Merge master into haskell-updates

2023-04-06 00:11:55 +00:00 · 2023-04-06 00:11:55 +00:00 · 6a7b8348a1
commit 6a7b8348a1
parent 391e94a986 96e569cb29
226 changed files with 21595 additions and 1491 deletions
--- a/.gitattributes
+++ b/.gitattributes
@ -1,5 +1,6 @@
 **/deps.nix linguist-generated
 **/deps.json linguist-generated
+**/deps.toml lingust-generated
 **/node-packages.nix linguist-generated

 pkgs/applications/editors/emacs-modes/*-generated.nix linguist-generated
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@ -162,7 +162,7 @@ required to build a rust package. A simple fix is to use:

 ```nix
 postPatch = ''
-  cp ${./Cargo.lock} Cargo.lock
+  ln -s ${./Cargo.lock} Cargo.lock
 '';
 ```

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2409,12 +2409,6 @@
    githubId = 91694;
    name = "Javier Candeira";
  };
-  candyc1oud = {
-    email = "candyc1oud@outlook.com";
-    github = "candyc1oud";
-    githubId = 113157395;
-    name = "Candy Cloud";
-  };
  canndrew = {
    email = "shum@canndrew.org";
    github = "canndrew";
@ -3395,6 +3389,11 @@
    githubId = 1298344;
    name = "Daniel Fullmer";
  };
+  dansbandit = {
+    github = "dansbandit";
+    githubId = 4530687;
+    name = "dansbandit";
+  };
  danth = {
    name = "Daniel Thwaites";
    email = "danthwaites30@btinternet.com";
@ -6986,6 +6985,12 @@
    githubId = 17029738;
    name = "Jean-Charles Quillet";
  };
+  jedsek = {
+    email = "jedsek@qq.com";
+    github = "jedsek";
+    githubId = 63626406;
+    name = "Jedsek";
+  };
  jefdaj = {
    email = "jefdaj@gmail.com";
    github = "jefdaj";
@ -8188,6 +8193,12 @@
    github = "konradmalik";
    githubId = 13033392;
  };
+  konst-aa = {
+    email = "konstantin.astafurov@gmail.com";
+    github = "konst-aa";
+    githubId = 40547702;
+    name = "Konstantin Astafurov";
+  };
  koozz = {
    email = "koozz@linux.com";
    github = "koozz";
--- a/maintainers/scripts/update.py
+++ b/maintainers/scripts/update.py
@ -100,7 +100,7 @@ async def commit_changes(name: str, merge_lock: asyncio.Lock, worktree: str, bra
        # Git can only handle a single index operation at a time
        async with merge_lock:
            await check_subprocess('git', 'add', *change['files'], cwd=worktree)
-            commit_message = '{attrPath}: {oldVersion} → {newVersion}'.format(**change)
+            commit_message = '{attrPath}: {oldVersion} -> {newVersion}'.format(**change)
            if 'commitMessage' in change:
                commit_message = change['commitMessage']
            elif 'commitBody' in change:
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -294,6 +294,9 @@ with lib.maintainers; {
      zowoq
      qbit
    ];
+    githubTeams = [
+      "golang"
+    ];
    scope = "Maintain Golang compilers.";
    shortName = "Go";
    enableFeatureFreezePing = true;
@ -423,6 +426,21 @@ with lib.maintainers; {
    shortName = "Linux Kernel";
  };

+  lisp = {
+    members = [
+      raskin
+      lukego
+      nagy
+      uthar
+    ];
+    githubTeams = [
+      "lisp"
+    ];
+    scope = "Maintain the Lisp ecosystem.";
+    shortName = "lisp";
+    enableFeatureFreezePing = true;
+  };
+
  llvm = {
    members = [
      dtzWill
@ -723,6 +741,9 @@ with lib.maintainers; {
      winter
      zowoq
    ];
+    githubTeams = [
+      "rust"
+    ];
    scope = "Maintain the Rust compiler toolchain and nixpkgs integration.";
    shortName = "Rust";
    enableFeatureFreezePing = true;
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@ -168,7 +168,7 @@ let
        ./manual.md \
        ./manual-combined-pre.xml

-      ${pkgs.libxslt.bin}/bin/xsltproc \
+      xsltproc \
        -o manual-combined.xml ${./../../lib/make-options-doc/postprocess-option-descriptions.xsl} \
        manual-combined-pre.xml

--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -130,6 +130,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The [services.unifi-video.openFirewall](#opt-services.unifi-video.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall.

+- The option `i18n.inputMethod.fcitx5.enableRimeData` has been removed. Default RIME data is now included in `fcitx5-rime` by default, and can be customized using `fcitx5-rime.override { rimeDataPkgs = [ pkgs.rime-data, package2, ... ]; }`
+
 - Kime has been updated from 2.5.6 to 3.0.2 and the `i18n.inputMethod.kime.config` option has been removed. Users should use `daemonModules`, `iconColor`, and `extraConfig` options under `i18n.inputMethod.kime` instead.

 - `tut` has been updated from 1.0.34 to 2.0.0, and now uses the TOML format for the configuration file instead of INI. Additional information can be found [here](https://github.com/RasmusLindroth/tut/releases/tag/2.0.0).
@ -233,6 +235,10 @@ In addition to numerous new and upgraded packages, this release has the followin
  - `services.openssh.ciphers` to `services.openssh.settings.Ciphers`
  - `services.openssh.gatewayPorts` to `services.openssh.settings.GatewayPorts`

+- `netbox` was updated to 3.4. NixOS' `services.netbox.package` still defaults to 3.3 if `stateVersion` is earlier than 23.05. Please review upstream's [breaking changes](https://github.com/netbox-community/netbox/releases/tag/v3.4.0), and upgrade NetBox by changing `services.netbox.package`. Database migrations will be run automatically.
+
+- `services.netbox` now support RFC42-style options, through `services.netbox.settings`.
+
 - `services.mastodon` gained a tootctl wrapped named `mastodon-tootctl` similar to `nextcloud-occ` which can be executed from any user and switches to the configured mastodon user with sudo and sources the environment variables.

 - DocBook option documentation, which has been deprecated since 22.11, will now cause a warning when documentation is built. Out-of-tree modules should migrate to using CommonMark documentation as outlined in [](#sec-option-declarations) to silence this warning.
--- a/nixos/modules/i18n/input-method/fcitx5.nix
+++ b/nixos/modules/i18n/input-method/fcitx5.nix
@ -5,10 +5,9 @@ with lib;
 let
  im = config.i18n.inputMethod;
  cfg = im.fcitx5;
-  addons = cfg.addons ++ optional cfg.enableRimeData pkgs.rime-data;
-  fcitx5Package = pkgs.fcitx5-with-addons.override { inherit addons; };
-  whetherRimeDataDir = any (p: p.pname == "fcitx5-rime") cfg.addons;
-in {
+  fcitx5Package = pkgs.fcitx5-with-addons.override { inherit (cfg) addons; };
+in
+{
  options = {
    i18n.inputMethod.fcitx5 = {
      addons = mkOption {
@ -19,30 +18,23 @@ in {
          Enabled Fcitx5 addons.
        '';
      };
-
-      enableRimeData = mkEnableOption (lib.mdDoc "default rime-data with fcitx5-rime");
    };
  };

+  imports = [
+    (mkRemovedOptionModule [ "i18n" "inputMethod" "fcitx5" "enableRimeData" ] ''
+      RIME data is now included in `fcitx5-rime` by default, and can be customized using `fcitx5-rime.override { rimeDataPkgs = ...; }`
+    '')
+  ];
+
  config = mkIf (im.enabled == "fcitx5") {
    i18n.inputMethod.package = fcitx5Package;

-    environment = mkMerge [{
-      variables = {
-        GTK_IM_MODULE = "fcitx";
-        QT_IM_MODULE = "fcitx";
-        XMODIFIERS = "@im=fcitx";
-        QT_PLUGIN_PATH = [ "${fcitx5Package}/${pkgs.qt6.qtbase.qtPluginPrefix}" ];
-      };
-    }
-    (mkIf whetherRimeDataDir {
-      pathsToLink = [
-        "/share/rime-data"
-      ];
-
-      variables =  {
-        NIX_RIME_DATA_DIR = "/run/current-system/sw/share/rime-data";
-      };
-    })];
+    environment.variables = {
+      GTK_IM_MODULE = "fcitx";
+      QT_IM_MODULE = "fcitx";
+      XMODIFIERS = "@im=fcitx";
+      QT_PLUGIN_PATH = [ "${fcitx5Package}/${pkgs.qt6.qtbase.qtPluginPrefix}" ];
+    };
  };
 }
--- a/nixos/modules/services/matrix/dendrite.nix
+++ b/nixos/modules/services/matrix/dendrite.nix
@ -159,6 +159,15 @@ in
            '';
          };
        };
+        options.relay_api.database = {
+          connection_string = lib.mkOption {
+            type = lib.types.str;
+            default = "file:relayapi.db";
+            description = lib.mdDoc ''
+              Database for the Relay Server.
+            '';
+          };
+        };
        options.media_api = {
          database = {
            connection_string = lib.mkOption {
@ -294,7 +303,7 @@ in
            -o /run/dendrite/dendrite.yaml
        ''];
        ExecStart = lib.strings.concatStringsSep " " ([
-          "${pkgs.dendrite}/bin/dendrite-monolith-server"
+          "${pkgs.dendrite}/bin/dendrite"
          "--config /run/dendrite/dendrite.yaml"
        ] ++ lib.optionals (cfg.httpPort != null) [
          "--http-bind-address :${builtins.toString cfg.httpPort}"
--- a/nixos/modules/services/networking/bind.nix
+++ b/nixos/modules/services/networking/bind.nix
@ -87,6 +87,7 @@ let
                     };
                   ''
                }
+                allow-query { any; };
                ${extraConfig}
              };
            '')
--- a/nixos/modules/services/networking/smokeping.nix
+++ b/nixos/modules/services/networking/smokeping.nix
@ -42,7 +42,7 @@ let
  configPath = pkgs.writeText "smokeping.conf" configFile;
  cgiHome = pkgs.writeScript "smokeping.fcgi" ''
    #!${pkgs.bash}/bin/bash
-    ${cfg.package}/bin/smokeping_cgi ${configPath}
+    ${cfg.package}/bin/smokeping_cgi /etc/smokeping.conf
  '';
 in

@ -307,6 +307,7 @@ in
          source = "${pkgs.fping}/bin/fping";
        };
    };
+    environment.etc."smokeping.conf".source = configPath;
    environment.systemPackages = [ pkgs.fping ];
    users.users.${cfg.user} = {
      isNormalUser = false;
@ -327,18 +328,23 @@ in
      # Thus, we need to make `smokepingHome` (which is given to `thttpd -d` below) `755`.
      homeMode = "755";
    };
-    users.groups.${cfg.user} = {};
+    users.groups.${cfg.user} = { };
    systemd.services.smokeping = {
-      requiredBy = [ "multi-user.target"];
+      reloadTriggers = [ configPath ];
+      requiredBy = [ "multi-user.target" ];
      serviceConfig = {
        User = cfg.user;
        Restart = "on-failure";
-        ExecStart = "${cfg.package}/bin/smokeping --config=${configPath} --nodaemon";
+        ExecStart = "${cfg.package}/bin/smokeping --config=/etc/smokeping.conf --nodaemon";
      };
      preStart = ''
        mkdir -m 0755 -p ${smokepingHome}/cache ${smokepingHome}/data
        rm -f ${smokepingHome}/cropper
        ln -s ${cfg.package}/htdocs/cropper ${smokepingHome}/cropper
+        rm -f ${smokepingHome}/css
+        ln -s ${cfg.package}/htdocs/css ${smokepingHome}/css
+        rm -f ${smokepingHome}/js
+        ln -s ${cfg.package}/htdocs/js ${smokepingHome}/js
        rm -f ${smokepingHome}/smokeping.fcgi
        ln -s ${cgiHome} ${smokepingHome}/smokeping.fcgi
        ${cfg.package}/bin/smokeping --check --config=${configPath}
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@ -4,45 +4,17 @@ with lib;

 let
  cfg = config.services.netbox;
+  pythonFmt = pkgs.formats.pythonVars {};
  staticDir = cfg.dataDir + "/static";
-  configFile = pkgs.writeTextFile {
-    name = "configuration.py";
-    text = ''
-      STATIC_ROOT = '${staticDir}'
-      MEDIA_ROOT = '${cfg.dataDir}/media'
-      REPORTS_ROOT = '${cfg.dataDir}/reports'
-      SCRIPTS_ROOT = '${cfg.dataDir}/scripts'

-      ALLOWED_HOSTS = ['*']
-      DATABASE = {
-        'NAME': 'netbox',
-        'USER': 'netbox',
-        'HOST': '/run/postgresql',
-      }
-
-      # Redis database settings. Redis is used for caching and for queuing background tasks such as webhook events. A separate
-      # configuration exists for each. Full connection details are required in both sections, and it is strongly recommended
-      # to use two separate database IDs.
-      REDIS = {
-          'tasks': {
-              'URL': 'unix://${config.services.redis.servers.netbox.unixSocket}?db=0',
-              'SSL': False,
-          },
-          'caching': {
-              'URL': 'unix://${config.services.redis.servers.netbox.unixSocket}?db=1',
-              'SSL': False,
-          }
-      }
-
-      with open("${cfg.secretKeyFile}", "r") as file:
-          SECRET_KEY = file.readline()
-
-      ${optionalString cfg.enableLdap "REMOTE_AUTH_BACKEND = 'netbox.authentication.LDAPBackend'"}
-
-      ${cfg.extraConfig}
-    '';
+  settingsFile = pythonFmt.generate "netbox-settings.py" cfg.settings;
+  extraConfigFile = pkgs.writeTextFile {
+    name = "netbox-extraConfig.py";
+    text = cfg.extraConfig;
  };
-  pkg = (pkgs.netbox.overrideAttrs (old: {
+  configFile = pkgs.concatText "configuration.py" [ settingsFile extraConfigFile ];
+
+  pkg = (cfg.package.overrideAttrs (old: {
    installPhase = old.installPhase + ''
      ln -s ${configFile} $out/opt/netbox/netbox/netbox/configuration.py
    '' + optionalString cfg.enableLdap ''
@ -70,6 +42,30 @@ in {
      '';
    };

+    settings = lib.mkOption {
+      description = lib.mdDoc ''
+        Configuration options to set in `configuration.py`.
+        See the [documentation](https://docs.netbox.dev/en/stable/configuration/) for more possible options.
+      '';
+
+      default = { };
+
+      type = lib.types.submodule {
+        freeformType = pythonFmt.type;
+
+        options = {
+          ALLOWED_HOSTS = lib.mkOption {
+            type = with lib.types; listOf str;
+            default = ["*"];
+            description = lib.mdDoc ''
+              A list of valid fully-qualified domain names (FQDNs) and/or IP
+              addresses that can be used to reach the NetBox service.
+            '';
+          };
+        };
+      };
+    };
+
    listenAddress = mkOption {
      type = types.str;
      default = "[::1]";
@ -78,6 +74,17 @@ in {
      '';
    };

+    package = mkOption {
+      type = types.package;
+      default = if versionAtLeast config.system.stateVersion "23.05" then pkgs.netbox else pkgs.netbox_3_3;
+      defaultText = literalExpression ''
+        if versionAtLeast config.system.stateVersion "23.05" then pkgs.netbox else pkgs.netbox_3_3;
+      '';
+      description = lib.mdDoc ''
+        NetBox package to use.
+      '';
+    };
+
    port = mkOption {
      type = types.port;
      default = 8001;
@ -117,7 +124,7 @@ in {
      default = "";
      description = lib.mdDoc ''
        Additional lines of configuration appended to the `configuration.py`.
-        See the [documentation](https://netbox.readthedocs.io/en/stable/configuration/optional-settings/) for more possible options.
+        See the [documentation](https://docs.netbox.dev/en/stable/configuration/) for more possible options.
      '';
    };

@ -138,11 +145,90 @@ in {
        Path to the Configuration-File for LDAP-Authentication, will be loaded as `ldap_config.py`.
        See the [documentation](https://netbox.readthedocs.io/en/stable/installation/6-ldap/#configuration) for possible options.
      '';
+      example = ''
+        import ldap
+        from django_auth_ldap.config import LDAPSearch, PosixGroupType
+
+        AUTH_LDAP_SERVER_URI = "ldaps://ldap.example.com/"
+
+        AUTH_LDAP_USER_SEARCH = LDAPSearch(
+            "ou=accounts,ou=posix,dc=example,dc=com",
+            ldap.SCOPE_SUBTREE,
+            "(uid=%(user)s)",
+        )
+
+        AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
+            "ou=groups,ou=posix,dc=example,dc=com",
+            ldap.SCOPE_SUBTREE,
+            "(objectClass=posixGroup)",
+        )
+        AUTH_LDAP_GROUP_TYPE = PosixGroupType()
+
+        # Mirror LDAP group assignments.
+        AUTH_LDAP_MIRROR_GROUPS = True
+
+        # For more granular permissions, we can map LDAP groups to Django groups.
+        AUTH_LDAP_FIND_GROUP_PERMS = True
+      '';
    };
  };

  config = mkIf cfg.enable {
-    services.netbox.plugins = mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+    services.netbox = {
+      plugins = mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+      settings = {
+        STATIC_ROOT = staticDir;
+        MEDIA_ROOT = "${cfg.dataDir}/media";
+        REPORTS_ROOT = "${cfg.dataDir}/reports";
+        SCRIPTS_ROOT = "${cfg.dataDir}/scripts";
+
+        DATABASE = {
+          NAME = "netbox";
+          USER = "netbox";
+          HOST = "/run/postgresql";
+        };
+
+        # Redis database settings. Redis is used for caching and for queuing
+        # background tasks such as webhook events. A separate configuration
+        # exists for each. Full connection details are required in both
+        # sections, and it is strongly recommended to use two separate database
+        # IDs.
+        REDIS = {
+            tasks = {
+                URL = "unix://${config.services.redis.servers.netbox.unixSocket}?db=0";
+                SSL = false;
+            };
+            caching =  {
+                URL = "unix://${config.services.redis.servers.netbox.unixSocket}?db=1";
+                SSL = false;
+            };
+        };
+
+        REMOTE_AUTH_BACKEND = lib.mkIf cfg.enableLdap "netbox.authentication.LDAPBackend";
+
+        LOGGING = lib.mkDefault {
+          version = 1;
+
+          formatters.precise.format = "[%(levelname)s@%(name)s] %(message)s";
+
+          handlers.console = {
+            class = "logging.StreamHandler";
+            formatter = "precise";
+          };
+
+          # log to console/systemd instead of file
+          root = {
+            level = "INFO";
+            handlers = [ "console" ];
+          };
+        };
+      };
+
+      extraConfig = ''
+        with open("${cfg.secretKeyFile}", "r") as file:
+            SECRET_KEY = file.readline()
+      '';
+    };

    services.redis.servers.netbox.enable = true;

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -460,7 +460,8 @@ in {
  netdata = handleTest ./netdata.nix {};
  networking.networkd = handleTest ./networking.nix { networkd = true; };
  networking.scripted = handleTest ./networking.nix { networkd = false; };
-  netbox = handleTest ./web-apps/netbox.nix {};
+  netbox = handleTest ./web-apps/netbox.nix { inherit (pkgs) netbox; };
+  netbox_3_3 = handleTest ./web-apps/netbox.nix { netbox = pkgs.netbox_3_3; };
  # TODO: put in networking.nix after the test becomes more complete
  networkingProxy = handleTest ./networking-proxy.nix {};
  nextcloud = handleTest ./nextcloud {};
--- a/nixos/tests/tracee.nix
+++ b/nixos/tests/tracee.nix
@ -1,5 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
  name = "tracee-integration";
+  meta.maintainers = pkgs.tracee.meta.maintainers;
+
  nodes = {
    machine = { config, pkgs, ... }: {
      # EventFilters/trace_only_events_from_new_containers and
@ -7,11 +9,11 @@ import ./make-test-python.nix ({ pkgs, ... }: {
      # require docker/dockerd
      virtualisation.docker.enable = true;

-      environment.systemPackages = [
+      environment.systemPackages = with pkgs; [
        # required by Test_EventFilters/trace_events_from_ls_and_which_binary_in_separate_scopes
-        pkgs.which
+        which
        # build the go integration tests as a binary
-        (pkgs.tracee.overrideAttrs (oa: {
+        (tracee.overrideAttrs (oa: {
          pname = oa.pname + "-integration";
          postPatch = oa.postPatch or "" + ''
            # prepare tester.sh (which will be embedded in the test binary)
@ -20,10 +22,11 @@ import ./make-test-python.nix ({ pkgs, ... }: {
            # fix the test to look at nixos paths for running programs
            substituteInPlace tests/integration/integration_test.go \
              --replace "bin=/usr/bin/" "comm=" \
+              --replace "binary=/usr/bin/" "comm=" \
              --replace "/usr/bin/dockerd" "dockerd" \
              --replace "/usr/bin" "/run/current-system/sw/bin"
          '';
-          nativeBuildInputs = oa.nativeBuildInputs or [ ] ++ [ pkgs.makeWrapper ];
+          nativeBuildInputs = oa.nativeBuildInputs or [ ] ++ [ makeWrapper ];
          buildPhase = ''
            runHook preBuild
            # just build the static lib we need for the go test binary
@ -34,6 +37,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
            runHook postBuild
          '';
          doCheck = false;
+          outputs = [ "out" ];
          installPhase = ''
            mkdir -p $out/bin
            mv $GOPATH/tracee-integration $out/bin/
--- a/nixos/tests/web-apps/netbox.nix
+++ b/nixos/tests/web-apps/netbox.nix
@ -1,21 +1,146 @@
-import ../make-test-python.nix ({ lib, pkgs, ... }: {
+let
+  ldapDomain = "example.org";
+  ldapSuffix = "dc=example,dc=org";
+
+  ldapRootUser = "admin";
+  ldapRootPassword = "foobar";
+
+  testUser = "alice";
+  testPassword = "verySecure";
+  testGroup = "netbox-users";
+in import ../make-test-python.nix ({ lib, pkgs, netbox, ... }: {
  name = "netbox";

  meta = with lib.maintainers; {
-    maintainers = [ n0emis ];
+    maintainers = [ minijackson n0emis ];
  };

-  nodes.machine = { ... }: {
+  nodes.machine = { config, ... }: {
    services.netbox = {
      enable = true;
+      package = netbox;
      secretKeyFile = pkgs.writeText "secret" ''
        abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
      '';
+
+      enableLdap = true;
+      ldapConfigPath = pkgs.writeText "ldap_config.py" ''
+        import ldap
+        from django_auth_ldap.config import LDAPSearch, PosixGroupType
+
+        AUTH_LDAP_SERVER_URI = "ldap://localhost/"
+
+        AUTH_LDAP_USER_SEARCH = LDAPSearch(
+            "ou=accounts,ou=posix,${ldapSuffix}",
+            ldap.SCOPE_SUBTREE,
+            "(uid=%(user)s)",
+        )
+
+        AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
+            "ou=groups,ou=posix,${ldapSuffix}",
+            ldap.SCOPE_SUBTREE,
+            "(objectClass=posixGroup)",
+        )
+        AUTH_LDAP_GROUP_TYPE = PosixGroupType()
+
+        # Mirror LDAP group assignments.
+        AUTH_LDAP_MIRROR_GROUPS = True
+
+        # For more granular permissions, we can map LDAP groups to Django groups.
+        AUTH_LDAP_FIND_GROUP_PERMS = True
+      '';
    };
+
+    services.nginx = {
+      enable = true;
+
+      recommendedProxySettings = true;
+
+      virtualHosts.netbox = {
+        default = true;
+        locations."/".proxyPass = "http://localhost:${toString config.services.netbox.port}";
+        locations."/static/".alias = "/var/lib/netbox/static/";
+      };
+    };
+
+    # Adapted from the sssd-ldap NixOS test
+    services.openldap = {
+      enable = true;
+      settings = {
+        children = {
+          "cn=schema".includes = [
+            "${pkgs.openldap}/etc/schema/core.ldif"
+            "${pkgs.openldap}/etc/schema/cosine.ldif"
+            "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
+            "${pkgs.openldap}/etc/schema/nis.ldif"
+          ];
+          "olcDatabase={1}mdb" = {
+            attrs = {
+              objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
+              olcDatabase = "{1}mdb";
+              olcDbDirectory = "/var/lib/openldap/db";
+              olcSuffix = ldapSuffix;
+              olcRootDN = "cn=${ldapRootUser},${ldapSuffix}";
+              olcRootPW = ldapRootPassword;
+            };
+          };
+        };
+      };
+      declarativeContents = {
+        ${ldapSuffix} = ''
+          dn: ${ldapSuffix}
+          objectClass: top
+          objectClass: dcObject
+          objectClass: organization
+          o: ${ldapDomain}
+
+          dn: ou=posix,${ldapSuffix}
+          objectClass: top
+          objectClass: organizationalUnit
+
+          dn: ou=accounts,ou=posix,${ldapSuffix}
+          objectClass: top
+          objectClass: organizationalUnit
+
+          dn: uid=${testUser},ou=accounts,ou=posix,${ldapSuffix}
+          objectClass: person
+          objectClass: posixAccount
+          userPassword: ${testPassword}
+          homeDirectory: /home/${testUser}
+          uidNumber: 1234
+          gidNumber: 1234
+          cn: ""
+          sn: ""
+
+          dn: ou=groups,ou=posix,${ldapSuffix}
+          objectClass: top
+          objectClass: organizationalUnit
+
+          dn: cn=${testGroup},ou=groups,ou=posix,${ldapSuffix}
+          objectClass: posixGroup
+          gidNumber: 2345
+          memberUid: ${testUser}
+        '';
+      };
+    };
+
+    users.users.nginx.extraGroups = [ "netbox" ];
+
+    networking.firewall.allowedTCPPorts = [ 80 ];
  };

-  testScript = ''
-    machine.start()
+  testScript = let
+    changePassword = pkgs.writeText "change-password.py" ''
+      from django.contrib.auth.models import User
+      u = User.objects.get(username='netbox')
+      u.set_password('netbox')
+      u.save()
+    '';
+  in ''
+    from typing import Any, Dict
+    import json
+
+    start_all()
    machine.wait_for_unit("netbox.target")
    machine.wait_until_succeeds("journalctl --since -1m --unit netbox --grep Listening")

@ -26,5 +151,167 @@ import ../make-test-python.nix ({ lib, pkgs, ... }: {

    with subtest("Staticfiles are generated"):
        machine.succeed("test -e /var/lib/netbox/static/netbox.js")
+
+    with subtest("Superuser can be created"):
+        machine.succeed(
+            "netbox-manage createsuperuser --noinput --username netbox --email netbox@example.com"
+        )
+        # Django doesn't have a "clean" way of inputting the password from the command line
+        machine.succeed("cat '${changePassword}' | netbox-manage shell")
+
+    machine.wait_for_unit("network.target")
+
+    with subtest("Home screen loads from nginx"):
+        machine.succeed(
+            "curl -sSfL http://localhost | grep '<title>Home | NetBox</title>'"
+        )
+
+    with subtest("Staticfiles can be fetched"):
+        machine.succeed("curl -sSfL http://localhost/static/netbox.js")
+        machine.succeed("curl -sSfL http://localhost/static/docs/")
+
+    with subtest("Can interact with API"):
+        json.loads(
+            machine.succeed("curl -sSfL -H 'Accept: application/json' 'http://localhost/api/'")
+        )
+
+    def login(username: str, password: str):
+        encoded_data = json.dumps({"username": username, "password": password})
+        uri = "/users/tokens/provision/"
+        result = json.loads(
+            machine.succeed(
+                "curl -sSfL "
+                "-X POST "
+                "-H 'Accept: application/json' "
+                "-H 'Content-Type: application/json' "
+                f"'http://localhost/api{uri}' "
+                f"--data '{encoded_data}'"
+            )
+        )
+        return result["key"]
+
+    with subtest("Can login"):
+        auth_token = login("netbox", "netbox")
+
+    def get(uri: str):
+        return json.loads(
+            machine.succeed(
+                "curl -sSfL "
+                "-H 'Accept: application/json' "
+                f"-H 'Authorization: Token {auth_token}' "
+                f"'http://localhost/api{uri}'"
+            )
+        )
+
+    def delete(uri: str):
+        return machine.succeed(
+            "curl -sSfL "
+            f"-X DELETE "
+            "-H 'Accept: application/json' "
+            f"-H 'Authorization: Token {auth_token}' "
+            f"'http://localhost/api{uri}'"
+        )
+
+
+    def data_request(uri: str, method: str, data: Dict[str, Any]):
+        encoded_data = json.dumps(data)
+        return json.loads(
+            machine.succeed(
+                "curl -sSfL "
+                f"-X {method} "
+                "-H 'Accept: application/json' "
+                "-H 'Content-Type: application/json' "
+                f"-H 'Authorization: Token {auth_token}' "
+                f"'http://localhost/api{uri}' "
+                f"--data '{encoded_data}'"
+            )
+        )
+
+    def post(uri: str, data: Dict[str, Any]):
+      return data_request(uri, "POST", data)
+
+    def patch(uri: str, data: Dict[str, Any]):
+      return data_request(uri, "PATCH", data)
+
+    with subtest("Can create objects"):
+        result = post("/dcim/sites/", {"name": "Test site", "slug": "test-site"})
+        site_id = result["id"]
+
+        # Example from:
+        # http://netbox.extra.cea.fr/static/docs/integrations/rest-api/#creating-a-new-object
+        post("/ipam/prefixes/", {"prefix": "192.0.2.0/24", "site": site_id})
+
+        result = post(
+            "/dcim/manufacturers/",
+            {"name": "Test manufacturer", "slug": "test-manufacturer"}
+        )
+        manufacturer_id = result["id"]
+
+        # Had an issue with device-types before NetBox 3.4.0
+        result = post(
+            "/dcim/device-types/",
+            {
+                "model": "Test device type",
+                "manufacturer": manufacturer_id,
+                "slug": "test-device-type",
+            },
+        )
+        device_type_id = result["id"]
+
+    with subtest("Can list objects"):
+        result = get("/dcim/sites/")
+
+        assert result["count"] == 1
+        assert result["results"][0]["id"] == site_id
+        assert result["results"][0]["name"] == "Test site"
+        assert result["results"][0]["description"] == ""
+
+        result = get("/dcim/device-types/")
+        assert result["count"] == 1
+        assert result["results"][0]["id"] == device_type_id
+        assert result["results"][0]["model"] == "Test device type"
+
+    with subtest("Can update objects"):
+        new_description = "Test site description"
+        patch(f"/dcim/sites/{site_id}/", {"description": new_description})
+        result = get(f"/dcim/sites/{site_id}/")
+        assert result["description"] == new_description
+
+    with subtest("Can delete objects"):
+        # Delete a device-type since no object depends on it
+        delete(f"/dcim/device-types/{device_type_id}/")
+
+        result = get("/dcim/device-types/")
+        assert result["count"] == 0
+
+    with subtest("Can use the GraphQL API"):
+        encoded_data = json.dumps({
+            "query": "query { prefix_list { prefix, site { id, description } } }",
+        })
+        result = json.loads(
+            machine.succeed(
+                "curl -sSfL "
+                "-H 'Accept: application/json' "
+                "-H 'Content-Type: application/json' "
+                f"-H 'Authorization: Token {auth_token}' "
+                "'http://localhost/graphql/' "
+                f"--data '{encoded_data}'"
+            )
+        )
+
+        assert len(result["data"]["prefix_list"]) == 1
+        assert result["data"]["prefix_list"][0]["prefix"] == "192.0.2.0/24"
+        assert result["data"]["prefix_list"][0]["site"]["id"] == str(site_id)
+        assert result["data"]["prefix_list"][0]["site"]["description"] == new_description
+
+    with subtest("Can login with LDAP"):
+        machine.wait_for_unit("openldap.service")
+        login("alice", "${testPassword}")
+
+    with subtest("Can associate LDAP groups"):
+        result = get("/users/users/?username=${testUser}")
+
+        assert result["count"] == 1
+        assert any(group["name"] == "${testGroup}" for group in result["results"][0]["groups"])
  '';
 })
--- a/pkgs/applications/blockchains/wasabiwallet/default.nix
+++ b/pkgs/applications/blockchains/wasabiwallet/default.nix
@ -31,11 +31,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "wasabiwallet";
-  version = "2.0.2.2";
+  version = "2.0.3";

  src = fetchurl {
    url = "https://github.com/zkSNACKs/WalletWasabi/releases/download/v${version}/Wasabi-${version}.tar.gz";
-    sha256 = "sha256-Mwr2TwJsA7+G5U2FHOC6SMgiYxuy6fAiA3t7oJGSVaA=";
+    sha256 = "sha256-RlWaeOK6XqxyCIQQp1/X6iG9t7f3ER5K+S3ZvPg6wBg=";
  };

  dontBuild = true;
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -15,11 +15,11 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1cwxb6713hlgbrp4yhaky18r05ykb2ljxkldpj3hlgiz8x9l3n8r";
-    x86_64-darwin = "14j7jsy7ldgkjpfb6acyv86nqfg6mip27rq0d9zfg26n4m0qm3s9";
-    aarch64-linux = "080qqc9bacgs655sz32vdczdlkylycgzf5l584il9xyn7bp8xyk1";
-    aarch64-darwin = "0ifzwjalwskxm4phf9c4v6sfyxhdh63vzdippcwh0r7fx0gcj6g8";
-    armv7l-linux = "1gchynk0i05jkan47773fdlkbppwvdim73qwpcxbl0ck2giy7q9z";
+    x86_64-linux = "1dz0fppcbb1cbrq7lp72fdm53ss85bp7i9y5yk3l0yzlmb737syv";
+    x86_64-darwin = "1m7j4fnlcjjfpx551svh67sj45zln798dsjc1b4hlwcn6qh65kfk";
+    aarch64-linux = "0ym6l1zkqwwj7jx2k1765094krq6cw562hyvliv1cy6079xkahiy";
+    aarch64-darwin = "14zq18s68nh8jq542kjn0pf92s7ld5x2p220z71xg3mywmlsgjqf";
+    armv7l-linux = "05h96x5nngli7zv2yh8a2yp8z5d8mqq1a6427sdpg3aybyj7ij2d";
  }.${system} or throwSystem;

  sourceRoot = if stdenv.isDarwin then "" else ".";
@ -29,7 +29,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.76.2.23074";
+    version = "1.77.0.23093";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/emulators/citra/default.nix
+++ b/pkgs/applications/emulators/citra/default.nix
@ -15,13 +15,13 @@ let
 in {
  nightly = libsForQt5.callPackage ./generic.nix rec {
    pname = "citra-nightly";
-    version = "1765";
+    version = "1873";

    src = fetchFromGitHub {
      owner = "citra-emu";
      repo = "citra-nightly";
      rev = "nightly-${version}";
-      sha256 = "0d3dfh63cmsy5idbypdz3ibydmb4a35sfv7qmxxlcpc390pp9cvq";
+      sha256 = "1csn9n1s2mvxwk2mahwm8mc4zgn40im374hcsqgz8gaxjkmnx288";
      fetchSubmodules = true;
    };

@ -30,13 +30,13 @@ in {

  canary = libsForQt5.callPackage ./generic.nix rec {
    pname = "citra-canary";
-    version = "2146";
+    version = "2440";

    src = fetchFromGitHub {
      owner = "citra-emu";
      repo = "citra-canary";
      rev = "canary-${version}";
-      sha256 = "1wnym0nklngimf5gaaa2703nz4g5iy572wlgp88h67rrh9b4f04r";
+      sha256 = "06f2qnvywyaf8jc43jrzjhfshj3k21ggk8wdrvd9wjsmrryvqgbz";
      fetchSubmodules = true;
    };

--- a/pkgs/applications/emulators/citra/generic.nix
+++ b/pkgs/applications/emulators/citra/generic.nix
@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
    "-DUSE_SYSTEM_BOOST=ON"
    "-DCITRA_USE_BUNDLED_FFMPEG=OFF"
    "-DCITRA_USE_BUNDLED_QT=OFF"
-    "-DCITRA_USE_BUNDLED_SDL2=OFF"
+    "-DUSE_SYSTEM_SDL2=ON"

    # We dont want to bother upstream with potentially outdated compat reports
    "-DCITRA_ENABLE_COMPATIBILITY_REPORTING=ON"
@ -65,6 +65,10 @@ stdenv.mkDerivation rec {
    ++ lib.optional enableFdk "-DENABLE_FDK=ON";

  postPatch = ''
+    # Fix file not found when looking in var/empty instead of opt
+    mkdir externals/dynarmic/src/dynarmic/ir/var
+    ln -s ../opt externals/dynarmic/src/dynarmic/ir/var/empty
+
    # Prep compatibilitylist
    ln -s ${compat-list} ./dist/compatibility_list/compatibility_list.json

--- a/pkgs/applications/emulators/ryujinx/default.nix
+++ b/pkgs/applications/emulators/ryujinx/default.nix
@ -29,13 +29,13 @@

 buildDotnetModule rec {
  pname = "ryujinx";
-  version = "1.1.687"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.692"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml

  src = fetchFromGitHub {
    owner = "Ryujinx";
    repo = "Ryujinx";
-    rev = "460f96967de6f5cb729ed57baaa4dad2178c8cb6";
-    sha256 = "008mjih7lp2zq86g750s237d9g2p2jqfryp6izac3iqr3s7dbr6g";
+    rev = "1b41b285ac7f551c3495ced436ce3930ad7223b4";
+    sha256 = "07s42xmdagi97i7c3mm9qak9msgv4c75say10dl4nha784kxkbvp";
  };

  dotnet-sdk = dotnetCorePackages.sdk_7_0;
--- a/pkgs/applications/emulators/ryujinx/deps.nix
+++ b/pkgs/applications/emulators/ryujinx/deps.nix
@ -2,24 +2,25 @@
 # Please dont edit it manually, your changes might get overwritten!

 { fetchNuGet }: [
-  (fetchNuGet { pname = "Avalonia"; version = "0.10.18"; sha256 = "01x7fc8rdkzba40piwi1ngsk7f8jawzn5bcq2la96hphsiahaarh"; })
+  (fetchNuGet { pname = "Avalonia"; version = "0.10.19"; sha256 = "1yzrbp0b6kv9h9d4kl96ldr6ln40xj1j2yvbvpm0pgv7ajwr7qhc"; })
  (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2020091801"; sha256 = "04jm83cz7vkhhr6n2c9hya2k8i2462xbf6np4bidk55as0jdq43a"; })
-  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "0.10.18"; sha256 = "1qbb527jvhv2p8dcxi7lhm3lczy96j546gb5w09gh90dmzaq45bw"; })
-  (fetchNuGet { pname = "Avalonia.Desktop"; version = "0.10.18"; sha256 = "0iaby5696km0yl0bs2a8i6a5ypras54mimnmh9wjwarwniqj8yjs"; })
-  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "0.10.18"; sha256 = "1qsrzv1fz73p46p9v60qqds229znfv9hawnams5hxwl46jn2v9cp"; })
-  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "0.10.18"; sha256 = "173apfayxkm3lgj7xk9xzsbxmdhv44svr49ccqnd1dii7y69bgny"; })
-  (fetchNuGet { pname = "Avalonia.Markup.Xaml.Loader"; version = "0.10.18"; sha256 = "0vcbhwckzxgcq9wxim91zk30kzjaydr9szl4rbr3rz85447hj9pi"; })
-  (fetchNuGet { pname = "Avalonia.Native"; version = "0.10.18"; sha256 = "1hvmjs7wfcbycviky79g1p5q3bzs8j31sr53nnqxqy6pnbmg0nxg"; })
-  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "0.10.18"; sha256 = "0phxxz4r1llklvp4svy9qlsms3qw77crai3ww70g03fifmmr9qq2"; })
+  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "0.10.19"; sha256 = "0wlmr4dlz8x3madm7xwhmsf0kgdnwcy6n7zvfd9x6h0bllii1lbn"; })
+  (fetchNuGet { pname = "Avalonia.Desktop"; version = "0.10.19"; sha256 = "0vghwp1wx6l1z0dlvd9aqdaikz6k34q0i9yzaphqlzjp6ms2g2ny"; })
+  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "0.10.19"; sha256 = "1zlcp8mwn2nscrdsvxlspny22m054gsva9az27pvk7s2s5mrqgfk"; })
+  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "0.10.19"; sha256 = "01fin1w9nwa3c9kpvbri26x1r4g59hmayx9r5hxwbhq7s7vm5ghr"; })
+  (fetchNuGet { pname = "Avalonia.Markup.Xaml.Loader"; version = "0.10.19"; sha256 = "19b74qs4bfslzldvs87r3skynw9k0bh7m6a2g9q67xb9ppwspr8n"; })
+  (fetchNuGet { pname = "Avalonia.Native"; version = "0.10.19"; sha256 = "0c9rw2wckyx9h5yfhm0af5zbs53n9bnhv0mlshl7mn0p92v1wfl3"; })
+  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "0.10.19"; sha256 = "0klk9hqas0h3d3lmr0di175nw2kwq5br1xpprkb4y4m83r5lfy0s"; })
  (fetchNuGet { pname = "Avalonia.Skia"; version = "0.10.18"; sha256 = "1vi83d9q6m2zd7b5snyzjxsj3vdp5bmi5vqhfslzghslpbhj2zwv"; })
+  (fetchNuGet { pname = "Avalonia.Skia"; version = "0.10.19"; sha256 = "16cl9ssmyif2a25fq9kvxs2vr83j589yns53zkfr3wmggl9n6lf2"; })
  (fetchNuGet { pname = "Avalonia.Svg"; version = "0.10.18"; sha256 = "06h7yh2lkm4rqfchn7nxqjbqx4afh42w61z9sby7b5gj56h5a84q"; })
  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "0.10.18"; sha256 = "0s25aq3xz0km55jwdxp59z8cc0d1zqaag1hiwnxdzd30id2ahn66"; })
-  (fetchNuGet { pname = "Avalonia.Win32"; version = "0.10.18"; sha256 = "1rvqydbzdi2n6jw4xx9q8i025w5zsgcli9vmv0vw1d51rd4cnc4k"; })
-  (fetchNuGet { pname = "Avalonia.X11"; version = "0.10.18"; sha256 = "0bzhbnz0dimxbpjxcrphnjn8nk37hqw0b83s2nsha4gzqvpc75b2"; })
+  (fetchNuGet { pname = "Avalonia.Win32"; version = "0.10.19"; sha256 = "1pd3jmrdc738j7b4d8rzaj7fxrfq1m2pl3i62z2ym3h0sxl51xy2"; })
+  (fetchNuGet { pname = "Avalonia.X11"; version = "0.10.19"; sha256 = "1h71w73r7r9ci059qwsjqnhp60l8sfd3i3xsw37qfnbhslcna6hh"; })
  (fetchNuGet { pname = "CommandLineParser"; version = "2.9.1"; sha256 = "1sldkj8lakggn4hnyabjj1fppqh50fkdrr1k99d4gswpbk5kv582"; })
  (fetchNuGet { pname = "Concentus"; version = "1.1.7"; sha256 = "0y5z444wrbhlmsqpy2sxmajl1fbf74843lvgj3y6vz260dn2q0l0"; })
  (fetchNuGet { pname = "DiscordRichPresence"; version = "1.1.3.18"; sha256 = "0p4bhaggjjfd4gl06yiphqgncxgcq2bws4sjkrw0n2ldf3hgrps3"; })
-  (fetchNuGet { pname = "DynamicData"; version = "7.12.11"; sha256 = "159037gd4rn8z5wdkbnb296rw5csay8rjigi1h4n35mjfg4nhm8f"; })
+  (fetchNuGet { pname = "DynamicData"; version = "7.13.1"; sha256 = "0hy2ba2nkhgp23glkinhfx3v892fkkf4cr9m41daaahnl2r2l8y1"; })
  (fetchNuGet { pname = "ExCSS"; version = "4.1.4"; sha256 = "1y50xp6rihkydbf5l73mr3qq2rm6rdfjrzdw9h1dw9my230q5lpd"; })
  (fetchNuGet { pname = "Fizzler"; version = "1.2.1"; sha256 = "1w5jb1d0figbv68dydbnlcsfmqlc3sv9z1zxp7d79dg2dkarc4qm"; })
  (fetchNuGet { pname = "FluentAvaloniaUI"; version = "1.4.5"; sha256 = "1j5ivy83f13dgn09qrfkq44ijvh0m9rbdx8760g47di70c4lda7j"; })
@ -275,5 +276,5 @@
  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.0.11"; sha256 = "0n4lvpqzy9kc7qy1a4acwwd7b7pnvygv895az5640idl2y9zbz18"; })
  (fetchNuGet { pname = "Tmds.DBus"; version = "0.9.0"; sha256 = "0vvx6sg8lxm23g5jvm5wh2gfs95mv85vd52lkq7d1b89bdczczf3"; })
  (fetchNuGet { pname = "UnicornEngine.Unicorn"; version = "2.0.2-rc1-fb78016"; sha256 = "1r43b5fd5q8xq8b5nk11jsz2gnm96dh7sxc0rrv2p605ivz7icin"; })
-  (fetchNuGet { pname = "XamlNameReferenceGenerator"; version = "1.5.1"; sha256 = "11sld5a9z2rdglkykvylghka7y37ny18naywpgpxp485m9bc63wc"; })
+  (fetchNuGet { pname = "XamlNameReferenceGenerator"; version = "1.6.1"; sha256 = "0348gj9g5rl0pj2frx4vscj6602gfyn9ba3i1rmfcrxh9jwwa09m"; })
 ]
--- a/pkgs/applications/emulators/snes9x/default.nix
+++ b/pkgs/applications/emulators/snes9x/default.nix
@ -33,14 +33,14 @@ stdenv.mkDerivation rec {
      "snes9x-gtk"
    else
      "snes9x";
-  version = "1.62.1";
+  version = "1.62.3";

  src = fetchFromGitHub {
    owner = "snes9xgit";
    repo = "snes9x";
    rev = version;
    fetchSubmodules = true;
-    hash = "sha256-y/tNJmmgigMEqjBWLyqxM/GQ2jcu4YXZjP0AbIjoPLg=";
+    hash = "sha256-+KHpvz7nfwGXjzDAK/V+2JDRT1sa0kXDkg7XcRyvSP8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/file-managers/vifm/default.nix
+++ b/pkgs/applications/file-managers/vifm/default.nix
@ -6,23 +6,24 @@

  # adds support for handling removable media (vifm-media). Linux only!
 , mediaSupport ? false, python3 ? null, udisks2 ? null, lib ? null
+, gitUpdater
 }:

 let isFullPackage = mediaSupport;
 in stdenv.mkDerivation rec {
  pname = if isFullPackage then "vifm-full" else "vifm";
-  version = "0.12.1";
+  version = "0.13";

  src = fetchurl {
    url = "https://github.com/vifm/vifm/releases/download/v${version}/vifm-${version}.tar.bz2";
-    sha256 = "sha256-j+KBPr3Mz+ma7OArBdYqIJkVJdRrDM+67Dr2FMZlVog=";
+    hash = "sha256-DZKTdJp5QHat6Wfs3EfRQdheRQNwWUdlORvfGpvUUHU=";
  };

  nativeBuildInputs = [ perl pkg-config makeWrapper ];
  buildInputs = [ ncurses libX11 util-linux file which groff ];

  postPatch = ''
-    # Avoid '#!/usr/bin/env perl' reverences to build help.
+    # Avoid '#!/usr/bin/env perl' references to build help.
    patchShebangs --build src/helpztags
  '';

@ -37,6 +38,12 @@ in stdenv.mkDerivation rec {
    ${lib.optionalString mediaSupport wrapVifmMedia}
  '';

+  passthru.updateScript = gitUpdater {
+    url = "https://github.com/vifm/vifm.git";
+    rev-prefix = "v";
+    ignoredVersions = "beta";
+  };
+
  meta = with lib; {
    description = "A vi-like file manager${lib.optionalString isFullPackage "; Includes support for optional features"}";
    maintainers = with maintainers; [ raskin ];
--- a/pkgs/applications/graphics/brlcad/default.nix
+++ b/pkgs/applications/graphics/brlcad/default.nix
@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, fontconfig
+, libX11
+, libXi
+, freetype
+, mesa
+}:
+
+stdenv.mkDerivation rec {
+  pname = "brlcad";
+  version = "7.34.0";
+
+  src = fetchFromGitHub {
+    owner = "BRL-CAD";
+    repo = pname;
+    rev = "refs/tags/rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
+    hash = "sha256-Re5gEXlqdPxniaEP13Q0v0O9rt40V5NrxoUpcNBwn7s=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    fontconfig
+    libX11
+    libXi
+    freetype
+    mesa
+  ];
+
+  cmakeFlags = [
+    "-DBRLCAD_ENABLE_STRICT=OFF"
+    "-DCMAKE_BUILD_TYPE=Release"
+  ];
+
+  meta = with lib; {
+    homepage = "https://brlcad.org";
+    description = "BRL-CAD is a powerful cross-platform open source combinatorial solid modeling system";
+    license = with licenses; [ lgpl21 bsd2 ];
+    maintainers = with maintainers; [ GaetanLepage ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/graphics/potreeconverter/default.nix
+++ b/pkgs/applications/graphics/potreeconverter/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "PotreeConverter";
-  version = "unstable-2022-08-04";
+  version = "unstable-2023-02-27";

  src = fetchFromGitHub {
    owner = "potree";
    repo = "PotreeConverter";
-    rev = "758bbac98a662de5e57d2280675e11cc76241688";
-    sha256 = "sha256-pDdV2/edYhhBWs153hSy1evI3cXD0Xq9nrEsw3JNcH4=";
+    rev = "af4666fa1090983d8ce7c11dcf49ba19eda90995";
+    sha256 = "sha256-QYNY+/v6mBEJFiv3i2QS+zqkgWJqeqXSqNoh+ChAiQA=";
  };

  buildInputs = [
@ -29,8 +29,16 @@ stdenv.mkDerivation rec {
  ];

  patchPhase = ''
+    runHook prePatch
+
    substituteInPlace ./CMakeLists.txt \
      --replace "find_package(TBB REQUIRED)" ""
+
+    # prevent inheriting permissions from /nix/store when copying
+    substituteInPlace Converter/src/main.cpp --replace \
+      'fs::copy(templateDir, pagedir, fs::copy_options::overwrite_existing | fs::copy_options::recursive)' 'string cmd = "cp --no-preserve=mode -r " + templateDir + " " + pagedir; system(cmd.c_str());'
+
+    runHook postPatch
  '';

  installPhase = ''
@ -48,6 +56,12 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

+  fixupPhase = ''
+    runHook preFixup
+    ln -s $src/resources $out/bin/resources
+    runHook postFixup
+  '';
+
  meta = with lib; {
    description = "Create multi res point cloud to use with potree";
    homepage = "https://github.com/potree/PotreeConverter";
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -41,17 +41,20 @@ stdenv.mkDerivation rec {
  buildInputs =
    [ boost ffmpeg gettext glew ilmbase
      freetype libjpeg libpng libsamplerate libsndfile libtiff libwebp
-      opencolorio openexr openimagedenoise openimageio openjpeg python zlib zstd fftw jemalloc
+      opencolorio openexr openimageio openjpeg python zlib zstd fftw jemalloc
      alembic
      (opensubdiv.override { inherit cudaSupport; })
      tbb
-      embree
      gmp
      pugixml
      potrace
      libharu
      libepoxy
    ]
+    ++ lib.optional (!stdenv.isAarch64) [
+      openimagedenoise
+      embree
+    ]
    ++ (if (!stdenv.isDarwin) then [
      libXi libX11 libXext libXrender
      libGLU libGL openal
@ -70,8 +73,6 @@ stdenv.mkDerivation rec {
  pythonPath = with python310Packages; [ numpy requests ];

  postPatch = ''
-    # allow usage of dynamically linked embree
-    rm build_files/cmake/Modules/FindEmbree.cmake
  '' +
    (if stdenv.isDarwin then ''
      : > build_files/cmake/platform/platform_apple_xcode.cmake
@ -121,6 +122,9 @@ stdenv.mkDerivation rec {
      "-DWITH_IMAGE_OPENJPEG=ON"
      "-DWITH_OPENCOLLADA=${if colladaSupport then "ON" else "OFF"}"
    ]
+    ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+      "-DWITH_CYCLES_EMBREE=OFF"
+    ]
    ++ lib.optionals stdenv.isDarwin [
      "-DWITH_CYCLES_OSL=OFF" # requires LLVM
      "-DWITH_OPENVDB=OFF" # OpenVDB currently doesn't build on darwin
@ -171,7 +175,7 @@ stdenv.mkDerivation rec {
    # say: "We've decided to cancel the BL offering for an indefinite period."
    # OptiX, enabled with cudaSupport, is non-free.
    license = with licenses; [ gpl2Plus ] ++ optional cudaSupport unfree;
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" ];
    maintainers = with maintainers; [ goibhniu veprbl ];
  };
 }
--- a/pkgs/applications/misc/fluidd/default.nix
+++ b/pkgs/applications/misc/fluidd/default.nix
@ -2,12 +2,12 @@

 stdenvNoCC.mkDerivation rec {
  pname = "fluidd";
-  version = "1.23.3";
+  version = "1.23.4";

  src = fetchurl {
    name = "fluidd-v${version}.zip";
    url = "https://github.com/cadriel/fluidd/releases/download/v${version}/fluidd.zip";
-    sha256 = "sha256-CCIu6DNU71oL0JIW3mQ5ThRSjbXeBmJ4FbF6i2dERbc=";
+    sha256 = "sha256-ofGjIxxk7tBEa4jbNSCNzZJBHvv+mA1u03f9KtdjIbQ=";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/misc/fuzzel/default.nix
+++ b/pkgs/applications/misc/fuzzel/default.nix
@ -24,14 +24,14 @@ assert svgSupport -> enableCairo;

 stdenv.mkDerivation rec {
  pname = "fuzzel";
-  version = "1.8.2";
+  version = "1.9.1";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "dnkl";
-    repo = "fuzzel";
+    repo = pname;
    rev = version;
-    sha256 = "sha256-5uXf5HfQ8bDQSMNCHHaC9sCX5P/D89T2ZOUiXTDx3bQ=";
+    hash = "sha256-Va/Rm35jqxDlIfQdrpZ41qrW8YzWmm1LWra76AW1xUw=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/otpclient/default.nix
+++ b/pkgs/applications/misc/otpclient/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "otpclient";
-  version = "3.1.5";
+  version = "3.1.6";

  src = fetchFromGitHub {
    owner = "paolostivanin";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-/1nycFh/slcfztfaZA6p9rZTWS4/vkb/Sovc94zlfCI=";
+    sha256 = "sha256-v7TvdS0IlfB4oKdaEh7Z3AFJDV1bOMiX5vVD7VhIMCE=";
  };

  buildInputs = [ gtk3 jansson libgcrypt libzip libpng libcotp zbar protobuf protobufc libsecret qrencode libuuid ];
--- a/pkgs/applications/misc/polar-bookshelf1/default.nix
+++ b/pkgs/applications/misc/polar-bookshelf1/default.nix
@ -0,0 +1,117 @@
+{ lib
+, stdenv
+, fetchurl
+, alsa-lib
+, at-spi2-atk
+, atk
+, autoPatchelfHook
+, cairo
+, cups
+, curl
+, dbus
+, dpkg
+, expat
+, fontconfig
+, gdk-pixbuf
+, glib
+, glibc
+, gsettings-desktop-schemas
+, gtk3
+, libX11
+, libXScrnSaver
+, libXcomposite
+, libXcursor
+, libXdamage
+, libXext
+, libXfixes
+, libXi
+, libXrandr
+, libXrender
+, libXtst
+, libnghttp2
+, libudev0-shim
+, libxcb
+, makeWrapper
+, nspr
+, nss
+, openssl
+, pango
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "polar-bookshelf1";
+  version = "1.100.14";
+
+  src = fetchurl {
+    url = "https://github.com/burtonator/polar-bookshelf/releases/download/v${version}/polar-bookshelf-${version}-amd64.deb";
+    hash = "sha256-5xa+Nwu0p1x5DLn1GNI0HDt7GtBGoFQ/9qGTeq9uBgU=";
+  };
+
+  buildInputs = [
+    alsa-lib
+    at-spi2-atk
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    fontconfig
+    gdk-pixbuf
+    glib
+    gsettings-desktop-schemas
+    gtk3
+    libX11
+    libXScrnSaver
+    libXcomposite
+    libXcursor
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXrandr
+    libXrender
+    libXtst
+    libxcb
+    nspr
+    nss
+    pango
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    dpkg
+    makeWrapper
+    wrapGAppsHook
+  ];
+
+  runtimeLibs = lib.makeLibraryPath [ libudev0-shim glibc curl openssl libnghttp2 ];
+
+  unpackPhase = ''
+    dpkg-deb -x $src .
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/polar-bookshelf $out/bin $out/lib
+    mv opt/Polar\ Bookshelf/* $out/share/polar-bookshelf
+    mv $out/share/polar-bookshelf/*.so $out/lib
+    mv usr/share/* $out/share/
+    ln -s $out/share/polar-bookshelf/polar-bookshelf $out/bin/polar-bookshelf
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : "${runtimeLibs}" )
+    # Correct desktop file `Exec`
+    substituteInPlace $out/share/applications/polar-bookshelf.desktop \
+      --replace "/opt/Polar Bookshelf/polar-bookshelf" "$out/bin/polar-bookshelf"
+  '';
+
+  meta = {
+    homepage = "https://getpolarized.io/";
+    description = "Personal knowledge repository for PDF and web content supporting incremental reading and document annotation";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.dansbandit ];
+    platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}
--- a/pkgs/applications/misc/ttdl/default.nix
+++ b/pkgs/applications/misc/ttdl/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ttdl";
-  version = "3.7.0";
+  version = "3.7.1";

  src = fetchFromGitHub {
    owner = "VladimirMarkelov";
    repo = "ttdl";
    rev = "v${version}";
-    sha256 = "sha256-4XmOFoj2kynQZzos/vf0rciJCGfnFLN7f1MG9NU53os=";
+    sha256 = "sha256-Bhi1d01VqeLmxsiyIG8HXD6AgabgsKgZoKYgnGNpk/8=";
  };

-  cargoHash = "sha256-9TyEHAlxTNx/ildlqEjuFIKfmUQQFQSVoxcrb2Tg9Ps=";
+  cargoHash = "sha256-A/5DS7b7Dgj+GlCPu6fx0t14BfMm4XjkpcDjSpeDSnE=";

  meta = with lib; {
    description = "A CLI tool to manage todo lists in todo.txt format";
--- a/pkgs/applications/misc/valent/default.nix
+++ b/pkgs/applications/misc/valent/default.nix
@ -5,9 +5,11 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, vala
+, wrapGAppsHook4
 , evolution-data-server-gtk4
 , glib
+, glib-networking
 , gnutls
 , gst_all_1
 , json-glib
@ -20,14 +22,14 @@

 stdenv.mkDerivation rec {
  pname = "valent";
-  version = "unstable-2023-03-02";
+  version = "unstable-2023-03-31";

  src = fetchFromGitHub {
    owner = "andyholmes";
    repo = "valent";
-    rev = "4b60f28f46bc948c5f3b30189bb9b5fbe29d2745";
+    rev = "bb9fc25a58eeb81abea2bb651accc9538a3a82fd";
    fetchSubmodules = true;
-    sha256 = "sha256-ltf/srQLqtqE71sxEh7VTQqXy2wOpTSdGDsjITOt3f8=";
+    sha256 = "sha256-3pEPE96gFjDGesFs/EZswuv6D3JQEpnAnlCw0IWYkR0=";
  };

  nativeBuildInputs = [
@ -35,12 +37,14 @@ stdenv.mkDerivation rec {
    meson
    ninja
    pkg-config
-    wrapGAppsHook
+    vala
+    wrapGAppsHook4
  ];

  buildInputs = [
    evolution-data-server-gtk4
    glib
+    glib-networking
    gnutls
    gst_all_1.gstreamer
    gst_all_1.gst-plugins-base
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -1,21 +1,21 @@
 {
  "stable": {
-    "version": "111.0.5563.146",
-    "sha256": "1zmm926fsifqaw60ilfav017xxnvnhvqbbq7qcrhdyjm3fiiyw0y",
-    "sha256bin64": "00z4rqgpd6sdmh5dlqbyk6c3ja8kyssw418rn6b3kc93zvn7df0p",
+    "version": "112.0.5615.49",
+    "sha256": "0hgzbbmz40235binfn3vkkxzvwxilaxg04dclqrz980z7hvkgzfx",
+    "sha256bin64": "0jq5pbyayk8pa9ksxp2dk3k7j2jic506mfpkq1a1z48j1l4fkr5i",
    "deps": {
      "gn": {
-        "version": "2022-12-12",
+        "version": "2023-02-17",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "5e19d2fb166fbd4f6f32147fbb2f497091a54ad8",
-        "sha256": "1b5fwldfmkkbpp5x63n1dxv0nc965hphc8rm8ah7zg44zscm9z30"
+        "rev": "b25a2f8c2d33f02082f0f258350f5e22c0973108",
+        "sha256": "075p4jwk1apvwmqmvhwfw5f669ci7nxwjq9mz5aa2g5lz4fkdm4c"
      }
    },
    "chromedriver": {
-      "version": "111.0.5563.64",
-      "sha256_linux": "0f4v6hds5wl43hnmqxmzidlg5nqgr4iy04hmrmvzaihsdny3na8s",
-      "sha256_darwin": "0izdp36d4wid5hmz8wcna3gddly7nbkafqqf5k1ikb2jgx9ipp8f",
-      "sha256_darwin_aarch64": "0yzn7bibj36wrc980s9sa8cl0qds01n9i88jk95afx5lk5zb8rgc"
+      "version": "112.0.5615.28",
+      "sha256_linux": "13i2y1zd3dxjvs9575m00gg8xxll1g08sn7dayl7l8qr3zy74p98",
+      "sha256_darwin": "0mw8h7ijc0nf7c2j731w30ajh6djy1lk6nak81fpksgk98vkv64f",
+      "sha256_darwin_aarch64": "103b3n7vxqvim4ks8vi5b29d41wdldkj1rz94fnqvgw04lykm9sk"
    }
  },
  "beta": {
@ -32,9 +32,9 @@
    }
  },
  "dev": {
-    "version": "113.0.5672.12",
-    "sha256": "1h0mll8xq096jzqg4hhwcaxg12j5pinjjyicm276f7r5m12l1c1x",
-    "sha256bin64": "1ffyhigs4x3c1cr4r8pv5jjg6qx9pxwy0hmyp9a1196jxkh65kpy",
+    "version": "113.0.5672.24",
+    "sha256": "1z7yv5lqi1n4ycymkf0kz1v8ig06n430a37ik8hri3a6db8r9lv8",
+    "sha256bin64": "0byksvk781gmh5fmjmc77jh19gvkzadf78yr9b4c42las44g4pn4",
    "deps": {
      "gn": {
        "version": "2023-03-18",
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -1,4 +1,5 @@
 { stdenv, lib, makeDesktopItem, makeWrapper, makeBinaryWrapper, lndir, config
+, buildPackages
 , jq, xdg-utils, writeText

 ## various stuff that can be plugged in
@ -275,7 +276,7 @@ let
          # Symbolic link: wrap the link's target.
          oldExe="$(readlink -v --canonicalize-existing "$executablePath")"
          rm "$executablePath"
-        elif wrapperCmd=$(${makeBinaryWrapper.extractCmd} "$executablePath"); [[ $wrapperCmd ]]; then
+        elif wrapperCmd=$(${buildPackages.makeBinaryWrapper.extractCmd} "$executablePath"); [[ $wrapperCmd ]]; then
          # If the executable is a binary wrapper, we need to update its target to
          # point to $out, but we can't just edit the binary in-place because of length
          # issues. So we extract the command used to create the wrapper and add the
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.9.5";
+  version = "0.9.6";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    sha256 = "sha256-gC7HdOrmOIYTaksx/CxXMt4wIly3RBL1SsQRbwQWLi8=";
+    sha256 = "sha256-EkpoXmaJ679B0sATDP/asJaywY4RFN7NNYc+7uyMQEA=";
  };

  CGO_ENABLED = 0;
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@ -69,6 +69,24 @@ let
          };
        })

+        (self: super: {
+          cryptography = super.cryptography.overridePythonAttrs (old: {
+            meta = old.meta // {
+              knownVulnerabilities = old.meta.knownVulnerabilities or [ ]
+                ++ lib.optionals (lib.versionOlder old.version "39.0.1") [
+                  "CVE-2022-4304"
+                  "CVE-2023-0215"
+                  "CVE-2023-0216"
+                  "CVE-2023-0217"
+                  "CVE-2023-0401"
+                  "CVE-2022-4203"
+                  "CVE-2022-4450"
+                  "CVE-2023-23931"
+                ];
+            };
+          });
+        })
+
      ];
    }
  ).python;
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -1,10 +1,10 @@
 {
  "aci": {
-    "hash": "sha256-rgPqf8PopvzXiIOjng7DNOv920MPI81EVMUu3DaS8o4=",
+    "hash": "sha256-OwQzr0Rt9fjbGfJPDezrh/j4hLwgq8ldRgTX3rL/ddY=",
    "homepage": "https://registry.terraform.io/providers/CiscoDevNet/aci",
    "owner": "CiscoDevNet",
    "repo": "terraform-provider-aci",
-    "rev": "v2.6.1",
+    "rev": "v2.7.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -146,11 +146,11 @@
    "vendorHash": null
  },
  "baiducloud": {
-    "hash": "sha256-htNkDa60XHpH0aoJhMvsMiqUl8Ldqa/ZMl5dp7OKwGA=",
+    "hash": "sha256-J17jzgCTCG87Cieci/TrMpEUxA4Ynfm1+Cr4fRjDtNY=",
    "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
    "owner": "baidubce",
    "repo": "terraform-provider-baiducloud",
-    "rev": "v1.19.5",
+    "rev": "v1.19.6",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -164,13 +164,13 @@
    "vendorHash": null
  },
  "bitbucket": {
-    "hash": "sha256-FrKNPpwPCpL7GuPkjYCPqHit/VPJG5Fe0Ew4WMzp1AI=",
+    "hash": "sha256-2JTJF+zYuf9ZKaEMSOxxjODbmIBXnhpwE8LJUdRIkYY=",
    "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
    "owner": "DrFaust92",
    "repo": "terraform-provider-bitbucket",
-    "rev": "v2.30.2",
+    "rev": "v2.31.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rtPbHItqsgHoHs85QO6Uix2yvJkHE6B2XYMOdcJvoGc="
+    "vendorHash": "sha256-mnG2CZ/ko4p4CTs0YskJP41sQD9lmEz4dRQLiklim34="
  },
  "brightbox": {
    "hash": "sha256-e4WvQKtf6zVEZ74c+lE3ZkbX24rPazp8MrJCNQDTz2c=",
@ -219,13 +219,13 @@
    "vendorHash": "sha256-w7Rsr3UgijW/3RMKzhMyWCvn5b1R1oqRs87/ZPO7jHs="
  },
  "cloudflare": {
-    "hash": "sha256-jf2NAhiavSWsKTRIJF8Ypm7tobzvTlESKEkDRre4ZVo=",
+    "hash": "sha256-dhSjFeTkbiG/Gx/DS1WzW2b31u3apfXX4Safh29e6Fw=",
    "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
    "owner": "cloudflare",
    "repo": "terraform-provider-cloudflare",
-    "rev": "v4.2.0",
+    "rev": "v4.3.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-9YmvaKPZVu+Fi0zlmJbKcU2iw2WUdzZJzgWPfkI1C24="
+    "vendorHash": "sha256-sgJ1HhhWQpvOGFVEC43pymBKyVcqdn8jLlW5fR21mFE="
  },
  "cloudfoundry": {
    "hash": "sha256-MKhsUGuDpKfYFf9Vk0uVrP/Z4hnQyO+2WiqWXO9EAC0=",
@ -420,11 +420,11 @@
    "vendorHash": "sha256-uWTY8cFztXFrQQ7GW6/R+x9M6vHmsb934ldq+oeW5vk="
  },
  "github": {
-    "hash": "sha256-QsytXQ1bf9/OI4+XyZ+lBIuwTwAbdSOdquH1oyp6rOE=",
+    "hash": "sha256-PdaQAR/dSzFnJ+f+EEm1Y/DRjTDL2Qj7goSakjEaW80=",
    "homepage": "https://registry.terraform.io/providers/integrations/github",
    "owner": "integrations",
    "repo": "terraform-provider-github",
-    "rev": "v5.19.0",
+    "rev": "v5.20.0",
    "spdx": "MIT",
    "vendorHash": null
  },
@ -438,22 +438,22 @@
    "vendorHash": "sha256-s4FynUO6bT+8uZYkecbQCtFw1jFTAAYUkSzONI6Ba9g="
  },
  "google": {
-    "hash": "sha256-44Jbh9PiSNJNpshL0G4zz/5U73Y28C/eLGlJ1GTMITk=",
+    "hash": "sha256-XeY2AXdwzYUC5d5Bhx0vgBnmF80qDsjxUlJfUf+eKzw=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.59.0",
+    "rev": "v4.60.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-ztoWOiqyOrusSo0peigEV9wy2f387gVGfcolkYoJvhw="
  },
  "google-beta": {
-    "hash": "sha256-5ywjtlJCCw+Vzj22op7tm5xVj+QOqGIg4Paw8t8jFAg=",
+    "hash": "sha256-Fx6CEMjgrd0dnscSRono4QsyV/zZKzgrP9jyLqxtAFU=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.59.0",
+    "rev": "v4.60.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-ztoWOiqyOrusSo0peigEV9wy2f387gVGfcolkYoJvhw="
  },
@ -973,13 +973,13 @@
    "vendorHash": null
  },
  "scaleway": {
-    "hash": "sha256-cHleY4quCLquw4XH0TmvQ+TO0XP+ikclCvd0LASgC2w=",
+    "hash": "sha256-8bo+bJdzEZWQN6dATt9ln2BlEu11/9abWLl5V09mQX8=",
    "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
    "owner": "scaleway",
    "repo": "terraform-provider-scaleway",
-    "rev": "v2.15.0",
+    "rev": "v2.16.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-BIXxAGvF4+MjfU5X9/wNLUgzcVkiuz60EGXU/mNyqd8="
+    "vendorHash": "sha256-KUbE00fajvs4p8QxmuKV5IoRfCdWtfZTrOftcRAPSws="
  },
  "secret": {
    "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@ -1090,13 +1090,13 @@
    "vendorHash": "sha256-iNBM4Y24vDGPKyb5cppSogk145F0/pAFmOzEeiWgfLI="
  },
  "tailscale": {
-    "hash": "sha256-X3YV640d3pLyKm/v88oEhXfYnox+ksrEWKgiJbYl6gk=",
+    "hash": "sha256-r8MUoPWD06DcM4Oqqyoe4MPR6/NY7vvs/90z2zjQKTU=",
    "homepage": "https://registry.terraform.io/providers/tailscale/tailscale",
    "owner": "tailscale",
    "repo": "terraform-provider-tailscale",
-    "rev": "v0.13.6",
+    "rev": "v0.13.7",
    "spdx": "MIT",
-    "vendorHash": "sha256-2wPmLpjhG6QgG+BUCO0oIzHjBOWIOYuptgdtSIm9TZw="
+    "vendorHash": "sha256-6UxBnQiogcizff5Rv4eadOeiG5JaXQphUWlfnqELvAI="
  },
  "talos": {
    "hash": "sha256-/Ml+Vsh50U5CoVdnls69iTPoSPpgAtOpO2hWlcmbyKw=",
@ -1126,11 +1126,11 @@
    "vendorHash": "sha256-plYy3INLi/SeKu7R0lDLY1CvRDU7bmZsQKzFtMc2Wu4="
  },
  "thunder": {
-    "hash": "sha256-GLyGm9Q+ajuQFIni/OCYvYhpj2fiVYHzkPwbofq/DEs=",
+    "hash": "sha256-GmFEgEKpkx+cvztHe2qDTVStMIGYYzmbZM8/QmSwbcA=",
    "homepage": "https://registry.terraform.io/providers/a10networks/thunder",
    "owner": "a10networks",
    "repo": "terraform-provider-thunder",
-    "rev": "v1.1.0",
+    "rev": "v1.2.0",
    "spdx": "BSD-2-Clause",
    "vendorHash": null
  },
--- a/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "cinny-desktop";
-  version = "2.2.4";
+  version = "2.2.6";

  src = fetchurl {
    url = "https://github.com/cinnyapp/cinny-desktop/releases/download/v${version}/Cinny_desktop-x86_64.deb";
-    sha256 = "sha256-ibUXNGgc23ndTqQKD0np5EH1T3xipVAmETbIy7akqkg=";
+    sha256 = "sha256-Bh7qBlHh2bQ6y2HnI4TtxMU6N3t04tr1Juoul2KMrqs=";
  };

  nativeBuildInputs = [
@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
    description = "Yet another matrix client for desktop";
    homepage = "https://github.com/cinnyapp/cinny-desktop";
    maintainers = [ maintainers.aveltras ];
-    license = licenses.mit;
+    license = licenses.agpl3Only;
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    platforms = platforms.linux;
    mainProgram = "cinny";
--- a/pkgs/applications/networking/sniffnet/default.nix
+++ b/pkgs/applications/networking/sniffnet/default.nix
@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pkg-config
 , libpcap
+, openssl
 , stdenv
 , alsa-lib
 , expat
@ -14,21 +15,22 @@

 rustPlatform.buildRustPackage rec {
  pname = "sniffnet";
-  version = "1.1.2";
+  version = "1.1.3";

  src = fetchFromGitHub {
    owner = "gyulyvgc";
    repo = "sniffnet";
    rev = "refs/tags/v${version}";
-    hash = "sha256-QEMd/vOi0DFCq7AJHhii7rnBAHS89XP3/b2UIewAgLc=";
+    hash = "sha256-sJUc14MXaCS4OHtwdCuwI1b7NAlOnaGsXBNUYCEXJqQ=";
  };

-  cargoHash = "sha256-VcmiM7prK5l8Ow8K9TGUR2xfx9648IoU6i40hOGAqGQ=";
+  cargoHash = "sha256-neRVpJmI4TgzvIQqKNqBr61O7rR8246PcxG50IIKE/M=";

  nativeBuildInputs = [ pkg-config ];

  buildInputs = [
    libpcap
+    openssl
  ] ++ lib.optionals stdenv.isLinux [
    alsa-lib
    expat
@ -43,6 +45,11 @@ rustPlatform.buildRustPackage rec {
    rustPlatform.bindgenHook
  ];

+  # requires internet access
+  checkFlags = [
+    "--skip=secondary_threads::check_updates::tests::fetch_latest_release_from_github"
+  ];
+
  postFixup = lib.optionalString stdenv.isLinux ''
    patchelf $out/bin/sniffnet \
      --add-rpath ${lib.makeLibraryPath [ vulkan-loader xorg.libX11 ]}
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -17,14 +17,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "23.2.4";
+  version = "23.4.0";
 in
 stdenv.mkDerivation {
  inherit pname appname version;

  src = fetchurl {
    url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
-    sha256 = "sha256-ZliVhnO9fK/6k4Ga86ZSmhzQ3YKziAab19oZs9Pteic=";
+    sha256 = "sha256-8gSy7WL0wpLAXxVo3oOA9X12qd/R7P3MgmlwXxpJSUs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/math/clp/default.nix
+++ b/pkgs/applications/science/math/clp/default.nix
@ -1,19 +1,23 @@
-{ lib, stdenv, fetchurl, zlib }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, coin-utils, zlib, osi }:

 stdenv.mkDerivation rec {
-  version = "1.17.6";
+  version = "1.17.7";
  pname = "clp";
-  src = fetchurl {
-    url = "https://www.coin-or.org/download/source/Clp/Clp-${version}.tgz";
-    sha256 = "0ap1f0lxppa6pnbc4bg7ih7a96avwaki482nig8w5fr3vg9wvkzr";
+  src = fetchFromGitHub {
+    owner = "coin-or";
+    repo = "Clp";
+    rev = "releases/${version}";
+    hash = "sha256-CfAK/UbGaWvyk2ZxKEgziVruzZfz7WMJVi/YvdR/UNA=";
  };

-  propagatedBuildInputs = [ zlib ];
+  nativeBuildInputs = [ pkg-config ];
+
+  propagatedBuildInputs = [ zlib coin-utils osi ];

  doCheck = true;

  meta = with lib; {
-    license = licenses.epl10;
+    license = licenses.epl20;
    homepage = "https://github.com/coin-or/Clp";
    description = "An open-source linear programming solver written in C++";
    platforms = platforms.darwin ++ [ "x86_64-linux" ];
--- a/pkgs/applications/version-management/gh/default.nix
+++ b/pkgs/applications/version-management/gh/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gh";
-  version = "2.26.0";
+  version = "2.26.1";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-PsZSlLI6ZcHsKWIwETJKPdNWin4YySGNpgH2Yc7rdF8=";
+    hash = "sha256-ECYUpbzZXEJv0r9q66kLpUtp1gbgSeXdb3p4vHWIIk4=";
  };

  vendorHash = "sha256-+8/cA0UxyVu7nyLhHYBWmn8Vs0O/EYepqTAOVU4gwt4=";
--- a/pkgs/applications/video/bilibili/default.nix
+++ b/pkgs/applications/video/bilibili/default.nix
@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, fetchurl
+, electron
+, makeWrapper
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bilibili";
+  version = "1.9.2-1";
+  src = fetchurl {
+    url = "https://github.com/msojocs/bilibili-linux/releases/download/v${version}/io.github.msojocs.bilibili_${version}_amd64.deb";
+    hash = "sha256-y3dUBImvcIG89m82RaIOa0cxJXIAIGa+n3FJkASacaY=";
+  };
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    ar x $src
+    tar xf data.tar.xz
+
+    runHook postUnpack
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp -r usr/share $out/share
+    sed -i "s|Exec=.*|Exec=$out/bin/bilibili|" $out/share/applications/*.desktop
+    cp -r opt/apps/io.github.msojocs.bilibili/files/bin/app $out/opt
+    makeWrapper ${electron}/bin/electron $out/bin/bilibili \
+      --argv0 "bilibili" \
+      --add-flags "$out/opt/app.asar"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Electron-based bilibili desktop client";
+    homepage = "https://github.com/msojocs/bilibili-linux";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jedsek ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/video/celluloid/default.nix
+++ b/pkgs/applications/video/celluloid/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "celluloid";
-  version = "0.24";
+  version = "0.25";

  src = fetchFromGitHub {
    owner = "celluloid-player";
    repo = "celluloid";
    rev = "v${version}";
-    hash = "sha256-8Y/dCeoS29R1UHwmLOp0d+JNNC4JH5pLpiqfBZU+kLI=";
+    hash = "sha256-GCRpcC/olMUbMG2fadNcXTKF/Zl0+GY2+eSRLQhnWxI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/video/media-downloader/default.nix
+++ b/pkgs/applications/video/media-downloader/default.nix
@ -2,38 +2,48 @@
 , stdenv
 , fetchFromGitHub
 , cmake
-, qt5
-, ffmpeg-full
+, wrapQtAppsHook
+, qtbase
 , aria2
-, yt-dlp
+, ffmpeg
 , python3
+, yt-dlp
 }:

 stdenv.mkDerivation rec {
  pname = "media-downloader";
-  version = "2.9.0";
+  version = "3.1.0";

  src = fetchFromGitHub {
    owner = "mhogomchungu";
    repo = pname;
    rev = "${version}";
-    sha256 = "sha256-3tVOyIwdGcSVnEJWQWh6HIsjY6uEzWkTs45qf81r/+0=";
+    hash = "sha256-/oKvjmLFchR2B/mcLIUVIHBK78u2OQGf2aiwVR/ZoQc=";
  };

-  nativeBuildInputs = [ cmake qt5.wrapQtAppsHook ];
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+  ];

-  preFixup = ''
-    qtWrapperArgs+=(
-      --prefix PATH : "${lib.makeBinPath [ ffmpeg-full aria2 yt-dlp python3 ]}"
-    )
-  '';
+  buildInputs = [
+    qtbase
+  ];
+
+  qtWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [
+        aria2
+        ffmpeg
+        python3
+        yt-dlp
+      ]}"
+  ];

  meta = with lib; {
    description = "A Qt/C++ GUI front end to youtube-dl";
    homepage = "https://github.com/mhogomchungu/media-downloader";
    license = licenses.gpl2Plus;
-    broken = stdenv.isDarwin;
-    platforms = platforms.unix;
+    platforms = platforms.linux;
    maintainers = with maintainers; [ zendo ];
  };
 }
--- a/pkgs/applications/virtualization/youki/default.nix
+++ b/pkgs/applications/virtualization/youki/default.nix
@ -40,7 +40,7 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://containers.github.io/youki/";
    changelog = "https://github.com/containers/youki/releases/tag/v${version}";
    license = licenses.asl20;
-    maintainers = with maintainers; [ candyc1oud ];
+    maintainers = [];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/window-managers/labwc/default.nix
+++ b/pkgs/applications/window-managers/labwc/default.nix
@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (self: {
  pname = "labwc";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromGitHub {
    owner = "labwc";
    repo = "labwc";
    rev = self.version;
-    hash = "sha256-PfvtNbSAz1vt0+ko4zRPyRRN+lhQoA2kJ2xoJy5o4So=";
+    hash = "sha256-yZ1tXx7AA9pFc5C6c/J3B03/TfXw1PsAunNNiee3BGU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/window-managers/wayfire/default.nix
+++ b/pkgs/applications/window-managers/wayfire/default.nix
@ -1,33 +1,87 @@
-{ lib, stdenv, fetchurl, cmake, meson, ninja, pkg-config
-, cairo, doctest, libdrm, libexecinfo, libinput, libjpeg, libxkbcommon, wayland
-, wayland-protocols, wf-config, wlroots, mesa
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, meson
+, ninja
+, pkg-config
+, wf-config
+, cairo
+, doctest
+, libdrm
+, libexecinfo
+, libinput
+, libjpeg
+, libxkbcommon
+, wayland
+, wayland-protocols
+, wayland-scanner
+, wlroots
+, pango
+, xorg
 }:

 stdenv.mkDerivation rec {
  pname = "wayfire";
-  version = "0.7.2";
+  version = "0.7.5";

-  src = fetchurl {
-    url = "https://github.com/WayfireWM/wayfire/releases/download/v${version}/wayfire-${version}.tar.xz";
-    sha256 = "1gasijjyfl00zpy6j9hh6qpwv0sw42h9irycbnm693j3vw9mcy66";
+  src = fetchFromGitHub {
+    owner = "WayfireWM";
+    repo = pname;
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-Z+rR9pY244I3i/++XZ4ROIkq3vtzMgcxxHvJNxFD9is=";
  };

-  nativeBuildInputs = [ cmake meson ninja pkg-config wayland ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    wayland-scanner
+  ];
+
+
  buildInputs = [
-    cairo doctest libdrm libexecinfo libinput libjpeg libxkbcommon wayland
-    wayland-protocols wf-config wlroots mesa
+    wf-config
+    libdrm
+    libexecinfo
+    libinput
+    libjpeg
+    libxkbcommon
+    wayland-protocols
+    xorg.xcbutilwm
+    wayland
+    cairo
+    pango
+  ];
+
+  propagatedBuildInputs = [
+    wlroots
+  ];
+
+  nativeCheckInputs = [
+    cmake
+    doctest
  ];

  # CMake is just used for finding doctest.
  dontUseCmakeConfigure = true;

-  mesonFlags = [ "--sysconfdir" "/etc" ];
+  doCheck = true;
+
+  mesonFlags = [
+    "--sysconfdir /etc"
+    "-Duse_system_wlroots=enabled"
+    "-Duse_system_wfconfig=enabled"
+  ];
+
+  passthru.providedSessions = [ "wayfire" ];

  meta = with lib; {
    homepage = "https://wayfire.org/";
    description = "3D Wayland compositor";
    license = licenses.mit;
-    maintainers = with maintainers; [ qyliss wucke13 ];
+    maintainers = with maintainers; [ qyliss wucke13 rewine ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/window-managers/wayfire/wcm.nix
+++ b/pkgs/applications/window-managers/wayfire/wcm.nix
@ -1,27 +1,61 @@
-{ stdenv, lib, fetchurl, meson, ninja, pkg-config, wayland, wrapGAppsHook
-, gtk3, libevdev, libxml2, wayfire, wayland-protocols, wf-config, wf-shell
+{ stdenv
+, lib
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, wayland
+, wrapGAppsHook
+, wayfire
+, wf-shell
+, wf-config
+, wayland-scanner
+, wayland-protocols
+, gtk3
+, libevdev
+, libxml2
 }:

 stdenv.mkDerivation rec {
  pname = "wcm";
-  version = "0.7.0";
+  version = "0.7.5";

-  src = fetchurl {
-    url = "https://github.com/WayfireWM/wcm/releases/download/v${version}/wcm-${version}.tar.xz";
-    sha256 = "19za1fnlf5hz4n4mxxwqcr5yxp6mga9ah539ifnjnqrgvj19cjlj";
+  src = fetchFromGitHub {
+    owner = "WayfireWM";
+    repo = pname;
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-LJR9JGl49o4O6LARofz3jOeAqseGcmzVhMnhk/aobUU=";
  };

-  nativeBuildInputs = [ meson ninja pkg-config wayland wrapGAppsHook ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    wayland-scanner
+    wrapGAppsHook
+  ];
+
  buildInputs = [
-    gtk3 libevdev libxml2 wayfire wayland
-    wayland-protocols wf-config wf-shell
+    wayfire
+    wf-config
+    wf-shell
+    wayland
+    wayland-protocols
+    gtk3
+    libevdev
+    libxml2
+  ];
+
+  mesonFlags = [
+    "-Denable_wdisplays=false"
  ];

  meta = with lib; {
    homepage = "https://github.com/WayfireWM/wcm";
    description = "Wayfire Config Manager";
    license = licenses.mit;
-    maintainers = with maintainers; [ qyliss wucke13 ];
+    maintainers = with maintainers; [ qyliss wucke13 rewine ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/window-managers/wayfire/wf-config.nix
+++ b/pkgs/applications/window-managers/wayfire/wf-config.nix
@ -1,20 +1,46 @@
-{ stdenv, lib, fetchurl, cmake, meson, ninja, pkg-config
-, doctest, glm, libevdev, libxml2
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, meson
+, ninja
+, pkg-config
+, doctest
+, glm
+, libevdev
+, libxml2
 }:

 stdenv.mkDerivation rec {
  pname = "wf-config";
  version = "0.7.1";

-  src = fetchurl {
-    url = "https://github.com/WayfireWM/wf-config/releases/download/v${version}/wf-config-${version}.tar.xz";
-    sha256 = "1w75yxhz0nvw4mlv38sxp8k8wb5h99b51x3fdvizc3yaxanqa8kx";
+  src = fetchFromGitHub {
+    owner = "WayfireWM";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-ADUBvDJcPYEB9ZvaFIgTfemo1WYwiWgCWX/z2yrEPtA=";
  };

-  nativeBuildInputs = [ cmake meson ninja pkg-config ];
-  buildInputs = [ doctest libevdev libxml2 ];
-  propagatedBuildInputs = [ glm ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];

+  buildInputs = [
+    libevdev
+    libxml2
+  ];
+
+  propagatedBuildInputs = [
+    glm
+  ];
+
+  nativeCheckInputs = [
+    cmake
+    doctest
+  ];
  # CMake is just used for finding doctest.
  dontUseCmakeConfigure = true;

@ -24,7 +50,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/WayfireWM/wf-config";
    description = "Library for managing configuration files, written for Wayfire";
    license = licenses.mit;
-    maintainers = with maintainers; [ qyliss wucke13 ];
+    maintainers = with maintainers; [ qyliss wucke13 rewine ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/window-managers/wayfire/wf-shell.nix
+++ b/pkgs/applications/window-managers/wayfire/wf-shell.nix
@ -1,29 +1,53 @@
-{ stdenv, lib, fetchurl, meson, ninja, pkg-config, wayland, alsa-lib, gtkmm3, gtk-layer-shell, pulseaudio, wayfire, wf-config
+{ stdenv
+, lib
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, wayland-scanner
+, wayfire
+, wf-config
+, alsa-lib
+, gtkmm3
+, gtk-layer-shell
+, pulseaudio
 }:

 stdenv.mkDerivation rec {
  pname = "wf-shell";
  version = "0.7.0";

-  # > Note to packagers: do not use the autogenerated "Source code"
-  # > archives from GitHub, but the wf-shell-0.4.0.tar.xz file.
-  src = fetchurl {
-    url = "https://github.com/WayfireWM/wf-shell/releases/download/v${version}/wf-shell-${version}.tar.xz";
-    sha256 = "1isybm9lcpxwyf6zh2vzkwrcnw3q7qxm21535g4f08f0l68cd5bl";
+  src = fetchFromGitHub {
+    owner = "WayfireWM";
+    repo = pname;
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-iQUBuNjbZuf51A69RC6NsMHFZCFRv+d9XZ0HtP6OpOA=";
  };

-  nativeBuildInputs = [ meson ninja pkg-config wayland ];
-  buildInputs = [
-    alsa-lib gtkmm3 gtk-layer-shell pulseaudio wayfire wf-config
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    wayland-scanner
  ];

-  mesonFlags = [ "--sysconfdir" "/etc" ];
+  buildInputs = [
+    wayfire
+    wf-config
+    alsa-lib
+    gtkmm3
+    gtk-layer-shell
+    pulseaudio
+  ];
+
+  mesonFlags = [ "--sysconfdir /etc" ];

  meta = with lib; {
    homepage = "https://github.com/WayfireWM/wf-shell";
    description = "GTK3-based panel for Wayfire";
    license = licenses.mit;
-    maintainers = with maintainers; [ qyliss wucke13 ];
+    maintainers = with maintainers; [ qyliss wucke13 rewine ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@ -10,7 +10,7 @@ args@{
 , bazelBuildFlags ? []
 , bazelTestFlags ? []
 , bazelFetchFlags ? []
-, bazelTarget
+, bazelTargets
 , bazelTestTargets ? []
 , buildAttrs
 , fetchAttrs
@ -69,11 +69,11 @@ let
    '';
 in
 stdenv.mkDerivation (fBuildAttrs // {
-  inherit name bazelFlags bazelBuildFlags bazelTestFlags bazelFetchFlags bazelTarget bazelTestTargets;
+  inherit name bazelFlags bazelBuildFlags bazelTestFlags bazelFetchFlags bazelTargets bazelTestTargets;

  deps = stdenv.mkDerivation (fFetchAttrs // {
    name = "${name}-deps.tar.gz";
-    inherit bazelFlags bazelBuildFlags bazelTestFlags bazelFetchFlags bazelTarget bazelTestTargets;
+    inherit bazelFlags bazelBuildFlags bazelTestFlags bazelFetchFlags bazelTargets bazelTestTargets;

    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ fFetchAttrs.impureEnvVars or [];

@ -94,21 +94,18 @@ stdenv.mkDerivation (fBuildAttrs // {
    buildPhase = fFetchAttrs.buildPhase or ''
      runHook preBuild

-      # See footnote called [USER and BAZEL_USE_CPP_ONLY_TOOLCHAIN variables].
-      # We disable multithreading for the fetching phase since it can lead to timeouts with many dependencies/threads:
-      # https://github.com/bazelbuild/bazel/issues/6502
-      BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
-      USER=homeless-shelter \
-      bazel \
-        --batch \
-        --output_base="$bazelOut" \
-        --output_user_root="$bazelUserRoot" \
-        ${if fetchConfigured then "build --nobuild" else "fetch"} \
-        --loading_phase_threads=1 \
-        $bazelFlags \
-        $bazelFetchFlags \
-        ${bazelTarget} \
-        ${lib.strings.concatStringsSep " " bazelTestTargets}
+      ${
+        bazelCmd {
+          cmd = if fetchConfigured then "build --nobuild" else "fetch";
+          additionalFlags = [
+            # We disable multithreading for the fetching phase since it can lead to timeouts with many dependencies/threads:
+            # https://github.com/bazelbuild/bazel/issues/6502
+            "--loading_phase_threads=1"
+            "$bazelFetchFlags"
+          ];
+          targets = bazelTargets ++ bazelTestTargets;
+        }
+      }

      runHook postBuild
    '';
@ -232,7 +229,7 @@ stdenv.mkDerivation (fBuildAttrs // {
      bazelCmd {
        cmd = "build";
        additionalFlags = bazelBuildFlags;
-        targets = [bazelTarget];
+        targets = bazelTargets;
      }
    }
    runHook postBuild
--- a/pkgs/build-support/docker/nix-prefetch-docker
+++ b/pkgs/build-support/docker/nix-prefetch-docker
@ -38,7 +38,7 @@ get_image_digest(){
        imageTag="latest"
    fi

-    skopeo --insecure-policy --tmpdir=$TMPDIR inspect "docker://$imageName:$imageTag" | jq '.Digest' -r
+    skopeo --override-os "${os}" --override-arch "${arch}" --insecure-policy --tmpdir=$TMPDIR inspect "docker://$imageName:$imageTag" | jq '.Digest' -r
 }

 get_name() {
--- a/pkgs/data/fonts/linja-sike/default.nix
+++ b/pkgs/data/fonts/linja-sike/default.nix
@ -0,0 +1,25 @@
+{ lib, fetchurl }:
+
+fetchurl {
+  pname = "linja-sike";
+  version = "5.0";
+
+  url = "https://wyub.github.io/tokipona/linja-sike-5.otf";
+
+  downloadToTemp = true;
+  recursiveHash = true;
+  postFetch = ''
+    install -D $downloadedFile $out/share/fonts/opentype/linja-sike.otf
+  '';
+
+  sha256 = "sha256-LkjG1Oao/LqKwI+eRZPzShTh7lz5DkooltXm7vxZC9w=";
+
+  meta = with lib; {
+    description = "An extensive sitelen pona font by lipamanka";
+    homepage = "https://docs.google.com/document/d/1d8kUIAVlB-JNgK3LWr_zVCuUOZTh2hF7CfC6xQgxsBs/edit?usp=sharing";
+    downloadPage = "https://wyub.github.io/tokipona/linjasike";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ somasis ];
+  };
+}
--- a/pkgs/data/fonts/smiley-sans/default.nix
+++ b/pkgs/data/fonts/smiley-sans/default.nix
@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
    homepage = "https://atelier-anchor.com/typefaces/smiley-sans/";
    changelog = "https://github.com/atelier-anchor/smiley-sans/blob/main/CHANGELOG.md";
    license = licenses.ofl;
-    maintainers = with maintainers; [ candyc1oud ];
+    maintainers = [];
    platforms = platforms.all;
  };
 }
--- a/pkgs/data/misc/clash-geoip/default.nix
+++ b/pkgs/data/misc/clash-geoip/default.nix
@ -26,6 +26,6 @@ stdenvNoCC.mkDerivation rec {
    description = "A GeoLite2 data created by MaxMind";
    homepage = "https://github.com/Dreamacro/maxmind-geoip";
    license = licenses.unfree;
-    maintainers = with maintainers; [ candyc1oud ];
+    maintainers = [];
  };
 }
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@ -18,6 +18,7 @@ let
    dtkcore = callPackage ./library/dtkcore { };
    dtkgui = callPackage ./library/dtkgui { };
    dtkwidget = callPackage ./library/dtkwidget { };
+    deepin-pdfium = callPackage ./library/deepin-pdfium { };
    qt5platform-plugins = callPackage ./library/qt5platform-plugins { };
    qt5integration = callPackage ./library/qt5integration { };
    deepin-wayland-protocols = callPackage ./library/deepin-wayland-protocols { };
@ -28,6 +29,7 @@ let
    gio-qt = callPackage ./library/gio-qt { };
    image-editor = callPackage ./library/image-editor { };
    udisks2-qt5 = callPackage ./library/udisks2-qt5 { };
+    util-dfm = callPackage ./library/util-dfm { };

    #### CORE
    dde-control-center = callPackage ./core/dde-control-center { };
--- a/pkgs/desktops/deepin/library/deepin-pdfium/default.nix
+++ b/pkgs/desktops/deepin/library/deepin-pdfium/default.nix
@ -0,0 +1,42 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, qmake
+, pkg-config
+, libchardet
+, lcms2
+, openjpeg
+}:
+
+stdenv.mkDerivation rec {
+  pname = "deepin-pdfium";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-gUIQ+fZ7VaYaIj1hbzER10ceoJZbvhJlnDTFIShMrKw=";
+  };
+
+  nativeBuildInputs = [
+    qmake
+    pkg-config
+  ];
+
+  dontWrapQtApps = true;
+
+  buildInputs = [
+    libchardet
+    lcms2
+    openjpeg
+  ];
+
+  meta = with lib; {
+    description = "development library for pdf on deepin";
+    homepage = "https://github.com/linuxdeepin/deepin-pdfium";
+    license = licenses.lgpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
--- a/pkgs/desktops/deepin/library/util-dfm/default.nix
+++ b/pkgs/desktops/deepin/library/util-dfm/default.nix
@ -0,0 +1,62 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, pkg-config
+, qtbase
+, libmediainfo
+, libsecret
+, libisoburn
+, libuuid
+, udisks
+}:
+
+stdenv.mkDerivation rec {
+  pname = "util-dfm";
+  version = "1.2.7";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-+qqirRkvVyKvt+Pu/ghQjMe+O6a7/7IoJL8AWL4QlvE=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "fix: use pkgconfig to check mount";
+      url = "https://github.com/linuxdeepin/util-dfm/commit/fb8425a8c13f16e86db38ff84f43347fdc8ea468.diff";
+      sha256 = "sha256-PGSRfnQ1MGmq0V3NBCoMk4p/T2x19VA04u9C+WcBKow=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  dontWrapQtApps = true;
+
+  buildInputs = [
+    qtbase
+    libmediainfo
+    libsecret
+    libuuid
+    libisoburn
+    udisks
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DPROJECT_VERSION=${version}"
+  ];
+
+  meta = with lib; {
+    description = "A Toolkits of libdfm-io,libdfm-mount and libdfm-burn";
+    homepage = "https://github.com/linuxdeepin/util-dfm";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
--- a/pkgs/desktops/gnome/core/eog/default.nix
+++ b/pkgs/desktops/gnome/core/eog/default.nix
@ -119,7 +119,5 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2Plus;
    maintainers = teams.gnome.members;
    platforms = platforms.unix;
-    # requires <gio/gdesktopappinfo.h>
-    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/development/compilers/abcl/default.nix
+++ b/pkgs/development/compilers/abcl/default.nix
@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "A JVM-based Common Lisp implementation";
    license = lib.licenses.gpl3 ;
-    maintainers = [lib.maintainers.raskin];
+    maintainers = lib.teams.lisp.members;
    platforms = lib.platforms.linux;
    homepage = "https://common-lisp.net/project/armedbear/";
  };
--- a/pkgs/development/compilers/ccl/default.nix
+++ b/pkgs/development/compilers/ccl/default.nix
@ -119,7 +119,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Clozure Common Lisp";
    homepage    = "https://ccl.clozure.com/";
-    maintainers = with maintainers; [ raskin ];
+    maintainers = lib.teams.lisp.members;
    platforms   = attrNames options;
    # assembler failures during build, x86_64-darwin broken since 2020-10-14
    broken      = (stdenv.isDarwin && stdenv.isx86_64);
--- a/pkgs/development/compilers/chicken/5/chicken.nix
+++ b/pkgs/development/compilers/chicken/5/chicken.nix
@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
  meta = {
    homepage = "https://call-cc.org/";
    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ corngood ];
+    maintainers = with lib.maintainers; [ corngood nagy konst-aa ];
    platforms = lib.platforms.unix;
    description = "A portable compiler for the Scheme programming language";
    longDescription = ''
--- a/pkgs/development/compilers/chicken/5/default.nix
+++ b/pkgs/development/compilers/chicken/5/default.nix
@ -1,11 +1,16 @@
-{ lib, newScope } :
+{ lib, newScope, fetchurl }:
 let
  callPackage = newScope self;

-  self = {
+  self = with lib; {
    pkgs = self;

-    fetchegg = callPackage ./fetchegg { };
+    fetchegg = { pname, version, sha256, ... }:
+      fetchurl {
+        inherit sha256;
+        url =
+          "https://code.call-cc.org/egg-tarballs/5/${pname}/${pname}-${version}.tar.gz";
+      };

    eggDerivation = callPackage ./eggDerivation.nix { };

@ -13,7 +18,21 @@ let
      bootstrap-chicken = self.chicken.override { bootstrap-chicken = null; };
    };

-    chickenEggs = lib.recurseIntoAttrs (callPackage ./eggs.nix { });
+    chickenEggs = recurseIntoAttrs (mapAttrs (pname:
+      eggData@{ version, synopsis, dependencies, license, ... }:
+      self.eggDerivation {
+        name = "${pname}-${version}";
+        src = self.fetchegg (eggData // { inherit pname; });
+        buildInputs = map (x: self.chickenEggs.${x}) dependencies;
+        meta.homepage =
+          "https://code.call-cc.org/cgi-bin/gitweb.cgi?p=eggs-5-latest.git;a=tree;f=${pname}/${version}";
+        meta.description = synopsis;
+        meta.license = (licenses // {
+          "bsd-2-clause" = licenses.bsd2;
+          "bsd-3-clause" = licenses.bsd3;
+          "public-domain" = licenses.publicDomain;
+        }).${license} or license;
+      }) (importTOML ./deps.toml));

    egg2nix = callPackage ./egg2nix.nix { };
  };
--- a/pkgs/development/compilers/chicken/5/deps.toml
+++ b/pkgs/development/compilers/chicken/5/deps.toml
--- a/pkgs/development/compilers/chicken/5/eggs.nix
+++ b/pkgs/development/compilers/chicken/5/eggs.nix
@ -1,551 +0,0 @@
-{ pkgs, stdenv }:
-rec {
-  inherit (pkgs) eggDerivation fetchegg;
-
-  address-info = eggDerivation {
-    name = "address-info-1.0.5";
-
-    src = fetchegg {
-      name = "address-info";
-      version = "1.0.5";
-      sha256 = "1nv87ghfv8szmi2l0rybrgrds6fs5w6jxafqslnzw0mw5sfj6jyk";
-    };
-
-    buildInputs = [
-      srfi-1
-    ];
-  };
-
-  apropos = eggDerivation {
-    name = "apropos-3.6.0";
-
-    src = fetchegg {
-      name = "apropos";
-      version = "3.6.0";
-      sha256 = "0jq5d4zijbf5dw2vsfn89smp7zjpgp82y5hs10xkysf831x7l551";
-    };
-
-    buildInputs = [
-      srfi-1
-      srfi-13
-      check-errors
-      string-utils
-      symbol-utils
-    ];
-  };
-
-  args = eggDerivation {
-    name = "args-1.6.0";
-
-    src = fetchegg {
-      name = "args";
-      version = "1.6.0";
-      sha256 = "1y9sznh4kxqxvhd8k44bjx0s7xspp52sx4bn8i8i0f8lwch6r2g4";
-    };
-
-    buildInputs = [
-      srfi-1
-      srfi-13
-      srfi-37
-    ];
-  };
-
-  base64 = eggDerivation {
-    name = "base64-1.0";
-
-    src = fetchegg {
-      name = "base64";
-      version = "1.0";
-      sha256 = "01lid9wxf94nr7gmskamxlfngack1hyxig8rl9swwgnbmz9qgysi";
-    };
-
-    buildInputs = [
-      srfi-13
-    ];
-  };
-
-  check-errors = eggDerivation {
-    name = "check-errors-3.2.0";
-
-    src = fetchegg {
-      name = "check-errors";
-      version = "3.2.0";
-      sha256 = "0d0hpq1nmwyvbg162bqzgk62f70rin0pxsr5a3pgx6xin5i3ngah";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  defstruct = eggDerivation {
-    name = "defstruct-2.0";
-
-    src = fetchegg {
-      name = "defstruct";
-      version = "2.0";
-      sha256 = "0q1v1gdwqlpmwcsa4jnqldfqky9k7kvb83qgkhdyqym52bm5aln8";
-    };
-
-    buildInputs = [
-      srfi-1
-    ];
-  };
-
-  feature-test = eggDerivation {
-    name = "feature-test-0.2.0";
-
-    src = fetchegg {
-      name = "feature-test";
-      version = "0.2.0";
-      sha256 = "1dxdisv64d8alg6r45cwxf5gmdpcvql1hvlq808lgwphd7kvfpgr";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  foreigners = eggDerivation {
-    name = "foreigners-1.5";
-
-    src = fetchegg {
-      name = "foreigners";
-      version = "1.5";
-      sha256 = "1mm91y61nlawgb7iqdrkz2fi9sc3fic07f5m1ig541b2hbscfiqy";
-    };
-
-    buildInputs = [
-      matchable
-    ];
-  };
-
-  intarweb = eggDerivation {
-    name = "intarweb-2.0.1";
-
-    src = fetchegg {
-      name = "intarweb";
-      version = "2.0.1";
-      sha256 = "0md226jikqhj993cw17588ipmnz0v7l34zrvylamyrs6zbvj3scm";
-    };
-
-    buildInputs = [
-      srfi-1
-      srfi-13
-      srfi-14
-      defstruct
-      uri-common
-      base64
-    ];
-  };
-
-  iset = eggDerivation {
-    name = "iset-2.2";
-
-    src = fetchegg {
-      name = "iset";
-      version = "2.2";
-      sha256 = "0yfkcd07cw6xnnqfbbvjy81x0vc54k40vdjp2m7gwxx64is6m3rz";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  json = eggDerivation {
-    name = "json-1.6";
-
-    src = fetchegg {
-      name = "json";
-      version = "1.6";
-      sha256 = "0sb8285dqrm27c8zaqfzc0gixvfmvf0cq2nbza8c4z7j5snxzs2w";
-    };
-
-    buildInputs = [
-      packrat
-      srfi-1
-      srfi-69
-    ];
-  };
-
-  matchable = eggDerivation {
-    name = "matchable-1.1";
-
-    src = fetchegg {
-      name = "matchable";
-      version = "1.1";
-      sha256 = "084hm5dvbvgnpb32ispkp3hjili8z02hamln860r99jx68jx6j2v";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  r7rs = eggDerivation {
-    name = "r7rs-1.0.5";
-
-    src = fetchegg {
-      name = "r7rs";
-      version = "1.0.5";
-      sha256 = "0zyi1z4m1995hm2wfc5wpi8jjgxcwk03qknq5v2ygff3akxazsf6";
-    };
-
-    buildInputs = [
-      matchable
-      srfi-1
-      srfi-13
-    ];
-  };
-
-  memory-mapped-files = eggDerivation {
-    name = "memory-mapped-files-0.4";
-
-    src = fetchegg {
-      name = "memory-mapped-files";
-      version = "0.4";
-      sha256 = "0by3r18bj9fs0bs9w5czx84vssmr58br3x7pz1m3myb4mns3mpsc";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  message-digest-primitive = eggDerivation {
-    name = "message-digest-primitive-4.3.2";
-
-    src = fetchegg {
-      name = "message-digest-primitive";
-      version = "4.3.2";
-      sha256 = "1wfmyyp1fv0sz70m0rgzbhkiqgzjc15ppz7fwmpnxg12rvfzdvq0";
-    };
-
-    buildInputs = [
-      check-errors
-    ];
-  };
-
-  miscmacros = eggDerivation {
-    name = "miscmacros-1.0";
-
-    src = fetchegg {
-      name = "miscmacros";
-      version = "1.0";
-      sha256 = "0n2ia4ib4f18hcbkm5byph07ncyx61pcpfp2qr5zijf8ykp8nbvr";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  packrat = eggDerivation {
-    name = "packrat-1.5";
-
-    src = fetchegg {
-      name = "packrat";
-      version = "1.5";
-      sha256 = "0hfnh57a8yga3byrk8522al5wdj7dyz48lixvvcgnsn3vdy333hq";
-    };
-
-    buildInputs = [
-      srfi-1
-    ];
-  };
-
-  regex = eggDerivation {
-    name = "regex-2.0";
-
-    src = fetchegg {
-      name = "regex";
-      version = "2.0";
-      sha256 = "0qgqrrdr95yqggw8xyvb693nhizwqvf1fp9cjx9p3z80c4ih8j4j";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  sendfile = eggDerivation {
-    name = "sendfile-1.8.3";
-
-    src = fetchegg {
-      name = "sendfile";
-      version = "1.8.3";
-      sha256 = "0acmydjxlrbq7bdspmrzv9q9l3gh4xxnbpi5g1d5mz1g2mjwgm63";
-    };
-
-    buildInputs = [
-      memory-mapped-files
-    ];
-  };
-
-  sha2 = eggDerivation {
-    name = "sha2-4.0.5";
-
-    src = fetchegg {
-      name = "sha2";
-      version = "4.0.5";
-      sha256 = "020yc41gkpg2s48v5n1nnq02dii340yly2y1zsi71bbfbkai2vcs";
-    };
-
-    buildInputs = [
-      message-digest-primitive
-    ];
-  };
-
-  socket = eggDerivation {
-    name = "socket-0.3.3";
-
-    src = fetchegg {
-      name = "socket";
-      version = "0.3.3";
-      sha256 = "04wfxrwjizvf1jdpfqp3r7381rp9lscrm3z21ihq2dc2lfzjgrxw";
-    };
-
-    buildInputs = [
-      srfi-13
-      srfi-18
-      foreigners
-      feature-test
-    ];
-  };
-
-  spiffy = eggDerivation {
-    name = "spiffy-6.3";
-
-    src = fetchegg {
-      name = "spiffy";
-      version = "6.3";
-      sha256 = "0f22gfdyysgbm3q6cjibn1z1yavks3imxi1mxcyfmms3x91k5k3c";
-    };
-
-    buildInputs = [
-      intarweb
-      uri-common
-      uri-generic
-      sendfile
-      srfi-1
-      srfi-13
-      srfi-14
-      srfi-18
-    ];
-  };
-
-  srfi-1 = eggDerivation {
-    name = "srfi-1-0.5.1";
-
-    src = fetchegg {
-      name = "srfi-1";
-      version = "0.5.1";
-      sha256 = "15x0ajdkw5gb3vgs8flzh5g0pzl3wmcpf11iimlm67mw6fxc8p7j";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  srfi-13 = eggDerivation {
-    name = "srfi-13-0.3.1";
-
-    src = fetchegg {
-      name = "srfi-13";
-      version = "0.3.1";
-      sha256 = "12ryxs3w3las0wjdh0yp52g1xmyq1fb48xi3i26l5a9sfx7gbilp";
-    };
-
-    buildInputs = [
-      srfi-14
-    ];
-  };
-
-  srfi-14 = eggDerivation {
-    name = "srfi-14-0.2.1";
-
-    src = fetchegg {
-      name = "srfi-14";
-      version = "0.2.1";
-      sha256 = "0gc33cx4xll9vsf7fm8jvn3gc0604kn3bbi6jfn6xscqp86kqb9p";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  srfi-145 = eggDerivation {
-    name = "srfi-145-0.1";
-
-    src = fetchegg {
-      name = "srfi-145";
-      version = "0.1";
-      sha256 = "1r4278xhpmm8gww64j6akpyv3qjnn14b6nsisyb9qm7yx3pkpim9";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  srfi-189 = eggDerivation {
-    name = "srfi-189-0.1";
-
-    src = fetchegg {
-      name = "srfi-189";
-      version = "0.1";
-      sha256 = "1nmrywpi9adi5mm1vcbxxsgw0j3v6m7s4j1mii7icj83xn81cgvx";
-    };
-
-    buildInputs = [
-      r7rs
-      srfi-1
-      srfi-145
-    ];
-  };
-
-  srfi-18 = eggDerivation {
-    name = "srfi-18-0.1.6";
-
-    src = fetchegg {
-      name = "srfi-18";
-      version = "0.1.6";
-      sha256 = "00lykm5lqbrcxl3dab9dqwimpgm36v4ys2957k3vdlg4xdb1abfa";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  srfi-37 = eggDerivation {
-    name = "srfi-37-1.4";
-
-    src = fetchegg {
-      name = "srfi-37";
-      version = "1.4";
-      sha256 = "17f593497n70gldkj6iab6ilgryiqar051v6azn1szhnm1lk7dwd";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  srfi-69 = eggDerivation {
-    name = "srfi-69-0.4.1";
-
-    src = fetchegg {
-      name = "srfi-69";
-      version = "0.4.1";
-      sha256 = "1l102kppncz27acsr4jyi46q0r7g2lb6gdbkd6p3h1xmvwcnk2hl";
-    };
-
-    buildInputs = [
-      
-    ];
-  };
-
-  string-utils = eggDerivation {
-    name = "string-utils-2.4.0";
-
-    src = fetchegg {
-      name = "string-utils";
-      version = "2.4.0";
-      sha256 = "09m3s0p199r2nmvc8qnqvbxjbq967gvwqrzp236wsw3hdcil6p8v";
-    };
-
-    buildInputs = [
-      srfi-1
-      srfi-13
-      srfi-69
-      miscmacros
-      check-errors
-      utf8
-    ];
-  };
-
-  symbol-utils = eggDerivation {
-    name = "symbol-utils-2.1.0";
-
-    src = fetchegg {
-      name = "symbol-utils";
-      version = "2.1.0";
-      sha256 = "17nq8bj18f3bbf3mdfx1m8agy97izn1xcl8ymvgvvd5g384b2xil";
-    };
-
-    buildInputs = [
-      check-errors
-    ];
-  };
-
-  tcp6 = eggDerivation {
-    name = "tcp6-0.2.1";
-
-    src = fetchegg {
-      name = "tcp6";
-      version = "0.2.1";
-      sha256 = "14dynnjgac28f46v781hi6kam326q6rh57pf0pvl0chdva4hlf3q";
-    };
-
-    buildInputs = [
-      socket
-      srfi-1
-    ];
-  };
-
-  uri-common = eggDerivation {
-    name = "uri-common-2.0";
-
-    src = fetchegg {
-      name = "uri-common";
-      version = "2.0";
-      sha256 = "07rq7ppkyk3i85vqspc048pnj6gmjhj236z00chslli9xybqkgrd";
-    };
-
-    buildInputs = [
-      uri-generic
-      defstruct
-      matchable
-      srfi-1
-      srfi-13
-      srfi-14
-    ];
-  };
-
-  uri-generic = eggDerivation {
-    name = "uri-generic-3.2";
-
-    src = fetchegg {
-      name = "uri-generic";
-      version = "3.2";
-      sha256 = "1lpvnk1mnhmrga149km7ygpy7fkq7z2pvw0mvpx2aql03l8gpdsj";
-    };
-
-    buildInputs = [
-      matchable
-      srfi-1
-      srfi-14
-    ];
-  };
-
-  utf8 = eggDerivation {
-    name = "utf8-3.6.2";
-
-    src = fetchegg {
-      name = "utf8";
-      version = "3.6.2";
-      sha256 = "10wzp3qmwik4gx3hhaqm2n83wza0rllgy57363h5ccv8fga5nnm6";
-    };
-
-    buildInputs = [
-      srfi-69
-      iset
-      regex
-    ];
-  };
-}
-
--- a/pkgs/development/compilers/chicken/5/eggs.scm
+++ b/pkgs/development/compilers/chicken/5/eggs.scm
@ -1,11 +0,0 @@
-;; Eggs used by egg2nix
-args
-matchable
-apropos
-spiffy
-json
-tcp6
-sha2
-
-;; other eggs to include in nixpkgs
-srfi-189
--- a/pkgs/development/compilers/chicken/5/fetchegg/builder.sh
+++ b/pkgs/development/compilers/chicken/5/fetchegg/builder.sh
@ -1,9 +0,0 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
-source $stdenv/setup
-
-echo "exporting egg ${eggName} (version $version) into $out"
-
-mkdir -p $out
-CHICKEN_EGG_CACHE=. chicken-install -r "${eggName}:${version}"
-rm ${eggName}/{STATUS,TIMESTAMP}
-cp -r ${eggName}/* $out/
--- a/pkgs/development/compilers/chicken/5/fetchegg/default.nix
+++ b/pkgs/development/compilers/chicken/5/fetchegg/default.nix
@ -1,25 +0,0 @@
-# Fetches a chicken egg from henrietta using `chicken-install -r'
-# See: http://wiki.call-cc.org/chicken-projects/egg-index-5.html
-
-{ lib, stdenvNoCC, chicken }:
-{ name, version, md5 ? "", sha256 ? "" }:
-
-if md5 != "" then
-  throw "fetchegg does not support md5 anymore, please use sha256"
-else
-stdenvNoCC.mkDerivation {
-  name = "chicken-${name}-export";
-  builder = ./builder.sh;
-  nativeBuildInputs = [ chicken ];
-
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = sha256;
-
-  inherit version;
-
-  eggName = name;
-
-  impureEnvVars = lib.fetchers.proxyImpureEnvVars;
-}
-
--- a/pkgs/development/compilers/chicken/5/read-egg.scm
+++ b/pkgs/development/compilers/chicken/5/read-egg.scm
@ -0,0 +1,40 @@
+(import (chicken process-context)
+        (chicken format)
+        (chicken string))
+
+(define env-var get-environment-variable)
+(define ref alist-ref)
+
+(define egg (read))
+
+(printf "[~A]\n" (env-var "EGG_NAME"))
+
+(define dependencies
+  (map (lambda (dep)
+         (->string (if (list? dep)
+                       (car dep)
+                       dep)))
+       (ref 'dependencies egg eqv? '())))
+(printf "dependencies = [~A]\n"
+        (string-intersperse (map (lambda (dep) (sprintf "~S" dep))
+                                 dependencies)
+                            ", "))
+
+(define license (ref 'license egg))
+(printf "license = ~S\n"
+        (if (not license)
+            ""
+            (string-translate (->string (car license))
+                              "ABCDEFGHIJKLMNOPQRSTUVWXYZ "
+                              "abcdefghijklmnopqrstuvwxyz-")))
+
+(printf "sha256 = ~S\n" (env-var "EGG_SHA256"))
+
+(define synopsis (ref 'synopsis egg))
+(printf "synopsis = ~S\n"
+        (if (not synopsis)
+            ""
+            (car synopsis)))
+
+(printf "version = ~S\n" (env-var "EGG_VERSION"))
+(print)
--- a/pkgs/development/compilers/chicken/5/update.sh
+++ b/pkgs/development/compilers/chicken/5/update.sh
@ -0,0 +1,19 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i oil -p oil chicken
+
+export URL_PREFIX="https://code.call-cc.org/egg-tarballs/5/"
+cd $(nix-prefetch-url \
+     'https://code.call-cc.org/cgi-bin/gitweb.cgi?p=eggs-5-latest.git;a=snapshot;h=master;sf=tgz' \
+     --name chicken-eggs-5-latest --unpack --print-path | tail -1)
+
+echo "# THIS IS A GENERATED FILE.  DO NOT EDIT!" > $_this_dir/deps.toml
+for i, item in */*/*.egg {
+  var EGG_NAME=$(dirname $(dirname $item))
+  var EGG_VERSION=$(basename $(dirname $item))
+  var EGG_URL="${URL_PREFIX}${EGG_NAME}/${EGG_NAME}-${EGG_VERSION}.tar.gz"
+  var EGG_SHA256=$(nix-prefetch-url $EGG_URL)
+  export EGG_NAME
+  export EGG_VERSION
+  export EGG_SHA256
+  csi -s $_this_dir/read-egg.scm < $item
+} >> $_this_dir/deps.toml
--- a/pkgs/development/compilers/clasp/default.nix
+++ b/pkgs/development/compilers/clasp/default.nix
@ -89,8 +89,11 @@ in llvmPackages_15.stdenv.mkDerivation {
  meta = {
    description = "A Common Lisp implementation based on LLVM with C++ integration";
    license = lib.licenses.lgpl21Plus ;
-    maintainers = [lib.maintainers.raskin lib.maintainers.uthar];
-    platforms = lib.platforms.linux;
+    maintainers = lib.teams.lisp.members;
+    platforms = ["x86_64-linux" "x86_64-darwin"];
+    # Upstream claims support, but breaks with:
+    # error: use of undeclared identifier 'aligned_alloc'
+    broken = llvmPackages_15.stdenv.isDarwin;
    homepage = "https://github.com/clasp-developers/clasp";
  };

--- a/pkgs/development/compilers/cmucl/binary.nix
+++ b/pkgs/development/compilers/cmucl/binary.nix
@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
      ANSI Common Lisp standard.
    '';
    license = licenses.publicDomain;
-    maintainers = [ ];
+    maintainers = lib.teams.lisp.members;
    platforms = [ "i686-linux" "x86_64-linux" ];
  };
 })
--- a/pkgs/development/compilers/ecl/16.1.2.nix
+++ b/pkgs/development/compilers/ecl/16.1.2.nix
@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Lisp implementation aiming to be small, fast and easy to embed";
    license = licenses.mit;
-    maintainers = with maintainers; [ raskin ];
+    maintainers = lib.teams.lisp.members;
    platforms = platforms.unix;
    # never built on aarch64-darwin since first introduction in nixpkgs
    broken = stdenv.isDarwin && stdenv.isAarch64;
--- a/pkgs/development/compilers/ecl/default.nix
+++ b/pkgs/development/compilers/ecl/default.nix
@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
    description = "Lisp implementation aiming to be small, fast and easy to embed";
    homepage = "https://common-lisp.net/project/ecl/";
    license = licenses.mit;
-    maintainers = with maintainers; [ raskin ];
+    maintainers = lib.teams.lisp.members;
    platforms = platforms.unix;
    changelog = "https://gitlab.com/embeddable-common-lisp/ecl/-/raw/${version}/CHANGELOG";
  };
--- a/pkgs/development/compilers/gbforth/default.nix
+++ b/pkgs/development/compilers/gbforth/default.nix
@ -0,0 +1,54 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, gforth
+}:
+
+stdenv.mkDerivation {
+  pname = "gbforth";
+  version = "unstable-2023-03-02";
+
+  src = fetchFromGitHub {
+    owner = "ams-hackers";
+    repo = "gbforth";
+    rev = "428fcf5054fe301e90ac74b1d920ee3ecc375b5b";
+    hash = "sha256-v1bdwT15Wg1VKpo74Cc3tsTl1uOKvKdlHWtbZkJ/qbA=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/gbforth $out/bin
+    cp -r lib shared src gbforth.fs $out/share/gbforth/
+    makeWrapper ${gforth}/bin/gforth $out/bin/gbforth \
+      --set GBFORTH_PATH $out/share/gbforth/lib \
+      --add-flags $out/share/gbforth/gbforth.fs
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/gbforth examples/simon/simon.fs
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://gbforth.org/";
+    description = "A Forth-based Game Boy development kit";
+    longDescription = ''
+      A Forth-based Game Boy development kit.
+      It features a Forth-based assembler, a cross-compiler with support for
+      lazy code generation and a library of useful words.
+    '';
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ fgaz ];
+  };
+}
--- a/pkgs/development/compilers/gcc-arm-embedded/10/default.nix
+++ b/pkgs/development/compilers/gcc-arm-embedded/10/default.nix
@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
    homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
    license = with licenses; [ bsd2 gpl2 gpl3 lgpl21 lgpl3 mit ];
-    maintainers = with maintainers; [ prusnak ];
+    maintainers = with maintainers; [ prusnak prtzl ];
    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
  };
--- a/pkgs/development/compilers/gcc-arm-embedded/11/default.nix
+++ b/pkgs/development/compilers/gcc-arm-embedded/11/default.nix
@ -3,6 +3,8 @@
 , fetchurl
 , ncurses5
 , python38
+, libxcrypt-legacy
+, runtimeShell
 }:

 stdenv.mkDerivation rec {
@ -38,10 +40,21 @@ stdenv.mkDerivation rec {
    find $out -type f | while read f; do
      patchelf "$f" > /dev/null 2>&1 || continue
      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
-      patchelf --set-rpath ${lib.makeLibraryPath [ "$out" stdenv.cc.cc ncurses5 python38 ]} "$f" || true
+      patchelf --set-rpath ${lib.makeLibraryPath [ "$out" stdenv.cc.cc ncurses5 python38 libxcrypt-legacy ]} "$f" || true
    done
  '';

+  postFixup = ''
+    mv $out/bin/arm-none-eabi-gdb $out/bin/arm-none-eabi-gdb-unwrapped
+    cat <<EOF > $out/bin/arm-none-eabi-gdb
+    #!${runtimeShell}
+    export PYTHONPATH=${python38}/lib/python3.8
+    export PYTHONHOME=${python38}/bin/python3.8
+    $out/bin/arm-none-eabi-gdb-unwrapped
+    EOF
+    chmod +x $out/bin/arm-none-eabi-gdb
+  '';
+
  meta = with lib; {
    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
    homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
--- a/pkgs/development/compilers/gcc-arm-embedded/12/default.nix
+++ b/pkgs/development/compilers/gcc-arm-embedded/12/default.nix
@ -3,6 +3,8 @@
 , fetchurl
 , ncurses5
 , python38
+, libxcrypt-legacy
+, runtimeShell
 }:

 stdenv.mkDerivation rec {
@ -40,15 +42,26 @@ stdenv.mkDerivation rec {
    find $out -type f | while read f; do
      patchelf "$f" > /dev/null 2>&1 || continue
      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
-      patchelf --set-rpath ${lib.makeLibraryPath [ "$out" stdenv.cc.cc ncurses5 python38 ]} "$f" || true
+      patchelf --set-rpath ${lib.makeLibraryPath [ "$out" stdenv.cc.cc ncurses5 python38 libxcrypt-legacy ]} "$f" || true
    done
  '';

+  postFixup = ''
+    mv $out/bin/arm-none-eabi-gdb $out/bin/arm-none-eabi-gdb-unwrapped
+    cat <<EOF > $out/bin/arm-none-eabi-gdb
+    #!${runtimeShell}
+    export PYTHONPATH=${python38}/lib/python3.8
+    export PYTHONHOME=${python38}/bin/python3.8
+    $out/bin/arm-none-eabi-gdb-unwrapped
+    EOF
+    chmod +x $out/bin/arm-none-eabi-gdb
+  '';
+
  meta = with lib; {
    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
    homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
    license = with licenses; [ bsd2 gpl2 gpl3 lgpl21 lgpl3 mit ];
-    maintainers = with maintainers; [ prusnak ];
+    maintainers = with maintainers; [ prusnak prtzl ];
    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
  };
--- a/pkgs/development/compilers/gcl/2.6.13-pre.nix
+++ b/pkgs/development/compilers/gcl/2.6.13-pre.nix
@ -43,7 +43,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "GNU Common Lisp compiler working via GCC";
-    maintainers = [ lib.maintainers.raskin ];
+    maintainers = lib.teams.lisp.members;
    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/development/compilers/gcl/default.nix
+++ b/pkgs/development/compilers/gcl/default.nix
@ -47,7 +47,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "GNU Common Lisp compiler working via GCC";
-    maintainers = [ maintainers.raskin ];
+    maintainers = lib.teams.lisp.members;
    license = licenses.gpl2;
    platforms = platforms.linux;
  };
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@ -47,11 +47,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.19.7";
+  version = "1.19.8";

  src = fetchurl {
    url = "https://go.dev/dl/go${version}.src.tar.gz";
-    hash = "sha256-d1vfKFzqupQNqKL+IBIlAO/XoLZdvO6FJHhUqNdAJjM=";
+    hash = "sha256-HXpnkp3Mr+r4op5VmFvCt4ngSZyxoXEAA58ITjI42i8=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@ -270,6 +270,7 @@ in stdenv.mkDerivation (rec {
    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
    "-DLLVM_ENABLE_PIC=OFF"
    "-DLLVM_BUILD_STATIC=ON"
+    "-DLLVM_LINK_LLVM_DYLIB=off"
    # libxml2 needs to be disabled because the LLVM build system ignores its .la
    # file and doesn't link zlib as well.
    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
--- a/pkgs/development/compilers/mkcl/default.nix
+++ b/pkgs/development/compilers/mkcl/default.nix
@ -60,6 +60,6 @@ stdenv.mkDerivation rec {
    homepage = "https://common-lisp.net/project/mkcl/";
    license = licenses.lgpl2Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = lib.teams.lisp.members;
  };
 }
--- a/pkgs/development/compilers/rml/default.nix
+++ b/pkgs/development/compilers/rml/default.nix
@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
    hash = "sha256-UFqXQBeIQMSV4O439j9s06p1hh7xA98Tu79FsjK9PIY=";
  };

+  strictDeps = true;
+
  nativeBuildInputs = with ocamlPackages; [
    ocaml
  ];
@ -23,9 +25,7 @@ stdenv.mkDerivation rec {
    num
  ];

-  configureFlags = [ "--prefix" "${placeholder "out"}" ];
-
-  dontAddPrefix = true;
+  prefixKey = "-prefix ";

  meta = with lib; {
    description = "ReactiveML: a programming language for implementing interactive systems";
--- a/pkgs/development/compilers/sbcl/bootstrap.nix
+++ b/pkgs/development/compilers/sbcl/bootstrap.nix
@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
    description = "Lisp compiler";
    homepage = "http://www.sbcl.org";
    license = licenses.publicDomain; # and FreeBSD
-    maintainers = [ maintainers.raskin ];
+    maintainers = lib.teams.lisp.members;
    platforms = attrNames options;
  };
 }
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "ANSI Common Lisp Implementation";
    homepage = "http://clisp.cons.org";
-    maintainers = with lib.maintainers; [ raskin ];
+    maintainers = lib.teams.lisp.members;
    platforms = lib.platforms.unix;
    # problems on Darwin: https://github.com/NixOS/nixpkgs/issues/20062
    broken = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAarch64;
--- a/pkgs/development/interpreters/clisp/hg.nix
+++ b/pkgs/development/interpreters/clisp/hg.nix
@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "ANSI Common Lisp Implementation";
    homepage = "http://clisp.cons.org";
-    maintainers = with lib.maintainers; [ raskin ];
+    maintainers = lib.teams.lisp.members;
    # problems on Darwin: https://github.com/NixOS/nixpkgs/issues/20062
    platforms = lib.platforms.linux;
  };
--- a/pkgs/development/libraries/cista/default.nix
+++ b/pkgs/development/libraries/cista/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
    homepage = "https://cista.rocks";
    description = "A simple, high-performance, zero-copy C++ serialization & reflection library";
    license = licenses.mit;
-    maintainers = with maintainers; [ candyc1oud ];
+    maintainers = [];
    platforms = platforms.all;
  };
 }
--- a/pkgs/development/libraries/coost/default.nix
+++ b/pkgs/development/libraries/coost/default.nix
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    description = "A tiny boost library in C++11";
    homepage = "https://github.com/idealvin/coost";
    license = licenses.mit;
-    maintainers = with maintainers; [ candyc1oud ];
+    maintainers = [];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/faudio/default.nix
+++ b/pkgs/development/libraries/faudio/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "faudio";
-  version = "23.03";
+  version = "23.04";

  src = fetchFromGitHub {
    owner = "FNA-XNA";
    repo = "FAudio";
    rev = version;
-    sha256 = "sha256-sQbltmHmScSn5E1tE32uU16JQasjOnLW5N2m6+LC9CI=";
+    sha256 = "sha256-XajCJ8wmKzvLxPaA/SVETRiDM3gcd3NFxmdoz+WzkF8=";
  };

  nativeBuildInputs = [cmake];
--- a/pkgs/development/libraries/functionalplus/default.nix
+++ b/pkgs/development/libraries/functionalplus/default.nix
@ -18,6 +18,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/Dobiasd/FunctionalPlus";
    license = licenses.boost;
    platforms = platforms.all;
-    maintainers = with maintainers; [ candyc1oud ];
+    maintainers = [];
  };
 }
--- a/pkgs/development/libraries/libcef/default.nix
+++ b/pkgs/development/libraries/libcef/default.nix
@ -112,6 +112,6 @@ stdenv.mkDerivation rec {
      binaryNativeCode
    ];
    license = licenses.bsd3;
-    platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
  };
 }
--- a/pkgs/development/libraries/liboqs/default.nix
+++ b/pkgs/development/libraries/liboqs/default.nix
@ -33,6 +33,6 @@ stdenv.mkDerivation rec {
    homepage = "https://openquantumsafe.org";
    license = licenses.mit;
    platforms = platforms.all;
-    maintainers = with maintainers; [ candyc1oud ];
+    maintainers = [];
  };
 }
--- a/pkgs/development/libraries/libsv/default.nix
+++ b/pkgs/development/libraries/libsv/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    description = "Public domain cross-platform semantic versioning in C99";
    homepage = "https://github.com/uael/sv";
    license = licenses.unlicense;
-    maintainers = with maintainers; [ candyc1oud ];
+    maintainers = [];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/ngtcp2/gnutls.nix
+++ b/pkgs/development/libraries/ngtcp2/gnutls.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "ngtcp2";
-  version = "0.13.0";
+  version = "0.13.1";

  src = fetchFromGitHub {
    owner = "ngtcp2";
    repo = "ngtcp2";
    rev = "v${version}";
-    sha256 = "sha256-rKEF5R1GubgFiblmdTqh26PxTRxIqXUJHxj0Qwd3N00=";
+    sha256 = "sha256-bkTbnf7vyTxA623JVGUgrwAuXK7d8kzijOK1F4Sh4yY=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/quantlib/default.nix
+++ b/pkgs/development/libraries/quantlib/default.nix
@ -26,6 +26,6 @@ stdenv.mkDerivation rec {
    homepage = "https://quantlib.org";
    platforms = platforms.unix;
    license = licenses.bsd3;
-    maintainers = with maintainers; [ candyc1oud ];
+    maintainers = [];
  };
 }
--- a/pkgs/development/libraries/restinio/default.nix
+++ b/pkgs/development/libraries/restinio/default.nix
@ -1,19 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:

-let
+stdenvNoCC.mkDerivation rec {
  pname = "restinio";
  version = "0.6.17";
-in
-fetchzip {
-  name = "${pname}-${version}";
-  url = "https://github.com/Stiffstream/restinio/releases/download/v.${version}/${pname}-${version}.tar.bz2";
-  hash = "sha256-8A13r3Qsn5S+kVWLPENoOjqz2tPMxSo6EWBvHG1cTAE=";

-  stripRoot = false;
-  postFetch = ''
+  src = fetchurl {
+    url = "https://github.com/Stiffstream/restinio/releases/download/v.${version}/${pname}-${version}.tar.bz2";
+    hash = "sha256-zqDEaQYZbpfDCyv++/1JV4yfhwqJUB185c05u9N2FCo=";
+  };
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/include
-    mv $out/restinio-*/dev/restinio $out/include
-    rm -r $out/restinio-*
+    mv restinio-*/dev/restinio $out/include
+
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/development/libraries/science/math/coin-utils/default.nix
+++ b/pkgs/development/libraries/science/math/coin-utils/default.nix
@ -0,0 +1,22 @@
+{ lib, stdenv, fetchFromGitHub, pkg-config }:
+
+stdenv.mkDerivation rec {
+  version = "2.11.6";
+  pname = "coinutils";
+
+  src = fetchFromGitHub {
+    owner = "coin-or";
+    repo = "CoinUtils";
+    rev = "releases/${version}";
+    hash = "sha256-avXp7eKSZ/Fe1QmSJiNDMnPQ70LlOHrBeUYb9lhka8c=";
+  };
+
+  doCheck = true;
+
+  meta = with lib; {
+    license = licenses.epl20;
+    homepage = "https://github.com/coin-or/CoinUtils";
+    description = "Collection of classes and helper functions that are generally useful to multiple COIN-OR projects";
+    maintainers = with maintainers; [ tmarkus ];
+  };
+}
--- a/pkgs/development/libraries/science/math/osi/default.nix
+++ b/pkgs/development/libraries/science/math/osi/default.nix
@ -1,19 +1,21 @@
-{ stdenv, lib, fetchurl, gfortran, pkg-config
-, blas, zlib, bzip2
+{ stdenv, lib, fetchFromGitHub, gfortran, pkg-config
+, blas, zlib, bzip2, coin-utils
 , withGurobi ? false, gurobi
 , withCplex ? false, cplex }:

 stdenv.mkDerivation rec {
  pname = "osi";
-  version = "0.108.6";
+  version = "0.108.7";

-  src = fetchurl {
-    url = "https://www.coin-or.org/download/source/Osi/Osi-${version}.tgz";
-    sha256 = "1n2jlpq4aikbp0ncs16f7q1pj7yk6kny1bh4fmjaqnwrjw63zvsp";
+  src = fetchFromGitHub {
+    owner = "coin-or";
+    repo = "Osi";
+    rev = "releases/${version}";
+    hash = "sha256-MTmt/MgsfEAXor2EZXJX05bQg5oOtMaN7oNxGv2PHJg=";
  };

  buildInputs =
-    [ blas zlib bzip2 ]
+    [ blas zlib bzip2 coin-utils ]
    ++ lib.optional withGurobi gurobi
    ++ lib.optional withCplex cplex;
  nativeBuildInputs = [ gfortran pkg-config ];
@ -35,7 +37,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "An abstract base class to a generic linear programming (LP) solver";
    homepage = "https://github.com/coin-or/Osi";
-    license = licenses.epl10;
+    license = licenses.epl20;
    platforms = platforms.unix;
    maintainers = with maintainers; [ abbradar ];
  };
--- a/Show More
+++ b/Show More