linuxArch}"
+      "manylinux2014_${stdenv.targetPlatform.linuxArch}"
     else if stdenv.system == "x86_64-darwin" then
       "macosx_10_9_${stdenv.targetPlatform.linuxArch}"
     else if stdenv.system == "aarch64-darwin" then
@@ -306,6 +312,7 @@ buildPythonPackage {
 
   propagatedBuildInputs = [
     absl-py
+    curl
     double-conversion
     flatbuffers
     giflib

pkgs/development/python-modules/jc/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "jc";
-  version = "1.21.1";
+  version = "1.21.2";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "kellyjonbrazil";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JkxLDuSaEfPb/Z+Bz2uZ3i0LcQgvYlKUNxXATGdCkzE=";
+    sha256 = "sha256-gzxN2ZbnZw7EE5oVeSpugzl/paAbyKKQlxVs/8n3Hzw=";
   };
 
   propagatedBuildInputs = [ ruamel-yaml xmltodict pygments ];

pkgs/development/python-modules/mathlibtools/default.nix

@@ -1,25 +1,52 @@
-{ lib, buildPythonPackage, fetchPypi, PyGithub, GitPython, toml, click, tqdm,
+{ lib
-  networkx, pydot, pyyaml, atomicwrites }:
+, atomicwrites
+, buildPythonPackage
+, click
+, fetchPypi
+, GitPython
+, networkx
+, pydot
+, PyGithub
+, pythonOlder
+, pyyaml
+, toml
+, tqdm
+}:
 
 buildPythonPackage rec {
   pname = "mathlibtools";
-  version = "1.1.1";
+  version = "1.1.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-0iW7SWIxb+Ek4T26hru5EgBgXfqRh6zOR73GAgLFNyE=";
+    hash = "sha256-Jbnb3FKyB1NAehB8tZxBV6d7JJCOgWZPMWMaFEAOzkM=";
   };
 
   propagatedBuildInputs = [
-    PyGithub GitPython toml click tqdm networkx pydot pyyaml atomicwrites
+    atomicwrites
+    click
+    GitPython
+    networkx
+    pydot
+    PyGithub
+    pyyaml
+    toml
+    tqdm
   ];
 
-  # requires internet access
+  # Requires internet access
   doCheck = false;
 
+  pythonImportsCheck = [
+    "mathlibtools"
+  ];
+
   meta = with lib; {
+    description = "Supporting tool for Lean's mathlib";
     homepage = "https://github.com/leanprover-community/mathlib-tools";
-    description = "leanproject is a supporting tool for Lean's mathlib";
     license = licenses.asl20;
     maintainers = with maintainers; [ gebner ];
   };

pkgs/development/python-modules/monai/default.nix

@@ -6,7 +6,7 @@
 , ignite
 , numpy
 , pybind11
-, pytorch
+, torch
 , which
 }:
 
@@ -33,7 +33,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ ninja which ];
   buildInputs = [ pybind11 ];
-  propagatedBuildInputs = [ numpy pytorch ignite ];
+  propagatedBuildInputs = [ numpy torch ignite ];
 
   BUILD_MONAI = 1;
 

pkgs/development/python-modules/peaqevcore/default.nix

@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "5.14.0";
+  version = "5.16.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YDdQ/q/QyR9vgY0jteAfQg6A4oCPKjFLySt/g74+eyw=";
+    hash = "sha256-hL07M5lelXmxhSVkY0dmnQWpI6B/9pW7jf00x/nDaJU=";
   };
 
   postPatch = ''

pkgs/development/python-modules/picobox/default.nix

@@ -0,0 +1,59 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, flask
+, isPy27
+, pytestCheckHook
+, pythonAtLeast
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "picobox";
+  version = "2.2.0";
+
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "ikalnytskyi";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-B2A8GMhBFU/mb/JiiqtP+HvpPj5FYwaYO3gQN2QI6z0=";
+  };
+
+  patches = [
+    (fetchpatch {
+      # already in master, but no new release yet.
+      # https://github.com/ikalnytskyi/picobox/issues/55
+      url = "https://github.com/ikalnytskyi/picobox/commit/1fcc4a0c26a7cd50ee3ef6694139177b5dfb2be0.patch";
+      hash = "sha256-/NIEzTFlZ5wG7jHT/YdySYoxT/UhSk29Up9/VqjG/jg=";
+      includes = [
+        "tests/test_box.py"
+        "tests/test_stack.py"
+      ];
+    })
+  ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  checkInputs = [
+    flask
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "picobox"
+  ];
+
+  meta = with lib; {
+    description = "Opinionated dependency injection framework";
+    homepage = "https://github.com/ikalnytskyi/picobox";
+    license = licenses.mit;
+    maintainers = with maintainers; [ flokli ];
+  };
+}

pkgs/development/python-modules/psycopg/default.nix

@@ -32,13 +32,13 @@
 
 let
   pname = "psycopg";
-  version = "3.0.16";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner = "psycopg";
     repo = pname;
-    rev = version;
+    rev = "refs/tags/${version}";
-    hash = "sha256-jKhpmCcDi7FyMSpn51eSukFvmu3yacNovmRYG9jnu3g=";
+    hash = "sha256-N0Qc8pSWN2NFZn06lYZ7DKMbk6H8aIByS+wDnOQ/O+Y=";
   };
 
   patches = [
@@ -192,6 +192,7 @@ buildPythonPackage rec {
     "tests/test_dns_srv.py"
     # Mypy typing test
     "tests/test_typing.py"
+    "tests/crdb/test_typing.py"
   ];
 
   pytestFlagsArray = [